VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp@ 46420

Last change on this file since 46420 was 46420, checked in by vboxsync, 12 years ago

VMM, recompiler: Purge deprecated macros.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 52.1 KB
Line 
1/* $Id: TRPMRCHandlers.cpp 46420 2013-06-06 16:27:25Z vboxsync $ */
2/** @file
3 * TRPM - Raw-mode Context Trap Handlers, CPP part
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_TRPM
23#include <VBox/vmm/selm.h>
24#include <VBox/vmm/iom.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/pdmapi.h>
27#include <VBox/vmm/dbgf.h>
28#include <VBox/vmm/em.h>
29#include <VBox/vmm/csam.h>
30#include <VBox/vmm/patm.h>
31#include <VBox/vmm/mm.h>
32#include <VBox/vmm/cpum.h>
33#include "TRPMInternal.h"
34#include <VBox/vmm/vm.h>
35#include <VBox/vmm/vmm.h>
36#include <VBox/param.h>
37
38#include <VBox/err.h>
39#include <VBox/dis.h>
40#include <VBox/disopcode.h>
41#include <VBox/log.h>
42#include <VBox/vmm/tm.h>
43#include <iprt/asm.h>
44#include <iprt/asm-amd64-x86.h>
45#include <iprt/assert.h>
46#include <iprt/x86.h>
47
48
49/*******************************************************************************
50* Defined Constants And Macros *
51*******************************************************************************/
52/* still here. MODR/M byte parsing */
53#define X86_OPCODE_MODRM_MOD_MASK 0xc0
54#define X86_OPCODE_MODRM_REG_MASK 0x38
55#define X86_OPCODE_MODRM_RM_MASK 0x07
56
57/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
58#define DTRACE_EXPERIMENT
59
60#if 1
61# define TRPM_ENTER_DBG_HOOK(a_iVector) do {} while (0)
62# define TRPM_EXIT_DBG_HOOK(a_iVector) do {} while (0)
63# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
64# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
65#else
66# define TRPM_ENTER_DBG_HOOK(a_iVector) \
67 uint32_t const fDbgEFlags1 = CPUMRawGetEFlags(pVCpu); \
68 if (!(fDbgEFlags1 & X86_EFL_IF)) Log(("%s: IF=0 ##\n", __FUNCTION__)); \
69 else do {} while(0)
70# define TRPM_EXIT_DBG_HOOK(a_iVector) \
71 do { \
72 uint32_t const fDbgEFlags2 = CPUMRawGetEFlags(pVCpu); \
73 if ((fDbgEFlags1 ^ fDbgEFlags2) & (X86_EFL_IF | X86_EFL_IOPL)) \
74 Log(("%s: IF=%d->%d IOPL=%d->%d !#\n", __FUNCTION__, \
75 !!(fDbgEFlags1 & X86_EFL_IF), !!(fDbgEFlags2 & X86_EFL_IF), \
76 X86_EFL_GET_IOPL(fDbgEFlags1), X86_EFL_GET_IOPL(fDbgEFlags2) )); \
77 else if (!(fDbgEFlags2 & X86_EFL_IF)) Log(("%s: IF=0 [ret] ##\n", __FUNCTION__)); \
78 } while (0)
79# define TRPM_ENTER_DBG_HOOK_HYPER(a_iVector) do {} while (0)
80# define TRPM_EXIT_DBG_HOOK_HYPER(a_iVector) do {} while (0)
81#endif
82
83/*******************************************************************************
84* Structures and Typedefs *
85*******************************************************************************/
86/** Pointer to a readonly hypervisor trap record. */
87typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
88
89/**
90 * A hypervisor trap record.
91 * This contains information about a handler for a instruction range.
92 *
93 * @remark This must match what TRPM_HANDLER outputs.
94 */
95typedef struct TRPMGCHYPER
96{
97 /** The start address. */
98 uintptr_t uStartEIP;
99 /** The end address. (exclusive)
100 * If NULL the it's only for the instruction at pvStartEIP. */
101 uintptr_t uEndEIP;
102 /**
103 * The handler.
104 *
105 * @returns VBox status code
106 * VINF_SUCCESS means we've handled the trap.
107 * Any other error code means returning to the host context.
108 * @param pVM Pointer to the VM.
109 * @param pRegFrame The register frame.
110 * @param uUser The user argument.
111 */
112 DECLRCCALLBACKMEMBER(int, pfnHandler, (PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser));
113 /** Whatever the handler desires to put here. */
114 uintptr_t uUser;
115} TRPMGCHYPER;
116
117
118/*******************************************************************************
119* Global Variables *
120*******************************************************************************/
121RT_C_DECLS_BEGIN
122/** Defined in VMMGC0.asm or VMMGC99.asm.
123 * @{ */
124extern const TRPMGCHYPER g_aTrap0bHandlers[1];
125extern const TRPMGCHYPER g_aTrap0bHandlersEnd[1];
126extern const TRPMGCHYPER g_aTrap0dHandlers[1];
127extern const TRPMGCHYPER g_aTrap0dHandlersEnd[1];
128extern const TRPMGCHYPER g_aTrap0eHandlers[1];
129extern const TRPMGCHYPER g_aTrap0eHandlersEnd[1];
130/** @} */
131RT_C_DECLS_END
132
133
134/*******************************************************************************
135* Internal Functions *
136*******************************************************************************/
137RT_C_DECLS_BEGIN /* addressed from asm (not called so no DECLASM). */
138DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser);
139RT_C_DECLS_END
140
141
142
143/**
144 * Exits the trap, called when exiting a trap handler.
145 *
146 * Will reset the trap if it's not a guest trap or the trap
147 * is already handled. Will process resume guest FFs.
148 *
149 * @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
150 * happened.
151 * @param pVM Pointer to the VM.
152 * @param pVCpu Pointer to the VMCPU.
153 * @param rc The VBox status code to return.
154 * @param pRegFrame Pointer to the register frame for the trap.
155 *
156 * @remarks This must not be used for hypervisor traps, only guest traps.
157 */
158static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
159{
160 uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
161 NOREF(uOldActiveVector);
162
163 /* Reset trap? */
164 if ( rc != VINF_EM_RAW_GUEST_TRAP
165 && rc != VINF_EM_RAW_RING_SWITCH_INT)
166 pVCpu->trpm.s.uActiveVector = UINT32_MAX;
167
168#ifdef VBOX_HIGH_RES_TIMERS_HACK
169 /*
170 * We should poll the timers occasionally.
171 * We must *NOT* do this too frequently as it adds a significant overhead
172 * and it'll kill us if the trap load is high. (See @bugref{1354}.)
173 * (The heuristic is not very intelligent, we should really check trap
174 * frequency etc. here, but alas, we lack any such information atm.)
175 */
176 static unsigned s_iTimerPoll = 0;
177 if (rc == VINF_SUCCESS)
178 {
179 if (!(++s_iTimerPoll & 0xf))
180 {
181 TMTimerPollVoid(pVM, pVCpu);
182 Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
183 VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER)));
184 }
185 }
186 else
187 s_iTimerPoll = 0;
188#endif
189
190 /* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
191 if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
192 {
193 Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
194 if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
195 {
196 /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
197 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
198 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
199 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
200 */
201 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
202 }
203 }
204
205 /*
206 * Pending resume-guest-FF?
207 * Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
208 */
209 if ( rc == VINF_SUCCESS
210 && ( VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC | VM_FF_REQUEST | VM_FF_PGM_NO_MEMORY | VM_FF_PDM_DMA)
211 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER | VMCPU_FF_TO_R3 | VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC
212 | VMCPU_FF_REQUEST | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
213 | VMCPU_FF_PDM_CRITSECT
214 | VMCPU_FF_SELM_SYNC_GDT | VMCPU_FF_SELM_SYNC_LDT | VMCPU_FF_SELM_SYNC_TSS
215 )
216 )
217 )
218 {
219 /* The out of memory condition naturally outranks the others. */
220 if (RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)))
221 rc = VINF_EM_NO_MEMORY;
222 /* Pending Ring-3 action. */
223 else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TO_R3 | VMCPU_FF_PDM_CRITSECT))
224 {
225 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
226 rc = VINF_EM_RAW_TO_R3;
227 }
228 /* Pending timer action. */
229 else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TIMER))
230 rc = VINF_EM_RAW_TIMER_PENDING;
231 /* The Virtual Sync clock has stopped. */
232 else if (VM_FF_IS_PENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
233 rc = VINF_EM_RAW_TO_R3;
234 /* DMA work pending? */
235 else if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
236 rc = VINF_EM_RAW_TO_R3;
237 /* Pending request packets might contain actions that need immediate
238 attention, such as pending hardware interrupts. */
239 else if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
240 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
241 rc = VINF_EM_PENDING_REQUEST;
242 /* Pending GDT/LDT/TSS sync. */
243 else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT | VMCPU_FF_SELM_SYNC_LDT | VMCPU_FF_SELM_SYNC_TSS))
244 rc = VINF_SELM_SYNC_GDT;
245 /* Pending interrupt: dispatch it. */
246 else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
247 && !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
248 && PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
249 )
250 {
251 uint8_t u8Interrupt;
252 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
253 Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
254 AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
255 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
256 /* can't return if successful */
257 Assert(rc != VINF_SUCCESS);
258
259 /* Stop the profile counter that was started in TRPMGCHandlersA.asm */
260 Assert(uOldActiveVector <= 16);
261 STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
262
263 /* Assert the trap and go to the recompiler to dispatch it. */
264 TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
265
266 STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
267 rc = VINF_EM_RAW_INTERRUPT_PENDING;
268 }
269 /*
270 * Try sync CR3?
271 */
272 else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
273 {
274#if 1
275 PGMRZDynMapReleaseAutoSet(pVCpu);
276 PGMRZDynMapStartAutoSet(pVCpu);
277 rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
278#else
279 rc = VINF_PGM_SYNC_CR3;
280#endif
281 }
282 }
283
284 /* Note! TRPMRCHandlersA.asm performs sanity checks in debug builds.*/
285 PGMRZDynMapReleaseAutoSet(pVCpu);
286 return rc;
287}
288
289
290/**
291 * \#DB (Debug event) handler.
292 *
293 * @returns VBox status code.
294 * VINF_SUCCESS means we completely handled this trap,
295 * other codes are passed execution to host context.
296 *
297 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
298 * @param pRegFrame Pointer to the register frame for the trap.
299 * @internal
300 */
301DECLASM(int) TRPMGCTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
302{
303 RTGCUINTREG uDr6 = ASMGetAndClearDR6();
304 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
305 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
306 LogFlow(("TRPMGC01: cs:eip=%04x:%08x uDr6=%RTreg EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
307 TRPM_ENTER_DBG_HOOK(1);
308
309 /*
310 * We currently don't make use of the X86_DR7_GD bit, but
311 * there might come a time when we do.
312 */
313 AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
314 ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
315 ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
316 VERR_NOT_IMPLEMENTED);
317 AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
318
319 /*
320 * Now leave the rest to the DBGF.
321 */
322 PGMRZDynMapStartAutoSet(pVCpu);
323 int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
324 if (rc == VINF_EM_RAW_GUEST_TRAP)
325 CPUMSetGuestDR6(pVCpu, uDr6);
326
327 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
328 Log6(("TRPMGC01: %Rrc (%04x:%08x %RTreg %EFlag=%#x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6, CPUMRawGetEFlags(pVCpu)));
329 TRPM_EXIT_DBG_HOOK(1);
330 return rc;
331}
332
333
334/**
335 * \#DB (Debug event) handler for the hypervisor code.
336 *
337 * This is mostly the same as TRPMGCTrap01Handler, but we skip the PGM auto
338 * mapping set as well as the default trap exit path since they are both really
339 * bad ideas in this context.
340 *
341 * @returns VBox status code.
342 * VINF_SUCCESS means we completely handled this trap,
343 * other codes are passed execution to host context.
344 *
345 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
346 * @param pRegFrame Pointer to the register frame for the trap.
347 * @internal
348 */
349DECLASM(int) TRPMGCHyperTrap01Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
350{
351 RTGCUINTREG uDr6 = ASMGetAndClearDR6();
352 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
353 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
354 TRPM_ENTER_DBG_HOOK_HYPER(1);
355 LogFlow(("TRPMGCHyper01: cs:eip=%04x:%08x uDr6=%RTreg\n", pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
356
357 /*
358 * We currently don't make use of the X86_DR7_GD bit, but
359 * there might come a time when we do.
360 */
361 AssertReleaseMsgReturn((uDr6 & X86_DR6_BD) != X86_DR6_BD,
362 ("X86_DR6_BD isn't used, but it's set! dr7=%RTreg(%RTreg) dr6=%RTreg\n",
363 ASMGetDR7(), CPUMGetHyperDR7(pVCpu), uDr6),
364 VERR_NOT_IMPLEMENTED);
365 AssertReleaseMsg(!(uDr6 & X86_DR6_BT), ("X86_DR6_BT is impossible!\n"));
366
367 /*
368 * Now leave the rest to the DBGF.
369 */
370 int rc = DBGFRZTrap01Handler(pVM, pVCpu, pRegFrame, uDr6);
371 AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_1);
372
373 Log6(("TRPMGCHyper01: %Rrc (%04x:%08x %RTreg)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, uDr6));
374 TRPM_EXIT_DBG_HOOK_HYPER(1);
375 return rc;
376}
377
378
379/**
380 * NMI handler, for when we are using NMIs to debug things.
381 *
382 * @returns VBox status code.
383 * VINF_SUCCESS means we completely handled this trap,
384 * other codes are passed execution to host context.
385 *
386 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
387 * @param pRegFrame Pointer to the register frame for the trap.
388 * @internal
389 * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
390 */
391DECLASM(int) TRPMGCTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
392{
393 LogFlow(("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
394 RTLogComPrintf("TRPMGCTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
395 NOREF(pTrpmCpu);
396 return VERR_TRPM_DONT_PANIC;
397}
398
399
400/**
401 * NMI handler, for when we are using NMIs to debug things.
402 *
403 * This is the handler we're most likely to hit when the NMI fires (it is
404 * unlikely that we'll be stuck in guest code).
405 *
406 * @returns VBox status code.
407 * VINF_SUCCESS means we completely handled this trap,
408 * other codes are passed execution to host context.
409 *
410 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
411 * @param pRegFrame Pointer to the register frame for the trap.
412 * @internal
413 * @remark This is not hooked up unless you're building with VBOX_WITH_NMI defined.
414 */
415DECLASM(int) TRPMGCHyperTrap02Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
416{
417 LogFlow(("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip));
418 RTLogComPrintf("TRPMGCHyperTrap02Handler: cs:eip=%04x:%08x\n", pRegFrame->cs.Sel, pRegFrame->eip);
419 NOREF(pTrpmCpu);
420 return VERR_TRPM_DONT_PANIC;
421}
422
423
424/**
425 * \#BP (Breakpoint) handler.
426 *
427 * @returns VBox status code.
428 * VINF_SUCCESS means we completely handled this trap,
429 * other codes are passed execution to host context.
430 *
431 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
432 * @param pRegFrame Pointer to the register frame for the trap.
433 * @internal
434 */
435DECLASM(int) TRPMGCTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
436{
437 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
438 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
439 int rc;
440 LogFlow(("TRPMGC03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
441 TRPM_ENTER_DBG_HOOK(3);
442 PGMRZDynMapStartAutoSet(pVCpu);
443
444 /*
445 * PATM is using INT3s, let them have a go first.
446 */
447 if ( ( (pRegFrame->ss.Sel & X86_SEL_RPL) == 1
448 || (EMIsRawRing1Enabled(pVM) && (pRegFrame->ss.Sel & X86_SEL_RPL) == 2) )
449 && !pRegFrame->eflags.Bits.u1VM)
450 {
451 rc = PATMRCHandleInt3PatchTrap(pVM, pRegFrame);
452 if ( rc == VINF_SUCCESS
453 || rc == VINF_EM_RAW_EMULATE_INSTR
454 || rc == VINF_PATM_PATCH_INT3
455 || rc == VINF_PATM_DUPLICATE_FUNCTION)
456 {
457 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
458 Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
459 TRPM_EXIT_DBG_HOOK(3);
460 return rc;
461 }
462 }
463 rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
464
465 /* anything we should do with this? Schedule it in GC? */
466 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
467 Log6(("TRPMGC03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
468 TRPM_EXIT_DBG_HOOK(3);
469 return rc;
470}
471
472
473/**
474 * \#BP (Breakpoint) handler.
475 *
476 * This is similar to TRPMGCTrap03Handler but we bits which are potentially
477 * harmful to us (common trap exit and the auto mapping set).
478 *
479 * @returns VBox status code.
480 * VINF_SUCCESS means we completely handled this trap,
481 * other codes are passed execution to host context.
482 *
483 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
484 * @param pRegFrame Pointer to the register frame for the trap.
485 * @internal
486 */
487DECLASM(int) TRPMGCHyperTrap03Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
488{
489 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
490 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
491 LogFlow(("TRPMGCHyper03: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
492 TRPM_ENTER_DBG_HOOK_HYPER(3);
493
494 /*
495 * Hand it over to DBGF.
496 */
497 int rc = DBGFRZTrap03Handler(pVM, pVCpu, pRegFrame);
498 AssertStmt(rc != VINF_EM_RAW_GUEST_TRAP, rc = VERR_TRPM_IPE_2);
499
500 Log6(("TRPMGCHyper03: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
501 TRPM_EXIT_DBG_HOOK_HYPER(3);
502 return rc;
503}
504
505
506/**
507 * Trap handler for illegal opcode fault (\#UD).
508 *
509 * @returns VBox status code.
510 * VINF_SUCCESS means we completely handled this trap,
511 * other codes are passed execution to host context.
512 *
513 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
514 * @param pRegFrame Pointer to the register frame for the trap.
515 * @internal
516 */
517DECLASM(int) TRPMGCTrap06Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
518{
519 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
520 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
521 int rc;
522 LogFlow(("TRPMGC06: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->eflags.u32, CPUMRawGetEFlags(pVCpu)));
523 TRPM_ENTER_DBG_HOOK(6);
524 PGMRZDynMapStartAutoSet(pVCpu);
525
526 if (CPUMGetGuestCPL(pVCpu) <= (EMIsRawRing1Enabled(pVM) ? 1U : 0U))
527 {
528 /*
529 * Decode the instruction.
530 */
531 RTGCPTR PC;
532 rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
533 pRegFrame->rip, &PC);
534 if (RT_FAILURE(rc))
535 {
536 Log(("TRPMGCTrap06Handler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n", pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
537 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
538 Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (SELM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
539 TRPM_EXIT_DBG_HOOK(6);
540 return rc;
541 }
542
543 DISCPUSTATE Cpu;
544 uint32_t cbOp;
545 rc = EMInterpretDisasOneEx(pVM, pVCpu, (RTGCUINTPTR)PC, pRegFrame, &Cpu, &cbOp);
546 if (RT_FAILURE(rc))
547 {
548 rc = trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
549 Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (EM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
550 TRPM_EXIT_DBG_HOOK(6);
551 return rc;
552 }
553
554 /*
555 * UD2 in a patch?
556 * Note! PATMGCHandleIllegalInstrTrap doesn't always return.
557 */
558 if ( Cpu.pCurInstr->uOpcode == OP_ILLUD2
559 && PATMIsPatchGCAddr(pVM, pRegFrame->eip))
560 {
561 LogFlow(("TRPMGCTrap06Handler: -> PATMRCHandleIllegalInstrTrap\n"));
562 rc = PATMRCHandleIllegalInstrTrap(pVM, pRegFrame);
563 /** @todo These tests are completely unnecessary, should just follow the
564 * flow and return at the end of the function. */
565 if ( rc == VINF_SUCCESS
566 || rc == VINF_EM_RAW_EMULATE_INSTR
567 || rc == VINF_PATM_DUPLICATE_FUNCTION
568 || rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
569 || rc == VINF_EM_RESCHEDULE)
570 {
571 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
572 Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x) (PATM)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
573 TRPM_EXIT_DBG_HOOK(6);
574 return rc;
575 }
576 }
577 /*
578 * Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
579 */
580 else if (Cpu.fPrefix & DISPREFIX_LOCK)
581 {
582 Log(("TRPMGCTrap06Handler: pc=%08x op=%d\n", pRegFrame->eip, Cpu.pCurInstr->uOpcode));
583#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
584 Assert(!PATMIsPatchGCAddr(pVM, pRegFrame->eip));
585 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
586 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
587#else
588 rc = VINF_EM_RAW_EMULATE_INSTR;
589#endif
590 }
591 /*
592 * Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
593 */
594 else if (Cpu.pCurInstr->uOpcode == OP_MONITOR)
595 {
596 LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
597 rc = EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
598 }
599 /* Never generate a raw trap here; it might be an instruction, that requires emulation. */
600 else
601 {
602 LogFlow(("TRPMGCTrap06Handler: -> VINF_EM_RAW_EMULATE_INSTR\n"));
603 rc = VINF_EM_RAW_EMULATE_INSTR;
604 }
605 }
606 else
607 {
608 LogFlow(("TRPMGCTrap06Handler: -> TRPMForwardTrap\n"));
609 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
610 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
611 }
612
613 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
614 Log6(("TRPMGC06: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
615 TRPM_EXIT_DBG_HOOK(6);
616 return rc;
617}
618
619
620/**
621 * Trap handler for device not present fault (\#NM).
622 *
623 * Device not available, FP or (F)WAIT instruction.
624 *
625 * @returns VBox status code.
626 * VINF_SUCCESS means we completely handled this trap,
627 * other codes are passed execution to host context.
628 *
629 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
630 * @param pRegFrame Pointer to the register frame for the trap.
631 * @internal
632 */
633DECLASM(int) TRPMGCTrap07Handler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
634{
635 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
636 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
637 LogFlow(("TRPMGC07: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
638 TRPM_ENTER_DBG_HOOK(7);
639 PGMRZDynMapStartAutoSet(pVCpu);
640
641 int rc = CPUMHandleLazyFPU(pVCpu);
642 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
643 Log6(("TRPMGC07: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
644 TRPM_EXIT_DBG_HOOK(7);
645 return rc;
646}
647
648
649/**
650 * \#NP ((segment) Not Present) handler.
651 *
652 * @returns VBox status code.
653 * VINF_SUCCESS means we completely handled this trap,
654 * other codes are passed execution to host context.
655 *
656 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
657 * @param pRegFrame Pointer to the register frame for the trap.
658 * @internal
659 */
660DECLASM(int) TRPMGCTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
661{
662 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
663 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
664 LogFlow(("TRPMGC0b: %04x:%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
665 TRPM_ENTER_DBG_HOOK(0xb);
666 PGMRZDynMapStartAutoSet(pVCpu);
667
668 /*
669 * Try to detect instruction by opcode which caused trap.
670 * XXX note: this code may cause \#PF (trap e) or \#GP (trap d) while
671 * accessing user code. need to handle it somehow in future!
672 */
673 RTGCPTR GCPtr;
674 if ( SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
675 (RTGCPTR)pRegFrame->eip, &GCPtr)
676 == VINF_SUCCESS)
677 {
678 uint8_t *pu8Code = (uint8_t *)(uintptr_t)GCPtr;
679
680 /*
681 * First skip possible instruction prefixes, such as:
682 * OS, AS
683 * CS:, DS:, ES:, SS:, FS:, GS:
684 * REPE, REPNE
685 *
686 * note: Currently we supports only up to 4 prefixes per opcode, more
687 * prefixes (normally not used anyway) will cause trap d in guest.
688 * note: Instruction length in IA-32 may be up to 15 bytes, we dont
689 * check this issue, its too hard.
690 */
691 for (unsigned i = 0; i < 4; i++)
692 {
693 if ( pu8Code[0] != 0xf2 /* REPNE/REPNZ */
694 && pu8Code[0] != 0xf3 /* REP/REPE/REPZ */
695 && pu8Code[0] != 0x2e /* CS: */
696 && pu8Code[0] != 0x36 /* SS: */
697 && pu8Code[0] != 0x3e /* DS: */
698 && pu8Code[0] != 0x26 /* ES: */
699 && pu8Code[0] != 0x64 /* FS: */
700 && pu8Code[0] != 0x65 /* GS: */
701 && pu8Code[0] != 0x66 /* OS */
702 && pu8Code[0] != 0x67 /* AS */
703 )
704 break;
705 pu8Code++;
706 }
707
708 /*
709 * Detect right switch using a callgate.
710 *
711 * We recognize the following causes for the trap 0b:
712 * CALL FAR, CALL FAR []
713 * JMP FAR, JMP FAR []
714 * IRET (may cause a task switch)
715 *
716 * Note: we can't detect whether the trap was caused by a call to a
717 * callgate descriptor or it is a real trap 0b due to a bad selector.
718 * In both situations we'll pass execution to our recompiler so we don't
719 * have to worry.
720 * If we wanted to do better detection, we have set GDT entries to callgate
721 * descriptors pointing to our own handlers.
722 */
723 /** @todo not sure about IRET, may generate Trap 0d (\#GP), NEED TO CHECK! */
724 if ( pu8Code[0] == 0x9a /* CALL FAR */
725 || ( pu8Code[0] == 0xff /* CALL FAR [] */
726 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x18)
727 || pu8Code[0] == 0xea /* JMP FAR */
728 || ( pu8Code[0] == 0xff /* JMP FAR [] */
729 && (pu8Code[1] & X86_OPCODE_MODRM_REG_MASK) == 0x28)
730 || pu8Code[0] == 0xcf /* IRET */
731 )
732 {
733 /*
734 * Got potential call to callgate.
735 * We simply return execution to the recompiler to do emulation
736 * starting from the instruction which caused the trap.
737 */
738 pTrpmCpu->uActiveVector = UINT32_MAX;
739 Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x) (CG)\n", VINF_EM_RAW_RING_SWITCH, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
740 TRPM_EXIT_DBG_HOOK(0xb);
741 PGMRZDynMapReleaseAutoSet(pVCpu);
742 return VINF_EM_RAW_RING_SWITCH;
743 }
744 }
745
746 /*
747 * Pass trap 0b as is to the recompiler in all other cases.
748 */
749 Log6(("TRPMGC0b: %Rrc (%04x:%08x EFL=%x)\n", VINF_EM_RAW_GUEST_TRAP, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
750 PGMRZDynMapReleaseAutoSet(pVCpu);
751 TRPM_EXIT_DBG_HOOK(0xb);
752 return VINF_EM_RAW_GUEST_TRAP;
753}
754
755
756/**
757 * \#GP (General Protection Fault) handler for Ring-0 privileged instructions.
758 *
759 * @returns VBox status code.
760 * VINF_SUCCESS means we completely handled this trap,
761 * other codes are passed execution to host context.
762 *
763 * @param pVM Pointer to the VM.
764 * @param pVCpu Pointer to the VMCPU.
765 * @param pRegFrame Pointer to the register frame for the trap.
766 * @param pCpu The opcode info.
767 * @param PC The program counter corresponding to cs:eip in pRegFrame.
768 */
769static int trpmGCTrap0dHandlerRing0(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
770{
771 int rc;
772 TRPM_ENTER_DBG_HOOK(0xd);
773
774 /*
775 * Try handle it here, if not return to HC and emulate/interpret it there.
776 */
777 switch (pCpu->pCurInstr->uOpcode)
778 {
779 case OP_INT3:
780 /*
781 * Little hack to make the code below not fail
782 */
783 pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
784 pCpu->Param1.uValue = 3;
785 /* fallthru */
786 case OP_INT:
787 {
788 Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
789 Assert(!(PATMIsPatchGCAddr(pVM, PC)));
790 if (pCpu->Param1.uValue == 3)
791 {
792 /* Int 3 replacement patch? */
793 if (PATMRCHandleInt3PatchTrap(pVM, pRegFrame) == VINF_SUCCESS)
794 {
795 AssertFailed();
796 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
797 }
798 }
799 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
800 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
801 {
802 TRPM_EXIT_DBG_HOOK(0xd);
803 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
804 }
805
806 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
807 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
808 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
809 }
810
811#ifdef PATM_EMULATE_SYSENTER
812 case OP_SYSEXIT:
813 case OP_SYSRET:
814 rc = PATMSysCall(pVM, pRegFrame, pCpu);
815 TRPM_EXIT_DBG_HOOK(0xd);
816 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
817#endif
818
819 case OP_HLT:
820 /* If it's in patch code, defer to ring-3. */
821 if (PATMIsPatchGCAddr(pVM, PC))
822 break;
823
824 pRegFrame->eip += pCpu->cbInstr;
825 TRPM_EXIT_DBG_HOOK(0xd);
826 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_HALT, pRegFrame);
827
828
829 /*
830 * These instructions are used by PATM and CASM for finding
831 * dangerous non-trapping instructions. Thus, since all
832 * scanning and patching is done in ring-3 we'll have to
833 * return to ring-3 on the first encounter of these instructions.
834 */
835 case OP_MOV_CR:
836 case OP_MOV_DR:
837 /* We can safely emulate control/debug register move instructions in patched code. */
838 if ( !PATMIsPatchGCAddr(pVM, PC)
839 && !CSAMIsKnownDangerousInstr(pVM, PC))
840 break;
841 case OP_INVLPG:
842 case OP_LLDT:
843 case OP_STI:
844 case OP_RDTSC: /* just in case */
845 case OP_RDPMC:
846 case OP_CLTS:
847 case OP_WBINVD: /* nop */
848 case OP_RDMSR:
849 case OP_WRMSR:
850 {
851 rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
852 if (rc == VERR_EM_INTERPRETER)
853 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
854 TRPM_EXIT_DBG_HOOK(0xd);
855 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
856 }
857 }
858
859 TRPM_EXIT_DBG_HOOK(0xd);
860 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EXCEPTION_PRIVILEGED, pRegFrame);
861}
862
863
864/**
865 * \#GP (General Protection Fault) handler for Ring-3.
866 *
867 * @returns VBox status code.
868 * VINF_SUCCESS means we completely handled this trap,
869 * other codes are passed execution to host context.
870 *
871 * @param pVM Pointer to the VM.
872 * @param pVCpu Pointer to the VMCPU.
873 * @param pRegFrame Pointer to the register frame for the trap.
874 * @param pCpu The opcode info.
875 * @param PC The program counter corresponding to cs:eip in pRegFrame.
876 */
877static int trpmGCTrap0dHandlerRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, PDISCPUSTATE pCpu, RTGCPTR PC)
878{
879 int rc;
880 Assert(!pRegFrame->eflags.Bits.u1VM);
881 TRPM_ENTER_DBG_HOOK(0xd);
882
883 switch (pCpu->pCurInstr->uOpcode)
884 {
885 /*
886 * INT3 and INT xx are ring-switching.
887 * (The shadow IDT will have set the entries to DPL=0, that's why we're here.)
888 */
889 case OP_INT3:
890 /*
891 * Little hack to make the code below not fail
892 */
893 pCpu->Param1.fUse = DISUSE_IMMEDIATE8;
894 pCpu->Param1.uValue = 3;
895 /* fall thru */
896 case OP_INT:
897 {
898 Assert(pCpu->Param1.fUse & DISUSE_IMMEDIATE8);
899 rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)pCpu->Param1.uValue, pCpu->cbInstr, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
900 if (RT_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
901 {
902 TRPM_EXIT_DBG_HOOK(0xd);
903 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
904 }
905
906 pVCpu->trpm.s.uActiveVector = (pVCpu->trpm.s.uActiveErrorCode & X86_TRAP_ERR_SEL_MASK) >> X86_TRAP_ERR_SEL_SHIFT;
907 pVCpu->trpm.s.enmActiveType = TRPM_SOFTWARE_INT;
908 TRPM_EXIT_DBG_HOOK(0xd);
909 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH_INT, pRegFrame);
910 }
911
912 /*
913 * SYSCALL, SYSENTER, INTO and BOUND are also ring-switchers.
914 */
915 case OP_SYSCALL:
916 case OP_SYSENTER:
917#ifdef PATM_EMULATE_SYSENTER
918 rc = PATMSysCall(pVM, pRegFrame, pCpu);
919 if (rc == VINF_SUCCESS)
920 {
921 TRPM_EXIT_DBG_HOOK(0xd);
922 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
923 }
924 /* else no break; */
925#endif
926 case OP_BOUND:
927 case OP_INTO:
928 pVCpu->trpm.s.uActiveVector = UINT32_MAX;
929 TRPM_EXIT_DBG_HOOK(0xd);
930 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_RING_SWITCH, pRegFrame);
931
932 /*
933 * Handle virtualized TSC & PMC reads, just in case.
934 */
935 case OP_RDTSC:
936 case OP_RDPMC:
937 {
938 rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
939 if (rc == VERR_EM_INTERPRETER)
940 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
941 TRPM_EXIT_DBG_HOOK(0xd);
942 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
943 }
944
945 /*
946 * STI and CLI are I/O privileged, i.e. if IOPL
947 */
948 case OP_STI:
949 case OP_CLI:
950 {
951 uint32_t efl = CPUMRawGetEFlags(pVCpu);
952 uint32_t cpl = CPUMRCGetGuestCPL(pVCpu, pRegFrame);
953 if (X86_EFL_GET_IOPL(efl) >= cpl)
954 {
955 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> REM\n"));
956 TRPM_EXIT_DBG_HOOK(0xd);
957 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RESCHEDULE_REM, pRegFrame);
958 }
959 LogFlow(("trpmGCTrap0dHandlerRing3: CLI/STI -> #GP(0) iopl=%x, cpl=%x\n", X86_EFL_GET_IOPL(efl), cpl));
960 break;
961 }
962 }
963
964 /*
965 * A genuine guest fault.
966 */
967 TRPM_EXIT_DBG_HOOK(0xd);
968 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_GUEST_TRAP, pRegFrame);
969}
970
971
972/**
973 * Emulates RDTSC for the \#GP handler.
974 *
975 * @returns VINF_SUCCESS or VINF_EM_RAW_EMULATE_INSTR.
976 *
977 * @param pVM Pointer to the VM.
978 * @param pVCpu Pointer to the VMCPU.
979 * @param pRegFrame Pointer to the register frame for the trap.
980 * This will be updated on successful return.
981 */
982DECLINLINE(int) trpmGCTrap0dHandlerRdTsc(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame)
983{
984 STAM_COUNTER_INC(&pVM->trpm.s.StatTrap0dRdTsc);
985 TRPM_ENTER_DBG_HOOK(0xd);
986
987 if (CPUMGetGuestCR4(pVCpu) & X86_CR4_TSD)
988 {
989 TRPM_EXIT_DBG_HOOK(0xd);
990 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame); /* will trap (optimize later). */
991 }
992
993 uint64_t uTicks = TMCpuTickGet(pVCpu);
994 pRegFrame->eax = uTicks;
995 pRegFrame->edx = uTicks >> 32;
996 pRegFrame->eip += 2;
997 TRPM_EXIT_DBG_HOOK(0xd);
998 return trpmGCExitTrap(pVM, pVCpu, VINF_SUCCESS, pRegFrame);
999}
1000
1001
1002/**
1003 * \#GP (General Protection Fault) handler.
1004 *
1005 * @returns VBox status code.
1006 * VINF_SUCCESS means we completely handled this trap,
1007 * other codes are passed execution to host context.
1008 *
1009 * @param pVM Pointer to the VM.
1010 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1011 * @param pRegFrame Pointer to the register frame for the trap.
1012 */
1013static int trpmGCTrap0dHandler(PVM pVM, PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1014{
1015 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1016 LogFlow(("trpmGCTrap0dHandler: cs:eip=%RTsel:%08RX32 uErr=%RGv EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, pTrpmCpu->uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1017 TRPM_ENTER_DBG_HOOK(0xd);
1018
1019 /*
1020 * Convert and validate CS.
1021 */
1022 STAM_PROFILE_START(&pVM->trpm.s.StatTrap0dDisasm, a);
1023 RTGCPTR PC;
1024 int rc = SELMValidateAndConvertCSAddr(pVCpu, pRegFrame->eflags, pRegFrame->ss.Sel, pRegFrame->cs.Sel, &pRegFrame->cs,
1025 pRegFrame->rip, &PC);
1026 if (RT_FAILURE(rc))
1027 {
1028 Log(("trpmGCTrap0dHandler: Failed to convert %RTsel:%RX32 (cpl=%d) - rc=%Rrc !!\n",
1029 pRegFrame->cs.Sel, pRegFrame->eip, pRegFrame->ss.Sel & X86_SEL_RPL, rc));
1030 TRPM_EXIT_DBG_HOOK(0xd);
1031 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1032 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1033 }
1034
1035 /*
1036 * Disassemble the instruction.
1037 */
1038 DISCPUSTATE Cpu;
1039 uint32_t cbOp;
1040 rc = EMInterpretDisasOneEx(pVM, pVCpu, PC, pRegFrame, &Cpu, &cbOp);
1041 if (RT_FAILURE(rc))
1042 {
1043 AssertMsgFailed(("DISCoreOneEx failed to PC=%RGv rc=%Rrc\n", PC, rc));
1044 TRPM_EXIT_DBG_HOOK(0xd);
1045 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1046 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1047 }
1048 STAM_PROFILE_STOP(&pVM->trpm.s.StatTrap0dDisasm, a);
1049
1050 /*
1051 * Optimize RDTSC traps.
1052 * Some guests (like Solaris) are using RDTSC all over the place and
1053 * will end up trapping a *lot* because of that.
1054 *
1055 * Note: it's no longer safe to access the instruction opcode directly due to possible stale code TLB entries
1056 */
1057 if (Cpu.pCurInstr->uOpcode == OP_RDTSC)
1058 return trpmGCTrap0dHandlerRdTsc(pVM, pVCpu, pRegFrame);
1059
1060 /*
1061 * Deal with I/O port access.
1062 */
1063 if ( pVCpu->trpm.s.uActiveErrorCode == 0
1064 && (Cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
1065 {
1066 VBOXSTRICTRC rcStrict = IOMRCIOPortHandler(pVM, pVCpu, pRegFrame, &Cpu);
1067 if (IOM_SUCCESS(rcStrict))
1068 pRegFrame->rip += cbOp;
1069 rc = VBOXSTRICTRC_TODO(rcStrict);
1070 TRPM_EXIT_DBG_HOOK(0xd);
1071 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1072 }
1073
1074 /*
1075 * Deal with Ring-0 (privileged instructions)
1076 */
1077 if ( (pRegFrame->ss.Sel & X86_SEL_RPL) <= 1
1078 && !pRegFrame->eflags.Bits.u1VM)
1079 return trpmGCTrap0dHandlerRing0(pVM, pVCpu, pRegFrame, &Cpu, PC);
1080
1081 /*
1082 * Deal with Ring-3 GPs.
1083 */
1084 if (!pRegFrame->eflags.Bits.u1VM)
1085 return trpmGCTrap0dHandlerRing3(pVM, pVCpu, pRegFrame, &Cpu, PC);
1086
1087 /*
1088 * Deal with v86 code.
1089 *
1090 * We always set IOPL to zero which makes e.g. pushf fault in V86
1091 * mode. The guest might use IOPL=3 and therefore not expect a #GP.
1092 * Simply fall back to the recompiler to emulate this instruction if
1093 * that's the case. To get the correct we must use CPUMRawGetEFlags.
1094 */
1095 X86EFLAGS eflags;
1096 eflags.u32 = CPUMRawGetEFlags(pVCpu); /* Get the correct value. */
1097 Log3(("TRPM #GP V86: cs:eip=%04x:%08x IOPL=%d efl=%08x\n", pRegFrame->cs.Sel, pRegFrame->eip, eflags.Bits.u2IOPL, eflags.u));
1098 if (eflags.Bits.u2IOPL != 3)
1099 {
1100 Assert(EMIsRawRing1Enabled(pVM) || eflags.Bits.u2IOPL == 0);
1101
1102 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
1103 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1104 TRPM_EXIT_DBG_HOOK(0xd);
1105 return trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1106 }
1107 TRPM_EXIT_DBG_HOOK(0xd);
1108 return trpmGCExitTrap(pVM, pVCpu, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
1109}
1110
1111
1112/**
1113 * \#GP (General Protection Fault) handler.
1114 *
1115 * @returns VBox status code.
1116 * VINF_SUCCESS means we completely handled this trap,
1117 * other codes are passed execution to host context.
1118 *
1119 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1120 * @param pRegFrame Pointer to the register frame for the trap.
1121 * @internal
1122 */
1123DECLASM(int) TRPMGCTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1124{
1125 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1126 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1127 LogFlow(("TRPMGC0d: %04x:%08x err=%x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, CPUMRawGetEFlags(pVCpu)));
1128 TRPM_ENTER_DBG_HOOK(0xd);
1129
1130 PGMRZDynMapStartAutoSet(pVCpu);
1131 int rc = trpmGCTrap0dHandler(pVM, pTrpmCpu, pRegFrame);
1132 switch (rc)
1133 {
1134 case VINF_EM_RAW_GUEST_TRAP:
1135 case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1136 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1137 rc = VINF_PATM_PATCH_TRAP_GP;
1138 break;
1139
1140 case VINF_EM_RAW_INTERRUPT_PENDING:
1141 Assert(TRPMHasTrap(pVCpu));
1142 /* no break; */
1143 case VINF_PGM_SYNC_CR3:
1144 case VINF_EM_RAW_EMULATE_INSTR:
1145 case VINF_IOM_R3_IOPORT_READ:
1146 case VINF_IOM_R3_IOPORT_WRITE:
1147 case VINF_IOM_R3_MMIO_WRITE:
1148 case VINF_IOM_R3_MMIO_READ:
1149 case VINF_IOM_R3_MMIO_READ_WRITE:
1150 case VINF_PATM_PATCH_INT3:
1151 case VINF_EM_NO_MEMORY:
1152 case VINF_EM_RAW_TO_R3:
1153 case VINF_EM_RAW_TIMER_PENDING:
1154 case VINF_EM_PENDING_REQUEST:
1155 case VINF_EM_HALT:
1156 case VINF_SELM_SYNC_GDT:
1157 case VINF_SUCCESS:
1158 break;
1159
1160 default:
1161 AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("return code %d\n", rc));
1162 break;
1163 }
1164 Log6(("TRPMGC0d: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1165 TRPM_EXIT_DBG_HOOK(0xd);
1166 return rc;
1167}
1168
1169
1170/**
1171 * \#PF (Page Fault) handler.
1172 *
1173 * Calls PGM which does the actual handling.
1174 *
1175 *
1176 * @returns VBox status code.
1177 * VINF_SUCCESS means we completely handled this trap,
1178 * other codes are passed execution to host context.
1179 *
1180 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1181 * @param pRegFrame Pointer to the register frame for the trap.
1182 * @internal
1183 */
1184DECLASM(int) TRPMGCTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1185{
1186 PVM pVM = TRPMCPU_2_VM(pTrpmCpu);
1187 PVMCPU pVCpu = TRPMCPU_2_VMCPU(pTrpmCpu);
1188 LogFlow(("TRPMGC0e: %04x:%08x err=%x cr2=%08x EFL=%x\n", pRegFrame->cs.Sel, pRegFrame->eip, (uint32_t)pVCpu->trpm.s.uActiveErrorCode, (uint32_t)pVCpu->trpm.s.uActiveCR2, CPUMRawGetEFlags(pVCpu)));
1189 TRPM_ENTER_DBG_HOOK(0xe);
1190
1191 /*
1192 * This is all PGM stuff.
1193 */
1194 PGMRZDynMapStartAutoSet(pVCpu);
1195 int rc = PGMTrap0eHandler(pVCpu, pVCpu->trpm.s.uActiveErrorCode, pRegFrame, (RTGCPTR)pVCpu->trpm.s.uActiveCR2);
1196 switch (rc)
1197 {
1198 case VINF_EM_RAW_EMULATE_INSTR:
1199 case VINF_EM_RAW_EMULATE_INSTR_PD_FAULT:
1200 case VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT:
1201 case VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT:
1202 case VINF_EM_RAW_EMULATE_INSTR_LDT_FAULT:
1203 case VINF_EM_RAW_EMULATE_INSTR_IDT_FAULT:
1204 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1205 rc = VINF_PATCH_EMULATE_INSTR;
1206 break;
1207
1208 case VINF_EM_RAW_GUEST_TRAP:
1209 if (PATMIsPatchGCAddr(pVM, pRegFrame->eip))
1210 {
1211 PGMRZDynMapReleaseAutoSet(pVCpu);
1212 TRPM_EXIT_DBG_HOOK(0xe);
1213 return VINF_PATM_PATCH_TRAP_PF;
1214 }
1215
1216 rc = TRPMForwardTrap(pVCpu, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
1217 Assert(rc == VINF_EM_RAW_GUEST_TRAP);
1218 break;
1219
1220 case VINF_EM_RAW_INTERRUPT_PENDING:
1221 Assert(TRPMHasTrap(pVCpu));
1222 /* no break; */
1223 case VINF_IOM_R3_MMIO_READ:
1224 case VINF_IOM_R3_MMIO_WRITE:
1225 case VINF_IOM_R3_MMIO_READ_WRITE:
1226 case VINF_PATM_HC_MMIO_PATCH_READ:
1227 case VINF_PATM_HC_MMIO_PATCH_WRITE:
1228 case VINF_SUCCESS:
1229 case VINF_EM_RAW_TO_R3:
1230 case VINF_EM_PENDING_REQUEST:
1231 case VINF_EM_RAW_TIMER_PENDING:
1232 case VINF_EM_NO_MEMORY:
1233 case VINF_CSAM_PENDING_ACTION:
1234 case VINF_PGM_SYNC_CR3: /** @todo Check this with Sander. */
1235 break;
1236
1237 default:
1238 AssertMsg(PATMIsPatchGCAddr(pVM, pRegFrame->eip) == false, ("Patch address for return code %d. eip=%08x\n", rc, pRegFrame->eip));
1239 break;
1240 }
1241 rc = trpmGCExitTrap(pVM, pVCpu, rc, pRegFrame);
1242 Log6(("TRPMGC0e: %Rrc (%04x:%08x EFL=%x)\n", rc, pRegFrame->cs.Sel, pRegFrame->eip, CPUMRawGetEFlags(pVCpu)));
1243 TRPM_EXIT_DBG_HOOK(0xe);
1244 return rc;
1245}
1246
1247
1248/**
1249 * Scans for the EIP in the specified array of trap handlers.
1250 *
1251 * If we don't fine the EIP, we'll panic.
1252 *
1253 * @returns VBox status code.
1254 *
1255 * @param pVM Pointer to the VM.
1256 * @param pRegFrame Pointer to the register frame for the trap.
1257 * @param paHandlers The array of trap handler records.
1258 * @param pEndRecord The end record (exclusive).
1259 */
1260static int trpmGCHyperGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, PCTRPMGCHYPER paHandlers, PCTRPMGCHYPER pEndRecord)
1261{
1262 uintptr_t uEip = (uintptr_t)pRegFrame->eip;
1263 Assert(paHandlers <= pEndRecord);
1264
1265 Log(("trpmGCHyperGeneric: uEip=%x %p-%p\n", uEip, paHandlers, pEndRecord));
1266
1267#if 0 /// @todo later
1268 /*
1269 * Start by doing a kind of binary search.
1270 */
1271 unsigned iStart = 0;
1272 unsigned iEnd = pEndRecord - paHandlers;
1273 unsigned i = iEnd / 2;
1274#endif
1275
1276 /*
1277 * Do a linear search now (in case the array wasn't properly sorted).
1278 */
1279 for (PCTRPMGCHYPER pCur = paHandlers; pCur < pEndRecord; pCur++)
1280 {
1281 if ( pCur->uStartEIP <= uEip
1282 && (pCur->uEndEIP ? pCur->uEndEIP > uEip : pCur->uStartEIP == uEip))
1283 return pCur->pfnHandler(pVM, pRegFrame, pCur->uUser);
1284 }
1285
1286 return VERR_TRPM_DONT_PANIC;
1287}
1288
1289
1290/**
1291 * Hypervisor \#NP ((segment) Not Present) handler.
1292 *
1293 * Scans for the EIP in the registered trap handlers.
1294 *
1295 * @returns VBox status code.
1296 * VINF_SUCCESS means we completely handled this trap,
1297 * other codes are passed back to host context.
1298 *
1299 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1300 * @param pRegFrame Pointer to the register frame for the trap.
1301 * @internal
1302 */
1303DECLASM(int) TRPMGCHyperTrap0bHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1304{
1305 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0bHandlers, g_aTrap0bHandlersEnd);
1306}
1307
1308
1309/**
1310 * Hypervisor \#GP (General Protection Fault) handler.
1311 *
1312 * Scans for the EIP in the registered trap handlers.
1313 *
1314 * @returns VBox status code.
1315 * VINF_SUCCESS means we completely handled this trap,
1316 * other codes are passed back to host context.
1317 *
1318 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1319 * @param pRegFrame Pointer to the register frame for the trap.
1320 * @internal
1321 */
1322DECLASM(int) TRPMGCHyperTrap0dHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1323{
1324 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1325}
1326
1327
1328/**
1329 * Hypervisor \#PF (Page Fault) handler.
1330 *
1331 * Scans for the EIP in the registered trap handlers.
1332 *
1333 * @returns VBox status code.
1334 * VINF_SUCCESS means we completely handled this trap,
1335 * other codes are passed back to host context.
1336 *
1337 * @param pTrpmCpu Pointer to TRPMCPU data (within VM).
1338 * @param pRegFrame Pointer to the register frame for the trap.
1339 * @internal
1340 */
1341DECLASM(int) TRPMGCHyperTrap0eHandler(PTRPMCPU pTrpmCpu, PCPUMCTXCORE pRegFrame)
1342{
1343 return trpmGCHyperGeneric(TRPMCPU_2_VM(pTrpmCpu), pRegFrame, g_aTrap0dHandlers, g_aTrap0dHandlersEnd);
1344}
1345
1346
1347/**
1348 * Deal with hypervisor traps occurring when resuming execution on a trap.
1349 *
1350 * There is a little problem with recursive RC (hypervisor) traps. We deal with
1351 * this by not allowing recursion without it being the subject of a guru
1352 * meditation. (We used to / tried to handle this but there isn't any reason
1353 * for it.)
1354 *
1355 * So, do NOT use this for handling RC traps!
1356 *
1357 * @returns VBox status code. (Anything but VINF_SUCCESS will cause guru.)
1358 * @param pVM Pointer to the VM.
1359 * @param pRegFrame Register frame.
1360 * @param uUser User arg.
1361 */
1362DECLCALLBACK(int) trpmRCTrapInGeneric(PVM pVM, PCPUMCTXCORE pRegFrame, uintptr_t uUser)
1363{
1364 Log(("********************************************************\n"));
1365 Log(("trpmRCTrapInGeneric: eip=%RX32 uUser=%#x\n", pRegFrame->eip, uUser));
1366 Log(("********************************************************\n"));
1367
1368 /*
1369 * This used to be kind of complicated, but since we stopped storing
1370 * the register frame on the stack and instead storing it directly
1371 * in the CPUMCPU::Guest structure, we just have to figure out which
1372 * status to hand on to the host and let the recompiler/IEM do its
1373 * job.
1374 */
1375 switch (uUser)
1376 {
1377 case TRPM_TRAP_IN_MOV_GS:
1378 case TRPM_TRAP_IN_MOV_FS:
1379 case TRPM_TRAP_IN_MOV_ES:
1380 case TRPM_TRAP_IN_MOV_DS:
1381 TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_STALE_SELECTOR);
1382 break;
1383
1384 case TRPM_TRAP_IN_IRET:
1385 case TRPM_TRAP_IN_IRET | TRPM_TRAP_IN_V86:
1386 TRPMGCHyperReturnToHost(pVM, VINF_EM_RAW_IRET_TRAP);
1387 break;
1388
1389 default:
1390 AssertMsgFailed(("Invalid uUser=%#x\n", uUser));
1391 return VERR_TRPM_BAD_TRAP_IN_OP;
1392 }
1393
1394 AssertMsgFailed(("Impossible!\n"));
1395 return VERR_TRPM_IPE_3;
1396}
1397
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette