VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp@ 32484

Last change on this file since 32484 was 32459, checked in by vboxsync, 14 years ago

VMM/raw: Heed VM_FF_REQUEST and VMCPU_FF_REQUEST before checking for interrupts and synccr3 actions since these two might not return to ring-3.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 50.6 KB
Line 
1/* $Id: TRPMGCHandlers.cpp 32459 2010-09-13 16:36:11Z vboxsync $ */
2/** @file
3 * TRPM - Guest Context Trap Handlers, CPP part
4 */
5
6/*
7 * Copyright (C) 2006-2007 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_TRPM
23#include <VBox/selm.h>
24#include <VBox/iom.h>
25#include <VBox/pgm.h>
26#include <VBox/pdmapi.h>
27#include <VBox/dbgf.h>
28#include <VBox/em.h>
29#include <VBox/csam.h>
30#include <VBox/patm.h>
31#include <VBox/mm.h>
32#include <VBox/cpum.h>
33#include "TRPMInternal.h"
34#include <VBox/vm.h>
35#include <VBox/vmm.h>
36#include <VBox/param.h>
37
38#include <VBox/err.h>
39#include <VBox/dis.h>
40#include <VBox/disopcode.h>
41#include <VBox/x86.h>
42#include <VBox/log.h>
43#include <VBox/tm.h>
44#include <iprt/asm.h>
45#include <iprt/asm-amd64-x86.h>
46#include <iprt/assert.h>
47
48
49/*******************************************************************************
50* Defined Constants And Macros *
51*******************************************************************************/
52/* still here. MODR/M byte parsing */
53#define X86_OPCODE_MODRM_MOD_MASK 0xc0
54#define X86_OPCODE_MODRM_REG_MASK 0x38
55#define X86_OPCODE_MODRM_RM_MASK 0x07
56
57/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
58#define DTRACE_EXPERIMENT
59
60
61/*******************************************************************************
62* Structures and Typedefs *
63*******************************************************************************/
64/** Pointer to a readonly hypervisor trap record. */
65typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
66
67/**
68 * A hypervisor trap record.
69 * This contains information about a handler for a instruction range.
70 *
71 * @remark This must match what TRPM_HANDLER outputs.
72 */
73typedef struct TRPMGCHYPER
74{
75 /** The start address. */
76 uintptr_t uStartEIP;
77 /** The end address. (exclusive)
78 * If NULL the it's only for the instruction at pvStartEIP. */
79 uintptr_t uEndEIP;
80 /**
81 * The handler.
82 *
83 * @returns VBox status code
84 * VINF_SUCCESS means we've handled the trap.
85 * Any other error code means returning to the host context.
86 * @param pVM The VM handle.
87 * @param pRegFrame The register frame.
88 * @param uUser The user argument.
89 */
90 DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
91 /** Whatever the handler desires to put here. */
92 uintptr_t uUser;
93} TRPMGCHYPER;
94
95
96/*******************************************************************************
97* Global Variables *
98*******************************************************************************/
99RT_C_DECLS_BEGIN
100/** Defined in VMMGC0.asm or VMMGC99.asm.
101 * @{ */
102extern const TRPMGCHYPER g_aTrap0bHandlers[1];
103extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
104extern const TRPMGCHYPER g_aTrap0dHandlers[1];
105extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
106extern const TRPMGCHYPER g_aTrap0eHandlers[1];
107extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
108/** @} */
109RT_C_DECLS_END
110
111
112/*******************************************************************************
113* Internal Functions *
114*******************************************************************************/
115RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
116DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
117RT_C_DECLS_END
118
119
120
121/**
122 * Exits the trap, called when exiting a trap handler.
123 *
124 * Will reset the trap if it's not a guest trap or the trap
125 * is already handled. Will process resume guest FFs.
126 *
127 * @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
128 * happened.
129 * @param pVM VM handle.
130 * @param pVCpu The virtual CPU handle.
131 * @param rc The VBox status code to return.
132 * @param pRegFrame Pointer to the register frame for the trap.
133 *
134 * @remarks This must not be used for hypervisor traps, only guest traps.
135 */
136static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
137{
138 uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
139 NOREF(uOldActiveVector);
140
141 /* Reset trap? */
142 if ( rc != VINF_EM_RAW_GUEST_TRAP
143 && rc != VINF_EM_RAW_RING_SWITCH_INT)
144 pVCpu->trpm.s.uActiveVector = ~0;
145
146#ifdef VBOX_HIGH_RES_TIMERS_HACK
147 /*
148 * We should poll the timers occationally.
149 * We must *NOT* do this too frequently as it adds a significant overhead
150 * and it'll kill us if the trap load is high. (See #1354.)
151 * (The heuristic is not very intelligent, we should really check trap
152 * frequency etc. here, but alas, we lack any such information atm.)
153 */
154 static unsigned s_iTimerPoll = 0;
155 if (rc == VINF_SUCCESS)
156 {
157 if (!(++s_iTimerPoll & 0xf))
158 {
159 TMTimerPollVoid(pVM, pVCpu);
160 Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
161 VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER)));
162 }
163 }
164 else
165 s_iTimerPoll = 0;
166#endif
167
168 /* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
169 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
170 {
171 Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
172 if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
173 {
174 /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
175 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
176 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
177 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
178 */
179 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
180 }
181 }
182
183 /*
184 * Pending resume-guest-FF?
185 * Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
186 */
187 if ( rc == VINF_SUCCESS
188 && ( VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC | VM_FF_REQUEST | VM_FF_PGM_NO_MEMORY | VM_FF_PDM_DMA)
189 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER | VMCPU_FF_TO_R3 | VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC | VMCPU_FF_REQUEST | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
190 )
191 )
192 {
193 /* The out of memory condition naturally outrang the others. */
194 if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
195 rc = VINF_EM_NO_MEMORY;
196 /* Pending Ring-3 action. */
197 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TO_R3))
198 {
199 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
200 rc = VINF_EM_RAW_TO_R3;
201 }
202 /* Pending timer action. */
203 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER))
204 rc = VINF_EM_RAW_TIMER_PENDING;
205 /* The Virtual Sync clock has stopped. */
206 else if (VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
207 rc = VINF_EM_RAW_TO_R3;
208 /* DMA work pending? */
209 else if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA))
210 rc = VINF_EM_RAW_TO_R3;
211 /* Pending request packets might contain actions that need immediate
212 attention, such as pending hardware interrupts. */
213 else if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
214 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
215 rc = VINF_EM_PENDING_REQUEST;
216 /* Pending interrupt: dispatch it. */
217 else if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
218 && !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
219 && PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
220 )
221 {
222 uint8_t u8Interrupt;
223 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
224 Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
225 AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
226 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
227 /* can't return if successful */
228 Assert(rc != VINF_SUCCESS);
229
230 /* Stop the profile counter that was started in TRPMGCHandlersA.asm */
231 Assert(uOldActiveVector <= 16);
232 STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
233
234 /* Assert the trap and go to the recompiler to dispatch it. */
235 TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
236
237 STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
238 rc = VINF_EM_RAW_INTERRUPT_PENDING;
239 }
240 /*
241 * Try sync CR3?
242 */
243 else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
244 {
245#if 1
246 PGMRZDynMapReleaseAutoSet(pVCpu);
247 PGMRZDynMapStartAutoSet(pVCpu);
248 rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
249#else
250 rc = VINF_PGM_SYNC_CR3;
251#endif
252 }
253 }
254
255 AssertMsg( rc != VINF_SUCCESS
256 || ( pRegFrame->eflags.Bits.u1IF
257 && ( pRegFrame->eflags.Bits.u2IOPL < (unsigned)(pRegFrame->ss & X86_SEL_RPL) || pRegFrame->eflags.Bits.u1VM))
258 , ("rc=%Rrc\neflags=%RX32 ss=%RTsel IOPL=%d\n", rc, pRegFrame->eflags.u32, pRegFrame->ss, pRegFrame->eflags.Bits.u2IOPL));
259 PGMRZDynMapReleaseAutoSet(pVCpu);
260 return rc;
261}
262
263
264/**
265 * \#DB (Debug event) handler.
266 *
267 * @returns VBox status code.
268 * VINF_SUCCESS means we completely handled this trap,
269 * other codes are passed execution to host context.
270 *
271 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
272 * @param pRegFrame Pointer to the register frame for the trap.
273 * @internal
274 */
275DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
276{
277 RTGCUINTREG uDr6 = ASMGetAndClearDR6();
278 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
279 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
280
281 LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs, pRegFrame->eip, uDr6));
282
283 /*
284 * We currently don't make use of the X86_DR7_GD bit, but
285 * there might come a time when we do.
286 */
287 AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
288 ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
289 ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
290 VERR_NOT_IMPLEMENTED);
291 AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
292
293 /*
294 * Now leave the rest to the DBGF.
295 */
296 PGMRZDynMapStartAutoSet(pVCpu);
297 int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
298 if (rc == VINF_EM_RAW_GUEST_TRAP)
299 CPUMSetGuestDR6(pVCpu, uDr6);
300
301 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
302 Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs, pRegFrame->eip, uDr6));
303 return rc;
304}
305
306
307/**
308 * \#DB (Debug event) handler for the hypervisor code.
309 *
310 * This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
311 * mapping set as well as the default trap exit path since they are both really
312 * bad ideas in this context.
313 *
314 * @returns VBox status code.
315 * VINF_SUCCESS means we completely handled this trap,
316 * other codes are passed execution to host context.
317 *
318 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
319 * @param pRegFrame Pointer to the register frame for the trap.
320 * @internal
321 */
322DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
323{
324 RTGCUINTREG uDr6 = ASMGetAndClearDR6();
325 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
326 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
327
328 LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs, pRegFrame->eip, uDr6));
329
330 /*
331 * We currently don't make use of the X86_DR7_GD bit, but
332 * there might come a time when we do.
333 */
334 AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
335 ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
336 ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
337 VERR_NOT_IMPLEMENTED);
338 AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
339
340 /*
341 * Now leave the rest to the DBGF.
342 */
343 int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
344 AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_INTERNAL_ERROR_3);
345
346 Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs, pRegFrame->eip, uDr6));
347 return rc;
348}
349
350
351/**
352 * NMI handler, for when we are using NMIs to debug things.
353 *
354 * @returns VBox status code.
355 * VINF_SUCCESS means we completely handled this trap,
356 * other codes are passed execution to host context.
357 *
358 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
359 * @param pRegFrame Pointer to the register frame for the trap.
360 * @internal
361 * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
362 */
363DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
364{
365 LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
366 RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip);
367 return VERR_TRPM_DONT_PANIC;
368}
369
370
371/**
372 * NMI handler, for when we are using NMIs to debug things.
373 *
374 * This is the handler we're most likely to hit when the NMI fires (it is
375 * unlikely that we'll be stuck in guest code).
376 *
377 * @returns VBox status code.
378 * VINF_SUCCESS means we completely handled this trap,
379 * other codes are passed execution to host context.
380 *
381 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
382 * @param pRegFrame Pointer to the register frame for the trap.
383 * @internal
384 * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
385 */
386DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
387{
388 LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
389 RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs, pRegFrame->eip);
390 return VERR_TRPM_DONT_PANIC;
391}
392
393
394/**
395 * \#BP (Breakpoint) handler.
396 *
397 * @returns VBox status code.
398 * VINF_SUCCESS means we completely handled this trap,
399 * other codes are passed execution to host context.
400 *
401 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
402 * @param pRegFrame Pointer to the register frame for the trap.
403 * @internal
404 */
405DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
406{
407 LogFlow(("TRPMGC03: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
408 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
409 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
410 int rc;
411 PGMRZDynMapStartAutoSet(pVCpu);
412
413 /*
414 * PATM is using INT3s, let them have a go first.
415 */
416 if ( (pRegFrame->ss & X86_SEL_RPL) == 1
417 && !pRegFrame->eflags.Bits.u1VM)
418 {
419 rc = PATMHandleInt3PatchTrap(pVM, pRegFrame);
420 if (rc == VINF_SUCCESS || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_PATM_PATCH_INT3 || rc == VINF_PATM_DUPLICATE_FUNCTION)
421 {
422 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
423 Log6(("TRPMGC03: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs, pRegFrame->eip));
424 return rc;
425 }
426 }
427 rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
428
429 /* anything we should do with this? Schedule it in GC? */
430 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
431 Log6(("TRPMGC03: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
432 return rc;
433}
434
435
436/**
437 * \#BP (Breakpoint) handler.
438 *
439 * This is similar to TRPMGCTrap03Handler but we bits which are potentially
440 * harmful to us (common trap exit and the auto mapping set).
441 *
442 * @returns VBox status code.
443 * VINF_SUCCESS means we completely handled this trap,
444 * other codes are passed execution to host context.
445 *
446 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
447 * @param pRegFrame Pointer to the register frame for the trap.
448 * @internal
449 */
450DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
451{
452 LogFlow(("TRPMGCHyper03: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
453 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
454 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
455
456 /*
457 * Hand it over to DBGF.
458 */
459 int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
460 AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_INTERNAL_ERROR_3);
461
462 Log6(("TRPMGCHyper03: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
463 return rc;
464}
465
466
467/**
468 * Trap handler for illegal opcode fault (\#UD).
469 *
470 * @returns VBox status code.
471 * VINF_SUCCESS means we completely handled this trap,
472 * other codes are passed execution to host context.
473 *
474 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
475 * @param pRegFrame Pointer to the register frame for the trap.
476 * @internal
477 */
478DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
479{
480 LogFlow(("TRPMGC06: %04x:%08x efl=%x\n", pRegFrame->cs, pRegFrame->eip, pRegFrame->eflags.u32));
481 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
482 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
483 int rc;
484 PGMRZDynMapStartAutoSet(pVCpu);
485
486 if (CPUMGetGuestCPL(pVCpu, pRegFrame) == 0)
487 {
488 /*
489 * Decode the instruction.
490 */
491 RTGCPTR PC;
492 rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid,
493 (RTGCPTR)pRegFrame->eip, &PC);
494 if (RT_FAILURE(rc))
495 {
496 Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
497 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
498 Log6(("TRPMGC06: %Rrc (%04x:%08x) (SELM)\n", rc, pRegFrame->cs, pRegFrame->eip));
499 return rc;
500 }
501
502 DISCPUSTATE Cpu;
503 uint32_t cbOp;
504 rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
505 if (RT_FAILURE(rc))
506 {
507 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
508 Log6(("TRPMGC06: %Rrc (%04x:%08x) (EM)\n", rc, pRegFrame->cs, pRegFrame->eip));
509 return rc;
510 }
511
512 /*
513 * UD2 in a patch?
514 * Note! PATMGCHandleIllegalInstrTrap doesn't always return.
515 */
516 if ( Cpu.pCurInstr->opcode == OP_ILLUD2
517 && PATMIsPatchGCAddr(pVM, pRegFrame->eip))
518 {
519 LogFlow(("TRPMGCTrap06Handler: -> PATMGCHandleIllegalInstrTrap\n"));
520 rc = PATMGCHandleIllegalInstrTrap(pVM, pRegFrame);
521 /** @todo These tests are completely unnecessary, should just follow the
522 * flow and return at the end of the function. */
523 if ( rc == VINF_SUCCESS
524 || rc == VINF_EM_RAW_EMULATE_INSTR
525 || rc == VINF_PATM_DUPLICATE_FUNCTION
526 || rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
527 || rc == VINF_EM_RESCHEDULE)
528 {
529 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
530 Log6(("TRPMGC06: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs, pRegFrame->eip));
531 return rc;
532 }
533 }
534 /*
535 * Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
536 */
537 else if (Cpu.prefix & PREFIX_LOCK)
538 {
539 Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->opcode));
540#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
541 Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
542 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
543 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
544#else
545 rc = VINF_EM_RAW_EMULATE_INSTR;
546#endif
547 }
548 /*
549 * Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
550 */
551 else if (Cpu.pCurInstr->opcode == OP_MONITOR)
552 {
553 LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
554 uint32_t cbIgnored;
555 rc = EMInterpretInstructionCPU(pVM, pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR, &cbIgnored);
556 if (RT_SUCCESS(rc))
557 pRegFrame->eip += Cpu.opsize;
558 }
559 /* Never generate a raw trap here; it might be an instruction, that requires emulation. */
560 else
561 {
562 LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
563 rc = VINF_EM_RAW_EMULATE_INSTR;
564 }
565 }
566 else
567 {
568 LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
569 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
570 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
571 }
572
573 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
574 Log6(("TRPMGC06: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
575 return rc;
576}
577
578
579/**
580 * Trap handler for device not present fault (\#NM).
581 *
582 * Device not available, FP or (F)WAIT instruction.
583 *
584 * @returns VBox status code.
585 * VINF_SUCCESS means we completely handled this trap,
586 * other codes are passed execution to host context.
587 *
588 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
589 * @param pRegFrame Pointer to the register frame for the trap.
590 * @internal
591 */
592DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
593{
594 LogFlow(("TRPMGC07: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
595 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
596 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
597 PGMRZDynMapStartAutoSet(pVCpu);
598
599 int rc = CPUMHandleLazyFPU(pVCpu);
600 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
601 Log6(("TRPMGC07: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
602 return rc;
603}
604
605
606/**
607 * \#NP ((segment) Not Present) handler.
608 *
609 * @returns VBox status code.
610 * VINF_SUCCESS means we completely handled this trap,
611 * other codes are passed execution to host context.
612 *
613 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
614 * @param pRegFrame Pointer to the register frame for the trap.
615 * @internal
616 */
617DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
618{
619 LogFlow(("TRPMGC0b: %04x:%08x\n", pRegFrame->cs, pRegFrame->eip));
620 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
621 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
622 PGMRZDynMapStartAutoSet(pVCpu);
623
624 /*
625 * Try to detect instruction by opcode which caused trap.
626 * XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
627 * accessing user code. need to handle it somehow in future!
628 */
629 RTGCPTR GCPtr;
630 if ( SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid,
631 (RTGCPTR)pRegFrame->eip, &GCPtr)
632 == VINF_SUCCESS)
633 {
634 uint8_t *pu8Code = (uint8_t *)(uintptr_t)GCPtr;
635
636 /*
637 * First skip possible instruction prefixes, such as:
638 * OS, AS
639 * CS:, DS:, ES:, SS:, FS:, GS:
640 * REPE, REPNE
641 *
642 * note: Currently we supports only up to 4 prefixes per opcode, more
643 * prefixes (normally not used anyway) will cause trap d in guest.
644 * note: Instruction length in IA-32 may be up to 15 bytes, we dont
645 * check this issue, its too hard.
646 */
647 for (unsigned i = 0; i < 4; i++)
648 {
649 if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
650 && pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
651 && pu8Code[0] != 0x2e /* CS: */
652 && pu8Code[0] != 0x36 /* SS: */
653 && pu8Code[0] != 0x3e /* DS: */
654 && pu8Code[0] != 0x26 /* ES: */
655 && pu8Code[0] != 0x64 /* FS: */
656 && pu8Code[0] != 0x65 /* GS: */
657 && pu8Code[0] != 0x66 /* OS */
658 && pu8Code[0] != 0x67 /* AS */
659 )
660 break;
661 pu8Code++;
662 }
663
664 /*
665 * Detect right switch using a callgate.
666 *
667 * We recognize the following causes for the trap 0b:
668 * CALL FAR, CALL FAR []
669 * JMP FAR, JMP FAR []
670 * IRET (may cause a task switch)
671 *
672 * Note: we can't detect whether the trap was caused by a call to a
673 * callgate descriptor or it is a real trap 0b due to a bad selector.
674 * In both situations we'll pass execution to our recompiler so we don't
675 * have to worry.
676 * If we wanted to do better detection, we have set GDT entries to callgate
677 * descriptors pointing to our own handlers.
678 */
679 /** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
680 if ( pu8Code[0] == 0x9a /* CALL FAR */
681 || ( pu8Code[0] == 0xff /* CALL FAR [] */
682 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
683 || pu8Code[0] == 0xea /* JMP FAR */
684 || ( pu8Code[0] == 0xff /* JMP FAR [] */
685 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
686 || pu8Code[0] == 0xcf /* IRET */
687 )
688 {
689 /*
690 * Got potential call to callgate.
691 * We simply return execution to the recompiler to do emulation
692 * starting from the instruction which caused the trap.
693 */
694 pTrpmCpu->uActiveVector = ~0;
695 Log6(("TRPMGC0b: %Rrc (%04x:%08x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs, pRegFrame->eip));
696 PGMRZDynMapReleaseAutoSet(pVCpu);
697 return VINF_EM_RAW_RING_SWITCH;
698 }
699 }
700
701 /*
702 * Pass trap 0b as is to the recompiler in all other cases.
703 */
704 Log6(("TRPMGC0b: %Rrc (%04x:%08x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs, pRegFrame->eip));
705 PGMRZDynMapReleaseAutoSet(pVCpu);
706 return VINF_EM_RAW_GUEST_TRAP;
707}
708
709
710/**
711 * \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
712 *
713 * @returns VBox status code.
714 * VINF_SUCCESS means we completely handled this trap,
715 * other codes are passed execution to host context.
716 *
717 * @param pVM The VM handle.
718 * @param pVCpu The virtual CPU handle.
719 * @param pRegFrame Pointer to the register frame for the trap.
720 * @param pCpu The opcode info.
721 * @param PC The program counter corresponding to cs:eip in pRegFrame.
722 */
723static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
724{
725 int rc;
726
727 /*
728 * Try handle it here, if not return to HC and emulate/interpret it there.
729 */
730 switch (pCpu->pCurInstr->opcode)
731 {
732 case OP_INT3:
733 /*
734 * Little hack to make the code below not fail
735 */
736 pCpu->param1.flags = USE_IMMEDIATE8;
737 pCpu->param1.parval = 3;
738 /* fallthru */
739 case OP_INT:
740 {
741 Assert(pCpu->param1.flags & USE_IMMEDIATE8);
742 Assert(!(PATMIsPatchGCAddr(pVM, PC)));
743 if (pCpu->param1.parval == 3)
744 {
745 /* Int 3 replacement patch? */
746 if (PATMHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
747 {
748 AssertFailed();
749 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
750 }
751 }
752 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
753 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
754 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
755
756 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
757 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
758 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
759 }
760
761#ifdef PATM_EMULATE_SYSENTER
762 case OP_SYSEXIT:
763 case OP_SYSRET:
764 rc = PATMSysCall(pVM, pRegFrame, pCpu);
765 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
766#endif
767
768 case OP_HLT:
769 /* If it's in patch code, defer to ring-3. */
770 if (PATMIsPatchGCAddr(pVM, PC))
771 break;
772
773 pRegFrame->eip += pCpu->opsize;
774 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
775
776
777 /*
778 * These instructions are used by PATM and CASM for finding
779 * dangerous non-trapping instructions. Thus, since all
780 * scanning and patching is done in ring-3 we'll have to
781 * return to ring-3 on the first encounter of these instructions.
782 */
783 case OP_MOV_CR:
784 case OP_MOV_DR:
785 /* We can safely emulate control/debug register move instructions in patched code. */
786 if ( !PATMIsPatchGCAddr(pVM, PC)
787 && !CSAMIsKnownDangerousInstr(pVM, PC))
788 break;
789 case OP_INVLPG:
790 case OP_LLDT:
791 case OP_STI:
792 case OP_RDTSC: /* just in case */
793 case OP_RDPMC:
794 case OP_CLTS:
795 case OP_WBINVD: /* nop */
796 case OP_RDMSR:
797 case OP_WRMSR:
798 {
799 uint32_t cbIgnored;
800 rc = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR, &cbIgnored);
801 if (RT_SUCCESS(rc))
802 pRegFrame->eip += pCpu->opsize;
803 else if (rc == VERR_EM_INTERPRETER)
804 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
805 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
806 }
807 }
808
809 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
810}
811
812
813/**
814 * \#GP (General Protection Fault) handler for Ring-3.
815 *
816 * @returns VBox status code.
817 * VINF_SUCCESS means we completely handled this trap,
818 * other codes are passed execution to host context.
819 *
820 * @param pVM The VM handle.
821 * @param pVCpu The virtual CPU handle.
822 * @param pRegFrame Pointer to the register frame for the trap.
823 * @param pCpu The opcode info.
824 * @param PC The program counter corresponding to cs:eip in pRegFrame.
825 */
826static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
827{
828 int rc;
829 Assert(!pRegFrame->eflags.Bits.u1VM);
830
831 switch (pCpu->pCurInstr->opcode)
832 {
833 /*
834 * INT3 and INT xx are ring-switching.
835 * (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
836 */
837 case OP_INT3:
838 /*
839 * Little hack to make the code below not fail
840 */
841 pCpu->param1.flags = USE_IMMEDIATE8;
842 pCpu->param1.parval = 3;
843 /* fall thru */
844 case OP_INT:
845 {
846 Assert(pCpu->param1.flags & USE_IMMEDIATE8);
847 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
848 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
849 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
850
851 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
852 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
853 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
854 }
855
856 /*
857 * SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
858 */
859 case OP_SYSCALL:
860 case OP_SYSENTER:
861#ifdef PATM_EMULATE_SYSENTER
862 rc = PATMSysCall(pVM, pRegFrame, pCpu);
863 if (rc == VINF_SUCCESS)
864 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
865 /* else no break; */
866#endif
867 case OP_BOUND:
868 case OP_INTO:
869 pVCpu->trpm.s.uActiveVector = ~0;
870 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
871
872 /*
873 * Handle virtualized TSC & PMC reads, just in case.
874 */
875 case OP_RDTSC:
876 case OP_RDPMC:
877 {
878 uint32_t cbIgnored;
879 rc = EMInterpretInstructionCPU(pVM, pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR, &cbIgnored);
880 if (RT_SUCCESS(rc))
881 pRegFrame->eip += pCpu->opsize;
882 else if (rc == VERR_EM_INTERPRETER)
883 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
884 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
885 }
886
887 /*
888 * STI and CLI are I/O privileged, i.e. if IOPL
889 */
890 case OP_STI:
891 case OP_CLI:
892 {
893 uint32_t efl = CPUMRawGetEFlags(pVCpu, pRegFrame);
894 if (X86_EFL_GET_IOPL(efl) >= (unsigned)(pRegFrame->ss & X86_SEL_RPL))
895 {
896 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
897 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
898 }
899 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0)\n"));
900 break;
901 }
902 }
903
904 /*
905 * A genuine guest fault.
906 */
907 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
908}
909
910
911/**
912 * Emulates RDTSC for the \#GP handler.
913 *
914 * @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
915 *
916 * @param pVM Pointer to the shared VM structure.
917 * @param pVCpu The virtual CPU handle.
918 * @param pRegFrame Pointer to the registre frame for the trap.
919 * This will be updated on successful return.
920 */
921DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
922{
923 STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
924
925 if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
926 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
927
928 uint64_t uTicks = TMCpuTickGet(pVCpu);
929 pRegFrame->eax = uTicks;
930 pRegFrame->edx = uTicks >> 32;
931 pRegFrame->eip += 2;
932 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
933}
934
935
936/**
937 * \#GP (General Protection Fault) handler.
938 *
939 * @returns VBox status code.
940 * VINF_SUCCESS means we completely handled this trap,
941 * other codes are passed execution to host context.
942 *
943 * @param pVM The VM handle.
944 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
945 * @param pRegFrame Pointer to the register frame for the trap.
946 */
947static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
948{
949 LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv\n", pRegFrame->ss, pRegFrame->eip, pTrpmCpu->uActiveErrorCode));
950 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
951
952 /*
953 * Convert and validate CS.
954 */
955 STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
956 RTGCPTR PC;
957 uint32_t cBits;
958 int rc = SELMValidateAndConvertCSAddrGCTrap(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs,
959 (RTGCPTR)pRegFrame->eip, &PC, &cBits);
960 if (RT_FAILURE(rc))
961 {
962 Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
963 pRegFrame->cs, pRegFrame->eip, pRegFrame->ss & X86_SEL_RPL, rc));
964 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
965 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
966 }
967
968 /*
969 * Disassemble the instruction.
970 */
971 DISCPUSTATE Cpu;
972 uint32_t cbOp;
973 rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
974 if (RT_FAILURE(rc))
975 {
976 AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
977 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
978 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
979 }
980 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
981
982 /*
983 * Optimize RDTSC traps.
984 * Some guests (like Solaris) are using RDTSC all over the place and
985 * will end up trapping a *lot* because of that.
986 *
987 * Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
988 */
989 if (Cpu.pCurInstr->opcode == OP_RDTSC)
990 return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
991
992 /*
993 * Deal with I/O port access.
994 */
995 if ( pVCpu->trpm.s.uActiveErrorCode == 0
996 && (Cpu.pCurInstr->optype & OPTYPE_PORTIO))
997 {
998 VBOXSTRICTRC rcStrict = EMInterpretPortIO(pVM, pVCpu, pRegFrame, &Cpu, cbOp);
999 rc = VBOXSTRICTRC_TODO(rcStrict);
1000 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1001 }
1002
1003 /*
1004 * Deal with Ring-0 (privileged instructions)
1005 */
1006 if ( (pRegFrame->ss & X86_SEL_RPL) <= 1
1007 && !pRegFrame->eflags.Bits.u1VM)
1008 return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1009
1010 /*
1011 * Deal with Ring-3 GPs.
1012 */
1013 if (!pRegFrame->eflags.Bits.u1VM)
1014 return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1015
1016 /*
1017 * Deal with v86 code.
1018 *
1019 * We always set IOPL to zero which makes e.g. pushf fault in V86
1020 * mode. The guest might use IOPL=3 and therefore not expect a #GP.
1021 * Simply fall back to the recompiler to emulate this instruction if
1022 * that's the case. To get the correct we must use CPUMRawGetEFlags.
1023 */
1024 X86EFLAGS eflags;
1025 eflags.u32 = CPUMRawGetEFlags(pVCpu, pRegFrame); /* Get the correct value. */
1026 Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1027 if (eflags.Bits.u2IOPL != 3)
1028 {
1029 Assert(eflags.Bits.u2IOPL == 0);
1030
1031 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1032 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1033 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1034 }
1035 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1036}
1037
1038
1039/**
1040 * \#GP (General Protection Fault) handler.
1041 *
1042 * @returns VBox status code.
1043 * VINF_SUCCESS means we completely handled this trap,
1044 * other codes are passed execution to host context.
1045 *
1046 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1047 * @param pRegFrame Pointer to the register frame for the trap.
1048 * @internal
1049 */
1050DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1051{
1052 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1053 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1054
1055 LogFlow(("TRPMGC0d: %04x:%08x err=%x\n", pRegFrame->cs, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode));
1056
1057 PGMRZDynMapStartAutoSet(pVCpu);
1058 int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1059 switch (rc)
1060 {
1061 case VINF_EM_RAW_GUEST_TRAP:
1062 case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1063 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1064 rc = VINF_PATM_PATCH_TRAP_GP;
1065 break;
1066
1067 case VINF_EM_RAW_INTERRUPT_PENDING:
1068 Assert(TRPMHasTrap(pVCpu));
1069 /* no break; */
1070 case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1071 case VINF_EM_RAW_EMULATE_INSTR:
1072 case VINF_IOM_HC_IOPORT_READ:
1073 case VINF_IOM_HC_IOPORT_WRITE:
1074 case VINF_IOM_HC_MMIO_WRITE:
1075 case VINF_IOM_HC_MMIO_READ:
1076 case VINF_IOM_HC_MMIO_READ_WRITE:
1077 case VINF_PATM_PATCH_INT3:
1078 case VINF_EM_NO_MEMORY:
1079 case VINF_EM_RAW_TO_R3:
1080 case VINF_EM_RAW_TIMER_PENDING:
1081 case VINF_EM_PENDING_REQUEST:
1082 case VINF_EM_HALT:
1083 case VINF_SUCCESS:
1084 break;
1085
1086 default:
1087 AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1088 break;
1089 }
1090 Log6(("TRPMGC0d: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
1091 return rc;
1092}
1093
1094
1095/**
1096 * \#PF (Page Fault) handler.
1097 *
1098 * Calls PGM which does the actual handling.
1099 *
1100 *
1101 * @returns VBox status code.
1102 * VINF_SUCCESS means we completely handled this trap,
1103 * other codes are passed execution to host context.
1104 *
1105 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1106 * @param pRegFrame Pointer to the register frame for the trap.
1107 * @internal
1108 */
1109DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1110{
1111 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1112 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1113
1114 LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x\n", pRegFrame->cs, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2));
1115
1116 /*
1117 * This is all PGM stuff.
1118 */
1119 PGMRZDynMapStartAutoSet(pVCpu);
1120 int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1121 switch (rc)
1122 {
1123 case VINF_EM_RAW_EMULATE_INSTR:
1124 case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
1125 case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1126 case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1127 case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1128 case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1129 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1130 rc = VINF_PATCH_EMULATE_INSTR;
1131 break;
1132
1133 case VINF_EM_RAW_GUEST_TRAP:
1134 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1135 {
1136 PGMRZDynMapReleaseAutoSet(pVCpu);
1137 return VINF_PATM_PATCH_TRAP_PF;
1138 }
1139
1140 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1141 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1142 break;
1143
1144 case VINF_EM_RAW_INTERRUPT_PENDING:
1145 Assert(TRPMHasTrap(pVCpu));
1146 /* no break; */
1147 case VINF_IOM_HC_MMIO_READ:
1148 case VINF_IOM_HC_MMIO_WRITE:
1149 case VINF_IOM_HC_MMIO_READ_WRITE:
1150 case VINF_PATM_HC_MMIO_PATCH_READ:
1151 case VINF_PATM_HC_MMIO_PATCH_WRITE:
1152 case VINF_SUCCESS:
1153 case VINF_EM_RAW_TO_R3:
1154 case VINF_EM_PENDING_REQUEST:
1155 case VINF_EM_RAW_TIMER_PENDING:
1156 case VINF_EM_NO_MEMORY:
1157 case VINF_CSAM_PENDING_ACTION:
1158 case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1159 break;
1160
1161 default:
1162 AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1163 break;
1164 }
1165 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1166 Log6(("TRPMGC0e: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs, pRegFrame->eip));
1167 return rc;
1168}
1169
1170
1171/**
1172 * Scans for the EIP in the specified array of trap handlers.
1173 *
1174 * If we don't fine the EIP, we'll panic.
1175 *
1176 * @returns VBox status code.
1177 *
1178 * @param pVM The VM handle.
1179 * @param pRegFrame Pointer to the register frame for the trap.
1180 * @param paHandlers The array of trap handler records.
1181 * @param pEndRecord The end record (exclusive).
1182 */
1183static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1184{
1185 uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1186 Assert(paHandlers <= pEndRecord);
1187
1188 Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1189
1190#if 0 /// @todo later
1191 /*
1192 * Start by doing a kind of binary search.
1193 */
1194 unsigned iStart = 0;
1195 unsigned iEnd = pEndRecord - paHandlers;
1196 unsigned i = iEnd / 2;
1197#endif
1198
1199 /*
1200 * Do a linear search now (in case the array wasn't properly sorted).
1201 */
1202 for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1203 {
1204 if ( pCur->uStartEIP <= uEip
1205 && (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1206 return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1207 }
1208
1209 return VERR_TRPM_DONT_PANIC;
1210}
1211
1212
1213/**
1214 * Hypervisor \#NP ((segment) Not Present) handler.
1215 *
1216 * Scans for the EIP in the registered trap handlers.
1217 *
1218 * @returns VBox status code.
1219 * VINF_SUCCESS means we completely handled this trap,
1220 * other codes are passed back to host context.
1221 *
1222 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1223 * @param pRegFrame Pointer to the register frame for the trap.
1224 * @internal
1225 */
1226DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1227{
1228 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1229}
1230
1231
1232/**
1233 * Hypervisor \#GP (General Protection Fault) handler.
1234 *
1235 * Scans for the EIP in the registered trap handlers.
1236 *
1237 * @returns VBox status code.
1238 * VINF_SUCCESS means we completely handled this trap,
1239 * other codes are passed back to host context.
1240 *
1241 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1242 * @param pRegFrame Pointer to the register frame for the trap.
1243 * @internal
1244 */
1245DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1246{
1247 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1248}
1249
1250
1251/**
1252 * Hypervisor \#PF (Page Fault) handler.
1253 *
1254 * Scans for the EIP in the registered trap handlers.
1255 *
1256 * @returns VBox status code.
1257 * VINF_SUCCESS means we completely handled this trap,
1258 * other codes are passed back to host context.
1259 *
1260 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1261 * @param pRegFrame Pointer to the register frame for the trap.
1262 * @internal
1263 */
1264DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1265{
1266 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1267}
1268
1269
1270/**
1271 * Deal with hypervisor traps occuring when resuming execution on a trap.
1272 *
1273 * @returns VBox status code.
1274 * @param pVM The VM handle.
1275 * @param pRegFrame Register frame.
1276 * @param uUser User arg.
1277 */
1278DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1279{
1280 Log(("********************************************************\n"));
1281 Log(("trpmGCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1282 Log(("********************************************************\n"));
1283
1284 if (uUser & TRPM_TRAP_IN_HYPER)
1285 {
1286 /*
1287 * Check that there is still some stack left, if not we'll flag
1288 * a guru meditation (the alternative is a triple fault).
1289 */
1290 RTRCUINTPTR cbStackUsed = (RTRCUINTPTR)VMMGetStackRC(VMMGetCpu(pVM)) - pRegFrame->esp;
1291 if (cbStackUsed > VMM_STACK_SIZE - _1K)
1292 {
1293 LogRel(("trpmGCTrapInGeneric: ran out of stack: esp=#x cbStackUsed=%#x\n", pRegFrame->esp, cbStackUsed));
1294 return VERR_TRPM_DONT_PANIC;
1295 }
1296
1297 /*
1298 * Just zero the register containing the selector in question.
1299 * We'll deal with the actual stale or troublesome selector value in
1300 * the outermost trap frame.
1301 */
1302 switch (uUser & TRPM_TRAP_IN_OP_MASK)
1303 {
1304 case TRPM_TRAP_IN_MOV_GS:
1305 pRegFrame->eax = 0;
1306 pRegFrame->gs = 0; /* prevent recursive trouble. */
1307 break;
1308 case TRPM_TRAP_IN_MOV_FS:
1309 pRegFrame->eax = 0;
1310 pRegFrame->fs = 0; /* prevent recursive trouble. */
1311 return VINF_SUCCESS;
1312
1313 default:
1314 AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1315 return VERR_INTERNAL_ERROR;
1316 }
1317 }
1318 else
1319 {
1320 /*
1321 * Reconstruct the guest context and switch to the recompiler.
1322 * We ASSUME we're only at
1323 */
1324 CPUMCTXCORE CtxCore = *pRegFrame;
1325 uint32_t *pEsp = (uint32_t *)pRegFrame->esp;
1326 int rc;
1327
1328 switch (uUser)
1329 {
1330 /*
1331 * This will only occur when resuming guest code in a trap handler!
1332 */
1333 /* @note ASSUMES esp points to the temporary guest CPUMCTXCORE!!! */
1334 case TRPM_TRAP_IN_MOV_GS:
1335 case TRPM_TRAP_IN_MOV_FS:
1336 case TRPM_TRAP_IN_MOV_ES:
1337 case TRPM_TRAP_IN_MOV_DS:
1338 {
1339 PCPUMCTXCORE pTempGuestCtx = (PCPUMCTXCORE)pEsp;
1340
1341 /* Just copy the whole thing; several selector registers, eip (etc) and eax are not yet in pRegFrame. */
1342 CtxCore = *pTempGuestCtx;
1343 rc = VINF_EM_RAW_STALE_SELECTOR;
1344 break;
1345 }
1346
1347 /*
1348 * This will only occur when resuming guest code!
1349 */
1350 case TRPM_TRAP_IN_IRET:
1351 CtxCore.eip = *pEsp++;
1352 CtxCore.cs = (RTSEL)*pEsp++;
1353 CtxCore.eflags.u32 = *pEsp++;
1354 CtxCore.esp = *pEsp++;
1355 CtxCore.ss = (RTSEL)*pEsp++;
1356 rc = VINF_EM_RAW_IRET_TRAP;
1357 break;
1358
1359 /*
1360 * This will only occur when resuming V86 guest code!
1361 */
1362 case TRPM_TRAP_IN_IRET | TRPM_TRAP_IN_V86:
1363 CtxCore.eip = *pEsp++;
1364 CtxCore.cs = (RTSEL)*pEsp++;
1365 CtxCore.eflags.u32 = *pEsp++;
1366 CtxCore.esp = *pEsp++;
1367 CtxCore.ss = (RTSEL)*pEsp++;
1368 CtxCore.es = (RTSEL)*pEsp++;
1369 CtxCore.ds = (RTSEL)*pEsp++;
1370 CtxCore.fs = (RTSEL)*pEsp++;
1371 CtxCore.gs = (RTSEL)*pEsp++;
1372 rc = VINF_EM_RAW_IRET_TRAP;
1373 break;
1374
1375 default:
1376 AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1377 return VERR_INTERNAL_ERROR;
1378 }
1379
1380
1381 CPUMSetGuestCtxCore(VMMGetCpu0(pVM), &CtxCore);
1382 TRPMGCHyperReturnToHost(pVM, rc);
1383 }
1384
1385 AssertMsgFailed(("Impossible!\n"));
1386 return VERR_INTERNAL_ERROR;
1387}
1388
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette