EM.cpp@ 1519

Last change on this file since 1519 was 1519, checked in by vboxsync, 18 years ago
Forward trap back to raw mode if the rechecked gate handler is valid.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 148.2 KB

Line
1	/* $Id: EM.cpp 1519 2007-03-15 16:27:16Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor/Manager.
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/** @page pg_em EM - The Execution Monitor/Manager
24	*
25	* The Execution Monitor/Manager is responsible for running the VM, scheduling
26	* the right kind of execution (Raw, Recompiled, Interpreted,..), and keeping
27	* the CPU states in sync. The function RMR3ExecuteVM() is the 'main-loop' of
28	* the VM.
29	*
30	*/
31
32	/*******************************************************************************
33	* Header Files *
34	*******************************************************************************/
35	#define LOG_GROUP LOG_GROUP_EM
36	#include <VBox/em.h>
37	#include <VBox/vmm.h>
38	#include <VBox/patm.h>
39	#include <VBox/csam.h>
40	#include <VBox/selm.h>
41	#include <VBox/trpm.h>
42	#include <VBox/iom.h>
43	#include <VBox/dbgf.h>
44	#include <VBox/pgm.h>
45	#include <VBox/rem.h>
46	#include <VBox/tm.h>
47	#include <VBox/mm.h>
48	#include <VBox/pdm.h>
49	#include <VBox/hwaccm.h>
50	#include <VBox/patm.h>
51	#include "EMInternal.h"
52	#include <VBox/vm.h>
53	#include <VBox/cpumdis.h>
54	#include <VBox/dis.h>
55	#include <VBox/disopcode.h>
56	#include <VBox/dbgf.h>
57
58	#include <VBox/log.h>
59	#include <iprt/thread.h>
60	#include <iprt/assert.h>
61	#include <iprt/asm.h>
62	#include <iprt/semaphore.h>
63	#include <iprt/string.h>
64	#include <iprt/avl.h>
65	#include <iprt/stream.h>
66	#include <VBox/param.h>
67	#include <VBox/err.h>
68
69
70	/*******************************************************************************
71	* Internal Functions *
72	*******************************************************************************/
73	static DECLCALLBACK(int) emR3Save(PVM pVM, PSSMHANDLE pSSM);
74	static DECLCALLBACK(int) emR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version);
75	static int emR3Debug(PVM pVM, int rc);
76	static int emR3RemStep(PVM pVM);
77	static int emR3RemExecute(PVM pVM, bool *pfFFDone);
78	static int emR3RawResumeHyper(PVM pVM);
79	static int emR3RawStep(PVM pVM);
80	DECLINLINE(int) emR3RawHandleRC(PVM pVM, PCPUMCTX pCtx, int rc);
81	DECLINLINE(int) emR3RawUpdateForceFlag(PVM pVM, PCPUMCTX pCtx, int rc);
82	static int emR3RawForcedActions(PVM pVM, PCPUMCTX pCtx);
83	static int emR3RawExecute(PVM pVM, bool *pfFFDone);
84	DECLINLINE(int) emR3RawExecuteInstruction(PVM pVM, const char *pszPrefix, int rcGC = VINF_SUCCESS);
85	static int emR3HighPriorityPostForcedActions(PVM pVM, int rc);
86	static int emR3ForcedActions(PVM pVM, int rc);
87	static int emR3RawGuestTrap(PVM pVM);
88
89
90	/**
91	* Initializes the EM.
92	*
93	* @returns VBox status code.
94	* @param pVM The VM to operate on.
95	*/
96	EMR3DECL(int) EMR3Init(PVM pVM)
97	{
98	LogFlow(("EMR3Init\n"));
99	/*
100	* Assert alignment and sizes.
101	*/
102	AssertRelease(!(RT_OFFSETOF(VM, em.s) & 31));
103	AssertRelease(sizeof(pVM->em.s) <= sizeof(pVM->em.padding));
104	AssertReleaseMsg(sizeof(pVM->em.s.u.FatalLongJump) <= sizeof(pVM->em.s.u.achPaddingFatalLongJump),
105	("%d bytes, padding %d\n", sizeof(pVM->em.s.u.FatalLongJump), sizeof(pVM->em.s.u.achPaddingFatalLongJump)));
106
107	/*
108	* Init the structure.
109	*/
110	pVM->em.s.offVM = RT_OFFSETOF(VM, em.s);
111	int rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "RawR3Enabled", &pVM->fRawR3Enabled);
112	if (VBOX_FAILURE(rc))
113	pVM->fRawR3Enabled = true;
114	rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "RawR0Enabled", &pVM->fRawR0Enabled);
115	if (VBOX_FAILURE(rc))
116	pVM->fRawR0Enabled = true;
117	Log(("EMR3Init: fRawR3Enabled=%d fRawR0Enabled=%d\n", pVM->fRawR3Enabled, pVM->fRawR0Enabled));
118	pVM->em.s.enmState = EMSTATE_NONE;
119	pVM->em.s.fForceRAW = false;
120
121	rc = CPUMQueryGuestCtxPtr(pVM, &pVM->em.s.pCtx);
122	AssertMsgRC(rc, ("CPUMQueryGuestCtxPtr -> %Vrc\n", rc));
123	pVM->em.s.pPatmGCState = PATMR3QueryGCStateHC(pVM);
124	AssertMsg(pVM->em.s.pPatmGCState, ("PATMR3QueryGCStateHC failed!\n"));
125
126	/*
127	* Saved state.
128	*/
129	rc = SSMR3RegisterInternal(pVM, "em", 0, EM_SAVED_STATE_VERSION, 16,
130	NULL, emR3Save, NULL,
131	NULL, emR3Load, NULL);
132	if (VBOX_FAILURE(rc))
133	return rc;
134
135	/*
136	* Statistics.
137	*/
138	#ifdef VBOX_WITH_STATISTICS
139	PEMSTATS pStats;
140	rc = MMHyperAlloc(pVM, sizeof(pStats), 0, MM_TAG_EM, (void *)&pStats);
141	if (VBOX_FAILURE(rc))
142	return rc;
143	pVM->em.s.pStatsHC = pStats;
144	pVM->em.s.pStatsGC = MMHyperHC2GC(pVM, pStats);
145
146	STAM_REG(pVM, &pStats->StatGCEmulate, STAMTYPE_PROFILE, "/EM/GC/Interpret", STAMUNIT_TICKS_PER_CALL, "Profiling of EMInterpretInstruction.");
147	STAM_REG(pVM, &pStats->StatHCEmulate, STAMTYPE_PROFILE, "/EM/HC/Interpret", STAMUNIT_TICKS_PER_CALL, "Profiling of EMInterpretInstruction.");
148
149	STAM_REG(pVM, &pStats->StatGCInterpretSucceeded, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success", STAMUNIT_OCCURENCES, "The number of times an instruction was successfully interpreted.");
150	STAM_REG(pVM, &pStats->StatHCInterpretSucceeded, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success", STAMUNIT_OCCURENCES, "The number of times an instruction was successfully interpreted.");
151
152	STAM_REG_USED(pVM, &pStats->StatGCAnd, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/And", STAMUNIT_OCCURENCES, "The number of times AND was successfully interpreted.");
153	STAM_REG_USED(pVM, &pStats->StatHCAnd, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/And", STAMUNIT_OCCURENCES, "The number of times AND was successfully interpreted.");
154	STAM_REG_USED(pVM, &pStats->StatGCAdd, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Add", STAMUNIT_OCCURENCES, "The number of times ADD was successfully interpreted.");
155	STAM_REG_USED(pVM, &pStats->StatHCAdd, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Add", STAMUNIT_OCCURENCES, "The number of times ADD was successfully interpreted.");
156	STAM_REG_USED(pVM, &pStats->StatGCAdc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Adc", STAMUNIT_OCCURENCES, "The number of times ADC was successfully interpreted.");
157	STAM_REG_USED(pVM, &pStats->StatHCAdc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Adc", STAMUNIT_OCCURENCES, "The number of times ADC was successfully interpreted.");
158	STAM_REG_USED(pVM, &pStats->StatGCSub, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Sub", STAMUNIT_OCCURENCES, "The number of times SUB was successfully interpreted.");
159	STAM_REG_USED(pVM, &pStats->StatHCSub, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Sub", STAMUNIT_OCCURENCES, "The number of times SUB was successfully interpreted.");
160	STAM_REG_USED(pVM, &pStats->StatGCCpuId, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/CpuId", STAMUNIT_OCCURENCES, "The number of times CPUID was successfully interpreted.");
161	STAM_REG_USED(pVM, &pStats->StatHCCpuId, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/CpuId", STAMUNIT_OCCURENCES, "The number of times CPUID was successfully interpreted.");
162	STAM_REG_USED(pVM, &pStats->StatGCDec, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Dec", STAMUNIT_OCCURENCES, "The number of times DEC was successfully interpreted.");
163	STAM_REG_USED(pVM, &pStats->StatHCDec, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Dec", STAMUNIT_OCCURENCES, "The number of times DEC was successfully interpreted.");
164	STAM_REG_USED(pVM, &pStats->StatGCHlt, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Hlt", STAMUNIT_OCCURENCES, "The number of times HLT was successfully interpreted.");
165	STAM_REG_USED(pVM, &pStats->StatHCHlt, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Hlt", STAMUNIT_OCCURENCES, "The number of times HLT was successfully interpreted.");
166	STAM_REG_USED(pVM, &pStats->StatGCInc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Inc", STAMUNIT_OCCURENCES, "The number of times INC was successfully interpreted.");
167	STAM_REG_USED(pVM, &pStats->StatHCInc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Inc", STAMUNIT_OCCURENCES, "The number of times INC was successfully interpreted.");
168	STAM_REG_USED(pVM, &pStats->StatGCInvlPg, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Invlpg", STAMUNIT_OCCURENCES, "The number of times INVLPG was successfully interpreted.");
169	STAM_REG_USED(pVM, &pStats->StatHCInvlPg, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Invlpg", STAMUNIT_OCCURENCES, "The number of times INVLPG was successfully interpreted.");
170	STAM_REG_USED(pVM, &pStats->StatGCIret, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Iret", STAMUNIT_OCCURENCES, "The number of times IRET was successfully interpreted.");
171	STAM_REG_USED(pVM, &pStats->StatHCIret, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Iret", STAMUNIT_OCCURENCES, "The number of times IRET was successfully interpreted.");
172	STAM_REG_USED(pVM, &pStats->StatGCLLdt, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/LLdt", STAMUNIT_OCCURENCES, "The number of times LLDT was successfully interpreted.");
173	STAM_REG_USED(pVM, &pStats->StatHCLLdt, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/LLdt", STAMUNIT_OCCURENCES, "The number of times LLDT was successfully interpreted.");
174	STAM_REG_USED(pVM, &pStats->StatGCMov, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Mov", STAMUNIT_OCCURENCES, "The number of times MOV was successfully interpreted.");
175	STAM_REG_USED(pVM, &pStats->StatHCMov, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Mov", STAMUNIT_OCCURENCES, "The number of times MOV was successfully interpreted.");
176	STAM_REG_USED(pVM, &pStats->StatGCMovCRx, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/MovCRx", STAMUNIT_OCCURENCES, "The number of times MOV CRx was successfully interpreted.");
177	STAM_REG_USED(pVM, &pStats->StatHCMovCRx, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/MovCRx", STAMUNIT_OCCURENCES, "The number of times MOV CRx was successfully interpreted.");
178	STAM_REG_USED(pVM, &pStats->StatGCMovDRx, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/MovDRx", STAMUNIT_OCCURENCES, "The number of times MOV DRx was successfully interpreted.");
179	STAM_REG_USED(pVM, &pStats->StatHCMovDRx, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/MovDRx", STAMUNIT_OCCURENCES, "The number of times MOV DRx was successfully interpreted.");
180	STAM_REG_USED(pVM, &pStats->StatGCOr, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Or", STAMUNIT_OCCURENCES, "The number of times OR was successfully interpreted.");
181	STAM_REG_USED(pVM, &pStats->StatHCOr, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Or", STAMUNIT_OCCURENCES, "The number of times OR was successfully interpreted.");
182	STAM_REG_USED(pVM, &pStats->StatGCPop, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Pop", STAMUNIT_OCCURENCES, "The number of times POP was successfully interpreted.");
183	STAM_REG_USED(pVM, &pStats->StatHCPop, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Pop", STAMUNIT_OCCURENCES, "The number of times POP was successfully interpreted.");
184	STAM_REG_USED(pVM, &pStats->StatGCRdtsc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Rdtsc", STAMUNIT_OCCURENCES, "The number of times RDTSC was successfully interpreted.");
185	//STAM_REG_USED(pVM, &pStats->StatHCRdtsc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Rdtsc", STAMUNIT_OCCURENCES, "The number of times RDTSC was successfully interpreted.");
186	STAM_REG_USED(pVM, &pStats->StatGCSti, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Sti", STAMUNIT_OCCURENCES, "The number of times STI was successfully interpreted.");
187	STAM_REG_USED(pVM, &pStats->StatHCSti, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Sti", STAMUNIT_OCCURENCES, "The number of times STI was successfully interpreted.");
188	STAM_REG_USED(pVM, &pStats->StatGCXchg, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Xchg", STAMUNIT_OCCURENCES, "The number of times XCHG was successfully interpreted.");
189	STAM_REG_USED(pVM, &pStats->StatHCXchg, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Xchg", STAMUNIT_OCCURENCES, "The number of times XCHG was successfully interpreted.");
190	STAM_REG_USED(pVM, &pStats->StatGCXor, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Xor", STAMUNIT_OCCURENCES, "The number of times XOR was successfully interpreted.");
191	STAM_REG_USED(pVM, &pStats->StatHCXor, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Xor", STAMUNIT_OCCURENCES, "The number of times XOR was successfully interpreted.");
192	STAM_REG_USED(pVM, &pStats->StatGCMonitor, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/Monitor", STAMUNIT_OCCURENCES, "The number of times MONITOR was successfully interpreted.");
193	STAM_REG_USED(pVM, &pStats->StatHCMonitor, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/Monitor", STAMUNIT_OCCURENCES, "The number of times MONITOR was successfully interpreted.");
194	STAM_REG_USED(pVM, &pStats->StatGCMWait, STAMTYPE_COUNTER, "/EM/GC/Interpret/Success/MWait", STAMUNIT_OCCURENCES, "The number of times MONITOR was successfully interpreted.");
195	STAM_REG_USED(pVM, &pStats->StatHCMWait, STAMTYPE_COUNTER, "/EM/HC/Interpret/Success/MWait", STAMUNIT_OCCURENCES, "The number of times MONITOR was successfully interpreted.");
196
197	STAM_REG(pVM, &pStats->StatGCInterpretFailed, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed", STAMUNIT_OCCURENCES, "The number of times an instruction was not interpreted.");
198	STAM_REG(pVM, &pStats->StatHCInterpretFailed, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed", STAMUNIT_OCCURENCES, "The number of times an instruction was not interpreted.");
199
200	STAM_REG_USED(pVM, &pStats->StatGCFailedAnd, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/And", STAMUNIT_OCCURENCES, "The number of times AND was not interpreted.");
201	STAM_REG_USED(pVM, &pStats->StatHCFailedAnd, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/And", STAMUNIT_OCCURENCES, "The number of times AND was not interpreted.");
202	STAM_REG_USED(pVM, &pStats->StatGCFailedCpuId, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/CpuId", STAMUNIT_OCCURENCES, "The number of times CPUID was not interpreted.");
203	STAM_REG_USED(pVM, &pStats->StatHCFailedCpuId, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/CpuId", STAMUNIT_OCCURENCES, "The number of times CPUID was not interpreted.");
204	STAM_REG_USED(pVM, &pStats->StatGCFailedDec, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Dec", STAMUNIT_OCCURENCES, "The number of times DEC was not interpreted.");
205	STAM_REG_USED(pVM, &pStats->StatHCFailedDec, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Dec", STAMUNIT_OCCURENCES, "The number of times DEC was not interpreted.");
206	STAM_REG_USED(pVM, &pStats->StatGCFailedHlt, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Hlt", STAMUNIT_OCCURENCES, "The number of times HLT was not interpreted.");
207	STAM_REG_USED(pVM, &pStats->StatHCFailedHlt, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Hlt", STAMUNIT_OCCURENCES, "The number of times HLT was not interpreted.");
208	STAM_REG_USED(pVM, &pStats->StatGCFailedInc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Inc", STAMUNIT_OCCURENCES, "The number of times INC was not interpreted.");
209	STAM_REG_USED(pVM, &pStats->StatHCFailedInc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Inc", STAMUNIT_OCCURENCES, "The number of times INC was not interpreted.");
210	STAM_REG_USED(pVM, &pStats->StatGCFailedInvlPg, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/InvlPg", STAMUNIT_OCCURENCES, "The number of times INVLPG was not interpreted.");
211	STAM_REG_USED(pVM, &pStats->StatHCFailedInvlPg, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/InvlPg", STAMUNIT_OCCURENCES, "The number of times INVLPG was not interpreted.");
212	STAM_REG_USED(pVM, &pStats->StatGCFailedIret, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Iret", STAMUNIT_OCCURENCES, "The number of times IRET was not interpreted.");
213	STAM_REG_USED(pVM, &pStats->StatHCFailedIret, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Iret", STAMUNIT_OCCURENCES, "The number of times IRET was not interpreted.");
214	STAM_REG_USED(pVM, &pStats->StatGCFailedLLdt, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/LLdt", STAMUNIT_OCCURENCES, "The number of times LLDT was not interpreted.");
215	STAM_REG_USED(pVM, &pStats->StatHCFailedLLdt, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/LLdt", STAMUNIT_OCCURENCES, "The number of times LLDT was not interpreted.");
216	STAM_REG_USED(pVM, &pStats->StatGCFailedMov, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Mov", STAMUNIT_OCCURENCES, "The number of times MOV was not interpreted.");
217	STAM_REG_USED(pVM, &pStats->StatHCFailedMov, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Mov", STAMUNIT_OCCURENCES, "The number of times MOV was not interpreted.");
218	STAM_REG_USED(pVM, &pStats->StatGCFailedMovCRx, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/MovCRx", STAMUNIT_OCCURENCES, "The number of times MOV CRx was not interpreted.");
219	STAM_REG_USED(pVM, &pStats->StatHCFailedMovCRx, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/MovCRx", STAMUNIT_OCCURENCES, "The number of times MOV CRx was not interpreted.");
220	STAM_REG_USED(pVM, &pStats->StatGCFailedMovDRx, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/MovDRx", STAMUNIT_OCCURENCES, "The number of times MOV DRx was not interpreted.");
221	STAM_REG_USED(pVM, &pStats->StatHCFailedMovDRx, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/MovDRx", STAMUNIT_OCCURENCES, "The number of times MOV DRx was not interpreted.");
222	STAM_REG_USED(pVM, &pStats->StatGCFailedOr, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Or", STAMUNIT_OCCURENCES, "The number of times OR was not interpreted.");
223	STAM_REG_USED(pVM, &pStats->StatHCFailedOr, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Or", STAMUNIT_OCCURENCES, "The number of times OR was not interpreted.");
224	STAM_REG_USED(pVM, &pStats->StatGCFailedPop, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Pop", STAMUNIT_OCCURENCES, "The number of times POP was not interpreted.");
225	STAM_REG_USED(pVM, &pStats->StatHCFailedPop, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Pop", STAMUNIT_OCCURENCES, "The number of times POP was not interpreted.");
226	STAM_REG_USED(pVM, &pStats->StatGCFailedSti, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Sti", STAMUNIT_OCCURENCES, "The number of times STI was not interpreted.");
227	STAM_REG_USED(pVM, &pStats->StatHCFailedSti, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Sti", STAMUNIT_OCCURENCES, "The number of times STI was not interpreted.");
228	STAM_REG_USED(pVM, &pStats->StatGCFailedXchg, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Xchg", STAMUNIT_OCCURENCES, "The number of times XCHG was not interpreted.");
229	STAM_REG_USED(pVM, &pStats->StatHCFailedXchg, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Xchg", STAMUNIT_OCCURENCES, "The number of times XCHG was not interpreted.");
230	STAM_REG_USED(pVM, &pStats->StatGCFailedXor, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Xor", STAMUNIT_OCCURENCES, "The number of times XOR was not interpreted.");
231	STAM_REG_USED(pVM, &pStats->StatHCFailedXor, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Xor", STAMUNIT_OCCURENCES, "The number of times XOR was not interpreted.");
232	STAM_REG_USED(pVM, &pStats->StatGCFailedMonitor, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Monitor", STAMUNIT_OCCURENCES, "The number of times MONITOR was not interpreted.");
233	STAM_REG_USED(pVM, &pStats->StatHCFailedMonitor, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Monitor", STAMUNIT_OCCURENCES, "The number of times MONITOR was not interpreted.");
234	STAM_REG_USED(pVM, &pStats->StatGCFailedMWait, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/MWait", STAMUNIT_OCCURENCES, "The number of times MONITOR was not interpreted.");
235	STAM_REG_USED(pVM, &pStats->StatHCFailedMWait, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/MWait", STAMUNIT_OCCURENCES, "The number of times MONITOR was not interpreted.");
236	STAM_REG_USED(pVM, &pStats->StatGCFailedRdtsc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Rdtsc", STAMUNIT_OCCURENCES, "The number of times RDTSC was not interpreted.");
237	//STAM_REG_USED(pVM, &pStats->StatHCFailedRdtsc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Rdtsc", STAMUNIT_OCCURENCES, "The number of times RDTSC was not interpreted.");
238
239	STAM_REG_USED(pVM, &pStats->StatGCFailedMisc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Misc", STAMUNIT_OCCURENCES, "The number of times some misc instruction was encountered.");
240	STAM_REG_USED(pVM, &pStats->StatHCFailedMisc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Misc", STAMUNIT_OCCURENCES, "The number of times some misc instruction was encountered.");
241	STAM_REG_USED(pVM, &pStats->StatGCFailedAdd, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Add", STAMUNIT_OCCURENCES, "The number of times ADD was not interpreted.");
242	STAM_REG_USED(pVM, &pStats->StatHCFailedAdd, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Add", STAMUNIT_OCCURENCES, "The number of times ADD was not interpreted.");
243	STAM_REG_USED(pVM, &pStats->StatGCFailedAdc, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Adc", STAMUNIT_OCCURENCES, "The number of times ADC was not interpreted.");
244	STAM_REG_USED(pVM, &pStats->StatHCFailedAdc, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Adc", STAMUNIT_OCCURENCES, "The number of times ADC was not interpreted.");
245	STAM_REG_USED(pVM, &pStats->StatGCFailedBtr, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Btr", STAMUNIT_OCCURENCES, "The number of times BTR was not interpreted.");
246	STAM_REG_USED(pVM, &pStats->StatHCFailedBtr, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Btr", STAMUNIT_OCCURENCES, "The number of times BTR was not interpreted.");
247	STAM_REG_USED(pVM, &pStats->StatGCFailedBts, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Bts", STAMUNIT_OCCURENCES, "The number of times BTS was not interpreted.");
248	STAM_REG_USED(pVM, &pStats->StatHCFailedBts, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Bts", STAMUNIT_OCCURENCES, "The number of times BTS was not interpreted.");
249	STAM_REG_USED(pVM, &pStats->StatGCFailedCli, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Cli", STAMUNIT_OCCURENCES, "The number of times CLI was not interpreted.");
250	STAM_REG_USED(pVM, &pStats->StatHCFailedCli, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Cli", STAMUNIT_OCCURENCES, "The number of times CLI was not interpreted.");
251	STAM_REG_USED(pVM, &pStats->StatGCFailedCmpXchg, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/CmpXchg", STAMUNIT_OCCURENCES, "The number of times CMPXCHG was not interpreted.");
252	STAM_REG_USED(pVM, &pStats->StatHCFailedCmpXchg, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/CmpXchg", STAMUNIT_OCCURENCES, "The number of times CMPXCHG was not interpreted.");
253	STAM_REG_USED(pVM, &pStats->StatGCFailedMovNTPS, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/MovNTPS", STAMUNIT_OCCURENCES, "The number of times MOVNTPS was not interpreted.");
254	STAM_REG_USED(pVM, &pStats->StatHCFailedMovNTPS, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/MovNTPS", STAMUNIT_OCCURENCES, "The number of times MOVNTPS was not interpreted.");
255	STAM_REG_USED(pVM, &pStats->StatGCFailedStosWD, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/StosWD", STAMUNIT_OCCURENCES, "The number of times STOSWD was not interpreted.");
256	STAM_REG_USED(pVM, &pStats->StatHCFailedStosWD, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/StosWD", STAMUNIT_OCCURENCES, "The number of times STOSWD was not interpreted.");
257	STAM_REG_USED(pVM, &pStats->StatGCFailedSub, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Sub", STAMUNIT_OCCURENCES, "The number of times SUB was not interpreted.");
258	STAM_REG_USED(pVM, &pStats->StatHCFailedSub, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Sub", STAMUNIT_OCCURENCES, "The number of times SUB was not interpreted.");
259	STAM_REG_USED(pVM, &pStats->StatGCFailedWbInvd, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/WbInvd", STAMUNIT_OCCURENCES, "The number of times WBINVD was not interpreted.");
260	STAM_REG_USED(pVM, &pStats->StatHCFailedWbInvd, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/WbInvd", STAMUNIT_OCCURENCES, "The number of times WBINVD was not interpreted.");
261
262	STAM_REG_USED(pVM, &pStats->StatGCFailedUserMode, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/UserMode", STAMUNIT_OCCURENCES, "The number of rejections because of CPL.");
263	STAM_REG_USED(pVM, &pStats->StatHCFailedUserMode, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/UserMode", STAMUNIT_OCCURENCES, "The number of rejections because of CPL.");
264	STAM_REG_USED(pVM, &pStats->StatGCFailedPrefix, STAMTYPE_COUNTER, "/EM/GC/Interpret/Failed/Prefix", STAMUNIT_OCCURENCES, "The number of rejections because of prefix .");
265	STAM_REG_USED(pVM, &pStats->StatHCFailedPrefix, STAMTYPE_COUNTER, "/EM/HC/Interpret/Failed/Prefix", STAMUNIT_OCCURENCES, "The number of rejections because of prefix .");
266
267	STAM_REG_USED(pVM, &pStats->StatCli, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Cli", STAMUNIT_OCCURENCES, "Number of cli instructions.");
268	STAM_REG_USED(pVM, &pStats->StatSti, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Sti", STAMUNIT_OCCURENCES, "Number of sli instructions.");
269	STAM_REG_USED(pVM, &pStats->StatIn, STAMTYPE_COUNTER, "/EM/HC/PrivInst/In", STAMUNIT_OCCURENCES, "Number of in instructions.");
270	STAM_REG_USED(pVM, &pStats->StatOut, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Out", STAMUNIT_OCCURENCES, "Number of out instructions.");
271	STAM_REG_USED(pVM, &pStats->StatHlt, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Hlt", STAMUNIT_OCCURENCES, "Number of hlt instructions not handled in GC because of PATM.");
272	STAM_REG_USED(pVM, &pStats->StatInvlpg, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Invlpg", STAMUNIT_OCCURENCES, "Number of invlpg instructions.");
273	STAM_REG_USED(pVM, &pStats->StatMisc, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Misc", STAMUNIT_OCCURENCES, "Number of misc. instructions.");
274	STAM_REG_USED(pVM, &pStats->StatMovWriteCR[0], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov CR0, X", STAMUNIT_OCCURENCES, "Number of mov CR0 read instructions.");
275	STAM_REG_USED(pVM, &pStats->StatMovWriteCR[1], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov CR1, X", STAMUNIT_OCCURENCES, "Number of mov CR1 read instructions.");
276	STAM_REG_USED(pVM, &pStats->StatMovWriteCR[2], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov CR2, X", STAMUNIT_OCCURENCES, "Number of mov CR2 read instructions.");
277	STAM_REG_USED(pVM, &pStats->StatMovWriteCR[3], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov CR3, X", STAMUNIT_OCCURENCES, "Number of mov CR3 read instructions.");
278	STAM_REG_USED(pVM, &pStats->StatMovWriteCR[4], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov CR4, X", STAMUNIT_OCCURENCES, "Number of mov CR4 read instructions.");
279	STAM_REG_USED(pVM, &pStats->StatMovReadCR[0], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov X, CR0", STAMUNIT_OCCURENCES, "Number of mov CR0 write instructions.");
280	STAM_REG_USED(pVM, &pStats->StatMovReadCR[1], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov X, CR1", STAMUNIT_OCCURENCES, "Number of mov CR1 write instructions.");
281	STAM_REG_USED(pVM, &pStats->StatMovReadCR[2], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov X, CR2", STAMUNIT_OCCURENCES, "Number of mov CR2 write instructions.");
282	STAM_REG_USED(pVM, &pStats->StatMovReadCR[3], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov X, CR3", STAMUNIT_OCCURENCES, "Number of mov CR3 write instructions.");
283	STAM_REG_USED(pVM, &pStats->StatMovReadCR[4], STAMTYPE_COUNTER, "/EM/HC/PrivInst/Mov X, CR4", STAMUNIT_OCCURENCES, "Number of mov CR4 write instructions.");
284	STAM_REG_USED(pVM, &pStats->StatMovDRx, STAMTYPE_COUNTER, "/EM/HC/PrivInst/MovDRx", STAMUNIT_OCCURENCES, "Number of mov DRx instructions.");
285	STAM_REG_USED(pVM, &pStats->StatIret, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Iret", STAMUNIT_OCCURENCES, "Number of iret instructions.");
286	STAM_REG_USED(pVM, &pStats->StatMovLgdt, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Lgdt", STAMUNIT_OCCURENCES, "Number of lgdt instructions.");
287	STAM_REG_USED(pVM, &pStats->StatMovLidt, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Lidt", STAMUNIT_OCCURENCES, "Number of lidt instructions.");
288	STAM_REG_USED(pVM, &pStats->StatMovLldt, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Lldt", STAMUNIT_OCCURENCES, "Number of lldt instructions.");
289	STAM_REG_USED(pVM, &pStats->StatSysEnter, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Sysenter", STAMUNIT_OCCURENCES, "Number of sysenter instructions.");
290	STAM_REG_USED(pVM, &pStats->StatSysExit, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Sysexit", STAMUNIT_OCCURENCES, "Number of sysexit instructions.");
291	STAM_REG_USED(pVM, &pStats->StatSysCall, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Syscall", STAMUNIT_OCCURENCES, "Number of syscall instructions.");
292	STAM_REG_USED(pVM, &pStats->StatSysRet, STAMTYPE_COUNTER, "/EM/HC/PrivInst/Sysret", STAMUNIT_OCCURENCES, "Number of sysret instructions.");
293
294	STAM_REG(pVM, &pVM->em.s.StatTotalClis, STAMTYPE_COUNTER, "/EM/Cli/Total", STAMUNIT_OCCURENCES, "Total number of cli instructions executed.");
295	pVM->em.s.pCliStatTree = 0;
296	#endif /* VBOX_WITH_STATISTICS */
297
298	/* these should be considered for release statistics. */
299	STAM_REG(pVM, &pVM->em.s.StatForcedActions, STAMTYPE_PROFILE, "/PROF/EM/ForcedActions", STAMUNIT_TICKS_PER_CALL, "Profiling forced action execution.");
300	STAM_REG(pVM, &pVM->em.s.StatHalted, STAMTYPE_PROFILE, "/PROF/EM/Halted", STAMUNIT_TICKS_PER_CALL, "Profiling halted state (VMR3WaitHalted).");
301	STAM_REG(pVM, &pVM->em.s.StatHwAccEntry, STAMTYPE_PROFILE, "/PROF/EM/HwAccEnter", STAMUNIT_TICKS_PER_CALL, "Profiling Hardware Accelerated Mode entry overhead.");
302	STAM_REG(pVM, &pVM->em.s.StatHwAccExec, STAMTYPE_PROFILE, "/PROF/EM/HwAccExec", STAMUNIT_TICKS_PER_CALL, "Profiling Hardware Accelerated Mode execution.");
303	STAM_REG(pVM, &pVM->em.s.StatIOEmu, STAMTYPE_PROFILE, "/PROF/EM/Emulation/IO", STAMUNIT_TICKS_PER_CALL, "Profiling of emR3RawExecuteIOInstruction.");
304	STAM_REG(pVM, &pVM->em.s.StatPrivEmu, STAMTYPE_PROFILE, "/PROF/EM/Emulation/Priv", STAMUNIT_TICKS_PER_CALL, "Profiling of emR3RawPrivileged.");
305	STAM_REG(pVM, &pVM->em.s.StatMiscEmu, STAMTYPE_PROFILE, "/PROF/EM/Emulation/Misc", STAMUNIT_TICKS_PER_CALL, "Profiling of emR3RawExecuteInstruction.");
306	STAM_REG(pVM, &pVM->em.s.StatREMEmu, STAMTYPE_PROFILE, "/PROF/EM/REMEmuSingle", STAMUNIT_TICKS_PER_CALL, "Profiling single instruction REM execution.");
307	STAM_REG(pVM, &pVM->em.s.StatREMExec, STAMTYPE_PROFILE, "/PROF/EM/REMExec", STAMUNIT_TICKS_PER_CALL, "Profiling REM execution.");
308	STAM_REG(pVM, &pVM->em.s.StatREMSync, STAMTYPE_PROFILE, "/PROF/EM/REMSync", STAMUNIT_TICKS_PER_CALL, "Profiling REM context syncing.");
309	STAM_REG(pVM, &pVM->em.s.StatREMTotal, STAMTYPE_PROFILE, "/PROF/EM/REMTotal", STAMUNIT_TICKS_PER_CALL, "Profiling emR3RemExecute (excluding FFs).");
310	STAM_REG(pVM, &pVM->em.s.StatRAWEntry, STAMTYPE_PROFILE, "/PROF/EM/RAWEnter", STAMUNIT_TICKS_PER_CALL, "Profiling Raw Mode entry overhead.");
311	STAM_REG(pVM, &pVM->em.s.StatRAWExec, STAMTYPE_PROFILE, "/PROF/EM/RAWExec", STAMUNIT_TICKS_PER_CALL, "Profiling Raw Mode execution.");
312	STAM_REG(pVM, &pVM->em.s.StatRAWTail, STAMTYPE_PROFILE, "/PROF/EM/RAWTail", STAMUNIT_TICKS_PER_CALL, "Profiling Raw Mode tail overhead.");
313	STAM_REG(pVM, &pVM->em.s.StatRAWTotal, STAMTYPE_PROFILE, "/PROF/EM/RAWTotal", STAMUNIT_TICKS_PER_CALL, "Profiling emR3RawExecute (excluding FFs).");
314	STAM_REG(pVM, &pVM->em.s.StatTotal, STAMTYPE_PROFILE, "/PROF/EM/Total", STAMUNIT_TICKS_PER_CALL, "Profiling EMR3ExecuteVM.");
315
316
317	return VINF_SUCCESS;
318	}
319
320
321
322	/**
323	* Applies relocations to data and code managed by this
324	* component. This function will be called at init and
325	* whenever the VMM need to relocate it self inside the GC.
326	*
327	* @param pVM The VM.
328	*/
329	EMR3DECL(void) EMR3Relocate(PVM pVM)
330	{
331	LogFlow(("EMR3Relocate\n"));
332	if (pVM->em.s.pStatsHC)
333	pVM->em.s.pStatsGC = MMHyperHC2GC(pVM, pVM->em.s.pStatsHC);
334	}
335
336
337	/**
338	* Reset notification.
339	*
340	* @param pVM
341	*/
342	EMR3DECL(void) EMR3Reset(PVM pVM)
343	{
344	LogFlow(("EMR3Reset: \n"));
345	pVM->em.s.fForceRAW = false;
346	}
347
348
349	/**
350	* Terminates the EM.
351	*
352	* Termination means cleaning up and freeing all resources,
353	* the VM it self is at this point powered off or suspended.
354	*
355	* @returns VBox status code.
356	* @param pVM The VM to operate on.
357	*/
358	EMR3DECL(int) EMR3Term(PVM pVM)
359	{
360	AssertMsg(pVM->em.s.offVM, ("bad init order!\n"));
361
362	return VINF_SUCCESS;
363	}
364
365
366	/**
367	* Execute state save operation.
368	*
369	* @returns VBox status code.
370	* @param pVM VM Handle.
371	* @param pSSM SSM operation handle.
372	*/
373	static DECLCALLBACK(int) emR3Save(PVM pVM, PSSMHANDLE pSSM)
374	{
375	return SSMR3PutBool(pSSM, pVM->em.s.fForceRAW);
376	}
377
378
379	/**
380	* Execute state load operation.
381	*
382	* @returns VBox status code.
383	* @param pVM VM Handle.
384	* @param pSSM SSM operation handle.
385	* @param u32Version Data layout version.
386	*/
387	static DECLCALLBACK(int) emR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t u32Version)
388	{
389	/*
390	* Validate version.
391	*/
392	if (u32Version != EM_SAVED_STATE_VERSION)
393	{
394	Log(("emR3Load: Invalid version u32Version=%d (current %d)!\n", u32Version, EM_SAVED_STATE_VERSION));
395	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
396	}
397
398	/*
399	* Load the saved state.
400	*/
401	int rc = SSMR3GetBool(pSSM, &pVM->em.s.fForceRAW);
402	if (VBOX_FAILURE(rc))
403	pVM->em.s.fForceRAW = false;
404
405	Assert(pVM->em.s.pCliStatTree == 0);
406	return rc;
407	}
408
409
410	/**
411	* Enables or disables a set of raw-mode execution modes.
412	*
413	* @returns VINF_SUCCESS on success.
414	* @returns VINF_RESCHEDULE if a rescheduling might be required.
415	* @returns VERR_INVALID_PARAMETER on an invalid enmMode value.
416	*
417	* @param pVM The VM to operate on.
418	* @param enmMode The execution mode change.
419	* @thread The emulation thread.
420	*/
421	EMR3DECL(int) EMR3RawSetMode(PVM pVM, EMRAWMODE enmMode)
422	{
423	switch (enmMode)
424	{
425	case EMRAW_NONE:
426	pVM->fRawR3Enabled = false;
427	pVM->fRawR0Enabled = false;
428	break;
429	case EMRAW_RING3_ENABLE:
430	pVM->fRawR3Enabled = true;
431	break;
432	case EMRAW_RING3_DISABLE:
433	pVM->fRawR3Enabled = false;
434	break;
435	case EMRAW_RING0_ENABLE:
436	pVM->fRawR0Enabled = true;
437	break;
438	case EMRAW_RING0_DISABLE:
439	pVM->fRawR0Enabled = false;
440	break;
441	default:
442	AssertMsgFailed(("Invalid enmMode=%d\n", enmMode));
443	return VERR_INVALID_PARAMETER;
444	}
445	Log(("EMR3SetRawMode: fRawR3Enabled=%RTbool fRawR0Enabled=%RTbool pVM->fRawR3Enabled=%RTbool\n",
446	pVM->fRawR3Enabled, pVM->fRawR0Enabled, pVM->fRawR3Enabled));
447	return pVM->em.s.enmState == EMSTATE_RAW ? VINF_EM_RESCHEDULE : VINF_SUCCESS;
448	}
449
450
451	/**
452	* Raise a fatal error.
453	*
454	* Safely terminate the VM with full state report and stuff. This function
455	* will naturally never return.
456	*
457	* @param pVM VM handle.
458	* @param rc VBox status code.
459	*/
460	EMR3DECL(void) EMR3FatalError(PVM pVM, int rc)
461	{
462	longjmp(pVM->em.s.u.FatalLongJump, rc);
463	AssertReleaseMsgFailed(("longjmp returned!\n"));
464	}
465
466
467	/**
468	* Gets the EM state name.
469	*
470	* @returns pointer to read only state name,
471	* @param enmState The state.
472	*/
473	EMR3DECL(const char *) EMR3GetStateName(EMSTATE enmState)
474	{
475	switch (enmState)
476	{
477	case EMSTATE_RAW: return "EMSTATE_RAW";
478	case EMSTATE_HWACC: return "EMSTATE_HWACC";
479	case EMSTATE_REM: return "EMSTATE_REM";
480	case EMSTATE_HALTED: return "EMSTATE_HALTED";
481	case EMSTATE_SUSPENDED: return "EMSTATE_SUSPENDED";
482	case EMSTATE_TERMINATING: return "EMSTATE_TERMINATING";
483	case EMSTATE_DEBUG_GUEST_RAW: return "EMSTATE_DEBUG_GUEST_RAW";
484	case EMSTATE_DEBUG_GUEST_REM: return "EMSTATE_DEBUG_GUEST_REM";
485	case EMSTATE_DEBUG_HYPER: return "EMSTATE_DEBUG_HYPER";
486	case EMSTATE_GURU_MEDITATION: return "EMSTATE_GURU_MEDITATION";
487	default: return "Unknown!";
488	}
489	}
490
491
492	#ifdef VBOX_WITH_STATISTICS
493	/**
494	* Just a braindead function to keep track of cli addresses.
495	* @param pVM VM handle.
496	* @param pInstrGC The EIP of the cli instruction.
497	*/
498	static void emR3RecordCli(PVM pVM, RTGCPTR pInstrGC)
499	{
500	PCLISTAT pRec;
501
502	pRec = (PCLISTAT)RTAvlPVGet(&pVM->em.s.pCliStatTree, (AVLPVKEY)pInstrGC);
503	if (!pRec)
504	{
505	/* New cli instruction; insert into the tree. */
506	pRec = (PCLISTAT)MMR3HeapAllocZ(pVM, MM_TAG_EM, sizeof(*pRec));
507	Assert(pRec);
508	if (!pRec)
509	return;
510	pRec->Core.Key = (AVLPVKEY)pInstrGC;
511
512	char szCliStatName[32];
513	RTStrPrintf(szCliStatName, sizeof(szCliStatName), "/EM/Cli/0x%VGv", pInstrGC);
514	STAM_REG(pVM, &pRec->Counter, STAMTYPE_COUNTER, szCliStatName, STAMUNIT_OCCURENCES, "Number of times cli was executed.");
515
516	bool fRc = RTAvlPVInsert(&pVM->em.s.pCliStatTree, &pRec->Core);
517	Assert(fRc); NOREF(fRc);
518	}
519	STAM_COUNTER_INC(&pRec->Counter);
520	STAM_COUNTER_INC(&pVM->em.s.StatTotalClis);
521	}
522	#endif /* VBOX_WITH_STATISTICS */
523
524
525	/**
526	* Debug loop.
527	*
528	* @returns VBox status code for EM.
529	* @param pVM VM handle.
530	* @param rc Current EM VBox status code..
531	*/
532	static int emR3Debug(PVM pVM, int rc)
533	{
534	for (;;)
535	{
536	Log(("emR3Debug: rc=%Vrc\n", rc));
537	const int rcLast = rc;
538
539	/*
540	* Debug related RC.
541	*/
542	switch (rc)
543	{
544	/*
545	* Single step an instruction.
546	*/
547	case VINF_EM_DBG_STEP:
548	if ( pVM->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
549	\|\| pVM->em.s.enmState == EMSTATE_DEBUG_HYPER
550	\|\| pVM->em.s.fForceRAW /* paranoia */)
551	rc = emR3RawStep(pVM);
552	else
553	{
554	Assert(pVM->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
555	rc = emR3RemStep(pVM);
556	}
557	break;
558
559	/*
560	* Simple events: stepped, breakpoint, stop/assertion.
561	*/
562	case VINF_EM_DBG_STEPPED:
563	rc = DBGFR3Event(pVM, DBGFEVENT_STEPPED);
564	break;
565
566	case VINF_EM_DBG_BREAKPOINT:
567	rc = DBGFR3EventBreakpoint(pVM, DBGFEVENT_BREAKPOINT);
568	break;
569
570	case VINF_EM_DBG_STOP:
571	rc = DBGFR3EventSrc(pVM, DBGFEVENT_DEV_STOP, NULL, 0, NULL, NULL);
572	break;
573
574	case VINF_EM_DBG_HYPER_STEPPED:
575	rc = DBGFR3Event(pVM, DBGFEVENT_STEPPED_HYPER);
576	break;
577
578	case VINF_EM_DBG_HYPER_BREAKPOINT:
579	rc = DBGFR3EventBreakpoint(pVM, DBGFEVENT_BREAKPOINT_HYPER);
580	break;
581
582	case VINF_EM_DBG_HYPER_ASSERTION:
583	RTPrintf("\nVINF_EM_DBG_HYPER_ASSERTION:\n%s%s\n", VMMR3GetGCAssertMsg1(pVM), VMMR3GetGCAssertMsg2(pVM));
584	rc = DBGFR3EventAssertion(pVM, DBGFEVENT_ASSERTION_HYPER, VMMR3GetGCAssertMsg1(pVM), VMMR3GetGCAssertMsg2(pVM));
585	break;
586
587	/*
588	* Guru meditation.
589	*/
590	default: /** @todo don't use default for guru, but make special errors code! */
591	rc = DBGFR3Event(pVM, DBGFEVENT_FATAL_ERROR);
592	break;
593	}
594
595	/*
596	* Process the result.
597	*/
598	do
599	{
600	switch (rc)
601	{
602	/*
603	* Continue the debugging loop.
604	*/
605	case VINF_EM_DBG_STEP:
606	case VINF_EM_DBG_STOP:
607	case VINF_EM_DBG_STEPPED:
608	case VINF_EM_DBG_BREAKPOINT:
609	case VINF_EM_DBG_HYPER_STEPPED:
610	case VINF_EM_DBG_HYPER_BREAKPOINT:
611	case VINF_EM_DBG_HYPER_ASSERTION:
612	break;
613
614	/*
615	* Resuming execution (in some form) has to be done here if we got
616	* a hypervisor debug event.
617	*/
618	case VINF_SUCCESS:
619	case VINF_EM_RESUME:
620	case VINF_EM_SUSPEND:
621	case VINF_EM_RESCHEDULE:
622	case VINF_EM_RESCHEDULE_RAW:
623	case VINF_EM_RESCHEDULE_REM:
624	case VINF_EM_HALT:
625	if (pVM->em.s.enmState == EMSTATE_DEBUG_HYPER)
626	{
627	rc = emR3RawResumeHyper(pVM);
628	if (rc != VINF_SUCCESS && VBOX_SUCCESS(rc))
629	continue;
630	}
631	if (rc == VINF_SUCCESS)
632	rc = VINF_EM_RESCHEDULE;
633	return rc;
634
635	/*
636	* The debugger isn't attached.
637	* We'll simply turn the thing off since that's the easiest thing to do.
638	*/
639	case VERR_DBGF_NOT_ATTACHED:
640	switch (rcLast)
641	{
642	case VINF_EM_DBG_HYPER_ASSERTION:
643	case VINF_EM_DBG_HYPER_STEPPED:
644	case VINF_EM_DBG_HYPER_BREAKPOINT:
645	return rcLast;
646	}
647	return VINF_EM_OFF;
648
649	/*
650	* Status codes terminating the VM in one or another sense.
651	*/
652	case VINF_EM_TERMINATE:
653	case VINF_EM_OFF:
654	case VINF_EM_RESET:
655	case VINF_EM_RAW_STALE_SELECTOR:
656	case VINF_EM_RAW_IRET_TRAP:
657	case VERR_TRPM_PANIC:
658	case VERR_TRPM_DONT_PANIC:
659	case VERR_INTERNAL_ERROR:
660	return rc;
661
662	/*
663	* The rest is unexpected, and will keep us here.
664	*/
665	default:
666	AssertMsgFailed(("Unxpected rc %Vrc!\n", rc));
667	break;
668	}
669	} while (false);
670	} /* debug for ever */
671	}
672
673
674	/**
675	* Steps recompiled code.
676	*
677	* @returns VBox status code. The most important ones are: VINF_EM_STEP_EVENT,
678	* VINF_EM_RESCHEDULE, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
679	*
680	* @param pVM VM handle.
681	*/
682	static int emR3RemStep(PVM pVM)
683	{
684	LogFlow(("emR3RemStep: cs:eip=%04x:%08x\n", CPUMGetGuestCS(pVM), CPUMGetGuestEIP(pVM)));
685
686	/*
687	* Switch to REM, step instruction, switch back.
688	*/
689	int rc = REMR3State(pVM);
690	if (VBOX_SUCCESS(rc))
691	{
692	rc = REMR3Step(pVM);
693	REMR3StateBack(pVM);
694	}
695	LogFlow(("emR3RemStep: returns %Vrc cs:eip=%04x:%08x\n", rc, CPUMGetGuestCS(pVM), CPUMGetGuestEIP(pVM)));
696	return rc;
697	}
698
699	/**
700	* Executes recompiled code.
701	*
702	* This function contains the recompiler version of the inner
703	* execution loop (the outer loop being in EMR3ExecuteVM()).
704	*
705	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
706	* VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
707	*
708	* @param pVM VM handle.
709	* @param pfFFDone Where to store an indicator telling wheter or not
710	* FFs were done before returning.
711	*
712	*/
713	static int emR3RemExecute(PVM pVM, bool *pfFFDone)
714	{
715	#ifdef LOG_ENABLED
716	PCPUMCTX pCtx = pVM->em.s.pCtx;
717	if (pCtx->eflags.Bits.u1VM)
718	Log(("EMV86: %04X:%08X IF=%d\n", pCtx->cs, pCtx->eip, pCtx->eflags.Bits.u1IF));
719	else if ((pCtx->ss & X86_SEL_RPL) == 0)
720	Log(("EMR0: %08X ESP=%08X IF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, (pCtx->ss & X86_SEL_RPL)));
721	else if ((pCtx->ss & X86_SEL_RPL) == 3)
722	Log(("EMR3: %08X ESP=%08X IF=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF));
723	#endif
724	STAM_PROFILE_ADV_START(&pVM->em.s.StatREMTotal, a);
725
726	#if defined(VBOX_STRICT) && defined(DEBUG_bird)
727	AssertMsg( VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3\|VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
728	\|\| !MMHyperIsInsideArea(pVM, CPUMGetGuestEIP(pVM)), /** @todo #1419 - get flat address. */
729	("cs:eip=%RX16:%RX32\n", CPUMGetGuestCS(pVM), CPUMGetGuestEIP(pVM)));
730	#endif
731
732	/*
733	* Spin till we get a forced action which returns anything but VINF_SUCCESS
734	* or the REM suggests raw-mode execution.
735	*/
736	*pfFFDone = false;
737	bool fInREMState = false;
738	int rc = VINF_SUCCESS;
739	for (;;)
740	{
741	/*
742	* Update REM state if not already in sync.
743	*/
744	if (!fInREMState)
745	{
746	STAM_PROFILE_START(&pVM->em.s.StatREMSync, b);
747	rc = REMR3State(pVM);
748	STAM_PROFILE_STOP(&pVM->em.s.StatREMSync, b);
749	if (VBOX_FAILURE(rc))
750	break;
751	fInREMState = true;
752
753	/*
754	* We might have missed the raising of VMREQ, TIMER and some other
755	* imporant FFs while we were busy switching the state. So, check again.
756	*/
757	if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST \| VM_FF_TIMER \| VM_FF_PDM_QUEUES \| VM_FF_DBGF \| VM_FF_TERMINATE \| VM_FF_RESET))
758	{
759	LogFlow(("emR3RemExecute: Skipping run, because FF is set. %#x\n", pVM->fForcedActions));
760	goto l_REMDoForcedActions;
761	}
762	}
763
764
765	/*
766	* Execute REM.
767	*/
768	STAM_PROFILE_START(&pVM->em.s.StatREMExec, c);
769	rc = REMR3Run(pVM);
770	STAM_PROFILE_STOP(&pVM->em.s.StatREMExec, c);
771
772
773	/*
774	* Deal with high priority post execution FFs before doing anything else.
775	*/
776	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK))
777	rc = emR3HighPriorityPostForcedActions(pVM, rc);
778
779	/*
780	* Process the returned status code.
781	* (Try keep this short! Call functions!)
782	*/
783	if (rc != VINF_SUCCESS)
784	{
785	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
786	break;
787	if (rc != VINF_REM_INTERRUPED_FF)
788	{
789	/*
790	* Anything which is not known to us means an internal error
791	* and the termination of the VM!
792	*/
793	AssertMsgFailed(("Unknown GC return code: %Vra\n", rc));
794	break;
795	}
796	}
797
798
799	/*
800	* Check and execute forced actions.
801	* Sync back the VM state before calling any of these.
802	*/
803	#ifdef VBOX_HIGH_RES_TIMERS_HACK
804	TMTimerPoll(pVM);
805	#endif
806	if (VM_FF_ISPENDING(pVM, VM_FF_ALL_BUT_RAW_MASK & ~(VM_FF_CSAM_FLUSH_DIRTY_PAGE \| VM_FF_CSAM_SCAN_PAGE)))
807	{
808	l_REMDoForcedActions:
809	if (fInREMState)
810	{
811	STAM_PROFILE_START(&pVM->em.s.StatREMSync, d);
812	REMR3StateBack(pVM);
813	STAM_PROFILE_STOP(&pVM->em.s.StatREMSync, d);
814	fInREMState = false;
815	}
816	STAM_PROFILE_ADV_SUSPEND(&pVM->em.s.StatREMTotal, a);
817	rc = emR3ForcedActions(pVM, rc);
818	STAM_PROFILE_ADV_RESUME(&pVM->em.s.StatREMTotal, a);
819	if ( rc != VINF_SUCCESS
820	&& rc != VINF_EM_RESCHEDULE_REM)
821	{
822	*pfFFDone = true;
823	break;
824	}
825	}
826
827	} /* The Inner Loop, recompiled execution mode version. */
828
829
830	/*
831	* Returning. Sync back the VM state if required.
832	*/
833	if (fInREMState)
834	{
835	STAM_PROFILE_START(&pVM->em.s.StatREMSync, e);
836	REMR3StateBack(pVM);
837	STAM_PROFILE_STOP(&pVM->em.s.StatREMSync, e);
838	}
839
840	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatREMTotal, a);
841	return rc;
842	}
843
844
845	/**
846	* Resumes executing hypervisor after a debug event.
847	*
848	* This is kind of special since our current guest state is
849	* potentially out of sync.
850	*
851	* @returns VBox status code.
852	* @param pVM The VM handle.
853	*/
854	static int emR3RawResumeHyper(PVM pVM)
855	{
856	int rc;
857	PCPUMCTX pCtx = pVM->em.s.pCtx;
858	Assert(pVM->em.s.enmState == EMSTATE_DEBUG_HYPER);
859	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr\n", pCtx->cs, pCtx->eip, pCtx->eflags));
860
861	/*
862	* Resume execution.
863	*/
864	CPUMRawEnter(pVM, NULL);
865	CPUMSetHyperEFlags(pVM, CPUMGetHyperEFlags(pVM) \| X86_EFL_RF);
866	rc = VMMR3ResumeHyper(pVM);
867	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - returned from GC with rc=%Vrc\n", pCtx->cs, pCtx->eip, pCtx->eflags, rc));
868	rc = CPUMRawLeave(pVM, NULL, rc);
869	VM_FF_CLEAR(pVM, VM_FF_RESUME_GUEST_MASK);
870
871	/*
872	* Deal with the return code.
873	*/
874	rc = emR3HighPriorityPostForcedActions(pVM, rc);
875	rc = emR3RawHandleRC(pVM, pCtx, rc);
876	rc = emR3RawUpdateForceFlag(pVM, pCtx, rc);
877	return rc;
878	}
879
880
881	/**
882	* Steps rawmode.
883	*
884	* @returns VBox status code.
885	* @param pVM The VM handle.
886	*/
887	static int emR3RawStep(PVM pVM)
888	{
889	Assert( pVM->em.s.enmState == EMSTATE_DEBUG_HYPER
890	\|\| pVM->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
891	\|\| pVM->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
892	int rc;
893	PCPUMCTX pCtx = pVM->em.s.pCtx;
894	bool fGuest = pVM->em.s.enmState != EMSTATE_DEBUG_HYPER;
895	#ifndef DEBUG_sandervl
896	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr\n", fGuest ? CPUMGetGuestCS(pVM) : CPUMGetHyperCS(pVM),
897	fGuest ? CPUMGetGuestEIP(pVM) : CPUMGetHyperEIP(pVM), fGuest ? CPUMGetGuestEFlags(pVM) : CPUMGetHyperEFlags(pVM)));
898	#endif
899	if (fGuest)
900	{
901	/*
902	* Check vital forced actions, but ignore pending interrupts and timers.
903	*/
904	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK))
905	{
906	rc = emR3RawForcedActions(pVM, pCtx);
907	if (VBOX_FAILURE(rc))
908	return rc;
909	}
910
911	/*
912	* Set flags for single stepping.
913	*/
914	CPUMSetGuestEFlags(pVM, CPUMGetGuestEFlags(pVM) \| X86_EFL_TF \| X86_EFL_RF);
915	}
916	else
917	CPUMSetHyperEFlags(pVM, CPUMGetHyperEFlags(pVM) \| X86_EFL_TF \| X86_EFL_RF);
918
919	/*
920	* Single step.
921	* We do not start time or anything, if anything we should just do a few nanoseconds.
922	*/
923	CPUMRawEnter(pVM, NULL);
924	do
925	{
926	if (pVM->em.s.enmState == EMSTATE_DEBUG_HYPER)
927	rc = VMMR3ResumeHyper(pVM);
928	else
929	rc = VMMR3RawRunGC(pVM);
930	#ifndef DEBUG_sandervl
931	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - GC rc %Vrc\n", fGuest ? CPUMGetGuestCS(pVM) : CPUMGetHyperCS(pVM),
932	fGuest ? CPUMGetGuestEIP(pVM) : CPUMGetHyperEIP(pVM), fGuest ? CPUMGetGuestEFlags(pVM) : CPUMGetHyperEFlags(pVM), rc));
933	#endif
934	} while ( rc == VINF_SUCCESS
935	\|\| rc == VINF_EM_RAW_INTERRUPT);
936	rc = CPUMRawLeave(pVM, NULL, rc);
937	VM_FF_CLEAR(pVM, VM_FF_RESUME_GUEST_MASK);
938
939	/*
940	* Make sure the trap flag is cleared.
941	* (Too bad if the guest is trying to single step too.)
942	*/
943	if (fGuest)
944	CPUMSetGuestEFlags(pVM, CPUMGetGuestEFlags(pVM) & ~X86_EFL_TF);
945	else
946	CPUMSetHyperEFlags(pVM, CPUMGetHyperEFlags(pVM) & ~X86_EFL_TF);
947
948	/*
949	* Deal with the return codes.
950	*/
951	rc = emR3HighPriorityPostForcedActions(pVM, rc);
952	rc = emR3RawHandleRC(pVM, pCtx, rc);
953	rc = emR3RawUpdateForceFlag(pVM, pCtx, rc);
954	return rc;
955	}
956
957	#ifdef DEBUG_sandervl
958	void emR3SingleStepExecRaw(PVM pVM, uint32_t cIterations)
959	{
960	EMSTATE enmOldState = pVM->em.s.enmState;
961	PCPUMCTX pCtx = pVM->em.s.pCtx;
962
963	pVM->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
964
965	Log(("Single step BEGIN:\n"));
966	for(uint32_t i=0;i<cIterations;i++)
967	{
968	DBGFR3PrgStep(pVM);
969	DBGFR3DisasInstrCurrentLog(pVM, "RSS: ");
970	emR3RawStep(pVM);
971	}
972	Log(("Single step END:\n"));
973	CPUMSetGuestEFlags(pVM, CPUMGetGuestEFlags(pVM) & ~X86_EFL_TF);
974	pVM->em.s.enmState = enmOldState;
975	}
976
977	void emR3SingleStepExecRem(PVM pVM, uint32_t cIterations)
978	{
979	EMSTATE enmOldState = pVM->em.s.enmState;
980	PCPUMCTX pCtx = pVM->em.s.pCtx;
981
982	pVM->em.s.enmState = EMSTATE_DEBUG_GUEST_REM;
983
984	Log(("Single step BEGIN:\n"));
985	for(uint32_t i=0;i<cIterations;i++)
986	{
987	DBGFR3PrgStep(pVM);
988	DBGFR3DisasInstrCurrentLog(pVM, "RSS: ");
989	emR3RemStep(pVM);
990	}
991	Log(("Single step END:\n"));
992	CPUMSetGuestEFlags(pVM, CPUMGetGuestEFlags(pVM) & ~X86_EFL_TF);
993	pVM->em.s.enmState = enmOldState;
994	}
995	#endif
996
997	/**
998	* Executes one (or perhaps a few more) instruction(s).
999	*
1000	* @returns VBox status code suitable for EM.
1001	*
1002	* @param pVM VM handle.
1003	* @param rcGC GC return code
1004	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
1005	* instruction and prefix the log output with this text.
1006	*/
1007	#ifdef LOG_ENABLED
1008	static int emR3RawExecuteInstructionWorker(PVM pVM, int rcGC, const char *pszPrefix)
1009	#else
1010	static int emR3RawExecuteInstructionWorker(PVM pVM, int rcGC)
1011	#endif
1012	{
1013	PCPUMCTX pCtx = pVM->em.s.pCtx;
1014	int rc;
1015
1016	/*
1017	*
1018	* The simple solution is to use the recompiler.
1019	* The better solution is to disassemble the current instruction and
1020	* try handle as many as possible without using REM.
1021	*
1022	*/
1023
1024	#ifdef LOG_ENABLED
1025	/*
1026	* Disassemble the instruction if requested.
1027	*/
1028	if (pszPrefix)
1029	{
1030	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
1031	DBGFR3DisasInstrCurrentLog(pVM, pszPrefix);
1032	}
1033	#endif /* LOG_ENABLED */
1034
1035
1036	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) != 1);
1037
1038	/*
1039	* PATM is making life more interesting.
1040	* We cannot hand anything to REM which has an EIP inside patch code. So, we'll
1041	* tell PATM there is a trap in this code and have it take the appropriate actions
1042	* to allow us execute the code in REM.
1043	*/
1044	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1045	{
1046	Log(("emR3RawExecuteInstruction: In patch block. eip=%VGv\n", pCtx->eip));
1047
1048	RTGCPTR pNewEip;
1049	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
1050	switch (rc)
1051	{
1052	/*
1053	* It's not very useful to emulate a single instruction and then go back to raw
1054	* mode; just execute the whole block until IF is set again.
1055	*/
1056	case VINF_SUCCESS:
1057	Log(("emR3RawExecuteInstruction: Executing instruction starting at new address %VGv IF=%d VMIF=%x\n",
1058	pNewEip, pCtx->eflags.Bits.u1IF, pVM->em.s.pPatmGCState->uVMFlags));
1059	pCtx->eip = pNewEip;
1060	Assert(pCtx->eip);
1061
1062	if (pCtx->eflags.Bits.u1IF)
1063	{
1064	/*
1065	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
1066	*/
1067	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
1068	return emR3RawExecuteInstruction(pVM, "PATCHIR");
1069	}
1070	#if 0 /** @note no noticable change; revisit later when we can emulate iret ourselves. */
1071	else if (rcGC == VINF_PATM_PENDING_IRQ_AFTER_IRET)
1072	{
1073	/* special case: iret, that sets IF, detected a pending irq/event */
1074	return emR3RawExecuteInstruction(pVM, "PATCHIRET");
1075	}
1076	#endif
1077	return VINF_EM_RESCHEDULE_REM;
1078
1079	/*
1080	* One instruction.
1081	*/
1082	case VINF_PATCH_EMULATE_INSTR:
1083	Log(("emR3RawExecuteInstruction: Emulate patched instruction at %VGv IF=%d VMIF=%x\n",
1084	pNewEip, pCtx->eflags.Bits.u1IF, pVM->em.s.pPatmGCState->uVMFlags));
1085	pCtx->eip = pNewEip;
1086	return emR3RawExecuteInstruction(pVM, "PATCHIR");
1087
1088	/*
1089	* The patch was disabled, hand it to the REM.
1090	*/
1091	case VERR_PATCH_DISABLED:
1092	Log(("emR3RawExecuteInstruction: Disabled patch -> new eip %VGv IF=%d VMIF=%x\n",
1093	pNewEip, pCtx->eflags.Bits.u1IF, pVM->em.s.pPatmGCState->uVMFlags));
1094	pCtx->eip = pNewEip;
1095	if (pCtx->eflags.Bits.u1IF)
1096	{
1097	/*
1098	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
1099	*/
1100	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
1101	return emR3RawExecuteInstruction(pVM, "PATCHIR");
1102	}
1103	return VINF_EM_RESCHEDULE_REM;
1104
1105	/* Force continued patch exection; usually due to write monitored stack. */
1106	case VINF_PATCH_CONTINUE:
1107	return VINF_SUCCESS;
1108
1109	default:
1110	AssertReleaseMsgFailed(("Unknown return code %Vrc from PATMR3HandleTrap\n", rc));
1111	return VERR_INTERNAL_ERROR;
1112	}
1113	}
1114
1115	#if 0 /// @todo Sander, this breaks the linux image (panics). So, I'm disabling it for now. (OP_MOV triggers it btw.)
1116	DISCPUSTATE Cpu;
1117	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &Cpu, "GEN EMU");
1118	if (VBOX_SUCCESS(rc))
1119	{
1120	uint32_t size;
1121
1122	switch (Cpu.pCurInstr->opcode)
1123	{
1124	case OP_MOV:
1125	case OP_AND:
1126	case OP_OR:
1127	case OP_XOR:
1128	case OP_POP:
1129	case OP_INC:
1130	case OP_DEC:
1131	case OP_XCHG:
1132	STAM_PROFILE_START(&pVM->em.s.StatMiscEmu, a);
1133	rc = EMInterpretInstructionCPU(pVM, &Cpu, CPUMCTX2CORE(pCtx), 0, &size);
1134	if (VBOX_SUCCESS(rc))
1135	{
1136	pCtx->eip += Cpu.opsize;
1137	STAM_PROFILE_STOP(&pVM->em.s.StatMiscEmu, a);
1138	return rc;
1139	}
1140	if (rc != VERR_EM_INTERPRETER)
1141	AssertMsgFailedReturn(("rc=%Vrc\n", rc), rc);
1142	STAM_PROFILE_STOP(&pVM->em.s.StatMiscEmu, a);
1143	break;
1144	}
1145	}
1146	#endif
1147	STAM_PROFILE_START(&pVM->em.s.StatREMEmu, a);
1148	rc = REMR3EmulateInstruction(pVM);
1149	STAM_PROFILE_STOP(&pVM->em.s.StatREMEmu, a);
1150
1151	return rc;
1152	}
1153
1154
1155	/**
1156	* Executes one (or perhaps a few more) instruction(s).
1157	* This is just a wrapper for discarding pszPrefix in non-logging builds.
1158	*
1159	* @returns VBox status code suitable for EM.
1160	* @param pVM VM handle.
1161	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
1162	* instruction and prefix the log output with this text.
1163	* @param rcGC GC return code
1164	*/
1165	DECLINLINE(int) emR3RawExecuteInstruction(PVM pVM, const char *pszPrefix, int rcGC)
1166	{
1167	#ifdef LOG_ENABLED
1168	return emR3RawExecuteInstructionWorker(pVM, rcGC, pszPrefix);
1169	#else
1170	return emR3RawExecuteInstructionWorker(pVM, rcGC);
1171	#endif
1172	}
1173
1174	/**
1175	* Executes one (or perhaps a few more) IO instruction(s).
1176	*
1177	* @returns VBox status code suitable for EM.
1178	* @param pVM VM handle.
1179	*/
1180	int emR3RawExecuteIOInstruction(PVM pVM)
1181	{
1182	int rc;
1183	PCPUMCTX pCtx = pVM->em.s.pCtx;
1184
1185	STAM_PROFILE_START(&pVM->em.s.StatIOEmu, a);
1186
1187	/** @todo probably we should fall back to the recompiler; otherwise we'll go back and forth between HC & GC
1188	* as io instructions tend to come in packages of more than one
1189	*/
1190	DISCPUSTATE Cpu;
1191	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &Cpu, "IO EMU");
1192	if (VBOX_SUCCESS(rc))
1193	{
1194	#ifdef VBOX_WITH_STATISTICS
1195	switch (Cpu.pCurInstr->opcode)
1196	{
1197	case OP_INSB:
1198	case OP_INSWD:
1199	case OP_IN:
1200	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatIn);
1201	break;
1202
1203	case OP_OUTSB:
1204	case OP_OUTSWD:
1205	case OP_OUT:
1206	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatOut);
1207	break;
1208	}
1209	#endif
1210
1211	if (!(Cpu.prefix & (PREFIX_REP \| PREFIX_REPNE)))
1212	{
1213	OP_PARAMVAL ParmVal;
1214	int rc;
1215	switch (Cpu.pCurInstr->opcode)
1216	{
1217	case OP_IN:
1218	{
1219	rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), &Cpu, &Cpu.param2, &ParmVal, PARAM_SOURCE);
1220	if ( VBOX_FAILURE(rc)
1221	\|\| ParmVal.type != PARMTYPE_IMMEDIATE)
1222	break;
1223
1224	if (!(Cpu.param1.flags & (USE_REG_GEN8 \| USE_REG_GEN16 \| USE_REG_GEN32)))
1225	break;
1226
1227	/* Make sure port access is allowed */
1228	rc = IOMInterpretCheckPortIOAccess(pVM, CPUMCTX2CORE(pCtx), ParmVal.val.val16, Cpu.param1.size);
1229	if (rc != VINF_SUCCESS)
1230	{
1231	if (rc == VINF_EM_RAW_GUEST_TRAP)
1232	rc = emR3RawGuestTrap(pVM);
1233
1234	return rc;
1235	}
1236
1237	uint32_t u32Value = 0;
1238	switch (Cpu.param1.size)
1239	{
1240	case 1:
1241	Assert(Cpu.param1.base.reg_gen8 == USE_REG_AL);
1242	rc = IOMIOPortRead(pVM, ParmVal.val.val16, &u32Value, sizeof(uint8_t));
1243	if (VBOX_SUCCESS(rc))
1244	{
1245	pCtx->eax = (pCtx->eax & ~0xFF) \| (uint8_t)u32Value;
1246	Log(("EMU: in8 %x, %x\n", ParmVal.val.val16, pCtx->eax & 0xFF));
1247	pCtx->eip += Cpu.opsize;
1248	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1249	return rc;
1250	}
1251	AssertRC(rc);
1252	break;
1253
1254	case 2:
1255	Assert(Cpu.param1.base.reg_gen16 == USE_REG_AX);
1256	rc = IOMIOPortRead(pVM, ParmVal.val.val16, &u32Value, sizeof(uint16_t));
1257	if (VBOX_SUCCESS(rc))
1258	{
1259	pCtx->eax = (pCtx->eax & ~0xFFFF) \| (uint16_t)u32Value;
1260	Log(("EMU: in16 %x, %x\n", ParmVal.val.val16, pCtx->eax & 0xFFFF));
1261	pCtx->eip += Cpu.opsize;
1262	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1263	return rc;
1264	}
1265	AssertRC(rc);
1266	break;
1267
1268	case 4:
1269	Assert(Cpu.param1.base.reg_gen32 == USE_REG_EAX);
1270	rc = IOMIOPortRead(pVM, ParmVal.val.val16, &u32Value, sizeof(uint32_t));
1271	if (VBOX_SUCCESS(rc))
1272	{
1273	pCtx->eax = u32Value;
1274	Log(("EMU: in32 %x, %x\n", ParmVal.val.val16, pCtx->eax));
1275	pCtx->eip += Cpu.opsize;
1276	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1277	return rc;
1278	}
1279	AssertRC(rc);
1280	break;
1281
1282	default:
1283	AssertMsgFailed(("Unexpected port size %d\n", ParmVal.size));
1284	break;
1285	}
1286	break;
1287	}
1288
1289	case OP_OUT:
1290	{
1291	// it really is the destination, but we're interested in the destination value. hence we specify PARAM_SOURCE (bit of a hack)
1292	rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), &Cpu, &Cpu.param1, &ParmVal, PARAM_SOURCE);
1293	if ( VBOX_FAILURE(rc)
1294	\|\| ParmVal.type != PARMTYPE_IMMEDIATE)
1295	break;
1296	OP_PARAMVAL ParmVal2;
1297	rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), &Cpu, &Cpu.param2, &ParmVal2, PARAM_SOURCE);
1298	if ( VBOX_FAILURE(rc)
1299	\|\| ParmVal2.type != PARMTYPE_IMMEDIATE)
1300	break;
1301
1302	/* Make sure port access is allowed */
1303	rc = IOMInterpretCheckPortIOAccess(pVM, CPUMCTX2CORE(pCtx), ParmVal.val.val16, Cpu.param1.size);
1304	if (rc != VINF_SUCCESS)
1305	{
1306	if (rc == VINF_EM_RAW_GUEST_TRAP)
1307	rc = emR3RawGuestTrap(pVM);
1308
1309	return rc;
1310	}
1311
1312	AssertMsg(Cpu.param2.size == ParmVal2.size, ("size %d vs %d\n", Cpu.param2.size, ParmVal2.size));
1313	switch (ParmVal2.size)
1314	{
1315	case 1:
1316	Log(("EMU: out8 %x, %x\n", ParmVal.val.val16, ParmVal2.val.val8));
1317	rc = IOMIOPortWrite(pVM, ParmVal.val.val16, ParmVal2.val.val8, sizeof(ParmVal2.val.val8));
1318	if (VBOX_SUCCESS(rc))
1319	{
1320	pCtx->eip += Cpu.opsize;
1321	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1322	return rc;
1323	}
1324	AssertRC(rc);
1325	break;
1326
1327	case 2:
1328	Log(("EMU: out16 %x, %x\n", ParmVal.val.val16, ParmVal2.val.val16));
1329	rc = IOMIOPortWrite(pVM, ParmVal.val.val16, ParmVal2.val.val16, sizeof(ParmVal2.val.val16));
1330	if (VBOX_SUCCESS(rc))
1331	{
1332	pCtx->eip += Cpu.opsize;
1333	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1334	return rc;
1335	}
1336	AssertRC(rc);
1337	break;
1338
1339	case 4:
1340	Log(("EMU: out32 %x, %x\n", ParmVal.val.val16, ParmVal2.val.val32));
1341	rc = IOMIOPortWrite(pVM, ParmVal.val.val16, ParmVal2.val.val32, sizeof(ParmVal2.val.val32));
1342	if (VBOX_SUCCESS(rc))
1343	{
1344	pCtx->eip += Cpu.opsize;
1345	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1346	return rc;
1347	}
1348	AssertRC(rc);
1349	break;
1350
1351	default:
1352	AssertMsgFailed(("Unexpected port size %d\n", ParmVal2.size));
1353	break;
1354	}
1355	break;
1356	}
1357
1358	default:
1359	break;
1360	}
1361	}//if(!(Cpu.prefix & (PREFIX_REP\|PREFIX_REPNE))
1362	else if (Cpu.prefix & PREFIX_REP)
1363	{
1364	switch (Cpu.pCurInstr->opcode)
1365	{
1366	case OP_INSB:
1367	case OP_INSWD:
1368	{
1369	/*
1370	* Do not optimize the destination address decrement case (not worth the effort)
1371	* and likewise for 16 bit address size (would need to use and update only cx/di).
1372	*/
1373	if (pCtx->eflags.Bits.u1DF \|\| Cpu.addrmode != CPUMODE_32BIT)
1374	break;
1375	/*
1376	* Get port number and transfer count directly from the registers (no need to bother the
1377	* disassembler). And get the I/O register size from the opcode / prefix.
1378	*/
1379	uint32_t uPort = pCtx->edx & 0xffff;
1380	RTGCUINTREG cTransfers = pCtx->ecx;
1381	unsigned cbUnit;
1382	if (Cpu.pCurInstr->opcode == OP_INSB)
1383	cbUnit = 1;
1384	else
1385	cbUnit = Cpu.opmode == CPUMODE_32BIT ? 4 : 2;
1386
1387	RTGCPTR GCPtrDst = pCtx->edi;
1388	uint32_t cpl = (pCtx->eflags.Bits.u1VM) ? 3 : (pCtx->ss & X86_SEL_RPL);
1389
1390	/* Access verification first; we can't recover from traps inside this instruction, as the port read cannot be repeated. */
1391	rc = PGMVerifyAccess(pVM, GCPtrDst, cTransfers * cbUnit,
1392	X86_PTE_RW \| ((cpl == 3) ? X86_PTE_US : 0));
1393	if (rc != VINF_SUCCESS)
1394	{
1395	Log(("EMU: rep ins%d will generate a trap -> fallback, rc=%d\n", cbUnit * 8, rc));
1396	break;
1397	}
1398
1399	Log(("EMU: rep ins%d port %#x count %d\n", cbUnit * 8, uPort, cTransfers));
1400
1401	/* Make sure port access is allowed */
1402	rc = IOMInterpretCheckPortIOAccess(pVM, CPUMCTX2CORE(pCtx), uPort, cbUnit);
1403	if (rc != VINF_SUCCESS)
1404	{
1405	if (rc == VINF_EM_RAW_GUEST_TRAP)
1406	rc = emR3RawGuestTrap(pVM);
1407
1408	return rc;
1409	}
1410
1411	/*
1412	* If the device supports string transfers, ask it to do as
1413	* much as it wants. The rest is done with single-word transfers.
1414	*/
1415	rc = IOMIOPortReadString(pVM, uPort, &GCPtrDst, &cTransfers, cbUnit);
1416	AssertRC(rc); Assert(cTransfers <= pCtx->ecx);
1417
1418	while (cTransfers && rc == VINF_SUCCESS)
1419	{
1420	uint32_t u32Value;
1421	rc = IOMIOPortRead(pVM, uPort, &u32Value, cbUnit);
1422	AssertRC(rc);
1423	int rc2 = PGMPhysWriteGCPtrDirty(pVM, GCPtrDst, &u32Value, cbUnit);
1424	AssertRC(rc2);
1425	GCPtrDst += cbUnit;
1426	cTransfers--;
1427	}
1428	pCtx->edi += (pCtx->ecx - cTransfers) * cbUnit;
1429	pCtx->ecx = cTransfers;
1430	if (!cTransfers && VBOX_SUCCESS(rc))
1431	pCtx->eip += Cpu.opsize;
1432	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1433	return rc;
1434	}
1435	case OP_OUTSB:
1436	case OP_OUTSWD:
1437	{
1438	/*
1439	* Do not optimize the source address decrement case (not worth the effort)
1440	* and likewise for 16 bit address size (would need to use and update only cx/si).
1441	*/
1442	if (pCtx->eflags.Bits.u1DF \|\| Cpu.addrmode != CPUMODE_32BIT)
1443	break;
1444	/*
1445	* Get port number and transfer count directly from the registers (no need to bother the
1446	* disassembler). And get the I/O register size from the opcode / prefix.
1447	*/
1448	uint32_t uPort = pCtx->edx & 0xffff;
1449	RTGCUINTREG cTransfers = pCtx->ecx;
1450	unsigned cbUnit;
1451	if (Cpu.pCurInstr->opcode == OP_OUTSB)
1452	cbUnit = 1;
1453	else
1454	cbUnit = Cpu.opmode == CPUMODE_32BIT ? 4 : 2;
1455
1456	RTGCPTR GCPtrSrc = pCtx->esi;
1457	uint32_t cpl = (pCtx->eflags.Bits.u1VM) ? 3 : (pCtx->ss & X86_SEL_RPL);
1458
1459	/* Access verification first; we currently can't recover properly from traps inside this instruction */
1460	rc = PGMVerifyAccess(pVM, GCPtrSrc, cTransfers * cbUnit, ((cpl == 3) ? X86_PTE_US : 0));
1461	if (rc != VINF_SUCCESS)
1462	{
1463	Log(("EMU: rep outs%d will generate a trap -> fallback, rc=%d\n", cbUnit * 8, rc));
1464	break;
1465	}
1466
1467	Log(("EMU: rep outs%d port %#x count %d\n", cbUnit * 8, uPort, cTransfers));
1468
1469	/* Make sure port access is allowed */
1470	rc = IOMInterpretCheckPortIOAccess(pVM, CPUMCTX2CORE(pCtx), uPort, cbUnit);
1471	if (rc != VINF_SUCCESS)
1472	{
1473	if (rc == VINF_EM_RAW_GUEST_TRAP)
1474	rc = emR3RawGuestTrap(pVM);
1475
1476	return rc;
1477	}
1478
1479	/*
1480	* If the device supports string transfers, ask it to do as
1481	* much as it wants. The rest is done with single-word transfers.
1482	*/
1483	rc = IOMIOPortWriteString(pVM, uPort, &GCPtrSrc, &cTransfers, cbUnit);
1484	AssertRC(rc); Assert(cTransfers <= pCtx->ecx);
1485
1486	while (cTransfers && rc == VINF_SUCCESS)
1487	{
1488	uint32_t u32Value;
1489	rc = PGMPhysReadGCPtr(pVM, &u32Value, GCPtrSrc, cbUnit);
1490	Assert(rc == VINF_SUCCESS);
1491	rc = IOMIOPortWrite(pVM, uPort, u32Value, cbUnit);
1492	AssertRC(rc);
1493	GCPtrSrc += cbUnit;
1494	cTransfers--;
1495	}
1496	pCtx->esi += (pCtx->ecx - cTransfers) * cbUnit;
1497	pCtx->ecx = cTransfers;
1498	if (!cTransfers && VBOX_SUCCESS(rc))
1499	pCtx->eip += Cpu.opsize;
1500	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1501	return rc;
1502	}
1503	}
1504	}//if(Cpu.prefix & PREFIX_REP)
1505	}
1506
1507	STAM_PROFILE_STOP(&pVM->em.s.StatIOEmu, a);
1508	return emR3RawExecuteInstruction(pVM, "IO: ");
1509	}
1510
1511
1512	/**
1513	* Handle a guest context trap.
1514	*
1515	* @returns VBox status code suitable for EM.
1516	* @param pVM VM handle.
1517	*/
1518	static int emR3RawGuestTrap(PVM pVM)
1519	{
1520	PCPUMCTX pCtx = pVM->em.s.pCtx;
1521
1522	/*
1523	* Get the trap info.
1524	*/
1525	uint8_t u8TrapNo;
1526	bool fSoftwareInterrupt;
1527	RTGCUINT uErrorCode;
1528	RTGCUINTPTR uCR2;
1529	int rc = TRPMQueryTrapAll(pVM, &u8TrapNo, &fSoftwareInterrupt, &uErrorCode, &uCR2);
1530	if (VBOX_FAILURE(rc))
1531	{
1532	AssertReleaseMsgFailed(("No trap! (rc=%Vrc)\n", rc));
1533	return rc;
1534	}
1535
1536	/* Traps can be directly forwarded in hardware accelerated mode. */
1537	if (HWACCMR3IsActive(pVM))
1538	{
1539	#ifdef LOGGING_ENABLED
1540	DBGFR3InfoLog(pVM, "cpumguest", "Guest trap");
1541	DBGFR3DisasInstrCurrentLog(pVM, "Guest trap");
1542	#endif
1543	return VINF_EM_RESCHEDULE_HWACC;
1544	}
1545
1546	/** Scan kernel code that traps; we might not get another chance. */
1547	if ( (pCtx->ss & X86_SEL_RPL) <= 1
1548	&& !pCtx->eflags.Bits.u1VM)
1549	{
1550	Assert(!PATMIsPatchGCAddr(pVM, pCtx->eip));
1551	CSAMR3CheckCodeEx(pVM, pCtx->cs, &pCtx->csHid, pCtx->eip);
1552	}
1553
1554	if (u8TrapNo == 6) /* (#UD) Invalid opcode. */
1555	{
1556	DISCPUSTATE cpu;
1557
1558	/* If MONITOR & MWAIT are supported, then interpret them here. */
1559	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &cpu, "Guest Trap (#UD): ");
1560	if ( VBOX_SUCCESS(rc)
1561	&& (cpu.pCurInstr->opcode == OP_MONITOR \|\| cpu.pCurInstr->opcode == OP_MWAIT))
1562	{
1563	uint32_t u32Dummy, u32Features, u32ExtFeatures, size;
1564
1565	CPUMGetGuestCpuId(pVM, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Features);
1566
1567	if (u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR)
1568	{
1569	rc = TRPMResetTrap(pVM);
1570	AssertRC(rc);
1571
1572	rc = EMInterpretInstructionCPU(pVM, &cpu, CPUMCTX2CORE(pCtx), 0, &size);
1573	if (VBOX_SUCCESS(rc))
1574	{
1575	pCtx->eip += cpu.opsize;
1576	return rc;
1577	}
1578	return emR3RawExecuteInstruction(pVM, "Monitor: ");
1579	}
1580	}
1581	}
1582	else if (u8TrapNo == 13) /* (#GP) Privileged exception */
1583	{
1584	DISCPUSTATE cpu;
1585
1586	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &cpu, "Guest Trap: ");
1587	if (VBOX_SUCCESS(rc) && (cpu.pCurInstr->optype & OPTYPE_PORTIO))
1588	{
1589	/*
1590	* We should really check the TSS for the IO bitmap, but it's not like this
1591	* lazy approach really makes things worse.
1592	*/
1593	rc = TRPMResetTrap(pVM);
1594	AssertRC(rc);
1595	return emR3RawExecuteInstruction(pVM, "IO Guest Trap: ");
1596	}
1597	}
1598
1599	#ifdef LOG_ENABLED
1600	DBGFR3InfoLog(pVM, "cpumguest", "Guest trap");
1601	DBGFR3DisasInstrCurrentLog(pVM, "Guest trap");
1602
1603	/* Get guest page information. */
1604	uint64_t fFlags = 0;
1605	RTGCPHYS GCPhys = 0;
1606	int rc2 = PGMGstGetPage(pVM, uCR2, &fFlags, &GCPhys);
1607	Log(("emR3RawGuestTrap: cs:eip=%04x:%08x: trap=%02x err=%08x cr2=%08x cr0=%08x%s: Phys=%VGp fFlags=%08llx %s %s %s%s rc2=%d\n",
1608	pCtx->cs, pCtx->eip, u8TrapNo, uErrorCode, uCR2, pCtx->cr0, fSoftwareInterrupt ? " software" : "", GCPhys, fFlags,
1609	fFlags & X86_PTE_P ? "P " : "NP", fFlags & X86_PTE_US ? "U" : "S",
1610	fFlags & X86_PTE_RW ? "RW" : "R0", fFlags & X86_PTE_G ? " G" : "", rc2));
1611	#endif
1612
1613	/*
1614	* #PG has CR2.
1615	* (Because of stuff like above we must set CR2 in a delayed fashion.)
1616	*/
1617	if (u8TrapNo == 14 /* #PG */)
1618	pCtx->cr2 = uCR2;
1619
1620	return VINF_EM_RESCHEDULE_REM;
1621	}
1622
1623
1624	/**
1625	* Handle a ring switch trap.
1626	* Need to do statistics and to install patches. The result is going to REM.
1627	*
1628	* @returns VBox status code suitable for EM.
1629	* @param pVM VM handle.
1630	*/
1631	int emR3RawRingSwitch(PVM pVM)
1632	{
1633	int rc;
1634	DISCPUSTATE Cpu;
1635	PCPUMCTX pCtx = pVM->em.s.pCtx;
1636
1637	/*
1638	* sysenter, syscall & callgate
1639	*/
1640	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &Cpu, "RSWITCH: ");
1641	if (VBOX_SUCCESS(rc))
1642	{
1643	if (Cpu.pCurInstr->opcode == OP_SYSENTER)
1644	{
1645	if (pCtx->SysEnter.cs != 0)
1646	{
1647	rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pCtx->eip),
1648	SELMIsSelector32Bit(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) ? PATMFL_CODE32 : 0);
1649	if (VBOX_SUCCESS(rc))
1650	{
1651	DBGFR3DisasInstrCurrentLog(pVM, "Patched sysenter instruction");
1652	return VINF_EM_RESCHEDULE_RAW;
1653	}
1654	}
1655	}
1656
1657	#ifdef VBOX_WITH_STATISTICS
1658	switch (Cpu.pCurInstr->opcode)
1659	{
1660	case OP_SYSENTER:
1661	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatSysEnter);
1662	break;
1663	case OP_SYSEXIT:
1664	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatSysExit);
1665	break;
1666	case OP_SYSCALL:
1667	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatSysCall);
1668	break;
1669	case OP_SYSRET:
1670	STAM_COUNTER_INC(&pVM->em.s.CTXSUFF(pStats)->StatSysRet);
1671	break;
1672	}
1673	#endif
1674	}
1675	else
1676	AssertRC(rc);
1677
1678	/* go to the REM to emulate a single instruction */
1679	return emR3RawExecuteInstruction(pVM, "RSWITCH: ");
1680	}
1681
1682	/**
1683	* Handle a trap (#PF or #GP) in patch code
1684	*
1685	* @returns VBox status code suitable for EM.
1686	* @param pVM VM handle.
1687	* @param pCtx CPU context
1688	* @param gcret GC return code
1689	*/
1690	int emR3PatchTrap(PVM pVM, PCPUMCTX pCtx, int gcret)
1691	{
1692	uint8_t u8TrapNo;
1693	int rc;
1694	bool fSoftwareInterrupt;
1695	RTGCUINT uErrorCode;
1696	RTGCUINTPTR uCR2;
1697
1698	Assert(PATMIsPatchGCAddr(pVM, pCtx->eip));
1699
1700	if (gcret == VINF_PATM_PATCH_INT3)
1701	{
1702	u8TrapNo = 3;
1703	uCR2 = 0;
1704	uErrorCode = 0;
1705	}
1706	else
1707	if (gcret == VINF_PATM_PATCH_TRAP_GP)
1708	{
1709	/* No active trap in this case. Kind of ugly. */
1710	u8TrapNo = X86_XCPT_GP;
1711	uCR2 = 0;
1712	uErrorCode = 0;
1713	}
1714	else
1715	{
1716	rc = TRPMQueryTrapAll(pVM, &u8TrapNo, &fSoftwareInterrupt, &uErrorCode, &uCR2);
1717	if (VBOX_FAILURE(rc))
1718	{
1719	AssertReleaseMsgFailed(("emR3PatchTrap: no trap! (rc=%Vrc) gcret=%Vrc\n", rc, gcret));
1720	return rc;
1721	}
1722	/* Reset the trap as we'll execute the original instruction again. */
1723	TRPMResetTrap(pVM);
1724	}
1725
1726	/*
1727	* Deal with traps inside patch code.
1728	* (This code won't run outside GC.)
1729	*/
1730	if (u8TrapNo != 1)
1731	{
1732	#ifdef LOG_ENABLED
1733	DBGFR3InfoLog(pVM, "cpumguest", "Trap in patch code");
1734	DBGFR3DisasInstrCurrentLog(pVM, "Patch code");
1735
1736	DISCPUSTATE Cpu;
1737	int rc;
1738
1739	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &Cpu, "Patch code: ");
1740	if ( VBOX_SUCCESS(rc)
1741	&& Cpu.pCurInstr->opcode == OP_IRET)
1742	{
1743	uint32_t eip, selCS, uEFlags;
1744
1745	/* Iret crashes are bad as we have already changed the flags on the stack */
1746	rc = PGMPhysReadGCPtr(pVM, &eip, pCtx->esp, 4);
1747	rc \|= PGMPhysReadGCPtr(pVM, &selCS, pCtx->esp+4, 4);
1748	rc \|= PGMPhysReadGCPtr(pVM, &uEFlags, pCtx->esp+8, 4);
1749	if (rc == VINF_SUCCESS)
1750	{
1751	if ( (uEFlags & X86_EFL_VM)
1752	\|\| (selCS & X86_SEL_RPL) == 3)
1753	{
1754	uint32_t selSS, esp;
1755
1756	rc \|= PGMPhysReadGCPtr(pVM, &esp, pCtx->esp + 12, 4);
1757	rc \|= PGMPhysReadGCPtr(pVM, &selSS, pCtx->esp + 16, 4);
1758
1759	if (uEFlags & X86_EFL_VM)
1760	{
1761	uint32_t selDS, selES, selFS, selGS;
1762	rc = PGMPhysReadGCPtr(pVM, &selES, pCtx->esp + 20, 4);
1763	rc \|= PGMPhysReadGCPtr(pVM, &selDS, pCtx->esp + 24, 4);
1764	rc \|= PGMPhysReadGCPtr(pVM, &selFS, pCtx->esp + 28, 4);
1765	rc \|= PGMPhysReadGCPtr(pVM, &selGS, pCtx->esp + 32, 4);
1766	if (rc == VINF_SUCCESS)
1767	{
1768	Log(("Patch code: IRET->VM stack frame: return address %04X:%VGv eflags=%08x ss:esp=%04X:%VGv\n", selCS, eip, uEFlags, selSS, esp));
1769	Log(("Patch code: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
1770	}
1771	}
1772	else
1773	Log(("Patch code: IRET stack frame: return address %04X:%VGv eflags=%08x ss:esp=%04X:%VGv\n", selCS, eip, uEFlags, selSS, esp));
1774	}
1775	else
1776	Log(("Patch code: IRET stack frame: return address %04X:%VGv eflags=%08x\n", selCS, eip, uEFlags));
1777	}
1778	}
1779	#endif
1780	Log(("emR3PatchTrap: in patch: eip=%08x: trap=%02x err=%08x cr2=%08x cr0=%08x\n",
1781	pCtx->eip, u8TrapNo, uErrorCode, uCR2, pCtx->cr0));
1782
1783	RTGCPTR pNewEip;
1784	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
1785	switch (rc)
1786	{
1787	/*
1788	* Execute the faulting instruction.
1789	*/
1790	case VINF_SUCCESS:
1791	{
1792	/** @todo execute a whole block */
1793	Log(("emR3PatchTrap: Executing faulting instruction at new address %VGv\n", pNewEip));
1794	if (!(pVM->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
1795	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
1796
1797	pCtx->eip = pNewEip;
1798	AssertRelease(pCtx->eip);
1799
1800	if (pCtx->eflags.Bits.u1IF)
1801	{
1802	/* Windows XP lets irets fault intentionally and then takes action based on the opcode; an
1803	* int3 patch overwrites it and leads to blue screens. Remove the patch in this case.
1804	*/
1805	if ( u8TrapNo == X86_XCPT_GP
1806	&& PATMIsInt3Patch(pVM, pCtx->eip, NULL, NULL))
1807	{
1808	/** @todo move to PATMR3HandleTrap */
1809	Log(("Possible Windows XP iret fault at %VGv\n", pCtx->eip));
1810	PATMR3RemovePatch(pVM, pCtx->eip);
1811	}
1812
1813	/** @todo Knoppix 5 regression when returning VINF_SUCCESS here and going back to raw mode. */
1814	/** @note possibly because a reschedule is required (e.g. iret to V86 code) */
1815
1816	return emR3RawExecuteInstruction(pVM, "PATCHIR");
1817	/* Interrupts are enabled; just go back to the original instruction.
1818	return VINF_SUCCESS; */
1819	}
1820	return VINF_EM_RESCHEDULE_REM;
1821	}
1822
1823	/*
1824	* One instruction.
1825	*/
1826	case VINF_PATCH_EMULATE_INSTR:
1827	Log(("emR3PatchTrap: Emulate patched instruction at %VGv IF=%d VMIF=%x\n",
1828	pNewEip, pCtx->eflags.Bits.u1IF, pVM->em.s.pPatmGCState->uVMFlags));
1829	pCtx->eip = pNewEip;
1830	AssertRelease(pCtx->eip);
1831	return emR3RawExecuteInstruction(pVM, "PATCHEMUL: ");
1832
1833	/*
1834	* The patch was disabled, hand it to the REM.
1835	*/
1836	case VERR_PATCH_DISABLED:
1837	if (!(pVM->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
1838	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
1839	pCtx->eip = pNewEip;
1840	AssertRelease(pCtx->eip);
1841
1842	if (pCtx->eflags.Bits.u1IF)
1843	{
1844	/*
1845	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
1846	*/
1847	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
1848	return emR3RawExecuteInstruction(pVM, "PATCHIR");
1849	}
1850	return VINF_EM_RESCHEDULE_REM;
1851
1852	/* Force continued patch exection; usually due to write monitored stack. */
1853	case VINF_PATCH_CONTINUE:
1854	return VINF_SUCCESS;
1855
1856	/*
1857	* Anything else is fatal.
1858	*/
1859	default:
1860	AssertReleaseMsgFailed(("Unknown return code %Vrc from PATMR3HandleTrap!\n", rc));
1861	return VERR_INTERNAL_ERROR;
1862	}
1863	}
1864	return VINF_SUCCESS;
1865	}
1866
1867
1868	/**
1869	* Handle a privileged instruction.
1870	*
1871	* @returns VBox status code suitable for EM.
1872	* @param pVM VM handle.
1873	*/
1874	int emR3RawPrivileged(PVM pVM)
1875	{
1876	STAM_PROFILE_START(&pVM->em.s.StatPrivEmu, a);
1877	PCPUMCTX pCtx = pVM->em.s.pCtx;
1878
1879	Assert(!pCtx->eflags.Bits.u1VM);
1880
1881	if (PATMIsEnabled(pVM))
1882	{
1883	/*
1884	* Check if in patch code.
1885	*/
1886	if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
1887	{
1888	#ifdef LOG_ENABLED
1889	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1890	#endif
1891	AssertMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08X\n", pCtx->eip));
1892	return VERR_EM_RAW_PATCH_CONFLICT;
1893	}
1894	if ( (pCtx->ss & X86_SEL_RPL) == 0
1895	&& !pCtx->eflags.Bits.u1VM
1896	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
1897	{
1898	int rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pCtx->eip),
1899	SELMIsSelector32Bit(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) ? PATMFL_CODE32 : 0);
1900	if (VBOX_SUCCESS(rc))
1901	{
1902	#ifdef LOG_ENABLED
1903	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1904	#endif
1905	DBGFR3DisasInstrCurrentLog(pVM, "Patched privileged instruction");
1906	return VINF_SUCCESS;
1907	}
1908	}
1909	}
1910
1911	#ifdef LOG_ENABLED
1912	if (!PATMIsPatchGCAddr(pVM, pCtx->eip))
1913	{
1914	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1915	DBGFR3DisasInstrCurrentLog(pVM, "Privileged instr: ");
1916	}
1917	#endif
1918
1919	/*
1920	* Instruction statistics and logging.
1921	*/
1922	DISCPUSTATE Cpu;
1923	int rc;
1924
1925	rc = CPUMR3DisasmInstrCPU(pVM, pCtx, pCtx->eip, &Cpu, "PRIV: ");
1926	if (VBOX_SUCCESS(rc))
1927	{
1928	#ifdef VBOX_WITH_STATISTICS
1929	PEMSTATS pStats = pVM->em.s.CTXSUFF(pStats);
1930	switch (Cpu.pCurInstr->opcode)
1931	{
1932	case OP_INVLPG:
1933	STAM_COUNTER_INC(&pStats->StatInvlpg);
1934	break;
1935	case OP_IRET:
1936	STAM_COUNTER_INC(&pStats->StatIret);
1937	break;
1938	case OP_CLI:
1939	STAM_COUNTER_INC(&pStats->StatCli);
1940	emR3RecordCli(pVM, pCtx->eip);
1941	break;
1942	case OP_STI:
1943	STAM_COUNTER_INC(&pStats->StatSti);
1944	break;
1945	case OP_INSB:
1946	case OP_INSWD:
1947	case OP_IN:
1948	case OP_OUTSB:
1949	case OP_OUTSWD:
1950	case OP_OUT:
1951	AssertMsgFailed(("Unexpected privileged exception due to port IO\n"));
1952	break;
1953
1954	case OP_MOV_CR:
1955	if (Cpu.param1.flags & USE_REG_GEN32)
1956	{
1957	//read
1958	Assert(Cpu.param2.flags & USE_REG_CR);
1959	Assert(Cpu.param2.base.reg_ctrl <= USE_REG_CR4);
1960	STAM_COUNTER_INC(&pStats->StatMovReadCR[Cpu.param2.base.reg_ctrl]);
1961	}
1962	else
1963	{
1964	//write
1965	Assert(Cpu.param1.flags & USE_REG_CR);
1966	Assert(Cpu.param1.base.reg_ctrl <= USE_REG_CR4);
1967	STAM_COUNTER_INC(&pStats->StatMovWriteCR[Cpu.param1.base.reg_ctrl]);
1968	}
1969	break;
1970
1971	case OP_MOV_DR:
1972	STAM_COUNTER_INC(&pStats->StatMovDRx);
1973	break;
1974	case OP_LLDT:
1975	STAM_COUNTER_INC(&pStats->StatMovLldt);
1976	break;
1977	case OP_LIDT:
1978	STAM_COUNTER_INC(&pStats->StatMovLidt);
1979	break;
1980	case OP_LGDT:
1981	STAM_COUNTER_INC(&pStats->StatMovLgdt);
1982	break;
1983	case OP_SYSENTER:
1984	STAM_COUNTER_INC(&pStats->StatSysEnter);
1985	break;
1986	case OP_SYSEXIT:
1987	STAM_COUNTER_INC(&pStats->StatSysExit);
1988	break;
1989	case OP_SYSCALL:
1990	STAM_COUNTER_INC(&pStats->StatSysCall);
1991	break;
1992	case OP_SYSRET:
1993	STAM_COUNTER_INC(&pStats->StatSysRet);
1994	break;
1995	case OP_HLT:
1996	STAM_COUNTER_INC(&pStats->StatHlt);
1997	break;
1998	default:
1999	STAM_COUNTER_INC(&pStats->StatMisc);
2000	Log4(("emR3RawPrivileged: opcode=%d\n", Cpu.pCurInstr->opcode));
2001	break;
2002	}
2003	#endif
2004	if ( (pCtx->ss & X86_SEL_RPL) == 0
2005	&& !pCtx->eflags.Bits.u1VM
2006	&& SELMIsSelector32Bit(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid))
2007	{
2008	uint32_t size;
2009
2010	STAM_PROFILE_START(&pVM->em.s.StatPrivEmu, a);
2011	switch (Cpu.pCurInstr->opcode)
2012	{
2013	case OP_CLI:
2014	pCtx->eflags.u32 &= ~X86_EFL_IF;
2015	Assert(Cpu.opsize == 1);
2016	pCtx->eip += Cpu.opsize;
2017	STAM_PROFILE_STOP(&pVM->em.s.StatPrivEmu, a);
2018	return VINF_EM_RESCHEDULE_REM; /* must go to the recompiler now! */
2019
2020	case OP_STI:
2021	pCtx->eflags.u32 \|= X86_EFL_IF;
2022	EMSetInhibitInterruptsPC(pVM, pCtx->eip + Cpu.opsize);
2023	Assert(Cpu.opsize == 1);
2024	pCtx->eip += Cpu.opsize;
2025	STAM_PROFILE_STOP(&pVM->em.s.StatPrivEmu, a);
2026	return VINF_SUCCESS;
2027
2028	case OP_HLT:
2029	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtx->eip))
2030	{
2031	PATMTRANSSTATE enmState;
2032	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->eip, &enmState);
2033
2034	if (enmState == PATMTRANS_OVERWRITTEN)
2035	{
2036	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
2037	Assert(rc == VERR_PATCH_DISABLED);
2038	/* Conflict detected, patch disabled */
2039	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %VGv\n", pCtx->eip));
2040
2041	enmState = PATMTRANS_SAFE;
2042	}
2043
2044	/* The translation had better be successful. Otherwise we can't recover. */
2045	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %VGv\n", pCtx->eip));
2046	if (enmState != PATMTRANS_OVERWRITTEN)
2047	pCtx->eip = pOrgInstrGC;
2048	}
2049	/* no break; we could just return VINF_EM_HALT here */
2050
2051	case OP_MOV_CR:
2052	case OP_MOV_DR:
2053	#ifdef LOG_ENABLED
2054	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
2055	{
2056	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
2057	DBGFR3DisasInstrCurrentLog(pVM, "Privileged instr: ");
2058	}
2059	#endif
2060
2061	rc = EMInterpretInstructionCPU(pVM, &Cpu, CPUMCTX2CORE(pCtx), 0, &size);
2062	if (VBOX_SUCCESS(rc))
2063	{
2064	pCtx->eip += Cpu.opsize;
2065	STAM_PROFILE_STOP(&pVM->em.s.StatPrivEmu, a);
2066
2067	if ( Cpu.pCurInstr->opcode == OP_MOV_CR
2068	&& Cpu.param1.flags == USE_REG_CR /* write */
2069	)
2070	{
2071	/* Reschedule is necessary as the execution/paging mode might have changed. */
2072	return VINF_EM_RESCHEDULE;
2073	}
2074	return rc; /* can return VINF_EM_HALT as well. */
2075	}
2076	AssertMsgReturn(rc == VERR_EM_INTERPRETER, ("%Vrc\n", rc), rc);
2077	break; /* fall back to the recompiler */
2078	}
2079	STAM_PROFILE_STOP(&pVM->em.s.StatPrivEmu, a);
2080	}
2081	}
2082
2083	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
2084	return emR3PatchTrap(pVM, pCtx, VINF_PATM_PATCH_TRAP_GP);
2085
2086	return emR3RawExecuteInstruction(pVM, "PRIV");
2087	}
2088
2089
2090	/**
2091	* Update the forced rawmode execution modifier.
2092	*
2093	* This function is called when we're returning from the raw-mode loop(s). If we're
2094	* in patch code, it will set a flag forcing execution to be resumed in raw-mode,
2095	* if not in patch code, the flag will be cleared.
2096	*
2097	* We should never interrupt patch code while it's being executed. Cli patches can
2098	* contain big code blocks, but they are always executed with IF=0. Other patches
2099	* replace single instructions and should be atomic.
2100	*
2101	* @returns Updated rc.
2102	*
2103	* @param pVM The VM handle.
2104	* @param pCtx The guest CPU context.
2105	* @param rc The result code.
2106	*/
2107	DECLINLINE(int) emR3RawUpdateForceFlag(PVM pVM, PCPUMCTX pCtx, int rc)
2108	{
2109	if (PATMIsPatchGCAddr(pVM, pCtx->eip)) /** @todo check cs selector base/type */
2110	{
2111	/* ignore reschedule attempts. */
2112	switch (rc)
2113	{
2114	case VINF_EM_RESCHEDULE:
2115	case VINF_EM_RESCHEDULE_REM:
2116	rc = VINF_SUCCESS;
2117	break;
2118	}
2119	pVM->em.s.fForceRAW = true;
2120	}
2121	else
2122	pVM->em.s.fForceRAW = false;
2123	return rc;
2124	}
2125
2126
2127	/**
2128	* Process a subset of the raw-mode return code.
2129	*
2130	* Since we have to share this with raw-mode single stepping, this inline
2131	* function has been created to avoid code duplication.
2132	*
2133	* @returns VINF_SUCCESS if it's ok to continue raw mode.
2134	* @returns VBox status code to return to the EM main loop.
2135	*
2136	* @param pVM The VM handle
2137	* @param rc The return code.
2138	* @param pCtx The guest cpu context.
2139	*/
2140	DECLINLINE(int) emR3RawHandleRC(PVM pVM, PCPUMCTX pCtx, int rc)
2141	{
2142	switch (rc)
2143	{
2144	/*
2145	* Common & simple ones.
2146	*/
2147	case VINF_SUCCESS:
2148	break;
2149	case VINF_EM_RESCHEDULE_RAW:
2150	case VINF_EM_RESCHEDULE_HWACC:
2151	case VINF_EM_RAW_INTERRUPT:
2152	case VINF_EM_RAW_TO_R3:
2153	case VINF_EM_RAW_TIMER_PENDING:
2154	case VINF_EM_PENDING_REQUEST:
2155	rc = VINF_SUCCESS;
2156	break;
2157
2158	/*
2159	* Privileged instruction.
2160	*/
2161	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
2162	case VINF_PATM_PATCH_TRAP_GP:
2163	rc = emR3RawPrivileged(pVM);
2164	break;
2165
2166	/*
2167	* Got a trap which needs dispatching.
2168	*/
2169	case VINF_EM_RAW_GUEST_TRAP:
2170	if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
2171	{
2172	AssertReleaseMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08X\n", CPUMGetGuestEIP(pVM)));
2173	rc = VERR_EM_RAW_PATCH_CONFLICT;
2174	break;
2175	}
2176
2177	Assert(TRPMHasTrap(pVM));
2178	Assert(!PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtx->eip));
2179
2180	if (TRPMHasTrap(pVM))
2181	{
2182	uint8_t u8Interrupt;
2183	uint32_t uErrorCode;
2184	TRPMERRORCODE enmError = TRPM_TRAP_NO_ERRORCODE;
2185
2186	rc = TRPMQueryTrapAll(pVM, &u8Interrupt, NULL, &uErrorCode, NULL);
2187	AssertRC(rc);
2188
2189	if (uErrorCode != ~0)
2190	enmError = TRPM_TRAP_HAS_ERRORCODE;
2191
2192	/* If the guest gate is marked unpatched, then we will check again if we can patch it. */
2193	if (TRPMR3GetGuestTrapHandler(pVM, u8Interrupt) == TRPM_INVALID_HANDLER)
2194	{
2195	CSAMR3CheckGates(pVM, u8Interrupt, 1);
2196	Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8Interrupt, TRPMR3GetGuestTrapHandler(pVM, u8Interrupt) != TRPM_INVALID_HANDLER));
2197	/** If it was successful, then we could go back to raw mode. */
2198	if (TRPMR3GetGuestTrapHandler(pVM, u8Interrupt) != TRPM_INVALID_HANDLER)
2199	{
2200	rc = TRPMForwardTrap(pVM, CPUMCTX2CORE(pCtx), u8Interrupt, uErrorCode, enmError, TRPM_TRAP);
2201	if (rc == VINF_SUCCESS /* Don't use VBOX_SUCCESS */)
2202	{
2203	TRPMResetTrap(pVM);
2204	return VINF_EM_RESCHEDULE_RAW;
2205	}
2206	}
2207	}
2208	}
2209	rc = emR3RawGuestTrap(pVM);
2210	break;
2211
2212	/*
2213	* Trap in patch code.
2214	*/
2215	case VINF_PATM_PATCH_TRAP_PF:
2216	case VINF_PATM_PATCH_INT3:
2217	rc = emR3PatchTrap(pVM, pCtx, rc);
2218	break;
2219
2220	case VINF_PATM_DUPLICATE_FUNCTION:
2221	Assert(PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtx->eip));
2222	rc = PATMR3DuplicateFunctionRequest(pVM, pCtx);
2223	AssertRC(rc);
2224	rc = VINF_SUCCESS;
2225	break;
2226
2227	case VINF_PATM_CHECK_PATCH_PAGE:
2228	rc = PATMR3HandleMonitoredPage(pVM);
2229	AssertRC(rc);
2230	rc = VINF_SUCCESS;
2231	break;
2232
2233	/*
2234	* Patch manager.
2235	*/
2236	case VERR_EM_RAW_PATCH_CONFLICT:
2237	AssertReleaseMsgFailed(("%Vrc handling is not yet implemented\n", rc));
2238	break;
2239
2240	/*
2241	* Memory mapped I/O access - attempt to patch the instruction
2242	*/
2243	case VINF_PATM_HC_MMIO_PATCH_READ:
2244	rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pCtx->eip),
2245	PATMFL_MMIO_ACCESS \| (SELMIsSelector32Bit(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) ? PATMFL_CODE32 : 0));
2246	if (VBOX_FAILURE(rc))
2247	rc = emR3RawExecuteInstruction(pVM, "MMIO");
2248	break;
2249
2250	case VINF_PATM_HC_MMIO_PATCH_WRITE:
2251	AssertFailed(); /* not yet implemented. */
2252	rc = emR3RawExecuteInstruction(pVM, "MMIO");
2253	break;
2254
2255	/*
2256	* Conflict or out of page tables.
2257	*
2258	* VM_FF_PGM_SYNC_CR3 is set by the hypervisor and all we need to
2259	* do here is to execute the pending forced actions.
2260	*/
2261	case VINF_PGM_SYNC_CR3:
2262	AssertMsg(VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL),
2263	("VINF_PGM_SYNC_CR3 and no VM_FF_PGM_SYNC_CR3*!\n"));
2264	rc = VINF_SUCCESS;
2265	break;
2266
2267	/*
2268	* Paging mode change.
2269	*/
2270	case VINF_PGM_CHANGE_MODE:
2271	rc = PGMChangeMode(pVM, pCtx->cr0, pCtx->cr4, 0);
2272	if (VBOX_SUCCESS(rc))
2273	rc = VINF_EM_RESCHEDULE;
2274	break;
2275
2276	/*
2277	* CSAM wants to perform a task in ring-3. It has set an FF action flag.
2278	*/
2279	case VINF_CSAM_PENDING_ACTION:
2280	rc = VINF_SUCCESS;
2281	break;
2282
2283	/*
2284	* Invoked Interrupt gate - must directly (!) go to the recompiler.
2285	*/
2286	case VINF_EM_RAW_INTERRUPT_PENDING:
2287	case VINF_EM_RAW_RING_SWITCH_INT:
2288	{
2289	uint8_t u8Interrupt;
2290
2291	Assert(TRPMHasTrap(pVM));
2292	Assert(!PATMIsPatchGCAddr(pVM, (RTGCPTR)pCtx->eip));
2293
2294	if (TRPMHasTrap(pVM))
2295	{
2296	u8Interrupt = TRPMGetTrapNo(pVM);
2297
2298	/* If the guest gate is marked unpatched, then we will check again if we can patch it. */
2299	if (TRPMR3GetGuestTrapHandler(pVM, u8Interrupt) == TRPM_INVALID_HANDLER)
2300	{
2301	CSAMR3CheckGates(pVM, u8Interrupt, 1);
2302	Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8Interrupt, TRPMR3GetGuestTrapHandler(pVM, u8Interrupt) != TRPM_INVALID_HANDLER));
2303	/** @note If it was successful, then we could go back to raw mode, but let's keep things simple for now. */
2304	}
2305	}
2306	rc = VINF_EM_RESCHEDULE_REM;
2307	break;
2308	}
2309
2310	/*
2311	* Other ring switch types.
2312	*/
2313	case VINF_EM_RAW_RING_SWITCH:
2314	rc = emR3RawRingSwitch(pVM);
2315	break;
2316
2317	/*
2318	* REMGCNotifyInvalidatePage() failed because of overflow.
2319	*/
2320	case VERR_REM_FLUSHED_PAGES_OVERFLOW:
2321	Assert((pCtx->ss & X86_SEL_RPL) != 1);
2322	REMR3ReplayInvalidatedPages(pVM);
2323	break;
2324
2325	/*
2326	* I/O Port access - emulate the instruction.
2327	*/
2328	case VINF_IOM_HC_IOPORT_READ:
2329	case VINF_IOM_HC_IOPORT_WRITE:
2330	case VINF_IOM_HC_IOPORT_READWRITE:
2331	rc = emR3RawExecuteIOInstruction(pVM);
2332	break;
2333
2334	/*
2335	* Memory mapped I/O access - emulate the instruction.
2336	*/
2337	case VINF_IOM_HC_MMIO_READ:
2338	case VINF_IOM_HC_MMIO_WRITE:
2339	case VINF_IOM_HC_MMIO_READ_WRITE:
2340	rc = emR3RawExecuteInstruction(pVM, "MMIO");
2341	break;
2342
2343	/*
2344	* Execute instruction.
2345	*/
2346	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
2347	rc = emR3RawExecuteInstruction(pVM, "LDT FAULT: ");
2348	break;
2349	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
2350	rc = emR3RawExecuteInstruction(pVM, "GDT FAULT: ");
2351	break;
2352	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
2353	rc = emR3RawExecuteInstruction(pVM, "IDT FAULT: ");
2354	break;
2355	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
2356	rc = emR3RawExecuteInstruction(pVM, "TSS FAULT: ");
2357	break;
2358	case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
2359	rc = emR3RawExecuteInstruction(pVM, "PD FAULT: ");
2360	break;
2361
2362	case VINF_EM_RAW_EMULATE_INSTR_HLT:
2363	/** @todo skip instruction and go directly to the halt state. (see REM for implementation details) */
2364	rc = emR3RawPrivileged(pVM);
2365	break;
2366
2367	case VINF_PATM_PENDING_IRQ_AFTER_IRET:
2368	rc = emR3RawExecuteInstruction(pVM, "EMUL: ", VINF_PATM_PENDING_IRQ_AFTER_IRET);
2369	break;
2370
2371	case VINF_EM_RAW_EMULATE_INSTR:
2372	case VINF_PATCH_EMULATE_INSTR:
2373	rc = emR3RawExecuteInstruction(pVM, "EMUL: ");
2374	break;
2375
2376	/*
2377	* Stale selector and iret traps => REM.
2378	*/
2379	case VINF_EM_RAW_STALE_SELECTOR:
2380	case VINF_EM_RAW_IRET_TRAP:
2381	/* We will not go to the recompiler if EIP points to patch code. */
2382	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
2383	{
2384	pCtx->eip = PATMR3PatchToGCPtr(pVM, (RTGCPTR)pCtx->eip, 0);
2385	}
2386	LogFlow(("emR3RawHandleRC: %Vrc -> %Vrc\n", rc, VINF_EM_RESCHEDULE_REM));
2387	rc = VINF_EM_RESCHEDULE_REM;
2388	break;
2389
2390	/*
2391	* Up a level.
2392	*/
2393	case VINF_EM_TERMINATE:
2394	case VINF_EM_OFF:
2395	case VINF_EM_RESET:
2396	case VINF_EM_SUSPEND:
2397	case VINF_EM_HALT:
2398	case VINF_EM_RESUME:
2399	case VINF_EM_RESCHEDULE:
2400	case VINF_EM_RESCHEDULE_REM:
2401	break;
2402
2403	/*
2404	* Up a level and invoke the debugger.
2405	*/
2406	case VINF_EM_DBG_STEPPED:
2407	case VINF_EM_DBG_BREAKPOINT:
2408	case VINF_EM_DBG_STEP:
2409	case VINF_EM_DBG_HYPER_ASSERTION:
2410	case VINF_EM_DBG_HYPER_BREAKPOINT:
2411	case VINF_EM_DBG_HYPER_STEPPED:
2412	case VINF_EM_DBG_STOP:
2413	break;
2414
2415	/*
2416	* Up a level, dump and debug.
2417	*/
2418	case VERR_TRPM_DONT_PANIC:
2419	case VERR_TRPM_PANIC:
2420	break;
2421
2422	/*
2423	* Anything which is not known to us means an internal error
2424	* and the termination of the VM!
2425	*/
2426	default:
2427	AssertMsgFailed(("Unknown GC return code: %Vra\n", rc));
2428	break;
2429	}
2430	return rc;
2431	}
2432
2433
2434	/**
2435	* Process raw-mode specific forced actions.
2436	*
2437	* This function is called when any FFs in the VM_FF_HIGH_PRIORITY_PRE_RAW_MASK is pending.
2438	*
2439	* @returns VBox status code.
2440	* Only the normal success/failure stuff, no VINF_EM_*.
2441	* @param pVM The VM handle.
2442	* @param pCtx The guest CPUM register context.
2443	*/
2444	static int emR3RawForcedActions(PVM pVM, PCPUMCTX pCtx)
2445	{
2446	/*
2447	* Note that the order is vitally important!
2448	* Also note that SELMR3UpdateFromCPUM may trigger VM_FF_SELM_SYNC_TSS.
2449	*/
2450
2451
2452	/*
2453	* Sync selector tables.
2454	*/
2455	if (VM_FF_ISPENDING(pVM, VM_FF_SELM_SYNC_GDT \| VM_FF_SELM_SYNC_LDT))
2456	{
2457	int rc = SELMR3UpdateFromCPUM(pVM);
2458	if (VBOX_FAILURE(rc))
2459	return rc;
2460	}
2461
2462	/*
2463	* Sync IDT.
2464	*/
2465	if (VM_FF_ISSET(pVM, VM_FF_TRPM_SYNC_IDT))
2466	{
2467	int rc = TRPMR3SyncIDT(pVM);
2468	if (VBOX_FAILURE(rc))
2469	return rc;
2470	}
2471
2472	/*
2473	* Sync TSS.
2474	*/
2475	if (VM_FF_ISSET(pVM, VM_FF_SELM_SYNC_TSS))
2476	{
2477	int rc = SELMR3SyncTSS(pVM);
2478	if (VBOX_FAILURE(rc))
2479	return rc;
2480	}
2481
2482	/*
2483	* Sync page directory.
2484	*/
2485	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2486	{
2487	int rc = PGMSyncCR3(pVM, pCtx->cr0, pCtx->cr3, pCtx->cr4, VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2488	if (VBOX_FAILURE(rc))
2489	return rc;
2490
2491	Assert(!VM_FF_ISPENDING(pVM, VM_FF_SELM_SYNC_GDT \| VM_FF_SELM_SYNC_LDT));
2492
2493	/* Prefetch pages for EIP and ESP */
2494	/** @todo This is rather expensive. Should investigate if it really helps at all. */
2495	rc = PGMPrefetchPage(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pCtx->eip));
2496	if (rc == VINF_SUCCESS)
2497	rc = PGMPrefetchPage(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->ss, &pCtx->ssHid, pCtx->esp));
2498	if (rc != VINF_SUCCESS)
2499	{
2500	if (rc != VINF_PGM_SYNC_CR3)
2501	return rc;
2502	rc = PGMSyncCR3(pVM, pCtx->cr0, pCtx->cr3, pCtx->cr4, VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2503	if (VBOX_FAILURE(rc))
2504	return rc;
2505	}
2506	/** @todo maybe prefetch the supervisor stack page as well */
2507	}
2508
2509	return VINF_SUCCESS;
2510	}
2511
2512
2513	/**
2514	* Executes raw code.
2515	*
2516	* This function contains the raw-mode version of the inner
2517	* execution loop (the outer loop being in EMR3ExecuteVM()).
2518	*
2519	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
2520	* VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
2521	*
2522	* @param pVM VM handle.
2523	* @param pfFFDone Where to store an indicator telling whether or not
2524	* FFs were done before returning.
2525	*/
2526	static int emR3RawExecute(PVM pVM, bool *pfFFDone)
2527	{
2528	STAM_PROFILE_ADV_START(&pVM->em.s.StatRAWTotal, a);
2529
2530	int rc = VERR_INTERNAL_ERROR;
2531	PCPUMCTX pCtx = pVM->em.s.pCtx;
2532	LogFlow(("emR3RawExecute: (cs:eip=%04x:%08x)\n", pCtx->cs, pCtx->eip));
2533	pVM->em.s.fForceRAW = false;
2534	*pfFFDone = false;
2535
2536
2537	/*
2538	*
2539	* Spin till we get a forced action or raw mode status code resulting in
2540	* in anything but VINF_SUCCESS or VINF_EM_RESCHEDULE_RAW.
2541	*
2542	*/
2543	for (;;)
2544	{
2545	STAM_PROFILE_ADV_START(&pVM->em.s.StatRAWEntry, b);
2546
2547	/*
2548	* Check various preconditions.
2549	*/
2550	#ifdef VBOX_STRICT
2551	Assert(REMR3QueryPendingInterrupt(pVM) == REM_NO_PENDING_IRQ);
2552	Assert(!(pCtx->cr4 & X86_CR4_PAE));
2553	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) == 3 \|\| (pCtx->ss & X86_SEL_RPL) == 0);
2554	AssertMsg( (pCtx->eflags.u32 & X86_EFL_IF)
2555	\|\| PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip),
2556	("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
2557	if ( !VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
2558	&& PGMR3MapHasConflicts(pVM, pCtx->cr3, pVM->fRawR0Enabled))
2559	{
2560	AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
2561	return VERR_INTERNAL_ERROR;
2562	}
2563	#endif /* VBOX_STRICT */
2564
2565	/*
2566	* Process high priority pre-execution raw-mode FFs.
2567	*/
2568	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK))
2569	{
2570	rc = emR3RawForcedActions(pVM, pCtx);
2571	if (VBOX_FAILURE(rc))
2572	break;
2573	}
2574
2575	/*
2576	* If we're going to execute ring-0 code, the guest state needs to
2577	* be modified a bit and some of the state components (IF, SS/CS RPL,
2578	* and perhaps EIP) needs to be stored with PATM.
2579	*/
2580	rc = CPUMRawEnter(pVM, NULL);
2581	if (rc != VINF_SUCCESS)
2582	{
2583	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWEntry, b);
2584	break;
2585	}
2586
2587	/*
2588	* Scan code before executing it. Don't bother with user mode or V86 code
2589	*/
2590	if ( (pCtx->ss & X86_SEL_RPL) <= 1
2591	&& !pCtx->eflags.Bits.u1VM
2592	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
2593	{
2594	STAM_PROFILE_ADV_SUSPEND(&pVM->em.s.StatRAWEntry, b);
2595	CSAMR3CheckCodeEx(pVM, pCtx->cs, &pCtx->csHid, pCtx->eip);
2596	STAM_PROFILE_ADV_RESUME(&pVM->em.s.StatRAWEntry, b);
2597	}
2598
2599	#ifdef LOG_ENABLED
2600	/*
2601	* Log important stuff before entering GC.
2602	*/
2603	PPATMGCSTATE pGCState = PATMR3QueryGCStateHC(pVM);
2604	if (pCtx->eflags.Bits.u1VM)
2605	Log(("RV86: %04X:%08X IF=%d VMFlags=%x\n", pCtx->cs, pCtx->eip, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
2606	else if ((pCtx->ss & X86_SEL_RPL) == 1)
2607	{
2608	bool fCSAMScanned = CSAMIsPageScanned(pVM, (RTGCPTR)pCtx->eip);
2609	Log(("RR0: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d (Scanned=%d)\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL), fCSAMScanned));
2610	}
2611	else if ((pCtx->ss & X86_SEL_RPL) == 3)
2612	Log(("RR3: %08X ESP=%08X IF=%d VMFlags=%x\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
2613	#endif /* LOG_ENABLED */
2614
2615
2616
2617	/*
2618	* Execute the code.
2619	*/
2620	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWEntry, b);
2621	STAM_PROFILE_START(&pVM->em.s.StatRAWExec, c);
2622	VMMR3Unlock(pVM);
2623	rc = VMMR3RawRunGC(pVM);
2624	VMMR3Lock(pVM);
2625	STAM_PROFILE_STOP(&pVM->em.s.StatRAWExec, c);
2626	STAM_PROFILE_ADV_START(&pVM->em.s.StatRAWTail, d);
2627
2628	LogFlow(("RR0-E: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL)));
2629	LogFlow(("VMMR3RawRunGC returned %Vrc\n", rc));
2630
2631
2632	/*
2633	* Restore the real CPU state and deal with high priority post
2634	* execution FFs before doing anything else.
2635	*/
2636	rc = CPUMRawLeave(pVM, NULL, rc);
2637	VM_FF_CLEAR(pVM, VM_FF_RESUME_GUEST_MASK);
2638	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK))
2639	rc = emR3HighPriorityPostForcedActions(pVM, rc);
2640
2641	#ifdef PGM_CACHE_VERY_STRICT
2642	/*
2643	* Page manager cache checks.
2644	*/
2645	if ( rc == VINF_EM_RAW_INTERRUPT
2646	\|\| rc == VINF_EM_RAW_GUEST_TRAP
2647	\|\| rc == VINF_IOM_HC_IOPORT_READ
2648	\|\| rc == VINF_IOM_HC_IOPORT_WRITE
2649	\|\| rc == VINF_IOM_HC_IOPORT_READWRITE
2650	//\|\| rc == VINF_PATM_PATCH_INT3
2651	)
2652	pgmCacheCheckPD(pVM, pCtx->cr0, pCtx->cr3, pCtx->cr4);
2653	#endif
2654
2655	#ifdef VBOX_STRICT
2656	/*
2657	* Assert TSS consistency & rc vs patch code.
2658	*/
2659	if ( !VM_FF_ISPENDING(pVM, VM_FF_SELM_SYNC_TSS \| VM_FF_SELM_SYNC_GDT) /* GDT implies TSS at the moment. */
2660	&& EMIsRawRing0Enabled(pVM))
2661	SELMR3CheckTSS(pVM);
2662	switch (rc)
2663	{
2664	case VINF_SUCCESS:
2665	case VINF_EM_RAW_INTERRUPT:
2666	case VINF_PATM_PATCH_TRAP_PF:
2667	case VINF_PATM_PATCH_TRAP_GP:
2668	case VINF_PATM_PATCH_INT3:
2669	case VINF_PATM_CHECK_PATCH_PAGE:
2670	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
2671	case VINF_EM_RAW_GUEST_TRAP:
2672	case VINF_EM_RESCHEDULE_RAW:
2673	break;
2674
2675	default:
2676	if (PATMIsPatchGCAddr(pVM, pCtx->eip) && !(pCtx->eflags.u32 & X86_EFL_TF))
2677	LogIt(NULL, 0, LOG_GROUP_PATM, ("Patch code interrupted at %VGv for reason %Vrc\n", CPUMGetGuestEIP(pVM), rc));
2678	break;
2679	}
2680	/*
2681	* Let's go paranoid!
2682	*/
2683	if ( !VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
2684	&& PGMR3MapHasConflicts(pVM, pCtx->cr3, pVM->fRawR0Enabled))
2685	{
2686	AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
2687	return VERR_INTERNAL_ERROR;
2688	}
2689	#endif /* VBOX_STRICT */
2690
2691	/*
2692	* Process the returned status code.
2693	*/
2694	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
2695	{
2696	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWTail, d);
2697	break;
2698	}
2699	rc = emR3RawHandleRC(pVM, pCtx, rc);
2700	if (rc != VINF_SUCCESS)
2701	{
2702	rc = emR3RawUpdateForceFlag(pVM, pCtx, rc);
2703	if (rc != VINF_SUCCESS)
2704	{
2705	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWTail, d);
2706	break;
2707	}
2708	}
2709
2710	/*
2711	* Check and execute forced actions.
2712	*/
2713	#ifdef VBOX_HIGH_RES_TIMERS_HACK
2714	TMTimerPoll(pVM);
2715	#endif
2716	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWTail, d);
2717	if (VM_FF_ISPENDING(pVM, ~VM_FF_HIGH_PRIORITY_PRE_RAW_MASK))
2718	{
2719	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) != 1);
2720
2721	STAM_PROFILE_ADV_SUSPEND(&pVM->em.s.StatRAWTotal, a);
2722	rc = emR3ForcedActions(pVM, rc);
2723	STAM_PROFILE_ADV_RESUME(&pVM->em.s.StatRAWTotal, a);
2724	if ( rc != VINF_SUCCESS
2725	&& rc != VINF_EM_RESCHEDULE_RAW)
2726	{
2727	rc = emR3RawUpdateForceFlag(pVM, pCtx, rc);
2728	if (rc != VINF_SUCCESS)
2729	{
2730	*pfFFDone = true;
2731	break;
2732	}
2733	}
2734	}
2735	}
2736
2737	/*
2738	* Return to outer loop.
2739	*/
2740	#if defined(LOG_ENABLED) && defined(DEBUG)
2741	RTLogFlush(NULL);
2742	#endif
2743	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatRAWTotal, a);
2744	return rc;
2745	}
2746
2747
2748	/**
2749	* Executes hardware accelerated raw code. (Intel VMX & AMD SVM)
2750	*
2751	* This function contains the raw-mode version of the inner
2752	* execution loop (the outer loop being in EMR3ExecuteVM()).
2753	*
2754	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE, VINF_EM_RESCHEDULE_RAW,
2755	* VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
2756	*
2757	* @param pVM VM handle.
2758	* @param pfFFDone Where to store an indicator telling whether or not
2759	* FFs were done before returning.
2760	*/
2761	static int emR3HwAccExecute(PVM pVM, bool *pfFFDone)
2762	{
2763	int rc = VERR_INTERNAL_ERROR;
2764	PCPUMCTX pCtx = pVM->em.s.pCtx;
2765
2766	LogFlow(("emR3HwAccExecute: (cs:eip=%04x:%08x)\n", pCtx->cs, pCtx->eip));
2767	*pfFFDone = false;
2768
2769	STAM_COUNTER_INC(&pVM->em.s.StatHwAccExecuteEntry);
2770
2771	/*
2772	* Spin till we get a forced action which returns anything but VINF_SUCCESS.
2773	*/
2774	for (;;)
2775	{
2776	STAM_PROFILE_ADV_START(&pVM->em.s.StatHwAccEntry, a);
2777
2778	/*
2779	* Check various preconditions.
2780	*/
2781	Assert(!(pCtx->cr4 & X86_CR4_PAE));
2782
2783	VM_FF_CLEAR(pVM, (VM_FF_SELM_SYNC_GDT \| VM_FF_SELM_SYNC_LDT \| VM_FF_TRPM_SYNC_IDT \| VM_FF_SELM_SYNC_TSS));
2784
2785	/*
2786	* Sync page directory.
2787	*/
2788	if (VM_FF_ISPENDING(pVM, (VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL)))
2789	{
2790	rc = PGMSyncCR3(pVM, pCtx->cr0, pCtx->cr3, pCtx->cr4, VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2791	if (VBOX_FAILURE(rc))
2792	return rc;
2793
2794	Assert(!VM_FF_ISPENDING(pVM, VM_FF_SELM_SYNC_GDT \| VM_FF_SELM_SYNC_LDT));
2795
2796	/* Prefetch pages for EIP and ESP */
2797	rc = PGMPrefetchPage(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid, pCtx->eip));
2798	if (rc == VINF_SUCCESS)
2799	rc = PGMPrefetchPage(pVM, SELMToFlat(pVM, pCtx->eflags, pCtx->ss, &pCtx->ssHid, pCtx->esp));
2800	if (rc != VINF_SUCCESS)
2801	{
2802	if (rc != VINF_PGM_SYNC_CR3)
2803	return rc;
2804	rc = PGMSyncCR3(pVM, pCtx->cr0, pCtx->cr3, pCtx->cr4, VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2805	if (VBOX_FAILURE(rc))
2806	return rc;
2807	}
2808
2809	/** @todo maybe prefetch the supervisor stack page as well */
2810	}
2811
2812	#ifdef LOG_ENABLED
2813	uint8_t u8Vector;
2814
2815	rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
2816	if (rc == VINF_SUCCESS)
2817	{
2818	Log(("Pending hardware interrupt %d\n", u8Vector));
2819	}
2820	/*
2821	* Log important stuff before entering GC.
2822	*/
2823	if (pCtx->eflags.Bits.u1VM)
2824	Log(("HWV86: %08X IF=%d\n", pCtx->eip, pCtx->eflags.Bits.u1IF));
2825	else if ((pCtx->ss & X86_SEL_RPL) == 0)
2826	Log(("HWR0: %08X ESP=%08X IF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, (pCtx->ss & X86_SEL_RPL)));
2827	else if ((pCtx->ss & X86_SEL_RPL) == 3)
2828	Log(("HWR3: %08X ESP=%08X IF=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF));
2829	#endif
2830
2831
2832	/*
2833	* Execute the code.
2834	*/
2835	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatHwAccEntry, a);
2836	STAM_PROFILE_START(&pVM->em.s.StatHwAccExec, x);
2837	VMMR3Unlock(pVM);
2838	rc = VMMR3HwAccRunGC(pVM);
2839	VMMR3Lock(pVM);
2840	STAM_PROFILE_STOP(&pVM->em.s.StatHwAccExec, x);
2841
2842
2843	/*
2844	* Deal with high priority post execution FFs before doing anything else.
2845	*/
2846	VM_FF_CLEAR(pVM, VM_FF_RESUME_GUEST_MASK);
2847	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK))
2848	rc = emR3HighPriorityPostForcedActions(pVM, rc);
2849
2850	/*
2851	* Process the returned status code.
2852	*/
2853	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
2854	break;
2855
2856	rc = emR3RawHandleRC(pVM, pCtx, rc);
2857	if (rc != VINF_SUCCESS)
2858	break;
2859
2860	/*
2861	* Check and execute forced actions.
2862	*/
2863	#ifdef VBOX_HIGH_RES_TIMERS_HACK
2864	TMTimerPoll(pVM);
2865	#endif
2866	if (VM_FF_ISPENDING(pVM, VM_FF_ALL_MASK))
2867	{
2868	rc = emR3ForcedActions(pVM, rc);
2869	if ( rc != VINF_SUCCESS
2870	&& rc != VINF_EM_RESCHEDULE_HWACC)
2871	{
2872	*pfFFDone = true;
2873	break;
2874	}
2875	}
2876	}
2877	/*
2878	* Return to outer loop.
2879	*/
2880	#if defined(LOG_ENABLED) && defined(DEBUG)
2881	RTLogFlush(NULL);
2882	#endif
2883	return rc;
2884	}
2885
2886
2887	/**
2888	* Decides whether to execute RAW, HWACC or REM.
2889	*
2890	* @returns new EM state
2891	* @param pVM The VM.
2892	* @param pCtx The CPU context.
2893	*/
2894	inline EMSTATE emR3Reschedule(PVM pVM, PCPUMCTX pCtx)
2895	{
2896	/*
2897	* When forcing raw-mode execution, things are simple.
2898	*/
2899	if (pVM->em.s.fForceRAW)
2900	return EMSTATE_RAW;
2901
2902	/* !!! THIS MUST BE IN SYNC WITH remR3CanExecuteRaw !!! */
2903	/* !!! THIS MUST BE IN SYNC WITH remR3CanExecuteRaw !!! */
2904	/* !!! THIS MUST BE IN SYNC WITH remR3CanExecuteRaw !!! */
2905
2906	X86EFLAGS EFlags = pCtx->eflags;
2907	if (HWACCMIsEnabled(pVM))
2908	{
2909	/* Hardware accelerated raw-mode:
2910	*
2911	* Typically only 32-bits protected mode, with paging enabled, code is allowed here.
2912	*/
2913	if (HWACCMR3CanExecuteGuest(pVM, pCtx) == true)
2914	return EMSTATE_HWACC;
2915
2916	/** @note Raw mode and hw accelerated mode are incompatible. The latter turns off monitoring features essential for raw mode! */
2917	return EMSTATE_REM;
2918	}
2919
2920	/* Standard raw-mode:
2921	*
2922	* Here we only support 16 & 32 bits protected mode ring 3 code that has no IO privileges
2923	* or 32 bits protected mode ring 0 code
2924	*
2925	* The tests are ordered by the likelyhood of being true during normal execution.
2926	*/
2927	if (EFlags.u32 & (X86_EFL_TF /* \| HF_INHIBIT_IRQ_MASK*/))
2928	{
2929	Log2(("raw mode refused: EFlags=%#x\n", EFlags.u32));
2930	return EMSTATE_REM;
2931	}
2932
2933	#ifndef VBOX_RAW_V86
2934	if (EFlags.u32 & X86_EFL_VM) {
2935	Log2(("raw mode refused: VM_MASK\n"));
2936	return EMSTATE_REM;
2937	}
2938	#endif
2939
2940	/** @todo check up the X86_CR0_AM flag in respect to raw mode!!! We're probably not emulating it right! */
2941	uint32_t u32CR0 = pCtx->cr0;
2942	if ((u32CR0 & (X86_CR0_PG \| X86_CR0_PE)) != (X86_CR0_PG \| X86_CR0_PE))
2943	{
2944	//Log2(("raw mode refused: %s%s%s\n", (u32CR0 & X86_CR0_PG) ? "" : " !PG", (u32CR0 & X86_CR0_PE) ? "" : " !PE", (u32CR0 & X86_CR0_AM) ? "" : " !AM"));
2945	return EMSTATE_REM;
2946	}
2947
2948	if (pCtx->cr4 & X86_CR4_PAE)
2949	{
2950	//Log2(("raw mode refused: PAE\n"));
2951	return EMSTATE_REM;
2952	}
2953
2954	unsigned uSS = pCtx->ss;
2955	if ( pCtx->eflags.Bits.u1VM
2956	\|\| (uSS & X86_SEL_RPL) == 3)
2957	{
2958	if (!EMIsRawRing3Enabled(pVM))
2959	return EMSTATE_REM;
2960
2961	if (!(EFlags.u32 & X86_EFL_IF))
2962	{
2963	Log2(("raw mode refused: IF (RawR3)\n"));
2964	return EMSTATE_REM;
2965	}
2966
2967	if (!(u32CR0 & X86_CR0_WP) && EMIsRawRing0Enabled(pVM))
2968	{
2969	Log2(("raw mode refused: CR0.WP + RawR0\n"));
2970	return EMSTATE_REM;
2971	}
2972	}
2973	else
2974	{
2975	if (!EMIsRawRing0Enabled(pVM))
2976	return EMSTATE_REM;
2977
2978	/* Only ring 0 supervisor code. */
2979	if ((uSS & X86_SEL_RPL) != 0)
2980	{
2981	Log2(("raw r0 mode refused: CPL %d\n", uSS & X86_SEL_RPL));
2982	return EMSTATE_REM;
2983	}
2984
2985	// Let's start with pure 32 bits ring 0 code first
2986	/** @todo What's pure 32-bit mode? flat? */
2987	if ( !(pCtx->ssHid.Attr.n.u1DefBig)
2988	\|\| !(pCtx->csHid.Attr.n.u1DefBig))
2989	{
2990	Log2(("raw r0 mode refused: SS/CS not 32bit\n"));
2991	return EMSTATE_REM;
2992	}
2993
2994	/* Write protection muts be turned on, or else the guest can overwrite our hypervisor code and data. */
2995	if (!(u32CR0 & X86_CR0_WP))
2996	{
2997	Log2(("raw r0 mode refused: CR0.WP=0!\n"));
2998	return EMSTATE_REM;
2999	}
3000
3001	if (PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip))
3002	{
3003	Log2(("raw r0 mode forced: patch code\n"));
3004	return EMSTATE_RAW;
3005	}
3006
3007	#if !defined(VBOX_ALLOW_IF0) && !defined(VBOX_RUN_INTERRUPT_GATE_HANDLERS)
3008	if (!(EFlags.u32 & X86_EFL_IF))
3009	{
3010	////Log2(("R0: IF=0 VIF=%d %08X\n", eip, pVMeflags));
3011	//Log2(("RR0: Interrupts turned off; fall back to emulation\n"));
3012	return EMSTATE_REM;
3013	}
3014	#endif
3015
3016	/** @todo still necessary??? */
3017	if (EFlags.Bits.u2IOPL != 0)
3018	{
3019	Log2(("raw r0 mode refused: IOPL %d\n", EFlags.Bits.u2IOPL));
3020	return EMSTATE_REM;
3021	}
3022	}
3023
3024	Assert(PGMPhysIsA20Enabled(pVM));
3025	return EMSTATE_RAW;
3026	}
3027
3028
3029	/**
3030	* Executes all high priority post execution force actions.
3031	*
3032	* @returns rc or a fatal status code.
3033	*
3034	* @param pVM VM handle.
3035	* @param rc The current rc.
3036	*/
3037	static int emR3HighPriorityPostForcedActions(PVM pVM, int rc)
3038	{
3039	if (VM_FF_ISSET(pVM, VM_FF_PDM_CRITSECT))
3040	PDMR3CritSectFF(pVM);
3041
3042	if (VM_FF_ISSET(pVM, VM_FF_CSAM_FLUSH_DIRTY_PAGE))
3043	CSAMR3FlushDirtyPages(pVM);
3044
3045	return rc;
3046	}
3047
3048
3049	/**
3050	* Executes all pending forced actions.
3051	*
3052	* Forced actions can cause execution delays and execution
3053	* rescheduling. The first we deal with using action priority, so
3054	* that for instance pending timers aren't scheduled and ran until
3055	* right before execution. The rescheduling we deal with using
3056	* return codes. The same goes for VM termination, only in that case
3057	* we exit everything.
3058	*
3059	* @returns VBox status code of equal or greater importance/severity than rc.
3060	* The most important ones are: VINF_EM_RESCHEDULE,
3061	* VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
3062	*
3063	* @param pVM VM handle.
3064	* @param rc The current rc.
3065	*
3066	*/
3067	static int emR3ForcedActions(PVM pVM, int rc)
3068	{
3069	#ifdef VBOX_STRICT
3070	int rcIrq = VINF_SUCCESS;
3071	#endif
3072	STAM_PROFILE_START(&pVM->em.s.StatForcedActions, a);
3073
3074	#define UPDATE_RC() \
3075	do { \
3076	AssertMsg(rc2 <= 0 \|\| (rc2 >= VINF_EM_FIRST && rc2 <= VINF_EM_LAST), ("Invalid FF return code: %Vra\n", rc2)); \
3077	if (rc2 == VINF_SUCCESS \|\| rc < VINF_SUCCESS) \
3078	break; \
3079	if (!rc \|\| rc2 < rc) \
3080	rc = rc2; \
3081	} while (0)
3082
3083	int rc2;
3084
3085	/*
3086	* Post execution chunk first.
3087	*/
3088	if (VM_FF_ISPENDING(pVM, VM_FF_NORMAL_PRIORITY_POST_MASK))
3089	{
3090	/*
3091	* Termination request.
3092	*/
3093	if (VM_FF_ISSET(pVM, VM_FF_TERMINATE))
3094	{
3095	Log2(("emR3ForcedActions: returns VINF_EM_TERMINATE\n"));
3096	STAM_PROFILE_STOP(&pVM->em.s.StatForcedActions, a);
3097	return VINF_EM_TERMINATE;
3098	}
3099
3100	/*
3101	* Debugger Facility polling.
3102	*/
3103	if (VM_FF_ISSET(pVM, VM_FF_DBGF))
3104	{
3105	rc2 = DBGFR3VMMForcedAction(pVM);
3106	UPDATE_RC();
3107	}
3108
3109	/*
3110	* Postponed reset request.
3111	*/
3112	if (VM_FF_ISSET(pVM, VM_FF_RESET))
3113	{
3114	rc2 = VMR3Reset(pVM);
3115	UPDATE_RC();
3116	VM_FF_CLEAR(pVM, VM_FF_RESET);
3117	}
3118
3119	/*
3120	* CSAM page scanning.
3121	*/
3122	if (VM_FF_ISSET(pVM, VM_FF_CSAM_SCAN_PAGE))
3123	{
3124	PCPUMCTX pCtx = pVM->em.s.pCtx;
3125
3126	/** @todo: check for 16 or 32 bits code! (D bit in the code selector) */
3127	Log(("Forced action VM_FF_CSAM_SCAN_PAGE\n"));
3128
3129	CSAMR3CheckCodeEx(pVM, pCtx->cs, &pCtx->csHid, pCtx->eip);
3130	VM_FF_CLEAR(pVM, VM_FF_CSAM_SCAN_PAGE);
3131	}
3132
3133	/* check that we got them all */
3134	Assert(!(VM_FF_NORMAL_PRIORITY_POST_MASK & ~(VM_FF_TERMINATE \| VM_FF_DBGF \| VM_FF_RESET \| VM_FF_CSAM_SCAN_PAGE)));
3135	}
3136
3137	/*
3138	* Normal priority then.
3139	* (Executed in no particular order.)
3140	*/
3141	if (VM_FF_ISPENDING(pVM, VM_FF_NORMAL_PRIORITY_MASK))
3142	{
3143	/*
3144	* PDM Queues are pending.
3145	*/
3146	if (VM_FF_ISSET(pVM, VM_FF_PDM_QUEUES))
3147	PDMR3QueueFlushAll(pVM);
3148
3149	/*
3150	* PDM DMA transfers are pending.
3151	*/
3152	if (VM_FF_ISSET(pVM, VM_FF_PDM_DMA))
3153	PDMR3DmaRun(pVM);
3154
3155	/*
3156	* Requests from other threads.
3157	*/
3158	if (VM_FF_ISSET(pVM, VM_FF_REQUEST))
3159	{
3160	rc2 = VMR3ReqProcess(pVM);
3161	if (rc2 == VINF_EM_OFF \|\| rc2 == VINF_EM_TERMINATE)
3162	{
3163	Log2(("emR3ForcedActions: returns %Vrc\n", rc2));
3164	STAM_PROFILE_STOP(&pVM->em.s.StatForcedActions, a);
3165	return rc2;
3166	}
3167	UPDATE_RC();
3168	}
3169
3170	/* check that we got them all */
3171	Assert(!(VM_FF_NORMAL_PRIORITY_MASK & ~(VM_FF_REQUEST \| VM_FF_PDM_QUEUES \| VM_FF_PDM_DMA)));
3172	}
3173
3174	/*
3175	* Execute polling function ever so often.
3176	* THIS IS A HACK, IT WILL BE REPLACED BY PROPER ASYNC NETWORKING SOON!
3177	*/
3178	static unsigned cLast = 0;
3179	if (!((++cLast) % 4))
3180	PDMR3Poll(pVM);
3181
3182	/*
3183	* High priority pre execution chunk last.
3184	* (Executed in ascending priority order.)
3185	*/
3186	if (VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_MASK))
3187	{
3188	/*
3189	* Timers before interrupts.
3190	*/
3191	if (VM_FF_ISSET(pVM, VM_FF_TIMER))
3192	TMR3TimerQueuesDo(pVM);
3193
3194	/*
3195	* The instruction following an emulated STI should always be executed!
3196	*/
3197	if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
3198	{
3199	Log(("VM_FF_EMULATED_STI at %VGv successor %VGv\n", CPUMGetGuestEIP(pVM), EMGetInhibitInterruptsPC(pVM)));
3200	if (CPUMGetGuestEIP(pVM) != EMGetInhibitInterruptsPC(pVM))
3201	{
3202	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
3203	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
3204	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
3205	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
3206	*/
3207	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
3208	}
3209	if (HWACCMR3IsActive(pVM))
3210	rc2 = VINF_EM_RESCHEDULE_HWACC;
3211	else
3212	rc2 = PATMAreInterruptsEnabled(pVM) ? VINF_EM_RESCHEDULE_RAW : VINF_EM_RESCHEDULE_REM;
3213
3214	UPDATE_RC();
3215	}
3216
3217	/*
3218	* Interrupts.
3219	*/
3220	if ( !VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS)
3221	&& (!rc \|\| rc >= VINF_EM_RESCHEDULE_RAW)
3222	&& !TRPMHasTrap(pVM) /* an interrupt could already be scheduled for dispatching in the recompiler. */
3223	&& PATMAreInterruptsEnabled(pVM)
3224	&& !HWACCMR3IsEventPending(pVM))
3225	{
3226	if (VM_FF_ISPENDING(pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC))
3227	{
3228	/** @note it's important to make sure the return code from TRPMR3InjectEvent isn't ignored! */
3229	/** @todo this really isn't nice, should properly handle this */
3230	rc2 = TRPMR3InjectEvent(pVM, TRPM_HARDWARE_INT);
3231	#ifdef VBOX_STRICT
3232	rcIrq = rc2;
3233	#endif
3234	UPDATE_RC();
3235	}
3236	/** @todo really ugly; if we entered the hlt state when exiting the recompiler and an interrupt was pending, we previously got stuck in the halted state. */
3237	else if (REMR3QueryPendingInterrupt(pVM) != REM_NO_PENDING_IRQ)
3238	{
3239	rc2 = VINF_EM_RESCHEDULE_REM;
3240	UPDATE_RC();
3241	}
3242	}
3243
3244	/*
3245	* Debugger Facility request.
3246	*/
3247	if (VM_FF_ISSET(pVM, VM_FF_DBGF))
3248	{
3249	rc2 = DBGFR3VMMForcedAction(pVM);
3250	UPDATE_RC();
3251	}
3252
3253	/*
3254	* Termination request.
3255	*/
3256	if (VM_FF_ISSET(pVM, VM_FF_TERMINATE))
3257	{
3258	Log2(("emR3ForcedActions: returns VINF_EM_TERMINATE\n"));
3259	STAM_PROFILE_STOP(&pVM->em.s.StatForcedActions, a);
3260	return VINF_EM_TERMINATE;
3261	}
3262
3263	#ifdef DEBUG
3264	/*
3265	* Debug, pause the VM.
3266	*/
3267	if (VM_FF_ISSET(pVM, VM_FF_DEBUG_SUSPEND))
3268	{
3269	VM_FF_CLEAR(pVM, VM_FF_DEBUG_SUSPEND);
3270	Log(("emR3ForcedActions: returns VINF_EM_SUSPEND\n"));
3271	return VINF_EM_SUSPEND;
3272	}
3273
3274	#endif
3275	/* check that we got them all */
3276	Assert(!(VM_FF_HIGH_PRIORITY_PRE_MASK & ~(VM_FF_TIMER \| VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC \| VM_FF_DBGF \| VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL \| VM_FF_SELM_SYNC_TSS \| VM_FF_TRPM_SYNC_IDT \| VM_FF_SELM_SYNC_GDT \| VM_FF_SELM_SYNC_LDT \| VM_FF_TERMINATE \| VM_FF_DEBUG_SUSPEND \| VM_FF_INHIBIT_INTERRUPTS)));
3277	}
3278
3279	#undef UPDATE_RC
3280	Log2(("emR3ForcedActions: returns %Vrc\n", rc));
3281	STAM_PROFILE_STOP(&pVM->em.s.StatForcedActions, a);
3282	Assert(rcIrq == VINF_SUCCESS \|\| rcIrq == rc);
3283	return rc;
3284	}
3285
3286
3287	/**
3288	* Execute VM.
3289	*
3290	* This function is the main loop of the VM. The emulation thread
3291	* calls this function when the VM has been successfully constructed
3292	* and we're ready for executing the VM.
3293	*
3294	* Returning from this function means that the VM is turned off or
3295	* suspended (state already saved) and deconstruction in next in line.
3296	*
3297	* All interaction from other thread are done using forced actions
3298	* and signaling of the wait object.
3299	*
3300	* @returns VBox status code.
3301	* @param pVM The VM to operate on.
3302	*/
3303	EMR3DECL(int) EMR3ExecuteVM(PVM pVM)
3304	{
3305	LogFlow(("EMR3ExecuteVM: pVM=%p enmVMState=%d enmState=%d (%s) fForceRAW=%d\n", pVM, pVM->enmVMState,
3306	pVM->em.s.enmState, EMR3GetStateName(pVM->em.s.enmState), pVM->em.s.fForceRAW));
3307	VM_ASSERT_EMT(pVM);
3308	Assert(pVM->em.s.enmState == EMSTATE_NONE \|\| pVM->em.s.enmState == EMSTATE_SUSPENDED);
3309
3310	VMMR3Lock(pVM);
3311
3312	int rc = setjmp(pVM->em.s.u.FatalLongJump);
3313	if (rc == 0)
3314	{
3315	/*
3316	* Start the virtual time.
3317	*/
3318	rc = TMVirtualResume(pVM);
3319	Assert(rc == VINF_SUCCESS);
3320	rc = TMCpuTickResume(pVM);
3321	Assert(rc == VINF_SUCCESS);
3322
3323	/*
3324	* The Outer Main Loop.
3325	*/
3326	bool fFFDone = false;
3327	rc = VINF_EM_RESCHEDULE;
3328	pVM->em.s.enmState = EMSTATE_REM;
3329	STAM_PROFILE_ADV_START(&pVM->em.s.StatTotal, x);
3330	for (;;)
3331	{
3332	/*
3333	* Before we can schedule anything (we're here because
3334	* scheduling is required) we must service any pending
3335	* forced actions to avoid any pending action causing
3336	* immidate rescheduling upon entering an inner loop
3337	*
3338	* Do forced actions.
3339	*/
3340	if ( !fFFDone
3341	&& rc != VINF_EM_TERMINATE
3342	&& rc != VINF_EM_OFF
3343	&& VM_FF_ISPENDING(pVM, VM_FF_ALL_BUT_RAW_MASK))
3344	{
3345	rc = emR3ForcedActions(pVM, rc);
3346	if ( ( rc == VINF_EM_RESCHEDULE_REM
3347	\|\| rc == VINF_EM_RESCHEDULE_HWACC)
3348	&& pVM->em.s.fForceRAW)
3349	rc = VINF_EM_RESCHEDULE_RAW;
3350	}
3351	else if (fFFDone)
3352	fFFDone = false;
3353
3354	/*
3355	* Now what to do?
3356	*/
3357	Log2(("EMR3ExecuteVM: rc=%Vrc\n", rc));
3358	switch (rc)
3359	{
3360	/*
3361	* Keep doing what we're currently doing.
3362	*/
3363	case VINF_SUCCESS:
3364	break;
3365
3366	/*
3367	* Reschedule - to raw-mode execution.
3368	*/
3369	case VINF_EM_RESCHEDULE_RAW:
3370	Log2(("EMR3ExecuteVM: VINF_EM_RESCHEDULE_RAW: %d -> %d (EMSTATE_RAW)\n", pVM->em.s.enmState, EMSTATE_RAW));
3371	pVM->em.s.enmState = EMSTATE_RAW;
3372	break;
3373
3374	/*
3375	* Reschedule - to hardware accelerated raw-mode execution.
3376	*/
3377	case VINF_EM_RESCHEDULE_HWACC:
3378	Log2(("EMR3ExecuteVM: VINF_EM_RESCHEDULE_HWACC: %d -> %d (EMSTATE_HWACC)\n", pVM->em.s.enmState, EMSTATE_HWACC));
3379	Assert(!pVM->em.s.fForceRAW);
3380	pVM->em.s.enmState = EMSTATE_HWACC;
3381	break;
3382
3383	/*
3384	* Reschedule - to recompiled execution.
3385	*/
3386	case VINF_EM_RESCHEDULE_REM:
3387	Log2(("EMR3ExecuteVM: VINF_EM_RESCHEDULE_REM: %d -> %d (EMSTATE_REM)\n", pVM->em.s.enmState, EMSTATE_REM));
3388	pVM->em.s.enmState = EMSTATE_REM;
3389	break;
3390
3391	/*
3392	* Resume.
3393	*/
3394	case VINF_EM_RESUME:
3395	Log2(("EMR3ExecuteVM: VINF_EM_RESUME: %d -> VINF_EM_RESCHEDULE\n", pVM->em.s.enmState));
3396	/* fall through and get scheduled. */
3397
3398	/*
3399	* Reschedule.
3400	*/
3401	case VINF_EM_RESCHEDULE:
3402	{
3403	EMSTATE enmState = emR3Reschedule(pVM, pVM->em.s.pCtx);
3404	Log2(("EMR3ExecuteVM: VINF_EM_RESCHEDULE: %d -> %d (%s)\n", pVM->em.s.enmState, enmState, EMR3GetStateName(enmState)));
3405	pVM->em.s.enmState = enmState;
3406	break;
3407	}
3408
3409	/*
3410	* Halted.
3411	*/
3412	case VINF_EM_HALT:
3413	Log2(("EMR3ExecuteVM: VINF_EM_HALT: %d -> %d\n", pVM->em.s.enmState, EMSTATE_HALTED));
3414	pVM->em.s.enmState = EMSTATE_HALTED;
3415	break;
3416
3417	/*
3418	* Suspend.
3419	*/
3420	case VINF_EM_SUSPEND:
3421	Log2(("EMR3ExecuteVM: VINF_EM_SUSPEND: %d -> %d\n", pVM->em.s.enmState, EMSTATE_SUSPENDED));
3422	pVM->em.s.enmState = EMSTATE_SUSPENDED;
3423	break;
3424
3425	/*
3426	* Reset.
3427	* We might end up doing a double reset for now, we'll have to clean up the mess later.
3428	*/
3429	case VINF_EM_RESET:
3430	Log2(("EMR3ExecuteVM: VINF_EM_RESET: %d -> %d\n", pVM->em.s.enmState, EMSTATE_REM));
3431	pVM->em.s.enmState = EMSTATE_REM;
3432	break;
3433
3434	/*
3435	* Power Off.
3436	*/
3437	case VINF_EM_OFF:
3438	pVM->em.s.enmState = EMSTATE_TERMINATING;
3439	Log2(("EMR3ExecuteVM: returns VINF_EM_OFF (%d -> %d)\n", pVM->em.s.enmState, EMSTATE_TERMINATING));
3440	TMVirtualPause(pVM);
3441	TMCpuTickPause(pVM);
3442	VMMR3Unlock(pVM);
3443	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3444	return rc;
3445
3446	/*
3447	* Terminate the VM.
3448	*/
3449	case VINF_EM_TERMINATE:
3450	pVM->em.s.enmState = EMSTATE_TERMINATING;
3451	Log(("EMR3ExecuteVM returns VINF_EM_TERMINATE (%d -> %d)\n", pVM->em.s.enmState, EMSTATE_TERMINATING));
3452	TMVirtualPause(pVM);
3453	TMCpuTickPause(pVM);
3454	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3455	return rc;
3456
3457	/*
3458	* Guest debug events.
3459	*/
3460	case VINF_EM_DBG_STEPPED:
3461	AssertMsgFailed(("VINF_EM_DBG_STEPPED cannot be here!"));
3462	case VINF_EM_DBG_STOP:
3463	case VINF_EM_DBG_BREAKPOINT:
3464	case VINF_EM_DBG_STEP:
3465	if (pVM->em.s.enmState == EMSTATE_RAW)
3466	{
3467	Log2(("EMR3ExecuteVM: %Vrc: %d -> %d\n", rc, pVM->em.s.enmState, EMSTATE_DEBUG_GUEST_RAW));
3468	pVM->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
3469	}
3470	else
3471	{
3472	Log2(("EMR3ExecuteVM: %Vrc: %d -> %d\n", rc, pVM->em.s.enmState, EMSTATE_DEBUG_GUEST_REM));
3473	pVM->em.s.enmState = EMSTATE_DEBUG_GUEST_REM;
3474	}
3475	break;
3476
3477	/*
3478	* Hypervisor debug events.
3479	*/
3480	case VINF_EM_DBG_HYPER_STEPPED:
3481	case VINF_EM_DBG_HYPER_BREAKPOINT:
3482	case VINF_EM_DBG_HYPER_ASSERTION:
3483	Log2(("EMR3ExecuteVM: %Vrc: %d -> %d\n", rc, pVM->em.s.enmState, EMSTATE_DEBUG_HYPER));
3484	pVM->em.s.enmState = EMSTATE_DEBUG_HYPER;
3485	break;
3486
3487	/*
3488	* Any error code showing up here other than the ones we
3489	* know and process above are considered to be FATAL.
3490	*
3491	* Unknown warnings and informational status codes are also
3492	* included in this.
3493	*/
3494	default:
3495	if (VBOX_SUCCESS(rc))
3496	{
3497	AssertMsgFailed(("Unexpected warning or informational status code %Vra!\n", rc));
3498	rc = VERR_EM_INTERNAL_ERROR;
3499	}
3500	pVM->em.s.enmState = EMSTATE_GURU_MEDITATION;
3501	Log(("EMR3ExecuteVM returns %d\n", rc));
3502	break;
3503	}
3504
3505
3506	/*
3507	* Any waiters can now be woken up
3508	*/
3509	VMMR3Unlock(pVM);
3510	VMMR3Lock(pVM);
3511
3512	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3513	STAM_PROFILE_ADV_START(&pVM->em.s.StatTotal, x);
3514
3515	/*
3516	* Act on the state.
3517	*/
3518	switch (pVM->em.s.enmState)
3519	{
3520	/*
3521	* Execute raw.
3522	*/
3523	case EMSTATE_RAW:
3524	rc = emR3RawExecute(pVM, &fFFDone);
3525	break;
3526
3527	/*
3528	* Execute hardware accelerated raw.
3529	*/
3530	case EMSTATE_HWACC:
3531	rc = emR3HwAccExecute(pVM, &fFFDone);
3532	break;
3533
3534	/*
3535	* Execute recompiled.
3536	*/
3537	case EMSTATE_REM:
3538	#if 0
3539	/* simulate a runtime error */
3540	VMSetRuntimeError (pVM, true, "simulatedError", "pVM=%p", pVM);
3541	#endif
3542	rc = emR3RemExecute(pVM, &fFFDone);
3543	Log2(("EMR3ExecuteVM: emR3RemExecute -> %Vrc\n", rc));
3544	break;
3545
3546	/*
3547	* hlt - execution halted until interrupt.
3548	*/
3549	case EMSTATE_HALTED:
3550	{
3551	STAM_PROFILE_START(&pVM->em.s.StatHalted, y);
3552	rc = VMR3WaitHalted(pVM, !(CPUMGetGuestEFlags(pVM) & X86_EFL_IF));
3553	STAM_PROFILE_STOP(&pVM->em.s.StatHalted, y);
3554	break;
3555	}
3556
3557	/*
3558	* Suspended - return to VM.cpp.
3559	*/
3560	case EMSTATE_SUSPENDED:
3561	TMVirtualPause(pVM);
3562	TMCpuTickPause(pVM);
3563	VMMR3Unlock(pVM);
3564	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3565	return VINF_EM_SUSPEND;
3566
3567	/*
3568	* Debugging in the guest.
3569	*/
3570	case EMSTATE_DEBUG_GUEST_REM:
3571	case EMSTATE_DEBUG_GUEST_RAW:
3572	TMVirtualPause(pVM);
3573	TMCpuTickPause(pVM);
3574	rc = emR3Debug(pVM, rc);
3575	TMVirtualResume(pVM);
3576	TMCpuTickResume(pVM);
3577	Log2(("EMR3ExecuteVM: enmr3Debug -> %Vrc (state %d)\n", rc, pVM->em.s.enmState));
3578	break;
3579
3580	/*
3581	* Debugging in the hypervisor.
3582	*/
3583	case EMSTATE_DEBUG_HYPER:
3584	{
3585	TMVirtualPause(pVM);
3586	TMCpuTickPause(pVM);
3587	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3588
3589	rc = emR3Debug(pVM, rc);
3590	Log2(("EMR3ExecuteVM: enmr3Debug -> %Vrc (state %d)\n", rc, pVM->em.s.enmState));
3591	if (rc != VINF_SUCCESS)
3592	{
3593	/* switch to guru meditation mode */
3594	pVM->em.s.enmState = EMSTATE_GURU_MEDITATION;
3595	VMMR3FatalDump(pVM, rc);
3596	return rc;
3597	}
3598
3599	STAM_PROFILE_ADV_START(&pVM->em.s.StatTotal, x);
3600	TMVirtualResume(pVM);
3601	TMCpuTickResume(pVM);
3602	break;
3603	}
3604
3605	/*
3606	* Guru meditation takes place in the debugger.
3607	*/
3608	case EMSTATE_GURU_MEDITATION:
3609	{
3610	/** @todo this ain't entirely safe. make a better return code check and specify this in DBGF/emR3Debug. */
3611	TMVirtualPause(pVM);
3612	TMCpuTickPause(pVM);
3613	VMMR3FatalDump(pVM, rc);
3614	int rc2 = emR3Debug(pVM, rc);
3615	if (rc2 == VERR_DBGF_NOT_ATTACHED)
3616	{
3617	VMMR3Unlock(pVM);
3618	/** @todo change the VM state! */
3619	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3620	return rc;
3621	}
3622	TMVirtualResume(pVM);
3623	TMCpuTickResume(pVM);
3624	rc = rc2;
3625	/** @todo we're not doing the right thing in emR3Debug and will cause code to be executed on disconnect and stuff.. */
3626	Log2(("EMR3ExecuteVM: enmr3Debug -> %Vrc (state %d)\n", rc, pVM->em.s.enmState));
3627	break;
3628	}
3629
3630	/*
3631	* The states we don't expect here.
3632	*/
3633	case EMSTATE_NONE:
3634	case EMSTATE_TERMINATING:
3635	default:
3636	AssertMsgFailed(("EMR3ExecuteVM: Invalid state %d!\n", pVM->em.s.enmState));
3637	pVM->em.s.enmState = EMSTATE_GURU_MEDITATION;
3638	TMVirtualPause(pVM);
3639	TMCpuTickPause(pVM);
3640	VMMR3Unlock(pVM);
3641	STAM_PROFILE_ADV_STOP(&pVM->em.s.StatTotal, x);
3642	return VERR_EM_INTERNAL_ERROR;
3643	}
3644	} /* The Outer Main Loop */
3645	}
3646	else
3647	{
3648	/*
3649	* Fatal error.
3650	*/
3651	LogFlow(("EMR3ExecuteVM: returns %Vrc (longjmp / fatal error)\n", rc));
3652	TMVirtualPause(pVM);
3653	TMCpuTickPause(pVM);
3654	VMMR3FatalDump(pVM, rc);
3655	emR3Debug(pVM, rc);
3656	VMMR3Unlock(pVM);
3657	/** @todo change the VM state! */
3658	return rc;
3659	}
3660
3661	/* (won't ever get here). */
3662	AssertFailed();
3663	}
3664

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/EM.cpp@ 1519

Download in other formats: