PATMRC.cpp@ 61018

Last change on this file since 61018 was 61018, checked in by vboxsync, 9 years ago
PATMRCHandlerInt3PatchTrap: logging non-VINF_SUCCESS statuses, rearranged code for better karma.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 24.1 KB

Line
1	/* $Id: PATMRC.cpp 61018 2016-05-17 22:04:08Z vboxsync $ */
2	/** @file
3	* PATM - Dynamic Guest OS Patching Manager - Raw-mode Context.
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_PATM
23	#include <VBox/vmm/patm.h>
24	#include <VBox/vmm/cpum.h>
25	#include <VBox/vmm/stam.h>
26	#include <VBox/vmm/pgm.h>
27	#include <VBox/vmm/mm.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/iem.h>
30	#include <VBox/vmm/selm.h>
31	#include <VBox/vmm/mm.h>
32	#include "PATMInternal.h"
33	#include "PATMA.h"
34	#include <VBox/vmm/vm.h>
35	#include <VBox/dbg.h>
36	#include <VBox/dis.h>
37	#include <VBox/disopcode.h>
38	#include <VBox/err.h>
39	#include <VBox/log.h>
40	#include <iprt/assert.h>
41	#include <iprt/asm.h>
42	#include <iprt/string.h>
43
44
45	/**
46	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
47	* PATM all access handler callback.}
48	*
49	* @remarks The @a pvUser argument is the base address of the page being
50	* monitored.
51	*/
52	DECLEXPORT(VBOXSTRICTRC) patmRCVirtPagePfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore,
53	RTGCPTR pvFault, RTGCPTR pvRange, uintptr_t offRange, void *pvUser)
54	{
55	NOREF(pVCpu); NOREF(uErrorCode); NOREF(pCtxCore); NOREF(pvFault); NOREF(pvRange); NOREF(offRange);
56
57	Assert(pvUser);
58	Assert(!((uintptr_t)pvUser & PAGE_OFFSET_MASK));
59	Assert(((uintptr_t)pvUser + (pvFault & PAGE_OFFSET_MASK)) == pvRange + offRange);
60
61	pVM->patm.s.pvFaultMonitor = (RTRCPTR)(pvRange + offRange);
62	return VINF_PATM_CHECK_PATCH_PAGE;
63	}
64
65
66	/**
67	* Checks if the write is located on a page with was patched before.
68	* (if so, then we are not allowed to turn on r/w)
69	*
70	* @returns Strict VBox status code.
71	* @retval VINF_SUCCESS if access interpreted (@a pCtxCore != NULL).
72	* @retval VINF_PGM_HANDLER_DO_DEFAULT (@a pCtxCore == NULL).
73	* @retval VINF_EM_RAW_EMULATE_INSTR on needing to go to ring-3 to do this.
74	* @retval VERR_PATCH_NOT_FOUND if no patch was found.
75	*
76	* @param pVM The cross context VM structure.
77	* @param pCtxCore CPU context if \#PF, NULL if other write..
78	* @param GCPtr GC pointer to write address.
79	* @param cbWrite Number of bytes to write.
80	*
81	*/
82	VMMRC_INT_DECL(VBOXSTRICTRC) PATMRCHandleWriteToPatchPage(PVM pVM, PCPUMCTXCORE pCtxCore, RTRCPTR GCPtr, uint32_t cbWrite)
83	{
84	Assert(cbWrite > 0);
85
86	/* Quick boundary check */
87	if ( PAGE_ADDRESS(GCPtr) < PAGE_ADDRESS(pVM->patm.s.pPatchedInstrGCLowest)
88	\|\| PAGE_ADDRESS(GCPtr) > PAGE_ADDRESS(pVM->patm.s.pPatchedInstrGCHighest))
89	return VERR_PATCH_NOT_FOUND;
90
91	STAM_PROFILE_ADV_START(&pVM->patm.s.StatPatchWriteDetect, a);
92
93	/*
94	* Lookup the patch page record for the write.
95	*/
96	RTRCUINTPTR pWritePageStart = (RTRCUINTPTR)GCPtr & PAGE_BASE_GC_MASK;
97	RTRCUINTPTR pWritePageEnd = ((RTRCUINTPTR)GCPtr + cbWrite - 1) & PAGE_BASE_GC_MASK;
98
99	PPATMPATCHPAGE pPatchPage;
100	pPatchPage = (PPATMPATCHPAGE)RTAvloU32Get(&pVM->patm.s.CTXSUFF(PatchLookupTree)->PatchTreeByPage, pWritePageStart);
101	if ( !pPatchPage
102	&& pWritePageStart != pWritePageEnd)
103	pPatchPage = (PPATMPATCHPAGE)RTAvloU32Get(&pVM->patm.s.CTXSUFF(PatchLookupTree)->PatchTreeByPage, pWritePageEnd);
104	if (pPatchPage)
105	{
106	Log(("PATMGCHandleWriteToPatchPage: Found page %RRv for write to %RRv %d bytes (page low:high %RRv:%RRv\n",
107	pPatchPage->Core.Key, GCPtr, cbWrite, pPatchPage->pLowestAddrGC, pPatchPage->pHighestAddrGC));
108	if ( (RTRCUINTPTR)pPatchPage->pLowestAddrGC > (RTRCUINTPTR)GCPtr + cbWrite - 1U
109	\|\| (RTRCUINTPTR)pPatchPage->pHighestAddrGC < (RTRCUINTPTR)GCPtr)
110	{
111	/* This part of the page was not patched; try to emulate the instruction / tell the caller to do so. */
112	if (!pCtxCore)
113	{
114	LogFlow(("PATMHandleWriteToPatchPage: Allow %#x writing %RRv LB %#x\n", pCtxCore->eip, GCPtr, cbWrite));
115	STAM_COUNTER_INC(&pVM->patm.s.StatPatchWriteInterpreted);
116	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
117	return VINF_PGM_HANDLER_DO_DEFAULT;
118	}
119	LogFlow(("PATMHandleWriteToPatchPage: Interpret %#x accessing %RRv\n", pCtxCore->eip, GCPtr));
120	int rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(VMMGetCpu0(pVM), pCtxCore, (RTGCPTR)(RTRCUINTPTR)GCPtr));
121	if (rc == VINF_SUCCESS)
122	{
123	STAM_COUNTER_INC(&pVM->patm.s.StatPatchWriteInterpreted);
124	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
125	return VINF_SUCCESS;
126	}
127	STAM_COUNTER_INC(&pVM->patm.s.StatPatchWriteInterpretedFailed);
128	}
129	R3PTRTYPE(PPATCHINFO) paPatch = (R3PTRTYPE(PPATCHINFO) )MMHyperR3ToRC(pVM, pPatchPage->papPatch);
130
131	/* Increase the invalid write counter for each patch that's registered for that page. */
132	for (uint32_t i=0;i<pPatchPage->cCount;i++)
133	{
134	PPATCHINFO pPatch = (PPATCHINFO)MMHyperR3ToRC(pVM, paPatch[i]);
135
136	pPatch->cInvalidWrites++;
137	}
138
139	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
140	return VINF_EM_RAW_EMULATE_INSTR;
141	}
142
143	STAM_PROFILE_ADV_STOP(&pVM->patm.s.StatPatchWriteDetect, a);
144	return VERR_PATCH_NOT_FOUND;
145	}
146
147
148	/**
149	* Checks if the illegal instruction was caused by a patched instruction
150	*
151	* @returns VBox status
152	*
153	* @param pVM The cross context VM structure.
154	* @param pCtxCore The relevant core context.
155	*/
156	VMMRC_INT_DECL(int) PATMRCHandleIllegalInstrTrap(PVM pVM, PCPUMCTXCORE pCtxCore)
157	{
158	PPATMPATCHREC pRec;
159	PVMCPU pVCpu = VMMGetCpu0(pVM);
160	int rc;
161
162	/* Very important check -> otherwise we have a security leak. */
163	AssertReturn(!pCtxCore->eflags.Bits.u1VM && (pCtxCore->ss.Sel & X86_SEL_RPL) <= (EMIsRawRing1Enabled(pVM) ? 2U : 1U),
164	VERR_ACCESS_DENIED);
165	Assert(PATMIsPatchGCAddr(pVM, pCtxCore->eip));
166
167	/* OP_ILLUD2 in PATM generated code? */
168	if (CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
169	{
170	LogFlow(("PATMRC: Pending action %x at %x\n", CTXSUFF(pVM->patm.s.pGCState)->uPendingAction, pCtxCore->eip));
171
172	/* Private PATM interface (@todo hack due to lack of anything generic). */
173	/* Parameters:
174	* eax = Pending action (currently PATM_ACTION_LOOKUP_ADDRESS)
175	* ecx = PATM_ACTION_MAGIC
176	*/
177	if ( (pCtxCore->eax & CTXSUFF(pVM->patm.s.pGCState)->uPendingAction)
178	&& pCtxCore->ecx == PATM_ACTION_MAGIC
179	)
180	{
181	CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
182
183	switch (pCtxCore->eax)
184	{
185	case PATM_ACTION_LOOKUP_ADDRESS:
186	{
187	/* Parameters:
188	* edx = GC address to find
189	* edi = PATCHJUMPTABLE ptr
190	*/
191	AssertMsg(!pCtxCore->edi \|\| PATMIsPatchGCAddr(pVM, pCtxCore->edi), ("edi = %x\n", pCtxCore->edi));
192
193	Log(("PATMRC: lookup %x jump table=%x\n", pCtxCore->edx, pCtxCore->edi));
194
195	pRec = patmQueryFunctionPatch(pVM, (RTRCPTR)pCtxCore->edx);
196	if (pRec)
197	{
198	if (pRec->patch.uState == PATCH_ENABLED)
199	{
200	RTGCUINTPTR pRelAddr = pRec->patch.pPatchBlockOffset; /* make it relative */
201	rc = patmAddBranchToLookupCache(pVM, (RTRCPTR)pCtxCore->edi, (RTRCPTR)pCtxCore->edx, pRelAddr);
202	if (rc == VINF_SUCCESS)
203	{
204	Log(("Patch block %RRv called as function\n", pRec->patch.pPrivInstrGC));
205	pRec->patch.flags \|= PATMFL_CODE_REFERENCED;
206
207	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
208	pCtxCore->eax = pRelAddr;
209	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionFound);
210	return VINF_SUCCESS;
211	}
212	AssertFailed();
213	}
214	else
215	{
216	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
217	pCtxCore->eax = 0; /* make it fault */
218	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
219	return VINF_SUCCESS;
220	}
221	}
222	else
223	{
224	/* Check first before trying to generate a function/trampoline patch. */
225	if (pVM->patm.s.fOutOfMemory)
226	{
227	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
228	pCtxCore->eax = 0; /* make it fault */
229	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
230	return VINF_SUCCESS;
231	}
232	STAM_COUNTER_INC(&pVM->patm.s.StatFunctionNotFound);
233	return VINF_PATM_DUPLICATE_FUNCTION;
234	}
235	}
236
237	case PATM_ACTION_DISPATCH_PENDING_IRQ:
238	/* Parameters:
239	* edi = GC address to jump to
240	*/
241	Log(("PATMRC: Dispatch pending interrupt; eip=%x->%x\n", pCtxCore->eip, pCtxCore->edi));
242
243	/* Change EIP to the guest address the patch would normally jump to after setting IF. */
244	pCtxCore->eip = pCtxCore->edi;
245
246	Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX\|PATM_RESTORE_ECX\|PATM_RESTORE_EDI));
247	Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
248
249	pCtxCore->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
250	pCtxCore->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
251	pCtxCore->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
252
253	pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
254
255	/* We are no longer executing PATM code; set PIF again. */
256	pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
257
258	STAM_COUNTER_INC(&pVM->patm.s.StatCheckPendingIRQ);
259
260	/* The caller will call trpmGCExitTrap, which will dispatch pending interrupts for us. */
261	return VINF_SUCCESS;
262
263	case PATM_ACTION_PENDING_IRQ_AFTER_IRET:
264	/* Parameters:
265	* edi = GC address to jump to
266	*/
267	Log(("PATMRC: Dispatch pending interrupt (iret); eip=%x->%x\n", pCtxCore->eip, pCtxCore->edi));
268	Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX\|PATM_RESTORE_ECX\|PATM_RESTORE_EDI));
269	Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
270
271	/* Change EIP to the guest address of the iret. */
272	pCtxCore->eip = pCtxCore->edi;
273
274	pCtxCore->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
275	pCtxCore->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
276	pCtxCore->edi = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEDI;
277	pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
278
279	/* We are no longer executing PATM code; set PIF again. */
280	pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
281
282	return VINF_PATM_PENDING_IRQ_AFTER_IRET;
283
284	case PATM_ACTION_DO_V86_IRET:
285	{
286	Log(("PATMRC: Do iret to V86 code; eip=%x\n", pCtxCore->eip));
287	Assert(pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags == (PATM_RESTORE_EAX\|PATM_RESTORE_ECX));
288	Assert(pVM->patm.s.CTXSUFF(pGCState)->fPIF == 0);
289
290	pCtxCore->eax = pVM->patm.s.CTXSUFF(pGCState)->Restore.uEAX;
291	pCtxCore->ecx = pVM->patm.s.CTXSUFF(pGCState)->Restore.uECX;
292	pVM->patm.s.CTXSUFF(pGCState)->Restore.uFlags = 0;
293
294	rc = EMInterpretIretV86ForPatm(pVM, pVCpu, pCtxCore);
295	if (RT_SUCCESS(rc))
296	{
297	STAM_COUNTER_INC(&pVM->patm.s.StatEmulIret);
298
299	/* We are no longer executing PATM code; set PIF again. */
300	pVM->patm.s.CTXSUFF(pGCState)->fPIF = 1;
301	PGMRZDynMapReleaseAutoSet(pVCpu);
302	CPUMGCCallV86Code(pCtxCore);
303	/* does not return */
304	}
305	else
306	STAM_COUNTER_INC(&pVM->patm.s.StatEmulIretFailed);
307	return rc;
308	}
309
310	#ifdef DEBUG
311	case PATM_ACTION_LOG_CLI:
312	Log(("PATMRC: CLI at %x (current IF=%d iopl=%d)\n", pCtxCore->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
313	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
314	return VINF_SUCCESS;
315
316	case PATM_ACTION_LOG_STI:
317	Log(("PATMRC: STI at %x (current IF=%d iopl=%d)\n", pCtxCore->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
318	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
319	return VINF_SUCCESS;
320
321	case PATM_ACTION_LOG_POPF_IF1:
322	Log(("PATMRC: POPF setting IF at %x (current IF=%d iopl=%d)\n", pCtxCore->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
323	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
324	return VINF_SUCCESS;
325
326	case PATM_ACTION_LOG_POPF_IF0:
327	Log(("PATMRC: POPF at %x (current IF=%d iopl=%d)\n", pCtxCore->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
328	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
329	return VINF_SUCCESS;
330
331	case PATM_ACTION_LOG_PUSHF:
332	Log(("PATMRC: PUSHF at %x (current IF=%d iopl=%d)\n", pCtxCore->eip, !!(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags & X86_EFL_IF), X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags) ));
333	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
334	return VINF_SUCCESS;
335
336	case PATM_ACTION_LOG_IF1:
337	Log(("PATMRC: IF=1 escape from %x\n", pCtxCore->eip));
338	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
339	return VINF_SUCCESS;
340
341	case PATM_ACTION_LOG_IRET:
342	{
343	char pIretFrame = (char )pCtxCore->edx;
344	uint32_t eip, selCS, uEFlags;
345
346	rc = MMGCRamRead(pVM, &eip, pIretFrame, 4);
347	rc \|= MMGCRamRead(pVM, &selCS, pIretFrame + 4, 4);
348	rc \|= MMGCRamRead(pVM, &uEFlags, pIretFrame + 8, 4);
349	if (rc == VINF_SUCCESS)
350	{
351	if ( (uEFlags & X86_EFL_VM)
352	\|\| (selCS & X86_SEL_RPL) == 3)
353	{
354	uint32_t selSS, esp;
355
356	rc \|= MMGCRamRead(pVM, &esp, pIretFrame + 12, 4);
357	rc \|= MMGCRamRead(pVM, &selSS, pIretFrame + 16, 4);
358
359	if (uEFlags & X86_EFL_VM)
360	{
361	uint32_t selDS, selES, selFS, selGS;
362	rc = MMGCRamRead(pVM, &selES, pIretFrame + 20, 4);
363	rc \|= MMGCRamRead(pVM, &selDS, pIretFrame + 24, 4);
364	rc \|= MMGCRamRead(pVM, &selFS, pIretFrame + 28, 4);
365	rc \|= MMGCRamRead(pVM, &selGS, pIretFrame + 32, 4);
366	if (rc == VINF_SUCCESS)
367	{
368	Log(("PATMRC: IRET->VM stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
369	Log(("PATMRC: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
370	}
371	}
372	else
373	Log(("PATMRC: IRET stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
374	}
375	else
376	Log(("PATMRC: IRET stack frame: return address %04X:%x eflags=%08x\n", selCS, eip, uEFlags));
377	}
378	Log(("PATMRC: IRET from %x (IF->1) current eflags=%x\n", pCtxCore->eip, pVM->patm.s.CTXSUFF(pGCState)->uVMFlags));
379	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
380	return VINF_SUCCESS;
381	}
382
383	case PATM_ACTION_LOG_GATE_ENTRY:
384	{
385	char pIretFrame = (char )pCtxCore->edx;
386	uint32_t eip, selCS, uEFlags;
387
388	rc = MMGCRamRead(pVM, &eip, pIretFrame, 4);
389	rc \|= MMGCRamRead(pVM, &selCS, pIretFrame + 4, 4);
390	rc \|= MMGCRamRead(pVM, &uEFlags, pIretFrame + 8, 4);
391	if (rc == VINF_SUCCESS)
392	{
393	if ( (uEFlags & X86_EFL_VM)
394	\|\| (selCS & X86_SEL_RPL) == 3)
395	{
396	uint32_t selSS, esp;
397
398	rc \|= MMGCRamRead(pVM, &esp, pIretFrame + 12, 4);
399	rc \|= MMGCRamRead(pVM, &selSS, pIretFrame + 16, 4);
400
401	if (uEFlags & X86_EFL_VM)
402	{
403	uint32_t selDS, selES, selFS, selGS;
404	rc = MMGCRamRead(pVM, &selES, pIretFrame + 20, 4);
405	rc \|= MMGCRamRead(pVM, &selDS, pIretFrame + 24, 4);
406	rc \|= MMGCRamRead(pVM, &selFS, pIretFrame + 28, 4);
407	rc \|= MMGCRamRead(pVM, &selGS, pIretFrame + 32, 4);
408	if (rc == VINF_SUCCESS)
409	{
410	Log(("PATMRC: GATE->VM stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
411	Log(("PATMRC: GATE->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
412	}
413	}
414	else
415	Log(("PATMRC: GATE stack frame: return address %04X:%x eflags=%08x ss:esp=%04X:%x\n", selCS, eip, uEFlags, selSS, esp));
416	}
417	else
418	Log(("PATMRC: GATE stack frame: return address %04X:%x eflags=%08x\n", selCS, eip, uEFlags));
419	}
420	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
421	return VINF_SUCCESS;
422	}
423
424	case PATM_ACTION_LOG_RET:
425	Log(("PATMRC: RET from %x to %x ESP=%x iopl=%d\n", pCtxCore->eip, pCtxCore->edx, pCtxCore->ebx, X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
426	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
427	return VINF_SUCCESS;
428
429	case PATM_ACTION_LOG_CALL:
430	Log(("PATMRC: CALL to %RRv return addr %RRv ESP=%x iopl=%d\n", pVM->patm.s.CTXSUFF(pGCState)->GCCallPatchTargetAddr, pVM->patm.s.CTXSUFF(pGCState)->GCCallReturnAddr, pCtxCore->edx, X86_EFL_GET_IOPL(pVM->patm.s.CTXSUFF(pGCState)->uVMFlags)));
431	pCtxCore->eip += PATM_ILLEGAL_INSTR_SIZE;
432	return VINF_SUCCESS;
433	#endif
434	default:
435	AssertFailed();
436	break;
437	}
438	}
439	else
440	AssertFailed();
441	CTXSUFF(pVM->patm.s.pGCState)->uPendingAction = 0;
442	}
443	AssertMsgFailed(("Unexpected OP_ILLUD2 in patch code at %x (pending action %x)!!!!\n", pCtxCore->eip, CTXSUFF(pVM->patm.s.pGCState)->uPendingAction));
444	return VINF_EM_RAW_EMULATE_INSTR;
445	}
446
447	/**
448	* Checks if the int 3 was caused by a patched instruction
449	*
450	* @returns Strict VBox status, includes all statuses that
451	* EMInterpretInstructionDisasState and
452	* @retval VINF_SUCCESS
453	* @retval VINF_PATM_PATCH_INT3
454	* @retval VINF_EM_RAW_EMULATE_INSTR
455	*
456	* @param pVM The cross context VM structure.
457	* @param pCtxCore The relevant core context.
458	*/
459	VMMRC_INT_DECL(int) PATMRCHandleInt3PatchTrap(PVM pVM, PCPUMCTXCORE pCtxCore)
460	{
461	PPATMPATCHREC pRec;
462
463	AssertReturn(!pCtxCore->eflags.Bits.u1VM
464	&& ( (pCtxCore->ss.Sel & X86_SEL_RPL) == 1
465	\|\| (EMIsRawRing1Enabled(pVM) && (pCtxCore->ss.Sel & X86_SEL_RPL) == 2)), VERR_ACCESS_DENIED);
466
467	/* Int 3 in PATM generated code? (most common case) */
468	if (PATMIsPatchGCAddr(pVM, pCtxCore->eip))
469	{
470	/* Note! Hardcoded assumption about it being a single byte int 3 instruction. */
471	pCtxCore->eip--;
472	return VINF_PATM_PATCH_INT3;
473	}
474
475	/** @todo could use simple caching here to speed things up. */
476	pRec = (PPATMPATCHREC)RTAvloU32Get(&CTXSUFF(pVM->patm.s.PatchLookupTree)->PatchTree, (AVLOU32KEY)(pCtxCore->eip - 1)); /* eip is pointing to the instruction after 'int 3' already */
477	if (pRec && pRec->patch.uState == PATCH_ENABLED)
478	{
479	if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT_BLOCK)
480	{
481	Assert(pRec->patch.opcode == OP_CLI);
482	/* This is a special cli block that was turned into an int 3 patch. We jump to the generated code manually. */
483	pCtxCore->eip = (uint32_t)PATCHCODE_PTR_GC(&pRec->patch);
484	STAM_COUNTER_INC(&pVM->patm.s.StatInt3BlockRun);
485	return VINF_SUCCESS;
486	}
487	if (pRec->patch.flags & PATMFL_INT3_REPLACEMENT)
488	{
489	/* eip is pointing to the instruction after 'int 3' already */
490	pCtxCore->eip = pCtxCore->eip - 1;
491
492	PATM_STAT_RUN_INC(&pRec->patch);
493
494	Log(("PATMHandleInt3PatchTrap found int3 for %s at %x\n", patmGetInstructionString(pRec->patch.opcode, 0), pCtxCore->eip));
495
496	switch(pRec->patch.opcode)
497	{
498	case OP_CPUID:
499	case OP_IRET:
500	#ifdef VBOX_WITH_RAW_RING1
501	case OP_SMSW:
502	case OP_MOV: /* mov xx, CS */
503	#endif
504	break;
505
506	case OP_STR:
507	case OP_SGDT:
508	case OP_SLDT:
509	case OP_SIDT:
510	case OP_LSL:
511	case OP_LAR:
512	#ifndef VBOX_WITH_RAW_RING1
513	case OP_SMSW:
514	#endif
515	case OP_VERW:
516	case OP_VERR:
517	default:
518	PATM_STAT_FAULT_INC(&pRec->patch);
519	pRec->patch.cTraps++;
520	return VINF_EM_RAW_EMULATE_INSTR;
521	}
522
523	PVMCPU pVCpu = VMMGetCpu0(pVM);
524	DISCPUMODE enmCpuMode = CPUMGetGuestDisMode(pVCpu);
525	if (enmCpuMode != DISCPUMODE_32BIT)
526	{
527	AssertFailed();
528	return VINF_EM_RAW_EMULATE_INSTR;
529	}
530
531	VBOXSTRICTRC rcStrict;
532	rcStrict = IEMExecOneBypassWithPrefetchedByPC(pVCpu, pCtxCore, pCtxCore->rip,
533	pRec->patch.aPrivInstr, pRec->patch.cbPrivInstr);
534	if (RT_SUCCESS(rcStrict))
535	{
536	if (rcStrict != VINF_SUCCESS)
537	Log(("PATMRCHandleInt3PatchTrap: returns %Rrc\n", VBOXSTRICTRC_TODO(rcStrict)));
538	return VBOXSTRICTRC_TODO(rcStrict);
539	}
540
541	Log(("IEMExecOneBypassWithPrefetchedByPC failed with %Rrc\n", VBOXSTRICTRC_TODO(rcStrict)));
542	PATM_STAT_FAULT_INC(&pRec->patch);
543	pRec->patch.cTraps++;
544	return VINF_EM_RAW_EMULATE_INSTR;
545	}
546	}
547	return VERR_PATCH_NOT_FOUND;
548	}
549

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/PATMRC.cpp@ 61018

Download in other formats: