CSAMRC.cpp revision fa8716d08ff627a8e1c14bcac56e8e3867b3f795
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync/* $Id$ */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync/** @file
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * CSAM - Guest OS Code Scanning and Analysis Manager - Any Context
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync/*
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Copyright (C) 2006-2007 Oracle Corporation
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync *
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * This file is part of VirtualBox Open Source Edition (OSE), as
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * available from http://www.virtualbox.org. This file is free software;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * you can redistribute it and/or modify it under the terms of the GNU
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * General Public License (GPL) as published by the Free Software
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Foundation, in version 2 as it comes in the "COPYING" file of the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync/*******************************************************************************
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync* Header Files *
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync*******************************************************************************/
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#define LOG_GROUP LOG_GROUP_CSAM
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/cpum.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/stam.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/patm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/csam.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/pgm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/mm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/sup.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/mm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#ifdef VBOX_WITH_REM
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync# include <VBox/vmm/rem.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#endif
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/param.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <iprt/avl.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include "CSAMInternal.h"
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/vmm/vm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/dbg.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/err.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/log.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <iprt/assert.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/dis.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <VBox/disopcode.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <iprt/asm.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <iprt/asm-amd64-x86.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#include <iprt/string.h>
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync/**
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * \#PF Handler callback for virtual access handler ranges. (CSAM self-modifying
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * code monitor)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync *
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Important to realize that a physical page in a range can have aliases, and
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * for ALL and WRITE handlers these will also trigger.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync *
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @returns VBox status code (appropriate for GC return).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param pVM Pointer to the VM.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param uErrorCode CPU Error code.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param pRegFrame Trap register frame.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param pvFault The fault address (cr2).
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param pvRange The base address of the handled virtual range.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * @param offRange The offset of the access into this range.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * (If it's a EIP range this is the EIP, if not it's pvFault.)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsyncVMMRCDECL(int) CSAMGCCodePageWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, RTGCPTR pvRange, uintptr_t offRange)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync{
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync PPATMGCSTATE pPATMGCState;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync bool fPatchCode = PATMIsPatchGCAddr(pVM, pRegFrame->eip);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync int rc;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync PVMCPU pVCpu = VMMGetCpu0(pVM);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync NOREF(uErrorCode);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Assert(pVM->csam.s.cDirtyPages < CSAM_MAX_DIRTY_PAGES);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#ifdef VBOX_WITH_REM
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /* Flush the recompilers translation block cache as the guest seems to be modifying instructions. */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync REMFlushTBs(pVM);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync#endif
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync pPATMGCState = PATMQueryGCState(pVM);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Assert(pPATMGCState);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Assert(pPATMGCState->fPIF || fPatchCode);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /** When patch code is executing instructions that must complete, then we must *never* interrupt it. */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (!pPATMGCState->fPIF && fPatchCode)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Log(("CSAMGCCodePageWriteHandler: fPIF=0 -> stack fault in patch generated code at %08RX32!\n", pRegFrame->eip));
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /** @note there are cases when pages previously used for code are now used for stack; patch generated code will fault (pushf))
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Just make the page r/w and continue.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /*
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Make this particular page R/W.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync rc = PGMShwMakePageWritable(pVCpu, pvFault, PGM_MK_PG_IS_WRITE_FAULT);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync AssertMsgRC(rc, ("PGMShwModifyPage -> rc=%Rrc\n", rc));
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync ASMInvalidatePage((void *)(uintptr_t)pvFault);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync return VINF_SUCCESS;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync uint32_t cpl;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (pRegFrame->eflags.Bits.u1VM)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync cpl = 3;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync else
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync cpl = (pRegFrame->ss & X86_SEL_RPL);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Log(("CSAMGCCodePageWriteHandler: code page write at %RGv original address %RGv (cpl=%d)\n", pvFault, (RTGCUINTPTR)pvRange + offRange, cpl));
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /* If user code is modifying one of our monitored pages, then we can safely make it r/w as it's no longer being used for supervisor code. */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (cpl != 3)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync rc = PATMGCHandleWriteToPatchPage(pVM, pRegFrame, (RTRCPTR)((RTRCUINTPTR)pvRange + offRange), 4 /** @todo */);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (rc == VINF_SUCCESS)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync return rc;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (rc == VINF_EM_RAW_EMULATE_INSTR)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync {
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync STAM_COUNTER_INC(&pVM->csam.s.StatDangerousWrite);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync return VINF_EM_RAW_EMULATE_INSTR;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Assert(rc == VERR_PATCH_NOT_FOUND);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync }
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync VMCPU_FF_SET(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /* Note that pvFault might be a different address in case of aliases. So use pvRange + offset instead!. */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync pVM->csam.s.pvDirtyBasePage[pVM->csam.s.cDirtyPages] = (RTRCPTR)((RTRCUINTPTR)pvRange + offRange);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync pVM->csam.s.pvDirtyFaultPage[pVM->csam.s.cDirtyPages] = (RTRCPTR)((RTRCUINTPTR)pvRange + offRange);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync if (++pVM->csam.s.cDirtyPages == CSAM_MAX_DIRTY_PAGES)
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync return VINF_CSAM_PENDING_ACTION;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync /*
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync * Make this particular page R/W. The VM_FF_CSAM_FLUSH_DIRTY_PAGE handler will reset it to readonly again.
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync */
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync Log(("CSAMGCCodePageWriteHandler: enabled r/w for page %RGv\n", pvFault));
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync rc = PGMShwMakePageWritable(pVCpu, pvFault, PGM_MK_PG_IS_WRITE_FAULT);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync AssertMsgRC(rc, ("PGMShwModifyPage -> rc=%Rrc\n", rc));
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync ASMInvalidatePage((void *)(uintptr_t)pvFault);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync STAM_COUNTER_INC(&pVM->csam.s.StatCodePageModified);
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync return VINF_SUCCESS;
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync}
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync
4fd606d1f5abe38e1f42c38de1d2e895166bd0f4vboxsync