VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp@ 20543

Last change on this file since 20543 was 20374, checked in by vboxsync, 15 years ago

*: s/RT_\(BEGIN|END\)_DECLS/RT_C_DECLS_\1/g
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 46.0 KB
Line 
1/* $Id: TRPMGCHandlers.cpp 20374 2009-06-08 00:43:21Z vboxsync $ */
2/** @file
3 * TRPM - Guest Context Trap Handlers, CPP part
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_TRPM
27#include <VBox/selm.h>
28#include <VBox/iom.h>
29#include <VBox/pgm.h>
30#include <VBox/pdm.h>
31#include <VBox/dbgf.h>
32#include <VBox/em.h>
33#include <VBox/csam.h>
34#include <VBox/patm.h>
35#include <VBox/mm.h>
36#include <VBox/cpum.h>
37#include "TRPMInternal.h"
38#include <VBox/vm.h>
39#include <VBox/vmm.h>
40#include <VBox/param.h>
41
42#include <VBox/err.h>
43#include <VBox/dis.h>
44#include <VBox/disopcode.h>
45#include <VBox/x86.h>
46#include <VBox/log.h>
47#include <VBox/tm.h>
48#include <iprt/asm.h>
49#include <iprt/assert.h>
50
51/*******************************************************************************
52* Defined Constants And Macros *
53*******************************************************************************/
54/* still here. MODR/M byte parsing */
55#define X86_OPCODE_MODRM_MOD_MASK 0xc0
56#define X86_OPCODE_MODRM_REG_MASK 0x38
57#define X86_OPCODE_MODRM_RM_MASK 0x07
58
59/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
60#define DTRACE_EXPERIMENT
61
62
63/*******************************************************************************
64* Structures and Typedefs *
65*******************************************************************************/
66/** Pointer to a readonly hypervisor trap record. */
67typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
68
69/**
70 * A hypervisor trap record.
71 * This contains information about a handler for a instruction range.
72 *
73 * @remark This must match what TRPM_HANDLER outputs.
74 */
75typedef struct TRPMGCHYPER
76{
77 /** The start address. */
78 uintptr_t uStartEIP;
79 /** The end address. (exclusive)
80 * If NULL the it's only for the instruction at pvStartEIP. */
81 uintptr_t uEndEIP;
82 /**
83 * The handler.
84 *
85 * @returns VBox status code
86 * VINF_SUCCESS means we've handled the trap.
87 * Any other error code means returning to the host context.
88 * @param pVM The VM handle.
89 * @param pRegFrame The register frame.
90 * @param uUser The user argument.
91 */
92 DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
93 /** Whatever the handler desires to put here. */
94 uintptr_t uUser;
95} TRPMGCHYPER;
96
97
98/*******************************************************************************
99* Global Variables *
100*******************************************************************************/
101RT_C_DECLS_BEGIN
102/** Defined in VMMGC0.asm or VMMGC99.asm.
103 * @{ */
104extern const TRPMGCHYPER g_aTrap0bHandlers[1];
105extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
106extern const TRPMGCHYPER g_aTrap0dHandlers[1];
107extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
108extern const TRPMGCHYPER g_aTrap0eHandlers[1];
109extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
110/** @} */
111RT_C_DECLS_END
112
113
114/*******************************************************************************
115* Internal Functions *
116*******************************************************************************/
117RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
118DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
119RT_C_DECLS_END
120
121
122
123/**
124 * Exits the trap, called when exiting a trap handler.
125 *
126 * Will reset the trap if it's not a guest trap or the trap
127 * is already handled. Will process resume guest FFs.
128 *
129 * @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
130 * happened.
131 * @param pVM VM handle.
132 * @param pVCpu The virtual CPU handle.
133 * @param rc The VBox status code to return.
134 * @param pRegFrame Pointer to the register frame for the trap.
135 */
136static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
137{
138 uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
139 NOREF(uOldActiveVector);
140
141 /* Reset trap? */
142 if ( rc != VINF_EM_RAW_GUEST_TRAP
143 && rc != VINF_EM_RAW_RING_SWITCH_INT)
144 pVCpu->trpm.s.uActiveVector = ~0;
145
146#ifdef VBOX_HIGH_RES_TIMERS_HACK
147 /*
148 * We should poll the timers occationally.
149 * We must *NOT* do this too frequently as it adds a significant overhead
150 * and it'll kill us if the trap load is high. (See #1354.)
151 * (The heuristic is not very intelligent, we should really check trap
152 * frequency etc. here, but alas, we lack any such information atm.)
153 */
154 static unsigned s_iTimerPoll = 0;
155 if (rc == VINF_SUCCESS)
156 {
157 if (!(++s_iTimerPoll & 0xf))
158 {
159 TMTimerPollVoid(pVM, pVCpu);
160 Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
161 VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER)));
162 }
163 }
164 else
165 s_iTimerPoll = 0;
166#endif
167
168 /* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
169 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
170 {
171 Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
172 if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
173 {
174 /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
175 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
176 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
177 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
178 */
179 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
180 }
181 }
182
183 /*
184 * Pending resume-guest-FF?
185 * Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
186 */
187 if ( rc == VINF_SUCCESS
188 && ( VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC | VM_FF_REQUEST | VM_FF_PGM_NO_MEMORY)
189 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER | VMCPU_FF_TO_R3 | VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC | VMCPU_FF_REQUEST | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
190 )
191 )
192 {
193 /* The out of memory condition naturally outrang the others. */
194 if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
195 rc = VINF_EM_NO_MEMORY;
196 /* Pending Ring-3 action. */
197 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TO_R3))
198 {
199 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
200 rc = VINF_EM_RAW_TO_R3;
201 }
202 /* Pending timer action. */
203 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER))
204 rc = VINF_EM_RAW_TIMER_PENDING;
205 /* The Virtual Sync clock has stopped. */
206 else if (VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
207 rc = VINF_EM_RAW_TO_R3;
208 /* Pending interrupt: dispatch it. */
209 else if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
210 && !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
211 && PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
212 )
213 {
214 uint8_t u8Interrupt;
215 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
216 Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
217 AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
218 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
219 /* can't return if successful */
220 Assert(rc != VINF_SUCCESS);
221
222 /* Stop the profile counter that was started in TRPMGCHandlersA.asm */
223 Assert(uOldActiveVector <= 16);
224 STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
225
226 /* Assert the trap and go to the recompiler to dispatch it. */
227 TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
228
229 STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
230 rc = VINF_EM_RAW_INTERRUPT_PENDING;
231 }
232 /*
233 * Try sync CR3?
234 */
235 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
236#if 1
237 rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
238#else
239 rc = VINF_PGM_SYNC_CR3;
240#endif
241 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
242 else if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
243 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
244 rc = VINF_EM_PENDING_REQUEST;
245 }
246
247 AssertMsg( rc != VINF_SUCCESS
248 || ( pRegFrame->eflags.Bits.u1IF
249 && ( pRegFrame->eflags.Bits.u2IOPL < (unsigned)(pRegFrame->ss & X86_SEL_RPL) || pRegFrame->eflags.Bits.u1VM))
250 , ("rc=%Rrc\neflags=%RX32 ss=%RTsel IOPL=%d\n", rc, pRegFrame->eflags.u32, pRegFrame->ss, pRegFrame->eflags.Bits.u2IOPL));
251 return rc;
252}
253
254
255/**
256 * \#DB (Debug event) handler.
257 *
258 * @returns VBox status code.
259 * VINF_SUCCESS means we completely handled this trap,
260 * other codes are passed execution to host context.
261 *
262 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
263 * @param pRegFrame Pointer to the register frame for the trap.
264 * @internal
265 */
266DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
267{
268 RTGCUINTREG uDr6 = ASMGetAndClearDR6();
269 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
270 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
271
272 LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs, pRegFrame->eip, uDr6));
273
274 /*
275 * We currently don't make sure of the X86_DR7_GD bit, but
276 * there might come a time when we do.
277 */
278 if ((uDr6 & X86_DR6_BD) == X86_DR6_BD)
279 {
280 AssertReleaseMsgFailed(("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
281 ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6));
282 return VERR_NOT_IMPLEMENTED;
283 }
284
285 AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
286
287 /*
288 * Now leave the rest to the DBGF.
289 */
290 int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
291 if (rc == VINF_EM_RAW_GUEST_TRAP)
292 CPUMSetGuestDR6(pVCpu, uDr6);
293
294 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
295 Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs, pRegFrame->eip, uDr6));
296 return rc;
297}
298
299
300/**
301 * NMI handler, for when we are using NMIs to debug things.
302 *
303 * @returns VBox status code.
304 * VINF_SUCCESS means we completely handled this trap,
305 * other codes are passed execution to host context.
306 *
307 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
308 * @param pRegFrame Pointer to the register frame for the trap.
309 * @internal
310 * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
311 */
312DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
313{
314 LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
315 RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip);
316 return VERR_TRPM_DONT_PANIC;
317}
318
319
320/**
321 * \#BP (Breakpoint) handler.
322 *
323 * @returns VBox status code.
324 * VINF_SUCCESS means we completely handled this trap,
325 * other codes are passed execution to host context.
326 *
327 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
328 * @param pRegFrame Pointer to the register frame for the trap.
329 * @internal
330 */
331DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
332{
333 LogFlow(("TRPMGC03: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
334 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
335 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
336 int rc;
337
338 /*
339 * Both PATM are using INT3s, let them have a go first.
340 */
341 if ( (pRegFrame->ss & X86_SEL_RPL) == 1
342 && !pRegFrame->eflags.Bits.u1VM)
343 {
344 rc = PATMHandleInt3PatchTrap(pVM, pRegFrame);
345 if (rc == VINF_SUCCESS || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_PATM_PATCH_INT3 || rc == VINF_PATM_DUPLICATE_FUNCTION)
346 {
347 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
348 Log6(("TRPMGC03: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs, pRegFrame->eip));
349 return rc;
350 }
351 }
352 rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
353
354 /* anything we should do with this? Schedule it in GC? */
355 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
356 Log6(("TRPMGC03: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
357 return rc;
358}
359
360
361/**
362 * Trap handler for illegal opcode fault (\#UD).
363 *
364 * @returns VBox status code.
365 * VINF_SUCCESS means we completely handled this trap,
366 * other codes are passed execution to host context.
367 *
368 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
369 * @param pRegFrame Pointer to the register frame for the trap.
370 * @internal
371 */
372DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
373{
374 LogFlow(("TRPMGC06: %04x:%08x efl=%x\n", pRegFrame->cs, pRegFrame->eip, pRegFrame->eflags.u32));
375 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
376 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
377 int rc;
378
379 if (CPUMGetGuestCPL(pVCpu, pRegFrame) == 0)
380 {
381 /*
382 * Decode the instruction.
383 */
384 RTGCPTR PC;
385 rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &PC);
386 if (RT_FAILURE(rc))
387 {
388 Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
389 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
390 Log6(("TRPMGC06: %Rrc (%04x:%08x) (SELM)\n", rc, pRegFrame->cs, pRegFrame->eip));
391 return rc;
392 }
393
394 DISCPUSTATE Cpu;
395 uint32_t cbOp;
396 rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
397 if (RT_FAILURE(rc))
398 {
399 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
400 Log6(("TRPMGC06: %Rrc (%04x:%08x) (EM)\n", rc, pRegFrame->cs, pRegFrame->eip));
401 return rc;
402 }
403
404 /*
405 * UD2 in a patch?
406 */
407 if ( Cpu.pCurInstr->opcode == OP_ILLUD2
408 && PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
409 {
410 rc = PATMGCHandleIllegalInstrTrap(pVM, pRegFrame);
411 /** @todo These tests are completely unnecessary, should just follow the
412 * flow and return at the end of the function. */
413 if ( rc == VINF_SUCCESS
414 || rc == VINF_EM_RAW_EMULATE_INSTR
415 || rc == VINF_PATM_DUPLICATE_FUNCTION
416 || rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
417 || rc == VINF_EM_RESCHEDULE)
418 {
419 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
420 Log6(("TRPMGC06: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs, pRegFrame->eip));
421 return rc;
422 }
423 }
424 /*
425 * Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
426 */
427 else if (Cpu.prefix & PREFIX_LOCK)
428 {
429 Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->opcode));
430#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
431 Assert(!PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip));
432 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
433 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
434#else
435 rc = VINF_EM_RAW_EMULATE_INSTR;
436#endif
437 }
438 /*
439 * Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
440 */
441 else if (Cpu.pCurInstr->opcode == OP_MONITOR)
442 {
443 uint32_t cbIgnored;
444 rc = EMInterpretInstructionCPU(pVM, pVCpu, &Cpu, pRegFrame, PC, &cbIgnored);
445 if (RT_LIKELY(RT_SUCCESS(rc)))
446 pRegFrame->eip += Cpu.opsize;
447 }
448 /* Never generate a raw trap here; it might be an instruction, that requires emulation. */
449 else
450 rc = VINF_EM_RAW_EMULATE_INSTR;
451 }
452 else
453 {
454 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
455 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
456 }
457
458 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
459 Log6(("TRPMGC06: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
460 return rc;
461}
462
463
464/**
465 * Trap handler for device not present fault (\#NM).
466 *
467 * Device not available, FP or (F)WAIT instruction.
468 *
469 * @returns VBox status code.
470 * VINF_SUCCESS means we completely handled this trap,
471 * other codes are passed execution to host context.
472 *
473 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
474 * @param pRegFrame Pointer to the register frame for the trap.
475 * @internal
476 */
477DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
478{
479 LogFlow(("TRPMGC07: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
480 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
481 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
482
483 int rc = CPUMHandleLazyFPU(pVCpu);
484 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
485 Log6(("TRPMGC07: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
486 return rc;
487}
488
489
490/**
491 * \#NP ((segment) Not Present) handler.
492 *
493 * @returns VBox status code.
494 * VINF_SUCCESS means we completely handled this trap,
495 * other codes are passed execution to host context.
496 *
497 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
498 * @param pRegFrame Pointer to the register frame for the trap.
499 * @internal
500 */
501DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
502{
503 LogFlow(("TRPMGC0b: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
504 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
505
506 /*
507 * Try to detect instruction by opcode which caused trap.
508 * XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
509 * accessing user code. need to handle it somehow in future!
510 */
511 RTGCPTR GCPtr;
512 if (SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &GCPtr) == VINF_SUCCESS)
513 {
514 uint8_t *pu8Code = (uint8_t *)(uintptr_t)GCPtr;
515
516 /*
517 * First skip possible instruction prefixes, such as:
518 * OS, AS
519 * CS:, DS:, ES:, SS:, FS:, GS:
520 * REPE, REPNE
521 *
522 * note: Currently we supports only up to 4 prefixes per opcode, more
523 * prefixes (normally not used anyway) will cause trap d in guest.
524 * note: Instruction length in IA-32 may be up to 15 bytes, we dont
525 * check this issue, its too hard.
526 */
527 for (unsigned i = 0; i < 4; i++)
528 {
529 if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
530 && pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
531 && pu8Code[0] != 0x2e /* CS: */
532 && pu8Code[0] != 0x36 /* SS: */
533 && pu8Code[0] != 0x3e /* DS: */
534 && pu8Code[0] != 0x26 /* ES: */
535 && pu8Code[0] != 0x64 /* FS: */
536 && pu8Code[0] != 0x65 /* GS: */
537 && pu8Code[0] != 0x66 /* OS */
538 && pu8Code[0] != 0x67 /* AS */
539 )
540 break;
541 pu8Code++;
542 }
543
544 /*
545 * Detect right switch using a callgate.
546 *
547 * We recognize the following causes for the trap 0b:
548 * CALL FAR, CALL FAR []
549 * JMP FAR, JMP FAR []
550 * IRET (may cause a task switch)
551 *
552 * Note: we can't detect whether the trap was caused by a call to a
553 * callgate descriptor or it is a real trap 0b due to a bad selector.
554 * In both situations we'll pass execution to our recompiler so we don't
555 * have to worry.
556 * If we wanted to do better detection, we have set GDT entries to callgate
557 * descriptors pointing to our own handlers.
558 */
559 /** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
560 if ( pu8Code[0] == 0x9a /* CALL FAR */
561 || ( pu8Code[0] == 0xff /* CALL FAR [] */
562 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
563 || pu8Code[0] == 0xea /* JMP FAR */
564 || ( pu8Code[0] == 0xff /* JMP FAR [] */
565 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
566 || pu8Code[0] == 0xcf /* IRET */
567 )
568 {
569 /*
570 * Got potential call to callgate.
571 * We simply return execution to the recompiler to do emulation
572 * starting from the instruction which caused the trap.
573 */
574 pTrpmCpu->uActiveVector = ~0;
575 Log6(("TRPMGC0b: %Rrc (%04x:%08x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs, pRegFrame->eip));
576 return VINF_EM_RAW_RING_SWITCH;
577 }
578 }
579
580 /*
581 * Pass trap 0b as is to the recompiler in all other cases.
582 */
583 Log6(("TRPMGC0b: %Rrc (%04x:%08x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs, pRegFrame->eip));
584 return VINF_EM_RAW_GUEST_TRAP;
585}
586
587
588/**
589 * \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
590 *
591 * @returns VBox status code.
592 * VINF_SUCCESS means we completely handled this trap,
593 * other codes are passed execution to host context.
594 *
595 * @param pVM The VM handle.
596 * @param pVCpu The virtual CPU handle.
597 * @param pRegFrame Pointer to the register frame for the trap.
598 * @param pCpu The opcode info.
599 * @param PC The program counter corresponding to cs:eip in pRegFrame.
600 */
601static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
602{
603 int rc;
604
605 /*
606 * Try handle it here, if not return to HC and emulate/interpret it there.
607 */
608 switch (pCpu->pCurInstr->opcode)
609 {
610 case OP_INT3:
611 /*
612 * Little hack to make the code below not fail
613 */
614 pCpu->param1.flags = USE_IMMEDIATE8;
615 pCpu->param1.parval = 3;
616 /* fallthru */
617 case OP_INT:
618 {
619 Assert(pCpu->param1.flags & USE_IMMEDIATE8);
620 Assert(!(PATMIsPatchGCAddr(pVM, (RTRCPTR)PC)));
621 if (pCpu->param1.parval == 3)
622 {
623 /* Int 3 replacement patch? */
624 if (PATMHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
625 {
626 AssertFailed();
627 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
628 }
629 }
630 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
631 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
632 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
633
634 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
635 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
636 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
637 }
638
639#ifdef PATM_EMULATE_SYSENTER
640 case OP_SYSEXIT:
641 case OP_SYSRET:
642 rc = PATMSysCall(pVM, pRegFrame, pCpu);
643 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
644#endif
645
646 case OP_HLT:
647 /* If it's in patch code, defer to ring-3. */
648 if (PATMIsPatchGCAddr(pVM, (RTRCPTR)PC))
649 break;
650
651 pRegFrame->eip += pCpu->opsize;
652 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
653
654
655 /*
656 * These instructions are used by PATM and CASM for finding
657 * dangerous non-trapping instructions. Thus, since all
658 * scanning and patching is done in ring-3 we'll have to
659 * return to ring-3 on the first encounter of these instructions.
660 */
661 case OP_MOV_CR:
662 case OP_MOV_DR:
663 /* We can safely emulate control/debug register move instructions in patched code. */
664 if ( !PATMIsPatchGCAddr(pVM, (RTRCPTR)PC)
665 && !CSAMIsKnownDangerousInstr(pVM, (RTRCPTR)PC))
666 break;
667 case OP_INVLPG:
668 case OP_LLDT:
669 case OP_STI:
670 case OP_RDTSC: /* just in case */
671 case OP_RDPMC:
672 case OP_CLTS:
673 case OP_WBINVD: /* nop */
674 case OP_RDMSR:
675 case OP_WRMSR:
676 {
677 uint32_t cbIgnored;
678 rc = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, PC, &cbIgnored);
679 if (RT_SUCCESS(rc))
680 pRegFrame->eip += pCpu->opsize;
681 else if (rc == VERR_EM_INTERPRETER)
682 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
683 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
684 }
685 }
686
687 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
688}
689
690
691/**
692 * \#GP (General Protection Fault) handler for Ring-3.
693 *
694 * @returns VBox status code.
695 * VINF_SUCCESS means we completely handled this trap,
696 * other codes are passed execution to host context.
697 *
698 * @param pVM The VM handle.
699 * @param pVCpu The virtual CPU handle.
700 * @param pRegFrame Pointer to the register frame for the trap.
701 * @param pCpu The opcode info.
702 * @param PC The program counter corresponding to cs:eip in pRegFrame.
703 */
704static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
705{
706 int rc;
707 Assert(!pRegFrame->eflags.Bits.u1VM);
708
709 switch (pCpu->pCurInstr->opcode)
710 {
711 /*
712 * INT3 and INT xx are ring-switching.
713 * (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
714 */
715 case OP_INT3:
716 /*
717 * Little hack to make the code below not fail
718 */
719 pCpu->param1.flags = USE_IMMEDIATE8;
720 pCpu->param1.parval = 3;
721 /* fall thru */
722 case OP_INT:
723 {
724 Assert(pCpu->param1.flags & USE_IMMEDIATE8);
725 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
726 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
727 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
728
729 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
730 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
731 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
732 }
733
734 /*
735 * SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
736 */
737 case OP_SYSCALL:
738 case OP_SYSENTER:
739#ifdef PATM_EMULATE_SYSENTER
740 rc = PATMSysCall(pVM, pRegFrame, pCpu);
741 if (rc == VINF_SUCCESS)
742 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
743 /* else no break; */
744#endif
745 case OP_BOUND:
746 case OP_INTO:
747 pVCpu->trpm.s.uActiveVector = ~0;
748 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
749
750 /*
751 * Handle virtualized TSC & PMC reads, just in case.
752 */
753 case OP_RDTSC:
754 case OP_RDPMC:
755 {
756 uint32_t cbIgnored;
757 rc = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, PC, &cbIgnored);
758 if (RT_SUCCESS(rc))
759 pRegFrame->eip += pCpu->opsize;
760 else if (rc == VERR_EM_INTERPRETER)
761 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
762 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
763 }
764
765 /*
766 * STI and CLI are I/O privileged, i.e. if IOPL
767 */
768 case OP_STI:
769 case OP_CLI:
770 {
771 uint32_t efl = CPUMRawGetEFlags(pVCpu, pRegFrame);
772 if (X86_EFL_GET_IOPL(efl) >= (unsigned)(pRegFrame->ss & X86_SEL_RPL))
773 {
774 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
775 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
776 }
777 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0)\n"));
778 break;
779 }
780 }
781
782 /*
783 * A genuine guest fault.
784 */
785 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
786}
787
788
789/**
790 * Emulates RDTSC for the \#GP handler.
791 *
792 * @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
793 *
794 * @param pVM Pointer to the shared VM structure.
795 * @param pVCpu The virtual CPU handle.
796 * @param pRegFrame Pointer to the registre frame for the trap.
797 * This will be updated on successful return.
798 */
799DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
800{
801 STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
802
803 if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
804 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
805
806 uint64_t uTicks = TMCpuTickGet(pVCpu);
807 pRegFrame->eax = uTicks;
808 pRegFrame->edx = uTicks >> 32;
809 pRegFrame->eip += 2;
810 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
811}
812
813
814/**
815 * \#GP (General Protection Fault) handler.
816 *
817 * @returns VBox status code.
818 * VINF_SUCCESS means we completely handled this trap,
819 * other codes are passed execution to host context.
820 *
821 * @param pVM The VM handle.
822 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
823 * @param pRegFrame Pointer to the register frame for the trap.
824 */
825static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
826{
827 LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv\n", pRegFrame->ss, pRegFrame->eip, pTrpmCpu->uActiveErrorCode));
828 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
829
830 /*
831 * Convert and validate CS.
832 */
833 STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
834 RTGCPTR PC;
835 uint32_t cBits;
836 int rc = SELMValidateAndConvertCSAddrGCTrap(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs,
837 (RTGCPTR)pRegFrame->eip, &PC, &cBits);
838 if (RT_FAILURE(rc))
839 {
840 Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
841 pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
842 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
843 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
844 }
845
846 /*
847 * Optimize RDTSC traps.
848 * Some guests (like Solaris) are using RDTSC all over the place and
849 * will end up trapping a *lot* because of that.
850 */
851 if ( !pRegFrame->eflags.Bits.u1VM
852 && ((uint8_t *)PC)[0] == 0x0f
853 && ((uint8_t *)PC)[1] == 0x31)
854 {
855 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
856 return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
857 }
858
859 /*
860 * Disassemble the instruction.
861 */
862 DISCPUSTATE Cpu;
863 uint32_t cbOp;
864 rc = DISCoreOneEx((RTGCUINTPTR)PC, cBits == 32 ? CPUMODE_32BIT : cBits == 16 ? CPUMODE_16BIT : CPUMODE_64BIT,
865 NULL, NULL, &Cpu, &cbOp);
866 if (RT_FAILURE(rc))
867 {
868 AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
869 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
870 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
871 }
872 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
873
874 /*
875 * Deal with I/O port access.
876 */
877 if ( pVCpu->trpm.s.uActiveErrorCode == 0
878 && (Cpu.pCurInstr->optype & OPTYPE_PORTIO))
879 {
880 rc = EMInterpretPortIO(pVM, pVCpu, pRegFrame, &Cpu, cbOp);
881 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
882 }
883
884 /*
885 * Deal with Ring-0 (privileged instructions)
886 */
887 if ( (pRegFrame->ss & X86_SEL_RPL) <= 1
888 && !pRegFrame->eflags.Bits.u1VM)
889 return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
890
891 /*
892 * Deal with Ring-3 GPs.
893 */
894 if (!pRegFrame->eflags.Bits.u1VM)
895 return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
896
897 /*
898 * Deal with v86 code.
899 *
900 * We always set IOPL to zero which makes e.g. pushf fault in V86
901 * mode. The guest might use IOPL=3 and therefore not expect a #GP.
902 * Simply fall back to the recompiler to emulate this instruction if
903 * that's the case. To get the correct we must use CPUMRawGetEFlags.
904 */
905 X86EFLAGS eflags;
906 eflags.u32 = CPUMRawGetEFlags(pVCpu, pRegFrame); /* Get the correct value. */
907 Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
908 if (eflags.Bits.u2IOPL != 3)
909 {
910 Assert(eflags.Bits.u2IOPL == 0);
911
912 int rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
913 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
914 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
915 }
916 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
917}
918
919
920/**
921 * \#GP (General Protection Fault) handler.
922 *
923 * @returns VBox status code.
924 * VINF_SUCCESS means we completely handled this trap,
925 * other codes are passed execution to host context.
926 *
927 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
928 * @param pRegFrame Pointer to the register frame for the trap.
929 * @internal
930 */
931DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
932{
933 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
934 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
935
936 LogFlow(("TRPMGC0d: %04x:%08x err=%x\n", pRegFrame->cs, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode));
937
938 int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
939 switch (rc)
940 {
941 case VINF_EM_RAW_GUEST_TRAP:
942 case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
943 if (PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
944 rc = VINF_PATM_PATCH_TRAP_GP;
945 break;
946
947 case VINF_EM_RAW_INTERRUPT_PENDING:
948 Assert(TRPMHasTrap(pVCpu));
949 /* no break; */
950 case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
951 case VINF_EM_RAW_EMULATE_INSTR:
952 case VINF_IOM_HC_IOPORT_READ:
953 case VINF_IOM_HC_IOPORT_WRITE:
954 case VINF_IOM_HC_MMIO_WRITE:
955 case VINF_IOM_HC_MMIO_READ:
956 case VINF_IOM_HC_MMIO_READ_WRITE:
957 case VINF_PATM_PATCH_INT3:
958 case VINF_EM_NO_MEMORY:
959 case VINF_EM_RAW_TO_R3:
960 case VINF_EM_RAW_TIMER_PENDING:
961 case VINF_EM_PENDING_REQUEST:
962 case VINF_EM_HALT:
963 case VINF_SUCCESS:
964 break;
965
966 default:
967 AssertMsg(PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip) == false, ("return code %d\n", rc));
968 break;
969 }
970 Log6(("TRPMGC0d: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
971 return rc;
972}
973
974
975/**
976 * \#PF (Page Fault) handler.
977 *
978 * Calls PGM which does the actual handling.
979 *
980 *
981 * @returns VBox status code.
982 * VINF_SUCCESS means we completely handled this trap,
983 * other codes are passed execution to host context.
984 *
985 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
986 * @param pRegFrame Pointer to the register frame for the trap.
987 * @internal
988 */
989DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
990{
991 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
992 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
993
994 LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x\n", pRegFrame->cs, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2));
995
996 /*
997 * This is all PGM stuff.
998 */
999 int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1000 switch (rc)
1001 {
1002 case VINF_EM_RAW_EMULATE_INSTR:
1003 case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
1004 case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1005 case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1006 case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1007 case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1008 if (PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
1009 rc = VINF_PATCH_EMULATE_INSTR;
1010 break;
1011
1012 case VINF_EM_RAW_GUEST_TRAP:
1013 if (PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip))
1014 return VINF_PATM_PATCH_TRAP_PF;
1015
1016 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1017 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1018 break;
1019
1020 case VINF_EM_RAW_INTERRUPT_PENDING:
1021 Assert(TRPMHasTrap(pVCpu));
1022 /* no break; */
1023 case VINF_IOM_HC_MMIO_READ:
1024 case VINF_IOM_HC_MMIO_WRITE:
1025 case VINF_IOM_HC_MMIO_READ_WRITE:
1026 case VINF_PATM_HC_MMIO_PATCH_READ:
1027 case VINF_PATM_HC_MMIO_PATCH_WRITE:
1028 case VINF_SUCCESS:
1029 case VINF_EM_RAW_TO_R3:
1030 case VINF_EM_PENDING_REQUEST:
1031 case VINF_EM_RAW_TIMER_PENDING:
1032 case VINF_EM_NO_MEMORY:
1033 case VINF_CSAM_PENDING_ACTION:
1034 case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1035 break;
1036
1037 default:
1038 AssertMsg(PATMIsPatchGCAddr(pVM, (RTRCPTR)pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1039 break;
1040 }
1041 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1042 Log6(("TRPMGC0e: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
1043 return rc;
1044}
1045
1046
1047/**
1048 * Scans for the EIP in the specified array of trap handlers.
1049 *
1050 * If we don't fine the EIP, we'll panic.
1051 *
1052 * @returns VBox status code.
1053 *
1054 * @param pVM The VM handle.
1055 * @param pRegFrame Pointer to the register frame for the trap.
1056 * @param paHandlers The array of trap handler records.
1057 * @param pEndRecord The end record (exclusive).
1058 */
1059static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1060{
1061 uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1062 Assert(paHandlers <= pEndRecord);
1063
1064 Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1065
1066#if 0 /// @todo later
1067 /*
1068 * Start by doing a kind of binary search.
1069 */
1070 unsigned iStart = 0;
1071 unsigned iEnd = pEndRecord - paHandlers;
1072 unsigned i = iEnd / 2;
1073#endif
1074
1075 /*
1076 * Do a linear search now (in case the array wasn't properly sorted).
1077 */
1078 for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1079 {
1080 if ( pCur->uStartEIP <= uEip
1081 && (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1082 return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1083 }
1084
1085 return VERR_TRPM_DONT_PANIC;
1086}
1087
1088
1089/**
1090 * Hypervisor \#NP ((segment) Not Present) handler.
1091 *
1092 * Scans for the EIP in the registered trap handlers.
1093 *
1094 * @returns VBox status code.
1095 * VINF_SUCCESS means we completely handled this trap,
1096 * other codes are passed back to host context.
1097 *
1098 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1099 * @param pRegFrame Pointer to the register frame for the trap.
1100 * @internal
1101 */
1102DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1103{
1104 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1105}
1106
1107
1108/**
1109 * Hypervisor \#GP (General Protection Fault) handler.
1110 *
1111 * Scans for the EIP in the registered trap handlers.
1112 *
1113 * @returns VBox status code.
1114 * VINF_SUCCESS means we completely handled this trap,
1115 * other codes are passed back to host context.
1116 *
1117 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1118 * @param pRegFrame Pointer to the register frame for the trap.
1119 * @internal
1120 */
1121DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1122{
1123 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1124}
1125
1126
1127/**
1128 * Hypervisor \#PF (Page Fault) handler.
1129 *
1130 * Scans for the EIP in the registered trap handlers.
1131 *
1132 * @returns VBox status code.
1133 * VINF_SUCCESS means we completely handled this trap,
1134 * other codes are passed back to host context.
1135 *
1136 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1137 * @param pRegFrame Pointer to the register frame for the trap.
1138 * @internal
1139 */
1140DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1141{
1142 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1143}
1144
1145
1146/**
1147 * Deal with hypervisor traps occuring when resuming execution on a trap.
1148 *
1149 * @returns VBox status code.
1150 * @param pVM The VM handle.
1151 * @param pRegFrame Register frame.
1152 * @param uUser User arg.
1153 */
1154DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1155{
1156 Log(("********************************************************\n"));
1157 Log(("trpmGCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1158 Log(("********************************************************\n"));
1159
1160 if (uUser & TRPM_TRAP_IN_HYPER)
1161 {
1162 /*
1163 * Check that there is still some stack left, if not we'll flag
1164 * a guru meditation (the alternative is a triple fault).
1165 */
1166 RTRCUINTPTR cbStackUsed = (RTRCUINTPTR)VMMGetStackRC(pVM) - pRegFrame->esp;
1167 if (cbStackUsed > VMM_STACK_SIZE - _1K)
1168 {
1169 LogRel(("trpmGCTrapInGeneric: ran out of stack: esp=#x cbStackUsed=%#x\n", pRegFrame->esp, cbStackUsed));
1170 return VERR_TRPM_DONT_PANIC;
1171 }
1172
1173 /*
1174 * Just zero the register containing the selector in question.
1175 * We'll deal with the actual stale or troublesome selector value in
1176 * the outermost trap frame.
1177 */
1178 switch (uUser & TRPM_TRAP_IN_OP_MASK)
1179 {
1180 case TRPM_TRAP_IN_MOV_GS:
1181 pRegFrame->eax = 0;
1182 pRegFrame->gs = 0; /* prevent recursive trouble. */
1183 break;
1184 case TRPM_TRAP_IN_MOV_FS:
1185 pRegFrame->eax = 0;
1186 pRegFrame->fs = 0; /* prevent recursive trouble. */
1187 return VINF_SUCCESS;
1188
1189 default:
1190 AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1191 return VERR_INTERNAL_ERROR;
1192 }
1193 }
1194 else
1195 {
1196 /*
1197 * Reconstruct the guest context and switch to the recompiler.
1198 * We ASSUME we're only at
1199 */
1200 CPUMCTXCORE CtxCore = *pRegFrame;
1201 uint32_t *pEsp = (uint32_t *)pRegFrame->esp;
1202 int rc;
1203
1204 switch (uUser)
1205 {
1206 /*
1207 * This will only occur when resuming guest code in a trap handler!
1208 */
1209 /* @note ASSUMES esp points to the temporary guest CPUMCTXCORE!!! */
1210 case TRPM_TRAP_IN_MOV_GS:
1211 case TRPM_TRAP_IN_MOV_FS:
1212 case TRPM_TRAP_IN_MOV_ES:
1213 case TRPM_TRAP_IN_MOV_DS:
1214 {
1215 PCPUMCTXCORE pTempGuestCtx = (PCPUMCTXCORE)pEsp;
1216
1217 /* Just copy the whole thing; several selector registers, eip (etc) and eax are not yet in pRegFrame. */
1218 CtxCore = *pTempGuestCtx;
1219 rc = VINF_EM_RAW_STALE_SELECTOR;
1220 break;
1221 }
1222
1223 /*
1224 * This will only occur when resuming guest code!
1225 */
1226 case TRPM_TRAP_IN_IRET:
1227 CtxCore.eip = *pEsp++;
1228 CtxCore.cs = (RTSEL)*pEsp++;
1229 CtxCore.eflags.u32 = *pEsp++;
1230 CtxCore.esp = *pEsp++;
1231 CtxCore.ss = (RTSEL)*pEsp++;
1232 rc = VINF_EM_RAW_IRET_TRAP;
1233 break;
1234
1235 /*
1236 * This will only occur when resuming V86 guest code!
1237 */
1238 case TRPM_TRAP_IN_IRET | TRPM_TRAP_IN_V86:
1239 CtxCore.eip = *pEsp++;
1240 CtxCore.cs = (RTSEL)*pEsp++;
1241 CtxCore.eflags.u32 = *pEsp++;
1242 CtxCore.esp = *pEsp++;
1243 CtxCore.ss = (RTSEL)*pEsp++;
1244 CtxCore.es = (RTSEL)*pEsp++;
1245 CtxCore.ds = (RTSEL)*pEsp++;
1246 CtxCore.fs = (RTSEL)*pEsp++;
1247 CtxCore.gs = (RTSEL)*pEsp++;
1248 rc = VINF_EM_RAW_IRET_TRAP;
1249 break;
1250
1251 default:
1252 AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1253 return VERR_INTERNAL_ERROR;
1254 }
1255
1256
1257 CPUMSetGuestCtxCore(VMMGetCpu0(pVM), &CtxCore);
1258 TRPMGCHyperReturnToHost(pVM, rc);
1259 }
1260
1261 AssertMsgFailed(("Impossible!\n"));
1262 return VERR_INTERNAL_ERROR;
1263}
1264
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette