VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMRC/PATMRC.cpp@ 40450

Last change on this file since 40450 was 40450, checked in by vboxsync, 13 years ago

EM: Refactoring (dropping pVM argument).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 23.0 KB
Line 
1/* $Id: PATMRC.cpp 40450 2012-03-13 15:56:22Z vboxsync $ */
2/** @file
3 * PATM - Dynamic Guest OS Patching Manager - Guest Context
4 */
5
6/*
7 * Copyright (C) 2006-2007 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_PATM
23#include <VBox/vmm/cpum.h>
24#include <VBox/vmm/stam.h>
25#include <VBox/vmm/patm.h>
26#include <VBox/vmm/pgm.h>
27#include <VBox/vmm/mm.h>
28#include <VBox/sup.h>
29#include <VBox/vmm/mm.h>
30#include <VBox/param.h>
31#include <iprt/avl.h>
32#include "PATMInternal.h"
33#include "PATMA.h"
34#include <VBox/vmm/vm.h>
35#include <VBox/dbg.h>
36#include <VBox/dis.h>
37#include <VBox/disopcode.h>
38#include <VBox/vmm/em.h>
39#include <VBox/err.h>
40#include <VBox/vmm/selm.h>
41#include <VBox/log.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/string.h>
45
46
47/**
48 * \#PF Virtual Handler callback for Guest access a page monitored by PATM
49 *
50 * @returns VBox status code (appropriate for trap handling and GC return).
51 * @param pVM VM Handle.
52 * @param uErrorCode CPU Error code.
53 * @param pRegFrame Trap register frame.
54 * @param pvFault The fault address (cr2).
55 * @param pvRange The base address of the handled virtual range.
56 * @param offRange The offset of the access into this range.
57 * (If it's a EIP range this is the EIP, if not it's pvFault.)
58 */
59VMMRCDECL(int) PATMGCMonitorPage(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPTR pvRange, uintptr_t offRange)
60{
61 NOREF(uErrorCode); NOREF(pRegFrame); NOREF(pvFault); NOREF(pvRange); NOREF(offRange);
62 pVM->patm.s.pvFaultMonitor = (RTRCPTR)(RTRCUINTPTR)pvFault;
63 return VINF_PATM_CHECK_PATCH_PAGE;
64}
65
66
67/**
68 * Checks if the write is located on a page with was patched before.
69 * (if so, then we are not allowed to turn on r/w)
70 *
71 * @returns VBox status
72 * @param pVM The VM to operate on.
73 * @param pRegFrame CPU context
74 * @param GCPtr GC pointer to write address
75 * @param cbWrite Nr of bytes to write
76 *
77 */
78VMMRCDECL(int) PATMGCHandleWriteToPatchPage(PVM pVM, PCPUMCTXCORE pRegFrame, RTRCPTR GCPtr, uint32_t cbWrite)
79{
80 RTGCUINTPTR pWritePageStart, pWritePageEnd;
81 PPATMPATCHPAGE pPatchPage;
82
83 /* Quick boundary check */
84 if ( PAGE_ADDRESS(GCPtr) < PAGE_ADDRESS(pVM->patm.s.pPatchedInstrGCLowest)
85 || PAGE_ADDRESS(GCPtr) > PAGE_ADDRESS(pVM->patm.s.pPatchedInstrGCHighest)
86 )
87 return VERR_PATCH_NOT_FOUND;
88
89 STAM_PROFILE_ADV_START(&pVM->patm.s.StatPatchWriteDetect, a);
90
91 pWritePageStart = (RTRCUINTPTR)GCPtr & PAGE_BASE_GC_MASK;
92 pWritePageEnd = ((RTRCUINTPTR)GCPtr + cbWrite - 1) & PAGE_BASE_GC_MASK;
93
94 pPatchPage = (PPATMPATCHPAGE)RTAvloU32Get(CTXSUFF(&pVM->patm.s.PatchLookupTree)->PatchTreeByPage, (AVLOU32KEY)pWritePageStart);
95 if ( !pPatchPage
96 && pWritePageStart != pWritePageEnd
97 )
98 {
99 pPatchPage = (PPATMPATCHPAGE)RTAvloU32Get(CTXSUFF(&pVM->patm.s.PatchLookupTree)->PatchTreeByPage, (AVLOU32KEY)pWritePageEnd);
100 }
101
102#ifdef LOG_ENABLED
103 if (pPatchPage)
104 Log(("PATMGCHandleWriteToPatchPage: Found page %RRv for write to %RRv %d bytes (page low:high %RRv:%RRv\n", pPatchPage->Core.Key, GCPtr, cbWrite, pPatchPage->pLowestAddrGC, pPatchPage->pHighestAddrGC));
105#endif
106
107 if (pPatchPage)
108 {
109 if ( pPatchPage->pLowestAddrGC > (RTRCPTR)((RTRCUINTPTR)GCPtr + cbWrite - 1)
110 || pPatchPage->pHighestAddrGC < (RTRCPTR)GCPtr)
111 {
112 /* This part of the page was not patched; try to emulate the instruction. */
113 LogFlow(("PATMHandleWriteToPatchPage: Interpret %x accessing %RRv\n", pRegFrame->eip, GCPtr));
114 int rc = EMInterpretInstruction(VMMGetCpu0(pVM), pRegFrame, (RTGCPTR)(RTRCUINTPTR)GCPtr);
115 if (rc == VINF_SUCCESS)
116 {
117 STAM_COUNTER_INC(&pVM->patm.s.StatPatchWriteInterpreted);
118 STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
119 return VINF_SUCCESS;
120 }
121 STAM_COUNTER_INC(&pVM->patm.s.StatPatchWriteInterpretedFailed);
122 }
123 R3PTRTYPE(PPATCHINFO) *paPatch = (R3PTRTYPE(PPATCHINFO) *)MMHyperR3ToRC(pVM, pPatchPage->aPatch);
124
125 /* Increase the invalid write counter for each patch that's registered for that page. */
126 for (uint32_t i=0;i<pPatchPage->cCount;i++)
127 {
128 PPATCHINFO pPatch = (PPATCHINFO)MMHyperR3ToRC(pVM, paPatch[i]);
129
130 pPatch->cInvalidWrites++;
131 }
132
133 STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
134 return VINF_EM_RAW_EMULATE_INSTR;
135 }
136
137 STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
138 return VERR_PATCH_NOT_FOUND;
139}
140
141
142/**
143 * Checks if the illegal instruction was caused by a patched instruction
144 *
145 * @returns VBox status
146 *
147 * @param pVM The VM handle.
148 * @param pCtxCore The relevant core context.
149 */
150VMMDECL(int) PATMGCHandleIllegalInstrTrap(PVM pVM, PCPUMCTXCORE pRegFrame)
151{
152 PPATMPATCHREC pRec;
153 int rc;
154
155 /* Very important check -> otherwise we have a security leak. */
156 AssertReturn(!pRegFrame->eflags.Bits.u1VM && (pRegFrame->ss & X86_SEL_RPL) == 1, VERR_ACCESS_DENIED);
157 Assert(PATMIsPatchGCAddr(pVM, pRegFrame->eip));
158
159 /* OP_ILLUD2 in PATM generated code? */
160 if (CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
161 {
162 LogFlow(("PATMGC: Pending action %x at %x\n", CTXSUFF(pVM->patm.s.pGCState)->uPendingAction, pRegFrame->eip));
163
164 /* Private PATM interface (@todo hack due to lack of anything generic). */
165 /* Parameters:
166 * eax = Pending action (currently PATM_ACTION_LOOKUP_ADDRESS)
167 * ecx = PATM_ACTION_MAGIC
168 */
169 if ( (pRegFrame->eax & CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
170 && pRegFrame->ecx == PATM_ACTION_MAGIC
171 )
172 {
173 CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
174
175 switch (pRegFrame->eax)
176 {
177 case PATM_ACTION_LOOKUP_ADDRESS:
178 {
179 /* Parameters:
180 * edx = GC address to find
181 * edi = PATCHJUMPTABLE ptr
182 */
183 AssertMsg(!pRegFrame->edi || PATMIsPatchGCAddr(pVM, pRegFrame->edi), ("edx = %x\n", pRegFrame->edi));
184
185 Log(("PATMGC: lookup %x jump table=%x\n", pRegFrame->edx, pRegFrame->edi));
186
187 pRec = PATMQueryFunctionPatch(pVM, (RTRCPTR)(pRegFrame->edx));
188 if (pRec)
189 {
190 if (pRec->patch.uState == PATCH_ENABLED)
191 {
192 RTGCUINTPTR pRelAddr = pRec->patch.pPatchBlockOffset; /* make it relative */
193 rc = PATMAddBranchToLookupCache(pVM, (RTRCPTR)pRegFrame->edi, (RTRCPTR)pRegFrame->edx, pRelAddr);
194 if (rc == VINF_SUCCESS)
195 {
196 Log(("Patch block %RRv called as function\n", pRec->patch.pPrivInstrGC));
197 pRec->patch.flags |= PATMFL_CODE_REFERENCED;
198
199 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
200 pRegFrame->eax = pRelAddr;
201 STAM_COUNTER_INC(&pVM->patm.s.StatFunctionFound);
202 return VINF_SUCCESS;
203 }
204 AssertFailed();
205 }
206 else
207 {
208 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
209 pRegFrame->eax = 0; /* make it fault */
210 STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
211 return VINF_SUCCESS;
212 }
213 }
214 else
215 {
216 /* Check first before trying to generate a function/trampoline patch. */
217 if (pVM->patm.s.fOutOfMemory)
218 {
219 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
220 pRegFrame->eax = 0; /* make it fault */
221 STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
222 return VINF_SUCCESS;
223 }
224 STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
225 return VINF_PATM_DUPLICATE_FUNCTION;
226 }
227 }
228
229 case PATM_ACTION_DISPATCH_PENDING_IRQ:
230 /* Parameters:
231 * edi = GC address to jump to
232 */
233 Log(("PATMGC: Dispatch pending interrupt; eip=%x->%x\n", pRegFrame->eip, pRegFrame->edi));
234
235 /* Change EIP to the guest address the patch would normally jump to after setting IF. */
236 pRegFrame->eip = pRegFrame->edi;
237
238 Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX|PATM_RESTORE_ECX|PATM_RESTORE_EDI));
239 Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
240
241 pRegFrame->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
242 pRegFrame->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
243 pRegFrame->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
244
245 pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
246
247 /* We are no longer executing PATM code; set PIF again. */
248 pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
249
250 STAM_COUNTER_INC(&pVM->patm.s.StatCheckPendingIRQ);
251
252 /* The caller will call trpmGCExitTrap, which will dispatch pending interrupts for us. */
253 return VINF_SUCCESS;
254
255 case PATM_ACTION_PENDING_IRQ_AFTER_IRET:
256 /* Parameters:
257 * edi = GC address to jump to
258 */
259 Log(("PATMGC: Dispatch pending interrupt (iret); eip=%x->%x\n", pRegFrame->eip, pRegFrame->edi));
260 Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX|PATM_RESTORE_ECX|PATM_RESTORE_EDI));
261 Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
262
263 /* Change EIP to the guest address of the iret. */
264 pRegFrame->eip = pRegFrame->edi;
265
266 pRegFrame->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
267 pRegFrame->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
268 pRegFrame->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
269 pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
270
271 /* We are no longer executing PATM code; set PIF again. */
272 pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
273
274 return VINF_PATM_PENDING_IRQ_AFTER_IRET;
275
276 case PATM_ACTION_DO_V86_IRET:
277 {
278 Log(("PATMGC: Do iret to V86 code; eip=%x\n", pRegFrame->eip));
279 Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX|PATM_RESTORE_ECX));
280 Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
281
282 pRegFrame->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
283 pRegFrame->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
284 pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
285
286 rc = EMInterpretIret(pVM, VMMGetCpu0(pVM), pRegFrame);
287 if (RT_SUCCESS(rc))
288 {
289 STAM_COUNTER_INC(&pVM->patm.s.StatEmulIret);
290
291 /* We are no longer executing PATM code; set PIF again. */
292 pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
293 PGMRZDynMapReleaseAutoSet(VMMGetCpu0(pVM));
294 CPUMGCCallV86Code(pRegFrame);
295 /* does not return */
296 }
297 else
298 STAM_COUNTER_INC(&pVM->patm.s.StatEmulIretFailed);
299 return rc;
300 }
301
302#ifdef DEBUG
303 case PATM_ACTION_LOG_CLI:
304 Log(("PATMGC: CLI at %x (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
305 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
306 return VINF_SUCCESS;
307
308 case PATM_ACTION_LOG_STI:
309 Log(("PATMGC: STI at %x (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
310 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
311 return VINF_SUCCESS;
312
313 case PATM_ACTION_LOG_POPF_IF1:
314 Log(("PATMGC: POPF setting IF at %x (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
315 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
316 return VINF_SUCCESS;
317
318 case PATM_ACTION_LOG_POPF_IF0:
319 Log(("PATMGC: POPF at %x (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
320 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
321 return VINF_SUCCESS;
322
323 case PATM_ACTION_LOG_PUSHF:
324 Log(("PATMGC: PUSHF at %x (current IF=%d iopl=%d)\n", pRegFrame->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
325 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
326 return VINF_SUCCESS;
327
328 case PATM_ACTION_LOG_IF1:
329 Log(("PATMGC: IF=1 escape from %x\n", pRegFrame->eip));
330 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
331 return VINF_SUCCESS;
332
333 case PATM_ACTION_LOG_IRET:
334 {
335 char *pIretFrame = (char *)pRegFrame->edx;
336 uint32_t eip, selCS, uEFlags;
337
338 rc = MMGCRamRead(pVM, &eip, pIretFrame, 4);
339 rc |= MMGCRamRead(pVM, &selCS, pIretFrame + 4, 4);
340 rc |= MMGCRamRead(pVM, &uEFlags, pIretFrame + 8, 4);
341 if (rc == VINF_SUCCESS)
342 {
343 if ( (uEFlags & X86_EFL_VM)
344 || (selCS & X86_SEL_RPL) == 3)
345 {
346 uint32_t selSS, esp;
347
348 rc |= MMGCRamRead(pVM, &esp, pIretFrame + 12, 4);
349 rc |= MMGCRamRead(pVM, &selSS, pIretFrame + 16, 4);
350
351 if (uEFlags & X86_EFL_VM)
352 {
353 uint32_t selDS, selES, selFS, selGS;
354 rc = MMGCRamRead(pVM, &selES, pIretFrame + 20, 4);
355 rc |= MMGCRamRead(pVM, &selDS, pIretFrame + 24, 4);
356 rc |= MMGCRamRead(pVM, &selFS, pIretFrame + 28, 4);
357 rc |= MMGCRamRead(pVM, &selGS, pIretFrame + 32, 4);
358 if (rc == VINF_SUCCESS)
359 {
360 Log(("PATMGC: IRET->VM stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
361 Log(("PATMGC: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
362 }
363 }
364 else
365 Log(("PATMGC: IRET stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
366 }
367 else
368 Log(("PATMGC: IRET stack frame: return address %04X:%x eflags=%08x\n", selCS, eip, uEFlags));
369 }
370 Log(("PATMGC: IRET from %x (IF->1) current eflags=%x\n", pRegFrame->eip, pVM->patm.s.CTXSUFF(pGCState)->uVMFlags));
371 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
372 return VINF_SUCCESS;
373 }
374
375 case PATM_ACTION_LOG_GATE_ENTRY:
376 {
377 char *pIretFrame = (char *)pRegFrame->edx;
378 uint32_t eip, selCS, uEFlags;
379
380 rc = MMGCRamRead(pVM, &eip, pIretFrame, 4);
381 rc |= MMGCRamRead(pVM, &selCS, pIretFrame + 4, 4);
382 rc |= MMGCRamRead(pVM, &uEFlags, pIretFrame + 8, 4);
383 if (rc == VINF_SUCCESS)
384 {
385 if ( (uEFlags & X86_EFL_VM)
386 || (selCS & X86_SEL_RPL) == 3)
387 {
388 uint32_t selSS, esp;
389
390 rc |= MMGCRamRead(pVM, &esp, pIretFrame + 12, 4);
391 rc |= MMGCRamRead(pVM, &selSS, pIretFrame + 16, 4);
392
393 if (uEFlags & X86_EFL_VM)
394 {
395 uint32_t selDS, selES, selFS, selGS;
396 rc = MMGCRamRead(pVM, &selES, pIretFrame + 20, 4);
397 rc |= MMGCRamRead(pVM, &selDS, pIretFrame + 24, 4);
398 rc |= MMGCRamRead(pVM, &selFS, pIretFrame + 28, 4);
399 rc |= MMGCRamRead(pVM, &selGS, pIretFrame + 32, 4);
400 if (rc == VINF_SUCCESS)
401 {
402 Log(("PATMGC: GATE->VM stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
403 Log(("PATMGC: GATE->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
404 }
405 }
406 else
407 Log(("PATMGC: GATE stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
408 }
409 else
410 Log(("PATMGC: GATE stack frame: return address %04X:%x eflags=%08x\n", selCS, eip, uEFlags));
411 }
412 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
413 return VINF_SUCCESS;
414 }
415
416 case PATM_ACTION_LOG_RET:
417 Log(("PATMGC: RET from %x to %x ESP=%x iopl=%d\n", pRegFrame->eip, pRegFrame->edx, pRegFrame->ebx, X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
418 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
419 return VINF_SUCCESS;
420
421 case PATM_ACTION_LOG_CALL:
422 Log(("PATMGC: CALL to %RRv return addr %RRv ESP=%x iopl=%d\n", pVM->patm.s.CTXSUFF(pGCState)->GCCallPatchTargetAddr, pVM->patm.s.CTXSUFF(pGCState)->GCCallReturnAddr, pRegFrame->edx, X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
423 pRegFrame->eip += PATM_ILLEGAL_INSTR_SIZE;
424 return VINF_SUCCESS;
425#endif
426 default:
427 AssertFailed();
428 break;
429 }
430 }
431 else
432 AssertFailed();
433 CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
434 }
435 AssertMsgFailed(("Unexpected OP_ILLUD2 in patch code at %x (pending action %x)!!!!\n", pRegFrame->eip, CTXSUFF(pVM->patm.s.pGCState)->uPendingAction));
436 return VINF_EM_RAW_EMULATE_INSTR;
437}
438
439/**
440 * Checks if the int 3 was caused by a patched instruction
441 *
442 * @returns VBox status
443 *
444 * @param pVM The VM handle.
445 * @param pCtxCore The relevant core context.
446 */
447VMMDECL(int) PATMHandleInt3PatchTrap(PVM pVM, PCPUMCTXCORE pRegFrame)
448{
449 PPATMPATCHREC pRec;
450 int rc;
451
452 AssertReturn(!pRegFrame->eflags.Bits.u1VM && (pRegFrame->ss & X86_SEL_RPL) == 1, VERR_ACCESS_DENIED);
453
454 /* Int 3 in PATM generated code? (most common case) */
455 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
456 {
457 /* @note hardcoded assumption about it being a single byte int 3 instruction. */
458 pRegFrame->eip--;
459 return VINF_PATM_PATCH_INT3;
460 }
461
462 /** @todo could use simple caching here to speed things up. */
463 pRec = (PPATMPATCHREC)RTAvloU32Get(&CTXSUFF(pVM->patm.s.PatchLookupTree)->PatchTree, (AVLOU32KEY)(pRegFrame->eip - 1)); /* eip is pointing to the instruction *after* 'int 3' already */
464 if (pRec && pRec->patch.uState == PATCH_ENABLED)
465 {
466 if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT_BLOCK)
467 {
468 Assert(pRec->patch.opcode == OP_CLI);
469 /* This is a special cli block that was turned into an int 3 patch. We jump to the generated code manually. */
470 pRegFrame->eip = (uint32_t)PATCHCODE_PTR_GC(&pRec->patch);
471 STAM_COUNTER_INC(&pVM->patm.s.StatInt3BlockRun);
472 return VINF_SUCCESS;
473 }
474 if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT)
475 {
476 uint32_t cbOp;
477 DISCPUSTATE cpu;
478
479 /* eip is pointing to the instruction *after* 'int 3' already */
480 pRegFrame->eip = pRegFrame->eip - 1;
481
482 PATM_STAT_RUN_INC(&pRec->patch);
483
484 Log(("PATMHandleInt3PatchTrap found int3 for %s at %x\n", patmGetInstructionString(pRec->patch.opcode, 0), pRegFrame->eip));
485
486 switch(pRec->patch.opcode)
487 {
488 case OP_CPUID:
489 case OP_IRET:
490 break;
491
492 case OP_STR:
493 case OP_SGDT:
494 case OP_SLDT:
495 case OP_SIDT:
496 case OP_LSL:
497 case OP_LAR:
498 case OP_SMSW:
499 case OP_VERW:
500 case OP_VERR:
501 default:
502 PATM_STAT_FAULT_INC(&pRec->patch);
503 pRec->patch.cTraps++;
504 return VINF_EM_RAW_EMULATE_INSTR;
505 }
506
507 cpu.mode = SELMGetCpuModeFromSelector(VMMGetCpu0(pVM), pRegFrame->eflags, pRegFrame->cs, 0);
508 if (cpu.mode != CPUMODE_32BIT)
509 {
510 AssertFailed();
511 return VINF_EM_RAW_EMULATE_INSTR;
512 }
513 rc = DISCoreOne(&cpu, (uintptr_t)&pRec->patch.aPrivInstr[0], &cbOp);
514 if (RT_FAILURE(rc))
515 {
516 Log(("DISCoreOne failed with %Rrc\n", rc));
517 PATM_STAT_FAULT_INC(&pRec->patch);
518 pRec->patch.cTraps++;
519 return VINF_EM_RAW_EMULATE_INSTR;
520 }
521
522 rc = EMInterpretInstructionCpuUpdtPC(VMMGetCpu0(pVM), &cpu, pRegFrame, 0 /* not relevant here */,
523 EMCODETYPE_SUPERVISOR);
524 if (rc != VINF_SUCCESS)
525 {
526 Log(("EMInterpretInstructionCPU failed with %Rrc\n", rc));
527 PATM_STAT_FAULT_INC(&pRec->patch);
528 pRec->patch.cTraps++;
529 return VINF_EM_RAW_EMULATE_INSTR;
530 }
531 return VINF_SUCCESS;
532 }
533 }
534 return VERR_PATCH_NOT_FOUND;
535}
536
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette