EMRaw.cpp@ 39405

Last change on this file since 39405 was 39405, checked in by vboxsync, 13 years ago
VMM: Don't use generic IPE status codes, use specific ones. Part 2.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 57.4 KB

Line
1	/* $Id: EMRaw.cpp 39405 2011-11-23 19:30:29Z vboxsync $ */
2
3	/** @file
4	* EM - Execution Monitor / Manager - software virtualization
5	*/
6
7	/*
8	* Copyright (C) 2006-2009 Oracle Corporation
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.virtualbox.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License (GPL) as published by the Free Software
14	* Foundation, in version 2 as it comes in the "COPYING" file of the
15	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
16	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
17	*/
18
19	/** @page pg_em EM - The Execution Monitor / Manager
20	*
21	* The Execution Monitor/Manager is responsible for running the VM, scheduling
22	* the right kind of execution (Raw-mode, Hardware Assisted, Recompiled or
23	* Interpreted), and keeping the CPU states in sync. The function
24	* EMR3ExecuteVM() is the 'main-loop' of the VM, while each of the execution
25	* modes has different inner loops (emR3RawExecute, emR3HwAccExecute, and
26	* emR3RemExecute).
27	*
28	* The interpreted execution is only used to avoid switching between
29	* raw-mode/hwaccm and the recompiler when fielding virtualization traps/faults.
30	* The interpretation is thus implemented as part of EM.
31	*
32	* @see grp_em
33	*/
34
35	/*******************************************************************************
36	* Header Files *
37	*******************************************************************************/
38	#define LOG_GROUP LOG_GROUP_EM
39	#include <VBox/vmm/em.h>
40	#include <VBox/vmm/vmm.h>
41	#include <VBox/vmm/patm.h>
42	#include <VBox/vmm/csam.h>
43	#include <VBox/vmm/selm.h>
44	#include <VBox/vmm/trpm.h>
45	#include <VBox/vmm/iom.h>
46	#include <VBox/vmm/dbgf.h>
47	#include <VBox/vmm/pgm.h>
48	#include <VBox/vmm/rem.h>
49	#include <VBox/vmm/tm.h>
50	#include <VBox/vmm/mm.h>
51	#include <VBox/vmm/ssm.h>
52	#include <VBox/vmm/pdmapi.h>
53	#include <VBox/vmm/pdmcritsect.h>
54	#include <VBox/vmm/pdmqueue.h>
55	#include <VBox/vmm/patm.h>
56	#include "EMInternal.h"
57	#include "internal/em.h"
58	#include <VBox/vmm/vm.h>
59	#include <VBox/vmm/cpumdis.h>
60	#include <VBox/dis.h>
61	#include <VBox/disopcode.h>
62	#include <VBox/vmm/dbgf.h>
63
64	#include <VBox/log.h>
65	#include <iprt/asm.h>
66	#include <iprt/string.h>
67	#include <iprt/stream.h>
68
69
70
71	/*******************************************************************************
72	* Internal Functions *
73	*******************************************************************************/
74	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
75	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC = VINF_SUCCESS);
76	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu);
77	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret);
78	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu);
79	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu);
80	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu);
81
82	#define EMHANDLERC_WITH_PATM
83	#include "EMHandleRCTmpl.h"
84
85
86
87	#ifdef VBOX_WITH_STATISTICS
88	/**
89	* Just a braindead function to keep track of cli addresses.
90	* @param pVM VM handle.
91	* @param pVMCPU VMCPU handle.
92	* @param GCPtrInstr The EIP of the cli instruction.
93	*/
94	static void emR3RecordCli(PVM pVM, PVMCPU pVCpu, RTGCPTR GCPtrInstr)
95	{
96	PCLISTAT pRec;
97
98	pRec = (PCLISTAT)RTAvlGCPtrGet(&pVCpu->em.s.pCliStatTree, GCPtrInstr);
99	if (!pRec)
100	{
101	/* New cli instruction; insert into the tree. */
102	pRec = (PCLISTAT)MMR3HeapAllocZ(pVM, MM_TAG_EM, sizeof(*pRec));
103	Assert(pRec);
104	if (!pRec)
105	return;
106	pRec->Core.Key = GCPtrInstr;
107
108	char szCliStatName[32];
109	RTStrPrintf(szCliStatName, sizeof(szCliStatName), "/EM/Cli/0x%RGv", GCPtrInstr);
110	STAM_REG(pVM, &pRec->Counter, STAMTYPE_COUNTER, szCliStatName, STAMUNIT_OCCURENCES, "Number of times cli was executed.");
111
112	bool fRc = RTAvlGCPtrInsert(&pVCpu->em.s.pCliStatTree, &pRec->Core);
113	Assert(fRc); NOREF(fRc);
114	}
115	STAM_COUNTER_INC(&pRec->Counter);
116	STAM_COUNTER_INC(&pVCpu->em.s.StatTotalClis);
117	}
118	#endif /* VBOX_WITH_STATISTICS */
119
120
121
122	/**
123	* Resumes executing hypervisor after a debug event.
124	*
125	* This is kind of special since our current guest state is
126	* potentially out of sync.
127	*
128	* @returns VBox status code.
129	* @param pVM The VM handle.
130	* @param pVCpu The VMCPU handle.
131	*/
132	int emR3RawResumeHyper(PVM pVM, PVMCPU pVCpu)
133	{
134	int rc;
135	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
136	Assert(pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER);
137	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr\n", pCtx->cs, pCtx->eip, pCtx->eflags));
138
139	/*
140	* Resume execution.
141	*/
142	CPUMR3RawEnter(pVCpu, NULL);
143	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_RF);
144	rc = VMMR3ResumeHyper(pVM, pVCpu);
145	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr - returned from GC with rc=%Rrc\n", pCtx->cs, pCtx->eip, pCtx->eflags, rc));
146	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
147	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
148
149	/*
150	* Deal with the return code.
151	*/
152	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
153	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
154	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
155	return rc;
156	}
157
158
159	/**
160	* Steps rawmode.
161	*
162	* @returns VBox status code.
163	* @param pVM The VM handle.
164	* @param pVCpu The VMCPU handle.
165	*/
166	int emR3RawStep(PVM pVM, PVMCPU pVCpu)
167	{
168	Assert( pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER
169	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
170	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
171	int rc;
172	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
173	bool fGuest = pVCpu->em.s.enmState != EMSTATE_DEBUG_HYPER;
174	#ifndef DEBUG_sandervl
175	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
176	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu)));
177	#endif
178	if (fGuest)
179	{
180	/*
181	* Check vital forced actions, but ignore pending interrupts and timers.
182	*/
183	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
184	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
185	{
186	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
187	if (rc != VINF_SUCCESS)
188	return rc;
189	}
190
191	/*
192	* Set flags for single stepping.
193	*/
194	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
195	}
196	else
197	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
198
199	/*
200	* Single step.
201	* We do not start time or anything, if anything we should just do a few nanoseconds.
202	*/
203	CPUMR3RawEnter(pVCpu, NULL);
204	do
205	{
206	if (pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER)
207	rc = VMMR3ResumeHyper(pVM, pVCpu);
208	else
209	rc = VMMR3RawRunGC(pVM, pVCpu);
210	#ifndef DEBUG_sandervl
211	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - GC rc %Rrc\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
212	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu), rc));
213	#endif
214	} while ( rc == VINF_SUCCESS
215	\|\| rc == VINF_EM_RAW_INTERRUPT);
216	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
217	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
218
219	/*
220	* Make sure the trap flag is cleared.
221	* (Too bad if the guest is trying to single step too.)
222	*/
223	if (fGuest)
224	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
225	else
226	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) & ~X86_EFL_TF);
227
228	/*
229	* Deal with the return codes.
230	*/
231	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
232	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
233	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
234	return rc;
235	}
236
237
238	#ifdef DEBUG
239
240
241	int emR3SingleStepExecRaw(PVM pVM, PVMCPU pVCpu, uint32_t cIterations)
242	{
243	int rc = VINF_SUCCESS;
244	EMSTATE enmOldState = pVCpu->em.s.enmState;
245	pVCpu->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
246
247	Log(("Single step BEGIN:\n"));
248	for (uint32_t i = 0; i < cIterations; i++)
249	{
250	DBGFR3PrgStep(pVCpu);
251	DBGFR3DisasInstrCurrentLog(pVCpu, "RSS: ");
252	rc = emR3RawStep(pVM, pVCpu);
253	if (rc != VINF_SUCCESS)
254	break;
255	}
256	Log(("Single step END: rc=%Rrc\n", rc));
257	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
258	pVCpu->em.s.enmState = enmOldState;
259	return rc;
260	}
261
262	#endif /* DEBUG */
263
264
265	/**
266	* Executes one (or perhaps a few more) instruction(s).
267	*
268	* @returns VBox status code suitable for EM.
269	*
270	* @param pVM VM handle.
271	* @param pVCpu VMCPU handle
272	* @param rcGC GC return code
273	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
274	* instruction and prefix the log output with this text.
275	*/
276	#ifdef LOG_ENABLED
277	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC, const char *pszPrefix)
278	#else
279	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC)
280	#endif
281	{
282	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
283	int rc;
284
285	/*
286	*
287	* The simple solution is to use the recompiler.
288	* The better solution is to disassemble the current instruction and
289	* try handle as many as possible without using REM.
290	*
291	*/
292
293	#ifdef LOG_ENABLED
294	/*
295	* Disassemble the instruction if requested.
296	*/
297	if (pszPrefix)
298	{
299	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
300	DBGFR3DisasInstrCurrentLog(pVCpu, pszPrefix);
301	}
302	#endif /* LOG_ENABLED */
303
304	/*
305	* PATM is making life more interesting.
306	* We cannot hand anything to REM which has an EIP inside patch code. So, we'll
307	* tell PATM there is a trap in this code and have it take the appropriate actions
308	* to allow us execute the code in REM.
309	*/
310	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
311	{
312	Log(("emR3ExecuteInstruction: In patch block. eip=%RRv\n", (RTRCPTR)pCtx->eip));
313
314	RTGCPTR pNewEip;
315	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
316	switch (rc)
317	{
318	/*
319	* It's not very useful to emulate a single instruction and then go back to raw
320	* mode; just execute the whole block until IF is set again.
321	*/
322	case VINF_SUCCESS:
323	Log(("emR3ExecuteInstruction: Executing instruction starting at new address %RGv IF=%d VMIF=%x\n",
324	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
325	pCtx->eip = pNewEip;
326	Assert(pCtx->eip);
327
328	if (pCtx->eflags.Bits.u1IF)
329	{
330	/*
331	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
332	*/
333	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
334	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
335	}
336	else if (rcGC == VINF_PATM_PENDING_IRQ_AFTER_IRET)
337	{
338	/* special case: iret, that sets IF, detected a pending irq/event */
339	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIRET");
340	}
341	return VINF_EM_RESCHEDULE_REM;
342
343	/*
344	* One instruction.
345	*/
346	case VINF_PATCH_EMULATE_INSTR:
347	Log(("emR3ExecuteInstruction: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
348	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
349	pCtx->eip = pNewEip;
350	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
351
352	/*
353	* The patch was disabled, hand it to the REM.
354	*/
355	case VERR_PATCH_DISABLED:
356	Log(("emR3ExecuteInstruction: Disabled patch -> new eip %RGv IF=%d VMIF=%x\n",
357	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
358	pCtx->eip = pNewEip;
359	if (pCtx->eflags.Bits.u1IF)
360	{
361	/*
362	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
363	*/
364	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
365	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
366	}
367	return VINF_EM_RESCHEDULE_REM;
368
369	/* Force continued patch exection; usually due to write monitored stack. */
370	case VINF_PATCH_CONTINUE:
371	return VINF_SUCCESS;
372
373	default:
374	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap\n", rc));
375	return VERR_IPE_UNEXPECTED_STATUS;
376	}
377	}
378
379	#if 0
380	/* Try our own instruction emulator before falling back to the recompiler. */
381	DISCPUSTATE Cpu;
382	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "GEN EMU");
383	if (RT_SUCCESS(rc))
384	{
385	uint32_t size;
386
387	switch (Cpu.pCurInstr->opcode)
388	{
389	/* @todo we can do more now */
390	case OP_MOV:
391	case OP_AND:
392	case OP_OR:
393	case OP_XOR:
394	case OP_POP:
395	case OP_INC:
396	case OP_DEC:
397	case OP_XCHG:
398	STAM_PROFILE_START(&pVCpu->em.s.StatMiscEmu, a);
399	rc = EMInterpretInstructionCPU(pVM, &Cpu, CPUMCTX2CORE(pCtx), 0, &size);
400	if (RT_SUCCESS(rc))
401	{
402	pCtx->rip += Cpu.opsize;
403	STAM_PROFILE_STOP(&pVCpu->em.s.StatMiscEmu, a);
404	return rc;
405	}
406	if (rc != VERR_EM_INTERPRETER)
407	AssertMsgFailedReturn(("rc=%Rrc\n", rc), rc);
408	STAM_PROFILE_STOP(&pVCpu->em.s.StatMiscEmu, a);
409	break;
410	}
411	}
412	#endif /* 0 */
413	STAM_PROFILE_START(&pVCpu->em.s.StatREMEmu, a);
414	Log(("EMINS: %04x:%RGv RSP=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, (RTGCPTR)pCtx->rsp));
415	EMRemLock(pVM);
416	/* Flush the recompiler TLB if the VCPU has changed. */
417	if (pVM->em.s.idLastRemCpu != pVCpu->idCpu)
418	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
419	pVM->em.s.idLastRemCpu = pVCpu->idCpu;
420
421	rc = REMR3EmulateInstruction(pVM, pVCpu);
422	EMRemUnlock(pVM);
423	STAM_PROFILE_STOP(&pVCpu->em.s.StatREMEmu, a);
424
425	return rc;
426	}
427
428
429	/**
430	* Executes one (or perhaps a few more) instruction(s).
431	* This is just a wrapper for discarding pszPrefix in non-logging builds.
432	*
433	* @returns VBox status code suitable for EM.
434	* @param pVM VM handle.
435	* @param pVCpu VMCPU handle.
436	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
437	* instruction and prefix the log output with this text.
438	* @param rcGC GC return code
439	*/
440	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC)
441	{
442	#ifdef LOG_ENABLED
443	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC, pszPrefix);
444	#else
445	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC);
446	#endif
447	}
448
449	/**
450	* Executes one (or perhaps a few more) IO instruction(s).
451	*
452	* @returns VBox status code suitable for EM.
453	* @param pVM VM handle.
454	* @param pVCpu VMCPU handle.
455	*/
456	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu)
457	{
458	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
459
460	STAM_PROFILE_START(&pVCpu->em.s.StatIOEmu, a);
461
462	/** @todo probably we should fall back to the recompiler; otherwise we'll go back and forth between HC & GC
463	* as io instructions tend to come in packages of more than one
464	*/
465	DISCPUSTATE Cpu;
466	int rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "IO EMU");
467	if (RT_SUCCESS(rc))
468	{
469	VBOXSTRICTRC rcStrict = VINF_EM_RAW_EMULATE_INSTR;
470
471	if (!(Cpu.prefix & (PREFIX_REP \| PREFIX_REPNE)))
472	{
473	switch (Cpu.pCurInstr->opcode)
474	{
475	case OP_IN:
476	{
477	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
478	rcStrict = IOMInterpretIN(pVM, CPUMCTX2CORE(pCtx), &Cpu);
479	break;
480	}
481
482	case OP_OUT:
483	{
484	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
485	rcStrict = IOMInterpretOUT(pVM, CPUMCTX2CORE(pCtx), &Cpu);
486	break;
487	}
488	}
489	}
490	else if (Cpu.prefix & PREFIX_REP)
491	{
492	switch (Cpu.pCurInstr->opcode)
493	{
494	case OP_INSB:
495	case OP_INSWD:
496	{
497	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
498	rcStrict = IOMInterpretINS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
499	break;
500	}
501
502	case OP_OUTSB:
503	case OP_OUTSWD:
504	{
505	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
506	rcStrict = IOMInterpretOUTS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
507	break;
508	}
509	}
510	}
511
512	/*
513	* Handled the I/O return codes.
514	* (The unhandled cases end up with rcStrict == VINF_EM_RAW_EMULATE_INSTR.)
515	*/
516	if (IOM_SUCCESS(rcStrict))
517	{
518	pCtx->rip += Cpu.opsize;
519	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
520	return VBOXSTRICTRC_TODO(rcStrict);
521	}
522
523	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
524	{
525	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
526	rcStrict = emR3RawGuestTrap(pVM, pVCpu);
527	return VBOXSTRICTRC_TODO(rcStrict);
528	}
529	AssertMsg(rcStrict != VINF_TRPM_XCPT_DISPATCHED, ("Handle VINF_TRPM_XCPT_DISPATCHED\n"));
530
531	if (RT_FAILURE(rcStrict))
532	{
533	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
534	return VBOXSTRICTRC_TODO(rcStrict);
535	}
536	AssertMsg(rcStrict == VINF_EM_RAW_EMULATE_INSTR \|\| rcStrict == VINF_EM_RESCHEDULE_REM, ("rcStrict=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
537	}
538	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
539	return emR3ExecuteInstruction(pVM, pVCpu, "IO: ");
540	}
541
542
543	/**
544	* Handle a guest context trap.
545	*
546	* @returns VBox status code suitable for EM.
547	* @param pVM VM handle.
548	* @param pVCpu VMCPU handle.
549	*/
550	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu)
551	{
552	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
553
554	/*
555	* Get the trap info.
556	*/
557	uint8_t u8TrapNo;
558	TRPMEVENT enmType;
559	RTGCUINT uErrorCode;
560	RTGCUINTPTR uCR2;
561	int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
562	if (RT_FAILURE(rc))
563	{
564	AssertReleaseMsgFailed(("No trap! (rc=%Rrc)\n", rc));
565	return rc;
566	}
567
568
569	#if 1 /* Experimental: Review, disable if it causes trouble. */
570	/*
571	* Handle traps in patch code first.
572	*
573	* We catch a few of these cases in RC before returning to R3 (#PF, #GP, #BP)
574	* but several traps isn't handled specially by TRPM in RC and we end up here
575	* instead. One example is #DE.
576	*/
577	uint32_t uCpl = CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx));
578	if ( uCpl == 0
579	&& PATMIsPatchGCAddr(pVM, pCtx->eip))
580	{
581	LogFlow(("emR3RawGuestTrap: trap %#x in patch code; eip=%08x\n", u8TrapNo, pCtx->eip));
582	return emR3PatchTrap(pVM, pVCpu, pCtx, rc);
583	}
584	#endif
585
586	/*
587	* If the guest gate is marked unpatched, then we will check again if we can patch it.
588	* (This assumes that we've already tried and failed to dispatch the trap in
589	* RC for the gates that already has been patched. Which is true for most high
590	* volume traps, because these are handled specially, but not for odd ones like #DE.)
591	*/
592	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) == TRPM_INVALID_HANDLER)
593	{
594	CSAMR3CheckGates(pVM, u8TrapNo, 1);
595	Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8TrapNo, TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER));
596
597	/* If it was successful, then we could go back to raw mode. */
598	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER)
599	{
600	/* Must check pending forced actions as our IDT or GDT might be out of sync. */
601	rc = EMR3CheckRawForcedActions(pVM, pVCpu);
602	AssertRCReturn(rc, rc);
603
604	TRPMERRORCODE enmError = uErrorCode != ~0U
605	? TRPM_TRAP_HAS_ERRORCODE
606	: TRPM_TRAP_NO_ERRORCODE;
607	rc = TRPMForwardTrap(pVCpu, CPUMCTX2CORE(pCtx), u8TrapNo, uErrorCode, enmError, TRPM_TRAP, -1);
608	if (rc == VINF_SUCCESS /* Don't use RT_SUCCESS */)
609	{
610	TRPMResetTrap(pVCpu);
611	return VINF_EM_RESCHEDULE_RAW;
612	}
613	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP, ("%Rrc\n", rc));
614	}
615	}
616
617	/*
618	* Scan kernel code that traps; we might not get another chance.
619	*/
620	/** @todo move this up before the dispatching? */
621	if ( (pCtx->ss & X86_SEL_RPL) <= 1
622	&& !pCtx->eflags.Bits.u1VM)
623	{
624	Assert(!PATMIsPatchGCAddr(pVM, pCtx->eip));
625	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
626	}
627
628	/*
629	* Trap specific handling.
630	*/
631	if (u8TrapNo == 6) /* (#UD) Invalid opcode. */
632	{
633	/*
634	* If MONITOR & MWAIT are supported, then interpret them here.
635	*/
636	DISCPUSTATE cpu;
637	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap (#UD): ");
638	if ( RT_SUCCESS(rc)
639	&& (cpu.pCurInstr->opcode == OP_MONITOR \|\| cpu.pCurInstr->opcode == OP_MWAIT))
640	{
641	uint32_t u32Dummy, u32Features, u32ExtFeatures;
642	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Features);
643	if (u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR)
644	{
645	rc = TRPMResetTrap(pVCpu);
646	AssertRC(rc);
647
648	uint32_t opsize;
649	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &opsize));
650	if (RT_SUCCESS(rc))
651	{
652	pCtx->rip += cpu.opsize;
653	return rc;
654	}
655	return emR3ExecuteInstruction(pVM, pVCpu, "Monitor: ");
656	}
657	}
658	}
659	else if (u8TrapNo == 13) /* (#GP) Privileged exception */
660	{
661	/*
662	* Handle I/O bitmap?
663	*/
664	/** @todo We're not supposed to be here with a false guest trap concerning
665	* I/O access. We can easily handle those in RC. */
666	DISCPUSTATE cpu;
667	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap: ");
668	if ( RT_SUCCESS(rc)
669	&& (cpu.pCurInstr->optype & OPTYPE_PORTIO))
670	{
671	/*
672	* We should really check the TSS for the IO bitmap, but it's not like this
673	* lazy approach really makes things worse.
674	*/
675	rc = TRPMResetTrap(pVCpu);
676	AssertRC(rc);
677	return emR3ExecuteInstruction(pVM, pVCpu, "IO Guest Trap: ");
678	}
679	}
680
681	#ifdef LOG_ENABLED
682	DBGFR3InfoLog(pVM, "cpumguest", "Guest trap");
683	DBGFR3DisasInstrCurrentLog(pVCpu, "Guest trap");
684
685	/* Get guest page information. */
686	uint64_t fFlags = 0;
687	RTGCPHYS GCPhys = 0;
688	int rc2 = PGMGstGetPage(pVCpu, uCR2, &fFlags, &GCPhys);
689	Log(("emR3RawGuestTrap: cs:eip=%04x:%08x: trap=%02x err=%08x cr2=%08x cr0=%08x%s: Phys=%RGp fFlags=%08llx %s %s %s%s rc2=%d\n",
690	pCtx->cs, pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0, (enmType == TRPM_SOFTWARE_INT) ? " software" : "", GCPhys, fFlags,
691	fFlags & X86_PTE_P ? "P " : "NP", fFlags & X86_PTE_US ? "U" : "S",
692	fFlags & X86_PTE_RW ? "RW" : "R0", fFlags & X86_PTE_G ? " G" : "", rc2));
693	#endif
694
695	/*
696	* #PG has CR2.
697	* (Because of stuff like above we must set CR2 in a delayed fashion.)
698	*/
699	if (u8TrapNo == 14 /* #PG */)
700	pCtx->cr2 = uCR2;
701
702	return VINF_EM_RESCHEDULE_REM;
703	}
704
705
706	/**
707	* Handle a ring switch trap.
708	* Need to do statistics and to install patches. The result is going to REM.
709	*
710	* @returns VBox status code suitable for EM.
711	* @param pVM VM handle.
712	* @param pVCpu VMCPU handle.
713	*/
714	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu)
715	{
716	int rc;
717	DISCPUSTATE Cpu;
718	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
719
720	/*
721	* sysenter, syscall & callgate
722	*/
723	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "RSWITCH: ");
724	if (RT_SUCCESS(rc))
725	{
726	if (Cpu.pCurInstr->opcode == OP_SYSENTER)
727	{
728	if (pCtx->SysEnter.cs != 0)
729	{
730	rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
731	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
732	if (RT_SUCCESS(rc))
733	{
734	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched sysenter instruction");
735	return VINF_EM_RESCHEDULE_RAW;
736	}
737	}
738	}
739
740	#ifdef VBOX_WITH_STATISTICS
741	switch (Cpu.pCurInstr->opcode)
742	{
743	case OP_SYSENTER:
744	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysEnter);
745	break;
746	case OP_SYSEXIT:
747	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysExit);
748	break;
749	case OP_SYSCALL:
750	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysCall);
751	break;
752	case OP_SYSRET:
753	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysRet);
754	break;
755	}
756	#endif
757	}
758	else
759	AssertRC(rc);
760
761	/* go to the REM to emulate a single instruction */
762	return emR3ExecuteInstruction(pVM, pVCpu, "RSWITCH: ");
763	}
764
765
766	/**
767	* Handle a trap (\#PF or \#GP) in patch code
768	*
769	* @returns VBox status code suitable for EM.
770	* @param pVM VM handle.
771	* @param pVCpu VMCPU handle.
772	* @param pCtx CPU context
773	* @param gcret GC return code
774	*/
775	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret)
776	{
777	uint8_t u8TrapNo;
778	int rc;
779	TRPMEVENT enmType;
780	RTGCUINT uErrorCode;
781	RTGCUINTPTR uCR2;
782
783	Assert(PATMIsPatchGCAddr(pVM, pCtx->eip));
784
785	if (gcret == VINF_PATM_PATCH_INT3)
786	{
787	u8TrapNo = 3;
788	uCR2 = 0;
789	uErrorCode = 0;
790	}
791	else if (gcret == VINF_PATM_PATCH_TRAP_GP)
792	{
793	/* No active trap in this case. Kind of ugly. */
794	u8TrapNo = X86_XCPT_GP;
795	uCR2 = 0;
796	uErrorCode = 0;
797	}
798	else
799	{
800	rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
801	if (RT_FAILURE(rc))
802	{
803	AssertReleaseMsgFailed(("emR3PatchTrap: no trap! (rc=%Rrc) gcret=%Rrc\n", rc, gcret));
804	return rc;
805	}
806	/* Reset the trap as we'll execute the original instruction again. */
807	TRPMResetTrap(pVCpu);
808	}
809
810	/*
811	* Deal with traps inside patch code.
812	* (This code won't run outside GC.)
813	*/
814	if (u8TrapNo != 1)
815	{
816	#ifdef LOG_ENABLED
817	DBGFR3InfoLog(pVM, "cpumguest", "Trap in patch code");
818	DBGFR3DisasInstrCurrentLog(pVCpu, "Patch code");
819
820	DISCPUSTATE Cpu;
821	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->eip, &Cpu, "Patch code: ");
822	if ( RT_SUCCESS(rc)
823	&& Cpu.pCurInstr->opcode == OP_IRET)
824	{
825	uint32_t eip, selCS, uEFlags;
826
827	/* Iret crashes are bad as we have already changed the flags on the stack */
828	rc = PGMPhysSimpleReadGCPtr(pVCpu, &eip, pCtx->esp, 4);
829	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selCS, pCtx->esp+4, 4);
830	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &uEFlags, pCtx->esp+8, 4);
831	if (rc == VINF_SUCCESS)
832	{
833	if ( (uEFlags & X86_EFL_VM)
834	\|\| (selCS & X86_SEL_RPL) == 3)
835	{
836	uint32_t selSS, esp;
837
838	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &esp, pCtx->esp + 12, 4);
839	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selSS, pCtx->esp + 16, 4);
840
841	if (uEFlags & X86_EFL_VM)
842	{
843	uint32_t selDS, selES, selFS, selGS;
844	rc = PGMPhysSimpleReadGCPtr(pVCpu, &selES, pCtx->esp + 20, 4);
845	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selDS, pCtx->esp + 24, 4);
846	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selFS, pCtx->esp + 28, 4);
847	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selGS, pCtx->esp + 32, 4);
848	if (rc == VINF_SUCCESS)
849	{
850	Log(("Patch code: IRET->VM stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
851	Log(("Patch code: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
852	}
853	}
854	else
855	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
856	}
857	else
858	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x\n", selCS, eip, uEFlags));
859	}
860	}
861	#endif /* LOG_ENABLED */
862	Log(("emR3PatchTrap: in patch: eip=%08x: trap=%02x err=%08x cr2=%08x cr0=%08x\n",
863	pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0));
864
865	RTGCPTR pNewEip;
866	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
867	switch (rc)
868	{
869	/*
870	* Execute the faulting instruction.
871	*/
872	case VINF_SUCCESS:
873	{
874	/** @todo execute a whole block */
875	Log(("emR3PatchTrap: Executing faulting instruction at new address %RGv\n", pNewEip));
876	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
877	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
878
879	pCtx->eip = pNewEip;
880	AssertRelease(pCtx->eip);
881
882	if (pCtx->eflags.Bits.u1IF)
883	{
884	/* Windows XP lets irets fault intentionally and then takes action based on the opcode; an
885	* int3 patch overwrites it and leads to blue screens. Remove the patch in this case.
886	*/
887	if ( u8TrapNo == X86_XCPT_GP
888	&& PATMIsInt3Patch(pVM, pCtx->eip, NULL, NULL))
889	{
890	/** @todo move to PATMR3HandleTrap */
891	Log(("Possible Windows XP iret fault at %08RX32\n", pCtx->eip));
892	PATMR3RemovePatch(pVM, pCtx->eip);
893	}
894
895	/** @todo Knoppix 5 regression when returning VINF_SUCCESS here and going back to raw mode. */
896	/* Note: possibly because a reschedule is required (e.g. iret to V86 code) */
897
898	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
899	/* Interrupts are enabled; just go back to the original instruction.
900	return VINF_SUCCESS; */
901	}
902	return VINF_EM_RESCHEDULE_REM;
903	}
904
905	/*
906	* One instruction.
907	*/
908	case VINF_PATCH_EMULATE_INSTR:
909	Log(("emR3PatchTrap: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
910	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
911	pCtx->eip = pNewEip;
912	AssertRelease(pCtx->eip);
913	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHEMUL: ");
914
915	/*
916	* The patch was disabled, hand it to the REM.
917	*/
918	case VERR_PATCH_DISABLED:
919	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
920	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
921	pCtx->eip = pNewEip;
922	AssertRelease(pCtx->eip);
923
924	if (pCtx->eflags.Bits.u1IF)
925	{
926	/*
927	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
928	*/
929	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
930	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
931	}
932	return VINF_EM_RESCHEDULE_REM;
933
934	/* Force continued patch exection; usually due to write monitored stack. */
935	case VINF_PATCH_CONTINUE:
936	return VINF_SUCCESS;
937
938	/*
939	* Anything else is fatal.
940	*/
941	default:
942	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap!\n", rc));
943	return VERR_IPE_UNEXPECTED_STATUS;
944	}
945	}
946	return VINF_SUCCESS;
947	}
948
949
950	/**
951	* Handle a privileged instruction.
952	*
953	* @returns VBox status code suitable for EM.
954	* @param pVM VM handle.
955	* @param pVCpu VMCPU handle;
956	*/
957	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu)
958	{
959	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
960
961	Assert(!pCtx->eflags.Bits.u1VM);
962
963	if (PATMIsEnabled(pVM))
964	{
965	/*
966	* Check if in patch code.
967	*/
968	if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
969	{
970	#ifdef LOG_ENABLED
971	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
972	#endif
973	AssertMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08X\n", pCtx->eip));
974	return VERR_EM_RAW_PATCH_CONFLICT;
975	}
976	if ( (pCtx->ss & X86_SEL_RPL) == 0
977	&& !pCtx->eflags.Bits.u1VM
978	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
979	{
980	int rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
981	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
982	if (RT_SUCCESS(rc))
983	{
984	#ifdef LOG_ENABLED
985	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
986	#endif
987	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched privileged instruction");
988	return VINF_SUCCESS;
989	}
990	}
991	}
992
993	#ifdef LOG_ENABLED
994	if (!PATMIsPatchGCAddr(pVM, pCtx->eip))
995	{
996	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
997	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
998	}
999	#endif
1000
1001	/*
1002	* Instruction statistics and logging.
1003	*/
1004	DISCPUSTATE Cpu;
1005	int rc;
1006
1007	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "PRIV: ");
1008	if (RT_SUCCESS(rc))
1009	{
1010	#ifdef VBOX_WITH_STATISTICS
1011	PEMSTATS pStats = pVCpu->em.s.CTX_SUFF(pStats);
1012	switch (Cpu.pCurInstr->opcode)
1013	{
1014	case OP_INVLPG:
1015	STAM_COUNTER_INC(&pStats->StatInvlpg);
1016	break;
1017	case OP_IRET:
1018	STAM_COUNTER_INC(&pStats->StatIret);
1019	break;
1020	case OP_CLI:
1021	STAM_COUNTER_INC(&pStats->StatCli);
1022	emR3RecordCli(pVM, pVCpu, pCtx->rip);
1023	break;
1024	case OP_STI:
1025	STAM_COUNTER_INC(&pStats->StatSti);
1026	break;
1027	case OP_INSB:
1028	case OP_INSWD:
1029	case OP_IN:
1030	case OP_OUTSB:
1031	case OP_OUTSWD:
1032	case OP_OUT:
1033	AssertMsgFailed(("Unexpected privileged exception due to port IO\n"));
1034	break;
1035
1036	case OP_MOV_CR:
1037	if (Cpu.param1.flags & USE_REG_GEN32)
1038	{
1039	//read
1040	Assert(Cpu.param2.flags & USE_REG_CR);
1041	Assert(Cpu.param2.base.reg_ctrl <= USE_REG_CR4);
1042	STAM_COUNTER_INC(&pStats->StatMovReadCR[Cpu.param2.base.reg_ctrl]);
1043	}
1044	else
1045	{
1046	//write
1047	Assert(Cpu.param1.flags & USE_REG_CR);
1048	Assert(Cpu.param1.base.reg_ctrl <= USE_REG_CR4);
1049	STAM_COUNTER_INC(&pStats->StatMovWriteCR[Cpu.param1.base.reg_ctrl]);
1050	}
1051	break;
1052
1053	case OP_MOV_DR:
1054	STAM_COUNTER_INC(&pStats->StatMovDRx);
1055	break;
1056	case OP_LLDT:
1057	STAM_COUNTER_INC(&pStats->StatMovLldt);
1058	break;
1059	case OP_LIDT:
1060	STAM_COUNTER_INC(&pStats->StatMovLidt);
1061	break;
1062	case OP_LGDT:
1063	STAM_COUNTER_INC(&pStats->StatMovLgdt);
1064	break;
1065	case OP_SYSENTER:
1066	STAM_COUNTER_INC(&pStats->StatSysEnter);
1067	break;
1068	case OP_SYSEXIT:
1069	STAM_COUNTER_INC(&pStats->StatSysExit);
1070	break;
1071	case OP_SYSCALL:
1072	STAM_COUNTER_INC(&pStats->StatSysCall);
1073	break;
1074	case OP_SYSRET:
1075	STAM_COUNTER_INC(&pStats->StatSysRet);
1076	break;
1077	case OP_HLT:
1078	STAM_COUNTER_INC(&pStats->StatHlt);
1079	break;
1080	default:
1081	STAM_COUNTER_INC(&pStats->StatMisc);
1082	Log4(("emR3RawPrivileged: opcode=%d\n", Cpu.pCurInstr->opcode));
1083	break;
1084	}
1085	#endif /* VBOX_WITH_STATISTICS */
1086	if ( (pCtx->ss & X86_SEL_RPL) == 0
1087	&& !pCtx->eflags.Bits.u1VM
1088	&& SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT)
1089	{
1090	uint32_t size;
1091
1092	STAM_PROFILE_START(&pVCpu->em.s.StatPrivEmu, a);
1093	switch (Cpu.pCurInstr->opcode)
1094	{
1095	case OP_CLI:
1096	pCtx->eflags.u32 &= ~X86_EFL_IF;
1097	Assert(Cpu.opsize == 1);
1098	pCtx->rip += Cpu.opsize;
1099	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1100	return VINF_EM_RESCHEDULE_REM; /* must go to the recompiler now! */
1101
1102	case OP_STI:
1103	pCtx->eflags.u32 \|= X86_EFL_IF;
1104	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + Cpu.opsize);
1105	Assert(Cpu.opsize == 1);
1106	pCtx->rip += Cpu.opsize;
1107	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1108	return VINF_SUCCESS;
1109
1110	case OP_HLT:
1111	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1112	{
1113	PATMTRANSSTATE enmState;
1114	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->eip, &enmState);
1115
1116	if (enmState == PATMTRANS_OVERWRITTEN)
1117	{
1118	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1119	Assert(rc == VERR_PATCH_DISABLED);
1120	/* Conflict detected, patch disabled */
1121	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %08RX32\n", pCtx->eip));
1122
1123	enmState = PATMTRANS_SAFE;
1124	}
1125
1126	/* The translation had better be successful. Otherwise we can't recover. */
1127	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %08RX32\n", pCtx->eip));
1128	if (enmState != PATMTRANS_OVERWRITTEN)
1129	pCtx->eip = pOrgInstrGC;
1130	}
1131	/* no break; we could just return VINF_EM_HALT here */
1132
1133	case OP_MOV_CR:
1134	case OP_MOV_DR:
1135	#ifdef LOG_ENABLED
1136	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1137	{
1138	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1139	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
1140	}
1141	#endif
1142
1143	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &Cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &size));
1144	if (RT_SUCCESS(rc))
1145	{
1146	pCtx->rip += Cpu.opsize;
1147	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1148
1149	if ( Cpu.pCurInstr->opcode == OP_MOV_CR
1150	&& Cpu.param1.flags == USE_REG_CR /* write */
1151	)
1152	{
1153	/* Deal with CR0 updates inside patch code that force
1154	* us to go to the recompiler.
1155	*/
1156	if ( PATMIsPatchGCAddr(pVM, pCtx->rip)
1157	&& (pCtx->cr0 & (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE)) != (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE))
1158	{
1159	PATMTRANSSTATE enmState;
1160	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->rip, &enmState);
1161
1162	Log(("Force recompiler switch due to cr0 (%RGp) update rip=%RGv -> %RGv (enmState=%d)\n", pCtx->cr0, pCtx->rip, pOrgInstrGC, enmState));
1163	if (enmState == PATMTRANS_OVERWRITTEN)
1164	{
1165	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1166	Assert(rc == VERR_PATCH_DISABLED);
1167	/* Conflict detected, patch disabled */
1168	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %RGv\n", (RTGCPTR)pCtx->rip));
1169	enmState = PATMTRANS_SAFE;
1170	}
1171	/* The translation had better be successful. Otherwise we can't recover. */
1172	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %RGv\n", (RTGCPTR)pCtx->rip));
1173	if (enmState != PATMTRANS_OVERWRITTEN)
1174	pCtx->rip = pOrgInstrGC;
1175	}
1176
1177	/* Reschedule is necessary as the execution/paging mode might have changed. */
1178	return VINF_EM_RESCHEDULE;
1179	}
1180	return rc; /* can return VINF_EM_HALT as well. */
1181	}
1182	AssertMsgReturn(rc == VERR_EM_INTERPRETER, ("%Rrc\n", rc), rc);
1183	break; /* fall back to the recompiler */
1184	}
1185	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1186	}
1187	}
1188
1189	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1190	return emR3PatchTrap(pVM, pVCpu, pCtx, VINF_PATM_PATCH_TRAP_GP);
1191
1192	return emR3ExecuteInstruction(pVM, pVCpu, "PRIV");
1193	}
1194
1195
1196	/**
1197	* Update the forced rawmode execution modifier.
1198	*
1199	* This function is called when we're returning from the raw-mode loop(s). If we're
1200	* in patch code, it will set a flag forcing execution to be resumed in raw-mode,
1201	* if not in patch code, the flag will be cleared.
1202	*
1203	* We should never interrupt patch code while it's being executed. Cli patches can
1204	* contain big code blocks, but they are always executed with IF=0. Other patches
1205	* replace single instructions and should be atomic.
1206	*
1207	* @returns Updated rc.
1208	*
1209	* @param pVM The VM handle.
1210	* @param pVCpu The VMCPU handle.
1211	* @param pCtx The guest CPU context.
1212	* @param rc The result code.
1213	*/
1214	int emR3RawUpdateForceFlag(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int rc)
1215	{
1216	if (PATMIsPatchGCAddr(pVM, pCtx->eip)) /** @todo check cs selector base/type */
1217	{
1218	/* ignore reschedule attempts. */
1219	switch (rc)
1220	{
1221	case VINF_EM_RESCHEDULE:
1222	case VINF_EM_RESCHEDULE_REM:
1223	LogFlow(("emR3RawUpdateForceFlag: patch address -> force raw reschedule\n"));
1224	rc = VINF_SUCCESS;
1225	break;
1226	}
1227	pVCpu->em.s.fForceRAW = true;
1228	}
1229	else
1230	pVCpu->em.s.fForceRAW = false;
1231	return rc;
1232	}
1233
1234
1235	/**
1236	* Check for pending raw actions
1237	*
1238	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1239	* EM statuses.
1240	* @param pVM The VM to operate on.
1241	* @param pVCpu The VMCPU handle.
1242	*/
1243	VMMR3DECL(int) EMR3CheckRawForcedActions(PVM pVM, PVMCPU pVCpu)
1244	{
1245	return emR3RawForcedActions(pVM, pVCpu, pVCpu->em.s.pCtx);
1246	}
1247
1248
1249	/**
1250	* Process raw-mode specific forced actions.
1251	*
1252	* This function is called when any FFs in the VM_FF_HIGH_PRIORITY_PRE_RAW_MASK is pending.
1253	*
1254	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1255	* EM statuses.
1256	* @param pVM The VM handle.
1257	* @param pVCpu The VMCPU handle.
1258	* @param pCtx The guest CPUM register context.
1259	*/
1260	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1261	{
1262	/*
1263	* Note that the order is vitally important!
1264	* Also note that SELMR3UpdateFromCPUM may trigger VM_FF_SELM_SYNC_TSS.
1265	*/
1266
1267
1268	/*
1269	* Sync selector tables.
1270	*/
1271	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT))
1272	{
1273	int rc = SELMR3UpdateFromCPUM(pVM, pVCpu);
1274	if (RT_FAILURE(rc))
1275	return rc;
1276	}
1277
1278	/*
1279	* Sync IDT.
1280	*
1281	* The CSAMR3CheckGates call in TRPMR3SyncIDT may call PGMPrefetchPage
1282	* and PGMShwModifyPage, so we're in for trouble if for instance a
1283	* PGMSyncCR3+pgmR3PoolClearAll is pending.
1284	*/
1285	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
1286	{
1287	if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3)
1288	&& EMIsRawRing0Enabled(pVM)
1289	&& CSAMIsEnabled(pVM))
1290	{
1291	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1292	if (RT_FAILURE(rc))
1293	return rc;
1294	}
1295
1296	int rc = TRPMR3SyncIDT(pVM, pVCpu);
1297	if (RT_FAILURE(rc))
1298	return rc;
1299	}
1300
1301	/*
1302	* Sync TSS.
1303	*/
1304	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1305	{
1306	int rc = SELMR3SyncTSS(pVM, pVCpu);
1307	if (RT_FAILURE(rc))
1308	return rc;
1309	}
1310
1311	/*
1312	* Sync page directory.
1313	*/
1314	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1315	{
1316	Assert(pVCpu->em.s.enmState != EMSTATE_WAIT_SIPI);
1317	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1318	if (RT_FAILURE(rc))
1319	return rc;
1320
1321	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1322
1323	/* Prefetch pages for EIP and ESP. */
1324	/** @todo This is rather expensive. Should investigate if it really helps at all. */
1325	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->rip));
1326	if (rc == VINF_SUCCESS)
1327	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), pCtx->rsp));
1328	if (rc != VINF_SUCCESS)
1329	{
1330	if (rc != VINF_PGM_SYNC_CR3)
1331	{
1332	AssertLogRelMsgReturn(RT_FAILURE(rc), ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
1333	return rc;
1334	}
1335	rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1336	if (RT_FAILURE(rc))
1337	return rc;
1338	}
1339	/** @todo maybe prefetch the supervisor stack page as well */
1340	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1341	}
1342
1343	/*
1344	* Allocate handy pages (just in case the above actions have consumed some pages).
1345	*/
1346	if (VM_FF_IS_PENDING_EXCEPT(pVM, VM_FF_PGM_NEED_HANDY_PAGES, VM_FF_PGM_NO_MEMORY))
1347	{
1348	int rc = PGMR3PhysAllocateHandyPages(pVM);
1349	if (RT_FAILURE(rc))
1350	return rc;
1351	}
1352
1353	/*
1354	* Check whether we're out of memory now.
1355	*
1356	* This may stem from some of the above actions or operations that has been executed
1357	* since we ran FFs. The allocate handy pages must for instance always be followed by
1358	* this check.
1359	*/
1360	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
1361	return VINF_EM_NO_MEMORY;
1362
1363	return VINF_SUCCESS;
1364	}
1365
1366
1367	/**
1368	* Executes raw code.
1369	*
1370	* This function contains the raw-mode version of the inner
1371	* execution loop (the outer loop being in EMR3ExecuteVM()).
1372	*
1373	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
1374	* VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
1375	*
1376	* @param pVM VM handle.
1377	* @param pVCpu VMCPU handle.
1378	* @param pfFFDone Where to store an indicator telling whether or not
1379	* FFs were done before returning.
1380	*/
1381	int emR3RawExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)
1382	{
1383	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTotal, a);
1384
1385	int rc = VERR_IPE_UNINITIALIZED_STATUS;
1386	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
1387	LogFlow(("emR3RawExecute: (cs:eip=%04x:%08x)\n", pCtx->cs, pCtx->eip));
1388	pVCpu->em.s.fForceRAW = false;
1389	*pfFFDone = false;
1390
1391
1392	/*
1393	*
1394	* Spin till we get a forced action or raw mode status code resulting in
1395	* in anything but VINF_SUCCESS or VINF_EM_RESCHEDULE_RAW.
1396	*
1397	*/
1398	for (;;)
1399	{
1400	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWEntry, b);
1401
1402	/*
1403	* Check various preconditions.
1404	*/
1405	#ifdef VBOX_STRICT
1406	Assert(REMR3QueryPendingInterrupt(pVM, pVCpu) == REM_NO_PENDING_IRQ);
1407	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) == 3 \|\| (pCtx->ss & X86_SEL_RPL) == 0);
1408	AssertMsg( (pCtx->eflags.u32 & X86_EFL_IF)
1409	\|\| PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip),
1410	("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
1411	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1412	&& PGMMapHasConflicts(pVM))
1413	{
1414	PGMMapCheck(pVM);
1415	AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
1416	return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1417	}
1418	#endif /* VBOX_STRICT */
1419
1420	/*
1421	* Process high priority pre-execution raw-mode FFs.
1422	*/
1423	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1424	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1425	{
1426	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1427	if (rc != VINF_SUCCESS)
1428	break;
1429	}
1430
1431	/*
1432	* If we're going to execute ring-0 code, the guest state needs to
1433	* be modified a bit and some of the state components (IF, SS/CS RPL,
1434	* and perhaps EIP) needs to be stored with PATM.
1435	*/
1436	rc = CPUMR3RawEnter(pVCpu, NULL);
1437	if (rc != VINF_SUCCESS)
1438	{
1439	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1440	break;
1441	}
1442
1443	/*
1444	* Scan code before executing it. Don't bother with user mode or V86 code
1445	*/
1446	if ( (pCtx->ss & X86_SEL_RPL) <= 1
1447	&& !pCtx->eflags.Bits.u1VM
1448	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
1449	{
1450	STAM_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWEntry, b);
1451	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
1452	STAM_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWEntry, b);
1453	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1454	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1455	{
1456	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1457	if (rc != VINF_SUCCESS)
1458	{
1459	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1460	break;
1461	}
1462	}
1463	}
1464
1465	#ifdef LOG_ENABLED
1466	/*
1467	* Log important stuff before entering GC.
1468	*/
1469	PPATMGCSTATE pGCState = PATMR3QueryGCStateHC(pVM);
1470	if (pCtx->eflags.Bits.u1VM)
1471	Log(("RV86: %04X:%08X IF=%d VMFlags=%x\n", pCtx->cs, pCtx->eip, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1472	else if ((pCtx->ss & X86_SEL_RPL) == 1)
1473	{
1474	bool fCSAMScanned = CSAMIsPageScanned(pVM, (RTGCPTR)pCtx->eip);
1475	Log(("RR0: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d (Scanned=%d)\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL), fCSAMScanned));
1476	}
1477	else if ((pCtx->ss & X86_SEL_RPL) == 3)
1478	Log(("RR3: %08X ESP=%08X IF=%d VMFlags=%x\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1479	#endif /* LOG_ENABLED */
1480
1481
1482
1483	/*
1484	* Execute the code.
1485	*/
1486	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1487	if (RT_LIKELY(EMR3IsExecutionAllowed(pVM, pVCpu)))
1488	{
1489	STAM_PROFILE_START(&pVCpu->em.s.StatRAWExec, c);
1490	rc = VMMR3RawRunGC(pVM, pVCpu);
1491	STAM_PROFILE_STOP(&pVCpu->em.s.StatRAWExec, c);
1492	}
1493	else
1494	{
1495	/* Give up this time slice; virtual time continues */
1496	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatCapped, u);
1497	RTThreadSleep(5);
1498	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatCapped, u);
1499	rc = VINF_SUCCESS;
1500	}
1501	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTail, d);
1502
1503	LogFlow(("RR0-E: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL)));
1504	LogFlow(("VMMR3RawRunGC returned %Rrc\n", rc));
1505
1506
1507
1508	/*
1509	* Restore the real CPU state and deal with high priority post
1510	* execution FFs before doing anything else.
1511	*/
1512	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1513	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
1514	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK)
1515	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_MASK))
1516	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
1517
1518	#ifdef VBOX_STRICT
1519	/*
1520	* Assert TSS consistency & rc vs patch code.
1521	*/
1522	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_SELM_SYNC_GDT) /* GDT implies TSS at the moment. */
1523	&& EMIsRawRing0Enabled(pVM))
1524	SELMR3CheckTSS(pVM);
1525	switch (rc)
1526	{
1527	case VINF_SUCCESS:
1528	case VINF_EM_RAW_INTERRUPT:
1529	case VINF_PATM_PATCH_TRAP_PF:
1530	case VINF_PATM_PATCH_TRAP_GP:
1531	case VINF_PATM_PATCH_INT3:
1532	case VINF_PATM_CHECK_PATCH_PAGE:
1533	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1534	case VINF_EM_RAW_GUEST_TRAP:
1535	case VINF_EM_RESCHEDULE_RAW:
1536	break;
1537
1538	default:
1539	if (PATMIsPatchGCAddr(pVM, pCtx->eip) && !(pCtx->eflags.u32 & X86_EFL_TF))
1540	LogIt(NULL, 0, LOG_GROUP_PATM, ("Patch code interrupted at %RRv for reason %Rrc\n", (RTRCPTR)CPUMGetGuestEIP(pVCpu), rc));
1541	break;
1542	}
1543	/*
1544	* Let's go paranoid!
1545	*/
1546	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1547	&& PGMMapHasConflicts(pVM))
1548	{
1549	PGMMapCheck(pVM);
1550	AssertMsgFailed(("We should not get conflicts any longer!!! rc=%Rrc\n", rc));
1551	return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1552	}
1553	#endif /* VBOX_STRICT */
1554
1555	/*
1556	* Process the returned status code.
1557	*/
1558	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
1559	{
1560	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1561	break;
1562	}
1563	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
1564	if (rc != VINF_SUCCESS)
1565	{
1566	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1567	if (rc != VINF_SUCCESS)
1568	{
1569	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1570	break;
1571	}
1572	}
1573
1574	/*
1575	* Check and execute forced actions.
1576	*/
1577	#ifdef VBOX_HIGH_RES_TIMERS_HACK
1578	TMTimerPollVoid(pVM, pVCpu);
1579	#endif
1580	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1581	if ( VM_FF_ISPENDING(pVM, ~VM_FF_HIGH_PRIORITY_PRE_RAW_MASK \| VM_FF_PGM_NO_MEMORY)
1582	\|\| VMCPU_FF_ISPENDING(pVCpu, ~VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1583	{
1584	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) != 1);
1585
1586	STAM_REL_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWTotal, a);
1587	rc = emR3ForcedActions(pVM, pVCpu, rc);
1588	STAM_REL_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWTotal, a);
1589	if ( rc != VINF_SUCCESS
1590	&& rc != VINF_EM_RESCHEDULE_RAW)
1591	{
1592	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1593	if (rc != VINF_SUCCESS)
1594	{
1595	*pfFFDone = true;
1596	break;
1597	}
1598	}
1599	}
1600	}
1601
1602	/*
1603	* Return to outer loop.
1604	*/
1605	#if defined(LOG_ENABLED) && defined(DEBUG)
1606	RTLogFlush(NULL);
1607	#endif
1608	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTotal, a);
1609	return rc;
1610	}
1611

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/EMRaw.cpp@ 39405

Download in other formats: