RT_C_DECLS_END
/**
* Exits the trap, called when exiting a trap handler.
*
* Will reset the trap if it's not a guest trap or the trap
* is already handled. Will process resume guest FFs.
*
* @returns rc, can be adjusted if its VINF_SUCCESS or something really bad
* happened.
* @param pVM Pointer to the VM.
* @param pVCpu Pointer to the VMCPU.
* @param rc The VBox status code to return.
* @param pRegFrame Pointer to the register frame for the trap.
*
* @remarks This must not be used for hypervisor traps, only guest traps.
*/
static int trpmGCExitTrap(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTXCORE pRegFrame)
{
uint32_t uOldActiveVector = pVCpu->trpm.s.uActiveVector;
NOREF(uOldActiveVector);
/* Reset trap? */
if ( rc != VINF_EM_RAW_GUEST_TRAP
&& rc != VINF_EM_RAW_RING_SWITCH_INT)
pVCpu->trpm.s.uActiveVector = UINT32_MAX;
#ifdef VBOX_HIGH_RES_TIMERS_HACK
/*
* We should poll the timers occasionally.
* We must *NOT* do this too frequently as it adds a significant overhead
* and it'll kill us if the trap load is high. (See @bugref{1354}.)
* (The heuristic is not very intelligent, we should really check trap
* frequency etc. here, but alas, we lack any such information atm.)
*/
static unsigned s_iTimerPoll = 0;
if (rc == VINF_SUCCESS)
{
if (!(++s_iTimerPoll & 0xf))
{
TMTimerPollVoid(pVM, pVCpu);
Log2(("TMTimerPoll at %08RX32 - VM_FF_TM_VIRTUAL_SYNC=%d VM_FF_TM_VIRTUAL_SYNC=%d\n", pRegFrame->eip,
VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC), VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER)));
}
}
else
s_iTimerPoll = 0;
#endif
/* Clear pending inhibit interrupt state if required. (necessary for dispatching interrupts later on) */
if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
{
Log2(("VM_FF_INHIBIT_INTERRUPTS at %08RX32 successor %RGv\n", pRegFrame->eip, EMGetInhibitInterruptsPC(pVCpu)));
if (pRegFrame->eip != EMGetInhibitInterruptsPC(pVCpu))
{
/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here if the eip is the same as the inhibited instr address.
* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
*/
VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
}
}
/*
* Pending resume-guest-FF?
* Or pending (A)PIC interrupt? Windows XP will crash if we delay APIC interrupts.
*/
if ( rc == VINF_SUCCESS
&& ( VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC | VM_FF_REQUEST | VM_FF_PGM_NO_MEMORY | VM_FF_PDM_DMA)
|| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER | VMCPU_FF_TO_R3 | VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC
| VMCPU_FF_REQUEST | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
| VMCPU_FF_PDM_CRITSECT)
)
)
{
/* The out of memory condition naturally outranks the others. */
if (RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)))
rc = VINF_EM_NO_MEMORY;
/* Pending Ring-3 action. */
else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TO_R3 | VMCPU_FF_PDM_CRITSECT))
{
VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
rc = VINF_EM_RAW_TO_R3;
}
/* Pending timer action. */
else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TIMER))
rc = VINF_EM_RAW_TIMER_PENDING;
/* The Virtual Sync clock has stopped. */
else if (VM_FF_ISPENDING(pVM, VM_FF_TM_VIRTUAL_SYNC))
rc = VINF_EM_RAW_TO_R3;
/* DMA work pending? */
else if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA))
rc = VINF_EM_RAW_TO_R3;
/* Pending request packets might contain actions that need immediate
attention, such as pending hardware interrupts. */
else if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
|| VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
rc = VINF_EM_PENDING_REQUEST;
/* Pending interrupt: dispatch it. */
else if ( VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
&& !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
&& PATMAreInterruptsEnabledByCtxCore(pVM, pRegFrame)
)
{
uint8_t u8Interrupt;
rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Rrc\n", rc));
rc = TRPMForwardTrap(pVCpu, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
/* can't return if successful */
Assert(rc != VINF_SUCCESS);
/* Stop the profile counter that was started in TRPMGCHandlersA.asm */
Assert(uOldActiveVector <= 16);
STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
/* Assert the trap and go to the recompiler to dispatch it. */
TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
STAM_PROFILE_ADV_START(&pVM->trpm.s.aStatGCTraps[uOldActiveVector], a);
rc = VINF_EM_RAW_INTERRUPT_PENDING;
}
/*
* Try sync CR3?
*/
else if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
{
#if 1
PGMRZDynMapReleaseAutoSet(pVCpu);
PGMRZDynMapStartAutoSet(pVCpu);
rc = PGMSyncCR3(pVCpu, CPUMGetGuestCR0(pVCpu), CPUMGetGuestCR3(pVCpu), CPUMGetGuestCR4(pVCpu), VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
#else
rc = VINF_PGM_SYNC_CR3;
#endif
}
}
AssertMsg( rc != VINF_SUCCESS
|| ( pRegFrame->eflags.Bits.u1IF
&& ( pRegFrame->eflags.Bits.u2IOPL < (unsigned)(pRegFrame->ss.Sel & X86_SEL_RPL) || pRegFrame->eflags.Bits.u1VM))
, ("rc=%Rrc\neflags=%RX32 ss=%RTsel IOPL=%d\n", rc, pRegFrame->eflags.u32, pRegFrame->ss.Sel, pRegFrame->eflags.Bits.u2IOPL));
PGMRZDynMapReleaseAutoSet(pVCpu);
return rc;
}
/**
* \#DB (Debug event) handler.
*
* @returns VBox status code.
* VINF_SUCCESS means we completely handled this trap,
* other codes are passed execution to host context.
*
* @param pVM The cross context VM structure.
* @param pVCpu The cross context virtual CPU structure.
* @param pRegFrame Pointer to the register frame for the trap.
* @param uDr6 The DR6 hypervisor register value.
* @param fAltStepping Alternative stepping indicator.
*/
VMMRZ_INT_DECL(int) DBGFRZTrap01Handler(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, RTGCUINTREG uDr6, bool fAltStepping)
{
#ifdef IN_RC
const bool fInHyper = !(pRegFrame->ss.Sel & X86_SEL_RPL) && !pRegFrame->eflags.Bits.u1VM;
#else
NOREF(pRegFrame);
const bool fInHyper = false;
#endif
/** @todo Intel docs say that X86_DR6_BS has the highest priority... */
/*
* A breakpoint?
*/
AssertCompile(X86_DR6_B0 == 1 && X86_DR6_B1 == 2 && X86_DR6_B2 == 4 && X86_DR6_B3 == 8);
if ( (uDr6 & (X86_DR6_B0 | X86_DR6_B1 | X86_DR6_B2 | X86_DR6_B3))
&& pVM->dbgf.s.cEnabledHwBreakpoints > 0)
{
for (unsigned iBp = 0; iBp < RT_ELEMENTS(pVM->dbgf.s.aHwBreakpoints); iBp++)
{
if ( ((uint32_t)uDr6 & RT_BIT_32(iBp))
&& pVM->dbgf.s.aHwBreakpoints[iBp].enmType == DBGFBPTYPE_REG)
{
pVCpu->dbgf.s.iActiveBp = pVM->dbgf.s.aHwBreakpoints[iBp].iBp;
pVCpu->dbgf.s.fSingleSteppingRaw = false;
LogFlow(("DBGFRZTrap03Handler: hit hw breakpoint %d at %04x:%RGv\n",
pVM->dbgf.s.aHwBreakpoints[iBp].iBp, pRegFrame->cs.Sel, pRegFrame->rip));
return fInHyper ? VINF_EM_DBG_HYPER_BREAKPOINT : VINF_EM_DBG_BREAKPOINT;
}
}
}
/*
* Single step?
* Are we single stepping or is it the guest?
*/
if ( (uDr6 & X86_DR6_BS)
&& (fInHyper || pVCpu->dbgf.s.fSingleSteppingRaw || fAltStepping))
{
pVCpu->dbgf.s.fSingleSteppingRaw = false;
LogFlow(("DBGFRZTrap01Handler: single step at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
return fInHyper ? VINF_EM_DBG_HYPER_STEPPED : VINF_EM_DBG_STEPPED;
}
#ifdef IN_RC
/*
* Either an ICEBP in hypervisor code or a guest related debug exception
* of sorts.
*/
if (RT_UNLIKELY(fInHyper))
{
/*
* Is this a guest debug event that was delayed past a ring transition?
*
* Since we do no allow sysenter/syscall in raw-mode, the only
* non-trap/fault type transitions that can occur are thru interrupt gates.
* Of those, only INT3 (#BP) has a DPL other than 0 with a CS.RPL of 0.
* See bugref:9171 and bs3-cpu-weird-1 for more details.
*
* We need to reconstruct the guest register state from the hypervisor one
* here, so here is the layout of the IRET frame on the stack:
* 20:[8] GS (V86 only)
* 1C:[7] FS (V86 only)
* 18:[6] DS (V86 only)
* 14:[5] ES (V86 only)
* 10:[4] SS
* 0c:[3] ESP
* 08:[2] EFLAGS
* 04:[1] CS
* 00:[0] EIP
*/
if (pRegFrame->rip == (uintptr_t)TRPMRCHandlerAsmTrap03)
{
uint32_t const *pu32Stack = (uint32_t const *)pRegFrame->esp;
if ( (pu32Stack[2] & X86_EFL_VM)
|| (pu32Stack[1] & X86_SEL_RPL))
{
LogFlow(("DBGFRZTrap01Handler: Detected guest #DB delayed past ring transition %04x:%RX32 %#x\n",
pu32Stack[1] & 0xffff, pu32Stack[0], pu32Stack[2]));
PCPUMCTX pGstCtx = CPUMQueryGuestCtxPtr(pVCpu);
pGstCtx->rip = pu32Stack[0];
pGstCtx->cs.Sel = pu32Stack[1];
pGstCtx->eflags.u = pu32Stack[2];
pGstCtx->rsp = pu32Stack[3];
pGstCtx->ss.Sel = pu32Stack[4];
if (pu32Stack[2] & X86_EFL_VM)
{
pGstCtx->es.Sel = pu32Stack[5];
pGstCtx->ds.Sel = pu32Stack[6];
pGstCtx->fs.Sel = pu32Stack[7];
pGstCtx->gs.Sel = pu32Stack[8];
}
else
{
pGstCtx->es.Sel = pRegFrame->es.Sel;
pGstCtx->ds.Sel = pRegFrame->ds.Sel;
pGstCtx->fs.Sel = pRegFrame->fs.Sel;
pGstCtx->gs.Sel = pRegFrame->gs.Sel;
}
pGstCtx->rax = pRegFrame->rax;
pGstCtx->rcx = pRegFrame->rcx;
pGstCtx->rdx = pRegFrame->rdx;
pGstCtx->rbx = pRegFrame->rbx;
pGstCtx->rsi = pRegFrame->rsi;
pGstCtx->rdi = pRegFrame->rdi;
pGstCtx->rbp = pRegFrame->rbp;
/*
* We should assert a #BP followed by a #DB here, but TRPM cannot
* do that. So, we'll just assert the #BP and ignore the #DB, even
* if that isn't strictly correct.
*/
TRPMResetTrap(pVCpu);
TRPMAssertTrap(pVCpu, X86_XCPT_BP, TRPM_SOFTWARE_INT);
return VINF_EM_RAW_GUEST_TRAP;
}
}
LogFlow(("DBGFRZTrap01Handler: Unknown bp at %04x:%RGv\n", pRegFrame->cs.Sel, pRegFrame->rip));
return VERR_DBGF_HYPER_DB_XCPT;
}
#endif
LogFlow(("DBGFRZTrap01Handler: guest debug event %#x at %04x:%RGv!\n", (uint32_t)uDr6, pRegFrame->cs.Sel, pRegFrame->rip));
return VINF_EM_RAW_GUEST_TRAP;
}
