EMRaw.cpp@ 40377

Last change on this file since 40377 was 40377, checked in by vboxsync, 13 years ago
Fixes for real dtrace (trailing digits are not allowed in provider names).
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 56.4 KB

Line
1	/* $Id: EMRaw.cpp 40377 2012-03-06 15:00:44Z vboxsync $ */
2	/** @file
3	* EM - Execution Monitor / Manager - software virtualization
4	*/
5
6	/*
7	* Copyright (C) 2006-2012 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_EM
23	#include <VBox/vmm/em.h>
24	#include <VBox/vmm/vmm.h>
25	#include <VBox/vmm/patm.h>
26	#include <VBox/vmm/csam.h>
27	#include <VBox/vmm/selm.h>
28	#include <VBox/vmm/trpm.h>
29	#include <VBox/vmm/iem.h>
30	#include <VBox/vmm/iom.h>
31	#include <VBox/vmm/dbgf.h>
32	#include <VBox/vmm/pgm.h>
33	#ifdef VBOX_WITH_REM
34	# include <VBox/vmm/rem.h>
35	#endif
36	#include <VBox/vmm/tm.h>
37	#include <VBox/vmm/mm.h>
38	#include <VBox/vmm/ssm.h>
39	#include <VBox/vmm/pdmapi.h>
40	#include <VBox/vmm/pdmcritsect.h>
41	#include <VBox/vmm/pdmqueue.h>
42	#include <VBox/vmm/patm.h>
43	#include "EMInternal.h"
44	#include "internal/em.h"
45	#include <VBox/vmm/vm.h>
46	#include <VBox/vmm/cpumdis.h>
47	#include <VBox/dis.h>
48	#include <VBox/disopcode.h>
49	#include <VBox/vmm/dbgf.h>
50	#include "VMMTracing.h"
51
52	#include <VBox/log.h>
53	#include <iprt/asm.h>
54	#include <iprt/string.h>
55	#include <iprt/stream.h>
56
57
58
59	/*******************************************************************************
60	* Internal Functions *
61	*******************************************************************************/
62	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
63	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC = VINF_SUCCESS);
64	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu);
65	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret);
66	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu);
67	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu);
68	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu);
69
70	#define EMHANDLERC_WITH_PATM
71	#include "EMHandleRCTmpl.h"
72
73
74
75	#ifdef VBOX_WITH_STATISTICS
76	/**
77	* Just a braindead function to keep track of cli addresses.
78	* @param pVM VM handle.
79	* @param pVMCPU VMCPU handle.
80	* @param GCPtrInstr The EIP of the cli instruction.
81	*/
82	static void emR3RecordCli(PVM pVM, PVMCPU pVCpu, RTGCPTR GCPtrInstr)
83	{
84	PCLISTAT pRec;
85
86	pRec = (PCLISTAT)RTAvlGCPtrGet(&pVCpu->em.s.pCliStatTree, GCPtrInstr);
87	if (!pRec)
88	{
89	/* New cli instruction; insert into the tree. */
90	pRec = (PCLISTAT)MMR3HeapAllocZ(pVM, MM_TAG_EM, sizeof(*pRec));
91	Assert(pRec);
92	if (!pRec)
93	return;
94	pRec->Core.Key = GCPtrInstr;
95
96	char szCliStatName[32];
97	RTStrPrintf(szCliStatName, sizeof(szCliStatName), "/EM/Cli/0x%RGv", GCPtrInstr);
98	STAM_REG(pVM, &pRec->Counter, STAMTYPE_COUNTER, szCliStatName, STAMUNIT_OCCURENCES, "Number of times cli was executed.");
99
100	bool fRc = RTAvlGCPtrInsert(&pVCpu->em.s.pCliStatTree, &pRec->Core);
101	Assert(fRc); NOREF(fRc);
102	}
103	STAM_COUNTER_INC(&pRec->Counter);
104	STAM_COUNTER_INC(&pVCpu->em.s.StatTotalClis);
105	}
106	#endif /* VBOX_WITH_STATISTICS */
107
108
109
110	/**
111	* Resumes executing hypervisor after a debug event.
112	*
113	* This is kind of special since our current guest state is
114	* potentially out of sync.
115	*
116	* @returns VBox status code.
117	* @param pVM The VM handle.
118	* @param pVCpu The VMCPU handle.
119	*/
120	int emR3RawResumeHyper(PVM pVM, PVMCPU pVCpu)
121	{
122	int rc;
123	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
124	Assert(pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER);
125	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr\n", pCtx->cs, pCtx->eip, pCtx->eflags));
126
127	/*
128	* Resume execution.
129	*/
130	CPUMR3RawEnter(pVCpu, NULL);
131	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_RF);
132	rc = VMMR3ResumeHyper(pVM, pVCpu);
133	Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr - returned from GC with rc=%Rrc\n", pCtx->cs, pCtx->eip, pCtx->eflags, rc));
134	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
135	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
136
137	/*
138	* Deal with the return code.
139	*/
140	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
141	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
142	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
143	return rc;
144	}
145
146
147	/**
148	* Steps rawmode.
149	*
150	* @returns VBox status code.
151	* @param pVM The VM handle.
152	* @param pVCpu The VMCPU handle.
153	*/
154	int emR3RawStep(PVM pVM, PVMCPU pVCpu)
155	{
156	Assert( pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER
157	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
158	\|\| pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
159	int rc;
160	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
161	bool fGuest = pVCpu->em.s.enmState != EMSTATE_DEBUG_HYPER;
162	#ifndef DEBUG_sandervl
163	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
164	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu)));
165	#endif
166	if (fGuest)
167	{
168	/*
169	* Check vital forced actions, but ignore pending interrupts and timers.
170	*/
171	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
172	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
173	{
174	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
175	VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
176	if (rc != VINF_SUCCESS)
177	return rc;
178	}
179
180	/*
181	* Set flags for single stepping.
182	*/
183	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
184	}
185	else
186	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) \| X86_EFL_TF \| X86_EFL_RF);
187
188	/*
189	* Single step.
190	* We do not start time or anything, if anything we should just do a few nanoseconds.
191	*/
192	CPUMR3RawEnter(pVCpu, NULL);
193	do
194	{
195	if (pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER)
196	rc = VMMR3ResumeHyper(pVM, pVCpu);
197	else
198	rc = VMMR3RawRunGC(pVM, pVCpu);
199	#ifndef DEBUG_sandervl
200	Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - GC rc %Rrc\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
201	fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu), rc));
202	#endif
203	} while ( rc == VINF_SUCCESS
204	\|\| rc == VINF_EM_RAW_INTERRUPT);
205	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
206	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
207
208	/*
209	* Make sure the trap flag is cleared.
210	* (Too bad if the guest is trying to single step too.)
211	*/
212	if (fGuest)
213	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
214	else
215	CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) & ~X86_EFL_TF);
216
217	/*
218	* Deal with the return codes.
219	*/
220	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
221	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
222	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
223	return rc;
224	}
225
226
227	#ifdef DEBUG
228
229
230	int emR3SingleStepExecRaw(PVM pVM, PVMCPU pVCpu, uint32_t cIterations)
231	{
232	int rc = VINF_SUCCESS;
233	EMSTATE enmOldState = pVCpu->em.s.enmState;
234	pVCpu->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
235
236	Log(("Single step BEGIN:\n"));
237	for (uint32_t i = 0; i < cIterations; i++)
238	{
239	DBGFR3PrgStep(pVCpu);
240	DBGFR3DisasInstrCurrentLog(pVCpu, "RSS: ");
241	rc = emR3RawStep(pVM, pVCpu);
242	if (rc != VINF_SUCCESS)
243	break;
244	}
245	Log(("Single step END: rc=%Rrc\n", rc));
246	CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
247	pVCpu->em.s.enmState = enmOldState;
248	return rc;
249	}
250
251	#endif /* DEBUG */
252
253
254	/**
255	* Executes one (or perhaps a few more) instruction(s).
256	*
257	* @returns VBox status code suitable for EM.
258	*
259	* @param pVM VM handle.
260	* @param pVCpu VMCPU handle
261	* @param rcGC GC return code
262	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
263	* instruction and prefix the log output with this text.
264	*/
265	#ifdef LOG_ENABLED
266	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC, const char *pszPrefix)
267	#else
268	static int emR3ExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC)
269	#endif
270	{
271	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
272	int rc;
273
274	/*
275	*
276	* The simple solution is to use the recompiler.
277	* The better solution is to disassemble the current instruction and
278	* try handle as many as possible without using REM.
279	*
280	*/
281
282	#ifdef LOG_ENABLED
283	/*
284	* Disassemble the instruction if requested.
285	*/
286	if (pszPrefix)
287	{
288	DBGFR3InfoLog(pVM, "cpumguest", pszPrefix);
289	DBGFR3DisasInstrCurrentLog(pVCpu, pszPrefix);
290	}
291	#endif /* LOG_ENABLED */
292
293	/*
294	* PATM is making life more interesting.
295	* We cannot hand anything to REM which has an EIP inside patch code. So, we'll
296	* tell PATM there is a trap in this code and have it take the appropriate actions
297	* to allow us execute the code in REM.
298	*/
299	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
300	{
301	Log(("emR3ExecuteInstruction: In patch block. eip=%RRv\n", (RTRCPTR)pCtx->eip));
302
303	RTGCPTR pNewEip;
304	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
305	switch (rc)
306	{
307	/*
308	* It's not very useful to emulate a single instruction and then go back to raw
309	* mode; just execute the whole block until IF is set again.
310	*/
311	case VINF_SUCCESS:
312	Log(("emR3ExecuteInstruction: Executing instruction starting at new address %RGv IF=%d VMIF=%x\n",
313	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
314	pCtx->eip = pNewEip;
315	Assert(pCtx->eip);
316
317	if (pCtx->eflags.Bits.u1IF)
318	{
319	/*
320	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
321	*/
322	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
323	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
324	}
325	else if (rcGC == VINF_PATM_PENDING_IRQ_AFTER_IRET)
326	{
327	/* special case: iret, that sets IF, detected a pending irq/event */
328	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIRET");
329	}
330	return VINF_EM_RESCHEDULE_REM;
331
332	/*
333	* One instruction.
334	*/
335	case VINF_PATCH_EMULATE_INSTR:
336	Log(("emR3ExecuteInstruction: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
337	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
338	pCtx->eip = pNewEip;
339	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
340
341	/*
342	* The patch was disabled, hand it to the REM.
343	*/
344	case VERR_PATCH_DISABLED:
345	Log(("emR3ExecuteInstruction: Disabled patch -> new eip %RGv IF=%d VMIF=%x\n",
346	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
347	pCtx->eip = pNewEip;
348	if (pCtx->eflags.Bits.u1IF)
349	{
350	/*
351	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
352	*/
353	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
354	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
355	}
356	return VINF_EM_RESCHEDULE_REM;
357
358	/* Force continued patch exection; usually due to write monitored stack. */
359	case VINF_PATCH_CONTINUE:
360	return VINF_SUCCESS;
361
362	default:
363	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap\n", rc));
364	return VERR_IPE_UNEXPECTED_STATUS;
365	}
366	}
367
368	STAM_PROFILE_START(&pVCpu->em.s.StatREMEmu, a);
369	Log(("EMINS: %04x:%RGv RSP=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, (RTGCPTR)pCtx->rsp));
370	#ifdef VBOX_WITH_REM
371	EMRemLock(pVM);
372	/* Flush the recompiler TLB if the VCPU has changed. */
373	if (pVM->em.s.idLastRemCpu != pVCpu->idCpu)
374	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
375	pVM->em.s.idLastRemCpu = pVCpu->idCpu;
376
377	rc = REMR3EmulateInstruction(pVM, pVCpu);
378	EMRemUnlock(pVM);
379	#else
380	rc = VBOXSTRICTRC_TODO(IEMExecOne(pVCpu));
381	#endif
382	STAM_PROFILE_STOP(&pVCpu->em.s.StatREMEmu, a);
383
384	return rc;
385	}
386
387
388	/**
389	* Executes one (or perhaps a few more) instruction(s).
390	* This is just a wrapper for discarding pszPrefix in non-logging builds.
391	*
392	* @returns VBox status code suitable for EM.
393	* @param pVM VM handle.
394	* @param pVCpu VMCPU handle.
395	* @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
396	* instruction and prefix the log output with this text.
397	* @param rcGC GC return code
398	*/
399	DECLINLINE(int) emR3ExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC)
400	{
401	#ifdef LOG_ENABLED
402	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC, pszPrefix);
403	#else
404	return emR3ExecuteInstructionWorker(pVM, pVCpu, rcGC);
405	#endif
406	}
407
408	/**
409	* Executes one (or perhaps a few more) IO instruction(s).
410	*
411	* @returns VBox status code suitable for EM.
412	* @param pVM VM handle.
413	* @param pVCpu VMCPU handle.
414	*/
415	static int emR3ExecuteIOInstruction(PVM pVM, PVMCPU pVCpu)
416	{
417	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
418
419	STAM_PROFILE_START(&pVCpu->em.s.StatIOEmu, a);
420
421	/** @todo probably we should fall back to the recompiler; otherwise we'll go back and forth between HC & GC
422	* as io instructions tend to come in packages of more than one
423	*/
424	DISCPUSTATE Cpu;
425	int rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "IO EMU");
426	if (RT_SUCCESS(rc))
427	{
428	VBOXSTRICTRC rcStrict = VINF_EM_RAW_EMULATE_INSTR;
429
430	if (!(Cpu.prefix & (PREFIX_REP \| PREFIX_REPNE)))
431	{
432	switch (Cpu.pCurInstr->opcode)
433	{
434	case OP_IN:
435	{
436	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
437	rcStrict = IOMInterpretIN(pVM, CPUMCTX2CORE(pCtx), &Cpu);
438	break;
439	}
440
441	case OP_OUT:
442	{
443	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
444	rcStrict = IOMInterpretOUT(pVM, CPUMCTX2CORE(pCtx), &Cpu);
445	break;
446	}
447	}
448	}
449	else if (Cpu.prefix & PREFIX_REP)
450	{
451	switch (Cpu.pCurInstr->opcode)
452	{
453	case OP_INSB:
454	case OP_INSWD:
455	{
456	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
457	rcStrict = IOMInterpretINS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
458	break;
459	}
460
461	case OP_OUTSB:
462	case OP_OUTSWD:
463	{
464	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
465	rcStrict = IOMInterpretOUTS(pVM, CPUMCTX2CORE(pCtx), &Cpu);
466	break;
467	}
468	}
469	}
470
471	/*
472	* Handled the I/O return codes.
473	* (The unhandled cases end up with rcStrict == VINF_EM_RAW_EMULATE_INSTR.)
474	*/
475	if (IOM_SUCCESS(rcStrict))
476	{
477	pCtx->rip += Cpu.opsize;
478	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
479	return VBOXSTRICTRC_TODO(rcStrict);
480	}
481
482	if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
483	{
484	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
485	rcStrict = emR3RawGuestTrap(pVM, pVCpu);
486	return VBOXSTRICTRC_TODO(rcStrict);
487	}
488	AssertMsg(rcStrict != VINF_TRPM_XCPT_DISPATCHED, ("Handle VINF_TRPM_XCPT_DISPATCHED\n"));
489
490	if (RT_FAILURE(rcStrict))
491	{
492	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
493	return VBOXSTRICTRC_TODO(rcStrict);
494	}
495	AssertMsg(rcStrict == VINF_EM_RAW_EMULATE_INSTR \|\| rcStrict == VINF_EM_RESCHEDULE_REM, ("rcStrict=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
496	}
497	STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
498	return emR3ExecuteInstruction(pVM, pVCpu, "IO: ");
499	}
500
501
502	/**
503	* Handle a guest context trap.
504	*
505	* @returns VBox status code suitable for EM.
506	* @param pVM VM handle.
507	* @param pVCpu VMCPU handle.
508	*/
509	static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu)
510	{
511	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
512
513	/*
514	* Get the trap info.
515	*/
516	uint8_t u8TrapNo;
517	TRPMEVENT enmType;
518	RTGCUINT uErrorCode;
519	RTGCUINTPTR uCR2;
520	int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
521	if (RT_FAILURE(rc))
522	{
523	AssertReleaseMsgFailed(("No trap! (rc=%Rrc)\n", rc));
524	return rc;
525	}
526
527
528	#if 1 /* Experimental: Review, disable if it causes trouble. */
529	/*
530	* Handle traps in patch code first.
531	*
532	* We catch a few of these cases in RC before returning to R3 (#PF, #GP, #BP)
533	* but several traps isn't handled specially by TRPM in RC and we end up here
534	* instead. One example is #DE.
535	*/
536	uint32_t uCpl = CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx));
537	if ( uCpl == 0
538	&& PATMIsPatchGCAddr(pVM, pCtx->eip))
539	{
540	LogFlow(("emR3RawGuestTrap: trap %#x in patch code; eip=%08x\n", u8TrapNo, pCtx->eip));
541	return emR3PatchTrap(pVM, pVCpu, pCtx, rc);
542	}
543	#endif
544
545	/*
546	* If the guest gate is marked unpatched, then we will check again if we can patch it.
547	* (This assumes that we've already tried and failed to dispatch the trap in
548	* RC for the gates that already has been patched. Which is true for most high
549	* volume traps, because these are handled specially, but not for odd ones like #DE.)
550	*/
551	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) == TRPM_INVALID_HANDLER)
552	{
553	CSAMR3CheckGates(pVM, u8TrapNo, 1);
554	Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8TrapNo, TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER));
555
556	/* If it was successful, then we could go back to raw mode. */
557	if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER)
558	{
559	/* Must check pending forced actions as our IDT or GDT might be out of sync. */
560	rc = EMR3CheckRawForcedActions(pVM, pVCpu);
561	AssertRCReturn(rc, rc);
562
563	TRPMERRORCODE enmError = uErrorCode != ~0U
564	? TRPM_TRAP_HAS_ERRORCODE
565	: TRPM_TRAP_NO_ERRORCODE;
566	rc = TRPMForwardTrap(pVCpu, CPUMCTX2CORE(pCtx), u8TrapNo, uErrorCode, enmError, TRPM_TRAP, -1);
567	if (rc == VINF_SUCCESS /* Don't use RT_SUCCESS */)
568	{
569	TRPMResetTrap(pVCpu);
570	return VINF_EM_RESCHEDULE_RAW;
571	}
572	AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP, ("%Rrc\n", rc));
573	}
574	}
575
576	/*
577	* Scan kernel code that traps; we might not get another chance.
578	*/
579	/** @todo move this up before the dispatching? */
580	if ( (pCtx->ss & X86_SEL_RPL) <= 1
581	&& !pCtx->eflags.Bits.u1VM)
582	{
583	Assert(!PATMIsPatchGCAddr(pVM, pCtx->eip));
584	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
585	}
586
587	/*
588	* Trap specific handling.
589	*/
590	if (u8TrapNo == 6) /* (#UD) Invalid opcode. */
591	{
592	/*
593	* If MONITOR & MWAIT are supported, then interpret them here.
594	*/
595	DISCPUSTATE cpu;
596	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap (#UD): ");
597	if ( RT_SUCCESS(rc)
598	&& (cpu.pCurInstr->opcode == OP_MONITOR \|\| cpu.pCurInstr->opcode == OP_MWAIT))
599	{
600	uint32_t u32Dummy, u32Features, u32ExtFeatures;
601	CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Features);
602	if (u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR)
603	{
604	rc = TRPMResetTrap(pVCpu);
605	AssertRC(rc);
606
607	uint32_t opsize;
608	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &opsize));
609	if (RT_SUCCESS(rc))
610	{
611	pCtx->rip += cpu.opsize;
612	return rc;
613	}
614	return emR3ExecuteInstruction(pVM, pVCpu, "Monitor: ");
615	}
616	}
617	}
618	else if (u8TrapNo == 13) /* (#GP) Privileged exception */
619	{
620	/*
621	* Handle I/O bitmap?
622	*/
623	/** @todo We're not supposed to be here with a false guest trap concerning
624	* I/O access. We can easily handle those in RC. */
625	DISCPUSTATE cpu;
626	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap: ");
627	if ( RT_SUCCESS(rc)
628	&& (cpu.pCurInstr->optype & OPTYPE_PORTIO))
629	{
630	/*
631	* We should really check the TSS for the IO bitmap, but it's not like this
632	* lazy approach really makes things worse.
633	*/
634	rc = TRPMResetTrap(pVCpu);
635	AssertRC(rc);
636	return emR3ExecuteInstruction(pVM, pVCpu, "IO Guest Trap: ");
637	}
638	}
639
640	#ifdef LOG_ENABLED
641	DBGFR3InfoLog(pVM, "cpumguest", "Guest trap");
642	DBGFR3DisasInstrCurrentLog(pVCpu, "Guest trap");
643
644	/* Get guest page information. */
645	uint64_t fFlags = 0;
646	RTGCPHYS GCPhys = 0;
647	int rc2 = PGMGstGetPage(pVCpu, uCR2, &fFlags, &GCPhys);
648	Log(("emR3RawGuestTrap: cs:eip=%04x:%08x: trap=%02x err=%08x cr2=%08x cr0=%08x%s: Phys=%RGp fFlags=%08llx %s %s %s%s rc2=%d\n",
649	pCtx->cs, pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0, (enmType == TRPM_SOFTWARE_INT) ? " software" : "", GCPhys, fFlags,
650	fFlags & X86_PTE_P ? "P " : "NP", fFlags & X86_PTE_US ? "U" : "S",
651	fFlags & X86_PTE_RW ? "RW" : "R0", fFlags & X86_PTE_G ? " G" : "", rc2));
652	#endif
653
654	/*
655	* #PG has CR2.
656	* (Because of stuff like above we must set CR2 in a delayed fashion.)
657	*/
658	if (u8TrapNo == 14 /* #PG */)
659	pCtx->cr2 = uCR2;
660
661	return VINF_EM_RESCHEDULE_REM;
662	}
663
664
665	/**
666	* Handle a ring switch trap.
667	* Need to do statistics and to install patches. The result is going to REM.
668	*
669	* @returns VBox status code suitable for EM.
670	* @param pVM VM handle.
671	* @param pVCpu VMCPU handle.
672	*/
673	static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu)
674	{
675	int rc;
676	DISCPUSTATE Cpu;
677	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
678
679	/*
680	* sysenter, syscall & callgate
681	*/
682	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "RSWITCH: ");
683	if (RT_SUCCESS(rc))
684	{
685	if (Cpu.pCurInstr->opcode == OP_SYSENTER)
686	{
687	if (pCtx->SysEnter.cs != 0)
688	{
689	rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
690	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
691	if (RT_SUCCESS(rc))
692	{
693	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched sysenter instruction");
694	return VINF_EM_RESCHEDULE_RAW;
695	}
696	}
697	}
698
699	#ifdef VBOX_WITH_STATISTICS
700	switch (Cpu.pCurInstr->opcode)
701	{
702	case OP_SYSENTER:
703	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysEnter);
704	break;
705	case OP_SYSEXIT:
706	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysExit);
707	break;
708	case OP_SYSCALL:
709	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysCall);
710	break;
711	case OP_SYSRET:
712	STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysRet);
713	break;
714	}
715	#endif
716	}
717	else
718	AssertRC(rc);
719
720	/* go to the REM to emulate a single instruction */
721	return emR3ExecuteInstruction(pVM, pVCpu, "RSWITCH: ");
722	}
723
724
725	/**
726	* Handle a trap (\#PF or \#GP) in patch code
727	*
728	* @returns VBox status code suitable for EM.
729	* @param pVM VM handle.
730	* @param pVCpu VMCPU handle.
731	* @param pCtx CPU context
732	* @param gcret GC return code
733	*/
734	static int emR3PatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret)
735	{
736	uint8_t u8TrapNo;
737	int rc;
738	TRPMEVENT enmType;
739	RTGCUINT uErrorCode;
740	RTGCUINTPTR uCR2;
741
742	Assert(PATMIsPatchGCAddr(pVM, pCtx->eip));
743
744	if (gcret == VINF_PATM_PATCH_INT3)
745	{
746	u8TrapNo = 3;
747	uCR2 = 0;
748	uErrorCode = 0;
749	}
750	else if (gcret == VINF_PATM_PATCH_TRAP_GP)
751	{
752	/* No active trap in this case. Kind of ugly. */
753	u8TrapNo = X86_XCPT_GP;
754	uCR2 = 0;
755	uErrorCode = 0;
756	}
757	else
758	{
759	rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2);
760	if (RT_FAILURE(rc))
761	{
762	AssertReleaseMsgFailed(("emR3PatchTrap: no trap! (rc=%Rrc) gcret=%Rrc\n", rc, gcret));
763	return rc;
764	}
765	/* Reset the trap as we'll execute the original instruction again. */
766	TRPMResetTrap(pVCpu);
767	}
768
769	/*
770	* Deal with traps inside patch code.
771	* (This code won't run outside GC.)
772	*/
773	if (u8TrapNo != 1)
774	{
775	#ifdef LOG_ENABLED
776	DBGFR3InfoLog(pVM, "cpumguest", "Trap in patch code");
777	DBGFR3DisasInstrCurrentLog(pVCpu, "Patch code");
778
779	DISCPUSTATE Cpu;
780	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->eip, &Cpu, "Patch code: ");
781	if ( RT_SUCCESS(rc)
782	&& Cpu.pCurInstr->opcode == OP_IRET)
783	{
784	uint32_t eip, selCS, uEFlags;
785
786	/* Iret crashes are bad as we have already changed the flags on the stack */
787	rc = PGMPhysSimpleReadGCPtr(pVCpu, &eip, pCtx->esp, 4);
788	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selCS, pCtx->esp+4, 4);
789	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &uEFlags, pCtx->esp+8, 4);
790	if (rc == VINF_SUCCESS)
791	{
792	if ( (uEFlags & X86_EFL_VM)
793	\|\| (selCS & X86_SEL_RPL) == 3)
794	{
795	uint32_t selSS, esp;
796
797	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &esp, pCtx->esp + 12, 4);
798	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selSS, pCtx->esp + 16, 4);
799
800	if (uEFlags & X86_EFL_VM)
801	{
802	uint32_t selDS, selES, selFS, selGS;
803	rc = PGMPhysSimpleReadGCPtr(pVCpu, &selES, pCtx->esp + 20, 4);
804	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selDS, pCtx->esp + 24, 4);
805	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selFS, pCtx->esp + 28, 4);
806	rc \|= PGMPhysSimpleReadGCPtr(pVCpu, &selGS, pCtx->esp + 32, 4);
807	if (rc == VINF_SUCCESS)
808	{
809	Log(("Patch code: IRET->VM stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
810	Log(("Patch code: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
811	}
812	}
813	else
814	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
815	}
816	else
817	Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x\n", selCS, eip, uEFlags));
818	}
819	}
820	#endif /* LOG_ENABLED */
821	Log(("emR3PatchTrap: in patch: eip=%08x: trap=%02x err=%08x cr2=%08x cr0=%08x\n",
822	pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0));
823
824	RTGCPTR pNewEip;
825	rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &pNewEip);
826	switch (rc)
827	{
828	/*
829	* Execute the faulting instruction.
830	*/
831	case VINF_SUCCESS:
832	{
833	/** @todo execute a whole block */
834	Log(("emR3PatchTrap: Executing faulting instruction at new address %RGv\n", pNewEip));
835	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
836	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
837
838	pCtx->eip = pNewEip;
839	AssertRelease(pCtx->eip);
840
841	if (pCtx->eflags.Bits.u1IF)
842	{
843	/* Windows XP lets irets fault intentionally and then takes action based on the opcode; an
844	* int3 patch overwrites it and leads to blue screens. Remove the patch in this case.
845	*/
846	if ( u8TrapNo == X86_XCPT_GP
847	&& PATMIsInt3Patch(pVM, pCtx->eip, NULL, NULL))
848	{
849	/** @todo move to PATMR3HandleTrap */
850	Log(("Possible Windows XP iret fault at %08RX32\n", pCtx->eip));
851	PATMR3RemovePatch(pVM, pCtx->eip);
852	}
853
854	/** @todo Knoppix 5 regression when returning VINF_SUCCESS here and going back to raw mode. */
855	/* Note: possibly because a reschedule is required (e.g. iret to V86 code) */
856
857	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
858	/* Interrupts are enabled; just go back to the original instruction.
859	return VINF_SUCCESS; */
860	}
861	return VINF_EM_RESCHEDULE_REM;
862	}
863
864	/*
865	* One instruction.
866	*/
867	case VINF_PATCH_EMULATE_INSTR:
868	Log(("emR3PatchTrap: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
869	pNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
870	pCtx->eip = pNewEip;
871	AssertRelease(pCtx->eip);
872	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHEMUL: ");
873
874	/*
875	* The patch was disabled, hand it to the REM.
876	*/
877	case VERR_PATCH_DISABLED:
878	if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
879	Log(("emR3PatchTrap: Virtual IF flag disabled!!\n"));
880	pCtx->eip = pNewEip;
881	AssertRelease(pCtx->eip);
882
883	if (pCtx->eflags.Bits.u1IF)
884	{
885	/*
886	* The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
887	*/
888	Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
889	return emR3ExecuteInstruction(pVM, pVCpu, "PATCHIR");
890	}
891	return VINF_EM_RESCHEDULE_REM;
892
893	/* Force continued patch exection; usually due to write monitored stack. */
894	case VINF_PATCH_CONTINUE:
895	return VINF_SUCCESS;
896
897	/*
898	* Anything else is fatal.
899	*/
900	default:
901	AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap!\n", rc));
902	return VERR_IPE_UNEXPECTED_STATUS;
903	}
904	}
905	return VINF_SUCCESS;
906	}
907
908
909	/**
910	* Handle a privileged instruction.
911	*
912	* @returns VBox status code suitable for EM.
913	* @param pVM VM handle.
914	* @param pVCpu VMCPU handle;
915	*/
916	static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu)
917	{
918	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
919
920	Assert(!pCtx->eflags.Bits.u1VM);
921
922	if (PATMIsEnabled(pVM))
923	{
924	/*
925	* Check if in patch code.
926	*/
927	if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
928	{
929	#ifdef LOG_ENABLED
930	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
931	#endif
932	AssertMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08X\n", pCtx->eip));
933	return VERR_EM_RAW_PATCH_CONFLICT;
934	}
935	if ( (pCtx->ss & X86_SEL_RPL) == 0
936	&& !pCtx->eflags.Bits.u1VM
937	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
938	{
939	int rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
940	(SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT) ? PATMFL_CODE32 : 0);
941	if (RT_SUCCESS(rc))
942	{
943	#ifdef LOG_ENABLED
944	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
945	#endif
946	DBGFR3DisasInstrCurrentLog(pVCpu, "Patched privileged instruction");
947	return VINF_SUCCESS;
948	}
949	}
950	}
951
952	#ifdef LOG_ENABLED
953	if (!PATMIsPatchGCAddr(pVM, pCtx->eip))
954	{
955	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
956	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
957	}
958	#endif
959
960	/*
961	* Instruction statistics and logging.
962	*/
963	DISCPUSTATE Cpu;
964	int rc;
965
966	rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "PRIV: ");
967	if (RT_SUCCESS(rc))
968	{
969	#ifdef VBOX_WITH_STATISTICS
970	PEMSTATS pStats = pVCpu->em.s.CTX_SUFF(pStats);
971	switch (Cpu.pCurInstr->opcode)
972	{
973	case OP_INVLPG:
974	STAM_COUNTER_INC(&pStats->StatInvlpg);
975	break;
976	case OP_IRET:
977	STAM_COUNTER_INC(&pStats->StatIret);
978	break;
979	case OP_CLI:
980	STAM_COUNTER_INC(&pStats->StatCli);
981	emR3RecordCli(pVM, pVCpu, pCtx->rip);
982	break;
983	case OP_STI:
984	STAM_COUNTER_INC(&pStats->StatSti);
985	break;
986	case OP_INSB:
987	case OP_INSWD:
988	case OP_IN:
989	case OP_OUTSB:
990	case OP_OUTSWD:
991	case OP_OUT:
992	AssertMsgFailed(("Unexpected privileged exception due to port IO\n"));
993	break;
994
995	case OP_MOV_CR:
996	if (Cpu.param1.flags & USE_REG_GEN32)
997	{
998	//read
999	Assert(Cpu.param2.flags & USE_REG_CR);
1000	Assert(Cpu.param2.base.reg_ctrl <= USE_REG_CR4);
1001	STAM_COUNTER_INC(&pStats->StatMovReadCR[Cpu.param2.base.reg_ctrl]);
1002	}
1003	else
1004	{
1005	//write
1006	Assert(Cpu.param1.flags & USE_REG_CR);
1007	Assert(Cpu.param1.base.reg_ctrl <= USE_REG_CR4);
1008	STAM_COUNTER_INC(&pStats->StatMovWriteCR[Cpu.param1.base.reg_ctrl]);
1009	}
1010	break;
1011
1012	case OP_MOV_DR:
1013	STAM_COUNTER_INC(&pStats->StatMovDRx);
1014	break;
1015	case OP_LLDT:
1016	STAM_COUNTER_INC(&pStats->StatMovLldt);
1017	break;
1018	case OP_LIDT:
1019	STAM_COUNTER_INC(&pStats->StatMovLidt);
1020	break;
1021	case OP_LGDT:
1022	STAM_COUNTER_INC(&pStats->StatMovLgdt);
1023	break;
1024	case OP_SYSENTER:
1025	STAM_COUNTER_INC(&pStats->StatSysEnter);
1026	break;
1027	case OP_SYSEXIT:
1028	STAM_COUNTER_INC(&pStats->StatSysExit);
1029	break;
1030	case OP_SYSCALL:
1031	STAM_COUNTER_INC(&pStats->StatSysCall);
1032	break;
1033	case OP_SYSRET:
1034	STAM_COUNTER_INC(&pStats->StatSysRet);
1035	break;
1036	case OP_HLT:
1037	STAM_COUNTER_INC(&pStats->StatHlt);
1038	break;
1039	default:
1040	STAM_COUNTER_INC(&pStats->StatMisc);
1041	Log4(("emR3RawPrivileged: opcode=%d\n", Cpu.pCurInstr->opcode));
1042	break;
1043	}
1044	#endif /* VBOX_WITH_STATISTICS */
1045	if ( (pCtx->ss & X86_SEL_RPL) == 0
1046	&& !pCtx->eflags.Bits.u1VM
1047	&& SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid) == CPUMODE_32BIT)
1048	{
1049	uint32_t size;
1050
1051	STAM_PROFILE_START(&pVCpu->em.s.StatPrivEmu, a);
1052	switch (Cpu.pCurInstr->opcode)
1053	{
1054	case OP_CLI:
1055	pCtx->eflags.u32 &= ~X86_EFL_IF;
1056	Assert(Cpu.opsize == 1);
1057	pCtx->rip += Cpu.opsize;
1058	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1059	return VINF_EM_RESCHEDULE_REM; /* must go to the recompiler now! */
1060
1061	case OP_STI:
1062	pCtx->eflags.u32 \|= X86_EFL_IF;
1063	EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + Cpu.opsize);
1064	Assert(Cpu.opsize == 1);
1065	pCtx->rip += Cpu.opsize;
1066	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1067	return VINF_SUCCESS;
1068
1069	case OP_HLT:
1070	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1071	{
1072	PATMTRANSSTATE enmState;
1073	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->eip, &enmState);
1074
1075	if (enmState == PATMTRANS_OVERWRITTEN)
1076	{
1077	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1078	Assert(rc == VERR_PATCH_DISABLED);
1079	/* Conflict detected, patch disabled */
1080	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %08RX32\n", pCtx->eip));
1081
1082	enmState = PATMTRANS_SAFE;
1083	}
1084
1085	/* The translation had better be successful. Otherwise we can't recover. */
1086	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %08RX32\n", pCtx->eip));
1087	if (enmState != PATMTRANS_OVERWRITTEN)
1088	pCtx->eip = pOrgInstrGC;
1089	}
1090	/* no break; we could just return VINF_EM_HALT here */
1091
1092	case OP_MOV_CR:
1093	case OP_MOV_DR:
1094	#ifdef LOG_ENABLED
1095	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1096	{
1097	DBGFR3InfoLog(pVM, "cpumguest", "PRIV");
1098	DBGFR3DisasInstrCurrentLog(pVCpu, "Privileged instr: ");
1099	}
1100	#endif
1101
1102	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionCPU(pVM, pVCpu, &Cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR, &size));
1103	if (RT_SUCCESS(rc))
1104	{
1105	pCtx->rip += Cpu.opsize;
1106	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1107
1108	if ( Cpu.pCurInstr->opcode == OP_MOV_CR
1109	&& Cpu.param1.flags == USE_REG_CR /* write */
1110	)
1111	{
1112	/* Deal with CR0 updates inside patch code that force
1113	* us to go to the recompiler.
1114	*/
1115	if ( PATMIsPatchGCAddr(pVM, pCtx->rip)
1116	&& (pCtx->cr0 & (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE)) != (X86_CR0_WP\|X86_CR0_PG\|X86_CR0_PE))
1117	{
1118	PATMTRANSSTATE enmState;
1119	RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->rip, &enmState);
1120
1121	Log(("Force recompiler switch due to cr0 (%RGp) update rip=%RGv -> %RGv (enmState=%d)\n", pCtx->cr0, pCtx->rip, pOrgInstrGC, enmState));
1122	if (enmState == PATMTRANS_OVERWRITTEN)
1123	{
1124	rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1125	Assert(rc == VERR_PATCH_DISABLED);
1126	/* Conflict detected, patch disabled */
1127	Log(("emR3RawPrivileged: detected conflict -> disabled patch at %RGv\n", (RTGCPTR)pCtx->rip));
1128	enmState = PATMTRANS_SAFE;
1129	}
1130	/* The translation had better be successful. Otherwise we can't recover. */
1131	AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %RGv\n", (RTGCPTR)pCtx->rip));
1132	if (enmState != PATMTRANS_OVERWRITTEN)
1133	pCtx->rip = pOrgInstrGC;
1134	}
1135
1136	/* Reschedule is necessary as the execution/paging mode might have changed. */
1137	return VINF_EM_RESCHEDULE;
1138	}
1139	return rc; /* can return VINF_EM_HALT as well. */
1140	}
1141	AssertMsgReturn(rc == VERR_EM_INTERPRETER, ("%Rrc\n", rc), rc);
1142	break; /* fall back to the recompiler */
1143	}
1144	STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1145	}
1146	}
1147
1148	if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1149	return emR3PatchTrap(pVM, pVCpu, pCtx, VINF_PATM_PATCH_TRAP_GP);
1150
1151	return emR3ExecuteInstruction(pVM, pVCpu, "PRIV");
1152	}
1153
1154
1155	/**
1156	* Update the forced rawmode execution modifier.
1157	*
1158	* This function is called when we're returning from the raw-mode loop(s). If we're
1159	* in patch code, it will set a flag forcing execution to be resumed in raw-mode,
1160	* if not in patch code, the flag will be cleared.
1161	*
1162	* We should never interrupt patch code while it's being executed. Cli patches can
1163	* contain big code blocks, but they are always executed with IF=0. Other patches
1164	* replace single instructions and should be atomic.
1165	*
1166	* @returns Updated rc.
1167	*
1168	* @param pVM The VM handle.
1169	* @param pVCpu The VMCPU handle.
1170	* @param pCtx The guest CPU context.
1171	* @param rc The result code.
1172	*/
1173	int emR3RawUpdateForceFlag(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int rc)
1174	{
1175	if (PATMIsPatchGCAddr(pVM, pCtx->eip)) /** @todo check cs selector base/type */
1176	{
1177	/* ignore reschedule attempts. */
1178	switch (rc)
1179	{
1180	case VINF_EM_RESCHEDULE:
1181	case VINF_EM_RESCHEDULE_REM:
1182	LogFlow(("emR3RawUpdateForceFlag: patch address -> force raw reschedule\n"));
1183	rc = VINF_SUCCESS;
1184	break;
1185	}
1186	pVCpu->em.s.fForceRAW = true;
1187	}
1188	else
1189	pVCpu->em.s.fForceRAW = false;
1190	return rc;
1191	}
1192
1193
1194	/**
1195	* Check for pending raw actions
1196	*
1197	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1198	* EM statuses.
1199	* @param pVM The VM to operate on.
1200	* @param pVCpu The VMCPU handle.
1201	*/
1202	VMMR3DECL(int) EMR3CheckRawForcedActions(PVM pVM, PVMCPU pVCpu)
1203	{
1204	int rc = emR3RawForcedActions(pVM, pVCpu, pVCpu->em.s.pCtx);
1205	VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1206	return rc;
1207	}
1208
1209
1210	/**
1211	* Process raw-mode specific forced actions.
1212	*
1213	* This function is called when any FFs in the VM_FF_HIGH_PRIORITY_PRE_RAW_MASK is pending.
1214	*
1215	* @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1216	* EM statuses.
1217	* @param pVM The VM handle.
1218	* @param pVCpu The VMCPU handle.
1219	* @param pCtx The guest CPUM register context.
1220	*/
1221	static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1222	{
1223	/*
1224	* Note that the order is vitally important!
1225	* Also note that SELMR3UpdateFromCPUM may trigger VM_FF_SELM_SYNC_TSS.
1226	*/
1227	VBOXVMM_EM_FF_RAW(pVCpu, pVM->fGlobalForcedActions, pVCpu->fLocalForcedActions);
1228
1229	/*
1230	* Sync selector tables.
1231	*/
1232	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT))
1233	{
1234	int rc = SELMR3UpdateFromCPUM(pVM, pVCpu);
1235	if (RT_FAILURE(rc))
1236	return rc;
1237	}
1238
1239	/*
1240	* Sync IDT.
1241	*
1242	* The CSAMR3CheckGates call in TRPMR3SyncIDT may call PGMPrefetchPage
1243	* and PGMShwModifyPage, so we're in for trouble if for instance a
1244	* PGMSyncCR3+pgmR3PoolClearAll is pending.
1245	*/
1246	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
1247	{
1248	if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3)
1249	&& EMIsRawRing0Enabled(pVM)
1250	&& CSAMIsEnabled(pVM))
1251	{
1252	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1253	if (RT_FAILURE(rc))
1254	return rc;
1255	}
1256
1257	int rc = TRPMR3SyncIDT(pVM, pVCpu);
1258	if (RT_FAILURE(rc))
1259	return rc;
1260	}
1261
1262	/*
1263	* Sync TSS.
1264	*/
1265	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1266	{
1267	int rc = SELMR3SyncTSS(pVM, pVCpu);
1268	if (RT_FAILURE(rc))
1269	return rc;
1270	}
1271
1272	/*
1273	* Sync page directory.
1274	*/
1275	if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1276	{
1277	Assert(pVCpu->em.s.enmState != EMSTATE_WAIT_SIPI);
1278	int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1279	if (RT_FAILURE(rc))
1280	return rc;
1281
1282	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1283
1284	/* Prefetch pages for EIP and ESP. */
1285	/** @todo This is rather expensive. Should investigate if it really helps at all. */
1286	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_CS, CPUMCTX2CORE(pCtx), pCtx->rip));
1287	if (rc == VINF_SUCCESS)
1288	rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), pCtx->rsp));
1289	if (rc != VINF_SUCCESS)
1290	{
1291	if (rc != VINF_PGM_SYNC_CR3)
1292	{
1293	AssertLogRelMsgReturn(RT_FAILURE(rc), ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
1294	return rc;
1295	}
1296	rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1297	if (RT_FAILURE(rc))
1298	return rc;
1299	}
1300	/** @todo maybe prefetch the supervisor stack page as well */
1301	Assert(!VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT));
1302	}
1303
1304	/*
1305	* Allocate handy pages (just in case the above actions have consumed some pages).
1306	*/
1307	if (VM_FF_IS_PENDING_EXCEPT(pVM, VM_FF_PGM_NEED_HANDY_PAGES, VM_FF_PGM_NO_MEMORY))
1308	{
1309	int rc = PGMR3PhysAllocateHandyPages(pVM);
1310	if (RT_FAILURE(rc))
1311	return rc;
1312	}
1313
1314	/*
1315	* Check whether we're out of memory now.
1316	*
1317	* This may stem from some of the above actions or operations that has been executed
1318	* since we ran FFs. The allocate handy pages must for instance always be followed by
1319	* this check.
1320	*/
1321	if (VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY))
1322	return VINF_EM_NO_MEMORY;
1323
1324	return VINF_SUCCESS;
1325	}
1326
1327
1328	/**
1329	* Executes raw code.
1330	*
1331	* This function contains the raw-mode version of the inner
1332	* execution loop (the outer loop being in EMR3ExecuteVM()).
1333	*
1334	* @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
1335	* VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
1336	*
1337	* @param pVM VM handle.
1338	* @param pVCpu VMCPU handle.
1339	* @param pfFFDone Where to store an indicator telling whether or not
1340	* FFs were done before returning.
1341	*/
1342	int emR3RawExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)
1343	{
1344	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTotal, a);
1345
1346	int rc = VERR_IPE_UNINITIALIZED_STATUS;
1347	PCPUMCTX pCtx = pVCpu->em.s.pCtx;
1348	LogFlow(("emR3RawExecute: (cs:eip=%04x:%08x)\n", pCtx->cs, pCtx->eip));
1349	pVCpu->em.s.fForceRAW = false;
1350	*pfFFDone = false;
1351
1352
1353	/*
1354	*
1355	* Spin till we get a forced action or raw mode status code resulting in
1356	* in anything but VINF_SUCCESS or VINF_EM_RESCHEDULE_RAW.
1357	*
1358	*/
1359	for (;;)
1360	{
1361	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWEntry, b);
1362
1363	/*
1364	* Check various preconditions.
1365	*/
1366	#ifdef VBOX_STRICT
1367	# ifdef VBOX_WITH_REM
1368	Assert(REMR3QueryPendingInterrupt(pVM, pVCpu) == REM_NO_PENDING_IRQ);
1369	# endif
1370	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) == 3 \|\| (pCtx->ss & X86_SEL_RPL) == 0);
1371	AssertMsg( (pCtx->eflags.u32 & X86_EFL_IF)
1372	\|\| PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip),
1373	("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
1374	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1375	&& PGMMapHasConflicts(pVM))
1376	{
1377	PGMMapCheck(pVM);
1378	AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
1379	return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1380	}
1381	#endif /* VBOX_STRICT */
1382
1383	/*
1384	* Process high priority pre-execution raw-mode FFs.
1385	*/
1386	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1387	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1388	{
1389	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1390	VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1391	if (rc != VINF_SUCCESS)
1392	break;
1393	}
1394
1395	/*
1396	* If we're going to execute ring-0 code, the guest state needs to
1397	* be modified a bit and some of the state components (IF, SS/CS RPL,
1398	* and perhaps EIP) needs to be stored with PATM.
1399	*/
1400	rc = CPUMR3RawEnter(pVCpu, NULL);
1401	if (rc != VINF_SUCCESS)
1402	{
1403	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1404	break;
1405	}
1406
1407	/*
1408	* Scan code before executing it. Don't bother with user mode or V86 code
1409	*/
1410	if ( (pCtx->ss & X86_SEL_RPL) <= 1
1411	&& !pCtx->eflags.Bits.u1VM
1412	&& !PATMIsPatchGCAddr(pVM, pCtx->eip))
1413	{
1414	STAM_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWEntry, b);
1415	CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
1416	STAM_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWEntry, b);
1417	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1418	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1419	{
1420	rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1421	VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1422	if (rc != VINF_SUCCESS)
1423	{
1424	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1425	break;
1426	}
1427	}
1428	}
1429
1430	#ifdef LOG_ENABLED
1431	/*
1432	* Log important stuff before entering GC.
1433	*/
1434	PPATMGCSTATE pGCState = PATMR3QueryGCStateHC(pVM);
1435	if (pCtx->eflags.Bits.u1VM)
1436	Log(("RV86: %04X:%08X IF=%d VMFlags=%x\n", pCtx->cs, pCtx->eip, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1437	else if ((pCtx->ss & X86_SEL_RPL) == 1)
1438	{
1439	bool fCSAMScanned = CSAMIsPageScanned(pVM, (RTGCPTR)pCtx->eip);
1440	Log(("RR0: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d (Scanned=%d)\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL), fCSAMScanned));
1441	}
1442	else if ((pCtx->ss & X86_SEL_RPL) == 3)
1443	Log(("RR3: %08X ESP=%08X IF=%d VMFlags=%x\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1444	#endif /* LOG_ENABLED */
1445
1446
1447
1448	/*
1449	* Execute the code.
1450	*/
1451	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1452	if (RT_LIKELY(EMR3IsExecutionAllowed(pVM, pVCpu)))
1453	{
1454	STAM_PROFILE_START(&pVCpu->em.s.StatRAWExec, c);
1455	VBOXVMM_EM_RAW_RUN_PRE(pVCpu, pCtx);
1456	rc = VMMR3RawRunGC(pVM, pVCpu);
1457	VBOXVMM_EM_RAW_RUN_RET(pVCpu, pCtx, rc);
1458	STAM_PROFILE_STOP(&pVCpu->em.s.StatRAWExec, c);
1459	}
1460	else
1461	{
1462	/* Give up this time slice; virtual time continues */
1463	STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatCapped, u);
1464	RTThreadSleep(5);
1465	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatCapped, u);
1466	rc = VINF_SUCCESS;
1467	}
1468	STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTail, d);
1469
1470	LogFlow(("RR0-E: %08X ESP=%08X IF=%d VMFlags=%x PIF=%d CPL=%d\n", pCtx->eip, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss & X86_SEL_RPL)));
1471	LogFlow(("VMMR3RawRunGC returned %Rrc\n", rc));
1472
1473
1474
1475	/*
1476	* Restore the real CPU state and deal with high priority post
1477	* execution FFs before doing anything else.
1478	*/
1479	rc = CPUMR3RawLeave(pVCpu, NULL, rc);
1480	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
1481	if ( VM_FF_ISPENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK)
1482	\|\| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_MASK))
1483	rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
1484
1485	#ifdef VBOX_STRICT
1486	/*
1487	* Assert TSS consistency & rc vs patch code.
1488	*/
1489	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_SELM_SYNC_GDT) /* GDT implies TSS at the moment. */
1490	&& EMIsRawRing0Enabled(pVM))
1491	SELMR3CheckTSS(pVM);
1492	switch (rc)
1493	{
1494	case VINF_SUCCESS:
1495	case VINF_EM_RAW_INTERRUPT:
1496	case VINF_PATM_PATCH_TRAP_PF:
1497	case VINF_PATM_PATCH_TRAP_GP:
1498	case VINF_PATM_PATCH_INT3:
1499	case VINF_PATM_CHECK_PATCH_PAGE:
1500	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1501	case VINF_EM_RAW_GUEST_TRAP:
1502	case VINF_EM_RESCHEDULE_RAW:
1503	break;
1504
1505	default:
1506	if (PATMIsPatchGCAddr(pVM, pCtx->eip) && !(pCtx->eflags.u32 & X86_EFL_TF))
1507	LogIt(NULL, 0, LOG_GROUP_PATM, ("Patch code interrupted at %RRv for reason %Rrc\n", (RTRCPTR)CPUMGetGuestEIP(pVCpu), rc));
1508	break;
1509	}
1510	/*
1511	* Let's go paranoid!
1512	*/
1513	if ( !VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1514	&& PGMMapHasConflicts(pVM))
1515	{
1516	PGMMapCheck(pVM);
1517	AssertMsgFailed(("We should not get conflicts any longer!!! rc=%Rrc\n", rc));
1518	return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1519	}
1520	#endif /* VBOX_STRICT */
1521
1522	/*
1523	* Process the returned status code.
1524	*/
1525	if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
1526	{
1527	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1528	break;
1529	}
1530	rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
1531	if (rc != VINF_SUCCESS)
1532	{
1533	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1534	if (rc != VINF_SUCCESS)
1535	{
1536	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1537	break;
1538	}
1539	}
1540
1541	/*
1542	* Check and execute forced actions.
1543	*/
1544	#ifdef VBOX_HIGH_RES_TIMERS_HACK
1545	TMTimerPollVoid(pVM, pVCpu);
1546	#endif
1547	STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1548	if ( VM_FF_ISPENDING(pVM, ~VM_FF_HIGH_PRIORITY_PRE_RAW_MASK \| VM_FF_PGM_NO_MEMORY)
1549	\|\| VMCPU_FF_ISPENDING(pVCpu, ~VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1550	{
1551	Assert(pCtx->eflags.Bits.u1VM \|\| (pCtx->ss & X86_SEL_RPL) != 1);
1552
1553	STAM_REL_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWTotal, a);
1554	rc = emR3ForcedActions(pVM, pVCpu, rc);
1555	VBOXVMM_EM_FF_ALL_RET(pVCpu, rc);
1556	STAM_REL_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWTotal, a);
1557	if ( rc != VINF_SUCCESS
1558	&& rc != VINF_EM_RESCHEDULE_RAW)
1559	{
1560	rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1561	if (rc != VINF_SUCCESS)
1562	{
1563	*pfFFDone = true;
1564	break;
1565	}
1566	}
1567	}
1568	}
1569
1570	/*
1571	* Return to outer loop.
1572	*/
1573	#if defined(LOG_ENABLED) && defined(DEBUG)
1574	RTLogFlush(NULL);
1575	#endif
1576	STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTotal, a);
1577	return rc;
1578	}
1579

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/EMRaw.cpp@ 40377

Download in other formats: