TRPMRCHandlers.cpp@ 56690

Last change on this file since 56690 was 56628, checked in by vboxsync, 9 years ago
IEM: Postpone INS memory writes to ring-3 if we hit an access handler. We cannot redo the read, that will only mess things us. This introduces a new per-cpu forced flag, VMCPU_FF_IEM, that must cause immediate return to ring-3 where it will be serviced ASAP. IEM will try return VINF_EM_RAW_TO_R3 as well to help make sure we get back to ring-3.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 56.0 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 56628 2015-06-24 19:44:56Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#include <VBox/vmm/csam.h>
31	#include <VBox/vmm/patm.h>
32	#include <VBox/vmm/mm.h>
33	#include <VBox/vmm/cpum.h>
34	#include "TRPMInternal.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/vmm.h>
37	#include <VBox/param.h>
38
39	#include <VBox/err.h>
40	#include <VBox/dis.h>
41	#include <VBox/disopcode.h>
42	#include <VBox/log.h>
43	#include <VBox/vmm/tm.h>
44	#include <iprt/asm.h>
45	#include <iprt/asm-amd64-x86.h>
46	#include <iprt/assert.h>
47	#include <iprt/x86.h>
48
49
50	/*******************************************************************************
51	* Defined Constants And Macros *
52	*******************************************************************************/
53	/* still here. MODR/M byte parsing */
54	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
55	#define X86_OPCODE_MODRM_REG_MASK 0x38
56	#define X86_OPCODE_MODRM_RM_MASK 0x07
57
58	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
59	#define DTRACE_EXPERIMENT
60
61	#if 1
62	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
63	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
64	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
65	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
66	#else
67	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
68	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
69	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
70	else do {} while (0)
71	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
72	do { \
73	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
74	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
75	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
76	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
77	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
78	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
79	} while (0)
80	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
81	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
82	#endif
83
84	/*******************************************************************************
85	* Structures and Typedefs *
86	*******************************************************************************/
87	/** Pointer to a readonly hypervisor trap record. */
88	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
89
90	/**
91	* A hypervisor trap record.
92	* This contains information about a handler for a instruction range.
93	*
94	* @remark This must match what TRPM_HANDLER outputs.
95	*/
96	typedef struct TRPMGCHYPER
97	{
98	/** The start address. */
99	uintptr_t uStartEIP;
100	/** The end address. (exclusive)
101	* If NULL the it's only for the instruction at pvStartEIP. */
102	uintptr_t uEndEIP;
103	/**
104	* The handler.
105	*
106	* @returns VBox status code
107	* VINF_SUCCESS means we've handled the trap.
108	* Any other error code means returning to the host context.
109	* @param pVM Pointer to the VM.
110	* @param pRegFrame The register frame.
111	* @param uUser The user argument.
112	*/
113	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
114	/** Whatever the handler desires to put here. */
115	uintptr_t uUser;
116	} TRPMGCHYPER;
117
118
119	/*******************************************************************************
120	* Global Variables *
121	*******************************************************************************/
122	RT_C_DECLS_BEGIN
123	/** Defined in VMMRC0.asm or VMMRC99.asm.
124	* @{ */
125	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
126	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
127	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
128	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
129	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
130	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
131	/** @} */
132	RT_C_DECLS_END
133
134
135	/*******************************************************************************
136	* Internal Functions *
137	*******************************************************************************/
138	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
139	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
140	RT_C_DECLS_END
141
142
143
144	/**
145	* Exits the trap, called when exiting a trap handler.
146	*
147	* Will reset the trap if it's not a guest trap or the trap
148	* is already handled. Will process resume guest FFs.
149	*
150	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
151	* happened.
152	* @param pVM Pointer to the VM.
153	* @param pVCpu Pointer to the VMCPU.
154	* @param rc The VBox status code to return.
155	* @param pRegFrame Pointer to the register frame for the trap.
156	*
157	* @remarks This must not be used for hypervisor traps, only guest traps.
158	*/
159	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
160	{
161	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
162	NOREF(uOldActiveVector);
163
164	/* Reset trap? */
165	if ( rc != VINF_EM_RAW_GUEST_TRAP
166	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
167	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
168
169	#ifdef VBOX_HIGH_RES_TIMERS_HACK
170	/*
171	* We should poll the timers occasionally.
172	* We must NOT do this too frequently as it adds a significant overhead
173	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
174	* (The heuristic is not very intelligent, we should really check trap
175	* frequency etc. here, but alas, we lack any such information atm.)
176	*/
177	static unsigned s_iTimerPoll = 0;
178	if (rc == VINF_SUCCESS)
179	{
180	if (!(++s_iTimerPoll & 0xf))
181	{
182	TMTimerPollVoid(pVM, pVCpu);
183	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
184	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
185	}
186	}
187	else
188	s_iTimerPoll = 0;
189	#endif
190
191	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
192	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
193	{
194	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
195	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
196	{
197	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
198	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
199	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
200	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
201	*/
202	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
203	}
204	}
205
206	/*
207	* Pending resume-guest-FF?
208	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
209	*/
210	if ( rc == VINF_SUCCESS
211	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
212	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3 \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
213	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
214	\| VMCPU_FF_PDM_CRITSECT
215	\| VMCPU_FF_IEM
216	\| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT
217	\| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
218	)
219	)
220	)
221	{
222	/* The out of memory condition naturally outranks the others. */
223	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
224	rc = VINF_EM_NO_MEMORY;
225	/* Pending Ring-3 action. */
226	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT \| VMCPU_FF_IEM))
227	{
228	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
229	rc = VINF_EM_RAW_TO_R3;
230	}
231	/* Pending timer action. */
232	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
233	rc = VINF_EM_RAW_TIMER_PENDING;
234	/* The Virtual Sync clock has stopped. */
235	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
236	rc = VINF_EM_RAW_TO_R3;
237	/* DMA work pending? */
238	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
239	rc = VINF_EM_RAW_TO_R3;
240	/* Pending request packets might contain actions that need immediate
241	attention, such as pending hardware interrupts. */
242	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
243	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
244	rc = VINF_EM_PENDING_REQUEST;
245	/* Pending GDT/LDT/TSS sync. */
246	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
247	rc = VINF_SELM_SYNC_GDT;
248	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
249	rc = VINF_EM_RAW_TO_R3;
250	/* Pending interrupt: dispatch it. */
251	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
252	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
253	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
254	)
255	{
256	uint8_t u8Interrupt;
257	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
258	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
259	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
260	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
261	/* can't return if successful */
262	Assert(rc != VINF_SUCCESS);
263
264	/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
265	Assert(uOldActiveVector <= 16);
266	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
267
268	/* Assert the trap and go to the recompiler to dispatch it. */
269	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
270
271	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
272	rc = VINF_EM_RAW_INTERRUPT_PENDING;
273	}
274	/*
275	* Try sync CR3?
276	*/
277	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
278	{
279	#if 1
280	PGMRZDynMapReleaseAutoSet(pVCpu);
281	PGMRZDynMapStartAutoSet(pVCpu);
282	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
283	#else
284	rc = VINF_PGM_SYNC_CR3;
285	#endif
286	}
287	}
288
289	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
290	PGMRZDynMapReleaseAutoSet(pVCpu);
291	return rc;
292	}
293
294
295	/**
296	* \#DB (Debug event) handler.
297	*
298	* @returns VBox status code.
299	* VINF_SUCCESS means we completely handled this trap,
300	* other codes are passed execution to host context.
301	*
302	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
303	* @param pRegFrame Pointer to the register frame for the trap.
304	* @internal
305	*/
306	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
307	{
308	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
309	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
310	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
311	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
312	TRPM_ENTER_DBG_HOOK(1);
313
314	/*
315	* We currently don't make use of the X86_DR7_GD bit, but
316	* there might come a time when we do.
317	*/
318	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
319	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
320	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
321	VERR_NOT_IMPLEMENTED);
322	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
323
324	/*
325	* Now leave the rest to the DBGF.
326	*/
327	PGMRZDynMapStartAutoSet(pVCpu);
328	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
329	if (rc == VINF_EM_RAW_GUEST_TRAP)
330	{
331	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
332	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
333	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
334	}
335	else if (rc == VINF_EM_DBG_STEPPED)
336	pRegFrame->eflags.Bits.u1TF = 0;
337
338	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
339	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg %EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
340	TRPM_EXIT_DBG_HOOK(1);
341	return rc;
342	}
343
344
345	/**
346	* \#DB (Debug event) handler for the hypervisor code.
347	*
348	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
349	* mapping set as well as the default trap exit path since they are both really
350	* bad ideas in this context.
351	*
352	* @returns VBox status code.
353	* VINF_SUCCESS means we completely handled this trap,
354	* other codes are passed execution to host context.
355	*
356	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
357	* @param pRegFrame Pointer to the register frame for the trap.
358	* @internal
359	*/
360	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
361	{
362	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
363	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
364	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
365	TRPM_ENTER_DBG_HOOK_HYPER(1);
366	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
367
368	/*
369	* We currently don't make use of the X86_DR7_GD bit, but
370	* there might come a time when we do.
371	*/
372	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
373	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
374	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
375	VERR_NOT_IMPLEMENTED);
376	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
377
378	/*
379	* Now leave the rest to the DBGF.
380	*/
381	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
382	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
383	if (rc == VINF_EM_DBG_STEPPED)
384	pRegFrame->eflags.Bits.u1TF = 0;
385
386	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
387	TRPM_EXIT_DBG_HOOK_HYPER(1);
388	return rc;
389	}
390
391
392	/**
393	* NMI handler, for when we are using NMIs to debug things.
394	*
395	* @returns VBox status code.
396	* VINF_SUCCESS means we completely handled this trap,
397	* other codes are passed execution to host context.
398	*
399	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
400	* @param pRegFrame Pointer to the register frame for the trap.
401	* @internal
402	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
403	*/
404	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
405	{
406	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
407	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
408	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
409	#endif
410	NOREF(pTrpmCpu);
411	return VERR_TRPM_DONT_PANIC;
412	}
413
414
415	/**
416	* NMI handler, for when we are using NMIs to debug things.
417	*
418	* This is the handler we're most likely to hit when the NMI fires (it is
419	* unlikely that we'll be stuck in guest code).
420	*
421	* @returns VBox status code.
422	* VINF_SUCCESS means we completely handled this trap,
423	* other codes are passed execution to host context.
424	*
425	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
426	* @param pRegFrame Pointer to the register frame for the trap.
427	* @internal
428	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
429	*/
430	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
431	{
432	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
433	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
434	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
435	#endif
436	NOREF(pTrpmCpu);
437	return VERR_TRPM_DONT_PANIC;
438	}
439
440
441	/**
442	* \#BP (Breakpoint) handler.
443	*
444	* @returns VBox status code.
445	* VINF_SUCCESS means we completely handled this trap,
446	* other codes are passed execution to host context.
447	*
448	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
449	* @param pRegFrame Pointer to the register frame for the trap.
450	* @internal
451	*/
452	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
453	{
454	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
455	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
456	int rc;
457	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
458	TRPM_ENTER_DBG_HOOK(3);
459	PGMRZDynMapStartAutoSet(pVCpu);
460
461	/*
462	* PATM is using INT3s, let them have a go first.
463	*/
464	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
465	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
466	&& !pRegFrame->eflags.Bits.u1VM)
467	{
468	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
469	if ( rc == VINF_SUCCESS
470	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
471	\|\| rc == VINF_PATM_PATCH_INT3
472	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
473	{
474	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
475	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
476	TRPM_EXIT_DBG_HOOK(3);
477	return rc;
478	}
479	}
480	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
481
482	/* anything we should do with this? Schedule it in GC? */
483	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
484	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
485	TRPM_EXIT_DBG_HOOK(3);
486	return rc;
487	}
488
489
490	/**
491	* \#BP (Breakpoint) handler.
492	*
493	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
494	* harmful to us (common trap exit and the auto mapping set).
495	*
496	* @returns VBox status code.
497	* VINF_SUCCESS means we completely handled this trap,
498	* other codes are passed execution to host context.
499	*
500	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
501	* @param pRegFrame Pointer to the register frame for the trap.
502	* @internal
503	*/
504	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
505	{
506	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
507	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
508	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
509	TRPM_ENTER_DBG_HOOK_HYPER(3);
510
511	/*
512	* Hand it over to DBGF.
513	*/
514	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
515	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
516
517	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
518	TRPM_EXIT_DBG_HOOK_HYPER(3);
519	return rc;
520	}
521
522
523	/**
524	* Trap handler for illegal opcode fault (\#UD).
525	*
526	* @returns VBox status code.
527	* VINF_SUCCESS means we completely handled this trap,
528	* other codes are passed execution to host context.
529	*
530	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
531	* @param pRegFrame Pointer to the register frame for the trap.
532	* @internal
533	*/
534	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
535	{
536	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
537	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
538	int rc;
539	LogFlow(("TRPMGC06: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
540	TRPM_ENTER_DBG_HOOK(6);
541	PGMRZDynMapStartAutoSet(pVCpu);
542
543	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
544	{
545	/*
546	* Decode the instruction.
547	*/
548	RTGCPTR PC;
549	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
550	pRegFrame->rip, &PC);
551	if (RT_FAILURE(rc))
552	{
553	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
554	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
555	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
556	TRPM_EXIT_DBG_HOOK(6);
557	return rc;
558	}
559
560	DISCPUSTATE Cpu;
561	uint32_t cbOp;
562	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
563	if (RT_FAILURE(rc))
564	{
565	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
566	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
567	TRPM_EXIT_DBG_HOOK(6);
568	return rc;
569	}
570
571	/*
572	* UD2 in a patch?
573	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
574	*/
575	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
576	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
577	{
578	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
579	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
580	/** @todo These tests are completely unnecessary, should just follow the
581	* flow and return at the end of the function. */
582	if ( rc == VINF_SUCCESS
583	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
584	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
585	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
586	\|\| rc == VINF_EM_RESCHEDULE)
587	{
588	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
589	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
590	TRPM_EXIT_DBG_HOOK(6);
591	return rc;
592	}
593	}
594	/*
595	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
596	*/
597	else if (Cpu.fPrefix & DISPREFIX_LOCK)
598	{
599	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
600	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
601	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
602	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
603	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
604	#else
605	rc = VINF_EM_RAW_EMULATE_INSTR;
606	#endif
607	}
608	/*
609	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
610	*/
611	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
612	{
613	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
614	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
615	}
616	else if (GIMShouldTrapXcptUD(pVCpu))
617	{
618	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
619	rc = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu);
620	if (RT_FAILURE(rc))
621	{
622	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD -> VINF_EM_RAW_EMULATE_INSTR\n"));
623	rc = VINF_EM_RAW_EMULATE_INSTR;
624	}
625	}
626	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
627	else
628	{
629	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
630	rc = VINF_EM_RAW_EMULATE_INSTR;
631	}
632	}
633	else
634	{
635	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
636	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
637	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
638	}
639
640	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
641	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
642	TRPM_EXIT_DBG_HOOK(6);
643	return rc;
644	}
645
646
647	/**
648	* Trap handler for device not present fault (\#NM).
649	*
650	* Device not available, FP or (F)WAIT instruction.
651	*
652	* @returns VBox status code.
653	* VINF_SUCCESS means we completely handled this trap,
654	* other codes are passed execution to host context.
655	*
656	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
657	* @param pRegFrame Pointer to the register frame for the trap.
658	* @internal
659	*/
660	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
661	{
662	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
663	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
664	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
665	TRPM_ENTER_DBG_HOOK(7);
666	PGMRZDynMapStartAutoSet(pVCpu);
667
668	int rc = CPUMHandleLazyFPU(pVCpu);
669	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
670	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
671	TRPM_EXIT_DBG_HOOK(7);
672	return rc;
673	}
674
675
676	/**
677	* \#NP ((segment) Not Present) handler.
678	*
679	* @returns VBox status code.
680	* VINF_SUCCESS means we completely handled this trap,
681	* other codes are passed execution to host context.
682	*
683	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
684	* @param pRegFrame Pointer to the register frame for the trap.
685	* @internal
686	*/
687	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
688	{
689	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
690	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
691	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
692	TRPM_ENTER_DBG_HOOK(0xb);
693	PGMRZDynMapStartAutoSet(pVCpu);
694
695	/*
696	* Try to detect instruction by opcode which caused trap.
697	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
698	* accessing user code. need to handle it somehow in future!
699	*/
700	RTGCPTR GCPtr;
701	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
702	(RTGCPTR)pRegFrame->eip, &GCPtr)
703	== VINF_SUCCESS)
704	{
705	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
706
707	/*
708	* First skip possible instruction prefixes, such as:
709	* OS, AS
710	* CS:, DS:, ES:, SS:, FS:, GS:
711	* REPE, REPNE
712	*
713	* note: Currently we supports only up to 4 prefixes per opcode, more
714	* prefixes (normally not used anyway) will cause trap d in guest.
715	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
716	* check this issue, its too hard.
717	*/
718	for (unsigned i = 0; i < 4; i++)
719	{
720	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
721	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
722	&& pu8Code[0] != 0x2e /* CS: */
723	&& pu8Code[0] != 0x36 /* SS: */
724	&& pu8Code[0] != 0x3e /* DS: */
725	&& pu8Code[0] != 0x26 /* ES: */
726	&& pu8Code[0] != 0x64 /* FS: */
727	&& pu8Code[0] != 0x65 /* GS: */
728	&& pu8Code[0] != 0x66 /* OS */
729	&& pu8Code[0] != 0x67 /* AS */
730	)
731	break;
732	pu8Code++;
733	}
734
735	/*
736	* Detect right switch using a callgate.
737	*
738	* We recognize the following causes for the trap 0b:
739	* CALL FAR, CALL FAR []
740	* JMP FAR, JMP FAR []
741	* IRET (may cause a task switch)
742	*
743	* Note: we can't detect whether the trap was caused by a call to a
744	* callgate descriptor or it is a real trap 0b due to a bad selector.
745	* In both situations we'll pass execution to our recompiler so we don't
746	* have to worry.
747	* If we wanted to do better detection, we have set GDT entries to callgate
748	* descriptors pointing to our own handlers.
749	*/
750	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
751	if ( pu8Code[0] == 0x9a /* CALL FAR */
752	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
753	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
754	\|\| pu8Code[0] == 0xea /* JMP FAR */
755	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
756	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
757	\|\| pu8Code[0] == 0xcf /* IRET */
758	)
759	{
760	/*
761	* Got potential call to callgate.
762	* We simply return execution to the recompiler to do emulation
763	* starting from the instruction which caused the trap.
764	*/
765	pTrpmCpu->uActiveVector = UINT32_MAX;
766	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
767	TRPM_EXIT_DBG_HOOK(0xb);
768	PGMRZDynMapReleaseAutoSet(pVCpu);
769	return VINF_EM_RAW_RING_SWITCH;
770	}
771	}
772
773	/*
774	* Pass trap 0b as is to the recompiler in all other cases.
775	*/
776	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
777	PGMRZDynMapReleaseAutoSet(pVCpu);
778	TRPM_EXIT_DBG_HOOK(0xb);
779	return VINF_EM_RAW_GUEST_TRAP;
780	}
781
782
783	/**
784	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
785	*
786	* @returns VBox status code.
787	* VINF_SUCCESS means we completely handled this trap,
788	* other codes are passed execution to host context.
789	*
790	* @param pVM Pointer to the VM.
791	* @param pVCpu Pointer to the VMCPU.
792	* @param pRegFrame Pointer to the register frame for the trap.
793	* @param pCpu The opcode info.
794	* @param PC The program counter corresponding to cs:eip in pRegFrame.
795	*/
796	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
797	{
798	int rc;
799	TRPM_ENTER_DBG_HOOK(0xd);
800
801	/*
802	* Try handle it here, if not return to HC and emulate/interpret it there.
803	*/
804	switch (pCpu->pCurInstr->uOpcode)
805	{
806	case OP_INT3:
807	/*
808	* Little hack to make the code below not fail
809	*/
810	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
811	pCpu->Param1.uValue = 3;
812	/* fallthru */
813	case OP_INT:
814	{
815	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
816	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
817	if (pCpu->Param1.uValue == 3)
818	{
819	/* Int 3 replacement patch? */
820	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
821	{
822	AssertFailed();
823	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
824	}
825	}
826	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
827	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
828	{
829	TRPM_EXIT_DBG_HOOK(0xd);
830	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
831	}
832
833	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
834	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
835	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
836	}
837
838	#ifdef PATM_EMULATE_SYSENTER
839	case OP_SYSEXIT:
840	case OP_SYSRET:
841	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
842	TRPM_EXIT_DBG_HOOK(0xd);
843	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
844	#endif
845
846	case OP_HLT:
847	/* If it's in patch code, defer to ring-3. */
848	if (PATMIsPatchGCAddr(pVM, PC))
849	break;
850
851	pRegFrame->eip += pCpu->cbInstr;
852	TRPM_EXIT_DBG_HOOK(0xd);
853	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
854
855
856	/*
857	* These instructions are used by PATM and CASM for finding
858	* dangerous non-trapping instructions. Thus, since all
859	* scanning and patching is done in ring-3 we'll have to
860	* return to ring-3 on the first encounter of these instructions.
861	*/
862	case OP_MOV_CR:
863	case OP_MOV_DR:
864	/* We can safely emulate control/debug register move instructions in patched code. */
865	if ( !PATMIsPatchGCAddr(pVM, PC)
866	&& !CSAMIsKnownDangerousInstr(pVM, PC))
867	break;
868	case OP_INVLPG:
869	case OP_LLDT:
870	case OP_STI:
871	case OP_RDTSC: /* just in case */
872	case OP_RDPMC:
873	case OP_CLTS:
874	case OP_WBINVD: /* nop */
875	case OP_RDMSR:
876	case OP_WRMSR:
877	{
878	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
879	if (rc == VERR_EM_INTERPRETER)
880	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
881	TRPM_EXIT_DBG_HOOK(0xd);
882	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
883	}
884	}
885
886	TRPM_EXIT_DBG_HOOK(0xd);
887	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
888	}
889
890
891	/**
892	* \#GP (General Protection Fault) handler for Ring-3.
893	*
894	* @returns VBox status code.
895	* VINF_SUCCESS means we completely handled this trap,
896	* other codes are passed execution to host context.
897	*
898	* @param pVM Pointer to the VM.
899	* @param pVCpu Pointer to the VMCPU.
900	* @param pRegFrame Pointer to the register frame for the trap.
901	* @param pCpu The opcode info.
902	* @param PC The program counter corresponding to cs:eip in pRegFrame.
903	*/
904	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
905	{
906	int rc;
907	Assert(!pRegFrame->eflags.Bits.u1VM);
908	TRPM_ENTER_DBG_HOOK(0xd);
909
910	switch (pCpu->pCurInstr->uOpcode)
911	{
912	/*
913	* INT3 and INT xx are ring-switching.
914	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
915	*/
916	case OP_INT3:
917	/*
918	* Little hack to make the code below not fail
919	*/
920	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
921	pCpu->Param1.uValue = 3;
922	/* fall thru */
923	case OP_INT:
924	{
925	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
926	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
927	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
928	{
929	TRPM_EXIT_DBG_HOOK(0xd);
930	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
931	}
932
933	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
934	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
935	TRPM_EXIT_DBG_HOOK(0xd);
936	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
937	}
938
939	/*
940	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
941	*/
942	case OP_SYSCALL:
943	case OP_SYSENTER:
944	#ifdef PATM_EMULATE_SYSENTER
945	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
946	if (rc == VINF_SUCCESS)
947	{
948	TRPM_EXIT_DBG_HOOK(0xd);
949	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
950	}
951	/* else no break; */
952	#endif
953	case OP_BOUND:
954	case OP_INTO:
955	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
956	TRPM_EXIT_DBG_HOOK(0xd);
957	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
958
959	/*
960	* Handle virtualized TSC & PMC reads, just in case.
961	*/
962	case OP_RDTSC:
963	case OP_RDPMC:
964	{
965	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
966	if (rc == VERR_EM_INTERPRETER)
967	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
968	TRPM_EXIT_DBG_HOOK(0xd);
969	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
970	}
971
972	/*
973	* STI and CLI are I/O privileged, i.e. if IOPL
974	*/
975	case OP_STI:
976	case OP_CLI:
977	{
978	uint32_t efl = CPUMRawGetEFlags(pVCpu);
979	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
980	if (X86_EFL_GET_IOPL(efl) >= cpl)
981	{
982	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
983	TRPM_EXIT_DBG_HOOK(0xd);
984	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
985	}
986	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
987	break;
988	}
989	}
990
991	/*
992	* A genuine guest fault.
993	*/
994	TRPM_EXIT_DBG_HOOK(0xd);
995	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
996	}
997
998
999	/**
1000	* Emulates RDTSC for the \#GP handler.
1001	*
1002	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
1003	*
1004	* @param pVM Pointer to the VM.
1005	* @param pVCpu Pointer to the VMCPU.
1006	* @param pRegFrame Pointer to the register frame for the trap.
1007	* This will be updated on successful return.
1008	*/
1009	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1010	{
1011	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1012	TRPM_ENTER_DBG_HOOK(0xd);
1013
1014	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1015	{
1016	TRPM_EXIT_DBG_HOOK(0xd);
1017	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1018	}
1019
1020	uint64_t uTicks = TMCpuTickGet(pVCpu);
1021	pRegFrame->eax = uTicks;
1022	pRegFrame->edx = uTicks >> 32;
1023	pRegFrame->eip += 2;
1024	TRPM_EXIT_DBG_HOOK(0xd);
1025	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1026	}
1027
1028
1029	/**
1030	* \#GP (General Protection Fault) handler.
1031	*
1032	* @returns VBox status code.
1033	* VINF_SUCCESS means we completely handled this trap,
1034	* other codes are passed execution to host context.
1035	*
1036	* @param pVM Pointer to the VM.
1037	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1038	* @param pRegFrame Pointer to the register frame for the trap.
1039	*/
1040	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1041	{
1042	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1043	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1044	TRPM_ENTER_DBG_HOOK(0xd);
1045
1046	/*
1047	* Convert and validate CS.
1048	*/
1049	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1050	RTGCPTR PC;
1051	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1052	pRegFrame->rip, &PC);
1053	if (RT_FAILURE(rc))
1054	{
1055	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1056	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1057	TRPM_EXIT_DBG_HOOK(0xd);
1058	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1059	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1060	}
1061
1062	/*
1063	* Disassemble the instruction.
1064	*/
1065	DISCPUSTATE Cpu;
1066	uint32_t cbOp;
1067	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1068	if (RT_FAILURE(rc))
1069	{
1070	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1071	TRPM_EXIT_DBG_HOOK(0xd);
1072	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1073	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1074	}
1075	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1076
1077	/*
1078	* Optimize RDTSC traps.
1079	* Some guests (like Solaris) are using RDTSC all over the place and
1080	* will end up trapping a lot because of that.
1081	*
1082	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1083	*/
1084	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1085	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1086
1087	/*
1088	* Deal with I/O port access.
1089	*/
1090	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1091	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1092	{
1093	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1094	if (IOM_SUCCESS(rcStrict))
1095	{
1096	pRegFrame->rip += cbOp;
1097
1098	/*
1099	* Check for I/O breakpoints. A bit clumsy, but should be short lived (moved to IEM).
1100	*/
1101	uint32_t const uDr7 = CPUMGetGuestDR7(pVCpu);
1102	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
1103	&& X86_DR7_ANY_RW_IO(uDr7)
1104	&& (CPUMGetGuestCR4(pVCpu) & X86_CR4_DE))
1105	\|\| DBGFBpIsHwIoArmed(pVM)))
1106	{
1107	uint64_t uPort = pRegFrame->dx;
1108	unsigned cbValue;
1109	if ( Cpu.pCurInstr->uOpcode == OP_IN
1110	\|\| Cpu.pCurInstr->uOpcode == OP_INSB
1111	\|\| Cpu.pCurInstr->uOpcode == OP_INSWD)
1112	{
1113	cbValue = DISGetParamSize(&Cpu, &Cpu.Param1);
1114	if (Cpu.Param2.fUse & DISUSE_IMMEDIATE)
1115	uPort = Cpu.Param2.uValue;
1116	}
1117	else
1118	{
1119	cbValue = DISGetParamSize(&Cpu, &Cpu.Param2);
1120	if (Cpu.Param1.fUse & DISUSE_IMMEDIATE)
1121	uPort = Cpu.Param1.uValue;
1122	}
1123
1124	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, CPUMCTX_FROM_CORE(pRegFrame), uPort, cbValue);
1125	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
1126	{
1127	/* Raise #DB. */
1128	TRPMResetTrap(pVCpu);
1129	TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
1130	if (rcStrict != VINF_SUCCESS)
1131	LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
1132	rcStrict = VINF_EM_RAW_GUEST_TRAP;
1133	}
1134	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
1135	else if ( rcStrict2 != VINF_SUCCESS
1136	&& (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
1137	rcStrict = rcStrict2;
1138	}
1139	}
1140	rc = VBOXSTRICTRC_TODO(rcStrict);
1141	TRPM_EXIT_DBG_HOOK(0xd);
1142	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1143	}
1144
1145	/*
1146	* Deal with Ring-0 (privileged instructions)
1147	*/
1148	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1149	&& !pRegFrame->eflags.Bits.u1VM)
1150	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1151
1152	/*
1153	* Deal with Ring-3 GPs.
1154	*/
1155	if (!pRegFrame->eflags.Bits.u1VM)
1156	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1157
1158	/*
1159	* Deal with v86 code.
1160	*
1161	* We always set IOPL to zero which makes e.g. pushf fault in V86
1162	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1163	* Simply fall back to the recompiler to emulate this instruction if
1164	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1165	*/
1166	X86EFLAGS eflags;
1167	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1168	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1169	if (eflags.Bits.u2IOPL != 3)
1170	{
1171	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1172
1173	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1174	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1175	TRPM_EXIT_DBG_HOOK(0xd);
1176	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1177	}
1178	TRPM_EXIT_DBG_HOOK(0xd);
1179	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1180	}
1181
1182
1183	/**
1184	* \#GP (General Protection Fault) handler.
1185	*
1186	* @returns VBox status code.
1187	* VINF_SUCCESS means we completely handled this trap,
1188	* other codes are passed execution to host context.
1189	*
1190	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1191	* @param pRegFrame Pointer to the register frame for the trap.
1192	* @internal
1193	*/
1194	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1195	{
1196	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1197	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1198	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1199	TRPM_ENTER_DBG_HOOK(0xd);
1200
1201	PGMRZDynMapStartAutoSet(pVCpu);
1202	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1203	switch (rc)
1204	{
1205	case VINF_EM_RAW_GUEST_TRAP:
1206	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1207	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1208	rc = VINF_PATM_PATCH_TRAP_GP;
1209	break;
1210
1211	case VINF_EM_RAW_INTERRUPT_PENDING:
1212	Assert(TRPMHasTrap(pVCpu));
1213	/* no break; */
1214	case VINF_PGM_SYNC_CR3:
1215	case VINF_EM_RAW_EMULATE_INSTR:
1216	case VINF_IOM_R3_IOPORT_READ:
1217	case VINF_IOM_R3_IOPORT_WRITE:
1218	case VINF_IOM_R3_MMIO_WRITE:
1219	case VINF_IOM_R3_MMIO_READ:
1220	case VINF_IOM_R3_MMIO_READ_WRITE:
1221	case VINF_CPUM_R3_MSR_READ:
1222	case VINF_CPUM_R3_MSR_WRITE:
1223	case VINF_PATM_PATCH_INT3:
1224	case VINF_EM_NO_MEMORY:
1225	case VINF_EM_RAW_TO_R3:
1226	case VINF_EM_RAW_TIMER_PENDING:
1227	case VINF_EM_PENDING_REQUEST:
1228	case VINF_EM_HALT:
1229	case VINF_SELM_SYNC_GDT:
1230	case VINF_SUCCESS:
1231	break;
1232
1233	default:
1234	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1235	break;
1236	}
1237	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1238	TRPM_EXIT_DBG_HOOK(0xd);
1239	return rc;
1240	}
1241
1242
1243	/**
1244	* \#PF (Page Fault) handler.
1245	*
1246	* Calls PGM which does the actual handling.
1247	*
1248	*
1249	* @returns VBox status code.
1250	* VINF_SUCCESS means we completely handled this trap,
1251	* other codes are passed execution to host context.
1252	*
1253	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1254	* @param pRegFrame Pointer to the register frame for the trap.
1255	* @internal
1256	*/
1257	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1258	{
1259	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1260	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1261	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1262	TRPM_ENTER_DBG_HOOK(0xe);
1263
1264	/*
1265	* This is all PGM stuff.
1266	*/
1267	PGMRZDynMapStartAutoSet(pVCpu);
1268	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1269	switch (rc)
1270	{
1271	case VINF_EM_RAW_EMULATE_INSTR:
1272	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1273	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1274	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1275	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1276	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1277	rc = VINF_PATCH_EMULATE_INSTR;
1278	break;
1279
1280	case VINF_EM_RAW_GUEST_TRAP:
1281	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1282	{
1283	PGMRZDynMapReleaseAutoSet(pVCpu);
1284	TRPM_EXIT_DBG_HOOK(0xe);
1285	return VINF_PATM_PATCH_TRAP_PF;
1286	}
1287
1288	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1289	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1290	break;
1291
1292	case VINF_EM_RAW_INTERRUPT_PENDING:
1293	Assert(TRPMHasTrap(pVCpu));
1294	/* no break; */
1295	case VINF_IOM_R3_MMIO_READ:
1296	case VINF_IOM_R3_MMIO_WRITE:
1297	case VINF_IOM_R3_MMIO_READ_WRITE:
1298	case VINF_PATM_HC_MMIO_PATCH_READ:
1299	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1300	case VINF_SUCCESS:
1301	case VINF_EM_RAW_TO_R3:
1302	case VINF_EM_PENDING_REQUEST:
1303	case VINF_EM_RAW_TIMER_PENDING:
1304	case VINF_EM_NO_MEMORY:
1305	case VINF_CSAM_PENDING_ACTION:
1306	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1307	break;
1308
1309	default:
1310	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1311	break;
1312	}
1313	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1314	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1315	TRPM_EXIT_DBG_HOOK(0xe);
1316	return rc;
1317	}
1318
1319
1320	/**
1321	* Scans for the EIP in the specified array of trap handlers.
1322	*
1323	* If we don't fine the EIP, we'll panic.
1324	*
1325	* @returns VBox status code.
1326	*
1327	* @param pVM Pointer to the VM.
1328	* @param pRegFrame Pointer to the register frame for the trap.
1329	* @param paHandlers The array of trap handler records.
1330	* @param pEndRecord The end record (exclusive).
1331	*/
1332	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1333	{
1334	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1335	Assert(paHandlers <= pEndRecord);
1336
1337	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1338
1339	#if 0 /// @todo later
1340	/*
1341	* Start by doing a kind of binary search.
1342	*/
1343	unsigned iStart = 0;
1344	unsigned iEnd = pEndRecord - paHandlers;
1345	unsigned i = iEnd / 2;
1346	#endif
1347
1348	/*
1349	* Do a linear search now (in case the array wasn't properly sorted).
1350	*/
1351	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1352	{
1353	if ( pCur->uStartEIP <= uEip
1354	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1355	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1356	}
1357
1358	return VERR_TRPM_DONT_PANIC;
1359	}
1360
1361
1362	/**
1363	* Hypervisor \#NP ((segment) Not Present) handler.
1364	*
1365	* Scans for the EIP in the registered trap handlers.
1366	*
1367	* @returns VBox status code.
1368	* VINF_SUCCESS means we completely handled this trap,
1369	* other codes are passed back to host context.
1370	*
1371	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1372	* @param pRegFrame Pointer to the register frame for the trap.
1373	* @internal
1374	*/
1375	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1376	{
1377	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1378	}
1379
1380
1381	/**
1382	* Hypervisor \#GP (General Protection Fault) handler.
1383	*
1384	* Scans for the EIP in the registered trap handlers.
1385	*
1386	* @returns VBox status code.
1387	* VINF_SUCCESS means we completely handled this trap,
1388	* other codes are passed back to host context.
1389	*
1390	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1391	* @param pRegFrame Pointer to the register frame for the trap.
1392	* @internal
1393	*/
1394	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1395	{
1396	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1397	}
1398
1399
1400	/**
1401	* Hypervisor \#PF (Page Fault) handler.
1402	*
1403	* Scans for the EIP in the registered trap handlers.
1404	*
1405	* @returns VBox status code.
1406	* VINF_SUCCESS means we completely handled this trap,
1407	* other codes are passed back to host context.
1408	*
1409	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1410	* @param pRegFrame Pointer to the register frame for the trap.
1411	* @internal
1412	*/
1413	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1414	{
1415	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1416	}
1417
1418
1419	/**
1420	* Deal with hypervisor traps occurring when resuming execution on a trap.
1421	*
1422	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1423	* this by not allowing recursion without it being the subject of a guru
1424	* meditation. (We used to / tried to handle this but there isn't any reason
1425	* for it.)
1426	*
1427	* So, do NOT use this for handling RC traps!
1428	*
1429	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1430	* @param pVM Pointer to the VM.
1431	* @param pRegFrame Register frame.
1432	* @param uUser User arg.
1433	*/
1434	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1435	{
1436	Log(("********************************************************\n"));
1437	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1438	Log(("********************************************************\n"));
1439
1440	/*
1441	* This used to be kind of complicated, but since we stopped storing
1442	* the register frame on the stack and instead storing it directly
1443	* in the CPUMCPU::Guest structure, we just have to figure out which
1444	* status to hand on to the host and let the recompiler/IEM do its
1445	* job.
1446	*/
1447	switch (uUser)
1448	{
1449	case TRPM_TRAP_IN_MOV_GS:
1450	case TRPM_TRAP_IN_MOV_FS:
1451	case TRPM_TRAP_IN_MOV_ES:
1452	case TRPM_TRAP_IN_MOV_DS:
1453	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1454	break;
1455
1456	case TRPM_TRAP_IN_IRET:
1457	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1458	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1459	break;
1460
1461	default:
1462	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1463	return VERR_TRPM_BAD_TRAP_IN_OP;
1464	}
1465
1466	AssertMsgFailed(("Impossible!\n"));
1467	return VERR_TRPM_IPE_3;
1468	}
1469
1470
1471	/**
1472	* Generic hyper trap handler that sets the EIP to @a uUser.
1473	*
1474	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1475	* @param pVM Pointer to the cross context VM structure.
1476	* @param pRegFrame Pointer to the register frame (within VM)
1477	* @param uUser The user arg, which should be the new EIP address.
1478	*/
1479	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1480	{
1481	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1482	pRegFrame->eip = uUser;
1483	return VINF_SUCCESS;
1484	}
1485

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 56690

Download in other formats: