VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/SELM.cpp@ 42371

Last change on this file since 42371 was 42371, checked in by vboxsync, 12 years ago

SELM.cpp: Drop the conditional tracing of TSS, GDT and LDT - we require the tracing now.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 101.5 KB
Line 
1/* $Id: SELM.cpp 42371 2012-07-24 19:34:46Z vboxsync $ */
2/** @file
3 * SELM - The Selector Manager.
4 */
5
6/*
7 * Copyright (C) 2006-2012 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/** @page pg_selm SELM - The Selector Manager
19 *
20 * SELM takes care of GDT, LDT and TSS shadowing in raw-mode, and the injection
21 * of a few hyper selector for the raw-mode context. In the hardware assisted
22 * virtualization mode its only task is to decode entries in the guest GDT or
23 * LDT once in a while.
24 *
25 * @see grp_selm
26 *
27 *
28 * @section seg_selm_shadowing Shadowing
29 *
30 * SELMR3UpdateFromCPUM() and SELMR3SyncTSS() does the bulk synchronization
31 * work. The three structures (GDT, LDT, TSS) are all shadowed wholesale atm.
32 * The idea is to do it in a more on-demand fashion when we get time. There
33 * also a whole bunch of issues with the current synchronization of all three
34 * tables, see notes and todos in the code.
35 *
36 * When the guest makes changes to the GDT we will try update the shadow copy
37 * without involving SELMR3UpdateFromCPUM(), see selmGCSyncGDTEntry().
38 *
39 * When the guest make LDT changes we'll trigger a full resync of the LDT
40 * (SELMR3UpdateFromCPUM()), which, needless to say, isn't optimal.
41 *
42 * The TSS shadowing is limited to the fields we need to care about, namely SS0
43 * and ESP0. The Patch Manager makes use of these. We monitor updates to the
44 * guest TSS and will try keep our SS0 and ESP0 copies up to date this way
45 * rather than go the SELMR3SyncTSS() route.
46 *
47 * When in raw-mode SELM also injects a few extra GDT selectors which are used
48 * by the raw-mode (hyper) context. These start their life at the high end of
49 * the table and will be relocated when the guest tries to make use of them...
50 * Well, that was that idea at least, only the code isn't quite there yet which
51 * is why we have trouble with guests which actually have a full sized GDT.
52 *
53 * So, the summary of the current GDT, LDT and TSS shadowing is that there is a
54 * lot of relatively simple and enjoyable work to be done, see @bugref{3267}.
55 *
56 */
57
58/*******************************************************************************
59* Header Files *
60*******************************************************************************/
61#define LOG_GROUP LOG_GROUP_SELM
62#include <VBox/vmm/selm.h>
63#include <VBox/vmm/cpum.h>
64#include <VBox/vmm/stam.h>
65#include <VBox/vmm/mm.h>
66#include <VBox/vmm/ssm.h>
67#include <VBox/vmm/pgm.h>
68#include <VBox/vmm/trpm.h>
69#include <VBox/vmm/dbgf.h>
70#include "SELMInternal.h"
71#include <VBox/vmm/vm.h>
72#include <VBox/err.h>
73#include <VBox/param.h>
74
75#include <iprt/assert.h>
76#include <VBox/log.h>
77#include <iprt/asm.h>
78#include <iprt/string.h>
79#include <iprt/thread.h>
80#include <iprt/string.h>
81
82
83/**
84 * Enable or disable tracking of Shadow GDT/LDT/TSS.
85 * @{
86 */
87#define SELM_TRACK_SHADOW_GDT_CHANGES
88#define SELM_TRACK_SHADOW_LDT_CHANGES
89#define SELM_TRACK_SHADOW_TSS_CHANGES
90/** @} */
91
92
93/** SELM saved state version. */
94#define SELM_SAVED_STATE_VERSION 5
95
96
97/*******************************************************************************
98* Internal Functions *
99*******************************************************************************/
100static DECLCALLBACK(int) selmR3Save(PVM pVM, PSSMHANDLE pSSM);
101static DECLCALLBACK(int) selmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
102static DECLCALLBACK(int) selmR3LoadDone(PVM pVM, PSSMHANDLE pSSM);
103static DECLCALLBACK(int) selmR3GuestGDTWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
104static DECLCALLBACK(int) selmR3GuestLDTWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
105static DECLCALLBACK(int) selmR3GuestTSSWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
106static DECLCALLBACK(void) selmR3InfoGdt(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
107static DECLCALLBACK(void) selmR3InfoGdtGuest(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
108static DECLCALLBACK(void) selmR3InfoLdt(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
109static DECLCALLBACK(void) selmR3InfoLdtGuest(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
110//static DECLCALLBACK(void) selmR3InfoTss(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
111//static DECLCALLBACK(void) selmR3InfoTssGuest(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs);
112
113
114
115/**
116 * Initializes the SELM.
117 *
118 * @returns VBox status code.
119 * @param pVM Pointer to the VM.
120 */
121VMMR3DECL(int) SELMR3Init(PVM pVM)
122{
123 LogFlow(("SELMR3Init\n"));
124
125 /*
126 * Assert alignment and sizes.
127 * (The TSS block requires contiguous back.)
128 */
129 AssertCompile(sizeof(pVM->selm.s) <= sizeof(pVM->selm.padding)); AssertRelease(sizeof(pVM->selm.s) <= sizeof(pVM->selm.padding));
130 AssertCompileMemberAlignment(VM, selm.s, 32); AssertRelease(!(RT_OFFSETOF(VM, selm.s) & 31));
131#if 0 /* doesn't work */
132 AssertCompile((RT_OFFSETOF(VM, selm.s.Tss) & PAGE_OFFSET_MASK) <= PAGE_SIZE - sizeof(pVM->selm.s.Tss));
133 AssertCompile((RT_OFFSETOF(VM, selm.s.TssTrap08) & PAGE_OFFSET_MASK) <= PAGE_SIZE - sizeof(pVM->selm.s.TssTrap08));
134#endif
135 AssertRelease((RT_OFFSETOF(VM, selm.s.Tss) & PAGE_OFFSET_MASK) <= PAGE_SIZE - sizeof(pVM->selm.s.Tss));
136 AssertRelease((RT_OFFSETOF(VM, selm.s.TssTrap08) & PAGE_OFFSET_MASK) <= PAGE_SIZE - sizeof(pVM->selm.s.TssTrap08));
137 AssertRelease(sizeof(pVM->selm.s.Tss.IntRedirBitmap) == 0x20);
138
139 /*
140 * Init the structure.
141 */
142 pVM->selm.s.offVM = RT_OFFSETOF(VM, selm);
143 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] = (SELM_GDT_ELEMENTS - 0x1) << 3;
144 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] = (SELM_GDT_ELEMENTS - 0x2) << 3;
145 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] = (SELM_GDT_ELEMENTS - 0x3) << 3;
146 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] = (SELM_GDT_ELEMENTS - 0x4) << 3;
147 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] = (SELM_GDT_ELEMENTS - 0x5) << 3;
148
149 /*
150 * Allocate GDT table.
151 */
152 int rc = MMR3HyperAllocOnceNoRel(pVM, sizeof(pVM->selm.s.paGdtR3[0]) * SELM_GDT_ELEMENTS,
153 PAGE_SIZE, MM_TAG_SELM, (void **)&pVM->selm.s.paGdtR3);
154 AssertRCReturn(rc, rc);
155
156 /*
157 * Allocate LDT area.
158 */
159 rc = MMR3HyperAllocOnceNoRel(pVM, _64K + PAGE_SIZE, PAGE_SIZE, MM_TAG_SELM, &pVM->selm.s.pvLdtR3);
160 AssertRCReturn(rc, rc);
161
162 /*
163 * Init Guest's and Shadow GDT, LDT, TSS changes control variables.
164 */
165 pVM->selm.s.cbEffGuestGdtLimit = 0;
166 pVM->selm.s.GuestGdtr.pGdt = RTRCPTR_MAX;
167 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
168 pVM->selm.s.GCPtrGuestTss = RTRCPTR_MAX;
169
170 pVM->selm.s.paGdtRC = NIL_RTRCPTR; /* Must be set in SELMR3Relocate because of monitoring. */
171 pVM->selm.s.pvLdtRC = RTRCPTR_MAX;
172 pVM->selm.s.pvMonShwTssRC = RTRCPTR_MAX;
173 pVM->selm.s.GCSelTss = RTSEL_MAX;
174
175 pVM->selm.s.fDisableMonitoring = false;
176 pVM->selm.s.fSyncTSSRing0Stack = false;
177
178 /* The I/O bitmap starts right after the virtual interrupt redirection bitmap. Outside the TSS on purpose; the CPU will not check it
179 * for I/O operations. */
180 pVM->selm.s.Tss.offIoBitmap = sizeof(VBOXTSS);
181 /* bit set to 1 means no redirection */
182 memset(pVM->selm.s.Tss.IntRedirBitmap, 0xff, sizeof(pVM->selm.s.Tss.IntRedirBitmap));
183
184 /*
185 * Register the saved state data unit.
186 */
187 rc = SSMR3RegisterInternal(pVM, "selm", 1, SELM_SAVED_STATE_VERSION, sizeof(SELM),
188 NULL, NULL, NULL,
189 NULL, selmR3Save, NULL,
190 NULL, selmR3Load, selmR3LoadDone);
191 if (RT_FAILURE(rc))
192 return rc;
193
194 /*
195 * Statistics.
196 */
197 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestGDTHandled, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/GDTInt", STAMUNIT_OCCURENCES, "The number of handled writes to the Guest GDT.");
198 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestGDTUnhandled, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/GDTEmu", STAMUNIT_OCCURENCES, "The number of unhandled writes to the Guest GDT.");
199 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestLDT, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/LDT", STAMUNIT_OCCURENCES, "The number of writes to the Guest LDT was detected.");
200 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestTSSHandled, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/TSSInt", STAMUNIT_OCCURENCES, "The number of handled writes to the Guest TSS.");
201 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestTSSRedir, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/TSSRedir",STAMUNIT_OCCURENCES, "The number of handled redir bitmap writes to the Guest TSS.");
202 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestTSSHandledChanged,STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/TSSIntChg", STAMUNIT_OCCURENCES, "The number of handled writes to the Guest TSS where the R0 stack changed.");
203 STAM_REG(pVM, &pVM->selm.s.StatRCWriteGuestTSSUnhandled, STAMTYPE_COUNTER, "/SELM/GC/Write/Guest/TSSEmu", STAMUNIT_OCCURENCES, "The number of unhandled writes to the Guest TSS.");
204 STAM_REG(pVM, &pVM->selm.s.StatTSSSync, STAMTYPE_PROFILE, "/PROF/SELM/TSSSync", STAMUNIT_TICKS_PER_CALL, "Profiling of the SELMR3SyncTSS() body.");
205 STAM_REG(pVM, &pVM->selm.s.StatUpdateFromCPUM, STAMTYPE_PROFILE, "/PROF/SELM/UpdateFromCPUM", STAMUNIT_TICKS_PER_CALL, "Profiling of the SELMR3UpdateFromCPUM() body.");
206
207 STAM_REG(pVM, &pVM->selm.s.StatHyperSelsChanged, STAMTYPE_COUNTER, "/SELM/HyperSels/Changed", STAMUNIT_OCCURENCES, "The number of times we had to relocate our hypervisor selectors.");
208 STAM_REG(pVM, &pVM->selm.s.StatScanForHyperSels, STAMTYPE_COUNTER, "/SELM/HyperSels/Scan", STAMUNIT_OCCURENCES, "The number of times we had find free hypervisor selectors.");
209
210 /*
211 * Default action when entering raw mode for the first time
212 */
213 PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies on VCPU */
214 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
215 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
216 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
217
218 /*
219 * Register info handlers.
220 */
221 DBGFR3InfoRegisterInternal(pVM, "gdt", "Displays the shadow GDT. No arguments.", &selmR3InfoGdt);
222 DBGFR3InfoRegisterInternal(pVM, "gdtguest", "Displays the guest GDT. No arguments.", &selmR3InfoGdtGuest);
223 DBGFR3InfoRegisterInternal(pVM, "ldt", "Displays the shadow LDT. No arguments.", &selmR3InfoLdt);
224 DBGFR3InfoRegisterInternal(pVM, "ldtguest", "Displays the guest LDT. No arguments.", &selmR3InfoLdtGuest);
225 //DBGFR3InfoRegisterInternal(pVM, "tss", "Displays the shadow TSS. No arguments.", &selmR3InfoTss);
226 //DBGFR3InfoRegisterInternal(pVM, "tssguest", "Displays the guest TSS. No arguments.", &selmR3InfoTssGuest);
227
228 return rc;
229}
230
231
232/**
233 * Finalizes HMA page attributes.
234 *
235 * @returns VBox status code.
236 * @param pVM Pointer to the VM.
237 */
238VMMR3DECL(int) SELMR3InitFinalize(PVM pVM)
239{
240 /** @cfgm{/DoubleFault,bool,false}
241 * Enables catching of double faults in the raw-mode context VMM code. This can
242 * be used when the triple faults or hangs occur and one suspect an unhandled
243 * double fault. This is not enabled by default because it means making the
244 * hyper selectors writeable for all supervisor code, including the guest's.
245 * The double fault is a task switch and thus requires write access to the GDT
246 * of the TSS (to set it busy), to the old TSS (to store state), and to the Trap
247 * 8 TSS for the back link.
248 */
249 bool f;
250#if defined(DEBUG_bird)
251 int rc = CFGMR3QueryBoolDef(CFGMR3GetRoot(pVM), "DoubleFault", &f, true);
252#else
253 int rc = CFGMR3QueryBoolDef(CFGMR3GetRoot(pVM), "DoubleFault", &f, false);
254#endif
255 AssertLogRelRCReturn(rc, rc);
256 if (f)
257 {
258 PX86DESC paGdt = pVM->selm.s.paGdtR3;
259 rc = PGMMapSetPage(pVM, MMHyperR3ToRC(pVM, &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] >> 3]), sizeof(paGdt[0]),
260 X86_PTE_RW | X86_PTE_P | X86_PTE_A | X86_PTE_D);
261 AssertRC(rc);
262 rc = PGMMapSetPage(pVM, MMHyperR3ToRC(pVM, &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] >> 3]), sizeof(paGdt[0]),
263 X86_PTE_RW | X86_PTE_P | X86_PTE_A | X86_PTE_D);
264 AssertRC(rc);
265 rc = PGMMapSetPage(pVM, VM_RC_ADDR(pVM, &pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS]), sizeof(pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS]),
266 X86_PTE_RW | X86_PTE_P | X86_PTE_A | X86_PTE_D);
267 AssertRC(rc);
268 rc = PGMMapSetPage(pVM, VM_RC_ADDR(pVM, &pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08]), sizeof(pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08]),
269 X86_PTE_RW | X86_PTE_P | X86_PTE_A | X86_PTE_D);
270 AssertRC(rc);
271 }
272 return VINF_SUCCESS;
273}
274
275
276/**
277 * Setup the hypervisor GDT selectors in our shadow table
278 *
279 * @param pVM Pointer to the VM.
280 */
281static void selmR3SetupHyperGDTSelectors(PVM pVM)
282{
283 PX86DESC paGdt = pVM->selm.s.paGdtR3;
284
285 /*
286 * Set up global code and data descriptors for use in the guest context.
287 * Both are wide open (base 0, limit 4GB)
288 */
289 PX86DESC pDesc = &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] >> 3];
290 pDesc->Gen.u16LimitLow = 0xffff;
291 pDesc->Gen.u4LimitHigh = 0xf;
292 pDesc->Gen.u16BaseLow = 0;
293 pDesc->Gen.u8BaseHigh1 = 0;
294 pDesc->Gen.u8BaseHigh2 = 0;
295 pDesc->Gen.u4Type = X86_SEL_TYPE_ER_ACC;
296 pDesc->Gen.u1DescType = 1; /* not system, but code/data */
297 pDesc->Gen.u2Dpl = 0; /* supervisor */
298 pDesc->Gen.u1Present = 1;
299 pDesc->Gen.u1Available = 0;
300 pDesc->Gen.u1Long = 0;
301 pDesc->Gen.u1DefBig = 1; /* def 32 bit */
302 pDesc->Gen.u1Granularity = 1; /* 4KB limit */
303
304 /* data */
305 pDesc = &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] >> 3];
306 pDesc->Gen.u16LimitLow = 0xffff;
307 pDesc->Gen.u4LimitHigh = 0xf;
308 pDesc->Gen.u16BaseLow = 0;
309 pDesc->Gen.u8BaseHigh1 = 0;
310 pDesc->Gen.u8BaseHigh2 = 0;
311 pDesc->Gen.u4Type = X86_SEL_TYPE_RW_ACC;
312 pDesc->Gen.u1DescType = 1; /* not system, but code/data */
313 pDesc->Gen.u2Dpl = 0; /* supervisor */
314 pDesc->Gen.u1Present = 1;
315 pDesc->Gen.u1Available = 0;
316 pDesc->Gen.u1Long = 0;
317 pDesc->Gen.u1DefBig = 1; /* big */
318 pDesc->Gen.u1Granularity = 1; /* 4KB limit */
319
320 /* 64-bit mode code (& data?) */
321 pDesc = &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] >> 3];
322 pDesc->Gen.u16LimitLow = 0xffff;
323 pDesc->Gen.u4LimitHigh = 0xf;
324 pDesc->Gen.u16BaseLow = 0;
325 pDesc->Gen.u8BaseHigh1 = 0;
326 pDesc->Gen.u8BaseHigh2 = 0;
327 pDesc->Gen.u4Type = X86_SEL_TYPE_ER_ACC;
328 pDesc->Gen.u1DescType = 1; /* not system, but code/data */
329 pDesc->Gen.u2Dpl = 0; /* supervisor */
330 pDesc->Gen.u1Present = 1;
331 pDesc->Gen.u1Available = 0;
332 pDesc->Gen.u1Long = 1; /* The Long (L) attribute bit. */
333 pDesc->Gen.u1DefBig = 0; /* With L=1 this must be 0. */
334 pDesc->Gen.u1Granularity = 1; /* 4KB limit */
335
336 /*
337 * TSS descriptor
338 */
339 pDesc = &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] >> 3];
340 RTRCPTR RCPtrTSS = VM_RC_ADDR(pVM, &pVM->selm.s.Tss);
341 pDesc->Gen.u16BaseLow = RT_LOWORD(RCPtrTSS);
342 pDesc->Gen.u8BaseHigh1 = RT_BYTE3(RCPtrTSS);
343 pDesc->Gen.u8BaseHigh2 = RT_BYTE4(RCPtrTSS);
344 pDesc->Gen.u16LimitLow = sizeof(VBOXTSS) - 1;
345 pDesc->Gen.u4LimitHigh = 0;
346 pDesc->Gen.u4Type = X86_SEL_TYPE_SYS_386_TSS_AVAIL;
347 pDesc->Gen.u1DescType = 0; /* system */
348 pDesc->Gen.u2Dpl = 0; /* supervisor */
349 pDesc->Gen.u1Present = 1;
350 pDesc->Gen.u1Available = 0;
351 pDesc->Gen.u1Long = 0;
352 pDesc->Gen.u1DefBig = 0;
353 pDesc->Gen.u1Granularity = 0; /* byte limit */
354
355 /*
356 * TSS descriptor for trap 08
357 */
358 pDesc = &paGdt[pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] >> 3];
359 pDesc->Gen.u16LimitLow = sizeof(VBOXTSS) - 1;
360 pDesc->Gen.u4LimitHigh = 0;
361 RCPtrTSS = VM_RC_ADDR(pVM, &pVM->selm.s.TssTrap08);
362 pDesc->Gen.u16BaseLow = RT_LOWORD(RCPtrTSS);
363 pDesc->Gen.u8BaseHigh1 = RT_BYTE3(RCPtrTSS);
364 pDesc->Gen.u8BaseHigh2 = RT_BYTE4(RCPtrTSS);
365 pDesc->Gen.u4Type = X86_SEL_TYPE_SYS_386_TSS_AVAIL;
366 pDesc->Gen.u1DescType = 0; /* system */
367 pDesc->Gen.u2Dpl = 0; /* supervisor */
368 pDesc->Gen.u1Present = 1;
369 pDesc->Gen.u1Available = 0;
370 pDesc->Gen.u1Long = 0;
371 pDesc->Gen.u1DefBig = 0;
372 pDesc->Gen.u1Granularity = 0; /* byte limit */
373}
374
375/**
376 * Applies relocations to data and code managed by this
377 * component. This function will be called at init and
378 * whenever the VMM need to relocate it self inside the GC.
379 *
380 * @param pVM The VM.
381 */
382VMMR3DECL(void) SELMR3Relocate(PVM pVM)
383{
384 PX86DESC paGdt = pVM->selm.s.paGdtR3;
385 LogFlow(("SELMR3Relocate\n"));
386
387 for (VMCPUID i = 0; i < pVM->cCpus; i++)
388 {
389 PVMCPU pVCpu = &pVM->aCpus[i];
390
391 /*
392 * Update GDTR and selector.
393 */
394 CPUMSetHyperGDTR(pVCpu, MMHyperR3ToRC(pVM, paGdt), SELM_GDT_ELEMENTS * sizeof(paGdt[0]) - 1);
395
396 /** @todo selector relocations should be a separate operation? */
397 CPUMSetHyperCS(pVCpu, pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS]);
398 CPUMSetHyperDS(pVCpu, pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS]);
399 CPUMSetHyperES(pVCpu, pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS]);
400 CPUMSetHyperSS(pVCpu, pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS]);
401 CPUMSetHyperTR(pVCpu, pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS]);
402 }
403
404 selmR3SetupHyperGDTSelectors(pVM);
405
406/** @todo SELM must be called when any of the CR3s changes during a cpu mode change. */
407/** @todo PGM knows the proper CR3 values these days, not CPUM. */
408 /*
409 * Update the TSSes.
410 */
411 /* Only applies to raw mode which supports only 1 VCPU */
412 PVMCPU pVCpu = &pVM->aCpus[0];
413
414 /* Current TSS */
415 pVM->selm.s.Tss.cr3 = PGMGetHyperCR3(pVCpu);
416 pVM->selm.s.Tss.ss0 = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
417 pVM->selm.s.Tss.esp0 = VMMGetStackRC(pVCpu);
418 pVM->selm.s.Tss.cs = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS];
419 pVM->selm.s.Tss.ds = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
420 pVM->selm.s.Tss.es = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
421 pVM->selm.s.Tss.offIoBitmap = sizeof(VBOXTSS);
422
423 /* trap 08 */
424 pVM->selm.s.TssTrap08.cr3 = PGMGetInterRCCR3(pVM, pVCpu); /* this should give use better survival chances. */
425 pVM->selm.s.TssTrap08.ss0 = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
426 pVM->selm.s.TssTrap08.ss = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
427 pVM->selm.s.TssTrap08.esp0 = VMMGetStackRC(pVCpu) - PAGE_SIZE / 2; /* upper half can be analysed this way. */
428 pVM->selm.s.TssTrap08.esp = pVM->selm.s.TssTrap08.esp0;
429 pVM->selm.s.TssTrap08.ebp = pVM->selm.s.TssTrap08.esp0;
430 pVM->selm.s.TssTrap08.cs = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS];
431 pVM->selm.s.TssTrap08.ds = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
432 pVM->selm.s.TssTrap08.es = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS];
433 pVM->selm.s.TssTrap08.fs = 0;
434 pVM->selm.s.TssTrap08.gs = 0;
435 pVM->selm.s.TssTrap08.selLdt = 0;
436 pVM->selm.s.TssTrap08.eflags = 0x2; /* all cleared */
437 pVM->selm.s.TssTrap08.ecx = VM_RC_ADDR(pVM, &pVM->selm.s.Tss); /* setup ecx to normal Hypervisor TSS address. */
438 pVM->selm.s.TssTrap08.edi = pVM->selm.s.TssTrap08.ecx;
439 pVM->selm.s.TssTrap08.eax = pVM->selm.s.TssTrap08.ecx;
440 pVM->selm.s.TssTrap08.edx = VM_RC_ADDR(pVM, pVM); /* setup edx VM address. */
441 pVM->selm.s.TssTrap08.edi = pVM->selm.s.TssTrap08.edx;
442 pVM->selm.s.TssTrap08.ebx = pVM->selm.s.TssTrap08.edx;
443 pVM->selm.s.TssTrap08.offIoBitmap = sizeof(VBOXTSS);
444 /* TRPM will be updating the eip */
445
446 if ( !pVM->selm.s.fDisableMonitoring
447 && !VMMIsHwVirtExtForced(pVM))
448 {
449 /*
450 * Update shadow GDT/LDT/TSS write access handlers.
451 */
452 int rc;
453#ifdef SELM_TRACK_SHADOW_GDT_CHANGES
454 if (pVM->selm.s.paGdtRC != NIL_RTRCPTR)
455 {
456 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.paGdtRC);
457 AssertRC(rc);
458 }
459 pVM->selm.s.paGdtRC = MMHyperR3ToRC(pVM, paGdt);
460 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_HYPERVISOR, pVM->selm.s.paGdtRC,
461 pVM->selm.s.paGdtRC + SELM_GDT_ELEMENTS * sizeof(paGdt[0]) - 1,
462 0, 0, "selmRCShadowGDTWriteHandler", 0, "Shadow GDT write access handler");
463 AssertRC(rc);
464#endif
465#ifdef SELM_TRACK_SHADOW_TSS_CHANGES
466 if (pVM->selm.s.pvMonShwTssRC != RTRCPTR_MAX)
467 {
468 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.pvMonShwTssRC);
469 AssertRC(rc);
470 }
471 pVM->selm.s.pvMonShwTssRC = VM_RC_ADDR(pVM, &pVM->selm.s.Tss);
472 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_HYPERVISOR, pVM->selm.s.pvMonShwTssRC,
473 pVM->selm.s.pvMonShwTssRC + sizeof(pVM->selm.s.Tss) - 1,
474 0, 0, "selmRCShadowTSSWriteHandler", 0, "Shadow TSS write access handler");
475 AssertRC(rc);
476#endif
477
478 /*
479 * Update the GC LDT region handler and address.
480 */
481#ifdef SELM_TRACK_SHADOW_LDT_CHANGES
482 if (pVM->selm.s.pvLdtRC != RTRCPTR_MAX)
483 {
484 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.pvLdtRC);
485 AssertRC(rc);
486 }
487#endif
488 pVM->selm.s.pvLdtRC = MMHyperR3ToRC(pVM, pVM->selm.s.pvLdtR3);
489#ifdef SELM_TRACK_SHADOW_LDT_CHANGES
490 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_HYPERVISOR, pVM->selm.s.pvLdtRC,
491 pVM->selm.s.pvLdtRC + _64K + PAGE_SIZE - 1,
492 0, 0, "selmRCShadowLDTWriteHandler", 0, "Shadow LDT write access handler");
493 AssertRC(rc);
494#endif
495 }
496}
497
498
499/**
500 * Terminates the SELM.
501 *
502 * Termination means cleaning up and freeing all resources,
503 * the VM it self is at this point powered off or suspended.
504 *
505 * @returns VBox status code.
506 * @param pVM Pointer to the VM.
507 */
508VMMR3DECL(int) SELMR3Term(PVM pVM)
509{
510 NOREF(pVM);
511 return 0;
512}
513
514
515/**
516 * The VM is being reset.
517 *
518 * For the SELM component this means that any GDT/LDT/TSS monitors
519 * needs to be removed.
520 *
521 * @param pVM Pointer to the VM.
522 */
523VMMR3DECL(void) SELMR3Reset(PVM pVM)
524{
525 LogFlow(("SELMR3Reset:\n"));
526 VM_ASSERT_EMT(pVM);
527
528 /*
529 * Uninstall guest GDT/LDT/TSS write access handlers.
530 */
531 int rc;
532 if (pVM->selm.s.GuestGdtr.pGdt != RTRCPTR_MAX && pVM->selm.s.fGDTRangeRegistered)
533 {
534 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GuestGdtr.pGdt);
535 AssertRC(rc);
536 pVM->selm.s.GuestGdtr.pGdt = RTRCPTR_MAX;
537 pVM->selm.s.GuestGdtr.cbGdt = 0;
538 }
539 pVM->selm.s.fGDTRangeRegistered = false;
540 if (pVM->selm.s.GCPtrGuestLdt != RTRCPTR_MAX)
541 {
542 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestLdt);
543 AssertRC(rc);
544 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
545 }
546 if (pVM->selm.s.GCPtrGuestTss != RTRCPTR_MAX)
547 {
548 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestTss);
549 AssertRC(rc);
550 pVM->selm.s.GCPtrGuestTss = RTRCPTR_MAX;
551 pVM->selm.s.GCSelTss = RTSEL_MAX;
552 }
553
554 /*
555 * Re-initialize other members.
556 */
557 pVM->selm.s.cbLdtLimit = 0;
558 pVM->selm.s.offLdtHyper = 0;
559 pVM->selm.s.cbMonitoredGuestTss = 0;
560
561 pVM->selm.s.fSyncTSSRing0Stack = false;
562
563 /*
564 * Default action when entering raw mode for the first time
565 */
566 PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies on VCPU */
567 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
568 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
569 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
570}
571
572/**
573 * Disable GDT/LDT/TSS monitoring and syncing
574 *
575 * @param pVM Pointer to the VM.
576 */
577VMMR3DECL(void) SELMR3DisableMonitoring(PVM pVM)
578{
579 /*
580 * Uninstall guest GDT/LDT/TSS write access handlers.
581 */
582 int rc;
583 if (pVM->selm.s.GuestGdtr.pGdt != RTRCPTR_MAX && pVM->selm.s.fGDTRangeRegistered)
584 {
585 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GuestGdtr.pGdt);
586 AssertRC(rc);
587 pVM->selm.s.GuestGdtr.pGdt = RTRCPTR_MAX;
588 pVM->selm.s.GuestGdtr.cbGdt = 0;
589 }
590 pVM->selm.s.fGDTRangeRegistered = false;
591 if (pVM->selm.s.GCPtrGuestLdt != RTRCPTR_MAX)
592 {
593 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestLdt);
594 AssertRC(rc);
595 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
596 }
597 if (pVM->selm.s.GCPtrGuestTss != RTRCPTR_MAX)
598 {
599 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestTss);
600 AssertRC(rc);
601 pVM->selm.s.GCPtrGuestTss = RTRCPTR_MAX;
602 pVM->selm.s.GCSelTss = RTSEL_MAX;
603 }
604
605 /*
606 * Unregister shadow GDT/LDT/TSS write access handlers.
607 */
608#ifdef SELM_TRACK_SHADOW_GDT_CHANGES
609 if (pVM->selm.s.paGdtRC != NIL_RTRCPTR)
610 {
611 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.paGdtRC);
612 AssertRC(rc);
613 pVM->selm.s.paGdtRC = NIL_RTRCPTR;
614 }
615#endif
616#ifdef SELM_TRACK_SHADOW_TSS_CHANGES
617 if (pVM->selm.s.pvMonShwTssRC != RTRCPTR_MAX)
618 {
619 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.pvMonShwTssRC);
620 AssertRC(rc);
621 pVM->selm.s.pvMonShwTssRC = RTRCPTR_MAX;
622 }
623#endif
624#ifdef SELM_TRACK_SHADOW_LDT_CHANGES
625 if (pVM->selm.s.pvLdtRC != RTRCPTR_MAX)
626 {
627 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.pvLdtRC);
628 AssertRC(rc);
629 pVM->selm.s.pvLdtRC = RTRCPTR_MAX;
630 }
631#endif
632
633 PVMCPU pVCpu = &pVM->aCpus[0]; /* raw mode implies on VCPU */
634 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
635 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
636 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
637
638 pVM->selm.s.fDisableMonitoring = true;
639}
640
641
642/**
643 * Execute state save operation.
644 *
645 * @returns VBox status code.
646 * @param pVM Pointer to the VM.
647 * @param pSSM SSM operation handle.
648 */
649static DECLCALLBACK(int) selmR3Save(PVM pVM, PSSMHANDLE pSSM)
650{
651 LogFlow(("selmR3Save:\n"));
652
653 /*
654 * Save the basic bits - fortunately all the other things can be resynced on load.
655 */
656 PSELM pSelm = &pVM->selm.s;
657
658 SSMR3PutBool(pSSM, pSelm->fDisableMonitoring);
659 SSMR3PutBool(pSSM, pSelm->fSyncTSSRing0Stack);
660 SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_CS]);
661 SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_DS]);
662 SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_CS64]);
663 SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_CS64]); /* reserved for DS64. */
664 SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_TSS]);
665 return SSMR3PutSel(pSSM, pSelm->aHyperSel[SELM_HYPER_SEL_TSS_TRAP08]);
666}
667
668
669/**
670 * Execute state load operation.
671 *
672 * @returns VBox status code.
673 * @param pVM Pointer to the VM.
674 * @param pSSM SSM operation handle.
675 * @param uVersion Data layout version.
676 * @param uPass The data pass.
677 */
678static DECLCALLBACK(int) selmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
679{
680 LogFlow(("selmR3Load:\n"));
681 Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
682
683 /*
684 * Validate version.
685 */
686 if (uVersion != SELM_SAVED_STATE_VERSION)
687 {
688 AssertMsgFailed(("selmR3Load: Invalid version uVersion=%d!\n", uVersion));
689 return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
690 }
691
692 /*
693 * Do a reset.
694 */
695 SELMR3Reset(pVM);
696
697 /* Get the monitoring flag. */
698 SSMR3GetBool(pSSM, &pVM->selm.s.fDisableMonitoring);
699
700 /* Get the TSS state flag. */
701 SSMR3GetBool(pSSM, &pVM->selm.s.fSyncTSSRing0Stack);
702
703 /*
704 * Get the selectors.
705 */
706 RTSEL SelCS;
707 SSMR3GetSel(pSSM, &SelCS);
708 RTSEL SelDS;
709 SSMR3GetSel(pSSM, &SelDS);
710 RTSEL SelCS64;
711 SSMR3GetSel(pSSM, &SelCS64);
712 RTSEL SelDS64;
713 SSMR3GetSel(pSSM, &SelDS64);
714 RTSEL SelTSS;
715 SSMR3GetSel(pSSM, &SelTSS);
716 RTSEL SelTSSTrap08;
717 SSMR3GetSel(pSSM, &SelTSSTrap08);
718
719 /* Copy the selectors; they will be checked during relocation. */
720 PSELM pSelm = &pVM->selm.s;
721 pSelm->aHyperSel[SELM_HYPER_SEL_CS] = SelCS;
722 pSelm->aHyperSel[SELM_HYPER_SEL_DS] = SelDS;
723 pSelm->aHyperSel[SELM_HYPER_SEL_CS64] = SelCS64;
724 pSelm->aHyperSel[SELM_HYPER_SEL_TSS] = SelTSS;
725 pSelm->aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] = SelTSSTrap08;
726
727 return VINF_SUCCESS;
728}
729
730
731/**
732 * Sync the GDT, LDT and TSS after loading the state.
733 *
734 * Just to play save, we set the FFs to force syncing before
735 * executing GC code.
736 *
737 * @returns VBox status code.
738 * @param pVM Pointer to the VM.
739 * @param pSSM SSM operation handle.
740 */
741static DECLCALLBACK(int) selmR3LoadDone(PVM pVM, PSSMHANDLE pSSM)
742{
743 PVMCPU pVCpu = VMMGetCpu(pVM);
744
745 LogFlow(("selmR3LoadDone:\n"));
746
747 /*
748 * Don't do anything if it's a load failure.
749 */
750 int rc = SSMR3HandleGetStatus(pSSM);
751 if (RT_FAILURE(rc))
752 return VINF_SUCCESS;
753
754 /*
755 * Do the syncing if we're in protected mode.
756 */
757 if (PGMGetGuestMode(pVCpu) != PGMMODE_REAL)
758 {
759 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
760 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
761 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
762 SELMR3UpdateFromCPUM(pVM, pVCpu);
763 }
764
765 /*
766 * Flag everything for resync on next raw mode entry.
767 */
768 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
769 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
770 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
771
772 return VINF_SUCCESS;
773}
774
775
776/**
777 * Updates the Guest GDT & LDT virtualization based on current CPU state.
778 *
779 * @returns VBox status code.
780 * @param pVM Pointer to the VM.
781 * @param pVCpu Pointer to the VMCPU.
782 */
783VMMR3DECL(int) SELMR3UpdateFromCPUM(PVM pVM, PVMCPU pVCpu)
784{
785 int rc = VINF_SUCCESS;
786
787 if (pVM->selm.s.fDisableMonitoring)
788 {
789 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
790 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
791 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
792
793 return VINF_SUCCESS;
794 }
795
796 STAM_PROFILE_START(&pVM->selm.s.StatUpdateFromCPUM, a);
797
798 /*
799 * GDT sync
800 */
801 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_SELM_SYNC_GDT))
802 {
803 /*
804 * Always assume the best
805 */
806 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
807
808 /* If the GDT was changed, then make sure the LDT is checked too */
809 /** @todo only do this if the actual ldtr selector was changed; this is a bit excessive */
810 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
811 /* Same goes for the TSS selector */
812 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
813
814 /*
815 * Get the GDTR and check if there is anything to do (there usually is).
816 */
817 VBOXGDTR GDTR;
818 CPUMGetGuestGDTR(pVCpu, &GDTR);
819 if (GDTR.cbGdt < sizeof(X86DESC))
820 {
821 Log(("No GDT entries...\n"));
822 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
823 return VINF_SUCCESS;
824 }
825
826 /*
827 * Read the Guest GDT.
828 * ASSUMES that the entire GDT is in memory.
829 */
830 RTUINT cbEffLimit = GDTR.cbGdt;
831 PX86DESC pGDTE = &pVM->selm.s.paGdtR3[1];
832 rc = PGMPhysSimpleReadGCPtr(pVCpu, pGDTE, GDTR.pGdt + sizeof(X86DESC), cbEffLimit + 1 - sizeof(X86DESC));
833 if (RT_FAILURE(rc))
834 {
835 /*
836 * Read it page by page.
837 *
838 * Keep track of the last valid page and delay memsets and
839 * adjust cbEffLimit to reflect the effective size. The latter
840 * is something we do in the belief that the guest will probably
841 * never actually commit the last page, thus allowing us to keep
842 * our selectors in the high end of the GDT.
843 */
844 RTUINT cbLeft = cbEffLimit + 1 - sizeof(X86DESC);
845 RTGCPTR GCPtrSrc = (RTGCPTR)GDTR.pGdt + sizeof(X86DESC);
846 uint8_t *pu8Dst = (uint8_t *)&pVM->selm.s.paGdtR3[1];
847 uint8_t *pu8DstInvalid = pu8Dst;
848
849 while (cbLeft)
850 {
851 RTUINT cb = PAGE_SIZE - (GCPtrSrc & PAGE_OFFSET_MASK);
852 cb = RT_MIN(cb, cbLeft);
853 rc = PGMPhysSimpleReadGCPtr(pVCpu, pu8Dst, GCPtrSrc, cb);
854 if (RT_SUCCESS(rc))
855 {
856 if (pu8DstInvalid != pu8Dst)
857 memset(pu8DstInvalid, 0, pu8Dst - pu8DstInvalid);
858 GCPtrSrc += cb;
859 pu8Dst += cb;
860 pu8DstInvalid = pu8Dst;
861 }
862 else if ( rc == VERR_PAGE_NOT_PRESENT
863 || rc == VERR_PAGE_TABLE_NOT_PRESENT)
864 {
865 GCPtrSrc += cb;
866 pu8Dst += cb;
867 }
868 else
869 {
870 AssertReleaseMsgFailed(("Couldn't read GDT at %016RX64, rc=%Rrc!\n", GDTR.pGdt, rc));
871 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
872 return VERR_NOT_IMPLEMENTED;
873 }
874 cbLeft -= cb;
875 }
876
877 /* any invalid pages at the end? */
878 if (pu8DstInvalid != pu8Dst)
879 {
880 cbEffLimit = pu8DstInvalid - (uint8_t *)pVM->selm.s.paGdtR3 - 1;
881 /* If any GDTEs was invalidated, zero them. */
882 if (cbEffLimit < pVM->selm.s.cbEffGuestGdtLimit)
883 memset(pu8DstInvalid + cbEffLimit + 1, 0, pVM->selm.s.cbEffGuestGdtLimit - cbEffLimit);
884 }
885
886 /* keep track of the effective limit. */
887 if (cbEffLimit != pVM->selm.s.cbEffGuestGdtLimit)
888 {
889 Log(("SELMR3UpdateFromCPUM: cbEffGuestGdtLimit=%#x -> %#x (actual %#x)\n",
890 pVM->selm.s.cbEffGuestGdtLimit, cbEffLimit, GDTR.cbGdt));
891 pVM->selm.s.cbEffGuestGdtLimit = cbEffLimit;
892 }
893 }
894
895 /*
896 * Check if the Guest GDT intrudes on our GDT entries.
897 */
898 /** @todo we should try to minimize relocations by making sure our current selectors can be reused. */
899 RTSEL aHyperSel[SELM_HYPER_SEL_MAX];
900 if (cbEffLimit >= SELM_HYPER_DEFAULT_BASE)
901 {
902 PX86DESC pGDTEStart = pVM->selm.s.paGdtR3;
903 PX86DESC pGDTECur = (PX86DESC)((char *)pGDTEStart + GDTR.cbGdt + 1 - sizeof(X86DESC));
904 int iGDT = 0;
905
906 Log(("Internal SELM GDT conflict: use non-present entries\n"));
907 STAM_COUNTER_INC(&pVM->selm.s.StatScanForHyperSels);
908 while (pGDTECur > pGDTEStart)
909 {
910 /* We can reuse non-present entries */
911 if (!pGDTECur->Gen.u1Present)
912 {
913 aHyperSel[iGDT] = ((uintptr_t)pGDTECur - (uintptr_t)pVM->selm.s.paGdtR3) / sizeof(X86DESC);
914 aHyperSel[iGDT] = aHyperSel[iGDT] << X86_SEL_SHIFT;
915 Log(("SELM: Found unused GDT %04X\n", aHyperSel[iGDT]));
916 iGDT++;
917 if (iGDT >= SELM_HYPER_SEL_MAX)
918 break;
919 }
920
921 pGDTECur--;
922 }
923 if (iGDT != SELM_HYPER_SEL_MAX)
924 {
925 AssertReleaseMsgFailed(("Internal SELM GDT conflict.\n"));
926 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
927 return VERR_NOT_IMPLEMENTED;
928 }
929 }
930 else
931 {
932 aHyperSel[SELM_HYPER_SEL_CS] = SELM_HYPER_DEFAULT_SEL_CS;
933 aHyperSel[SELM_HYPER_SEL_DS] = SELM_HYPER_DEFAULT_SEL_DS;
934 aHyperSel[SELM_HYPER_SEL_CS64] = SELM_HYPER_DEFAULT_SEL_CS64;
935 aHyperSel[SELM_HYPER_SEL_TSS] = SELM_HYPER_DEFAULT_SEL_TSS;
936 aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] = SELM_HYPER_DEFAULT_SEL_TSS_TRAP08;
937 }
938
939 /*
940 * Work thru the copied GDT entries adjusting them for correct virtualization.
941 */
942 PX86DESC pGDTEEnd = (PX86DESC)((char *)pGDTE + cbEffLimit + 1 - sizeof(X86DESC));
943 while (pGDTE < pGDTEEnd)
944 {
945 if (pGDTE->Gen.u1Present)
946 {
947 /*
948 * Code and data selectors are generally 1:1, with the
949 * 'little' adjustment we do for DPL 0 selectors.
950 */
951 if (pGDTE->Gen.u1DescType)
952 {
953 /*
954 * Hack for A-bit against Trap E on read-only GDT.
955 */
956 /** @todo Fix this by loading ds and cs before turning off WP. */
957 pGDTE->Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
958
959 /*
960 * All DPL 0 code and data segments are squeezed into DPL 1.
961 *
962 * We're skipping conforming segments here because those
963 * cannot give us any trouble.
964 */
965 if ( pGDTE->Gen.u2Dpl == 0
966 && (pGDTE->Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
967 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF) )
968 pGDTE->Gen.u2Dpl = 1;
969 }
970 else
971 {
972 /*
973 * System type selectors are marked not present.
974 * Recompiler or special handling is required for these.
975 */
976 /** @todo what about interrupt gates and rawr0? */
977 pGDTE->Gen.u1Present = 0;
978 }
979 }
980
981 /* Next GDT entry. */
982 pGDTE++;
983 }
984
985 /*
986 * Check if our hypervisor selectors were changed.
987 */
988 if ( aHyperSel[SELM_HYPER_SEL_CS] != pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS]
989 || aHyperSel[SELM_HYPER_SEL_DS] != pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS]
990 || aHyperSel[SELM_HYPER_SEL_CS64] != pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64]
991 || aHyperSel[SELM_HYPER_SEL_TSS] != pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS]
992 || aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] != pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08])
993 {
994 /* Reinitialize our hypervisor GDTs */
995 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] = aHyperSel[SELM_HYPER_SEL_CS];
996 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] = aHyperSel[SELM_HYPER_SEL_DS];
997 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] = aHyperSel[SELM_HYPER_SEL_CS64];
998 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] = aHyperSel[SELM_HYPER_SEL_TSS];
999 pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] = aHyperSel[SELM_HYPER_SEL_TSS_TRAP08];
1000
1001 STAM_COUNTER_INC(&pVM->selm.s.StatHyperSelsChanged);
1002
1003 /*
1004 * Do the relocation callbacks to let everyone update their hyper selector dependencies.
1005 * (SELMR3Relocate will call selmR3SetupHyperGDTSelectors() for us.)
1006 */
1007 VMR3Relocate(pVM, 0);
1008 }
1009 else if (cbEffLimit >= SELM_HYPER_DEFAULT_BASE)
1010 /* We overwrote all entries above, so we have to save them again. */
1011 selmR3SetupHyperGDTSelectors(pVM);
1012
1013 /*
1014 * Adjust the cached GDT limit.
1015 * Any GDT entries which have been removed must be cleared.
1016 */
1017 if (pVM->selm.s.GuestGdtr.cbGdt != GDTR.cbGdt)
1018 {
1019 if (pVM->selm.s.GuestGdtr.cbGdt > GDTR.cbGdt)
1020 memset(pGDTE, 0, pVM->selm.s.GuestGdtr.cbGdt - GDTR.cbGdt);
1021 }
1022
1023 /*
1024 * Check if Guest's GDTR is changed.
1025 */
1026 if ( GDTR.pGdt != pVM->selm.s.GuestGdtr.pGdt
1027 || GDTR.cbGdt != pVM->selm.s.GuestGdtr.cbGdt)
1028 {
1029 Log(("SELMR3UpdateFromCPUM: Guest's GDT is changed to pGdt=%016RX64 cbGdt=%08X\n", GDTR.pGdt, GDTR.cbGdt));
1030
1031 /*
1032 * [Re]Register write virtual handler for guest's GDT.
1033 */
1034 if (pVM->selm.s.GuestGdtr.pGdt != RTRCPTR_MAX && pVM->selm.s.fGDTRangeRegistered)
1035 {
1036 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GuestGdtr.pGdt);
1037 AssertRC(rc);
1038 }
1039
1040 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GDTR.pGdt, GDTR.pGdt + GDTR.cbGdt /* already inclusive */,
1041 0, selmR3GuestGDTWriteHandler, "selmRCGuestGDTWriteHandler", 0, "Guest GDT write access handler");
1042 if (RT_FAILURE(rc))
1043 return rc;
1044
1045 /* Update saved Guest GDTR. */
1046 pVM->selm.s.GuestGdtr = GDTR;
1047 pVM->selm.s.fGDTRangeRegistered = true;
1048 }
1049 }
1050
1051 /*
1052 * TSS sync
1053 */
1054 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1055 {
1056 SELMR3SyncTSS(pVM, pVCpu);
1057 }
1058
1059 /*
1060 * LDT sync
1061 */
1062 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_SELM_SYNC_LDT))
1063 {
1064 /*
1065 * Always assume the best
1066 */
1067 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_LDT);
1068
1069 /*
1070 * LDT handling is done similarly to the GDT handling with a shadow
1071 * array. However, since the LDT is expected to be swappable (at least
1072 * some ancient OSes makes it swappable) it must be floating and
1073 * synced on a per-page basis.
1074 *
1075 * Eventually we will change this to be fully on demand. Meaning that
1076 * we will only sync pages containing LDT selectors actually used and
1077 * let the #PF handler lazily sync pages as they are used.
1078 * (This applies to GDT too, when we start making OS/2 fast.)
1079 */
1080
1081 /*
1082 * First, determine the current LDT selector.
1083 */
1084 RTSEL SelLdt = CPUMGetGuestLDTR(pVCpu);
1085 if ((SelLdt & X86_SEL_MASK) == 0)
1086 {
1087 /* ldtr = 0 - update hyper LDTR and deregister any active handler. */
1088 CPUMSetHyperLDTR(pVCpu, 0);
1089 if (pVM->selm.s.GCPtrGuestLdt != RTRCPTR_MAX)
1090 {
1091 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestLdt);
1092 AssertRC(rc);
1093 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
1094 }
1095 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
1096 return VINF_SUCCESS;
1097 }
1098
1099 /*
1100 * Get the LDT selector.
1101 */
1102 PX86DESC pDesc = &pVM->selm.s.paGdtR3[SelLdt >> X86_SEL_SHIFT];
1103 RTGCPTR GCPtrLdt = X86DESC_BASE(*pDesc);
1104 unsigned cbLdt = X86DESC_LIMIT(*pDesc);
1105 if (pDesc->Gen.u1Granularity)
1106 cbLdt = (cbLdt << PAGE_SHIFT) | PAGE_OFFSET_MASK;
1107
1108 /*
1109 * Validate it.
1110 */
1111 if ( !cbLdt
1112 || SelLdt >= pVM->selm.s.GuestGdtr.cbGdt
1113 || pDesc->Gen.u1DescType
1114 || pDesc->Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
1115 {
1116 AssertMsg(!cbLdt, ("Invalid LDT %04x!\n", SelLdt));
1117
1118 /* cbLdt > 0:
1119 * This is quite impossible, so we do as most people do when faced with
1120 * the impossible, we simply ignore it.
1121 */
1122 CPUMSetHyperLDTR(pVCpu, 0);
1123 if (pVM->selm.s.GCPtrGuestLdt != RTRCPTR_MAX)
1124 {
1125 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestLdt);
1126 AssertRC(rc);
1127 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
1128 }
1129 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
1130 return VINF_SUCCESS;
1131 }
1132 /** @todo check what intel does about odd limits. */
1133 AssertMsg(RT_ALIGN(cbLdt + 1, sizeof(X86DESC)) == cbLdt + 1 && cbLdt <= 0xffff, ("cbLdt=%d\n", cbLdt));
1134
1135 /*
1136 * Use the cached guest ldt address if the descriptor has already been modified (see below)
1137 * (this is necessary due to redundant LDT updates; see todo above at GDT sync)
1138 */
1139 if (MMHyperIsInsideArea(pVM, GCPtrLdt))
1140 GCPtrLdt = pVM->selm.s.GCPtrGuestLdt; /* use the old one */
1141
1142
1143 /** @todo Handle only present LDT segments. */
1144 // if (pDesc->Gen.u1Present)
1145 {
1146 /*
1147 * Check if Guest's LDT address/limit is changed.
1148 */
1149 if ( GCPtrLdt != pVM->selm.s.GCPtrGuestLdt
1150 || cbLdt != pVM->selm.s.cbLdtLimit)
1151 {
1152 Log(("SELMR3UpdateFromCPUM: Guest LDT changed to from %RGv:%04x to %RGv:%04x. (GDTR=%016RX64:%04x)\n",
1153 pVM->selm.s.GCPtrGuestLdt, pVM->selm.s.cbLdtLimit, GCPtrLdt, cbLdt, pVM->selm.s.GuestGdtr.pGdt, pVM->selm.s.GuestGdtr.cbGdt));
1154
1155 /*
1156 * [Re]Register write virtual handler for guest's GDT.
1157 * In the event of LDT overlapping something, don't install it just assume it's being updated.
1158 */
1159 if (pVM->selm.s.GCPtrGuestLdt != RTRCPTR_MAX)
1160 {
1161 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestLdt);
1162 AssertRC(rc);
1163 }
1164#ifdef DEBUG
1165 if (pDesc->Gen.u1Present)
1166 Log(("LDT selector marked not present!!\n"));
1167#endif
1168 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtrLdt, GCPtrLdt + cbLdt /* already inclusive */,
1169 0, selmR3GuestLDTWriteHandler, "selmRCGuestLDTWriteHandler", 0, "Guest LDT write access handler");
1170 if (rc == VERR_PGM_HANDLER_VIRTUAL_CONFLICT)
1171 {
1172 /** @todo investigate the various cases where conflicts happen and try avoid them by enh. the instruction emulation. */
1173 pVM->selm.s.GCPtrGuestLdt = RTRCPTR_MAX;
1174 Log(("WARNING: Guest LDT (%RGv:%04x) conflicted with existing access range!! Assumes LDT is begin updated. (GDTR=%016RX64:%04x)\n",
1175 GCPtrLdt, cbLdt, pVM->selm.s.GuestGdtr.pGdt, pVM->selm.s.GuestGdtr.cbGdt));
1176 }
1177 else if (RT_SUCCESS(rc))
1178 pVM->selm.s.GCPtrGuestLdt = GCPtrLdt;
1179 else
1180 {
1181 CPUMSetHyperLDTR(pVCpu, 0);
1182 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
1183 return rc;
1184 }
1185
1186 pVM->selm.s.cbLdtLimit = cbLdt;
1187 }
1188 }
1189
1190 /*
1191 * Calc Shadow LDT base.
1192 */
1193 unsigned off;
1194 pVM->selm.s.offLdtHyper = off = (GCPtrLdt & PAGE_OFFSET_MASK);
1195 RTGCPTR GCPtrShadowLDT = (RTGCPTR)((RTGCUINTPTR)pVM->selm.s.pvLdtRC + off);
1196 PX86DESC pShadowLDT = (PX86DESC)((uintptr_t)pVM->selm.s.pvLdtR3 + off);
1197
1198 /*
1199 * Enable the LDT selector in the shadow GDT.
1200 */
1201 pDesc->Gen.u1Present = 1;
1202 pDesc->Gen.u16BaseLow = RT_LOWORD(GCPtrShadowLDT);
1203 pDesc->Gen.u8BaseHigh1 = RT_BYTE3(GCPtrShadowLDT);
1204 pDesc->Gen.u8BaseHigh2 = RT_BYTE4(GCPtrShadowLDT);
1205 pDesc->Gen.u1Available = 0;
1206 pDesc->Gen.u1Long = 0;
1207 if (cbLdt > 0xffff)
1208 {
1209 cbLdt = 0xffff;
1210 pDesc->Gen.u4LimitHigh = 0;
1211 pDesc->Gen.u16LimitLow = pDesc->Gen.u1Granularity ? 0xf : 0xffff;
1212 }
1213
1214 /*
1215 * Set Hyper LDTR and notify TRPM.
1216 */
1217 CPUMSetHyperLDTR(pVCpu, SelLdt);
1218
1219 /*
1220 * Loop synchronising the LDT page by page.
1221 */
1222 /** @todo investigate how intel handle various operations on half present cross page entries. */
1223 off = GCPtrLdt & (sizeof(X86DESC) - 1);
1224 AssertMsg(!off, ("LDT is not aligned on entry size! GCPtrLdt=%08x\n", GCPtrLdt));
1225
1226 /* Note: Do not skip the first selector; unlike the GDT, a zero LDT selector is perfectly valid. */
1227 unsigned cbLeft = cbLdt + 1;
1228 PX86DESC pLDTE = pShadowLDT;
1229 while (cbLeft)
1230 {
1231 /*
1232 * Read a chunk.
1233 */
1234 unsigned cbChunk = PAGE_SIZE - ((RTGCUINTPTR)GCPtrLdt & PAGE_OFFSET_MASK);
1235 if (cbChunk > cbLeft)
1236 cbChunk = cbLeft;
1237 rc = PGMPhysSimpleReadGCPtr(pVCpu, pShadowLDT, GCPtrLdt, cbChunk);
1238 if (RT_SUCCESS(rc))
1239 {
1240 /*
1241 * Mark page
1242 */
1243 rc = PGMMapSetPage(pVM, GCPtrShadowLDT & PAGE_BASE_GC_MASK, PAGE_SIZE, X86_PTE_P | X86_PTE_A | X86_PTE_D);
1244 AssertRC(rc);
1245
1246 /*
1247 * Loop thru the available LDT entries.
1248 * Figure out where to start and end and the potential cross pageness of
1249 * things adds a little complexity. pLDTE is updated there and not in the
1250 * 'next' part of the loop. The pLDTEEnd is inclusive.
1251 */
1252 PX86DESC pLDTEEnd = (PX86DESC)((uintptr_t)pShadowLDT + cbChunk) - 1;
1253 if (pLDTE + 1 < pShadowLDT)
1254 pLDTE = (PX86DESC)((uintptr_t)pShadowLDT + off);
1255 while (pLDTE <= pLDTEEnd)
1256 {
1257 if (pLDTE->Gen.u1Present)
1258 {
1259 /*
1260 * Code and data selectors are generally 1:1, with the
1261 * 'little' adjustment we do for DPL 0 selectors.
1262 */
1263 if (pLDTE->Gen.u1DescType)
1264 {
1265 /*
1266 * Hack for A-bit against Trap E on read-only GDT.
1267 */
1268 /** @todo Fix this by loading ds and cs before turning off WP. */
1269 if (!(pLDTE->Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1270 pLDTE->Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1271
1272 /*
1273 * All DPL 0 code and data segments are squeezed into DPL 1.
1274 *
1275 * We're skipping conforming segments here because those
1276 * cannot give us any trouble.
1277 */
1278 if ( pLDTE->Gen.u2Dpl == 0
1279 && (pLDTE->Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
1280 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF) )
1281 pLDTE->Gen.u2Dpl = 1;
1282 }
1283 else
1284 {
1285 /*
1286 * System type selectors are marked not present.
1287 * Recompiler or special handling is required for these.
1288 */
1289 /** @todo what about interrupt gates and rawr0? */
1290 pLDTE->Gen.u1Present = 0;
1291 }
1292 }
1293
1294 /* Next LDT entry. */
1295 pLDTE++;
1296 }
1297 }
1298 else
1299 {
1300 AssertMsg(rc == VERR_PAGE_NOT_PRESENT || rc == VERR_PAGE_TABLE_NOT_PRESENT, ("rc=%Rrc\n", rc));
1301 rc = PGMMapSetPage(pVM, GCPtrShadowLDT & PAGE_BASE_GC_MASK, PAGE_SIZE, 0);
1302 AssertRC(rc);
1303 }
1304
1305 /*
1306 * Advance to the next page.
1307 */
1308 cbLeft -= cbChunk;
1309 GCPtrShadowLDT += cbChunk;
1310 pShadowLDT = (PX86DESC)((char *)pShadowLDT + cbChunk);
1311 GCPtrLdt += cbChunk;
1312 }
1313 }
1314
1315 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
1316 return VINF_SUCCESS;
1317}
1318
1319
1320/**
1321 * \#PF Handler callback for virtual access handler ranges.
1322 *
1323 * Important to realize that a physical page in a range can have aliases, and
1324 * for ALL and WRITE handlers these will also trigger.
1325 *
1326 * @returns VINF_SUCCESS if the handler have carried out the operation.
1327 * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1328 * @param pVM Pointer to the VM.
1329 * @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
1330 * @param pvPtr The HC mapping of that address.
1331 * @param pvBuf What the guest is reading/writing.
1332 * @param cbBuf How much it's reading/writing.
1333 * @param enmAccessType The access type.
1334 * @param pvUser User argument.
1335 */
1336static DECLCALLBACK(int) selmR3GuestGDTWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf,
1337 PGMACCESSTYPE enmAccessType, void *pvUser)
1338{
1339 Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
1340 Log(("selmR3GuestGDTWriteHandler: write to %RGv size %d\n", GCPtr, cbBuf)); NOREF(GCPtr); NOREF(cbBuf);
1341 NOREF(pvPtr); NOREF(pvBuf); NOREF(pvUser);
1342
1343 VMCPU_FF_SET(VMMGetCpu(pVM), VMCPU_FF_SELM_SYNC_GDT);
1344 return VINF_PGM_HANDLER_DO_DEFAULT;
1345}
1346
1347
1348/**
1349 * \#PF Handler callback for virtual access handler ranges.
1350 *
1351 * Important to realize that a physical page in a range can have aliases, and
1352 * for ALL and WRITE handlers these will also trigger.
1353 *
1354 * @returns VINF_SUCCESS if the handler have carried out the operation.
1355 * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1356 * @param pVM Pointer to the VM.
1357 * @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
1358 * @param pvPtr The HC mapping of that address.
1359 * @param pvBuf What the guest is reading/writing.
1360 * @param cbBuf How much it's reading/writing.
1361 * @param enmAccessType The access type.
1362 * @param pvUser User argument.
1363 */
1364static DECLCALLBACK(int) selmR3GuestLDTWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf,
1365 PGMACCESSTYPE enmAccessType, void *pvUser)
1366{
1367 Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
1368 Log(("selmR3GuestLDTWriteHandler: write to %RGv size %d\n", GCPtr, cbBuf)); NOREF(GCPtr); NOREF(cbBuf);
1369 NOREF(pvPtr); NOREF(pvBuf); NOREF(pvUser);
1370
1371 VMCPU_FF_SET(VMMGetCpu(pVM), VMCPU_FF_SELM_SYNC_LDT);
1372 return VINF_PGM_HANDLER_DO_DEFAULT;
1373}
1374
1375
1376/**
1377 * \#PF Handler callback for virtual access handler ranges.
1378 *
1379 * Important to realize that a physical page in a range can have aliases, and
1380 * for ALL and WRITE handlers these will also trigger.
1381 *
1382 * @returns VINF_SUCCESS if the handler have carried out the operation.
1383 * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1384 * @param pVM Pointer to the VM.
1385 * @param GCPtr The virtual address the guest is writing to. (not correct if it's an alias!)
1386 * @param pvPtr The HC mapping of that address.
1387 * @param pvBuf What the guest is reading/writing.
1388 * @param cbBuf How much it's reading/writing.
1389 * @param enmAccessType The access type.
1390 * @param pvUser User argument.
1391 */
1392static DECLCALLBACK(int) selmR3GuestTSSWriteHandler(PVM pVM, RTGCPTR GCPtr, void *pvPtr, void *pvBuf, size_t cbBuf,
1393 PGMACCESSTYPE enmAccessType, void *pvUser)
1394{
1395 Assert(enmAccessType == PGMACCESSTYPE_WRITE); NOREF(enmAccessType);
1396 Log(("selmR3GuestTSSWriteHandler: write %.*Rhxs to %RGv size %d\n", RT_MIN(8, cbBuf), pvBuf, GCPtr, cbBuf));
1397 NOREF(pvBuf); NOREF(GCPtr); NOREF(cbBuf); NOREF(pvUser);NOREF(pvPtr);
1398
1399 /** @todo This can be optimized by checking for the ESP0 offset and tracking TR
1400 * reloads in REM (setting VM_FF_SELM_SYNC_TSS if TR is reloaded). We
1401 * should probably also deregister the virtual handler if TR.base/size
1402 * changes while we're in REM. */
1403
1404 VMCPU_FF_SET(VMMGetCpu(pVM), VMCPU_FF_SELM_SYNC_TSS);
1405 return VINF_PGM_HANDLER_DO_DEFAULT;
1406}
1407
1408
1409/**
1410 * Synchronize the shadowed fields in the TSS.
1411 *
1412 * At present we're shadowing the ring-0 stack selector & pointer, and the
1413 * interrupt redirection bitmap (if present). We take the lazy approach wrt to
1414 * REM and this function is called both if REM made any changes to the TSS or
1415 * loaded TR.
1416 *
1417 * @returns VBox status code.
1418 * @param pVM Pointer to the VM.
1419 * @param pVCpu Pointer to the VMCPU.
1420 */
1421VMMR3DECL(int) SELMR3SyncTSS(PVM pVM, PVMCPU pVCpu)
1422{
1423 int rc;
1424
1425 if (pVM->selm.s.fDisableMonitoring)
1426 {
1427 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
1428 return VINF_SUCCESS;
1429 }
1430
1431 STAM_PROFILE_START(&pVM->selm.s.StatTSSSync, a);
1432 Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_SELM_SYNC_TSS));
1433
1434 /*
1435 * Get TR and extract and store the basic info.
1436 *
1437 * Note! The TSS limit is not checked by the LTR code, so we
1438 * have to be a bit careful with it. We make sure cbTss
1439 * won't be zero if TR is valid and if it's NULL we'll
1440 * make sure cbTss is 0.
1441 */
1442 CPUMSELREGHID trHid;
1443 RTSEL SelTss = CPUMGetGuestTR(pVCpu, &trHid);
1444 RTGCPTR GCPtrTss = trHid.u64Base;
1445 uint32_t cbTss = trHid.u32Limit;
1446 Assert( (SelTss & X86_SEL_MASK)
1447 || (cbTss == 0 && GCPtrTss == 0 && trHid.Attr.u == 0 /* TR=0 */)
1448 || (cbTss == 0xffff && GCPtrTss == 0 && trHid.Attr.n.u1Present && trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY /* RESET */));
1449 if (SelTss & X86_SEL_MASK)
1450 {
1451 Assert(!(SelTss & X86_SEL_LDT));
1452 Assert(trHid.Attr.n.u1DescType == 0);
1453 Assert( trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY
1454 || trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY);
1455 if (!++cbTss)
1456 cbTss = UINT32_MAX;
1457 }
1458 else
1459 {
1460 Assert( (cbTss == 0 && GCPtrTss == 0 && trHid.Attr.u == 0 /* TR=0 */)
1461 || (cbTss == 0xffff && GCPtrTss == 0 && trHid.Attr.n.u1Present && trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY /* RESET */));
1462 cbTss = 0; /* the reset case. */
1463 }
1464 pVM->selm.s.cbGuestTss = cbTss;
1465 pVM->selm.s.fGuestTss32Bit = trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL
1466 || trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY;
1467
1468 /*
1469 * Figure out the size of what need to monitor.
1470 */
1471 /* We're not interested in any 16-bit TSSes. */
1472 uint32_t cbMonitoredTss = cbTss;
1473 if ( trHid.Attr.n.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL
1474 && trHid.Attr.n.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
1475 cbMonitoredTss = 0;
1476
1477 pVM->selm.s.offGuestIoBitmap = 0;
1478 bool fNoRing1Stack = true;
1479 if (cbMonitoredTss)
1480 {
1481 /*
1482 * 32-bit TSS. What we're really keen on is the SS0 and ESP0 fields.
1483 * If VME is enabled we also want to keep an eye on the interrupt
1484 * redirection bitmap.
1485 */
1486 VBOXTSS Tss;
1487 uint32_t cr4 = CPUMGetGuestCR4(pVCpu);
1488 rc = PGMPhysSimpleReadGCPtr(pVCpu, &Tss, GCPtrTss, RT_OFFSETOF(VBOXTSS, IntRedirBitmap));
1489 if ( !(cr4 & X86_CR4_VME)
1490 || ( RT_SUCCESS(rc)
1491 && Tss.offIoBitmap < sizeof(VBOXTSS) /* too small */
1492 && Tss.offIoBitmap > cbTss) /* beyond the end */ /** @todo not sure how the partial case is handled; probably not allowed. */
1493 )
1494 /* No interrupt redirection bitmap, just ESP0 and SS0. */
1495 cbMonitoredTss = RT_UOFFSETOF(VBOXTSS, padding_ss0);
1496 else if (RT_SUCCESS(rc))
1497 {
1498 /*
1499 * Everything up to and including the interrupt redirection bitmap. Unfortunately
1500 * this can be quite a large chunk. We use to skip it earlier and just hope it
1501 * was kind of static...
1502 *
1503 * Update the virtual interrupt redirection bitmap while we're here.
1504 * (It is located in the 32 bytes before TR:offIoBitmap.)
1505 */
1506 cbMonitoredTss = Tss.offIoBitmap;
1507 pVM->selm.s.offGuestIoBitmap = Tss.offIoBitmap;
1508
1509 uint32_t offRedirBitmap = Tss.offIoBitmap - sizeof(Tss.IntRedirBitmap);
1510 rc = PGMPhysSimpleReadGCPtr(pVCpu, &pVM->selm.s.Tss.IntRedirBitmap,
1511 GCPtrTss + offRedirBitmap, sizeof(Tss.IntRedirBitmap));
1512 AssertRC(rc);
1513 /** @todo memset the bitmap on failure? */
1514 Log2(("Redirection bitmap:\n"));
1515 Log2(("%.*Rhxd\n", sizeof(Tss.IntRedirBitmap), &pVM->selm.s.Tss.IntRedirBitmap));
1516 }
1517 else
1518 {
1519 cbMonitoredTss = RT_OFFSETOF(VBOXTSS, IntRedirBitmap);
1520 pVM->selm.s.offGuestIoBitmap = 0;
1521 /** @todo memset the bitmap? */
1522 }
1523
1524 /*
1525 * Update the ring 0 stack selector and base address.
1526 */
1527 if (RT_SUCCESS(rc))
1528 {
1529#ifdef LOG_ENABLED
1530 if (LogIsEnabled())
1531 {
1532 uint32_t ssr0, espr0;
1533 SELMGetRing1Stack(pVM, &ssr0, &espr0);
1534 if ((ssr0 & ~1) != Tss.ss0 || espr0 != Tss.esp0)
1535 {
1536 RTGCPHYS GCPhys = NIL_RTGCPHYS;
1537 rc = PGMGstGetPage(pVCpu, GCPtrTss, NULL, &GCPhys); AssertRC(rc);
1538 Log(("SELMR3SyncTSS: Updating TSS ring 0 stack to %04X:%08X from %04X:%08X; TSS Phys=%RGp)\n",
1539 Tss.ss0, Tss.esp0, (ssr0 & ~1), espr0, GCPhys));
1540 AssertMsg(ssr0 != Tss.ss0,
1541 ("ring-1 leak into TSS.SS0! %04X:%08X from %04X:%08X; TSS Phys=%RGp)\n",
1542 Tss.ss0, Tss.esp0, (ssr0 & ~1), espr0, GCPhys));
1543 }
1544 Log(("offIoBitmap=%#x\n", Tss.offIoBitmap));
1545 }
1546#endif /* LOG_ENABLED */
1547 AssertMsg(!(Tss.ss0 & 3), ("ring-1 leak into TSS.SS0? %04X:%08X\n", Tss.ss0, Tss.esp0));
1548
1549 /* Update our TSS structure for the guest's ring 1 stack */
1550 selmSetRing1Stack(pVM, Tss.ss0 | 1, Tss.esp0);
1551 pVM->selm.s.fSyncTSSRing0Stack = fNoRing1Stack = false;
1552 }
1553 }
1554
1555 /*
1556 * Flush the ring-1 stack and the direct syscall dispatching if we
1557 * cannot obtain SS0:ESP0.
1558 */
1559 if (fNoRing1Stack)
1560 {
1561 selmSetRing1Stack(pVM, 0 /* invalid SS */, 0);
1562 pVM->selm.s.fSyncTSSRing0Stack = cbMonitoredTss != 0;
1563
1564 /** @todo handle these dependencies better! */
1565 TRPMR3SetGuestTrapHandler(pVM, 0x2E, TRPM_INVALID_HANDLER);
1566 TRPMR3SetGuestTrapHandler(pVM, 0x80, TRPM_INVALID_HANDLER);
1567 }
1568
1569 /*
1570 * Check for monitor changes and apply them.
1571 */
1572 if ( GCPtrTss != pVM->selm.s.GCPtrGuestTss
1573 || cbMonitoredTss != pVM->selm.s.cbMonitoredGuestTss)
1574 {
1575 Log(("SELMR3SyncTSS: Guest's TSS is changed to pTss=%RGv cbMonitoredTss=%08X cbGuestTss=%#08x\n",
1576 GCPtrTss, cbMonitoredTss, pVM->selm.s.cbGuestTss));
1577
1578 /* Release the old range first. */
1579 if (pVM->selm.s.GCPtrGuestTss != RTRCPTR_MAX)
1580 {
1581 rc = PGMHandlerVirtualDeregister(pVM, pVM->selm.s.GCPtrGuestTss);
1582 AssertRC(rc);
1583 }
1584
1585 /* Register the write handler if TS != 0. */
1586 if (cbMonitoredTss != 0)
1587 {
1588 rc = PGMR3HandlerVirtualRegister(pVM, PGMVIRTHANDLERTYPE_WRITE, GCPtrTss, GCPtrTss + cbMonitoredTss - 1,
1589 0, selmR3GuestTSSWriteHandler,
1590 "selmRCGuestTSSWriteHandler", 0, "Guest TSS write access handler");
1591 if (RT_FAILURE(rc))
1592 {
1593 STAM_PROFILE_STOP(&pVM->selm.s.StatUpdateFromCPUM, a);
1594 return rc;
1595 }
1596
1597 /* Update saved Guest TSS info. */
1598 pVM->selm.s.GCPtrGuestTss = GCPtrTss;
1599 pVM->selm.s.cbMonitoredGuestTss = cbMonitoredTss;
1600 pVM->selm.s.GCSelTss = SelTss;
1601 }
1602 else
1603 {
1604 pVM->selm.s.GCPtrGuestTss = RTRCPTR_MAX;
1605 pVM->selm.s.cbMonitoredGuestTss = 0;
1606 pVM->selm.s.GCSelTss = 0;
1607 }
1608 }
1609
1610 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
1611
1612 STAM_PROFILE_STOP(&pVM->selm.s.StatTSSSync, a);
1613 return VINF_SUCCESS;
1614}
1615
1616
1617/**
1618 * Compares the Guest GDT and LDT with the shadow tables.
1619 * This is a VBOX_STRICT only function.
1620 *
1621 * @returns VBox status code.
1622 * @param pVM Pointer to the VM.
1623 */
1624VMMR3DECL(int) SELMR3DebugCheck(PVM pVM)
1625{
1626#ifdef VBOX_STRICT
1627 PVMCPU pVCpu = VMMGetCpu(pVM);
1628
1629 /*
1630 * Get GDTR and check for conflict.
1631 */
1632 VBOXGDTR GDTR;
1633 CPUMGetGuestGDTR(pVCpu, &GDTR);
1634 if (GDTR.cbGdt == 0)
1635 return VINF_SUCCESS;
1636
1637 if (GDTR.cbGdt >= (unsigned)(pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] >> X86_SEL_SHIFT))
1638 Log(("SELMR3DebugCheck: guest GDT size forced us to look for unused selectors.\n"));
1639
1640 if (GDTR.cbGdt != pVM->selm.s.GuestGdtr.cbGdt)
1641 Log(("SELMR3DebugCheck: limits have changed! new=%d old=%d\n", GDTR.cbGdt, pVM->selm.s.GuestGdtr.cbGdt));
1642
1643 /*
1644 * Loop thru the GDT checking each entry.
1645 */
1646 RTGCPTR GCPtrGDTEGuest = GDTR.pGdt;
1647 PX86DESC pGDTE = pVM->selm.s.paGdtR3;
1648 PX86DESC pGDTEEnd = (PX86DESC)((uintptr_t)pGDTE + GDTR.cbGdt);
1649 while (pGDTE < pGDTEEnd)
1650 {
1651 X86DESC GDTEGuest;
1652 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &GDTEGuest, GCPtrGDTEGuest, sizeof(GDTEGuest));
1653 if (RT_SUCCESS(rc))
1654 {
1655 if (pGDTE->Gen.u1DescType || pGDTE->Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
1656 {
1657 if ( pGDTE->Gen.u16LimitLow != GDTEGuest.Gen.u16LimitLow
1658 || pGDTE->Gen.u4LimitHigh != GDTEGuest.Gen.u4LimitHigh
1659 || pGDTE->Gen.u16BaseLow != GDTEGuest.Gen.u16BaseLow
1660 || pGDTE->Gen.u8BaseHigh1 != GDTEGuest.Gen.u8BaseHigh1
1661 || pGDTE->Gen.u8BaseHigh2 != GDTEGuest.Gen.u8BaseHigh2
1662 || pGDTE->Gen.u1DefBig != GDTEGuest.Gen.u1DefBig
1663 || pGDTE->Gen.u1DescType != GDTEGuest.Gen.u1DescType)
1664 {
1665 unsigned iGDT = pGDTE - pVM->selm.s.paGdtR3;
1666 SELMR3DumpDescriptor(*pGDTE, iGDT << 3, "SELMR3DebugCheck: GDT mismatch, shadow");
1667 SELMR3DumpDescriptor(GDTEGuest, iGDT << 3, "SELMR3DebugCheck: GDT mismatch, guest");
1668 }
1669 }
1670 }
1671
1672 /* Advance to the next descriptor. */
1673 GCPtrGDTEGuest += sizeof(X86DESC);
1674 pGDTE++;
1675 }
1676
1677
1678 /*
1679 * LDT?
1680 */
1681 RTSEL SelLdt = CPUMGetGuestLDTR(pVCpu);
1682 if ((SelLdt & X86_SEL_MASK) == 0)
1683 return VINF_SUCCESS;
1684 if (SelLdt > GDTR.cbGdt)
1685 {
1686 Log(("SELMR3DebugCheck: ldt is out of bound SelLdt=%#x\n", SelLdt));
1687 return VERR_SELM_LDT_OUT_OF_BOUNDS;
1688 }
1689 X86DESC LDTDesc;
1690 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &LDTDesc, GDTR.pGdt + (SelLdt & X86_SEL_MASK), sizeof(LDTDesc));
1691 if (RT_FAILURE(rc))
1692 {
1693 Log(("SELMR3DebugCheck: Failed to read LDT descriptor. rc=%d\n", rc));
1694 return rc;
1695 }
1696 RTGCPTR GCPtrLDTEGuest = X86DESC_BASE(LDTDesc);
1697 unsigned cbLdt = X86DESC_LIMIT(LDTDesc);
1698 if (LDTDesc.Gen.u1Granularity)
1699 cbLdt = (cbLdt << PAGE_SHIFT) | PAGE_OFFSET_MASK;
1700
1701 /*
1702 * Validate it.
1703 */
1704 if (!cbLdt)
1705 return VINF_SUCCESS;
1706 /** @todo check what intel does about odd limits. */
1707 AssertMsg(RT_ALIGN(cbLdt + 1, sizeof(X86DESC)) == cbLdt + 1 && cbLdt <= 0xffff, ("cbLdt=%d\n", cbLdt));
1708 if ( LDTDesc.Gen.u1DescType
1709 || LDTDesc.Gen.u4Type != X86_SEL_TYPE_SYS_LDT
1710 || SelLdt >= pVM->selm.s.GuestGdtr.cbGdt)
1711 {
1712 Log(("SELmR3DebugCheck: Invalid LDT %04x!\n", SelLdt));
1713 return VERR_SELM_INVALID_LDT;
1714 }
1715
1716 /*
1717 * Loop thru the LDT checking each entry.
1718 */
1719 unsigned off = (GCPtrLDTEGuest & PAGE_OFFSET_MASK);
1720 PX86DESC pLDTE = (PX86DESC)((uintptr_t)pVM->selm.s.pvLdtR3 + off);
1721 PX86DESC pLDTEEnd = (PX86DESC)((uintptr_t)pGDTE + cbLdt);
1722 while (pLDTE < pLDTEEnd)
1723 {
1724 X86DESC LDTEGuest;
1725 rc = PGMPhysSimpleReadGCPtr(pVCpu, &LDTEGuest, GCPtrLDTEGuest, sizeof(LDTEGuest));
1726 if (RT_SUCCESS(rc))
1727 {
1728 if ( pLDTE->Gen.u16LimitLow != LDTEGuest.Gen.u16LimitLow
1729 || pLDTE->Gen.u4LimitHigh != LDTEGuest.Gen.u4LimitHigh
1730 || pLDTE->Gen.u16BaseLow != LDTEGuest.Gen.u16BaseLow
1731 || pLDTE->Gen.u8BaseHigh1 != LDTEGuest.Gen.u8BaseHigh1
1732 || pLDTE->Gen.u8BaseHigh2 != LDTEGuest.Gen.u8BaseHigh2
1733 || pLDTE->Gen.u1DefBig != LDTEGuest.Gen.u1DefBig
1734 || pLDTE->Gen.u1DescType != LDTEGuest.Gen.u1DescType)
1735 {
1736 unsigned iLDT = pLDTE - (PX86DESC)((uintptr_t)pVM->selm.s.pvLdtR3 + off);
1737 SELMR3DumpDescriptor(*pLDTE, iLDT << 3, "SELMR3DebugCheck: LDT mismatch, shadow");
1738 SELMR3DumpDescriptor(LDTEGuest, iLDT << 3, "SELMR3DebugCheck: LDT mismatch, guest");
1739 }
1740 }
1741
1742 /* Advance to the next descriptor. */
1743 GCPtrLDTEGuest += sizeof(X86DESC);
1744 pLDTE++;
1745 }
1746
1747#else /* !VBOX_STRICT */
1748 NOREF(pVM);
1749#endif /* !VBOX_STRICT */
1750
1751 return VINF_SUCCESS;
1752}
1753
1754
1755/**
1756 * Validates the RawR0 TSS values against the one in the Guest TSS.
1757 *
1758 * @returns true if it matches.
1759 * @returns false and assertions on mismatch..
1760 * @param pVM Pointer to the VM.
1761 */
1762VMMR3DECL(bool) SELMR3CheckTSS(PVM pVM)
1763{
1764#ifdef VBOX_STRICT
1765 PVMCPU pVCpu = VMMGetCpu(pVM);
1766
1767 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1768 return true;
1769
1770 /*
1771 * Get TR and extract the basic info.
1772 */
1773 CPUMSELREGHID trHid;
1774 RTSEL SelTss = CPUMGetGuestTR(pVCpu, &trHid);
1775 RTGCPTR GCPtrTss = trHid.u64Base;
1776 uint32_t cbTss = trHid.u32Limit;
1777 Assert( (SelTss & X86_SEL_MASK)
1778 || (cbTss == 0 && GCPtrTss == 0 && trHid.Attr.u == 0 /* TR=0 */)
1779 || (cbTss == 0xffff && GCPtrTss == 0 && trHid.Attr.n.u1Present && trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY /* RESET */));
1780 if (SelTss & X86_SEL_MASK)
1781 {
1782 AssertReturn(!(SelTss & X86_SEL_LDT), false);
1783 AssertReturn(trHid.Attr.n.u1DescType == 0, false);
1784 AssertReturn( trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY
1785 || trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY,
1786 false);
1787 if (!++cbTss)
1788 cbTss = UINT32_MAX;
1789 }
1790 else
1791 {
1792 AssertReturn( (cbTss == 0 && GCPtrTss == 0 && trHid.Attr.u == 0 /* TR=0 */)
1793 || (cbTss == 0xffff && GCPtrTss == 0 && trHid.Attr.n.u1Present && trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY /* RESET */),
1794 false);
1795 cbTss = 0; /* the reset case. */
1796 }
1797 AssertMsgReturn(pVM->selm.s.cbGuestTss == cbTss, ("%#x %#x\n", pVM->selm.s.cbGuestTss, cbTss), false);
1798 AssertMsgReturn(pVM->selm.s.fGuestTss32Bit == ( trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL
1799 || trHid.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY),
1800 ("%RTbool u4Type=%d\n", pVM->selm.s.fGuestTss32Bit, trHid.Attr.n.u4Type),
1801 false);
1802 AssertMsgReturn( pVM->selm.s.GCSelTss == SelTss
1803 || (!pVM->selm.s.GCSelTss && !(SelTss & X86_SEL_LDT)),
1804 ("%#x %#x\n", pVM->selm.s.GCSelTss, SelTss),
1805 false);
1806 AssertMsgReturn( pVM->selm.s.GCPtrGuestTss == GCPtrTss
1807 || (pVM->selm.s.GCPtrGuestTss == RTRCPTR_MAX && !GCPtrTss),
1808 ("%#RGv %#RGv\n", pVM->selm.s.GCPtrGuestTss, GCPtrTss),
1809 false);
1810
1811
1812 /*
1813 * Figure out the size of what need to monitor.
1814 */
1815 /* We're not interested in any 16-bit TSSes. */
1816 uint32_t cbMonitoredTss = cbTss;
1817 if ( trHid.Attr.n.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL
1818 && trHid.Attr.n.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
1819 cbMonitoredTss = 0;
1820 if (cbMonitoredTss)
1821 {
1822 VBOXTSS Tss;
1823 uint32_t cr4 = CPUMGetGuestCR4(pVCpu);
1824 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &Tss, GCPtrTss, RT_OFFSETOF(VBOXTSS, IntRedirBitmap));
1825 AssertReturn( rc == VINF_SUCCESS
1826 /* Happens early in XP boot during page table switching. */
1827 || ( (rc == VERR_PAGE_TABLE_NOT_PRESENT || rc == VERR_PAGE_NOT_PRESENT)
1828 && !(CPUMGetGuestEFlags(pVCpu) & X86_EFL_IF)),
1829 false);
1830 if ( !(cr4 & X86_CR4_VME)
1831 || ( RT_SUCCESS(rc)
1832 && Tss.offIoBitmap < sizeof(VBOXTSS) /* too small */
1833 && Tss.offIoBitmap > cbTss)
1834 )
1835 cbMonitoredTss = RT_UOFFSETOF(VBOXTSS, padding_ss0);
1836 else if (RT_SUCCESS(rc))
1837 {
1838 cbMonitoredTss = Tss.offIoBitmap;
1839 AssertMsgReturn(pVM->selm.s.offGuestIoBitmap == Tss.offIoBitmap,
1840 ("#x %#x\n", pVM->selm.s.offGuestIoBitmap, Tss.offIoBitmap),
1841 false);
1842
1843 /* check the bitmap */
1844 uint32_t offRedirBitmap = Tss.offIoBitmap - sizeof(Tss.IntRedirBitmap);
1845 rc = PGMPhysSimpleReadGCPtr(pVCpu, &Tss.IntRedirBitmap,
1846 GCPtrTss + offRedirBitmap, sizeof(Tss.IntRedirBitmap));
1847 AssertRCReturn(rc, false);
1848 AssertMsgReturn(!memcmp(&Tss.IntRedirBitmap[0], &pVM->selm.s.Tss.IntRedirBitmap[0], sizeof(Tss.IntRedirBitmap)),
1849 ("offIoBitmap=%#x cbTss=%#x\n"
1850 " Guest: %.32Rhxs\n"
1851 "Shadow: %.32Rhxs\n",
1852 Tss.offIoBitmap, cbTss,
1853 &Tss.IntRedirBitmap[0],
1854 &pVM->selm.s.Tss.IntRedirBitmap[0]),
1855 false);
1856 }
1857 else
1858 cbMonitoredTss = RT_OFFSETOF(VBOXTSS, IntRedirBitmap);
1859
1860 /*
1861 * Check SS0 and ESP0.
1862 */
1863 if ( !pVM->selm.s.fSyncTSSRing0Stack
1864 && RT_SUCCESS(rc))
1865 {
1866 if ( Tss.esp0 != pVM->selm.s.Tss.esp1
1867 || Tss.ss0 != (pVM->selm.s.Tss.ss1 & ~1))
1868 {
1869 RTGCPHYS GCPhys;
1870 rc = PGMGstGetPage(pVCpu, GCPtrTss, NULL, &GCPhys); AssertRC(rc);
1871 AssertMsgFailed(("TSS out of sync!! (%04X:%08X vs %04X:%08X (guest)) Tss=%RGv Phys=%RGp\n",
1872 (pVM->selm.s.Tss.ss1 & ~1), pVM->selm.s.Tss.esp1,
1873 Tss.ss1, Tss.esp1, GCPtrTss, GCPhys));
1874 return false;
1875 }
1876 }
1877 AssertMsgReturn(pVM->selm.s.cbMonitoredGuestTss == cbMonitoredTss, ("%#x %#x\n", pVM->selm.s.cbMonitoredGuestTss, cbMonitoredTss), false);
1878 }
1879 else
1880 {
1881 AssertMsgReturn(pVM->selm.s.Tss.ss1 == 0 && pVM->selm.s.Tss.esp1 == 0, ("%04x:%08x\n", pVM->selm.s.Tss.ss1, pVM->selm.s.Tss.esp1), false);
1882 AssertReturn(!pVM->selm.s.fSyncTSSRing0Stack, false);
1883 AssertMsgReturn(pVM->selm.s.cbMonitoredGuestTss == cbMonitoredTss, ("%#x %#x\n", pVM->selm.s.cbMonitoredGuestTss, cbMonitoredTss), false);
1884 }
1885
1886
1887
1888 return true;
1889
1890#else /* !VBOX_STRICT */
1891 NOREF(pVM);
1892 return true;
1893#endif /* !VBOX_STRICT */
1894}
1895
1896
1897/**
1898 * Returns flat address and limit of LDT by LDT selector from guest GDTR.
1899 *
1900 * Fully validate selector.
1901 *
1902 * @returns VBox status.
1903 * @param pVM Pointer to the VM.
1904 * @param SelLdt LDT selector.
1905 * @param ppvLdt Where to store the flat address of LDT.
1906 * @param pcbLimit Where to store LDT limit.
1907 */
1908VMMDECL(int) SELMGetLDTFromSel(PVM pVM, RTSEL SelLdt, PRTGCPTR ppvLdt, unsigned *pcbLimit)
1909{
1910 PVMCPU pVCpu = VMMGetCpu(pVM);
1911
1912 /* Get guest GDTR. */
1913 VBOXGDTR GDTR;
1914 CPUMGetGuestGDTR(pVCpu, &GDTR);
1915
1916 /* Check selector TI and GDT limit. */
1917 if ( (SelLdt & X86_SEL_LDT)
1918 || SelLdt > GDTR.cbGdt)
1919 return VERR_INVALID_SELECTOR;
1920
1921 /* Read descriptor from GC. */
1922 X86DESC Desc;
1923 int rc = PGMPhysSimpleReadGCPtr(pVCpu, (void *)&Desc, (RTGCPTR)(GDTR.pGdt + (SelLdt & X86_SEL_MASK)), sizeof(Desc));
1924 if (RT_FAILURE(rc))
1925 {
1926 /* fatal */
1927 Log(("Can't read LDT descriptor for selector=%04X\n", SelLdt));
1928 return VERR_SELECTOR_NOT_PRESENT;
1929 }
1930
1931 /* Check if LDT descriptor is not present. */
1932 if (Desc.Gen.u1Present == 0)
1933 return VERR_SELECTOR_NOT_PRESENT;
1934
1935 /* Check LDT descriptor type. */
1936 if ( Desc.Gen.u1DescType == 1
1937 || Desc.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
1938 return VERR_INVALID_SELECTOR;
1939
1940 /* LDT descriptor is ok. */
1941 if (ppvLdt)
1942 {
1943 *ppvLdt = (RTGCPTR)X86DESC_BASE(Desc);
1944 *pcbLimit = X86DESC_LIMIT(Desc);
1945 }
1946 return VINF_SUCCESS;
1947}
1948
1949
1950/**
1951 * Gets information about a 64-bit selector, SELMR3GetSelectorInfo helper.
1952 *
1953 * See SELMR3GetSelectorInfo for details.
1954 *
1955 * @returns VBox status code, see SELMR3GetSelectorInfo for details.
1956 *
1957 * @param pVCpu Pointer to the VMCPU.
1958 * @param Sel The selector to get info about.
1959 * @param pSelInfo Where to store the information.
1960 */
1961static int selmR3GetSelectorInfo64(PVMCPU pVCpu, RTSEL Sel, PDBGFSELINFO pSelInfo)
1962{
1963 /*
1964 * Read it from the guest descriptor table.
1965 */
1966 X86DESC64 Desc;
1967 VBOXGDTR Gdtr;
1968 RTGCPTR GCPtrDesc;
1969 CPUMGetGuestGDTR(pVCpu, &Gdtr);
1970 if (!(Sel & X86_SEL_LDT))
1971 {
1972 /* GDT */
1973 if ((unsigned)(Sel & X86_SEL_MASK) + sizeof(X86DESC) - 1 > (unsigned)Gdtr.cbGdt)
1974 return VERR_INVALID_SELECTOR;
1975 GCPtrDesc = Gdtr.pGdt + (Sel & X86_SEL_MASK);
1976 }
1977 else
1978 {
1979 /*
1980 * LDT - must locate the LDT first.
1981 */
1982 RTSEL SelLdt = CPUMGetGuestLDTR(pVCpu);
1983 if ( (unsigned)(SelLdt & X86_SEL_MASK) < sizeof(X86DESC) /* the first selector is invalid, right? */ /** @todo r=bird: No, I don't think so */
1984 || (unsigned)(SelLdt & X86_SEL_MASK) + sizeof(X86DESC) - 1 > (unsigned)Gdtr.cbGdt)
1985 return VERR_INVALID_SELECTOR;
1986 GCPtrDesc = Gdtr.pGdt + (SelLdt & X86_SEL_MASK);
1987 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &Desc, GCPtrDesc, sizeof(Desc));
1988 if (RT_FAILURE(rc))
1989 return rc;
1990
1991 /* validate the LDT descriptor. */
1992 if (Desc.Gen.u1Present == 0)
1993 return VERR_SELECTOR_NOT_PRESENT;
1994 if ( Desc.Gen.u1DescType == 1
1995 || Desc.Gen.u4Type != AMD64_SEL_TYPE_SYS_LDT)
1996 return VERR_INVALID_SELECTOR;
1997
1998 uint32_t cbLimit = X86DESC_LIMIT(Desc);
1999 if (Desc.Gen.u1Granularity)
2000 cbLimit = (cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
2001 if ((uint32_t)(Sel & X86_SEL_MASK) + sizeof(X86DESC) - 1 > cbLimit)
2002 return VERR_INVALID_SELECTOR;
2003
2004 /* calc the descriptor location. */
2005 GCPtrDesc = X86DESC64_BASE(Desc);
2006 GCPtrDesc += (Sel & X86_SEL_MASK);
2007 }
2008
2009 /* read the descriptor. */
2010 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &Desc, GCPtrDesc, sizeof(Desc));
2011 if (RT_FAILURE(rc))
2012 {
2013 rc = PGMPhysSimpleReadGCPtr(pVCpu, &Desc, GCPtrDesc, sizeof(X86DESC));
2014 if (RT_FAILURE(rc))
2015 return rc;
2016 Desc.au64[1] = 0;
2017 }
2018
2019 /*
2020 * Extract the base and limit
2021 * (We ignore the present bit here, which is probably a bit silly...)
2022 */
2023 pSelInfo->Sel = Sel;
2024 pSelInfo->fFlags = DBGFSELINFO_FLAGS_LONG_MODE;
2025 pSelInfo->u.Raw64 = Desc;
2026 if (Desc.Gen.u1DescType)
2027 {
2028 /*
2029 * 64-bit code selectors are wide open, it's not possible to detect
2030 * 64-bit data or stack selectors without also dragging in assumptions
2031 * about current CS (i.e. that's we're executing in 64-bit mode). So,
2032 * the selinfo user needs to deal with this in the context the info is
2033 * used unfortunately.
2034 */
2035 if ( Desc.Gen.u1Long
2036 && !Desc.Gen.u1DefBig
2037 && (Desc.Gen.u4Type & X86_SEL_TYPE_CODE))
2038 {
2039 /* Note! We ignore the segment limit hacks that was added by AMD. */
2040 pSelInfo->GCPtrBase = 0;
2041 pSelInfo->cbLimit = ~(RTGCUINTPTR)0;
2042 }
2043 else
2044 {
2045 pSelInfo->cbLimit = X86DESC_LIMIT(Desc);
2046 if (Desc.Gen.u1Granularity)
2047 pSelInfo->cbLimit = (pSelInfo->cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
2048 pSelInfo->GCPtrBase = X86DESC_BASE(Desc);
2049 }
2050 pSelInfo->SelGate = 0;
2051 }
2052 else if ( Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_LDT
2053 || Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_TSS_AVAIL
2054 || Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY)
2055 {
2056 /* Note. LDT descriptors are weird in long mode, we ignore the footnote
2057 in the AMD manual here as a simplification. */
2058 pSelInfo->GCPtrBase = X86DESC64_BASE(Desc);
2059 pSelInfo->cbLimit = X86DESC_LIMIT(Desc);
2060 if (Desc.Gen.u1Granularity)
2061 pSelInfo->cbLimit = (pSelInfo->cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
2062 pSelInfo->SelGate = 0;
2063 }
2064 else if ( Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE
2065 || Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_TRAP_GATE
2066 || Desc.Gen.u4Type == AMD64_SEL_TYPE_SYS_INT_GATE)
2067 {
2068 pSelInfo->cbLimit = X86DESC64_BASE(Desc);
2069 pSelInfo->GCPtrBase = Desc.Gate.u16OffsetLow
2070 | ((uint32_t)Desc.Gate.u16OffsetHigh << 16)
2071 | ((uint64_t)Desc.Gate.u32OffsetTop << 32);
2072 pSelInfo->SelGate = Desc.Gate.u16Sel;
2073 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_GATE;
2074 }
2075 else
2076 {
2077 pSelInfo->cbLimit = 0;
2078 pSelInfo->GCPtrBase = 0;
2079 pSelInfo->SelGate = 0;
2080 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_INVALID;
2081 }
2082 if (!Desc.Gen.u1Present)
2083 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_NOT_PRESENT;
2084
2085 return VINF_SUCCESS;
2086}
2087
2088
2089/**
2090 * Worker for selmR3GetSelectorInfo32 and SELMR3GetShadowSelectorInfo that
2091 * interprets a legacy descriptor table entry and fills in the selector info
2092 * structure from it.
2093 *
2094 * @param pSelInfo Where to store the selector info. Only the fFlags and
2095 * Sel members have been initialized.
2096 * @param pDesc The legacy descriptor to parse.
2097 */
2098DECLINLINE(void) selmR3SelInfoFromDesc32(PDBGFSELINFO pSelInfo, PCX86DESC pDesc)
2099{
2100 pSelInfo->u.Raw64.au64[1] = 0;
2101 pSelInfo->u.Raw = *pDesc;
2102 if ( pDesc->Gen.u1DescType
2103 || !(pDesc->Gen.u4Type & 4))
2104 {
2105 pSelInfo->cbLimit = X86DESC_LIMIT(*pDesc);
2106 if (pDesc->Gen.u1Granularity)
2107 pSelInfo->cbLimit = (pSelInfo->cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
2108 pSelInfo->GCPtrBase = X86DESC_BASE(*pDesc);
2109 pSelInfo->SelGate = 0;
2110 }
2111 else if (pDesc->Gen.u4Type != X86_SEL_TYPE_SYS_UNDEFINED4)
2112 {
2113 pSelInfo->cbLimit = 0;
2114 if (pDesc->Gen.u4Type == X86_SEL_TYPE_SYS_TASK_GATE)
2115 pSelInfo->GCPtrBase = 0;
2116 else
2117 pSelInfo->GCPtrBase = pDesc->Gate.u16OffsetLow
2118 | (uint32_t)pDesc->Gate.u16OffsetHigh << 16;
2119 pSelInfo->SelGate = pDesc->Gate.u16Sel;
2120 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_GATE;
2121 }
2122 else
2123 {
2124 pSelInfo->cbLimit = 0;
2125 pSelInfo->GCPtrBase = 0;
2126 pSelInfo->SelGate = 0;
2127 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_INVALID;
2128 }
2129 if (!pDesc->Gen.u1Present)
2130 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_NOT_PRESENT;
2131}
2132
2133
2134/**
2135 * Gets information about a 64-bit selector, SELMR3GetSelectorInfo helper.
2136 *
2137 * See SELMR3GetSelectorInfo for details.
2138 *
2139 * @returns VBox status code, see SELMR3GetSelectorInfo for details.
2140 *
2141 * @param pVM Pointer to the VM.
2142 * @param pVCpu Pointer to the VMCPU.
2143 * @param Sel The selector to get info about.
2144 * @param pSelInfo Where to store the information.
2145 */
2146static int selmR3GetSelectorInfo32(PVM pVM, PVMCPU pVCpu, RTSEL Sel, PDBGFSELINFO pSelInfo)
2147{
2148 /*
2149 * Read the descriptor entry
2150 */
2151 pSelInfo->fFlags = 0;
2152 X86DESC Desc;
2153 if ( !(Sel & X86_SEL_LDT)
2154 && ( pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] == (Sel & X86_SEL_MASK)
2155 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] == (Sel & X86_SEL_MASK)
2156 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] == (Sel & X86_SEL_MASK)
2157 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] == (Sel & X86_SEL_MASK)
2158 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] == (Sel & X86_SEL_MASK))
2159 )
2160 {
2161 /*
2162 * Hypervisor descriptor.
2163 */
2164 pSelInfo->fFlags = DBGFSELINFO_FLAGS_HYPER;
2165 if (CPUMIsGuestInProtectedMode(pVCpu))
2166 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_PROT_MODE;
2167 else
2168 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_REAL_MODE;
2169
2170 Desc = pVM->selm.s.paGdtR3[Sel >> X86_SEL_SHIFT];
2171 }
2172 else if (CPUMIsGuestInProtectedMode(pVCpu))
2173 {
2174 /*
2175 * Read it from the guest descriptor table.
2176 */
2177 pSelInfo->fFlags = DBGFSELINFO_FLAGS_PROT_MODE;
2178
2179 VBOXGDTR Gdtr;
2180 RTGCPTR GCPtrDesc;
2181 CPUMGetGuestGDTR(pVCpu, &Gdtr);
2182 if (!(Sel & X86_SEL_LDT))
2183 {
2184 /* GDT */
2185 if ((unsigned)(Sel & X86_SEL_MASK) + sizeof(X86DESC) - 1 > (unsigned)Gdtr.cbGdt)
2186 return VERR_INVALID_SELECTOR;
2187 GCPtrDesc = Gdtr.pGdt + (Sel & X86_SEL_MASK);
2188 }
2189 else
2190 {
2191 /*
2192 * LDT - must locate the LDT first...
2193 */
2194 RTSEL SelLdt = CPUMGetGuestLDTR(pVCpu);
2195 if ( (unsigned)(SelLdt & X86_SEL_MASK) < sizeof(X86DESC) /* the first selector is invalid, right? */ /** @todo r=bird: No, I don't think so */
2196 || (unsigned)(SelLdt & X86_SEL_MASK) + sizeof(X86DESC) - 1 > (unsigned)Gdtr.cbGdt)
2197 return VERR_INVALID_SELECTOR;
2198 GCPtrDesc = Gdtr.pGdt + (SelLdt & X86_SEL_MASK);
2199 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &Desc, GCPtrDesc, sizeof(Desc));
2200 if (RT_FAILURE(rc))
2201 return rc;
2202
2203 /* validate the LDT descriptor. */
2204 if (Desc.Gen.u1Present == 0)
2205 return VERR_SELECTOR_NOT_PRESENT;
2206 if ( Desc.Gen.u1DescType == 1
2207 || Desc.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
2208 return VERR_INVALID_SELECTOR;
2209
2210 unsigned cbLimit = X86DESC_LIMIT(Desc);
2211 if (Desc.Gen.u1Granularity)
2212 cbLimit = (cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
2213 if ((unsigned)(Sel & X86_SEL_MASK) + sizeof(X86DESC) - 1 > cbLimit)
2214 return VERR_INVALID_SELECTOR;
2215
2216 /* calc the descriptor location. */
2217 GCPtrDesc = X86DESC_BASE(Desc);
2218 GCPtrDesc += (Sel & X86_SEL_MASK);
2219 }
2220
2221 /* read the descriptor. */
2222 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &Desc, GCPtrDesc, sizeof(Desc));
2223 if (RT_FAILURE(rc))
2224 return rc;
2225 }
2226 else
2227 {
2228 /*
2229 * We're in real mode.
2230 */
2231 pSelInfo->Sel = Sel;
2232 pSelInfo->GCPtrBase = Sel << 4;
2233 pSelInfo->cbLimit = 0xffff;
2234 pSelInfo->fFlags = DBGFSELINFO_FLAGS_REAL_MODE;
2235 pSelInfo->u.Raw64.au64[0] = 0;
2236 pSelInfo->u.Raw64.au64[1] = 0;
2237 pSelInfo->SelGate = 0;
2238 return VINF_SUCCESS;
2239 }
2240
2241 /*
2242 * Extract the base and limit or sel:offset for gates.
2243 */
2244 pSelInfo->Sel = Sel;
2245 selmR3SelInfoFromDesc32(pSelInfo, &Desc);
2246
2247 return VINF_SUCCESS;
2248}
2249
2250
2251/**
2252 * Gets information about a selector.
2253 *
2254 * Intended for the debugger mostly and will prefer the guest descriptor tables
2255 * over the shadow ones.
2256 *
2257 * @retval VINF_SUCCESS on success.
2258 * @retval VERR_INVALID_SELECTOR if the selector isn't fully inside the
2259 * descriptor table.
2260 * @retval VERR_SELECTOR_NOT_PRESENT if the LDT is invalid or not present. This
2261 * is not returned if the selector itself isn't present, you have to
2262 * check that for yourself (see DBGFSELINFO::fFlags).
2263 * @retval VERR_PAGE_TABLE_NOT_PRESENT or VERR_PAGE_NOT_PRESENT if the
2264 * pagetable or page backing the selector table wasn't present.
2265 * @returns Other VBox status code on other errors.
2266 *
2267 * @param pVM Pointer to the VM.
2268 * @param pVCpu Pointer to the VMCPU.
2269 * @param Sel The selector to get info about.
2270 * @param pSelInfo Where to store the information.
2271 */
2272VMMR3DECL(int) SELMR3GetSelectorInfo(PVM pVM, PVMCPU pVCpu, RTSEL Sel, PDBGFSELINFO pSelInfo)
2273{
2274 AssertPtr(pSelInfo);
2275 if (CPUMIsGuestInLongMode(pVCpu))
2276 return selmR3GetSelectorInfo64(pVCpu, Sel, pSelInfo);
2277 return selmR3GetSelectorInfo32(pVM, pVCpu, Sel, pSelInfo);
2278}
2279
2280
2281/**
2282 * Gets information about a selector from the shadow tables.
2283 *
2284 * This is intended to be faster than the SELMR3GetSelectorInfo() method, but
2285 * requires that the caller ensures that the shadow tables are up to date.
2286 *
2287 * @retval VINF_SUCCESS on success.
2288 * @retval VERR_INVALID_SELECTOR if the selector isn't fully inside the
2289 * descriptor table.
2290 * @retval VERR_SELECTOR_NOT_PRESENT if the LDT is invalid or not present. This
2291 * is not returned if the selector itself isn't present, you have to
2292 * check that for yourself (see DBGFSELINFO::fFlags).
2293 * @retval VERR_PAGE_TABLE_NOT_PRESENT or VERR_PAGE_NOT_PRESENT if the
2294 * pagetable or page backing the selector table wasn't present.
2295 * @returns Other VBox status code on other errors.
2296 *
2297 * @param pVM Pointer to the VM.
2298 * @param Sel The selector to get info about.
2299 * @param pSelInfo Where to store the information.
2300 *
2301 * @remarks Don't use this when in hardware assisted virtualization mode.
2302 */
2303VMMR3DECL(int) SELMR3GetShadowSelectorInfo(PVM pVM, RTSEL Sel, PDBGFSELINFO pSelInfo)
2304{
2305 Assert(pSelInfo);
2306
2307 /*
2308 * Read the descriptor entry
2309 */
2310 X86DESC Desc;
2311 if (!(Sel & X86_SEL_LDT))
2312 {
2313 /*
2314 * Global descriptor.
2315 */
2316 Desc = pVM->selm.s.paGdtR3[Sel >> X86_SEL_SHIFT];
2317 pSelInfo->fFlags = pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] == (Sel & X86_SEL_MASK)
2318 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] == (Sel & X86_SEL_MASK)
2319 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] == (Sel & X86_SEL_MASK)
2320 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] == (Sel & X86_SEL_MASK)
2321 || pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] == (Sel & X86_SEL_MASK)
2322 ? DBGFSELINFO_FLAGS_HYPER
2323 : 0;
2324 /** @todo check that the GDT offset is valid. */
2325 }
2326 else
2327 {
2328 /*
2329 * Local Descriptor.
2330 */
2331 PX86DESC paLDT = (PX86DESC)((char *)pVM->selm.s.pvLdtR3 + pVM->selm.s.offLdtHyper);
2332 Desc = paLDT[Sel >> X86_SEL_SHIFT];
2333 /** @todo check if the LDT page is actually available. */
2334 /** @todo check that the LDT offset is valid. */
2335 pSelInfo->fFlags = 0;
2336 }
2337 if (CPUMIsGuestInProtectedMode(VMMGetCpu0(pVM)))
2338 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_PROT_MODE;
2339 else
2340 pSelInfo->fFlags |= DBGFSELINFO_FLAGS_REAL_MODE;
2341
2342 /*
2343 * Extract the base and limit or sel:offset for gates.
2344 */
2345 pSelInfo->Sel = Sel;
2346 selmR3SelInfoFromDesc32(pSelInfo, &Desc);
2347
2348 return VINF_SUCCESS;
2349}
2350
2351
2352/**
2353 * Formats a descriptor.
2354 *
2355 * @param Desc Descriptor to format.
2356 * @param Sel Selector number.
2357 * @param pszOutput Output buffer.
2358 * @param cchOutput Size of output buffer.
2359 */
2360static void selmR3FormatDescriptor(X86DESC Desc, RTSEL Sel, char *pszOutput, size_t cchOutput)
2361{
2362 /*
2363 * Make variable description string.
2364 */
2365 static struct
2366 {
2367 unsigned cch;
2368 const char *psz;
2369 } const aTypes[32] =
2370 {
2371#define STRENTRY(str) { sizeof(str) - 1, str }
2372 /* system */
2373 STRENTRY("Reserved0 "), /* 0x00 */
2374 STRENTRY("TSS16Avail "), /* 0x01 */
2375 STRENTRY("LDT "), /* 0x02 */
2376 STRENTRY("TSS16Busy "), /* 0x03 */
2377 STRENTRY("Call16 "), /* 0x04 */
2378 STRENTRY("Task "), /* 0x05 */
2379 STRENTRY("Int16 "), /* 0x06 */
2380 STRENTRY("Trap16 "), /* 0x07 */
2381 STRENTRY("Reserved8 "), /* 0x08 */
2382 STRENTRY("TSS32Avail "), /* 0x09 */
2383 STRENTRY("ReservedA "), /* 0x0a */
2384 STRENTRY("TSS32Busy "), /* 0x0b */
2385 STRENTRY("Call32 "), /* 0x0c */
2386 STRENTRY("ReservedD "), /* 0x0d */
2387 STRENTRY("Int32 "), /* 0x0e */
2388 STRENTRY("Trap32 "), /* 0x0f */
2389 /* non system */
2390 STRENTRY("DataRO "), /* 0x10 */
2391 STRENTRY("DataRO Accessed "), /* 0x11 */
2392 STRENTRY("DataRW "), /* 0x12 */
2393 STRENTRY("DataRW Accessed "), /* 0x13 */
2394 STRENTRY("DataDownRO "), /* 0x14 */
2395 STRENTRY("DataDownRO Accessed "), /* 0x15 */
2396 STRENTRY("DataDownRW "), /* 0x16 */
2397 STRENTRY("DataDownRW Accessed "), /* 0x17 */
2398 STRENTRY("CodeEO "), /* 0x18 */
2399 STRENTRY("CodeEO Accessed "), /* 0x19 */
2400 STRENTRY("CodeER "), /* 0x1a */
2401 STRENTRY("CodeER Accessed "), /* 0x1b */
2402 STRENTRY("CodeConfEO "), /* 0x1c */
2403 STRENTRY("CodeConfEO Accessed "), /* 0x1d */
2404 STRENTRY("CodeConfER "), /* 0x1e */
2405 STRENTRY("CodeConfER Accessed ") /* 0x1f */
2406#undef SYSENTRY
2407 };
2408#define ADD_STR(psz, pszAdd) do { strcpy(psz, pszAdd); psz += strlen(pszAdd); } while (0)
2409 char szMsg[128];
2410 char *psz = &szMsg[0];
2411 unsigned i = Desc.Gen.u1DescType << 4 | Desc.Gen.u4Type;
2412 memcpy(psz, aTypes[i].psz, aTypes[i].cch);
2413 psz += aTypes[i].cch;
2414
2415 if (Desc.Gen.u1Present)
2416 ADD_STR(psz, "Present ");
2417 else
2418 ADD_STR(psz, "Not-Present ");
2419 if (Desc.Gen.u1Granularity)
2420 ADD_STR(psz, "Page ");
2421 if (Desc.Gen.u1DefBig)
2422 ADD_STR(psz, "32-bit ");
2423 else
2424 ADD_STR(psz, "16-bit ");
2425#undef ADD_STR
2426 *psz = '\0';
2427
2428 /*
2429 * Limit and Base and format the output.
2430 */
2431 uint32_t u32Limit = X86DESC_LIMIT(Desc);
2432 if (Desc.Gen.u1Granularity)
2433 u32Limit = u32Limit << PAGE_SHIFT | PAGE_OFFSET_MASK;
2434 uint32_t u32Base = X86DESC_BASE(Desc);
2435
2436 RTStrPrintf(pszOutput, cchOutput, "%04x - %08x %08x - base=%08x limit=%08x dpl=%d %s",
2437 Sel, Desc.au32[0], Desc.au32[1], u32Base, u32Limit, Desc.Gen.u2Dpl, szMsg);
2438}
2439
2440
2441/**
2442 * Dumps a descriptor.
2443 *
2444 * @param Desc Descriptor to dump.
2445 * @param Sel Selector number.
2446 * @param pszMsg Message to prepend the log entry with.
2447 */
2448VMMR3DECL(void) SELMR3DumpDescriptor(X86DESC Desc, RTSEL Sel, const char *pszMsg)
2449{
2450 char szOutput[128];
2451 selmR3FormatDescriptor(Desc, Sel, &szOutput[0], sizeof(szOutput));
2452 Log(("%s: %s\n", pszMsg, szOutput));
2453 NOREF(szOutput[0]);
2454}
2455
2456
2457/**
2458 * Display the shadow gdt.
2459 *
2460 * @param pVM Pointer to the VM.
2461 * @param pHlp The info helpers.
2462 * @param pszArgs Arguments, ignored.
2463 */
2464static DECLCALLBACK(void) selmR3InfoGdt(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs)
2465{
2466 NOREF(pszArgs);
2467 pHlp->pfnPrintf(pHlp, "Shadow GDT (GCAddr=%RRv):\n", MMHyperR3ToRC(pVM, pVM->selm.s.paGdtR3));
2468 for (unsigned iGDT = 0; iGDT < SELM_GDT_ELEMENTS; iGDT++)
2469 {
2470 if (pVM->selm.s.paGdtR3[iGDT].Gen.u1Present)
2471 {
2472 char szOutput[128];
2473 selmR3FormatDescriptor(pVM->selm.s.paGdtR3[iGDT], iGDT << X86_SEL_SHIFT, &szOutput[0], sizeof(szOutput));
2474 const char *psz = "";
2475 if (iGDT == ((unsigned)pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS] >> X86_SEL_SHIFT))
2476 psz = " HyperCS";
2477 else if (iGDT == ((unsigned)pVM->selm.s.aHyperSel[SELM_HYPER_SEL_DS] >> X86_SEL_SHIFT))
2478 psz = " HyperDS";
2479 else if (iGDT == ((unsigned)pVM->selm.s.aHyperSel[SELM_HYPER_SEL_CS64] >> X86_SEL_SHIFT))
2480 psz = " HyperCS64";
2481 else if (iGDT == ((unsigned)pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS] >> X86_SEL_SHIFT))
2482 psz = " HyperTSS";
2483 else if (iGDT == ((unsigned)pVM->selm.s.aHyperSel[SELM_HYPER_SEL_TSS_TRAP08] >> X86_SEL_SHIFT))
2484 psz = " HyperTSSTrap08";
2485 pHlp->pfnPrintf(pHlp, "%s%s\n", szOutput, psz);
2486 }
2487 }
2488}
2489
2490
2491/**
2492 * Display the guest gdt.
2493 *
2494 * @param pVM Pointer to the VM.
2495 * @param pHlp The info helpers.
2496 * @param pszArgs Arguments, ignored.
2497 */
2498static DECLCALLBACK(void) selmR3InfoGdtGuest(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs)
2499{
2500 /** @todo SMP support! */
2501 PVMCPU pVCpu = &pVM->aCpus[0];
2502
2503 VBOXGDTR GDTR;
2504 CPUMGetGuestGDTR(pVCpu, &GDTR);
2505 RTGCPTR GCPtrGDT = GDTR.pGdt;
2506 unsigned cGDTs = ((unsigned)GDTR.cbGdt + 1) / sizeof(X86DESC);
2507
2508 pHlp->pfnPrintf(pHlp, "Guest GDT (GCAddr=%RGv limit=%x):\n", GCPtrGDT, GDTR.cbGdt);
2509 for (unsigned iGDT = 0; iGDT < cGDTs; iGDT++, GCPtrGDT += sizeof(X86DESC))
2510 {
2511 X86DESC GDTE;
2512 int rc = PGMPhysSimpleReadGCPtr(pVCpu, &GDTE, GCPtrGDT, sizeof(GDTE));
2513 if (RT_SUCCESS(rc))
2514 {
2515 if (GDTE.Gen.u1Present)
2516 {
2517 char szOutput[128];
2518 selmR3FormatDescriptor(GDTE, iGDT << X86_SEL_SHIFT, &szOutput[0], sizeof(szOutput));
2519 pHlp->pfnPrintf(pHlp, "%s\n", szOutput);
2520 }
2521 }
2522 else if (rc == VERR_PAGE_NOT_PRESENT)
2523 {
2524 if ((GCPtrGDT & PAGE_OFFSET_MASK) + sizeof(X86DESC) - 1 < sizeof(X86DESC))
2525 pHlp->pfnPrintf(pHlp, "%04x - page not present (GCAddr=%RGv)\n", iGDT << X86_SEL_SHIFT, GCPtrGDT);
2526 }
2527 else
2528 pHlp->pfnPrintf(pHlp, "%04x - read error rc=%Rrc GCAddr=%RGv\n", iGDT << X86_SEL_SHIFT, rc, GCPtrGDT);
2529 }
2530 NOREF(pszArgs);
2531}
2532
2533
2534/**
2535 * Display the shadow ldt.
2536 *
2537 * @param pVM Pointer to the VM.
2538 * @param pHlp The info helpers.
2539 * @param pszArgs Arguments, ignored.
2540 */
2541static DECLCALLBACK(void) selmR3InfoLdt(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs)
2542{
2543 unsigned cLDTs = ((unsigned)pVM->selm.s.cbLdtLimit + 1) >> X86_SEL_SHIFT;
2544 PX86DESC paLDT = (PX86DESC)((char *)pVM->selm.s.pvLdtR3 + pVM->selm.s.offLdtHyper);
2545 pHlp->pfnPrintf(pHlp, "Shadow LDT (GCAddr=%RRv limit=%#x):\n", pVM->selm.s.pvLdtRC + pVM->selm.s.offLdtHyper, pVM->selm.s.cbLdtLimit);
2546 for (unsigned iLDT = 0; iLDT < cLDTs; iLDT++)
2547 {
2548 if (paLDT[iLDT].Gen.u1Present)
2549 {
2550 char szOutput[128];
2551 selmR3FormatDescriptor(paLDT[iLDT], (iLDT << X86_SEL_SHIFT) | X86_SEL_LDT, &szOutput[0], sizeof(szOutput));
2552 pHlp->pfnPrintf(pHlp, "%s\n", szOutput);
2553 }
2554 }
2555 NOREF(pszArgs);
2556}
2557
2558
2559/**
2560 * Display the guest ldt.
2561 *
2562 * @param pVM Pointer to the VM.
2563 * @param pHlp The info helpers.
2564 * @param pszArgs Arguments, ignored.
2565 */
2566static DECLCALLBACK(void) selmR3InfoLdtGuest(PVM pVM, PCDBGFINFOHLP pHlp, const char *pszArgs)
2567{
2568 /** @todo SMP support! */
2569 PVMCPU pVCpu = &pVM->aCpus[0];
2570
2571 RTSEL SelLdt = CPUMGetGuestLDTR(pVCpu);
2572 if (!(SelLdt & X86_SEL_MASK))
2573 {
2574 pHlp->pfnPrintf(pHlp, "Guest LDT (Sel=%x): Null-Selector\n", SelLdt);
2575 return;
2576 }
2577
2578 RTGCPTR GCPtrLdt;
2579 unsigned cbLdt;
2580 int rc = SELMGetLDTFromSel(pVM, SelLdt, &GCPtrLdt, &cbLdt);
2581 if (RT_FAILURE(rc))
2582 {
2583 pHlp->pfnPrintf(pHlp, "Guest LDT (Sel=%x): rc=%Rrc\n", SelLdt, rc);
2584 return;
2585 }
2586
2587 pHlp->pfnPrintf(pHlp, "Guest LDT (Sel=%x GCAddr=%RGv limit=%x):\n", SelLdt, GCPtrLdt, cbLdt);
2588 unsigned cLdts = (cbLdt + 1) >> X86_SEL_SHIFT;
2589 for (unsigned iLdt = 0; iLdt < cLdts; iLdt++, GCPtrLdt += sizeof(X86DESC))
2590 {
2591 X86DESC LdtE;
2592 rc = PGMPhysSimpleReadGCPtr(pVCpu, &LdtE, GCPtrLdt, sizeof(LdtE));
2593 if (RT_SUCCESS(rc))
2594 {
2595 if (LdtE.Gen.u1Present)
2596 {
2597 char szOutput[128];
2598 selmR3FormatDescriptor(LdtE, (iLdt << X86_SEL_SHIFT) | X86_SEL_LDT, &szOutput[0], sizeof(szOutput));
2599 pHlp->pfnPrintf(pHlp, "%s\n", szOutput);
2600 }
2601 }
2602 else if (rc == VERR_PAGE_NOT_PRESENT)
2603 {
2604 if ((GCPtrLdt & PAGE_OFFSET_MASK) + sizeof(X86DESC) - 1 < sizeof(X86DESC))
2605 pHlp->pfnPrintf(pHlp, "%04x - page not present (GCAddr=%RGv)\n", (iLdt << X86_SEL_SHIFT) | X86_SEL_LDT, GCPtrLdt);
2606 }
2607 else
2608 pHlp->pfnPrintf(pHlp, "%04x - read error rc=%Rrc GCAddr=%RGv\n", (iLdt << X86_SEL_SHIFT) | X86_SEL_LDT, rc, GCPtrLdt);
2609 }
2610 NOREF(pszArgs);
2611}
2612
2613
2614/**
2615 * Dumps the hypervisor GDT
2616 *
2617 * @param pVM Pointer to the VM.
2618 */
2619VMMR3DECL(void) SELMR3DumpHyperGDT(PVM pVM)
2620{
2621 DBGFR3Info(pVM, "gdt", NULL, NULL);
2622}
2623
2624
2625/**
2626 * Dumps the hypervisor LDT
2627 *
2628 * @param pVM Pointer to the VM.
2629 */
2630VMMR3DECL(void) SELMR3DumpHyperLDT(PVM pVM)
2631{
2632 DBGFR3Info(pVM, "ldt", NULL, NULL);
2633}
2634
2635
2636/**
2637 * Dumps the guest GDT
2638 *
2639 * @param pVM Pointer to the VM.
2640 */
2641VMMR3DECL(void) SELMR3DumpGuestGDT(PVM pVM)
2642{
2643 DBGFR3Info(pVM, "gdtguest", NULL, NULL);
2644}
2645
2646
2647/**
2648 * Dumps the guest LDT
2649 *
2650 * @param pVM Pointer to the VM.
2651 */
2652VMMR3DECL(void) SELMR3DumpGuestLDT(PVM pVM)
2653{
2654 DBGFR3Info(pVM, "ldtguest", NULL, NULL);
2655}
2656
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette