TRPMRCHandlers.cpp@ 72564

Last change on this file since 72564 was 72564, checked in by vboxsync, 7 years ago
EM,TRPM,IOM: Improved the raw-mode exit history a little (just for the heck of it). bugref:9044
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 61.8 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 72564 2018-06-15 12:56:01Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#include <VBox/vmm/apic.h>
31	#include <VBox/vmm/csam.h>
32	#include <VBox/vmm/patm.h>
33	#include <VBox/vmm/mm.h>
34	#include <VBox/vmm/cpum.h>
35	#include "TRPMInternal.h"
36	#include <VBox/vmm/vm.h>
37	#include <VBox/vmm/vmm.h>
38	#include <VBox/param.h>
39
40	#include <VBox/err.h>
41	#include <VBox/dis.h>
42	#include <VBox/disopcode.h>
43	#include <VBox/log.h>
44	#include <VBox/vmm/tm.h>
45	#include <iprt/asm.h>
46	#include <iprt/asm-amd64-x86.h>
47	#include <iprt/assert.h>
48	#include <iprt/x86.h>
49
50
51	/*********************************************************************************************************************************
52	* Defined Constants And Macros *
53	*********************************************************************************************************************************/
54	/* still here. MODR/M byte parsing */
55	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
56	#define X86_OPCODE_MODRM_REG_MASK 0x38
57	#define X86_OPCODE_MODRM_RM_MASK 0x07
58
59	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
60	#define DTRACE_EXPERIMENT
61
62	#if 1
63	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
64	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
65	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
66	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
67	#else
68	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
69	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
70	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
71	else do {} while (0)
72	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
73	do { \
74	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
75	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
76	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
77	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
78	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
79	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
80	} while (0)
81	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
82	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
83	#endif
84
85
86	/*********************************************************************************************************************************
87	* Structures and Typedefs *
88	*********************************************************************************************************************************/
89	/** Pointer to a readonly hypervisor trap record. */
90	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
91
92	/**
93	* A hypervisor trap record.
94	* This contains information about a handler for a instruction range.
95	*
96	* @remark This must match what TRPM_HANDLER outputs.
97	*/
98	typedef struct TRPMGCHYPER
99	{
100	/** The start address. */
101	uintptr_t uStartEIP;
102	/** The end address. (exclusive)
103	* If NULL the it's only for the instruction at pvStartEIP. */
104	uintptr_t uEndEIP;
105	/**
106	* The handler.
107	*
108	* @returns VBox status code
109	* VINF_SUCCESS means we've handled the trap.
110	* Any other error code means returning to the host context.
111	* @param pVM The cross context VM structure.
112	* @param pRegFrame The register frame.
113	* @param uUser The user argument.
114	*/
115	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
116	/** Whatever the handler desires to put here. */
117	uintptr_t uUser;
118	} TRPMGCHYPER;
119
120
121	/*********************************************************************************************************************************
122	* Global Variables *
123	*********************************************************************************************************************************/
124	RT_C_DECLS_BEGIN
125	/** Defined in VMMRC0.asm or VMMRC99.asm.
126	* @{ */
127	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
128	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
129	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
130	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
131	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
132	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
133	/** @} */
134	RT_C_DECLS_END
135
136
137	/*********************************************************************************************************************************
138	* Internal Functions *
139	*********************************************************************************************************************************/
140	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
141	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
142	RT_C_DECLS_END
143
144
145
146	/**
147	* Exits the trap, called when exiting a trap handler.
148	*
149	* Will reset the trap if it's not a guest trap or the trap
150	* is already handled. Will process resume guest FFs.
151	*
152	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
153	* happened.
154	* @param pVM The cross context VM structure.
155	* @param pVCpu The cross context virtual CPU structure.
156	* @param rc The VBox status code to return.
157	* @param pRegFrame Pointer to the register frame for the trap.
158	*
159	* @remarks This must not be used for hypervisor traps, only guest traps.
160	*/
161	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
162	{
163	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
164	NOREF(uOldActiveVector);
165
166	/* Reset trap? */
167	if ( rc != VINF_EM_RAW_GUEST_TRAP
168	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
169	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
170
171	#ifdef VBOX_HIGH_RES_TIMERS_HACK
172	/*
173	* We should poll the timers occasionally.
174	* We must NOT do this too frequently as it adds a significant overhead
175	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
176	* (The heuristic is not very intelligent, we should really check trap
177	* frequency etc. here, but alas, we lack any such information atm.)
178	*/
179	static unsigned s_iTimerPoll = 0;
180	if (rc == VINF_SUCCESS)
181	{
182	if (!(++s_iTimerPoll & 0xf))
183	{
184	TMTimerPollVoid(pVM, pVCpu);
185	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
186	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
187	}
188	}
189	else
190	s_iTimerPoll = 0;
191	#endif
192
193	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
194	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
195	{
196	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
197	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
198	{
199	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
200	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
201	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
202	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
203	*/
204	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
205	}
206	}
207
208	/*
209	* Pending resume-guest-FF?
210	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
211	*/
212	if ( rc == VINF_SUCCESS
213	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
214	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3
215	\| VMCPU_FF_UPDATE_APIC \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
216	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
217	\| VMCPU_FF_PDM_CRITSECT \| VMCPU_FF_IEM \| VMCPU_FF_SELM_SYNC_GDT
218	\| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
219	\| VMCPU_FF_IOM \| VMCPU_FF_CPUM
220	)
221	)
222	)
223	{
224	/* The out of memory condition naturally outranks the others. */
225	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
226	rc = VINF_EM_NO_MEMORY;
227	else
228	{
229	/* APIC needs updating. */
230	if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_UPDATE_APIC))
231	APICUpdatePendingInterrupts(pVCpu);
232
233	if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_CPUM))
234	CPUMRCProcessForceFlag(pVCpu);
235
236	/* Pending Ring-3 action. */
237	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT \| VMCPU_FF_IEM \| VMCPU_FF_IOM))
238	{
239	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
240	rc = VINF_EM_RAW_TO_R3;
241	}
242	/* Pending timer action. */
243	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
244	rc = VINF_EM_RAW_TIMER_PENDING;
245	/* The Virtual Sync clock has stopped. */
246	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
247	rc = VINF_EM_RAW_TO_R3;
248	/* DMA work pending? */
249	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
250	rc = VINF_EM_RAW_TO_R3;
251	/* Pending request packets might contain actions that need immediate
252	attention, such as pending hardware interrupts. */
253	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
254	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
255	rc = VINF_EM_PENDING_REQUEST;
256	/* Pending GDT/LDT/TSS sync. */
257	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
258	rc = VINF_SELM_SYNC_GDT;
259	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
260	rc = VINF_EM_RAW_TO_R3;
261	/* Possibly pending interrupt: dispatch it. */
262	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
263	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
264	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
265	)
266	{
267	uint8_t u8Interrupt;
268	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
269	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
270	if (RT_SUCCESS(rc))
271	{
272	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
273	/* can't return if successful */
274	Assert(rc != VINF_SUCCESS);
275
276	/* Stop the profile counter that was started in TRPMRCHandlersA.asm */
277	Assert(uOldActiveVector <= 16);
278	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
279
280	/* Assert the trap and go to the recompiler to dispatch it. */
281	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
282
283	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
284	rc = VINF_EM_RAW_INTERRUPT_PENDING;
285	}
286	else if ( rc == VERR_APIC_INTR_MASKED_BY_TPR /* Can happen if TPR is too high for the newly arrived interrupt. */
287	\|\| rc == VERR_NO_DATA) /* Can happen if the APIC is disabled. */
288	{
289	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
290	rc = VINF_SUCCESS;
291	}
292	else
293	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed. rc=%Rrc\n", rc));
294	}
295	/*
296	* Try sync CR3?
297	*/
298	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
299	{
300	#if 1
301	PGMRZDynMapReleaseAutoSet(pVCpu);
302	PGMRZDynMapStartAutoSet(pVCpu);
303	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
304	#else
305	rc = VINF_PGM_SYNC_CR3;
306	#endif
307	}
308	}
309	}
310
311	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
312	PGMRZDynMapReleaseAutoSet(pVCpu);
313	return rc;
314	}
315
316
317	/**
318	* \#DB (Debug event) handler.
319	*
320	* @returns VBox status code.
321	* VINF_SUCCESS means we completely handled this trap,
322	* other codes are passed execution to host context.
323	*
324	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
325	* @param pRegFrame Pointer to the register frame for the trap.
326	* @internal
327	*/
328	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
329	{
330	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
331	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
332	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
333	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
334	TRPM_ENTER_DBG_HOOK(1);
335	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_DB), pRegFrame->cs.Sel, pRegFrame->eip);
336
337	/*
338	* We currently don't make use of the X86_DR7_GD bit, but
339	* there might come a time when we do.
340	*/
341	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
342	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
343	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
344	VERR_NOT_IMPLEMENTED);
345	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
346
347	/*
348	* Now leave the rest to the DBGF.
349	*/
350	PGMRZDynMapStartAutoSet(pVCpu);
351	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
352	if (rc == VINF_EM_RAW_GUEST_TRAP)
353	{
354	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
355	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
356	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
357	}
358	else if (rc == VINF_EM_DBG_STEPPED)
359	pRegFrame->eflags.Bits.u1TF = 0;
360
361	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
362	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
363	TRPM_EXIT_DBG_HOOK(1);
364	return rc;
365	}
366
367
368	/**
369	* \#DB (Debug event) handler for the hypervisor code.
370	*
371	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
372	* mapping set as well as the default trap exit path since they are both really
373	* bad ideas in this context.
374	*
375	* @returns VBox status code.
376	* VINF_SUCCESS means we completely handled this trap,
377	* other codes are passed execution to host context.
378	*
379	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
380	* @param pRegFrame Pointer to the register frame for the trap.
381	* @internal
382	*/
383	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
384	{
385	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
386	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
387	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
388	TRPM_ENTER_DBG_HOOK_HYPER(1);
389	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_DB), pRegFrame->cs.Sel, pRegFrame->eip);
390	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
391
392	/*
393	* We currently don't make use of the X86_DR7_GD bit, but
394	* there might come a time when we do.
395	*/
396	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
397	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
398	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
399	VERR_NOT_IMPLEMENTED);
400	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
401
402	/*
403	* Now leave the rest to the DBGF.
404	*/
405	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
406	if (rc == VINF_EM_DBG_STEPPED)
407	pRegFrame->eflags.Bits.u1TF = 0;
408
409	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
410	TRPM_EXIT_DBG_HOOK_HYPER(1);
411	return rc;
412	}
413
414
415	/**
416	* NMI handler, for when we are using NMIs to debug things.
417	*
418	* @returns VBox status code.
419	* VINF_SUCCESS means we completely handled this trap,
420	* other codes are passed execution to host context.
421	*
422	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
423	* @param pRegFrame Pointer to the register frame for the trap.
424	* @internal
425	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
426	*/
427	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
428	{
429	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
430	EMRCHistoryAddExitNoTs(TRPMCPU_2_VMCPU(pTrpmCpu), EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_NMI),
431	pRegFrame->cs.Sel, pRegFrame->eip);
432	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
433	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
434	#endif
435	NOREF(pTrpmCpu); RT_NOREF_PV(pRegFrame);
436	return VERR_TRPM_DONT_PANIC;
437	}
438
439
440	/**
441	* NMI handler, for when we are using NMIs to debug things.
442	*
443	* This is the handler we're most likely to hit when the NMI fires (it is
444	* unlikely that we'll be stuck in guest code).
445	*
446	* @returns VBox status code.
447	* VINF_SUCCESS means we completely handled this trap,
448	* other codes are passed execution to host context.
449	*
450	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
451	* @param pRegFrame Pointer to the register frame for the trap.
452	* @internal
453	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
454	*/
455	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
456	{
457	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
458	EMRCHistoryAddExitNoTs(TRPMCPU_2_VMCPU(pTrpmCpu), EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_NMI),
459	pRegFrame->cs.Sel, pRegFrame->eip);
460	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
461	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
462	#endif
463	NOREF(pTrpmCpu); RT_NOREF_PV(pRegFrame);
464	return VERR_TRPM_DONT_PANIC;
465	}
466
467
468	/**
469	* \#BP (Breakpoint) handler.
470	*
471	* @returns VBox status code.
472	* VINF_SUCCESS means we completely handled this trap,
473	* other codes are passed execution to host context.
474	*
475	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
476	* @param pRegFrame Pointer to the register frame for the trap.
477	* @internal
478	*/
479	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
480	{
481	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
482	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
483	int rc;
484	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
485	TRPM_ENTER_DBG_HOOK(3);
486	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_BP), pRegFrame->cs.Sel, pRegFrame->eip);
487	PGMRZDynMapStartAutoSet(pVCpu);
488
489	/*
490	* PATM is using INT3s, let them have a go first.
491	*/
492	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
493	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
494	&& !pRegFrame->eflags.Bits.u1VM)
495	{
496	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
497	if ( rc == VINF_SUCCESS
498	\|\| rc == VINF_EM_RESCHEDULE
499	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
500	\|\| rc == VINF_PATM_PATCH_INT3
501	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION )
502	{
503	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
504	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
505	TRPM_EXIT_DBG_HOOK(3);
506	return rc;
507	}
508	}
509	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
510
511	/* anything we should do with this? Schedule it in GC? */
512	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
513	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
514	TRPM_EXIT_DBG_HOOK(3);
515	return rc;
516	}
517
518
519	/**
520	* \#BP (Breakpoint) handler.
521	*
522	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
523	* harmful to us (common trap exit and the auto mapping set).
524	*
525	* @returns VBox status code.
526	* VINF_SUCCESS means we completely handled this trap,
527	* other codes are passed execution to host context.
528	*
529	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
530	* @param pRegFrame Pointer to the register frame for the trap.
531	* @internal
532	*/
533	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
534	{
535	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
536	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
537	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
538	TRPM_ENTER_DBG_HOOK_HYPER(3);
539	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_BP), pRegFrame->cs.Sel, pRegFrame->eip);
540
541	/*
542	* Hand it over to DBGF.
543	*/
544	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
545	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
546
547	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
548	TRPM_EXIT_DBG_HOOK_HYPER(3);
549	return rc;
550	}
551
552
553	/**
554	* Trap handler for illegal opcode fault (\#UD).
555	*
556	* @returns VBox status code.
557	* VINF_SUCCESS means we completely handled this trap,
558	* other codes are passed execution to host context.
559	*
560	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
561	* @param pRegFrame Pointer to the register frame for the trap.
562	* @internal
563	*/
564	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
565	{
566	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
567	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
568	int rc;
569	LogFlow(("TRPMGC06: %04x:%08x EFL=%#x/%#x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
570	TRPM_ENTER_DBG_HOOK(6);
571	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_UD), pRegFrame->cs.Sel, pRegFrame->eip);
572	PGMRZDynMapStartAutoSet(pVCpu);
573
574	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
575	{
576	/*
577	* Decode the instruction.
578	*/
579	RTGCPTR PC;
580	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
581	pRegFrame->rip, &PC);
582	if (RT_FAILURE(rc))
583	{
584	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
585	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
586	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
587	TRPM_EXIT_DBG_HOOK(6);
588	return rc;
589	}
590
591	DISCPUSTATE Cpu;
592	uint32_t cbOp;
593	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
594	if (RT_FAILURE(rc))
595	{
596	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
597	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
598	TRPM_EXIT_DBG_HOOK(6);
599	return rc;
600	}
601
602	/*
603	* UD2 in a patch?
604	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
605	*/
606	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
607	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
608	{
609	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
610	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
611	/** @todo These tests are completely unnecessary, should just follow the
612	* flow and return at the end of the function. */
613	if ( rc == VINF_SUCCESS
614	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
615	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
616	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
617	\|\| rc == VINF_EM_RESCHEDULE)
618	{
619	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
620	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
621	TRPM_EXIT_DBG_HOOK(6);
622	return rc;
623	}
624	}
625	/*
626	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
627	*/
628	else if (Cpu.fPrefix & DISPREFIX_LOCK)
629	{
630	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
631	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
632	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
633	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
634	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
635	#else
636	rc = VINF_EM_RAW_EMULATE_INSTR;
637	#endif
638	}
639	/*
640	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
641	*/
642	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
643	{
644	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
645	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
646	}
647	else if (GIMShouldTrapXcptUD(pVCpu))
648	{
649	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
650	VBOXSTRICTRC rcStrict = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu, NULL /* pcbInstr */);
651	if (rcStrict == VINF_SUCCESS)
652	{
653	/* The interrupt inhibition wrt to EIP will be handled by trpmGCExitTrap() below. */
654	pRegFrame->eip += Cpu.cbInstr;
655	Assert(Cpu.cbInstr);
656	}
657	else if (rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
658	rc = VINF_SUCCESS;
659	else if (rcStrict == VINF_GIM_R3_HYPERCALL)
660	rc = VINF_GIM_R3_HYPERCALL;
661	else
662	{
663	Assert(RT_FAILURE(VBOXSTRICTRC_VAL(rcStrict)));
664	LogFlow(("TRPMGCTrap06Handler: GIMXcptUD returns %Rrc -> VINF_EM_RAW_EMULATE_INSTR\n", rc));
665	rc = VINF_EM_RAW_EMULATE_INSTR;
666	}
667	}
668	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
669	else
670	{
671	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
672	rc = VINF_EM_RAW_EMULATE_INSTR;
673	}
674	}
675	else
676	{
677	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
678	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
679	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
680	}
681
682	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
683	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
684	TRPM_EXIT_DBG_HOOK(6);
685	return rc;
686	}
687
688
689	/**
690	* Trap handler for device not present fault (\#NM).
691	*
692	* Device not available, FP or (F)WAIT instruction.
693	*
694	* @returns VBox status code.
695	* VINF_SUCCESS means we completely handled this trap,
696	* other codes are passed execution to host context.
697	*
698	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
699	* @param pRegFrame Pointer to the register frame for the trap.
700	* @internal
701	*/
702	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
703	{
704	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
705	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
706	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
707	TRPM_ENTER_DBG_HOOK(7);
708	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_NM), pRegFrame->cs.Sel, pRegFrame->eip);
709	PGMRZDynMapStartAutoSet(pVCpu);
710
711	int rc = CPUMHandleLazyFPU(pVCpu);
712	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
713	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
714	TRPM_EXIT_DBG_HOOK(7);
715	return rc;
716	}
717
718
719	/**
720	* \#NP ((segment) Not Present) handler.
721	*
722	* @returns VBox status code.
723	* VINF_SUCCESS means we completely handled this trap,
724	* other codes are passed execution to host context.
725	*
726	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
727	* @param pRegFrame Pointer to the register frame for the trap.
728	* @internal
729	*/
730	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
731	{
732	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
733	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
734	TRPM_ENTER_DBG_HOOK(0xb);
735	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_NP), pRegFrame->cs.Sel, pRegFrame->eip);
736	PGMRZDynMapStartAutoSet(pVCpu);
737
738	/*
739	* Try to detect instruction by opcode which caused trap.
740	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
741	* accessing user code. need to handle it somehow in future!
742	*/
743	RTGCPTR GCPtr;
744	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
745	(RTGCPTR)pRegFrame->eip, &GCPtr)
746	== VINF_SUCCESS)
747	{
748	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
749
750	/*
751	* First skip possible instruction prefixes, such as:
752	* OS, AS
753	* CS:, DS:, ES:, SS:, FS:, GS:
754	* REPE, REPNE
755	*
756	* note: Currently we supports only up to 4 prefixes per opcode, more
757	* prefixes (normally not used anyway) will cause trap d in guest.
758	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
759	* check this issue, its too hard.
760	*/
761	for (unsigned i = 0; i < 4; i++)
762	{
763	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
764	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
765	&& pu8Code[0] != 0x2e /* CS: */
766	&& pu8Code[0] != 0x36 /* SS: */
767	&& pu8Code[0] != 0x3e /* DS: */
768	&& pu8Code[0] != 0x26 /* ES: */
769	&& pu8Code[0] != 0x64 /* FS: */
770	&& pu8Code[0] != 0x65 /* GS: */
771	&& pu8Code[0] != 0x66 /* OS */
772	&& pu8Code[0] != 0x67 /* AS */
773	)
774	break;
775	pu8Code++;
776	}
777
778	/*
779	* Detect right switch using a callgate.
780	*
781	* We recognize the following causes for the trap 0b:
782	* CALL FAR, CALL FAR []
783	* JMP FAR, JMP FAR []
784	* IRET (may cause a task switch)
785	*
786	* Note: we can't detect whether the trap was caused by a call to a
787	* callgate descriptor or it is a real trap 0b due to a bad selector.
788	* In both situations we'll pass execution to our recompiler so we don't
789	* have to worry.
790	* If we wanted to do better detection, we have set GDT entries to callgate
791	* descriptors pointing to our own handlers.
792	*/
793	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
794	if ( pu8Code[0] == 0x9a /* CALL FAR */
795	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
796	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
797	\|\| pu8Code[0] == 0xea /* JMP FAR */
798	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
799	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
800	\|\| pu8Code[0] == 0xcf /* IRET */
801	)
802	{
803	/*
804	* Got potential call to callgate.
805	* We simply return execution to the recompiler to do emulation
806	* starting from the instruction which caused the trap.
807	*/
808	pTrpmCpu->uActiveVector = UINT32_MAX;
809	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
810	TRPM_EXIT_DBG_HOOK(0xb);
811	PGMRZDynMapReleaseAutoSet(pVCpu);
812	return VINF_EM_RAW_RING_SWITCH;
813	}
814	}
815
816	/*
817	* Pass trap 0b as is to the recompiler in all other cases.
818	*/
819	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
820	PGMRZDynMapReleaseAutoSet(pVCpu);
821	TRPM_EXIT_DBG_HOOK(0xb);
822	return VINF_EM_RAW_GUEST_TRAP;
823	}
824
825
826	/**
827	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
828	*
829	* @returns VBox status code.
830	* VINF_SUCCESS means we completely handled this trap,
831	* other codes are passed execution to host context.
832	*
833	* @param pVM The cross context VM structure.
834	* @param pVCpu The cross context virtual CPU structure.
835	* @param pRegFrame Pointer to the register frame for the trap.
836	* @param pCpu The opcode info.
837	* @param PC The program counter corresponding to cs:eip in pRegFrame.
838	*/
839	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
840	{
841	int rc;
842	TRPM_ENTER_DBG_HOOK(0xd);
843
844	/*
845	* Try handle it here, if not return to HC and emulate/interpret it there.
846	*/
847	uint16_t const uOpcode = pCpu->pCurInstr->uOpcode;
848	switch (uOpcode)
849	{
850	case OP_INT3:
851	/*
852	* Little hack to make the code below not fail
853	*/
854	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
855	pCpu->Param1.uValue = 3;
856	RT_FALL_THRU();
857	case OP_INT:
858	{
859	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_INT));
860	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
861	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
862	if (pCpu->Param1.uValue == 3)
863	{
864	/* Int 3 replacement patch? */
865	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
866	{
867	AssertFailed();
868	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
869	}
870	}
871	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
872	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
873	{
874	TRPM_EXIT_DBG_HOOK(0xd);
875	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
876	}
877
878	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
879	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
880	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
881	}
882
883	#ifdef PATM_EMULATE_SYSENTER
884	case OP_SYSEXIT:
885	case OP_SYSRET:
886	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
887	TRPM_EXIT_DBG_HOOK(0xd);
888	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
889	#endif
890
891	case OP_HLT:
892	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_HLT));
893
894	/* If it's in patch code, defer to ring-3. */
895	if (PATMIsPatchGCAddr(pVM, PC))
896	break;
897
898	pRegFrame->eip += pCpu->cbInstr;
899	TRPM_EXIT_DBG_HOOK(0xd);
900	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
901
902
903	/*
904	* These instructions are used by PATM and CASM for finding
905	* dangerous non-trapping instructions. Thus, since all
906	* scanning and patching is done in ring-3 we'll have to
907	* return to ring-3 on the first encounter of these instructions.
908	*/
909	case OP_MOV_CR:
910	case OP_MOV_DR:
911	/* We can safely emulate control/debug register move instructions in patched code. */
912	if ( !PATMIsPatchGCAddr(pVM, PC)
913	&& !CSAMIsKnownDangerousInstr(pVM, PC))
914	{
915	if (uOpcode == OP_MOV_CR)
916	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MOV_CRX));
917	else
918	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MOV_DRX));
919	break;
920	}
921	RT_FALL_THRU();
922	case OP_INVLPG:
923	case OP_LLDT:
924	case OP_STI:
925	case OP_RDTSC: /* just in case */
926	case OP_RDPMC:
927	case OP_CLTS:
928	case OP_WBINVD: /* nop */
929	case OP_RDMSR:
930	case OP_WRMSR:
931	{
932	/* Update history. */
933	switch (uOpcode)
934	{
935	case OP_MOV_CR:
936	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MOV_CRX));
937	break;
938	case OP_MOV_DR:
939	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MOV_DRX));
940	break;
941	case OP_INVLPG:
942	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_INVLPG));
943	break;
944	case OP_LLDT:
945	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_LLDT));
946	break;
947	case OP_STI:
948	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_STI));
949	break;
950	case OP_RDPMC:
951	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_RDPMC));
952	break;
953	case OP_CLTS:
954	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_CLTS));
955	break;
956	case OP_WBINVD:
957	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_CLTS));
958	break;
959	case OP_RDMSR:
960	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MSR_READ));
961	break;
962	case OP_WRMSR:
963	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_MSR_WRITE));
964	break;
965	}
966
967	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
968	if (rc == VERR_EM_INTERPRETER)
969	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
970	TRPM_EXIT_DBG_HOOK(0xd);
971	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
972	}
973	}
974
975	TRPM_EXIT_DBG_HOOK(0xd);
976	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
977	}
978
979
980	/**
981	* \#GP (General Protection Fault) handler for Ring-3.
982	*
983	* @returns VBox status code.
984	* VINF_SUCCESS means we completely handled this trap,
985	* other codes are passed execution to host context.
986	*
987	* @param pVM The cross context VM structure.
988	* @param pVCpu The cross context virtual CPU structure.
989	* @param pRegFrame Pointer to the register frame for the trap.
990	* @param pCpu The opcode info.
991	* @param PC The program counter corresponding to cs:eip in pRegFrame.
992	*/
993	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
994	{
995	int rc;
996	Assert(!pRegFrame->eflags.Bits.u1VM);
997	TRPM_ENTER_DBG_HOOK(0xd);
998
999	uint16_t const uOpcode = pCpu->pCurInstr->uOpcode;
1000	switch (uOpcode)
1001	{
1002	/*
1003	* INT3 and INT xx are ring-switching.
1004	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
1005	*/
1006	case OP_INT3:
1007	/*
1008	* Little hack to make the code below not fail
1009	*/
1010	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
1011	pCpu->Param1.uValue = 3;
1012	RT_FALL_THRU();
1013	case OP_INT:
1014	{
1015	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_INT));
1016	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
1017	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
1018	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
1019	{
1020	TRPM_EXIT_DBG_HOOK(0xd);
1021	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1022	}
1023
1024	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
1025	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
1026	TRPM_EXIT_DBG_HOOK(0xd);
1027	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
1028	}
1029
1030	/*
1031	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
1032	*/
1033	case OP_SYSCALL:
1034	case OP_SYSENTER:
1035	if (uOpcode == OP_SYSCALL)
1036	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_SYSCALL));
1037	else
1038	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_SYSENTER));
1039	#ifdef PATM_EMULATE_SYSENTER
1040	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
1041	if (rc == VINF_SUCCESS)
1042	{
1043	TRPM_EXIT_DBG_HOOK(0xd);
1044	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1045	}
1046	/* else no break; */
1047	#endif
1048	case OP_BOUND:
1049	case OP_INTO:
1050	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
1051	TRPM_EXIT_DBG_HOOK(0xd);
1052	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
1053
1054	/*
1055	* Handle virtualized TSC & PMC reads, just in case.
1056	*/
1057	case OP_RDTSC:
1058	case OP_RDPMC:
1059	{
1060	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
1061	if (rc == VERR_EM_INTERPRETER)
1062	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
1063	TRPM_EXIT_DBG_HOOK(0xd);
1064	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1065	}
1066
1067	/*
1068	* STI and CLI are I/O privileged, i.e. if IOPL
1069	*/
1070	case OP_STI:
1071	case OP_CLI:
1072	{
1073	uint32_t efl = CPUMRawGetEFlags(pVCpu);
1074	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
1075	if (X86_EFL_GET_IOPL(efl) >= cpl)
1076	{
1077	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
1078	TRPM_EXIT_DBG_HOOK(0xd);
1079	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
1080	}
1081	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
1082	break;
1083	}
1084	}
1085
1086	/*
1087	* A genuine guest fault.
1088	*/
1089	TRPM_EXIT_DBG_HOOK(0xd);
1090	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
1091	}
1092
1093
1094	/**
1095	* Emulates RDTSC for the \#GP handler.
1096	*
1097	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
1098	*
1099	* @param pVM The cross context VM structure.
1100	* @param pVCpu The cross context virtual CPU structure.
1101	* @param pRegFrame Pointer to the register frame for the trap.
1102	* This will be updated on successful return.
1103	*/
1104	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1105	{
1106	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1107	TRPM_ENTER_DBG_HOOK(0xd);
1108
1109	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1110	{
1111	TRPM_EXIT_DBG_HOOK(0xd);
1112	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1113	}
1114
1115	uint64_t uTicks = TMCpuTickGet(pVCpu);
1116	pRegFrame->eax = RT_LO_U32(uTicks);
1117	pRegFrame->edx = RT_HI_U32(uTicks);
1118	pRegFrame->eip += 2;
1119	TRPM_EXIT_DBG_HOOK(0xd);
1120	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1121	}
1122
1123
1124	/**
1125	* \#GP (General Protection Fault) handler.
1126	*
1127	* @returns VBox status code.
1128	* VINF_SUCCESS means we completely handled this trap,
1129	* other codes are passed execution to host context.
1130	*
1131	* @param pVM The cross context VM structure.
1132	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1133	* @param pRegFrame Pointer to the register frame for the trap.
1134	*/
1135	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1136	{
1137	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1138	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1139	TRPM_ENTER_DBG_HOOK(0xd);
1140
1141	/*
1142	* Convert and validate CS.
1143	*/
1144	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1145	RTGCPTR PC;
1146	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1147	pRegFrame->rip, &PC);
1148	if (RT_FAILURE(rc))
1149	{
1150	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1151	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1152	TRPM_EXIT_DBG_HOOK(0xd);
1153	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1154	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1155	}
1156
1157	/*
1158	* Disassemble the instruction.
1159	*/
1160	DISCPUSTATE Cpu;
1161	uint32_t cbOp;
1162	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1163	if (RT_FAILURE(rc))
1164	{
1165	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1166	TRPM_EXIT_DBG_HOOK(0xd);
1167	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1168	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1169	}
1170	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1171
1172	/*
1173	* Optimize RDTSC traps.
1174	* Some guests (like Solaris) are using RDTSC all over the place and
1175	* will end up trapping a lot because of that.
1176	*
1177	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1178	*/
1179	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1180	{
1181	EMHistoryUpdateFlagsAndType(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_EM, EMEXITTYPE_RDTSC));
1182	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1183	}
1184
1185	/*
1186	* Deal with I/O port access.
1187	*/
1188	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1189	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1190	{
1191	/* IOMRCIOPortHandler updates exit history. */
1192	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1193	TRPM_EXIT_DBG_HOOK(0xd);
1194	return trpmGCExitTrap(pVM, pVCpu, VBOXSTRICTRC_TODO(rcStrict), pRegFrame);
1195	}
1196
1197	/*
1198	* Deal with Ring-0 (privileged instructions)
1199	*/
1200	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1201	&& !pRegFrame->eflags.Bits.u1VM)
1202	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1203
1204	/*
1205	* Deal with Ring-3 GPs.
1206	*/
1207	if (!pRegFrame->eflags.Bits.u1VM)
1208	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1209
1210	/*
1211	* Deal with v86 code.
1212	*
1213	* We always set IOPL to zero which makes e.g. pushf fault in V86
1214	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1215	* Simply fall back to the recompiler to emulate this instruction if
1216	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1217	*/
1218	X86EFLAGS eflags;
1219	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1220	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1221	if (eflags.Bits.u2IOPL != 3)
1222	{
1223	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1224
1225	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1226	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1227	TRPM_EXIT_DBG_HOOK(0xd);
1228	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1229	}
1230	TRPM_EXIT_DBG_HOOK(0xd);
1231	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1232	}
1233
1234
1235	/**
1236	* \#GP (General Protection Fault) handler.
1237	*
1238	* @returns VBox status code.
1239	* VINF_SUCCESS means we completely handled this trap,
1240	* other codes are passed execution to host context.
1241	*
1242	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1243	* @param pRegFrame Pointer to the register frame for the trap.
1244	* @internal
1245	*/
1246	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1247	{
1248	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1249	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1250	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1251	TRPM_ENTER_DBG_HOOK(0xd);
1252	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_GP), pRegFrame->cs.Sel, pRegFrame->eip);
1253
1254	PGMRZDynMapStartAutoSet(pVCpu);
1255	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1256	switch (rc)
1257	{
1258	case VINF_EM_RAW_GUEST_TRAP:
1259	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1260	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1261	rc = VINF_PATM_PATCH_TRAP_GP;
1262	break;
1263
1264	case VINF_EM_RAW_INTERRUPT_PENDING:
1265	Assert(TRPMHasTrap(pVCpu));
1266	/* no break; */
1267	case VINF_PGM_SYNC_CR3:
1268	case VINF_EM_RAW_EMULATE_INSTR:
1269	case VINF_IOM_R3_IOPORT_READ:
1270	case VINF_IOM_R3_IOPORT_WRITE:
1271	case VINF_IOM_R3_IOPORT_COMMIT_WRITE:
1272	case VINF_IOM_R3_MMIO_WRITE:
1273	case VINF_IOM_R3_MMIO_COMMIT_WRITE:
1274	case VINF_IOM_R3_MMIO_READ:
1275	case VINF_IOM_R3_MMIO_READ_WRITE:
1276	case VINF_CPUM_R3_MSR_READ:
1277	case VINF_CPUM_R3_MSR_WRITE:
1278	case VINF_PATM_PATCH_INT3:
1279	case VINF_EM_NO_MEMORY:
1280	case VINF_EM_RAW_TO_R3:
1281	case VINF_EM_RAW_TIMER_PENDING:
1282	case VINF_EM_PENDING_REQUEST:
1283	case VINF_EM_HALT:
1284	case VINF_SELM_SYNC_GDT:
1285	case VINF_SUCCESS:
1286	break;
1287
1288	default:
1289	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1290	break;
1291	}
1292	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1293	TRPM_EXIT_DBG_HOOK(0xd);
1294	return rc;
1295	}
1296
1297
1298	/**
1299	* \#PF (Page Fault) handler.
1300	*
1301	* Calls PGM which does the actual handling.
1302	*
1303	*
1304	* @returns VBox status code.
1305	* VINF_SUCCESS means we completely handled this trap,
1306	* other codes are passed execution to host context.
1307	*
1308	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1309	* @param pRegFrame Pointer to the register frame for the trap.
1310	* @internal
1311	*/
1312	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1313	{
1314	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1315	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1316	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1317	TRPM_ENTER_DBG_HOOK(0xe);
1318	EMRCHistoryAddExitNoTs(pVCpu, EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_PF), pRegFrame->cs.Sel, pRegFrame->eip);
1319
1320	/*
1321	* This is all PGM stuff.
1322	*/
1323	PGMRZDynMapStartAutoSet(pVCpu);
1324	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1325	switch (rc)
1326	{
1327	case VINF_EM_RAW_EMULATE_INSTR:
1328	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1329	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1330	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1331	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1332	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1333	rc = VINF_PATCH_EMULATE_INSTR;
1334	break;
1335
1336	case VINF_EM_RAW_GUEST_TRAP:
1337	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1338	{
1339	PGMRZDynMapReleaseAutoSet(pVCpu);
1340	TRPM_EXIT_DBG_HOOK(0xe);
1341	return VINF_PATM_PATCH_TRAP_PF;
1342	}
1343
1344	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1345	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1346	break;
1347
1348	case VINF_EM_RAW_INTERRUPT_PENDING:
1349	Assert(TRPMHasTrap(pVCpu));
1350	/* no break; */
1351	case VINF_IOM_R3_MMIO_READ:
1352	case VINF_IOM_R3_MMIO_WRITE:
1353	case VINF_IOM_R3_MMIO_COMMIT_WRITE:
1354	case VINF_IOM_R3_MMIO_READ_WRITE:
1355	case VINF_PATM_HC_MMIO_PATCH_READ:
1356	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1357	case VINF_SUCCESS:
1358	case VINF_EM_RAW_TO_R3:
1359	case VINF_EM_PENDING_REQUEST:
1360	case VINF_EM_RAW_TIMER_PENDING:
1361	case VINF_EM_NO_MEMORY:
1362	case VINF_CSAM_PENDING_ACTION:
1363	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1364	break;
1365
1366	default:
1367	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1368	break;
1369	}
1370	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1371	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1372	TRPM_EXIT_DBG_HOOK(0xe);
1373	return rc;
1374	}
1375
1376
1377	/**
1378	* Scans for the EIP in the specified array of trap handlers.
1379	*
1380	* If we don't fine the EIP, we'll panic.
1381	*
1382	* @returns VBox status code.
1383	*
1384	* @param pVM The cross context VM structure.
1385	* @param pRegFrame Pointer to the register frame for the trap.
1386	* @param paHandlers The array of trap handler records.
1387	* @param pEndRecord The end record (exclusive).
1388	*/
1389	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1390	{
1391	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1392	Assert(paHandlers <= pEndRecord);
1393
1394	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1395
1396	#if 0 /// @todo later
1397	/*
1398	* Start by doing a kind of binary search.
1399	*/
1400	unsigned iStart = 0;
1401	unsigned iEnd = pEndRecord - paHandlers;
1402	unsigned i = iEnd / 2;
1403	#endif
1404
1405	/*
1406	* Do a linear search now (in case the array wasn't properly sorted).
1407	*/
1408	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1409	{
1410	if ( pCur->uStartEIP <= uEip
1411	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1412	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1413	}
1414
1415	return VERR_TRPM_DONT_PANIC;
1416	}
1417
1418
1419	/**
1420	* Hypervisor \#NP ((segment) Not Present) handler.
1421	*
1422	* Scans for the EIP in the registered trap handlers.
1423	*
1424	* @returns VBox status code.
1425	* VINF_SUCCESS means we completely handled this trap,
1426	* other codes are passed back to host context.
1427	*
1428	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1429	* @param pRegFrame Pointer to the register frame for the trap.
1430	* @internal
1431	*/
1432	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1433	{
1434	EMRCHistoryAddExitNoTs(TRPMCPU_2_VMCPU(pTrpmCpu), EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_NP),
1435	pRegFrame->cs.Sel, pRegFrame->eip);
1436	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1437	}
1438
1439
1440	/**
1441	* Hypervisor \#GP (General Protection Fault) handler.
1442	*
1443	* Scans for the EIP in the registered trap handlers.
1444	*
1445	* @returns VBox status code.
1446	* VINF_SUCCESS means we completely handled this trap,
1447	* other codes are passed back to host context.
1448	*
1449	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1450	* @param pRegFrame Pointer to the register frame for the trap.
1451	* @internal
1452	*/
1453	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1454	{
1455	EMRCHistoryAddExitNoTs(TRPMCPU_2_VMCPU(pTrpmCpu), EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_GP),
1456	pRegFrame->cs.Sel, pRegFrame->eip);
1457	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1458	}
1459
1460
1461	/**
1462	* Hypervisor \#PF (Page Fault) handler.
1463	*
1464	* Scans for the EIP in the registered trap handlers.
1465	*
1466	* @returns VBox status code.
1467	* VINF_SUCCESS means we completely handled this trap,
1468	* other codes are passed back to host context.
1469	*
1470	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1471	* @param pRegFrame Pointer to the register frame for the trap.
1472	* @internal
1473	*/
1474	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1475	{
1476	EMRCHistoryAddExitNoTs(TRPMCPU_2_VMCPU(pTrpmCpu), EMEXIT_MAKE_FLAGS_AND_TYPE(EMEXIT_F_KIND_XCPT, X86_XCPT_PF),
1477	pRegFrame->cs.Sel, pRegFrame->eip);
1478	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1479	}
1480
1481
1482	/**
1483	* Deal with hypervisor traps occurring when resuming execution on a trap.
1484	*
1485	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1486	* this by not allowing recursion without it being the subject of a guru
1487	* meditation. (We used to / tried to handle this but there isn't any reason
1488	* for it.)
1489	*
1490	* So, do NOT use this for handling RC traps!
1491	*
1492	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1493	* @param pVM The cross context VM structure.
1494	* @param pRegFrame Register frame.
1495	* @param uUser User arg.
1496	*/
1497	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1498	{
1499	RT_NOREF_PV(pRegFrame);
1500	Log(("********************************************************\n"));
1501	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1502	Log(("********************************************************\n"));
1503
1504	/*
1505	* This used to be kind of complicated, but since we stopped storing
1506	* the register frame on the stack and instead storing it directly
1507	* in the CPUMCPU::Guest structure, we just have to figure out which
1508	* status to hand on to the host and let the recompiler/IEM do its
1509	* job.
1510	*/
1511	switch (uUser)
1512	{
1513	case TRPM_TRAP_IN_MOV_GS:
1514	case TRPM_TRAP_IN_MOV_FS:
1515	case TRPM_TRAP_IN_MOV_ES:
1516	case TRPM_TRAP_IN_MOV_DS:
1517	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1518	break;
1519
1520	case TRPM_TRAP_IN_IRET:
1521	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1522	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1523	break;
1524
1525	default:
1526	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1527	return VERR_TRPM_BAD_TRAP_IN_OP;
1528	}
1529
1530	AssertMsgFailed(("Impossible!\n"));
1531	return VERR_TRPM_IPE_3;
1532	}
1533
1534
1535	/**
1536	* Generic hyper trap handler that sets the EIP to @a uUser.
1537	*
1538	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1539	* @param pVM The cross context VM structure.
1540	* @param pRegFrame Pointer to the register frame (within VM)
1541	* @param uUser The user arg, which should be the new EIP address.
1542	*/
1543	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1544	{
1545	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1546	pRegFrame->eip = uUser;
1547	return VINF_SUCCESS;
1548	}
1549

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 72564

Download in other formats: