Changeset 4057 in vbox for trunk/src/VBox/VMM/PATM

Timestamp:

Aug 7, 2007 10:05:48 AM (17 years ago)

Author:

vboxsync

Message:

Don't allow popf instructions to change the current IOPL in simple (cli) patches. (see defect 2042)

Location:

trunk/src/VBox/VMM/PATM

Files:

• PATM.cpp (modified) (1 diff)
• PATMA.asm (modified) (3 diffs)
• PATMPatch.cpp (modified) (1 diff)

trunk/src/VBox/VMM/PATM/PATM.cpp

@@ -1757 +1757 @@
 
         /* Not an exit point for IDT handler or function replacement patches */
+        /* Note: keep IOPL in mind when changing any of this!! (see comments in PATMA.asm, PATMPopf32Replacement) */
         if (pPatch->flags & (PATMFL_IDTHANDLER|PATMFL_DUPLICATE_FUNCTION))
             fGenerateJmpBack = false;

trunk/src/VBox/VMM/PATM/PATMA.asm

@@ -737 +737 @@
 
 PATMPopf32_Ok:
-    pop     dword [ss:PATM_VMFLAGS]
-    push    dword [ss:PATM_VMFLAGS]
+    ; Note: we don't allow popf instructions to change the current IOPL; we simply ignore such changes (!!!)
+    ; In this particular patch it's rather unlikely the pushf was included, so we have no way to check if the flags on the stack are correctly synched
+    ; PATMPopf32Replacement_NoExit is different, because it's only used in IDT and function patches
 
     ; if interrupts are pending, then we must go back to the host context to handle them!
@@ -776 +777 @@
     DD      PATMPopf32End - PATMPopf32Start
 %ifdef PATM_LOG_PATCHINSTR
-    DD      13
+    DD      11
 %else
-    DD      12
+    DD      10
 %endif
     DD      PATM_INTERRUPTFLAG
@@ -787 +788 @@
 %endif
     DD      PATM_INTERRUPTFLAG
-    DD      0
-    DD      PATM_VMFLAGS
-    DD      0
-    DD      PATM_VMFLAGS
     DD      0
     DD      PATM_VM_FORCEDACTIONS

trunk/src/VBox/VMM/PATM/PATMPatch.cpp

@@ -475 +475 @@
     Log(("patmPatchGenPopf at %VGv\n", pReturnAddrGC));
 
-    /** @todo check if we mess up IOPL here (theoretical possibility afaik) */
+    /* Note: keep IOPL in mind when changing any of this!! (see comments in PATMA.asm, PATMPopf32Replacement) */
     if (fSizeOverride == true)
     {