1 | /* $Id: TRPMRCHandlers.cpp 41906 2012-06-24 15:44:03Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * TRPM - Guest Context Trap Handlers, CPP part
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2006-2007 Oracle Corporation
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
12 | * General Public License (GPL) as published by the Free Software
|
---|
13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
16 | */
|
---|
17 |
|
---|
18 |
|
---|
19 | /*******************************************************************************
|
---|
20 | * Header Files *
|
---|
21 | *******************************************************************************/
|
---|
22 | #define LOG_GROUP LOG_GROUP_TRPM
|
---|
23 | #include <VBox/vmm/selm.h>
|
---|
24 | #include <VBox/vmm/iom.h>
|
---|
25 | #include <VBox/vmm/pgm.h>
|
---|
26 | #include <VBox/vmm/pdmapi.h>
|
---|
27 | #include <VBox/vmm/dbgf.h>
|
---|
28 | #include <VBox/vmm/em.h>
|
---|
29 | #include <VBox/vmm/csam.h>
|
---|
30 | #include <VBox/vmm/patm.h>
|
---|
31 | #include <VBox/vmm/mm.h>
|
---|
32 | #include <VBox/vmm/cpum.h>
|
---|
33 | #include "TRPMInternal.h"
|
---|
34 | #include <VBox/vmm/vm.h>
|
---|
35 | #include <VBox/vmm/vmm.h>
|
---|
36 | #include <VBox/param.h>
|
---|
37 |
|
---|
38 | #include <VBox/err.h>
|
---|
39 | #include <VBox/dis.h>
|
---|
40 | #include <VBox/disopcode.h>
|
---|
41 | #include <VBox/log.h>
|
---|
42 | #include <VBox/vmm/tm.h>
|
---|
43 | #include <iprt/asm.h>
|
---|
44 | #include <iprt/asm-amd64-x86.h>
|
---|
45 | #include <iprt/assert.h>
|
---|
46 | #include <iprt/x86.h>
|
---|
47 |
|
---|
48 |
|
---|
49 | /*******************************************************************************
|
---|
50 | * Defined Constants And Macros *
|
---|
51 | *******************************************************************************/
|
---|
52 | /* still here. MODR/M byte parsing */
|
---|
53 | #define X86_OPCODE_MODRM_MOD_MASK 0xc0
|
---|
54 | #define X86_OPCODE_MODRM_REG_MASK 0x38
|
---|
55 | #define X86_OPCODE_MODRM_RM_MASK 0x07
|
---|
56 |
|
---|
57 | /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
|
---|
58 | #define DTRACE_EXPERIMENT
|
---|
59 |
|
---|
60 |
|
---|
61 | /*******************************************************************************
|
---|
62 | * Structures and Typedefs *
|
---|
63 | *******************************************************************************/
|
---|
64 | /** Pointer to a readonly hypervisor trap record. */
|
---|
65 | typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
|
---|
66 |
|
---|
67 | /**
|
---|
68 | * A hypervisor trap record.
|
---|
69 | * This contains information about a handler for a instruction range.
|
---|
70 | *
|
---|
71 | * @remark This must match what TRPM_HANDLER outputs.
|
---|
72 | */
|
---|
73 | typedef struct TRPMGCHYPER
|
---|
74 | {
|
---|
75 | /** The start address. */
|
---|
76 | uintptr_t uStartEIP;
|
---|
77 | /** The end address. (exclusive)
|
---|
78 | * If NULL the it's only for the instruction at pvStartEIP. */
|
---|
79 | uintptr_t uEndEIP;
|
---|
80 | /**
|
---|
81 | * The handler.
|
---|
82 | *
|
---|
83 | * @returns VBox status code
|
---|
84 | * VINF_SUCCESS means we've handled the trap.
|
---|
85 | * Any other error code means returning to the host context.
|
---|
86 | * @param pVM Pointer to the VM.
|
---|
87 | * @param pRegFrame The register frame.
|
---|
88 | * @param uUser The user argument.
|
---|
89 | */
|
---|
90 | DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
|
---|
91 | /** Whatever the handler desires to put here. */
|
---|
92 | uintptr_t uUser;
|
---|
93 | } TRPMGCHYPER;
|
---|
94 |
|
---|
95 |
|
---|
96 | /*******************************************************************************
|
---|
97 | * Global Variables *
|
---|
98 | *******************************************************************************/
|
---|
99 | RT_C_DECLS_BEGIN
|
---|
100 | /** Defined in VMMGC0.asm or VMMGC99.asm.
|
---|
101 | * @{ */
|
---|
102 | extern const TRPMGCHYPER g_aTrap0bHandlers[1];
|
---|
103 | extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
|
---|
104 | extern const TRPMGCHYPER g_aTrap0dHandlers[1];
|
---|
105 | extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
|
---|
106 | extern const TRPMGCHYPER g_aTrap0eHandlers[1];
|
---|
107 | extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
|
---|
108 | /** @} */
|
---|
109 | RT_C_DECLS_END
|
---|
110 |
|
---|
111 |
|
---|
112 | /*******************************************************************************
|
---|
113 | * Internal Functions *
|
---|
114 | *******************************************************************************/
|
---|
115 | RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
|
---|
116 | DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
|
---|
117 | RT_C_DECLS_END
|
---|
118 |
|
---|
119 |
|
---|
120 |
|
---|
121 | /**
|
---|
122 | * Exits the trap, called when exiting a trap handler.
|
---|
123 | *
|
---|
124 | * Will reset the trap if it's not a guest trap or the trap
|
---|
125 | * is already handled. Will process resume guest FFs.
|
---|
126 | *
|
---|
127 | * @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
|
---|
128 | * happened.
|
---|
129 | * @param pVM Pointer to the VM.
|
---|
130 | * @param pVCpu Pointer to the VMCPU.
|
---|
131 | * @param rc The VBox status code to return.
|
---|
132 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
133 | *
|
---|
134 | * @remarks This must not be used for hypervisor traps, only guest traps.
|
---|
135 | */
|
---|
136 | static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
|
---|
137 | {
|
---|
138 | uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
|
---|
139 | NOREF(uOldActiveVector);
|
---|
140 |
|
---|
141 | /* Reset trap? */
|
---|
142 | if ( rc != VINF_EM_RAW_GUEST_TRAP
|
---|
143 | && rc != VINF_EM_RAW_RING_SWITCH_INT)
|
---|
144 | pVCpu->trpm.s.uActiveVector = UINT32_MAX;
|
---|
145 |
|
---|
146 | #ifdef VBOX_HIGH_RES_TIMERS_HACK
|
---|
147 | /*
|
---|
148 | * We should poll the timers occasionally.
|
---|
149 | * We must *NOT* do this too frequently as it adds a significant overhead
|
---|
150 | * and it'll kill us if the trap load is high. (See @bugref{1354}.)
|
---|
151 | * (The heuristic is not very intelligent, we should really check trap
|
---|
152 | * frequency etc. here, but alas, we lack any such information atm.)
|
---|
153 | */
|
---|
154 | static unsigned s_iTimerPoll = 0;
|
---|
155 | if (rc == VINF_SUCCESS)
|
---|
156 | {
|
---|
157 | if (!(++s_iTimerPoll & 0xf))
|
---|
158 | {
|
---|
159 | TMTimerPollVoid(pVM, pVCpu);
|
---|
160 | Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
|
---|
161 | VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER)));
|
---|
162 | }
|
---|
163 | }
|
---|
164 | else
|
---|
165 | s_iTimerPoll = 0;
|
---|
166 | #endif
|
---|
167 |
|
---|
168 | /* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
|
---|
169 | if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
|
---|
170 | {
|
---|
171 | Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
|
---|
172 | if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
|
---|
173 | {
|
---|
174 | /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
|
---|
175 | * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
|
---|
176 | * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
|
---|
177 | * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
|
---|
178 | */
|
---|
179 | VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
|
---|
180 | }
|
---|
181 | }
|
---|
182 |
|
---|
183 | /*
|
---|
184 | * Pending resume-guest-FF?
|
---|
185 | * Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
|
---|
186 | */
|
---|
187 | if ( rc == VINF_SUCCESS
|
---|
188 | && ( VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC | VM_FF_REQUEST | VM_FF_PGM_NO_MEMORY | VM_FF_PDM_DMA)
|
---|
189 | || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER | VMCPU_FF_TO_R3 | VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC
|
---|
190 | | VMCPU_FF_REQUEST | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
|
---|
191 | | VMCPU_FF_PDM_CRITSECT)
|
---|
192 | )
|
---|
193 | )
|
---|
194 | {
|
---|
195 | /* The out of memory condition naturally outranks the others. */
|
---|
196 | if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
|
---|
197 | rc = VINF_EM_NO_MEMORY;
|
---|
198 | /* Pending Ring-3 action. */
|
---|
199 | else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TO_R3 | VMCPU_FF_PDM_CRITSECT))
|
---|
200 | {
|
---|
201 | VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
|
---|
202 | rc = VINF_EM_RAW_TO_R3;
|
---|
203 | }
|
---|
204 | /* Pending timer action. */
|
---|
205 | else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER))
|
---|
206 | rc = VINF_EM_RAW_TIMER_PENDING;
|
---|
207 | /* The Virtual Sync clock has stopped. */
|
---|
208 | else if (VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
|
---|
209 | rc = VINF_EM_RAW_TO_R3;
|
---|
210 | /* DMA work pending? */
|
---|
211 | else if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA))
|
---|
212 | rc = VINF_EM_RAW_TO_R3;
|
---|
213 | /* Pending request packets might contain actions that need immediate
|
---|
214 | attention, such as pending hardware interrupts. */
|
---|
215 | else if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
|
---|
216 | || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
|
---|
217 | rc = VINF_EM_PENDING_REQUEST;
|
---|
218 | /* Pending interrupt: dispatch it. */
|
---|
219 | else if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
|
---|
220 | && !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
|
---|
221 | && PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
|
---|
222 | )
|
---|
223 | {
|
---|
224 | uint8_t u8Interrupt;
|
---|
225 | rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
|
---|
226 | Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
|
---|
227 | AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
|
---|
228 | rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
|
---|
229 | /* can't return if successful */
|
---|
230 | Assert(rc != VINF_SUCCESS);
|
---|
231 |
|
---|
232 | /* Stop the profile counter that was started in TRPMGCHandlersA.asm */
|
---|
233 | Assert(uOldActiveVector <= 16);
|
---|
234 | STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
|
---|
235 |
|
---|
236 | /* Assert the trap and go to the recompiler to dispatch it. */
|
---|
237 | TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
|
---|
238 |
|
---|
239 | STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
|
---|
240 | rc = VINF_EM_RAW_INTERRUPT_PENDING;
|
---|
241 | }
|
---|
242 | /*
|
---|
243 | * Try sync CR3?
|
---|
244 | */
|
---|
245 | else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
|
---|
246 | {
|
---|
247 | #if 1
|
---|
248 | PGMRZDynMapReleaseAutoSet(pVCpu);
|
---|
249 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
250 | rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
|
---|
251 | #else
|
---|
252 | rc = VINF_PGM_SYNC_CR3;
|
---|
253 | #endif
|
---|
254 | }
|
---|
255 | }
|
---|
256 |
|
---|
257 | AssertMsg( rc != VINF_SUCCESS
|
---|
258 | || ( pRegFrame->eflags.Bits.u1IF
|
---|
259 | && ( pRegFrame->eflags.Bits.u2IOPL < (unsigned)(pRegFrame->ss.Sel & X86_SEL_RPL) || pRegFrame->eflags.Bits.u1VM))
|
---|
260 | , ("rc=%Rrc\neflags=%RX32 ss=%RTsel IOPL=%d\n", rc, pRegFrame->eflags.u32, pRegFrame->ss.Sel, pRegFrame->eflags.Bits.u2IOPL));
|
---|
261 | PGMRZDynMapReleaseAutoSet(pVCpu);
|
---|
262 | return rc;
|
---|
263 | }
|
---|
264 |
|
---|
265 |
|
---|
266 | /**
|
---|
267 | * \#DB (Debug event) handler.
|
---|
268 | *
|
---|
269 | * @returns VBox status code.
|
---|
270 | * VINF_SUCCESS means we completely handled this trap,
|
---|
271 | * other codes are passed execution to host context.
|
---|
272 | *
|
---|
273 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
274 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
275 | * @internal
|
---|
276 | */
|
---|
277 | DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
278 | {
|
---|
279 | RTGCUINTREG uDr6 = ASMGetAndClearDR6();
|
---|
280 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
281 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
282 |
|
---|
283 | LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
|
---|
284 |
|
---|
285 | /*
|
---|
286 | * We currently don't make use of the X86_DR7_GD bit, but
|
---|
287 | * there might come a time when we do.
|
---|
288 | */
|
---|
289 | AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
|
---|
290 | ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
|
---|
291 | ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
|
---|
292 | VERR_NOT_IMPLEMENTED);
|
---|
293 | AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
|
---|
294 |
|
---|
295 | /*
|
---|
296 | * Now leave the rest to the DBGF.
|
---|
297 | */
|
---|
298 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
299 | int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
|
---|
300 | if (rc == VINF_EM_RAW_GUEST_TRAP)
|
---|
301 | CPUMSetGuestDR6(pVCpu, uDr6);
|
---|
302 |
|
---|
303 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
304 | Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
|
---|
305 | return rc;
|
---|
306 | }
|
---|
307 |
|
---|
308 |
|
---|
309 | /**
|
---|
310 | * \#DB (Debug event) handler for the hypervisor code.
|
---|
311 | *
|
---|
312 | * This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
|
---|
313 | * mapping set as well as the default trap exit path since they are both really
|
---|
314 | * bad ideas in this context.
|
---|
315 | *
|
---|
316 | * @returns VBox status code.
|
---|
317 | * VINF_SUCCESS means we completely handled this trap,
|
---|
318 | * other codes are passed execution to host context.
|
---|
319 | *
|
---|
320 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
321 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
322 | * @internal
|
---|
323 | */
|
---|
324 | DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
325 | {
|
---|
326 | RTGCUINTREG uDr6 = ASMGetAndClearDR6();
|
---|
327 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
328 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
329 |
|
---|
330 | LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
|
---|
331 |
|
---|
332 | /*
|
---|
333 | * We currently don't make use of the X86_DR7_GD bit, but
|
---|
334 | * there might come a time when we do.
|
---|
335 | */
|
---|
336 | AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
|
---|
337 | ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
|
---|
338 | ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
|
---|
339 | VERR_NOT_IMPLEMENTED);
|
---|
340 | AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
|
---|
341 |
|
---|
342 | /*
|
---|
343 | * Now leave the rest to the DBGF.
|
---|
344 | */
|
---|
345 | int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
|
---|
346 | AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
|
---|
347 |
|
---|
348 | Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
|
---|
349 | return rc;
|
---|
350 | }
|
---|
351 |
|
---|
352 |
|
---|
353 | /**
|
---|
354 | * NMI handler, for when we are using NMIs to debug things.
|
---|
355 | *
|
---|
356 | * @returns VBox status code.
|
---|
357 | * VINF_SUCCESS means we completely handled this trap,
|
---|
358 | * other codes are passed execution to host context.
|
---|
359 | *
|
---|
360 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
361 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
362 | * @internal
|
---|
363 | * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
|
---|
364 | */
|
---|
365 | DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
366 | {
|
---|
367 | LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
368 | RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
|
---|
369 | NOREF(pTrpmCpu);
|
---|
370 | return VERR_TRPM_DONT_PANIC;
|
---|
371 | }
|
---|
372 |
|
---|
373 |
|
---|
374 | /**
|
---|
375 | * NMI handler, for when we are using NMIs to debug things.
|
---|
376 | *
|
---|
377 | * This is the handler we're most likely to hit when the NMI fires (it is
|
---|
378 | * unlikely that we'll be stuck in guest code).
|
---|
379 | *
|
---|
380 | * @returns VBox status code.
|
---|
381 | * VINF_SUCCESS means we completely handled this trap,
|
---|
382 | * other codes are passed execution to host context.
|
---|
383 | *
|
---|
384 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
385 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
386 | * @internal
|
---|
387 | * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
|
---|
388 | */
|
---|
389 | DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
390 | {
|
---|
391 | LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
392 | RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
|
---|
393 | NOREF(pTrpmCpu);
|
---|
394 | return VERR_TRPM_DONT_PANIC;
|
---|
395 | }
|
---|
396 |
|
---|
397 |
|
---|
398 | /**
|
---|
399 | * \#BP (Breakpoint) handler.
|
---|
400 | *
|
---|
401 | * @returns VBox status code.
|
---|
402 | * VINF_SUCCESS means we completely handled this trap,
|
---|
403 | * other codes are passed execution to host context.
|
---|
404 | *
|
---|
405 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
406 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
407 | * @internal
|
---|
408 | */
|
---|
409 | DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
410 | {
|
---|
411 | LogFlow(("TRPMGC03: %04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
412 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
413 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
414 | int rc;
|
---|
415 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
416 |
|
---|
417 | /*
|
---|
418 | * PATM is using INT3s, let them have a go first.
|
---|
419 | */
|
---|
420 | if ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
|
---|
421 | && !pRegFrame->eflags.Bits.u1VM)
|
---|
422 | {
|
---|
423 | rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
|
---|
424 | if ( rc == VINF_SUCCESS
|
---|
425 | || rc == VINF_EM_RAW_EMULATE_INSTR
|
---|
426 | || rc == VINF_PATM_PATCH_INT3
|
---|
427 | || rc == VINF_PATM_DUPLICATE_FUNCTION)
|
---|
428 | {
|
---|
429 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
430 | Log6(("TRPMGC03: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
431 | return rc;
|
---|
432 | }
|
---|
433 | }
|
---|
434 | rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
|
---|
435 |
|
---|
436 | /* anything we should do with this? Schedule it in GC? */
|
---|
437 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
438 | Log6(("TRPMGC03: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
439 | return rc;
|
---|
440 | }
|
---|
441 |
|
---|
442 |
|
---|
443 | /**
|
---|
444 | * \#BP (Breakpoint) handler.
|
---|
445 | *
|
---|
446 | * This is similar to TRPMGCTrap03Handler but we bits which are potentially
|
---|
447 | * harmful to us (common trap exit and the auto mapping set).
|
---|
448 | *
|
---|
449 | * @returns VBox status code.
|
---|
450 | * VINF_SUCCESS means we completely handled this trap,
|
---|
451 | * other codes are passed execution to host context.
|
---|
452 | *
|
---|
453 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
454 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
455 | * @internal
|
---|
456 | */
|
---|
457 | DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
458 | {
|
---|
459 | LogFlow(("TRPMGCHyper03: %04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
460 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
461 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
462 |
|
---|
463 | /*
|
---|
464 | * Hand it over to DBGF.
|
---|
465 | */
|
---|
466 | int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
|
---|
467 | AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
|
---|
468 |
|
---|
469 | Log6(("TRPMGCHyper03: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
470 | return rc;
|
---|
471 | }
|
---|
472 |
|
---|
473 |
|
---|
474 | /**
|
---|
475 | * Trap handler for illegal opcode fault (\#UD).
|
---|
476 | *
|
---|
477 | * @returns VBox status code.
|
---|
478 | * VINF_SUCCESS means we completely handled this trap,
|
---|
479 | * other codes are passed execution to host context.
|
---|
480 | *
|
---|
481 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
482 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
483 | * @internal
|
---|
484 | */
|
---|
485 | DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
486 | {
|
---|
487 | LogFlow(("TRPMGC06: %04x:%08x efl=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32));
|
---|
488 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
489 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
490 | int rc;
|
---|
491 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
492 |
|
---|
493 | if (CPUMGetGuestCPL(pVCpu, pRegFrame) == 0)
|
---|
494 | {
|
---|
495 | /*
|
---|
496 | * Decode the instruction.
|
---|
497 | */
|
---|
498 | RTGCPTR PC;
|
---|
499 | rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
|
---|
500 | pRegFrame->rip, &PC);
|
---|
501 | if (RT_FAILURE(rc))
|
---|
502 | {
|
---|
503 | Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
|
---|
504 | rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
|
---|
505 | Log6(("TRPMGC06: %Rrc (%04x:%08x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
506 | return rc;
|
---|
507 | }
|
---|
508 |
|
---|
509 | DISCPUSTATE Cpu;
|
---|
510 | uint32_t cbOp;
|
---|
511 | rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
|
---|
512 | if (RT_FAILURE(rc))
|
---|
513 | {
|
---|
514 | rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
|
---|
515 | Log6(("TRPMGC06: %Rrc (%04x:%08x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
516 | return rc;
|
---|
517 | }
|
---|
518 |
|
---|
519 | /*
|
---|
520 | * UD2 in a patch?
|
---|
521 | * Note! PATMGCHandleIllegalInstrTrap doesn't always return.
|
---|
522 | */
|
---|
523 | if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
|
---|
524 | && PATMIsPatchGCAddr(pVM, pRegFrame->eip))
|
---|
525 | {
|
---|
526 | LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
|
---|
527 | rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
|
---|
528 | /** @todo These tests are completely unnecessary, should just follow the
|
---|
529 | * flow and return at the end of the function. */
|
---|
530 | if ( rc == VINF_SUCCESS
|
---|
531 | || rc == VINF_EM_RAW_EMULATE_INSTR
|
---|
532 | || rc == VINF_PATM_DUPLICATE_FUNCTION
|
---|
533 | || rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
|
---|
534 | || rc == VINF_EM_RESCHEDULE)
|
---|
535 | {
|
---|
536 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
537 | Log6(("TRPMGC06: %Rrc (%04x:%08x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
538 | return rc;
|
---|
539 | }
|
---|
540 | }
|
---|
541 | /*
|
---|
542 | * Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
|
---|
543 | */
|
---|
544 | else if (Cpu.fPrefix & DISPREFIX_LOCK)
|
---|
545 | {
|
---|
546 | Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
|
---|
547 | #ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
|
---|
548 | Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
|
---|
549 | rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
|
---|
550 | Assert(rc == VINF_EM_RAW_GUEST_TRAP);
|
---|
551 | #else
|
---|
552 | rc = VINF_EM_RAW_EMULATE_INSTR;
|
---|
553 | #endif
|
---|
554 | }
|
---|
555 | /*
|
---|
556 | * Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
|
---|
557 | */
|
---|
558 | else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
|
---|
559 | {
|
---|
560 | LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
|
---|
561 | rc = EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
|
---|
562 | }
|
---|
563 | /* Never generate a raw trap here; it might be an instruction, that requires emulation. */
|
---|
564 | else
|
---|
565 | {
|
---|
566 | LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
|
---|
567 | rc = VINF_EM_RAW_EMULATE_INSTR;
|
---|
568 | }
|
---|
569 | }
|
---|
570 | else
|
---|
571 | {
|
---|
572 | LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
|
---|
573 | rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
|
---|
574 | Assert(rc == VINF_EM_RAW_GUEST_TRAP);
|
---|
575 | }
|
---|
576 |
|
---|
577 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
578 | Log6(("TRPMGC06: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
579 | return rc;
|
---|
580 | }
|
---|
581 |
|
---|
582 |
|
---|
583 | /**
|
---|
584 | * Trap handler for device not present fault (\#NM).
|
---|
585 | *
|
---|
586 | * Device not available, FP or (F)WAIT instruction.
|
---|
587 | *
|
---|
588 | * @returns VBox status code.
|
---|
589 | * VINF_SUCCESS means we completely handled this trap,
|
---|
590 | * other codes are passed execution to host context.
|
---|
591 | *
|
---|
592 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
593 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
594 | * @internal
|
---|
595 | */
|
---|
596 | DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
597 | {
|
---|
598 | LogFlow(("TRPMGC07: %04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
599 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
600 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
601 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
602 |
|
---|
603 | int rc = CPUMHandleLazyFPU(pVCpu);
|
---|
604 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
605 | Log6(("TRPMGC07: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
606 | return rc;
|
---|
607 | }
|
---|
608 |
|
---|
609 |
|
---|
610 | /**
|
---|
611 | * \#NP ((segment) Not Present) handler.
|
---|
612 | *
|
---|
613 | * @returns VBox status code.
|
---|
614 | * VINF_SUCCESS means we completely handled this trap,
|
---|
615 | * other codes are passed execution to host context.
|
---|
616 | *
|
---|
617 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
618 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
619 | * @internal
|
---|
620 | */
|
---|
621 | DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
622 | {
|
---|
623 | LogFlow(("TRPMGC0b: %04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
624 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
625 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
626 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
627 |
|
---|
628 | /*
|
---|
629 | * Try to detect instruction by opcode which caused trap.
|
---|
630 | * XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
|
---|
631 | * accessing user code. need to handle it somehow in future!
|
---|
632 | */
|
---|
633 | RTGCPTR GCPtr;
|
---|
634 | if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
|
---|
635 | (RTGCPTR)pRegFrame->eip, &GCPtr)
|
---|
636 | == VINF_SUCCESS)
|
---|
637 | {
|
---|
638 | uint8_t *pu8Code = (uint8_t *)(uintptr_t)GCPtr;
|
---|
639 |
|
---|
640 | /*
|
---|
641 | * First skip possible instruction prefixes, such as:
|
---|
642 | * OS, AS
|
---|
643 | * CS:, DS:, ES:, SS:, FS:, GS:
|
---|
644 | * REPE, REPNE
|
---|
645 | *
|
---|
646 | * note: Currently we supports only up to 4 prefixes per opcode, more
|
---|
647 | * prefixes (normally not used anyway) will cause trap d in guest.
|
---|
648 | * note: Instruction length in IA-32 may be up to 15 bytes, we dont
|
---|
649 | * check this issue, its too hard.
|
---|
650 | */
|
---|
651 | for (unsigned i = 0; i < 4; i++)
|
---|
652 | {
|
---|
653 | if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
|
---|
654 | && pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
|
---|
655 | && pu8Code[0] != 0x2e /* CS: */
|
---|
656 | && pu8Code[0] != 0x36 /* SS: */
|
---|
657 | && pu8Code[0] != 0x3e /* DS: */
|
---|
658 | && pu8Code[0] != 0x26 /* ES: */
|
---|
659 | && pu8Code[0] != 0x64 /* FS: */
|
---|
660 | && pu8Code[0] != 0x65 /* GS: */
|
---|
661 | && pu8Code[0] != 0x66 /* OS */
|
---|
662 | && pu8Code[0] != 0x67 /* AS */
|
---|
663 | )
|
---|
664 | break;
|
---|
665 | pu8Code++;
|
---|
666 | }
|
---|
667 |
|
---|
668 | /*
|
---|
669 | * Detect right switch using a callgate.
|
---|
670 | *
|
---|
671 | * We recognize the following causes for the trap 0b:
|
---|
672 | * CALL FAR, CALL FAR []
|
---|
673 | * JMP FAR, JMP FAR []
|
---|
674 | * IRET (may cause a task switch)
|
---|
675 | *
|
---|
676 | * Note: we can't detect whether the trap was caused by a call to a
|
---|
677 | * callgate descriptor or it is a real trap 0b due to a bad selector.
|
---|
678 | * In both situations we'll pass execution to our recompiler so we don't
|
---|
679 | * have to worry.
|
---|
680 | * If we wanted to do better detection, we have set GDT entries to callgate
|
---|
681 | * descriptors pointing to our own handlers.
|
---|
682 | */
|
---|
683 | /** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
|
---|
684 | if ( pu8Code[0] == 0x9a /* CALL FAR */
|
---|
685 | || ( pu8Code[0] == 0xff /* CALL FAR [] */
|
---|
686 | && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
|
---|
687 | || pu8Code[0] == 0xea /* JMP FAR */
|
---|
688 | || ( pu8Code[0] == 0xff /* JMP FAR [] */
|
---|
689 | && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
|
---|
690 | || pu8Code[0] == 0xcf /* IRET */
|
---|
691 | )
|
---|
692 | {
|
---|
693 | /*
|
---|
694 | * Got potential call to callgate.
|
---|
695 | * We simply return execution to the recompiler to do emulation
|
---|
696 | * starting from the instruction which caused the trap.
|
---|
697 | */
|
---|
698 | pTrpmCpu->uActiveVector = UINT32_MAX;
|
---|
699 | Log6(("TRPMGC0b: %Rrc (%04x:%08x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
700 | PGMRZDynMapReleaseAutoSet(pVCpu);
|
---|
701 | return VINF_EM_RAW_RING_SWITCH;
|
---|
702 | }
|
---|
703 | }
|
---|
704 |
|
---|
705 | /*
|
---|
706 | * Pass trap 0b as is to the recompiler in all other cases.
|
---|
707 | */
|
---|
708 | Log6(("TRPMGC0b: %Rrc (%04x:%08x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
709 | PGMRZDynMapReleaseAutoSet(pVCpu);
|
---|
710 | return VINF_EM_RAW_GUEST_TRAP;
|
---|
711 | }
|
---|
712 |
|
---|
713 |
|
---|
714 | /**
|
---|
715 | * \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
|
---|
716 | *
|
---|
717 | * @returns VBox status code.
|
---|
718 | * VINF_SUCCESS means we completely handled this trap,
|
---|
719 | * other codes are passed execution to host context.
|
---|
720 | *
|
---|
721 | * @param pVM Pointer to the VM.
|
---|
722 | * @param pVCpu Pointer to the VMCPU.
|
---|
723 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
724 | * @param pCpu The opcode info.
|
---|
725 | * @param PC The program counter corresponding to cs:eip in pRegFrame.
|
---|
726 | */
|
---|
727 | static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
|
---|
728 | {
|
---|
729 | int rc;
|
---|
730 |
|
---|
731 | /*
|
---|
732 | * Try handle it here, if not return to HC and emulate/interpret it there.
|
---|
733 | */
|
---|
734 | switch (pCpu->pCurInstr->uOpcode)
|
---|
735 | {
|
---|
736 | case OP_INT3:
|
---|
737 | /*
|
---|
738 | * Little hack to make the code below not fail
|
---|
739 | */
|
---|
740 | pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
|
---|
741 | pCpu->Param1.uValue = 3;
|
---|
742 | /* fallthru */
|
---|
743 | case OP_INT:
|
---|
744 | {
|
---|
745 | Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
|
---|
746 | Assert(!(PATMIsPatchGCAddr(pVM, PC)));
|
---|
747 | if (pCpu->Param1.uValue == 3)
|
---|
748 | {
|
---|
749 | /* Int 3 replacement patch? */
|
---|
750 | if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
|
---|
751 | {
|
---|
752 | AssertFailed();
|
---|
753 | return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
|
---|
754 | }
|
---|
755 | }
|
---|
756 | rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
|
---|
757 | if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
|
---|
758 | return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
|
---|
759 |
|
---|
760 | pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
|
---|
761 | pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
|
---|
762 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
|
---|
763 | }
|
---|
764 |
|
---|
765 | #ifdef PATM_EMULATE_SYSENTER
|
---|
766 | case OP_SYSEXIT:
|
---|
767 | case OP_SYSRET:
|
---|
768 | rc = PATMSysCall(pVM, pRegFrame, pCpu);
|
---|
769 | return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
770 | #endif
|
---|
771 |
|
---|
772 | case OP_HLT:
|
---|
773 | /* If it's in patch code, defer to ring-3. */
|
---|
774 | if (PATMIsPatchGCAddr(pVM, PC))
|
---|
775 | break;
|
---|
776 |
|
---|
777 | pRegFrame->eip += pCpu->cbInstr;
|
---|
778 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
|
---|
779 |
|
---|
780 |
|
---|
781 | /*
|
---|
782 | * These instructions are used by PATM and CASM for finding
|
---|
783 | * dangerous non-trapping instructions. Thus, since all
|
---|
784 | * scanning and patching is done in ring-3 we'll have to
|
---|
785 | * return to ring-3 on the first encounter of these instructions.
|
---|
786 | */
|
---|
787 | case OP_MOV_CR:
|
---|
788 | case OP_MOV_DR:
|
---|
789 | /* We can safely emulate control/debug register move instructions in patched code. */
|
---|
790 | if ( !PATMIsPatchGCAddr(pVM, PC)
|
---|
791 | && !CSAMIsKnownDangerousInstr(pVM, PC))
|
---|
792 | break;
|
---|
793 | case OP_INVLPG:
|
---|
794 | case OP_LLDT:
|
---|
795 | case OP_STI:
|
---|
796 | case OP_RDTSC: /* just in case */
|
---|
797 | case OP_RDPMC:
|
---|
798 | case OP_CLTS:
|
---|
799 | case OP_WBINVD: /* nop */
|
---|
800 | case OP_RDMSR:
|
---|
801 | case OP_WRMSR:
|
---|
802 | {
|
---|
803 | rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
|
---|
804 | if (rc == VERR_EM_INTERPRETER)
|
---|
805 | rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
|
---|
806 | return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
807 | }
|
---|
808 | }
|
---|
809 |
|
---|
810 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
|
---|
811 | }
|
---|
812 |
|
---|
813 |
|
---|
814 | /**
|
---|
815 | * \#GP (General Protection Fault) handler for Ring-3.
|
---|
816 | *
|
---|
817 | * @returns VBox status code.
|
---|
818 | * VINF_SUCCESS means we completely handled this trap,
|
---|
819 | * other codes are passed execution to host context.
|
---|
820 | *
|
---|
821 | * @param pVM Pointer to the VM.
|
---|
822 | * @param pVCpu Pointer to the VMCPU.
|
---|
823 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
824 | * @param pCpu The opcode info.
|
---|
825 | * @param PC The program counter corresponding to cs:eip in pRegFrame.
|
---|
826 | */
|
---|
827 | static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
|
---|
828 | {
|
---|
829 | int rc;
|
---|
830 | Assert(!pRegFrame->eflags.Bits.u1VM);
|
---|
831 |
|
---|
832 | switch (pCpu->pCurInstr->uOpcode)
|
---|
833 | {
|
---|
834 | /*
|
---|
835 | * INT3 and INT xx are ring-switching.
|
---|
836 | * (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
|
---|
837 | */
|
---|
838 | case OP_INT3:
|
---|
839 | /*
|
---|
840 | * Little hack to make the code below not fail
|
---|
841 | */
|
---|
842 | pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
|
---|
843 | pCpu->Param1.uValue = 3;
|
---|
844 | /* fall thru */
|
---|
845 | case OP_INT:
|
---|
846 | {
|
---|
847 | Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
|
---|
848 | rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
|
---|
849 | if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
|
---|
850 | return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
|
---|
851 |
|
---|
852 | pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
|
---|
853 | pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
|
---|
854 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
|
---|
855 | }
|
---|
856 |
|
---|
857 | /*
|
---|
858 | * SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
|
---|
859 | */
|
---|
860 | case OP_SYSCALL:
|
---|
861 | case OP_SYSENTER:
|
---|
862 | #ifdef PATM_EMULATE_SYSENTER
|
---|
863 | rc = PATMSysCall(pVM, pRegFrame, pCpu);
|
---|
864 | if (rc == VINF_SUCCESS)
|
---|
865 | return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
|
---|
866 | /* else no break; */
|
---|
867 | #endif
|
---|
868 | case OP_BOUND:
|
---|
869 | case OP_INTO:
|
---|
870 | pVCpu->trpm.s.uActiveVector = UINT32_MAX;
|
---|
871 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
|
---|
872 |
|
---|
873 | /*
|
---|
874 | * Handle virtualized TSC & PMC reads, just in case.
|
---|
875 | */
|
---|
876 | case OP_RDTSC:
|
---|
877 | case OP_RDPMC:
|
---|
878 | {
|
---|
879 | rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
|
---|
880 | if (rc == VERR_EM_INTERPRETER)
|
---|
881 | rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
|
---|
882 | return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
883 | }
|
---|
884 |
|
---|
885 | /*
|
---|
886 | * STI and CLI are I/O privileged, i.e. if IOPL
|
---|
887 | */
|
---|
888 | case OP_STI:
|
---|
889 | case OP_CLI:
|
---|
890 | {
|
---|
891 | uint32_t efl = CPUMRawGetEFlags(pVCpu, pRegFrame);
|
---|
892 | if (X86_EFL_GET_IOPL(efl) >= (unsigned)(pRegFrame->ss.Sel & X86_SEL_RPL))
|
---|
893 | {
|
---|
894 | LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
|
---|
895 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
|
---|
896 | }
|
---|
897 | LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0)\n"));
|
---|
898 | break;
|
---|
899 | }
|
---|
900 | }
|
---|
901 |
|
---|
902 | /*
|
---|
903 | * A genuine guest fault.
|
---|
904 | */
|
---|
905 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
|
---|
906 | }
|
---|
907 |
|
---|
908 |
|
---|
909 | /**
|
---|
910 | * Emulates RDTSC for the \#GP handler.
|
---|
911 | *
|
---|
912 | * @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
|
---|
913 | *
|
---|
914 | * @param pVM Pointer to the VM.
|
---|
915 | * @param pVCpu Pointer to the VMCPU.
|
---|
916 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
917 | * This will be updated on successful return.
|
---|
918 | */
|
---|
919 | DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
|
---|
920 | {
|
---|
921 | STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
|
---|
922 |
|
---|
923 | if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
|
---|
924 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
|
---|
925 |
|
---|
926 | uint64_t uTicks = TMCpuTickGet(pVCpu);
|
---|
927 | pRegFrame->eax = uTicks;
|
---|
928 | pRegFrame->edx = uTicks >> 32;
|
---|
929 | pRegFrame->eip += 2;
|
---|
930 | return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
|
---|
931 | }
|
---|
932 |
|
---|
933 |
|
---|
934 | /**
|
---|
935 | * \#GP (General Protection Fault) handler.
|
---|
936 | *
|
---|
937 | * @returns VBox status code.
|
---|
938 | * VINF_SUCCESS means we completely handled this trap,
|
---|
939 | * other codes are passed execution to host context.
|
---|
940 | *
|
---|
941 | * @param pVM Pointer to the VM.
|
---|
942 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
943 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
944 | */
|
---|
945 | static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
946 | {
|
---|
947 | LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode));
|
---|
948 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
949 |
|
---|
950 | /*
|
---|
951 | * Convert and validate CS.
|
---|
952 | */
|
---|
953 | STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
|
---|
954 | RTGCPTR PC;
|
---|
955 | uint32_t cBits;
|
---|
956 | int rc = SELMValidateAndConvertCSAddrGCTrap(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel,
|
---|
957 | pRegFrame->rip, &PC, &cBits);
|
---|
958 | if (RT_FAILURE(rc))
|
---|
959 | {
|
---|
960 | Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
|
---|
961 | pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
|
---|
962 | STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
|
---|
963 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
|
---|
964 | }
|
---|
965 |
|
---|
966 | /*
|
---|
967 | * Disassemble the instruction.
|
---|
968 | */
|
---|
969 | DISCPUSTATE Cpu;
|
---|
970 | uint32_t cbOp;
|
---|
971 | rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
|
---|
972 | if (RT_FAILURE(rc))
|
---|
973 | {
|
---|
974 | AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
|
---|
975 | STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
|
---|
976 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
|
---|
977 | }
|
---|
978 | STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
|
---|
979 |
|
---|
980 | /*
|
---|
981 | * Optimize RDTSC traps.
|
---|
982 | * Some guests (like Solaris) are using RDTSC all over the place and
|
---|
983 | * will end up trapping a *lot* because of that.
|
---|
984 | *
|
---|
985 | * Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
|
---|
986 | */
|
---|
987 | if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
|
---|
988 | return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
|
---|
989 |
|
---|
990 | /*
|
---|
991 | * Deal with I/O port access.
|
---|
992 | */
|
---|
993 | if ( pVCpu->trpm.s.uActiveErrorCode == 0
|
---|
994 | && (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
|
---|
995 | {
|
---|
996 | VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pRegFrame, &Cpu);
|
---|
997 | if (IOM_SUCCESS(rcStrict))
|
---|
998 | pRegFrame->rip += cbOp;
|
---|
999 | rc = VBOXSTRICTRC_TODO(rcStrict);
|
---|
1000 | return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
1001 | }
|
---|
1002 |
|
---|
1003 | /*
|
---|
1004 | * Deal with Ring-0 (privileged instructions)
|
---|
1005 | */
|
---|
1006 | if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
|
---|
1007 | && !pRegFrame->eflags.Bits.u1VM)
|
---|
1008 | return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
|
---|
1009 |
|
---|
1010 | /*
|
---|
1011 | * Deal with Ring-3 GPs.
|
---|
1012 | */
|
---|
1013 | if (!pRegFrame->eflags.Bits.u1VM)
|
---|
1014 | return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
|
---|
1015 |
|
---|
1016 | /*
|
---|
1017 | * Deal with v86 code.
|
---|
1018 | *
|
---|
1019 | * We always set IOPL to zero which makes e.g. pushf fault in V86
|
---|
1020 | * mode. The guest might use IOPL=3 and therefore not expect a #GP.
|
---|
1021 | * Simply fall back to the recompiler to emulate this instruction if
|
---|
1022 | * that's the case. To get the correct we must use CPUMRawGetEFlags.
|
---|
1023 | */
|
---|
1024 | X86EFLAGS eflags;
|
---|
1025 | eflags.u32 = CPUMRawGetEFlags(pVCpu, pRegFrame); /* Get the correct value. */
|
---|
1026 | Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
|
---|
1027 | if (eflags.Bits.u2IOPL != 3)
|
---|
1028 | {
|
---|
1029 | Assert(eflags.Bits.u2IOPL == 0);
|
---|
1030 |
|
---|
1031 | rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
|
---|
1032 | Assert(rc == VINF_EM_RAW_GUEST_TRAP);
|
---|
1033 | return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
1034 | }
|
---|
1035 | return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
|
---|
1036 | }
|
---|
1037 |
|
---|
1038 |
|
---|
1039 | /**
|
---|
1040 | * \#GP (General Protection Fault) handler.
|
---|
1041 | *
|
---|
1042 | * @returns VBox status code.
|
---|
1043 | * VINF_SUCCESS means we completely handled this trap,
|
---|
1044 | * other codes are passed execution to host context.
|
---|
1045 | *
|
---|
1046 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
1047 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1048 | * @internal
|
---|
1049 | */
|
---|
1050 | DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
1051 | {
|
---|
1052 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
1053 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
1054 |
|
---|
1055 | LogFlow(("TRPMGC0d: %04x:%08x err=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode));
|
---|
1056 |
|
---|
1057 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
1058 | int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
|
---|
1059 | switch (rc)
|
---|
1060 | {
|
---|
1061 | case VINF_EM_RAW_GUEST_TRAP:
|
---|
1062 | case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
|
---|
1063 | if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
|
---|
1064 | rc = VINF_PATM_PATCH_TRAP_GP;
|
---|
1065 | break;
|
---|
1066 |
|
---|
1067 | case VINF_EM_RAW_INTERRUPT_PENDING:
|
---|
1068 | Assert(TRPMHasTrap(pVCpu));
|
---|
1069 | /* no break; */
|
---|
1070 | case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
|
---|
1071 | case VINF_EM_RAW_EMULATE_INSTR:
|
---|
1072 | case VINF_IOM_R3_IOPORT_READ:
|
---|
1073 | case VINF_IOM_R3_IOPORT_WRITE:
|
---|
1074 | case VINF_IOM_R3_MMIO_WRITE:
|
---|
1075 | case VINF_IOM_R3_MMIO_READ:
|
---|
1076 | case VINF_IOM_R3_MMIO_READ_WRITE:
|
---|
1077 | case VINF_PATM_PATCH_INT3:
|
---|
1078 | case VINF_EM_NO_MEMORY:
|
---|
1079 | case VINF_EM_RAW_TO_R3:
|
---|
1080 | case VINF_EM_RAW_TIMER_PENDING:
|
---|
1081 | case VINF_EM_PENDING_REQUEST:
|
---|
1082 | case VINF_EM_HALT:
|
---|
1083 | case VINF_SUCCESS:
|
---|
1084 | break;
|
---|
1085 |
|
---|
1086 | default:
|
---|
1087 | AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
|
---|
1088 | break;
|
---|
1089 | }
|
---|
1090 | Log6(("TRPMGC0d: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
1091 | return rc;
|
---|
1092 | }
|
---|
1093 |
|
---|
1094 |
|
---|
1095 | /**
|
---|
1096 | * \#PF (Page Fault) handler.
|
---|
1097 | *
|
---|
1098 | * Calls PGM which does the actual handling.
|
---|
1099 | *
|
---|
1100 | *
|
---|
1101 | * @returns VBox status code.
|
---|
1102 | * VINF_SUCCESS means we completely handled this trap,
|
---|
1103 | * other codes are passed execution to host context.
|
---|
1104 | *
|
---|
1105 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
1106 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1107 | * @internal
|
---|
1108 | */
|
---|
1109 | DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
1110 | {
|
---|
1111 | PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
|
---|
1112 | PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
|
---|
1113 |
|
---|
1114 | LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2));
|
---|
1115 |
|
---|
1116 | /*
|
---|
1117 | * This is all PGM stuff.
|
---|
1118 | */
|
---|
1119 | PGMRZDynMapStartAutoSet(pVCpu);
|
---|
1120 | int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
|
---|
1121 | switch (rc)
|
---|
1122 | {
|
---|
1123 | case VINF_EM_RAW_EMULATE_INSTR:
|
---|
1124 | case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
|
---|
1125 | case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
|
---|
1126 | case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
|
---|
1127 | case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
|
---|
1128 | case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
|
---|
1129 | if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
|
---|
1130 | rc = VINF_PATCH_EMULATE_INSTR;
|
---|
1131 | break;
|
---|
1132 |
|
---|
1133 | case VINF_EM_RAW_GUEST_TRAP:
|
---|
1134 | if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
|
---|
1135 | {
|
---|
1136 | PGMRZDynMapReleaseAutoSet(pVCpu);
|
---|
1137 | return VINF_PATM_PATCH_TRAP_PF;
|
---|
1138 | }
|
---|
1139 |
|
---|
1140 | rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
|
---|
1141 | Assert(rc == VINF_EM_RAW_GUEST_TRAP);
|
---|
1142 | break;
|
---|
1143 |
|
---|
1144 | case VINF_EM_RAW_INTERRUPT_PENDING:
|
---|
1145 | Assert(TRPMHasTrap(pVCpu));
|
---|
1146 | /* no break; */
|
---|
1147 | case VINF_IOM_R3_MMIO_READ:
|
---|
1148 | case VINF_IOM_R3_MMIO_WRITE:
|
---|
1149 | case VINF_IOM_R3_MMIO_READ_WRITE:
|
---|
1150 | case VINF_PATM_HC_MMIO_PATCH_READ:
|
---|
1151 | case VINF_PATM_HC_MMIO_PATCH_WRITE:
|
---|
1152 | case VINF_SUCCESS:
|
---|
1153 | case VINF_EM_RAW_TO_R3:
|
---|
1154 | case VINF_EM_PENDING_REQUEST:
|
---|
1155 | case VINF_EM_RAW_TIMER_PENDING:
|
---|
1156 | case VINF_EM_NO_MEMORY:
|
---|
1157 | case VINF_CSAM_PENDING_ACTION:
|
---|
1158 | case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
|
---|
1159 | break;
|
---|
1160 |
|
---|
1161 | default:
|
---|
1162 | AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
|
---|
1163 | break;
|
---|
1164 | }
|
---|
1165 | rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
|
---|
1166 | Log6(("TRPMGC0e: %Rrc (%04x:%08x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip));
|
---|
1167 | return rc;
|
---|
1168 | }
|
---|
1169 |
|
---|
1170 |
|
---|
1171 | /**
|
---|
1172 | * Scans for the EIP in the specified array of trap handlers.
|
---|
1173 | *
|
---|
1174 | * If we don't fine the EIP, we'll panic.
|
---|
1175 | *
|
---|
1176 | * @returns VBox status code.
|
---|
1177 | *
|
---|
1178 | * @param pVM Pointer to the VM.
|
---|
1179 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1180 | * @param paHandlers The array of trap handler records.
|
---|
1181 | * @param pEndRecord The end record (exclusive).
|
---|
1182 | */
|
---|
1183 | static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
|
---|
1184 | {
|
---|
1185 | uintptr_t uEip = (uintptr_t)pRegFrame->eip;
|
---|
1186 | Assert(paHandlers <= pEndRecord);
|
---|
1187 |
|
---|
1188 | Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
|
---|
1189 |
|
---|
1190 | #if 0 /// @todo later
|
---|
1191 | /*
|
---|
1192 | * Start by doing a kind of binary search.
|
---|
1193 | */
|
---|
1194 | unsigned iStart = 0;
|
---|
1195 | unsigned iEnd = pEndRecord - paHandlers;
|
---|
1196 | unsigned i = iEnd / 2;
|
---|
1197 | #endif
|
---|
1198 |
|
---|
1199 | /*
|
---|
1200 | * Do a linear search now (in case the array wasn't properly sorted).
|
---|
1201 | */
|
---|
1202 | for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
|
---|
1203 | {
|
---|
1204 | if ( pCur->uStartEIP <= uEip
|
---|
1205 | && (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
|
---|
1206 | return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
|
---|
1207 | }
|
---|
1208 |
|
---|
1209 | return VERR_TRPM_DONT_PANIC;
|
---|
1210 | }
|
---|
1211 |
|
---|
1212 |
|
---|
1213 | /**
|
---|
1214 | * Hypervisor \#NP ((segment) Not Present) handler.
|
---|
1215 | *
|
---|
1216 | * Scans for the EIP in the registered trap handlers.
|
---|
1217 | *
|
---|
1218 | * @returns VBox status code.
|
---|
1219 | * VINF_SUCCESS means we completely handled this trap,
|
---|
1220 | * other codes are passed back to host context.
|
---|
1221 | *
|
---|
1222 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
1223 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1224 | * @internal
|
---|
1225 | */
|
---|
1226 | DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
1227 | {
|
---|
1228 | return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
|
---|
1229 | }
|
---|
1230 |
|
---|
1231 |
|
---|
1232 | /**
|
---|
1233 | * Hypervisor \#GP (General Protection Fault) handler.
|
---|
1234 | *
|
---|
1235 | * Scans for the EIP in the registered trap handlers.
|
---|
1236 | *
|
---|
1237 | * @returns VBox status code.
|
---|
1238 | * VINF_SUCCESS means we completely handled this trap,
|
---|
1239 | * other codes are passed back to host context.
|
---|
1240 | *
|
---|
1241 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
1242 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1243 | * @internal
|
---|
1244 | */
|
---|
1245 | DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
1246 | {
|
---|
1247 | return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
|
---|
1248 | }
|
---|
1249 |
|
---|
1250 |
|
---|
1251 | /**
|
---|
1252 | * Hypervisor \#PF (Page Fault) handler.
|
---|
1253 | *
|
---|
1254 | * Scans for the EIP in the registered trap handlers.
|
---|
1255 | *
|
---|
1256 | * @returns VBox status code.
|
---|
1257 | * VINF_SUCCESS means we completely handled this trap,
|
---|
1258 | * other codes are passed back to host context.
|
---|
1259 | *
|
---|
1260 | * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
|
---|
1261 | * @param pRegFrame Pointer to the register frame for the trap.
|
---|
1262 | * @internal
|
---|
1263 | */
|
---|
1264 | DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
|
---|
1265 | {
|
---|
1266 | return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
|
---|
1267 | }
|
---|
1268 |
|
---|
1269 |
|
---|
1270 | /**
|
---|
1271 | * Deal with hypervisor traps occurring when resuming execution on a trap.
|
---|
1272 | *
|
---|
1273 | * @returns VBox status code.
|
---|
1274 | * @param pVM Pointer to the VM.
|
---|
1275 | * @param pRegFrame Register frame.
|
---|
1276 | * @param uUser User arg.
|
---|
1277 | */
|
---|
1278 | DECLCALLBACK(int) trpmGCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
|
---|
1279 | {
|
---|
1280 | Log(("********************************************************\n"));
|
---|
1281 | Log(("trpmGCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
|
---|
1282 | Log(("********************************************************\n"));
|
---|
1283 |
|
---|
1284 | if (uUser & TRPM_TRAP_IN_HYPER)
|
---|
1285 | {
|
---|
1286 | /*
|
---|
1287 | * Check that there is still some stack left, if not we'll flag
|
---|
1288 | * a guru meditation (the alternative is a triple fault).
|
---|
1289 | */
|
---|
1290 | RTRCUINTPTR cbStackUsed = (RTRCUINTPTR)VMMGetStackRC(VMMGetCpu(pVM)) - pRegFrame->esp;
|
---|
1291 | if (cbStackUsed > VMM_STACK_SIZE - _1K)
|
---|
1292 | {
|
---|
1293 | LogRel(("trpmGCTrapInGeneric: ran out of stack: esp=#x cbStackUsed=%#x\n", pRegFrame->esp, cbStackUsed));
|
---|
1294 | return VERR_TRPM_DONT_PANIC;
|
---|
1295 | }
|
---|
1296 |
|
---|
1297 | /*
|
---|
1298 | * Just zero the register containing the selector in question.
|
---|
1299 | * We'll deal with the actual stale or troublesome selector value in
|
---|
1300 | * the outermost trap frame.
|
---|
1301 | */
|
---|
1302 | switch (uUser & TRPM_TRAP_IN_OP_MASK)
|
---|
1303 | {
|
---|
1304 | case TRPM_TRAP_IN_MOV_GS:
|
---|
1305 | pRegFrame->eax = 0;
|
---|
1306 | pRegFrame->gs.Sel = 0; /* prevent recursive trouble. */
|
---|
1307 | break;
|
---|
1308 | case TRPM_TRAP_IN_MOV_FS:
|
---|
1309 | pRegFrame->eax = 0;
|
---|
1310 | pRegFrame->fs.Sel = 0; /* prevent recursive trouble. */
|
---|
1311 | return VINF_SUCCESS;
|
---|
1312 |
|
---|
1313 | default:
|
---|
1314 | AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
|
---|
1315 | return VERR_TRPM_BAD_TRAP_IN_OP;
|
---|
1316 | }
|
---|
1317 | }
|
---|
1318 | else
|
---|
1319 | {
|
---|
1320 | /*
|
---|
1321 | * Reconstruct the guest context and switch to the recompiler.
|
---|
1322 | * We ASSUME we're only at
|
---|
1323 | */
|
---|
1324 | CPUMCTXCORE CtxCore = *pRegFrame;
|
---|
1325 | uint32_t *pEsp = (uint32_t *)pRegFrame->esp;
|
---|
1326 | int rc;
|
---|
1327 |
|
---|
1328 | switch (uUser)
|
---|
1329 | {
|
---|
1330 | /*
|
---|
1331 | * This will only occur when resuming guest code in a trap handler!
|
---|
1332 | */
|
---|
1333 | /* @note ASSUMES esp points to the temporary guest CPUMCTXCORE!!! */
|
---|
1334 | case TRPM_TRAP_IN_MOV_GS:
|
---|
1335 | case TRPM_TRAP_IN_MOV_FS:
|
---|
1336 | case TRPM_TRAP_IN_MOV_ES:
|
---|
1337 | case TRPM_TRAP_IN_MOV_DS:
|
---|
1338 | {
|
---|
1339 | PCPUMCTXCORE pTempGuestCtx = (PCPUMCTXCORE)pEsp;
|
---|
1340 |
|
---|
1341 | /* Just copy the whole thing; several selector registers, eip (etc) and eax are not yet in pRegFrame. */
|
---|
1342 | CtxCore = *pTempGuestCtx;
|
---|
1343 | rc = VINF_EM_RAW_STALE_SELECTOR;
|
---|
1344 | break;
|
---|
1345 | }
|
---|
1346 |
|
---|
1347 | /*
|
---|
1348 | * This will only occur when resuming guest code!
|
---|
1349 | */
|
---|
1350 | case TRPM_TRAP_IN_IRET:
|
---|
1351 | CtxCore.eip = *pEsp++;
|
---|
1352 | CtxCore.cs.Sel = (RTSEL)*pEsp++;
|
---|
1353 | CtxCore.eflags.u32 = *pEsp++;
|
---|
1354 | CtxCore.esp = *pEsp++;
|
---|
1355 | CtxCore.ss.Sel = (RTSEL)*pEsp++;
|
---|
1356 | rc = VINF_EM_RAW_IRET_TRAP;
|
---|
1357 | break;
|
---|
1358 |
|
---|
1359 | /*
|
---|
1360 | * This will only occur when resuming V86 guest code!
|
---|
1361 | */
|
---|
1362 | case TRPM_TRAP_IN_IRET | TRPM_TRAP_IN_V86:
|
---|
1363 | CtxCore.eip = *pEsp++;
|
---|
1364 | CtxCore.cs.Sel = (RTSEL)*pEsp++;
|
---|
1365 | CtxCore.eflags.u32 = *pEsp++;
|
---|
1366 | CtxCore.esp = *pEsp++;
|
---|
1367 | CtxCore.ss.Sel = (RTSEL)*pEsp++;
|
---|
1368 | CtxCore.es.Sel = (RTSEL)*pEsp++;
|
---|
1369 | CtxCore.ds.Sel = (RTSEL)*pEsp++;
|
---|
1370 | CtxCore.fs.Sel = (RTSEL)*pEsp++;
|
---|
1371 | CtxCore.gs.Sel = (RTSEL)*pEsp++;
|
---|
1372 | rc = VINF_EM_RAW_IRET_TRAP;
|
---|
1373 | break;
|
---|
1374 |
|
---|
1375 | default:
|
---|
1376 | AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
|
---|
1377 | return VERR_TRPM_BAD_TRAP_IN_OP;
|
---|
1378 | }
|
---|
1379 |
|
---|
1380 |
|
---|
1381 | CPUMSetGuestCtxCore(VMMGetCpu0(pVM), &CtxCore);
|
---|
1382 | TRPMGCHyperReturnToHost(pVM, rc);
|
---|
1383 | }
|
---|
1384 |
|
---|
1385 | AssertMsgFailed(("Impossible!\n"));
|
---|
1386 | return VERR_TRPM_IPE_3;
|
---|
1387 | }
|
---|
1388 |
|
---|