VirtualBox

Changeset 5342

Show
Ignore:
Timestamp:
10/17/07 09:30:36 (1 year ago)
Author:
vboxsync
Message:

Protect cmpxchg emulation

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/include/VBox/em.h

    r4071 r5342  
    457457EMGCDECL(int) EMGCTrap(PVM pVM, unsigned uTrap, PCPUMCTXCORE pRegFrame); 
    458458 
    459 EMGCDECL(uint32_t) EMGCEmulateLockCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize); 
    460 EMGCDECL(uint32_t) EMGCEmulateCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize); 
     459EMGCDECL(uint32_t) EMGCEmulateLockCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize, uint32_t *pEflags); 
     460EMGCDECL(uint32_t) EMGCEmulateCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize, uint32_t *pEflags); 
    461461 
    462462/** @} */ 

  • trunk/src/VBox/VMM/VMMGC/EMGCA.asm

    r4071 r5342  
    2626;; 
    2727; Emulate lock CMPXCHG instruction, CDECL calling conv. 
    28 ; EMGCDECL(uint32_t) EMGCEmulateLockCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize); 
     28; EMGCDECL(uint32_t) EMGCEmulateLockCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize, uint32_t *pEflags); 
    2929; 
    30 ; @returns EFLAGS after the operation, only arithmetic flags is valid. 
     30; @returns eax=0 if data written, other code - invalid access, #PF was generated. 
    3131; @param    [esp + 04h]    Param 1 - First parameter - pointer to first parameter 
    3232; @param    [esp + 08h]    Param 2 - Second parameter - pointer to second parameter (eax) 
    3333; @param    [esp + 0ch]    Param 3 - Third parameter - third parameter 
    3434; @param    [esp + 10h]    Param 4 - Size of parameters, only 1/2/4 is valid. 
     35; @param    [esp + 14h]    Param 4 - Pointer to eflags (out) 
    3536; @uses     eax, ecx, edx 
    3637; 
    …… 
    7980    pop     eax 
    8081 
     82    mov     edx, [esp + 14h + 4]            ; eflags pointer 
     83    mov     dword [edx], eax 
     84 
    8185    pop     ebx 
     86    mov     eax, VINF_SUCCESS 
    8287    retn 
     88 
     89; Read error - we will be here after our page fault handler. 
     90GLOBALNAME EMGCEmulateLockCmpXchg_Error 
     91    pop     ebx 
     92    mov     eax, VERR_ACCESS_DENIED 
     93    ret 
     94 
    8395ENDPROC     EMGCEmulateLockCmpXchg 
    8496 
    8597;; 
    8698; Emulate CMPXCHG instruction, CDECL calling conv. 
    87 ; EMGCDECL(uint32_t) EMGCEmulateCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize); 
     99; EMGCDECL(uint32_t) EMGCEmulateCmpXchg(RTGCPTR pu32Param1, uint32_t *pu32Param2, uint32_t u32Param3, size_t cbSize, uint32_t *pEflags); 
    88100; 
    89 ; @returns EFLAGS after the operation, only arithmetic flags is valid. 
     101; @returns eax=0 if data written, other code - invalid access, #PF was generated. 
    90102; @param    [esp + 04h]    Param 1 - First parameter - pointer to first parameter 
    91103; @param    [esp + 08h]    Param 2 - Second parameter - pointer to second parameter (eax) 
    92104; @param    [esp + 0ch]    Param 3 - Third parameter - third parameter 
    93105; @param    [esp + 10h]    Param 4 - Size of parameters, only 1/2/4 is valid. 
     106; @param    [esp + 14h]    Param 4 - Pointer to eflags (out) 
    94107; @uses     eax, ecx, edx 
    95108; 
    …… 
    138151    pop     eax 
    139152 
     153    mov     edx, [esp + 14h + 4]        ; eflags pointer 
     154    mov     dword [edx], eax 
     155 
    140156    pop     ebx 
     157    mov     eax, VINF_SUCCESS 
    141158    retn 
     159 
     160; Read error - we will be here after our page fault handler. 
     161GLOBALNAME EMGCEmulateCmpXchg_Error 
     162    pop     ebx 
     163    mov     eax, VERR_ACCESS_DENIED 
     164    ret 
    142165ENDPROC     EMGCEmulateCmpXchg 

  • trunk/src/VBox/VMM/VMMGC/MMRamGC.cpp

    r4071 r5342  
    2424#include <VBox/cpum.h> 
    2525#include <VBox/trpm.h> 
     26#include <VBox/em.h> 
    2627#include "MMInternal.h" 
    2728#include <VBox/vm.h> 
    …… 
    4041DECLASM(void) MMGCRamReadNoTrapHandler_EndProc(void); 
    4142DECLASM(void) MMGCRamWriteNoTrapHandler_EndProc(void); 
    42  
     43DECLASM(void) EMGCEmulateCmpXchg_EndProc(void); 
     44DECLASM(void) EMGCEmulateLockCmpXchg_EndProc(void); 
     45DECLASM(void) EMGCEmulateCmpXchg_Error(void); 
     46DECLASM(void) EMGCEmulateLockCmpXchg_Error(void); 
    4347DECLASM(void) MMGCRamRead_Error(void); 
    4448DECLASM(void) MMGCRamWrite_Error(void); 
    …… 
    166170        return VINF_SUCCESS; 
    167171    } 
     172    else if (    (uintptr_t)&EMGCEmulateLockCmpXchg < (uintptr_t)pRegFrame->eip 
     173             &&  (uintptr_t)pRegFrame->eip < (uintptr_t)&EMGCEmulateLockCmpXchg_EndProc) 
     174    { 
     175        /* 
     176         * Page fault inside EMGCEmulateLockCmpXchg() func. 
     177         */ 
     178 
     179        /* Return execution to func at error label. */ 
     180        pRegFrame->eip = (uintptr_t)&EMGCEmulateLockCmpXchg_Error; 
     181        return VINF_SUCCESS; 
     182    } 
     183    else if (    (uintptr_t)&EMGCEmulateCmpXchg < (uintptr_t)pRegFrame->eip 
     184             &&  (uintptr_t)pRegFrame->eip < (uintptr_t)&EMGCEmulateCmpXchg_EndProc) 
     185    { 
     186        /* 
     187         * Page fault inside EMGCEmulateCmpXchg() func. 
     188         */ 
     189 
     190        /* Return execution to func at error label. */ 
     191        pRegFrame->eip = (uintptr_t)&EMGCEmulateCmpXchg_Error; 
     192        return VINF_SUCCESS; 
     193    } 
    168194 
    169195    /* #PF is not handled - kill the Hypervisor. */ 

© 2008 Sun Microsystems, Inc.
Contact – Privacy policy