TRPMGCHandlers.cpp@ 830

Last change on this file since 830 was 716, checked in by vboxsync, 18 years ago
More stats
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 36.7 KB

Line
1	/* $Id: TRPMGCHandlers.cpp 716 2007-02-06 15:56:35Z vboxsync $ */
2	/** @file
3	* TRPM - Guest Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006 InnoTek Systemberatung GmbH
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License as published by the Free Software Foundation,
13	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
14	* distribution. VirtualBox OSE is distributed in the hope that it will
15	* be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* If you received this file as part of a commercial VirtualBox
18	* distribution, then only the terms of your commercial VirtualBox
19	* license agreement apply instead of the previous paragraph.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_TRPM
27	#include <VBox/selm.h>
28	#include <VBox/iom.h>
29	#include <VBox/pgm.h>
30	#include <VBox/pdm.h>
31	#include <VBox/dbgf.h>
32	#include <VBox/em.h>
33	#include <VBox/csam.h>
34	#include <VBox/patm.h>
35	#include <VBox/mm.h>
36	#include <VBox/cpum.h>
37	#include "TRPMInternal.h"
38	#include <VBox/vm.h>
39
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/x86.h>
44	#include <VBox/log.h>
45	#include <VBox/tm.h>
46	#include <iprt/asm.h>
47	#include <iprt/assert.h>
48
49	/* still here. MODR/M byte parsing */
50	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
51	#define X86_OPCODE_MODRM_REG_MASK 0x38
52	#define X86_OPCODE_MODRM_RM_MASK 0x07
53
54	/** Pointer to a readonly hypervisor trap record. */
55	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
56
57	/**
58	* A hypervisor trap record.
59	* This contains information about a handler for a instruction range.
60	*
61	* @remark This must match what TRPM_HANDLER outputs.
62	*/
63	typedef struct TRPMGCHYPER
64	{
65	/** The start address. */
66	uintptr_t uStartEIP;
67	/** The end address. (exclusive)
68	* If NULL the it's only for the instruction at pvStartEIP. */
69	uintptr_t uEndEIP;
70	/**
71	* The handler.
72	*
73	* @returns VBox status code
74	* VINF_SUCCESS means we've handled the trap.
75	* Any other error code means returning to the host context.
76	* @param pVM The VM handle.
77	* @param pRegFrame The register frame.
78	* @param uUser The user argument.
79	*/
80	DECLCALLBACKMEMBER(int, pfnHandler)(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
81	/** Whatever the handler desires to put here. */
82	uintptr_t uUser;
83	} TRPMGCHYPER;
84
85
86	/*******************************************************************************
87	* Global Variables *
88	*******************************************************************************/
89	__BEGIN_DECLS
90	/** Defined in VMMGC0.asm or VMMGC99.asm.
91	* @{ */
92	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
93	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
94	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
95	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
96	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
97	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
98	/** @} */
99	__END_DECLS
100
101
102	/*******************************************************************************
103	* Internal Functions *
104	*******************************************************************************/
105	__BEGIN_DECLS /* addressed from asm (not called so no DECLASM). */
106	DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
107	__END_DECLS
108
109
110
111	/**
112	* Exits the trap, called when exiting a trap handler.
113	*
114	* Will reset the trap if it's not a guest trap or the trap
115	* is already handled. Will process resume guest FFs.
116	*
117	* @returns rc.
118	* @param pVM VM handle.
119	* @param rc The VBox status code to return.
120	* @param pRegFrame Pointer to the register frame for the trap.
121	*/
122	static int trpmGCExitTrap(PVM pVM, int rc, PCPUMCTXCORE pRegFrame)
123	{
124	uint32_t uOldActiveVector = pVM->trpm.s.uActiveVector;
125
126	/* Reset trap? */
127	if ( rc != VINF_EM_RAW_GUEST_TRAP
128	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
129	pVM->trpm.s.uActiveVector = ~0;
130
131	#ifdef VBOX_HIGH_RES_TIMERS_HACK
132	/*
133	* Occationally we should poll timers.
134	* We must NOT do this too frequently as it adds a significant overhead
135	* and it'll kill us if the trap load is high. (See #1354.)
136	* (The heuristic is not very intelligent, we should really check trap
137	* frequency etc. here, but alas, we lack any such information atm.)
138	*/
139	static unsigned s_iTimerPoll = 0;
140	if (rc == VINF_SUCCESS)
141	{
142	if (!(++s_iTimerPoll & 0xf))
143	{
144	uint64_t cTicks = TMTimerPoll(pVM); NOREF(cTicks);
145	Log2(("TMTimerPoll at %VGv returned %RX64 (VM_FF_TIMER=%d)\n", pRegFrame->eip, cTicks, VM_FF_ISPENDING(pVM, VM_FF_TIMER)));
146	}
147	}
148	else
149	s_iTimerPoll = 0;
150	#endif
151
152	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
153	if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
154	{
155	Log2(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVM)));
156	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVM))
157	{
158	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
159	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
160	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
161	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
162	*/
163	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
164	}
165	}
166
167	/*
168	* Pending resume-guest-FF?
169	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
170	*/
171	if ( rc == VINF_SUCCESS
172	&& VM_FF_ISPENDING(pVM, VM_FF_TO_R3 \| VM_FF_TIMER \| VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC \| VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL \| VM_FF_REQUEST))
173	{
174	/* Pending Ring-3 action. */
175	if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3))
176	{
177	VM_FF_CLEAR(pVM, VM_FF_TO_R3);
178	rc = VINF_EM_RAW_TO_R3;
179	}
180	/* Pending timer action. */
181	else if (VM_FF_ISPENDING(pVM, VM_FF_TIMER))
182	rc = VINF_EM_RAW_TIMER_PENDING;
183	/* Pending interrupt: dispatch it. */
184	else if ( VM_FF_ISPENDING(pVM, VM_FF_INTERRUPT_APIC \| VM_FF_INTERRUPT_PIC)
185	&& !VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS)
186	&& PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
187	)
188	{
189	uint8_t u8Interrupt;
190	rc = PDMGetInterrupt(pVM, &u8Interrupt);
191	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
192	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Vrc\n", rc));
193	rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT);
194	/* can't return if successful */
195	Assert(rc != VINF_SUCCESS);
196
197	/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
198	Assert(uOldActiveVector <= 16);
199	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
200
201	/* Assert the trap and go to the recompiler to dispatch it. */
202	TRPMAssertTrap(pVM, u8Interrupt, false);
203
204	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
205	rc = VINF_EM_RAW_INTERRUPT_PENDING;
206	}
207	/*
208	* Try sync CR3?
209	* This ASSUMES that the MOV CRx, x emulation doesn't return with VINF_PGM_SYNC_CR3. (a bit hackish)
210	*/
211	else if (VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
212	#if 1
213	rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
214	#else
215	rc = VINF_PGM_SYNC_CR3;
216	#endif
217	/* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
218	else if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
219	rc = VINF_EM_PENDING_REQUEST;
220	}
221
222	AssertMsg( rc != VINF_SUCCESS
223	\|\| ( pRegFrame->eflags.Bits.u1IF
224	&& pRegFrame->eflags.Bits.u2IOPL < (unsigned)(pRegFrame->ss & X86_SEL_RPL))
225	, ("rc = %VGv\neflags=%RX32 ss=%RTsel IOPL=%d\n", rc, pRegFrame->eflags.u32, pRegFrame->ss, pRegFrame->eflags.Bits.u2IOPL));
226	return rc;
227	}
228
229
230	/**
231	* \#DB (Debug event) handler.
232	*
233	* @returns VBox status code.
234	* VINF_SUCCESS means we completely handled this trap,
235	* other codes are passed execution to host context.
236	*
237	* @param pTrpm Pointer to TRPM data (within VM).
238	* @param pRegFrame Pointer to the register frame for the trap.
239	* @internal
240	*/
241	DECLASM(int) TRPMGCTrap01Handler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
242	{
243	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
244	PVM pVM = TRPM2VM(pTrpm);
245	LogFlow(("TRPMGCTrap01Handler: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs, pRegFrame->eip, uDr6));
246
247	/*
248	* We currently don't make sure of the X86_DR7_GD bit, but
249	* there might come a time when we do.
250	*/
251	if ((uDr6 & X86_DR6_BD) == X86_DR6_BD)
252	{
253	AssertReleaseMsgFailed(("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
254	ASMGetDR7(), CPUMGetHyperDR7(pVM), uDr6));
255	return VERR_NOT_IMPLEMENTED;
256	}
257
258	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
259
260	/*
261	* Now leave the rest to the DBGF.
262	*/
263	int rc = DBGFGCTrap01Handler(pVM, pRegFrame, uDr6);
264	if (rc == VINF_EM_RAW_GUEST_TRAP)
265	CPUMSetGuestDR6(pVM, uDr6);
266
267	return trpmGCExitTrap(pVM, rc, pRegFrame);
268	}
269
270
271
272	/**
273	* NMI handler, for when we are using NMIs to debug things.
274	*
275	* @returns VBox status code.
276	* VINF_SUCCESS means we completely handled this trap,
277	* other codes are passed execution to host context.
278	*
279	* @param pTrpm Pointer to TRPM data (within VM).
280	* @param pRegFrame Pointer to the register frame for the trap.
281	* @internal
282	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
283	*/
284	DECLASM(int) TRPMGCTrap02Handler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
285	{
286	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
287	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip);
288	return VERR_TRPM_DONT_PANIC;
289	}
290
291
292	/**
293	* \#BP (Breakpoint) handler.
294	*
295	* @returns VBox status code.
296	* VINF_SUCCESS means we completely handled this trap,
297	* other codes are passed execution to host context.
298	*
299	* @param pTrpm Pointer to TRPM data (within VM).
300	* @param pRegFrame Pointer to the register frame for the trap.
301	* @internal
302	*/
303	DECLASM(int) TRPMGCTrap03Handler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
304	{
305	LogFlow(("TRPMGCTrap03Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
306	PVM pVM = TRPM2VM(pTrpm);
307	int rc;
308
309	/*
310	* Both PATM are using INT3s, let them have a go first.
311	*/
312	if ((pRegFrame->ss & X86_SEL_RPL) == 1)
313	{
314	rc = PATMHandleInt3PatchTrap(pVM, pRegFrame);
315	if (rc == VINF_SUCCESS \|\| rc == VINF_EM_RAW_EMULATE_INSTR \|\| rc == VINF_PATM_PATCH_INT3 \|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
316	return trpmGCExitTrap(pVM, rc, pRegFrame);
317	}
318	rc = DBGFGCTrap03Handler(pVM, pRegFrame);
319	/* anything we should do with this? Schedule it in GC? */
320	return trpmGCExitTrap(pVM, rc, pRegFrame);
321	}
322
323
324	/**
325	* Trap handler for illegal opcode fault (\#UD).
326	*
327	* @returns VBox status code.
328	* VINF_SUCCESS means we completely handled this trap,
329	* other codes are passed execution to host context.
330	*
331	* @param pTrpm Pointer to TRPM data (within VM).
332	* @param pRegFrame Pointer to the register frame for the trap.
333	* @internal
334	*/
335	DECLASM(int) TRPMGCTrap06Handler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
336	{
337	PVM pVM = TRPM2VM(pTrpm);
338
339	LogFlow(("TRPMGCTrap06Handler %VGv\n", pRegFrame->eip));
340
341	if ( (pRegFrame->ss & X86_SEL_RPL) == 1
342	&& PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
343	{
344	/*
345	* Decode the instruction.
346	*/
347	RTGCPTR PC;
348	int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &PC);
349	if (VBOX_FAILURE(rc))
350	{
351	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Vrc !!\n", pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
352	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
353	}
354
355	DISCPUSTATE Cpu;
356	uint32_t cbOp;
357	rc = EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
358	if (VBOX_FAILURE(rc))
359	return trpmGCExitTrap(pVM, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
360
361	/** @note monitor causes an #UD exception instead of #GP when not executed in ring 0. */
362	if (Cpu.pCurInstr->opcode == OP_ILLUD2)
363	{
364	int rc = PATMHandleIllegalInstrTrap(pVM, pRegFrame);
365	if (rc == VINF_SUCCESS \|\| rc == VINF_EM_RAW_EMULATE_INSTR \|\| rc == VINF_PATM_DUPLICATE_FUNCTION \|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET)
366	return trpmGCExitTrap(pVM, rc, pRegFrame);
367	}
368	}
369	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
370	}
371
372
373	/**
374	* Trap handler for device not present fault (\#NM).
375	*
376	* Device not available, FP or (F)WAIT instruction.
377	*
378	* @returns VBox status code.
379	* VINF_SUCCESS means we completely handled this trap,
380	* other codes are passed execution to host context.
381	*
382	* @param pTrpm Pointer to TRPM data (within VM).
383	* @param pRegFrame Pointer to the register frame for the trap.
384	* @internal
385	*/
386	DECLASM(int) TRPMGCTrap07Handler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
387	{
388	PVM pVM = TRPM2VM(pTrpm);
389
390	LogFlow(("TRPMTrap07HandlerGC: eip=%VGv\n", pRegFrame->eip));
391	return CPUMHandleLazyFPU(pVM);
392	}
393
394
395	/**
396	* \#NP ((segment) Not Present) handler.
397	*
398	* @returns VBox status code.
399	* VINF_SUCCESS means we completely handled this trap,
400	* other codes are passed execution to host context.
401	*
402	* @param pTrpm Pointer to TRPM data (within VM).
403	* @param pRegFrame Pointer to the register frame for the trap.
404	* @internal
405	*/
406	DECLASM(int) TRPMGCTrap0bHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
407	{
408	LogFlow(("TRPMGCTrap0bHandler: eip=%VGv\n", pRegFrame->eip));
409	PVM pVM = TRPM2VM(pTrpm);
410
411	/*
412	* Try to detect instruction by opcode which caused trap.
413	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
414	* accessing user code. need to handle it somehow in future!
415	*/
416	uint8_t *pu8Code;
417	if (SELMValidateAndConvertCSAddr(pVM, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, (PRTGCPTR)&pu8Code) == VINF_SUCCESS)
418	{
419	/*
420	* First skip possible instruction prefixes, such as:
421	* OS, AS
422	* CS:, DS:, ES:, SS:, FS:, GS:
423	* REPE, REPNE
424	*
425	* note: Currently we supports only up to 4 prefixes per opcode, more
426	* prefixes (normally not used anyway) will cause trap d in guest.
427	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
428	* check this issue, its too hard.
429	*/
430	for (unsigned i = 0; i < 4; i++)
431	{
432	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
433	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
434	&& pu8Code[0] != 0x2e /* CS: */
435	&& pu8Code[0] != 0x36 /* SS: */
436	&& pu8Code[0] != 0x3e /* DS: */
437	&& pu8Code[0] != 0x26 /* ES: */
438	&& pu8Code[0] != 0x64 /* FS: */
439	&& pu8Code[0] != 0x65 /* GS: */
440	&& pu8Code[0] != 0x66 /* OS */
441	&& pu8Code[0] != 0x67 /* AS */
442	)
443	break;
444	pu8Code++;
445	}
446
447	/*
448	* Detect right switch using a callgate.
449	*
450	* We recognize the following causes for the trap 0b:
451	* CALL FAR, CALL FAR []
452	* JMP FAR, JMP FAR []
453	* IRET (may cause a task switch)
454	*
455	* Note: we can't detect whether the trap was caused by a call to a
456	* callgate descriptor or it is a real trap 0b due to a bad selector.
457	* In both situations we'll pass execution to our recompiler so we don't
458	* have to worry.
459	* If we wanted to do better detection, we have set GDT entries to callgate
460	* descriptors pointing to our own handlers.
461	*/
462	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
463	if ( pu8Code[0] == 0x9a /* CALL FAR */
464	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
465	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
466	\|\| pu8Code[0] == 0xea /* JMP FAR */
467	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
468	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
469	\|\| pu8Code[0] == 0xcf /* IRET */
470	)
471	{
472	/*
473	* Got potential call to callgate.
474	* We simply return execution to the recompiler to do emulation
475	* starting from the instruction which caused the trap.
476	*/
477	pTrpm->uActiveVector = ~0;
478	return VINF_EM_RAW_RING_SWITCH;
479	}
480	}
481
482	/*
483	* Pass trap 0b as is to the recompiler in all other cases.
484	*/
485	return VINF_EM_RAW_GUEST_TRAP;
486	}
487
488
489	/**
490	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
491	*
492	* @returns VBox status code.
493	* VINF_SUCCESS means we completely handled this trap,
494	* other codes are passed execution to host context.
495	*
496	* @param pVM The VM handle.
497	* @param pRegFrame Pointer to the register frame for the trap.
498	* @param pCpu The opcode info.
499	* @param PC Program counter.
500	*/
501	static int trpmGCTrap0dHandlerRing0(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
502	{
503	int rc;
504
505	/*
506	* Try handle it here, if not return to HC and emulate/interpret it there.
507	*/
508	switch (pCpu->pCurInstr->opcode)
509	{
510	case OP_INT3:
511	/*
512	* Little hack to make the code below not fail
513	*/
514	pCpu->param1.flags = USE_IMMEDIATE8;
515	pCpu->param1.parval = 3;
516	/* fallthru */
517	case OP_INT:
518	{
519	Assert(pCpu->param1.flags & USE_IMMEDIATE8);
520	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
521	if (pCpu->param1.parval == 3)
522	{
523	/* Obsolete!! */
524	/* Int 3 replacement patch? */
525	if (PATMHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
526	{
527	AssertFailed();
528	return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
529	}
530	}
531	rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT);
532	if (VBOX_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
533	return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
534
535	pVM->trpm.s.uActiveVector = (pVM->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
536	pVM->trpm.s.fActiveSoftwareInterrupt = true;
537	return trpmGCExitTrap(pVM, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
538	}
539
540	#ifdef PATM_EMULATE_SYSENTER
541	case OP_SYSEXIT:
542	case OP_SYSRET:
543	rc = PATMSysCall(pVM, pRegFrame, pCpu);
544	return trpmGCExitTrap(pVM, rc, pRegFrame);
545	#endif
546
547	case OP_HLT:
548	/* If it's in patch code, defer to ring-3. */
549	if (PATMIsPatchGCAddr(pVM, PC))
550	break;
551
552	pRegFrame->eip += pCpu->opsize;
553	return trpmGCExitTrap(pVM, VINF_EM_HALT, pRegFrame);
554
555
556	/*
557	* These instructions are used by PATM and CASM for finding
558	* dangerous non-trapping instructions. Thus, since all
559	* scanning and patching is done in ring-3 we'll have to
560	* return to ring-3 on the first encounter of these instructions.
561	*/
562	case OP_MOV_CR:
563	case OP_MOV_DR:
564	/* We can safely emulate control/debug register move instructions in patched code. */
565	if ( !PATMIsPatchGCAddr(pVM, PC)
566	&& !CSAMIsKnownDangerousInstr(pVM, PC))
567	break;
568	case OP_INVLPG:
569	case OP_LLDT:
570	case OP_STI:
571	case OP_RDTSC:
572	{
573	uint32_t cbIgnored;
574	rc = EMInterpretInstructionCPU(pVM, pCpu, pRegFrame, PC, &cbIgnored);
575	if (VBOX_SUCCESS(rc))
576	pRegFrame->eip += pCpu->opsize;
577	else if (rc == VERR_EM_INTERPRETER)
578	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
579	return trpmGCExitTrap(pVM, rc, pRegFrame);
580	}
581	}
582
583	return trpmGCExitTrap(pVM, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
584	}
585
586
587	/**
588	* \#GP (General Protection Fault) handler for Ring-3.
589	*
590	* @returns VBox status code.
591	* VINF_SUCCESS means we completely handled this trap,
592	* other codes are passed execution to host context.
593	*
594	* @param pVM The VM handle.
595	* @param pRegFrame Pointer to the register frame for the trap.
596	* @param pCpu The opcode info.
597	*/
598	static int trpmGCTrap0dHandlerRing3(PVM pVM, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu)
599	{
600	int rc;
601
602	switch (pCpu->pCurInstr->opcode)
603	{
604	/*
605	* STI and CLI are I/O privileged, i.e. if IOPL
606	*/
607	case OP_STI:
608	case OP_CLI:
609	{
610	uint32_t efl = CPUMRawGetEFlags(pVM, pRegFrame);
611	if (X86_EFL_GET_IOPL(efl) >= (unsigned)(pRegFrame->ss & X86_SEL_RPL))
612	{
613	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
614	return trpmGCExitTrap(pVM, VINF_EM_RESCHEDULE_REM, pRegFrame);
615	}
616	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0)\n"));
617	break;
618	}
619
620	/*
621	* INT3 and INT xx are ring-switching.
622	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
623	*/
624	case OP_INT3:
625	/*
626	* Little hack to make the code below not fail
627	*/
628	pCpu->param1.flags = USE_IMMEDIATE8;
629	pCpu->param1.parval = 3;
630	/* fall thru */
631	case OP_INT:
632	{
633	Assert(pCpu->param1.flags & USE_IMMEDIATE8);
634	rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT);
635	if (VBOX_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
636	return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
637
638	pVM->trpm.s.uActiveVector = (pVM->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
639	pVM->trpm.s.fActiveSoftwareInterrupt = true;
640	return trpmGCExitTrap(pVM, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
641	}
642
643	/*
644	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
645	*/
646	case OP_SYSCALL:
647	case OP_SYSENTER:
648	#ifdef PATM_EMULATE_SYSENTER
649	rc = PATMSysCall(pVM, pRegFrame, pCpu);
650	if (rc == VINF_SUCCESS)
651	return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
652	/* else no break; */
653	#endif
654	case OP_BOUND:
655	case OP_INTO:
656	pVM->trpm.s.uActiveVector = ~0;
657	return trpmGCExitTrap(pVM, VINF_EM_RAW_RING_SWITCH, pRegFrame);
658	}
659
660	/*
661	* A genuine guest fault.
662	*/
663	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
664	}
665
666
667	/**
668	* \#GP (General Protection Fault) handler.
669	*
670	* @returns VBox status code.
671	* VINF_SUCCESS means we completely handled this trap,
672	* other codes are passed execution to host context.
673	*
674	* @param pVM The VM handle.
675	* @param pTrpm Pointer to TRPM data (within VM).
676	* @param pRegFrame Pointer to the register frame for the trap.
677	*/
678	static int trpmGCTrap0dHandler(PVM pVM, PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
679	{
680	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%VGv uErr=%RX32\n", pRegFrame->ss, pRegFrame->eip, pTrpm->uActiveErrorCode));
681
682	#if 0 /* not right for iret. Shouldn't really be needed as SELMValidateAndConvertCSAddr deals with invalid cs. */
683	/*
684	* Filter out selector problems first as these may mean that the
685	* instruction isn't safe to read. If we're here because CS is NIL
686	* the flattening of cs:eip will deal with that.
687	*/
688	if ( !(pTrpm->uActiveErrorCode & (X86_TRAP_ERR_IDT \| X86_TRAP_ERR_EXTERNAL))
689	&& (pTrpm->uActiveErrorCode & X86_TRAP_ERR_SEL_MASK))
690	{
691	/* It's a guest trap. */
692	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
693	}
694	#endif
695
696	STAM_PROFILE_ADV_START(&pVM->trpm.s.StatTrap0dDisasm, a);
697	/*
698	* Decode the instruction.
699	*/
700	RTGCPTR PC;
701	int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &PC);
702	if (VBOX_FAILURE(rc))
703	{
704	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Vrc !!\n",
705	pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
706	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
707	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
708	}
709
710	DISCPUSTATE Cpu;
711	uint32_t cbOp;
712	rc = EMInterpretDisasOneEx(pVM, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
713	if (VBOX_FAILURE(rc))
714	{
715	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
716	return trpmGCExitTrap(pVM, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
717	}
718	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
719
720	/*
721	* Deal with I/O port access.
722	*/
723	if ( pVM->trpm.s.uActiveErrorCode == 0
724	&& (Cpu.pCurInstr->optype & OPTYPE_PORTIO))
725	{
726	rc = EMInterpretPortIO(pVM, pRegFrame, &Cpu, cbOp);
727	return trpmGCExitTrap(pVM, rc, pRegFrame);
728	}
729
730	/*
731	* Deal with Ring-0 (privileged instructions)
732	*/
733	if ( (pRegFrame->ss & X86_SEL_RPL) <= 1
734	&& !pRegFrame->eflags.Bits.u1VM)
735	return trpmGCTrap0dHandlerRing0(pVM, pRegFrame, &Cpu, PC);
736
737	/*
738	* Deal with Ring-3 GPs.
739	*/
740	if (!pRegFrame->eflags.Bits.u1VM)
741	return trpmGCTrap0dHandlerRing3(pVM, pRegFrame, &Cpu);
742
743	/** @todo what about V86 mode? */
744	return trpmGCExitTrap(pVM, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
745	}
746
747
748	/**
749	* \#GP (General Protection Fault) handler.
750	*
751	* @returns VBox status code.
752	* VINF_SUCCESS means we completely handled this trap,
753	* other codes are passed execution to host context.
754	*
755	* @param pTrpm Pointer to TRPM data (within VM).
756	* @param pRegFrame Pointer to the register frame for the trap.
757	* @internal
758	*/
759	DECLASM(int) TRPMGCTrap0dHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
760	{
761	LogFlow(("TRPMGCTrap0dHandler: eip=%RGv\n", pRegFrame->eip));
762	PVM pVM = TRPM2VM(pTrpm);
763
764	int rc = trpmGCTrap0dHandler(pVM, pTrpm, pRegFrame);
765	switch (rc)
766	{
767	case VINF_EM_RAW_GUEST_TRAP:
768	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
769	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
770	rc = VINF_PATM_PATCH_TRAP_GP;
771	break;
772
773	case VINF_EM_RAW_INTERRUPT_PENDING:
774	Assert(TRPMHasTrap(pVM));
775	/* no break; */
776	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
777	case VINF_IOM_HC_IOPORT_READWRITE:
778	case VINF_IOM_HC_IOPORT_READ:
779	case VINF_IOM_HC_IOPORT_WRITE:
780	case VINF_IOM_HC_MMIO_WRITE:
781	case VINF_IOM_HC_MMIO_READ:
782	case VINF_IOM_HC_MMIO_READ_WRITE:
783	case VINF_PATM_PATCH_INT3:
784	case VINF_EM_RAW_TO_R3:
785	case VINF_EM_RAW_TIMER_PENDING:
786	case VINF_EM_PENDING_REQUEST:
787	case VINF_EM_HALT:
788	case VINF_SUCCESS:
789	break;
790
791	default:
792	AssertMsg(PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip) == false, ("return code %d\n", rc));
793	break;
794	}
795	return rc;
796	}
797
798	/**
799	* \#PF (Page Fault) handler.
800	*
801	* Calls PGM which does the actual handling.
802	*
803	*
804	* @returns VBox status code.
805	* VINF_SUCCESS means we completely handled this trap,
806	* other codes are passed execution to host context.
807	*
808	* @param pTrpm Pointer to TRPM data (within VM).
809	* @param pRegFrame Pointer to the register frame for the trap.
810	* @internal
811	*/
812	DECLASM(int) TRPMGCTrap0eHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
813	{
814	LogBird(("TRPMGCTrap0eHandler: eip=%RGv\n", pRegFrame->eip));
815	PVM pVM = TRPM2VM(pTrpm);
816
817	/*
818	* This is all PGM stuff.
819	*/
820	int rc = PGMTrap0eHandler(pVM, pTrpm->uActiveErrorCode, pRegFrame, (RTGCPTR)pTrpm->uActiveCR2);
821
822	switch (rc)
823	{
824	case VINF_EM_RAW_EMULATE_INSTR:
825	case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
826	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
827	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
828	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
829	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
830	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
831	rc = VINF_PATCH_EMULATE_INSTR;
832	break;
833
834	case VINF_EM_RAW_GUEST_TRAP:
835	if (PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
836	return VINF_PATM_PATCH_TRAP_PF;
837
838	rc = TRPMForwardTrap(pVM, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP);
839	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
840	break;
841
842	case VINF_EM_RAW_INTERRUPT_PENDING:
843	Assert(TRPMHasTrap(pVM));
844	/* no break; */
845	case VINF_IOM_HC_MMIO_READ:
846	case VINF_IOM_HC_MMIO_WRITE:
847	case VINF_IOM_HC_MMIO_READ_WRITE:
848	case VINF_PATM_HC_MMIO_PATCH_READ:
849	case VINF_PATM_HC_MMIO_PATCH_WRITE:
850	case VINF_SUCCESS:
851	case VINF_EM_RAW_TO_R3:
852	case VINF_EM_PENDING_REQUEST:
853	case VINF_EM_RAW_TIMER_PENDING:
854	case VINF_CSAM_PENDING_ACTION:
855	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
856	break;
857
858	default:
859	AssertMsg(PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
860	break;
861	}
862	return trpmGCExitTrap(pVM, rc, pRegFrame);
863	}
864
865
866	/**
867	* Scans for the EIP in the specified array of trap handlers.
868	*
869	* If we don't fine the EIP, we'll panic.
870	*
871	* @returns VBox status code.
872	*
873	* @param pVM The VM handle.
874	* @param pRegFrame Pointer to the register frame for the trap.
875	* @param paHandlers The array of trap handler records.
876	* @param pEndRecord The end record (exclusive).
877	*/
878	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
879	{
880	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
881	Assert(paHandlers <= pEndRecord);
882
883	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
884
885	#if 0 /// @todo later
886	/*
887	* Start by doing a kind of binary search.
888	*/
889	unsigned iStart = 0;
890	unsigned iEnd = pEndRecord - paHandlers;
891	unsigned i = iEnd / 2;
892	#endif
893
894	/*
895	* Do a linear search now (in case the array wasn't properly sorted).
896	*/
897	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
898	{
899	if ( pCur->uStartEIP <= uEip
900	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
901	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
902	}
903
904	return VERR_TRPM_DONT_PANIC;
905	}
906
907
908	/**
909	* Hypervisor \#NP ((segment) Not Present) handler.
910	*
911	* Scans for the EIP in the registered trap handlers.
912	*
913	* @returns VBox status code.
914	* VINF_SUCCESS means we completely handled this trap,
915	* other codes are passed back to host context.
916	*
917	* @param pTrpm Pointer to TRPM data (within VM).
918	* @param pRegFrame Pointer to the register frame for the trap.
919	* @internal
920	*/
921	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
922	{
923	return trpmGCHyperGeneric(TRPM2VM(pTrpm), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
924	}
925
926
927	/**
928	* Hypervisor \#GP (General Protection Fault) handler.
929	*
930	* Scans for the EIP in the registered trap handlers.
931	*
932	* @returns VBox status code.
933	* VINF_SUCCESS means we completely handled this trap,
934	* other codes are passed back to host context.
935	*
936	* @param pTrpm Pointer to TRPM data (within VM).
937	* @param pRegFrame Pointer to the register frame for the trap.
938	* @internal
939	*/
940	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
941	{
942	return trpmGCHyperGeneric(TRPM2VM(pTrpm), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
943	}
944
945
946	/**
947	* Hypervisor \#PF (Page Fault) handler.
948	*
949	* Scans for the EIP in the registered trap handlers.
950	*
951	* @returns VBox status code.
952	* VINF_SUCCESS means we completely handled this trap,
953	* other codes are passed back to host context.
954	*
955	* @param pTrpm Pointer to TRPM data (within VM).
956	* @param pRegFrame Pointer to the register frame for the trap.
957	* @internal
958	*/
959	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPM pTrpm, PCPUMCTXCORE pRegFrame)
960	{
961	return trpmGCHyperGeneric(TRPM2VM(pTrpm), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
962	}
963
964
965	/**
966	* Deal with hypervisor traps occuring when resuming execution on a trap.
967	*
968	* @returns VBox status code.
969	* @param pVM The VM handle.
970	* @param pRegFrame Register frame.
971	* @param uUser User arg.
972	*/
973	DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
974	{
975	Log(("trpmGCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
976
977	if (uUser & TRPM_TRAP_IN_HYPER)
978	{
979	/*
980	* Just zero the register in question.
981	* We're ASSUMING that esp points to it.
982	*/
983	switch (uUser & TRPM_TRAP_IN_OP_MASK)
984	{
985	case TRPM_TRAP_IN_MOV_GS:
986	case TRPM_TRAP_IN_MOV_FS:
987	*(PRTSEL)pRegFrame->esp = 0;
988	return VINF_SUCCESS;
989
990	default:
991	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
992	return VERR_INTERNAL_ERROR;
993	}
994	}
995	else
996	{
997	/*
998	* Reconstruct the guest context and switch to the recompiler.
999	* We ASSUME we're only at
1000	*/
1001	CPUMCTXCORE CtxCore = *pRegFrame;
1002	uint32_t pEsp = (uint32_t )pRegFrame->esp;
1003	int rc;
1004
1005	switch (uUser)
1006	{
1007	/*
1008	* This will only occur when resuming guest code in a trap handler!
1009	*/
1010	/* @note ASSUMES esp points to the temporary guest CPUMCTXCORE!!! */
1011	case TRPM_TRAP_IN_MOV_GS:
1012	case TRPM_TRAP_IN_MOV_FS:
1013	case TRPM_TRAP_IN_MOV_ES:
1014	case TRPM_TRAP_IN_MOV_DS:
1015	{
1016	PCPUMCTXCORE pTempGuestCtx = (PCPUMCTXCORE) pEsp;
1017
1018	/* Just copy the whole thing; several selector registers, eip (etc) and eax are not yet in pRegFrame. */
1019	CtxCore = *pTempGuestCtx;
1020	rc = VINF_EM_RAW_STALE_SELECTOR;
1021	break;
1022	}
1023
1024	/*
1025	* This will only occur when resuming guest code!
1026	*/
1027	case TRPM_TRAP_IN_IRET:
1028	CtxCore.eip = *pEsp++;
1029	CtxCore.cs = (RTSEL)*pEsp++;
1030	CtxCore.eflags.u32 = *pEsp++;
1031	CtxCore.esp = *pEsp++;
1032	CtxCore.ss = (RTSEL)*pEsp++;
1033	rc = VINF_EM_RAW_IRET_TRAP;
1034	break;
1035
1036	/*
1037	* This will only occur when resuming V86 guest code!
1038	*/
1039	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1040	CtxCore.eip = *pEsp++;
1041	CtxCore.cs = (RTSEL)*pEsp++;
1042	CtxCore.eflags.u32 = *pEsp++;
1043	CtxCore.esp = *pEsp++;
1044	CtxCore.ss = (RTSEL)*pEsp++;
1045	CtxCore.es = (RTSEL)*pEsp++;
1046	CtxCore.ds = (RTSEL)*pEsp++;
1047	CtxCore.fs = (RTSEL)*pEsp++;
1048	CtxCore.gs = (RTSEL)*pEsp++;
1049	rc = VINF_EM_RAW_IRET_TRAP;
1050	break;
1051
1052	default:
1053	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1054	return VERR_INTERNAL_ERROR;
1055	}
1056
1057
1058	CPUMSetGuestCtxCore(pVM, &CtxCore);
1059	TRPMGCHyperReturnToHost(pVM, rc);
1060	}
1061
1062	AssertMsgFailed(("Impossible!\n"));
1063	return VERR_INTERNAL_ERROR;
1064	}
1065

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp@ 830

Download in other formats: