winpower.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "winpower.h"
#include "guests.h"
#include "ptfilter.h"
#include "vecore.h"
#include "winagent.h"




static INTRO_POWER_STATE
IntWinPowFromGuestToIntroPowState(
    _In_ DWORD GuestPowerAction,
    _In_ DWORD GuestPowerState
    )
{
    // Shutdown: action is "shutdown" or "shutdown off" and state different from hibernate (can be sleep)
    if ((GuestPowerAction == PowerActionShutdown ||
         GuestPowerAction == PowerActionShutdownOff) &&
        GuestPowerState != PowerSystemHibernate)
    {
        return intPowStateShutdown;
    }

    // Reset: power action is reset (we don't care about requested power state, as there is not an edge case
    // like "pressing restart" but system enters on hibernate)
    if (GuestPowerAction == PowerActionShutdownReset)
    {
        return intPowStateReboot;
    }

    // Sleep: action must be sleep and the requested power state must be sleep
    if (GuestPowerAction == PowerActionSleep &&
        GuestPowerState >= PowerSystemSleeping1 &&
        GuestPowerState <= PowerSystemSleeping3)
    {
        return intPowStateSleeping;
    }

    // Hibernate: action can be hibernate/shutdown/shutdown off and the requested power state must be hibernate
    if ((GuestPowerAction == PowerActionHibernate ||
         GuestPowerAction == PowerActionShutdown ||
         GuestPowerAction == PowerActionShutdownOff ||
         GuestPowerAction == PowerActionSleep) &&
        GuestPowerState == PowerSystemHibernate)
    {
        return intPowStateHibernate;
    }

    WARNING("[WARNING] Unknown power action/reason: %d %d!\n", GuestPowerAction, GuestPowerState);

    return intPowStateUnknown;
}


static INTSTATUS
IntWinPowGetRequestedPowerState(
    _Out_ DWORD *RequestedPowerAction,
    _Out_ DWORD *RequestedPowerState
    )
{
    if (gGuest.Guest64)
    {
        *RequestedPowerState = (DWORD)gVcpu->Regs.Rdx;
        *RequestedPowerAction = (DWORD)gVcpu->Regs.Rcx;
        return INT_STATUS_SUCCESS;
    }
    else
    {
        DWORD buffer[2];
        INTSTATUS status;

        status = IntKernVirtMemRead(gVcpu->Regs.Rsp + 0x4, 8, buffer, NULL);
        if (!INT_SUCCESS(status))
        {
            return status;
        }

        *RequestedPowerAction = buffer[0];
        *RequestedPowerState = buffer[1];

        return INT_STATUS_SUCCESS;
    }
}


INTSTATUS
IntWinPowEnableSpinWait(
    void
    )

{
    INTSTATUS status = INT_STATUS_SUCCESS;
    BYTE hkbuff[4] = { 0xf3, 0x90, 0xeb, 0xfc };

    LOG("[POW-SPIN-WAIT] IntWinPowEnableSpinWait called!\n");

    IntPauseVcpus();

    // 0x6 is the address after the hypercall, where the spinwait is taking place
    // if the handler is ever changed, this must also be changed!
    status = IntDetModifyPublicData(detTagPowerState, hkbuff, sizeof(hkbuff), "spinwait");
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntDetModifyPublicData failed: 0x%08x\n", status);
    }

    IntResumeVcpus();

    return status;
}


INTSTATUS
IntWinPowDisableSpinWait(
    void
    )
{
    INTSTATUS status;
    BYTE nopbuff[4] = { 0x66, 0x90, 0x66, 0x90 };

    LOG("[POW-SPIN-WAIT] IntWinPowDisableSpinWait called!\n");

    IntPauseVcpus();

    // 0x6 is the address after the hypercall, where the spinwait is taking place
    // if the handler is ever changed, this must also be changed!
    status = IntDetModifyPublicData(detTagPowerState, nopbuff, sizeof(nopbuff), "spinwait");
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntDetModifyPublicData failed: 0x%08x\n", status);
    }

    IntResumeVcpus();

    return status;
}


static INTSTATUS
IntWinPowHandleEventCommon(
    _In_ INTRO_POWER_STATE PowerState
    )
{
    // Init to not needed hint, so we don't call IntWinPowEnableSpinWait in case INTRO_OPT_IN_GUEST_PT_FILTER
    // or INTRO_OPT_VE is not set
    INTSTATUS status = INT_STATUS_NOT_NEEDED_HINT;

    if (PowerState == intPowStateUnknown)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    // INTRO_OPT_IN_GUEST_PT_FILTER and INTRO_OPT_VE are mutually exclusive (this is enforced in IntNewGuestNotification
    // and IntGuestUpdateCoreOptions
    if (gGuest.CoreOptions.Current & INTRO_OPT_IN_GUEST_PT_FILTER)
    {
        LOG("Removing the PT Filter due to power state change...\n");
        status = IntPtiRemovePtFilter(AG_OPT_INJECT_ON_RIP_POWSTATE_CHANGE);
    }
    else if (gGuest.CoreOptions.Current & INTRO_OPT_VE)
    {
        LOG("Removing the #VE Agent due to power state change...\n");
        status = IntVeRemoveAgent(AG_OPT_INJECT_ON_RIP_POWSTATE_CHANGE);
    }

    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPtiRemovePtFilter/IntVeRemoveAgent failed: 0x%08x (options: %016llx)\n",
              status, gGuest.CoreOptions.Current);
    }
    else if (INT_STATUS_NOT_NEEDED_HINT != status)
    {
        // if the unloader was deployed then enable the spinwait
        status = IntWinPowEnableSpinWait();
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinPowEnableSpinWait failed: 0x%08x\n", status);
        }
    }

    return status;
}


static void
IntWinPowHandleHibernateEvent(
    void
    )
{
    // Set this on TRUE because in this way we'll block other APIs
    gGuest.EnterHibernate = TRUE;

    IntGuestUpdateCoreOptions(0);
}


INTSTATUS
IntWinPowHandlePowerStateChange(
    _In_ void *Detour
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    DWORD requestedPowerState;
    DWORD requestedPowerAction;
    INTRO_POWER_STATE internalPowerState;

    UNREFERENCED_PARAMETER(Detour);

    status = IntWinPowGetRequestedPowerState(&requestedPowerAction, &requestedPowerState);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] We could not get the requested power state!");
        return status;
    }

    LOG("[POWER-STATE] Entering power state %d, action %d\n", requestedPowerState, requestedPowerAction);

    // For power-state >= sleep, we should disable the PT filter as the following might happen inside the guest:
    // 1. Guest is hybrid sleeping -> it will unmap the PT filter agent, so a BSOD will occur
    // 2. Guest is hibernating -> the agent will remain inside the guest and a BSOD will most likely occur at resume
    //                            also, the name of the patched processes must be restored

    internalPowerState = IntWinPowFromGuestToIntroPowState(requestedPowerAction, requestedPowerState);

    // First do the common handling, then handle more specifically depending on which power state guest tries to get in
    status = IntWinPowHandleEventCommon(internalPowerState);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntWinPowHandleEventCommon failed: 0x%08x\n", status);
    }

    LOG("[POWER-STATE] Internal power state: %d\n", internalPowerState);

    switch (internalPowerState)
    {
    case intPowStateSleeping:
    case intPowStateShutdown:
    case intPowStateReboot:
    case intPowStateUnknown:
    {
        // We have nothing to do for now
        break;
    }
    case intPowStateHibernate:
    {
        IntWinPowHandleHibernateEvent();

        break;
    }
    default:
    {
        ERROR("[ERROR] Power state %d requested, but we don't have any callback for it!\n", requestedPowerState);
        return INT_STATUS_NOT_FOUND;
    }
    }

    return INT_STATUS_SUCCESS;
}