TRPMRCHandlers.cpp@ 55118

Last change on this file since 55118 was 55118, checked in by vboxsync, 10 years ago
VMM: GIM raw-mode support.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 55.8 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 55118 2015-04-07 15:21:45Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2013 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#include <VBox/vmm/csam.h>
31	#include <VBox/vmm/patm.h>
32	#include <VBox/vmm/mm.h>
33	#include <VBox/vmm/cpum.h>
34	#include "TRPMInternal.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/vmm.h>
37	#include <VBox/param.h>
38
39	#include <VBox/err.h>
40	#include <VBox/dis.h>
41	#include <VBox/disopcode.h>
42	#include <VBox/log.h>
43	#include <VBox/vmm/tm.h>
44	#include <iprt/asm.h>
45	#include <iprt/asm-amd64-x86.h>
46	#include <iprt/assert.h>
47	#include <iprt/x86.h>
48
49
50	/*******************************************************************************
51	* Defined Constants And Macros *
52	*******************************************************************************/
53	/* still here. MODR/M byte parsing */
54	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
55	#define X86_OPCODE_MODRM_REG_MASK 0x38
56	#define X86_OPCODE_MODRM_RM_MASK 0x07
57
58	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
59	#define DTRACE_EXPERIMENT
60
61	#if 1
62	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
63	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
64	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
65	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
66	#else
67	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
68	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
69	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
70	else do {} while (0)
71	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
72	do { \
73	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
74	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
75	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
76	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
77	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
78	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
79	} while (0)
80	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
81	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
82	#endif
83
84	/*******************************************************************************
85	* Structures and Typedefs *
86	*******************************************************************************/
87	/** Pointer to a readonly hypervisor trap record. */
88	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
89
90	/**
91	* A hypervisor trap record.
92	* This contains information about a handler for a instruction range.
93	*
94	* @remark This must match what TRPM_HANDLER outputs.
95	*/
96	typedef struct TRPMGCHYPER
97	{
98	/** The start address. */
99	uintptr_t uStartEIP;
100	/** The end address. (exclusive)
101	* If NULL the it's only for the instruction at pvStartEIP. */
102	uintptr_t uEndEIP;
103	/**
104	* The handler.
105	*
106	* @returns VBox status code
107	* VINF_SUCCESS means we've handled the trap.
108	* Any other error code means returning to the host context.
109	* @param pVM Pointer to the VM.
110	* @param pRegFrame The register frame.
111	* @param uUser The user argument.
112	*/
113	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
114	/** Whatever the handler desires to put here. */
115	uintptr_t uUser;
116	} TRPMGCHYPER;
117
118
119	/*******************************************************************************
120	* Global Variables *
121	*******************************************************************************/
122	RT_C_DECLS_BEGIN
123	/** Defined in VMMGC0.asm or VMMGC99.asm.
124	* @{ */
125	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
126	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
127	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
128	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
129	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
130	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
131	/** @} */
132	RT_C_DECLS_END
133
134
135	/*******************************************************************************
136	* Internal Functions *
137	*******************************************************************************/
138	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
139	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
140	RT_C_DECLS_END
141
142
143
144	/**
145	* Exits the trap, called when exiting a trap handler.
146	*
147	* Will reset the trap if it's not a guest trap or the trap
148	* is already handled. Will process resume guest FFs.
149	*
150	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
151	* happened.
152	* @param pVM Pointer to the VM.
153	* @param pVCpu Pointer to the VMCPU.
154	* @param rc The VBox status code to return.
155	* @param pRegFrame Pointer to the register frame for the trap.
156	*
157	* @remarks This must not be used for hypervisor traps, only guest traps.
158	*/
159	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
160	{
161	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
162	NOREF(uOldActiveVector);
163
164	/* Reset trap? */
165	if ( rc != VINF_EM_RAW_GUEST_TRAP
166	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
167	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
168
169	#ifdef VBOX_HIGH_RES_TIMERS_HACK
170	/*
171	* We should poll the timers occasionally.
172	* We must NOT do this too frequently as it adds a significant overhead
173	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
174	* (The heuristic is not very intelligent, we should really check trap
175	* frequency etc. here, but alas, we lack any such information atm.)
176	*/
177	static unsigned s_iTimerPoll = 0;
178	if (rc == VINF_SUCCESS)
179	{
180	if (!(++s_iTimerPoll & 0xf))
181	{
182	TMTimerPollVoid(pVM, pVCpu);
183	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
184	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
185	}
186	}
187	else
188	s_iTimerPoll = 0;
189	#endif
190
191	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
192	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
193	{
194	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
195	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
196	{
197	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
198	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
199	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
200	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
201	*/
202	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
203	}
204	}
205
206	/*
207	* Pending resume-guest-FF?
208	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
209	*/
210	if ( rc == VINF_SUCCESS
211	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
212	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3 \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
213	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
214	\| VMCPU_FF_PDM_CRITSECT
215	\| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS
216	)
217	)
218	)
219	{
220	/* The out of memory condition naturally outranks the others. */
221	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
222	rc = VINF_EM_NO_MEMORY;
223	/* Pending Ring-3 action. */
224	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT))
225	{
226	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
227	rc = VINF_EM_RAW_TO_R3;
228	}
229	/* Pending timer action. */
230	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
231	rc = VINF_EM_RAW_TIMER_PENDING;
232	/* The Virtual Sync clock has stopped. */
233	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
234	rc = VINF_EM_RAW_TO_R3;
235	/* DMA work pending? */
236	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
237	rc = VINF_EM_RAW_TO_R3;
238	/* Pending request packets might contain actions that need immediate
239	attention, such as pending hardware interrupts. */
240	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
241	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
242	rc = VINF_EM_PENDING_REQUEST;
243	/* Pending GDT/LDT/TSS sync. */
244	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
245	rc = VINF_SELM_SYNC_GDT;
246	/* Pending interrupt: dispatch it. */
247	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
248	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
249	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
250	)
251	{
252	uint8_t u8Interrupt;
253	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
254	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
255	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
256	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
257	/* can't return if successful */
258	Assert(rc != VINF_SUCCESS);
259
260	/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
261	Assert(uOldActiveVector <= 16);
262	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
263
264	/* Assert the trap and go to the recompiler to dispatch it. */
265	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
266
267	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
268	rc = VINF_EM_RAW_INTERRUPT_PENDING;
269	}
270	/*
271	* Try sync CR3?
272	*/
273	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
274	{
275	#if 1
276	PGMRZDynMapReleaseAutoSet(pVCpu);
277	PGMRZDynMapStartAutoSet(pVCpu);
278	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
279	#else
280	rc = VINF_PGM_SYNC_CR3;
281	#endif
282	}
283	}
284
285	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
286	PGMRZDynMapReleaseAutoSet(pVCpu);
287	return rc;
288	}
289
290
291	/**
292	* \#DB (Debug event) handler.
293	*
294	* @returns VBox status code.
295	* VINF_SUCCESS means we completely handled this trap,
296	* other codes are passed execution to host context.
297	*
298	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
299	* @param pRegFrame Pointer to the register frame for the trap.
300	* @internal
301	*/
302	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
303	{
304	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
305	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
306	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
307	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
308	TRPM_ENTER_DBG_HOOK(1);
309
310	/*
311	* We currently don't make use of the X86_DR7_GD bit, but
312	* there might come a time when we do.
313	*/
314	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
315	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
316	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
317	VERR_NOT_IMPLEMENTED);
318	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
319
320	/*
321	* Now leave the rest to the DBGF.
322	*/
323	PGMRZDynMapStartAutoSet(pVCpu);
324	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
325	if (rc == VINF_EM_RAW_GUEST_TRAP)
326	{
327	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
328	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
329	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
330	}
331	else if (rc == VINF_EM_DBG_STEPPED)
332	pRegFrame->eflags.Bits.u1TF = 0;
333
334	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
335	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg %EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
336	TRPM_EXIT_DBG_HOOK(1);
337	return rc;
338	}
339
340
341	/**
342	* \#DB (Debug event) handler for the hypervisor code.
343	*
344	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
345	* mapping set as well as the default trap exit path since they are both really
346	* bad ideas in this context.
347	*
348	* @returns VBox status code.
349	* VINF_SUCCESS means we completely handled this trap,
350	* other codes are passed execution to host context.
351	*
352	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
353	* @param pRegFrame Pointer to the register frame for the trap.
354	* @internal
355	*/
356	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
357	{
358	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
359	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
360	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
361	TRPM_ENTER_DBG_HOOK_HYPER(1);
362	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
363
364	/*
365	* We currently don't make use of the X86_DR7_GD bit, but
366	* there might come a time when we do.
367	*/
368	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
369	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
370	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
371	VERR_NOT_IMPLEMENTED);
372	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
373
374	/*
375	* Now leave the rest to the DBGF.
376	*/
377	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
378	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
379	if (rc == VINF_EM_DBG_STEPPED)
380	pRegFrame->eflags.Bits.u1TF = 0;
381
382	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
383	TRPM_EXIT_DBG_HOOK_HYPER(1);
384	return rc;
385	}
386
387
388	/**
389	* NMI handler, for when we are using NMIs to debug things.
390	*
391	* @returns VBox status code.
392	* VINF_SUCCESS means we completely handled this trap,
393	* other codes are passed execution to host context.
394	*
395	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
396	* @param pRegFrame Pointer to the register frame for the trap.
397	* @internal
398	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
399	*/
400	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
401	{
402	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
403	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
404	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
405	#endif
406	NOREF(pTrpmCpu);
407	return VERR_TRPM_DONT_PANIC;
408	}
409
410
411	/**
412	* NMI handler, for when we are using NMIs to debug things.
413	*
414	* This is the handler we're most likely to hit when the NMI fires (it is
415	* unlikely that we'll be stuck in guest code).
416	*
417	* @returns VBox status code.
418	* VINF_SUCCESS means we completely handled this trap,
419	* other codes are passed execution to host context.
420	*
421	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
422	* @param pRegFrame Pointer to the register frame for the trap.
423	* @internal
424	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
425	*/
426	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
427	{
428	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
429	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
430	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
431	#endif
432	NOREF(pTrpmCpu);
433	return VERR_TRPM_DONT_PANIC;
434	}
435
436
437	/**
438	* \#BP (Breakpoint) handler.
439	*
440	* @returns VBox status code.
441	* VINF_SUCCESS means we completely handled this trap,
442	* other codes are passed execution to host context.
443	*
444	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
445	* @param pRegFrame Pointer to the register frame for the trap.
446	* @internal
447	*/
448	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
449	{
450	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
451	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
452	int rc;
453	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
454	TRPM_ENTER_DBG_HOOK(3);
455	PGMRZDynMapStartAutoSet(pVCpu);
456
457	/*
458	* PATM is using INT3s, let them have a go first.
459	*/
460	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
461	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
462	&& !pRegFrame->eflags.Bits.u1VM)
463	{
464	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
465	if ( rc == VINF_SUCCESS
466	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
467	\|\| rc == VINF_PATM_PATCH_INT3
468	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
469	{
470	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
471	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
472	TRPM_EXIT_DBG_HOOK(3);
473	return rc;
474	}
475	}
476	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
477
478	/* anything we should do with this? Schedule it in GC? */
479	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
480	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
481	TRPM_EXIT_DBG_HOOK(3);
482	return rc;
483	}
484
485
486	/**
487	* \#BP (Breakpoint) handler.
488	*
489	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
490	* harmful to us (common trap exit and the auto mapping set).
491	*
492	* @returns VBox status code.
493	* VINF_SUCCESS means we completely handled this trap,
494	* other codes are passed execution to host context.
495	*
496	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
497	* @param pRegFrame Pointer to the register frame for the trap.
498	* @internal
499	*/
500	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
501	{
502	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
503	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
504	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
505	TRPM_ENTER_DBG_HOOK_HYPER(3);
506
507	/*
508	* Hand it over to DBGF.
509	*/
510	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
511	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
512
513	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
514	TRPM_EXIT_DBG_HOOK_HYPER(3);
515	return rc;
516	}
517
518
519	/**
520	* Trap handler for illegal opcode fault (\#UD).
521	*
522	* @returns VBox status code.
523	* VINF_SUCCESS means we completely handled this trap,
524	* other codes are passed execution to host context.
525	*
526	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
527	* @param pRegFrame Pointer to the register frame for the trap.
528	* @internal
529	*/
530	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
531	{
532	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
533	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
534	int rc;
535	LogFlow(("TRPMGC06: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
536	TRPM_ENTER_DBG_HOOK(6);
537	PGMRZDynMapStartAutoSet(pVCpu);
538
539	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
540	{
541	/*
542	* Decode the instruction.
543	*/
544	RTGCPTR PC;
545	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
546	pRegFrame->rip, &PC);
547	if (RT_FAILURE(rc))
548	{
549	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
550	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
551	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
552	TRPM_EXIT_DBG_HOOK(6);
553	return rc;
554	}
555
556	DISCPUSTATE Cpu;
557	uint32_t cbOp;
558	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
559	if (RT_FAILURE(rc))
560	{
561	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
562	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
563	TRPM_EXIT_DBG_HOOK(6);
564	return rc;
565	}
566
567	/*
568	* UD2 in a patch?
569	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
570	*/
571	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
572	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
573	{
574	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
575	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
576	/** @todo These tests are completely unnecessary, should just follow the
577	* flow and return at the end of the function. */
578	if ( rc == VINF_SUCCESS
579	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
580	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
581	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
582	\|\| rc == VINF_EM_RESCHEDULE)
583	{
584	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
585	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
586	TRPM_EXIT_DBG_HOOK(6);
587	return rc;
588	}
589	}
590	/*
591	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
592	*/
593	else if (Cpu.fPrefix & DISPREFIX_LOCK)
594	{
595	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
596	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
597	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
598	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
599	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
600	#else
601	rc = VINF_EM_RAW_EMULATE_INSTR;
602	#endif
603	}
604	/*
605	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
606	*/
607	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
608	{
609	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
610	rc = EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
611	}
612	else if (GIMShouldTrapXcptUD(pVM))
613	{
614	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
615	rc = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu);
616	if (RT_FAILURE(rc))
617	{
618	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD -> VINF_EM_RAW_EMULATE_INSTR\n"));
619	rc = VINF_EM_RAW_EMULATE_INSTR;
620	}
621	}
622	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
623	else
624	{
625	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
626	rc = VINF_EM_RAW_EMULATE_INSTR;
627	}
628	}
629	else
630	{
631	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
632	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
633	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
634	}
635
636	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
637	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
638	TRPM_EXIT_DBG_HOOK(6);
639	return rc;
640	}
641
642
643	/**
644	* Trap handler for device not present fault (\#NM).
645	*
646	* Device not available, FP or (F)WAIT instruction.
647	*
648	* @returns VBox status code.
649	* VINF_SUCCESS means we completely handled this trap,
650	* other codes are passed execution to host context.
651	*
652	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
653	* @param pRegFrame Pointer to the register frame for the trap.
654	* @internal
655	*/
656	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
657	{
658	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
659	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
660	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
661	TRPM_ENTER_DBG_HOOK(7);
662	PGMRZDynMapStartAutoSet(pVCpu);
663
664	int rc = CPUMHandleLazyFPU(pVCpu);
665	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
666	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
667	TRPM_EXIT_DBG_HOOK(7);
668	return rc;
669	}
670
671
672	/**
673	* \#NP ((segment) Not Present) handler.
674	*
675	* @returns VBox status code.
676	* VINF_SUCCESS means we completely handled this trap,
677	* other codes are passed execution to host context.
678	*
679	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
680	* @param pRegFrame Pointer to the register frame for the trap.
681	* @internal
682	*/
683	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
684	{
685	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
686	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
687	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
688	TRPM_ENTER_DBG_HOOK(0xb);
689	PGMRZDynMapStartAutoSet(pVCpu);
690
691	/*
692	* Try to detect instruction by opcode which caused trap.
693	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
694	* accessing user code. need to handle it somehow in future!
695	*/
696	RTGCPTR GCPtr;
697	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
698	(RTGCPTR)pRegFrame->eip, &GCPtr)
699	== VINF_SUCCESS)
700	{
701	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
702
703	/*
704	* First skip possible instruction prefixes, such as:
705	* OS, AS
706	* CS:, DS:, ES:, SS:, FS:, GS:
707	* REPE, REPNE
708	*
709	* note: Currently we supports only up to 4 prefixes per opcode, more
710	* prefixes (normally not used anyway) will cause trap d in guest.
711	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
712	* check this issue, its too hard.
713	*/
714	for (unsigned i = 0; i < 4; i++)
715	{
716	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
717	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
718	&& pu8Code[0] != 0x2e /* CS: */
719	&& pu8Code[0] != 0x36 /* SS: */
720	&& pu8Code[0] != 0x3e /* DS: */
721	&& pu8Code[0] != 0x26 /* ES: */
722	&& pu8Code[0] != 0x64 /* FS: */
723	&& pu8Code[0] != 0x65 /* GS: */
724	&& pu8Code[0] != 0x66 /* OS */
725	&& pu8Code[0] != 0x67 /* AS */
726	)
727	break;
728	pu8Code++;
729	}
730
731	/*
732	* Detect right switch using a callgate.
733	*
734	* We recognize the following causes for the trap 0b:
735	* CALL FAR, CALL FAR []
736	* JMP FAR, JMP FAR []
737	* IRET (may cause a task switch)
738	*
739	* Note: we can't detect whether the trap was caused by a call to a
740	* callgate descriptor or it is a real trap 0b due to a bad selector.
741	* In both situations we'll pass execution to our recompiler so we don't
742	* have to worry.
743	* If we wanted to do better detection, we have set GDT entries to callgate
744	* descriptors pointing to our own handlers.
745	*/
746	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
747	if ( pu8Code[0] == 0x9a /* CALL FAR */
748	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
749	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
750	\|\| pu8Code[0] == 0xea /* JMP FAR */
751	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
752	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
753	\|\| pu8Code[0] == 0xcf /* IRET */
754	)
755	{
756	/*
757	* Got potential call to callgate.
758	* We simply return execution to the recompiler to do emulation
759	* starting from the instruction which caused the trap.
760	*/
761	pTrpmCpu->uActiveVector = UINT32_MAX;
762	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
763	TRPM_EXIT_DBG_HOOK(0xb);
764	PGMRZDynMapReleaseAutoSet(pVCpu);
765	return VINF_EM_RAW_RING_SWITCH;
766	}
767	}
768
769	/*
770	* Pass trap 0b as is to the recompiler in all other cases.
771	*/
772	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
773	PGMRZDynMapReleaseAutoSet(pVCpu);
774	TRPM_EXIT_DBG_HOOK(0xb);
775	return VINF_EM_RAW_GUEST_TRAP;
776	}
777
778
779	/**
780	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
781	*
782	* @returns VBox status code.
783	* VINF_SUCCESS means we completely handled this trap,
784	* other codes are passed execution to host context.
785	*
786	* @param pVM Pointer to the VM.
787	* @param pVCpu Pointer to the VMCPU.
788	* @param pRegFrame Pointer to the register frame for the trap.
789	* @param pCpu The opcode info.
790	* @param PC The program counter corresponding to cs:eip in pRegFrame.
791	*/
792	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
793	{
794	int rc;
795	TRPM_ENTER_DBG_HOOK(0xd);
796
797	/*
798	* Try handle it here, if not return to HC and emulate/interpret it there.
799	*/
800	switch (pCpu->pCurInstr->uOpcode)
801	{
802	case OP_INT3:
803	/*
804	* Little hack to make the code below not fail
805	*/
806	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
807	pCpu->Param1.uValue = 3;
808	/* fallthru */
809	case OP_INT:
810	{
811	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
812	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
813	if (pCpu->Param1.uValue == 3)
814	{
815	/* Int 3 replacement patch? */
816	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
817	{
818	AssertFailed();
819	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
820	}
821	}
822	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
823	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
824	{
825	TRPM_EXIT_DBG_HOOK(0xd);
826	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
827	}
828
829	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
830	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
831	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
832	}
833
834	#ifdef PATM_EMULATE_SYSENTER
835	case OP_SYSEXIT:
836	case OP_SYSRET:
837	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
838	TRPM_EXIT_DBG_HOOK(0xd);
839	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
840	#endif
841
842	case OP_HLT:
843	/* If it's in patch code, defer to ring-3. */
844	if (PATMIsPatchGCAddr(pVM, PC))
845	break;
846
847	pRegFrame->eip += pCpu->cbInstr;
848	TRPM_EXIT_DBG_HOOK(0xd);
849	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
850
851
852	/*
853	* These instructions are used by PATM and CASM for finding
854	* dangerous non-trapping instructions. Thus, since all
855	* scanning and patching is done in ring-3 we'll have to
856	* return to ring-3 on the first encounter of these instructions.
857	*/
858	case OP_MOV_CR:
859	case OP_MOV_DR:
860	/* We can safely emulate control/debug register move instructions in patched code. */
861	if ( !PATMIsPatchGCAddr(pVM, PC)
862	&& !CSAMIsKnownDangerousInstr(pVM, PC))
863	break;
864	case OP_INVLPG:
865	case OP_LLDT:
866	case OP_STI:
867	case OP_RDTSC: /* just in case */
868	case OP_RDPMC:
869	case OP_CLTS:
870	case OP_WBINVD: /* nop */
871	case OP_RDMSR:
872	case OP_WRMSR:
873	{
874	rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
875	if (rc == VERR_EM_INTERPRETER)
876	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
877	TRPM_EXIT_DBG_HOOK(0xd);
878	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
879	}
880	}
881
882	TRPM_EXIT_DBG_HOOK(0xd);
883	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
884	}
885
886
887	/**
888	* \#GP (General Protection Fault) handler for Ring-3.
889	*
890	* @returns VBox status code.
891	* VINF_SUCCESS means we completely handled this trap,
892	* other codes are passed execution to host context.
893	*
894	* @param pVM Pointer to the VM.
895	* @param pVCpu Pointer to the VMCPU.
896	* @param pRegFrame Pointer to the register frame for the trap.
897	* @param pCpu The opcode info.
898	* @param PC The program counter corresponding to cs:eip in pRegFrame.
899	*/
900	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
901	{
902	int rc;
903	Assert(!pRegFrame->eflags.Bits.u1VM);
904	TRPM_ENTER_DBG_HOOK(0xd);
905
906	switch (pCpu->pCurInstr->uOpcode)
907	{
908	/*
909	* INT3 and INT xx are ring-switching.
910	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
911	*/
912	case OP_INT3:
913	/*
914	* Little hack to make the code below not fail
915	*/
916	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
917	pCpu->Param1.uValue = 3;
918	/* fall thru */
919	case OP_INT:
920	{
921	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
922	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
923	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
924	{
925	TRPM_EXIT_DBG_HOOK(0xd);
926	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
927	}
928
929	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
930	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
931	TRPM_EXIT_DBG_HOOK(0xd);
932	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
933	}
934
935	/*
936	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
937	*/
938	case OP_SYSCALL:
939	case OP_SYSENTER:
940	#ifdef PATM_EMULATE_SYSENTER
941	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
942	if (rc == VINF_SUCCESS)
943	{
944	TRPM_EXIT_DBG_HOOK(0xd);
945	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
946	}
947	/* else no break; */
948	#endif
949	case OP_BOUND:
950	case OP_INTO:
951	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
952	TRPM_EXIT_DBG_HOOK(0xd);
953	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
954
955	/*
956	* Handle virtualized TSC & PMC reads, just in case.
957	*/
958	case OP_RDTSC:
959	case OP_RDPMC:
960	{
961	rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
962	if (rc == VERR_EM_INTERPRETER)
963	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
964	TRPM_EXIT_DBG_HOOK(0xd);
965	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
966	}
967
968	/*
969	* STI and CLI are I/O privileged, i.e. if IOPL
970	*/
971	case OP_STI:
972	case OP_CLI:
973	{
974	uint32_t efl = CPUMRawGetEFlags(pVCpu);
975	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
976	if (X86_EFL_GET_IOPL(efl) >= cpl)
977	{
978	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
979	TRPM_EXIT_DBG_HOOK(0xd);
980	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
981	}
982	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
983	break;
984	}
985	}
986
987	/*
988	* A genuine guest fault.
989	*/
990	TRPM_EXIT_DBG_HOOK(0xd);
991	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
992	}
993
994
995	/**
996	* Emulates RDTSC for the \#GP handler.
997	*
998	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
999	*
1000	* @param pVM Pointer to the VM.
1001	* @param pVCpu Pointer to the VMCPU.
1002	* @param pRegFrame Pointer to the register frame for the trap.
1003	* This will be updated on successful return.
1004	*/
1005	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1006	{
1007	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1008	TRPM_ENTER_DBG_HOOK(0xd);
1009
1010	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1011	{
1012	TRPM_EXIT_DBG_HOOK(0xd);
1013	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1014	}
1015
1016	uint64_t uTicks = TMCpuTickGet(pVCpu);
1017	pRegFrame->eax = uTicks;
1018	pRegFrame->edx = uTicks >> 32;
1019	pRegFrame->eip += 2;
1020	TRPM_EXIT_DBG_HOOK(0xd);
1021	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1022	}
1023
1024
1025	/**
1026	* \#GP (General Protection Fault) handler.
1027	*
1028	* @returns VBox status code.
1029	* VINF_SUCCESS means we completely handled this trap,
1030	* other codes are passed execution to host context.
1031	*
1032	* @param pVM Pointer to the VM.
1033	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1034	* @param pRegFrame Pointer to the register frame for the trap.
1035	*/
1036	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1037	{
1038	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1039	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1040	TRPM_ENTER_DBG_HOOK(0xd);
1041
1042	/*
1043	* Convert and validate CS.
1044	*/
1045	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1046	RTGCPTR PC;
1047	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1048	pRegFrame->rip, &PC);
1049	if (RT_FAILURE(rc))
1050	{
1051	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1052	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1053	TRPM_EXIT_DBG_HOOK(0xd);
1054	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1055	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1056	}
1057
1058	/*
1059	* Disassemble the instruction.
1060	*/
1061	DISCPUSTATE Cpu;
1062	uint32_t cbOp;
1063	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1064	if (RT_FAILURE(rc))
1065	{
1066	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1067	TRPM_EXIT_DBG_HOOK(0xd);
1068	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1069	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1070	}
1071	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1072
1073	/*
1074	* Optimize RDTSC traps.
1075	* Some guests (like Solaris) are using RDTSC all over the place and
1076	* will end up trapping a lot because of that.
1077	*
1078	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1079	*/
1080	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1081	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1082
1083	/*
1084	* Deal with I/O port access.
1085	*/
1086	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1087	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1088	{
1089	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1090	if (IOM_SUCCESS(rcStrict))
1091	{
1092	pRegFrame->rip += cbOp;
1093
1094	/*
1095	* Check for I/O breakpoints. A bit clumsy, but should be short lived (moved to IEM).
1096	*/
1097	uint32_t const uDr7 = CPUMGetGuestDR7(pVCpu);
1098	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
1099	&& X86_DR7_ANY_RW_IO(uDr7)
1100	&& (CPUMGetGuestCR4(pVCpu) & X86_CR4_DE))
1101	\|\| DBGFBpIsHwIoArmed(pVM)))
1102	{
1103	uint64_t uPort = pRegFrame->dx;
1104	unsigned cbValue;
1105	if ( Cpu.pCurInstr->uOpcode == OP_IN
1106	\|\| Cpu.pCurInstr->uOpcode == OP_INSB
1107	\|\| Cpu.pCurInstr->uOpcode == OP_INSWD)
1108	{
1109	cbValue = DISGetParamSize(&Cpu, &Cpu.Param1);
1110	if (Cpu.Param2.fUse & DISUSE_IMMEDIATE)
1111	uPort = Cpu.Param2.uValue;
1112	}
1113	else
1114	{
1115	cbValue = DISGetParamSize(&Cpu, &Cpu.Param2);
1116	if (Cpu.Param1.fUse & DISUSE_IMMEDIATE)
1117	uPort = Cpu.Param1.uValue;
1118	}
1119
1120	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, CPUMCTX_FROM_CORE(pRegFrame), uPort, cbValue);
1121	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
1122	{
1123	/* Raise #DB. */
1124	TRPMResetTrap(pVCpu);
1125	TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
1126	if (rcStrict)
1127	LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
1128	rcStrict = VINF_EM_RAW_GUEST_TRAP;
1129	}
1130	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
1131	else if ( rcStrict2 != VINF_SUCCESS
1132	&& (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
1133	rcStrict = rcStrict2;
1134	}
1135	}
1136	rc = VBOXSTRICTRC_TODO(rcStrict);
1137	TRPM_EXIT_DBG_HOOK(0xd);
1138	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1139	}
1140
1141	/*
1142	* Deal with Ring-0 (privileged instructions)
1143	*/
1144	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1145	&& !pRegFrame->eflags.Bits.u1VM)
1146	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1147
1148	/*
1149	* Deal with Ring-3 GPs.
1150	*/
1151	if (!pRegFrame->eflags.Bits.u1VM)
1152	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1153
1154	/*
1155	* Deal with v86 code.
1156	*
1157	* We always set IOPL to zero which makes e.g. pushf fault in V86
1158	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1159	* Simply fall back to the recompiler to emulate this instruction if
1160	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1161	*/
1162	X86EFLAGS eflags;
1163	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1164	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1165	if (eflags.Bits.u2IOPL != 3)
1166	{
1167	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1168
1169	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1170	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1171	TRPM_EXIT_DBG_HOOK(0xd);
1172	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1173	}
1174	TRPM_EXIT_DBG_HOOK(0xd);
1175	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1176	}
1177
1178
1179	/**
1180	* \#GP (General Protection Fault) handler.
1181	*
1182	* @returns VBox status code.
1183	* VINF_SUCCESS means we completely handled this trap,
1184	* other codes are passed execution to host context.
1185	*
1186	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1187	* @param pRegFrame Pointer to the register frame for the trap.
1188	* @internal
1189	*/
1190	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1191	{
1192	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1193	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1194	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1195	TRPM_ENTER_DBG_HOOK(0xd);
1196
1197	PGMRZDynMapStartAutoSet(pVCpu);
1198	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1199	switch (rc)
1200	{
1201	case VINF_EM_RAW_GUEST_TRAP:
1202	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1203	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1204	rc = VINF_PATM_PATCH_TRAP_GP;
1205	break;
1206
1207	case VINF_EM_RAW_INTERRUPT_PENDING:
1208	Assert(TRPMHasTrap(pVCpu));
1209	/* no break; */
1210	case VINF_PGM_SYNC_CR3:
1211	case VINF_EM_RAW_EMULATE_INSTR:
1212	case VINF_IOM_R3_IOPORT_READ:
1213	case VINF_IOM_R3_IOPORT_WRITE:
1214	case VINF_IOM_R3_MMIO_WRITE:
1215	case VINF_IOM_R3_MMIO_READ:
1216	case VINF_IOM_R3_MMIO_READ_WRITE:
1217	case VINF_CPUM_R3_MSR_READ:
1218	case VINF_CPUM_R3_MSR_WRITE:
1219	case VINF_PATM_PATCH_INT3:
1220	case VINF_EM_NO_MEMORY:
1221	case VINF_EM_RAW_TO_R3:
1222	case VINF_EM_RAW_TIMER_PENDING:
1223	case VINF_EM_PENDING_REQUEST:
1224	case VINF_EM_HALT:
1225	case VINF_SELM_SYNC_GDT:
1226	case VINF_SUCCESS:
1227	break;
1228
1229	default:
1230	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1231	break;
1232	}
1233	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1234	TRPM_EXIT_DBG_HOOK(0xd);
1235	return rc;
1236	}
1237
1238
1239	/**
1240	* \#PF (Page Fault) handler.
1241	*
1242	* Calls PGM which does the actual handling.
1243	*
1244	*
1245	* @returns VBox status code.
1246	* VINF_SUCCESS means we completely handled this trap,
1247	* other codes are passed execution to host context.
1248	*
1249	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1250	* @param pRegFrame Pointer to the register frame for the trap.
1251	* @internal
1252	*/
1253	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1254	{
1255	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1256	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1257	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1258	TRPM_ENTER_DBG_HOOK(0xe);
1259
1260	/*
1261	* This is all PGM stuff.
1262	*/
1263	PGMRZDynMapStartAutoSet(pVCpu);
1264	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1265	switch (rc)
1266	{
1267	case VINF_EM_RAW_EMULATE_INSTR:
1268	case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
1269	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1270	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1271	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1272	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1273	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1274	rc = VINF_PATCH_EMULATE_INSTR;
1275	break;
1276
1277	case VINF_EM_RAW_GUEST_TRAP:
1278	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1279	{
1280	PGMRZDynMapReleaseAutoSet(pVCpu);
1281	TRPM_EXIT_DBG_HOOK(0xe);
1282	return VINF_PATM_PATCH_TRAP_PF;
1283	}
1284
1285	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1286	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1287	break;
1288
1289	case VINF_EM_RAW_INTERRUPT_PENDING:
1290	Assert(TRPMHasTrap(pVCpu));
1291	/* no break; */
1292	case VINF_IOM_R3_MMIO_READ:
1293	case VINF_IOM_R3_MMIO_WRITE:
1294	case VINF_IOM_R3_MMIO_READ_WRITE:
1295	case VINF_PATM_HC_MMIO_PATCH_READ:
1296	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1297	case VINF_SUCCESS:
1298	case VINF_EM_RAW_TO_R3:
1299	case VINF_EM_PENDING_REQUEST:
1300	case VINF_EM_RAW_TIMER_PENDING:
1301	case VINF_EM_NO_MEMORY:
1302	case VINF_CSAM_PENDING_ACTION:
1303	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1304	break;
1305
1306	default:
1307	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1308	break;
1309	}
1310	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1311	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1312	TRPM_EXIT_DBG_HOOK(0xe);
1313	return rc;
1314	}
1315
1316
1317	/**
1318	* Scans for the EIP in the specified array of trap handlers.
1319	*
1320	* If we don't fine the EIP, we'll panic.
1321	*
1322	* @returns VBox status code.
1323	*
1324	* @param pVM Pointer to the VM.
1325	* @param pRegFrame Pointer to the register frame for the trap.
1326	* @param paHandlers The array of trap handler records.
1327	* @param pEndRecord The end record (exclusive).
1328	*/
1329	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1330	{
1331	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1332	Assert(paHandlers <= pEndRecord);
1333
1334	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1335
1336	#if 0 /// @todo later
1337	/*
1338	* Start by doing a kind of binary search.
1339	*/
1340	unsigned iStart = 0;
1341	unsigned iEnd = pEndRecord - paHandlers;
1342	unsigned i = iEnd / 2;
1343	#endif
1344
1345	/*
1346	* Do a linear search now (in case the array wasn't properly sorted).
1347	*/
1348	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1349	{
1350	if ( pCur->uStartEIP <= uEip
1351	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1352	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1353	}
1354
1355	return VERR_TRPM_DONT_PANIC;
1356	}
1357
1358
1359	/**
1360	* Hypervisor \#NP ((segment) Not Present) handler.
1361	*
1362	* Scans for the EIP in the registered trap handlers.
1363	*
1364	* @returns VBox status code.
1365	* VINF_SUCCESS means we completely handled this trap,
1366	* other codes are passed back to host context.
1367	*
1368	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1369	* @param pRegFrame Pointer to the register frame for the trap.
1370	* @internal
1371	*/
1372	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1373	{
1374	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1375	}
1376
1377
1378	/**
1379	* Hypervisor \#GP (General Protection Fault) handler.
1380	*
1381	* Scans for the EIP in the registered trap handlers.
1382	*
1383	* @returns VBox status code.
1384	* VINF_SUCCESS means we completely handled this trap,
1385	* other codes are passed back to host context.
1386	*
1387	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1388	* @param pRegFrame Pointer to the register frame for the trap.
1389	* @internal
1390	*/
1391	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1392	{
1393	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1394	}
1395
1396
1397	/**
1398	* Hypervisor \#PF (Page Fault) handler.
1399	*
1400	* Scans for the EIP in the registered trap handlers.
1401	*
1402	* @returns VBox status code.
1403	* VINF_SUCCESS means we completely handled this trap,
1404	* other codes are passed back to host context.
1405	*
1406	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1407	* @param pRegFrame Pointer to the register frame for the trap.
1408	* @internal
1409	*/
1410	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1411	{
1412	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1413	}
1414
1415
1416	/**
1417	* Deal with hypervisor traps occurring when resuming execution on a trap.
1418	*
1419	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1420	* this by not allowing recursion without it being the subject of a guru
1421	* meditation. (We used to / tried to handle this but there isn't any reason
1422	* for it.)
1423	*
1424	* So, do NOT use this for handling RC traps!
1425	*
1426	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1427	* @param pVM Pointer to the VM.
1428	* @param pRegFrame Register frame.
1429	* @param uUser User arg.
1430	*/
1431	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1432	{
1433	Log(("********************************************************\n"));
1434	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1435	Log(("********************************************************\n"));
1436
1437	/*
1438	* This used to be kind of complicated, but since we stopped storing
1439	* the register frame on the stack and instead storing it directly
1440	* in the CPUMCPU::Guest structure, we just have to figure out which
1441	* status to hand on to the host and let the recompiler/IEM do its
1442	* job.
1443	*/
1444	switch (uUser)
1445	{
1446	case TRPM_TRAP_IN_MOV_GS:
1447	case TRPM_TRAP_IN_MOV_FS:
1448	case TRPM_TRAP_IN_MOV_ES:
1449	case TRPM_TRAP_IN_MOV_DS:
1450	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1451	break;
1452
1453	case TRPM_TRAP_IN_IRET:
1454	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1455	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1456	break;
1457
1458	default:
1459	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1460	return VERR_TRPM_BAD_TRAP_IN_OP;
1461	}
1462
1463	AssertMsgFailed(("Impossible!\n"));
1464	return VERR_TRPM_IPE_3;
1465	}
1466
1467
1468	/**
1469	* Generic hyper trap handler that sets the EIP to @a uUser.
1470	*
1471	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1472	* @param pVM Pointer to the cross context VM structure.
1473	* @param pRegFrame Pointer to the register frame (within VM)
1474	* @param uUser The user arg, which should be the new EIP address.
1475	*/
1476	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1477	{
1478	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1479	pRegFrame->eip = uUser;
1480	return VINF_SUCCESS;
1481	}
1482

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 55118

Download in other formats: