Guru Meditation when stack pointer for trap handler is near zero

[diamond]

If the guest causes a trap, ESP is near zero, e.g. ESP=10h (this is just enough for eflags+cs+eip+errorcode without ring transition), hardware virtualization is disabled, VirtualBox goes to Guru Meditation state.

The small example is attached; it is valid bootsector, so can be installed as floppy image. This example raises #PF with ESP=10h from ring-0, in real environment the handler of #PF gots control, skips faulting instruction, and then the code enters idle state. VirtualBox goes to 'Guru Meditation' VERR_TRPM_DONT_PANIC. VBox.log is attached, VBox.png shows black screen.

According to stack trace, TRPMForwardTrap calls PGMVerifyAccess for range [esp-28h,esp), integer overflow results in negative 64-bit address, and pgmRCGst32BitGetPage does not expect this.

[diamond]

bootsector, which causes guru meditation

[Sander van Leeuwen]

Thanks for the report. I've added some extra boundary checks for 32 bits paging modes.