TRPMRCHandlers.cpp@ 60189

Last change on this file since 60189 was 58123, checked in by vboxsync, 9 years ago
VMM: Made @param pVCpu more uniform and to the point.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 56.9 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 58123 2015-10-08 18:09:45Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#include <VBox/vmm/csam.h>
31	#include <VBox/vmm/patm.h>
32	#include <VBox/vmm/mm.h>
33	#include <VBox/vmm/cpum.h>
34	#include "TRPMInternal.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/vmm.h>
37	#include <VBox/param.h>
38
39	#include <VBox/err.h>
40	#include <VBox/dis.h>
41	#include <VBox/disopcode.h>
42	#include <VBox/log.h>
43	#include <VBox/vmm/tm.h>
44	#include <iprt/asm.h>
45	#include <iprt/asm-amd64-x86.h>
46	#include <iprt/assert.h>
47	#include <iprt/x86.h>
48
49
50	/*********************************************************************************************************************************
51	* Defined Constants And Macros *
52	*********************************************************************************************************************************/
53	/* still here. MODR/M byte parsing */
54	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
55	#define X86_OPCODE_MODRM_REG_MASK 0x38
56	#define X86_OPCODE_MODRM_RM_MASK 0x07
57
58	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
59	#define DTRACE_EXPERIMENT
60
61	#if 1
62	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
63	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
64	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
65	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
66	#else
67	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
68	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
69	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
70	else do {} while (0)
71	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
72	do { \
73	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
74	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
75	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
76	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
77	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
78	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
79	} while (0)
80	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
81	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
82	#endif
83
84
85	/*********************************************************************************************************************************
86	* Structures and Typedefs *
87	*********************************************************************************************************************************/
88	/** Pointer to a readonly hypervisor trap record. */
89	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
90
91	/**
92	* A hypervisor trap record.
93	* This contains information about a handler for a instruction range.
94	*
95	* @remark This must match what TRPM_HANDLER outputs.
96	*/
97	typedef struct TRPMGCHYPER
98	{
99	/** The start address. */
100	uintptr_t uStartEIP;
101	/** The end address. (exclusive)
102	* If NULL the it's only for the instruction at pvStartEIP. */
103	uintptr_t uEndEIP;
104	/**
105	* The handler.
106	*
107	* @returns VBox status code
108	* VINF_SUCCESS means we've handled the trap.
109	* Any other error code means returning to the host context.
110	* @param pVM The cross context VM structure.
111	* @param pRegFrame The register frame.
112	* @param uUser The user argument.
113	*/
114	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
115	/** Whatever the handler desires to put here. */
116	uintptr_t uUser;
117	} TRPMGCHYPER;
118
119
120	/*********************************************************************************************************************************
121	* Global Variables *
122	*********************************************************************************************************************************/
123	RT_C_DECLS_BEGIN
124	/** Defined in VMMRC0.asm or VMMRC99.asm.
125	* @{ */
126	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
127	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
128	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
129	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
130	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
131	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
132	/** @} */
133	RT_C_DECLS_END
134
135
136	/*********************************************************************************************************************************
137	* Internal Functions *
138	*********************************************************************************************************************************/
139	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
140	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
141	RT_C_DECLS_END
142
143
144
145	/**
146	* Exits the trap, called when exiting a trap handler.
147	*
148	* Will reset the trap if it's not a guest trap or the trap
149	* is already handled. Will process resume guest FFs.
150	*
151	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
152	* happened.
153	* @param pVM The cross context VM structure.
154	* @param pVCpu The cross context virtual CPU structure.
155	* @param rc The VBox status code to return.
156	* @param pRegFrame Pointer to the register frame for the trap.
157	*
158	* @remarks This must not be used for hypervisor traps, only guest traps.
159	*/
160	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
161	{
162	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
163	NOREF(uOldActiveVector);
164
165	/* Reset trap? */
166	if ( rc != VINF_EM_RAW_GUEST_TRAP
167	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
168	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
169
170	#ifdef VBOX_HIGH_RES_TIMERS_HACK
171	/*
172	* We should poll the timers occasionally.
173	* We must NOT do this too frequently as it adds a significant overhead
174	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
175	* (The heuristic is not very intelligent, we should really check trap
176	* frequency etc. here, but alas, we lack any such information atm.)
177	*/
178	static unsigned s_iTimerPoll = 0;
179	if (rc == VINF_SUCCESS)
180	{
181	if (!(++s_iTimerPoll & 0xf))
182	{
183	TMTimerPollVoid(pVM, pVCpu);
184	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
185	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
186	}
187	}
188	else
189	s_iTimerPoll = 0;
190	#endif
191
192	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
193	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
194	{
195	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
196	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
197	{
198	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
199	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
200	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
201	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
202	*/
203	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
204	}
205	}
206
207	/*
208	* Pending resume-guest-FF?
209	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
210	*/
211	if ( rc == VINF_SUCCESS
212	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
213	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3 \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
214	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
215	\| VMCPU_FF_PDM_CRITSECT
216	\| VMCPU_FF_IEM
217	\| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT
218	\| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
219	)
220	)
221	)
222	{
223	/* The out of memory condition naturally outranks the others. */
224	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
225	rc = VINF_EM_NO_MEMORY;
226	/* Pending Ring-3 action. */
227	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT \| VMCPU_FF_IEM))
228	{
229	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
230	rc = VINF_EM_RAW_TO_R3;
231	}
232	/* Pending timer action. */
233	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
234	rc = VINF_EM_RAW_TIMER_PENDING;
235	/* The Virtual Sync clock has stopped. */
236	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
237	rc = VINF_EM_RAW_TO_R3;
238	/* DMA work pending? */
239	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
240	rc = VINF_EM_RAW_TO_R3;
241	/* Pending request packets might contain actions that need immediate
242	attention, such as pending hardware interrupts. */
243	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
244	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
245	rc = VINF_EM_PENDING_REQUEST;
246	/* Pending GDT/LDT/TSS sync. */
247	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
248	rc = VINF_SELM_SYNC_GDT;
249	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
250	rc = VINF_EM_RAW_TO_R3;
251	/* Pending interrupt: dispatch it. */
252	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
253	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
254	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
255	)
256	{
257	uint8_t u8Interrupt;
258	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
259	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
260	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
261	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
262	/* can't return if successful */
263	Assert(rc != VINF_SUCCESS);
264
265	/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
266	Assert(uOldActiveVector <= 16);
267	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
268
269	/* Assert the trap and go to the recompiler to dispatch it. */
270	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
271
272	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
273	rc = VINF_EM_RAW_INTERRUPT_PENDING;
274	}
275	/*
276	* Try sync CR3?
277	*/
278	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
279	{
280	#if 1
281	PGMRZDynMapReleaseAutoSet(pVCpu);
282	PGMRZDynMapStartAutoSet(pVCpu);
283	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
284	#else
285	rc = VINF_PGM_SYNC_CR3;
286	#endif
287	}
288	}
289
290	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
291	PGMRZDynMapReleaseAutoSet(pVCpu);
292	return rc;
293	}
294
295
296	/**
297	* \#DB (Debug event) handler.
298	*
299	* @returns VBox status code.
300	* VINF_SUCCESS means we completely handled this trap,
301	* other codes are passed execution to host context.
302	*
303	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
304	* @param pRegFrame Pointer to the register frame for the trap.
305	* @internal
306	*/
307	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
308	{
309	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
310	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
311	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
312	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
313	TRPM_ENTER_DBG_HOOK(1);
314
315	/*
316	* We currently don't make use of the X86_DR7_GD bit, but
317	* there might come a time when we do.
318	*/
319	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
320	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
321	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
322	VERR_NOT_IMPLEMENTED);
323	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
324
325	/*
326	* Now leave the rest to the DBGF.
327	*/
328	PGMRZDynMapStartAutoSet(pVCpu);
329	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
330	if (rc == VINF_EM_RAW_GUEST_TRAP)
331	{
332	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
333	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
334	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
335	}
336	else if (rc == VINF_EM_DBG_STEPPED)
337	pRegFrame->eflags.Bits.u1TF = 0;
338
339	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
340	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
341	TRPM_EXIT_DBG_HOOK(1);
342	return rc;
343	}
344
345
346	/**
347	* \#DB (Debug event) handler for the hypervisor code.
348	*
349	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
350	* mapping set as well as the default trap exit path since they are both really
351	* bad ideas in this context.
352	*
353	* @returns VBox status code.
354	* VINF_SUCCESS means we completely handled this trap,
355	* other codes are passed execution to host context.
356	*
357	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
358	* @param pRegFrame Pointer to the register frame for the trap.
359	* @internal
360	*/
361	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
362	{
363	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
364	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
365	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
366	TRPM_ENTER_DBG_HOOK_HYPER(1);
367	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
368
369	/*
370	* We currently don't make use of the X86_DR7_GD bit, but
371	* there might come a time when we do.
372	*/
373	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
374	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
375	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
376	VERR_NOT_IMPLEMENTED);
377	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
378
379	/*
380	* Now leave the rest to the DBGF.
381	*/
382	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
383	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
384	if (rc == VINF_EM_DBG_STEPPED)
385	pRegFrame->eflags.Bits.u1TF = 0;
386
387	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
388	TRPM_EXIT_DBG_HOOK_HYPER(1);
389	return rc;
390	}
391
392
393	/**
394	* NMI handler, for when we are using NMIs to debug things.
395	*
396	* @returns VBox status code.
397	* VINF_SUCCESS means we completely handled this trap,
398	* other codes are passed execution to host context.
399	*
400	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
401	* @param pRegFrame Pointer to the register frame for the trap.
402	* @internal
403	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
404	*/
405	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
406	{
407	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
408	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
409	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
410	#endif
411	NOREF(pTrpmCpu);
412	return VERR_TRPM_DONT_PANIC;
413	}
414
415
416	/**
417	* NMI handler, for when we are using NMIs to debug things.
418	*
419	* This is the handler we're most likely to hit when the NMI fires (it is
420	* unlikely that we'll be stuck in guest code).
421	*
422	* @returns VBox status code.
423	* VINF_SUCCESS means we completely handled this trap,
424	* other codes are passed execution to host context.
425	*
426	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
427	* @param pRegFrame Pointer to the register frame for the trap.
428	* @internal
429	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
430	*/
431	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
432	{
433	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
434	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
435	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
436	#endif
437	NOREF(pTrpmCpu);
438	return VERR_TRPM_DONT_PANIC;
439	}
440
441
442	/**
443	* \#BP (Breakpoint) handler.
444	*
445	* @returns VBox status code.
446	* VINF_SUCCESS means we completely handled this trap,
447	* other codes are passed execution to host context.
448	*
449	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
450	* @param pRegFrame Pointer to the register frame for the trap.
451	* @internal
452	*/
453	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
454	{
455	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
456	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
457	int rc;
458	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
459	TRPM_ENTER_DBG_HOOK(3);
460	PGMRZDynMapStartAutoSet(pVCpu);
461
462	/*
463	* PATM is using INT3s, let them have a go first.
464	*/
465	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
466	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
467	&& !pRegFrame->eflags.Bits.u1VM)
468	{
469	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
470	if ( rc == VINF_SUCCESS
471	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
472	\|\| rc == VINF_PATM_PATCH_INT3
473	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
474	{
475	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
476	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
477	TRPM_EXIT_DBG_HOOK(3);
478	return rc;
479	}
480	}
481	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
482
483	/* anything we should do with this? Schedule it in GC? */
484	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
485	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
486	TRPM_EXIT_DBG_HOOK(3);
487	return rc;
488	}
489
490
491	/**
492	* \#BP (Breakpoint) handler.
493	*
494	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
495	* harmful to us (common trap exit and the auto mapping set).
496	*
497	* @returns VBox status code.
498	* VINF_SUCCESS means we completely handled this trap,
499	* other codes are passed execution to host context.
500	*
501	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
502	* @param pRegFrame Pointer to the register frame for the trap.
503	* @internal
504	*/
505	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
506	{
507	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
508	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
509	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
510	TRPM_ENTER_DBG_HOOK_HYPER(3);
511
512	/*
513	* Hand it over to DBGF.
514	*/
515	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
516	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
517
518	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
519	TRPM_EXIT_DBG_HOOK_HYPER(3);
520	return rc;
521	}
522
523
524	/**
525	* Trap handler for illegal opcode fault (\#UD).
526	*
527	* @returns VBox status code.
528	* VINF_SUCCESS means we completely handled this trap,
529	* other codes are passed execution to host context.
530	*
531	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
532	* @param pRegFrame Pointer to the register frame for the trap.
533	* @internal
534	*/
535	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
536	{
537	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
538	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
539	int rc;
540	LogFlow(("TRPMGC06: %04x:%08x EFL=%#x/%#x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
541	TRPM_ENTER_DBG_HOOK(6);
542	PGMRZDynMapStartAutoSet(pVCpu);
543
544	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
545	{
546	/*
547	* Decode the instruction.
548	*/
549	RTGCPTR PC;
550	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
551	pRegFrame->rip, &PC);
552	if (RT_FAILURE(rc))
553	{
554	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
555	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
556	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
557	TRPM_EXIT_DBG_HOOK(6);
558	return rc;
559	}
560
561	DISCPUSTATE Cpu;
562	uint32_t cbOp;
563	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
564	if (RT_FAILURE(rc))
565	{
566	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
567	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
568	TRPM_EXIT_DBG_HOOK(6);
569	return rc;
570	}
571
572	/*
573	* UD2 in a patch?
574	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
575	*/
576	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
577	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
578	{
579	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
580	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
581	/** @todo These tests are completely unnecessary, should just follow the
582	* flow and return at the end of the function. */
583	if ( rc == VINF_SUCCESS
584	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
585	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
586	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
587	\|\| rc == VINF_EM_RESCHEDULE)
588	{
589	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
590	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
591	TRPM_EXIT_DBG_HOOK(6);
592	return rc;
593	}
594	}
595	/*
596	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
597	*/
598	else if (Cpu.fPrefix & DISPREFIX_LOCK)
599	{
600	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
601	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
602	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
603	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
604	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
605	#else
606	rc = VINF_EM_RAW_EMULATE_INSTR;
607	#endif
608	}
609	/*
610	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
611	*/
612	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
613	{
614	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
615	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
616	}
617	else if (GIMShouldTrapXcptUD(pVCpu))
618	{
619	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
620	rc = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu);
621	if (RT_FAILURE(rc))
622	{
623	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD -> VINF_EM_RAW_EMULATE_INSTR\n"));
624	rc = VINF_EM_RAW_EMULATE_INSTR;
625	}
626	}
627	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
628	else
629	{
630	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
631	rc = VINF_EM_RAW_EMULATE_INSTR;
632	}
633	}
634	else
635	{
636	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
637	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
638	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
639	}
640
641	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
642	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
643	TRPM_EXIT_DBG_HOOK(6);
644	return rc;
645	}
646
647
648	/**
649	* Trap handler for device not present fault (\#NM).
650	*
651	* Device not available, FP or (F)WAIT instruction.
652	*
653	* @returns VBox status code.
654	* VINF_SUCCESS means we completely handled this trap,
655	* other codes are passed execution to host context.
656	*
657	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
658	* @param pRegFrame Pointer to the register frame for the trap.
659	* @internal
660	*/
661	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
662	{
663	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
664	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
665	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
666	TRPM_ENTER_DBG_HOOK(7);
667	PGMRZDynMapStartAutoSet(pVCpu);
668
669	int rc = CPUMHandleLazyFPU(pVCpu);
670	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
671	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
672	TRPM_EXIT_DBG_HOOK(7);
673	return rc;
674	}
675
676
677	/**
678	* \#NP ((segment) Not Present) handler.
679	*
680	* @returns VBox status code.
681	* VINF_SUCCESS means we completely handled this trap,
682	* other codes are passed execution to host context.
683	*
684	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
685	* @param pRegFrame Pointer to the register frame for the trap.
686	* @internal
687	*/
688	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
689	{
690	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
691	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
692	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
693	TRPM_ENTER_DBG_HOOK(0xb);
694	PGMRZDynMapStartAutoSet(pVCpu);
695
696	/*
697	* Try to detect instruction by opcode which caused trap.
698	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
699	* accessing user code. need to handle it somehow in future!
700	*/
701	RTGCPTR GCPtr;
702	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
703	(RTGCPTR)pRegFrame->eip, &GCPtr)
704	== VINF_SUCCESS)
705	{
706	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
707
708	/*
709	* First skip possible instruction prefixes, such as:
710	* OS, AS
711	* CS:, DS:, ES:, SS:, FS:, GS:
712	* REPE, REPNE
713	*
714	* note: Currently we supports only up to 4 prefixes per opcode, more
715	* prefixes (normally not used anyway) will cause trap d in guest.
716	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
717	* check this issue, its too hard.
718	*/
719	for (unsigned i = 0; i < 4; i++)
720	{
721	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
722	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
723	&& pu8Code[0] != 0x2e /* CS: */
724	&& pu8Code[0] != 0x36 /* SS: */
725	&& pu8Code[0] != 0x3e /* DS: */
726	&& pu8Code[0] != 0x26 /* ES: */
727	&& pu8Code[0] != 0x64 /* FS: */
728	&& pu8Code[0] != 0x65 /* GS: */
729	&& pu8Code[0] != 0x66 /* OS */
730	&& pu8Code[0] != 0x67 /* AS */
731	)
732	break;
733	pu8Code++;
734	}
735
736	/*
737	* Detect right switch using a callgate.
738	*
739	* We recognize the following causes for the trap 0b:
740	* CALL FAR, CALL FAR []
741	* JMP FAR, JMP FAR []
742	* IRET (may cause a task switch)
743	*
744	* Note: we can't detect whether the trap was caused by a call to a
745	* callgate descriptor or it is a real trap 0b due to a bad selector.
746	* In both situations we'll pass execution to our recompiler so we don't
747	* have to worry.
748	* If we wanted to do better detection, we have set GDT entries to callgate
749	* descriptors pointing to our own handlers.
750	*/
751	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
752	if ( pu8Code[0] == 0x9a /* CALL FAR */
753	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
754	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
755	\|\| pu8Code[0] == 0xea /* JMP FAR */
756	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
757	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
758	\|\| pu8Code[0] == 0xcf /* IRET */
759	)
760	{
761	/*
762	* Got potential call to callgate.
763	* We simply return execution to the recompiler to do emulation
764	* starting from the instruction which caused the trap.
765	*/
766	pTrpmCpu->uActiveVector = UINT32_MAX;
767	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
768	TRPM_EXIT_DBG_HOOK(0xb);
769	PGMRZDynMapReleaseAutoSet(pVCpu);
770	return VINF_EM_RAW_RING_SWITCH;
771	}
772	}
773
774	/*
775	* Pass trap 0b as is to the recompiler in all other cases.
776	*/
777	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
778	PGMRZDynMapReleaseAutoSet(pVCpu);
779	TRPM_EXIT_DBG_HOOK(0xb);
780	return VINF_EM_RAW_GUEST_TRAP;
781	}
782
783
784	/**
785	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
786	*
787	* @returns VBox status code.
788	* VINF_SUCCESS means we completely handled this trap,
789	* other codes are passed execution to host context.
790	*
791	* @param pVM The cross context VM structure.
792	* @param pVCpu The cross context virtual CPU structure.
793	* @param pRegFrame Pointer to the register frame for the trap.
794	* @param pCpu The opcode info.
795	* @param PC The program counter corresponding to cs:eip in pRegFrame.
796	*/
797	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
798	{
799	int rc;
800	TRPM_ENTER_DBG_HOOK(0xd);
801
802	/*
803	* Try handle it here, if not return to HC and emulate/interpret it there.
804	*/
805	switch (pCpu->pCurInstr->uOpcode)
806	{
807	case OP_INT3:
808	/*
809	* Little hack to make the code below not fail
810	*/
811	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
812	pCpu->Param1.uValue = 3;
813	/* fallthru */
814	case OP_INT:
815	{
816	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
817	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
818	if (pCpu->Param1.uValue == 3)
819	{
820	/* Int 3 replacement patch? */
821	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
822	{
823	AssertFailed();
824	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
825	}
826	}
827	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
828	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
829	{
830	TRPM_EXIT_DBG_HOOK(0xd);
831	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
832	}
833
834	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
835	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
836	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
837	}
838
839	#ifdef PATM_EMULATE_SYSENTER
840	case OP_SYSEXIT:
841	case OP_SYSRET:
842	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
843	TRPM_EXIT_DBG_HOOK(0xd);
844	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
845	#endif
846
847	case OP_HLT:
848	/* If it's in patch code, defer to ring-3. */
849	if (PATMIsPatchGCAddr(pVM, PC))
850	break;
851
852	pRegFrame->eip += pCpu->cbInstr;
853	TRPM_EXIT_DBG_HOOK(0xd);
854	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
855
856
857	/*
858	* These instructions are used by PATM and CASM for finding
859	* dangerous non-trapping instructions. Thus, since all
860	* scanning and patching is done in ring-3 we'll have to
861	* return to ring-3 on the first encounter of these instructions.
862	*/
863	case OP_MOV_CR:
864	case OP_MOV_DR:
865	/* We can safely emulate control/debug register move instructions in patched code. */
866	if ( !PATMIsPatchGCAddr(pVM, PC)
867	&& !CSAMIsKnownDangerousInstr(pVM, PC))
868	break;
869	case OP_INVLPG:
870	case OP_LLDT:
871	case OP_STI:
872	case OP_RDTSC: /* just in case */
873	case OP_RDPMC:
874	case OP_CLTS:
875	case OP_WBINVD: /* nop */
876	case OP_RDMSR:
877	case OP_WRMSR:
878	{
879	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
880	if (rc == VERR_EM_INTERPRETER)
881	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
882	TRPM_EXIT_DBG_HOOK(0xd);
883	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
884	}
885	}
886
887	TRPM_EXIT_DBG_HOOK(0xd);
888	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
889	}
890
891
892	/**
893	* \#GP (General Protection Fault) handler for Ring-3.
894	*
895	* @returns VBox status code.
896	* VINF_SUCCESS means we completely handled this trap,
897	* other codes are passed execution to host context.
898	*
899	* @param pVM The cross context VM structure.
900	* @param pVCpu The cross context virtual CPU structure.
901	* @param pRegFrame Pointer to the register frame for the trap.
902	* @param pCpu The opcode info.
903	* @param PC The program counter corresponding to cs:eip in pRegFrame.
904	*/
905	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
906	{
907	int rc;
908	Assert(!pRegFrame->eflags.Bits.u1VM);
909	TRPM_ENTER_DBG_HOOK(0xd);
910
911	switch (pCpu->pCurInstr->uOpcode)
912	{
913	/*
914	* INT3 and INT xx are ring-switching.
915	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
916	*/
917	case OP_INT3:
918	/*
919	* Little hack to make the code below not fail
920	*/
921	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
922	pCpu->Param1.uValue = 3;
923	/* fall thru */
924	case OP_INT:
925	{
926	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
927	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
928	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
929	{
930	TRPM_EXIT_DBG_HOOK(0xd);
931	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
932	}
933
934	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
935	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
936	TRPM_EXIT_DBG_HOOK(0xd);
937	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
938	}
939
940	/*
941	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
942	*/
943	case OP_SYSCALL:
944	case OP_SYSENTER:
945	#ifdef PATM_EMULATE_SYSENTER
946	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
947	if (rc == VINF_SUCCESS)
948	{
949	TRPM_EXIT_DBG_HOOK(0xd);
950	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
951	}
952	/* else no break; */
953	#endif
954	case OP_BOUND:
955	case OP_INTO:
956	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
957	TRPM_EXIT_DBG_HOOK(0xd);
958	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
959
960	/*
961	* Handle virtualized TSC & PMC reads, just in case.
962	*/
963	case OP_RDTSC:
964	case OP_RDPMC:
965	{
966	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
967	if (rc == VERR_EM_INTERPRETER)
968	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
969	TRPM_EXIT_DBG_HOOK(0xd);
970	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
971	}
972
973	/*
974	* STI and CLI are I/O privileged, i.e. if IOPL
975	*/
976	case OP_STI:
977	case OP_CLI:
978	{
979	uint32_t efl = CPUMRawGetEFlags(pVCpu);
980	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
981	if (X86_EFL_GET_IOPL(efl) >= cpl)
982	{
983	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
984	TRPM_EXIT_DBG_HOOK(0xd);
985	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
986	}
987	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
988	break;
989	}
990	}
991
992	/*
993	* A genuine guest fault.
994	*/
995	TRPM_EXIT_DBG_HOOK(0xd);
996	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
997	}
998
999
1000	/**
1001	* Emulates RDTSC for the \#GP handler.
1002	*
1003	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
1004	*
1005	* @param pVM The cross context VM structure.
1006	* @param pVCpu The cross context virtual CPU structure.
1007	* @param pRegFrame Pointer to the register frame for the trap.
1008	* This will be updated on successful return.
1009	*/
1010	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1011	{
1012	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1013	TRPM_ENTER_DBG_HOOK(0xd);
1014
1015	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1016	{
1017	TRPM_EXIT_DBG_HOOK(0xd);
1018	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1019	}
1020
1021	uint64_t uTicks = TMCpuTickGet(pVCpu);
1022	pRegFrame->eax = uTicks;
1023	pRegFrame->edx = uTicks >> 32;
1024	pRegFrame->eip += 2;
1025	TRPM_EXIT_DBG_HOOK(0xd);
1026	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1027	}
1028
1029
1030	/**
1031	* \#GP (General Protection Fault) handler.
1032	*
1033	* @returns VBox status code.
1034	* VINF_SUCCESS means we completely handled this trap,
1035	* other codes are passed execution to host context.
1036	*
1037	* @param pVM The cross context VM structure.
1038	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1039	* @param pRegFrame Pointer to the register frame for the trap.
1040	*/
1041	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1042	{
1043	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1044	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1045	TRPM_ENTER_DBG_HOOK(0xd);
1046
1047	/*
1048	* Convert and validate CS.
1049	*/
1050	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1051	RTGCPTR PC;
1052	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1053	pRegFrame->rip, &PC);
1054	if (RT_FAILURE(rc))
1055	{
1056	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1057	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1058	TRPM_EXIT_DBG_HOOK(0xd);
1059	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1060	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1061	}
1062
1063	/*
1064	* Disassemble the instruction.
1065	*/
1066	DISCPUSTATE Cpu;
1067	uint32_t cbOp;
1068	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1069	if (RT_FAILURE(rc))
1070	{
1071	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1072	TRPM_EXIT_DBG_HOOK(0xd);
1073	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1074	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1075	}
1076	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1077
1078	/*
1079	* Optimize RDTSC traps.
1080	* Some guests (like Solaris) are using RDTSC all over the place and
1081	* will end up trapping a lot because of that.
1082	*
1083	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1084	*/
1085	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1086	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1087
1088	/*
1089	* Deal with I/O port access.
1090	*/
1091	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1092	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1093	{
1094	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1095	if (IOM_SUCCESS(rcStrict))
1096	{
1097	pRegFrame->rip += cbOp;
1098
1099	/*
1100	* Check for I/O breakpoints. A bit clumsy, but should be short lived (moved to IEM).
1101	*/
1102	uint32_t const uDr7 = CPUMGetGuestDR7(pVCpu);
1103	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
1104	&& X86_DR7_ANY_RW_IO(uDr7)
1105	&& (CPUMGetGuestCR4(pVCpu) & X86_CR4_DE))
1106	\|\| DBGFBpIsHwIoArmed(pVM)))
1107	{
1108	uint64_t uPort = pRegFrame->dx;
1109	unsigned cbValue;
1110	if ( Cpu.pCurInstr->uOpcode == OP_IN
1111	\|\| Cpu.pCurInstr->uOpcode == OP_INSB
1112	\|\| Cpu.pCurInstr->uOpcode == OP_INSWD)
1113	{
1114	cbValue = DISGetParamSize(&Cpu, &Cpu.Param1);
1115	if (Cpu.Param2.fUse & DISUSE_IMMEDIATE)
1116	uPort = Cpu.Param2.uValue;
1117	}
1118	else
1119	{
1120	cbValue = DISGetParamSize(&Cpu, &Cpu.Param2);
1121	if (Cpu.Param1.fUse & DISUSE_IMMEDIATE)
1122	uPort = Cpu.Param1.uValue;
1123	}
1124
1125	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, CPUMCTX_FROM_CORE(pRegFrame), uPort, cbValue);
1126	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
1127	{
1128	/* Raise #DB. */
1129	TRPMResetTrap(pVCpu);
1130	TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
1131	if (rcStrict != VINF_SUCCESS)
1132	LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
1133	rcStrict = VINF_EM_RAW_GUEST_TRAP;
1134	}
1135	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
1136	else if ( rcStrict2 != VINF_SUCCESS
1137	&& (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
1138	rcStrict = rcStrict2;
1139	}
1140	}
1141	rc = VBOXSTRICTRC_TODO(rcStrict);
1142	TRPM_EXIT_DBG_HOOK(0xd);
1143	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1144	}
1145
1146	/*
1147	* Deal with Ring-0 (privileged instructions)
1148	*/
1149	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1150	&& !pRegFrame->eflags.Bits.u1VM)
1151	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1152
1153	/*
1154	* Deal with Ring-3 GPs.
1155	*/
1156	if (!pRegFrame->eflags.Bits.u1VM)
1157	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1158
1159	/*
1160	* Deal with v86 code.
1161	*
1162	* We always set IOPL to zero which makes e.g. pushf fault in V86
1163	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1164	* Simply fall back to the recompiler to emulate this instruction if
1165	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1166	*/
1167	X86EFLAGS eflags;
1168	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1169	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1170	if (eflags.Bits.u2IOPL != 3)
1171	{
1172	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1173
1174	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1175	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1176	TRPM_EXIT_DBG_HOOK(0xd);
1177	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1178	}
1179	TRPM_EXIT_DBG_HOOK(0xd);
1180	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1181	}
1182
1183
1184	/**
1185	* \#GP (General Protection Fault) handler.
1186	*
1187	* @returns VBox status code.
1188	* VINF_SUCCESS means we completely handled this trap,
1189	* other codes are passed execution to host context.
1190	*
1191	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1192	* @param pRegFrame Pointer to the register frame for the trap.
1193	* @internal
1194	*/
1195	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1196	{
1197	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1198	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1199	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1200	TRPM_ENTER_DBG_HOOK(0xd);
1201
1202	PGMRZDynMapStartAutoSet(pVCpu);
1203	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1204	switch (rc)
1205	{
1206	case VINF_EM_RAW_GUEST_TRAP:
1207	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1208	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1209	rc = VINF_PATM_PATCH_TRAP_GP;
1210	break;
1211
1212	case VINF_EM_RAW_INTERRUPT_PENDING:
1213	Assert(TRPMHasTrap(pVCpu));
1214	/* no break; */
1215	case VINF_PGM_SYNC_CR3:
1216	case VINF_EM_RAW_EMULATE_INSTR:
1217	case VINF_IOM_R3_IOPORT_READ:
1218	case VINF_IOM_R3_IOPORT_WRITE:
1219	case VINF_IOM_R3_MMIO_WRITE:
1220	case VINF_IOM_R3_MMIO_READ:
1221	case VINF_IOM_R3_MMIO_READ_WRITE:
1222	case VINF_CPUM_R3_MSR_READ:
1223	case VINF_CPUM_R3_MSR_WRITE:
1224	case VINF_PATM_PATCH_INT3:
1225	case VINF_EM_NO_MEMORY:
1226	case VINF_EM_RAW_TO_R3:
1227	case VINF_EM_RAW_TIMER_PENDING:
1228	case VINF_EM_PENDING_REQUEST:
1229	case VINF_EM_HALT:
1230	case VINF_SELM_SYNC_GDT:
1231	case VINF_SUCCESS:
1232	break;
1233
1234	default:
1235	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1236	break;
1237	}
1238	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1239	TRPM_EXIT_DBG_HOOK(0xd);
1240	return rc;
1241	}
1242
1243
1244	/**
1245	* \#PF (Page Fault) handler.
1246	*
1247	* Calls PGM which does the actual handling.
1248	*
1249	*
1250	* @returns VBox status code.
1251	* VINF_SUCCESS means we completely handled this trap,
1252	* other codes are passed execution to host context.
1253	*
1254	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1255	* @param pRegFrame Pointer to the register frame for the trap.
1256	* @internal
1257	*/
1258	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1259	{
1260	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1261	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1262	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1263	TRPM_ENTER_DBG_HOOK(0xe);
1264
1265	/*
1266	* This is all PGM stuff.
1267	*/
1268	PGMRZDynMapStartAutoSet(pVCpu);
1269	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1270	switch (rc)
1271	{
1272	case VINF_EM_RAW_EMULATE_INSTR:
1273	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1274	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1275	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1276	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1277	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1278	rc = VINF_PATCH_EMULATE_INSTR;
1279	break;
1280
1281	case VINF_EM_RAW_GUEST_TRAP:
1282	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1283	{
1284	PGMRZDynMapReleaseAutoSet(pVCpu);
1285	TRPM_EXIT_DBG_HOOK(0xe);
1286	return VINF_PATM_PATCH_TRAP_PF;
1287	}
1288
1289	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1290	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1291	break;
1292
1293	case VINF_EM_RAW_INTERRUPT_PENDING:
1294	Assert(TRPMHasTrap(pVCpu));
1295	/* no break; */
1296	case VINF_IOM_R3_MMIO_READ:
1297	case VINF_IOM_R3_MMIO_WRITE:
1298	case VINF_IOM_R3_MMIO_READ_WRITE:
1299	case VINF_PATM_HC_MMIO_PATCH_READ:
1300	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1301	case VINF_SUCCESS:
1302	case VINF_EM_RAW_TO_R3:
1303	case VINF_EM_PENDING_REQUEST:
1304	case VINF_EM_RAW_TIMER_PENDING:
1305	case VINF_EM_NO_MEMORY:
1306	case VINF_CSAM_PENDING_ACTION:
1307	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1308	break;
1309
1310	default:
1311	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1312	break;
1313	}
1314	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1315	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1316	TRPM_EXIT_DBG_HOOK(0xe);
1317	return rc;
1318	}
1319
1320
1321	/**
1322	* Scans for the EIP in the specified array of trap handlers.
1323	*
1324	* If we don't fine the EIP, we'll panic.
1325	*
1326	* @returns VBox status code.
1327	*
1328	* @param pVM The cross context VM structure.
1329	* @param pRegFrame Pointer to the register frame for the trap.
1330	* @param paHandlers The array of trap handler records.
1331	* @param pEndRecord The end record (exclusive).
1332	*/
1333	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1334	{
1335	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1336	Assert(paHandlers <= pEndRecord);
1337
1338	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1339
1340	#if 0 /// @todo later
1341	/*
1342	* Start by doing a kind of binary search.
1343	*/
1344	unsigned iStart = 0;
1345	unsigned iEnd = pEndRecord - paHandlers;
1346	unsigned i = iEnd / 2;
1347	#endif
1348
1349	/*
1350	* Do a linear search now (in case the array wasn't properly sorted).
1351	*/
1352	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1353	{
1354	if ( pCur->uStartEIP <= uEip
1355	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1356	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1357	}
1358
1359	return VERR_TRPM_DONT_PANIC;
1360	}
1361
1362
1363	/**
1364	* Hypervisor \#NP ((segment) Not Present) handler.
1365	*
1366	* Scans for the EIP in the registered trap handlers.
1367	*
1368	* @returns VBox status code.
1369	* VINF_SUCCESS means we completely handled this trap,
1370	* other codes are passed back to host context.
1371	*
1372	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1373	* @param pRegFrame Pointer to the register frame for the trap.
1374	* @internal
1375	*/
1376	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1377	{
1378	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1379	}
1380
1381
1382	/**
1383	* Hypervisor \#GP (General Protection Fault) handler.
1384	*
1385	* Scans for the EIP in the registered trap handlers.
1386	*
1387	* @returns VBox status code.
1388	* VINF_SUCCESS means we completely handled this trap,
1389	* other codes are passed back to host context.
1390	*
1391	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1392	* @param pRegFrame Pointer to the register frame for the trap.
1393	* @internal
1394	*/
1395	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1396	{
1397	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1398	}
1399
1400
1401	/**
1402	* Hypervisor \#PF (Page Fault) handler.
1403	*
1404	* Scans for the EIP in the registered trap handlers.
1405	*
1406	* @returns VBox status code.
1407	* VINF_SUCCESS means we completely handled this trap,
1408	* other codes are passed back to host context.
1409	*
1410	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1411	* @param pRegFrame Pointer to the register frame for the trap.
1412	* @internal
1413	*/
1414	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1415	{
1416	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1417	}
1418
1419
1420	/**
1421	* Deal with hypervisor traps occurring when resuming execution on a trap.
1422	*
1423	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1424	* this by not allowing recursion without it being the subject of a guru
1425	* meditation. (We used to / tried to handle this but there isn't any reason
1426	* for it.)
1427	*
1428	* So, do NOT use this for handling RC traps!
1429	*
1430	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1431	* @param pVM The cross context VM structure.
1432	* @param pRegFrame Register frame.
1433	* @param uUser User arg.
1434	*/
1435	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1436	{
1437	Log(("********************************************************\n"));
1438	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1439	Log(("********************************************************\n"));
1440
1441	/*
1442	* This used to be kind of complicated, but since we stopped storing
1443	* the register frame on the stack and instead storing it directly
1444	* in the CPUMCPU::Guest structure, we just have to figure out which
1445	* status to hand on to the host and let the recompiler/IEM do its
1446	* job.
1447	*/
1448	switch (uUser)
1449	{
1450	case TRPM_TRAP_IN_MOV_GS:
1451	case TRPM_TRAP_IN_MOV_FS:
1452	case TRPM_TRAP_IN_MOV_ES:
1453	case TRPM_TRAP_IN_MOV_DS:
1454	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1455	break;
1456
1457	case TRPM_TRAP_IN_IRET:
1458	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1459	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1460	break;
1461
1462	default:
1463	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1464	return VERR_TRPM_BAD_TRAP_IN_OP;
1465	}
1466
1467	AssertMsgFailed(("Impossible!\n"));
1468	return VERR_TRPM_IPE_3;
1469	}
1470
1471
1472	/**
1473	* Generic hyper trap handler that sets the EIP to @a uUser.
1474	*
1475	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1476	* @param pVM The cross context VM structure.
1477	* @param pRegFrame Pointer to the register frame (within VM)
1478	* @param uUser The user arg, which should be the new EIP address.
1479	*/
1480	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1481	{
1482	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1483	pRegFrame->eip = uUser;
1484	return VINF_SUCCESS;
1485	}
1486

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 60189

Download in other formats: