PATM.cpp revision 677833bc953b6cb418c701facbdcf4aa18d6c44e
/** @file
*
* PATM - Dynamic Guest OS Patching Manager
*
* NOTE: Never ever reuse patch memory!!
*/
/*
* Copyright (C) 2006 InnoTek Systemberatung GmbH
*
* This file is part of VirtualBox Open Source Edition (OSE), as
* available from http://www.virtualbox.org. This file is free software;
* General Public License as published by the Free Software Foundation,
* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
* distribution. VirtualBox OSE is distributed in the hope that it will
* be useful, but WITHOUT ANY WARRANTY of any kind.
*
* If you received this file as part of a commercial VirtualBox
* distribution, then only the terms of your commercial VirtualBox
* license agreement apply instead of the previous paragraph.
*/
/*******************************************************************************
* Header Files *
*******************************************************************************/
#define LOG_GROUP LOG_GROUP_PATM
#include "PATMInternal.h"
#include "PATMPatch.h"
#include <VBox/disopcode.h>
#include "PATMA.h"
//#define PATM_REMOVE_PATCH_ON_TOO_MANY_TRAPS
//#define PATM_DISABLE_ALL
/*******************************************************************************
* Internal Functions *
*******************************************************************************/
static int patmDisableUnusablePatch(PVM pVM, RTGCPTR pInstrGC, RTGCPTR pConflictAddr, PPATCHINFO pPatch);
#ifdef DEBUG // keep gcc quiet
#endif
#ifdef VBOX_WITH_STATISTICS
#endif
#define patmPatchHCPtr2PatchGCPtr(pVM, pHC) (pVM->patm.s.pPatchMemGC + (pHC - pVM->patm.s.pPatchMemHC))
#define patmPatchGCPtr2PatchHCPtr(pVM, pGC) (pVM->patm.s.pPatchMemHC + (pGC - pVM->patm.s.pPatchMemGC))
static DECLCALLBACK(int) patmVirtPageHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
#ifdef VBOX_WITH_DEBUGGER
static DECLCALLBACK(int) patmr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
static DECLCALLBACK(int) patmr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult);
/** Command descriptors. */
{
/* pszCmd, cArgsMin, cArgsMax, paArgDesc, cArgDescs, pResultDesc, fFlags, pfnHandler pszSyntax, ....pszDescription */
};
#endif
/**
* Initializes the PATM.
*
* @returns VBox status code.
* @param pVM The VM to operate on.
*/
{
int rc;
AssertReleaseMsg(PATMInterruptFlag == (VM_FF_INTERRUPT_APIC | VM_FF_INTERRUPT_PIC | VM_FF_TIMER | VM_FF_REQUEST), ("Interrupt flags out of sync!!\n"));
/* Allocate patch memory and GC patch state memory. */
/* Add another page in case the generated code is much larger than expected. */
/** @todo bad safety precaution */
rc = MMR3HyperAllocOnceNoRel(pVM, PATCH_MEMORY_SIZE + PAGE_SIZE + PATM_STACK_TOTAL_SIZE + PAGE_SIZE + PATM_STAT_MEMSIZE, PAGE_SIZE, MM_TAG_PATM, (void **)&pVM->patm.s.pPatchMemHC);
if (VBOX_FAILURE(rc))
{
return rc;
}
/* PATM stack page for call instruction execution. (2 parts: one for our private stack and one to store the original return address */
/*
*
* Note1: This is non-critical data; if trashed by the guest, then it will only cause problems for itself
* Note2: This doesn't really belong here, but we need access to it for relocation purposes
*
*/
/* Hypervisor memory for patch statistics */
/* Memory for patch lookup trees. */
rc = MMHyperAlloc(pVM, sizeof(*pVM->patm.s.PatchLookupTreeHC), 0, MM_TAG_PATM, (void **)&pVM->patm.s.PatchLookupTreeHC);
if (VBOX_FAILURE(rc))
return rc;
/*
* Register save and load state notificators.
*/
rc = SSMR3RegisterInternal(pVM, "PATM", 0, PATM_SSM_VERSION, sizeof(pVM->patm.s) + PATCH_MEMORY_SIZE + PAGE_SIZE + PATM_STACK_TOTAL_SIZE + PAGE_SIZE,
if (VBOX_FAILURE(rc))
{
return rc;
}
#ifdef VBOX_WITH_DEBUGGER
/*
* Debugger commands.
*/
static bool fRegisteredCmds = false;
if (!fRegisteredCmds)
{
if (VBOX_SUCCESS(rc))
fRegisteredCmds = true;
}
#endif
#ifdef VBOX_WITH_STATISTICS
STAM_REG(pVM, &pVM->patm.s.StatNrOpcodeRead, STAMTYPE_COUNTER, "/PATM/OpcodeBytesRead", STAMUNIT_OCCURENCES, "The number of opcode bytes read by the recompiler.");
STAM_REG(pVM, &pVM->patm.s.StatPATMMemoryUsed,STAMTYPE_COUNTER, "/PATM/MemoryUsed", STAMUNIT_OCCURENCES, "The amount of hypervisor heap used for patches.");
STAM_REG(pVM, &pVM->patm.s.StatDisabled, STAMTYPE_COUNTER, "/PATM/Patch/Disabled", STAMUNIT_OCCURENCES, "Number of times patches were disabled.");
STAM_REG(pVM, &pVM->patm.s.StatEnabled, STAMTYPE_COUNTER, "/PATM/Patch/Enabled", STAMUNIT_OCCURENCES, "Number of times patches were enabled.");
STAM_REG(pVM, &pVM->patm.s.StatDirty, STAMTYPE_COUNTER, "/PATM/Patch/Dirty", STAMUNIT_OCCURENCES, "Number of times patches were marked dirty.");
STAM_REG(pVM, &pVM->patm.s.StatUnusable, STAMTYPE_COUNTER, "/PATM/Patch/Unusable", STAMUNIT_OCCURENCES, "Number of unusable patches (conflicts).");
STAM_REG(pVM, &pVM->patm.s.StatInstalled, STAMTYPE_COUNTER, "/PATM/Patch/Installed", STAMUNIT_OCCURENCES, "Number of installed patches.");
STAM_REG(pVM, &pVM->patm.s.StatInt3Callable, STAMTYPE_COUNTER, "/PATM/Patch/Int3Callable", STAMUNIT_OCCURENCES, "Number of cli patches turned into int3 patches.");
STAM_REG(pVM, &pVM->patm.s.StatInt3BlockRun, STAMTYPE_COUNTER, "/PATM/Patch/Run/Int3", STAMUNIT_OCCURENCES, "Number of times an int3 block patch was executed.");
STAMR3RegisterF(pVM, &pVM->patm.s.pGCStateHC->uPatchCalls, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Patch/Run/Normal");
STAM_REG(pVM, &pVM->patm.s.StatInstalledFunctionPatches, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Function", STAMUNIT_OCCURENCES, "Number of installed function duplication patches.");
STAM_REG(pVM, &pVM->patm.s.StatInstalledTrampoline, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Trampoline", STAMUNIT_OCCURENCES, "Number of installed trampoline patches.");
STAM_REG(pVM, &pVM->patm.s.StatInstalledJump, STAMTYPE_COUNTER, "/PATM/Patch/Installed/Jump", STAMUNIT_OCCURENCES, "Number of installed jump patches.");
STAM_REG(pVM, &pVM->patm.s.StatOverwritten, STAMTYPE_COUNTER, "/PATM/Patch/Overwritten", STAMUNIT_OCCURENCES, "Number of overwritten patches.");
STAM_REG(pVM, &pVM->patm.s.StatFixedConflicts,STAMTYPE_COUNTER, "/PATM/Patch/ConflictFixed", STAMUNIT_OCCURENCES, "Number of fixed conflicts.");
STAM_REG(pVM, &pVM->patm.s.StatFlushed, STAMTYPE_COUNTER, "/PATM/Patch/Flushed", STAMUNIT_OCCURENCES, "Number of flushes of pages with patch jumps.");
STAM_REG(pVM, &pVM->patm.s.StatMonitored, STAMTYPE_COUNTER, "/PATM/Patch/Monitored", STAMUNIT_OCCURENCES, "Number of patches in monitored patch pages.");
STAM_REG(pVM, &pVM->patm.s.StatPageBoundaryCrossed, STAMTYPE_COUNTER, "/PATM/Patch/BoundaryCross", STAMUNIT_OCCURENCES, "Number of refused patches due to patch jump crossing page boundary.");
STAM_REG(pVM, &pVM->patm.s.StatHandleTrap, STAMTYPE_PROFILE, "/PATM/HandleTrap", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMR3HandleTrap");
STAM_REG(pVM, &pVM->patm.s.StatPushTrap, STAMTYPE_COUNTER, "/PATM/HandleTrap/PushWP", STAMUNIT_OCCURENCES, "Number of traps due to monitored stack pages.");
STAM_REG(pVM, &pVM->patm.s.StatSwitchBack, STAMTYPE_COUNTER, "/PATM/SwitchBack", STAMUNIT_OCCURENCES, "Switch back to original guest code when IF=1 & executing PATM instructions");
STAM_REG(pVM, &pVM->patm.s.StatSwitchBackFail,STAMTYPE_COUNTER, "/PATM/SwitchBackFail", STAMUNIT_OCCURENCES, "Failed switch back to original guest code when IF=1 & executing PATM instructions");
STAM_REG(pVM, &pVM->patm.s.StatDuplicateREQFailed, STAMTYPE_COUNTER, "/PATM/Function/DupREQ/Failed", STAMUNIT_OCCURENCES, "Nr of failed PATMR3DuplicateFunctionRequest calls");
STAM_REG(pVM, &pVM->patm.s.StatDuplicateREQSuccess, STAMTYPE_COUNTER, "/PATM/Function/DupREQ/Success", STAMUNIT_OCCURENCES, "Nr of successful PATMR3DuplicateFunctionRequest calls");
STAM_REG(pVM, &pVM->patm.s.StatDuplicateUseExisting,STAMTYPE_COUNTER, "/PATM/Function/DupREQ/UseExist", STAMUNIT_OCCURENCES, "Nr of successful PATMR3DuplicateFunctionRequest calls when using an existing patch");
STAM_REG(pVM, &pVM->patm.s.StatFunctionLookupInsert, STAMTYPE_COUNTER, "/PATM/Function/Lookup/Insert", STAMUNIT_OCCURENCES, "Nr of successful function address insertions");
STAM_REG(pVM, &pVM->patm.s.StatFunctionLookupReplace, STAMTYPE_COUNTER, "/PATM/Function/Lookup/Replace", STAMUNIT_OCCURENCES, "Nr of successful function address replacements");
STAM_REG(pVM, &pVM->patm.s.StatU32FunctionMaxSlotsUsed, STAMTYPE_U32_RESET,"/PATM/Function/Lookup/MaxSlots", STAMUNIT_OCCURENCES, "Maximum nr of lookup slots used in all call patches");
STAM_REG(pVM, &pVM->patm.s.StatFunctionFound, STAMTYPE_COUNTER, "/PATM/Function/Found", STAMUNIT_OCCURENCES, "Nr of successful function patch lookups in GC");
STAM_REG(pVM, &pVM->patm.s.StatFunctionNotFound, STAMTYPE_COUNTER, "/PATM/Function/NotFound", STAMUNIT_OCCURENCES, "Nr of failed function patch lookups in GC");
STAM_REG(pVM, &pVM->patm.s.StatPatchWrite, STAMTYPE_PROFILE, "/PATM/Write/Handle", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMR3PatchWrite");
STAM_REG(pVM, &pVM->patm.s.StatPatchWriteDetect, STAMTYPE_PROFILE, "/PATM/Write/Detect", STAMUNIT_TICKS_PER_CALL, "Profiling of PATMIsWriteToPatchPage");
STAM_REG(pVM, &pVM->patm.s.StatPatchWriteInterpreted, STAMTYPE_COUNTER, "/PATM/Write/Interpreted/Success", STAMUNIT_OCCURENCES, "Nr of interpreted patch writes.");
STAM_REG(pVM, &pVM->patm.s.StatPatchWriteInterpretedFailed, STAMTYPE_COUNTER, "/PATM/Write/Interpreted/Failed", STAMUNIT_OCCURENCES, "Nr of failed interpreted patch writes.");
STAM_REG(pVM, &pVM->patm.s.StatPatchPageInserted, STAMTYPE_COUNTER, "/PATM/Page/Inserted", STAMUNIT_OCCURENCES, "Nr of inserted guest pages that were patched");
STAM_REG(pVM, &pVM->patm.s.StatPatchPageRemoved, STAMTYPE_COUNTER, "/PATM/Page/Removed", STAMUNIT_OCCURENCES, "Nr of removed guest pages that were patched");
STAM_REG(pVM, &pVM->patm.s.StatInstrDirty, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Detected", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty.");
STAM_REG(pVM, &pVM->patm.s.StatInstrDirtyGood, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Corrected", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty and corrected later on.");
STAM_REG(pVM, &pVM->patm.s.StatInstrDirtyBad, STAMTYPE_COUNTER, "/PATM/Instr/Dirty/Failed", STAMUNIT_OCCURENCES, "Number of times instructions were marked dirty and we were not able to correct them.");
STAM_REG(pVM, &pVM->patm.s.StatSysEnter, STAMTYPE_COUNTER, "/PATM/Emul/SysEnter", STAMUNIT_OCCURENCES, "Number of times sysenter was emulated.");
STAM_REG(pVM, &pVM->patm.s.StatSysExit, STAMTYPE_COUNTER, "/PATM/Emul/SysExit" , STAMUNIT_OCCURENCES, "Number of times sysexit was emulated.");
STAM_REG(pVM, &pVM->patm.s.StatGenRet, STAMTYPE_COUNTER, "/PATM/Gen/Ret" , STAMUNIT_OCCURENCES, "Number of generated ret instructions.");
STAM_REG(pVM, &pVM->patm.s.StatGenRetReused, STAMTYPE_COUNTER, "/PATM/Gen/RetReused" , STAMUNIT_OCCURENCES, "Number of reused ret instructions.");
STAM_REG(pVM, &pVM->patm.s.StatGenCall, STAMTYPE_COUNTER, "/PATM/Gen/Call", STAMUNIT_OCCURENCES, "Number of generated call instructions.");
STAM_REG(pVM, &pVM->patm.s.StatGenJump, STAMTYPE_COUNTER, "/PATM/Gen/Jmp" , STAMUNIT_OCCURENCES, "Number of generated indirect jump instructions.");
STAM_REG(pVM, &pVM->patm.s.StatGenPopf, STAMTYPE_COUNTER, "/PATM/Gen/Popf" , STAMUNIT_OCCURENCES, "Number of generated popf instructions.");
STAM_REG(pVM, &pVM->patm.s.StatCheckPendingIRQ, STAMTYPE_COUNTER, "/PATM/GC/CheckIRQ" , STAMUNIT_OCCURENCES, "Number of traps that ask to check for pending irqs.");
#endif /* VBOX_WITH_STATISTICS */
return rc;
}
/**
* Finalizes HMA page attributes.
*
* @returns VBox status code.
* @param pVM The VM handle.
*/
{
/* The GC state, stack and statistics must be read/write for the guest (supervisor only of course). */
int rc = PGMMapSetPage(pVM, pVM->patm.s.pGCStateGC, PAGE_SIZE, X86_PTE_P | X86_PTE_A | X86_PTE_D | X86_PTE_RW);
if (VBOX_FAILURE(rc))
rc = PGMMapSetPage(pVM, pVM->patm.s.pGCStackGC, PATM_STACK_TOTAL_SIZE, X86_PTE_P | X86_PTE_A | X86_PTE_D | X86_PTE_RW);
if (VBOX_FAILURE(rc))
rc = PGMMapSetPage(pVM, pVM->patm.s.pStatsGC, PATM_STAT_MEMSIZE, X86_PTE_P | X86_PTE_A | X86_PTE_D | X86_PTE_RW);
if (VBOX_FAILURE(rc))
return rc;
}
/**
* (Re)initializes PATM
*
* @param pVM The VM.
*/
{
int rc;
/*
* Assert alignment and sizes.
*/
/*
* Setup any fixed pointers and offsets.
*/
#ifndef PATM_DISABLE_ALL
pVM->fPATMEnabled = true;
#endif
AssertReleaseMsg(pVM->patm.s.pGCStateGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pGCStateGC));
AssertReleaseMsg(pVM->patm.s.pGCStackGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pGCStackGC));
AssertReleaseMsg(pVM->patm.s.pStatsGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pStatsGC));
AssertReleaseMsg(pVM->patm.s.pPatchMemGC, ("Impossible! MMHyperHC2GC(%p) failed!\n", pVM->patm.s.pPatchMemHC));
/*
* (Re)Initialize PATM structure
*/
/* Lowest and highest patched instruction */
/* Generate all global functions to be used by future patches. */
/* We generate a fake patch in order to use the existing code for relocation. */
rc = MMHyperAlloc(pVM, sizeof(PATMPATCHREC), 0, MM_TAG_PATM_PATCH, (void **)&pVM->patm.s.pGlobalPatchRec);
if (VBOX_FAILURE(rc))
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
/* Update free pointer in patch memory. */
/* Round to next 8 byte boundary. */
return rc;
}
/**
* Applies relocations to data and code managed by this
* component. This function will be called at init and
* whenever the VMM need to relocate it self inside the GC.
*
* The PATM will update the addresses used by the switcher.
*
* @param pVM The VM.
*/
{
if (delta)
{
int rc;
/* Update CPUMCTX guest context pointer. */
RTAvloGCPtrDoWithAll(&pVM->patm.s.PatchLookupTreeHC->PatchTree, true, RelocatePatches, (void *)pVM);
/* If we are running patch code right now, then also adjust EIP. */
/* Deal with the global patch functions. */
}
}
/**
* Terminates the PATM.
*
* Termination means cleaning up and freeing all resources,
* the VM it self is at this point powered off or suspended.
*
* @returns VBox status code.
* @param pVM The VM to operate on.
*/
{
/* Memory was all allocated from the two MM heaps and requires no freeing. */
return VINF_SUCCESS;
}
/**
* PATM reset callback.
*
* @returns VBox status code.
* @param pVM The VM which is reset.
*/
{
Log(("PATMR3Reset\n"));
/* Free all patches. */
while (true)
{
PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrRemoveBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, 0, true);
if (pPatchRec)
{
}
else
break;
}
if (VBOX_SUCCESS(rc))
return rc;
}
/**
* Read callback for disassembly function; supports reading bytes that cross a page boundary
*
* @returns VBox status code.
* @param pSrc GC source pointer
* @param pDest HC destination pointer
* @param size Number of bytes to read
* @param dwUserdata Callback specific user data (pCpu)
*
*/
{
if (size == 0)
return VERR_INVALID_PARAMETER;
/*
* Trap/interrupt handler typically call common code on entry. Which might already have patches inserted.
* As we currently don't support calling patch code from patch code, we'll let it read the original opcode bytes instead.
*/
/** @todo could change in the future! */
{
for (int i=0;i<orgsize;i++)
{
if (VBOX_SUCCESS(rc))
{
pSrc++;
pDest++;
size--;
}
else break;
}
if (size == 0)
return VINF_SUCCESS;
#ifdef VBOX_STRICT
{
}
#endif
}
if (PAGE_ADDRESS(pDisInfo->pInstrGC) != PAGE_ADDRESS(pSrc + size - 1) && !PATMIsPatchGCAddr(pDisInfo->pVM, pSrc))
{
}
else
{
/* pInstrHC is the base address; adjust according to the GC pointer. */
}
return VINF_SUCCESS;
}
/**
* Callback function for RTAvloGCPtrDoWithAll
*
* Updates all fixups in the patches
*
* @returns VBox status code.
* @param pNode Current node
* @param pParam The VM to operate on.
*/
{
#ifdef LOG_ENABLED
char szOutput[256];
bool disret;
#endif
int rc;
/* Nothing to do if the patch is not active. */
return 0;
#ifdef LOG_ENABLED
{
/** @note pPrivInstrHC is probably not valid anymore */
if (rc == VINF_SUCCESS)
{
disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pPatch->patch.pPrivInstrGC, pPatch->patch.pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
}
}
#endif
/*
* Apply fixups
*/
while (true)
{
/* Get the record that's closest from above */
if (pRec == 0)
break;
{
case FIXUP_ABSOLUTE:
Log(("Absolute fixup at %VGv %VHv -> %VHv at %VGv\n", pRec->pSource, *(RTGCUINTPTR*)pRec->pRelocPos, *(RTGCINTPTR*)pRec->pRelocPos + delta, pRec->pRelocPos));
{
}
else
{
{
Log(("PATM: Patch page not present -> check later!\n"));
rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_ALL, pPage, pPage + (PAGE_SIZE - 1) /* inclusive! */, 0, patmVirtPageHandler, "PATMGCMonitorPage", 0, "PATMMonitorPatchJump");
}
else
{
Log(("PATM: Patch was overwritten -> disabling patch!!\n"));
/*
* Disable patch; this is not a good solution
*/
/* @todo hopefully it was completely overwritten (if the read was successful)!!!! */
}
else
if (VBOX_SUCCESS(rc))
{
}
}
break;
case FIXUP_REL_JMPTOPATCH:
{
{
Log(("Relative fixup (g2p) %08X -> %08X at %08X (source=%08x, target=%08x)\n", *(int32_t*)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
{
}
else
#endif
{
oldJump[0] = 0xE9;
}
else
{
continue; //this should never happen!!
}
/*
* Read old patch jump and compare it to the one we previously installed
*/
{
rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_ALL, pPage, pPage + (PAGE_SIZE - 1) /* inclusive! */, 0, patmVirtPageHandler, "PATMGCMonitorPage", 0, "PATMMonitorPatchJump");
}
else
{
Log(("PATM: Patch jump was overwritten -> disabling patch!!\n"));
/*
* Disable patch; this is not a good solution
*/
/* @todo hopefully it was completely overwritten (if the read was successful)!!!! */
}
else
if (VBOX_SUCCESS(rc))
{
}
else
{
}
}
else
{
Log(("Skip the guest jump to patch code for this disabled patch %08X - %08X\n", pPatch->patch.pPrivInstrHC, pRec->pRelocPos));
}
break;
}
case FIXUP_REL_JMPTOGUEST:
{
Log(("Relative fixup (p2g) %08X -> %08X at %08X (source=%08x, target=%08x)\n", *(int32_t*)pRec->pRelocPos, displ, pRec->pRelocPos, pRec->pSource, pRec->pDest));
break;
}
default:
AssertMsg(0, ("Invalid fixup type!!\n"));
return VERR_INVALID_PARAMETER;
}
}
#ifdef LOG_ENABLED
{
/** @note pPrivInstrHC is probably not valid anymore */
if (rc == VINF_SUCCESS)
{
disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pPatch->patch.pPrivInstrGC, pPatch->patch.pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
}
}
#endif
return 0;
}
/**
* #PF Handler callback for virtual access handler ranges.
*
* Important to realize that a physical page in a range can have aliases, and
* for ALL and WRITE handlers these will also trigger.
*
* @returns VINF_SUCCESS if the handler have carried out the operation.
* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
* @param pVM VM Handle.
* @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
* @param pvPtr The HC mapping of that address.
* @param enmAccessType The access type.
* @param pvUser User argument.
*/
static DECLCALLBACK(int) patmVirtPageHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
{
/** @todo could be the wrong virtual address (alias) */
return VINF_PGM_HANDLER_DO_DEFAULT;
}
#ifdef VBOX_WITH_DEBUGGER
/**
* Callback function for RTAvloGCPtrDoWithAll
*
* Enables the patch that's being enumerated
*
* @returns 0 (continue enumeration).
* @param pNode Current node
* @param pVM The VM to operate on.
*/
{
return 0;
}
#endif /* VBOX_WITH_DEBUGGER */
#ifdef VBOX_WITH_DEBUGGER
/**
* Callback function for RTAvloGCPtrDoWithAll
*
* Disables the patch that's being enumerated
*
* @returns 0 (continue enumeration).
* @param pNode Current node
* @param pVM The VM to operate on.
*/
{
return 0;
}
#endif
/**
* Returns the host context pointer and size of the patch memory block
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pcb Size of the patch memory block
*/
{
if (pcb)
{
}
}
/**
* Returns the guest context pointer and size of the patch memory block
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pcb Size of the patch memory block
*/
{
if (pcb)
{
}
}
/**
* Returns the host context pointer of the GC context structure
*
* @returns VBox status code.
* @param pVM The VM to operate on.
*/
{
}
/**
* Checks whether the HC address is part of our patch region
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pAddrGC Guest context address
*/
{
return (pAddrHC >= pVM->patm.s.pPatchMemHC && pAddrHC < pVM->patm.s.pPatchMemHC + pVM->patm.s.cbPatchMem) ? true : false;
}
/**
* Allows or disallow patching of privileged instructions executed by the guest OS
*
* @returns VBox status code.
* @param pVM The VM to operate on.
*/
{
return VINF_SUCCESS;
}
/**
* Convert a GC patch block pointer to a HC patch pointer
*
* @returns HC pointer or NULL if it's not a GC patch pointer
* @param pVM The VM to operate on.
* @param pAddrGC GC pointer
*/
{
if (pVM->patm.s.pPatchMemGC <= pAddrGC && pVM->patm.s.pPatchMemGC + pVM->patm.s.cbPatchMem > pAddrGC)
{
}
return NULL;
}
/**
*
* @returns 0 - disabled, 1 - enabled
* @param pVM The VM to operate on.
*/
{
return pVM->fPATMEnabled;
}
/**
* Convert guest context address to host context pointer
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch block structure pointer
* @param pGCPtr Guest context pointer
*
* @returns Host context pointer or NULL in case of an error
*
*/
{
int rc;
{
}
{
}
if (rc != VINF_SUCCESS)
{
AssertMsg(rc == VINF_SUCCESS || rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("MMR3PhysGCVirt2HCVirtEx failed for %08X\n", pGCPtr));
return NULL;
}
return pHCPtr;
}
/* Calculates and fills in all branch targets
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Current patch block pointer
*
*/
{
int nrJumpRecs = 0;
/*
* Set all branch targets inside the patch block.
* We remove all jump records as they are no longer needed afterwards.
*/
while (true)
{
if (pRec == 0)
break;
nrJumpRecs++;
/* HC in patch block to GC in patch block. */
{
/* Special case: call function replacement patch from this patch block.
*/
{
int rc;
else
if (VBOX_FAILURE(rc))
{
/* Failure for some reason -> mark exit point with int 3. */
/* Set a breakpoint at the very beginning of the recompiled instruction */
*pPatchHC = 0xCC;
continue;
}
}
}
else
{
}
if (pBranchTargetGC == 0)
{
AssertMsgFailed(("patmr3SetBranchTargets: patmGuestGCPtrToPatchGCPtr failed for %08X\n", pRec->pTargetGC));
return VERR_PATCHING_REFUSED;
}
/* Our jumps *always* have a dword displacement (to make things easier). */
Log(("Set branch target %d to %08X : %08x - (%08x + %d + %d)\n", nrJumpRecs, displ, pBranchTargetGC, pInstrGC, pRec->offDispl, sizeof(RTGCPTR)));
}
return VINF_SUCCESS;
}
/* Add an illegal instruction record
*
* @param pVM The VM to operate on.
* @param pPatch Patch structure ptr
* @param pInstrGC Guest context pointer to privileged instruction
*
*/
{
}
{
if (pRec)
return true;
return false;
}
/**
* Add a patch to guest lookup record
*
* @param pVM The VM to operate on.
* @param pPatch Patch structure ptr
* @param pPatchInstrHC Guest context pointer to patch block
* @param pInstrGC Guest context pointer to privileged instruction
* @param enmType Lookup type
* @param fDirty Dirty flag
*
*/
/** @note Be extremely careful with this function. Make absolutely sure the guest address is correct! (to avoid executing instructions twice!) */
void patmr3AddP2GLookupRecord(PVM pVM, PPATCHINFO pPatch, uint8_t *pPatchInstrHC, RTGCPTR pInstrGC, PATM_LOOKUP_TYPE enmType, bool fDirty)
{
bool ret;
RTGCUINTPTR PatchOffset = pPatchInstrHC - pVM->patm.s.pPatchMemHC; /* Offset in memory reserved for PATM. */
if (enmType == PATM_LOOKUP_PATCH2GUEST)
{
pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
return; /* already there */
}
#ifdef VBOX_STRICT
else
{
pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
}
#endif
pPatchToGuestRec = (PRECPATCHTOGUEST)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(RECPATCHTOGUEST) + sizeof(RECGUESTTOPATCH));
/* GC to patch address */
if (enmType == PATM_LOOKUP_BOTHDIR)
{
pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGet(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)PatchOffset);
if (!pGuestToPatchRec)
{
}
}
}
/**
* Removes a patch to guest lookup record
*
* @param pVM The VM to operate on.
* @param pPatch Patch structure ptr
* @param pPatchInstrGC Guest context pointer to patch block
*/
{
RTGCUINTPTR PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC; /* Offset in memory reserved for PATM. */
pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
if (pPatchToGuestRec)
{
{
}
}
}
/* Empty the specified tree (PV tree, MMR3 heap)
*
* @param pVM The VM to operate on.
* @param ppTree Tree to empty
*/
{
if (*ppTree == 0)
return;
while (true)
{
if (pRec)
{
}
else
break;
}
}
/**
* Analyses the instructions following the cli for compliance with our heuristics for cli & pushf
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu CPU disassembly state
* @param pInstrGC Guest context pointer to privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pUserData User pointer (callback specific)
*
*/
static int patmAnalyseBlockCallback(PVM pVM, DISCPUSTATE *pCpu, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, void *pUserData)
{
bool fIllegalInstr = false;
//Preliminary heuristics:
//- no jumps in the instructions following cli (4+ bytes; enough for the replacement jump (5 bytes))
//- no near or far returns; no int xx, no into
//
// Note: Later on we can impose less stricter guidelines if the need arises
/* Bail out if the patch gets too big. */
{
fIllegalInstr = true;
}
else
{
/* No unconditinal jumps or calls without fixed displacements. */
)
{
|| (OP_PARM_VTYPE(pCpu->pCurInstr->param1) != OP_PARM_J && !(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS))
)
{
fIllegalInstr = true;
}
}
/* An unconditional (short) jump right after a cli is a potential problem; we will overwrite whichever function comes afterwards */
{
if (pCurInstrGC > pPatch->pPrivInstrGC && pCurInstrGC + pCpu->opsize < pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32) /* hardcoded patch jump size; cbPatchJump is still zero */
{
Log(("Dangerous unconditional jump ends in our generated patch jump!! (%x vs %x)\n", pCurInstrGC, pPatch->pPrivInstrGC));
/* We turn this one into a int 3 callable patch. */
}
}
else
/* no nested pushfs just yet; nested cli is allowed for cli patches though. */
{
{
fIllegalInstr = true;
}
}
// no far returns
{
fIllegalInstr = true;
}
else
// no int xx or into either
if (pCpu->pCurInstr->opcode == OP_INT3 || pCpu->pCurInstr->opcode == OP_INT || pCpu->pCurInstr->opcode == OP_INTO)
{
fIllegalInstr = true;
}
}
/* Illegal instruction -> end of analysis phase for this code block */
return VINF_SUCCESS;
/* Check for exit points. */
{
case OP_SYSEXIT:
return VINF_SUCCESS; /* duplicate it; will fault or emulated in GC. */
case OP_SYSENTER:
case OP_ILLUD2:
//This appears to be some kind of kernel panic in Linux 2.4; no point to analyse more
Log(("Illegal opcode (0xf 0xb) -> return here\n"));
return VINF_SUCCESS;
case OP_STI:
case OP_POPF:
/* If out exit point lies within the generated patch jump, then we have to refuse!! */
if (pCurInstrGC > pPatch->pPrivInstrGC && pCurInstrGC < pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32) /* hardcoded patch jump size; cbPatchJump is still zero */
{
return VERR_PATCHING_REFUSED;
}
{
{
return VINF_SUCCESS;
/* Or else we need to duplicate more instructions, because we can't jump back yet! */
Log(("WARNING: End of block reached, but we need to duplicate some extra instruction to avoid a conflict with the patch jump\n"));
}
break; //sti doesn't mark the end of a pushf block; only popf does
}
//else no break
case OP_RETN: /* exit point for function replacement */
return VINF_SUCCESS;
case OP_IRET:
return VINF_SUCCESS; /* exitpoint */
case OP_CPUID:
case OP_CALL:
case OP_JMP:
break;
default:
{
return VINF_SUCCESS; /* exit point */
}
break;
}
// If single instruction patch, we've copied enough instructions *and* the current instruction is not a relative jump
if ((pPatch->flags & PATMFL_CHECK_SIZE) && pPatch->cbPatchBlockSize > SIZEOF_NEARJUMP32 && !(pCpu->pCurInstr->optype & OPTYPE_RELATIVE_CONTROLFLOW))
{
// The end marker for this kind of patch is any instruction at a location outside our patch jump
return VINF_SUCCESS;
}
return VWRN_CONTINUE_ANALYSIS;
}
/**
* Analyses the instructions inside a function for compliance
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu CPU disassembly state
* @param pInstrGC Guest context pointer to privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pUserData User pointer (callback specific)
*
*/
static int patmAnalyseFunctionCallback(PVM pVM, DISCPUSTATE *pCpu, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, void *pUserData)
{
bool fIllegalInstr = false;
//Preliminary heuristics:
//- no call instructions
//- ret ends a block
// bail out if the patch gets too big
{
Log(("Code block too big (%x) for function patch at %VGv!!\n", pPatch->cbPatchBlockSize, pCurInstrGC));
fIllegalInstr = true;
}
else
{
// no unconditinal jumps or calls without fixed displacements
)
{
|| (OP_PARM_VTYPE(pCpu->pCurInstr->param1) != OP_PARM_J && !(pPatch->flags & PATMFL_SUPPORT_INDIRECT_CALLS))
)
{
fIllegalInstr = true;
}
}
else /* no far returns */
{
fIllegalInstr = true;
}
else /* no int xx or into either */
if (pCpu->pCurInstr->opcode == OP_INT3 || pCpu->pCurInstr->opcode == OP_INT || pCpu->pCurInstr->opcode == OP_INTO)
{
fIllegalInstr = true;
}
#if 0
{
Log(("Illegal instructions for function patch!!\n"));
return VERR_PATCHING_REFUSED;
}
#endif
}
/* Illegal instruction -> end of analysis phase for this code block */
{
return VINF_SUCCESS;
}
// Check for exit points
{
case OP_ILLUD2:
//This appears to be some kind of kernel panic in Linux 2.4; no point to analyse more
Log(("Illegal opcode (0xf 0xb) -> return here\n"));
return VINF_SUCCESS;
case OP_IRET:
case OP_SYSEXIT: /* will fault or emulated in GC */
case OP_RETN:
return VINF_SUCCESS;
case OP_POPF:
case OP_STI:
return VWRN_CONTINUE_ANALYSIS;
default:
{
return VINF_SUCCESS; /* exit point */
}
return VWRN_CONTINUE_ANALYSIS;
}
return VWRN_CONTINUE_ANALYSIS;
}
/**
* Recompiles the instructions in a code block
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu CPU disassembly state
* @param pInstrGC Guest context pointer to privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pUserData User pointer (callback specific)
*
*/
static int patmRecompileCallback(PVM pVM, DISCPUSTATE *pCpu, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, void *pUserData)
{
int rc = VINF_SUCCESS;
bool fInhibitIRQInstr = false; /* did the instruction cause PATMFL_INHIBITIRQS to be set? */
&& !(pPatch->flags & PATMFL_RECOMPILE_NEXT)) /* do not do this when the next instruction *must* be executed! */
{
/*
* Been there, done that; so insert a jump (we don't want to duplicate code)
* no need to record this instruction as it's glue code that never crashes (it had better not!)
*/
}
{
}
else
if (VBOX_FAILURE(rc))
return rc;
/** @note Never do a direct return unless a failure is encountered! */
/* Clear recompilation of next instruction flag; we are doing that right here. */
/* Add lookup record for patch to guest address translation */
patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
/* Update lowest and highest instruction address for this patch */
else
/* Illegal instruction -> end of recompile phase for this code block. */
{
goto end;
}
/* For our first attempt, we'll handle only simple relative jumps (immediate offset coded in instruction).
* Indirect calls are handled below.
*/
{
if (pTargetGC == 0)
{
return VERR_PATCHING_REFUSED;
}
{
{
if (pTargetGC == 0)
return VERR_PATCHING_REFUSED;
}
if (VBOX_FAILURE(rc))
goto end;
}
else
rc = patmPatchGenRelJump(pVM, pPatch, pTargetGC, pCpu->pCurInstr->opcode, !!(pCpu->prefix & PREFIX_OPSIZE));
if (VBOX_SUCCESS(rc))
goto end;
}
{
case OP_CLI:
{
/* If a cli is found while duplicating instructions for another patch, then it's of vital importance to continue
* until we've found the proper exit point(s).
*/
if ( pCurInstrGC != pInstrGC
)
{
Log(("cli instruction found in other instruction patch block; force it to continue & find an exit point\n"));
}
/* Set by irq inhibition; no longer valid now. */
if (VBOX_SUCCESS(rc))
break;
}
case OP_MOV:
{
/* mov ss, src? */
{
}
}
goto duplicate_instr;
case OP_POP:
{
}
goto duplicate_instr;
case OP_STI:
{
/** In a sequence of instructions that inhibit irqs, only the first one actually inhibits irqs. */
{
fInhibitIRQInstr = true;
}
if (VBOX_SUCCESS(rc))
{
unsigned opsize;
int disret;
if (pNextInstrHC == NULL)
{
AssertFailed();
return VERR_PATCHING_REFUSED;
}
// Disassemble the next instruction
if (disret == false)
{
AssertMsgFailed(("STI: Disassembly failed (probably page not present) -> return to caller\n"));
return VERR_PATCHING_REFUSED;
}
|| pReturnInstrGC <= pInstrGC
)
{
/* Not an exit point for function duplication patches */
&& VBOX_SUCCESS(rc))
{
}
else
}
else {
Log(("PATM: sti occurred too soon; refusing patch!\n"));
}
}
break;
}
case OP_POPF:
{
/* Not an exit point for IDT handler or function replacement patches */
fGenerateJmpBack = false;
rc = patmPatchGenPopf(pVM, pPatch, pCurInstrGC + pCpu->opsize, !!(pCpu->prefix & PREFIX_OPSIZE), fGenerateJmpBack);
if (VBOX_SUCCESS(rc))
{
if (fGenerateJmpBack == false)
{
/* Not an exit point for IDT handler or function replacement patches */
}
else
{
}
}
break;
}
case OP_PUSHF:
if (VBOX_SUCCESS(rc))
break;
case OP_PUSH:
{
if (VBOX_SUCCESS(rc))
break;
}
goto duplicate_instr;
case OP_IRET:
if (VBOX_SUCCESS(rc))
{
}
break;
case OP_ILLUD2:
/* This appears to be some kind of kernel panic in Linux 2.4; no point to continue */
if (VBOX_SUCCESS(rc))
Log(("Illegal opcode (0xf 0xb)\n"));
break;
case OP_CPUID:
if (VBOX_SUCCESS(rc))
break;
case OP_STR:
case OP_SLDT:
if (VBOX_SUCCESS(rc))
break;
case OP_SGDT:
case OP_SIDT:
if (VBOX_SUCCESS(rc))
break;
case OP_RETN:
/* retn is an exit point for function patches */
if (VBOX_SUCCESS(rc))
break;
case OP_SYSEXIT:
/* Duplicate it, so it can be emulated in GC (or fault). */
if (VBOX_SUCCESS(rc))
break;
case OP_CALL:
/* In interrupt gate handlers it's possible to encounter jumps or calls when IF has been enabled again.
* In that case we'll jump to the original instruction and continue from there. Otherwise an int 3 is executed.
*/
{
if (VBOX_SUCCESS(rc))
{
}
break;
}
goto gen_illegal_instr;
case OP_JMP:
/* In interrupt gate handlers it's possible to encounter jumps or calls when IF has been enabled again.
* In that case we'll jump to the original instruction and continue from there. Otherwise an int 3 is executed.
*/
{
if (VBOX_SUCCESS(rc))
break;
}
goto gen_illegal_instr;
case OP_INT3:
case OP_INT:
case OP_INTO:
goto gen_illegal_instr;
case OP_MOV_DR:
/** @note: currently we let DRx writes cause a trap d; our trap handler will decide to interpret it or not. */
{
if (VBOX_SUCCESS(rc))
break;
}
goto duplicate_instr;
case OP_MOV_CR:
/** @note: currently we let CRx writes cause a trap d; our trap handler will decide to interpret it or not. */
{
if (VBOX_SUCCESS(rc))
break;
}
goto duplicate_instr;
default:
{
if (VBOX_SUCCESS(rc))
}
else
{
Log(("patmPatchGenDuplicate\n"));
if (VBOX_SUCCESS(rc))
}
break;
}
end:
if ( !fInhibitIRQInstr
{
int rc2;
{
Log(("patmRecompileCallback: generate jump back to guest (%VGv) after fused instruction\n", pNextInstrGC));
}
else
{
}
if (VBOX_FAILURE(rc2))
}
if (VBOX_SUCCESS(rc))
{
// If single instruction patch, we've copied enough instructions *and* the current instruction is not a relative jump
&& !(pPatch->flags & PATMFL_RECOMPILE_NEXT) /* do not do this when the next instruction *must* be executed! */
)
{
// The end marker for this kind of patch is any instruction at a location outside our patch jump
Log(("patmRecompileCallback: end found for single instruction patch at %VGv opsize %d\n", pNextInstrGC, pCpu->opsize));
}
}
return rc;
}
#ifdef LOG_ENABLED
/* Add a disasm jump record (temporary for prevent duplicate analysis)
*
* @param pVM The VM to operate on.
* @param pPatch Patch structure ptr
* @param pInstrGC Guest context pointer to privileged instruction
*
*/
{
}
/**
* Checks if jump target has been analysed before.
*
* @returns VBox status code.
* @param pPatch Patch struct
* @param pInstrGC Jump target
*
*/
{
if (pRec)
return true;
return false;
}
/**
* For proper disassembly of the final patch block
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu CPU disassembly state
* @param pInstrGC Guest context pointer to privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pUserData User pointer (callback specific)
*
*/
int patmr3DisasmCallback(PVM pVM, DISCPUSTATE *pCpu, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, void *pUserData)
{
{
/* Could be an int3 inserted in a call patch. Check to be sure */
return VINF_SUCCESS;
return VWRN_CONTINUE_ANALYSIS;
}
{
/* the indirect call patch contains an 0xF/0xB illegal instr to call for assistance; check for this and continue */
return VWRN_CONTINUE_ANALYSIS;
}
)
{
return VINF_SUCCESS;
}
return VINF_SUCCESS;
return VWRN_CONTINUE_ANALYSIS;
}
/**
* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to the initial privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pfnPATMR3Disasm Callback for testing the disassembled instruction
* @param pUserData User pointer (callback specific)
*
*/
int patmr3DisasmCode(PVM pVM, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Disasm, void *pUserData)
{
int rc = VWRN_CONTINUE_ANALYSIS;
bool disret;
char szOutput[256];
/* We need this to determine branch targets (and for disassembling). */
while(rc == VWRN_CONTINUE_ANALYSIS)
{
if (pCurInstrHC == NULL)
{
goto end;
}
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pCurInstrGC, pCurInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
{
else
{
rc = VINF_SUCCESS;
goto end;
}
}
else
if (disret == false)
{
Log(("Disassembly failed (probably page not present) -> return to caller\n"));
rc = VINF_SUCCESS;
goto end;
}
if (rc != VWRN_CONTINUE_ANALYSIS) {
break; //done!
}
/* For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction) */
)
{
if (pTargetGC == 0)
{
break;
}
{
//jump back to guest code
rc = VINF_SUCCESS;
goto end;
}
{
rc = VINF_SUCCESS;
goto end;
}
{
/* New jump, let's check it. */
if (rc != VINF_SUCCESS) {
break; //done!
}
}
{
/* Unconditional jump; return to caller. */
rc = VINF_SUCCESS;
goto end;
}
}
pCurInstrGC += opsize;
}
end:
return rc;
}
/**
* Disassembles the code stream until the callback function detects a failure or decides everything is acceptable
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to the initial privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pfnPATMR3Disasm Callback for testing the disassembled instruction
* @param pUserData User pointer (callback specific)
*
*/
int patmr3DisasmCodeStream(PVM pVM, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Disasm, void *pUserData)
{
/* Free all disasm jump records. */
return rc;
}
#endif /* LOG_ENABLED */
/**
* Detects it the specified address falls within a 5 byte jump generated for an active patch.
* If so, this patch is permanently disabled.
*
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to instruction
* @param pConflictGC Guest context pointer to check
*
* @note also checks for patch hints to make sure they can never be enabled if a conflict is present.
*
*/
{
PPATCHINFO pTargetPatch = PATMFindActivePatchByEntrypoint(pVM, pConflictGC, true /* include patch hints */);
if (pTargetPatch)
{
}
return VERR_PATCH_NO_CONFLICT;
}
/**
* Recompile the code stream until the callback function detects a failure or decides everything is acceptable
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to privileged instruction
* @param pCurInstrGC Guest context pointer to the current instruction
* @param pfnPATMR3Recompile Callback for testing the disassembled instruction
* @param pUserData User pointer (callback specific)
*
*/
static int patmRecompileCodeStream(PVM pVM, GCPTRTYPE(uint8_t *) pInstrGC, GCPTRTYPE(uint8_t *) pCurInstrGC, PFN_PATMR3ANALYSE pfnPATMR3Recompile, void *pUserData)
{
int rc = VWRN_CONTINUE_ANALYSIS;
bool disret;
#ifdef LOG_ENABLED
char szOutput[256];
#endif
while (rc == VWRN_CONTINUE_RECOMPILE)
{
////Log(("patmRecompileCodeStream %VGv %VGv\n", pInstrGC, pCurInstrGC));
if (pCurInstrHC == NULL)
{
goto end;
}
#ifdef LOG_ENABLED
#else
#endif
if (disret == false)
{
Log(("Disassembly failed (probably page not present) -> return to caller\n"));
/* Add lookup record for patch to guest address translation */
patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pCurInstrGC, PATM_LOOKUP_BOTHDIR);
goto end;
}
if (rc != VWRN_CONTINUE_RECOMPILE)
{
/* If irqs are inhibited because of the current instruction, then we must make sure the next one is executed! */
if ( rc == VINF_SUCCESS
{
/* Certain instructions (e.g. sti) force the next instruction to be executed before any interrupts can occur.
* Recompile the next instruction as well
*/
if (pNextInstrHC == NULL)
{
goto end;
}
if (disret == false)
{
goto end;
}
{
case OP_IRET: /* inhibit cleared in generated code */
case OP_SYSEXIT: /* faults; inhibit should be cleared in HC handling */
case OP_HLT:
break; /* recompile these */
default:
{
Log(("Unexpected control flow instruction after inhibit irq instruction\n"));
goto end; /** @todo should be ok to ignore instruction fusing in this case */
}
break;
}
/** @note after a cli we must continue to a proper exit point */
{
if (VBOX_SUCCESS(rc))
{
rc = VINF_SUCCESS;
goto end;
}
break;
}
else
}
else
break; /* done! */
}
/** @todo continue with the instructions following the jump and then recompile the jump target code */
/* For our first attempt, we'll handle only simple relative jumps and calls (immediate offset coded in instruction). */
)
{
if (addr == 0)
{
break;
}
/* We don't check if the branch target lies in a valid page as we've already done that in the analysis phase. */
{
Log(("patmRecompileCodeStream continue passed conditional jump\n"));
/* First we need to finish this linear code stream until the next exit point. */
if (VBOX_FAILURE(rc))
{
break; //fatal error
}
}
{
/* New code; let's recompile it. */
Log(("patmRecompileCodeStream continue with jump\n"));
/*
* If we are jumping to an existing patch (or within 5 bytes of the entrypoint), then we must temporarily disable
* this patch so we can continue our analysis
*
* We rely on CSAM to detect and resolve conflicts
*/
if(pTargetPatch)
{
Log(("Found active patch at target %VGv (%VGv) -> temporarily disabling it!!\n", addr, pTargetPatch->pPrivInstrGC));
}
if(pTargetPatch)
{
}
if (VBOX_FAILURE(rc))
{
break; //done!
}
}
/* Always return to caller here; we're done! */
rc = VINF_SUCCESS;
goto end;
}
else
{
rc = VINF_SUCCESS;
goto end;
}
pCurInstrGC += opsize;
}
end:
return rc;
}
/**
* Generate the jump from guest to patch code
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
{
{
// jmp [PatchCode]
if (fAddFixup)
{
if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + pPatch->cbPatchJump, pPatch->pPatchJumpDestGC) != VINF_SUCCESS)
{
Log(("Relocation failed for the jump in the guest code!!\n"));
return VERR_PATCHING_REFUSED;
}
}
*(uint32_t *)&temp[1] = (uint32_t)pPatch->pPatchJumpDestGC - ((uint32_t)pPatch->pPrivInstrGC + pPatch->cbPatchJump); //return address
}
else
{
// jmp [PatchCode]
if (fAddFixup)
{
if (patmPatchAddReloc32(pVM, pPatch, &pPB[2], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + pPatch->cbPatchJump, pPatch->pPatchJumpDestGC) != VINF_SUCCESS)
{
Log(("Relocation failed for the jump in the guest code!!\n"));
return VERR_PATCHING_REFUSED;
}
}
*(uint32_t *)&temp[2] = (uint32_t)pPatch->pPatchJumpDestGC - ((uint32_t)pPatch->pPrivInstrGC + pPatch->cbPatchJump); //return address
}
else
{
Assert(0);
return VERR_PATCHING_REFUSED;
}
}
else
#endif
{
// jmp [PatchCode]
if (fAddFixup)
{
if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32, PATCHCODE_PTR_GC(pPatch)) != VINF_SUCCESS)
{
Log(("Relocation failed for the jump in the guest code!!\n"));
return VERR_PATCHING_REFUSED;
}
}
*(uint32_t *)&temp[1] = (RTGCUINTPTR)PATCHCODE_PTR_GC(pPatch) - ((RTGCUINTPTR)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32); //return address
}
if (rc == VINF_SUCCESS)
return rc;
}
/**
* Remove the jump from guest to patch code
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
#ifdef DEBUG
char szOutput[256];
bool disret;
while(i < pPatch->cbPrivInstr)
{
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
if (disret == false)
break;
i += opsize;
}
#endif
/* Restore original code (privileged instruction + following instructions that were overwritten because of the 5/6 byte jmp). */
int rc = PGMPhysWriteGCPtrDirty(pVM, pPatch->pPrivInstrGC, pPatch->aPrivInstr, pPatch->cbPatchJump);
#ifdef DEBUG
if (rc == VINF_SUCCESS)
{
char szOutput[256];
bool disret;
while(i < pPatch->cbPrivInstr)
{
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
if (disret == false)
break;
i += opsize;
}
}
#endif
return rc;
}
/**
* Generate the call from guest to patch code
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
// jmp [PatchCode]
if (fAddFixup)
{
if (patmPatchAddReloc32(pVM, pPatch, &pPB[1], FIXUP_REL_JMPTOPATCH, pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32, pTargetGC) != VINF_SUCCESS)
{
Log(("Relocation failed for the jump in the guest code!!\n"));
return VERR_PATCHING_REFUSED;
}
}
*(uint32_t *)&temp[1] = (uint32_t)pTargetGC - ((uint32_t)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32); //return address
return rc;
}
/**
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pInstrHC Host context point to privileged instruction
* @param uOpcode Instruction opcode
* @param uOpSize Size of starting instruction
* @param pPatchRec Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
{
int rc = VERR_PATCHING_REFUSED;
uint32_t orgOffsetPatchMem = ~0;
#ifdef LOG_ENABLED
char szOutput[256];
bool disret;
#endif
/* Save original offset (in case of failures later on) */
switch (uOpcode)
{
case OP_MOV:
break;
case OP_CLI:
case OP_PUSHF:
/* We can 'call' a cli or pushf patch. It will either return to the original guest code when IF is set again, or fault. */
/** @note special precautions are taken when disabling and enabling such patches. */
break;
default:
{
return VERR_INVALID_PARAMETER;
}
}
{
#ifdef DEBUG_sandervl
//// AssertMsgFailed(("Patch jump would cross page boundary -> refuse!!\n"));
#endif
goto failure;
}
pPatch->nrPatch2GuestRecs = 0;
#ifdef PATM_ENABLE_CALL
#endif
pPatch->uCurPatchOffset = 0;
if ((pPatch->flags & (PATMFL_IDTHANDLER|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT|PATMFL_SYSENTER)) == PATMFL_IDTHANDLER)
{
/* Install fake cli patch (to clear the virtual IF and check int xx parameters) */
if (VBOX_FAILURE(rc))
goto failure;
}
/***************************************************************************************************************************/
/** @note We can't insert *any* code before a sysenter handler; some linux guests have an invalid stack at this point!!!!! */
/***************************************************************************************************************************/
#ifdef VBOX_WITH_STATISTICS
{
if (VBOX_FAILURE(rc))
goto failure;
}
#endif
if (rc != VINF_SUCCESS)
{
goto failure;
}
/* Calculated during analysis. */
{
/* Most likely cause: we encountered an illegal instruction very early on. */
/** @todo could turn it into an int3 callable patch. */
Log(("PATMR3PatchBlock: patch block too small -> refuse\n"));
goto failure;
}
/* size of patch block */
/* Update free pointer in patch memory. */
/* Round to next 8 byte boundary. */
/*
* Insert into patch to guest lookup tree
*/
LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
if (!rc)
{
goto failure;
}
/* Note that patmr3SetBranchTargets can install additional patches!! */
if (rc != VINF_SUCCESS)
{
goto failure;
}
#ifdef LOG_ENABLED
Log(("Patch code ----------------------------------------------------------\n"));
patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
Log(("Patch code ends -----------------------------------------------------\n"));
#endif
/* make a copy of the guest code bytes that will be overwritten */
{
/* Replace first opcode byte with 'int 3'. */
if (VBOX_FAILURE(rc))
goto failure;
}
else
{
/* now insert a jump in the guest code */
if (VBOX_FAILURE(rc))
goto failure;
}
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput, PATMREAD_RAWCODE);
#endif
Log(("Successfully installed %s patch at %VGv\n", patmGetInstructionString(pPatch->opcode, pPatch->flags), pInstrGC));
return VINF_SUCCESS;
pPatch->nrJumpRecs = 0;
/* Turn this cli patch into a dummy. */
pPatch->pPatchBlockOffset = 0;
// Give back the patch memory we no longer need
return rc;
}
/**
* Patch IDT handler
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pInstrHC Host context point to privileged instruction
* @param uOpSize Size of starting instruction
* @param pPatchRec Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
{
bool disret;
uint32_t orgOffsetPatchMem = ~0;
/*
* In Linux it's often the case that many interrupt handlers push a predefined value onto the stack
* and then jump to a common entrypoint. In order not to waste a lot of memory, we will check for this
* condition here and only patch the common entypoint once.
*/
{
int rc;
pCurInstrGC += opsize;
if ( disret
)
{
PPATMPATCHREC pJmpPatch = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pJmpInstrGC);
if (pJmpPatch == 0)
{
/* Patch it first! */
if (rc != VINF_SUCCESS)
goto failure;
}
goto failure;
/* save original offset (in case of failures later on) */
pPatch->uCurPatchOffset = 0;
pPatch->nrPatch2GuestRecs = 0;
#ifdef VBOX_WITH_STATISTICS
if (VBOX_FAILURE(rc))
goto failure;
#endif
/* Install fake cli patch (to clear the virtual IF) */
if (VBOX_FAILURE(rc))
goto failure;
/* Add lookup record for patch to guest address translation (for the push) */
patmr3AddP2GLookupRecord(pVM, pPatch, PATCHCODE_PTR_HC(pPatch) + pPatch->uCurPatchOffset, pInstrGC, PATM_LOOKUP_BOTHDIR);
/* Duplicate push. */
if (VBOX_FAILURE(rc))
goto failure;
/* Generate jump to common entrypoint. */
if (VBOX_FAILURE(rc))
goto failure;
/* size of patch block */
/* Update free pointer in patch memory. */
/* Round to next 8 byte boundary */
/* There's no jump from guest to patch code. */
pPatch->cbPatchJump = 0;
#ifdef LOG_ENABLED
Log(("Patch code ----------------------------------------------------------\n"));
patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
Log(("Patch code ends -----------------------------------------------------\n"));
#endif
/*
* Insert into patch to guest lookup tree
*/
LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
return VINF_SUCCESS;
}
}
/* Give back the patch memory we no longer need */
if (orgOffsetPatchMem != (uint32_t)~0)
}
/**
* Install a trampoline to call a guest trap handler directly
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pPatchRec Patch record
*
*/
{
int rc = VERR_PATCHING_REFUSED;
uint32_t orgOffsetPatchMem = ~0;
#ifdef LOG_ENABLED
bool disret;
char szOutput[256];
#endif
// save original offset (in case of failures later on)
pPatch->uCurPatchOffset = 0;
pPatch->nrPatch2GuestRecs = 0;
#ifdef VBOX_WITH_STATISTICS
if (VBOX_FAILURE(rc))
goto failure;
#endif
if (VBOX_FAILURE(rc))
goto failure;
/* size of patch block */
/* Update free pointer in patch memory. */
/* Round to next 8 byte boundary */
/* There's no jump from guest to patch code. */
pPatch->cbPatchJump = 0;
#ifdef LOG_ENABLED
Log(("Patch code ----------------------------------------------------------\n"));
patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
Log(("Patch code ends -----------------------------------------------------\n"));
#endif
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
#endif
/*
* Insert into patch to guest lookup tree
*/
LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
return VINF_SUCCESS;
AssertMsgFailed(("Failed to install trap handler trampoline!!\n"));
/* Turn this cli patch into a dummy. */
pPatch->pPatchBlockOffset = 0;
/* Give back the patch memory we no longer need */
return rc;
}
#ifdef DEBUG
/**
* Check if the instruction is patched as a common idt handler
*
* @returns true or false
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to the instruction
*
*/
{
return true;
return false;
}
#endif //DEBUG
/**
* Duplicates a complete function
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu Disassembly CPU structure ptr
* @param pInstrGC Guest context point to privileged instruction
* @param pPatchRec Patch record
*
*/
static int patmDuplicateFunction(PVM pVM, DISCPUSTATE *pCpu, RTGCPTR pInstrGC, PPATMPATCHREC pPatchRec)
{
int rc = VERR_PATCHING_REFUSED;
uint32_t orgOffsetPatchMem = ~0;
/* Save original offset (in case of failures later on). */
/* We will not go on indefinitely with call instruction handling. */
{
Log(("patmDuplicateFunction: maximum callback depth reached!!\n"));
return VERR_PATCHING_REFUSED;
}
#ifdef PATM_ENABLE_CALL
#endif
pPatch->nrPatch2GuestRecs = 0;
pPatch->uCurPatchOffset = 0;
/** @note Set the PATM interrupt flag here; it was cleared before the patched call. (!!!) */
if (VBOX_FAILURE(rc))
goto failure;
#ifdef VBOX_WITH_STATISTICS
if (VBOX_FAILURE(rc))
goto failure;
#endif
if (rc != VINF_SUCCESS)
{
goto failure;
}
//size of patch block
//update free pointer in patch memory
/* Round to next 8 byte boundary. */
/*
* Insert into patch to guest lookup tree
*/
LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
if (!rc)
{
goto failure;
}
/* Note that patmr3SetBranchTargets can install additional patches!! */
if (rc != VINF_SUCCESS)
{
goto failure;
}
#ifdef LOG_ENABLED
Log(("Patch code ----------------------------------------------------------\n"));
patmr3DisasmCodeStream(pVM, PATCHCODE_PTR_GC(pPatch), PATCHCODE_PTR_GC(pPatch), patmr3DisasmCallback, pPatch);
Log(("Patch code ends -----------------------------------------------------\n"));
#endif
return VINF_SUCCESS;
pPatch->nrJumpRecs = 0;
/* Turn this cli patch into a dummy. */
pPatch->pPatchBlockOffset = 0;
// Give back the patch memory we no longer need
return rc;
}
/**
* Creates trampoline code to jump inside an existing patch
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pPatchRec Patch record
*
*/
{
uint32_t orgOffsetPatchMem = ~0;
int rc = VERR_PATCHING_REFUSED;
/* Save original offset (in case of failures later on). */
/* First we check if the duplicate function target lies in some existing function patch already. Will save some space. */
/** @todo we already checked this before */
PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
if (pPatchPage)
{
uint32_t i;
for (i=0;i<pPatchPage->cCount;i++)
{
if (pPatchPage->aPatch[i])
{
{
if (pPatchTargetGC)
break;
}
}
}
}
pPatch->nrPatch2GuestRecs = 0;
pPatch->uCurPatchOffset = 0;
/** @note Set the PATM interrupt flag here; it was cleared before the patched call. (!!!) */
if (VBOX_FAILURE(rc))
goto failure;
#ifdef VBOX_WITH_STATISTICS
if (VBOX_FAILURE(rc))
goto failure;
#endif
if (VBOX_FAILURE(rc))
goto failure;
/*
* Insert into patch to guest lookup tree
*/
LogFlow(("Insert %VGv patch offset %VGv\n", pPatchRec->patch.pPrivInstrGC, pPatch->pPatchBlockOffset));
rc = RTAvloGCPtrInsert(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, &pPatchRec->CoreOffset);
if (!rc)
{
goto failure;
}
/* size of patch block */
/* Update free pointer in patch memory. */
/* Round to next 8 byte boundary */
/* There's no jump from guest to patch code. */
pPatch->cbPatchJump = 0;
/* Enable the patch. */
/* We allow this patch to be called as a function. */
return VINF_SUCCESS;
pPatch->nrJumpRecs = 0;
/* Turn this cli patch into a dummy. */
pPatch->pPatchBlockOffset = 0;
// Give back the patch memory we no longer need
return rc;
}
/**
* (in responds to a VINF_PATM_DUPLICATE_FUNCTION GC exit reason)
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCtx Guest context
*
*/
{
int rc;
RTGCPTR pPatchTargetGC = 0;
/* First we check if the duplicate function target lies in some existing function patch already. Will save some space. */
PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
if (pPatchPage)
{
uint32_t i;
for (i=0;i<pPatchPage->cCount;i++)
{
if (pPatchPage->aPatch[i])
{
{
if (pPatchTargetGC)
{
break;
}
}
}
}
}
if (pPatchTargetGC)
{
/* Create a trampoline that also sets PATM_INTERRUPTFLAG. */
}
else
{
}
if (rc == VINF_SUCCESS)
{
}
if (pPatchTargetGC)
{
}
else
{
/* We add a dummy entry into the lookup cache so we won't get bombarded with the same requests over and over again. */
}
return VINF_SUCCESS;
}
/**
* Replaces a function call by a call to an existing function duplicate (or jmp -> jmp)
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCpu Disassembly CPU structure ptr
* @param pInstrGC Guest context point to privileged instruction
* @param pPatch Patch record
*
*/
{
int rc = VERR_PATCHING_REFUSED;
bool disret;
#ifdef LOG_ENABLED
char szOutput[256];
#endif
Assert((pCpu->pCurInstr->opcode == OP_CALL || pCpu->pCurInstr->opcode == OP_JMP) && pCpu->opsize == SIZEOF_NEARJUMP32);
if ((pCpu->pCurInstr->opcode != OP_CALL && pCpu->pCurInstr->opcode != OP_JMP) || pCpu->opsize != SIZEOF_NEARJUMP32)
{
goto failure;
}
if (pTargetGC == 0)
{
goto failure;
}
pPatchFunction = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pTargetGC);
if (pPatchFunction == NULL)
{
for(;;)
{
/* It could be an indirect call (call -> jmp dest).
* Note that it's dangerous to assume the jump will never change...
*/
if (pTmpInstrHC == 0)
break;
break;
if (pTargetGC == 0)
{
break;
}
pPatchFunction = (PPATMPATCHREC)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pTargetGC);
break;
}
if (pPatchFunction == 0)
{
goto failure;
}
}
// make a copy of the guest code bytes that will be overwritten
/* Now replace the original call in the guest code */
if (VBOX_FAILURE(rc))
goto failure;
/* Lowest and highest address for write monitoring. */
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
#endif
return VINF_SUCCESS;
/* Turn this patch into a dummy. */
return rc;
}
/**
* Replace the address in an MMIO instruction with the cached version.
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pCpu Disassembly CPU structure ptr
* @param pPatch Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
{
int rc = VERR_PATCHING_REFUSED;
#ifdef LOG_ENABLED
bool disret;
char szOutput[256];
#endif
goto failure;
goto failure;
/* Add relocation record for cached data access. */
if (patmPatchAddReloc32(pVM, pPatch, &pPB[pCpu->opsize - sizeof(RTGCPTR)], FIXUP_ABSOLUTE, pPatch->pPrivInstrGC, pVM->patm.s.mmio.pCachedData) != VINF_SUCCESS)
{
Log(("Relocation failed for cached mmio address!!\n"));
return VERR_PATCHING_REFUSED;
}
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
#endif
/* Save original instruction. */
pPatch->cbPatchJump = pPatch->cbPrivInstr; /* bit of a misnomer in this case; size of replacement instruction. */
/* Replace address with that of the cached item. */
rc = PGMPhysWriteGCPtrDirty(pVM, pInstrGC + pCpu->opsize - sizeof(RTGCPTR), &pVM->patm.s.mmio.pCachedData, sizeof(RTGCPTR));
if (VBOX_FAILURE(rc))
{
goto failure;
}
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
#endif
return VINF_SUCCESS;
/* Turn this patch into a dummy. */
return rc;
}
/**
* Replace the address in an MMIO instruction with the cached version. (instruction is part of an existing patch)
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pPatch Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
{
bool disret;
#ifdef LOG_ENABLED
char szOutput[256];
#endif
/* Convert GC to HC address. */
/* Disassemble mmio instruction. */
if (disret == false)
{
Log(("Disassembly failed (probably page not present) -> return to caller\n"));
return VERR_PATCHING_REFUSED;
}
if (opsize > MAX_INSTR_SIZE)
return VERR_PATCHING_REFUSED;
return VERR_PATCHING_REFUSED;
/* Add relocation record for cached data access. */
if (patmPatchAddReloc32(pVM, pPatch, &pInstrHC[cpu.opsize - sizeof(RTGCPTR)], FIXUP_ABSOLUTE) != VINF_SUCCESS)
{
Log(("Relocation failed for cached mmio address!!\n"));
return VERR_PATCHING_REFUSED;
}
/* Replace address with that of the cached item. */
/* Lowest and highest address for write monitoring. */
#ifdef LOG_ENABLED
#endif
return VINF_SUCCESS;
}
/**
* Activates an int3 patch
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
/* Replace first opcode byte with 'int 3'. */
return rc;
}
/**
* Deactivates an int3 patch
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
/* Restore first opcode byte. */
return rc;
}
/**
* Replace an instruction with a breakpoint (0xCC), that is handled dynamically in the guest context.
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pInstrHC Host context point to privileged instruction
* @param pCpu Disassembly CPU structure ptr
* @param pPatch Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
PATMR3DECL(int) PATMR3PatchInstrInt3(PVM pVM, RTGCPTR pInstrGC, HCPTRTYPE(uint8_t *) pInstrHC, DISCPUSTATE *pCpu, PPATCHINFO pPatch)
{
int rc;
/** @note Do not use patch memory here! It might called during patch installation too. */
#ifdef LOG_ENABLED
char szOutput[256];
#endif
/* Save the original instruction. */
pPatch->cbPatchJump = sizeof(ASMInt3); /* bit of a misnomer in this case; size of replacement instruction. */
/* Replace first opcode byte with 'int 3'. */
if (VBOX_FAILURE(rc))
goto failure;
/* Lowest and highest address for write monitoring. */
return VINF_SUCCESS;
/* Turn this patch into a dummy. */
return VERR_PATCHING_REFUSED;
}
/**
* Patch a jump instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC Guest context point to privileged instruction
* @param pInstrHC Host context point to privileged instruction
* @param pCpu Disassembly CPU structure ptr
* @param pPatchRec Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
int patmPatchJump(PVM pVM, RTGCPTR pInstrGC, HCPTRTYPE(uint8_t *) pInstrHC, DISCPUSTATE *pCpu, PPATMPATCHREC pPatchRec)
{
int rc = VERR_PATCHING_REFUSED;
#ifdef LOG_ENABLED
bool disret;
char szOutput[256];
#endif
pPatch->uCurPatchOffset = 0;
pPatch->cbPatchBlockSize = 0;
/*
* Instruction replacements such as these should never be interrupted. I've added code to EM.cpp to
* make sure this never happens. (unless a trap is triggered (intentionally or not))
*/
{
case OP_JO:
case OP_JNO:
case OP_JC:
case OP_JNC:
case OP_JE:
case OP_JNE:
case OP_JBE:
case OP_JNBE:
case OP_JS:
case OP_JNS:
case OP_JP:
case OP_JNP:
case OP_JL:
case OP_JNL:
case OP_JLE:
case OP_JNLE:
case OP_JMP:
goto failure;
goto failure;
{
AssertMsgFailed(("Patch jump would cross page boundary -> refuse!!\n"));
goto failure;
}
break;
default:
goto failure;
}
// make a copy of the guest code bytes that will be overwritten
/* Now insert a jump in the guest code. */
/*
* A conflict jump patch needs to be treated differently; we'll just replace the relative jump address with one that
* references the target instruction in the conflict patch.
*/
RTGCPTR pJmpDest = PATMR3GuestGCPtrToPatchGCPtr(pVM, pInstrGC + pCpu->opsize + (int32_t)pCpu->param1.parval);
AssertMsg(pJmpDest, ("PATMR3GuestGCPtrToPatchGCPtr failed for %VGv\n", pInstrGC + pCpu->opsize + (int32_t)pCpu->param1.parval));
if (VBOX_FAILURE(rc))
goto failure;
#ifdef LOG_ENABLED
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC, pPatch->pPrivInstrHC, &opsize, szOutput);
#endif
Log(("Successfully installed %s patch at %VGv\n", patmGetInstructionString(pPatch->opcode, pPatch->flags), pInstrGC));
/* Lowest and highest address for write monitoring. */
return VINF_SUCCESS;
/* Turn this cli patch into a dummy. */
return rc;
}
#endif /* PATM_RESOLVE_CONFLICTS_WITH_JUMP_PATCHES */
/**
* Gives hint to PATM about supervisor guest instructions
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context point to privileged instruction
* @param flags Patch flags
*/
{
}
/**
* Patch privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context point to privileged instruction
* @param flags Patch flags
*
* @note returns failure if patching is not allowed or possible
*/
{
bool disret;
int rc;
if (!pVM || pInstrGC == 0 || (flags & ~(PATMFL_CODE32|PATMFL_IDTHANDLER|PATMFL_INTHANDLER|PATMFL_SYSENTER|PATMFL_TRAPHANDLER|PATMFL_DUPLICATE_FUNCTION|PATMFL_REPLACE_FUNCTION_CALL|PATMFL_GUEST_SPECIFIC|PATMFL_INT3_REPLACEMENT|PATMFL_TRAPHANDLER_WITH_ERRORCODE|PATMFL_IDTHANDLER_WITHOUT_ENTRYPOINT|PATMFL_MMIO_ACCESS|PATMFL_TRAMPOLINE|PATMFL_INSTR_HINT|PATMFL_JUMP_CONFLICT)))
{
AssertFailed();
return VERR_INVALID_PARAMETER;
}
if (PATMIsEnabled(pVM) == false)
return VERR_PATCHING_REFUSED;
/* Test for patch conflict only with patches that actually change guest code. */
{
AssertReleaseMsg(pConflictPatch == 0, ("Unable to patch overwritten instruction at %VGv (%VGv)\n", pInstrGC, pConflictPatch->pPrivInstrGC));
if (pConflictPatch != 0)
return VERR_PATCHING_REFUSED;
}
if (!(flags & PATMFL_CODE32))
{
/** @todo Only 32 bits code right now */
AssertMsgFailed(("PATMR3InstallPatch: We don't support 16 bits code at this moment!!\n"));
return VERR_NOT_IMPLEMENTED;
}
/* We ran out of patch memory; don't bother anymore. */
return VERR_PATCHING_REFUSED;
/** @note the OpenBSD specific check will break if we allow additional patches to be installed (int 3)) */
if (!(flags & PATMFL_GUEST_SPECIFIC))
{
/* New code. Make sure CSAM has a go at it first. */
}
/** @note obsolete */
&& (flags & PATMFL_MMIO_ACCESS))
{
void *pvPatchCoreOffset;
/* Find the patch record. */
pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, offset, false);
if (pvPatchCoreOffset == NULL)
{
return VERR_PATCH_NOT_FOUND; //fatal error
}
}
if (pPatchRec)
{
/* Hints about existing patches are ignored. */
if (flags & PATMFL_INSTR_HINT)
return VERR_PATCHING_REFUSED;
{
Log(("PATMR3InstallPatch: disable operation is pending for patch at %VGv\n", pPatchRec->patch.pPrivInstrGC));
}
{
/* A patch, for which we previously received a hint, will be enabled and turned into a normal patch. */
{
}
else
/** @todo we shouldn't disable and enable patches too often (it's relatively cheap, but pointless if it always happens) */
if (VBOX_SUCCESS(rc))
return VWRN_PATCH_ENABLED;
return rc;
}
{
/*
* The patch might have been overwritten.
*/
{
/* Patch must have been overwritten; remove it and pretend nothing happened. */
if (pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION|PATMFL_IDTHANDLER|PATMFL_MMIO_ACCESS|PATMFL_INT3_REPLACEMENT|PATMFL_INT3_REPLACEMENT_BLOCK))
{
if (flags & PATMFL_IDTHANDLER)
pPatchRec->patch.flags |= (flags & (PATMFL_IDTHANDLER|PATMFL_TRAPHANDLER|PATMFL_INTHANDLER)); /* update the type */
return VERR_PATM_ALREADY_PATCHED; /* already done once */
}
}
}
else
{
AssertMsg(pPatchRec->patch.uState == PATCH_REFUSED || pPatchRec->patch.uState == PATCH_UNUSABLE, ("Patch an existing patched instruction?!? (%VGv, state=%d)\n", pInstrGC, pPatchRec->patch.uState));
/* already tried it once! */
return VERR_PATCHING_REFUSED;
}
}
if (VBOX_FAILURE(rc))
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
if (rc != VINF_SUCCESS)
{
return rc;
}
/* Disallow patching instructions inside ROM code; complete function duplication is allowed though. */
{
return VERR_PATCHING_REFUSED;
}
if (!(pPatchRec->patch.flags & (PATMFL_DUPLICATE_FUNCTION | PATMFL_IDTHANDLER | PATMFL_SYSENTER | PATMFL_TRAMPOLINE)))
{
/*
* Close proximity to an unusable patch is a possible hint that this patch would turn out to be dangerous too!
*/
PPATMPATCHREC pPatchNear = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, (pInstrGC + SIZEOF_NEARJUMP32 - 1), false);
if (pPatchNear)
{
if (pPatchNear->patch.uState == PATCH_UNUSABLE && pInstrGC < pPatchNear->patch.pPrivInstrGC && pInstrGC + SIZEOF_NEARJUMP32 > pPatchNear->patch.pPrivInstrGC)
{
Log(("Dangerous patch; would overwrite the ususable patch at %VGv\n", pPatchNear->patch.pPrivInstrGC));
/*
* Leave the new patch active as it's marked unusable; to prevent us from checking it over and over again
*/
return VERR_PATCHING_REFUSED;
}
}
}
pPatchRec->patch.pTempInfo = (PPATCHINFOTEMP)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(PATCHINFOTEMP));
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
if (disret == false)
{
Log(("Disassembly failed (probably page not present) -> return to caller\n"));
return VERR_PATCHING_REFUSED;
}
if (opsize > MAX_INSTR_SIZE)
{
return VERR_PATCHING_REFUSED;
}
/* Restricted hinting for now. */
/* Allocate statistics slot */
{
}
else
{
Log(("WARNING: Patch index wrap around!!\n"));
}
{
}
else
{
}
else
{
}
else
{
}
else
{
}
else
{
}
else
{
#ifdef VBOX_WITH_STATISTICS
if ( rc == VINF_SUCCESS
{
}
#endif
}
else
{
{
case OP_SYSENTER:
case OP_PUSHF:
if (rc == VINF_SUCCESS)
{
if (rc == VINF_SUCCESS)
Log(("PATMR3InstallPatch GUEST: %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
return rc;
}
break;
default:
break;
}
}
else
{
{
case OP_SYSENTER:
if (rc == VINF_SUCCESS)
{
Log(("PATMR3InstallPatch GUEST: %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
return VINF_SUCCESS;
}
break;
case OP_JO:
case OP_JNO:
case OP_JC:
case OP_JNC:
case OP_JE:
case OP_JNE:
case OP_JBE:
case OP_JNBE:
case OP_JS:
case OP_JNS:
case OP_JP:
case OP_JNP:
case OP_JL:
case OP_JNL:
case OP_JLE:
case OP_JNLE:
case OP_JECXZ:
case OP_LOOP:
case OP_LOOPNE:
case OP_LOOPE:
case OP_JMP:
{
break;
}
return VERR_NOT_IMPLEMENTED;
#endif
case OP_PUSHF:
case OP_CLI:
Log(("PATMR3InstallPatch %s %VGv code32=%d\n", patmGetInstructionString(pPatchRec->patch.opcode, pPatchRec->patch.flags), pInstrGC, (flags & PATMFL_CODE32) ? 1 : 0));
break;
case OP_STR:
case OP_SGDT:
case OP_SLDT:
case OP_SIDT:
case OP_CPUID:
case OP_LSL:
case OP_LAR:
case OP_SMSW:
case OP_VERW:
case OP_VERR:
case OP_IRET:
break;
default:
return VERR_NOT_IMPLEMENTED;
}
}
if (rc != VINF_SUCCESS)
{
{
}
}
else
{
/* Keep track upper and lower boundaries of patched instructions */
Log(("Patch lowest %VGv highest %VGv\n", pPatchRec->patch.pInstrGCLowest, pPatchRec->patch.pInstrGCHighest));
Log(("Global lowest %VGv highest %VGv\n", pVM->patm.s.pPatchedInstrGCLowest, pVM->patm.s.pPatchedInstrGCHighest));
rc = VINF_SUCCESS;
/* Patch hints are not enabled by default. Only when the are actually encountered. */
{
}
#ifdef VBOX_WITH_STATISTICS
/* Register statistics counter */
{
STAMR3RegisterCallback(pVM, &pPatchRec->patch, STAMVISIBILITY_NOT_GUI, STAMUNIT_GOOD_BAD, patmResetStat, patmPrintStat, "Patch statistics",
#ifndef DEBUG_sandervl
/* Full breakdown for the GUI. */
STAMR3RegisterF(pVM, &pVM->patm.s.pStatsHC[pPatchRec->patch.uPatchIdx], STAMTYPE_RATIO_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_GOOD_BAD, PATMPatchType(pVM, &pPatchRec->patch),
STAMR3RegisterF(pVM, &pPatchRec->patch.cbPatchBlockSize,STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPatchBlockSize", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.cbPatchJump, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPatchJump", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.cbPrivInstr, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cbPrivInstr", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.cCodeWrites, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cCodeWrites", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.cInvalidWrites, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cInvalidWrites", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.cTraps, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/cTraps", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.flags, STAMTYPE_X32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/flags", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.nrJumpRecs, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/nrJumpRecs", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.nrFixups, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/nrFixups", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.opcode, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, NULL, "/PATM/Stats/PatchBD/0x%VGv/opcode", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.uOldState, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uOldState", pPatchRec->patch.pPrivInstrGC);
STAMR3RegisterF(pVM, &pPatchRec->patch.uOpMode, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uOpMode", pPatchRec->patch.pPrivInstrGC);
/// @todo change the state to be a callback so we can get a state mnemonic instead.
STAMR3RegisterF(pVM, &pPatchRec->patch.uState, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_NONE, NULL, "/PATM/Stats/PatchBD/0x%VGv/uState", pPatchRec->patch.pPrivInstrGC);
#endif
}
#endif
}
return rc;
}
/**
* Query instruction size
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
* @param pInstrGC Instruction address
*/
{
if (rc == VINF_SUCCESS)
{
bool disret;
if (disret)
return opsize;
}
return 0;
}
/**
* Add patch to page record
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPage Page address
* @param pPatch Patch record
*/
{
int rc;
pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
if (pPatchPage)
{
{
rc = MMHyperAlloc(pVM, sizeof(PPATCHINFO)*pPatchPage->cMaxPatches, 0, MM_TAG_PATM_PATCH, (void **)&pPatchPage->aPatch);
if (VBOX_FAILURE(rc))
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
}
pPatchPage->cCount++;
}
else
{
if (VBOX_FAILURE(rc))
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
rc = MMHyperAlloc(pVM, sizeof(PPATCHINFO)*PATMPATCHPAGE_PREALLOC_INCREMENT, 0, MM_TAG_PATM_PATCH, (void **)&pPatchPage->aPatch);
if (VBOX_FAILURE(rc))
{
Log(("Out of memory!!!!\n"));
return VERR_NO_MEMORY;
}
}
/* Get the closest guest instruction (from below) */
PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGetBestFit(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)pPage, true);
if (pGuestToPatchRec)
{
if ( pPatchPage->pLowestAddrGC == 0
{
/* If we're too close to the page boundary, then make sure an instruction from the previous page doesn't cross the boundary itself. */
{
/* Get the closest guest instruction (from above) */
pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGetBestFit(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)(pPage-1), false);
if (pGuestToPatchRec)
{
}
}
}
}
/* Get the closest guest instruction (from above) */
pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGetBestFit(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)(pPage+PAGE_SIZE-1), false);
if (pGuestToPatchRec)
{
if ( pPatchPage->pHighestAddrGC == 0
{
/* Increase by instruction size. */
}
}
return VINF_SUCCESS;
}
/**
* Remove patch from page record
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPage Page address
* @param pPatch Patch record
*/
{
int rc;
pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
if (!pPatchPage)
return VERR_INVALID_PARAMETER;
{
uint32_t i;
/* Used by multiple patches */
for (i=0;i<pPatchPage->cCount;i++)
{
{
pPatchPage->aPatch[i] = 0;
break;
}
}
/* close the gap between the remaining pointers. */
{
memcpy(&pPatchPage->aPatch[i], &pPatchPage->aPatch[i+1], sizeof(PPATCHINFO)*(pPatchPage->cCount - (i+1)));
}
pPatchPage->cCount--;
}
else
{
pPatchNode = (PPATMPATCHPAGE)RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, pPage);
}
return VINF_SUCCESS;
}
/**
* Insert page records for all guest pages that contain instructions that were recompiled for this patch
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
/* Insert the pages that contain patched instructions into a lookup tree for detecting self-modifying code. */
/** @todo optimize better (large gaps between current and next used page) */
{
/* Get the closest guest instruction (from above) */
PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGetBestFit(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)pPage, true);
if ( pGuestToPatchRec
)
{
/* Code in page really patched -> add record */
}
}
return VINF_SUCCESS;
}
/**
* Remove page records for all guest pages that contain instructions that were recompiled for this patch
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*/
{
int rc;
/* Insert the pages that contain patched instructions into a lookup tree for detecting self-modifying code. */
{
/* Get the closest guest instruction (from above) */
PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGetBestFit(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)pPage, true);
if ( pGuestToPatchRec
)
{
/* Code in page really patched -> remove record */
}
}
return VINF_SUCCESS;
}
/**
* Notifies PATM about a (potential) write to code that has been patched.
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param GCPtr GC pointer to write address
* @param cbWrite Nr of bytes to write
*
*/
{
/* Quick boundary check */
)
return VINF_SUCCESS;
{
PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
if (pPatchPage)
{
uint32_t i;
bool fValidPatchWrite = false;
for (i=0;i<pPatchPage->cCount;i++)
{
if (pPatchPage->aPatch[i])
{
//unused: bool fForceBreak = false;
/** @todo inefficient and includes redundant checks for multiple pages. */
{
if ( pPatch->cbPatchJump
{
/* The guest is about to overwrite the 5 byte jump to patch code. Remove the patch. */
Log(("PATMR3PatchWrite: overwriting jump to patch code -> remove patch.\n"));
/** @note jump back to the start as the pPatchPage has been deleted or changed */
goto loop_start;
}
if (pPatchInstrGC)
{
RTGCUINTPTR PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC; /* Offset in memory reserved for PATM. */
fValidPatchWrite = true;
PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
{
{
LogRel(("PATM: Disable block at %VGv - write %VGv-%VGv\n", pPatch->pPrivInstrGC, pGuestPtrGC, pGuestPtrGC+cbWrite));
/** @note jump back to the start as the pPatchPage has been deleted or changed */
goto loop_start;
}
else
{
/* Replace the patch instruction with a breakpoint; when it's hit, then we'll attempt to recompile the instruction again. */
pPatchToGuestRec->fDirty = true;
*pInstrHC = 0xCC;
}
}
/* else already marked dirty */
}
}
}
} /* for each patch */
if (fValidPatchWrite == false)
{
/* Write to a part of the page that either:
* - old code page that's no longer in active use.
*/
pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, (RTGCPTR)pPage);
if (pPatchPage)
{
for (i=0;i<pPatchPage->cCount;i++)
{
{
LogRel(("PATM: Disable block at %VGv - invalid write %VGv-%VGv \n", pPatch->pPrivInstrGC, GCPtr, GCPtr+cbWrite));
/** @note jump back to the start as the pPatchPage has been deleted or changed */
goto invalid_write_loop_start;
}
}
}
}
}
}
return VINF_SUCCESS;
}
/**
* Disable all patches in a flushed page
*
* @returns VBox status code
* @param pVM The VM to operate on.
* @param addr GC address of the page to flush
*/
/** @note Currently only called by CSAMR3FlushPage; optimization to avoid having to double check if the physical address has changed
*/
{
PPATMPATCHPAGE pPatchPage = (PPATMPATCHPAGE)RTAvloGCPtrGet(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPage, addr);
if (pPatchPage)
{
int i;
/* From top to bottom as the array is modified by PATMR3MarkDirtyPatch. */
{
if (pPatchPage->aPatch[i])
{
}
}
}
return VINF_SUCCESS;
}
/**
* Checks if the instructions at the specified address has been patched already.
*
* @returns boolean, patched or not
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to instruction
*/
{
return true;
return false;
}
/**
* Query the opcode of the original code that was overwritten by the 5 bytes patch jump
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstrGC GC address of instr
* @param pByte opcode byte pointer (OUT)
*
*/
{
/** @todo this will not work for aliased pages! (never has, but so far not a problem for us) */
/* Shortcut. */
if ( !PATMIsEnabled(pVM)
{
return VERR_PATCH_NOT_FOUND;
}
pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
// if the patch is enabled and the pointer lies within 5 bytes of this priv instr ptr, then we've got a hit!
if ( pPatchRec
{
{
}
return VINF_SUCCESS;
}
return VERR_PATCH_NOT_FOUND;
}
/**
* Disable patch for privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context point to privileged instruction
*
* @note returns failure if patching is not allowed or possible
*
*/
{
if (pPatchRec)
{
int rc = VINF_SUCCESS;
/* Already disabled? */
return VINF_SUCCESS;
/* Clear the IDT entries for the patch we're disabling. */
/** @note very important as we clear IF in the patch itself */
/** @todo this needs to be changed */
{
{
}
}
/* Mark the entry with a breakpoint in case somebody else calls it later on (cli patch used as a function, function, trampoline or idt patches) */
if ( pPatch->pPatchBlockOffset
{
}
/* IDT or function patches haven't changed any guest code. */
{
Assert(!(pPatch->flags & (PATMFL_DUPLICATE_FUNCTION|PATMFL_IDTHANDLER|PATMFL_TRAMPOLINE|PATMFL_INT3_REPLACEMENT|PATMFL_INT3_REPLACEMENT_BLOCK)));
{
/** pPrivInstrHC is probably not valid anymore */
rc = PGMPhysGCPtr2HCPtr(pVM, pPatchRec->patch.pPrivInstrGC, (PRTHCPTR)&pPatchRec->patch.pPrivInstrHC);
if (rc == VINF_SUCCESS)
{
/* Let's first check if the guest code is still the same. */
if (rc == VINF_SUCCESS)
{
RTGCINTPTR displ = (RTGCUINTPTR)PATCHCODE_PTR_GC(pPatch) - ((RTGCUINTPTR)pPatch->pPrivInstrGC + SIZEOF_NEARJUMP32);
)
{
Log(("PATMR3DisablePatch: Can't disable a patch who's guest code has changed!!\n"));
/* Remove it completely */
return VWRN_PATCH_REMOVED;
}
}
}
else
{
Log(("PATMR3DisablePatch: unable to disable patch -> mark PATCH_DISABLE_PENDING\n"));
}
}
else
{
AssertMsgFailed(("Patch was refused!\n"));
return VERR_PATCH_ALREADY_DISABLED;
}
}
else
{
/* Let's first check if the guest code is still the same. */
if (rc == VINF_SUCCESS)
{
if (temp[0] != 0xCC)
{
Log(("PATMR3DisablePatch: Can't disable a patch who's guest code has changed!!\n"));
/* Remove it completely */
return VWRN_PATCH_REMOVED;
}
}
}
if (rc == VINF_SUCCESS)
{
/* Save old state and mark this one as disabled (so it can be enabled later on). */
{
/* Just to be safe, let's make sure this one can never be reused; the patch might be marked dirty already (int3 at start) */
}
else
{
}
}
return VINF_SUCCESS;
}
Log(("Patch not found!\n"));
return VERR_PATCH_NOT_FOUND;
}
/**
* Permanently disable patch for privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context instruction pointer
* @param pConflictAddr Guest context pointer which conflicts with specified patch
* @param pConflictPatch Conflicting patch
*
*/
static int patmDisableUnusablePatch(PVM pVM, RTGCPTR pInstrGC, RTGCPTR pConflictAddr, PPATCHINFO pConflictPatch)
{
bool disret;
int rc;
/*
* If it's a 5 byte relative jump, then we can work around the problem by replacing the 32 bits relative offset
* with one that jumps right into the conflict patch.
* Otherwise we must disable the conflicting patch to avoid serious problems.
*/
if ( disret == true
{
/* Hint patches must be enabled first. */
{
/* Enabling might fail if the patched code has changed in the meantime. */
if (rc != VINF_SUCCESS)
return rc;
}
if (VBOX_SUCCESS(rc))
{
return VINF_SUCCESS;
}
}
#endif
{
/* Turn it into an int3 patch; our GC trap handler will call the generated code manually. */
Log(("PATM -> CONFLICT: Found active patch at instruction %VGv with target %VGv -> turn into int 3 patch!!\n", pInstrGC, pConflictPatch->pPrivInstrGC));
if (rc == VWRN_PATCH_REMOVED)
return VINF_SUCCESS;
if (VBOX_SUCCESS(rc))
{
if (rc == VERR_PATCH_NOT_FOUND)
return VINF_SUCCESS; /* removed already */
if (VBOX_SUCCESS(rc))
{
return VINF_SUCCESS;
}
}
/* else turned into unusable patch (see below) */
}
else
{
Log(("PATM -> CONFLICT: Found active patch at instruction %VGv with target %VGv -> DISABLING it!!\n", pInstrGC, pConflictPatch->pPrivInstrGC));
if (rc == VWRN_PATCH_REMOVED)
return VINF_SUCCESS;
}
/* No need to monitor the code anymore. */
{
}
return VERR_PATCH_DISABLED;
}
/**
* Enable patch for privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context point to privileged instruction
*
* @note returns failure if patching is not allowed or possible
*
*/
{
if (pPatchRec)
{
int rc = VINF_SUCCESS;
{
{
/** @todo -> pPrivInstrHC is probably not valid anymore */
rc = PGMPhysGCPtr2HCPtr(pVM, pPatchRec->patch.pPrivInstrGC, (PRTHCPTR)&pPatchRec->patch.pPrivInstrHC);
if (rc == VINF_SUCCESS)
{
#ifdef DEBUG
char szOutput[256];
#endif
// let's first check if the guest code is still the same
{
Log(("PATMR3EnablePatch: Can't enable a patch who's guest code has changed!!\n"));
/* Remove it completely */
return VERR_PATCH_NOT_FOUND;
}
if (VBOX_FAILURE(rc))
return rc;
#ifdef DEBUG
bool disret;
i = 0;
while(i < pPatch->cbPatchJump)
{
disret = PATMR3DISInstr(pVM, pPatch, &cpu, pPatch->pPrivInstrGC + i, &pPatch->pPrivInstrHC[i], &opsize, szOutput);
i += opsize;
}
#endif
}
}
else
{
/* Let's first check if the guest code is still the same. */
{
Log(("PATMR3EnablePatch: Can't enable a patch who's guest code has changed!!\n"));
return VERR_PATCH_NOT_FOUND;
}
if (VBOX_FAILURE(rc))
return rc;
}
/* Restore the entry breakpoint with the original opcode (see PATMR3DisablePatch). */
if (pPatch->pPatchBlockOffset)
{
}
}
else
return rc;
}
return VERR_PATCH_NOT_FOUND;
}
/**
* Remove patch for privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatchRec Patch record
* @param fForceRemove Remove *all* patches
*/
{
/* Strictly forbidden to remove such patches. There can be dependencies!! */
/** @note NEVER EVER REUSE PATCH MEMORY */
/** @note PATMR3DisablePatch put a breakpoint (0xCC) at the entry of this patch */
{
pNode = RTAvloGCPtrRemove(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchRec->patch.pPatchBlockOffset);
}
{
}
#ifdef VBOX_WITH_STATISTICS
{
#ifndef DEBUG_sandervl
#endif
}
#endif
/** @note no need to free Guest2PatchAddrTree as those records share memory with Patch2GuestAddrTree records. */
pPatch->nrPatch2GuestRecs = 0;
/** @note might fail, because it has already been removed (e.g. during reset). */
/* Free the patch record */
return VINF_SUCCESS;
}
/**
* Find patch for privileged instruction at specified location
*
* @returns Patch structure pointer if found; else NULL
* @param pVM The VM to operate on.
* @param pInstr Guest context point to instruction that might lie within 5 bytes of an existing patch jump
* @param fIncludeHints Include hinted patches or not
*
*/
{
PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
/* if the patch is enabled, the pointer is not indentical to the privileged patch ptr and it lies within 5 bytes of this priv instr ptr, then we've got a hit! */
if (pPatchRec)
{
{
}
else
if ( fIncludeHints
{
}
}
return NULL;
}
/**
* Checks whether the GC address is inside a generated patch jump
*
* @returns true -> yes, false -> no
* @param pVM The VM to operate on.
* @param pAddr Guest context address
* @param pPatchAddr Guest context patch address (if true)
*/
{
if (PATMIsEnabled(pVM) == false)
return false;
if (pPatchAddr == NULL)
pPatchAddr = &addr;
*pPatchAddr = 0;
if (pPatch)
{
}
return *pPatchAddr == 0 ? false : true;
}
/**
* Remove patch for privileged instruction at specified location
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pInstr Guest context point to privileged instruction
*
* @note returns failure if patching is not allowed or possible
*
*/
{
if (pPatchRec)
{
if (rc == VWRN_PATCH_REMOVED)
return VINF_SUCCESS;
}
AssertFailed();
return VERR_PATCH_NOT_FOUND;
}
/**
* Mark patch as dirty
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch record
*
* @note returns failure if patching is not allowed or possible
*
*/
{
if (pPatch->pPatchBlockOffset)
{
}
/* Put back the replaced instruction. */
if (rc == VWRN_PATCH_REMOVED)
return VINF_SUCCESS;
/** @note we don't restore patch pages for patches that are not enabled! */
/** @note be careful when changing this behaviour!! */
/* The patch pages are no longer marked for self-modifying code detection */
{
}
/* Paranoia; make sure this patch is not somewhere in the callchain, so prevent ret instructions from succeeding. */
return VINF_SUCCESS;
}
/**
* Query the corresponding GC instruction pointer from a pointer inside the patch block itself
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pPatch Patch block structure pointer
* @param pPatchGC GC address in patch block
*/
{
/* Get the closest record from below. */
PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)(pPatchGC - pVM->patm.s.pPatchMemGC), false);
if (pPatchToGuestRec)
return pPatchToGuestRec->pOrgInstrGC;
return 0;
}
/* Converts Guest code GC ptr to Patch code GC ptr (if found)
*
* @returns corresponding GC pointer in patch block
* @param pVM The VM to operate on.
* @param pPatch Current patch block pointer
* @param pInstrGC Guest context pointer to privileged instruction
*
*/
{
if (pPatch->Guest2PatchAddrTree)
{
PRECGUESTTOPATCH pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGet(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)pInstrGC);
if (pGuestToPatchRec)
}
return 0;
}
/* Converts Guest code GC ptr to Patch code GC ptr (if found)
*
* @returns corresponding GC pointer in patch block
* @param pVM The VM to operate on.
* @param pInstrGC Guest context pointer to privileged instruction
*
*/
{
PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, pInstrGC, false);
if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED && pInstrGC >= pPatchRec->patch.pPrivInstrGC)
{
}
return 0;
}
/**
* Query the corresponding GC instruction pointer from a pointer inside the patch block itself
*
* @returns original GC instruction pointer or 0 if not found
* @param pVM The VM to operate on.
* @param pPatchGC GC address in patch block
* @param pEnmState State of the translated address (out)
*
*/
{
void *pvPatchCoreOffset;
pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, pPatchGC - pVM->patm.s.pPatchMemGC, false);
if (pvPatchCoreOffset == 0)
{
Log(("PATMR3PatchToGCPtr failed for %VGv offset %x\n", pPatchGC, pPatchGC - pVM->patm.s.pPatchMemGC));
return 0;
}
if (pEnmState)
{
if ( !pPrivInstrGC
{
pPrivInstrGC = 0;
}
else
{
}
else
{
}
else
{
}
else
{
}
else
}
return pPrivInstrGC;
}
/**
* Returns the GC pointer of the patch for the specified GC address
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pAddrGC Guest context address
*/
{
// Find the patch record
if (pPatchRec)
{
}
return 0;
}
/**
* Handle traps in patch code.
*
* The current guest trap has an EIP inside patch code space.
*
* @returns On success VINF_SUCCESS or between VINF_EM_FIRST and VINF_EM_LAST.
* @returns On failure appropriate status code.
* @param pVM VM Handle.
* @param rc The GC return code.
*/
{
/** @todo Implement PATMR3Trap! */
return VERR_NOT_IMPLEMENTED;
}
/**
* Attempt to recover dirty instructions
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCtx CPU context
* @param pPatch Patch record
* @param pPatchToGuestRec Patch to guest address record
* @param pEip GC pointer of trapping instruction
*/
static int patmR3HandleDirtyInstr(PVM pVM, PCPUMCTX pCtx, PPATMPATCHREC pPatch, PRECPATCHTOGUEST pPatchToGuestRec, RTGCPTR pEip)
{
int rc;
Log(("patmR3HandleDirtyInstr: dirty instruction at %VGv (%VGv)\n", pEip, pPatchToGuestRec->pOrgInstrGC));
cbDirty = 0;
/* Find all adjacent dirty instructions */
while (true)
{
/* Restore original instruction opcode byte so we can check if the write was indeed safe. */
/* Only harmless instructions are acceptable. */
break;
#ifdef DEBUG
char szBuf[256];
szBuf[0] = '\0';
#endif
/** Remove old lookup record. */
/* Mark as clean; if we fail we'll let it always fault. */
/* Let's see if there's another dirty instruction right after. */
pRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->patch.Patch2GuestAddrTree, (AVLPVKEY)(pCurPatchInstrGC - pVM->patm.s.pPatchMemGC), true);
break; /* no more dirty instructions */
}
if ( VBOX_SUCCESS(rc)
)
{
{
bool fValidInstr;
if ( !fValidInstr
)
{
)
{
/* A relative jump to an instruction inside or to the end of the dirty block is acceptable. */
fValidInstr = true;
}
}
/* If the instruction is completely harmless (which implies a 1:1 patch copy). */
if ( rc == VINF_SUCCESS
&& fValidInstr
)
{
#ifdef DEBUG
char szBuf[256];
szBuf[0] = '\0';
#endif
/* Copy the new instruction. */
/* Add a new lookup record for the duplicated instruction. */
}
else
{
#ifdef DEBUG
char szBuf[256];
szBuf[0] = '\0';
#endif
break;
}
}
}
else
if (VBOX_SUCCESS(rc))
{
}
else
{
/* Mark the whole instruction stream with breakpoints. */
}
return rc;
}
/**
* Handle trap inside patch code
*
* @returns VBox status code.
* @param pVM The VM to operate on.
* @param pCtx CPU context
* @param pEip GC pointer of trapping instruction
* @param ppNewEip GC pointer to new instruction
*/
{
PPATMPATCHREC pPatch = 0;
void *pvPatchCoreOffset;
int rc ;
pNewEip = 0;
*ppNewEip = 0;
/* Find the patch record. */
/** @note there might not be a patch to guest translation record (global function) */
pvPatchCoreOffset = RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTreeByPatchAddr, offset, false);
if (pvPatchCoreOffset)
{
{
{
/* Function duplication patches set fPIF to 1 on entry */
}
}
else
{
{
/* Function duplication patches set fPIF to 1 on entry */
}
}
else
{
Log(("PATMR3HandleTrap: disable operation is pending for patch at %VGv\n", pPatch->patch.pPrivInstrGC));
AssertReleaseMsg(rc != VWRN_PATCH_REMOVED, ("PATMR3DisablePatch removed patch at %VGv\n", pPrivInstrGC));
AssertMsg(pPatch->patch.uState == PATCH_DISABLED || pPatch->patch.uState == PATCH_UNUSABLE, ("Unexpected failure to disable patch state=%d rc=%Vrc\n", pPatch->patch.uState, rc));
}
pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->patch.Patch2GuestAddrTree, (AVLPVKEY)offset, false);
AssertReleaseMsg(pPatchToGuestRec, ("PATMR3HandleTrap: Unable to find corresponding guest address for %VGv (offset %x)\n", pEip, offset));
}
else
AssertReleaseMsg(pVM->patm.s.pGCStateHC->fPIF == 0, ("PATMR3HandleTrap: Unable to find translation record for %VGv (PIF=0)\n", pEip));
/* Check if we were interrupted in PATM generated instruction code. */
{
if ( rc == VINF_SUCCESS
)
{
/* Typical pushf (most patches)/push (call patch) trap because of a monitored page. */
if (rc == VINF_SUCCESS)
{
/* The guest page *must* be present. */
{
return VINF_PATCH_CONTINUE;
}
}
}
char szBuf[256];
szBuf[0] = '\0';
/* Very bad. We crashed in emitted code. Probably stack? */
if (pPatch)
{
("Crash in patch code %VGv (%VGv) esp=%RX32\nPatch state=%x flags=%x fDirty=%d\n%s\n", pEip, pNewEip, CPUMGetGuestESP(pVM), pPatch->patch.uState, pPatch->patch.flags, pPatchToGuestRec->fDirty, szBuf));
}
else
}
/* From here on, we must have a valid patch to guest translation. */
if (pvPatchCoreOffset == 0)
{
return VERR_PATCH_NOT_FOUND; //fatal error
}
if (pPatchToGuestRec->fDirty)
{
if (VBOX_SUCCESS(rc))
{
/* Retry the current instruction. */
}
else
return rc;
}
#ifdef VBOX_STRICT
{
bool disret;
disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_RAWCODE);
{
int rc;
Log(("Expected return address %VGv found address %VGv Psp=%x\n", pVM->patm.s.pGCStackHC[(pVM->patm.s.pGCStateHC->Psp+PATM_STACK_SIZE)/sizeof(RTGCPTR)], retaddr, pVM->patm.s.pGCStateHC->Psp));
}
}
#endif
/* Return value. */
/* Reset the PATM stack. */
{
/* Must be a faulting instruction after sti; currently only sysexit, hlt or iret */
#ifdef VBOX_STRICT
bool disret;
disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_ORGCODE);
if (disret && (cpu.pCurInstr->opcode == OP_SYSEXIT || cpu.pCurInstr->opcode == OP_HLT || cpu.pCurInstr->opcode == OP_INT3))
{
disret = PATMR3DISInstr(pVM, &pPatch->patch, &cpu, pNewEip, PATMGCVirtToHCVirt(pVM, &pPatch->patch, pNewEip), &opsize, NULL, PATMREAD_RAWCODE);
Assert(cpu.pCurInstr->opcode == OP_SYSEXIT || cpu.pCurInstr->opcode == OP_HLT || cpu.pCurInstr->opcode == OP_IRET);
}
#endif
}
Log2(("pPatchBlockGC %VGv - pEip %VGv corresponding GC address %VGv\n", PATCHCODE_PTR_GC(&pPatch->patch), pEip, pNewEip));
if (pNewEip >= pPatch->patch.pPrivInstrGC && pNewEip < pPatch->patch.pPrivInstrGC + pPatch->patch.cbPatchJump)
{
/* We can't jump back to code that we've overwritten with a 5 byte jump! */
Log(("Disabling patch at location %VGv due to trap too close to the privileged instruction \n", pPatch->patch.pPrivInstrGC));
return VERR_PATCH_DISABLED;
}
/** @todo compare to nr of successful runs. add some aging algorithm and determine the best time to disable the patch */
{
Log(("Disabling patch at location %VGv due to too many traps inside patch code\n", pPatch->patch.pPrivInstrGC));
//we are only wasting time, back out the patch
pTrapRec->pNextPatchInstr = 0;
return VERR_PATCH_DISABLED;
}
#endif
return VINF_SUCCESS;
}
/**
* Handle page-fault in monitored page
*
* @returns VBox status code.
* @param pVM The VM to operate on.
*/
{
PPATMPATCHREC pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, addr, false);
if (pPatchRec && pPatchRec->patch.uState == PATCH_ENABLED && PAGE_ADDRESS(pPatchRec->patch.pPrivInstrGC) == PAGE_ADDRESS(addr))
{
if (rc == VWRN_PATCH_REMOVED)
return VINF_SUCCESS;
addr++;
}
for(;;)
{
pPatchRec = (PPATMPATCHREC)RTAvloGCPtrGetBestFit(&pVM->patm.s.PatchLookupTreeHC->PatchTree, addr, true);
break;
{
}
}
return VINF_SUCCESS;
}
#ifdef VBOX_WITH_STATISTICS
{
{
return "SYSENT";
}
else
{
static char szTrap[16];
if (iGate < 256)
RTStrPrintf(szTrap, sizeof(szTrap), (pPatch->flags & PATMFL_INTHANDLER) ? "INT-%2X" : "TRAP-%2X", iGate);
else
return szTrap;
}
else
return "DUPFUNC";
else
return "FUNCCALL";
else
return "TRAMP";
else
}
{
{
case PATCH_ENABLED:
return "ENA";
case PATCH_DISABLED:
return "DIS";
case PATCH_DIRTY:
return "DIR";
case PATCH_UNUSABLE:
return "UNU";
case PATCH_REFUSED:
return "REF";
case PATCH_DISABLE_PENDING:
return "DIP";
default:
AssertFailed();
return " ";
}
}
/**
* Resets the sample.
* @param pVM The VM handle.
* @param pvSample The sample registered using STAMR3RegisterCallback.
*/
{
}
/**
* Prints the sample into the buffer.
*
* @param pVM The VM handle.
* @param pvSample The sample registered using STAMR3RegisterCallback.
* @param pszBuf The buffer to print into.
* @param cchBuf The size of the buffer.
*/
{
}
/**
* Returns the GC address of the corresponding patch statistics counter
*
* @returns Stat address
* @param pVM The VM to operate on.
* @param pPatch Patch structure
*/
{
return pVM->patm.s.pStatsGC + sizeof(STAMRATIOU32) * pPatch->uPatchIdx + RT_OFFSETOF(STAMRATIOU32, u32A);
}
#endif /* VBOX_WITH_STATISTICS */
#ifdef VBOX_WITH_DEBUGGER
/**
* The '.patmoff' command.
*
* @returns VBox status.
* @param pCmd Pointer to the command descriptor (as registered).
* @param pCmdHlp Pointer to command helper functions.
* @param pVM Pointer to the current VM (if any).
* @param paArgs Pointer to (readonly) array of arguments.
* @param cArgs Number of arguments in the array.
*/
static DECLCALLBACK(int) patmr3CmdOff(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
{
/*
* Validate input.
*/
if (!pVM)
PATMR3AllowPatching(pVM, false);
}
/**
* The '.patmon' command.
*
* @returns VBox status.
* @param pCmd Pointer to the command descriptor (as registered).
* @param pCmdHlp Pointer to command helper functions.
* @param pVM Pointer to the current VM (if any).
* @param paArgs Pointer to (readonly) array of arguments.
* @param cArgs Number of arguments in the array.
*/
static DECLCALLBACK(int) patmr3CmdOn(PCDBGCCMD pCmd, PDBGCCMDHLP pCmdHlp, PVM pVM, PCDBGCVAR paArgs, unsigned cArgs, PDBGCVAR pResult)
{
/*
* Validate input.
*/
if (!pVM)
PATMR3AllowPatching(pVM, true);
}
#endif