TRPMRCHandlers.cpp@ 56295

Last change on this file since 56295 was 56287, checked in by vboxsync, 9 years ago
VMM: Updated (C) year.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 56.0 KB

Line
1	/* $Id: TRPMRCHandlers.cpp 56287 2015-06-09 11:15:22Z vboxsync $ */
2	/** @file
3	* TRPM - Raw-mode Context Trap Handlers, CPP part
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_TRPM
23	#include <VBox/vmm/selm.h>
24	#include <VBox/vmm/iom.h>
25	#include <VBox/vmm/pgm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/dbgf.h>
28	#include <VBox/vmm/em.h>
29	#include <VBox/vmm/gim.h>
30	#include <VBox/vmm/csam.h>
31	#include <VBox/vmm/patm.h>
32	#include <VBox/vmm/mm.h>
33	#include <VBox/vmm/cpum.h>
34	#include "TRPMInternal.h"
35	#include <VBox/vmm/vm.h>
36	#include <VBox/vmm/vmm.h>
37	#include <VBox/param.h>
38
39	#include <VBox/err.h>
40	#include <VBox/dis.h>
41	#include <VBox/disopcode.h>
42	#include <VBox/log.h>
43	#include <VBox/vmm/tm.h>
44	#include <iprt/asm.h>
45	#include <iprt/asm-amd64-x86.h>
46	#include <iprt/assert.h>
47	#include <iprt/x86.h>
48
49
50	/*******************************************************************************
51	* Defined Constants And Macros *
52	*******************************************************************************/
53	/* still here. MODR/M byte parsing */
54	#define X86_OPCODE_MODRM_MOD_MASK 0xc0
55	#define X86_OPCODE_MODRM_REG_MASK 0x38
56	#define X86_OPCODE_MODRM_RM_MASK 0x07
57
58	/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
59	#define DTRACE_EXPERIMENT
60
61	#if 1
62	# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
63	# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
64	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
65	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
66	#else
67	# define TRPM_ENTER_DBG_HOOK(a_iVector) \
68	uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
69	if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
70	else do {} while (0)
71	# define TRPM_EXIT_DBG_HOOK(a_iVector) \
72	do { \
73	uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
74	if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF \| X86_EFL_IOPL)) \
75	Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
76	!!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
77	X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
78	else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
79	} while (0)
80	# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
81	# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
82	#endif
83
84	/*******************************************************************************
85	* Structures and Typedefs *
86	*******************************************************************************/
87	/** Pointer to a readonly hypervisor trap record. */
88	typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
89
90	/**
91	* A hypervisor trap record.
92	* This contains information about a handler for a instruction range.
93	*
94	* @remark This must match what TRPM_HANDLER outputs.
95	*/
96	typedef struct TRPMGCHYPER
97	{
98	/** The start address. */
99	uintptr_t uStartEIP;
100	/** The end address. (exclusive)
101	* If NULL the it's only for the instruction at pvStartEIP. */
102	uintptr_t uEndEIP;
103	/**
104	* The handler.
105	*
106	* @returns VBox status code
107	* VINF_SUCCESS means we've handled the trap.
108	* Any other error code means returning to the host context.
109	* @param pVM Pointer to the VM.
110	* @param pRegFrame The register frame.
111	* @param uUser The user argument.
112	*/
113	DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
114	/** Whatever the handler desires to put here. */
115	uintptr_t uUser;
116	} TRPMGCHYPER;
117
118
119	/*******************************************************************************
120	* Global Variables *
121	*******************************************************************************/
122	RT_C_DECLS_BEGIN
123	/** Defined in VMMRC0.asm or VMMRC99.asm.
124	* @{ */
125	extern const TRPMGCHYPER g_aTrap0bHandlers[1];
126	extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
127	extern const TRPMGCHYPER g_aTrap0dHandlers[1];
128	extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
129	extern const TRPMGCHYPER g_aTrap0eHandlers[1];
130	extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
131	/** @} */
132	RT_C_DECLS_END
133
134
135	/*******************************************************************************
136	* Internal Functions *
137	*******************************************************************************/
138	RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
139	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
140	RT_C_DECLS_END
141
142
143
144	/**
145	* Exits the trap, called when exiting a trap handler.
146	*
147	* Will reset the trap if it's not a guest trap or the trap
148	* is already handled. Will process resume guest FFs.
149	*
150	* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
151	* happened.
152	* @param pVM Pointer to the VM.
153	* @param pVCpu Pointer to the VMCPU.
154	* @param rc The VBox status code to return.
155	* @param pRegFrame Pointer to the register frame for the trap.
156	*
157	* @remarks This must not be used for hypervisor traps, only guest traps.
158	*/
159	static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
160	{
161	uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
162	NOREF(uOldActiveVector);
163
164	/* Reset trap? */
165	if ( rc != VINF_EM_RAW_GUEST_TRAP
166	&& rc != VINF_EM_RAW_RING_SWITCH_INT)
167	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
168
169	#ifdef VBOX_HIGH_RES_TIMERS_HACK
170	/*
171	* We should poll the timers occasionally.
172	* We must NOT do this too frequently as it adds a significant overhead
173	* and it'll kill us if the trap load is high. (See @bugref{1354}.)
174	* (The heuristic is not very intelligent, we should really check trap
175	* frequency etc. here, but alas, we lack any such information atm.)
176	*/
177	static unsigned s_iTimerPoll = 0;
178	if (rc == VINF_SUCCESS)
179	{
180	if (!(++s_iTimerPoll & 0xf))
181	{
182	TMTimerPollVoid(pVM, pVCpu);
183	Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
184	VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
185	}
186	}
187	else
188	s_iTimerPoll = 0;
189	#endif
190
191	/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
192	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
193	{
194	Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
195	if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
196	{
197	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
198	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
199	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
200	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
201	*/
202	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
203	}
204	}
205
206	/*
207	* Pending resume-guest-FF?
208	* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
209	*/
210	if ( rc == VINF_SUCCESS
211	&& ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC \| VM_FF_REQUEST \| VM_FF_PGM_NO_MEMORY \| VM_FF_PDM_DMA)
212	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER \| VMCPU_FF_TO_R3 \| VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC
213	\| VMCPU_FF_REQUEST \| VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
214	\| VMCPU_FF_PDM_CRITSECT
215	\| VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT
216	\| VMCPU_FF_SELM_SYNC_TSS \| VMCPU_FF_TRPM_SYNC_IDT
217	)
218	)
219	)
220	{
221	/* The out of memory condition naturally outranks the others. */
222	if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
223	rc = VINF_EM_NO_MEMORY;
224	/* Pending Ring-3 action. */
225	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 \| VMCPU_FF_PDM_CRITSECT))
226	{
227	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
228	rc = VINF_EM_RAW_TO_R3;
229	}
230	/* Pending timer action. */
231	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
232	rc = VINF_EM_RAW_TIMER_PENDING;
233	/* The Virtual Sync clock has stopped. */
234	else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
235	rc = VINF_EM_RAW_TO_R3;
236	/* DMA work pending? */
237	else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
238	rc = VINF_EM_RAW_TO_R3;
239	/* Pending request packets might contain actions that need immediate
240	attention, such as pending hardware interrupts. */
241	else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
242	\|\| VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
243	rc = VINF_EM_PENDING_REQUEST;
244	/* Pending GDT/LDT/TSS sync. */
245	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT \| VMCPU_FF_SELM_SYNC_LDT \| VMCPU_FF_SELM_SYNC_TSS))
246	rc = VINF_SELM_SYNC_GDT;
247	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
248	rc = VINF_EM_RAW_TO_R3;
249	/* Pending interrupt: dispatch it. */
250	else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC \| VMCPU_FF_INTERRUPT_PIC)
251	&& !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
252	&& PATMAreInterruptsEnabledByCtx(pVM, CPUMCTX_FROM_CORE(pRegFrame))
253	)
254	{
255	uint8_t u8Interrupt;
256	rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
257	Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
258	AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
259	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
260	/* can't return if successful */
261	Assert(rc != VINF_SUCCESS);
262
263	/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
264	Assert(uOldActiveVector <= 16);
265	STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
266
267	/* Assert the trap and go to the recompiler to dispatch it. */
268	TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
269
270	STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
271	rc = VINF_EM_RAW_INTERRUPT_PENDING;
272	}
273	/*
274	* Try sync CR3?
275	*/
276	else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 \| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
277	{
278	#if 1
279	PGMRZDynMapReleaseAutoSet(pVCpu);
280	PGMRZDynMapStartAutoSet(pVCpu);
281	rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
282	#else
283	rc = VINF_PGM_SYNC_CR3;
284	#endif
285	}
286	}
287
288	/* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
289	PGMRZDynMapReleaseAutoSet(pVCpu);
290	return rc;
291	}
292
293
294	/**
295	* \#DB (Debug event) handler.
296	*
297	* @returns VBox status code.
298	* VINF_SUCCESS means we completely handled this trap,
299	* other codes are passed execution to host context.
300	*
301	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
302	* @param pRegFrame Pointer to the register frame for the trap.
303	* @internal
304	*/
305	DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
306	{
307	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
308	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
309	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
310	LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
311	TRPM_ENTER_DBG_HOOK(1);
312
313	/*
314	* We currently don't make use of the X86_DR7_GD bit, but
315	* there might come a time when we do.
316	*/
317	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
318	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
319	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
320	VERR_NOT_IMPLEMENTED);
321	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
322
323	/*
324	* Now leave the rest to the DBGF.
325	*/
326	PGMRZDynMapStartAutoSet(pVCpu);
327	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
328	if (rc == VINF_EM_RAW_GUEST_TRAP)
329	{
330	CPUMSetGuestDR6(pVCpu, (CPUMGetGuestDR6(pVCpu) & ~X86_DR6_B_MASK) \| uDr6);
331	if (CPUMGetGuestDR7(pVCpu) & X86_DR7_GD)
332	CPUMSetGuestDR7(pVCpu, CPUMGetGuestDR7(pVCpu) & ~X86_DR7_GD);
333	}
334	else if (rc == VINF_EM_DBG_STEPPED)
335	pRegFrame->eflags.Bits.u1TF = 0;
336
337	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
338	Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg %EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
339	TRPM_EXIT_DBG_HOOK(1);
340	return rc;
341	}
342
343
344	/**
345	* \#DB (Debug event) handler for the hypervisor code.
346	*
347	* This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
348	* mapping set as well as the default trap exit path since they are both really
349	* bad ideas in this context.
350	*
351	* @returns VBox status code.
352	* VINF_SUCCESS means we completely handled this trap,
353	* other codes are passed execution to host context.
354	*
355	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
356	* @param pRegFrame Pointer to the register frame for the trap.
357	* @internal
358	*/
359	DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
360	{
361	RTGCUINTREG uDr6 = ASMGetAndClearDR6();
362	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
363	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
364	TRPM_ENTER_DBG_HOOK_HYPER(1);
365	LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
366
367	/*
368	* We currently don't make use of the X86_DR7_GD bit, but
369	* there might come a time when we do.
370	*/
371	AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
372	("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
373	ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
374	VERR_NOT_IMPLEMENTED);
375	AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
376
377	/*
378	* Now leave the rest to the DBGF.
379	*/
380	int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6, false /fAltStepping/);
381	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
382	if (rc == VINF_EM_DBG_STEPPED)
383	pRegFrame->eflags.Bits.u1TF = 0;
384
385	Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
386	TRPM_EXIT_DBG_HOOK_HYPER(1);
387	return rc;
388	}
389
390
391	/**
392	* NMI handler, for when we are using NMIs to debug things.
393	*
394	* @returns VBox status code.
395	* VINF_SUCCESS means we completely handled this trap,
396	* other codes are passed execution to host context.
397	*
398	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
399	* @param pRegFrame Pointer to the register frame for the trap.
400	* @internal
401	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
402	*/
403	DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
404	{
405	LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
406	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
407	RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
408	#endif
409	NOREF(pTrpmCpu);
410	return VERR_TRPM_DONT_PANIC;
411	}
412
413
414	/**
415	* NMI handler, for when we are using NMIs to debug things.
416	*
417	* This is the handler we're most likely to hit when the NMI fires (it is
418	* unlikely that we'll be stuck in guest code).
419	*
420	* @returns VBox status code.
421	* VINF_SUCCESS means we completely handled this trap,
422	* other codes are passed execution to host context.
423	*
424	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
425	* @param pRegFrame Pointer to the register frame for the trap.
426	* @internal
427	* @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
428	*/
429	DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
430	{
431	LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
432	#if 0 /* Enable this iff you have a COM port and really want this debug info. */
433	RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
434	#endif
435	NOREF(pTrpmCpu);
436	return VERR_TRPM_DONT_PANIC;
437	}
438
439
440	/**
441	* \#BP (Breakpoint) handler.
442	*
443	* @returns VBox status code.
444	* VINF_SUCCESS means we completely handled this trap,
445	* other codes are passed execution to host context.
446	*
447	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
448	* @param pRegFrame Pointer to the register frame for the trap.
449	* @internal
450	*/
451	DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
452	{
453	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
454	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
455	int rc;
456	LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
457	TRPM_ENTER_DBG_HOOK(3);
458	PGMRZDynMapStartAutoSet(pVCpu);
459
460	/*
461	* PATM is using INT3s, let them have a go first.
462	*/
463	if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
464	\|\| (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
465	&& !pRegFrame->eflags.Bits.u1VM)
466	{
467	rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
468	if ( rc == VINF_SUCCESS
469	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
470	\|\| rc == VINF_PATM_PATCH_INT3
471	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION)
472	{
473	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
474	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
475	TRPM_EXIT_DBG_HOOK(3);
476	return rc;
477	}
478	}
479	rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
480
481	/* anything we should do with this? Schedule it in GC? */
482	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
483	Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
484	TRPM_EXIT_DBG_HOOK(3);
485	return rc;
486	}
487
488
489	/**
490	* \#BP (Breakpoint) handler.
491	*
492	* This is similar to TRPMGCTrap03Handler but we bits which are potentially
493	* harmful to us (common trap exit and the auto mapping set).
494	*
495	* @returns VBox status code.
496	* VINF_SUCCESS means we completely handled this trap,
497	* other codes are passed execution to host context.
498	*
499	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
500	* @param pRegFrame Pointer to the register frame for the trap.
501	* @internal
502	*/
503	DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
504	{
505	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
506	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
507	LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
508	TRPM_ENTER_DBG_HOOK_HYPER(3);
509
510	/*
511	* Hand it over to DBGF.
512	*/
513	int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
514	AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
515
516	Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
517	TRPM_EXIT_DBG_HOOK_HYPER(3);
518	return rc;
519	}
520
521
522	/**
523	* Trap handler for illegal opcode fault (\#UD).
524	*
525	* @returns VBox status code.
526	* VINF_SUCCESS means we completely handled this trap,
527	* other codes are passed execution to host context.
528	*
529	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
530	* @param pRegFrame Pointer to the register frame for the trap.
531	* @internal
532	*/
533	DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
534	{
535	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
536	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
537	int rc;
538	LogFlow(("TRPMGC06: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
539	TRPM_ENTER_DBG_HOOK(6);
540	PGMRZDynMapStartAutoSet(pVCpu);
541
542	if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
543	{
544	/*
545	* Decode the instruction.
546	*/
547	RTGCPTR PC;
548	rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
549	pRegFrame->rip, &PC);
550	if (RT_FAILURE(rc))
551	{
552	Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
553	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
554	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
555	TRPM_EXIT_DBG_HOOK(6);
556	return rc;
557	}
558
559	DISCPUSTATE Cpu;
560	uint32_t cbOp;
561	rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
562	if (RT_FAILURE(rc))
563	{
564	rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
565	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
566	TRPM_EXIT_DBG_HOOK(6);
567	return rc;
568	}
569
570	/*
571	* UD2 in a patch?
572	* Note! PATMGCHandleIllegalInstrTrap doesn't always return.
573	*/
574	if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
575	&& PATMIsPatchGCAddr(pVM, pRegFrame->eip))
576	{
577	LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
578	rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
579	/** @todo These tests are completely unnecessary, should just follow the
580	* flow and return at the end of the function. */
581	if ( rc == VINF_SUCCESS
582	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
583	\|\| rc == VINF_PATM_DUPLICATE_FUNCTION
584	\|\| rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
585	\|\| rc == VINF_EM_RESCHEDULE)
586	{
587	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
588	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
589	TRPM_EXIT_DBG_HOOK(6);
590	return rc;
591	}
592	}
593	/*
594	* Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
595	*/
596	else if (Cpu.fPrefix & DISPREFIX_LOCK)
597	{
598	Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
599	#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
600	Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
601	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
602	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
603	#else
604	rc = VINF_EM_RAW_EMULATE_INSTR;
605	#endif
606	}
607	/*
608	* Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
609	*/
610	else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
611	{
612	LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
613	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
614	}
615	else if (GIMShouldTrapXcptUD(pVCpu))
616	{
617	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD\n"));
618	rc = GIMXcptUD(pVCpu, CPUMCTX_FROM_CORE(pRegFrame), &Cpu);
619	if (RT_FAILURE(rc))
620	{
621	LogFlow(("TRPMGCTrap06Handler: -> GIMXcptUD -> VINF_EM_RAW_EMULATE_INSTR\n"));
622	rc = VINF_EM_RAW_EMULATE_INSTR;
623	}
624	}
625	/* Never generate a raw trap here; it might be an instruction, that requires emulation. */
626	else
627	{
628	LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
629	rc = VINF_EM_RAW_EMULATE_INSTR;
630	}
631	}
632	else
633	{
634	LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
635	rc = TRPMForwardTrap(pVCpu, pRegFrame, X86_XCPT_UD, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, X86_XCPT_UD);
636	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
637	}
638
639	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
640	Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
641	TRPM_EXIT_DBG_HOOK(6);
642	return rc;
643	}
644
645
646	/**
647	* Trap handler for device not present fault (\#NM).
648	*
649	* Device not available, FP or (F)WAIT instruction.
650	*
651	* @returns VBox status code.
652	* VINF_SUCCESS means we completely handled this trap,
653	* other codes are passed execution to host context.
654	*
655	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
656	* @param pRegFrame Pointer to the register frame for the trap.
657	* @internal
658	*/
659	DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
660	{
661	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
662	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
663	LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
664	TRPM_ENTER_DBG_HOOK(7);
665	PGMRZDynMapStartAutoSet(pVCpu);
666
667	int rc = CPUMHandleLazyFPU(pVCpu);
668	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
669	Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
670	TRPM_EXIT_DBG_HOOK(7);
671	return rc;
672	}
673
674
675	/**
676	* \#NP ((segment) Not Present) handler.
677	*
678	* @returns VBox status code.
679	* VINF_SUCCESS means we completely handled this trap,
680	* other codes are passed execution to host context.
681	*
682	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
683	* @param pRegFrame Pointer to the register frame for the trap.
684	* @internal
685	*/
686	DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
687	{
688	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
689	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
690	LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
691	TRPM_ENTER_DBG_HOOK(0xb);
692	PGMRZDynMapStartAutoSet(pVCpu);
693
694	/*
695	* Try to detect instruction by opcode which caused trap.
696	* XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
697	* accessing user code. need to handle it somehow in future!
698	*/
699	RTGCPTR GCPtr;
700	if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
701	(RTGCPTR)pRegFrame->eip, &GCPtr)
702	== VINF_SUCCESS)
703	{
704	uint8_t pu8Code = (uint8_t )(uintptr_t)GCPtr;
705
706	/*
707	* First skip possible instruction prefixes, such as:
708	* OS, AS
709	* CS:, DS:, ES:, SS:, FS:, GS:
710	* REPE, REPNE
711	*
712	* note: Currently we supports only up to 4 prefixes per opcode, more
713	* prefixes (normally not used anyway) will cause trap d in guest.
714	* note: Instruction length in IA-32 may be up to 15 bytes, we dont
715	* check this issue, its too hard.
716	*/
717	for (unsigned i = 0; i < 4; i++)
718	{
719	if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
720	&& pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
721	&& pu8Code[0] != 0x2e /* CS: */
722	&& pu8Code[0] != 0x36 /* SS: */
723	&& pu8Code[0] != 0x3e /* DS: */
724	&& pu8Code[0] != 0x26 /* ES: */
725	&& pu8Code[0] != 0x64 /* FS: */
726	&& pu8Code[0] != 0x65 /* GS: */
727	&& pu8Code[0] != 0x66 /* OS */
728	&& pu8Code[0] != 0x67 /* AS */
729	)
730	break;
731	pu8Code++;
732	}
733
734	/*
735	* Detect right switch using a callgate.
736	*
737	* We recognize the following causes for the trap 0b:
738	* CALL FAR, CALL FAR []
739	* JMP FAR, JMP FAR []
740	* IRET (may cause a task switch)
741	*
742	* Note: we can't detect whether the trap was caused by a call to a
743	* callgate descriptor or it is a real trap 0b due to a bad selector.
744	* In both situations we'll pass execution to our recompiler so we don't
745	* have to worry.
746	* If we wanted to do better detection, we have set GDT entries to callgate
747	* descriptors pointing to our own handlers.
748	*/
749	/** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
750	if ( pu8Code[0] == 0x9a /* CALL FAR */
751	\|\| ( pu8Code[0] == 0xff /* CALL FAR [] */
752	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
753	\|\| pu8Code[0] == 0xea /* JMP FAR */
754	\|\| ( pu8Code[0] == 0xff /* JMP FAR [] */
755	&& (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
756	\|\| pu8Code[0] == 0xcf /* IRET */
757	)
758	{
759	/*
760	* Got potential call to callgate.
761	* We simply return execution to the recompiler to do emulation
762	* starting from the instruction which caused the trap.
763	*/
764	pTrpmCpu->uActiveVector = UINT32_MAX;
765	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
766	TRPM_EXIT_DBG_HOOK(0xb);
767	PGMRZDynMapReleaseAutoSet(pVCpu);
768	return VINF_EM_RAW_RING_SWITCH;
769	}
770	}
771
772	/*
773	* Pass trap 0b as is to the recompiler in all other cases.
774	*/
775	Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
776	PGMRZDynMapReleaseAutoSet(pVCpu);
777	TRPM_EXIT_DBG_HOOK(0xb);
778	return VINF_EM_RAW_GUEST_TRAP;
779	}
780
781
782	/**
783	* \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
784	*
785	* @returns VBox status code.
786	* VINF_SUCCESS means we completely handled this trap,
787	* other codes are passed execution to host context.
788	*
789	* @param pVM Pointer to the VM.
790	* @param pVCpu Pointer to the VMCPU.
791	* @param pRegFrame Pointer to the register frame for the trap.
792	* @param pCpu The opcode info.
793	* @param PC The program counter corresponding to cs:eip in pRegFrame.
794	*/
795	static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
796	{
797	int rc;
798	TRPM_ENTER_DBG_HOOK(0xd);
799
800	/*
801	* Try handle it here, if not return to HC and emulate/interpret it there.
802	*/
803	switch (pCpu->pCurInstr->uOpcode)
804	{
805	case OP_INT3:
806	/*
807	* Little hack to make the code below not fail
808	*/
809	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
810	pCpu->Param1.uValue = 3;
811	/* fallthru */
812	case OP_INT:
813	{
814	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
815	Assert(!(PATMIsPatchGCAddr(pVM, PC)));
816	if (pCpu->Param1.uValue == 3)
817	{
818	/* Int 3 replacement patch? */
819	if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
820	{
821	AssertFailed();
822	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
823	}
824	}
825	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
826	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
827	{
828	TRPM_EXIT_DBG_HOOK(0xd);
829	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
830	}
831
832	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
833	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
834	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
835	}
836
837	#ifdef PATM_EMULATE_SYSENTER
838	case OP_SYSEXIT:
839	case OP_SYSRET:
840	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
841	TRPM_EXIT_DBG_HOOK(0xd);
842	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
843	#endif
844
845	case OP_HLT:
846	/* If it's in patch code, defer to ring-3. */
847	if (PATMIsPatchGCAddr(pVM, PC))
848	break;
849
850	pRegFrame->eip += pCpu->cbInstr;
851	TRPM_EXIT_DBG_HOOK(0xd);
852	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
853
854
855	/*
856	* These instructions are used by PATM and CASM for finding
857	* dangerous non-trapping instructions. Thus, since all
858	* scanning and patching is done in ring-3 we'll have to
859	* return to ring-3 on the first encounter of these instructions.
860	*/
861	case OP_MOV_CR:
862	case OP_MOV_DR:
863	/* We can safely emulate control/debug register move instructions in patched code. */
864	if ( !PATMIsPatchGCAddr(pVM, PC)
865	&& !CSAMIsKnownDangerousInstr(pVM, PC))
866	break;
867	case OP_INVLPG:
868	case OP_LLDT:
869	case OP_STI:
870	case OP_RDTSC: /* just in case */
871	case OP_RDPMC:
872	case OP_CLTS:
873	case OP_WBINVD: /* nop */
874	case OP_RDMSR:
875	case OP_WRMSR:
876	{
877	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
878	if (rc == VERR_EM_INTERPRETER)
879	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
880	TRPM_EXIT_DBG_HOOK(0xd);
881	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
882	}
883	}
884
885	TRPM_EXIT_DBG_HOOK(0xd);
886	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
887	}
888
889
890	/**
891	* \#GP (General Protection Fault) handler for Ring-3.
892	*
893	* @returns VBox status code.
894	* VINF_SUCCESS means we completely handled this trap,
895	* other codes are passed execution to host context.
896	*
897	* @param pVM Pointer to the VM.
898	* @param pVCpu Pointer to the VMCPU.
899	* @param pRegFrame Pointer to the register frame for the trap.
900	* @param pCpu The opcode info.
901	* @param PC The program counter corresponding to cs:eip in pRegFrame.
902	*/
903	static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
904	{
905	int rc;
906	Assert(!pRegFrame->eflags.Bits.u1VM);
907	TRPM_ENTER_DBG_HOOK(0xd);
908
909	switch (pCpu->pCurInstr->uOpcode)
910	{
911	/*
912	* INT3 and INT xx are ring-switching.
913	* (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
914	*/
915	case OP_INT3:
916	/*
917	* Little hack to make the code below not fail
918	*/
919	pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
920	pCpu->Param1.uValue = 3;
921	/* fall thru */
922	case OP_INT:
923	{
924	Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
925	rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
926	if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
927	{
928	TRPM_EXIT_DBG_HOOK(0xd);
929	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
930	}
931
932	pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
933	pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
934	TRPM_EXIT_DBG_HOOK(0xd);
935	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
936	}
937
938	/*
939	* SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
940	*/
941	case OP_SYSCALL:
942	case OP_SYSENTER:
943	#ifdef PATM_EMULATE_SYSENTER
944	rc = PATMSysCall(pVM, CPUMCTX_FROM_CORE(pRegFrame), pCpu);
945	if (rc == VINF_SUCCESS)
946	{
947	TRPM_EXIT_DBG_HOOK(0xd);
948	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
949	}
950	/* else no break; */
951	#endif
952	case OP_BOUND:
953	case OP_INTO:
954	pVCpu->trpm.s.uActiveVector = UINT32_MAX;
955	TRPM_EXIT_DBG_HOOK(0xd);
956	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
957
958	/*
959	* Handle virtualized TSC & PMC reads, just in case.
960	*/
961	case OP_RDTSC:
962	case OP_RDPMC:
963	{
964	rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
965	if (rc == VERR_EM_INTERPRETER)
966	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
967	TRPM_EXIT_DBG_HOOK(0xd);
968	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
969	}
970
971	/*
972	* STI and CLI are I/O privileged, i.e. if IOPL
973	*/
974	case OP_STI:
975	case OP_CLI:
976	{
977	uint32_t efl = CPUMRawGetEFlags(pVCpu);
978	uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
979	if (X86_EFL_GET_IOPL(efl) >= cpl)
980	{
981	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
982	TRPM_EXIT_DBG_HOOK(0xd);
983	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
984	}
985	LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
986	break;
987	}
988	}
989
990	/*
991	* A genuine guest fault.
992	*/
993	TRPM_EXIT_DBG_HOOK(0xd);
994	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
995	}
996
997
998	/**
999	* Emulates RDTSC for the \#GP handler.
1000	*
1001	* @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
1002	*
1003	* @param pVM Pointer to the VM.
1004	* @param pVCpu Pointer to the VMCPU.
1005	* @param pRegFrame Pointer to the register frame for the trap.
1006	* This will be updated on successful return.
1007	*/
1008	DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
1009	{
1010	STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
1011	TRPM_ENTER_DBG_HOOK(0xd);
1012
1013	if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
1014	{
1015	TRPM_EXIT_DBG_HOOK(0xd);
1016	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
1017	}
1018
1019	uint64_t uTicks = TMCpuTickGet(pVCpu);
1020	pRegFrame->eax = uTicks;
1021	pRegFrame->edx = uTicks >> 32;
1022	pRegFrame->eip += 2;
1023	TRPM_EXIT_DBG_HOOK(0xd);
1024	return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
1025	}
1026
1027
1028	/**
1029	* \#GP (General Protection Fault) handler.
1030	*
1031	* @returns VBox status code.
1032	* VINF_SUCCESS means we completely handled this trap,
1033	* other codes are passed execution to host context.
1034	*
1035	* @param pVM Pointer to the VM.
1036	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1037	* @param pRegFrame Pointer to the register frame for the trap.
1038	*/
1039	static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1040	{
1041	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1042	LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1043	TRPM_ENTER_DBG_HOOK(0xd);
1044
1045	/*
1046	* Convert and validate CS.
1047	*/
1048	STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1049	RTGCPTR PC;
1050	int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1051	pRegFrame->rip, &PC);
1052	if (RT_FAILURE(rc))
1053	{
1054	Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1055	pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1056	TRPM_EXIT_DBG_HOOK(0xd);
1057	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1058	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1059	}
1060
1061	/*
1062	* Disassemble the instruction.
1063	*/
1064	DISCPUSTATE Cpu;
1065	uint32_t cbOp;
1066	rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1067	if (RT_FAILURE(rc))
1068	{
1069	AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1070	TRPM_EXIT_DBG_HOOK(0xd);
1071	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1072	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1073	}
1074	STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1075
1076	/*
1077	* Optimize RDTSC traps.
1078	* Some guests (like Solaris) are using RDTSC all over the place and
1079	* will end up trapping a lot because of that.
1080	*
1081	* Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1082	*/
1083	if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1084	return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1085
1086	/*
1087	* Deal with I/O port access.
1088	*/
1089	if ( pVCpu->trpm.s.uActiveErrorCode == 0
1090	&& (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1091	{
1092	VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1093	if (IOM_SUCCESS(rcStrict))
1094	{
1095	pRegFrame->rip += cbOp;
1096
1097	/*
1098	* Check for I/O breakpoints. A bit clumsy, but should be short lived (moved to IEM).
1099	*/
1100	uint32_t const uDr7 = CPUMGetGuestDR7(pVCpu);
1101	if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
1102	&& X86_DR7_ANY_RW_IO(uDr7)
1103	&& (CPUMGetGuestCR4(pVCpu) & X86_CR4_DE))
1104	\|\| DBGFBpIsHwIoArmed(pVM)))
1105	{
1106	uint64_t uPort = pRegFrame->dx;
1107	unsigned cbValue;
1108	if ( Cpu.pCurInstr->uOpcode == OP_IN
1109	\|\| Cpu.pCurInstr->uOpcode == OP_INSB
1110	\|\| Cpu.pCurInstr->uOpcode == OP_INSWD)
1111	{
1112	cbValue = DISGetParamSize(&Cpu, &Cpu.Param1);
1113	if (Cpu.Param2.fUse & DISUSE_IMMEDIATE)
1114	uPort = Cpu.Param2.uValue;
1115	}
1116	else
1117	{
1118	cbValue = DISGetParamSize(&Cpu, &Cpu.Param2);
1119	if (Cpu.Param1.fUse & DISUSE_IMMEDIATE)
1120	uPort = Cpu.Param1.uValue;
1121	}
1122
1123	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, CPUMCTX_FROM_CORE(pRegFrame), uPort, cbValue);
1124	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
1125	{
1126	/* Raise #DB. */
1127	TRPMResetTrap(pVCpu);
1128	TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
1129	if (rcStrict != VINF_SUCCESS)
1130	LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
1131	rcStrict = VINF_EM_RAW_GUEST_TRAP;
1132	}
1133	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
1134	else if ( rcStrict2 != VINF_SUCCESS
1135	&& (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
1136	rcStrict = rcStrict2;
1137	}
1138	}
1139	rc = VBOXSTRICTRC_TODO(rcStrict);
1140	TRPM_EXIT_DBG_HOOK(0xd);
1141	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1142	}
1143
1144	/*
1145	* Deal with Ring-0 (privileged instructions)
1146	*/
1147	if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1148	&& !pRegFrame->eflags.Bits.u1VM)
1149	return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1150
1151	/*
1152	* Deal with Ring-3 GPs.
1153	*/
1154	if (!pRegFrame->eflags.Bits.u1VM)
1155	return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1156
1157	/*
1158	* Deal with v86 code.
1159	*
1160	* We always set IOPL to zero which makes e.g. pushf fault in V86
1161	* mode. The guest might use IOPL=3 and therefore not expect a #GP.
1162	* Simply fall back to the recompiler to emulate this instruction if
1163	* that's the case. To get the correct we must use CPUMRawGetEFlags.
1164	*/
1165	X86EFLAGS eflags;
1166	eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1167	Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1168	if (eflags.Bits.u2IOPL != 3)
1169	{
1170	Assert(EMIsRawRing1Enabled(pVM) \|\| eflags.Bits.u2IOPL == 0);
1171
1172	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1173	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1174	TRPM_EXIT_DBG_HOOK(0xd);
1175	return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1176	}
1177	TRPM_EXIT_DBG_HOOK(0xd);
1178	return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1179	}
1180
1181
1182	/**
1183	* \#GP (General Protection Fault) handler.
1184	*
1185	* @returns VBox status code.
1186	* VINF_SUCCESS means we completely handled this trap,
1187	* other codes are passed execution to host context.
1188	*
1189	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1190	* @param pRegFrame Pointer to the register frame for the trap.
1191	* @internal
1192	*/
1193	DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1194	{
1195	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1196	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1197	LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1198	TRPM_ENTER_DBG_HOOK(0xd);
1199
1200	PGMRZDynMapStartAutoSet(pVCpu);
1201	int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1202	switch (rc)
1203	{
1204	case VINF_EM_RAW_GUEST_TRAP:
1205	case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1206	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1207	rc = VINF_PATM_PATCH_TRAP_GP;
1208	break;
1209
1210	case VINF_EM_RAW_INTERRUPT_PENDING:
1211	Assert(TRPMHasTrap(pVCpu));
1212	/* no break; */
1213	case VINF_PGM_SYNC_CR3:
1214	case VINF_EM_RAW_EMULATE_INSTR:
1215	case VINF_IOM_R3_IOPORT_READ:
1216	case VINF_IOM_R3_IOPORT_WRITE:
1217	case VINF_IOM_R3_MMIO_WRITE:
1218	case VINF_IOM_R3_MMIO_READ:
1219	case VINF_IOM_R3_MMIO_READ_WRITE:
1220	case VINF_CPUM_R3_MSR_READ:
1221	case VINF_CPUM_R3_MSR_WRITE:
1222	case VINF_PATM_PATCH_INT3:
1223	case VINF_EM_NO_MEMORY:
1224	case VINF_EM_RAW_TO_R3:
1225	case VINF_EM_RAW_TIMER_PENDING:
1226	case VINF_EM_PENDING_REQUEST:
1227	case VINF_EM_HALT:
1228	case VINF_SELM_SYNC_GDT:
1229	case VINF_SUCCESS:
1230	break;
1231
1232	default:
1233	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1234	break;
1235	}
1236	Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1237	TRPM_EXIT_DBG_HOOK(0xd);
1238	return rc;
1239	}
1240
1241
1242	/**
1243	* \#PF (Page Fault) handler.
1244	*
1245	* Calls PGM which does the actual handling.
1246	*
1247	*
1248	* @returns VBox status code.
1249	* VINF_SUCCESS means we completely handled this trap,
1250	* other codes are passed execution to host context.
1251	*
1252	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1253	* @param pRegFrame Pointer to the register frame for the trap.
1254	* @internal
1255	*/
1256	DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1257	{
1258	PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1259	PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1260	LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1261	TRPM_ENTER_DBG_HOOK(0xe);
1262
1263	/*
1264	* This is all PGM stuff.
1265	*/
1266	PGMRZDynMapStartAutoSet(pVCpu);
1267	int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1268	switch (rc)
1269	{
1270	case VINF_EM_RAW_EMULATE_INSTR:
1271	case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1272	case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1273	case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1274	case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1275	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1276	rc = VINF_PATCH_EMULATE_INSTR;
1277	break;
1278
1279	case VINF_EM_RAW_GUEST_TRAP:
1280	if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1281	{
1282	PGMRZDynMapReleaseAutoSet(pVCpu);
1283	TRPM_EXIT_DBG_HOOK(0xe);
1284	return VINF_PATM_PATCH_TRAP_PF;
1285	}
1286
1287	rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1288	Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1289	break;
1290
1291	case VINF_EM_RAW_INTERRUPT_PENDING:
1292	Assert(TRPMHasTrap(pVCpu));
1293	/* no break; */
1294	case VINF_IOM_R3_MMIO_READ:
1295	case VINF_IOM_R3_MMIO_WRITE:
1296	case VINF_IOM_R3_MMIO_READ_WRITE:
1297	case VINF_PATM_HC_MMIO_PATCH_READ:
1298	case VINF_PATM_HC_MMIO_PATCH_WRITE:
1299	case VINF_SUCCESS:
1300	case VINF_EM_RAW_TO_R3:
1301	case VINF_EM_PENDING_REQUEST:
1302	case VINF_EM_RAW_TIMER_PENDING:
1303	case VINF_EM_NO_MEMORY:
1304	case VINF_CSAM_PENDING_ACTION:
1305	case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1306	break;
1307
1308	default:
1309	AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1310	break;
1311	}
1312	rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1313	Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1314	TRPM_EXIT_DBG_HOOK(0xe);
1315	return rc;
1316	}
1317
1318
1319	/**
1320	* Scans for the EIP in the specified array of trap handlers.
1321	*
1322	* If we don't fine the EIP, we'll panic.
1323	*
1324	* @returns VBox status code.
1325	*
1326	* @param pVM Pointer to the VM.
1327	* @param pRegFrame Pointer to the register frame for the trap.
1328	* @param paHandlers The array of trap handler records.
1329	* @param pEndRecord The end record (exclusive).
1330	*/
1331	static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1332	{
1333	uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1334	Assert(paHandlers <= pEndRecord);
1335
1336	Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1337
1338	#if 0 /// @todo later
1339	/*
1340	* Start by doing a kind of binary search.
1341	*/
1342	unsigned iStart = 0;
1343	unsigned iEnd = pEndRecord - paHandlers;
1344	unsigned i = iEnd / 2;
1345	#endif
1346
1347	/*
1348	* Do a linear search now (in case the array wasn't properly sorted).
1349	*/
1350	for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1351	{
1352	if ( pCur->uStartEIP <= uEip
1353	&& (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1354	return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1355	}
1356
1357	return VERR_TRPM_DONT_PANIC;
1358	}
1359
1360
1361	/**
1362	* Hypervisor \#NP ((segment) Not Present) handler.
1363	*
1364	* Scans for the EIP in the registered trap handlers.
1365	*
1366	* @returns VBox status code.
1367	* VINF_SUCCESS means we completely handled this trap,
1368	* other codes are passed back to host context.
1369	*
1370	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1371	* @param pRegFrame Pointer to the register frame for the trap.
1372	* @internal
1373	*/
1374	DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1375	{
1376	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1377	}
1378
1379
1380	/**
1381	* Hypervisor \#GP (General Protection Fault) handler.
1382	*
1383	* Scans for the EIP in the registered trap handlers.
1384	*
1385	* @returns VBox status code.
1386	* VINF_SUCCESS means we completely handled this trap,
1387	* other codes are passed back to host context.
1388	*
1389	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1390	* @param pRegFrame Pointer to the register frame for the trap.
1391	* @internal
1392	*/
1393	DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1394	{
1395	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1396	}
1397
1398
1399	/**
1400	* Hypervisor \#PF (Page Fault) handler.
1401	*
1402	* Scans for the EIP in the registered trap handlers.
1403	*
1404	* @returns VBox status code.
1405	* VINF_SUCCESS means we completely handled this trap,
1406	* other codes are passed back to host context.
1407	*
1408	* @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1409	* @param pRegFrame Pointer to the register frame for the trap.
1410	* @internal
1411	*/
1412	DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1413	{
1414	return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1415	}
1416
1417
1418	/**
1419	* Deal with hypervisor traps occurring when resuming execution on a trap.
1420	*
1421	* There is a little problem with recursive RC (hypervisor) traps. We deal with
1422	* this by not allowing recursion without it being the subject of a guru
1423	* meditation. (We used to / tried to handle this but there isn't any reason
1424	* for it.)
1425	*
1426	* So, do NOT use this for handling RC traps!
1427	*
1428	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1429	* @param pVM Pointer to the VM.
1430	* @param pRegFrame Register frame.
1431	* @param uUser User arg.
1432	*/
1433	DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1434	{
1435	Log(("********************************************************\n"));
1436	Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1437	Log(("********************************************************\n"));
1438
1439	/*
1440	* This used to be kind of complicated, but since we stopped storing
1441	* the register frame on the stack and instead storing it directly
1442	* in the CPUMCPU::Guest structure, we just have to figure out which
1443	* status to hand on to the host and let the recompiler/IEM do its
1444	* job.
1445	*/
1446	switch (uUser)
1447	{
1448	case TRPM_TRAP_IN_MOV_GS:
1449	case TRPM_TRAP_IN_MOV_FS:
1450	case TRPM_TRAP_IN_MOV_ES:
1451	case TRPM_TRAP_IN_MOV_DS:
1452	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1453	break;
1454
1455	case TRPM_TRAP_IN_IRET:
1456	case TRPM_TRAP_IN_IRET \| TRPM_TRAP_IN_V86:
1457	TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1458	break;
1459
1460	default:
1461	AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1462	return VERR_TRPM_BAD_TRAP_IN_OP;
1463	}
1464
1465	AssertMsgFailed(("Impossible!\n"));
1466	return VERR_TRPM_IPE_3;
1467	}
1468
1469
1470	/**
1471	* Generic hyper trap handler that sets the EIP to @a uUser.
1472	*
1473	* @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1474	* @param pVM Pointer to the cross context VM structure.
1475	* @param pRegFrame Pointer to the register frame (within VM)
1476	* @param uUser The user arg, which should be the new EIP address.
1477	*/
1478	extern "C" DECLCALLBACK(int) TRPMRCTrapHyperHandlerSetEIP(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1479	{
1480	AssertReturn(MMHyperIsInsideArea(pVM, uUser), VERR_TRPM_IPE_3);
1481	pRegFrame->eip = uUser;
1482	return VINF_SUCCESS;
1483	}
1484

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 56295

Download in other formats: