VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR3/EMRaw.cpp@ 50653

Last change on this file since 50653 was 47823, checked in by vboxsync, 11 years ago

EMRaw.cpp: fixes, IEM single instruction emulation is still disabled.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 58.5 KB
Line 
1/* $Id: EMRaw.cpp 47823 2013-08-17 11:36:08Z vboxsync $ */
2/** @file
3 * EM - Execution Monitor / Manager - software virtualization
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_EM
23#include <VBox/vmm/em.h>
24#include <VBox/vmm/vmm.h>
25#include <VBox/vmm/patm.h>
26#include <VBox/vmm/csam.h>
27#include <VBox/vmm/selm.h>
28#include <VBox/vmm/trpm.h>
29#include <VBox/vmm/iem.h>
30#include <VBox/vmm/iom.h>
31#include <VBox/vmm/dbgf.h>
32#include <VBox/vmm/pgm.h>
33#ifdef VBOX_WITH_REM
34# include <VBox/vmm/rem.h>
35#endif
36#include <VBox/vmm/tm.h>
37#include <VBox/vmm/mm.h>
38#include <VBox/vmm/ssm.h>
39#include <VBox/vmm/pdmapi.h>
40#include <VBox/vmm/pdmcritsect.h>
41#include <VBox/vmm/pdmqueue.h>
42#include <VBox/vmm/patm.h>
43#include "EMInternal.h"
44#include <VBox/vmm/vm.h>
45#include <VBox/vmm/cpumdis.h>
46#include <VBox/dis.h>
47#include <VBox/disopcode.h>
48#include <VBox/vmm/dbgf.h>
49#include "VMMTracing.h"
50
51#include <VBox/log.h>
52#include <iprt/asm.h>
53#include <iprt/string.h>
54#include <iprt/stream.h>
55
56
57
58/*******************************************************************************
59* Internal Functions *
60*******************************************************************************/
61static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
62DECLINLINE(int) emR3RawExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC = VINF_SUCCESS);
63static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu);
64static int emR3RawPatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret);
65static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu);
66static int emR3RawExecuteIOInstruction(PVM pVM, PVMCPU pVCpu);
67static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu);
68
69#define EMHANDLERC_WITH_PATM
70#define emR3ExecuteInstruction emR3RawExecuteInstruction
71#define emR3ExecuteIOInstruction emR3RawExecuteIOInstruction
72#include "EMHandleRCTmpl.h"
73
74
75
76#ifdef VBOX_WITH_STATISTICS
77/**
78 * Just a braindead function to keep track of cli addresses.
79 * @param pVM Pointer to the VM.
80 * @param pVMCPU Pointer to the VMCPU.
81 * @param GCPtrInstr The EIP of the cli instruction.
82 */
83static void emR3RecordCli(PVM pVM, PVMCPU pVCpu, RTGCPTR GCPtrInstr)
84{
85 PCLISTAT pRec;
86
87 pRec = (PCLISTAT)RTAvlGCPtrGet(&pVCpu->em.s.pCliStatTree, GCPtrInstr);
88 if (!pRec)
89 {
90 /* New cli instruction; insert into the tree. */
91 pRec = (PCLISTAT)MMR3HeapAllocZ(pVM, MM_TAG_EM, sizeof(*pRec));
92 Assert(pRec);
93 if (!pRec)
94 return;
95 pRec->Core.Key = GCPtrInstr;
96
97 char szCliStatName[32];
98 RTStrPrintf(szCliStatName, sizeof(szCliStatName), "/EM/Cli/0x%RGv", GCPtrInstr);
99 STAM_REG(pVM, &pRec->Counter, STAMTYPE_COUNTER, szCliStatName, STAMUNIT_OCCURENCES, "Number of times cli was executed.");
100
101 bool fRc = RTAvlGCPtrInsert(&pVCpu->em.s.pCliStatTree, &pRec->Core);
102 Assert(fRc); NOREF(fRc);
103 }
104 STAM_COUNTER_INC(&pRec->Counter);
105 STAM_COUNTER_INC(&pVCpu->em.s.StatTotalClis);
106}
107#endif /* VBOX_WITH_STATISTICS */
108
109
110
111/**
112 * Resumes executing hypervisor after a debug event.
113 *
114 * This is kind of special since our current guest state is
115 * potentially out of sync.
116 *
117 * @returns VBox status code.
118 * @param pVM Pointer to the VM.
119 * @param pVCpu Pointer to the VMCPU.
120 */
121int emR3RawResumeHyper(PVM pVM, PVMCPU pVCpu)
122{
123 int rc;
124 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
125 Assert(pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER);
126 Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr\n", pCtx->cs.Sel, pCtx->eip, pCtx->eflags));
127
128 /*
129 * Resume execution.
130 */
131 CPUMRawEnter(pVCpu, NULL);
132 CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) | X86_EFL_RF);
133 rc = VMMR3ResumeHyper(pVM, pVCpu);
134 Log(("emR3RawResumeHyper: cs:eip=%RTsel:%RGr efl=%RGr - returned from GC with rc=%Rrc\n", pCtx->cs.Sel, pCtx->eip, pCtx->eflags, rc));
135 rc = CPUMRawLeave(pVCpu, NULL, rc);
136 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
137
138 /*
139 * Deal with the return code.
140 */
141 rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
142 rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
143 rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
144 return rc;
145}
146
147
148/**
149 * Steps rawmode.
150 *
151 * @returns VBox status code.
152 * @param pVM Pointer to the VM.
153 * @param pVCpu Pointer to the VMCPU.
154 */
155int emR3RawStep(PVM pVM, PVMCPU pVCpu)
156{
157 Assert( pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER
158 || pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_RAW
159 || pVCpu->em.s.enmState == EMSTATE_DEBUG_GUEST_REM);
160 int rc;
161 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
162 bool fGuest = pVCpu->em.s.enmState != EMSTATE_DEBUG_HYPER;
163#ifndef DEBUG_sander
164 Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
165 fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu)));
166#endif
167 if (fGuest)
168 {
169 /*
170 * Check vital forced actions, but ignore pending interrupts and timers.
171 */
172 if ( VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
173 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
174 {
175 rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
176 VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
177 if (rc != VINF_SUCCESS)
178 return rc;
179 }
180
181 /*
182 * Set flags for single stepping.
183 */
184 CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) | X86_EFL_TF | X86_EFL_RF);
185 }
186 else
187 CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) | X86_EFL_TF | X86_EFL_RF);
188
189 /*
190 * Single step.
191 * We do not start time or anything, if anything we should just do a few nanoseconds.
192 */
193 CPUMRawEnter(pVCpu, NULL);
194 do
195 {
196 if (pVCpu->em.s.enmState == EMSTATE_DEBUG_HYPER)
197 rc = VMMR3ResumeHyper(pVM, pVCpu);
198 else
199 rc = VMMR3RawRunGC(pVM, pVCpu);
200#ifndef DEBUG_sander
201 Log(("emR3RawStep: cs:eip=%RTsel:%RGr efl=%RGr - GC rc %Rrc\n", fGuest ? CPUMGetGuestCS(pVCpu) : CPUMGetHyperCS(pVCpu),
202 fGuest ? CPUMGetGuestEIP(pVCpu) : CPUMGetHyperEIP(pVCpu), fGuest ? CPUMGetGuestEFlags(pVCpu) : CPUMGetHyperEFlags(pVCpu), rc));
203#endif
204 } while ( rc == VINF_SUCCESS
205 || rc == VINF_EM_RAW_INTERRUPT);
206 rc = CPUMRawLeave(pVCpu, NULL, rc);
207 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
208
209 /*
210 * Make sure the trap flag is cleared.
211 * (Too bad if the guest is trying to single step too.)
212 */
213 if (fGuest)
214 CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
215 else
216 CPUMSetHyperEFlags(pVCpu, CPUMGetHyperEFlags(pVCpu) & ~X86_EFL_TF);
217
218 /*
219 * Deal with the return codes.
220 */
221 rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
222 rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
223 rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
224 return rc;
225}
226
227
228#ifdef DEBUG
229
230
231int emR3SingleStepExecRaw(PVM pVM, PVMCPU pVCpu, uint32_t cIterations)
232{
233 int rc = VINF_SUCCESS;
234 EMSTATE enmOldState = pVCpu->em.s.enmState;
235 pVCpu->em.s.enmState = EMSTATE_DEBUG_GUEST_RAW;
236
237 Log(("Single step BEGIN:\n"));
238 for (uint32_t i = 0; i < cIterations; i++)
239 {
240 DBGFR3PrgStep(pVCpu);
241 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "RSS");
242 rc = emR3RawStep(pVM, pVCpu);
243 if ( rc != VINF_SUCCESS
244 && rc != VINF_EM_DBG_STEPPED)
245 break;
246 }
247 Log(("Single step END: rc=%Rrc\n", rc));
248 CPUMSetGuestEFlags(pVCpu, CPUMGetGuestEFlags(pVCpu) & ~X86_EFL_TF);
249 pVCpu->em.s.enmState = enmOldState;
250 return rc;
251}
252
253#endif /* DEBUG */
254
255
256/**
257 * Executes one (or perhaps a few more) instruction(s).
258 *
259 * @returns VBox status code suitable for EM.
260 *
261 * @param pVM Pointer to the VM.
262 * @param pVCpu Pointer to the VMCPU.
263 * @param rcGC GC return code
264 * @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
265 * instruction and prefix the log output with this text.
266 */
267#ifdef LOG_ENABLED
268static int emR3RawExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC, const char *pszPrefix)
269#else
270static int emR3RawExecuteInstructionWorker(PVM pVM, PVMCPU pVCpu, int rcGC)
271#endif
272{
273 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
274 int rc;
275
276#ifdef LOG_ENABLED
277 /*
278 * Disassemble the instruction if requested.
279 */
280 if (pszPrefix)
281 {
282 DBGFR3_INFO_LOG(pVM, "cpumguest", pszPrefix);
283 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, pszPrefix);
284 }
285#endif /* LOG_ENABLED */
286
287 /*
288 * PATM is making life more interesting.
289 * We cannot hand anything to REM which has an EIP inside patch code. So, we'll
290 * tell PATM there is a trap in this code and have it take the appropriate actions
291 * to allow us execute the code in REM.
292 */
293 if (PATMIsPatchGCAddr(pVM, pCtx->eip))
294 {
295 Log(("emR3RawExecuteInstruction: In patch block. eip=%RRv\n", (RTRCPTR)pCtx->eip));
296
297 RTGCPTR uNewEip;
298 rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &uNewEip);
299 switch (rc)
300 {
301 /*
302 * It's not very useful to emulate a single instruction and then go back to raw
303 * mode; just execute the whole block until IF is set again.
304 */
305 case VINF_SUCCESS:
306 Log(("emR3RawExecuteInstruction: Executing instruction starting at new address %RGv IF=%d VMIF=%x\n",
307 uNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
308 pCtx->eip = uNewEip;
309 Assert(pCtx->eip);
310
311 if (pCtx->eflags.Bits.u1IF)
312 {
313 /*
314 * The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
315 */
316 Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
317 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIR");
318 }
319 else if (rcGC == VINF_PATM_PENDING_IRQ_AFTER_IRET)
320 {
321 /* special case: iret, that sets IF, detected a pending irq/event */
322 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIRET");
323 }
324 return VINF_EM_RESCHEDULE_REM;
325
326 /*
327 * One instruction.
328 */
329 case VINF_PATCH_EMULATE_INSTR:
330 Log(("emR3RawExecuteInstruction: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
331 uNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
332 pCtx->eip = uNewEip;
333 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIR");
334
335 /*
336 * The patch was disabled, hand it to the REM.
337 */
338 case VERR_PATCH_DISABLED:
339 Log(("emR3RawExecuteInstruction: Disabled patch -> new eip %RGv IF=%d VMIF=%x\n",
340 uNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
341 pCtx->eip = uNewEip;
342 if (pCtx->eflags.Bits.u1IF)
343 {
344 /*
345 * The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
346 */
347 Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
348 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIR");
349 }
350 return VINF_EM_RESCHEDULE_REM;
351
352 /* Force continued patch exection; usually due to write monitored stack. */
353 case VINF_PATCH_CONTINUE:
354 return VINF_SUCCESS;
355
356 default:
357 AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap\n", rc));
358 return VERR_IPE_UNEXPECTED_STATUS;
359 }
360 }
361
362
363 /*
364 * Use IEM and fallback on REM if the functionality is missing.
365 * Once IEM gets mature enough, nothing should ever fall back.
366 */
367#ifdef VBOX_WITH_FIRST_IEM_STEP
368//# define VBOX_WITH_FIRST_IEM_STEP_B
369#endif
370#if defined(VBOX_WITH_FIRST_IEM_STEP_B) || !defined(VBOX_WITH_REM)
371 Log(("EMINS: %04x:%RGv RSP=%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip, (RTGCPTR)pCtx->rsp));
372 STAM_PROFILE_START(&pVCpu->em.s.StatIEMEmu, a);
373 rc = VBOXSTRICTRC_TODO(IEMExecOne(pVCpu));
374 STAM_PROFILE_STOP(&pVCpu->em.s.StatIEMEmu, a);
375 if (RT_SUCCESS(rc))
376 {
377 if (rc == VINF_SUCCESS || rc == VINF_EM_RESCHEDULE)
378 rc = VINF_EM_RESCHEDULE;
379# ifdef DEBUG_bird
380 else
381 AssertMsgFailed(("%Rrc\n", rc));
382# endif
383 }
384 else if ( rc == VERR_IEM_ASPECT_NOT_IMPLEMENTED
385 || rc == VERR_IEM_INSTR_NOT_IMPLEMENTED)
386#endif
387 {
388#ifdef VBOX_WITH_REM
389 STAM_PROFILE_START(&pVCpu->em.s.StatREMEmu, b);
390# ifndef VBOX_WITH_FIRST_IEM_STEP_B
391 Log(("EMINS[rem]: %04x:%RGv RSP=%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip, (RTGCPTR)pCtx->rsp));
392//# elif defined(DEBUG_bird)
393// AssertFailed();
394# endif
395 EMRemLock(pVM);
396 /* Flush the recompiler TLB if the VCPU has changed. */
397 if (pVM->em.s.idLastRemCpu != pVCpu->idCpu)
398 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
399 pVM->em.s.idLastRemCpu = pVCpu->idCpu;
400
401 rc = REMR3EmulateInstruction(pVM, pVCpu);
402 EMRemUnlock(pVM);
403 STAM_PROFILE_STOP(&pVCpu->em.s.StatREMEmu, b);
404#else /* !VBOX_WITH_REM */
405 NOREF(pVM);
406#endif /* !VBOX_WITH_REM */
407 }
408 return rc;
409}
410
411
412/**
413 * Executes one (or perhaps a few more) instruction(s).
414 * This is just a wrapper for discarding pszPrefix in non-logging builds.
415 *
416 * @returns VBox status code suitable for EM.
417 * @param pVM Pointer to the VM.
418 * @param pVCpu Pointer to the VMCPU.
419 * @param pszPrefix Disassembly prefix. If not NULL we'll disassemble the
420 * instruction and prefix the log output with this text.
421 * @param rcGC GC return code
422 */
423DECLINLINE(int) emR3RawExecuteInstruction(PVM pVM, PVMCPU pVCpu, const char *pszPrefix, int rcGC)
424{
425#ifdef LOG_ENABLED
426 return emR3RawExecuteInstructionWorker(pVM, pVCpu, rcGC, pszPrefix);
427#else
428 return emR3RawExecuteInstructionWorker(pVM, pVCpu, rcGC);
429#endif
430}
431
432/**
433 * Executes one (or perhaps a few more) IO instruction(s).
434 *
435 * @returns VBox status code suitable for EM.
436 * @param pVM Pointer to the VM.
437 * @param pVCpu Pointer to the VMCPU.
438 */
439static int emR3RawExecuteIOInstruction(PVM pVM, PVMCPU pVCpu)
440{
441#ifdef VBOX_WITH_FIRST_IEM_STEP
442 STAM_PROFILE_START(&pVCpu->em.s.StatIOEmu, a);
443
444 /* Hand it over to the interpreter. */
445 VBOXSTRICTRC rcStrict = IEMExecOne(pVCpu);
446 LogFlow(("emR3RawExecuteIOInstruction: %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
447 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIoIem);
448 STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
449 return VBOXSTRICTRC_TODO(rcStrict);
450
451#else
452 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
453
454 STAM_PROFILE_START(&pVCpu->em.s.StatIOEmu, a);
455
456 /** @todo probably we should fall back to the recompiler; otherwise we'll go back and forth between HC & GC
457 * as io instructions tend to come in packages of more than one
458 */
459 DISCPUSTATE Cpu;
460 int rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "IO EMU");
461 if (RT_SUCCESS(rc))
462 {
463 VBOXSTRICTRC rcStrict = VINF_EM_RAW_EMULATE_INSTR;
464
465 if (!(Cpu.fPrefix & (DISPREFIX_REP | DISPREFIX_REPNE)))
466 {
467 switch (Cpu.pCurInstr->uOpcode)
468 {
469 case OP_IN:
470 {
471 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
472 rcStrict = IOMInterpretIN(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu);
473 break;
474 }
475
476 case OP_OUT:
477 {
478 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
479 rcStrict = IOMInterpretOUT(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu);
480 break;
481 }
482 }
483 }
484 else if (Cpu.fPrefix & DISPREFIX_REP)
485 {
486 switch (Cpu.pCurInstr->uOpcode)
487 {
488 case OP_INSB:
489 case OP_INSWD:
490 {
491 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatIn);
492 rcStrict = IOMInterpretINS(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu);
493 break;
494 }
495
496 case OP_OUTSB:
497 case OP_OUTSWD:
498 {
499 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatOut);
500 rcStrict = IOMInterpretOUTS(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu);
501 break;
502 }
503 }
504 }
505
506 /*
507 * Handled the I/O return codes.
508 * (The unhandled cases end up with rcStrict == VINF_EM_RAW_EMULATE_INSTR.)
509 */
510 if (IOM_SUCCESS(rcStrict))
511 {
512 pCtx->rip += Cpu.cbInstr;
513 STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
514 return VBOXSTRICTRC_TODO(rcStrict);
515 }
516
517 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
518 {
519 STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
520 rcStrict = emR3RawGuestTrap(pVM, pVCpu);
521 return VBOXSTRICTRC_TODO(rcStrict);
522 }
523 AssertMsg(rcStrict != VINF_TRPM_XCPT_DISPATCHED, ("Handle VINF_TRPM_XCPT_DISPATCHED\n"));
524
525 if (RT_FAILURE(rcStrict))
526 {
527 STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
528 return VBOXSTRICTRC_TODO(rcStrict);
529 }
530 AssertMsg(rcStrict == VINF_EM_RAW_EMULATE_INSTR || rcStrict == VINF_EM_RESCHEDULE_REM, ("rcStrict=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
531 }
532 STAM_PROFILE_STOP(&pVCpu->em.s.StatIOEmu, a);
533 return emR3RawExecuteInstruction(pVM, pVCpu, "IO: ");
534#endif
535}
536
537
538/**
539 * Handle a guest context trap.
540 *
541 * @returns VBox status code suitable for EM.
542 * @param pVM Pointer to the VM.
543 * @param pVCpu Pointer to the VMCPU.
544 */
545static int emR3RawGuestTrap(PVM pVM, PVMCPU pVCpu)
546{
547 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
548
549 /*
550 * Get the trap info.
551 */
552 uint8_t u8TrapNo;
553 TRPMEVENT enmType;
554 RTGCUINT uErrorCode;
555 RTGCUINTPTR uCR2;
556 int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2, NULL /* pu8InstrLen */);
557 if (RT_FAILURE(rc))
558 {
559 AssertReleaseMsgFailed(("No trap! (rc=%Rrc)\n", rc));
560 return rc;
561 }
562
563
564#if 1 /* Experimental: Review, disable if it causes trouble. */
565 /*
566 * Handle traps in patch code first.
567 *
568 * We catch a few of these cases in RC before returning to R3 (#PF, #GP, #BP)
569 * but several traps isn't handled specially by TRPM in RC and we end up here
570 * instead. One example is #DE.
571 */
572 uint32_t uCpl = CPUMGetGuestCPL(pVCpu);
573 if ( uCpl == 0
574 && PATMIsPatchGCAddr(pVM, pCtx->eip))
575 {
576 LogFlow(("emR3RawGuestTrap: trap %#x in patch code; eip=%08x\n", u8TrapNo, pCtx->eip));
577 return emR3RawPatchTrap(pVM, pVCpu, pCtx, rc);
578 }
579#endif
580
581 /*
582 * If the guest gate is marked unpatched, then we will check again if we can patch it.
583 * (This assumes that we've already tried and failed to dispatch the trap in
584 * RC for the gates that already has been patched. Which is true for most high
585 * volume traps, because these are handled specially, but not for odd ones like #DE.)
586 */
587 if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) == TRPM_INVALID_HANDLER)
588 {
589 CSAMR3CheckGates(pVM, u8TrapNo, 1);
590 Log(("emR3RawHandleRC: recheck gate %x -> valid=%d\n", u8TrapNo, TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER));
591
592 /* If it was successful, then we could go back to raw mode. */
593 if (TRPMR3GetGuestTrapHandler(pVM, u8TrapNo) != TRPM_INVALID_HANDLER)
594 {
595 /* Must check pending forced actions as our IDT or GDT might be out of sync. */
596 rc = EMR3CheckRawForcedActions(pVM, pVCpu);
597 AssertRCReturn(rc, rc);
598
599 TRPMERRORCODE enmError = uErrorCode != ~0U
600 ? TRPM_TRAP_HAS_ERRORCODE
601 : TRPM_TRAP_NO_ERRORCODE;
602 rc = TRPMForwardTrap(pVCpu, CPUMCTX2CORE(pCtx), u8TrapNo, uErrorCode, enmError, TRPM_TRAP, -1);
603 if (rc == VINF_SUCCESS /* Don't use RT_SUCCESS */)
604 {
605 TRPMResetTrap(pVCpu);
606 return VINF_EM_RESCHEDULE_RAW;
607 }
608 AssertMsg(rc == VINF_EM_RAW_GUEST_TRAP, ("%Rrc\n", rc));
609 }
610 }
611
612 /*
613 * Scan kernel code that traps; we might not get another chance.
614 */
615 /** @todo move this up before the dispatching? */
616 if ( (pCtx->ss.Sel & X86_SEL_RPL) <= 1
617 && !pCtx->eflags.Bits.u1VM)
618 {
619 Assert(!PATMIsPatchGCAddr(pVM, pCtx->eip));
620 CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
621 }
622
623 /*
624 * Trap specific handling.
625 */
626 if (u8TrapNo == 6) /* (#UD) Invalid opcode. */
627 {
628 /*
629 * If MONITOR & MWAIT are supported, then interpret them here.
630 */
631 DISCPUSTATE cpu;
632 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap (#UD): ");
633 if ( RT_SUCCESS(rc)
634 && (cpu.pCurInstr->uOpcode == OP_MONITOR || cpu.pCurInstr->uOpcode == OP_MWAIT))
635 {
636 uint32_t u32Dummy, u32Features, u32ExtFeatures;
637 CPUMGetGuestCpuId(pVCpu, 1, &u32Dummy, &u32Dummy, &u32ExtFeatures, &u32Features);
638 if (u32ExtFeatures & X86_CPUID_FEATURE_ECX_MONITOR)
639 {
640 rc = TRPMResetTrap(pVCpu);
641 AssertRC(rc);
642
643 rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR));
644 if (RT_SUCCESS(rc))
645 return rc;
646 return emR3RawExecuteInstruction(pVM, pVCpu, "Monitor: ");
647 }
648 }
649 }
650 else if (u8TrapNo == 13) /* (#GP) Privileged exception */
651 {
652 /*
653 * Handle I/O bitmap?
654 */
655 /** @todo We're not supposed to be here with a false guest trap concerning
656 * I/O access. We can easily handle those in RC. */
657 DISCPUSTATE cpu;
658 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &cpu, "Guest Trap: ");
659 if ( RT_SUCCESS(rc)
660 && (cpu.pCurInstr->fOpType & DISOPTYPE_PORTIO))
661 {
662 /*
663 * We should really check the TSS for the IO bitmap, but it's not like this
664 * lazy approach really makes things worse.
665 */
666 rc = TRPMResetTrap(pVCpu);
667 AssertRC(rc);
668 return emR3RawExecuteInstruction(pVM, pVCpu, "IO Guest Trap: ");
669 }
670 }
671
672#ifdef LOG_ENABLED
673 DBGFR3_INFO_LOG(pVM, "cpumguest", "Guest trap");
674 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Guest trap");
675
676 /* Get guest page information. */
677 uint64_t fFlags = 0;
678 RTGCPHYS GCPhys = 0;
679 int rc2 = PGMGstGetPage(pVCpu, uCR2, &fFlags, &GCPhys);
680 Log(("emR3RawGuestTrap: cs:eip=%04x:%08x: trap=%02x err=%08x cr2=%08x cr0=%08x%s: Phys=%RGp fFlags=%08llx %s %s %s%s rc2=%d\n",
681 pCtx->cs.Sel, pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0,
682 (enmType == TRPM_SOFTWARE_INT) ? " software" : "", GCPhys, fFlags,
683 fFlags & X86_PTE_P ? "P " : "NP", fFlags & X86_PTE_US ? "U" : "S",
684 fFlags & X86_PTE_RW ? "RW" : "R0", fFlags & X86_PTE_G ? " G" : "", rc2));
685#endif
686
687 /*
688 * #PG has CR2.
689 * (Because of stuff like above we must set CR2 in a delayed fashion.)
690 */
691 if (u8TrapNo == 14 /* #PG */)
692 pCtx->cr2 = uCR2;
693
694 return VINF_EM_RESCHEDULE_REM;
695}
696
697
698/**
699 * Handle a ring switch trap.
700 * Need to do statistics and to install patches. The result is going to REM.
701 *
702 * @returns VBox status code suitable for EM.
703 * @param pVM Pointer to the VM.
704 * @param pVCpu Pointer to the VMCPU.
705 */
706static int emR3RawRingSwitch(PVM pVM, PVMCPU pVCpu)
707{
708 int rc;
709 DISCPUSTATE Cpu;
710 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
711
712 /*
713 * sysenter, syscall & callgate
714 */
715 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "RSWITCH: ");
716 if (RT_SUCCESS(rc))
717 {
718 if (Cpu.pCurInstr->uOpcode == OP_SYSENTER)
719 {
720 if (pCtx->SysEnter.cs != 0)
721 {
722 rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DISSELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
723 CPUMGetGuestCodeBits(pVCpu) == 32 ? PATMFL_CODE32 : 0);
724 if (RT_SUCCESS(rc))
725 {
726 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Patched sysenter instruction");
727 return VINF_EM_RESCHEDULE_RAW;
728 }
729 }
730 }
731
732#ifdef VBOX_WITH_STATISTICS
733 switch (Cpu.pCurInstr->uOpcode)
734 {
735 case OP_SYSENTER:
736 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysEnter);
737 break;
738 case OP_SYSEXIT:
739 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysExit);
740 break;
741 case OP_SYSCALL:
742 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysCall);
743 break;
744 case OP_SYSRET:
745 STAM_COUNTER_INC(&pVCpu->em.s.CTX_SUFF(pStats)->StatSysRet);
746 break;
747 }
748#endif
749 }
750 else
751 AssertRC(rc);
752
753 /* go to the REM to emulate a single instruction */
754 return emR3RawExecuteInstruction(pVM, pVCpu, "RSWITCH: ");
755}
756
757
758/**
759 * Handle a trap (\#PF or \#GP) in patch code
760 *
761 * @returns VBox status code suitable for EM.
762 * @param pVM Pointer to the VM.
763 * @param pVCpu Pointer to the VMCPU.
764 * @param pCtx Pointer to the guest CPU context.
765 * @param gcret GC return code.
766 */
767static int emR3RawPatchTrap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int gcret)
768{
769 uint8_t u8TrapNo;
770 int rc;
771 TRPMEVENT enmType;
772 RTGCUINT uErrorCode;
773 RTGCUINTPTR uCR2;
774
775 Assert(PATMIsPatchGCAddr(pVM, pCtx->eip));
776
777 if (gcret == VINF_PATM_PATCH_INT3)
778 {
779 u8TrapNo = 3;
780 uCR2 = 0;
781 uErrorCode = 0;
782 }
783 else if (gcret == VINF_PATM_PATCH_TRAP_GP)
784 {
785 /* No active trap in this case. Kind of ugly. */
786 u8TrapNo = X86_XCPT_GP;
787 uCR2 = 0;
788 uErrorCode = 0;
789 }
790 else
791 {
792 rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrorCode, &uCR2, NULL /* pu8InstrLen */);
793 if (RT_FAILURE(rc))
794 {
795 AssertReleaseMsgFailed(("emR3RawPatchTrap: no trap! (rc=%Rrc) gcret=%Rrc\n", rc, gcret));
796 return rc;
797 }
798 /* Reset the trap as we'll execute the original instruction again. */
799 TRPMResetTrap(pVCpu);
800 }
801
802 /*
803 * Deal with traps inside patch code.
804 * (This code won't run outside GC.)
805 */
806 if (u8TrapNo != 1)
807 {
808#ifdef LOG_ENABLED
809 DBGFR3_INFO_LOG(pVM, "cpumguest", "Trap in patch code");
810 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Patch code");
811
812 DISCPUSTATE Cpu;
813 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->eip, &Cpu, "Patch code: ");
814 if ( RT_SUCCESS(rc)
815 && Cpu.pCurInstr->uOpcode == OP_IRET)
816 {
817 uint32_t eip, selCS, uEFlags;
818
819 /* Iret crashes are bad as we have already changed the flags on the stack */
820 rc = PGMPhysSimpleReadGCPtr(pVCpu, &eip, pCtx->esp, 4);
821 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &selCS, pCtx->esp+4, 4);
822 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &uEFlags, pCtx->esp+8, 4);
823 if (rc == VINF_SUCCESS)
824 {
825 if ( (uEFlags & X86_EFL_VM)
826 || (selCS & X86_SEL_RPL) == 3)
827 {
828 uint32_t selSS, esp;
829
830 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &esp, pCtx->esp + 12, 4);
831 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &selSS, pCtx->esp + 16, 4);
832
833 if (uEFlags & X86_EFL_VM)
834 {
835 uint32_t selDS, selES, selFS, selGS;
836 rc = PGMPhysSimpleReadGCPtr(pVCpu, &selES, pCtx->esp + 20, 4);
837 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &selDS, pCtx->esp + 24, 4);
838 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &selFS, pCtx->esp + 28, 4);
839 rc |= PGMPhysSimpleReadGCPtr(pVCpu, &selGS, pCtx->esp + 32, 4);
840 if (rc == VINF_SUCCESS)
841 {
842 Log(("Patch code: IRET->VM stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
843 Log(("Patch code: IRET->VM stack frame: DS=%04X ES=%04X FS=%04X GS=%04X\n", selDS, selES, selFS, selGS));
844 }
845 }
846 else
847 Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x ss:esp=%04X:%08RX32\n", selCS, eip, uEFlags, selSS, esp));
848 }
849 else
850 Log(("Patch code: IRET stack frame: return address %04X:%08RX32 eflags=%08x\n", selCS, eip, uEFlags));
851 }
852 }
853#endif /* LOG_ENABLED */
854 Log(("emR3RawPatchTrap: in patch: eip=%08x: trap=%02x err=%08x cr2=%08x cr0=%08x\n",
855 pCtx->eip, u8TrapNo, uErrorCode, uCR2, (uint32_t)pCtx->cr0));
856
857 RTGCPTR uNewEip;
858 rc = PATMR3HandleTrap(pVM, pCtx, pCtx->eip, &uNewEip);
859 switch (rc)
860 {
861 /*
862 * Execute the faulting instruction.
863 */
864 case VINF_SUCCESS:
865 {
866 /** @todo execute a whole block */
867 Log(("emR3RawPatchTrap: Executing faulting instruction at new address %RGv\n", uNewEip));
868 if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
869 Log(("emR3RawPatchTrap: Virtual IF flag disabled!!\n"));
870
871 pCtx->eip = uNewEip;
872 AssertRelease(pCtx->eip);
873
874 if (pCtx->eflags.Bits.u1IF)
875 {
876 /* Windows XP lets irets fault intentionally and then takes action based on the opcode; an
877 * int3 patch overwrites it and leads to blue screens. Remove the patch in this case.
878 */
879 if ( u8TrapNo == X86_XCPT_GP
880 && PATMIsInt3Patch(pVM, pCtx->eip, NULL, NULL))
881 {
882 /** @todo move to PATMR3HandleTrap */
883 Log(("Possible Windows XP iret fault at %08RX32\n", pCtx->eip));
884 PATMR3RemovePatch(pVM, pCtx->eip);
885 }
886
887 /** @todo Knoppix 5 regression when returning VINF_SUCCESS here and going back to raw mode. */
888 /* Note: possibly because a reschedule is required (e.g. iret to V86 code) */
889
890 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIR");
891 /* Interrupts are enabled; just go back to the original instruction.
892 return VINF_SUCCESS; */
893 }
894 return VINF_EM_RESCHEDULE_REM;
895 }
896
897 /*
898 * One instruction.
899 */
900 case VINF_PATCH_EMULATE_INSTR:
901 Log(("emR3RawPatchTrap: Emulate patched instruction at %RGv IF=%d VMIF=%x\n",
902 uNewEip, pCtx->eflags.Bits.u1IF, pVCpu->em.s.pPatmGCState->uVMFlags));
903 pCtx->eip = uNewEip;
904 AssertRelease(pCtx->eip);
905 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHEMUL: ");
906
907 /*
908 * The patch was disabled, hand it to the REM.
909 */
910 case VERR_PATCH_DISABLED:
911 if (!(pVCpu->em.s.pPatmGCState->uVMFlags & X86_EFL_IF))
912 Log(("emR3RawPatchTrap: Virtual IF flag disabled!!\n"));
913 pCtx->eip = uNewEip;
914 AssertRelease(pCtx->eip);
915
916 if (pCtx->eflags.Bits.u1IF)
917 {
918 /*
919 * The last instruction in the patch block needs to be executed!! (sti/sysexit for example)
920 */
921 Log(("PATCH: IF=1 -> emulate last instruction as it can't be interrupted!!\n"));
922 return emR3RawExecuteInstruction(pVM, pVCpu, "PATCHIR");
923 }
924 return VINF_EM_RESCHEDULE_REM;
925
926 /* Force continued patch exection; usually due to write monitored stack. */
927 case VINF_PATCH_CONTINUE:
928 return VINF_SUCCESS;
929
930 /*
931 * Anything else is *fatal*.
932 */
933 default:
934 AssertReleaseMsgFailed(("Unknown return code %Rrc from PATMR3HandleTrap!\n", rc));
935 return VERR_IPE_UNEXPECTED_STATUS;
936 }
937 }
938 return VINF_SUCCESS;
939}
940
941
942/**
943 * Handle a privileged instruction.
944 *
945 * @returns VBox status code suitable for EM.
946 * @param pVM Pointer to the VM.
947 * @param pVCpu Pointer to the VMCPU.
948 */
949static int emR3RawPrivileged(PVM pVM, PVMCPU pVCpu)
950{
951 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
952
953 Assert(!pCtx->eflags.Bits.u1VM);
954
955 if (PATMIsEnabled(pVM))
956 {
957 /*
958 * Check if in patch code.
959 */
960 if (PATMR3IsInsidePatchJump(pVM, pCtx->eip, NULL))
961 {
962#ifdef LOG_ENABLED
963 DBGFR3_INFO_LOG(pVM, "cpumguest", "PRIV");
964#endif
965 AssertMsgFailed(("FATAL ERROR: executing random instruction inside generated patch jump %08x\n", pCtx->eip));
966 return VERR_EM_RAW_PATCH_CONFLICT;
967 }
968 if ( (pCtx->ss.Sel & X86_SEL_RPL) == 0
969 && !pCtx->eflags.Bits.u1VM
970 && !PATMIsPatchGCAddr(pVM, pCtx->eip))
971 {
972 int rc = PATMR3InstallPatch(pVM, SELMToFlat(pVM, DISSELREG_CS, CPUMCTX2CORE(pCtx), pCtx->eip),
973 CPUMGetGuestCodeBits(pVCpu) == 32 ? PATMFL_CODE32 : 0);
974 if (RT_SUCCESS(rc))
975 {
976#ifdef LOG_ENABLED
977 DBGFR3_INFO_LOG(pVM, "cpumguest", "PRIV");
978#endif
979 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Patched privileged instruction");
980 return VINF_SUCCESS;
981 }
982 }
983 }
984
985#ifdef LOG_ENABLED
986 if (!PATMIsPatchGCAddr(pVM, pCtx->eip))
987 {
988 DBGFR3_INFO_LOG(pVM, "cpumguest", "PRIV");
989 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Privileged instr");
990 }
991#endif
992
993 /*
994 * Instruction statistics and logging.
995 */
996 DISCPUSTATE Cpu;
997 int rc;
998
999 rc = CPUMR3DisasmInstrCPU(pVM, pVCpu, pCtx, pCtx->rip, &Cpu, "PRIV: ");
1000 if (RT_SUCCESS(rc))
1001 {
1002#ifdef VBOX_WITH_STATISTICS
1003 PEMSTATS pStats = pVCpu->em.s.CTX_SUFF(pStats);
1004 switch (Cpu.pCurInstr->uOpcode)
1005 {
1006 case OP_INVLPG:
1007 STAM_COUNTER_INC(&pStats->StatInvlpg);
1008 break;
1009 case OP_IRET:
1010 STAM_COUNTER_INC(&pStats->StatIret);
1011 break;
1012 case OP_CLI:
1013 STAM_COUNTER_INC(&pStats->StatCli);
1014 emR3RecordCli(pVM, pVCpu, pCtx->rip);
1015 break;
1016 case OP_STI:
1017 STAM_COUNTER_INC(&pStats->StatSti);
1018 break;
1019 case OP_INSB:
1020 case OP_INSWD:
1021 case OP_IN:
1022 case OP_OUTSB:
1023 case OP_OUTSWD:
1024 case OP_OUT:
1025 AssertMsgFailed(("Unexpected privileged exception due to port IO\n"));
1026 break;
1027
1028 case OP_MOV_CR:
1029 if (Cpu.Param1.fUse & DISUSE_REG_GEN32)
1030 {
1031 //read
1032 Assert(Cpu.Param2.fUse & DISUSE_REG_CR);
1033 Assert(Cpu.Param2.Base.idxCtrlReg <= DISCREG_CR4);
1034 STAM_COUNTER_INC(&pStats->StatMovReadCR[Cpu.Param2.Base.idxCtrlReg]);
1035 }
1036 else
1037 {
1038 //write
1039 Assert(Cpu.Param1.fUse & DISUSE_REG_CR);
1040 Assert(Cpu.Param1.Base.idxCtrlReg <= DISCREG_CR4);
1041 STAM_COUNTER_INC(&pStats->StatMovWriteCR[Cpu.Param1.Base.idxCtrlReg]);
1042 }
1043 break;
1044
1045 case OP_MOV_DR:
1046 STAM_COUNTER_INC(&pStats->StatMovDRx);
1047 break;
1048 case OP_LLDT:
1049 STAM_COUNTER_INC(&pStats->StatMovLldt);
1050 break;
1051 case OP_LIDT:
1052 STAM_COUNTER_INC(&pStats->StatMovLidt);
1053 break;
1054 case OP_LGDT:
1055 STAM_COUNTER_INC(&pStats->StatMovLgdt);
1056 break;
1057 case OP_SYSENTER:
1058 STAM_COUNTER_INC(&pStats->StatSysEnter);
1059 break;
1060 case OP_SYSEXIT:
1061 STAM_COUNTER_INC(&pStats->StatSysExit);
1062 break;
1063 case OP_SYSCALL:
1064 STAM_COUNTER_INC(&pStats->StatSysCall);
1065 break;
1066 case OP_SYSRET:
1067 STAM_COUNTER_INC(&pStats->StatSysRet);
1068 break;
1069 case OP_HLT:
1070 STAM_COUNTER_INC(&pStats->StatHlt);
1071 break;
1072 default:
1073 STAM_COUNTER_INC(&pStats->StatMisc);
1074 Log4(("emR3RawPrivileged: opcode=%d\n", Cpu.pCurInstr->uOpcode));
1075 break;
1076 }
1077#endif /* VBOX_WITH_STATISTICS */
1078 if ( (pCtx->ss.Sel & X86_SEL_RPL) == 0
1079 && !pCtx->eflags.Bits.u1VM
1080 && CPUMGetGuestCodeBits(pVCpu) == 32)
1081 {
1082 STAM_PROFILE_START(&pVCpu->em.s.StatPrivEmu, a);
1083 switch (Cpu.pCurInstr->uOpcode)
1084 {
1085 case OP_CLI:
1086 pCtx->eflags.u32 &= ~X86_EFL_IF;
1087 Assert(Cpu.cbInstr == 1);
1088 pCtx->rip += Cpu.cbInstr;
1089 STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1090 return VINF_EM_RESCHEDULE_REM; /* must go to the recompiler now! */
1091
1092 case OP_STI:
1093 pCtx->eflags.u32 |= X86_EFL_IF;
1094 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + Cpu.cbInstr);
1095 Assert(Cpu.cbInstr == 1);
1096 pCtx->rip += Cpu.cbInstr;
1097 STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1098 return VINF_SUCCESS;
1099
1100 case OP_HLT:
1101 if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1102 {
1103 PATMTRANSSTATE enmState;
1104 RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->eip, &enmState);
1105
1106 if (enmState == PATMTRANS_OVERWRITTEN)
1107 {
1108 rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1109 Assert(rc == VERR_PATCH_DISABLED);
1110 /* Conflict detected, patch disabled */
1111 Log(("emR3RawPrivileged: detected conflict -> disabled patch at %08RX32\n", pCtx->eip));
1112
1113 enmState = PATMTRANS_SAFE;
1114 }
1115
1116 /* The translation had better be successful. Otherwise we can't recover. */
1117 AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %08RX32\n", pCtx->eip));
1118 if (enmState != PATMTRANS_OVERWRITTEN)
1119 pCtx->eip = pOrgInstrGC;
1120 }
1121 /* no break; we could just return VINF_EM_HALT here */
1122
1123 case OP_MOV_CR:
1124 case OP_MOV_DR:
1125#ifdef LOG_ENABLED
1126 if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1127 {
1128 DBGFR3_INFO_LOG(pVM, "cpumguest", "PRIV");
1129 DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Privileged instr");
1130 }
1131#endif
1132
1133 rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR));
1134 if (RT_SUCCESS(rc))
1135 {
1136 STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1137
1138 if ( Cpu.pCurInstr->uOpcode == OP_MOV_CR
1139 && Cpu.Param1.fUse == DISUSE_REG_CR /* write */
1140 )
1141 {
1142 /* Deal with CR0 updates inside patch code that force
1143 * us to go to the recompiler.
1144 */
1145 if ( PATMIsPatchGCAddr(pVM, pCtx->rip)
1146 && (pCtx->cr0 & (X86_CR0_WP|X86_CR0_PG|X86_CR0_PE)) != (X86_CR0_WP|X86_CR0_PG|X86_CR0_PE))
1147 {
1148 PATMTRANSSTATE enmState;
1149 RTGCPTR pOrgInstrGC = PATMR3PatchToGCPtr(pVM, pCtx->rip, &enmState);
1150
1151 Log(("Force recompiler switch due to cr0 (%RGp) update rip=%RGv -> %RGv (enmState=%d)\n", pCtx->cr0, pCtx->rip, pOrgInstrGC, enmState));
1152 if (enmState == PATMTRANS_OVERWRITTEN)
1153 {
1154 rc = PATMR3DetectConflict(pVM, pOrgInstrGC, pOrgInstrGC);
1155 Assert(rc == VERR_PATCH_DISABLED);
1156 /* Conflict detected, patch disabled */
1157 Log(("emR3RawPrivileged: detected conflict -> disabled patch at %RGv\n", (RTGCPTR)pCtx->rip));
1158 enmState = PATMTRANS_SAFE;
1159 }
1160 /* The translation had better be successful. Otherwise we can't recover. */
1161 AssertReleaseMsg(pOrgInstrGC && enmState != PATMTRANS_OVERWRITTEN, ("Unable to translate instruction address at %RGv\n", (RTGCPTR)pCtx->rip));
1162 if (enmState != PATMTRANS_OVERWRITTEN)
1163 pCtx->rip = pOrgInstrGC;
1164 }
1165
1166 /* Reschedule is necessary as the execution/paging mode might have changed. */
1167 return VINF_EM_RESCHEDULE;
1168 }
1169 return rc; /* can return VINF_EM_HALT as well. */
1170 }
1171 AssertMsgReturn(rc == VERR_EM_INTERPRETER, ("%Rrc\n", rc), rc);
1172 break; /* fall back to the recompiler */
1173 }
1174 STAM_PROFILE_STOP(&pVCpu->em.s.StatPrivEmu, a);
1175 }
1176 }
1177
1178 if (PATMIsPatchGCAddr(pVM, pCtx->eip))
1179 return emR3RawPatchTrap(pVM, pVCpu, pCtx, VINF_PATM_PATCH_TRAP_GP);
1180
1181 return emR3RawExecuteInstruction(pVM, pVCpu, "PRIV");
1182}
1183
1184
1185/**
1186 * Update the forced rawmode execution modifier.
1187 *
1188 * This function is called when we're returning from the raw-mode loop(s). If we're
1189 * in patch code, it will set a flag forcing execution to be resumed in raw-mode,
1190 * if not in patch code, the flag will be cleared.
1191 *
1192 * We should never interrupt patch code while it's being executed. Cli patches can
1193 * contain big code blocks, but they are always executed with IF=0. Other patches
1194 * replace single instructions and should be atomic.
1195 *
1196 * @returns Updated rc.
1197 *
1198 * @param pVM Pointer to the VM.
1199 * @param pVCpu Pointer to the VMCPU.
1200 * @param pCtx Pointer to the guest CPU context.
1201 * @param rc The result code.
1202 */
1203int emR3RawUpdateForceFlag(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int rc)
1204{
1205 if (PATMIsPatchGCAddr(pVM, pCtx->eip)) /** @todo check cs selector base/type */
1206 {
1207 /* ignore reschedule attempts. */
1208 switch (rc)
1209 {
1210 case VINF_EM_RESCHEDULE:
1211 case VINF_EM_RESCHEDULE_REM:
1212 LogFlow(("emR3RawUpdateForceFlag: patch address -> force raw reschedule\n"));
1213 rc = VINF_SUCCESS;
1214 break;
1215 }
1216 pVCpu->em.s.fForceRAW = true;
1217 }
1218 else
1219 pVCpu->em.s.fForceRAW = false;
1220 return rc;
1221}
1222
1223
1224/**
1225 * Check for pending raw actions
1226 *
1227 * @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1228 * EM statuses.
1229 * @param pVM Pointer to the VM.
1230 * @param pVCpu Pointer to the VMCPU.
1231 */
1232VMMR3_INT_DECL(int) EMR3CheckRawForcedActions(PVM pVM, PVMCPU pVCpu)
1233{
1234 int rc = emR3RawForcedActions(pVM, pVCpu, pVCpu->em.s.pCtx);
1235 VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1236 return rc;
1237}
1238
1239
1240/**
1241 * Process raw-mode specific forced actions.
1242 *
1243 * This function is called when any FFs in the VM_FF_HIGH_PRIORITY_PRE_RAW_MASK is pending.
1244 *
1245 * @returns VBox status code. May return VINF_EM_NO_MEMORY but none of the other
1246 * EM statuses.
1247 * @param pVM Pointer to the VM.
1248 * @param pVCpu Pointer to the VMCPU.
1249 * @param pCtx Pointer to the guest CPU context.
1250 */
1251static int emR3RawForcedActions(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1252{
1253 /*
1254 * Note that the order is *vitally* important!
1255 * Also note that SELMR3UpdateFromCPUM may trigger VM_FF_SELM_SYNC_TSS.
1256 */
1257 VBOXVMM_EM_FF_RAW(pVCpu, pVM->fGlobalForcedActions, pVCpu->fLocalForcedActions);
1258
1259 /*
1260 * Sync selector tables.
1261 */
1262 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT | VMCPU_FF_SELM_SYNC_LDT))
1263 {
1264 VBOXSTRICTRC rcStrict = SELMR3UpdateFromCPUM(pVM, pVCpu);
1265 if (rcStrict != VINF_SUCCESS)
1266 return VBOXSTRICTRC_TODO(rcStrict);
1267 }
1268
1269 /*
1270 * Sync IDT.
1271 *
1272 * The CSAMR3CheckGates call in TRPMR3SyncIDT may call PGMPrefetchPage
1273 * and PGMShwModifyPage, so we're in for trouble if for instance a
1274 * PGMSyncCR3+pgmR3PoolClearAll is pending.
1275 */
1276 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TRPM_SYNC_IDT))
1277 {
1278 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3)
1279 && EMIsRawRing0Enabled(pVM)
1280 && CSAMIsEnabled(pVM))
1281 {
1282 int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1283 if (RT_FAILURE(rc))
1284 return rc;
1285 }
1286
1287 int rc = TRPMR3SyncIDT(pVM, pVCpu);
1288 if (RT_FAILURE(rc))
1289 return rc;
1290 }
1291
1292 /*
1293 * Sync TSS.
1294 */
1295 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS))
1296 {
1297 int rc = SELMR3SyncTSS(pVM, pVCpu);
1298 if (RT_FAILURE(rc))
1299 return rc;
1300 }
1301
1302 /*
1303 * Sync page directory.
1304 */
1305 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1306 {
1307 Assert(pVCpu->em.s.enmState != EMSTATE_WAIT_SIPI);
1308 int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1309 if (RT_FAILURE(rc))
1310 return rc;
1311
1312 Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT | VMCPU_FF_SELM_SYNC_LDT));
1313
1314 /* Prefetch pages for EIP and ESP. */
1315 /** @todo This is rather expensive. Should investigate if it really helps at all. */
1316 rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DISSELREG_CS, CPUMCTX2CORE(pCtx), pCtx->rip));
1317 if (rc == VINF_SUCCESS)
1318 rc = PGMPrefetchPage(pVCpu, SELMToFlat(pVM, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->rsp));
1319 if (rc != VINF_SUCCESS)
1320 {
1321 if (rc != VINF_PGM_SYNC_CR3)
1322 {
1323 AssertLogRelMsgReturn(RT_FAILURE(rc), ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_INFO_STATUS);
1324 return rc;
1325 }
1326 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1327 if (RT_FAILURE(rc))
1328 return rc;
1329 }
1330 /** @todo maybe prefetch the supervisor stack page as well */
1331 Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_GDT | VMCPU_FF_SELM_SYNC_LDT));
1332 }
1333
1334 /*
1335 * Allocate handy pages (just in case the above actions have consumed some pages).
1336 */
1337 if (VM_FF_IS_PENDING_EXCEPT(pVM, VM_FF_PGM_NEED_HANDY_PAGES, VM_FF_PGM_NO_MEMORY))
1338 {
1339 int rc = PGMR3PhysAllocateHandyPages(pVM);
1340 if (RT_FAILURE(rc))
1341 return rc;
1342 }
1343
1344 /*
1345 * Check whether we're out of memory now.
1346 *
1347 * This may stem from some of the above actions or operations that has been executed
1348 * since we ran FFs. The allocate handy pages must for instance always be followed by
1349 * this check.
1350 */
1351 if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY))
1352 return VINF_EM_NO_MEMORY;
1353
1354 return VINF_SUCCESS;
1355}
1356
1357
1358/**
1359 * Executes raw code.
1360 *
1361 * This function contains the raw-mode version of the inner
1362 * execution loop (the outer loop being in EMR3ExecuteVM()).
1363 *
1364 * @returns VBox status code. The most important ones are: VINF_EM_RESCHEDULE,
1365 * VINF_EM_RESCHEDULE_REM, VINF_EM_SUSPEND, VINF_EM_RESET and VINF_EM_TERMINATE.
1366 *
1367 * @param pVM Pointer to the VM.
1368 * @param pVCpu Pointer to the VMCPU.
1369 * @param pfFFDone Where to store an indicator telling whether or not
1370 * FFs were done before returning.
1371 */
1372int emR3RawExecute(PVM pVM, PVMCPU pVCpu, bool *pfFFDone)
1373{
1374 STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTotal, a);
1375
1376 int rc = VERR_IPE_UNINITIALIZED_STATUS;
1377 PCPUMCTX pCtx = pVCpu->em.s.pCtx;
1378 LogFlow(("emR3RawExecute: (cs:eip=%04x:%08x)\n", pCtx->cs.Sel, pCtx->eip));
1379 pVCpu->em.s.fForceRAW = false;
1380 *pfFFDone = false;
1381
1382
1383 /*
1384 *
1385 * Spin till we get a forced action or raw mode status code resulting in
1386 * in anything but VINF_SUCCESS or VINF_EM_RESCHEDULE_RAW.
1387 *
1388 */
1389 for (;;)
1390 {
1391 STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWEntry, b);
1392
1393 /*
1394 * Check various preconditions.
1395 */
1396#ifdef VBOX_STRICT
1397# ifdef VBOX_WITH_REM
1398 Assert(REMR3QueryPendingInterrupt(pVM, pVCpu) == REM_NO_PENDING_IRQ);
1399# endif
1400 Assert(pCtx->eflags.Bits.u1VM || (pCtx->ss.Sel & X86_SEL_RPL) == 3 || (pCtx->ss.Sel & X86_SEL_RPL) == 0
1401 || (EMIsRawRing1Enabled(pVM) && (pCtx->ss.Sel & X86_SEL_RPL) == 1));
1402 AssertMsg( (pCtx->eflags.u32 & X86_EFL_IF)
1403 || PATMShouldUseRawMode(pVM, (RTGCPTR)pCtx->eip),
1404 ("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
1405 if ( !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1406 && PGMMapHasConflicts(pVM))
1407 {
1408 PGMMapCheck(pVM);
1409 AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
1410 return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1411 }
1412#endif /* VBOX_STRICT */
1413
1414 /*
1415 * Process high priority pre-execution raw-mode FFs.
1416 */
1417 if ( VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1418 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1419 {
1420 rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1421 VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1422 if (rc != VINF_SUCCESS)
1423 break;
1424 }
1425
1426 /*
1427 * If we're going to execute ring-0 code, the guest state needs to
1428 * be modified a bit and some of the state components (IF, SS/CS RPL,
1429 * and perhaps EIP) needs to be stored with PATM.
1430 */
1431 rc = CPUMRawEnter(pVCpu, NULL);
1432 if (rc != VINF_SUCCESS)
1433 {
1434 STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1435 break;
1436 }
1437
1438 /*
1439 * Scan code before executing it. Don't bother with user mode or V86 code
1440 */
1441 if ( (pCtx->ss.Sel & X86_SEL_RPL) <= 1
1442 && !pCtx->eflags.Bits.u1VM
1443 && !PATMIsPatchGCAddr(pVM, pCtx->eip))
1444 {
1445 STAM_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWEntry, b);
1446 CSAMR3CheckCodeEx(pVM, CPUMCTX2CORE(pCtx), pCtx->eip);
1447 STAM_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWEntry, b);
1448 if ( VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_PRE_RAW_MASK)
1449 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1450 {
1451 rc = emR3RawForcedActions(pVM, pVCpu, pCtx);
1452 VBOXVMM_EM_FF_RAW_RET(pVCpu, rc);
1453 if (rc != VINF_SUCCESS)
1454 {
1455 rc = CPUMRawLeave(pVCpu, NULL, rc);
1456 break;
1457 }
1458 }
1459 }
1460
1461#ifdef LOG_ENABLED
1462 /*
1463 * Log important stuff before entering GC.
1464 */
1465 PPATMGCSTATE pGCState = PATMR3QueryGCStateHC(pVM);
1466 if (pCtx->eflags.Bits.u1VM)
1467 Log(("RV86: %04x:%08x IF=%d VMFlags=%x\n", pCtx->cs.Sel, pCtx->eip, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1468 else if ((pCtx->ss.Sel & X86_SEL_RPL) == 1)
1469 Log(("RR0: %x:%08x ESP=%x:%08x EFL=%x IF=%d/%d VMFlags=%x PIF=%d CPL=%d (Scanned=%d)\n",
1470 pCtx->cs.Sel, pCtx->eip, pCtx->ss.Sel, pCtx->esp, CPUMRawGetEFlags(pVCpu), !!(pGCState->uVMFlags & X86_EFL_IF), pCtx->eflags.Bits.u1IF,
1471 pGCState->uVMFlags, pGCState->fPIF, (pCtx->ss.Sel & X86_SEL_RPL), CSAMIsPageScanned(pVM, (RTGCPTR)pCtx->eip)));
1472# ifdef VBOX_WITH_RAW_RING1
1473 else if ((pCtx->ss.Sel & X86_SEL_RPL) == 2)
1474 Log(("RR1: %x:%08x ESP=%x:%08x IF=%d VMFlags=%x CPL=%x\n", pCtx->cs.Sel, pCtx->eip, pCtx->ss.Sel, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, (pCtx->ss.Sel & X86_SEL_RPL)));
1475# endif
1476 else if ((pCtx->ss.Sel & X86_SEL_RPL) == 3)
1477 Log(("RR3: %x:%08x ESP=%x:%08x IF=%d VMFlags=%x\n", pCtx->cs.Sel, pCtx->eip, pCtx->ss.Sel, pCtx->esp, pCtx->eflags.Bits.u1IF, pGCState->uVMFlags));
1478#endif /* LOG_ENABLED */
1479
1480
1481
1482 /*
1483 * Execute the code.
1484 */
1485 STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWEntry, b);
1486 if (RT_LIKELY(emR3IsExecutionAllowed(pVM, pVCpu)))
1487 {
1488 STAM_PROFILE_START(&pVCpu->em.s.StatRAWExec, c);
1489 VBOXVMM_EM_RAW_RUN_PRE(pVCpu, pCtx);
1490 rc = VMMR3RawRunGC(pVM, pVCpu);
1491 VBOXVMM_EM_RAW_RUN_RET(pVCpu, pCtx, rc);
1492 STAM_PROFILE_STOP(&pVCpu->em.s.StatRAWExec, c);
1493 }
1494 else
1495 {
1496 /* Give up this time slice; virtual time continues */
1497 STAM_REL_PROFILE_ADV_START(&pVCpu->em.s.StatCapped, u);
1498 RTThreadSleep(5);
1499 STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatCapped, u);
1500 rc = VINF_SUCCESS;
1501 }
1502 STAM_PROFILE_ADV_START(&pVCpu->em.s.StatRAWTail, d);
1503
1504 LogFlow(("RR%u-E: %08x ESP=%08x EFL=%x IF=%d/%d VMFlags=%x PIF=%d\n",
1505 (pCtx->ss.Sel & X86_SEL_RPL), pCtx->eip, pCtx->esp, CPUMRawGetEFlags(pVCpu),
1506 !!(pGCState->uVMFlags & X86_EFL_IF), pCtx->eflags.Bits.u1IF, pGCState->uVMFlags, pGCState->fPIF));
1507 LogFlow(("VMMR3RawRunGC returned %Rrc\n", rc));
1508
1509
1510
1511 /*
1512 * Restore the real CPU state and deal with high priority post
1513 * execution FFs before doing anything else.
1514 */
1515 rc = CPUMRawLeave(pVCpu, NULL, rc);
1516 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_RESUME_GUEST_MASK);
1517 if ( VM_FF_IS_PENDING(pVM, VM_FF_HIGH_PRIORITY_POST_MASK)
1518 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_MASK))
1519 rc = emR3HighPriorityPostForcedActions(pVM, pVCpu, rc);
1520
1521#ifdef VBOX_STRICT
1522 /*
1523 * Assert TSS consistency & rc vs patch code.
1524 */
1525 if ( !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_SELM_SYNC_TSS | VMCPU_FF_SELM_SYNC_GDT) /* GDT implies TSS at the moment. */
1526 && EMIsRawRing0Enabled(pVM))
1527 SELMR3CheckTSS(pVM);
1528 switch (rc)
1529 {
1530 case VINF_SUCCESS:
1531 case VINF_EM_RAW_INTERRUPT:
1532 case VINF_PATM_PATCH_TRAP_PF:
1533 case VINF_PATM_PATCH_TRAP_GP:
1534 case VINF_PATM_PATCH_INT3:
1535 case VINF_PATM_CHECK_PATCH_PAGE:
1536 case VINF_EM_RAW_EXCEPTION_PRIVILEGED:
1537 case VINF_EM_RAW_GUEST_TRAP:
1538 case VINF_EM_RESCHEDULE_RAW:
1539 break;
1540
1541 default:
1542 if (PATMIsPatchGCAddr(pVM, pCtx->eip) && !(pCtx->eflags.u32 & X86_EFL_TF))
1543 LogIt(NULL, 0, LOG_GROUP_PATM, ("Patch code interrupted at %RRv for reason %Rrc\n", (RTRCPTR)CPUMGetGuestEIP(pVCpu), rc));
1544 break;
1545 }
1546 /*
1547 * Let's go paranoid!
1548 */
1549 if ( !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL)
1550 && PGMMapHasConflicts(pVM))
1551 {
1552 PGMMapCheck(pVM);
1553 AssertMsgFailed(("We should not get conflicts any longer!!! rc=%Rrc\n", rc));
1554 return VERR_EM_UNEXPECTED_MAPPING_CONFLICT;
1555 }
1556#endif /* VBOX_STRICT */
1557
1558 /*
1559 * Process the returned status code.
1560 */
1561 if (rc >= VINF_EM_FIRST && rc <= VINF_EM_LAST)
1562 {
1563 STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1564 break;
1565 }
1566 rc = emR3RawHandleRC(pVM, pVCpu, pCtx, rc);
1567 if (rc != VINF_SUCCESS)
1568 {
1569 rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1570 if (rc != VINF_SUCCESS)
1571 {
1572 STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1573 break;
1574 }
1575 }
1576
1577 /*
1578 * Check and execute forced actions.
1579 */
1580#ifdef VBOX_HIGH_RES_TIMERS_HACK
1581 TMTimerPollVoid(pVM, pVCpu);
1582#endif
1583 STAM_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTail, d);
1584 if ( VM_FF_IS_PENDING(pVM, ~VM_FF_HIGH_PRIORITY_PRE_RAW_MASK | VM_FF_PGM_NO_MEMORY)
1585 || VMCPU_FF_IS_PENDING(pVCpu, ~VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK))
1586 {
1587 Assert(pCtx->eflags.Bits.u1VM || (pCtx->ss.Sel & X86_SEL_RPL) != (EMIsRawRing1Enabled(pVM) ? 2 : 1));
1588
1589 STAM_REL_PROFILE_ADV_SUSPEND(&pVCpu->em.s.StatRAWTotal, a);
1590 rc = emR3ForcedActions(pVM, pVCpu, rc);
1591 VBOXVMM_EM_FF_ALL_RET(pVCpu, rc);
1592 STAM_REL_PROFILE_ADV_RESUME(&pVCpu->em.s.StatRAWTotal, a);
1593 if ( rc != VINF_SUCCESS
1594 && rc != VINF_EM_RESCHEDULE_RAW)
1595 {
1596 rc = emR3RawUpdateForceFlag(pVM, pVCpu, pCtx, rc);
1597 if (rc != VINF_SUCCESS)
1598 {
1599 *pfFFDone = true;
1600 break;
1601 }
1602 }
1603 }
1604 }
1605
1606 /*
1607 * Return to outer loop.
1608 */
1609#if defined(LOG_ENABLED) && defined(DEBUG)
1610 RTLogFlush(NULL);
1611#endif
1612 STAM_REL_PROFILE_ADV_STOP(&pVCpu->em.s.StatRAWTotal, a);
1613 return rc;
1614}
1615
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use