TRPMRCHandlers.cpp@ 60740

Last change on this file since 60740 was 60740, checked in by vboxsync, 9 years ago
VMM, recompiler: Fix APIC to update pending interrupts to IRR when the force-flag is set, rather than in PDMGetInterrupt() which gets called only with EFLAGS.IF set in certain places.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 57.7 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 60740 2016-04-28 12:51:47Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#ifdef VBOX_WITH_NEW_APIC
31	# include <VBox/vmm/apic.h>
32	#endif
33	#include <VBox/vmm/csam.h>
34	#include <VBox/vmm/patm.h>
35	#include <VBox/vmm/mm.h>
36	#include <VBox/vmm/cpum.h>
37	#include "TRPMInternal.h"
38	#include <VBox/vmm/vm.h>
39	#include <VBox/vmm/vmm.h>
40	#include <VBox/param.h>
41
42	#include <VBox/err.h>
43	#include <VBox/dis.h>
44	#include <VBox/disopcode.h>
45	#include <VBox/log.h>
46	#include <VBox/vmm/tm.h>
47	#include <iprt/asm.h>
48	#include <iprt/asm-amd64-x86.h>
49	#include <iprt/assert.h>
50	#include <iprt/x86.h>
51
52
53	/*********************************************************************************************************************************
54	* Defined Constants And Macros *
55	*********************************************************************************************************************************/
56	/* still here. MODR/M byte parsing */
57	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
58	#define X86_OPCODE_MODRM_REG_MASK 0x38
59	#define X86_OPCODE_MODRM_RM_MASK 0x07
60
61	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
62	#define DTRACE_EXPERIMENT
63
64	#if 1
65	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
66	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
67	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
68	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
69	#else
70	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
71	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
72	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
73	else do {} while (0)
74	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
75	do { \
76	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
77	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
78	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
79	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
80	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
81	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
82	} while (0)
83	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
84	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
85	#endif
86
87
88	/*********************************************************************************************************************************
89	* Structures and Typedefs *
90	*********************************************************************************************************************************/
91	/** Pointer to a readonly hypervisor trap record. */
92	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
93
94	/**
95	* A hypervisor trap record.
96	* This contains information about a handler for a instruction range.
97	*
98	* @remark This must match what TRPM_HANDLER outputs.
99	*/
100	typedef struct TRPMGCHYPER
101	{
102	/** The start address. */
103	uintptr_t uStartEIP;
104	/** The end address. (exclusive)
105	* If NULL the it's only for the instruction at pvStartEIP. */
106	uintptr_t uEndEIP;
107	/**
108	* The handler.
109	*
110	* @returns VBox status code
111	* VINF_SUCCESS means we've handled the trap.
112	* Any other error code means returning to the host context.
113	* @param pVM The cross context VM structure.
114	* @param pRegFrame The register frame.
115	* @param uUser The user argument.
116	*/
117	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
118	/** Whatever the handler desires to put here. */
119	uintptr_t uUser;
120	} TRPMGCHYPER;
121
122
123	/*********************************************************************************************************************************
124	* Global Variables *
125	*********************************************************************************************************************************/
126	RT_C_DECLS_BEGIN
127	/** Defined in VMMRC0.asm or VMMRC99.asm.
128	* @{ */
129	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
130	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
131	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
132	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
133	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
134	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
135	/** @} */
136	RT_C_DECLS_END
137
138
139	/*********************************************************************************************************************************
140	* Internal Functions *
141	*********************************************************************************************************************************/
142	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
143	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
144	RT_C_DECLS_END
145
146
147
148	/**
149	* Exits the trap, called when exiting a trap handler.
150	*
151	* Will reset the trap if it's not a guest trap or the trap
152	* is already handled. Will process resume guest FFs.
153	*
154	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
155	* happened.
156	* @param pVM The cross context VM structure.
157	* @param pVCpu The cross context virtual CPU structure.
158	* @param rc The VBox status code to return.
159	* @param pRegFrame Pointer to the register frame for the trap.
160	*
161	* @remarks This must not be used for hypervisor traps, only guest traps.
162	*/
163	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
164	{
165	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
166	NOREF(uOldActiveVector);
167
168	/* Reset trap? */
169	if ( rc != VINF_EM_RAW_GUEST_TRAP
170	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
171	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
172
173	#ifdef VBOX_HIGH_RES_TIMERS_HACK
174	/*
175	* We should poll the timers occasionally.
176	* We must NOT do this too frequently as it adds a significant overhead
177	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
178	* (The heuristic is not very intelligent, we should really check trap
179	* frequency etc. here, but alas, we lack any such information atm.)
180	*/
181	static unsigned s_iTimerPoll = 0;
182	if (rc == VINF_SUCCESS)
183	{
184	if (!(++s_iTimerPoll & 0xf))
185	{
186	TMTimerPollVoid(pVM, pVCpu);
187	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
188	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
189	}
190	}
191	else
192	s_iTimerPoll = 0;
193	#endif
194
195	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
196	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
197	{
198	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
199	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
200	{
201	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
202	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
203	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
204	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
205	*/
206	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
207	}
208	}
209
210	/*
211	* Pending resume-guest-FF?
212	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
213	*/
214	if ( rc == VINF_SUCCESS
215	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
216	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3 \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
217	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
218	\| VMCPU_FF_PDM_CRITSECT
219	\| VMCPU_FF_IEM
220	\| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT
221	\| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
222	)
223	)
224	)
225	{
226	/* The out of memory condition naturally outranks the others. */
227	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
228	rc = VINF_EM_NO_MEMORY;
229	/* Pending Ring-3 action. */
230	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT \| VMCPU_FF_IEM))
231	{
232	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
233	rc = VINF_EM_RAW_TO_R3;
234	}
235	/* Pending timer action. */
236	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
237	rc = VINF_EM_RAW_TIMER_PENDING;
238	/* The Virtual Sync clock has stopped. */
239	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
240	rc = VINF_EM_RAW_TO_R3;
241	/* DMA work pending? */
242	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
243	rc = VINF_EM_RAW_TO_R3;
244	/* Pending request packets might contain actions that need immediate
245	attention, such as pending hardware interrupts. */
246	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
247	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
248	rc = VINF_EM_PENDING_REQUEST;
249	/* Pending GDT/LDT/TSS sync. */
250	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
251	rc = VINF_SELM_SYNC_GDT;
252	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
253	rc = VINF_EM_RAW_TO_R3;
254	/* Possibly pending interrupt: dispatch it. */
255	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
256	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
257	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
258	)
259	{
260	#ifdef VBOX_WITH_NEW_APIC
261	/* The EFLAGS are checked in TRPMForwardTrap() below. */
262	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC))
263	APICUpdatePendingInterrupts(pVCpu);
264	#endif
265	uint8_t u8Interrupt;
266	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
267	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
268	if (RT_SUCCESS(rc))
269	{
270	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
271	/* can't return if successful */
272	Assert(rc != VINF_SUCCESS);
273
274	/* Stop the profile counter that was started in TRPMRCHandlersA.asm */
275	Assert(uOldActiveVector <= 16);
276	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
277
278	/* Assert the trap and go to the recompiler to dispatch it. */
279	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
280
281	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
282	rc = VINF_EM_RAW_INTERRUPT_PENDING;
283	}
284	else if ( rc == VERR_APIC_INTR_MASKED_BY_TPR /* Can happen if TPR is too high for the newly arrived interrupt. */
285	\|\| rc == VERR_NO_DATA) /* Can happen if the APIC is disabled. */
286	{
287	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
288	rc = VINF_SUCCESS;
289	}
290	else
291	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed. rc=%Rrc\n", rc));
292	}
293	/*
294	* Try sync CR3?
295	*/
296	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
297	{
298	#if 1
299	PGMRZDynMapReleaseAutoSet(pVCpu);
300	PGMRZDynMapStartAutoSet(pVCpu);
301	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
302	#else
303	rc = VINF_PGM_SYNC_CR3;
304	#endif
305	}
306	}
307
308	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
309	PGMRZDynMapReleaseAutoSet(pVCpu);
310	return rc;
311	}
312
313
314	/**
315	* \#DB (Debug event) handler.
316	*
317	* @returns VBox status code.
318	* VINF_SUCCESS means we completely handled this trap,
319	* other codes are passed execution to host context.
320	*
321	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
322	* @param pRegFrame Pointer to the register frame for the trap.
323	* @internal
324	*/
325	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
326	{
327	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
328	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
329	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
330	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
331	TRPM_ENTER_DBG_HOOK(1);
332
333	/*
334	* We currently don't make use of the X86_DR7_GD bit, but
335	* there might come a time when we do.
336	*/
337	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
338	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
339	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
340	VERR_NOT_IMPLEMENTED);
341	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
342
343	/*
344	* Now leave the rest to the DBGF.
345	*/
346	PGMRZDynMapStartAutoSet(pVCpu);
347	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
348	if (rc == VINF_EM_RAW_GUEST_TRAP)
349	{
350	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
351	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
352	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
353	}
354	else if (rc == VINF_EM_DBG_STEPPED)
355	pRegFrame->eflags.Bits.u1TF = 0;
356
357	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
358	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
359	TRPM_EXIT_DBG_HOOK(1);
360	return rc;
361	}
362
363
364	/**
365	* \#DB (Debug event) handler for the hypervisor code.
366	*
367	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
368	* mapping set as well as the default trap exit path since they are both really
369	* bad ideas in this context.
370	*
371	* @returns VBox status code.
372	* VINF_SUCCESS means we completely handled this trap,
373	* other codes are passed execution to host context.
374	*
375	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
376	* @param pRegFrame Pointer to the register frame for the trap.
377	* @internal
378	*/
379	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
380	{
381	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
382	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
383	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
384	TRPM_ENTER_DBG_HOOK_HYPER(1);
385	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
386
387	/*
388	* We currently don't make use of the X86_DR7_GD bit, but
389	* there might come a time when we do.
390	*/
391	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
392	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
393	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
394	VERR_NOT_IMPLEMENTED);
395	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
396
397	/*
398	* Now leave the rest to the DBGF.
399	*/
400	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
401	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
402	if (rc == VINF_EM_DBG_STEPPED)
403	pRegFrame->eflags.Bits.u1TF = 0;
404
405	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
406	TRPM_EXIT_DBG_HOOK_HYPER(1);
407	return rc;
408	}
409
410
411	/**
412	* NMI handler, for when we are using NMIs to debug things.
413	*
414	* @returns VBox status code.
415	* VINF_SUCCESS means we completely handled this trap,
416	* other codes are passed execution to host context.
417	*
418	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
419	* @param pRegFrame Pointer to the register frame for the trap.
420	* @internal
421	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
422	*/
423	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
424	{
425	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
426	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
427	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
428	#endif
429	NOREF(pTrpmCpu);
430	return VERR_TRPM_DONT_PANIC;
431	}
432
433
434	/**
435	* NMI handler, for when we are using NMIs to debug things.
436	*
437	* This is the handler we're most likely to hit when the NMI fires (it is
438	* unlikely that we'll be stuck in guest code).
439	*
440	* @returns VBox status code.
441	* VINF_SUCCESS means we completely handled this trap,
442	* other codes are passed execution to host context.
443	*
444	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
445	* @param pRegFrame Pointer to the register frame for the trap.
446	* @internal
447	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
448	*/
449	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
450	{
451	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
452	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
453	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
454	#endif
455	NOREF(pTrpmCpu);
456	return VERR_TRPM_DONT_PANIC;
457	}
458
459
460	/**
461	* \#BP (Breakpoint) handler.
462	*
463	* @returns VBox status code.
464	* VINF_SUCCESS means we completely handled this trap,
465	* other codes are passed execution to host context.
466	*
467	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
468	* @param pRegFrame Pointer to the register frame for the trap.
469	* @internal
470	*/
471	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
472	{
473	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
474	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
475	int rc;
476	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
477	TRPM_ENTER_DBG_HOOK(3);
478	PGMRZDynMapStartAutoSet(pVCpu);
479
480	/*
481	* PATM is using INT3s, let them have a go first.
482	*/
483	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
484	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
485	&& !pRegFrame->eflags.Bits.u1VM)
486	{
487	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
488	if ( rc == VINF_SUCCESS
489	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
490	\|\| rc == VINF_PATM_PATCH_INT3
491	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
492	{
493	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
494	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
495	TRPM_EXIT_DBG_HOOK(3);
496	return rc;
497	}
498	}
499	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
500
501	/* anything we should do with this? Schedule it in GC? */
502	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
503	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
504	TRPM_EXIT_DBG_HOOK(3);
505	return rc;
506	}
507
508
509	/**
510	* \#BP (Breakpoint) handler.
511	*
512	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
513	* harmful to us (common trap exit and the auto mapping set).
514	*
515	* @returns VBox status code.
516	* VINF_SUCCESS means we completely handled this trap,
517	* other codes are passed execution to host context.
518	*
519	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
520	* @param pRegFrame Pointer to the register frame for the trap.
521	* @internal
522	*/
523	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
524	{
525	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
526	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
527	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
528	TRPM_ENTER_DBG_HOOK_HYPER(3);
529
530	/*
531	* Hand it over to DBGF.
532	*/
533	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
534	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
535
536	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
537	TRPM_EXIT_DBG_HOOK_HYPER(3);
538	return rc;
539	}
540
541
542	/**
543	* Trap handler for illegal opcode fault (\#UD).
544	*
545	* @returns VBox status code.
546	* VINF_SUCCESS means we completely handled this trap,
547	* other codes are passed execution to host context.
548	*
549	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
550	* @param pRegFrame Pointer to the register frame for the trap.
551	* @internal
552	*/
553	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
554	{
555	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
556	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
557	int rc;
558	LogFlow(("TRPMGC06: %04x:%08x EFL=%#x/%#x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
559	TRPM_ENTER_DBG_HOOK(6);
560	PGMRZDynMapStartAutoSet(pVCpu);
561
562	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
563	{
564	/*
565	* Decode the instruction.
566	*/
567	RTGCPTR PC;
568	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
569	pRegFrame->rip, &PC);
570	if (RT_FAILURE(rc))
571	{
572	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
573	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
574	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
575	TRPM_EXIT_DBG_HOOK(6);
576	return rc;
577	}
578
579	DISCPUSTATE Cpu;
580	uint32_t cbOp;
581	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
582	if (RT_FAILURE(rc))
583	{
584	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
585	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
586	TRPM_EXIT_DBG_HOOK(6);
587	return rc;
588	}
589
590	/*
591	* UD2 in a patch?
592	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
593	*/
594	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
595	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
596	{
597	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
598	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
599	/** @todo These tests are completely unnecessary, should just follow the
600	* flow and return at the end of the function. */
601	if ( rc == VINF_SUCCESS
602	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
603	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
604	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
605	\|\| rc == VINF_EM_RESCHEDULE)
606	{
607	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
608	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
609	TRPM_EXIT_DBG_HOOK(6);
610	return rc;
611	}
612	}
613	/*
614	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
615	*/
616	else if (Cpu.fPrefix & DISPREFIX_LOCK)
617	{
618	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
619	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
620	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
621	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
622	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
623	#else
624	rc = VINF_EM_RAW_EMULATE_INSTR;
625	#endif
626	}
627	/*
628	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
629	*/
630	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
631	{
632	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
633	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
634	}
635	else if (GIMShouldTrapXcptUD(pVCpu))
636	{
637	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
638	rc = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu);
639	if (RT_FAILURE(rc))
640	{
641	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD -> VINF_EM_RAW_EMULATE_INSTR\n"));
642	rc = VINF_EM_RAW_EMULATE_INSTR;
643	}
644	}
645	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
646	else
647	{
648	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
649	rc = VINF_EM_RAW_EMULATE_INSTR;
650	}
651	}
652	else
653	{
654	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
655	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
656	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
657	}
658
659	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
660	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
661	TRPM_EXIT_DBG_HOOK(6);
662	return rc;
663	}
664
665
666	/**
667	* Trap handler for device not present fault (\#NM).
668	*
669	* Device not available, FP or (F)WAIT instruction.
670	*
671	* @returns VBox status code.
672	* VINF_SUCCESS means we completely handled this trap,
673	* other codes are passed execution to host context.
674	*
675	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
676	* @param pRegFrame Pointer to the register frame for the trap.
677	* @internal
678	*/
679	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
680	{
681	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
682	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
683	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
684	TRPM_ENTER_DBG_HOOK(7);
685	PGMRZDynMapStartAutoSet(pVCpu);
686
687	int rc = CPUMHandleLazyFPU(pVCpu);
688	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
689	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
690	TRPM_EXIT_DBG_HOOK(7);
691	return rc;
692	}
693
694
695	/**
696	* \#NP ((segment) Not Present) handler.
697	*
698	* @returns VBox status code.
699	* VINF_SUCCESS means we completely handled this trap,
700	* other codes are passed execution to host context.
701	*
702	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
703	* @param pRegFrame Pointer to the register frame for the trap.
704	* @internal
705	*/
706	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
707	{
708	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
709	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
710	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
711	TRPM_ENTER_DBG_HOOK(0xb);
712	PGMRZDynMapStartAutoSet(pVCpu);
713
714	/*
715	* Try to detect instruction by opcode which caused trap.
716	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
717	* accessing user code. need to handle it somehow in future!
718	*/
719	RTGCPTR GCPtr;
720	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
721	(RTGCPTR)pRegFrame->eip, &GCPtr)
722	== VINF_SUCCESS)
723	{
724	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
725
726	/*
727	* First skip possible instruction prefixes, such as:
728	* OS, AS
729	* CS:, DS:, ES:, SS:, FS:, GS:
730	* REPE, REPNE
731	*
732	* note: Currently we supports only up to 4 prefixes per opcode, more
733	* prefixes (normally not used anyway) will cause trap d in guest.
734	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
735	* check this issue, its too hard.
736	*/
737	for (unsigned i = 0; i < 4; i++)
738	{
739	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
740	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
741	&& pu8Code[0] != 0x2e /* CS: */
742	&& pu8Code[0] != 0x36 /* SS: */
743	&& pu8Code[0] != 0x3e /* DS: */
744	&& pu8Code[0] != 0x26 /* ES: */
745	&& pu8Code[0] != 0x64 /* FS: */
746	&& pu8Code[0] != 0x65 /* GS: */
747	&& pu8Code[0] != 0x66 /* OS */
748	&& pu8Code[0] != 0x67 /* AS */
749	)
750	break;
751	pu8Code++;
752	}
753
754	/*
755	* Detect right switch using a callgate.
756	*
757	* We recognize the following causes for the trap 0b:
758	* CALL FAR, CALL FAR []
759	* JMP FAR, JMP FAR []
760	* IRET (may cause a task switch)
761	*
762	* Note: we can't detect whether the trap was caused by a call to a
763	* callgate descriptor or it is a real trap 0b due to a bad selector.
764	* In both situations we'll pass execution to our recompiler so we don't
765	* have to worry.
766	* If we wanted to do better detection, we have set GDT entries to callgate
767	* descriptors pointing to our own handlers.
768	*/
769	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
770	if ( pu8Code[0] == 0x9a /* CALL FAR */
771	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
772	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
773	\|\| pu8Code[0] == 0xea /* JMP FAR */
774	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
775	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
776	\|\| pu8Code[0] == 0xcf /* IRET */
777	)
778	{
779	/*
780	* Got potential call to callgate.
781	* We simply return execution to the recompiler to do emulation
782	* starting from the instruction which caused the trap.
783	*/
784	pTrpmCpu->uActiveVector = UINT32_MAX;
785	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
786	TRPM_EXIT_DBG_HOOK(0xb);
787	PGMRZDynMapReleaseAutoSet(pVCpu);
788	return VINF_EM_RAW_RING_SWITCH;
789	}
790	}
791
792	/*
793	* Pass trap 0b as is to the recompiler in all other cases.
794	*/
795	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
796	PGMRZDynMapReleaseAutoSet(pVCpu);
797	TRPM_EXIT_DBG_HOOK(0xb);
798	return VINF_EM_RAW_GUEST_TRAP;
799	}
800
801
802	/**
803	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
804	*
805	* @returns VBox status code.
806	* VINF_SUCCESS means we completely handled this trap,
807	* other codes are passed execution to host context.
808	*
809	* @param pVM The cross context VM structure.
810	* @param pVCpu The cross context virtual CPU structure.
811	* @param pRegFrame Pointer to the register frame for the trap.
812	* @param pCpu The opcode info.
813	* @param PC The program counter corresponding to cs:eip in pRegFrame.
814	*/
815	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
816	{
817	int rc;
818	TRPM_ENTER_DBG_HOOK(0xd);
819
820	/*
821	* Try handle it here, if not return to HC and emulate/interpret it there.
822	*/
823	switch (pCpu->pCurInstr->uOpcode)
824	{
825	case OP_INT3:
826	/*
827	* Little hack to make the code below not fail
828	*/
829	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
830	pCpu->Param1.uValue = 3;
831	/* fallthru */
832	case OP_INT:
833	{
834	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
835	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
836	if (pCpu->Param1.uValue == 3)
837	{
838	/* Int 3 replacement patch? */
839	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
840	{
841	AssertFailed();
842	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
843	}
844	}
845	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
846	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
847	{
848	TRPM_EXIT_DBG_HOOK(0xd);
849	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
850	}
851
852	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
853	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
854	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
855	}
856
857	#ifdef PATM_EMULATE_SYSENTER
858	case OP_SYSEXIT:
859	case OP_SYSRET:
860	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
861	TRPM_EXIT_DBG_HOOK(0xd);
862	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
863	#endif
864
865	case OP_HLT:
866	/* If it's in patch code, defer to ring-3. */
867	if (PATMIsPatchGCAddr(pVM, PC))
868	break;
869
870	pRegFrame->eip += pCpu->cbInstr;
871	TRPM_EXIT_DBG_HOOK(0xd);
872	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
873
874
875	/*
876	* These instructions are used by PATM and CASM for finding
877	* dangerous non-trapping instructions. Thus, since all
878	* scanning and patching is done in ring-3 we'll have to
879	* return to ring-3 on the first encounter of these instructions.
880	*/
881	case OP_MOV_CR:
882	case OP_MOV_DR:
883	/* We can safely emulate control/debug register move instructions in patched code. */
884	if ( !PATMIsPatchGCAddr(pVM, PC)
885	&& !CSAMIsKnownDangerousInstr(pVM, PC))
886	break;
887	case OP_INVLPG:
888	case OP_LLDT:
889	case OP_STI:
890	case OP_RDTSC: /* just in case */
891	case OP_RDPMC:
892	case OP_CLTS:
893	case OP_WBINVD: /* nop */
894	case OP_RDMSR:
895	case OP_WRMSR:
896	{
897	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
898	if (rc == VERR_EM_INTERPRETER)
899	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
900	TRPM_EXIT_DBG_HOOK(0xd);
901	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
902	}
903	}
904
905	TRPM_EXIT_DBG_HOOK(0xd);
906	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
907	}
908
909
910	/**
911	* \#GP (General Protection Fault) handler for Ring-3.
912	*
913	* @returns VBox status code.
914	* VINF_SUCCESS means we completely handled this trap,
915	* other codes are passed execution to host context.
916	*
917	* @param pVM The cross context VM structure.
918	* @param pVCpu The cross context virtual CPU structure.
919	* @param pRegFrame Pointer to the register frame for the trap.
920	* @param pCpu The opcode info.
921	* @param PC The program counter corresponding to cs:eip in pRegFrame.
922	*/
923	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
924	{
925	int rc;
926	Assert(!pRegFrame->eflags.Bits.u1VM);
927	TRPM_ENTER_DBG_HOOK(0xd);
928
929	switch (pCpu->pCurInstr->uOpcode)
930	{
931	/*
932	* INT3 and INT xx are ring-switching.
933	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
934	*/
935	case OP_INT3:
936	/*
937	* Little hack to make the code below not fail
938	*/
939	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
940	pCpu->Param1.uValue = 3;
941	/* fall thru */
942	case OP_INT:
943	{
944	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
945	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
946	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
947	{
948	TRPM_EXIT_DBG_HOOK(0xd);
949	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
950	}
951
952	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
953	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
954	TRPM_EXIT_DBG_HOOK(0xd);
955	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
956	}
957
958	/*
959	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
960	*/
961	case OP_SYSCALL:
962	case OP_SYSENTER:
963	#ifdef PATM_EMULATE_SYSENTER
964	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
965	if (rc == VINF_SUCCESS)
966	{
967	TRPM_EXIT_DBG_HOOK(0xd);
968	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
969	}
970	/* else no break; */
971	#endif
972	case OP_BOUND:
973	case OP_INTO:
974	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
975	TRPM_EXIT_DBG_HOOK(0xd);
976	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
977
978	/*
979	* Handle virtualized TSC & PMC reads, just in case.
980	*/
981	case OP_RDTSC:
982	case OP_RDPMC:
983	{
984	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
985	if (rc == VERR_EM_INTERPRETER)
986	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
987	TRPM_EXIT_DBG_HOOK(0xd);
988	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
989	}
990
991	/*
992	* STI and CLI are I/O privileged, i.e. if IOPL
993	*/
994	case OP_STI:
995	case OP_CLI:
996	{
997	uint32_t efl = CPUMRawGetEFlags(pVCpu);
998	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
999	if (X86_EFL_GET_IOPL(efl) >= cpl)
1000	{
1001	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
1002	TRPM_EXIT_DBG_HOOK(0xd);
1003	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
1004	}
1005	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
1006	break;
1007	}
1008	}
1009
1010	/*
1011	* A genuine guest fault.
1012	*/
1013	TRPM_EXIT_DBG_HOOK(0xd);
1014	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
1015	}
1016
1017
1018	/**
1019	* Emulates RDTSC for the \#GP handler.
1020	*
1021	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
1022	*
1023	* @param pVM The cross context VM structure.
1024	* @param pVCpu The cross context virtual CPU structure.
1025	* @param pRegFrame Pointer to the register frame for the trap.
1026	* This will be updated on successful return.
1027	*/
1028	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1029	{
1030	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1031	TRPM_ENTER_DBG_HOOK(0xd);
1032
1033	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1034	{
1035	TRPM_EXIT_DBG_HOOK(0xd);
1036	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1037	}
1038
1039	uint64_t uTicks = TMCpuTickGet(pVCpu);
1040	pRegFrame->eax = uTicks;
1041	pRegFrame->edx = uTicks >> 32;
1042	pRegFrame->eip += 2;
1043	TRPM_EXIT_DBG_HOOK(0xd);
1044	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1045	}
1046
1047
1048	/**
1049	* \#GP (General Protection Fault) handler.
1050	*
1051	* @returns VBox status code.
1052	* VINF_SUCCESS means we completely handled this trap,
1053	* other codes are passed execution to host context.
1054	*
1055	* @param pVM The cross context VM structure.
1056	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1057	* @param pRegFrame Pointer to the register frame for the trap.
1058	*/
1059	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1060	{
1061	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1062	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1063	TRPM_ENTER_DBG_HOOK(0xd);
1064
1065	/*
1066	* Convert and validate CS.
1067	*/
1068	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1069	RTGCPTR PC;
1070	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1071	pRegFrame->rip, &PC);
1072	if (RT_FAILURE(rc))
1073	{
1074	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1075	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1076	TRPM_EXIT_DBG_HOOK(0xd);
1077	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1078	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1079	}
1080
1081	/*
1082	* Disassemble the instruction.
1083	*/
1084	DISCPUSTATE Cpu;
1085	uint32_t cbOp;
1086	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1087	if (RT_FAILURE(rc))
1088	{
1089	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1090	TRPM_EXIT_DBG_HOOK(0xd);
1091	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1092	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1093	}
1094	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1095
1096	/*
1097	* Optimize RDTSC traps.
1098	* Some guests (like Solaris) are using RDTSC all over the place and
1099	* will end up trapping a lot because of that.
1100	*
1101	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1102	*/
1103	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1104	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1105
1106	/*
1107	* Deal with I/O port access.
1108	*/
1109	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1110	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1111	{
1112	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1113	if (IOM_SUCCESS(rcStrict))
1114	{
1115	pRegFrame->rip += cbOp;
1116
1117	/*
1118	* Check for I/O breakpoints. A bit clumsy, but should be short lived (moved to IEM).
1119	*/
1120	uint32_t const uDr7 = CPUMGetGuestDR7(pVCpu);
1121	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
1122	&& X86_DR7_ANY_RW_IO(uDr7)
1123	&& (CPUMGetGuestCR4(pVCpu) & X86_CR4_DE))
1124	\|\| DBGFBpIsHwIoArmed(pVM)))
1125	{
1126	uint64_t uPort = pRegFrame->dx;
1127	unsigned cbValue;
1128	if ( Cpu.pCurInstr->uOpcode == OP_IN
1129	\|\| Cpu.pCurInstr->uOpcode == OP_INSB
1130	\|\| Cpu.pCurInstr->uOpcode == OP_INSWD)
1131	{
1132	cbValue = DISGetParamSize(&Cpu, &Cpu.Param1);
1133	if (Cpu.Param2.fUse & DISUSE_IMMEDIATE)
1134	uPort = Cpu.Param2.uValue;
1135	}
1136	else
1137	{
1138	cbValue = DISGetParamSize(&Cpu, &Cpu.Param2);
1139	if (Cpu.Param1.fUse & DISUSE_IMMEDIATE)
1140	uPort = Cpu.Param1.uValue;
1141	}
1142
1143	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, CPUMCTX_FROM_CORE(pRegFrame), uPort, cbValue);
1144	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
1145	{
1146	/* Raise #DB. */
1147	TRPMResetTrap(pVCpu);
1148	TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
1149	if (rcStrict != VINF_SUCCESS)
1150	LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
1151	rcStrict = VINF_EM_RAW_GUEST_TRAP;
1152	}
1153	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
1154	else if ( rcStrict2 != VINF_SUCCESS
1155	&& (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
1156	rcStrict = rcStrict2;
1157	}
1158	}
1159	rc = VBOXSTRICTRC_TODO(rcStrict);
1160	TRPM_EXIT_DBG_HOOK(0xd);
1161	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1162	}
1163
1164	/*
1165	* Deal with Ring-0 (privileged instructions)
1166	*/
1167	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1168	&& !pRegFrame->eflags.Bits.u1VM)
1169	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1170
1171	/*
1172	* Deal with Ring-3 GPs.
1173	*/
1174	if (!pRegFrame->eflags.Bits.u1VM)
1175	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1176
1177	/*
1178	* Deal with v86 code.
1179	*
1180	* We always set IOPL to zero which makes e.g. pushf fault in V86
1181	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1182	* Simply fall back to the recompiler to emulate this instruction if
1183	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1184	*/
1185	X86EFLAGS eflags;
1186	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1187	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1188	if (eflags.Bits.u2IOPL != 3)
1189	{
1190	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1191
1192	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1193	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1194	TRPM_EXIT_DBG_HOOK(0xd);
1195	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1196	}
1197	TRPM_EXIT_DBG_HOOK(0xd);
1198	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1199	}
1200
1201
1202	/**
1203	* \#GP (General Protection Fault) handler.
1204	*
1205	* @returns VBox status code.
1206	* VINF_SUCCESS means we completely handled this trap,
1207	* other codes are passed execution to host context.
1208	*
1209	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1210	* @param pRegFrame Pointer to the register frame for the trap.
1211	* @internal
1212	*/
1213	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1214	{
1215	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1216	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1217	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1218	TRPM_ENTER_DBG_HOOK(0xd);
1219
1220	PGMRZDynMapStartAutoSet(pVCpu);
1221	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1222	switch (rc)
1223	{
1224	case VINF_EM_RAW_GUEST_TRAP:
1225	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1226	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1227	rc = VINF_PATM_PATCH_TRAP_GP;
1228	break;
1229
1230	case VINF_EM_RAW_INTERRUPT_PENDING:
1231	Assert(TRPMHasTrap(pVCpu));
1232	/* no break; */
1233	case VINF_PGM_SYNC_CR3:
1234	case VINF_EM_RAW_EMULATE_INSTR:
1235	case VINF_IOM_R3_IOPORT_READ:
1236	case VINF_IOM_R3_IOPORT_WRITE:
1237	case VINF_IOM_R3_MMIO_WRITE:
1238	case VINF_IOM_R3_MMIO_READ:
1239	case VINF_IOM_R3_MMIO_READ_WRITE:
1240	case VINF_CPUM_R3_MSR_READ:
1241	case VINF_CPUM_R3_MSR_WRITE:
1242	case VINF_PATM_PATCH_INT3:
1243	case VINF_EM_NO_MEMORY:
1244	case VINF_EM_RAW_TO_R3:
1245	case VINF_EM_RAW_TIMER_PENDING:
1246	case VINF_EM_PENDING_REQUEST:
1247	case VINF_EM_HALT:
1248	case VINF_SELM_SYNC_GDT:
1249	case VINF_SUCCESS:
1250	break;
1251
1252	default:
1253	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1254	break;
1255	}
1256	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1257	TRPM_EXIT_DBG_HOOK(0xd);
1258	return rc;
1259	}
1260
1261
1262	/**
1263	* \#PF (Page Fault) handler.
1264	*
1265	* Calls PGM which does the actual handling.
1266	*
1267	*
1268	* @returns VBox status code.
1269	* VINF_SUCCESS means we completely handled this trap,
1270	* other codes are passed execution to host context.
1271	*
1272	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1273	* @param pRegFrame Pointer to the register frame for the trap.
1274	* @internal
1275	*/
1276	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1277	{
1278	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1279	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1280	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1281	TRPM_ENTER_DBG_HOOK(0xe);
1282
1283	/*
1284	* This is all PGM stuff.
1285	*/
1286	PGMRZDynMapStartAutoSet(pVCpu);
1287	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1288	switch (rc)
1289	{
1290	case VINF_EM_RAW_EMULATE_INSTR:
1291	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1292	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1293	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1294	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1295	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1296	rc = VINF_PATCH_EMULATE_INSTR;
1297	break;
1298
1299	case VINF_EM_RAW_GUEST_TRAP:
1300	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1301	{
1302	PGMRZDynMapReleaseAutoSet(pVCpu);
1303	TRPM_EXIT_DBG_HOOK(0xe);
1304	return VINF_PATM_PATCH_TRAP_PF;
1305	}
1306
1307	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1308	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1309	break;
1310
1311	case VINF_EM_RAW_INTERRUPT_PENDING:
1312	Assert(TRPMHasTrap(pVCpu));
1313	/* no break; */
1314	case VINF_IOM_R3_MMIO_READ:
1315	case VINF_IOM_R3_MMIO_WRITE:
1316	case VINF_IOM_R3_MMIO_READ_WRITE:
1317	case VINF_PATM_HC_MMIO_PATCH_READ:
1318	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1319	case VINF_SUCCESS:
1320	case VINF_EM_RAW_TO_R3:
1321	case VINF_EM_PENDING_REQUEST:
1322	case VINF_EM_RAW_TIMER_PENDING:
1323	case VINF_EM_NO_MEMORY:
1324	case VINF_CSAM_PENDING_ACTION:
1325	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1326	break;
1327
1328	default:
1329	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1330	break;
1331	}
1332	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1333	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1334	TRPM_EXIT_DBG_HOOK(0xe);
1335	return rc;
1336	}
1337
1338
1339	/**
1340	* Scans for the EIP in the specified array of trap handlers.
1341	*
1342	* If we don't fine the EIP, we'll panic.
1343	*
1344	* @returns VBox status code.
1345	*
1346	* @param pVM The cross context VM structure.
1347	* @param pRegFrame Pointer to the register frame for the trap.
1348	* @param paHandlers The array of trap handler records.
1349	* @param pEndRecord The end record (exclusive).
1350	*/
1351	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1352	{
1353	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1354	Assert(paHandlers <= pEndRecord);
1355
1356	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1357
1358	#if 0 /// @todo later
1359	/*
1360	* Start by doing a kind of binary search.
1361	*/
1362	unsigned iStart = 0;
1363	unsigned iEnd = pEndRecord - paHandlers;
1364	unsigned i = iEnd / 2;
1365	#endif
1366
1367	/*
1368	* Do a linear search now (in case the array wasn't properly sorted).
1369	*/
1370	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1371	{
1372	if ( pCur->uStartEIP <= uEip
1373	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1374	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1375	}
1376
1377	return VERR_TRPM_DONT_PANIC;
1378	}
1379
1380
1381	/**
1382	* Hypervisor \#NP ((segment) Not Present) handler.
1383	*
1384	* Scans for the EIP in the registered trap handlers.
1385	*
1386	* @returns VBox status code.
1387	* VINF_SUCCESS means we completely handled this trap,
1388	* other codes are passed back to host context.
1389	*
1390	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1391	* @param pRegFrame Pointer to the register frame for the trap.
1392	* @internal
1393	*/
1394	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1395	{
1396	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1397	}
1398
1399
1400	/**
1401	* Hypervisor \#GP (General Protection Fault) handler.
1402	*
1403	* Scans for the EIP in the registered trap handlers.
1404	*
1405	* @returns VBox status code.
1406	* VINF_SUCCESS means we completely handled this trap,
1407	* other codes are passed back to host context.
1408	*
1409	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1410	* @param pRegFrame Pointer to the register frame for the trap.
1411	* @internal
1412	*/
1413	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1414	{
1415	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1416	}
1417
1418
1419	/**
1420	* Hypervisor \#PF (Page Fault) handler.
1421	*
1422	* Scans for the EIP in the registered trap handlers.
1423	*
1424	* @returns VBox status code.
1425	* VINF_SUCCESS means we completely handled this trap,
1426	* other codes are passed back to host context.
1427	*
1428	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1429	* @param pRegFrame Pointer to the register frame for the trap.
1430	* @internal
1431	*/
1432	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1433	{
1434	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1435	}
1436
1437
1438	/**
1439	* Deal with hypervisor traps occurring when resuming execution on a trap.
1440	*
1441	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1442	* this by not allowing recursion without it being the subject of a guru
1443	* meditation. (We used to / tried to handle this but there isn't any reason
1444	* for it.)
1445	*
1446	* So, do NOT use this for handling RC traps!
1447	*
1448	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1449	* @param pVM The cross context VM structure.
1450	* @param pRegFrame Register frame.
1451	* @param uUser User arg.
1452	*/
1453	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1454	{
1455	Log(("********************************************************\n"));
1456	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1457	Log(("********************************************************\n"));
1458
1459	/*
1460	* This used to be kind of complicated, but since we stopped storing
1461	* the register frame on the stack and instead storing it directly
1462	* in the CPUMCPU::Guest structure, we just have to figure out which
1463	* status to hand on to the host and let the recompiler/IEM do its
1464	* job.
1465	*/
1466	switch (uUser)
1467	{
1468	case TRPM_TRAP_IN_MOV_GS:
1469	case TRPM_TRAP_IN_MOV_FS:
1470	case TRPM_TRAP_IN_MOV_ES:
1471	case TRPM_TRAP_IN_MOV_DS:
1472	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1473	break;
1474
1475	case TRPM_TRAP_IN_IRET:
1476	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1477	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1478	break;
1479
1480	default:
1481	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1482	return VERR_TRPM_BAD_TRAP_IN_OP;
1483	}
1484
1485	AssertMsgFailed(("Impossible!\n"));
1486	return VERR_TRPM_IPE_3;
1487	}
1488
1489
1490	/**
1491	* Generic hyper trap handler that sets the EIP to @a uUser.
1492	*
1493	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1494	* @param pVM The cross context VM structure.
1495	* @param pRegFrame Pointer to the register frame (within VM)
1496	* @param uUser The user arg, which should be the new EIP address.
1497	*/
1498	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1499	{
1500	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1501	pRegFrame->eip = uUser;
1502	return VINF_SUCCESS;
1503	}
1504

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 60740

Download in other formats: