EMRaw.cpp@ 35333

Last change on this file since 35333 was 35333, checked in by vboxsync, 14 years ago
VMM source reorg.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 58.9 KB

Line
1	/* $Id: EMRaw.cpp 35333 2010-12-27 12:10:56Z vboxsync $ */
2
3	/** @file
4	* EM - Execution Monitor / Manager - software virtualization
5	*/
6
7	/*
8	* Copyright (C) 2006-2009 Oracle Corporation
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.virtualbox.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License (GPL) as published by the Free Software
14	* Foundation, in version 2 as it comes in the "COPYING" file of the
15	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
16	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
17	*/
18
19	/** @page pg_em EM - The Execution Monitor / Manager
20	*
21	* The Execution Monitor/Manager is responsible for running the VM, scheduling
22	* the right kind of execution (Raw-mode, Hardware Assisted, Recompiled or
23	* Interpreted), and keeping the CPU states in sync. The function
24	* EMR3ExecuteVM() is the 'main-loop' of the VM, while each of the execution
25	* modes has different inner loops (emR3RawExecute, emR3HwAccExecute, and
26	* emR3RemExecute).
27	*
28	* The interpreted execution is only used to avoid switching between
29	* raw-mode/hwaccm and the recompiler when fielding virtualization traps/faults.
30	* The interpretation is thus implemented as part of EM.
31	*
32	* @see grp_em
33	*/
34
35	/*******************************************************************************
36	* Header Files *
37	*******************************************************************************/
38	#define LOG_GROUP LOG_GROUP_EM
39	#include <VBox/em.h>
40	#include <VBox/vmm.h>
41	#include <VBox/patm.h>
42	#include <VBox/csam.h>
43	#include <VBox/selm.h>
44	#include <VBox/trpm.h>
45	#include <VBox/iom.h>
46	#include <VBox/dbgf.h>
47	#include <VBox/pgm.h>
48	#include <VBox/rem.h>
49	#include <VBox/tm.h>
50	#include <VBox/mm.h>
51	#include <VBox/ssm.h>
52	#include <VBox/pdmapi.h>
53	#include <VBox/pdmcritsect.h>
54	#include <VBox/pdmqueue.h>
55	#include <VBox/patm.h>
56	#include "EMInternal.h"
57	#include "internal/em.h"
58	#include <VBox/vm.h>
59	#include <VBox/cpumdis.h>
60	#include <VBox/dis.h>
61	#include <VBox/disopcode.h>
62	#include <VBox/dbgf.h>
63
64	#include <VBox/log.h>
65	#include <iprt/asm.h>
66	#include <iprt/string.h>
67	#include <iprt/stream.h>
68
69
70	/*******************************************************************************
71	* Defined Constants And Macros *
72	*******************************************************************************/
73
74
75	/*******************************************************************************
76	* Internal Functions *
77	*******************************************************************************/
78	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
79	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC = VINF_SUCCESS);
80	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu);
81	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret);
82	static int emR3SingleStepExecRem(PVM pVM, uint32_t cIterations);
83	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu);
84	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu);
85	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu);
86
87	#define EMHANDLERC_WITH_PATM
88	#include "EMHandleRCTmpl.h"
89
90	/**
91	* Enables or disables a set of raw-mode execution modes.
92	*
93	* @returns VINF_SUCCESS on success.
94	* @returns VINF_RESCHEDULE if a rescheduling might be required.
95	* @returns VERR_INVALID_PARAMETER on an invalid enmMode value.
96	*
97	* @param pVM The VM to operate on.
98	* @param enmMode The execution mode change.
99	* @thread The emulation thread.
100	*/
101	VMMR3DECL(int) EMR3RawSetMode(PVM pVM, EMRAWMODE enmMode)
102	{
103	switch (enmMode)
104	{
105	case EMRAW_NONE:
106	pVM->fRawR3Enabled = false;
107	pVM->fRawR0Enabled = false;
108	break;
109	case EMRAW_RING3_ENABLE:
110	pVM->fRawR3Enabled = true;
111	break;
112	case EMRAW_RING3_DISABLE:
113	pVM->fRawR3Enabled = false;
114	break;
115	case EMRAW_RING0_ENABLE:
116	pVM->fRawR0Enabled = true;
117	break;
118	case EMRAW_RING0_DISABLE:
119	pVM->fRawR0Enabled = false;
120	break;
121	default:
122	AssertMsgFailed(("Invalid enmMode=%d\n", enmMode));
123	return VERR_INVALID_PARAMETER;
124	}
125	Log(("EMR3SetRawMode: fRawR3Enabled=%RTbool fRawR0Enabled=%RTbool\n",
126	pVM->fRawR3Enabled, pVM->fRawR0Enabled));
127	return pVM->aCpus[0].em.s.enmState == EMSTATE_RAW ? VINF_EM_RESCHEDULE : VINF_SUCCESS;
128	}
129
130
131
132	#ifdef VBOX_WITH_STATISTICS
133	/**
134	* Just a braindead function to keep track of cli addresses.
135	* @param pVM VM handle.
136	* @param pVMCPU VMCPU handle.
137	* @param GCPtrInstr The EIP of the cli instruction.
138	*/
139	static void emR3RecordCli(PVM pVM, PVMCPU pVCpu, RTGCPTR GCPtrInstr)
140	{
141	PCLISTAT pRec;
142
143	pRec = (PCLISTAT)RTAvlGCPtrGet(&pVCpu->em.s.pCliStatTree, GCPtrInstr);
144	if (!pRec)
145	{
146	/* New cli instruction; insert into the tree. */
147	pRec = (PCLISTAT)MMR3HeapAllocZ(pVM, MM_TAG_EM, sizeof(*pRec));
148	Assert(pRec);
149	if (!pRec)
150	return;
151	pRec->Core.Key = GCPtrInstr;
152
153	char szCliStatName[32];
154	RTStrPrintf(szCliStatName, sizeof(szCliStatName), "/EM/Cli/0x%RGv", GCPtrInstr);
155	STAM_REG(pVM, &pRec->Counter, STAMTYPE_COUNTER, szCliStatName, STAMUNIT_OCCURENCES, "Number of times cli was executed.");
156
157	bool fRc = RTAvlGCPtrInsert(&pVCpu->em.s.pCliStatTree, &pRec->Core);
158	Assert(fRc); NOREF(fRc);
159	}
160	STAM_COUNTER_INC(&pRec->Counter);
161	STAM_COUNTER_INC(&pVCpu->em.s.StatTotalClis);
162	}
163	#endif /* VBOX_WITH_STATISTICS */
164
165
166
167	/**
168	* Resumes executing hypervisor after a debug event.
169	*
170	* This is kind of special since our current guest state is
171	* potentially out of sync.
172	*
173	* @returns VBox status code.
174	* @param pVM The VM handle.
175	* @param pVCpu The VMCPU handle.
176	*/
177	int emR3RawResumeHyper(PVM pVM, PVMCPU pVCpu)
178	{
179	int rc;
180	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
181	Assert(pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER);
182	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr\n", pCtx->cs, pCtx->eip, pCtx->eflags));
183
184	/*
185	* Resume execution.
186	*/
187	CPUMR3RawEnter(pVCpu, NULL);
188	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_RF);
189	rc = VMMR3ResumeHyper(pVM, pVCpu);
190	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr - returned from GC with rc=%Rrc\n", pCtx->cs, pCtx->eip, pCtx->eflags, rc));
191	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
192	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
193
194	/*
195	* Deal with the return code.
196	*/
197	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
198	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
199	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
200	return rc;
201	}
202
203
204	/**
205	* Steps rawmode.
206	*
207	* @returns VBox status code.
208	* @param pVM The VM handle.
209	* @param pVCpu The VMCPU handle.
210	*/
211	int emR3RawStep(PVM pVM, PVMCPU pVCpu)
212	{
213	Assert( pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER
214	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
215	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
216	int rc;
217	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
218	bool fGuest = pVCpu->em.s.enmState != EMSTATE_DEBUG_HYPER;
219	#ifndef DEBUG_sandervl
220	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
221	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu)));
222	#endif
223	if (fGuest)
224	{
225	/*
226	* Check vital forced actions, but ignore pending interrupts and timers.
227	*/
228	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
229	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
230	{
231	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
232	if (rc != VINF_SUCCESS)
233	return rc;
234	}
235
236	/*
237	* Set flags for single stepping.
238	*/
239	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
240	}
241	else
242	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
243
244	/*
245	* Single step.
246	* We do not start time or anything, if anything we should just do a few nanoseconds.
247	*/
248	CPUMR3RawEnter(pVCpu, NULL);
249	do
250	{
251	if (pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER)
252	rc = VMMR3ResumeHyper(pVM, pVCpu);
253	else
254	rc = VMMR3RawRunGC(pVM, pVCpu);
255	#ifndef DEBUG_sandervl
256	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - GC rc %Rrc\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
257	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu), rc));
258	#endif
259	} while ( rc == VINF_SUCCESS
260	\|\| rc == VINF_EM_RAW_INTERRUPT);
261	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
262	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
263
264	/*
265	* Make sure the trap flag is cleared.
266	* (Too bad if the guest is trying to single step too.)
267	*/
268	if (fGuest)
269	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
270	else
271	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) & ~X86_EFL_TF);
272
273	/*
274	* Deal with the return codes.
275	*/
276	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
277	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
278	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
279	return rc;
280	}
281
282
283	#ifdef DEBUG
284
285
286	int emR3SingleStepExecRaw(PVM pVM, PVMCPU pVCpu, uint32_t cIterations)
287	{
288	int rc = VINF_SUCCESS;
289	EMSTATE enmOldState = pVCpu->em.s.enmState;
290	pVCpu->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
291
292	Log(("Single step BEGIN:\n"));
293	for (uint32_t i = 0; i < cIterations; i++)
294	{
295	DBGFR3PrgStep(pVCpu);
296	DBGFR3DisasInstrCurrentLog(pVCpu, "RSS: ");
297	rc = emR3RawStep(pVM, pVCpu);
298	if (rc != VINF_SUCCESS)
299	break;
300	}
301	Log(("Single step END: rc=%Rrc\n", rc));
302	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
303	pVCpu->em.s.enmState = enmOldState;
304	return rc;
305	}
306
307	#endif /* DEBUG */
308
309
310	/**
311	* Executes one (or perhaps a few more) instruction(s).
312	*
313	* @returns VBox status code suitable for EM.
314	*
315	* @param pVM VM handle.
316	* @param pVCpu VMCPU handle
317	* @param rcGC GC return code
318	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
319	* instruction and prefix the log output with this text.
320	*/
321	#ifdef LOG_ENABLED
322	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC, const char *pszPrefix)
323	#else
324	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC)
325	#endif
326	{
327	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
328	int rc;
329
330	/*
331	*
332	* The simple solution is to use the recompiler.
333	* The better solution is to disassemble the current instruction and
334	* try handle as many as possible without using REM.
335	*
336	*/
337
338	#ifdef LOG_ENABLED
339	/*
340	* Disassemble the instruction if requested.
341	*/
342	if (pszPrefix)
343	{
344	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
345	DBGFR3DisasInstrCurrentLog(pVCpu, pszPrefix);
346	}
347	#endif /* LOG_ENABLED */
348
349	/*
350	* PATM is making life more interesting.
351	* We cannot hand anything to REM which has an EIP inside patch code. So, we'll
352	* tell PATM there is a trap in this code and have it take the appropriate actions
353	* to allow us execute the code in REM.
354	*/
355	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
356	{
357	Log(("emR3ExecuteInstruction: In patch block. eip=%RRv\n", (RTRCPTR)pCtx->eip));
358
359	RTGCPTR pNewEip;
360	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
361	switch (rc)
362	{
363	/*
364	* It's not very useful to emulate a single instruction and then go back to raw
365	* mode; just execute the whole block until IF is set again.
366	*/
367	case VINF_SUCCESS:
368	Log(("emR3ExecuteInstruction: Executing instruction starting at new address %RGv IF=%d VMIF=%x\n",
369	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
370	pCtx->eip = pNewEip;
371	Assert(pCtx->eip);
372
373	if (pCtx->eflags.Bits.u1IF)
374	{
375	/*
376	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
377	*/
378	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
379	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
380	}
381	else if (rcGC == VINF_PATM_PENDING_IRQ_AFTER_IRET)
382	{
383	/* special case: iret, that sets IF, detected a pending irq/event */
384	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIRET");
385	}
386	return VINF_EM_RESCHEDULE_REM;
387
388	/*
389	* One instruction.
390	*/
391	case VINF_PATCH_EMULATE_INSTR:
392	Log(("emR3ExecuteInstruction: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
393	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
394	pCtx->eip = pNewEip;
395	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
396
397	/*
398	* The patch was disabled, hand it to the REM.
399	*/
400	case VERR_PATCH_DISABLED:
401	Log(("emR3ExecuteInstruction: Disabled patch -> new eip %RGv IF=%d VMIF=%x\n",
402	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
403	pCtx->eip = pNewEip;
404	if (pCtx->eflags.Bits.u1IF)
405	{
406	/*
407	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
408	*/
409	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
410	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
411	}
412	return VINF_EM_RESCHEDULE_REM;
413
414	/* Force continued patch exection; usually due to write monitored stack. */
415	case VINF_PATCH_CONTINUE:
416	return VINF_SUCCESS;
417
418	default:
419	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap\n", rc));
420	return VERR_IPE_UNEXPECTED_STATUS;
421	}
422	}
423
424	#if 0
425	/* Try our own instruction emulator before falling back to the recompiler. */
426	DISCPUSTATE Cpu;
427	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "GEN EMU");
428	if (RT_SUCCESS(rc))
429	{
430	uint32_t size;
431
432	switch (Cpu.pCurInstr->opcode)
433	{
434	/* @todo we can do more now */
435	case OP_MOV:
436	case OP_AND:
437	case OP_OR:
438	case OP_XOR:
439	case OP_POP:
440	case OP_INC:
441	case OP_DEC:
442	case OP_XCHG:
443	STAM_PROFILE_START(&pVCpu->em.s.StatMiscEmu, a);
444	rc = EMInterpretInstructionCPU(pVM, &Cpu, CPUMCTX2CORE(pCtx), 0, &size);
445	if (RT_SUCCESS(rc))
446	{
447	pCtx->rip += Cpu.opsize;
448	STAM_PROFILE_STOP(&pVCpu->em.s.StatMiscEmu, a);
449	return rc;
450	}
451	if (rc != VERR_EM_INTERPRETER)
452	AssertMsgFailedReturn(("rc=%Rrc\n", rc), rc);
453	STAM_PROFILE_STOP(&pVCpu->em.s.StatMiscEmu, a);
454	break;
455	}
456	}
457	#endif /* 0 */
458	STAM_PROFILE_START(&pVCpu->em.s.StatREMEmu, a);
459	Log(("EMINS: %04x:%RGv RSP=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, (RTGCPTR)pCtx->rsp));
460	EMRemLock(pVM);
461	/* Flush the recompiler TLB if the VCPU has changed. */
462	if (pVM->em.s.idLastRemCpu != pVCpu->idCpu)
463	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
464	pVM->em.s.idLastRemCpu = pVCpu->idCpu;
465
466	rc = REMR3EmulateInstruction(pVM, pVCpu);
467	EMRemUnlock(pVM);
468	STAM_PROFILE_STOP(&pVCpu->em.s.StatREMEmu, a);
469
470	return rc;
471	}
472
473
474	/**
475	* Executes one (or perhaps a few more) instruction(s).
476	* This is just a wrapper for discarding pszPrefix in non-logging builds.
477	*
478	* @returns VBox status code suitable for EM.
479	* @param pVM VM handle.
480	* @param pVCpu VMCPU handle.
481	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
482	* instruction and prefix the log output with this text.
483	* @param rcGC GC return code
484	*/
485	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC)
486	{
487	#ifdef LOG_ENABLED
488	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC, pszPrefix);
489	#else
490	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC);
491	#endif
492	}
493
494	/**
495	* Executes one (or perhaps a few more) IO instruction(s).
496	*
497	* @returns VBox status code suitable for EM.
498	* @param pVM VM handle.
499	* @param pVCpu VMCPU handle.
500	*/
501	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu)
502	{
503	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
504
505	STAM_PROFILE_START(&pVCpu->em.s.StatIOEmu, a);
506
507	/** @todo probably we should fall back to the recompiler; otherwise we'll go back and forth between HC & GC
508	* as io instructions tend to come in packages of more than one
509	*/
510	DISCPUSTATE Cpu;
511	int rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "IO EMU");
512	if (RT_SUCCESS(rc))
513	{
514	VBOXSTRICTRC rcStrict = VINF_EM_RAW_EMULATE_INSTR;
515
516	if (!(Cpu.prefix & (PREFIX_REP \| PREFIX_REPNE)))
517	{
518	switch (Cpu.pCurInstr->opcode)
519	{
520	case OP_IN:
521	{
522	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
523	rcStrict = IOMInterpretIN(pVM, CPUMCTX2CORE(pCtx), &Cpu);
524	break;
525	}
526
527	case OP_OUT:
528	{
529	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
530	rcStrict = IOMInterpretOUT(pVM, CPUMCTX2CORE(pCtx), &Cpu);
531	break;
532	}
533	}
534	}
535	else if (Cpu.prefix & PREFIX_REP)
536	{
537	switch (Cpu.pCurInstr->opcode)
538	{
539	case OP_INSB:
540	case OP_INSWD:
541	{
542	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
543	rcStrict = IOMInterpretINS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
544	break;
545	}
546
547	case OP_OUTSB:
548	case OP_OUTSWD:
549	{
550	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
551	rcStrict = IOMInterpretOUTS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
552	break;
553	}
554	}
555	}
556
557	/*
558	* Handled the I/O return codes.
559	* (The unhandled cases end up with rcStrict == VINF_EM_RAW_EMULATE_INSTR.)
560	*/
561	if (IOM_SUCCESS(rcStrict))
562	{
563	pCtx->rip += Cpu.opsize;
564	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
565	return VBOXSTRICTRC_TODO(rcStrict);
566	}
567
568	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
569	{
570	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
571	rcStrict = emR3RawGuestTrap(pVM, pVCpu);
572	return VBOXSTRICTRC_TODO(rcStrict);
573	}
574	AssertMsg(rcStrict != VINF_TRPM_XCPT_DISPATCHED, ("Handle VINF_TRPM_XCPT_DISPATCHED\n"));
575
576	if (RT_FAILURE(rcStrict))
577	{
578	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
579	return VBOXSTRICTRC_TODO(rcStrict);
580	}
581	AssertMsg(rcStrict == VINF_EM_RAW_EMULATE_INSTR \|\| rcStrict == VINF_EM_RESCHEDULE_REM, ("rcStrict=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
582	}
583	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
584	return emR3ExecuteInstruction(pVM, pVCpu, "IO: ");
585	}
586
587
588	/**
589	* Handle a guest context trap.
590	*
591	* @returns VBox status code suitable for EM.
592	* @param pVM VM handle.
593	* @param pVCpu VMCPU handle.
594	*/
595	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu)
596	{
597	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
598
599	/*
600	* Get the trap info.
601	*/
602	uint8_t u8TrapNo;
603	TRPMEVENT enmType;
604	RTGCUINT uErrorCode;
605	RTGCUINTPTR uCR2;
606	int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
607	if (RT_FAILURE(rc))
608	{
609	AssertReleaseMsgFailed(("No trap! (rc=%Rrc)\n", rc));
610	return rc;
611	}
612
613
614	#if 1 /* Experimental: Review, disable if it causes trouble. */
615	/*
616	* Handle traps in patch code first.
617	*
618	* We catch a few of these cases in RC before returning to R3 (#PF, #GP, #BP)
619	* but several traps isn't handled specially by TRPM in RC and we end up here
620	* instead. One example is #DE.
621	*/
622	uint32_t uCpl = CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx));
623	if ( uCpl == 0
624	&& PATMIsPatchGCAddr(pVM, pCtx->eip))
625	{
626	LogFlow(("emR3RawGuestTrap: trap %#x in patch code; eip=%08x\n", u8TrapNo, pCtx->eip));
627	return emR3PatchTrap(pVM, pVCpu, pCtx, rc);
628	}
629	#endif
630
631	/*
632	* If the guest gate is marked unpatched, then we will check again if we can patch it.
633	* (This assumes that we've already tried and failed to dispatch the trap in
634	* RC for the gates that already has been patched. Which is true for most high
635	* volume traps, because these are handled specially, but not for odd ones like #DE.)
636	*/
637	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) == TRPM_INVALID_HANDLER)
638	{
639	CSAMR3CheckGates(pVM, u8TrapNo, 1);
640	Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8TrapNo, TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER));
641
642	/* If it was successful, then we could go back to raw mode. */
643	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER)
644	{
645	/* Must check pending forced actions as our IDT or GDT might be out of sync. */
646	rc = EMR3CheckRawForcedActions(pVM, pVCpu);
647	AssertRCReturn(rc, rc);
648
649	TRPMERRORCODE enmError = uErrorCode != ~0U
650	? TRPM_TRAP_HAS_ERRORCODE
651	: TRPM_TRAP_NO_ERRORCODE;
652	rc = TRPMForwardTrap(pVCpu, CPUMCTX2CORE(pCtx), u8TrapNo, uErrorCode, enmError, TRPM_TRAP, -1);
653	if (rc == VINF_SUCCESS /* Don't use RT_SUCCESS */)
654	{
655	TRPMResetTrap(pVCpu);
656	return VINF_EM_RESCHEDULE_RAW;
657	}
658	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP, ("%Rrc\n", rc));
659	}
660	}
661
662	/*
663	* Scan kernel code that traps; we might not get another chance.
664	*/
665	/** @todo move this up before the dispatching? */
666	if ( (pCtx->ss & X86_SEL_RPL) <= 1
667	&& !pCtx->eflags.Bits.u1VM)
668	{
669	Assert(!PATMIsPatchGCAddr(pVM, pCtx->eip));
670	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
671	}
672
673	/*
674	* Trap specific handling.
675	*/
676	if (u8TrapNo == 6) /* (#UD) Invalid opcode. */
677	{
678	/*
679	* If MONITOR & MWAIT are supported, then interpret them here.
680	*/
681	DISCPUSTATE cpu;
682	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap (#UD): ");
683	if ( RT_SUCCESS(rc)
684	&& (cpu.pCurInstr->opcode == OP_MONITOR \|\| cpu.pCurInstr->opcode == OP_MWAIT))
685	{
686	uint32_t u32Dummy, u32Features, u32ExtFeatures;
687	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Features);
688	if (u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR)
689	{
690	rc = TRPMResetTrap(pVCpu);
691	AssertRC(rc);
692
693	uint32_t opsize;
694	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &opsize));
695	if (RT_SUCCESS(rc))
696	{
697	pCtx->rip += cpu.opsize;
698	return rc;
699	}
700	return emR3ExecuteInstruction(pVM, pVCpu, "Monitor: ");
701	}
702	}
703	}
704	else if (u8TrapNo == 13) /* (#GP) Privileged exception */
705	{
706	/*
707	* Handle I/O bitmap?
708	*/
709	/** @todo We're not supposed to be here with a false guest trap concerning
710	* I/O access. We can easily handle those in RC. */
711	DISCPUSTATE cpu;
712	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap: ");
713	if ( RT_SUCCESS(rc)
714	&& (cpu.pCurInstr->optype & OPTYPE_PORTIO))
715	{
716	/*
717	* We should really check the TSS for the IO bitmap, but it's not like this
718	* lazy approach really makes things worse.
719	*/
720	rc = TRPMResetTrap(pVCpu);
721	AssertRC(rc);
722	return emR3ExecuteInstruction(pVM, pVCpu, "IO Guest Trap: ");
723	}
724	}
725
726	#ifdef LOG_ENABLED
727	DBGFR3InfoLog(pVM, "cpumguest", "Guest trap");
728	DBGFR3DisasInstrCurrentLog(pVCpu, "Guest trap");
729
730	/* Get guest page information. */
731	uint64_t fFlags = 0;
732	RTGCPHYS GCPhys = 0;
733	int rc2 = PGMGstGetPage(pVCpu, uCR2, &fFlags, &GCPhys);
734	Log(("emR3RawGuestTrap: cs:eip=%04x:%08x: trap=%02x err=%08x cr2=%08x cr0=%08x%s: Phys=%RGp fFlags=%08llx %s %s %s%s rc2=%d\n",
735	pCtx->cs, pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0, (enmType == TRPM_SOFTWARE_INT) ? " software" : "", GCPhys, fFlags,
736	fFlags & X86_PTE_P ? "P " : "NP", fFlags & X86_PTE_US ? "U" : "S",
737	fFlags & X86_PTE_RW ? "RW" : "R0", fFlags & X86_PTE_G ? " G" : "", rc2));
738	#endif
739
740	/*
741	* #PG has CR2.
742	* (Because of stuff like above we must set CR2 in a delayed fashion.)
743	*/
744	if (u8TrapNo == 14 /* #PG */)
745	pCtx->cr2 = uCR2;
746
747	return VINF_EM_RESCHEDULE_REM;
748	}
749
750
751	/**
752	* Handle a ring switch trap.
753	* Need to do statistics and to install patches. The result is going to REM.
754	*
755	* @returns VBox status code suitable for EM.
756	* @param pVM VM handle.
757	* @param pVCpu VMCPU handle.
758	*/
759	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu)
760	{
761	int rc;
762	DISCPUSTATE Cpu;
763	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
764
765	/*
766	* sysenter, syscall & callgate
767	*/
768	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "RSWITCH: ");
769	if (RT_SUCCESS(rc))
770	{
771	if (Cpu.pCurInstr->opcode == OP_SYSENTER)
772	{
773	if (pCtx->SysEnter.cs != 0)
774	{
775	rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
776	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
777	if (RT_SUCCESS(rc))
778	{
779	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched sysenter instruction");
780	return VINF_EM_RESCHEDULE_RAW;
781	}
782	}
783	}
784
785	#ifdef VBOX_WITH_STATISTICS
786	switch (Cpu.pCurInstr->opcode)
787	{
788	case OP_SYSENTER:
789	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysEnter);
790	break;
791	case OP_SYSEXIT:
792	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysExit);
793	break;
794	case OP_SYSCALL:
795	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysCall);
796	break;
797	case OP_SYSRET:
798	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysRet);
799	break;
800	}
801	#endif
802	}
803	else
804	AssertRC(rc);
805
806	/* go to the REM to emulate a single instruction */
807	return emR3ExecuteInstruction(pVM, pVCpu, "RSWITCH: ");
808	}
809
810
811	/**
812	* Handle a trap (\#PF or \#GP) in patch code
813	*
814	* @returns VBox status code suitable for EM.
815	* @param pVM VM handle.
816	* @param pVCpu VMCPU handle.
817	* @param pCtx CPU context
818	* @param gcret GC return code
819	*/
820	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret)
821	{
822	uint8_t u8TrapNo;
823	int rc;
824	TRPMEVENT enmType;
825	RTGCUINT uErrorCode;
826	RTGCUINTPTR uCR2;
827
828	Assert(PATMIsPatchGCAddr(pVM, pCtx->eip));
829
830	if (gcret == VINF_PATM_PATCH_INT3)
831	{
832	u8TrapNo = 3;
833	uCR2 = 0;
834	uErrorCode = 0;
835	}
836	else if (gcret == VINF_PATM_PATCH_TRAP_GP)
837	{
838	/* No active trap in this case. Kind of ugly. */
839	u8TrapNo = X86_XCPT_GP;
840	uCR2 = 0;
841	uErrorCode = 0;
842	}
843	else
844	{
845	rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
846	if (RT_FAILURE(rc))
847	{
848	AssertReleaseMsgFailed(("emR3PatchTrap: no trap! (rc=%Rrc) gcret=%Rrc\n", rc, gcret));
849	return rc;
850	}
851	/* Reset the trap as we'll execute the original instruction again. */
852	TRPMResetTrap(pVCpu);
853	}
854
855	/*
856	* Deal with traps inside patch code.
857	* (This code won't run outside GC.)
858	*/
859	if (u8TrapNo != 1)
860	{
861	#ifdef LOG_ENABLED
862	DBGFR3InfoLog(pVM, "cpumguest", "Trap in patch code");
863	DBGFR3DisasInstrCurrentLog(pVCpu, "Patch code");
864
865	DISCPUSTATE Cpu;
866	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->eip, &Cpu, "Patch code: ");
867	if ( RT_SUCCESS(rc)
868	&& Cpu.pCurInstr->opcode == OP_IRET)
869	{
870	uint32_t eip, selCS, uEFlags;
871
872	/* Iret crashes are bad as we have already changed the flags on the stack */
873	rc = PGMPhysSimpleReadGCPtr(pVCpu, &eip, pCtx->esp, 4);
874	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selCS, pCtx->esp+4, 4);
875	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &uEFlags, pCtx->esp+8, 4);
876	if (rc == VINF_SUCCESS)
877	{
878	if ( (uEFlags & X86_EFL_VM)
879	\|\| (selCS & X86_SEL_RPL) == 3)
880	{
881	uint32_t selSS, esp;
882
883	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &esp, pCtx->esp + 12, 4);
884	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selSS, pCtx->esp + 16, 4);
885
886	if (uEFlags & X86_EFL_VM)
887	{
888	uint32_t selDS, selES, selFS, selGS;
889	rc = PGMPhysSimpleReadGCPtr(pVCpu, &selES, pCtx->esp + 20, 4);
890	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selDS, pCtx->esp + 24, 4);
891	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selFS, pCtx->esp + 28, 4);
892	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selGS, pCtx->esp + 32, 4);
893	if (rc == VINF_SUCCESS)
894	{
895	Log(("Patch code: IRET->VM stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
896	Log(("Patch code: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
897	}
898	}
899	else
900	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
901	}
902	else
903	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x\n", selCS, eip, uEFlags));
904	}
905	}
906	#endif /* LOG_ENABLED */
907	Log(("emR3PatchTrap: in patch: eip=%08x: trap=%02x err=%08x cr2=%08x cr0=%08x\n",
908	pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0));
909
910	RTGCPTR pNewEip;
911	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
912	switch (rc)
913	{
914	/*
915	* Execute the faulting instruction.
916	*/
917	case VINF_SUCCESS:
918	{
919	/** @todo execute a whole block */
920	Log(("emR3PatchTrap: Executing faulting instruction at new address %RGv\n", pNewEip));
921	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
922	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
923
924	pCtx->eip = pNewEip;
925	AssertRelease(pCtx->eip);
926
927	if (pCtx->eflags.Bits.u1IF)
928	{
929	/* Windows XP lets irets fault intentionally and then takes action based on the opcode; an
930	* int3 patch overwrites it and leads to blue screens. Remove the patch in this case.
931	*/
932	if ( u8TrapNo == X86_XCPT_GP
933	&& PATMIsInt3Patch(pVM, pCtx->eip, NULL, NULL))
934	{
935	/** @todo move to PATMR3HandleTrap */
936	Log(("Possible Windows XP iret fault at %08RX32\n", pCtx->eip));
937	PATMR3RemovePatch(pVM, pCtx->eip);
938	}
939
940	/** @todo Knoppix 5 regression when returning VINF_SUCCESS here and going back to raw mode. */
941	/* Note: possibly because a reschedule is required (e.g. iret to V86 code) */
942
943	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
944	/* Interrupts are enabled; just go back to the original instruction.
945	return VINF_SUCCESS; */
946	}
947	return VINF_EM_RESCHEDULE_REM;
948	}
949
950	/*
951	* One instruction.
952	*/
953	case VINF_PATCH_EMULATE_INSTR:
954	Log(("emR3PatchTrap: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
955	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
956	pCtx->eip = pNewEip;
957	AssertRelease(pCtx->eip);
958	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHEMUL: ");
959
960	/*
961	* The patch was disabled, hand it to the REM.
962	*/
963	case VERR_PATCH_DISABLED:
964	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
965	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
966	pCtx->eip = pNewEip;
967	AssertRelease(pCtx->eip);
968
969	if (pCtx->eflags.Bits.u1IF)
970	{
971	/*
972	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
973	*/
974	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
975	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
976	}
977	return VINF_EM_RESCHEDULE_REM;
978
979	/* Force continued patch exection; usually due to write monitored stack. */
980	case VINF_PATCH_CONTINUE:
981	return VINF_SUCCESS;
982
983	/*
984	* Anything else is fatal.
985	*/
986	default:
987	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap!\n", rc));
988	return VERR_IPE_UNEXPECTED_STATUS;
989	}
990	}
991	return VINF_SUCCESS;
992	}
993
994
995	/**
996	* Handle a privileged instruction.
997	*
998	* @returns VBox status code suitable for EM.
999	* @param pVM VM handle.
1000	* @param pVCpu VMCPU handle;
1001	*/
1002	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu)
1003	{
1004	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
1005
1006	Assert(!pCtx->eflags.Bits.u1VM);
1007
1008	if (PATMIsEnabled(pVM))
1009	{
1010	/*
1011	* Check if in patch code.
1012	*/
1013	if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
1014	{
1015	#ifdef LOG_ENABLED
1016	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1017	#endif
1018	AssertMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08X\n", pCtx->eip));
1019	return VERR_EM_RAW_PATCH_CONFLICT;
1020	}
1021	if ( (pCtx->ss & X86_SEL_RPL) == 0
1022	&& !pCtx->eflags.Bits.u1VM
1023	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
1024	{
1025	int rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
1026	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
1027	if (RT_SUCCESS(rc))
1028	{
1029	#ifdef LOG_ENABLED
1030	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1031	#endif
1032	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched privileged instruction");
1033	return VINF_SUCCESS;
1034	}
1035	}
1036	}
1037
1038	#ifdef LOG_ENABLED
1039	if (!PATMIsPatchGCAddr(pVM, pCtx->eip))
1040	{
1041	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1042	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
1043	}
1044	#endif
1045
1046	/*
1047	* Instruction statistics and logging.
1048	*/
1049	DISCPUSTATE Cpu;
1050	int rc;
1051
1052	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "PRIV: ");
1053	if (RT_SUCCESS(rc))
1054	{
1055	#ifdef VBOX_WITH_STATISTICS
1056	PEMSTATS pStats = pVCpu->em.s.CTX_SUFF(pStats);
1057	switch (Cpu.pCurInstr->opcode)
1058	{
1059	case OP_INVLPG:
1060	STAM_COUNTER_INC(&pStats->StatInvlpg);
1061	break;
1062	case OP_IRET:
1063	STAM_COUNTER_INC(&pStats->StatIret);
1064	break;
1065	case OP_CLI:
1066	STAM_COUNTER_INC(&pStats->StatCli);
1067	emR3RecordCli(pVM, pVCpu, pCtx->rip);
1068	break;
1069	case OP_STI:
1070	STAM_COUNTER_INC(&pStats->StatSti);
1071	break;
1072	case OP_INSB:
1073	case OP_INSWD:
1074	case OP_IN:
1075	case OP_OUTSB:
1076	case OP_OUTSWD:
1077	case OP_OUT:
1078	AssertMsgFailed(("Unexpected privileged exception due to port IO\n"));
1079	break;
1080
1081	case OP_MOV_CR:
1082	if (Cpu.param1.flags & USE_REG_GEN32)
1083	{
1084	//read
1085	Assert(Cpu.param2.flags & USE_REG_CR);
1086	Assert(Cpu.param2.base.reg_ctrl <= USE_REG_CR4);
1087	STAM_COUNTER_INC(&pStats->StatMovReadCR[Cpu.param2.base.reg_ctrl]);
1088	}
1089	else
1090	{
1091	//write
1092	Assert(Cpu.param1.flags & USE_REG_CR);
1093	Assert(Cpu.param1.base.reg_ctrl <= USE_REG_CR4);
1094	STAM_COUNTER_INC(&pStats->StatMovWriteCR[Cpu.param1.base.reg_ctrl]);
1095	}
1096	break;
1097
1098	case OP_MOV_DR:
1099	STAM_COUNTER_INC(&pStats->StatMovDRx);
1100	break;
1101	case OP_LLDT:
1102	STAM_COUNTER_INC(&pStats->StatMovLldt);
1103	break;
1104	case OP_LIDT:
1105	STAM_COUNTER_INC(&pStats->StatMovLidt);
1106	break;
1107	case OP_LGDT:
1108	STAM_COUNTER_INC(&pStats->StatMovLgdt);
1109	break;
1110	case OP_SYSENTER:
1111	STAM_COUNTER_INC(&pStats->StatSysEnter);
1112	break;
1113	case OP_SYSEXIT:
1114	STAM_COUNTER_INC(&pStats->StatSysExit);
1115	break;
1116	case OP_SYSCALL:
1117	STAM_COUNTER_INC(&pStats->StatSysCall);
1118	break;
1119	case OP_SYSRET:
1120	STAM_COUNTER_INC(&pStats->StatSysRet);
1121	break;
1122	case OP_HLT:
1123	STAM_COUNTER_INC(&pStats->StatHlt);
1124	break;
1125	default:
1126	STAM_COUNTER_INC(&pStats->StatMisc);
1127	Log4(("emR3RawPrivileged: opcode=%d\n", Cpu.pCurInstr->opcode));
1128	break;
1129	}
1130	#endif /* VBOX_WITH_STATISTICS */
1131	if ( (pCtx->ss & X86_SEL_RPL) == 0
1132	&& !pCtx->eflags.Bits.u1VM
1133	&& SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT)
1134	{
1135	uint32_t size;
1136
1137	STAM_PROFILE_START(&pVCpu->em.s.StatPrivEmu, a);
1138	switch (Cpu.pCurInstr->opcode)
1139	{
1140	case OP_CLI:
1141	pCtx->eflags.u32 &= ~X86_EFL_IF;
1142	Assert(Cpu.opsize == 1);
1143	pCtx->rip += Cpu.opsize;
1144	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1145	return VINF_EM_RESCHEDULE_REM; /* must go to the recompiler now! */
1146
1147	case OP_STI:
1148	pCtx->eflags.u32 \|= X86_EFL_IF;
1149	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + Cpu.opsize);
1150	Assert(Cpu.opsize == 1);
1151	pCtx->rip += Cpu.opsize;
1152	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1153	return VINF_SUCCESS;
1154
1155	case OP_HLT:
1156	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1157	{
1158	PATMTRANSSTATE enmState;
1159	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->eip, &enmState);
1160
1161	if (enmState == PATMTRANS_OVERWRITTEN)
1162	{
1163	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1164	Assert(rc == VERR_PATCH_DISABLED);
1165	/* Conflict detected, patch disabled */
1166	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %08RX32\n", pCtx->eip));
1167
1168	enmState = PATMTRANS_SAFE;
1169	}
1170
1171	/* The translation had better be successful. Otherwise we can't recover. */
1172	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %08RX32\n", pCtx->eip));
1173	if (enmState != PATMTRANS_OVERWRITTEN)
1174	pCtx->eip = pOrgInstrGC;
1175	}
1176	/* no break; we could just return VINF_EM_HALT here */
1177
1178	case OP_MOV_CR:
1179	case OP_MOV_DR:
1180	#ifdef LOG_ENABLED
1181	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1182	{
1183	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1184	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
1185	}
1186	#endif
1187
1188	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &Cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &size));
1189	if (RT_SUCCESS(rc))
1190	{
1191	pCtx->rip += Cpu.opsize;
1192	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1193
1194	if ( Cpu.pCurInstr->opcode == OP_MOV_CR
1195	&& Cpu.param1.flags == USE_REG_CR /* write */
1196	)
1197	{
1198	/* Deal with CR0 updates inside patch code that force
1199	* us to go to the recompiler.
1200	*/
1201	if ( PATMIsPatchGCAddr(pVM, pCtx->rip)
1202	&& (pCtx->cr0 & (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE)) != (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE))
1203	{
1204	PATMTRANSSTATE enmState;
1205	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->rip, &enmState);
1206
1207	Log(("Force recompiler switch due to cr0 (%RGp) update rip=%RGv -> %RGv (enmState=%d)\n", pCtx->cr0, pCtx->rip, pOrgInstrGC, enmState));
1208	if (enmState == PATMTRANS_OVERWRITTEN)
1209	{
1210	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1211	Assert(rc == VERR_PATCH_DISABLED);
1212	/* Conflict detected, patch disabled */
1213	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %RGv\n", (RTGCPTR)pCtx->rip));
1214	enmState = PATMTRANS_SAFE;
1215	}
1216	/* The translation had better be successful. Otherwise we can't recover. */
1217	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %RGv\n", (RTGCPTR)pCtx->rip));
1218	if (enmState != PATMTRANS_OVERWRITTEN)
1219	pCtx->rip = pOrgInstrGC;
1220	}
1221
1222	/* Reschedule is necessary as the execution/paging mode might have changed. */
1223	return VINF_EM_RESCHEDULE;
1224	}
1225	return rc; /* can return VINF_EM_HALT as well. */
1226	}
1227	AssertMsgReturn(rc == VERR_EM_INTERPRETER, ("%Rrc\n", rc), rc);
1228	break; /* fall back to the recompiler */
1229	}
1230	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1231	}
1232	}
1233
1234	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1235	return emR3PatchTrap(pVM, pVCpu, pCtx, VINF_PATM_PATCH_TRAP_GP);
1236
1237	return emR3ExecuteInstruction(pVM, pVCpu, "PRIV");
1238	}
1239
1240
1241	/**
1242	* Update the forced rawmode execution modifier.
1243	*
1244	* This function is called when we're returning from the raw-mode loop(s). If we're
1245	* in patch code, it will set a flag forcing execution to be resumed in raw-mode,
1246	* if not in patch code, the flag will be cleared.
1247	*
1248	* We should never interrupt patch code while it's being executed. Cli patches can
1249	* contain big code blocks, but they are always executed with IF=0. Other patches
1250	* replace single instructions and should be atomic.
1251	*
1252	* @returns Updated rc.
1253	*
1254	* @param pVM The VM handle.
1255	* @param pVCpu The VMCPU handle.
1256	* @param pCtx The guest CPU context.
1257	* @param rc The result code.
1258	*/
1259	int emR3RawUpdateForceFlag(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int rc)
1260	{
1261	if (PATMIsPatchGCAddr(pVM, pCtx->eip)) /** @todo check cs selector base/type */
1262	{
1263	/* ignore reschedule attempts. */
1264	switch (rc)
1265	{
1266	case VINF_EM_RESCHEDULE:
1267	case VINF_EM_RESCHEDULE_REM:
1268	LogFlow(("emR3RawUpdateForceFlag: patch address -> force raw reschedule\n"));
1269	rc = VINF_SUCCESS;
1270	break;
1271	}
1272	pVCpu->em.s.fForceRAW = true;
1273	}
1274	else
1275	pVCpu->em.s.fForceRAW = false;
1276	return rc;
1277	}
1278
1279
1280	/**
1281	* Check for pending raw actions
1282	*
1283	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1284	* EM statuses.
1285	* @param pVM The VM to operate on.
1286	* @param pVCpu The VMCPU handle.
1287	*/
1288	VMMR3DECL(int) EMR3CheckRawForcedActions(PVM pVM, PVMCPU pVCpu)
1289	{
1290	return emR3RawForcedActions(pVM, pVCpu, pVCpu->em.s.pCtx);
1291	}
1292
1293
1294	/**
1295	* Process raw-mode specific forced actions.
1296	*
1297	* This function is called when any FFs in the VM_FF_HIGH_PRIORITY_PRE_RAW_MASK is pending.
1298	*
1299	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1300	* EM statuses.
1301	* @param pVM The VM handle.
1302	* @param pVCpu The VMCPU handle.
1303	* @param pCtx The guest CPUM register context.
1304	*/
1305	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1306	{
1307	/*
1308	* Note that the order is vitally important!
1309	* Also note that SELMR3UpdateFromCPUM may trigger VM_FF_SELM_SYNC_TSS.
1310	*/
1311
1312
1313	/*
1314	* Sync selector tables.
1315	*/
1316	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT))
1317	{
1318	int rc = SELMR3UpdateFromCPUM(pVM, pVCpu);
1319	if (RT_FAILURE(rc))
1320	return rc;
1321	}
1322
1323	/*
1324	* Sync IDT.
1325	*
1326	* The CSAMR3CheckGates call in TRPMR3SyncIDT may call PGMPrefetchPage
1327	* and PGMShwModifyPage, so we're in for trouble if for instance a
1328	* PGMSyncCR3+pgmR3PoolClearAll is pending.
1329	*/
1330	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
1331	{
1332	if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3)
1333	&& EMIsRawRing0Enabled(pVM)
1334	&& CSAMIsEnabled(pVM))
1335	{
1336	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1337	if (RT_FAILURE(rc))
1338	return rc;
1339	}
1340
1341	int rc = TRPMR3SyncIDT(pVM, pVCpu);
1342	if (RT_FAILURE(rc))
1343	return rc;
1344	}
1345
1346	/*
1347	* Sync TSS.
1348	*/
1349	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1350	{
1351	int rc = SELMR3SyncTSS(pVM, pVCpu);
1352	if (RT_FAILURE(rc))
1353	return rc;
1354	}
1355
1356	/*
1357	* Sync page directory.
1358	*/
1359	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1360	{
1361	Assert(pVCpu->em.s.enmState != EMSTATE_WAIT_SIPI);
1362	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1363	if (RT_FAILURE(rc))
1364	return rc;
1365
1366	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1367
1368	/* Prefetch pages for EIP and ESP. */
1369	/** @todo This is rather expensive. Should investigate if it really helps at all. */
1370	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->rip));
1371	if (rc == VINF_SUCCESS)
1372	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), pCtx->rsp));
1373	if (rc != VINF_SUCCESS)
1374	{
1375	if (rc != VINF_PGM_SYNC_CR3)
1376	{
1377	AssertLogRelMsgReturn(RT_FAILURE(rc), ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
1378	return rc;
1379	}
1380	rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1381	if (RT_FAILURE(rc))
1382	return rc;
1383	}
1384	/** @todo maybe prefetch the supervisor stack page as well */
1385	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1386	}
1387
1388	/*
1389	* Allocate handy pages (just in case the above actions have consumed some pages).
1390	*/
1391	if (VM_FF_IS_PENDING_EXCEPT(pVM, VM_FF_PGM_NEED_HANDY_PAGES, VM_FF_PGM_NO_MEMORY))
1392	{
1393	int rc = PGMR3PhysAllocateHandyPages(pVM);
1394	if (RT_FAILURE(rc))
1395	return rc;
1396	}
1397
1398	/*
1399	* Check whether we're out of memory now.
1400	*
1401	* This may stem from some of the above actions or operations that has been executed
1402	* since we ran FFs. The allocate handy pages must for instance always be followed by
1403	* this check.
1404	*/
1405	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
1406	return VINF_EM_NO_MEMORY;
1407
1408	return VINF_SUCCESS;
1409	}
1410
1411
1412	/**
1413	* Executes raw code.
1414	*
1415	* This function contains the raw-mode version of the inner
1416	* execution loop (the outer loop being in EMR3ExecuteVM()).
1417	*
1418	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
1419	* VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
1420	*
1421	* @param pVM VM handle.
1422	* @param pVCpu VMCPU handle.
1423	* @param pfFFDone Where to store an indicator telling whether or not
1424	* FFs were done before returning.
1425	*/
1426	int emR3RawExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)
1427	{
1428	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTotal, a);
1429
1430	int rc = VERR_INTERNAL_ERROR;
1431	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
1432	LogFlow(("emR3RawExecute: (cs:eip=%04x:%08x)\n", pCtx->cs, pCtx->eip));
1433	pVCpu->em.s.fForceRAW = false;
1434	*pfFFDone = false;
1435
1436
1437	/*
1438	*
1439	* Spin till we get a forced action or raw mode status code resulting in
1440	* in anything but VINF_SUCCESS or VINF_EM_RESCHEDULE_RAW.
1441	*
1442	*/
1443	for (;;)
1444	{
1445	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWEntry, b);
1446
1447	/*
1448	* Check various preconditions.
1449	*/
1450	#ifdef VBOX_STRICT
1451	Assert(REMR3QueryPendingInterrupt(pVM, pVCpu) == REM_NO_PENDING_IRQ);
1452	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) == 3 \|\| (pCtx->ss & X86_SEL_RPL) == 0);
1453	AssertMsg( (pCtx->eflags.u32 & X86_EFL_IF)
1454	\|\| PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip),
1455	("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
1456	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1457	&& PGMMapHasConflicts(pVM))
1458	{
1459	PGMMapCheck(pVM);
1460	AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
1461	return VERR_INTERNAL_ERROR;
1462	}
1463	#endif /* VBOX_STRICT */
1464
1465	/*
1466	* Process high priority pre-execution raw-mode FFs.
1467	*/
1468	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1469	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1470	{
1471	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1472	if (rc != VINF_SUCCESS)
1473	break;
1474	}
1475
1476	/*
1477	* If we're going to execute ring-0 code, the guest state needs to
1478	* be modified a bit and some of the state components (IF, SS/CS RPL,
1479	* and perhaps EIP) needs to be stored with PATM.
1480	*/
1481	rc = CPUMR3RawEnter(pVCpu, NULL);
1482	if (rc != VINF_SUCCESS)
1483	{
1484	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1485	break;
1486	}
1487
1488	/*
1489	* Scan code before executing it. Don't bother with user mode or V86 code
1490	*/
1491	if ( (pCtx->ss & X86_SEL_RPL) <= 1
1492	&& !pCtx->eflags.Bits.u1VM
1493	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
1494	{
1495	STAM_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWEntry, b);
1496	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
1497	STAM_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWEntry, b);
1498	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1499	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1500	{
1501	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1502	if (rc != VINF_SUCCESS)
1503	{
1504	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1505	break;
1506	}
1507	}
1508	}
1509
1510	#ifdef LOG_ENABLED
1511	/*
1512	* Log important stuff before entering GC.
1513	*/
1514	PPATMGCSTATE pGCState = PATMR3QueryGCStateHC(pVM);
1515	if (pCtx->eflags.Bits.u1VM)
1516	Log(("RV86: %04X:%08X IF=%d VMFlags=%x\n", pCtx->cs, pCtx->eip, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1517	else if ((pCtx->ss & X86_SEL_RPL) == 1)
1518	{
1519	bool fCSAMScanned = CSAMIsPageScanned(pVM, (RTGCPTR)pCtx->eip);
1520	Log(("RR0: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d (Scanned=%d)\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL), fCSAMScanned));
1521	}
1522	else if ((pCtx->ss & X86_SEL_RPL) == 3)
1523	Log(("RR3: %08X ESP=%08X IF=%d VMFlags=%x\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1524	#endif /* LOG_ENABLED */
1525
1526
1527
1528	/*
1529	* Execute the code.
1530	*/
1531	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1532	if (RT_LIKELY(EMR3IsExecutionAllowed(pVM, pVCpu)))
1533	{
1534	STAM_PROFILE_START(&pVCpu->em.s.StatRAWExec, c);
1535	rc = VMMR3RawRunGC(pVM, pVCpu);
1536	STAM_PROFILE_STOP(&pVCpu->em.s.StatRAWExec, c);
1537	}
1538	else
1539	{
1540	/* Give up this time slice; virtual time continues */
1541	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatCapped, u);
1542	RTThreadSleep(5);
1543	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatCapped, u);
1544	rc = VINF_SUCCESS;
1545	}
1546	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTail, d);
1547
1548	LogFlow(("RR0-E: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL)));
1549	LogFlow(("VMMR3RawRunGC returned %Rrc\n", rc));
1550
1551
1552
1553	/*
1554	* Restore the real CPU state and deal with high priority post
1555	* execution FFs before doing anything else.
1556	*/
1557	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1558	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
1559	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK)
1560	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_MASK))
1561	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
1562
1563	#ifdef VBOX_STRICT
1564	/*
1565	* Assert TSS consistency & rc vs patch code.
1566	*/
1567	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_SELM_SYNC_GDT) /* GDT implies TSS at the moment. */
1568	&& EMIsRawRing0Enabled(pVM))
1569	SELMR3CheckTSS(pVM);
1570	switch (rc)
1571	{
1572	case VINF_SUCCESS:
1573	case VINF_EM_RAW_INTERRUPT:
1574	case VINF_PATM_PATCH_TRAP_PF:
1575	case VINF_PATM_PATCH_TRAP_GP:
1576	case VINF_PATM_PATCH_INT3:
1577	case VINF_PATM_CHECK_PATCH_PAGE:
1578	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1579	case VINF_EM_RAW_GUEST_TRAP:
1580	case VINF_EM_RESCHEDULE_RAW:
1581	break;
1582
1583	default:
1584	if (PATMIsPatchGCAddr(pVM, pCtx->eip) && !(pCtx->eflags.u32 & X86_EFL_TF))
1585	LogIt(NULL, 0, LOG_GROUP_PATM, ("Patch code interrupted at %RRv for reason %Rrc\n", (RTRCPTR)CPUMGetGuestEIP(pVCpu), rc));
1586	break;
1587	}
1588	/*
1589	* Let's go paranoid!
1590	*/
1591	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1592	&& PGMMapHasConflicts(pVM))
1593	{
1594	PGMMapCheck(pVM);
1595	AssertMsgFailed(("We should not get conflicts any longer!!! rc=%Rrc\n", rc));
1596	return VERR_INTERNAL_ERROR;
1597	}
1598	#endif /* VBOX_STRICT */
1599
1600	/*
1601	* Process the returned status code.
1602	*/
1603	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
1604	{
1605	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1606	break;
1607	}
1608	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
1609	if (rc != VINF_SUCCESS)
1610	{
1611	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1612	if (rc != VINF_SUCCESS)
1613	{
1614	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1615	break;
1616	}
1617	}
1618
1619	/*
1620	* Check and execute forced actions.
1621	*/
1622	#ifdef VBOX_HIGH_RES_TIMERS_HACK
1623	TMTimerPollVoid(pVM, pVCpu);
1624	#endif
1625	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1626	if ( VM_FF_ISPENDING(pVM, ~VM_FF_HIGH_PRIORITY_PRE_RAW_MASK \| VM_FF_PGM_NO_MEMORY)
1627	\|\| VMCPU_FF_ISPENDING(pVCpu, ~VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1628	{
1629	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) != 1);
1630
1631	STAM_REL_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWTotal, a);
1632	rc = emR3ForcedActions(pVM, pVCpu, rc);
1633	STAM_REL_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWTotal, a);
1634	if ( rc != VINF_SUCCESS
1635	&& rc != VINF_EM_RESCHEDULE_RAW)
1636	{
1637	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1638	if (rc != VINF_SUCCESS)
1639	{
1640	*pfFFDone = true;
1641	break;
1642	}
1643	}
1644	}
1645	}
1646
1647	/*
1648	* Return to outer loop.
1649	*/
1650	#if defined(LOG_ENABLED) && defined(DEBUG)
1651	RTLogFlush(NULL);
1652	#endif
1653	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTotal, a);
1654	return rc;
1655	}
1656

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/EMRaw.cpp@ 35333

Download in other formats: