VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp@ 72783

Last change on this file since 72783 was 72783, checked in by vboxsync, 6 years ago

HM: doxygen fixes

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 318.4 KB
Line 
1/* $Id: HMSVMR0.cpp 72783 2018-07-01 16:33:06Z vboxsync $ */
2/** @file
3 * HM SVM (AMD-V) - Host Context Ring-0.
4 */
5
6/*
7 * Copyright (C) 2013-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Header Files *
21*********************************************************************************************************************************/
22#define LOG_GROUP LOG_GROUP_HM
23#define VMCPU_INCL_CPUM_GST_CTX
24#include <iprt/asm-amd64-x86.h>
25#include <iprt/thread.h>
26
27#include <VBox/vmm/pdmapi.h>
28#include <VBox/vmm/dbgf.h>
29#include <VBox/vmm/iem.h>
30#include <VBox/vmm/iom.h>
31#include <VBox/vmm/tm.h>
32#include <VBox/vmm/gim.h>
33#include <VBox/vmm/apic.h>
34#include "HMInternal.h"
35#include <VBox/vmm/vm.h>
36#include "HMSVMR0.h"
37#include "dtrace/VBoxVMM.h"
38
39#ifdef DEBUG_ramshankar
40# define HMSVM_SYNC_FULL_GUEST_STATE
41# define HMSVM_SYNC_FULL_NESTED_GUEST_STATE
42# define HMSVM_ALWAYS_TRAP_ALL_XCPTS
43# define HMSVM_ALWAYS_TRAP_PF
44# define HMSVM_ALWAYS_TRAP_TASK_SWITCH
45#endif
46
47
48/*********************************************************************************************************************************
49* Defined Constants And Macros *
50*********************************************************************************************************************************/
51#ifdef VBOX_WITH_STATISTICS
52# define HMSVM_EXITCODE_STAM_COUNTER_INC(u64ExitCode) do { \
53 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitAll); \
54 if ((u64ExitCode) == SVM_EXIT_NPF) \
55 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf); \
56 else \
57 STAM_COUNTER_INC(&pVCpu->hm.s.paStatExitReasonR0[(u64ExitCode) & MASK_EXITREASON_STAT]); \
58 } while (0)
59
60# ifdef VBOX_WITH_NESTED_HWVIRT_SVM
61# define HMSVM_NESTED_EXITCODE_STAM_COUNTER_INC(u64ExitCode) do { \
62 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitAll); \
63 if ((u64ExitCode) == SVM_EXIT_NPF) \
64 STAM_COUNTER_INC(&pVCpu->hm.s.StatNestedExitReasonNpf); \
65 else \
66 STAM_COUNTER_INC(&pVCpu->hm.s.paStatNestedExitReasonR0[(u64ExitCode) & MASK_EXITREASON_STAT]); \
67 } while (0)
68# endif
69#else
70# define HMSVM_EXITCODE_STAM_COUNTER_INC(u64ExitCode) do { } while (0)
71# ifdef VBOX_WITH_NESTED_HWVIRT_SVM
72# define HMSVM_NESTED_EXITCODE_STAM_COUNTER_INC(u64ExitCode) do { } while (0)
73# endif
74#endif /* !VBOX_WITH_STATISTICS */
75
76
77/** If we decide to use a function table approach this can be useful to
78 * switch to a "static DECLCALLBACK(int)". */
79#define HMSVM_EXIT_DECL static int
80
81/**
82 * Subset of the guest-CPU state that is kept by SVM R0 code while executing the
83 * guest using hardware-assisted SVM.
84 *
85 * This excludes state like TSC AUX, GPRs (other than RSP, RAX) which are always
86 * are swapped and restored across the world-switch and also registers like
87 * EFER, PAT MSR etc. which cannot be modified by the guest without causing a
88 * \#VMEXIT.
89 */
90#define HMSVM_CPUMCTX_EXTRN_ALL ( CPUMCTX_EXTRN_RIP \
91 | CPUMCTX_EXTRN_RFLAGS \
92 | CPUMCTX_EXTRN_RAX \
93 | CPUMCTX_EXTRN_RSP \
94 | CPUMCTX_EXTRN_SREG_MASK \
95 | CPUMCTX_EXTRN_CR0 \
96 | CPUMCTX_EXTRN_CR2 \
97 | CPUMCTX_EXTRN_CR3 \
98 | CPUMCTX_EXTRN_TABLE_MASK \
99 | CPUMCTX_EXTRN_DR6 \
100 | CPUMCTX_EXTRN_DR7 \
101 | CPUMCTX_EXTRN_KERNEL_GS_BASE \
102 | CPUMCTX_EXTRN_SYSCALL_MSRS \
103 | CPUMCTX_EXTRN_SYSENTER_MSRS \
104 | CPUMCTX_EXTRN_HWVIRT \
105 | CPUMCTX_EXTRN_HM_SVM_MASK)
106
107/**
108 * Subset of the guest-CPU state that is shared between the guest and host.
109 */
110#define HMSVM_CPUMCTX_SHARED_STATE CPUMCTX_EXTRN_DR_MASK
111
112/** Macro for importing guest state from the VMCB back into CPUMCTX. */
113#define HMSVM_CPUMCTX_IMPORT_STATE(a_pVCpu, a_fWhat) \
114 do { \
115 if ((a_pVCpu)->cpum.GstCtx.fExtrn & (a_fWhat)) \
116 hmR0SvmImportGuestState((a_pVCpu), (a_fWhat)); \
117 } while (0)
118
119/** Assert that the required state bits are fetched. */
120#define HMSVM_CPUMCTX_ASSERT(a_pVCpu, a_fExtrnMbz) AssertMsg(!((a_pVCpu)->cpum.GstCtx.fExtrn & (a_fExtrnMbz)), \
121 ("fExtrn=%#RX64 fExtrnMbz=%#RX64\n", \
122 (a_pVCpu)->cpum.GstCtx.fExtrn, (a_fExtrnMbz)))
123
124/** Macro for checking and returning from the using function for
125 * \#VMEXIT intercepts that maybe caused during delivering of another
126 * event in the guest. */
127#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
128# define HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY() \
129 do \
130 { \
131 int rc = hmR0SvmCheckExitDueToEventDelivery(pVCpu, pCtx, pSvmTransient); \
132 if (RT_LIKELY(rc == VINF_SUCCESS)) { /* continue #VMEXIT handling */ } \
133 else if ( rc == VINF_HM_DOUBLE_FAULT) { return VINF_SUCCESS; } \
134 else if ( rc == VINF_EM_RESET \
135 && CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_SHUTDOWN)) \
136 { \
137 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK); \
138 return VBOXSTRICTRC_TODO(IEMExecSvmVmexit(pVCpu, SVM_EXIT_SHUTDOWN, 0, 0)); \
139 } \
140 else \
141 return rc; \
142 } while (0)
143#else
144# define HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY() \
145 do \
146 { \
147 int rc = hmR0SvmCheckExitDueToEventDelivery(pVCpu, pCtx, pSvmTransient); \
148 if (RT_LIKELY(rc == VINF_SUCCESS)) { /* continue #VMEXIT handling */ } \
149 else if ( rc == VINF_HM_DOUBLE_FAULT) { return VINF_SUCCESS; } \
150 else \
151 return rc; \
152 } while (0)
153#endif
154
155/** Macro which updates interrupt shadow for the current RIP. */
156#define HMSVM_UPDATE_INTR_SHADOW(pVCpu, pCtx) \
157 do { \
158 /* Update interrupt shadow. */ \
159 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) \
160 && pCtx->rip != EMGetInhibitInterruptsPC(pVCpu)) \
161 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS); \
162 } while (0)
163
164/** Macro for upgrading a @a a_rc to VINF_EM_DBG_STEPPED after emulating an
165 * instruction that exited. */
166#define HMSVM_CHECK_SINGLE_STEP(a_pVCpu, a_rc) \
167 do { \
168 if ((a_pVCpu)->hm.s.fSingleInstruction && (a_rc) == VINF_SUCCESS) \
169 (a_rc) = VINF_EM_DBG_STEPPED; \
170 } while (0)
171
172/** Assert that preemption is disabled or covered by thread-context hooks. */
173#define HMSVM_ASSERT_PREEMPT_SAFE() Assert( VMMR0ThreadCtxHookIsEnabled(pVCpu) \
174 || !RTThreadPreemptIsEnabled(NIL_RTTHREAD));
175
176/** Assert that we haven't migrated CPUs when thread-context hooks are not
177 * used. */
178#define HMSVM_ASSERT_CPU_SAFE() AssertMsg( VMMR0ThreadCtxHookIsEnabled(pVCpu) \
179 || pVCpu->hm.s.idEnteredCpu == RTMpCpuId(), \
180 ("Illegal migration! Entered on CPU %u Current %u\n", \
181 pVCpu->hm.s.idEnteredCpu, RTMpCpuId()));
182
183/** Assert that we're not executing a nested-guest. */
184#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
185# define HMSVM_ASSERT_NOT_IN_NESTED_GUEST(a_pCtx) Assert(!CPUMIsGuestInSvmNestedHwVirtMode((a_pCtx)))
186#else
187# define HMSVM_ASSERT_NOT_IN_NESTED_GUEST(a_pCtx) do { NOREF((a_pCtx)); } while (0)
188#endif
189
190/** Assert that we're executing a nested-guest. */
191#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
192# define HMSVM_ASSERT_IN_NESTED_GUEST(a_pCtx) Assert(CPUMIsGuestInSvmNestedHwVirtMode((a_pCtx)))
193#else
194# define HMSVM_ASSERT_IN_NESTED_GUEST(a_pCtx) do { NOREF((a_pCtx)); } while (0)
195#endif
196
197/** Validate segment descriptor granularity bit. */
198#ifdef VBOX_STRICT
199# define HMSVM_ASSERT_SEG_GRANULARITY(a_pCtx, reg) \
200 AssertMsg( !(a_pCtx)->reg.Attr.n.u1Present \
201 || ( (a_pCtx)->reg.Attr.n.u1Granularity \
202 ? ((a_pCtx)->reg.u32Limit & 0xfff) == 0xfff \
203 : (a_pCtx)->reg.u32Limit <= UINT32_C(0xfffff)), \
204 ("Invalid Segment Attributes Limit=%#RX32 Attr=%#RX32 Base=%#RX64\n", (a_pCtx)->reg.u32Limit, \
205 (a_pCtx)->reg.Attr.u, (a_pCtx)->reg.u64Base))
206#else
207# define HMSVM_ASSERT_SEG_GRANULARITY(a_pCtx, reg) do { } while (0)
208#endif
209
210/**
211 * Exception bitmap mask for all contributory exceptions.
212 *
213 * Page fault is deliberately excluded here as it's conditional as to whether
214 * it's contributory or benign. Page faults are handled separately.
215 */
216#define HMSVM_CONTRIBUTORY_XCPT_MASK ( RT_BIT(X86_XCPT_GP) | RT_BIT(X86_XCPT_NP) | RT_BIT(X86_XCPT_SS) | RT_BIT(X86_XCPT_TS) \
217 | RT_BIT(X86_XCPT_DE))
218
219/**
220 * Mandatory/unconditional guest control intercepts.
221 *
222 * SMIs can and do happen in normal operation. We need not intercept them
223 * while executing the guest (or nested-guest).
224 */
225#define HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS ( SVM_CTRL_INTERCEPT_INTR \
226 | SVM_CTRL_INTERCEPT_NMI \
227 | SVM_CTRL_INTERCEPT_INIT \
228 | SVM_CTRL_INTERCEPT_RDPMC \
229 | SVM_CTRL_INTERCEPT_CPUID \
230 | SVM_CTRL_INTERCEPT_RSM \
231 | SVM_CTRL_INTERCEPT_HLT \
232 | SVM_CTRL_INTERCEPT_IOIO_PROT \
233 | SVM_CTRL_INTERCEPT_MSR_PROT \
234 | SVM_CTRL_INTERCEPT_INVLPGA \
235 | SVM_CTRL_INTERCEPT_SHUTDOWN \
236 | SVM_CTRL_INTERCEPT_FERR_FREEZE \
237 | SVM_CTRL_INTERCEPT_VMRUN \
238 | SVM_CTRL_INTERCEPT_SKINIT \
239 | SVM_CTRL_INTERCEPT_WBINVD \
240 | SVM_CTRL_INTERCEPT_MONITOR \
241 | SVM_CTRL_INTERCEPT_MWAIT \
242 | SVM_CTRL_INTERCEPT_CR0_SEL_WRITE \
243 | SVM_CTRL_INTERCEPT_XSETBV)
244
245/** @name VMCB Clean Bits.
246 *
247 * These flags are used for VMCB-state caching. A set VMCB Clean bit indicates
248 * AMD-V doesn't need to reload the corresponding value(s) from the VMCB in
249 * memory.
250 *
251 * @{ */
252/** All intercepts vectors, TSC offset, PAUSE filter counter. */
253#define HMSVM_VMCB_CLEAN_INTERCEPTS RT_BIT(0)
254/** I/O permission bitmap, MSR permission bitmap. */
255#define HMSVM_VMCB_CLEAN_IOPM_MSRPM RT_BIT(1)
256/** ASID. */
257#define HMSVM_VMCB_CLEAN_ASID RT_BIT(2)
258/** TRP: V_TPR, V_IRQ, V_INTR_PRIO, V_IGN_TPR, V_INTR_MASKING,
259V_INTR_VECTOR. */
260#define HMSVM_VMCB_CLEAN_INT_CTRL RT_BIT(3)
261/** Nested Paging: Nested CR3 (nCR3), PAT. */
262#define HMSVM_VMCB_CLEAN_NP RT_BIT(4)
263/** Control registers (CR0, CR3, CR4, EFER). */
264#define HMSVM_VMCB_CLEAN_CRX_EFER RT_BIT(5)
265/** Debug registers (DR6, DR7). */
266#define HMSVM_VMCB_CLEAN_DRX RT_BIT(6)
267/** GDT, IDT limit and base. */
268#define HMSVM_VMCB_CLEAN_DT RT_BIT(7)
269/** Segment register: CS, SS, DS, ES limit and base. */
270#define HMSVM_VMCB_CLEAN_SEG RT_BIT(8)
271/** CR2.*/
272#define HMSVM_VMCB_CLEAN_CR2 RT_BIT(9)
273/** Last-branch record (DbgCtlMsr, br_from, br_to, lastint_from, lastint_to) */
274#define HMSVM_VMCB_CLEAN_LBR RT_BIT(10)
275/** AVIC (AVIC APIC_BAR; AVIC APIC_BACKING_PAGE, AVIC
276PHYSICAL_TABLE and AVIC LOGICAL_TABLE Pointers). */
277#define HMSVM_VMCB_CLEAN_AVIC RT_BIT(11)
278/** Mask of all valid VMCB Clean bits. */
279#define HMSVM_VMCB_CLEAN_ALL ( HMSVM_VMCB_CLEAN_INTERCEPTS \
280 | HMSVM_VMCB_CLEAN_IOPM_MSRPM \
281 | HMSVM_VMCB_CLEAN_ASID \
282 | HMSVM_VMCB_CLEAN_INT_CTRL \
283 | HMSVM_VMCB_CLEAN_NP \
284 | HMSVM_VMCB_CLEAN_CRX_EFER \
285 | HMSVM_VMCB_CLEAN_DRX \
286 | HMSVM_VMCB_CLEAN_DT \
287 | HMSVM_VMCB_CLEAN_SEG \
288 | HMSVM_VMCB_CLEAN_CR2 \
289 | HMSVM_VMCB_CLEAN_LBR \
290 | HMSVM_VMCB_CLEAN_AVIC)
291/** @} */
292
293/** @name SVM transient.
294 *
295 * A state structure for holding miscellaneous information across AMD-V
296 * VMRUN/\#VMEXIT operation, restored after the transition.
297 *
298 * @{ */
299typedef struct SVMTRANSIENT
300{
301 /** The host's rflags/eflags. */
302 RTCCUINTREG fEFlags;
303#if HC_ARCH_BITS == 32
304 uint32_t u32Alignment0;
305#endif
306
307 /** The \#VMEXIT exit code (the EXITCODE field in the VMCB). */
308 uint64_t u64ExitCode;
309 /** The guest's TPR value used for TPR shadowing. */
310 uint8_t u8GuestTpr;
311 /** Alignment. */
312 uint8_t abAlignment0[7];
313
314 /** Pointer to the currently executing VMCB. */
315 PSVMVMCB pVmcb;
316 /** Whether we are currently executing a nested-guest. */
317 bool fIsNestedGuest;
318
319 /** Whether the guest debug state was active at the time of \#VMEXIT. */
320 bool fWasGuestDebugStateActive;
321 /** Whether the hyper debug state was active at the time of \#VMEXIT. */
322 bool fWasHyperDebugStateActive;
323 /** Whether the TSC offset mode needs to be updated. */
324 bool fUpdateTscOffsetting;
325 /** Whether the TSC_AUX MSR needs restoring on \#VMEXIT. */
326 bool fRestoreTscAuxMsr;
327 /** Whether the \#VMEXIT was caused by a page-fault during delivery of a
328 * contributary exception or a page-fault. */
329 bool fVectoringDoublePF;
330 /** Whether the \#VMEXIT was caused by a page-fault during delivery of an
331 * external interrupt or NMI. */
332 bool fVectoringPF;
333} SVMTRANSIENT, *PSVMTRANSIENT;
334AssertCompileMemberAlignment(SVMTRANSIENT, u64ExitCode, sizeof(uint64_t));
335AssertCompileMemberAlignment(SVMTRANSIENT, pVmcb, sizeof(uint64_t));
336/** @} */
337
338/**
339 * MSRPM (MSR permission bitmap) read permissions (for guest RDMSR).
340 */
341typedef enum SVMMSREXITREAD
342{
343 /** Reading this MSR causes a \#VMEXIT. */
344 SVMMSREXIT_INTERCEPT_READ = 0xb,
345 /** Reading this MSR does not cause a \#VMEXIT. */
346 SVMMSREXIT_PASSTHRU_READ
347} SVMMSREXITREAD;
348
349/**
350 * MSRPM (MSR permission bitmap) write permissions (for guest WRMSR).
351 */
352typedef enum SVMMSREXITWRITE
353{
354 /** Writing to this MSR causes a \#VMEXIT. */
355 SVMMSREXIT_INTERCEPT_WRITE = 0xd,
356 /** Writing to this MSR does not cause a \#VMEXIT. */
357 SVMMSREXIT_PASSTHRU_WRITE
358} SVMMSREXITWRITE;
359
360/**
361 * SVM \#VMEXIT handler.
362 *
363 * @returns VBox status code.
364 * @param pVCpu The cross context virtual CPU structure.
365 * @param pCtx Pointer to the guest-CPU context.
366 * @param pSvmTransient Pointer to the SVM-transient structure.
367 */
368typedef int FNSVMEXITHANDLER(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient);
369
370
371/*********************************************************************************************************************************
372* Internal Functions *
373*********************************************************************************************************************************/
374static void hmR0SvmPendingEventToTrpmTrap(PVMCPU pVCpu);
375static void hmR0SvmLeave(PVMCPU pVCpu, bool fImportState);
376
377
378/** @name \#VMEXIT handlers.
379 * @{
380 */
381static FNSVMEXITHANDLER hmR0SvmExitIntr;
382static FNSVMEXITHANDLER hmR0SvmExitWbinvd;
383static FNSVMEXITHANDLER hmR0SvmExitInvd;
384static FNSVMEXITHANDLER hmR0SvmExitCpuid;
385static FNSVMEXITHANDLER hmR0SvmExitRdtsc;
386static FNSVMEXITHANDLER hmR0SvmExitRdtscp;
387static FNSVMEXITHANDLER hmR0SvmExitRdpmc;
388static FNSVMEXITHANDLER hmR0SvmExitInvlpg;
389static FNSVMEXITHANDLER hmR0SvmExitHlt;
390static FNSVMEXITHANDLER hmR0SvmExitMonitor;
391static FNSVMEXITHANDLER hmR0SvmExitMwait;
392static FNSVMEXITHANDLER hmR0SvmExitShutdown;
393static FNSVMEXITHANDLER hmR0SvmExitUnexpected;
394static FNSVMEXITHANDLER hmR0SvmExitReadCRx;
395static FNSVMEXITHANDLER hmR0SvmExitWriteCRx;
396static FNSVMEXITHANDLER hmR0SvmExitMsr;
397static FNSVMEXITHANDLER hmR0SvmExitReadDRx;
398static FNSVMEXITHANDLER hmR0SvmExitWriteDRx;
399static FNSVMEXITHANDLER hmR0SvmExitXsetbv;
400static FNSVMEXITHANDLER hmR0SvmExitIOInstr;
401static FNSVMEXITHANDLER hmR0SvmExitNestedPF;
402static FNSVMEXITHANDLER hmR0SvmExitVIntr;
403static FNSVMEXITHANDLER hmR0SvmExitTaskSwitch;
404static FNSVMEXITHANDLER hmR0SvmExitVmmCall;
405static FNSVMEXITHANDLER hmR0SvmExitPause;
406static FNSVMEXITHANDLER hmR0SvmExitFerrFreeze;
407static FNSVMEXITHANDLER hmR0SvmExitIret;
408static FNSVMEXITHANDLER hmR0SvmExitXcptPF;
409static FNSVMEXITHANDLER hmR0SvmExitXcptUD;
410static FNSVMEXITHANDLER hmR0SvmExitXcptMF;
411static FNSVMEXITHANDLER hmR0SvmExitXcptDB;
412static FNSVMEXITHANDLER hmR0SvmExitXcptAC;
413static FNSVMEXITHANDLER hmR0SvmExitXcptBP;
414#if defined(HMSVM_ALWAYS_TRAP_ALL_XCPTS) || defined(VBOX_WITH_NESTED_HWVIRT_SVM)
415static FNSVMEXITHANDLER hmR0SvmExitXcptGeneric;
416#endif
417#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
418static FNSVMEXITHANDLER hmR0SvmExitClgi;
419static FNSVMEXITHANDLER hmR0SvmExitStgi;
420static FNSVMEXITHANDLER hmR0SvmExitVmload;
421static FNSVMEXITHANDLER hmR0SvmExitVmsave;
422static FNSVMEXITHANDLER hmR0SvmExitInvlpga;
423static FNSVMEXITHANDLER hmR0SvmExitVmrun;
424static FNSVMEXITHANDLER hmR0SvmNestedExitXcptDB;
425static FNSVMEXITHANDLER hmR0SvmNestedExitXcptBP;
426#endif
427/** @} */
428
429static int hmR0SvmHandleExit(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient);
430#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
431static int hmR0SvmHandleExitNested(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient);
432#endif
433
434
435/*********************************************************************************************************************************
436* Global Variables *
437*********************************************************************************************************************************/
438/** Ring-0 memory object for the IO bitmap. */
439static RTR0MEMOBJ g_hMemObjIOBitmap = NIL_RTR0MEMOBJ;
440/** Physical address of the IO bitmap. */
441static RTHCPHYS g_HCPhysIOBitmap;
442/** Pointer to the IO bitmap. */
443static R0PTRTYPE(void *) g_pvIOBitmap;
444
445#ifdef VBOX_STRICT
446# define HMSVM_LOG_RBP_RSP RT_BIT_32(0)
447# define HMSVM_LOG_CR_REGS RT_BIT_32(1)
448# define HMSVM_LOG_CS RT_BIT_32(2)
449# define HMSVM_LOG_SS RT_BIT_32(3)
450# define HMSVM_LOG_FS RT_BIT_32(4)
451# define HMSVM_LOG_GS RT_BIT_32(5)
452# define HMSVM_LOG_LBR RT_BIT_32(6)
453# define HMSVM_LOG_ALL ( HMSVM_LOG_RBP_RSP \
454 | HMSVM_LOG_CR_REGS \
455 | HMSVM_LOG_CS \
456 | HMSVM_LOG_SS \
457 | HMSVM_LOG_FS \
458 | HMSVM_LOG_GS \
459 | HMSVM_LOG_LBR)
460
461/**
462 * Dumps virtual CPU state and additional info. to the logger for diagnostics.
463 *
464 * @param pVCpu The cross context virtual CPU structure.
465 * @param pVmcb Pointer to the VM control block.
466 * @param pszPrefix Log prefix.
467 * @param fFlags Log flags, see HMSVM_LOG_XXX.
468 * @param uVerbose The verbosity level, currently unused.
469 */
470static void hmR0SvmLogState(PVMCPU pVCpu, PCSVMVMCB pVmcb, const char *pszPrefix, uint32_t fFlags, uint8_t uVerbose)
471{
472 RT_NOREF2(pVCpu, uVerbose);
473 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
474
475 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CS | CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_RFLAGS);
476 Log4(("%s: cs:rip=%04x:%RX64 efl=%#RX64\n", pszPrefix, pCtx->cs.Sel, pCtx->rip, pCtx->rflags.u));
477
478 if (fFlags & HMSVM_LOG_RBP_RSP)
479 {
480 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_RSP | CPUMCTX_EXTRN_RBP);
481 Log4(("%s: rsp=%#RX64 rbp=%#RX64\n", pszPrefix, pCtx->rsp, pCtx->rbp));
482 }
483
484 if (fFlags & HMSVM_LOG_CR_REGS)
485 {
486 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4);
487 Log4(("%s: cr0=%#RX64 cr3=%#RX64 cr4=%#RX64\n", pszPrefix, pCtx->cr0, pCtx->cr3, pCtx->cr4));
488 }
489
490 if (fFlags & HMSVM_LOG_CS)
491 {
492 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CS);
493 Log4(("%s: cs={%04x base=%016RX64 limit=%08x flags=%08x}\n", pszPrefix, pCtx->cs.Sel, pCtx->cs.u64Base,
494 pCtx->cs.u32Limit, pCtx->cs.Attr.u));
495 }
496 if (fFlags & HMSVM_LOG_SS)
497 {
498 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SS);
499 Log4(("%s: ss={%04x base=%016RX64 limit=%08x flags=%08x}\n", pszPrefix, pCtx->ss.Sel, pCtx->ss.u64Base,
500 pCtx->ss.u32Limit, pCtx->ss.Attr.u));
501 }
502 if (fFlags & HMSVM_LOG_FS)
503 {
504 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_FS);
505 Log4(("%s: fs={%04x base=%016RX64 limit=%08x flags=%08x}\n", pszPrefix, pCtx->fs.Sel, pCtx->fs.u64Base,
506 pCtx->fs.u32Limit, pCtx->fs.Attr.u));
507 }
508 if (fFlags & HMSVM_LOG_GS)
509 {
510 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_GS);
511 Log4(("%s: gs={%04x base=%016RX64 limit=%08x flags=%08x}\n", pszPrefix, pCtx->gs.Sel, pCtx->gs.u64Base,
512 pCtx->gs.u32Limit, pCtx->gs.Attr.u));
513 }
514
515 PCSVMVMCBSTATESAVE pVmcbGuest = &pVmcb->guest;
516 if (fFlags & HMSVM_LOG_LBR)
517 {
518 Log4(("%s: br_from=%#RX64 br_to=%#RX64 lastxcpt_from=%#RX64 lastxcpt_to=%#RX64\n", pszPrefix, pVmcbGuest->u64BR_FROM,
519 pVmcbGuest->u64BR_TO, pVmcbGuest->u64LASTEXCPFROM, pVmcbGuest->u64LASTEXCPTO));
520 }
521 NOREF(pVmcbGuest); NOREF(pCtx);
522}
523#endif /* VBOX_STRICT */
524
525
526/**
527 * Sets up and activates AMD-V on the current CPU.
528 *
529 * @returns VBox status code.
530 * @param pCpu Pointer to the CPU info struct.
531 * @param pVM The cross context VM structure. Can be
532 * NULL after a resume!
533 * @param pvCpuPage Pointer to the global CPU page.
534 * @param HCPhysCpuPage Physical address of the global CPU page.
535 * @param fEnabledByHost Whether the host OS has already initialized AMD-V.
536 * @param pvArg Unused on AMD-V.
537 */
538VMMR0DECL(int) SVMR0EnableCpu(PHMGLOBALCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage, bool fEnabledByHost,
539 void *pvArg)
540{
541 Assert(!fEnabledByHost);
542 Assert(HCPhysCpuPage && HCPhysCpuPage != NIL_RTHCPHYS);
543 Assert(RT_ALIGN_T(HCPhysCpuPage, _4K, RTHCPHYS) == HCPhysCpuPage);
544 Assert(pvCpuPage); NOREF(pvCpuPage);
545 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
546
547 NOREF(pvArg);
548 NOREF(fEnabledByHost);
549
550 /* Paranoid: Disable interrupt as, in theory, interrupt handlers might mess with EFER. */
551 RTCCUINTREG const fEFlags = ASMIntDisableFlags();
552
553 /*
554 * We must turn on AMD-V and setup the host state physical address, as those MSRs are per CPU.
555 */
556 uint64_t u64HostEfer = ASMRdMsr(MSR_K6_EFER);
557 if (u64HostEfer & MSR_K6_EFER_SVME)
558 {
559 /* If the VBOX_HWVIRTEX_IGNORE_SVM_IN_USE is active, then we blindly use AMD-V. */
560 if ( pVM
561 && pVM->hm.s.svm.fIgnoreInUseError)
562 pCpu->fIgnoreAMDVInUseError = true;
563
564 if (!pCpu->fIgnoreAMDVInUseError)
565 {
566 ASMSetFlags(fEFlags);
567 return VERR_SVM_IN_USE;
568 }
569 }
570
571 /* Turn on AMD-V in the EFER MSR. */
572 ASMWrMsr(MSR_K6_EFER, u64HostEfer | MSR_K6_EFER_SVME);
573
574 /* Write the physical page address where the CPU will store the host state while executing the VM. */
575 ASMWrMsr(MSR_K8_VM_HSAVE_PA, HCPhysCpuPage);
576
577 /* Restore interrupts. */
578 ASMSetFlags(fEFlags);
579
580 /*
581 * Theoretically, other hypervisors may have used ASIDs, ideally we should flush all
582 * non-zero ASIDs when enabling SVM. AMD doesn't have an SVM instruction to flush all
583 * ASIDs (flushing is done upon VMRUN). Therefore, flag that we need to flush the TLB
584 * entirely with before executing any guest code.
585 */
586 pCpu->fFlushAsidBeforeUse = true;
587
588 /*
589 * Ensure each VCPU scheduled on this CPU gets a new ASID on resume. See @bugref{6255}.
590 */
591 ++pCpu->cTlbFlushes;
592
593 return VINF_SUCCESS;
594}
595
596
597/**
598 * Deactivates AMD-V on the current CPU.
599 *
600 * @returns VBox status code.
601 * @param pCpu Pointer to the CPU info struct.
602 * @param pvCpuPage Pointer to the global CPU page.
603 * @param HCPhysCpuPage Physical address of the global CPU page.
604 */
605VMMR0DECL(int) SVMR0DisableCpu(PHMGLOBALCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
606{
607 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
608 AssertReturn( HCPhysCpuPage
609 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
610 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
611 NOREF(pCpu);
612
613 /* Paranoid: Disable interrupts as, in theory, interrupt handlers might mess with EFER. */
614 RTCCUINTREG const fEFlags = ASMIntDisableFlags();
615
616 /* Turn off AMD-V in the EFER MSR. */
617 uint64_t u64HostEfer = ASMRdMsr(MSR_K6_EFER);
618 ASMWrMsr(MSR_K6_EFER, u64HostEfer & ~MSR_K6_EFER_SVME);
619
620 /* Invalidate host state physical address. */
621 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
622
623 /* Restore interrupts. */
624 ASMSetFlags(fEFlags);
625
626 return VINF_SUCCESS;
627}
628
629
630/**
631 * Does global AMD-V initialization (called during module initialization).
632 *
633 * @returns VBox status code.
634 */
635VMMR0DECL(int) SVMR0GlobalInit(void)
636{
637 /*
638 * Allocate 12 KB (3 pages) for the IO bitmap. Since this is non-optional and we always
639 * intercept all IO accesses, it's done once globally here instead of per-VM.
640 */
641 Assert(g_hMemObjIOBitmap == NIL_RTR0MEMOBJ);
642 int rc = RTR0MemObjAllocCont(&g_hMemObjIOBitmap, SVM_IOPM_PAGES << X86_PAGE_4K_SHIFT, false /* fExecutable */);
643 if (RT_FAILURE(rc))
644 return rc;
645
646 g_pvIOBitmap = RTR0MemObjAddress(g_hMemObjIOBitmap);
647 g_HCPhysIOBitmap = RTR0MemObjGetPagePhysAddr(g_hMemObjIOBitmap, 0 /* iPage */);
648
649 /* Set all bits to intercept all IO accesses. */
650 ASMMemFill32(g_pvIOBitmap, SVM_IOPM_PAGES << X86_PAGE_4K_SHIFT, UINT32_C(0xffffffff));
651
652 return VINF_SUCCESS;
653}
654
655
656/**
657 * Does global AMD-V termination (called during module termination).
658 */
659VMMR0DECL(void) SVMR0GlobalTerm(void)
660{
661 if (g_hMemObjIOBitmap != NIL_RTR0MEMOBJ)
662 {
663 RTR0MemObjFree(g_hMemObjIOBitmap, true /* fFreeMappings */);
664 g_pvIOBitmap = NULL;
665 g_HCPhysIOBitmap = 0;
666 g_hMemObjIOBitmap = NIL_RTR0MEMOBJ;
667 }
668}
669
670
671/**
672 * Frees any allocated per-VCPU structures for a VM.
673 *
674 * @param pVM The cross context VM structure.
675 */
676DECLINLINE(void) hmR0SvmFreeStructs(PVM pVM)
677{
678 for (uint32_t i = 0; i < pVM->cCpus; i++)
679 {
680 PVMCPU pVCpu = &pVM->aCpus[i];
681 AssertPtr(pVCpu);
682
683 if (pVCpu->hm.s.svm.hMemObjVmcbHost != NIL_RTR0MEMOBJ)
684 {
685 RTR0MemObjFree(pVCpu->hm.s.svm.hMemObjVmcbHost, false);
686 pVCpu->hm.s.svm.HCPhysVmcbHost = 0;
687 pVCpu->hm.s.svm.hMemObjVmcbHost = NIL_RTR0MEMOBJ;
688 }
689
690 if (pVCpu->hm.s.svm.hMemObjVmcb != NIL_RTR0MEMOBJ)
691 {
692 RTR0MemObjFree(pVCpu->hm.s.svm.hMemObjVmcb, false);
693 pVCpu->hm.s.svm.pVmcb = NULL;
694 pVCpu->hm.s.svm.HCPhysVmcb = 0;
695 pVCpu->hm.s.svm.hMemObjVmcb = NIL_RTR0MEMOBJ;
696 }
697
698 if (pVCpu->hm.s.svm.hMemObjMsrBitmap != NIL_RTR0MEMOBJ)
699 {
700 RTR0MemObjFree(pVCpu->hm.s.svm.hMemObjMsrBitmap, false);
701 pVCpu->hm.s.svm.pvMsrBitmap = NULL;
702 pVCpu->hm.s.svm.HCPhysMsrBitmap = 0;
703 pVCpu->hm.s.svm.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
704 }
705 }
706}
707
708
709/**
710 * Does per-VM AMD-V initialization.
711 *
712 * @returns VBox status code.
713 * @param pVM The cross context VM structure.
714 */
715VMMR0DECL(int) SVMR0InitVM(PVM pVM)
716{
717 int rc = VERR_INTERNAL_ERROR_5;
718
719 /*
720 * Check for an AMD CPU erratum which requires us to flush the TLB before every world-switch.
721 */
722 uint32_t u32Family;
723 uint32_t u32Model;
724 uint32_t u32Stepping;
725 if (HMAmdIsSubjectToErratum170(&u32Family, &u32Model, &u32Stepping))
726 {
727 Log4Func(("AMD cpu with erratum 170 family %#x model %#x stepping %#x\n", u32Family, u32Model, u32Stepping));
728 pVM->hm.s.svm.fAlwaysFlushTLB = true;
729 }
730
731 /*
732 * Initialize the R0 memory objects up-front so we can properly cleanup on allocation failures.
733 */
734 for (VMCPUID i = 0; i < pVM->cCpus; i++)
735 {
736 PVMCPU pVCpu = &pVM->aCpus[i];
737 pVCpu->hm.s.svm.hMemObjVmcbHost = NIL_RTR0MEMOBJ;
738 pVCpu->hm.s.svm.hMemObjVmcb = NIL_RTR0MEMOBJ;
739 pVCpu->hm.s.svm.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
740 }
741
742 for (VMCPUID i = 0; i < pVM->cCpus; i++)
743 {
744 PVMCPU pVCpu = &pVM->aCpus[i];
745
746 /*
747 * Allocate one page for the host-context VM control block (VMCB). This is used for additional host-state (such as
748 * FS, GS, Kernel GS Base, etc.) apart from the host-state save area specified in MSR_K8_VM_HSAVE_PA.
749 */
750 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.svm.hMemObjVmcbHost, SVM_VMCB_PAGES << PAGE_SHIFT, false /* fExecutable */);
751 if (RT_FAILURE(rc))
752 goto failure_cleanup;
753
754 void *pvVmcbHost = RTR0MemObjAddress(pVCpu->hm.s.svm.hMemObjVmcbHost);
755 pVCpu->hm.s.svm.HCPhysVmcbHost = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.svm.hMemObjVmcbHost, 0 /* iPage */);
756 Assert(pVCpu->hm.s.svm.HCPhysVmcbHost < _4G);
757 ASMMemZeroPage(pvVmcbHost);
758
759 /*
760 * Allocate one page for the guest-state VMCB.
761 */
762 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.svm.hMemObjVmcb, SVM_VMCB_PAGES << PAGE_SHIFT, false /* fExecutable */);
763 if (RT_FAILURE(rc))
764 goto failure_cleanup;
765
766 pVCpu->hm.s.svm.pVmcb = (PSVMVMCB)RTR0MemObjAddress(pVCpu->hm.s.svm.hMemObjVmcb);
767 pVCpu->hm.s.svm.HCPhysVmcb = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.svm.hMemObjVmcb, 0 /* iPage */);
768 Assert(pVCpu->hm.s.svm.HCPhysVmcb < _4G);
769 ASMMemZeroPage(pVCpu->hm.s.svm.pVmcb);
770
771 /*
772 * Allocate two pages (8 KB) for the MSR permission bitmap. There doesn't seem to be a way to convince
773 * SVM to not require one.
774 */
775 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.svm.hMemObjMsrBitmap, SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT,
776 false /* fExecutable */);
777 if (RT_FAILURE(rc))
778 goto failure_cleanup;
779
780 pVCpu->hm.s.svm.pvMsrBitmap = RTR0MemObjAddress(pVCpu->hm.s.svm.hMemObjMsrBitmap);
781 pVCpu->hm.s.svm.HCPhysMsrBitmap = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.svm.hMemObjMsrBitmap, 0 /* iPage */);
782 /* Set all bits to intercept all MSR accesses (changed later on). */
783 ASMMemFill32(pVCpu->hm.s.svm.pvMsrBitmap, SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT, UINT32_C(0xffffffff));
784 }
785
786 return VINF_SUCCESS;
787
788failure_cleanup:
789 hmR0SvmFreeStructs(pVM);
790 return rc;
791}
792
793
794/**
795 * Does per-VM AMD-V termination.
796 *
797 * @returns VBox status code.
798 * @param pVM The cross context VM structure.
799 */
800VMMR0DECL(int) SVMR0TermVM(PVM pVM)
801{
802 hmR0SvmFreeStructs(pVM);
803 return VINF_SUCCESS;
804}
805
806
807/**
808 * Returns whether the VMCB Clean Bits feature is supported.
809 *
810 * @return @c true if supported, @c false otherwise.
811 * @param pVCpu The cross context virtual CPU structure.
812 * @param pCtx Pointer to the guest-CPU context.
813 */
814DECLINLINE(bool) hmR0SvmSupportsVmcbCleanBits(PVMCPU pVCpu, PCCPUMCTX pCtx)
815{
816 PVM pVM = pVCpu->CTX_SUFF(pVM);
817#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
818 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
819 {
820 return (pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VMCB_CLEAN)
821 && pVM->cpum.ro.GuestFeatures.fSvmVmcbClean;
822 }
823#else
824 RT_NOREF(pCtx);
825#endif
826 return RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VMCB_CLEAN);
827}
828
829
830/**
831 * Returns whether the decode assists feature is supported.
832 *
833 * @return @c true if supported, @c false otherwise.
834 * @param pVCpu The cross context virtual CPU structure.
835 * @param pCtx Pointer to the guest-CPU context.
836 */
837DECLINLINE(bool) hmR0SvmSupportsDecodeAssists(PVMCPU pVCpu, PCPUMCTX pCtx)
838{
839 PVM pVM = pVCpu->CTX_SUFF(pVM);
840#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
841 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
842 {
843 return (pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_DECODE_ASSISTS)
844 && pVM->cpum.ro.GuestFeatures.fSvmDecodeAssists;
845 }
846#else
847 RT_NOREF(pCtx);
848#endif
849 return RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_DECODE_ASSISTS);
850}
851
852
853/**
854 * Returns whether the NRIP_SAVE feature is supported.
855 *
856 * @return @c true if supported, @c false otherwise.
857 * @param pVCpu The cross context virtual CPU structure.
858 * @param pCtx Pointer to the guest-CPU context.
859 */
860DECLINLINE(bool) hmR0SvmSupportsNextRipSave(PVMCPU pVCpu, PCPUMCTX pCtx)
861{
862 PVM pVM = pVCpu->CTX_SUFF(pVM);
863#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
864 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
865 {
866 return (pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_NRIP_SAVE)
867 && pVM->cpum.ro.GuestFeatures.fSvmNextRipSave;
868 }
869#else
870 RT_NOREF(pCtx);
871#endif
872 return RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_NRIP_SAVE);
873}
874
875
876/**
877 * Sets the permission bits for the specified MSR in the MSRPM bitmap.
878 *
879 * @param pCtx Pointer to the guest-CPU or nested-guest-CPU context.
880 * @param pbMsrBitmap Pointer to the MSR bitmap.
881 * @param idMsr The MSR for which the permissions are being set.
882 * @param enmRead MSR read permissions.
883 * @param enmWrite MSR write permissions.
884 *
885 * @remarks This function does -not- clear the VMCB clean bits for MSRPM. The
886 * caller needs to take care of this.
887 */
888static void hmR0SvmSetMsrPermission(PCCPUMCTX pCtx, uint8_t *pbMsrBitmap, uint32_t idMsr, SVMMSREXITREAD enmRead,
889 SVMMSREXITWRITE enmWrite)
890{
891 bool const fInNestedGuestMode = CPUMIsGuestInSvmNestedHwVirtMode(pCtx);
892 uint16_t offMsrpm;
893 uint8_t uMsrpmBit;
894 int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
895 AssertRC(rc);
896
897 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
898 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
899
900 pbMsrBitmap += offMsrpm;
901 if (enmRead == SVMMSREXIT_INTERCEPT_READ)
902 *pbMsrBitmap |= RT_BIT(uMsrpmBit);
903 else
904 {
905 if (!fInNestedGuestMode)
906 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit);
907#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
908 else
909 {
910 /* Only clear the bit if the nested-guest is also not intercepting the MSR read.*/
911 uint8_t const *pbNstGstMsrBitmap = (uint8_t *)pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
912 pbNstGstMsrBitmap += offMsrpm;
913 if (!(*pbNstGstMsrBitmap & RT_BIT(uMsrpmBit)))
914 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit);
915 else
916 Assert(*pbMsrBitmap & RT_BIT(uMsrpmBit));
917 }
918#endif
919 }
920
921 if (enmWrite == SVMMSREXIT_INTERCEPT_WRITE)
922 *pbMsrBitmap |= RT_BIT(uMsrpmBit + 1);
923 else
924 {
925 if (!fInNestedGuestMode)
926 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit + 1);
927#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
928 else
929 {
930 /* Only clear the bit if the nested-guest is also not intercepting the MSR write.*/
931 uint8_t const *pbNstGstMsrBitmap = (uint8_t *)pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
932 pbNstGstMsrBitmap += offMsrpm;
933 if (!(*pbNstGstMsrBitmap & RT_BIT(uMsrpmBit + 1)))
934 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit + 1);
935 else
936 Assert(*pbMsrBitmap & RT_BIT(uMsrpmBit + 1));
937 }
938#endif
939 }
940}
941
942
943/**
944 * Sets up AMD-V for the specified VM.
945 * This function is only called once per-VM during initalization.
946 *
947 * @returns VBox status code.
948 * @param pVM The cross context VM structure.
949 */
950VMMR0DECL(int) SVMR0SetupVM(PVM pVM)
951{
952 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
953 AssertReturn(pVM, VERR_INVALID_PARAMETER);
954 Assert(pVM->hm.s.svm.fSupported);
955
956 bool const fPauseFilter = RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_PAUSE_FILTER);
957 bool const fPauseFilterThreshold = RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_PAUSE_FILTER_THRESHOLD);
958 bool const fUsePauseFilter = fPauseFilter && pVM->hm.s.svm.cPauseFilter;
959
960 bool const fLbrVirt = RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_LBR_VIRT);
961 bool const fUseLbrVirt = fLbrVirt; /** @todo CFGM, IEM implementation etc. */
962
963#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
964 bool const fVirtVmsaveVmload = RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VIRT_VMSAVE_VMLOAD);
965 bool const fUseVirtVmsaveVmload = fVirtVmsaveVmload && pVM->hm.s.svm.fVirtVmsaveVmload && pVM->hm.s.fNestedPaging;
966
967 bool const fVGif = RT_BOOL(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VGIF);
968 bool const fUseVGif = fVGif && pVM->hm.s.svm.fVGif;
969#endif
970
971 PVMCPU pVCpu = &pVM->aCpus[0];
972 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
973 AssertMsgReturn(pVmcb, ("Invalid pVmcb for vcpu[0]\n"), VERR_SVM_INVALID_PVMCB);
974 PSVMVMCBCTRL pVmcbCtrl = &pVmcb->ctrl;
975
976 /* Always trap #AC for reasons of security. */
977 pVmcbCtrl->u32InterceptXcpt |= RT_BIT_32(X86_XCPT_AC);
978
979 /* Always trap #DB for reasons of security. */
980 pVmcbCtrl->u32InterceptXcpt |= RT_BIT_32(X86_XCPT_DB);
981
982 /* Trap exceptions unconditionally (debug purposes). */
983#ifdef HMSVM_ALWAYS_TRAP_PF
984 pVmcbCtrl->u32InterceptXcpt |= RT_BIT(X86_XCPT_PF);
985#endif
986#ifdef HMSVM_ALWAYS_TRAP_ALL_XCPTS
987 /* If you add any exceptions here, make sure to update hmR0SvmHandleExit(). */
988 pVmcbCtrl->u32InterceptXcpt |= 0
989 | RT_BIT(X86_XCPT_BP)
990 | RT_BIT(X86_XCPT_DE)
991 | RT_BIT(X86_XCPT_NM)
992 | RT_BIT(X86_XCPT_UD)
993 | RT_BIT(X86_XCPT_NP)
994 | RT_BIT(X86_XCPT_SS)
995 | RT_BIT(X86_XCPT_GP)
996 | RT_BIT(X86_XCPT_PF)
997 | RT_BIT(X86_XCPT_MF)
998 ;
999#endif
1000
1001 /* Apply the exceptions intercepts needed by the GIM provider. */
1002 if (pVCpu->hm.s.fGIMTrapXcptUD)
1003 pVmcbCtrl->u32InterceptXcpt |= RT_BIT(X86_XCPT_UD);
1004
1005 /* Set up unconditional intercepts and conditions. */
1006 pVmcbCtrl->u64InterceptCtrl = HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS
1007 | SVM_CTRL_INTERCEPT_VMMCALL;
1008
1009#ifdef HMSVM_ALWAYS_TRAP_TASK_SWITCH
1010 pVmcbCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_TASK_SWITCH;
1011#endif
1012
1013#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1014 /* Virtualized VMSAVE/VMLOAD. */
1015 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = fUseVirtVmsaveVmload;
1016 if (!fUseVirtVmsaveVmload)
1017 {
1018 pVmcbCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_VMSAVE
1019 | SVM_CTRL_INTERCEPT_VMLOAD;
1020 }
1021
1022 /* Virtual GIF. */
1023 pVmcbCtrl->IntCtrl.n.u1VGifEnable = fUseVGif;
1024 if (!fUseVGif)
1025 {
1026 pVmcbCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_CLGI
1027 | SVM_CTRL_INTERCEPT_STGI;
1028 }
1029#endif
1030
1031 /* CR4 writes must always be intercepted for tracking PGM mode changes. */
1032 pVmcbCtrl->u16InterceptWrCRx = RT_BIT(4);
1033
1034 /* Intercept all DRx reads and writes by default. Changed later on. */
1035 pVmcbCtrl->u16InterceptRdDRx = 0xffff;
1036 pVmcbCtrl->u16InterceptWrDRx = 0xffff;
1037
1038 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
1039 pVmcbCtrl->IntCtrl.n.u1VIntrMasking = 1;
1040
1041 /* Ignore the priority in the virtual TPR. This is necessary for delivering PIC style (ExtInt) interrupts
1042 and we currently deliver both PIC and APIC interrupts alike, see hmR0SvmEvaluatePendingEvent() */
1043 pVmcbCtrl->IntCtrl.n.u1IgnoreTPR = 1;
1044
1045 /* Set the IO permission bitmap physical addresses. */
1046 pVmcbCtrl->u64IOPMPhysAddr = g_HCPhysIOBitmap;
1047
1048 /* LBR virtualization. */
1049 pVmcbCtrl->LbrVirt.n.u1LbrVirt = fUseLbrVirt;
1050
1051 /* The host ASID MBZ, for the guest start with 1. */
1052 pVmcbCtrl->TLBCtrl.n.u32ASID = 1;
1053
1054 /* Setup Nested Paging. This doesn't change throughout the execution time of the VM. */
1055 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = pVM->hm.s.fNestedPaging;
1056
1057 /* Without Nested Paging, we need additionally intercepts. */
1058 if (!pVM->hm.s.fNestedPaging)
1059 {
1060 /* CR3 reads/writes must be intercepted; our shadow values differ from the guest values. */
1061 pVmcbCtrl->u16InterceptRdCRx |= RT_BIT(3);
1062 pVmcbCtrl->u16InterceptWrCRx |= RT_BIT(3);
1063
1064 /* Intercept INVLPG and task switches (may change CR3, EFLAGS, LDT). */
1065 pVmcbCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_INVLPG
1066 | SVM_CTRL_INTERCEPT_TASK_SWITCH;
1067
1068 /* Page faults must be intercepted to implement shadow paging. */
1069 pVmcbCtrl->u32InterceptXcpt |= RT_BIT(X86_XCPT_PF);
1070 }
1071
1072 /* Setup Pause Filter for guest pause-loop (spinlock) exiting. */
1073 if (fUsePauseFilter)
1074 {
1075 Assert(pVM->hm.s.svm.cPauseFilter > 0);
1076 pVmcbCtrl->u16PauseFilterCount = pVM->hm.s.svm.cPauseFilter;
1077 if (fPauseFilterThreshold)
1078 pVmcbCtrl->u16PauseFilterThreshold = pVM->hm.s.svm.cPauseFilterThresholdTicks;
1079 pVmcbCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_PAUSE;
1080 }
1081
1082 /*
1083 * Setup the MSR permission bitmap.
1084 * The following MSRs are saved/restored automatically during the world-switch.
1085 * Don't intercept guest read/write accesses to these MSRs.
1086 */
1087 uint8_t *pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
1088 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1089 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1090 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_CSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1091 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K6_STAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1092 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_SF_MASK, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1093 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_FS_BASE, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1094 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_GS_BASE, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1095 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_KERNEL_GS_BASE, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1096 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_IA32_SYSENTER_CS, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1097 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_IA32_SYSENTER_ESP, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1098 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_IA32_SYSENTER_EIP, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
1099 pVmcbCtrl->u64MSRPMPhysAddr = pVCpu->hm.s.svm.HCPhysMsrBitmap;
1100
1101 /* Initially all VMCB clean bits MBZ indicating that everything should be loaded from the VMCB in memory. */
1102 Assert(pVmcbCtrl->u32VmcbCleanBits == 0);
1103
1104 for (VMCPUID i = 1; i < pVM->cCpus; i++)
1105 {
1106 PVMCPU pVCpuCur = &pVM->aCpus[i];
1107 PSVMVMCB pVmcbCur = pVM->aCpus[i].hm.s.svm.pVmcb;
1108 AssertMsgReturn(pVmcbCur, ("Invalid pVmcb for vcpu[%u]\n", i), VERR_SVM_INVALID_PVMCB);
1109 PSVMVMCBCTRL pVmcbCtrlCur = &pVmcbCur->ctrl;
1110
1111 /* Copy the VMCB control area. */
1112 memcpy(pVmcbCtrlCur, pVmcbCtrl, sizeof(*pVmcbCtrlCur));
1113
1114 /* Copy the MSR bitmap and setup the VCPU-specific host physical address. */
1115 uint8_t *pbMsrBitmapCur = (uint8_t *)pVCpuCur->hm.s.svm.pvMsrBitmap;
1116 memcpy(pbMsrBitmapCur, pbMsrBitmap, SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1117 pVmcbCtrlCur->u64MSRPMPhysAddr = pVCpuCur->hm.s.svm.HCPhysMsrBitmap;
1118
1119 /* Initially all VMCB clean bits MBZ indicating that everything should be loaded from the VMCB in memory. */
1120 Assert(pVmcbCtrlCur->u32VmcbCleanBits == 0);
1121
1122 /* Verify our assumption that GIM providers trap #UD uniformly across VCPUs initially. */
1123 Assert(pVCpuCur->hm.s.fGIMTrapXcptUD == pVCpu->hm.s.fGIMTrapXcptUD);
1124 }
1125
1126 return VINF_SUCCESS;
1127}
1128
1129
1130/**
1131 * Gets a pointer to the currently active guest (or nested-guest) VMCB.
1132 *
1133 * @returns Pointer to the current context VMCB.
1134 * @param pVCpu The cross context virtual CPU structure.
1135 * @param pCtx Pointer to the guest-CPU context.
1136 */
1137DECLINLINE(PSVMVMCB) hmR0SvmGetCurrentVmcb(PVMCPU pVCpu, PCPUMCTX pCtx)
1138{
1139#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1140 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
1141 return pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
1142#else
1143 RT_NOREF(pCtx);
1144#endif
1145 return pVCpu->hm.s.svm.pVmcb;
1146}
1147
1148
1149/**
1150 * Gets a pointer to the nested-guest VMCB cache.
1151 *
1152 * @returns Pointer to the nested-guest VMCB cache.
1153 * @param pVCpu The cross context virtual CPU structure.
1154 */
1155DECLINLINE(PSVMNESTEDVMCBCACHE) hmR0SvmGetNestedVmcbCache(PVMCPU pVCpu)
1156{
1157#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1158 Assert(pVCpu->hm.s.svm.NstGstVmcbCache.fCacheValid);
1159 return &pVCpu->hm.s.svm.NstGstVmcbCache;
1160#else
1161 RT_NOREF(pVCpu);
1162 return NULL;
1163#endif
1164}
1165
1166
1167/**
1168 * Invalidates a guest page by guest virtual address.
1169 *
1170 * @returns VBox status code.
1171 * @param pVM The cross context VM structure.
1172 * @param pVCpu The cross context virtual CPU structure.
1173 * @param GCVirt Guest virtual address of the page to invalidate.
1174 */
1175VMMR0DECL(int) SVMR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
1176{
1177 AssertReturn(pVM, VERR_INVALID_PARAMETER);
1178 Assert(pVM->hm.s.svm.fSupported);
1179
1180 bool fFlushPending = pVM->hm.s.svm.fAlwaysFlushTLB || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TLB_FLUSH);
1181
1182 /* Skip it if a TLB flush is already pending. */
1183 if (!fFlushPending)
1184 {
1185 Log4Func(("%#RGv\n", GCVirt));
1186
1187 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1188 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
1189 AssertMsgReturn(pVmcb, ("Invalid pVmcb!\n"), VERR_SVM_INVALID_PVMCB);
1190
1191#if HC_ARCH_BITS == 32
1192 /* If we get a flush in 64-bit guest mode, then force a full TLB flush. INVLPGA takes only 32-bit addresses. */
1193 if (CPUMIsGuestInLongMode(pVCpu))
1194 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
1195 else
1196#endif
1197 {
1198 SVMR0InvlpgA(GCVirt, pVmcb->ctrl.TLBCtrl.n.u32ASID);
1199 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbInvlpgVirt);
1200 }
1201 }
1202 return VINF_SUCCESS;
1203}
1204
1205
1206/**
1207 * Flushes the appropriate tagged-TLB entries.
1208 *
1209 * @param pVCpu The cross context virtual CPU structure.
1210 * @param pCtx Pointer to the guest-CPU or nested-guest-CPU context.
1211 * @param pVmcb Pointer to the VM control block.
1212 * @param pHostCpu Pointer to the HM host-CPU info.
1213 */
1214static void hmR0SvmFlushTaggedTlb(PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMVMCB pVmcb, PHMGLOBALCPUINFO pHostCpu)
1215{
1216#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
1217 RT_NOREF(pCtx);
1218#endif
1219 PVM pVM = pVCpu->CTX_SUFF(pVM);
1220
1221 /*
1222 * Force a TLB flush for the first world switch if the current CPU differs from the one
1223 * we ran on last. This can happen both for start & resume due to long jumps back to
1224 * ring-3.
1225 *
1226 * We also force a TLB flush every time when executing a nested-guest VCPU as there is no
1227 * correlation between it and the physical CPU.
1228 *
1229 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while
1230 * flushing the TLB, so we cannot reuse the ASIDs without flushing.
1231 */
1232 bool fNewAsid = false;
1233 Assert(pHostCpu->idCpu != NIL_RTCPUID);
1234 if ( pVCpu->hm.s.idLastCpu != pHostCpu->idCpu
1235 || pVCpu->hm.s.cTlbFlushes != pHostCpu->cTlbFlushes
1236#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1237 || CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
1238#endif
1239 )
1240 {
1241 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
1242 pVCpu->hm.s.fForceTLBFlush = true;
1243 fNewAsid = true;
1244 }
1245
1246 /* Set TLB flush state as checked until we return from the world switch. */
1247 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);
1248
1249 /* Check for explicit TLB flushes. */
1250 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
1251 {
1252 pVCpu->hm.s.fForceTLBFlush = true;
1253 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlb);
1254 }
1255
1256 /*
1257 * If the AMD CPU erratum 170, We need to flush the entire TLB for each world switch. Sad.
1258 * This Host CPU requirement takes precedence.
1259 */
1260 if (pVM->hm.s.svm.fAlwaysFlushTLB)
1261 {
1262 pHostCpu->uCurrentAsid = 1;
1263 pVCpu->hm.s.uCurrentAsid = 1;
1264 pVCpu->hm.s.cTlbFlushes = pHostCpu->cTlbFlushes;
1265 pVCpu->hm.s.idLastCpu = pHostCpu->idCpu;
1266 pVmcb->ctrl.TLBCtrl.n.u8TLBFlush = SVM_TLB_FLUSH_ENTIRE;
1267
1268 /* Clear the VMCB Clean Bit for NP while flushing the TLB. See @bugref{7152}. */
1269 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_NP;
1270 }
1271 else
1272 {
1273 pVmcb->ctrl.TLBCtrl.n.u8TLBFlush = SVM_TLB_FLUSH_NOTHING;
1274 if (pVCpu->hm.s.fForceTLBFlush)
1275 {
1276 /* Clear the VMCB Clean Bit for NP while flushing the TLB. See @bugref{7152}. */
1277 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_NP;
1278
1279 if (fNewAsid)
1280 {
1281 ++pHostCpu->uCurrentAsid;
1282
1283 bool fHitASIDLimit = false;
1284 if (pHostCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
1285 {
1286 pHostCpu->uCurrentAsid = 1; /* Wraparound at 1; host uses 0 */
1287 pHostCpu->cTlbFlushes++; /* All VCPUs that run on this host CPU must use a new ASID. */
1288 fHitASIDLimit = true;
1289 }
1290
1291 if ( fHitASIDLimit
1292 || pHostCpu->fFlushAsidBeforeUse)
1293 {
1294 pVmcb->ctrl.TLBCtrl.n.u8TLBFlush = SVM_TLB_FLUSH_ENTIRE;
1295 pHostCpu->fFlushAsidBeforeUse = false;
1296 }
1297
1298 pVCpu->hm.s.uCurrentAsid = pHostCpu->uCurrentAsid;
1299 pVCpu->hm.s.idLastCpu = pHostCpu->idCpu;
1300 pVCpu->hm.s.cTlbFlushes = pHostCpu->cTlbFlushes;
1301 }
1302 else
1303 {
1304 if (pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_FLUSH_BY_ASID)
1305 pVmcb->ctrl.TLBCtrl.n.u8TLBFlush = SVM_TLB_FLUSH_SINGLE_CONTEXT;
1306 else
1307 pVmcb->ctrl.TLBCtrl.n.u8TLBFlush = SVM_TLB_FLUSH_ENTIRE;
1308 }
1309
1310 pVCpu->hm.s.fForceTLBFlush = false;
1311 }
1312 }
1313
1314 /* Update VMCB with the ASID. */
1315 if (pVmcb->ctrl.TLBCtrl.n.u32ASID != pVCpu->hm.s.uCurrentAsid)
1316 {
1317 pVmcb->ctrl.TLBCtrl.n.u32ASID = pVCpu->hm.s.uCurrentAsid;
1318 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_ASID;
1319 }
1320
1321 AssertMsg(pVCpu->hm.s.idLastCpu == pHostCpu->idCpu,
1322 ("vcpu idLastCpu=%u hostcpu idCpu=%u\n", pVCpu->hm.s.idLastCpu, pHostCpu->idCpu));
1323 AssertMsg(pVCpu->hm.s.cTlbFlushes == pHostCpu->cTlbFlushes,
1324 ("Flush count mismatch for cpu %u (%u vs %u)\n", pHostCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pHostCpu->cTlbFlushes));
1325 AssertMsg(pHostCpu->uCurrentAsid >= 1 && pHostCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
1326 ("cpu%d uCurrentAsid = %x\n", pHostCpu->idCpu, pHostCpu->uCurrentAsid));
1327 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
1328 ("cpu%d VM uCurrentAsid = %x\n", pHostCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
1329
1330#ifdef VBOX_WITH_STATISTICS
1331 if (pVmcb->ctrl.TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_NOTHING)
1332 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
1333 else if ( pVmcb->ctrl.TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
1334 || pVmcb->ctrl.TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
1335 {
1336 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushAsid);
1337 }
1338 else
1339 {
1340 Assert(pVmcb->ctrl.TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE);
1341 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushEntire);
1342 }
1343#endif
1344}
1345
1346
1347/** @name 64-bit guest on 32-bit host OS helper functions.
1348 *
1349 * The host CPU is still 64-bit capable but the host OS is running in 32-bit
1350 * mode (code segment, paging). These wrappers/helpers perform the necessary
1351 * bits for the 32->64 switcher.
1352 *
1353 * @{ */
1354#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1355/**
1356 * Prepares for and executes VMRUN (64-bit guests on a 32-bit host).
1357 *
1358 * @returns VBox status code.
1359 * @param HCPhysVmcbHost Physical address of host VMCB.
1360 * @param HCPhysVmcb Physical address of the VMCB.
1361 * @param pCtx Pointer to the guest-CPU context.
1362 * @param pVM The cross context VM structure.
1363 * @param pVCpu The cross context virtual CPU structure.
1364 */
1365DECLASM(int) SVMR0VMSwitcherRun64(RTHCPHYS HCPhysVmcbHost, RTHCPHYS HCPhysVmcb, PCPUMCTX pCtx, PVM pVM, PVMCPU pVCpu)
1366{
1367 RT_NOREF2(pVM, pCtx);
1368 uint32_t aParam[8];
1369 aParam[0] = RT_LO_U32(HCPhysVmcbHost); /* Param 1: HCPhysVmcbHost - Lo. */
1370 aParam[1] = RT_HI_U32(HCPhysVmcbHost); /* Param 1: HCPhysVmcbHost - Hi. */
1371 aParam[2] = RT_LO_U32(HCPhysVmcb); /* Param 2: HCPhysVmcb - Lo. */
1372 aParam[3] = RT_HI_U32(HCPhysVmcb); /* Param 2: HCPhysVmcb - Hi. */
1373 aParam[4] = VM_RC_ADDR(pVM, pVM);
1374 aParam[5] = 0;
1375 aParam[6] = VM_RC_ADDR(pVM, pVCpu);
1376 aParam[7] = 0;
1377
1378 return SVMR0Execute64BitsHandler(pVCpu, HM64ON32OP_SVMRCVMRun64, RT_ELEMENTS(aParam), &aParam[0]);
1379}
1380
1381
1382/**
1383 * Executes the specified VMRUN handler in 64-bit mode.
1384 *
1385 * @returns VBox status code.
1386 * @param pVCpu The cross context virtual CPU structure.
1387 * @param enmOp The operation to perform.
1388 * @param cParams Number of parameters.
1389 * @param paParam Array of 32-bit parameters.
1390 */
1391VMMR0DECL(int) SVMR0Execute64BitsHandler(PVMCPU pVCpu, HM64ON32OP enmOp, uint32_t cParams, uint32_t *paParam)
1392{
1393 PVM pVM = pVCpu->CTX_SUFF(pVM);
1394 AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
1395 Assert(enmOp > HM64ON32OP_INVALID && enmOp < HM64ON32OP_END);
1396
1397 /* Disable interrupts. */
1398 RTHCUINTREG const fEFlags = ASMIntDisableFlags();
1399
1400#ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
1401 RTCPUID idHostCpu = RTMpCpuId();
1402 CPUMR0SetLApic(pVCpu, idHostCpu);
1403#endif
1404
1405 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
1406 CPUMSetHyperEIP(pVCpu, enmOp);
1407 for (int i = (int)cParams - 1; i >= 0; i--)
1408 CPUMPushHyper(pVCpu, paParam[i]);
1409
1410 /* Call the switcher. */
1411 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
1412 int rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
1413 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
1414
1415 /* Restore interrupts. */
1416 ASMSetFlags(fEFlags);
1417 return rc;
1418}
1419
1420#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) */
1421/** @} */
1422
1423
1424/**
1425 * Sets an exception intercept in the specified VMCB.
1426 *
1427 * @param pVmcb Pointer to the VM control block.
1428 * @param uXcpt The exception (X86_XCPT_*).
1429 */
1430DECLINLINE(void) hmR0SvmSetXcptIntercept(PSVMVMCB pVmcb, uint8_t uXcpt)
1431{
1432 if (!(pVmcb->ctrl.u32InterceptXcpt & RT_BIT(uXcpt)))
1433 {
1434 pVmcb->ctrl.u32InterceptXcpt |= RT_BIT(uXcpt);
1435 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
1436 }
1437}
1438
1439
1440/**
1441 * Clears an exception intercept in the specified VMCB.
1442 *
1443 * @param pVCpu The cross context virtual CPU structure.
1444 * @param pVmcb Pointer to the VM control block.
1445 * @param uXcpt The exception (X86_XCPT_*).
1446 *
1447 * @remarks This takes into account if we're executing a nested-guest and only
1448 * removes the exception intercept if both the guest -and- nested-guest
1449 * are not intercepting it.
1450 */
1451DECLINLINE(void) hmR0SvmClearXcptIntercept(PVMCPU pVCpu, PSVMVMCB pVmcb, uint8_t uXcpt)
1452{
1453 Assert(uXcpt != X86_XCPT_DB);
1454 Assert(uXcpt != X86_XCPT_AC);
1455#ifndef HMSVM_ALWAYS_TRAP_ALL_XCPTS
1456 if (pVmcb->ctrl.u32InterceptXcpt & RT_BIT(uXcpt))
1457 {
1458 bool fRemove = true;
1459# ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1460 /* Only remove the intercept if the nested-guest is also not intercepting it! */
1461 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1462 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
1463 {
1464 PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
1465 fRemove = !(pVmcbNstGstCache->u32InterceptXcpt & RT_BIT(uXcpt));
1466 }
1467# else
1468 RT_NOREF(pVCpu);
1469# endif
1470 if (fRemove)
1471 {
1472 pVmcb->ctrl.u32InterceptXcpt &= ~RT_BIT(uXcpt);
1473 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
1474 }
1475 }
1476#else
1477 RT_NOREF3(pVCpu, pVmcb, uXcpt);
1478#endif
1479}
1480
1481
1482/**
1483 * Sets a control intercept in the specified VMCB.
1484 *
1485 * @param pVmcb Pointer to the VM control block.
1486 * @param fCtrlIntercept The control intercept (SVM_CTRL_INTERCEPT_*).
1487 */
1488DECLINLINE(void) hmR0SvmSetCtrlIntercept(PSVMVMCB pVmcb, uint64_t fCtrlIntercept)
1489{
1490 if (!(pVmcb->ctrl.u64InterceptCtrl & fCtrlIntercept))
1491 {
1492 pVmcb->ctrl.u64InterceptCtrl |= fCtrlIntercept;
1493 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
1494 }
1495}
1496
1497
1498/**
1499 * Clears a control intercept in the specified VMCB.
1500 *
1501 * @returns @c true if the intercept is still set, @c false otherwise.
1502 * @param pVCpu The cross context virtual CPU structure.
1503 * @param pCtx Pointer to the guest-CPU context.
1504 * @param pVmcb Pointer to the VM control block.
1505 * @param fCtrlIntercept The control intercept (SVM_CTRL_INTERCEPT_*).
1506 *
1507 * @remarks This takes into account if we're executing a nested-guest and only
1508 * removes the control intercept if both the guest -and- nested-guest
1509 * are not intercepting it.
1510 */
1511DECLINLINE(bool) hmR0SvmClearCtrlIntercept(PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMVMCB pVmcb, uint64_t fCtrlIntercept)
1512{
1513 if (pVmcb->ctrl.u64InterceptCtrl & fCtrlIntercept)
1514 {
1515 bool fRemove = true;
1516#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1517 /* Only remove the control intercept if the nested-guest is also not intercepting it! */
1518 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
1519 {
1520 PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
1521 fRemove = !(pVmcbNstGstCache->u64InterceptCtrl & fCtrlIntercept);
1522 }
1523#else
1524 RT_NOREF2(pVCpu, pCtx);
1525#endif
1526 if (fRemove)
1527 {
1528 pVmcb->ctrl.u64InterceptCtrl &= ~fCtrlIntercept;
1529 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
1530 }
1531 }
1532
1533 return RT_BOOL(pVmcb->ctrl.u64InterceptCtrl & fCtrlIntercept);
1534}
1535
1536
1537/**
1538 * Exports the guest (or nested-guest) CR0 into the VMCB.
1539 *
1540 * @param pVCpu The cross context virtual CPU structure.
1541 * @param pVmcb Pointer to the VM control block.
1542 *
1543 * @remarks This assumes we always pre-load the guest FPU.
1544 * @remarks No-long-jump zone!!!
1545 */
1546static void hmR0SvmExportGuestCR0(PVMCPU pVCpu, PSVMVMCB pVmcb)
1547{
1548 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1549
1550 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1551 uint64_t const uGuestCr0 = pCtx->cr0;
1552 uint64_t uShadowCr0 = uGuestCr0;
1553
1554 /* Always enable caching. */
1555 uShadowCr0 &= ~(X86_CR0_CD | X86_CR0_NW);
1556
1557 /* When Nested Paging is not available use shadow page tables and intercept #PFs (latter done in SVMR0SetupVM()). */
1558 if (!pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging)
1559 {
1560 uShadowCr0 |= X86_CR0_PG /* Use shadow page tables. */
1561 | X86_CR0_WP; /* Guest CPL 0 writes to its read-only pages should cause a #PF #VMEXIT. */
1562 }
1563
1564 /*
1565 * Use the #MF style of legacy-FPU error reporting for now. Although AMD-V has MSRs that
1566 * lets us isolate the host from it, IEM/REM still needs work to emulate it properly,
1567 * see @bugref{7243#c103}.
1568 */
1569 if (!(uGuestCr0 & X86_CR0_NE))
1570 {
1571 uShadowCr0 |= X86_CR0_NE;
1572 hmR0SvmSetXcptIntercept(pVmcb, X86_XCPT_MF);
1573 }
1574 else
1575 hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_MF);
1576
1577 /*
1578 * If the shadow and guest CR0 are identical we can avoid intercepting CR0 reads.
1579 *
1580 * CR0 writes still needs interception as PGM requires tracking paging mode changes,
1581 * see @bugref{6944}.
1582 *
1583 * We also don't ever want to honor weird things like cache disable from the guest.
1584 * However, we can avoid intercepting changes to the TS & MP bits by clearing the CR0
1585 * write intercept below and keeping SVM_CTRL_INTERCEPT_CR0_SEL_WRITE instead.
1586 */
1587 if (uShadowCr0 == uGuestCr0)
1588 {
1589 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
1590 {
1591 pVmcb->ctrl.u16InterceptRdCRx &= ~RT_BIT(0);
1592 pVmcb->ctrl.u16InterceptWrCRx &= ~RT_BIT(0);
1593 Assert(pVmcb->ctrl.u64InterceptCtrl & SVM_CTRL_INTERCEPT_CR0_SEL_WRITE);
1594 }
1595 else
1596 {
1597 /* If the nested-hypervisor intercepts CR0 reads/writes, we need to continue intercepting them. */
1598 PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
1599 pVmcb->ctrl.u16InterceptRdCRx = (pVmcb->ctrl.u16InterceptRdCRx & ~RT_BIT(0))
1600 | (pVmcbNstGstCache->u16InterceptRdCRx & RT_BIT(0));
1601 pVmcb->ctrl.u16InterceptWrCRx = (pVmcb->ctrl.u16InterceptWrCRx & ~RT_BIT(0))
1602 | (pVmcbNstGstCache->u16InterceptWrCRx & RT_BIT(0));
1603 }
1604 }
1605 else
1606 {
1607 pVmcb->ctrl.u16InterceptRdCRx |= RT_BIT(0);
1608 pVmcb->ctrl.u16InterceptWrCRx |= RT_BIT(0);
1609 }
1610 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
1611
1612 Assert(RT_HI_U32(uShadowCr0) == 0);
1613 if (pVmcb->guest.u64CR0 != uShadowCr0)
1614 {
1615 pVmcb->guest.u64CR0 = uShadowCr0;
1616 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
1617 }
1618}
1619
1620
1621/**
1622 * Exports the guest (or nested-guest) CR3 into the VMCB.
1623 *
1624 * @param pVCpu The cross context virtual CPU structure.
1625 * @param pVmcb Pointer to the VM control block.
1626 *
1627 * @remarks No-long-jump zone!!!
1628 */
1629static void hmR0SvmExportGuestCR3(PVMCPU pVCpu, PSVMVMCB pVmcb)
1630{
1631 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1632
1633 PVM pVM = pVCpu->CTX_SUFF(pVM);
1634 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1635 if (pVM->hm.s.fNestedPaging)
1636 {
1637 PGMMODE enmShwPagingMode;
1638#if HC_ARCH_BITS == 32
1639 if (CPUMIsGuestInLongModeEx(pCtx))
1640 enmShwPagingMode = PGMMODE_AMD64_NX;
1641 else
1642#endif
1643 enmShwPagingMode = PGMGetHostMode(pVM);
1644
1645 pVmcb->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
1646 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_NP;
1647 pVmcb->guest.u64CR3 = pCtx->cr3;
1648 Assert(pVmcb->ctrl.u64NestedPagingCR3);
1649 }
1650 else
1651 pVmcb->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
1652
1653 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
1654}
1655
1656
1657/**
1658 * Exports the guest (or nested-guest) CR4 into the VMCB.
1659 *
1660 * @param pVCpu The cross context virtual CPU structure.
1661 * @param pVmcb Pointer to the VM control block.
1662 *
1663 * @remarks No-long-jump zone!!!
1664 */
1665static int hmR0SvmExportGuestCR4(PVMCPU pVCpu, PSVMVMCB pVmcb)
1666{
1667 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1668
1669 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1670 uint64_t uShadowCr4 = pCtx->cr4;
1671 if (!pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging)
1672 {
1673 switch (pVCpu->hm.s.enmShadowMode)
1674 {
1675 case PGMMODE_REAL:
1676 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
1677 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1678
1679 case PGMMODE_32_BIT: /* 32-bit paging. */
1680 uShadowCr4 &= ~X86_CR4_PAE;
1681 break;
1682
1683 case PGMMODE_PAE: /* PAE paging. */
1684 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1685 /** Must use PAE paging as we could use physical memory > 4 GB */
1686 uShadowCr4 |= X86_CR4_PAE;
1687 break;
1688
1689 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1690 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1691#ifdef VBOX_ENABLE_64_BITS_GUESTS
1692 break;
1693#else
1694 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1695#endif
1696
1697 default: /* shut up gcc */
1698 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1699 }
1700 }
1701
1702 /* Whether to save/load/restore XCR0 during world switch depends on CR4.OSXSAVE and host+guest XCR0. */
1703 pVCpu->hm.s.fLoadSaveGuestXcr0 = (pCtx->cr4 & X86_CR4_OSXSAVE) && pCtx->aXcr[0] != ASMGetXcr0();
1704
1705 /* Avoid intercepting CR4 reads if the guest and shadow CR4 values are identical. */
1706 if (uShadowCr4 == pCtx->cr4)
1707 {
1708 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
1709 pVmcb->ctrl.u16InterceptRdCRx &= ~RT_BIT(4);
1710 else
1711 {
1712 /* If the nested-hypervisor intercepts CR4 reads, we need to continue intercepting them. */
1713 PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
1714 pVmcb->ctrl.u16InterceptRdCRx = (pVmcb->ctrl.u16InterceptRdCRx & ~RT_BIT(4))
1715 | (pVmcbNstGstCache->u16InterceptRdCRx & RT_BIT(4));
1716 }
1717 }
1718 else
1719 pVmcb->ctrl.u16InterceptRdCRx |= RT_BIT(4);
1720
1721 /* CR4 writes are always intercepted (both guest, nested-guest) for tracking PGM mode changes. */
1722 Assert(pVmcb->ctrl.u16InterceptWrCRx & RT_BIT(4));
1723
1724 /* Update VMCB with the shadow CR4 the appropriate VMCB clean bits. */
1725 Assert(RT_HI_U32(uShadowCr4) == 0);
1726 pVmcb->guest.u64CR4 = uShadowCr4;
1727 pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_CRX_EFER | HMSVM_VMCB_CLEAN_INTERCEPTS);
1728
1729 return VINF_SUCCESS;
1730}
1731
1732
1733/**
1734 * Exports the guest (or nested-guest) control registers into the VMCB.
1735 *
1736 * @returns VBox status code.
1737 * @param pVCpu The cross context virtual CPU structure.
1738 * @param pVmcb Pointer to the VM control block.
1739 *
1740 * @remarks No-long-jump zone!!!
1741 */
1742static int hmR0SvmExportGuestControlRegs(PVMCPU pVCpu, PSVMVMCB pVmcb)
1743{
1744 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1745
1746 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR_MASK)
1747 {
1748 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR0)
1749 hmR0SvmExportGuestCR0(pVCpu, pVmcb);
1750
1751 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR2)
1752 {
1753 pVmcb->guest.u64CR2 = pVCpu->cpum.GstCtx.cr2;
1754 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CR2;
1755 }
1756
1757 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR3)
1758 hmR0SvmExportGuestCR3(pVCpu, pVmcb);
1759
1760 /* CR4 re-loading is ASSUMED to be done everytime we get in from ring-3! (XCR0) */
1761 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR4)
1762 {
1763 int rc = hmR0SvmExportGuestCR4(pVCpu, pVmcb);
1764 if (RT_FAILURE(rc))
1765 return rc;
1766 }
1767
1768 pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_CR_MASK;
1769 }
1770 return VINF_SUCCESS;
1771}
1772
1773
1774/**
1775 * Exports the guest (or nested-guest) segment registers into the VMCB.
1776 *
1777 * @returns VBox status code.
1778 * @param pVCpu The cross context virtual CPU structure.
1779 * @param pVmcb Pointer to the VM control block.
1780 *
1781 * @remarks No-long-jump zone!!!
1782 */
1783static void hmR0SvmExportGuestSegmentRegs(PVMCPU pVCpu, PSVMVMCB pVmcb)
1784{
1785 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1786 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1787
1788 /* Guest segment registers. */
1789 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SREG_MASK)
1790 {
1791 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CS)
1792 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, CS, cs);
1793
1794 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SS)
1795 {
1796 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, SS, ss);
1797 pVmcb->guest.u8CPL = pCtx->ss.Attr.n.u2Dpl;
1798 }
1799
1800 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_DS)
1801 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, DS, ds);
1802
1803 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_ES)
1804 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, ES, es);
1805
1806 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_FS)
1807 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, FS, fs);
1808
1809 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_GS)
1810 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, GS, gs);
1811
1812 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_SEG;
1813 }
1814
1815 /* Guest TR. */
1816 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_TR)
1817 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, TR, tr);
1818
1819 /* Guest LDTR. */
1820 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_LDTR)
1821 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, LDTR, ldtr);
1822
1823 /* Guest GDTR. */
1824 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_GDTR)
1825 {
1826 pVmcb->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
1827 pVmcb->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
1828 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DT;
1829 }
1830
1831 /* Guest IDTR. */
1832 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_IDTR)
1833 {
1834 pVmcb->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
1835 pVmcb->guest.IDTR.u64Base = pCtx->idtr.pIdt;
1836 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DT;
1837 }
1838
1839 pVCpu->hm.s.fCtxChanged &= ~( HM_CHANGED_GUEST_SREG_MASK
1840 | HM_CHANGED_GUEST_TABLE_MASK);
1841}
1842
1843
1844/**
1845 * Exports the guest (or nested-guest) MSRs into the VMCB.
1846 *
1847 * @param pVCpu The cross context virtual CPU structure.
1848 * @param pVmcb Pointer to the VM control block.
1849 *
1850 * @remarks No-long-jump zone!!!
1851 */
1852static void hmR0SvmExportGuestMsrs(PVMCPU pVCpu, PSVMVMCB pVmcb)
1853{
1854 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
1855 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1856
1857 /* Guest Sysenter MSRs. */
1858 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_MSR_MASK)
1859 {
1860 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_CS_MSR)
1861 pVmcb->guest.u64SysEnterCS = pCtx->SysEnter.cs;
1862
1863 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_EIP_MSR)
1864 pVmcb->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
1865
1866 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_ESP_MSR)
1867 pVmcb->guest.u64SysEnterESP = pCtx->SysEnter.esp;
1868 }
1869
1870 /*
1871 * Guest EFER MSR.
1872 * AMD-V requires guest EFER.SVME to be set. Weird.
1873 * See AMD spec. 15.5.1 "Basic Operation" | "Canonicalization and Consistency Checks".
1874 */
1875 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_EFER_MSR)
1876 {
1877 pVmcb->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
1878 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
1879 }
1880
1881 /* If the guest isn't in 64-bit mode, clear MSR_K6_LME bit, otherwise SVM expects amd64 shadow paging. */
1882 if ( !CPUMIsGuestInLongModeEx(pCtx)
1883 && (pCtx->msrEFER & MSR_K6_EFER_LME))
1884 {
1885 pVmcb->guest.u64EFER &= ~MSR_K6_EFER_LME;
1886 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
1887 }
1888
1889 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSCALL_MSRS)
1890 {
1891 pVmcb->guest.u64STAR = pCtx->msrSTAR;
1892 pVmcb->guest.u64LSTAR = pCtx->msrLSTAR;
1893 pVmcb->guest.u64CSTAR = pCtx->msrCSTAR;
1894 pVmcb->guest.u64SFMASK = pCtx->msrSFMASK;
1895 }
1896
1897 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_KERNEL_GS_BASE)
1898 pVmcb->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1899
1900 pVCpu->hm.s.fCtxChanged &= ~( HM_CHANGED_GUEST_SYSENTER_MSR_MASK
1901 | HM_CHANGED_GUEST_EFER_MSR
1902 | HM_CHANGED_GUEST_SYSCALL_MSRS
1903 | HM_CHANGED_GUEST_KERNEL_GS_BASE);
1904
1905 /*
1906 * Setup the PAT MSR (applicable for Nested Paging only).
1907 *
1908 * While guests can modify and see the modified values through the shadow values,
1909 * we shall not honor any guest modifications of this MSR to ensure caching is always
1910 * enabled similar to how we clear CR0.CD and NW bits.
1911 *
1912 * For nested-guests this needs to always be set as well, see @bugref{7243#c109}.
1913 */
1914 pVmcb->guest.u64PAT = MSR_IA32_CR_PAT_INIT_VAL;
1915
1916 /* Enable the last branch record bit if LBR virtualization is enabled. */
1917 if (pVmcb->ctrl.LbrVirt.n.u1LbrVirt)
1918 pVmcb->guest.u64DBGCTL = MSR_IA32_DEBUGCTL_LBR;
1919}
1920
1921
1922/**
1923 * Exports the guest (or nested-guest) debug state into the VMCB and programs
1924 * the necessary intercepts accordingly.
1925 *
1926 * @param pVCpu The cross context virtual CPU structure.
1927 * @param pVmcb Pointer to the VM control block.
1928 *
1929 * @remarks No-long-jump zone!!!
1930 * @remarks Requires EFLAGS to be up-to-date in the VMCB!
1931 */
1932static void hmR0SvmExportSharedDebugState(PVMCPU pVCpu, PSVMVMCB pVmcb)
1933{
1934 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
1935
1936 /*
1937 * Anyone single stepping on the host side? If so, we'll have to use the
1938 * trap flag in the guest EFLAGS since AMD-V doesn't have a trap flag on
1939 * the VMM level like the VT-x implementations does.
1940 */
1941 bool fInterceptMovDRx = false;
1942 bool const fStepping = pVCpu->hm.s.fSingleInstruction || DBGFIsStepping(pVCpu);
1943 if (fStepping)
1944 {
1945 pVCpu->hm.s.fClearTrapFlag = true;
1946 pVmcb->guest.u64RFlags |= X86_EFL_TF;
1947 fInterceptMovDRx = true; /* Need clean DR6, no guest mess. */
1948 }
1949
1950 if ( fStepping
1951 || (CPUMGetHyperDR7(pVCpu) & X86_DR7_ENABLED_MASK))
1952 {
1953 /*
1954 * Use the combined guest and host DRx values found in the hypervisor
1955 * register set because the debugger has breakpoints active or someone
1956 * is single stepping on the host side.
1957 *
1958 * Note! DBGF expects a clean DR6 state before executing guest code.
1959 */
1960#if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
1961 if ( CPUMIsGuestInLongModeEx(pCtx)
1962 && !CPUMIsHyperDebugStateActivePending(pVCpu))
1963 {
1964 CPUMR0LoadHyperDebugState(pVCpu, false /* include DR6 */);
1965 Assert(!CPUMIsGuestDebugStateActivePending(pVCpu));
1966 Assert(CPUMIsHyperDebugStateActivePending(pVCpu));
1967 }
1968 else
1969#endif
1970 if (!CPUMIsHyperDebugStateActive(pVCpu))
1971 {
1972 CPUMR0LoadHyperDebugState(pVCpu, false /* include DR6 */);
1973 Assert(!CPUMIsGuestDebugStateActive(pVCpu));
1974 Assert(CPUMIsHyperDebugStateActive(pVCpu));
1975 }
1976
1977 /* Update DR6 & DR7. (The other DRx values are handled by CPUM one way or the other.) */
1978 if ( pVmcb->guest.u64DR6 != X86_DR6_INIT_VAL
1979 || pVmcb->guest.u64DR7 != CPUMGetHyperDR7(pVCpu))
1980 {
1981 pVmcb->guest.u64DR7 = CPUMGetHyperDR7(pVCpu);
1982 pVmcb->guest.u64DR6 = X86_DR6_INIT_VAL;
1983 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
1984 }
1985
1986 /** @todo If we cared, we could optimize to allow the guest to read registers
1987 * with the same values. */
1988 fInterceptMovDRx = true;
1989 pVCpu->hm.s.fUsingHyperDR7 = true;
1990 Log5(("hmR0SvmExportSharedDebugState: Loaded hyper DRx\n"));
1991 }
1992 else
1993 {
1994 /*
1995 * Update DR6, DR7 with the guest values if necessary.
1996 */
1997 if ( pVmcb->guest.u64DR7 != pCtx->dr[7]
1998 || pVmcb->guest.u64DR6 != pCtx->dr[6])
1999 {
2000 pVmcb->guest.u64DR7 = pCtx->dr[7];
2001 pVmcb->guest.u64DR6 = pCtx->dr[6];
2002 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
2003 }
2004 pVCpu->hm.s.fUsingHyperDR7 = false;
2005
2006 /*
2007 * If the guest has enabled debug registers, we need to load them prior to
2008 * executing guest code so they'll trigger at the right time.
2009 */
2010 if (pCtx->dr[7] & (X86_DR7_ENABLED_MASK | X86_DR7_GD)) /** @todo Why GD? */
2011 {
2012#if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
2013 if ( CPUMIsGuestInLongModeEx(pCtx)
2014 && !CPUMIsGuestDebugStateActivePending(pVCpu))
2015 {
2016 CPUMR0LoadGuestDebugState(pVCpu, false /* include DR6 */);
2017 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2018 Assert(!CPUMIsHyperDebugStateActivePending(pVCpu));
2019 Assert(CPUMIsGuestDebugStateActivePending(pVCpu));
2020 }
2021 else
2022#endif
2023 if (!CPUMIsGuestDebugStateActive(pVCpu))
2024 {
2025 CPUMR0LoadGuestDebugState(pVCpu, false /* include DR6 */);
2026 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2027 Assert(!CPUMIsHyperDebugStateActive(pVCpu));
2028 Assert(CPUMIsGuestDebugStateActive(pVCpu));
2029 }
2030 Log5(("hmR0SvmExportSharedDebugState: Loaded guest DRx\n"));
2031 }
2032 /*
2033 * If no debugging enabled, we'll lazy load DR0-3. We don't need to
2034 * intercept #DB as DR6 is updated in the VMCB.
2035 *
2036 * Note! If we cared and dared, we could skip intercepting \#DB here.
2037 * However, \#DB shouldn't be performance critical, so we'll play safe
2038 * and keep the code similar to the VT-x code and always intercept it.
2039 */
2040#if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
2041 else if ( !CPUMIsGuestDebugStateActivePending(pVCpu)
2042 && !CPUMIsGuestDebugStateActive(pVCpu))
2043#else
2044 else if (!CPUMIsGuestDebugStateActive(pVCpu))
2045#endif
2046 {
2047 fInterceptMovDRx = true;
2048 }
2049 }
2050
2051 Assert(pVmcb->ctrl.u32InterceptXcpt & RT_BIT_32(X86_XCPT_DB));
2052 if (fInterceptMovDRx)
2053 {
2054 if ( pVmcb->ctrl.u16InterceptRdDRx != 0xffff
2055 || pVmcb->ctrl.u16InterceptWrDRx != 0xffff)
2056 {
2057 pVmcb->ctrl.u16InterceptRdDRx = 0xffff;
2058 pVmcb->ctrl.u16InterceptWrDRx = 0xffff;
2059 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
2060 }
2061 }
2062 else
2063 {
2064 if ( pVmcb->ctrl.u16InterceptRdDRx
2065 || pVmcb->ctrl.u16InterceptWrDRx)
2066 {
2067 pVmcb->ctrl.u16InterceptRdDRx = 0;
2068 pVmcb->ctrl.u16InterceptWrDRx = 0;
2069 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
2070 }
2071 }
2072 Log4Func(("DR6=%#RX64 DR7=%#RX64\n", pCtx->dr[6], pCtx->dr[7]));
2073}
2074
2075#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
2076/**
2077 * Exports the nested-guest hardware virtualization state into the nested-guest
2078 * VMCB.
2079 *
2080 * @param pVCpu The cross context virtual CPU structure.
2081 * @param pVmcbNstGst Pointer to the nested-guest VM control block.
2082 *
2083 * @remarks No-long-jump zone!!!
2084 */
2085static void hmR0SvmExportGuestHwvirtStateNested(PVMCPU pVCpu, PSVMVMCB pVmcbNstGst)
2086{
2087 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2088
2089 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_HWVIRT)
2090 {
2091 /*
2092 * Ensure the nested-guest pause-filter counters don't exceed the outer guest values esp.
2093 * since SVM doesn't have a preemption timer.
2094 *
2095 * We do this here rather than in hmR0SvmSetupVmcbNested() as we may have been executing the
2096 * nested-guest in IEM incl. PAUSE instructions which would update the pause-filter counters
2097 * and may continue execution in SVM R0 without a nested-guest #VMEXIT in between.
2098 */
2099 PVM pVM = pVCpu->CTX_SUFF(pVM);
2100 PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
2101 uint16_t const uGuestPauseFilterCount = pVM->hm.s.svm.cPauseFilter;
2102 uint16_t const uGuestPauseFilterThreshold = pVM->hm.s.svm.cPauseFilterThresholdTicks;
2103 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_PAUSE))
2104 {
2105 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2106 pVmcbNstGstCtrl->u16PauseFilterCount = RT_MIN(pCtx->hwvirt.svm.cPauseFilter, uGuestPauseFilterCount);
2107 pVmcbNstGstCtrl->u16PauseFilterThreshold = RT_MIN(pCtx->hwvirt.svm.cPauseFilterThreshold, uGuestPauseFilterThreshold);
2108 pVmcbNstGstCtrl->u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
2109 }
2110 else
2111 {
2112 pVmcbNstGstCtrl->u16PauseFilterCount = uGuestPauseFilterCount;
2113 pVmcbNstGstCtrl->u16PauseFilterThreshold = uGuestPauseFilterThreshold;
2114 }
2115
2116 pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_HWVIRT;
2117 }
2118}
2119#endif
2120
2121/**
2122 * Exports the guest APIC TPR state into the VMCB.
2123 *
2124 * @returns VBox status code.
2125 * @param pVCpu The cross context virtual CPU structure.
2126 * @param pVmcb Pointer to the VM control block.
2127 */
2128static int hmR0SvmExportGuestApicTpr(PVMCPU pVCpu, PSVMVMCB pVmcb)
2129{
2130 if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_APIC_TPR)
2131 {
2132 PVM pVM = pVCpu->CTX_SUFF(pVM);
2133 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2134 if ( PDMHasApic(pVM)
2135 && APICIsEnabled(pVCpu))
2136 {
2137 bool fPendingIntr;
2138 uint8_t u8Tpr;
2139 int rc = APICGetTpr(pVCpu, &u8Tpr, &fPendingIntr, NULL /* pu8PendingIrq */);
2140 AssertRCReturn(rc, rc);
2141
2142 /* Assume that we need to trap all TPR accesses and thus need not check on
2143 every #VMEXIT if we should update the TPR. */
2144 Assert(pVmcb->ctrl.IntCtrl.n.u1VIntrMasking);
2145 pVCpu->hm.s.svm.fSyncVTpr = false;
2146
2147 if (!pVM->hm.s.fTPRPatchingActive)
2148 {
2149 /* Bits 3-0 of the VTPR field correspond to bits 7-4 of the TPR (which is the Task-Priority Class). */
2150 pVmcb->ctrl.IntCtrl.n.u8VTPR = (u8Tpr >> 4);
2151
2152 /* If there are interrupts pending, intercept CR8 writes to evaluate ASAP if we
2153 can deliver the interrupt to the guest. */
2154 if (fPendingIntr)
2155 pVmcb->ctrl.u16InterceptWrCRx |= RT_BIT(8);
2156 else
2157 {
2158 pVmcb->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
2159 pVCpu->hm.s.svm.fSyncVTpr = true;
2160 }
2161
2162 pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_INTERCEPTS | HMSVM_VMCB_CLEAN_INT_CTRL);
2163 }
2164 else
2165 {
2166 /* 32-bit guests uses LSTAR MSR for patching guest code which touches the TPR. */
2167 pVmcb->guest.u64LSTAR = u8Tpr;
2168 uint8_t *pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
2169
2170 /* If there are interrupts pending, intercept LSTAR writes, otherwise don't intercept reads or writes. */
2171 if (fPendingIntr)
2172 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_INTERCEPT_WRITE);
2173 else
2174 {
2175 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
2176 pVCpu->hm.s.svm.fSyncVTpr = true;
2177 }
2178 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_IOPM_MSRPM;
2179 }
2180 }
2181 ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_APIC_TPR);
2182 }
2183 return VINF_SUCCESS;
2184}
2185
2186
2187/**
2188 * Sets up the exception interrupts required for guest (or nested-guest)
2189 * execution in the VMCB.
2190 *
2191 * @param pVCpu The cross context virtual CPU structure.
2192 * @param pVmcb Pointer to the VM control block.
2193 *
2194 * @remarks No-long-jump zone!!!
2195 */
2196static void hmR0SvmExportGuestXcptIntercepts(PVMCPU pVCpu, PSVMVMCB pVmcb)
2197{
2198 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2199
2200 /* If we modify intercepts from here, please check & adjust hmR0SvmMergeVmcbCtrlsNested() if required. */
2201 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS)
2202 {
2203 /* Trap #UD for GIM provider (e.g. for hypercalls). */
2204 if (pVCpu->hm.s.fGIMTrapXcptUD)
2205 hmR0SvmSetXcptIntercept(pVmcb, X86_XCPT_UD);
2206 else
2207 hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_UD);
2208
2209 /* Trap #BP for INT3 debug breakpoints set by the VM debugger. */
2210 if (pVCpu->CTX_SUFF(pVM)->dbgf.ro.cEnabledInt3Breakpoints)
2211 hmR0SvmSetXcptIntercept(pVmcb, X86_XCPT_BP);
2212 else
2213 hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_BP);
2214
2215 /* The remaining intercepts are handled elsewhere, e.g. in hmR0SvmExportGuestCR0(). */
2216 pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS;
2217 }
2218}
2219
2220
2221#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
2222/**
2223 * Merges guest and nested-guest intercepts for executing the nested-guest using
2224 * hardware-assisted SVM.
2225 *
2226 * This merges the guest and nested-guest intercepts in a way that if the outer
2227 * guest intercept is set we need to intercept it in the nested-guest as
2228 * well.
2229 *
2230 * @param pVCpu The cross context virtual CPU structure.
2231 * @param pVmcbNstGst Pointer to the nested-guest VM control block.
2232 * @param pCtx Pointer to the nested-guest-CPU context.
2233 */
2234static void hmR0SvmMergeVmcbCtrlsNested(PVMCPU pVCpu, PCCPUMCTX pCtx)
2235{
2236 PVM pVM = pVCpu->CTX_SUFF(pVM);
2237 PCSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
2238 PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
2239 PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
2240
2241 /* Merge the guest's CR intercepts into the nested-guest VMCB. */
2242 pVmcbNstGstCtrl->u16InterceptRdCRx |= pVmcb->ctrl.u16InterceptRdCRx;
2243 pVmcbNstGstCtrl->u16InterceptWrCRx |= pVmcb->ctrl.u16InterceptWrCRx;
2244
2245 /* Always intercept CR4 writes for tracking PGM mode changes. */
2246 pVmcbNstGstCtrl->u16InterceptWrCRx |= RT_BIT(4);
2247
2248 /* Without nested paging, intercept CR3 reads and writes as we load shadow page tables. */
2249 if (!pVM->hm.s.fNestedPaging)
2250 {
2251 pVmcbNstGstCtrl->u16InterceptRdCRx |= RT_BIT(3);
2252 pVmcbNstGstCtrl->u16InterceptWrCRx |= RT_BIT(3);
2253 }
2254
2255 /** @todo Figure out debugging with nested-guests, till then just intercept
2256 * all DR[0-15] accesses. */
2257 pVmcbNstGstCtrl->u16InterceptRdDRx |= 0xffff;
2258 pVmcbNstGstCtrl->u16InterceptWrDRx |= 0xffff;
2259
2260 /*
2261 * Merge the guest's exception intercepts into the nested-guest VMCB.
2262 *
2263 * - \#UD: Exclude these as the outer guest's GIM hypercalls are not applicable
2264 * while executing the nested-guest.
2265 *
2266 * - \#BP: Exclude breakpoints set by the VM debugger for the outer guest. This can
2267 * be tweaked later depending on how we wish to implement breakpoints.
2268 *
2269 * Warning!! This ASSUMES we only intercept \#UD for hypercall purposes and \#BP
2270 * for VM debugger breakpoints, see hmR0SvmExportGuestXcptIntercepts().
2271 */
2272#ifndef HMSVM_ALWAYS_TRAP_ALL_XCPTS
2273 pVmcbNstGstCtrl->u32InterceptXcpt |= (pVmcb->ctrl.u32InterceptXcpt & ~( RT_BIT(X86_XCPT_UD)
2274 | RT_BIT(X86_XCPT_BP)));
2275#else
2276 pVmcbNstGstCtrl->u32InterceptXcpt |= pVmcb->ctrl.u32InterceptXcpt;
2277#endif
2278
2279 /*
2280 * Adjust intercepts while executing the nested-guest that differ from the
2281 * outer guest intercepts.
2282 *
2283 * - VINTR: Exclude the outer guest intercept as we don't need to cause VINTR #VMEXITs
2284 * that belong to the nested-guest to the outer guest.
2285 *
2286 * - VMMCALL: Exclude the outer guest intercept as when it's also not intercepted by
2287 * the nested-guest, the physical CPU raises a \#UD exception as expected.
2288 */
2289 pVmcbNstGstCtrl->u64InterceptCtrl |= (pVmcb->ctrl.u64InterceptCtrl & ~( SVM_CTRL_INTERCEPT_VINTR
2290 | SVM_CTRL_INTERCEPT_VMMCALL))
2291 | HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS;
2292
2293 Assert( (pVmcbNstGstCtrl->u64InterceptCtrl & HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS)
2294 == HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS);
2295
2296 /* Finally, update the VMCB clean bits. */
2297 pVmcbNstGstCtrl->u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
2298}
2299#endif
2300
2301
2302/**
2303 * Selects the appropriate function to run guest code.
2304 *
2305 * @returns VBox status code.
2306 * @param pVCpu The cross context virtual CPU structure.
2307 *
2308 * @remarks No-long-jump zone!!!
2309 */
2310static int hmR0SvmSelectVMRunHandler(PVMCPU pVCpu)
2311{
2312 if (CPUMIsGuestInLongMode(pVCpu))
2313 {
2314#ifndef VBOX_ENABLE_64_BITS_GUESTS
2315 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2316#endif
2317 Assert(pVCpu->CTX_SUFF(pVM)->hm.s.fAllow64BitGuests); /* Guaranteed by hmR3InitFinalizeR0(). */
2318#if HC_ARCH_BITS == 32
2319 /* 32-bit host. We need to switch to 64-bit before running the 64-bit guest. */
2320 pVCpu->hm.s.svm.pfnVMRun = SVMR0VMSwitcherRun64;
2321#else
2322 /* 64-bit host or hybrid host. */
2323 pVCpu->hm.s.svm.pfnVMRun = SVMR0VMRun64;
2324#endif
2325 }
2326 else
2327 {
2328 /* Guest is not in long mode, use the 32-bit handler. */
2329 pVCpu->hm.s.svm.pfnVMRun = SVMR0VMRun;
2330 }
2331 return VINF_SUCCESS;
2332}
2333
2334
2335/**
2336 * Enters the AMD-V session.
2337 *
2338 * @returns VBox status code.
2339 * @param pVM The cross context VM structure.
2340 * @param pVCpu The cross context virtual CPU structure.
2341 * @param pCpu Pointer to the CPU info struct.
2342 */
2343VMMR0DECL(int) SVMR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBALCPUINFO pCpu)
2344{
2345 AssertPtr(pVM);
2346 AssertPtr(pVCpu);
2347 Assert(pVM->hm.s.svm.fSupported);
2348 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2349 NOREF(pVM); NOREF(pCpu);
2350
2351 LogFlowFunc(("pVM=%p pVCpu=%p\n", pVM, pVCpu));
2352 Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE))
2353 == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE));
2354
2355 pVCpu->hm.s.fLeaveDone = false;
2356 return VINF_SUCCESS;
2357}
2358
2359
2360/**
2361 * Thread-context callback for AMD-V.
2362 *
2363 * @param enmEvent The thread-context event.
2364 * @param pVCpu The cross context virtual CPU structure.
2365 * @param fGlobalInit Whether global VT-x/AMD-V init. is used.
2366 * @thread EMT(pVCpu)
2367 */
2368VMMR0DECL(void) SVMR0ThreadCtxCallback(RTTHREADCTXEVENT enmEvent, PVMCPU pVCpu, bool fGlobalInit)
2369{
2370 NOREF(fGlobalInit);
2371
2372 switch (enmEvent)
2373 {
2374 case RTTHREADCTXEVENT_OUT:
2375 {
2376 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2377 Assert(VMMR0ThreadCtxHookIsEnabled(pVCpu));
2378 VMCPU_ASSERT_EMT(pVCpu);
2379
2380 /* No longjmps (log-flush, locks) in this fragile context. */
2381 VMMRZCallRing3Disable(pVCpu);
2382
2383 if (!pVCpu->hm.s.fLeaveDone)
2384 {
2385 hmR0SvmLeave(pVCpu, false /* fImportState */);
2386 pVCpu->hm.s.fLeaveDone = true;
2387 }
2388
2389 /* Leave HM context, takes care of local init (term). */
2390 int rc = HMR0LeaveCpu(pVCpu);
2391 AssertRC(rc); NOREF(rc);
2392
2393 /* Restore longjmp state. */
2394 VMMRZCallRing3Enable(pVCpu);
2395 STAM_REL_COUNTER_INC(&pVCpu->hm.s.StatSwitchPreempt);
2396 break;
2397 }
2398
2399 case RTTHREADCTXEVENT_IN:
2400 {
2401 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2402 Assert(VMMR0ThreadCtxHookIsEnabled(pVCpu));
2403 VMCPU_ASSERT_EMT(pVCpu);
2404
2405 /* No longjmps (log-flush, locks) in this fragile context. */
2406 VMMRZCallRing3Disable(pVCpu);
2407
2408 /*
2409 * Initialize the bare minimum state required for HM. This takes care of
2410 * initializing AMD-V if necessary (onlined CPUs, local init etc.)
2411 */
2412 int rc = HMR0EnterCpu(pVCpu);
2413 AssertRC(rc); NOREF(rc);
2414 Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE))
2415 == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE));
2416
2417 pVCpu->hm.s.fLeaveDone = false;
2418
2419 /* Restore longjmp state. */
2420 VMMRZCallRing3Enable(pVCpu);
2421 break;
2422 }
2423
2424 default:
2425 break;
2426 }
2427}
2428
2429
2430/**
2431 * Saves the host state.
2432 *
2433 * @returns VBox status code.
2434 * @param pVCpu The cross context virtual CPU structure.
2435 *
2436 * @remarks No-long-jump zone!!!
2437 */
2438VMMR0DECL(int) SVMR0ExportHostState(PVMCPU pVCpu)
2439{
2440 NOREF(pVCpu);
2441
2442 /* Nothing to do here. AMD-V does this for us automatically during the world-switch. */
2443 ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_HOST_CONTEXT);
2444 return VINF_SUCCESS;
2445}
2446
2447
2448/**
2449 * Exports the guest state from the guest-CPU context into the VMCB.
2450 *
2451 * The CPU state will be loaded from these fields on every successful VM-entry.
2452 * Also sets up the appropriate VMRUN function to execute guest code based on
2453 * the guest CPU mode.
2454 *
2455 * @returns VBox status code.
2456 * @param pVM The cross context VM structure.
2457 * @param pVCpu The cross context virtual CPU structure.
2458 * @param pCtx Pointer to the guest-CPU context.
2459 *
2460 * @remarks No-long-jump zone!!!
2461 */
2462static int hmR0SvmExportGuestState(PVMCPU pVCpu)
2463{
2464 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExportGuestState, x);
2465
2466 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
2467 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2468
2469 Assert(pVmcb);
2470 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
2471
2472 pVmcb->guest.u64RIP = pCtx->rip;
2473 pVmcb->guest.u64RSP = pCtx->rsp;
2474 pVmcb->guest.u64RFlags = pCtx->eflags.u32;
2475 pVmcb->guest.u64RAX = pCtx->rax;
2476#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
2477 if (pVmcb->ctrl.IntCtrl.n.u1VGifEnable)
2478 {
2479 Assert(pVCpu->CTX_SUFF(pVM)->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VGIF);
2480 pVmcb->ctrl.IntCtrl.n.u1VGif = pCtx->hwvirt.fGif;
2481 }
2482#endif
2483
2484 RTCCUINTREG const fEFlags = ASMIntDisableFlags();
2485
2486 int rc = hmR0SvmExportGuestControlRegs(pVCpu, pVmcb);
2487 AssertRCReturnStmt(rc, ASMSetFlags(fEFlags), rc);
2488
2489 hmR0SvmExportGuestSegmentRegs(pVCpu, pVmcb);
2490 hmR0SvmExportGuestMsrs(pVCpu, pVmcb);
2491 hmR0SvmExportGuestXcptIntercepts(pVCpu, pVmcb);
2492
2493 ASMSetFlags(fEFlags);
2494
2495 /* hmR0SvmExportGuestApicTpr() must be called -after- hmR0SvmExportGuestMsrs() as we
2496 otherwise we would overwrite the LSTAR MSR that we use for TPR patching. */
2497 hmR0SvmExportGuestApicTpr(pVCpu, pVmcb);
2498
2499 rc = hmR0SvmSelectVMRunHandler(pVCpu);
2500 AssertRCReturn(rc, rc);
2501
2502 /* Clear any bits that may be set but exported unconditionally or unused/reserved bits. */
2503 ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~( HM_CHANGED_GUEST_RIP
2504 | HM_CHANGED_GUEST_RFLAGS
2505 | HM_CHANGED_GUEST_GPRS_MASK
2506 | HM_CHANGED_GUEST_X87
2507 | HM_CHANGED_GUEST_SSE_AVX
2508 | HM_CHANGED_GUEST_OTHER_XSAVE
2509 | HM_CHANGED_GUEST_XCRx
2510 | HM_CHANGED_GUEST_TSC_AUX
2511 | HM_CHANGED_GUEST_OTHER_MSRS
2512 | HM_CHANGED_GUEST_HWVIRT
2513 | (HM_CHANGED_KEEPER_STATE_MASK & ~HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS)));
2514
2515#ifdef VBOX_STRICT
2516 /*
2517 * All of the guest-CPU state and SVM keeper bits should be exported here by now,
2518 * except for the host-context and/or shared host-guest context bits.
2519 */
2520 uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
2521 AssertMsg(!(fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)),
2522 ("fCtxChanged=%#RX64\n", fCtxChanged));
2523
2524 /*
2525 * If we need to log state that isn't always imported, we'll need to import them here.
2526 * See hmR0SvmPostRunGuest() for which part of the state is imported uncondtionally.
2527 */
2528 hmR0SvmLogState(pVCpu, pVmcb, "hmR0SvmExportGuestState", 0 /* fFlags */, 0 /* uVerbose */);
2529#endif
2530
2531 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExportGuestState, x);
2532 return VINF_SUCCESS;
2533}
2534
2535
2536#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
2537/**
2538 * Merges the guest and nested-guest MSR permission bitmap.
2539 *
2540 * If the guest is intercepting an MSR we need to intercept it regardless of
2541 * whether the nested-guest is intercepting it or not.
2542 *
2543 * @param pHostCpu Pointer to the physical CPU HM info. struct.
2544 * @param pVCpu The cross context virtual CPU structure.
2545 * @param pCtx Pointer to the nested-guest-CPU context.
2546 *
2547 * @remarks No-long-jmp zone!!!
2548 */
2549DECLINLINE(void) hmR0SvmMergeMsrpmNested(PHMGLOBALCPUINFO pHostCpu, PVMCPU pVCpu, PCCPUMCTX pCtx)
2550{
2551 uint64_t const *pu64GstMsrpm = (uint64_t const *)pVCpu->hm.s.svm.pvMsrBitmap;
2552 uint64_t const *pu64NstGstMsrpm = (uint64_t const *)pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
2553 uint64_t *pu64DstMsrpm = (uint64_t *)pHostCpu->n.svm.pvNstGstMsrpm;
2554
2555 /* MSRPM bytes from offset 0x1800 are reserved, so we stop merging there. */
2556 uint32_t const offRsvdQwords = 0x1800 >> 3;
2557 for (uint32_t i = 0; i < offRsvdQwords; i++)
2558 pu64DstMsrpm[i] = pu64NstGstMsrpm[i] | pu64GstMsrpm[i];
2559}
2560
2561
2562/**
2563 * Caches the nested-guest VMCB fields before we modify them for execution using
2564 * hardware-assisted SVM.
2565 *
2566 * @returns true if the VMCB was previously already cached, false otherwise.
2567 * @param pCtx Pointer to the guest-CPU context.
2568 *
2569 * @sa HMSvmNstGstVmExitNotify.
2570 */
2571static bool hmR0SvmCacheVmcbNested(PVMCPU pVCpu, PCCPUMCTX pCtx)
2572{
2573 /*
2574 * Cache the nested-guest programmed VMCB fields if we have not cached it yet.
2575 * Otherwise we risk re-caching the values we may have modified, see @bugref{7243#c44}.
2576 *
2577 * Nested-paging CR3 is not saved back into the VMCB on #VMEXIT, hence no need to
2578 * cache and restore it, see AMD spec. 15.25.4 "Nested Paging and VMRUN/#VMEXIT".
2579 */
2580 PSVMNESTEDVMCBCACHE pVmcbNstGstCache = &pVCpu->hm.s.svm.NstGstVmcbCache;
2581 bool const fWasCached = pVmcbNstGstCache->fCacheValid;
2582 if (!fWasCached)
2583 {
2584 PCSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
2585 PCSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
2586 pVmcbNstGstCache->u16InterceptRdCRx = pVmcbNstGstCtrl->u16InterceptRdCRx;
2587 pVmcbNstGstCache->u16InterceptWrCRx = pVmcbNstGstCtrl->u16InterceptWrCRx;
2588 pVmcbNstGstCache->u16InterceptRdDRx = pVmcbNstGstCtrl->u16InterceptRdDRx;
2589 pVmcbNstGstCache->u16InterceptWrDRx = pVmcbNstGstCtrl->u16InterceptWrDRx;
2590 pVmcbNstGstCache->u16PauseFilterThreshold = pVmcbNstGstCtrl->u16PauseFilterThreshold;
2591 pVmcbNstGstCache->u16PauseFilterCount = pVmcbNstGstCtrl->u16PauseFilterCount;
2592 pVmcbNstGstCache->u32InterceptXcpt = pVmcbNstGstCtrl->u32InterceptXcpt;
2593 pVmcbNstGstCache->u64InterceptCtrl = pVmcbNstGstCtrl->u64InterceptCtrl;
2594 pVmcbNstGstCache->u64TSCOffset = pVmcbNstGstCtrl->u64TSCOffset;
2595 pVmcbNstGstCache->fVIntrMasking = pVmcbNstGstCtrl->IntCtrl.n.u1VIntrMasking;
2596 pVmcbNstGstCache->fNestedPaging = pVmcbNstGstCtrl->NestedPagingCtrl.n.u1NestedPaging;
2597 pVmcbNstGstCache->fLbrVirt = pVmcbNstGstCtrl->LbrVirt.n.u1LbrVirt;
2598 pVmcbNstGstCache->fCacheValid = true;
2599 Log4Func(("Cached VMCB fields\n"));
2600 }
2601
2602 return fWasCached;
2603}
2604
2605
2606/**
2607 * Sets up the nested-guest VMCB for execution using hardware-assisted SVM.
2608 *
2609 * This is done the first time we enter nested-guest execution using SVM R0
2610 * until the nested-guest \#VMEXIT (not to be confused with physical CPU
2611 * \#VMEXITs which may or may not cause a corresponding nested-guest \#VMEXIT).
2612 *
2613 * @param pVCpu The cross context virtual CPU structure.
2614 */
2615static void hmR0SvmSetupVmcbNested(PVMCPU pVCpu)
2616{
2617 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2618 PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
2619 PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
2620
2621 /*
2622 * First cache the nested-guest VMCB fields we may potentially modify.
2623 */
2624 bool const fVmcbCached = hmR0SvmCacheVmcbNested(pVCpu, pCtx);
2625 if (!fVmcbCached)
2626 {
2627 /*
2628 * The IOPM of the nested-guest can be ignored because the the guest always
2629 * intercepts all IO port accesses. Thus, we'll swap to the guest IOPM rather
2630 * than the nested-guest IOPM and swap the field back on the #VMEXIT.
2631 */
2632 pVmcbNstGstCtrl->u64IOPMPhysAddr = g_HCPhysIOBitmap;
2633
2634 /*
2635 * Use the same nested-paging as the outer guest. We can't dynamically switch off
2636 * nested-paging suddenly while executing a VM (see assertion at the end of
2637 * Trap0eHandler() in PGMAllBth.h).
2638 */
2639 pVmcbNstGstCtrl->NestedPagingCtrl.n.u1NestedPaging = pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging;
2640
2641 /* Always enable V_INTR_MASKING as we do not want to allow access to the physical APIC TPR. */
2642 pVmcbNstGstCtrl->IntCtrl.n.u1VIntrMasking = 1;
2643
2644 /*
2645 * Turn off TPR syncing on #VMEXIT for nested-guests as CR8 intercepts are subject
2646 * to the nested-guest intercepts and we always run with V_INTR_MASKING.
2647 */
2648 pVCpu->hm.s.svm.fSyncVTpr = false;
2649
2650#ifdef DEBUG_ramshankar
2651 /* For debugging purposes - copy the LBR info. from outer guest VMCB. */
2652 pVmcbNstGstCtrl->LbrVirt.n.u1LbrVirt = pVmcb->ctrl.LbrVirt.n.u1LbrVirt;
2653#endif
2654
2655 /*
2656 * If we don't expose Virtualized-VMSAVE/VMLOAD feature to the outer guest, we
2657 * need to intercept VMSAVE/VMLOAD instructions executed by the nested-guest.
2658 */
2659 if (!pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
2660 pVmcbNstGstCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_VMSAVE
2661 | SVM_CTRL_INTERCEPT_VMLOAD;
2662
2663 /*
2664 * If we don't expose Virtual GIF feature to the outer guest, we need to intercept
2665 * CLGI/STGI instructions executed by the nested-guest.
2666 */
2667 if (!pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.fSvmVGif)
2668 pVmcbNstGstCtrl->u64InterceptCtrl |= SVM_CTRL_INTERCEPT_CLGI
2669 | SVM_CTRL_INTERCEPT_STGI;
2670
2671 /* Merge the guest and nested-guest intercepts. */
2672 hmR0SvmMergeVmcbCtrlsNested(pVCpu, pCtx);
2673
2674 /* Update the VMCB clean bits. */
2675 pVmcbNstGstCtrl->u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
2676 }
2677 else
2678 {
2679 Assert(!pVCpu->hm.s.svm.fSyncVTpr);
2680 Assert(pVmcbNstGstCtrl->u64IOPMPhysAddr == g_HCPhysIOBitmap);
2681 Assert(RT_BOOL(pVmcbNstGstCtrl->NestedPagingCtrl.n.u1NestedPaging) == pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging);
2682 }
2683}
2684
2685
2686/**
2687 * Exports the nested-guest state into the VMCB.
2688 *
2689 * We need to export the entire state as we could be continuing nested-guest
2690 * execution at any point (not just immediately after VMRUN) and thus the VMCB
2691 * can be out-of-sync with the nested-guest state if it was executed in IEM.
2692 *
2693 * @returns VBox status code.
2694 * @param pVCpu The cross context virtual CPU structure.
2695 * @param pCtx Pointer to the guest-CPU context.
2696 *
2697 * @remarks No-long-jump zone!!!
2698 */
2699static int hmR0SvmExportGuestStateNested(PVMCPU pVCpu)
2700{
2701 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExportGuestState, x);
2702
2703 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2704 PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
2705 Assert(pVmcbNstGst);
2706
2707 hmR0SvmSetupVmcbNested(pVCpu);
2708
2709 pVmcbNstGst->guest.u64RIP = pCtx->rip;
2710 pVmcbNstGst->guest.u64RSP = pCtx->rsp;
2711 pVmcbNstGst->guest.u64RFlags = pCtx->eflags.u32;
2712 pVmcbNstGst->guest.u64RAX = pCtx->rax;
2713
2714 RTCCUINTREG const fEFlags = ASMIntDisableFlags();
2715
2716 int rc = hmR0SvmExportGuestControlRegs(pVCpu, pVmcbNstGst);
2717 AssertRCReturnStmt(rc, ASMSetFlags(fEFlags), rc);
2718
2719 hmR0SvmExportGuestSegmentRegs(pVCpu, pVmcbNstGst);
2720 hmR0SvmExportGuestMsrs(pVCpu, pVmcbNstGst);
2721 hmR0SvmExportGuestHwvirtStateNested(pVCpu, pVmcbNstGst);
2722
2723 ASMSetFlags(fEFlags);
2724
2725 /* Nested VGIF not supported yet. */
2726 Assert(!pVmcbNstGst->ctrl.IntCtrl.n.u1VGifEnable);
2727
2728 rc = hmR0SvmSelectVMRunHandler(pVCpu);
2729 AssertRCReturn(rc, rc);
2730
2731 /* Clear any bits that may be set but exported unconditionally or unused/reserved bits. */
2732 ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~( HM_CHANGED_GUEST_RIP
2733 | HM_CHANGED_GUEST_RFLAGS
2734 | HM_CHANGED_GUEST_GPRS_MASK
2735 | HM_CHANGED_GUEST_APIC_TPR
2736 | HM_CHANGED_GUEST_X87
2737 | HM_CHANGED_GUEST_SSE_AVX
2738 | HM_CHANGED_GUEST_OTHER_XSAVE
2739 | HM_CHANGED_GUEST_XCRx
2740 | HM_CHANGED_GUEST_TSC_AUX
2741 | HM_CHANGED_GUEST_OTHER_MSRS
2742 | HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS
2743 | (HM_CHANGED_KEEPER_STATE_MASK & ~HM_CHANGED_SVM_MASK)));
2744
2745#ifdef VBOX_STRICT
2746 /*
2747 * All of the guest-CPU state and SVM keeper bits should be exported here by now, except
2748 * for the host-context and/or shared host-guest context bits.
2749 */
2750 uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
2751 AssertMsg(!(fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)),
2752 ("fCtxChanged=%#RX64\n", fCtxChanged));
2753
2754 /*
2755 * If we need to log state that isn't always imported, we'll need to import them here.
2756 * See hmR0SvmPostRunGuest() for which part of the state is imported uncondtionally.
2757 */
2758 hmR0SvmLogState(pVCpu, pVmcbNstGst, "hmR0SvmExportGuestStateNested", 0 /* fFlags */, 0 /* uVerbose */);
2759#endif
2760
2761 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExportGuestState, x);
2762 return rc;
2763}
2764#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
2765
2766
2767/**
2768 * Exports the state shared between the host and guest (or nested-guest) into
2769 * the VMCB.
2770 *
2771 * @param pVCpu The cross context virtual CPU structure.
2772 * @param pVmcb Pointer to the VM control block.
2773 *
2774 * @remarks No-long-jump zone!!!
2775 */
2776static void hmR0SvmExportSharedState(PVMCPU pVCpu, PSVMVMCB pVmcb)
2777{
2778 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
2779 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
2780
2781 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_DR_MASK)
2782 {
2783 /** @todo Figure out stepping with nested-guest. */
2784 PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2785 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
2786 hmR0SvmExportSharedDebugState(pVCpu, pVmcb);
2787 else
2788 {
2789 pVmcb->guest.u64DR6 = pCtx->dr[6];
2790 pVmcb->guest.u64DR7 = pCtx->dr[7];
2791 }
2792 }
2793
2794 pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_DR_MASK;
2795 AssertMsg(!(pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE),
2796 ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
2797}
2798
2799
2800/**
2801 * Worker for SVMR0ImportStateOnDemand.
2802 *
2803 * @param pVCpu The cross context virtual CPU structure.
2804 * @param pCtx Pointer to the guest-CPU or nested-guest-CPU context.
2805 * @param fWhat What to import, CPUMCTX_EXTRN_XXX.
2806 */
2807static void hmR0SvmImportGuestState(PVMCPU pVCpu, uint64_t fWhat)
2808{
2809 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatImportGuestState, x);
2810
2811 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
2812 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
2813 PCSVMVMCBSTATESAVE pVmcbGuest = &pVmcb->guest;
2814 PCSVMVMCBCTRL pVmcbCtrl = &pVmcb->ctrl;
2815
2816 Log4Func(("fExtrn=%#RX64 fWhat=%#RX64\n", pCtx->fExtrn, fWhat));
2817
2818 /*
2819 * We disable interrupts to make the updating of the state and in particular
2820 * the fExtrn modification atomic wrt to preemption hooks.
2821 */
2822 RTCCUINTREG const fEFlags = ASMIntDisableFlags();
2823
2824 fWhat &= pCtx->fExtrn;
2825 if (fWhat)
2826 {
2827#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
2828 if (fWhat & CPUMCTX_EXTRN_HWVIRT)
2829 {
2830 if ( !CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
2831 && pVmcbCtrl->IntCtrl.n.u1VGifEnable)
2832 {
2833 /* We don't yet support passing VGIF feature to the guest. */
2834 Assert(pVCpu->CTX_SUFF(pVM)->hm.s.svm.fVGif);
2835 pCtx->hwvirt.fGif = pVmcbCtrl->IntCtrl.n.u1VGif;
2836 }
2837 }
2838
2839 if (fWhat & CPUMCTX_EXTRN_HM_SVM_HWVIRT_VIRQ)
2840 {
2841 if ( !pVmcbCtrl->IntCtrl.n.u1VIrqPending
2842 && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
2843 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
2844 }
2845#endif
2846
2847 if (fWhat & CPUMCTX_EXTRN_HM_SVM_INT_SHADOW)
2848 {
2849 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
2850 EMSetInhibitInterruptsPC(pVCpu, pVmcbGuest->u64RIP);
2851 else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
2852 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2853 }
2854
2855 if (fWhat & CPUMCTX_EXTRN_RIP)
2856 pCtx->rip = pVmcbGuest->u64RIP;
2857
2858 if (fWhat & CPUMCTX_EXTRN_RFLAGS)
2859 pCtx->eflags.u32 = pVmcbGuest->u64RFlags;
2860
2861 if (fWhat & CPUMCTX_EXTRN_RSP)
2862 pCtx->rsp = pVmcbGuest->u64RSP;
2863
2864 if (fWhat & CPUMCTX_EXTRN_RAX)
2865 pCtx->rax = pVmcbGuest->u64RAX;
2866
2867 if (fWhat & CPUMCTX_EXTRN_SREG_MASK)
2868 {
2869 if (fWhat & CPUMCTX_EXTRN_CS)
2870 {
2871 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, CS, cs);
2872 /* Correct the CS granularity bit. Haven't seen it being wrong in any other register (yet). */
2873 /** @todo SELM might need to be fixed as it too should not care about the
2874 * granularity bit. See @bugref{6785}. */
2875 if ( !pCtx->cs.Attr.n.u1Granularity
2876 && pCtx->cs.Attr.n.u1Present
2877 && pCtx->cs.u32Limit > UINT32_C(0xfffff))
2878 {
2879 Assert((pCtx->cs.u32Limit & 0xfff) == 0xfff);
2880 pCtx->cs.Attr.n.u1Granularity = 1;
2881 }
2882 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, cs);
2883 }
2884 if (fWhat & CPUMCTX_EXTRN_SS)
2885 {
2886 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, SS, ss);
2887 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, ss);
2888 /*
2889 * Sync the hidden SS DPL field. AMD CPUs have a separate CPL field in the
2890 * VMCB and uses that and thus it's possible that when the CPL changes during
2891 * guest execution that the SS DPL isn't updated by AMD-V. Observed on some
2892 * AMD Fusion CPUs with 64-bit guests.
2893 *
2894 * See AMD spec. 15.5.1 "Basic operation".
2895 */
2896 Assert(!(pVmcbGuest->u8CPL & ~0x3));
2897 uint8_t const uCpl = pVmcbGuest->u8CPL;
2898 if (pCtx->ss.Attr.n.u2Dpl != uCpl)
2899 pCtx->ss.Attr.n.u2Dpl = uCpl & 0x3;
2900 }
2901 if (fWhat & CPUMCTX_EXTRN_DS)
2902 {
2903 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, DS, ds);
2904 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, ds);
2905 }
2906 if (fWhat & CPUMCTX_EXTRN_ES)
2907 {
2908 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, ES, es);
2909 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, es);
2910 }
2911 if (fWhat & CPUMCTX_EXTRN_FS)
2912 {
2913 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, FS, fs);
2914 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, fs);
2915 }
2916 if (fWhat & CPUMCTX_EXTRN_GS)
2917 {
2918 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, GS, gs);
2919 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, gs);
2920 }
2921 }
2922
2923 if (fWhat & CPUMCTX_EXTRN_TABLE_MASK)
2924 {
2925 if (fWhat & CPUMCTX_EXTRN_TR)
2926 {
2927 /*
2928 * Fixup TR attributes so it's compatible with Intel. Important when saved-states
2929 * are used between Intel and AMD, see @bugref{6208#c39}.
2930 * ASSUME that it's normally correct and that we're in 32-bit or 64-bit mode.
2931 */
2932 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, TR, tr);
2933 if (pCtx->tr.Attr.n.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
2934 {
2935 if ( pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL
2936 || CPUMIsGuestInLongModeEx(pCtx))
2937 pCtx->tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
2938 else if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
2939 pCtx->tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_286_TSS_BUSY;
2940 }
2941 }
2942
2943 if (fWhat & CPUMCTX_EXTRN_LDTR)
2944 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, LDTR, ldtr);
2945
2946 if (fWhat & CPUMCTX_EXTRN_GDTR)
2947 {
2948 pCtx->gdtr.cbGdt = pVmcbGuest->GDTR.u32Limit;
2949 pCtx->gdtr.pGdt = pVmcbGuest->GDTR.u64Base;
2950 }
2951
2952 if (fWhat & CPUMCTX_EXTRN_IDTR)
2953 {
2954 pCtx->idtr.cbIdt = pVmcbGuest->IDTR.u32Limit;
2955 pCtx->idtr.pIdt = pVmcbGuest->IDTR.u64Base;
2956 }
2957 }
2958
2959 if (fWhat & CPUMCTX_EXTRN_SYSCALL_MSRS)
2960 {
2961 pCtx->msrSTAR = pVmcbGuest->u64STAR;
2962 pCtx->msrLSTAR = pVmcbGuest->u64LSTAR;
2963 pCtx->msrCSTAR = pVmcbGuest->u64CSTAR;
2964 pCtx->msrSFMASK = pVmcbGuest->u64SFMASK;
2965 }
2966
2967 if (fWhat & CPUMCTX_EXTRN_SYSENTER_MSRS)
2968 {
2969 pCtx->SysEnter.cs = pVmcbGuest->u64SysEnterCS;
2970 pCtx->SysEnter.eip = pVmcbGuest->u64SysEnterEIP;
2971 pCtx->SysEnter.esp = pVmcbGuest->u64SysEnterESP;
2972 }
2973
2974 if (fWhat & CPUMCTX_EXTRN_KERNEL_GS_BASE)
2975 pCtx->msrKERNELGSBASE = pVmcbGuest->u64KernelGSBase;
2976
2977 if (fWhat & CPUMCTX_EXTRN_DR_MASK)
2978 {
2979 if (fWhat & CPUMCTX_EXTRN_DR6)
2980 {
2981 if (!pVCpu->hm.s.fUsingHyperDR7)
2982 pCtx->dr[6] = pVmcbGuest->u64DR6;
2983 else
2984 CPUMSetHyperDR6(pVCpu, pVmcbGuest->u64DR6);
2985 }
2986
2987 if (fWhat & CPUMCTX_EXTRN_DR7)
2988 {
2989 if (!pVCpu->hm.s.fUsingHyperDR7)
2990 pCtx->dr[7] = pVmcbGuest->u64DR7;
2991 else
2992 Assert(pVmcbGuest->u64DR7 == CPUMGetHyperDR7(pVCpu));
2993 }
2994 }
2995
2996 if (fWhat & CPUMCTX_EXTRN_CR_MASK)
2997 {
2998 if (fWhat & CPUMCTX_EXTRN_CR0)
2999 {
3000 /* We intercept changes to all CR0 bits except maybe TS & MP bits. */
3001 uint64_t const uCr0 = (pCtx->cr0 & ~(X86_CR0_TS | X86_CR0_MP))
3002 | (pVmcbGuest->u64CR0 & (X86_CR0_TS | X86_CR0_MP));
3003 VMMRZCallRing3Disable(pVCpu); /* Calls into PGM which has Log statements. */
3004 CPUMSetGuestCR0(pVCpu, uCr0);
3005 VMMRZCallRing3Enable(pVCpu);
3006 }
3007
3008 if (fWhat & CPUMCTX_EXTRN_CR2)
3009 pCtx->cr2 = pVmcbGuest->u64CR2;
3010
3011 if (fWhat & CPUMCTX_EXTRN_CR3)
3012 {
3013 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
3014 && pCtx->cr3 != pVmcbGuest->u64CR3)
3015 {
3016 CPUMSetGuestCR3(pVCpu, pVmcbGuest->u64CR3);
3017 VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_CR3);
3018 }
3019 }
3020
3021 /* Changes to CR4 are always intercepted. */
3022 }
3023
3024 /* Update fExtrn. */
3025 pCtx->fExtrn &= ~fWhat;
3026
3027 /* If everything has been imported, clear the HM keeper bit. */
3028 if (!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL))
3029 {
3030 pCtx->fExtrn &= ~CPUMCTX_EXTRN_KEEPER_HM;
3031 Assert(!pCtx->fExtrn);
3032 }
3033 }
3034 else
3035 Assert(!pCtx->fExtrn || (pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
3036
3037 ASMSetFlags(fEFlags);
3038
3039 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatImportGuestState, x);
3040
3041 /*
3042 * Honor any pending CR3 updates.
3043 *
3044 * Consider this scenario: #VMEXIT -> VMMRZCallRing3Enable() -> do stuff that causes a longjmp
3045 * -> hmR0SvmCallRing3Callback() -> VMMRZCallRing3Disable() -> hmR0SvmImportGuestState()
3046 * -> Sets VMCPU_FF_HM_UPDATE_CR3 pending -> return from the longjmp -> continue with #VMEXIT
3047 * handling -> hmR0SvmImportGuestState() and here we are.
3048 *
3049 * The reason for such complicated handling is because VM-exits that call into PGM expect
3050 * CR3 to be up-to-date and thus any CR3-saves -before- the VM-exit (longjmp) would've
3051 * postponed the CR3 update via the force-flag and cleared CR3 from fExtrn. Any SVM R0
3052 * VM-exit handler that requests CR3 to be saved will end up here and we call PGMUpdateCR3().
3053 *
3054 * The longjmp exit path can't check these CR3 force-flags and call code that takes a lock again,
3055 * and does not process force-flag like regular exits to ring-3 either, we cover for it here.
3056 */
3057 if ( VMMRZCallRing3IsEnabled(pVCpu)
3058 && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3))
3059 {
3060 Assert(pCtx->cr3 == pVmcbGuest->u64CR3);
3061 PGMUpdateCR3(pVCpu, pCtx->cr3);
3062 }
3063}
3064
3065
3066/**
3067 * Saves the guest (or nested-guest) state from the VMCB into the guest-CPU
3068 * context.
3069 *
3070 * Currently there is no residual state left in the CPU that is not updated in the
3071 * VMCB.
3072 *
3073 * @returns VBox status code.
3074 * @param pVCpu The cross context virtual CPU structure.
3075 * @param fWhat What to import, CPUMCTX_EXTRN_XXX.
3076 */
3077VMMR0DECL(int) SVMR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat)
3078{
3079 hmR0SvmImportGuestState(pVCpu, fWhat);
3080 return VINF_SUCCESS;
3081}
3082
3083
3084/**
3085 * Does the necessary state syncing before returning to ring-3 for any reason
3086 * (longjmp, preemption, voluntary exits to ring-3) from AMD-V.
3087 *
3088 * @param pVCpu The cross context virtual CPU structure.
3089 * @param fImportState Whether to import the guest state from the VMCB back
3090 * to the guest-CPU context.
3091 *
3092 * @remarks No-long-jmp zone!!!
3093 */
3094static void hmR0SvmLeave(PVMCPU pVCpu, bool fImportState)
3095{
3096 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
3097 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
3098 Assert(VMMR0IsLogFlushDisabled(pVCpu));
3099
3100 /*
3101 * !!! IMPORTANT !!!
3102 * If you modify code here, make sure to check whether hmR0SvmCallRing3Callback() needs to be updated too.
3103 */
3104
3105 /* Save the guest state if necessary. */
3106 if (fImportState)
3107 hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
3108
3109 /* Restore host FPU state if necessary and resync on next R0 reentry. */
3110 CPUMR0FpuStateMaybeSaveGuestAndRestoreHost(pVCpu);
3111 Assert(!CPUMIsGuestFPUStateActive(pVCpu));
3112
3113 /*
3114 * Restore host debug registers if necessary and resync on next R0 reentry.
3115 */
3116#ifdef VBOX_STRICT
3117 if (CPUMIsHyperDebugStateActive(pVCpu))
3118 {
3119 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb; /** @todo nested-guest. */
3120 Assert(pVmcb->ctrl.u16InterceptRdDRx == 0xffff);
3121 Assert(pVmcb->ctrl.u16InterceptWrDRx == 0xffff);
3122 }
3123#endif
3124 CPUMR0DebugStateMaybeSaveGuestAndRestoreHost(pVCpu, false /* save DR6 */);
3125 Assert(!CPUMIsHyperDebugStateActive(pVCpu));
3126 Assert(!CPUMIsGuestDebugStateActive(pVCpu));
3127
3128 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatEntry);
3129 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatImportGuestState);
3130 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExportGuestState);
3131 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
3132 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
3133 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchLongJmpToR3);
3134
3135 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED_HM, VMCPUSTATE_STARTED_EXEC);
3136}
3137
3138
3139/**
3140 * Leaves the AMD-V session.
3141 *
3142 * Only used while returning to ring-3 either due to longjump or exits to
3143 * ring-3.
3144 *
3145 * @returns VBox status code.
3146 * @param pVCpu The cross context virtual CPU structure.
3147 */
3148static int hmR0SvmLeaveSession(PVMCPU pVCpu)
3149{
3150 HM_DISABLE_PREEMPT();
3151 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
3152 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
3153
3154 /* When thread-context hooks are used, we can avoid doing the leave again if we had been preempted before
3155 and done this from the SVMR0ThreadCtxCallback(). */
3156 if (!pVCpu->hm.s.fLeaveDone)
3157 {
3158 hmR0SvmLeave(pVCpu, true /* fImportState */);
3159 pVCpu->hm.s.fLeaveDone = true;
3160 }
3161
3162 /*
3163 * !!! IMPORTANT !!!
3164 * If you modify code here, make sure to check whether hmR0SvmCallRing3Callback() needs to be updated too.
3165 */
3166
3167 /** @todo eliminate the need for calling VMMR0ThreadCtxHookDisable here! */
3168 /* Deregister hook now that we've left HM context before re-enabling preemption. */
3169 VMMR0ThreadCtxHookDisable(pVCpu);
3170
3171 /* Leave HM context. This takes care of local init (term). */
3172 int rc = HMR0LeaveCpu(pVCpu);
3173
3174 HM_RESTORE_PREEMPT();
3175 return rc;
3176}
3177
3178
3179/**
3180 * Does the necessary state syncing before doing a longjmp to ring-3.
3181 *
3182 * @returns VBox status code.
3183 * @param pVCpu The cross context virtual CPU structure.
3184 *
3185 * @remarks No-long-jmp zone!!!
3186 */
3187static int hmR0SvmLongJmpToRing3(PVMCPU pVCpu)
3188{
3189 return hmR0SvmLeaveSession(pVCpu);
3190}
3191
3192
3193/**
3194 * VMMRZCallRing3() callback wrapper which saves the guest state (or restores
3195 * any remaining host state) before we longjump to ring-3 and possibly get
3196 * preempted.
3197 *
3198 * @param pVCpu The cross context virtual CPU structure.
3199 * @param enmOperation The operation causing the ring-3 longjump.
3200 * @param pvUser The user argument (pointer to the possibly
3201 * out-of-date guest-CPU context).
3202 */
3203static DECLCALLBACK(int) hmR0SvmCallRing3Callback(PVMCPU pVCpu, VMMCALLRING3 enmOperation, void *pvUser)
3204{
3205 RT_NOREF_PV(pvUser);
3206
3207 if (enmOperation == VMMCALLRING3_VM_R0_ASSERTION)
3208 {
3209 /*
3210 * !!! IMPORTANT !!!
3211 * If you modify code here, make sure to check whether hmR0SvmLeave() and hmR0SvmLeaveSession() needs
3212 * to be updated too. This is a stripped down version which gets out ASAP trying to not trigger any assertion.
3213 */
3214 VMMRZCallRing3RemoveNotification(pVCpu);
3215 VMMRZCallRing3Disable(pVCpu);
3216 HM_DISABLE_PREEMPT();
3217
3218 /* Restore host FPU state if necessary and resync on next R0 reentry. */
3219 CPUMR0FpuStateMaybeSaveGuestAndRestoreHost(pVCpu);
3220
3221 /* Restore host debug registers if necessary and resync on next R0 reentry. */
3222 CPUMR0DebugStateMaybeSaveGuestAndRestoreHost(pVCpu, false /* save DR6 */);
3223
3224 /* Deregister the hook now that we've left HM context before re-enabling preemption. */
3225 /** @todo eliminate the need for calling VMMR0ThreadCtxHookDisable here! */
3226 VMMR0ThreadCtxHookDisable(pVCpu);
3227
3228 /* Leave HM context. This takes care of local init (term). */
3229 HMR0LeaveCpu(pVCpu);
3230
3231 HM_RESTORE_PREEMPT();
3232 return VINF_SUCCESS;
3233 }
3234
3235 Assert(pVCpu);
3236 Assert(pvUser);
3237 Assert(VMMRZCallRing3IsEnabled(pVCpu));
3238 HMSVM_ASSERT_PREEMPT_SAFE();
3239
3240 VMMRZCallRing3Disable(pVCpu);
3241 Assert(VMMR0IsLogFlushDisabled(pVCpu));
3242
3243 Log4Func(("Calling hmR0SvmLongJmpToRing3\n"));
3244 int rc = hmR0SvmLongJmpToRing3(pVCpu);
3245 AssertRCReturn(rc, rc);
3246
3247 VMMRZCallRing3Enable(pVCpu);
3248 return VINF_SUCCESS;
3249}
3250
3251
3252/**
3253 * Take necessary actions before going back to ring-3.
3254 *
3255 * An action requires us to go back to ring-3. This function does the necessary
3256 * steps before we can safely return to ring-3. This is not the same as longjmps
3257 * to ring-3, this is voluntary.
3258 *
3259 * @returns VBox status code.
3260 * @param pVM The cross context VM structure.
3261 * @param pVCpu The cross context virtual CPU structure.
3262 * @param pCtx Pointer to the guest-CPU context.
3263 * @param rcExit The reason for exiting to ring-3. Can be
3264 * VINF_VMM_UNKNOWN_RING3_CALL.
3265 */
3266static int hmR0SvmExitToRing3(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, int rcExit)
3267{
3268 Assert(pVM);
3269 Assert(pVCpu);
3270 Assert(pCtx);
3271 HMSVM_ASSERT_PREEMPT_SAFE();
3272
3273 /* Please, no longjumps here (any logging shouldn't flush jump back to ring-3). NO LOGGING BEFORE THIS POINT! */
3274 VMMRZCallRing3Disable(pVCpu);
3275 Log4Func(("rcExit=%d LocalFF=%#RX32 GlobalFF=%#RX32\n", rcExit, pVCpu->fLocalForcedActions, pVM->fGlobalForcedActions));
3276
3277 /* We need to do this only while truly exiting the "inner loop" back to ring-3 and -not- for any longjmp to ring3. */
3278 if (pVCpu->hm.s.Event.fPending)
3279 {
3280 hmR0SvmPendingEventToTrpmTrap(pVCpu);
3281 Assert(!pVCpu->hm.s.Event.fPending);
3282 }
3283
3284 /* Sync. the necessary state for going back to ring-3. */
3285 hmR0SvmLeaveSession(pVCpu);
3286 STAM_COUNTER_DEC(&pVCpu->hm.s.StatSwitchLongJmpToR3);
3287
3288 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
3289 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_SYSENTER_MSR
3290 | CPUM_CHANGED_LDTR
3291 | CPUM_CHANGED_GDTR
3292 | CPUM_CHANGED_IDTR
3293 | CPUM_CHANGED_TR
3294 | CPUM_CHANGED_HIDDEN_SEL_REGS);
3295 if ( pVM->hm.s.fNestedPaging
3296 && CPUMIsGuestPagingEnabledEx(pCtx))
3297 {
3298 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_GLOBAL_TLB_FLUSH);
3299 }
3300
3301 /* Update the exit-to-ring 3 reason. */
3302 pVCpu->hm.s.rcLastExitToR3 = rcExit;
3303
3304 /* On our way back from ring-3 reload the guest state if there is a possibility of it being changed. */
3305 if (rcExit != VINF_EM_RAW_INTERRUPT)
3306 {
3307 Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
3308 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
3309 }
3310
3311 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchExitToR3);
3312
3313 /* We do -not- want any longjmp notifications after this! We must return to ring-3 ASAP. */
3314 VMMRZCallRing3RemoveNotification(pVCpu);
3315 VMMRZCallRing3Enable(pVCpu);
3316
3317 /*
3318 * If we're emulating an instruction, we shouldn't have any TRPM traps pending
3319 * and if we're injecting an event we should have a TRPM trap pending.
3320 */
3321 AssertReturnStmt(rcExit != VINF_EM_RAW_INJECT_TRPM_EVENT || TRPMHasTrap(pVCpu),
3322 pVCpu->hm.s.u32HMError = rcExit,
3323 VERR_SVM_IPE_5);
3324 AssertReturnStmt(rcExit != VINF_EM_RAW_EMULATE_INSTR || !TRPMHasTrap(pVCpu),
3325 pVCpu->hm.s.u32HMError = rcExit,
3326 VERR_SVM_IPE_4);
3327
3328 return rcExit;
3329}
3330
3331
3332/**
3333 * Updates the use of TSC offsetting mode for the CPU and adjusts the necessary
3334 * intercepts.
3335 *
3336 * @param pVM The cross context VM structure.
3337 * @param pVCpu The cross context virtual CPU structure.
3338 * @param pCtx Pointer to the guest-CPU or nested-guest-CPU context.
3339 * @param pVmcb Pointer to the VM control block.
3340 *
3341 * @remarks No-long-jump zone!!!
3342 */
3343static void hmR0SvmUpdateTscOffsetting(PVM pVM, PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMVMCB pVmcb)
3344{
3345 /*
3346 * Avoid intercepting RDTSC/RDTSCP if we determined the host TSC (++) is stable
3347 * and in case of a nested-guest, if the nested-VMCB specifies it is not intercepting
3348 * RDTSC/RDTSCP as well.
3349 */
3350 bool fParavirtTsc;
3351 uint64_t uTscOffset;
3352 bool const fCanUseRealTsc = TMCpuTickCanUseRealTSC(pVM, pVCpu, &uTscOffset, &fParavirtTsc);
3353
3354 bool fIntercept;
3355 if (fCanUseRealTsc)
3356 fIntercept = hmR0SvmClearCtrlIntercept(pVCpu, pCtx, pVmcb, SVM_CTRL_INTERCEPT_RDTSC | SVM_CTRL_INTERCEPT_RDTSCP);
3357 else
3358 {
3359 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_RDTSC | SVM_CTRL_INTERCEPT_RDTSCP);
3360 fIntercept = true;
3361 }
3362
3363 if (!fIntercept)
3364 {
3365 /* Apply the nested-guest VMCB's TSC offset over the guest TSC offset. */
3366 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
3367 uTscOffset = HMSvmNstGstApplyTscOffset(pVCpu, uTscOffset);
3368
3369 /* Update the TSC offset in the VMCB and the relevant clean bits. */
3370 pVmcb->ctrl.u64TSCOffset = uTscOffset;
3371 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
3372
3373 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscOffset);
3374 }
3375 else
3376 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscIntercept);
3377
3378 /* Currently neither Hyper-V nor KVM need to update their paravirt. TSC
3379 information before every VM-entry, hence we have nothing to do here at the moment. */
3380 if (fParavirtTsc)
3381 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscParavirt);
3382}
3383
3384
3385/**
3386 * Sets an event as a pending event to be injected into the guest.
3387 *
3388 * @param pVCpu The cross context virtual CPU structure.
3389 * @param pEvent Pointer to the SVM event.
3390 * @param GCPtrFaultAddress The fault-address (CR2) in case it's a
3391 * page-fault.
3392 *
3393 * @remarks Statistics counter assumes this is a guest event being reflected to
3394 * the guest i.e. 'StatInjectPendingReflect' is incremented always.
3395 */
3396DECLINLINE(void) hmR0SvmSetPendingEvent(PVMCPU pVCpu, PSVMEVENT pEvent, RTGCUINTPTR GCPtrFaultAddress)
3397{
3398 Assert(!pVCpu->hm.s.Event.fPending);
3399 Assert(pEvent->n.u1Valid);
3400
3401 pVCpu->hm.s.Event.u64IntInfo = pEvent->u;
3402 pVCpu->hm.s.Event.fPending = true;
3403 pVCpu->hm.s.Event.GCPtrFaultAddress = GCPtrFaultAddress;
3404
3405 Log4Func(("u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u, pEvent->n.u8Vector,
3406 (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
3407}
3408
3409
3410/**
3411 * Sets an invalid-opcode (\#UD) exception as pending-for-injection into the VM.
3412 *
3413 * @param pVCpu The cross context virtual CPU structure.
3414 */
3415DECLINLINE(void) hmR0SvmSetPendingXcptUD(PVMCPU pVCpu)
3416{
3417 SVMEVENT Event;
3418 Event.u = 0;
3419 Event.n.u1Valid = 1;
3420 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3421 Event.n.u8Vector = X86_XCPT_UD;
3422 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3423}
3424
3425
3426/**
3427 * Sets a debug (\#DB) exception as pending-for-injection into the VM.
3428 *
3429 * @param pVCpu The cross context virtual CPU structure.
3430 */
3431DECLINLINE(void) hmR0SvmSetPendingXcptDB(PVMCPU pVCpu)
3432{
3433 SVMEVENT Event;
3434 Event.u = 0;
3435 Event.n.u1Valid = 1;
3436 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3437 Event.n.u8Vector = X86_XCPT_DB;
3438 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3439}
3440
3441
3442/**
3443 * Sets a page fault (\#PF) exception as pending-for-injection into the VM.
3444 *
3445 * @param pVCpu The cross context virtual CPU structure.
3446 * @param pCtx Pointer to the guest-CPU context.
3447 * @param u32ErrCode The error-code for the page-fault.
3448 * @param uFaultAddress The page fault address (CR2).
3449 *
3450 * @remarks This updates the guest CR2 with @a uFaultAddress!
3451 */
3452DECLINLINE(void) hmR0SvmSetPendingXcptPF(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t u32ErrCode, RTGCUINTPTR uFaultAddress)
3453{
3454 SVMEVENT Event;
3455 Event.u = 0;
3456 Event.n.u1Valid = 1;
3457 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3458 Event.n.u8Vector = X86_XCPT_PF;
3459 Event.n.u1ErrorCodeValid = 1;
3460 Event.n.u32ErrorCode = u32ErrCode;
3461
3462 /* Update CR2 of the guest. */
3463 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR2);
3464 if (pCtx->cr2 != uFaultAddress)
3465 {
3466 pCtx->cr2 = uFaultAddress;
3467 /* The VMCB clean bit for CR2 will be updated while re-loading the guest state. */
3468 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR2);
3469 }
3470
3471 hmR0SvmSetPendingEvent(pVCpu, &Event, uFaultAddress);
3472}
3473
3474
3475/**
3476 * Sets a math-fault (\#MF) exception as pending-for-injection into the VM.
3477 *
3478 * @param pVCpu The cross context virtual CPU structure.
3479 */
3480DECLINLINE(void) hmR0SvmSetPendingXcptMF(PVMCPU pVCpu)
3481{
3482 SVMEVENT Event;
3483 Event.u = 0;
3484 Event.n.u1Valid = 1;
3485 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3486 Event.n.u8Vector = X86_XCPT_MF;
3487 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3488}
3489
3490
3491/**
3492 * Sets a double fault (\#DF) exception as pending-for-injection into the VM.
3493 *
3494 * @param pVCpu The cross context virtual CPU structure.
3495 */
3496DECLINLINE(void) hmR0SvmSetPendingXcptDF(PVMCPU pVCpu)
3497{
3498 SVMEVENT Event;
3499 Event.u = 0;
3500 Event.n.u1Valid = 1;
3501 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3502 Event.n.u8Vector = X86_XCPT_DF;
3503 Event.n.u1ErrorCodeValid = 1;
3504 Event.n.u32ErrorCode = 0;
3505 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3506}
3507
3508
3509/**
3510 * Injects an event into the guest upon VMRUN by updating the relevant field
3511 * in the VMCB.
3512 *
3513 * @param pVCpu The cross context virtual CPU structure.
3514 * @param pVmcb Pointer to the guest VM control block.
3515 * @param pEvent Pointer to the event.
3516 *
3517 * @remarks No-long-jump zone!!!
3518 * @remarks Requires CR0!
3519 */
3520DECLINLINE(void) hmR0SvmInjectEventVmcb(PVMCPU pVCpu, PSVMVMCB pVmcb, PSVMEVENT pEvent)
3521{
3522 Assert(!pVmcb->ctrl.EventInject.n.u1Valid);
3523 pVmcb->ctrl.EventInject.u = pEvent->u;
3524 STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[pEvent->n.u8Vector & MASK_INJECT_IRQ_STAT]);
3525 RT_NOREF(pVCpu);
3526
3527 Log4Func(("u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u, pEvent->n.u8Vector,
3528 (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
3529}
3530
3531
3532
3533/**
3534 * Converts any TRPM trap into a pending HM event. This is typically used when
3535 * entering from ring-3 (not longjmp returns).
3536 *
3537 * @param pVCpu The cross context virtual CPU structure.
3538 */
3539static void hmR0SvmTrpmTrapToPendingEvent(PVMCPU pVCpu)
3540{
3541 Assert(TRPMHasTrap(pVCpu));
3542 Assert(!pVCpu->hm.s.Event.fPending);
3543
3544 uint8_t uVector;
3545 TRPMEVENT enmTrpmEvent;
3546 RTGCUINT uErrCode;
3547 RTGCUINTPTR GCPtrFaultAddress;
3548 uint8_t cbInstr;
3549
3550 int rc = TRPMQueryTrapAll(pVCpu, &uVector, &enmTrpmEvent, &uErrCode, &GCPtrFaultAddress, &cbInstr);
3551 AssertRC(rc);
3552
3553 SVMEVENT Event;
3554 Event.u = 0;
3555 Event.n.u1Valid = 1;
3556 Event.n.u8Vector = uVector;
3557
3558 /* Refer AMD spec. 15.20 "Event Injection" for the format. */
3559 if (enmTrpmEvent == TRPM_TRAP)
3560 {
3561 Event.n.u3Type = SVM_EVENT_EXCEPTION;
3562 switch (uVector)
3563 {
3564 case X86_XCPT_NMI:
3565 {
3566 Event.n.u3Type = SVM_EVENT_NMI;
3567 break;
3568 }
3569
3570 case X86_XCPT_PF:
3571 case X86_XCPT_DF:
3572 case X86_XCPT_TS:
3573 case X86_XCPT_NP:
3574 case X86_XCPT_SS:
3575 case X86_XCPT_GP:
3576 case X86_XCPT_AC:
3577 {
3578 Event.n.u1ErrorCodeValid = 1;
3579 Event.n.u32ErrorCode = uErrCode;
3580 break;
3581 }
3582 }
3583 }
3584 else if (enmTrpmEvent == TRPM_HARDWARE_INT)
3585 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
3586 else if (enmTrpmEvent == TRPM_SOFTWARE_INT)
3587 Event.n.u3Type = SVM_EVENT_SOFTWARE_INT;
3588 else
3589 AssertMsgFailed(("Invalid TRPM event type %d\n", enmTrpmEvent));
3590
3591 rc = TRPMResetTrap(pVCpu);
3592 AssertRC(rc);
3593
3594 Log4(("TRPM->HM event: u=%#RX64 u8Vector=%#x uErrorCodeValid=%RTbool uErrorCode=%#RX32\n", Event.u, Event.n.u8Vector,
3595 !!Event.n.u1ErrorCodeValid, Event.n.u32ErrorCode));
3596
3597 hmR0SvmSetPendingEvent(pVCpu, &Event, GCPtrFaultAddress);
3598}
3599
3600
3601/**
3602 * Converts any pending SVM event into a TRPM trap. Typically used when leaving
3603 * AMD-V to execute any instruction.
3604 *
3605 * @param pVCpu The cross context virtual CPU structure.
3606 */
3607static void hmR0SvmPendingEventToTrpmTrap(PVMCPU pVCpu)
3608{
3609 Assert(pVCpu->hm.s.Event.fPending);
3610 Assert(TRPMQueryTrap(pVCpu, NULL /* pu8TrapNo */, NULL /* pEnmType */) == VERR_TRPM_NO_ACTIVE_TRAP);
3611
3612 SVMEVENT Event;
3613 Event.u = pVCpu->hm.s.Event.u64IntInfo;
3614
3615 uint8_t uVector = Event.n.u8Vector;
3616 uint8_t uVectorType = Event.n.u3Type;
3617 TRPMEVENT enmTrapType = HMSvmEventToTrpmEventType(&Event);
3618
3619 Log4(("HM event->TRPM: uVector=%#x enmTrapType=%d\n", uVector, uVectorType));
3620
3621 int rc = TRPMAssertTrap(pVCpu, uVector, enmTrapType);
3622 AssertRC(rc);
3623
3624 if (Event.n.u1ErrorCodeValid)
3625 TRPMSetErrorCode(pVCpu, Event.n.u32ErrorCode);
3626
3627 if ( uVectorType == SVM_EVENT_EXCEPTION
3628 && uVector == X86_XCPT_PF)
3629 {
3630 TRPMSetFaultAddress(pVCpu, pVCpu->hm.s.Event.GCPtrFaultAddress);
3631 Assert(pVCpu->hm.s.Event.GCPtrFaultAddress == CPUMGetGuestCR2(pVCpu));
3632 }
3633 else if (uVectorType == SVM_EVENT_SOFTWARE_INT)
3634 {
3635 AssertMsg( uVectorType == SVM_EVENT_SOFTWARE_INT
3636 || (uVector == X86_XCPT_BP || uVector == X86_XCPT_OF),
3637 ("Invalid vector: uVector=%#x uVectorType=%#x\n", uVector, uVectorType));
3638 TRPMSetInstrLength(pVCpu, pVCpu->hm.s.Event.cbInstr);
3639 }
3640 pVCpu->hm.s.Event.fPending = false;
3641}
3642
3643
3644/**
3645 * Checks if the guest (or nested-guest) has an interrupt shadow active right
3646 * now.
3647 *
3648 * @returns @c true if the interrupt shadow is active, @c false otherwise.
3649 * @param pVCpu The cross context virtual CPU structure.
3650 * @param pCtx Pointer to the guest-CPU context.
3651 *
3652 * @remarks No-long-jump zone!!!
3653 * @remarks Has side-effects with VMCPU_FF_INHIBIT_INTERRUPTS force-flag.
3654 */
3655DECLINLINE(bool) hmR0SvmIsIntrShadowActive(PVMCPU pVCpu, PCCPUMCTX pCtx)
3656{
3657 /*
3658 * Instructions like STI and MOV SS inhibit interrupts till the next instruction
3659 * completes. Check if we should inhibit interrupts or clear any existing
3660 * interrupt inhibition.
3661 */
3662 if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
3663 {
3664 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
3665 {
3666 /*
3667 * We can clear the inhibit force flag as even if we go back to the recompiler
3668 * without executing guest code in AMD-V, the flag's condition to be cleared is
3669 * met and thus the cleared state is correct.
3670 */
3671 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3672 return false;
3673 }
3674 return true;
3675 }
3676 return false;
3677}
3678
3679
3680/**
3681 * Sets the virtual interrupt intercept control in the VMCB.
3682 *
3683 * @param pVCpu The cross context virtual CPU structure.
3684 * @param pVmcb Pointer to the VM control block.
3685 * @param pCtx Pointer to the guest-CPU context.
3686 */
3687DECLINLINE(void) hmR0SvmSetIntWindowExiting(PVMCPU pVCpu, PSVMVMCB pVmcb, PCPUMCTX pCtx)
3688{
3689 /*
3690 * When AVIC isn't supported, set up an interrupt window to cause a #VMEXIT when the guest
3691 * is ready to accept interrupts. At #VMEXIT, we then get the interrupt from the APIC
3692 * (updating ISR at the right time) and inject the interrupt.
3693 *
3694 * With AVIC is supported, we could make use of the asynchronously delivery without
3695 * #VMEXIT and we would be passing the AVIC page to SVM.
3696 *
3697 * In AMD-V, an interrupt window is achieved using a combination of V_IRQ (an interrupt
3698 * is pending), V_IGN_TPR (ignore TPR priorities) and the VINTR intercept all being set.
3699 */
3700#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
3701 /*
3702 * Currently we don't overlay interupt windows and if there's any V_IRQ pending in the
3703 * nested-guest VMCB, we avoid setting up any interrupt window on behalf of the outer
3704 * guest.
3705 */
3706 /** @todo Does this mean we end up prioritizing virtual interrupt
3707 * delivery/window over a physical interrupt (from the outer guest)
3708 * might be pending? */
3709 bool const fEnableIntWindow = !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
3710 if (!fEnableIntWindow)
3711 {
3712 Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx)); RT_NOREF(pCtx);
3713 Log4(("Nested-guest V_IRQ already pending\n"));
3714 }
3715#else
3716 RT_NOREF2(pVCpu, pCtx);
3717 bool const fEnableIntWindow = true;
3718#endif
3719 if (fEnableIntWindow)
3720 {
3721 Assert(pVmcb->ctrl.IntCtrl.n.u1IgnoreTPR);
3722 pVmcb->ctrl.IntCtrl.n.u1VIrqPending = 1;
3723 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INT_CTRL;
3724 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_VINTR);
3725 Log4(("Set VINTR intercept\n"));
3726 }
3727}
3728
3729
3730/**
3731 * Clears the virtual interrupt intercept control in the VMCB as
3732 * we are figured the guest is unable process any interrupts
3733 * at this point of time.
3734 *
3735 * @param pVCpu The cross context virtual CPU structure.
3736 * @param pVmcb Pointer to the VM control block.
3737 * @param pCtx Pointer to the guest-CPU context.
3738 */
3739DECLINLINE(void) hmR0SvmClearIntWindowExiting(PVMCPU pVCpu, PSVMVMCB pVmcb, PCPUMCTX pCtx)
3740{
3741 PSVMVMCBCTRL pVmcbCtrl = &pVmcb->ctrl;
3742 if ( pVmcbCtrl->IntCtrl.n.u1VIrqPending
3743 || (pVmcbCtrl->u64InterceptCtrl & SVM_CTRL_INTERCEPT_VINTR))
3744 {
3745 pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
3746 pVmcbCtrl->u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INT_CTRL;
3747 hmR0SvmClearCtrlIntercept(pVCpu, pCtx, pVmcb, SVM_CTRL_INTERCEPT_VINTR);
3748 Log4(("Cleared VINTR intercept\n"));
3749 }
3750}
3751
3752#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
3753/**
3754 * Evaluates the event to be delivered to the nested-guest and sets it as the
3755 * pending event.
3756 *
3757 * @returns VBox strict status code.
3758 * @param pVCpu The cross context virtual CPU structure.
3759 * @param pCtx Pointer to the guest-CPU context.
3760 */
3761static VBOXSTRICTRC hmR0SvmEvaluatePendingEventNested(PVMCPU pVCpu, PCPUMCTX pCtx)
3762{
3763 HMSVM_ASSERT_IN_NESTED_GUEST(pCtx);
3764 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT
3765 | CPUMCTX_EXTRN_RFLAGS
3766 | CPUMCTX_EXTRN_HM_SVM_INT_SHADOW
3767 | CPUMCTX_EXTRN_HM_SVM_HWVIRT_VIRQ);
3768
3769 Assert(!pVCpu->hm.s.Event.fPending);
3770 Assert(pCtx->hwvirt.fGif);
3771 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
3772 Assert(pVmcb);
3773
3774 bool const fVirtualGif = CPUMGetSvmNstGstVGif(pCtx);
3775 bool const fIntShadow = hmR0SvmIsIntrShadowActive(pVCpu, pCtx);
3776 bool const fBlockNmi = VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS);
3777
3778 Log4Func(("fVirtualGif=%RTbool fBlockNmi=%RTbool fIntShadow=%RTbool fIntPending=%RTbool fNmiPending=%RTbool\n",
3779 fVirtualGif, fBlockNmi, fIntShadow, VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC),
3780 VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NMI)));
3781
3782 /** @todo SMI. SMIs take priority over NMIs. */
3783
3784 /*
3785 * Check if the guest can receive NMIs.
3786 * Nested NMIs are not allowed, see AMD spec. 8.1.4 "Masking External Interrupts".
3787 * NMIs take priority over maskable interrupts, see AMD spec. 8.5 "Priorities".
3788 */
3789 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NMI)
3790 && !fBlockNmi)
3791 {
3792 if ( fVirtualGif
3793 && !fIntShadow)
3794 {
3795 if (CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_NMI))
3796 {
3797 Log4(("Intercepting NMI -> #VMEXIT\n"));
3798 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
3799 return IEMExecSvmVmexit(pVCpu, SVM_EXIT_NMI, 0, 0);
3800 }
3801
3802 Log4(("Setting NMI pending for injection\n"));
3803 SVMEVENT Event;
3804 Event.u = 0;
3805 Event.n.u1Valid = 1;
3806 Event.n.u8Vector = X86_XCPT_NMI;
3807 Event.n.u3Type = SVM_EVENT_NMI;
3808 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3809 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI);
3810 }
3811 else if (!fVirtualGif)
3812 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_STGI);
3813 else
3814 hmR0SvmSetIntWindowExiting(pVCpu, pVmcb, pCtx);
3815 }
3816 /*
3817 * Check if the nested-guest can receive external interrupts (generated by the guest's
3818 * PIC/APIC).
3819 *
3820 * External intercepts, NMI, SMI etc. from the physical CPU are -always- intercepted
3821 * when executing using hardware-assisted SVM, see HMSVM_MANDATORY_GUEST_CTRL_INTERCEPTS.
3822 *
3823 * External interrupts that are generated for the outer guest may be intercepted
3824 * depending on how the nested-guest VMCB was programmed by guest software.
3825 *
3826 * Physical interrupts always take priority over virtual interrupts,
3827 * see AMD spec. 15.21.4 "Injecting Virtual (INTR) Interrupts".
3828 */
3829 else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
3830 && !pVCpu->hm.s.fSingleInstruction)
3831 {
3832 if ( fVirtualGif
3833 && !fIntShadow
3834 && CPUMCanSvmNstGstTakePhysIntr(pVCpu, pCtx))
3835 {
3836 if (CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_INTR))
3837 {
3838 Log4(("Intercepting INTR -> #VMEXIT\n"));
3839 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
3840 return IEMExecSvmVmexit(pVCpu, SVM_EXIT_INTR, 0, 0);
3841 }
3842
3843 uint8_t u8Interrupt;
3844 int rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
3845 if (RT_SUCCESS(rc))
3846 {
3847 Log4(("Setting external interrupt %#x pending for injection\n", u8Interrupt));
3848 SVMEVENT Event;
3849 Event.u = 0;
3850 Event.n.u1Valid = 1;
3851 Event.n.u8Vector = u8Interrupt;
3852 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
3853 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3854 }
3855 else if (rc == VERR_APIC_INTR_MASKED_BY_TPR)
3856 {
3857 /*
3858 * AMD-V has no TPR thresholding feature. TPR and the force-flag will be
3859 * updated eventually when the TPR is written by the guest.
3860 */
3861 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchTprMaskedIrq);
3862 }
3863 else
3864 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
3865 }
3866 else if (!fVirtualGif)
3867 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_STGI);
3868 else
3869 hmR0SvmSetIntWindowExiting(pVCpu, pVmcb, pCtx);
3870 }
3871
3872 return VINF_SUCCESS;
3873}
3874#endif
3875
3876/**
3877 * Evaluates the event to be delivered to the guest and sets it as the pending
3878 * event.
3879 *
3880 * @param pVCpu The cross context virtual CPU structure.
3881 * @param pCtx Pointer to the guest-CPU context.
3882 */
3883static void hmR0SvmEvaluatePendingEvent(PVMCPU pVCpu, PCPUMCTX pCtx)
3884{
3885 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
3886 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT
3887 | CPUMCTX_EXTRN_RFLAGS
3888 | CPUMCTX_EXTRN_HM_SVM_INT_SHADOW);
3889
3890 Assert(!pVCpu->hm.s.Event.fPending);
3891 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
3892 Assert(pVmcb);
3893
3894#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
3895 bool const fGif = pCtx->hwvirt.fGif;
3896#else
3897 bool const fGif = true;
3898#endif
3899 bool const fIntShadow = hmR0SvmIsIntrShadowActive(pVCpu, pCtx);
3900 bool const fBlockInt = !(pCtx->eflags.u32 & X86_EFL_IF);
3901 bool const fBlockNmi = VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS);
3902
3903 Log4Func(("fGif=%RTbool fBlockNmi=%RTbool fBlockInt=%RTbool fIntShadow=%RTbool fIntPending=%RTbool NMI pending=%RTbool\n",
3904 fGif, fBlockNmi, fBlockInt, fIntShadow,
3905 VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC),
3906 VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NMI)));
3907
3908 /** @todo SMI. SMIs take priority over NMIs. */
3909
3910 /*
3911 * Check if the guest can receive NMIs.
3912 * Nested NMIs are not allowed, see AMD spec. 8.1.4 "Masking External Interrupts".
3913 * NMIs take priority over maskable interrupts, see AMD spec. 8.5 "Priorities".
3914 */
3915 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NMI)
3916 && !fBlockNmi)
3917 {
3918 if ( fGif
3919 && !fIntShadow)
3920 {
3921 Log4(("Setting NMI pending for injection\n"));
3922 SVMEVENT Event;
3923 Event.u = 0;
3924 Event.n.u1Valid = 1;
3925 Event.n.u8Vector = X86_XCPT_NMI;
3926 Event.n.u3Type = SVM_EVENT_NMI;
3927 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3928 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI);
3929 }
3930 else if (!fGif)
3931 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_STGI);
3932 else
3933 hmR0SvmSetIntWindowExiting(pVCpu, pVmcb, pCtx);
3934 }
3935 /*
3936 * Check if the guest can receive external interrupts (PIC/APIC). Once PDMGetInterrupt()
3937 * returns a valid interrupt we -must- deliver the interrupt. We can no longer re-request
3938 * it from the APIC device.
3939 */
3940 else if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
3941 && !pVCpu->hm.s.fSingleInstruction)
3942 {
3943 if ( fGif
3944 && !fBlockInt
3945 && !fIntShadow)
3946 {
3947 uint8_t u8Interrupt;
3948 int rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
3949 if (RT_SUCCESS(rc))
3950 {
3951 Log4(("Setting external interrupt %#x pending for injection\n", u8Interrupt));
3952 SVMEVENT Event;
3953 Event.u = 0;
3954 Event.n.u1Valid = 1;
3955 Event.n.u8Vector = u8Interrupt;
3956 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
3957 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
3958 }
3959 else if (rc == VERR_APIC_INTR_MASKED_BY_TPR)
3960 {
3961 /*
3962 * AMD-V has no TPR thresholding feature. TPR and the force-flag will be
3963 * updated eventually when the TPR is written by the guest.
3964 */
3965 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchTprMaskedIrq);
3966 }
3967 else
3968 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
3969 }
3970 else if (!fGif)
3971 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_STGI);
3972 else
3973 hmR0SvmSetIntWindowExiting(pVCpu, pVmcb, pCtx);
3974 }
3975}
3976
3977
3978/**
3979 * Injects any pending events into the guest (or nested-guest).
3980 *
3981 * @param pVCpu The cross context virtual CPU structure.
3982 * @param pCtx Pointer to the guest-CPU context.
3983 * @param pVmcb Pointer to the VM control block.
3984 *
3985 * @remarks Must only be called when we are guaranteed to enter
3986 * hardware-assisted SVM execution and not return to ring-3
3987 * prematurely.
3988 */
3989static void hmR0SvmInjectPendingEvent(PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMVMCB pVmcb)
3990{
3991 Assert(!TRPMHasTrap(pVCpu));
3992 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
3993
3994 bool const fIntShadow = hmR0SvmIsIntrShadowActive(pVCpu, pCtx);
3995#ifdef VBOX_STRICT
3996 bool const fGif = pCtx->hwvirt.fGif;
3997 bool fAllowInt = fGif;
3998 if (fGif)
3999 {
4000 /*
4001 * For nested-guests we have no way to determine if we're injecting a physical or
4002 * virtual interrupt at this point. Hence the partial verification below.
4003 */
4004 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4005 fAllowInt = CPUMCanSvmNstGstTakePhysIntr(pVCpu, pCtx) || CPUMCanSvmNstGstTakeVirtIntr(pVCpu, pCtx);
4006 else
4007 fAllowInt = RT_BOOL(pCtx->eflags.u32 & X86_EFL_IF);
4008 }
4009#endif
4010
4011 if (pVCpu->hm.s.Event.fPending)
4012 {
4013 SVMEVENT Event;
4014 Event.u = pVCpu->hm.s.Event.u64IntInfo;
4015 Assert(Event.n.u1Valid);
4016
4017 /*
4018 * Validate event injection pre-conditions.
4019 */
4020 if (Event.n.u3Type == SVM_EVENT_EXTERNAL_IRQ)
4021 {
4022 Assert(fAllowInt);
4023 Assert(!fIntShadow);
4024 }
4025 else if (Event.n.u3Type == SVM_EVENT_NMI)
4026 {
4027 Assert(fGif);
4028 Assert(!fIntShadow);
4029 }
4030
4031 /*
4032 * Before injecting an NMI we must set VMCPU_FF_BLOCK_NMIS to prevent nested NMIs. We
4033 * do this only when we are surely going to inject the NMI as otherwise if we return
4034 * to ring-3 prematurely we could leave NMIs blocked indefinitely upon re-entry into
4035 * SVM R0.
4036 *
4037 * With VT-x, this is handled by the Guest interruptibility information VMCS field
4038 * which will set the VMCS field after actually delivering the NMI which we read on
4039 * VM-exit to determine the state.
4040 */
4041 if ( Event.n.u3Type == SVM_EVENT_NMI
4042 && Event.n.u8Vector == X86_XCPT_NMI
4043 && !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
4044 {
4045 VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
4046 }
4047
4048 /*
4049 * Inject it (update VMCB for injection by the hardware).
4050 */
4051 Log4(("Injecting pending HM event\n"));
4052 hmR0SvmInjectEventVmcb(pVCpu, pVmcb, &Event);
4053 pVCpu->hm.s.Event.fPending = false;
4054
4055 if (Event.n.u3Type == SVM_EVENT_EXTERNAL_IRQ)
4056 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectInterrupt);
4057 else
4058 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectXcpt);
4059 }
4060 else
4061 Assert(pVmcb->ctrl.EventInject.n.u1Valid == 0);
4062
4063 /*
4064 * We could have injected an NMI through IEM and continue guest execution using
4065 * hardware-assisted SVM. In which case, we would not have any events pending (above)
4066 * but we still need to intercept IRET in order to eventually clear NMI inhibition.
4067 */
4068 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
4069 hmR0SvmSetCtrlIntercept(pVmcb, SVM_CTRL_INTERCEPT_IRET);
4070
4071 /*
4072 * Update the guest interrupt shadow in the guest (or nested-guest) VMCB.
4073 *
4074 * For nested-guests: We need to update it too for the scenario where IEM executes
4075 * the nested-guest but execution later continues here with an interrupt shadow active.
4076 */
4077 pVmcb->ctrl.IntShadow.n.u1IntShadow = fIntShadow;
4078}
4079
4080
4081/**
4082 * Reports world-switch error and dumps some useful debug info.
4083 *
4084 * @param pVM The cross context VM structure.
4085 * @param pVCpu The cross context virtual CPU structure.
4086 * @param rcVMRun The return code from VMRUN (or
4087 * VERR_SVM_INVALID_GUEST_STATE for invalid
4088 * guest-state).
4089 * @param pCtx Pointer to the guest-CPU context.
4090 */
4091static void hmR0SvmReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rcVMRun, PCPUMCTX pCtx)
4092{
4093 NOREF(pCtx);
4094 HMSVM_ASSERT_PREEMPT_SAFE();
4095 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
4096 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
4097
4098 PCSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
4099 if (rcVMRun == VERR_SVM_INVALID_GUEST_STATE)
4100 {
4101 hmR0DumpRegs(pVM, pVCpu, pCtx); NOREF(pVM);
4102 /** @todo We probably don't need to dump this anymore or we can expand
4103 * hmR0DumpRegs()? */
4104#ifdef VBOX_STRICT
4105 Log4(("ctrl.u32VmcbCleanBits %#RX32\n", pVmcb->ctrl.u32VmcbCleanBits));
4106 Log4(("ctrl.u16InterceptRdCRx %#x\n", pVmcb->ctrl.u16InterceptRdCRx));
4107 Log4(("ctrl.u16InterceptWrCRx %#x\n", pVmcb->ctrl.u16InterceptWrCRx));
4108 Log4(("ctrl.u16InterceptRdDRx %#x\n", pVmcb->ctrl.u16InterceptRdDRx));
4109 Log4(("ctrl.u16InterceptWrDRx %#x\n", pVmcb->ctrl.u16InterceptWrDRx));
4110 Log4(("ctrl.u32InterceptXcpt %#x\n", pVmcb->ctrl.u32InterceptXcpt));
4111 Log4(("ctrl.u64InterceptCtrl %#RX64\n", pVmcb->ctrl.u64InterceptCtrl));
4112 Log4(("ctrl.u64IOPMPhysAddr %#RX64\n", pVmcb->ctrl.u64IOPMPhysAddr));
4113 Log4(("ctrl.u64MSRPMPhysAddr %#RX64\n", pVmcb->ctrl.u64MSRPMPhysAddr));
4114 Log4(("ctrl.u64TSCOffset %#RX64\n", pVmcb->ctrl.u64TSCOffset));
4115
4116 Log4(("ctrl.TLBCtrl.u32ASID %#x\n", pVmcb->ctrl.TLBCtrl.n.u32ASID));
4117 Log4(("ctrl.TLBCtrl.u8TLBFlush %#x\n", pVmcb->ctrl.TLBCtrl.n.u8TLBFlush));
4118 Log4(("ctrl.TLBCtrl.u24Reserved %#x\n", pVmcb->ctrl.TLBCtrl.n.u24Reserved));
4119
4120 Log4(("ctrl.IntCtrl.u8VTPR %#x\n", pVmcb->ctrl.IntCtrl.n.u8VTPR));
4121 Log4(("ctrl.IntCtrl.u1VIrqPending %#x\n", pVmcb->ctrl.IntCtrl.n.u1VIrqPending));
4122 Log4(("ctrl.IntCtrl.u1VGif %#x\n", pVmcb->ctrl.IntCtrl.n.u1VGif));
4123 Log4(("ctrl.IntCtrl.u6Reserved0 %#x\n", pVmcb->ctrl.IntCtrl.n.u6Reserved));
4124 Log4(("ctrl.IntCtrl.u4VIntrPrio %#x\n", pVmcb->ctrl.IntCtrl.n.u4VIntrPrio));
4125 Log4(("ctrl.IntCtrl.u1IgnoreTPR %#x\n", pVmcb->ctrl.IntCtrl.n.u1IgnoreTPR));
4126 Log4(("ctrl.IntCtrl.u3Reserved %#x\n", pVmcb->ctrl.IntCtrl.n.u3Reserved));
4127 Log4(("ctrl.IntCtrl.u1VIntrMasking %#x\n", pVmcb->ctrl.IntCtrl.n.u1VIntrMasking));
4128 Log4(("ctrl.IntCtrl.u1VGifEnable %#x\n", pVmcb->ctrl.IntCtrl.n.u1VGifEnable));
4129 Log4(("ctrl.IntCtrl.u5Reserved1 %#x\n", pVmcb->ctrl.IntCtrl.n.u5Reserved));
4130 Log4(("ctrl.IntCtrl.u8VIntrVector %#x\n", pVmcb->ctrl.IntCtrl.n.u8VIntrVector));
4131 Log4(("ctrl.IntCtrl.u24Reserved %#x\n", pVmcb->ctrl.IntCtrl.n.u24Reserved));
4132
4133 Log4(("ctrl.IntShadow.u1IntShadow %#x\n", pVmcb->ctrl.IntShadow.n.u1IntShadow));
4134 Log4(("ctrl.IntShadow.u1GuestIntMask %#x\n", pVmcb->ctrl.IntShadow.n.u1GuestIntMask));
4135 Log4(("ctrl.u64ExitCode %#RX64\n", pVmcb->ctrl.u64ExitCode));
4136 Log4(("ctrl.u64ExitInfo1 %#RX64\n", pVmcb->ctrl.u64ExitInfo1));
4137 Log4(("ctrl.u64ExitInfo2 %#RX64\n", pVmcb->ctrl.u64ExitInfo2));
4138 Log4(("ctrl.ExitIntInfo.u8Vector %#x\n", pVmcb->ctrl.ExitIntInfo.n.u8Vector));
4139 Log4(("ctrl.ExitIntInfo.u3Type %#x\n", pVmcb->ctrl.ExitIntInfo.n.u3Type));
4140 Log4(("ctrl.ExitIntInfo.u1ErrorCodeValid %#x\n", pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
4141 Log4(("ctrl.ExitIntInfo.u19Reserved %#x\n", pVmcb->ctrl.ExitIntInfo.n.u19Reserved));
4142 Log4(("ctrl.ExitIntInfo.u1Valid %#x\n", pVmcb->ctrl.ExitIntInfo.n.u1Valid));
4143 Log4(("ctrl.ExitIntInfo.u32ErrorCode %#x\n", pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode));
4144 Log4(("ctrl.NestedPagingCtrl.u1NestedPaging %#x\n", pVmcb->ctrl.NestedPagingCtrl.n.u1NestedPaging));
4145 Log4(("ctrl.NestedPagingCtrl.u1Sev %#x\n", pVmcb->ctrl.NestedPagingCtrl.n.u1Sev));
4146 Log4(("ctrl.NestedPagingCtrl.u1SevEs %#x\n", pVmcb->ctrl.NestedPagingCtrl.n.u1SevEs));
4147 Log4(("ctrl.EventInject.u8Vector %#x\n", pVmcb->ctrl.EventInject.n.u8Vector));
4148 Log4(("ctrl.EventInject.u3Type %#x\n", pVmcb->ctrl.EventInject.n.u3Type));
4149 Log4(("ctrl.EventInject.u1ErrorCodeValid %#x\n", pVmcb->ctrl.EventInject.n.u1ErrorCodeValid));
4150 Log4(("ctrl.EventInject.u19Reserved %#x\n", pVmcb->ctrl.EventInject.n.u19Reserved));
4151 Log4(("ctrl.EventInject.u1Valid %#x\n", pVmcb->ctrl.EventInject.n.u1Valid));
4152 Log4(("ctrl.EventInject.u32ErrorCode %#x\n", pVmcb->ctrl.EventInject.n.u32ErrorCode));
4153
4154 Log4(("ctrl.u64NestedPagingCR3 %#RX64\n", pVmcb->ctrl.u64NestedPagingCR3));
4155
4156 Log4(("ctrl.LbrVirt.u1LbrVirt %#x\n", pVmcb->ctrl.LbrVirt.n.u1LbrVirt));
4157 Log4(("ctrl.LbrVirt.u1VirtVmsaveVmload %#x\n", pVmcb->ctrl.LbrVirt.n.u1VirtVmsaveVmload));
4158
4159 Log4(("guest.CS.u16Sel %RTsel\n", pVmcb->guest.CS.u16Sel));
4160 Log4(("guest.CS.u16Attr %#x\n", pVmcb->guest.CS.u16Attr));
4161 Log4(("guest.CS.u32Limit %#RX32\n", pVmcb->guest.CS.u32Limit));
4162 Log4(("guest.CS.u64Base %#RX64\n", pVmcb->guest.CS.u64Base));
4163 Log4(("guest.DS.u16Sel %#RTsel\n", pVmcb->guest.DS.u16Sel));
4164 Log4(("guest.DS.u16Attr %#x\n", pVmcb->guest.DS.u16Attr));
4165 Log4(("guest.DS.u32Limit %#RX32\n", pVmcb->guest.DS.u32Limit));
4166 Log4(("guest.DS.u64Base %#RX64\n", pVmcb->guest.DS.u64Base));
4167 Log4(("guest.ES.u16Sel %RTsel\n", pVmcb->guest.ES.u16Sel));
4168 Log4(("guest.ES.u16Attr %#x\n", pVmcb->guest.ES.u16Attr));
4169 Log4(("guest.ES.u32Limit %#RX32\n", pVmcb->guest.ES.u32Limit));
4170 Log4(("guest.ES.u64Base %#RX64\n", pVmcb->guest.ES.u64Base));
4171 Log4(("guest.FS.u16Sel %RTsel\n", pVmcb->guest.FS.u16Sel));
4172 Log4(("guest.FS.u16Attr %#x\n", pVmcb->guest.FS.u16Attr));
4173 Log4(("guest.FS.u32Limit %#RX32\n", pVmcb->guest.FS.u32Limit));
4174 Log4(("guest.FS.u64Base %#RX64\n", pVmcb->guest.FS.u64Base));
4175 Log4(("guest.GS.u16Sel %RTsel\n", pVmcb->guest.GS.u16Sel));
4176 Log4(("guest.GS.u16Attr %#x\n", pVmcb->guest.GS.u16Attr));
4177 Log4(("guest.GS.u32Limit %#RX32\n", pVmcb->guest.GS.u32Limit));
4178 Log4(("guest.GS.u64Base %#RX64\n", pVmcb->guest.GS.u64Base));
4179
4180 Log4(("guest.GDTR.u32Limit %#RX32\n", pVmcb->guest.GDTR.u32Limit));
4181 Log4(("guest.GDTR.u64Base %#RX64\n", pVmcb->guest.GDTR.u64Base));
4182
4183 Log4(("guest.LDTR.u16Sel %RTsel\n", pVmcb->guest.LDTR.u16Sel));
4184 Log4(("guest.LDTR.u16Attr %#x\n", pVmcb->guest.LDTR.u16Attr));
4185 Log4(("guest.LDTR.u32Limit %#RX32\n", pVmcb->guest.LDTR.u32Limit));
4186 Log4(("guest.LDTR.u64Base %#RX64\n", pVmcb->guest.LDTR.u64Base));
4187
4188 Log4(("guest.IDTR.u32Limit %#RX32\n", pVmcb->guest.IDTR.u32Limit));
4189 Log4(("guest.IDTR.u64Base %#RX64\n", pVmcb->guest.IDTR.u64Base));
4190
4191 Log4(("guest.TR.u16Sel %RTsel\n", pVmcb->guest.TR.u16Sel));
4192 Log4(("guest.TR.u16Attr %#x\n", pVmcb->guest.TR.u16Attr));
4193 Log4(("guest.TR.u32Limit %#RX32\n", pVmcb->guest.TR.u32Limit));
4194 Log4(("guest.TR.u64Base %#RX64\n", pVmcb->guest.TR.u64Base));
4195
4196 Log4(("guest.u8CPL %#x\n", pVmcb->guest.u8CPL));
4197 Log4(("guest.u64CR0 %#RX64\n", pVmcb->guest.u64CR0));
4198 Log4(("guest.u64CR2 %#RX64\n", pVmcb->guest.u64CR2));
4199 Log4(("guest.u64CR3 %#RX64\n", pVmcb->guest.u64CR3));
4200 Log4(("guest.u64CR4 %#RX64\n", pVmcb->guest.u64CR4));
4201 Log4(("guest.u64DR6 %#RX64\n", pVmcb->guest.u64DR6));
4202 Log4(("guest.u64DR7 %#RX64\n", pVmcb->guest.u64DR7));
4203
4204 Log4(("guest.u64RIP %#RX64\n", pVmcb->guest.u64RIP));
4205 Log4(("guest.u64RSP %#RX64\n", pVmcb->guest.u64RSP));
4206 Log4(("guest.u64RAX %#RX64\n", pVmcb->guest.u64RAX));
4207 Log4(("guest.u64RFlags %#RX64\n", pVmcb->guest.u64RFlags));
4208
4209 Log4(("guest.u64SysEnterCS %#RX64\n", pVmcb->guest.u64SysEnterCS));
4210 Log4(("guest.u64SysEnterEIP %#RX64\n", pVmcb->guest.u64SysEnterEIP));
4211 Log4(("guest.u64SysEnterESP %#RX64\n", pVmcb->guest.u64SysEnterESP));
4212
4213 Log4(("guest.u64EFER %#RX64\n", pVmcb->guest.u64EFER));
4214 Log4(("guest.u64STAR %#RX64\n", pVmcb->guest.u64STAR));
4215 Log4(("guest.u64LSTAR %#RX64\n", pVmcb->guest.u64LSTAR));
4216 Log4(("guest.u64CSTAR %#RX64\n", pVmcb->guest.u64CSTAR));
4217 Log4(("guest.u64SFMASK %#RX64\n", pVmcb->guest.u64SFMASK));
4218 Log4(("guest.u64KernelGSBase %#RX64\n", pVmcb->guest.u64KernelGSBase));
4219 Log4(("guest.u64PAT %#RX64\n", pVmcb->guest.u64PAT));
4220 Log4(("guest.u64DBGCTL %#RX64\n", pVmcb->guest.u64DBGCTL));
4221 Log4(("guest.u64BR_FROM %#RX64\n", pVmcb->guest.u64BR_FROM));
4222 Log4(("guest.u64BR_TO %#RX64\n", pVmcb->guest.u64BR_TO));
4223 Log4(("guest.u64LASTEXCPFROM %#RX64\n", pVmcb->guest.u64LASTEXCPFROM));
4224 Log4(("guest.u64LASTEXCPTO %#RX64\n", pVmcb->guest.u64LASTEXCPTO));
4225#endif /* VBOX_STRICT */
4226 }
4227 else
4228 Log4Func(("rcVMRun=%d\n", rcVMRun));
4229
4230 NOREF(pVmcb);
4231}
4232
4233
4234/**
4235 * Check per-VM and per-VCPU force flag actions that require us to go back to
4236 * ring-3 for one reason or another.
4237 *
4238 * @returns VBox status code (information status code included).
4239 * @retval VINF_SUCCESS if we don't have any actions that require going back to
4240 * ring-3.
4241 * @retval VINF_PGM_SYNC_CR3 if we have pending PGM CR3 sync.
4242 * @retval VINF_EM_PENDING_REQUEST if we have pending requests (like hardware
4243 * interrupts)
4244 * @retval VINF_PGM_POOL_FLUSH_PENDING if PGM is doing a pool flush and requires
4245 * all EMTs to be in ring-3.
4246 * @retval VINF_EM_RAW_TO_R3 if there is pending DMA requests.
4247 * @retval VINF_EM_NO_MEMORY PGM is out of memory, we need to return
4248 * to the EM loop.
4249 *
4250 * @param pVM The cross context VM structure.
4251 * @param pVCpu The cross context virtual CPU structure.
4252 * @param pCtx Pointer to the guest-CPU context.
4253 */
4254static int hmR0SvmCheckForceFlags(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
4255{
4256 Assert(VMMRZCallRing3IsEnabled(pVCpu));
4257 Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
4258
4259 /* Could happen as a result of longjump. */
4260 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3))
4261 PGMUpdateCR3(pVCpu, CPUMGetGuestCR3(pVCpu));
4262
4263 /* Update pending interrupts into the APIC's IRR. */
4264 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_UPDATE_APIC))
4265 APICUpdatePendingInterrupts(pVCpu);
4266
4267 if ( VM_FF_IS_PENDING(pVM, !pVCpu->hm.s.fSingleInstruction
4268 ? VM_FF_HP_R0_PRE_HM_MASK : VM_FF_HP_R0_PRE_HM_STEP_MASK)
4269 || VMCPU_FF_IS_PENDING(pVCpu, !pVCpu->hm.s.fSingleInstruction
4270 ? VMCPU_FF_HP_R0_PRE_HM_MASK : VMCPU_FF_HP_R0_PRE_HM_STEP_MASK) )
4271 {
4272 /* Pending PGM C3 sync. */
4273 if (VMCPU_FF_IS_PENDING(pVCpu,VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
4274 {
4275 int rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
4276 if (rc != VINF_SUCCESS)
4277 {
4278 Log4Func(("PGMSyncCR3 forcing us back to ring-3. rc=%d\n", rc));
4279 return rc;
4280 }
4281 }
4282
4283 /* Pending HM-to-R3 operations (critsects, timers, EMT rendezvous etc.) */
4284 /* -XXX- what was that about single stepping? */
4285 if ( VM_FF_IS_PENDING(pVM, VM_FF_HM_TO_R3_MASK)
4286 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
4287 {
4288 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
4289 int rc = RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
4290 Log4Func(("HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc));
4291 return rc;
4292 }
4293
4294 /* Pending VM request packets, such as hardware interrupts. */
4295 if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
4296 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
4297 {
4298 Log4Func(("Pending VM request forcing us back to ring-3\n"));
4299 return VINF_EM_PENDING_REQUEST;
4300 }
4301
4302 /* Pending PGM pool flushes. */
4303 if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
4304 {
4305 Log4Func(("PGM pool flush pending forcing us back to ring-3\n"));
4306 return VINF_PGM_POOL_FLUSH_PENDING;
4307 }
4308
4309 /* Pending DMA requests. */
4310 if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
4311 {
4312 Log4Func(("Pending DMA request forcing us back to ring-3\n"));
4313 return VINF_EM_RAW_TO_R3;
4314 }
4315 }
4316
4317 return VINF_SUCCESS;
4318}
4319
4320
4321#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
4322/**
4323 * Does the preparations before executing nested-guest code in AMD-V.
4324 *
4325 * @returns VBox status code (informational status codes included).
4326 * @retval VINF_SUCCESS if we can proceed with running the guest.
4327 * @retval VINF_* scheduling changes, we have to go back to ring-3.
4328 *
4329 * @param pVM The cross context VM structure.
4330 * @param pVCpu The cross context virtual CPU structure.
4331 * @param pCtx Pointer to the nested-guest-CPU context.
4332 * @param pSvmTransient Pointer to the SVM transient structure.
4333 *
4334 * @remarks Same caveats regarding longjumps as hmR0SvmPreRunGuest applies.
4335 * @sa hmR0SvmPreRunGuest.
4336 */
4337static int hmR0SvmPreRunGuestNested(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
4338{
4339 HMSVM_ASSERT_PREEMPT_SAFE();
4340 HMSVM_ASSERT_IN_NESTED_GUEST(pCtx);
4341
4342#ifdef VBOX_WITH_NESTED_HWVIRT_SVM_ONLY_IN_IEM
4343 Log2(("hmR0SvmPreRunGuest: Rescheduling to IEM due to nested-hwvirt or forced IEM exec -> VINF_EM_RESCHEDULE_REM\n"));
4344 return VINF_EM_RESCHEDULE_REM;
4345#endif
4346
4347 /* Check force flag actions that might require us to go back to ring-3. */
4348 int rc = hmR0SvmCheckForceFlags(pVM, pVCpu, pCtx);
4349 if (rc != VINF_SUCCESS)
4350 return rc;
4351
4352 if (TRPMHasTrap(pVCpu))
4353 hmR0SvmTrpmTrapToPendingEvent(pVCpu);
4354 else if (!pVCpu->hm.s.Event.fPending)
4355 {
4356 VBOXSTRICTRC rcStrict = hmR0SvmEvaluatePendingEventNested(pVCpu, pCtx);
4357 if ( rcStrict != VINF_SUCCESS
4358 || !CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4359 return VBOXSTRICTRC_VAL(rcStrict);
4360 }
4361
4362 HMSVM_ASSERT_IN_NESTED_GUEST(pCtx);
4363
4364 /*
4365 * On the oldest AMD-V systems, we may not get enough information to reinject an NMI.
4366 * Just do it in software, see @bugref{8411}.
4367 * NB: If we could continue a task switch exit we wouldn't need to do this.
4368 */
4369 if (RT_UNLIKELY( !pVM->hm.s.svm.u32Features
4370 && pVCpu->hm.s.Event.fPending
4371 && SVM_EVENT_GET_TYPE(pVCpu->hm.s.Event.u64IntInfo) == SVM_EVENT_NMI))
4372 {
4373 return VINF_EM_RAW_INJECT_TRPM_EVENT;
4374 }
4375
4376#ifdef HMSVM_SYNC_FULL_NESTED_GUEST_STATE
4377 Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
4378 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
4379#endif
4380
4381 /*
4382 * Export the nested-guest state bits that are not shared with the host in any way as we
4383 * can longjmp or get preempted in the midst of exporting some of the state.
4384 */
4385 rc = hmR0SvmExportGuestStateNested(pVCpu);
4386 AssertRCReturn(rc, rc);
4387 STAM_COUNTER_INC(&pVCpu->hm.s.StatExportFull);
4388
4389 /* Ensure we've cached (and hopefully modified) the VMCB for execution using hardware-assisted SVM. */
4390 Assert(pVCpu->hm.s.svm.NstGstVmcbCache.fCacheValid);
4391
4392 /*
4393 * No longjmps to ring-3 from this point on!!!
4394 *
4395 * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
4396 * better than a kernel panic. This also disables flushing of the R0-logger instance.
4397 */
4398 VMMRZCallRing3Disable(pVCpu);
4399
4400 /*
4401 * We disable interrupts so that we don't miss any interrupts that would flag preemption
4402 * (IPI/timers etc.) when thread-context hooks aren't used and we've been running with
4403 * preemption disabled for a while. Since this is purly to aid the
4404 * RTThreadPreemptIsPending() code, it doesn't matter that it may temporarily reenable and
4405 * disable interrupt on NT.
4406 *
4407 * We need to check for force-flags that could've possible been altered since we last
4408 * checked them (e.g. by PDMGetInterrupt() leaving the PDM critical section,
4409 * see @bugref{6398}).
4410 *
4411 * We also check a couple of other force-flags as a last opportunity to get the EMT back
4412 * to ring-3 before executing guest code.
4413 */
4414 pSvmTransient->fEFlags = ASMIntDisableFlags();
4415 if ( VM_FF_IS_PENDING(pVM, VM_FF_EMT_RENDEZVOUS | VM_FF_TM_VIRTUAL_SYNC)
4416 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
4417 {
4418 ASMSetFlags(pSvmTransient->fEFlags);
4419 VMMRZCallRing3Enable(pVCpu);
4420 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
4421 return VINF_EM_RAW_TO_R3;
4422 }
4423 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
4424 {
4425 ASMSetFlags(pSvmTransient->fEFlags);
4426 VMMRZCallRing3Enable(pVCpu);
4427 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
4428 return VINF_EM_RAW_INTERRUPT;
4429 }
4430 return VINF_SUCCESS;
4431}
4432#endif
4433
4434
4435/**
4436 * Does the preparations before executing guest code in AMD-V.
4437 *
4438 * This may cause longjmps to ring-3 and may even result in rescheduling to the
4439 * recompiler. We must be cautious what we do here regarding committing
4440 * guest-state information into the VMCB assuming we assuredly execute the guest
4441 * in AMD-V. If we fall back to the recompiler after updating the VMCB and
4442 * clearing the common-state (TRPM/forceflags), we must undo those changes so
4443 * that the recompiler can (and should) use them when it resumes guest
4444 * execution. Otherwise such operations must be done when we can no longer
4445 * exit to ring-3.
4446 *
4447 * @returns VBox status code (informational status codes included).
4448 * @retval VINF_SUCCESS if we can proceed with running the guest.
4449 * @retval VINF_* scheduling changes, we have to go back to ring-3.
4450 *
4451 * @param pVM The cross context VM structure.
4452 * @param pVCpu The cross context virtual CPU structure.
4453 * @param pCtx Pointer to the guest-CPU context.
4454 * @param pSvmTransient Pointer to the SVM transient structure.
4455 */
4456static int hmR0SvmPreRunGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
4457{
4458 HMSVM_ASSERT_PREEMPT_SAFE();
4459 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
4460
4461 /* Check force flag actions that might require us to go back to ring-3. */
4462 int rc = hmR0SvmCheckForceFlags(pVM, pVCpu, pCtx);
4463 if (rc != VINF_SUCCESS)
4464 return rc;
4465
4466 if (TRPMHasTrap(pVCpu))
4467 hmR0SvmTrpmTrapToPendingEvent(pVCpu);
4468 else if (!pVCpu->hm.s.Event.fPending)
4469 hmR0SvmEvaluatePendingEvent(pVCpu, pCtx);
4470
4471 /*
4472 * On the oldest AMD-V systems, we may not get enough information to reinject an NMI.
4473 * Just do it in software, see @bugref{8411}.
4474 * NB: If we could continue a task switch exit we wouldn't need to do this.
4475 */
4476 if (RT_UNLIKELY(pVCpu->hm.s.Event.fPending && (((pVCpu->hm.s.Event.u64IntInfo >> 8) & 7) == SVM_EVENT_NMI)))
4477 if (RT_UNLIKELY(!pVM->hm.s.svm.u32Features))
4478 return VINF_EM_RAW_INJECT_TRPM_EVENT;
4479
4480#ifdef HMSVM_SYNC_FULL_GUEST_STATE
4481 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4482 {
4483 Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
4484 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
4485 }
4486#endif
4487#ifdef HMSVM_SYNC_FULL_NESTED_GUEST_STATE
4488 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4489 {
4490 Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
4491 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
4492 }
4493#endif
4494
4495 /*
4496 * Export the guest state bits that are not shared with the host in any way as we can
4497 * longjmp or get preempted in the midst of exporting some of the state.
4498 */
4499 rc = hmR0SvmExportGuestState(pVCpu);
4500 AssertRCReturn(rc, rc);
4501 STAM_COUNTER_INC(&pVCpu->hm.s.StatExportFull);
4502
4503 /*
4504 * If we're not intercepting TPR changes in the guest, save the guest TPR before the
4505 * world-switch so we can update it on the way back if the guest changed the TPR.
4506 */
4507 if (pVCpu->hm.s.svm.fSyncVTpr)
4508 {
4509 PCSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
4510 if (pVM->hm.s.fTPRPatchingActive)
4511 pSvmTransient->u8GuestTpr = pVmcb->guest.u64LSTAR;
4512 else
4513 pSvmTransient->u8GuestTpr = pVmcb->ctrl.IntCtrl.n.u8VTPR;
4514 }
4515
4516 /*
4517 * No longjmps to ring-3 from this point on!!!
4518 *
4519 * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
4520 * better than a kernel panic. This also disables flushing of the R0-logger instance.
4521 */
4522 VMMRZCallRing3Disable(pVCpu);
4523
4524 /*
4525 * We disable interrupts so that we don't miss any interrupts that would flag preemption
4526 * (IPI/timers etc.) when thread-context hooks aren't used and we've been running with
4527 * preemption disabled for a while. Since this is purly to aid the
4528 * RTThreadPreemptIsPending() code, it doesn't matter that it may temporarily reenable and
4529 * disable interrupt on NT.
4530 *
4531 * We need to check for force-flags that could've possible been altered since we last
4532 * checked them (e.g. by PDMGetInterrupt() leaving the PDM critical section,
4533 * see @bugref{6398}).
4534 *
4535 * We also check a couple of other force-flags as a last opportunity to get the EMT back
4536 * to ring-3 before executing guest code.
4537 */
4538 pSvmTransient->fEFlags = ASMIntDisableFlags();
4539 if ( VM_FF_IS_PENDING(pVM, VM_FF_EMT_RENDEZVOUS | VM_FF_TM_VIRTUAL_SYNC)
4540 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
4541 {
4542 ASMSetFlags(pSvmTransient->fEFlags);
4543 VMMRZCallRing3Enable(pVCpu);
4544 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
4545 return VINF_EM_RAW_TO_R3;
4546 }
4547 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
4548 {
4549 ASMSetFlags(pSvmTransient->fEFlags);
4550 VMMRZCallRing3Enable(pVCpu);
4551 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
4552 return VINF_EM_RAW_INTERRUPT;
4553 }
4554
4555 return VINF_SUCCESS;
4556}
4557
4558
4559/**
4560 * Prepares to run guest (or nested-guest) code in AMD-V and we've committed to
4561 * doing so.
4562 *
4563 * This means there is no backing out to ring-3 or anywhere else at this point.
4564 *
4565 * @param pVCpu The cross context virtual CPU structure.
4566 * @param pCtx Pointer to the guest-CPU context.
4567 * @param pSvmTransient Pointer to the SVM transient structure.
4568 *
4569 * @remarks Called with preemption disabled.
4570 * @remarks No-long-jump zone!!!
4571 */
4572static void hmR0SvmPreRunGuestCommitted(PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
4573{
4574 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
4575 Assert(VMMR0IsLogFlushDisabled(pVCpu));
4576 Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
4577
4578 VMCPU_ASSERT_STATE(pVCpu, VMCPUSTATE_STARTED_HM);
4579 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC); /* Indicate the start of guest execution. */
4580
4581 PVM pVM = pVCpu->CTX_SUFF(pVM);
4582 PSVMVMCB pVmcb = pSvmTransient->pVmcb;
4583
4584 hmR0SvmInjectPendingEvent(pVCpu, pCtx, pVmcb);
4585
4586 if (!CPUMIsGuestFPUStateActive(pVCpu))
4587 {
4588 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestFpuState, x);
4589 CPUMR0LoadGuestFPU(pVM, pVCpu); /* (Ignore rc, no need to set HM_CHANGED_HOST_CONTEXT for SVM.) */
4590 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestFpuState, x);
4591 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadGuestFpu);
4592 }
4593
4594 /* Load the state shared between host and guest (FPU, debug). */
4595 if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)
4596 hmR0SvmExportSharedState(pVCpu, pVmcb);
4597
4598 pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_HOST_CONTEXT; /* Preemption might set this, nothing to do on AMD-V. */
4599 AssertMsg(!pVCpu->hm.s.fCtxChanged, ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
4600
4601 PHMGLOBALCPUINFO pHostCpu = hmR0GetCurrentCpu();
4602 RTCPUID const idHostCpu = pHostCpu->idCpu;
4603 bool const fMigratedHostCpu = idHostCpu != pVCpu->hm.s.idLastCpu;
4604
4605 /* Setup TSC offsetting. */
4606 if ( pSvmTransient->fUpdateTscOffsetting
4607 || fMigratedHostCpu)
4608 {
4609 hmR0SvmUpdateTscOffsetting(pVM, pVCpu, pCtx, pVmcb);
4610 pSvmTransient->fUpdateTscOffsetting = false;
4611 }
4612
4613 /* If we've migrating CPUs, mark the VMCB Clean bits as dirty. */
4614 if (fMigratedHostCpu)
4615 pVmcb->ctrl.u32VmcbCleanBits = 0;
4616
4617 /* Store status of the shared guest-host state at the time of VMRUN. */
4618#if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
4619 if (CPUMIsGuestInLongModeEx(pCtx))
4620 {
4621 pSvmTransient->fWasGuestDebugStateActive = CPUMIsGuestDebugStateActivePending(pVCpu);
4622 pSvmTransient->fWasHyperDebugStateActive = CPUMIsHyperDebugStateActivePending(pVCpu);
4623 }
4624 else
4625#endif
4626 {
4627 pSvmTransient->fWasGuestDebugStateActive = CPUMIsGuestDebugStateActive(pVCpu);
4628 pSvmTransient->fWasHyperDebugStateActive = CPUMIsHyperDebugStateActive(pVCpu);
4629 }
4630
4631#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
4632 uint8_t *pbMsrBitmap;
4633 if (!pSvmTransient->fIsNestedGuest)
4634 pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
4635 else
4636 {
4637 hmR0SvmMergeMsrpmNested(pHostCpu, pVCpu, pCtx);
4638
4639 /* Update the nested-guest VMCB with the newly merged MSRPM (clean bits updated below). */
4640 pVmcb->ctrl.u64MSRPMPhysAddr = pHostCpu->n.svm.HCPhysNstGstMsrpm;
4641 pbMsrBitmap = (uint8_t *)pHostCpu->n.svm.pvNstGstMsrpm;
4642 }
4643#else
4644 uint8_t *pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
4645#endif
4646
4647 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true); /* Used for TLB flushing, set this across the world switch. */
4648 /* Flush the appropriate tagged-TLB entries. */
4649 hmR0SvmFlushTaggedTlb(pVCpu, pCtx, pVmcb, pHostCpu);
4650 Assert(pVCpu->hm.s.idLastCpu == idHostCpu);
4651
4652 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatEntry, &pVCpu->hm.s.StatInGC, x);
4653
4654 TMNotifyStartOfExecution(pVCpu); /* Finally, notify TM to resume its clocks as we're about
4655 to start executing. */
4656
4657 /*
4658 * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that RDTSCPs
4659 * (that don't cause exits) reads the guest MSR, see @bugref{3324}.
4660 *
4661 * This should be done -after- any RDTSCPs for obtaining the host timestamp (TM, STAM etc).
4662 */
4663 if ( (pVM->hm.s.cpuid.u32AMDFeatureEDX & X86_CPUID_EXT_FEATURE_EDX_RDTSCP)
4664 && !(pVmcb->ctrl.u64InterceptCtrl & SVM_CTRL_INTERCEPT_RDTSCP))
4665 {
4666 uint64_t const uGuestTscAux = CPUMGetGuestTscAux(pVCpu);
4667 pVCpu->hm.s.u64HostTscAux = ASMRdMsr(MSR_K8_TSC_AUX);
4668 if (uGuestTscAux != pVCpu->hm.s.u64HostTscAux)
4669 ASMWrMsr(MSR_K8_TSC_AUX, uGuestTscAux);
4670 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_TSC_AUX, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
4671 pSvmTransient->fRestoreTscAuxMsr = true;
4672 }
4673 else
4674 {
4675 hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_TSC_AUX, SVMMSREXIT_INTERCEPT_READ, SVMMSREXIT_INTERCEPT_WRITE);
4676 pSvmTransient->fRestoreTscAuxMsr = false;
4677 }
4678 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_IOPM_MSRPM;
4679
4680 /*
4681 * If VMCB Clean bits isn't supported by the CPU or exposed to the guest in the nested
4682 * virtualization case, mark all state-bits as dirty indicating to the CPU to re-load
4683 * from the VMCB.
4684 */
4685 bool const fSupportsVmcbCleanBits = hmR0SvmSupportsVmcbCleanBits(pVCpu, pCtx);
4686 if (!fSupportsVmcbCleanBits)
4687 pVmcb->ctrl.u32VmcbCleanBits = 0;
4688}
4689
4690
4691/**
4692 * Wrapper for running the guest code in AMD-V.
4693 *
4694 * @returns VBox strict status code.
4695 * @param pVM The cross context VM structure.
4696 * @param pVCpu The cross context virtual CPU structure.
4697 * @param pCtx Pointer to the guest-CPU context.
4698 *
4699 * @remarks No-long-jump zone!!!
4700 */
4701DECLINLINE(int) hmR0SvmRunGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
4702{
4703 /* Mark that HM is the keeper of all guest-CPU registers now that we're going to execute guest code. */
4704 pCtx->fExtrn |= HMSVM_CPUMCTX_EXTRN_ALL | CPUMCTX_EXTRN_KEEPER_HM;
4705
4706 /*
4707 * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses
4708 * floating-point operations using SSE instructions. Some XMM registers (XMM6-XMM15) are
4709 * callee-saved and thus the need for this XMM wrapper.
4710 *
4711 * Refer MSDN "Configuring Programs for 64-bit/x64 Software Conventions / Register Usage".
4712 */
4713#ifdef VBOX_WITH_KERNEL_USING_XMM
4714 return hmR0SVMRunWrapXMM(pVCpu->hm.s.svm.HCPhysVmcbHost, pVCpu->hm.s.svm.HCPhysVmcb, pCtx, pVM, pVCpu,
4715 pVCpu->hm.s.svm.pfnVMRun);
4716#else
4717 return pVCpu->hm.s.svm.pfnVMRun(pVCpu->hm.s.svm.HCPhysVmcbHost, pVCpu->hm.s.svm.HCPhysVmcb, pCtx, pVM, pVCpu);
4718#endif
4719}
4720
4721
4722#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
4723/**
4724 * Wrapper for running the nested-guest code in AMD-V.
4725 *
4726 * @returns VBox strict status code.
4727 * @param pVM The cross context VM structure.
4728 * @param pVCpu The cross context virtual CPU structure.
4729 * @param pCtx Pointer to the guest-CPU context.
4730 *
4731 * @remarks No-long-jump zone!!!
4732 */
4733DECLINLINE(int) hmR0SvmRunGuestNested(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
4734{
4735 /* Mark that HM is the keeper of all guest-CPU registers now that we're going to execute guest code. */
4736 pCtx->fExtrn |= HMSVM_CPUMCTX_EXTRN_ALL | CPUMCTX_EXTRN_KEEPER_HM;
4737
4738 /*
4739 * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses
4740 * floating-point operations using SSE instructions. Some XMM registers (XMM6-XMM15) are
4741 * callee-saved and thus the need for this XMM wrapper.
4742 *
4743 * Refer MSDN "Configuring Programs for 64-bit/x64 Software Conventions / Register Usage".
4744 */
4745#ifdef VBOX_WITH_KERNEL_USING_XMM
4746 return hmR0SVMRunWrapXMM(pVCpu->hm.s.svm.HCPhysVmcbHost, pCtx->hwvirt.svm.HCPhysVmcb, pCtx, pVM, pVCpu,
4747 pVCpu->hm.s.svm.pfnVMRun);
4748#else
4749 return pVCpu->hm.s.svm.pfnVMRun(pVCpu->hm.s.svm.HCPhysVmcbHost, pCtx->hwvirt.svm.HCPhysVmcb, pCtx, pVM, pVCpu);
4750#endif
4751}
4752
4753
4754/**
4755 * Undoes the TSC offset applied for an SVM nested-guest and returns the TSC
4756 * value for the guest.
4757 *
4758 * @returns The TSC offset after undoing any nested-guest TSC offset.
4759 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
4760 * @param uTicks The nested-guest TSC.
4761 *
4762 * @note If you make any changes to this function, please check if
4763 * hmR0SvmNstGstUndoTscOffset() needs adjusting.
4764 *
4765 * @sa HMSvmNstGstApplyTscOffset().
4766 */
4767DECLINLINE(uint64_t) hmR0SvmNstGstUndoTscOffset(PVMCPU pVCpu, uint64_t uTicks)
4768{
4769 PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = &pVCpu->hm.s.svm.NstGstVmcbCache;
4770 Assert(pVmcbNstGstCache->fCacheValid);
4771 return uTicks - pVmcbNstGstCache->u64TSCOffset;
4772}
4773#endif
4774
4775/**
4776 * Performs some essential restoration of state after running guest (or
4777 * nested-guest) code in AMD-V.
4778 *
4779 * @param pVCpu The cross context virtual CPU structure.
4780 * @param pCtx Pointer to the guest-CPU context. The data maybe
4781 * out-of-sync. Make sure to update the required fields
4782 * before using them.
4783 * @param pSvmTransient Pointer to the SVM transient structure.
4784 * @param rcVMRun Return code of VMRUN.
4785 *
4786 * @remarks Called with interrupts disabled.
4787 * @remarks No-long-jump zone!!! This function will however re-enable longjmps
4788 * unconditionally when it is safe to do so.
4789 */
4790static void hmR0SvmPostRunGuest(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient, int rcVMRun)
4791{
4792 Assert(!VMMRZCallRing3IsEnabled(pVCpu));
4793
4794 uint64_t const uHostTsc = ASMReadTSC(); /* Read the TSC as soon as possible. */
4795 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false); /* See HMInvalidatePageOnAllVCpus(): used for TLB flushing. */
4796 ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits); /* Initialized in vmR3CreateUVM(): used for EMT poking. */
4797
4798 PSVMVMCB pVmcb = pSvmTransient->pVmcb;
4799 PSVMVMCBCTRL pVmcbCtrl = &pVmcb->ctrl;
4800
4801 /* TSC read must be done early for maximum accuracy. */
4802 if (!(pVmcbCtrl->u64InterceptCtrl & SVM_CTRL_INTERCEPT_RDTSC))
4803 {
4804 if (!pSvmTransient->fIsNestedGuest)
4805 TMCpuTickSetLastSeen(pVCpu, uHostTsc + pVmcbCtrl->u64TSCOffset);
4806#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
4807 else
4808 {
4809 /* The nested-guest VMCB TSC offset shall eventually be restored on #VMEXIT via HMSvmNstGstVmExitNotify(). */
4810 uint64_t const uGstTsc = hmR0SvmNstGstUndoTscOffset(pVCpu, uHostTsc + pVmcbCtrl->u64TSCOffset);
4811 TMCpuTickSetLastSeen(pVCpu, uGstTsc);
4812 }
4813#endif
4814 }
4815
4816 if (pSvmTransient->fRestoreTscAuxMsr)
4817 {
4818 uint64_t u64GuestTscAuxMsr = ASMRdMsr(MSR_K8_TSC_AUX);
4819 CPUMSetGuestTscAux(pVCpu, u64GuestTscAuxMsr);
4820 if (u64GuestTscAuxMsr != pVCpu->hm.s.u64HostTscAux)
4821 ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hm.s.u64HostTscAux);
4822 }
4823
4824 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
4825 TMNotifyEndOfExecution(pVCpu); /* Notify TM that the guest is no longer running. */
4826 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_HM);
4827
4828 Assert(!(ASMGetFlags() & X86_EFL_IF));
4829 ASMSetFlags(pSvmTransient->fEFlags); /* Enable interrupts. */
4830 VMMRZCallRing3Enable(pVCpu); /* It is now safe to do longjmps to ring-3!!! */
4831
4832 /* If VMRUN failed, we can bail out early. This does -not- cover SVM_EXIT_INVALID. */
4833 if (RT_UNLIKELY(rcVMRun != VINF_SUCCESS))
4834 {
4835 Log4Func(("VMRUN failure: rcVMRun=%Rrc\n", rcVMRun));
4836 return;
4837 }
4838
4839 pSvmTransient->u64ExitCode = pVmcbCtrl->u64ExitCode; /* Save the #VMEXIT reason. */
4840 pVmcbCtrl->u32VmcbCleanBits = HMSVM_VMCB_CLEAN_ALL; /* Mark the VMCB-state cache as unmodified by VMM. */
4841 pSvmTransient->fVectoringDoublePF = false; /* Vectoring double page-fault needs to be determined later. */
4842 pSvmTransient->fVectoringPF = false; /* Vectoring page-fault needs to be determined later. */
4843
4844#ifdef HMSVM_SYNC_FULL_GUEST_STATE
4845 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4846 hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
4847#elif defined(HMSVM_SYNC_FULL_NESTED_GUEST_STATE)
4848 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4849 hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
4850#else
4851 /*
4852 * Always import the following:
4853 *
4854 * - RIP for exit optimizations and evaluating event injection on re-entry.
4855 * - RFLAGS for evaluating event injection on VM re-entry and for exporting shared debug
4856 * state on preemption.
4857 * - Interrupt shadow, GIF for evaluating event injection on VM re-entry.
4858 * - CS for exit optimizations.
4859 * - RAX, RSP for simplifying assumptions on GPRs. All other GPRs are swapped by the
4860 * assembly switcher code.
4861 * - Shared state (only DR7 currently) for exporting shared debug state on preemption.
4862 */
4863 hmR0SvmImportGuestState(pVCpu, CPUMCTX_EXTRN_RIP
4864 | CPUMCTX_EXTRN_RFLAGS
4865 | CPUMCTX_EXTRN_RAX
4866 | CPUMCTX_EXTRN_RSP
4867 | CPUMCTX_EXTRN_CS
4868 | CPUMCTX_EXTRN_HWVIRT
4869 | CPUMCTX_EXTRN_HM_SVM_INT_SHADOW
4870 | CPUMCTX_EXTRN_HM_SVM_HWVIRT_VIRQ
4871 | HMSVM_CPUMCTX_SHARED_STATE);
4872#endif
4873
4874#ifdef DEBUG_ramshankar
4875 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
4876 {
4877 hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
4878 hmR0SvmLogState(pVCpu, pVmcb, pCtx, "hmR0SvmPostRunGuestNested", HMSVM_LOG_ALL & ~HMSVM_LOG_LBR, 0 /* uVerbose */);
4879 }
4880#endif
4881
4882 if ( pSvmTransient->u64ExitCode != SVM_EXIT_INVALID
4883 && pVCpu->hm.s.svm.fSyncVTpr)
4884 {
4885 Assert(!pSvmTransient->fIsNestedGuest);
4886 /* TPR patching (for 32-bit guests) uses LSTAR MSR for holding the TPR value, otherwise uses the VTPR. */
4887 if ( pVCpu->CTX_SUFF(pVM)->hm.s.fTPRPatchingActive
4888 && (pVmcb->guest.u64LSTAR & 0xff) != pSvmTransient->u8GuestTpr)
4889 {
4890 int rc = APICSetTpr(pVCpu, pVmcb->guest.u64LSTAR & 0xff);
4891 AssertRC(rc);
4892 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
4893 }
4894 /* Sync TPR when we aren't intercepting CR8 writes. */
4895 else if (pSvmTransient->u8GuestTpr != pVmcbCtrl->IntCtrl.n.u8VTPR)
4896 {
4897 int rc = APICSetTpr(pVCpu, pVmcbCtrl->IntCtrl.n.u8VTPR << 4);
4898 AssertRC(rc);
4899 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
4900 }
4901 }
4902
4903 HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CS | CPUMCTX_EXTRN_RIP);
4904 EMHistoryAddExit(pVCpu, EMEXIT_MAKE_FT(EMEXIT_F_KIND_SVM, pSvmTransient->u64ExitCode & EMEXIT_F_TYPE_MASK),
4905 pCtx->cs.u64Base + pCtx->rip, uHostTsc);
4906}
4907
4908
4909/**
4910 * Runs the guest code using AMD-V.
4911 *
4912 * @returns VBox status code.
4913 * @param pVM The cross context VM structure.
4914 * @param pVCpu The cross context virtual CPU structure.
4915 * @param pCtx Pointer to the guest-CPU context.
4916 * @param pcLoops Pointer to the number of executed loops.
4917 */
4918static int hmR0SvmRunGuestCodeNormal(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t *pcLoops)
4919{
4920 uint32_t const cMaxResumeLoops = pVM->hm.s.cMaxResumeLoops;
4921 Assert(pcLoops);
4922 Assert(*pcLoops <= cMaxResumeLoops);
4923
4924 SVMTRANSIENT SvmTransient;
4925 RT_ZERO(SvmTransient);
4926 SvmTransient.fUpdateTscOffsetting = true;
4927 SvmTransient.pVmcb = pVCpu->hm.s.svm.pVmcb;
4928
4929 int rc = VERR_INTERNAL_ERROR_5;
4930 for (;;)
4931 {
4932 Assert(!HMR0SuspendPending());
4933 HMSVM_ASSERT_CPU_SAFE();
4934
4935 /* Preparatory work for running nested-guest code, this may force us to return to
4936 ring-3. This bugger disables interrupts on VINF_SUCCESS! */
4937 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
4938 rc = hmR0SvmPreRunGuest(pVM, pVCpu, pCtx, &SvmTransient);
4939 if (rc != VINF_SUCCESS)
4940 break;
4941
4942 /*
4943 * No longjmps to ring-3 from this point on!!!
4944 *
4945 * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
4946 * better than a kernel panic. This also disables flushing of the R0-logger instance.
4947 */
4948 hmR0SvmPreRunGuestCommitted(pVCpu, pCtx, &SvmTransient);
4949 rc = hmR0SvmRunGuest(pVM, pVCpu, pCtx);
4950
4951 /* Restore any residual host-state and save any bits shared between host and guest
4952 into the guest-CPU state. Re-enables interrupts! */
4953 hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
4954
4955 if (RT_UNLIKELY( rc != VINF_SUCCESS /* Check for VMRUN errors. */
4956 || SvmTransient.u64ExitCode == SVM_EXIT_INVALID)) /* Check for invalid guest-state errors. */
4957 {
4958 if (rc == VINF_SUCCESS)
4959 rc = VERR_SVM_INVALID_GUEST_STATE;
4960 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
4961 hmR0SvmReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
4962 break;
4963 }
4964
4965 /* Handle the #VMEXIT. */
4966 HMSVM_EXITCODE_STAM_COUNTER_INC(SvmTransient.u64ExitCode);
4967 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
4968 VBOXVMM_R0_HMSVM_VMEXIT(pVCpu, pCtx, SvmTransient.u64ExitCode, pVCpu->hm.s.svm.pVmcb);
4969 rc = hmR0SvmHandleExit(pVCpu, pCtx, &SvmTransient);
4970 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
4971 if (rc != VINF_SUCCESS)
4972 break;
4973 if (++(*pcLoops) >= cMaxResumeLoops)
4974 {
4975 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchMaxResumeLoops);
4976 rc = VINF_EM_RAW_INTERRUPT;
4977 break;
4978 }
4979 }
4980
4981 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
4982 return rc;
4983}
4984
4985
4986/**
4987 * Runs the guest code using AMD-V in single step mode.
4988 *
4989 * @returns VBox status code.
4990 * @param pVM The cross context VM structure.
4991 * @param pVCpu The cross context virtual CPU structure.
4992 * @param pCtx Pointer to the guest-CPU context.
4993 * @param pcLoops Pointer to the number of executed loops.
4994 */
4995static int hmR0SvmRunGuestCodeStep(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t *pcLoops)
4996{
4997 uint32_t const cMaxResumeLoops = pVM->hm.s.cMaxResumeLoops;
4998 Assert(pcLoops);
4999 Assert(*pcLoops <= cMaxResumeLoops);
5000
5001 SVMTRANSIENT SvmTransient;
5002 RT_ZERO(SvmTransient);
5003 SvmTransient.fUpdateTscOffsetting = true;
5004 SvmTransient.pVmcb = pVCpu->hm.s.svm.pVmcb;
5005
5006 uint16_t uCsStart = pCtx->cs.Sel;
5007 uint64_t uRipStart = pCtx->rip;
5008
5009 int rc = VERR_INTERNAL_ERROR_5;
5010 for (;;)
5011 {
5012 Assert(!HMR0SuspendPending());
5013 AssertMsg(pVCpu->hm.s.idEnteredCpu == RTMpCpuId(),
5014 ("Illegal migration! Entered on CPU %u Current %u cLoops=%u\n", (unsigned)pVCpu->hm.s.idEnteredCpu,
5015 (unsigned)RTMpCpuId(), *pcLoops));
5016
5017 /* Preparatory work for running nested-guest code, this may force us to return to
5018 ring-3. This bugger disables interrupts on VINF_SUCCESS! */
5019 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
5020 rc = hmR0SvmPreRunGuest(pVM, pVCpu, pCtx, &SvmTransient);
5021 if (rc != VINF_SUCCESS)
5022 break;
5023
5024 /*
5025 * No longjmps to ring-3 from this point on!!!
5026 *
5027 * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
5028 * better than a kernel panic. This also disables flushing of the R0-logger instance.
5029 */
5030 VMMRZCallRing3Disable(pVCpu);
5031 VMMRZCallRing3RemoveNotification(pVCpu);
5032 hmR0SvmPreRunGuestCommitted(pVCpu, pCtx, &SvmTransient);
5033
5034 rc = hmR0SvmRunGuest(pVM, pVCpu, pCtx);
5035
5036 /* Restore any residual host-state and save any bits shared between host and guest
5037 into the guest-CPU state. Re-enables interrupts! */
5038 hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
5039
5040 if (RT_UNLIKELY( rc != VINF_SUCCESS /* Check for VMRUN errors. */
5041 || SvmTransient.u64ExitCode == SVM_EXIT_INVALID)) /* Check for invalid guest-state errors. */
5042 {
5043 if (rc == VINF_SUCCESS)
5044 rc = VERR_SVM_INVALID_GUEST_STATE;
5045 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
5046 hmR0SvmReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
5047 return rc;
5048 }
5049
5050 /* Handle the #VMEXIT. */
5051 HMSVM_EXITCODE_STAM_COUNTER_INC(SvmTransient.u64ExitCode);
5052 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
5053 VBOXVMM_R0_HMSVM_VMEXIT(pVCpu, pCtx, SvmTransient.u64ExitCode, pVCpu->hm.s.svm.pVmcb);
5054 rc = hmR0SvmHandleExit(pVCpu, pCtx, &SvmTransient);
5055 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5056 if (rc != VINF_SUCCESS)
5057 break;
5058 if (++(*pcLoops) >= cMaxResumeLoops)
5059 {
5060 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchMaxResumeLoops);
5061 rc = VINF_EM_RAW_INTERRUPT;
5062 break;
5063 }
5064
5065 /*
5066 * Did the RIP change, if so, consider it a single step.
5067 * Otherwise, make sure one of the TFs gets set.
5068 */
5069 if ( pCtx->rip != uRipStart
5070 || pCtx->cs.Sel != uCsStart)
5071 {
5072 rc = VINF_EM_DBG_STEPPED;
5073 break;
5074 }
5075 pVCpu->hm.s.fCtxChanged |= HM_CHANGED_GUEST_DR_MASK;
5076 }
5077
5078 /*
5079 * Clear the X86_EFL_TF if necessary.
5080 */
5081 if (pVCpu->hm.s.fClearTrapFlag)
5082 {
5083 pVCpu->hm.s.fClearTrapFlag = false;
5084 pCtx->eflags.Bits.u1TF = 0;
5085 }
5086
5087 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5088 return rc;
5089}
5090
5091#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5092/**
5093 * Runs the nested-guest code using AMD-V.
5094 *
5095 * @returns VBox status code.
5096 * @param pVM The cross context VM structure.
5097 * @param pVCpu The cross context virtual CPU structure.
5098 * @param pCtx Pointer to the guest-CPU context.
5099 * @param pcLoops Pointer to the number of executed loops. If we're switching
5100 * from the guest-code execution loop to this nested-guest
5101 * execution loop pass the remainder value, else pass 0.
5102 */
5103static int hmR0SvmRunGuestCodeNested(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t *pcLoops)
5104{
5105 HMSVM_ASSERT_IN_NESTED_GUEST(pCtx);
5106 Assert(pcLoops);
5107 Assert(*pcLoops <= pVM->hm.s.cMaxResumeLoops);
5108
5109 SVMTRANSIENT SvmTransient;
5110 RT_ZERO(SvmTransient);
5111 SvmTransient.fUpdateTscOffsetting = true;
5112 SvmTransient.pVmcb = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
5113 SvmTransient.fIsNestedGuest = true;
5114
5115 int rc = VERR_INTERNAL_ERROR_4;
5116 for (;;)
5117 {
5118 Assert(!HMR0SuspendPending());
5119 HMSVM_ASSERT_CPU_SAFE();
5120
5121 /* Preparatory work for running nested-guest code, this may force us to return to
5122 ring-3. This bugger disables interrupts on VINF_SUCCESS! */
5123 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
5124 rc = hmR0SvmPreRunGuestNested(pVM, pVCpu, pCtx, &SvmTransient);
5125 if ( rc != VINF_SUCCESS
5126 || !CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5127 {
5128 break;
5129 }
5130
5131 /*
5132 * No longjmps to ring-3 from this point on!!!
5133 *
5134 * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
5135 * better than a kernel panic. This also disables flushing of the R0-logger instance.
5136 */
5137 hmR0SvmPreRunGuestCommitted(pVCpu, pCtx, &SvmTransient);
5138
5139 rc = hmR0SvmRunGuestNested(pVM, pVCpu, pCtx);
5140
5141 /* Restore any residual host-state and save any bits shared between host and guest
5142 into the guest-CPU state. Re-enables interrupts! */
5143 hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
5144
5145 if (RT_LIKELY( rc == VINF_SUCCESS
5146 && SvmTransient.u64ExitCode != SVM_EXIT_INVALID))
5147 { /* extremely likely */ }
5148 else
5149 {
5150 /* VMRUN failed, shouldn't really happen, Guru. */
5151 if (rc != VINF_SUCCESS)
5152 break;
5153
5154 /* Invalid nested-guest state. Cause a #VMEXIT but assert on strict builds. */
5155 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
5156 AssertMsgFailed(("Invalid nested-guest state. rc=%Rrc u64ExitCode=%#RX64\n", rc, SvmTransient.u64ExitCode));
5157 rc = VBOXSTRICTRC_TODO(IEMExecSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0, 0));
5158 break;
5159 }
5160
5161 /* Handle the #VMEXIT. */
5162 HMSVM_NESTED_EXITCODE_STAM_COUNTER_INC(SvmTransient.u64ExitCode);
5163 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
5164 VBOXVMM_R0_HMSVM_VMEXIT(pVCpu, pCtx, SvmTransient.u64ExitCode, pCtx->hwvirt.svm.CTX_SUFF(pVmcb));
5165 rc = hmR0SvmHandleExitNested(pVCpu, pCtx, &SvmTransient);
5166 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5167 if ( rc != VINF_SUCCESS
5168 || !CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5169 break;
5170 if (++(*pcLoops) >= pVM->hm.s.cMaxResumeLoops)
5171 {
5172 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchMaxResumeLoops);
5173 rc = VINF_EM_RAW_INTERRUPT;
5174 break;
5175 }
5176
5177 /** @todo handle single-stepping */
5178 }
5179
5180 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5181 return rc;
5182}
5183#endif
5184
5185
5186/**
5187 * Runs the guest code using AMD-V.
5188 *
5189 * @returns Strict VBox status code.
5190 * @param pVM The cross context VM structure.
5191 * @param pVCpu The cross context virtual CPU structure.
5192 * @param pCtx Pointer to the guest-CPU context.
5193 */
5194VMMR0DECL(VBOXSTRICTRC) SVMR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5195{
5196 Assert(VMMRZCallRing3IsEnabled(pVCpu));
5197 HMSVM_ASSERT_PREEMPT_SAFE();
5198 VMMRZCallRing3SetNotification(pVCpu, hmR0SvmCallRing3Callback, pCtx);
5199
5200 uint32_t cLoops = 0;
5201 int rc;
5202#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5203 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5204#endif
5205 {
5206 if (!pVCpu->hm.s.fSingleInstruction)
5207 rc = hmR0SvmRunGuestCodeNormal(pVM, pVCpu, pCtx, &cLoops);
5208 else
5209 rc = hmR0SvmRunGuestCodeStep(pVM, pVCpu, pCtx, &cLoops);
5210 }
5211#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5212 else
5213 {
5214 rc = VINF_SVM_VMRUN;
5215 }
5216
5217 /* Re-check the nested-guest condition here as we may be transitioning from the normal
5218 execution loop into the nested-guest, hence this is not placed in the 'else' part above. */
5219 if (rc == VINF_SVM_VMRUN)
5220 {
5221 rc = hmR0SvmRunGuestCodeNested(pVM, pVCpu, pCtx, &cLoops);
5222 if (rc == VINF_SVM_VMEXIT)
5223 rc = VINF_SUCCESS;
5224 }
5225#endif
5226
5227 /* Fixup error codes. */
5228 if (rc == VERR_EM_INTERPRETER)
5229 rc = VINF_EM_RAW_EMULATE_INSTR;
5230 else if (rc == VINF_EM_RESET)
5231 rc = VINF_EM_TRIPLE_FAULT;
5232
5233 /* Prepare to return to ring-3. This will remove longjmp notifications. */
5234 rc = hmR0SvmExitToRing3(pVM, pVCpu, pCtx, rc);
5235 Assert(!VMMRZCallRing3IsNotificationSet(pVCpu));
5236 return rc;
5237}
5238
5239
5240#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5241/**
5242 * Determines whether an IOIO intercept is active for the nested-guest or not.
5243 *
5244 * @param pvIoBitmap Pointer to the nested-guest IO bitmap.
5245 * @param pIoExitInfo Pointer to the SVMIOIOEXITINFO.
5246 */
5247static bool hmR0SvmIsIoInterceptActive(void *pvIoBitmap, PSVMIOIOEXITINFO pIoExitInfo)
5248{
5249 const uint16_t u16Port = pIoExitInfo->n.u16Port;
5250 const SVMIOIOTYPE enmIoType = (SVMIOIOTYPE)pIoExitInfo->n.u1Type;
5251 const uint8_t cbReg = (pIoExitInfo->u >> SVM_IOIO_OP_SIZE_SHIFT) & 7;
5252 const uint8_t cAddrSizeBits = ((pIoExitInfo->u >> SVM_IOIO_ADDR_SIZE_SHIFT) & 7) << 4;
5253 const uint8_t iEffSeg = pIoExitInfo->n.u3Seg;
5254 const bool fRep = pIoExitInfo->n.u1Rep;
5255 const bool fStrIo = pIoExitInfo->n.u1Str;
5256
5257 return HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
5258 NULL /* pIoExitInfo */);
5259}
5260
5261
5262/**
5263 * Handles a nested-guest \#VMEXIT (for all EXITCODE values except
5264 * SVM_EXIT_INVALID).
5265 *
5266 * @returns VBox status code (informational status codes included).
5267 * @param pVCpu The cross context virtual CPU structure.
5268 * @param pCtx Pointer to the guest-CPU context.
5269 * @param pSvmTransient Pointer to the SVM transient structure.
5270 */
5271static int hmR0SvmHandleExitNested(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
5272{
5273 HMSVM_ASSERT_IN_NESTED_GUEST(pCtx);
5274 Assert(pSvmTransient->u64ExitCode != SVM_EXIT_INVALID);
5275 Assert(pSvmTransient->u64ExitCode <= SVM_EXIT_MAX);
5276
5277 /** @todo Figure out why using IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK instead of
5278 * HMSVM_CPUMCTX_EXTRN_ALL breaks nested guests (XP Pro, DSL etc.), see
5279 * also HMSvmNstGstVmExitNotify(). */
5280#define NST_GST_VMEXIT_CALL_RET(a_pVCpu, a_pCtx, a_uExitCode, a_uExitInfo1, a_uExitInfo2) \
5281 do { \
5282 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL); \
5283 return VBOXSTRICTRC_TODO(IEMExecSvmVmexit((a_pVCpu), (a_uExitCode), (a_uExitInfo1), (a_uExitInfo2))); \
5284 } while (0)
5285
5286 /*
5287 * For all the #VMEXITs here we primarily figure out if the #VMEXIT is expected by the
5288 * nested-guest. If it isn't, it should be handled by the (outer) guest.
5289 */
5290 PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
5291 PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
5292 uint64_t const uExitCode = pVmcbNstGstCtrl->u64ExitCode;
5293 uint64_t const uExitInfo1 = pVmcbNstGstCtrl->u64ExitInfo1;
5294 uint64_t const uExitInfo2 = pVmcbNstGstCtrl->u64ExitInfo2;
5295
5296 Assert(uExitCode == pVmcbNstGstCtrl->u64ExitCode);
5297 switch (uExitCode)
5298 {
5299 case SVM_EXIT_CPUID:
5300 {
5301 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
5302 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5303 return hmR0SvmExitCpuid(pVCpu, pCtx, pSvmTransient);
5304 }
5305
5306 case SVM_EXIT_RDTSC:
5307 {
5308 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
5309 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5310 return hmR0SvmExitRdtsc(pVCpu, pCtx, pSvmTransient);
5311 }
5312
5313 case SVM_EXIT_RDTSCP:
5314 {
5315 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
5316 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5317 return hmR0SvmExitRdtscp(pVCpu, pCtx, pSvmTransient);
5318 }
5319
5320 case SVM_EXIT_MONITOR:
5321 {
5322 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
5323 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5324 return hmR0SvmExitMonitor(pVCpu, pCtx, pSvmTransient);
5325 }
5326
5327 case SVM_EXIT_MWAIT:
5328 {
5329 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
5330 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5331 return hmR0SvmExitMwait(pVCpu, pCtx, pSvmTransient);
5332 }
5333
5334 case SVM_EXIT_HLT:
5335 {
5336 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_HLT))
5337 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5338 return hmR0SvmExitHlt(pVCpu, pCtx, pSvmTransient);
5339 }
5340
5341 case SVM_EXIT_MSR:
5342 {
5343 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
5344 {
5345 uint32_t const idMsr = pCtx->ecx;
5346 uint16_t offMsrpm;
5347 uint8_t uMsrpmBit;
5348 int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
5349 if (RT_SUCCESS(rc))
5350 {
5351 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
5352 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
5353
5354 uint8_t const *pbMsrBitmap = (uint8_t const *)pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
5355 pbMsrBitmap += offMsrpm;
5356 bool const fInterceptRead = RT_BOOL(*pbMsrBitmap & RT_BIT(uMsrpmBit));
5357 bool const fInterceptWrite = RT_BOOL(*pbMsrBitmap & RT_BIT(uMsrpmBit + 1));
5358
5359 if ( (fInterceptWrite && pVmcbNstGstCtrl->u64ExitInfo1 == SVM_EXIT1_MSR_WRITE)
5360 || (fInterceptRead && pVmcbNstGstCtrl->u64ExitInfo1 == SVM_EXIT1_MSR_READ))
5361 {
5362 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5363 }
5364 }
5365 else
5366 {
5367 /*
5368 * MSRs not covered by the MSRPM automatically cause an #VMEXIT.
5369 * See AMD-V spec. "15.11 MSR Intercepts".
5370 */
5371 Assert(rc == VERR_OUT_OF_RANGE);
5372 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5373 }
5374 }
5375 return hmR0SvmExitMsr(pVCpu, pCtx, pSvmTransient);
5376 }
5377
5378 case SVM_EXIT_IOIO:
5379 {
5380 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
5381 {
5382 void *pvIoBitmap = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
5383 SVMIOIOEXITINFO IoExitInfo;
5384 IoExitInfo.u = pVmcbNstGst->ctrl.u64ExitInfo1;
5385 bool const fIntercept = hmR0SvmIsIoInterceptActive(pvIoBitmap, &IoExitInfo);
5386 if (fIntercept)
5387 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5388 }
5389 return hmR0SvmExitIOInstr(pVCpu, pCtx, pSvmTransient);
5390 }
5391
5392 case SVM_EXIT_XCPT_PF:
5393 {
5394 PVM pVM = pVCpu->CTX_SUFF(pVM);
5395 if (pVM->hm.s.fNestedPaging)
5396 {
5397 uint32_t const u32ErrCode = pVmcbNstGstCtrl->u64ExitInfo1;
5398 uint64_t const uFaultAddress = pVmcbNstGstCtrl->u64ExitInfo2;
5399
5400 /* If the nested-guest is intercepting #PFs, cause a #PF #VMEXIT. */
5401 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_PF))
5402 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, u32ErrCode, uFaultAddress);
5403
5404 /* If the nested-guest is not intercepting #PFs, forward the #PF to the guest. */
5405 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR2);
5406 hmR0SvmSetPendingXcptPF(pVCpu, pCtx, u32ErrCode, uFaultAddress);
5407 return VINF_SUCCESS;
5408 }
5409 return hmR0SvmExitXcptPF(pVCpu, pCtx,pSvmTransient);
5410 }
5411
5412 case SVM_EXIT_XCPT_UD:
5413 {
5414 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_UD))
5415 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5416 hmR0SvmSetPendingXcptUD(pVCpu);
5417 return VINF_SUCCESS;
5418 }
5419
5420 case SVM_EXIT_XCPT_MF:
5421 {
5422 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_MF))
5423 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5424 return hmR0SvmExitXcptMF(pVCpu, pCtx, pSvmTransient);
5425 }
5426
5427 case SVM_EXIT_XCPT_DB:
5428 {
5429 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_DB))
5430 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5431 return hmR0SvmNestedExitXcptDB(pVCpu, pCtx, pSvmTransient);
5432 }
5433
5434 case SVM_EXIT_XCPT_AC:
5435 {
5436 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_AC))
5437 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5438 return hmR0SvmExitXcptAC(pVCpu, pCtx, pSvmTransient);
5439 }
5440
5441 case SVM_EXIT_XCPT_BP:
5442 {
5443 if (HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_BP))
5444 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5445 return hmR0SvmNestedExitXcptBP(pVCpu, pCtx, pSvmTransient);
5446 }
5447
5448 case SVM_EXIT_READ_CR0:
5449 case SVM_EXIT_READ_CR3:
5450 case SVM_EXIT_READ_CR4:
5451 {
5452 uint8_t const uCr = uExitCode - SVM_EXIT_READ_CR0;
5453 if (HMIsGuestSvmReadCRxInterceptSet(pVCpu, uCr))
5454 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5455 return hmR0SvmExitReadCRx(pVCpu, pCtx, pSvmTransient);
5456 }
5457
5458 case SVM_EXIT_CR0_SEL_WRITE:
5459 {
5460 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5461 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5462 return hmR0SvmExitWriteCRx(pVCpu, pCtx, pSvmTransient);
5463 }
5464
5465 case SVM_EXIT_WRITE_CR0:
5466 case SVM_EXIT_WRITE_CR3:
5467 case SVM_EXIT_WRITE_CR4:
5468 case SVM_EXIT_WRITE_CR8: /* CR8 writes would go to the V_TPR rather than here, since we run with V_INTR_MASKING. */
5469 {
5470 uint8_t const uCr = uExitCode - SVM_EXIT_WRITE_CR0;
5471 Log4Func(("Write CR%u: uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uCr, uExitInfo1, uExitInfo2));
5472
5473 if (HMIsGuestSvmWriteCRxInterceptSet(pVCpu, uCr))
5474 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5475 return hmR0SvmExitWriteCRx(pVCpu, pCtx, pSvmTransient);
5476 }
5477
5478 case SVM_EXIT_PAUSE:
5479 {
5480 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_PAUSE))
5481 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5482 return hmR0SvmExitPause(pVCpu, pCtx, pSvmTransient);
5483 }
5484
5485 case SVM_EXIT_VINTR:
5486 {
5487 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_VINTR))
5488 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5489 return hmR0SvmExitUnexpected(pVCpu, pCtx, pSvmTransient);
5490 }
5491
5492 case SVM_EXIT_INTR:
5493 case SVM_EXIT_NMI:
5494 case SVM_EXIT_SMI:
5495 case SVM_EXIT_XCPT_NMI: /* Should not occur, SVM_EXIT_NMI is used instead. */
5496 {
5497 /*
5498 * We shouldn't direct physical interrupts, NMIs, SMIs to the nested-guest.
5499 *
5500 * Although we don't intercept SMIs, the nested-guest might. Therefore, we might
5501 * get an SMI #VMEXIT here so simply ignore rather than causing a corresponding
5502 * nested-guest #VMEXIT.
5503 */
5504 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
5505 return hmR0SvmExitIntr(pVCpu, pCtx, pSvmTransient);
5506 }
5507
5508 case SVM_EXIT_FERR_FREEZE:
5509 {
5510 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_FERR_FREEZE))
5511 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5512 return hmR0SvmExitFerrFreeze(pVCpu, pCtx, pSvmTransient);
5513 }
5514
5515 case SVM_EXIT_INVLPG:
5516 {
5517 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
5518 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5519 return hmR0SvmExitInvlpg(pVCpu, pCtx, pSvmTransient);
5520 }
5521
5522 case SVM_EXIT_WBINVD:
5523 {
5524 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_WBINVD))
5525 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5526 return hmR0SvmExitWbinvd(pVCpu, pCtx, pSvmTransient);
5527 }
5528
5529 case SVM_EXIT_INVD:
5530 {
5531 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_INVD))
5532 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5533 return hmR0SvmExitInvd(pVCpu, pCtx, pSvmTransient);
5534 }
5535
5536 case SVM_EXIT_RDPMC:
5537 {
5538 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
5539 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5540 return hmR0SvmExitRdpmc(pVCpu, pCtx, pSvmTransient);
5541 }
5542
5543 default:
5544 {
5545 switch (uExitCode)
5546 {
5547 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
5548 case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7: case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9:
5549 case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11: case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13:
5550 case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
5551 {
5552 uint8_t const uDr = uExitCode - SVM_EXIT_READ_DR0;
5553 if (HMIsGuestSvmReadDRxInterceptSet(pVCpu, uDr))
5554 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5555 return hmR0SvmExitReadDRx(pVCpu, pCtx, pSvmTransient);
5556 }
5557
5558 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
5559 case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7: case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9:
5560 case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11: case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13:
5561 case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
5562 {
5563 uint8_t const uDr = uExitCode - SVM_EXIT_WRITE_DR0;
5564 if (HMIsGuestSvmWriteDRxInterceptSet(pVCpu, uDr))
5565 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5566 return hmR0SvmExitWriteDRx(pVCpu, pCtx, pSvmTransient);
5567 }
5568
5569 case SVM_EXIT_XCPT_DE:
5570 /* SVM_EXIT_XCPT_DB: */ /* Handled above. */
5571 /* SVM_EXIT_XCPT_NMI: */ /* Handled above. */
5572 /* SVM_EXIT_XCPT_BP: */ /* Handled above. */
5573 case SVM_EXIT_XCPT_OF:
5574 case SVM_EXIT_XCPT_BR:
5575 /* SVM_EXIT_XCPT_UD: */ /* Handled above. */
5576 case SVM_EXIT_XCPT_NM:
5577 case SVM_EXIT_XCPT_DF:
5578 case SVM_EXIT_XCPT_CO_SEG_OVERRUN:
5579 case SVM_EXIT_XCPT_TS:
5580 case SVM_EXIT_XCPT_NP:
5581 case SVM_EXIT_XCPT_SS:
5582 case SVM_EXIT_XCPT_GP:
5583 /* SVM_EXIT_XCPT_PF: */ /* Handled above. */
5584 case SVM_EXIT_XCPT_15: /* Reserved. */
5585 /* SVM_EXIT_XCPT_MF: */ /* Handled above. */
5586 /* SVM_EXIT_XCPT_AC: */ /* Handled above. */
5587 case SVM_EXIT_XCPT_MC:
5588 case SVM_EXIT_XCPT_XF:
5589 case SVM_EXIT_XCPT_20: case SVM_EXIT_XCPT_21: case SVM_EXIT_XCPT_22: case SVM_EXIT_XCPT_23:
5590 case SVM_EXIT_XCPT_24: case SVM_EXIT_XCPT_25: case SVM_EXIT_XCPT_26: case SVM_EXIT_XCPT_27:
5591 case SVM_EXIT_XCPT_28: case SVM_EXIT_XCPT_29: case SVM_EXIT_XCPT_30: case SVM_EXIT_XCPT_31:
5592 {
5593 uint8_t const uVector = uExitCode - SVM_EXIT_XCPT_0;
5594 if (HMIsGuestSvmXcptInterceptSet(pVCpu, uVector))
5595 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5596 return hmR0SvmExitXcptGeneric(pVCpu, pCtx, pSvmTransient);
5597 }
5598
5599 case SVM_EXIT_XSETBV:
5600 {
5601 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
5602 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5603 return hmR0SvmExitXsetbv(pVCpu, pCtx, pSvmTransient);
5604 }
5605
5606 case SVM_EXIT_TASK_SWITCH:
5607 {
5608 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_TASK_SWITCH))
5609 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5610 return hmR0SvmExitTaskSwitch(pVCpu, pCtx, pSvmTransient);
5611 }
5612
5613 case SVM_EXIT_IRET:
5614 {
5615 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_IRET))
5616 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5617 return hmR0SvmExitIret(pVCpu, pCtx, pSvmTransient);
5618 }
5619
5620 case SVM_EXIT_SHUTDOWN:
5621 {
5622 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_SHUTDOWN))
5623 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5624 return hmR0SvmExitShutdown(pVCpu, pCtx, pSvmTransient);
5625 }
5626
5627 case SVM_EXIT_VMMCALL:
5628 {
5629 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
5630 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5631 return hmR0SvmExitVmmCall(pVCpu, pCtx, pSvmTransient);
5632 }
5633
5634 case SVM_EXIT_CLGI:
5635 {
5636 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
5637 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5638 return hmR0SvmExitClgi(pVCpu, pCtx, pSvmTransient);
5639 }
5640
5641 case SVM_EXIT_STGI:
5642 {
5643 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_STGI))
5644 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5645 return hmR0SvmExitStgi(pVCpu, pCtx, pSvmTransient);
5646 }
5647
5648 case SVM_EXIT_VMLOAD:
5649 {
5650 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
5651 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5652 return hmR0SvmExitVmload(pVCpu, pCtx, pSvmTransient);
5653 }
5654
5655 case SVM_EXIT_VMSAVE:
5656 {
5657 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
5658 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5659 return hmR0SvmExitVmsave(pVCpu, pCtx, pSvmTransient);
5660 }
5661
5662 case SVM_EXIT_INVLPGA:
5663 {
5664 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
5665 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5666 return hmR0SvmExitInvlpga(pVCpu, pCtx, pSvmTransient);
5667 }
5668
5669 case SVM_EXIT_VMRUN:
5670 {
5671 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
5672 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5673 return hmR0SvmExitVmrun(pVCpu, pCtx, pSvmTransient);
5674 }
5675
5676 case SVM_EXIT_RSM:
5677 {
5678 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_RSM))
5679 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5680 hmR0SvmSetPendingXcptUD(pVCpu);
5681 return VINF_SUCCESS;
5682 }
5683
5684 case SVM_EXIT_SKINIT:
5685 {
5686 if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
5687 NST_GST_VMEXIT_CALL_RET(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
5688 hmR0SvmSetPendingXcptUD(pVCpu);
5689 return VINF_SUCCESS;
5690 }
5691
5692 case SVM_EXIT_NPF:
5693 {
5694 Assert(pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging);
5695 return hmR0SvmExitNestedPF(pVCpu, pCtx, pSvmTransient);
5696 }
5697
5698 case SVM_EXIT_INIT: /* We shouldn't get INIT signals while executing a nested-guest. */
5699 return hmR0SvmExitUnexpected(pVCpu, pCtx, pSvmTransient);
5700
5701 default:
5702 {
5703 AssertMsgFailed(("hmR0SvmHandleExitNested: Unknown exit code %#x\n", pSvmTransient->u64ExitCode));
5704 pVCpu->hm.s.u32HMError = pSvmTransient->u64ExitCode;
5705 return VERR_SVM_UNKNOWN_EXIT;
5706 }
5707 }
5708 }
5709 }
5710 /* not reached */
5711
5712#undef NST_GST_VMEXIT_CALL_RET
5713}
5714#endif
5715
5716
5717/**
5718 * Handles a guest \#VMEXIT (for all EXITCODE values except SVM_EXIT_INVALID).
5719 *
5720 * @returns VBox status code (informational status codes included).
5721 * @param pVCpu The cross context virtual CPU structure.
5722 * @param pCtx Pointer to the guest-CPU context.
5723 * @param pSvmTransient Pointer to the SVM transient structure.
5724 */
5725static int hmR0SvmHandleExit(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
5726{
5727 Assert(pSvmTransient->u64ExitCode != SVM_EXIT_INVALID);
5728 Assert(pSvmTransient->u64ExitCode <= SVM_EXIT_MAX);
5729
5730#ifdef DEBUG_ramshankar
5731# define VMEXIT_CALL_RET(a_fDbg, a_CallExpr) \
5732 do { \
5733 if ((a_fDbg) == 1) \
5734 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL); \
5735 int rc = a_CallExpr; \
5736 if ((a_fDbg) == 1) \
5737 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST); \
5738 return rc; \
5739 } while (0)
5740#else
5741# define VMEXIT_CALL_RET(a_fDbg, a_CallExpr) return a_CallExpr
5742#endif
5743
5744 /*
5745 * The ordering of the case labels is based on most-frequently-occurring #VMEXITs
5746 * for most guests under normal workloads (for some definition of "normal").
5747 */
5748 uint64_t const uExitCode = pSvmTransient->u64ExitCode;
5749 switch (uExitCode)
5750 {
5751 case SVM_EXIT_NPF: VMEXIT_CALL_RET(0, hmR0SvmExitNestedPF(pVCpu, pCtx, pSvmTransient));
5752 case SVM_EXIT_IOIO: VMEXIT_CALL_RET(0, hmR0SvmExitIOInstr(pVCpu, pCtx, pSvmTransient));
5753 case SVM_EXIT_RDTSC: VMEXIT_CALL_RET(0, hmR0SvmExitRdtsc(pVCpu, pCtx, pSvmTransient));
5754 case SVM_EXIT_RDTSCP: VMEXIT_CALL_RET(0, hmR0SvmExitRdtscp(pVCpu, pCtx, pSvmTransient));
5755 case SVM_EXIT_CPUID: VMEXIT_CALL_RET(0, hmR0SvmExitCpuid(pVCpu, pCtx, pSvmTransient));
5756 case SVM_EXIT_XCPT_PF: VMEXIT_CALL_RET(0, hmR0SvmExitXcptPF(pVCpu, pCtx, pSvmTransient));
5757 case SVM_EXIT_MSR: VMEXIT_CALL_RET(0, hmR0SvmExitMsr(pVCpu, pCtx, pSvmTransient));
5758 case SVM_EXIT_MONITOR: VMEXIT_CALL_RET(0, hmR0SvmExitMonitor(pVCpu, pCtx, pSvmTransient));
5759 case SVM_EXIT_MWAIT: VMEXIT_CALL_RET(0, hmR0SvmExitMwait(pVCpu, pCtx, pSvmTransient));
5760 case SVM_EXIT_HLT: VMEXIT_CALL_RET(0, hmR0SvmExitHlt(pVCpu, pCtx, pSvmTransient));
5761
5762 case SVM_EXIT_XCPT_NMI: /* Should not occur, SVM_EXIT_NMI is used instead. */
5763 case SVM_EXIT_INTR:
5764 case SVM_EXIT_NMI: VMEXIT_CALL_RET(0, hmR0SvmExitIntr(pVCpu, pCtx, pSvmTransient));
5765
5766 case SVM_EXIT_READ_CR0:
5767 case SVM_EXIT_READ_CR3:
5768 case SVM_EXIT_READ_CR4: VMEXIT_CALL_RET(0, hmR0SvmExitReadCRx(pVCpu, pCtx, pSvmTransient));
5769
5770 case SVM_EXIT_CR0_SEL_WRITE:
5771 case SVM_EXIT_WRITE_CR0:
5772 case SVM_EXIT_WRITE_CR3:
5773 case SVM_EXIT_WRITE_CR4:
5774 case SVM_EXIT_WRITE_CR8: VMEXIT_CALL_RET(0, hmR0SvmExitWriteCRx(pVCpu, pCtx, pSvmTransient));
5775
5776 case SVM_EXIT_VINTR: VMEXIT_CALL_RET(0, hmR0SvmExitVIntr(pVCpu, pCtx, pSvmTransient));
5777 case SVM_EXIT_PAUSE: VMEXIT_CALL_RET(0, hmR0SvmExitPause(pVCpu, pCtx, pSvmTransient));
5778 case SVM_EXIT_VMMCALL: VMEXIT_CALL_RET(0, hmR0SvmExitVmmCall(pVCpu, pCtx, pSvmTransient));
5779 case SVM_EXIT_INVLPG: VMEXIT_CALL_RET(0, hmR0SvmExitInvlpg(pVCpu, pCtx, pSvmTransient));
5780 case SVM_EXIT_WBINVD: VMEXIT_CALL_RET(0, hmR0SvmExitWbinvd(pVCpu, pCtx, pSvmTransient));
5781 case SVM_EXIT_INVD: VMEXIT_CALL_RET(0, hmR0SvmExitInvd(pVCpu, pCtx, pSvmTransient));
5782 case SVM_EXIT_RDPMC: VMEXIT_CALL_RET(0, hmR0SvmExitRdpmc(pVCpu, pCtx, pSvmTransient));
5783 case SVM_EXIT_IRET: VMEXIT_CALL_RET(0, hmR0SvmExitIret(pVCpu, pCtx, pSvmTransient));
5784 case SVM_EXIT_XCPT_UD: VMEXIT_CALL_RET(0, hmR0SvmExitXcptUD(pVCpu, pCtx, pSvmTransient));
5785 case SVM_EXIT_XCPT_MF: VMEXIT_CALL_RET(0, hmR0SvmExitXcptMF(pVCpu, pCtx, pSvmTransient));
5786 case SVM_EXIT_XCPT_DB: VMEXIT_CALL_RET(0, hmR0SvmExitXcptDB(pVCpu, pCtx, pSvmTransient));
5787 case SVM_EXIT_XCPT_AC: VMEXIT_CALL_RET(0, hmR0SvmExitXcptAC(pVCpu, pCtx, pSvmTransient));
5788 case SVM_EXIT_XCPT_BP: VMEXIT_CALL_RET(0, hmR0SvmExitXcptBP(pVCpu, pCtx, pSvmTransient));
5789 case SVM_EXIT_XSETBV: VMEXIT_CALL_RET(0, hmR0SvmExitXsetbv(pVCpu, pCtx, pSvmTransient));
5790 case SVM_EXIT_FERR_FREEZE: VMEXIT_CALL_RET(0, hmR0SvmExitFerrFreeze(pVCpu, pCtx, pSvmTransient));
5791
5792 default:
5793 {
5794 switch (pSvmTransient->u64ExitCode)
5795 {
5796 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
5797 case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7: case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9:
5798 case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11: case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13:
5799 case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
5800 VMEXIT_CALL_RET(0, hmR0SvmExitReadDRx(pVCpu, pCtx, pSvmTransient));
5801
5802 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
5803 case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7: case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9:
5804 case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11: case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13:
5805 case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
5806 VMEXIT_CALL_RET(0, hmR0SvmExitWriteDRx(pVCpu, pCtx, pSvmTransient));
5807
5808 case SVM_EXIT_TASK_SWITCH: VMEXIT_CALL_RET(0, hmR0SvmExitTaskSwitch(pVCpu, pCtx, pSvmTransient));
5809 case SVM_EXIT_SHUTDOWN: VMEXIT_CALL_RET(0, hmR0SvmExitShutdown(pVCpu, pCtx, pSvmTransient));
5810
5811 case SVM_EXIT_SMI:
5812 case SVM_EXIT_INIT:
5813 {
5814 /*
5815 * We don't intercept SMIs. As for INIT signals, it really shouldn't ever happen here.
5816 * If it ever does, we want to know about it so log the exit code and bail.
5817 */
5818 VMEXIT_CALL_RET(0, hmR0SvmExitUnexpected(pVCpu, pCtx, pSvmTransient));
5819 }
5820
5821#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5822 case SVM_EXIT_CLGI: VMEXIT_CALL_RET(0, hmR0SvmExitClgi(pVCpu, pCtx, pSvmTransient));
5823 case SVM_EXIT_STGI: VMEXIT_CALL_RET(0, hmR0SvmExitStgi(pVCpu, pCtx, pSvmTransient));
5824 case SVM_EXIT_VMLOAD: VMEXIT_CALL_RET(0, hmR0SvmExitVmload(pVCpu, pCtx, pSvmTransient));
5825 case SVM_EXIT_VMSAVE: VMEXIT_CALL_RET(0, hmR0SvmExitVmsave(pVCpu, pCtx, pSvmTransient));
5826 case SVM_EXIT_INVLPGA: VMEXIT_CALL_RET(0, hmR0SvmExitInvlpga(pVCpu, pCtx, pSvmTransient));
5827 case SVM_EXIT_VMRUN: VMEXIT_CALL_RET(0, hmR0SvmExitVmrun(pVCpu, pCtx, pSvmTransient));
5828#else
5829 case SVM_EXIT_CLGI:
5830 case SVM_EXIT_STGI:
5831 case SVM_EXIT_VMLOAD:
5832 case SVM_EXIT_VMSAVE:
5833 case SVM_EXIT_INVLPGA:
5834 case SVM_EXIT_VMRUN:
5835#endif
5836 case SVM_EXIT_RSM:
5837 case SVM_EXIT_SKINIT:
5838 {
5839 hmR0SvmSetPendingXcptUD(pVCpu);
5840 return VINF_SUCCESS;
5841 }
5842
5843#ifdef HMSVM_ALWAYS_TRAP_ALL_XCPTS
5844 case SVM_EXIT_XCPT_DE:
5845 /* SVM_EXIT_XCPT_DB: */ /* Handled above. */
5846 /* SVM_EXIT_XCPT_NMI: */ /* Handled above. */
5847 /* SVM_EXIT_XCPT_BP: */ /* Handled above. */
5848 case SVM_EXIT_XCPT_OF:
5849 case SVM_EXIT_XCPT_BR:
5850 /* SVM_EXIT_XCPT_UD: */ /* Handled above. */
5851 case SVM_EXIT_XCPT_NM:
5852 case SVM_EXIT_XCPT_DF:
5853 case SVM_EXIT_XCPT_CO_SEG_OVERRUN:
5854 case SVM_EXIT_XCPT_TS:
5855 case SVM_EXIT_XCPT_NP:
5856 case SVM_EXIT_XCPT_SS:
5857 case SVM_EXIT_XCPT_GP:
5858 /* SVM_EXIT_XCPT_PF: */
5859 case SVM_EXIT_XCPT_15: /* Reserved. */
5860 /* SVM_EXIT_XCPT_MF: */ /* Handled above. */
5861 /* SVM_EXIT_XCPT_AC: */ /* Handled above. */
5862 case SVM_EXIT_XCPT_MC:
5863 case SVM_EXIT_XCPT_XF:
5864 case SVM_EXIT_XCPT_20: case SVM_EXIT_XCPT_21: case SVM_EXIT_XCPT_22: case SVM_EXIT_XCPT_23:
5865 case SVM_EXIT_XCPT_24: case SVM_EXIT_XCPT_25: case SVM_EXIT_XCPT_26: case SVM_EXIT_XCPT_27:
5866 case SVM_EXIT_XCPT_28: case SVM_EXIT_XCPT_29: case SVM_EXIT_XCPT_30: case SVM_EXIT_XCPT_31:
5867 VMEXIT_CALL_RET(0, hmR0SvmExitXcptGeneric(pVCpu, pCtx, pSvmTransient));
5868#endif /* HMSVM_ALWAYS_TRAP_ALL_XCPTS */
5869
5870 default:
5871 {
5872 AssertMsgFailed(("hmR0SvmHandleExit: Unknown exit code %#RX64\n", uExitCode));
5873 pVCpu->hm.s.u32HMError = uExitCode;
5874 return VERR_SVM_UNKNOWN_EXIT;
5875 }
5876 }
5877 }
5878 }
5879 /* not reached */
5880#undef VMEXIT_CALL_RET
5881}
5882
5883
5884#ifdef DEBUG
5885/* Is there some generic IPRT define for this that are not in Runtime/internal/\* ?? */
5886# define HMSVM_ASSERT_PREEMPT_CPUID_VAR() \
5887 RTCPUID const idAssertCpu = RTThreadPreemptIsEnabled(NIL_RTTHREAD) ? NIL_RTCPUID : RTMpCpuId()
5888
5889# define HMSVM_ASSERT_PREEMPT_CPUID() \
5890 do \
5891 { \
5892 RTCPUID const idAssertCpuNow = RTThreadPreemptIsEnabled(NIL_RTTHREAD) ? NIL_RTCPUID : RTMpCpuId(); \
5893 AssertMsg(idAssertCpu == idAssertCpuNow, ("SVM %#x, %#x\n", idAssertCpu, idAssertCpuNow)); \
5894 } while (0)
5895
5896# define HMSVM_VALIDATE_EXIT_HANDLER_PARAMS() \
5897 do { \
5898 AssertPtr(pVCpu); \
5899 AssertPtr(pCtx); \
5900 AssertPtr(pSvmTransient); \
5901 Assert(ASMIntAreEnabled()); \
5902 HMSVM_ASSERT_PREEMPT_SAFE(); \
5903 HMSVM_ASSERT_PREEMPT_CPUID_VAR(); \
5904 Log4Func(("vcpu[%u] -v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-v-\n", (uint32_t)pVCpu->idCpu)); \
5905 HMSVM_ASSERT_PREEMPT_SAFE(); \
5906 if (VMMR0IsLogFlushDisabled(pVCpu)) \
5907 HMSVM_ASSERT_PREEMPT_CPUID(); \
5908 } while (0)
5909#else /* Release builds */
5910# define HMSVM_VALIDATE_EXIT_HANDLER_PARAMS() do { NOREF(pVCpu); NOREF(pCtx); NOREF(pSvmTransient); } while (0)
5911#endif
5912
5913
5914/**
5915 * Worker for hmR0SvmInterpretInvlpg().
5916 *
5917 * @return VBox status code.
5918 * @param pVCpu The cross context virtual CPU structure.
5919 * @param pCpu Pointer to the disassembler state.
5920 * @param pCtx The guest CPU context.
5921 */
5922static int hmR0SvmInterpretInvlPgEx(PVMCPU pVCpu, PDISCPUSTATE pCpu, PCPUMCTX pCtx)
5923{
5924 DISQPVPARAMVAL Param1;
5925 RTGCPTR GCPtrPage;
5926
5927 int rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), pCpu, &pCpu->Param1, &Param1, DISQPVWHICH_SRC);
5928 if (RT_FAILURE(rc))
5929 return VERR_EM_INTERPRETER;
5930
5931 if ( Param1.type == DISQPV_TYPE_IMMEDIATE
5932 || Param1.type == DISQPV_TYPE_ADDRESS)
5933 {
5934 if (!(Param1.flags & (DISQPV_FLAG_32 | DISQPV_FLAG_64)))
5935 return VERR_EM_INTERPRETER;
5936
5937 GCPtrPage = Param1.val.val64;
5938 VBOXSTRICTRC rc2 = EMInterpretInvlpg(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx), GCPtrPage);
5939 rc = VBOXSTRICTRC_VAL(rc2);
5940 }
5941 else
5942 {
5943 Log4Func(("Invalid parameter type %#x\n", Param1.type));
5944 rc = VERR_EM_INTERPRETER;
5945 }
5946
5947 return rc;
5948}
5949
5950
5951/**
5952 * Interprets INVLPG.
5953 *
5954 * @returns VBox status code.
5955 * @retval VINF_* Scheduling instructions.
5956 * @retval VERR_EM_INTERPRETER Something we can't cope with.
5957 * @retval VERR_* Fatal errors.
5958 *
5959 * @param pVM The cross context VM structure.
5960 * @param pVCpu The cross context virtual CPU structure.
5961 * @param pCtx The guest CPU context.
5962 *
5963 * @remarks Updates the RIP if the instruction was executed successfully.
5964 */
5965static int hmR0SvmInterpretInvlpg(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5966{
5967 /* Only allow 32 & 64 bit code. */
5968 if (CPUMGetGuestCodeBits(pVCpu) != 16)
5969 {
5970 PDISSTATE pDis = &pVCpu->hm.s.DisState;
5971 int rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL /* pcbInstr */);
5972 if ( RT_SUCCESS(rc)
5973 && pDis->pCurInstr->uOpcode == OP_INVLPG)
5974 {
5975 rc = hmR0SvmInterpretInvlPgEx(pVCpu, pDis, pCtx);
5976 if (RT_SUCCESS(rc))
5977 pCtx->rip += pDis->cbInstr;
5978 return rc;
5979 }
5980 else
5981 Log4Func(("EMInterpretDisasCurrent failed! rc=%Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
5982 }
5983 return VERR_EM_INTERPRETER;
5984}
5985
5986
5987/**
5988 * Gets the IEM exception flags for the specified SVM event.
5989 *
5990 * @returns The IEM exception flags.
5991 * @param pEvent Pointer to the SVM event.
5992 *
5993 * @remarks This function currently only constructs flags required for
5994 * IEMEvaluateRecursiveXcpt and not the complete flags (e.g. error-code
5995 * and CR2 aspects of an exception are not included).
5996 */
5997static uint32_t hmR0SvmGetIemXcptFlags(PCSVMEVENT pEvent)
5998{
5999 uint8_t const uEventType = pEvent->n.u3Type;
6000 uint32_t fIemXcptFlags;
6001 switch (uEventType)
6002 {
6003 case SVM_EVENT_EXCEPTION:
6004 /*
6005 * Only INT3 and INTO instructions can raise #BP and #OF exceptions.
6006 * See AMD spec. Table 8-1. "Interrupt Vector Source and Cause".
6007 */
6008 if (pEvent->n.u8Vector == X86_XCPT_BP)
6009 {
6010 fIemXcptFlags = IEM_XCPT_FLAGS_T_SOFT_INT | IEM_XCPT_FLAGS_BP_INSTR;
6011 break;
6012 }
6013 if (pEvent->n.u8Vector == X86_XCPT_OF)
6014 {
6015 fIemXcptFlags = IEM_XCPT_FLAGS_T_SOFT_INT | IEM_XCPT_FLAGS_OF_INSTR;
6016 break;
6017 }
6018 /** @todo How do we distinguish ICEBP \#DB from the regular one? */
6019 RT_FALL_THRU();
6020 case SVM_EVENT_NMI:
6021 fIemXcptFlags = IEM_XCPT_FLAGS_T_CPU_XCPT;
6022 break;
6023
6024 case SVM_EVENT_EXTERNAL_IRQ:
6025 fIemXcptFlags = IEM_XCPT_FLAGS_T_EXT_INT;
6026 break;
6027
6028 case SVM_EVENT_SOFTWARE_INT:
6029 fIemXcptFlags = IEM_XCPT_FLAGS_T_SOFT_INT;
6030 break;
6031
6032 default:
6033 fIemXcptFlags = 0;
6034 AssertMsgFailed(("Unexpected event type! uEventType=%#x uVector=%#x", uEventType, pEvent->n.u8Vector));
6035 break;
6036 }
6037 return fIemXcptFlags;
6038}
6039
6040
6041/**
6042 * Handle a condition that occurred while delivering an event through the guest
6043 * IDT.
6044 *
6045 * @returns VBox status code (informational error codes included).
6046 * @retval VINF_SUCCESS if we should continue handling the \#VMEXIT.
6047 * @retval VINF_HM_DOUBLE_FAULT if a \#DF condition was detected and we ought to
6048 * continue execution of the guest which will delivery the \#DF.
6049 * @retval VINF_EM_RESET if we detected a triple-fault condition.
6050 * @retval VERR_EM_GUEST_CPU_HANG if we detected a guest CPU hang.
6051 *
6052 * @param pVCpu The cross context virtual CPU structure.
6053 * @param pCtx Pointer to the guest-CPU context.
6054 * @param pSvmTransient Pointer to the SVM transient structure.
6055 *
6056 * @remarks No-long-jump zone!!!
6057 */
6058static int hmR0SvmCheckExitDueToEventDelivery(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6059{
6060 int rc = VINF_SUCCESS;
6061 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6062 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR2);
6063
6064 Log4(("EXITINTINFO: Pending vectoring event %#RX64 Valid=%RTbool ErrValid=%RTbool Err=%#RX32 Type=%u Vector=%u\n",
6065 pVmcb->ctrl.ExitIntInfo.u, !!pVmcb->ctrl.ExitIntInfo.n.u1Valid, !!pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid,
6066 pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode, pVmcb->ctrl.ExitIntInfo.n.u3Type, pVmcb->ctrl.ExitIntInfo.n.u8Vector));
6067
6068 /*
6069 * The EXITINTINFO (if valid) contains the prior exception (IDT vector) that was trying to
6070 * be delivered to the guest which caused a #VMEXIT which was intercepted (Exit vector).
6071 *
6072 * See AMD spec. 15.7.3 "EXITINFO Pseudo-Code".
6073 */
6074 if (pVmcb->ctrl.ExitIntInfo.n.u1Valid)
6075 {
6076 IEMXCPTRAISE enmRaise;
6077 IEMXCPTRAISEINFO fRaiseInfo;
6078 bool const fExitIsHwXcpt = pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0 <= SVM_EXIT_XCPT_31;
6079 uint8_t const uIdtVector = pVmcb->ctrl.ExitIntInfo.n.u8Vector;
6080 if (fExitIsHwXcpt)
6081 {
6082 uint8_t const uExitVector = pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0;
6083 uint32_t const fIdtVectorFlags = hmR0SvmGetIemXcptFlags(&pVmcb->ctrl.ExitIntInfo);
6084 uint32_t const fExitVectorFlags = IEM_XCPT_FLAGS_T_CPU_XCPT;
6085 enmRaise = IEMEvaluateRecursiveXcpt(pVCpu, fIdtVectorFlags, uIdtVector, fExitVectorFlags, uExitVector, &fRaiseInfo);
6086 }
6087 else
6088 {
6089 /*
6090 * If delivery of an event caused a #VMEXIT that is not an exception (e.g. #NPF)
6091 * then we end up here.
6092 *
6093 * If the event was:
6094 * - a software interrupt, we can re-execute the instruction which will
6095 * regenerate the event.
6096 * - an NMI, we need to clear NMI blocking and re-inject the NMI.
6097 * - a hardware exception or external interrupt, we re-inject it.
6098 */
6099 fRaiseInfo = IEMXCPTRAISEINFO_NONE;
6100 if (pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_SOFTWARE_INT)
6101 enmRaise = IEMXCPTRAISE_REEXEC_INSTR;
6102 else
6103 enmRaise = IEMXCPTRAISE_PREV_EVENT;
6104 }
6105
6106 switch (enmRaise)
6107 {
6108 case IEMXCPTRAISE_CURRENT_XCPT:
6109 case IEMXCPTRAISE_PREV_EVENT:
6110 {
6111 /* For software interrupts, we shall re-execute the instruction. */
6112 if (!(fRaiseInfo & IEMXCPTRAISEINFO_SOFT_INT_XCPT))
6113 {
6114 RTGCUINTPTR GCPtrFaultAddress = 0;
6115
6116 /* If we are re-injecting an NMI, clear NMI blocking. */
6117 if (pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_NMI)
6118 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
6119
6120 /* Determine a vectoring #PF condition, see comment in hmR0SvmExitXcptPF(). */
6121 if (fRaiseInfo & (IEMXCPTRAISEINFO_EXT_INT_PF | IEMXCPTRAISEINFO_NMI_PF))
6122 {
6123 pSvmTransient->fVectoringPF = true;
6124 Log4Func(("IDT: Pending vectoring #PF due to delivery of Ext-Int/NMI. uCR2=%#RX64\n", pCtx->cr2));
6125 }
6126 else if ( pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_EXCEPTION
6127 && uIdtVector == X86_XCPT_PF)
6128 {
6129 /*
6130 * If the previous exception was a #PF, we need to recover the CR2 value.
6131 * This can't happen with shadow paging.
6132 */
6133 GCPtrFaultAddress = pCtx->cr2;
6134 }
6135
6136 /*
6137 * Without nested paging, when uExitVector is #PF, CR2 value will be updated from the VMCB's
6138 * exit info. fields, if it's a guest #PF, see hmR0SvmExitXcptPF().
6139 */
6140 Assert(pVmcb->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT);
6141 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
6142 hmR0SvmSetPendingEvent(pVCpu, &pVmcb->ctrl.ExitIntInfo, GCPtrFaultAddress);
6143
6144 Log4Func(("IDT: Pending vectoring event %#RX64 ErrValid=%RTbool Err=%#RX32 GCPtrFaultAddress=%#RX64\n",
6145 pVmcb->ctrl.ExitIntInfo.u, RT_BOOL(pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid),
6146 pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode, GCPtrFaultAddress));
6147 }
6148 break;
6149 }
6150
6151 case IEMXCPTRAISE_REEXEC_INSTR:
6152 {
6153 Assert(rc == VINF_SUCCESS);
6154 break;
6155 }
6156
6157 case IEMXCPTRAISE_DOUBLE_FAULT:
6158 {
6159 /*
6160 * Determing a vectoring double #PF condition. Used later, when PGM evaluates
6161 * the second #PF as a guest #PF (and not a shadow #PF) and needs to be
6162 * converted into a #DF.
6163 */
6164 if (fRaiseInfo & IEMXCPTRAISEINFO_PF_PF)
6165 {
6166 Log4Func(("IDT: Pending vectoring double #PF uCR2=%#RX64\n", pCtx->cr2));
6167 pSvmTransient->fVectoringDoublePF = true;
6168 Assert(rc == VINF_SUCCESS);
6169 }
6170 else
6171 {
6172 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
6173 hmR0SvmSetPendingXcptDF(pVCpu);
6174 rc = VINF_HM_DOUBLE_FAULT;
6175 }
6176 break;
6177 }
6178
6179 case IEMXCPTRAISE_TRIPLE_FAULT:
6180 {
6181 rc = VINF_EM_RESET;
6182 break;
6183 }
6184
6185 case IEMXCPTRAISE_CPU_HANG:
6186 {
6187 rc = VERR_EM_GUEST_CPU_HANG;
6188 break;
6189 }
6190
6191 default:
6192 {
6193 AssertMsgFailed(("hmR0SvmExitCpuid: EMInterpretCpuId failed with %Rrc\n", rc));
6194 rc = VERR_SVM_IPE_2;
6195 break;
6196 }
6197 }
6198 }
6199 Assert(rc == VINF_SUCCESS || rc == VINF_HM_DOUBLE_FAULT || rc == VINF_EM_RESET || rc == VERR_EM_GUEST_CPU_HANG);
6200 NOREF(pCtx);
6201 return rc;
6202}
6203
6204
6205/**
6206 * Advances the guest RIP making use of the CPU's NRIP_SAVE feature if
6207 * supported, otherwise advances the RIP by the number of bytes specified in
6208 * @a cb.
6209 *
6210 * @param pVCpu The cross context virtual CPU structure.
6211 * @param pCtx Pointer to the guest-CPU context.
6212 * @param cb RIP increment value in bytes.
6213 *
6214 * @remarks Use this function only from \#VMEXIT's where the NRIP value is valid
6215 * when NRIP_SAVE is supported by the CPU, otherwise use
6216 * hmR0SvmAdvanceRipDumb!
6217 */
6218DECLINLINE(void) hmR0SvmAdvanceRipHwAssist(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t cb)
6219{
6220 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6221 if (fSupportsNextRipSave)
6222 {
6223 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6224 Assert(pVmcb);
6225 Assert(pVmcb->ctrl.u64NextRIP);
6226 Assert(!(pCtx->fExtrn & CPUMCTX_EXTRN_RIP));
6227 AssertRelease(pVmcb->ctrl.u64NextRIP - pCtx->rip == cb); /* temporary, remove later */
6228 pCtx->rip = pVmcb->ctrl.u64NextRIP;
6229 }
6230 else
6231 pCtx->rip += cb;
6232
6233 HMSVM_UPDATE_INTR_SHADOW(pVCpu, pCtx);
6234}
6235
6236
6237/**
6238 * Gets the length of the current instruction if the CPU supports the NRIP_SAVE
6239 * feature. Otherwise, returns the value in @a cbLikely.
6240 *
6241 * @param pVCpu The cross context virtual CPU structure.
6242 * @param pCtx Pointer to the guest-CPU context.
6243 * @param cbLikely The likely instruction length.
6244 */
6245DECLINLINE(uint8_t) hmR0SvmGetInstrLengthHwAssist(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbLikely)
6246{
6247 Assert(cbLikely <= 15); /* See Intel spec. 2.3.11 "AVX Instruction Length" */
6248 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6249 if (fSupportsNextRipSave)
6250 {
6251 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6252 uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
6253 Assert(cbInstr == cbLikely);
6254 return cbInstr;
6255 }
6256 return cbLikely;
6257}
6258
6259
6260/**
6261 * Advances the guest RIP by the number of bytes specified in @a cb. This does
6262 * not make use of any hardware features to determine the instruction length.
6263 *
6264 * @param pVCpu The cross context virtual CPU structure.
6265 * @param pCtx Pointer to the guest-CPU context.
6266 * @param cb RIP increment value in bytes.
6267 */
6268DECLINLINE(void) hmR0SvmAdvanceRipDumb(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t cb)
6269{
6270 pCtx->rip += cb;
6271 HMSVM_UPDATE_INTR_SHADOW(pVCpu, pCtx);
6272}
6273#undef HMSVM_UPDATE_INTR_SHADOW
6274
6275
6276/* -=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= */
6277/* -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- #VMEXIT handlers -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- */
6278/* -=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= */
6279
6280/** @name \#VMEXIT handlers.
6281 * @{
6282 */
6283
6284/**
6285 * \#VMEXIT handler for external interrupts, NMIs, FPU assertion freeze and INIT
6286 * signals (SVM_EXIT_INTR, SVM_EXIT_NMI, SVM_EXIT_FERR_FREEZE, SVM_EXIT_INIT).
6287 */
6288HMSVM_EXIT_DECL hmR0SvmExitIntr(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6289{
6290 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6291
6292 if (pSvmTransient->u64ExitCode == SVM_EXIT_NMI)
6293 STAM_REL_COUNTER_INC(&pVCpu->hm.s.StatExitHostNmiInGC);
6294 else if (pSvmTransient->u64ExitCode == SVM_EXIT_INTR)
6295 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitExtInt);
6296
6297 /*
6298 * AMD-V has no preemption timer and the generic periodic preemption timer has no way to
6299 * signal -before- the timer fires if the current interrupt is our own timer or a some
6300 * other host interrupt. We also cannot examine what interrupt it is until the host
6301 * actually take the interrupt.
6302 *
6303 * Going back to executing guest code here unconditionally causes random scheduling
6304 * problems (observed on an AMD Phenom 9850 Quad-Core on Windows 64-bit host).
6305 */
6306 return VINF_EM_RAW_INTERRUPT;
6307}
6308
6309
6310/**
6311 * \#VMEXIT handler for WBINVD (SVM_EXIT_WBINVD). Conditional \#VMEXIT.
6312 */
6313HMSVM_EXIT_DECL hmR0SvmExitWbinvd(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6314{
6315 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6316
6317 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
6318 int rc = VINF_SUCCESS;
6319 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6320 return rc;
6321}
6322
6323
6324/**
6325 * \#VMEXIT handler for INVD (SVM_EXIT_INVD). Unconditional \#VMEXIT.
6326 */
6327HMSVM_EXIT_DECL hmR0SvmExitInvd(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6328{
6329 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6330
6331 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
6332 int rc = VINF_SUCCESS;
6333 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6334 return rc;
6335}
6336
6337
6338/**
6339 * \#VMEXIT handler for INVD (SVM_EXIT_CPUID). Conditional \#VMEXIT.
6340 */
6341HMSVM_EXIT_DECL hmR0SvmExitCpuid(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6342{
6343 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6344
6345 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_RIP
6346 | CPUMCTX_EXTRN_CS);
6347 VBOXSTRICTRC rcStrict;
6348 PCEMEXITREC pExitRec = EMHistoryUpdateFlagsAndTypeAndPC(pVCpu,
6349 EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_CPUID),
6350 pVCpu->cpum.GstCtx.rip + pVCpu->cpum.GstCtx.cs.u64Base);
6351 if (!pExitRec)
6352 {
6353 PVM pVM = pVCpu->CTX_SUFF(pVM);
6354 rcStrict = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
6355 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
6356 {
6357 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
6358 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6359 }
6360 else
6361 {
6362 AssertMsgFailed(("hmR0SvmExitCpuid: EMInterpretCpuId failed with %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
6363 rcStrict = VERR_EM_INTERPRETER;
6364 }
6365 }
6366 else
6367 {
6368 /*
6369 * Frequent exit or something needing probing. Get state and call EMHistoryExec.
6370 */
6371 Assert(pCtx == &pVCpu->cpum.GstCtx);
6372 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6373
6374 Log4(("CpuIdExit/%u: %04x:%08RX64: %#x/%#x -> EMHistoryExec\n",
6375 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ecx));
6376
6377 rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
6378
6379 Log4(("CpuIdExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
6380 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
6381 VBOXSTRICTRC_VAL(rcStrict), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip));
6382 }
6383 return VBOXSTRICTRC_TODO(rcStrict);
6384}
6385
6386
6387/**
6388 * \#VMEXIT handler for RDTSC (SVM_EXIT_RDTSC). Conditional \#VMEXIT.
6389 */
6390HMSVM_EXIT_DECL hmR0SvmExitRdtsc(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6391{
6392 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6393 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6394 VBOXSTRICTRC rcStrict = IEMExecDecodedRdtsc(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 2));
6395 if (rcStrict == VINF_SUCCESS)
6396 pSvmTransient->fUpdateTscOffsetting = true;
6397 else if (rcStrict == VINF_IEM_RAISED_XCPT)
6398 rcStrict = VINF_SUCCESS;
6399 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6400 return VBOXSTRICTRC_TODO(rcStrict);
6401}
6402
6403
6404/**
6405 * \#VMEXIT handler for RDTSCP (SVM_EXIT_RDTSCP). Conditional \#VMEXIT.
6406 */
6407HMSVM_EXIT_DECL hmR0SvmExitRdtscp(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6408{
6409 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6410 VBOXSTRICTRC rcStrict = IEMExecDecodedRdtscp(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3));
6411 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6412 if (rcStrict == VINF_SUCCESS)
6413 pSvmTransient->fUpdateTscOffsetting = true;
6414 else if (rcStrict == VINF_IEM_RAISED_XCPT)
6415 rcStrict = VINF_SUCCESS;
6416 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6417 return VBOXSTRICTRC_TODO(rcStrict);
6418}
6419
6420
6421/**
6422 * \#VMEXIT handler for RDPMC (SVM_EXIT_RDPMC). Conditional \#VMEXIT.
6423 */
6424HMSVM_EXIT_DECL hmR0SvmExitRdpmc(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6425{
6426 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6427 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0
6428 | CPUMCTX_EXTRN_CR4
6429 | CPUMCTX_EXTRN_SS);
6430
6431 int rc = EMInterpretRdpmc(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
6432 if (RT_LIKELY(rc == VINF_SUCCESS))
6433 {
6434 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
6435 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6436 }
6437 else
6438 {
6439 AssertMsgFailed(("hmR0SvmExitRdpmc: EMInterpretRdpmc failed with %Rrc\n", rc));
6440 rc = VERR_EM_INTERPRETER;
6441 }
6442 return rc;
6443}
6444
6445
6446/**
6447 * \#VMEXIT handler for INVLPG (SVM_EXIT_INVLPG). Conditional \#VMEXIT.
6448 */
6449HMSVM_EXIT_DECL hmR0SvmExitInvlpg(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6450{
6451 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6452 PVM pVM = pVCpu->CTX_SUFF(pVM);
6453 Assert(!pVM->hm.s.fNestedPaging);
6454
6455 bool const fSupportsDecodeAssists = hmR0SvmSupportsDecodeAssists(pVCpu, pCtx);
6456 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6457 if ( fSupportsDecodeAssists
6458 && fSupportsNextRipSave)
6459 {
6460 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6461 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6462 uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
6463 RTGCPTR const GCPtrPage = pVmcb->ctrl.u64ExitInfo1;
6464 VBOXSTRICTRC rcStrict = IEMExecDecodedInvlpg(pVCpu, cbInstr, GCPtrPage);
6465 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6466 return VBOXSTRICTRC_VAL(rcStrict);
6467 }
6468
6469 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6470 int rc = hmR0SvmInterpretInvlpg(pVM, pVCpu, pCtx); /* Updates RIP if successful. */
6471 Assert(rc == VINF_SUCCESS || rc == VERR_EM_INTERPRETER);
6472 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6473 return rc;
6474}
6475
6476
6477/**
6478 * \#VMEXIT handler for HLT (SVM_EXIT_HLT). Conditional \#VMEXIT.
6479 */
6480HMSVM_EXIT_DECL hmR0SvmExitHlt(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6481{
6482 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6483
6484 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 1);
6485 int rc = EMShouldContinueAfterHalt(pVCpu, pCtx) ? VINF_SUCCESS : VINF_EM_HALT;
6486 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6487
6488 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
6489 if (rc != VINF_SUCCESS)
6490 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHltToR3);
6491 return rc;
6492}
6493
6494
6495/**
6496 * \#VMEXIT handler for MONITOR (SVM_EXIT_MONITOR). Conditional \#VMEXIT.
6497 */
6498HMSVM_EXIT_DECL hmR0SvmExitMonitor(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6499{
6500 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6501 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0
6502 | CPUMCTX_EXTRN_SS);
6503
6504 int rc = EMInterpretMonitor(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
6505 if (RT_LIKELY(rc == VINF_SUCCESS))
6506 {
6507 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 3);
6508 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6509 }
6510 else
6511 {
6512 AssertMsg(rc == VERR_EM_INTERPRETER, ("hmR0SvmExitMonitor: EMInterpretMonitor failed with %Rrc\n", rc));
6513 rc = VERR_EM_INTERPRETER;
6514 }
6515 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMonitor);
6516 return rc;
6517}
6518
6519
6520/**
6521 * \#VMEXIT handler for MWAIT (SVM_EXIT_MWAIT). Conditional \#VMEXIT.
6522 */
6523HMSVM_EXIT_DECL hmR0SvmExitMwait(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6524{
6525 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6526 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0
6527 | CPUMCTX_EXTRN_SS);
6528
6529 VBOXSTRICTRC rc2 = EMInterpretMWait(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
6530 int rc = VBOXSTRICTRC_VAL(rc2);
6531 if ( rc == VINF_EM_HALT
6532 || rc == VINF_SUCCESS)
6533 {
6534 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 3);
6535
6536 if ( rc == VINF_EM_HALT
6537 && EMMonitorWaitShouldContinue(pVCpu, pCtx))
6538 {
6539 rc = VINF_SUCCESS;
6540 }
6541 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6542 }
6543 else
6544 {
6545 AssertMsg(rc == VERR_EM_INTERPRETER, ("hmR0SvmExitMwait: EMInterpretMWait failed with %Rrc\n", rc));
6546 rc = VERR_EM_INTERPRETER;
6547 }
6548 AssertMsg(rc == VINF_SUCCESS || rc == VINF_EM_HALT || rc == VERR_EM_INTERPRETER,
6549 ("hmR0SvmExitMwait: EMInterpretMWait failed rc=%Rrc\n", rc));
6550 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMwait);
6551 return rc;
6552}
6553
6554
6555/**
6556 * \#VMEXIT handler for shutdown (triple-fault) (SVM_EXIT_SHUTDOWN). Conditional
6557 * \#VMEXIT.
6558 */
6559HMSVM_EXIT_DECL hmR0SvmExitShutdown(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6560{
6561 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6562 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6563 return VINF_EM_RESET;
6564}
6565
6566
6567/**
6568 * \#VMEXIT handler for unexpected exits. Conditional \#VMEXIT.
6569 */
6570HMSVM_EXIT_DECL hmR0SvmExitUnexpected(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6571{
6572 RT_NOREF(pCtx);
6573 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6574 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6575 AssertMsgFailed(("hmR0SvmExitUnexpected: ExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pSvmTransient->u64ExitCode,
6576 pVmcb->ctrl.u64ExitInfo1, pVmcb->ctrl.u64ExitInfo2));
6577 RT_NOREF(pVmcb);
6578 pVCpu->hm.s.u32HMError = (uint32_t)pSvmTransient->u64ExitCode;
6579 return VERR_SVM_UNEXPECTED_EXIT;
6580}
6581
6582
6583/**
6584 * \#VMEXIT handler for CRx reads (SVM_EXIT_READ_CR*). Conditional \#VMEXIT.
6585 */
6586HMSVM_EXIT_DECL hmR0SvmExitReadCRx(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6587{
6588 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6589
6590 Log4Func(("CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
6591#ifdef VBOX_WITH_STATISTICS
6592 switch (pSvmTransient->u64ExitCode)
6593 {
6594 case SVM_EXIT_READ_CR0: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Read); break;
6595 case SVM_EXIT_READ_CR2: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Read); break;
6596 case SVM_EXIT_READ_CR3: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Read); break;
6597 case SVM_EXIT_READ_CR4: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Read); break;
6598 case SVM_EXIT_READ_CR8: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Read); break;
6599 }
6600#endif
6601
6602 bool const fSupportsDecodeAssists = hmR0SvmSupportsDecodeAssists(pVCpu, pCtx);
6603 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6604 if ( fSupportsDecodeAssists
6605 && fSupportsNextRipSave)
6606 {
6607 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6608 bool const fMovCRx = RT_BOOL(pVmcb->ctrl.u64ExitInfo1 & SVM_EXIT1_MOV_CRX_MASK);
6609 if (fMovCRx)
6610 {
6611 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6612 uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
6613 uint8_t const iCrReg = pSvmTransient->u64ExitCode - SVM_EXIT_READ_CR0;
6614 uint8_t const iGReg = pVmcb->ctrl.u64ExitInfo1 & SVM_EXIT1_MOV_CRX_GPR_NUMBER;
6615 VBOXSTRICTRC rcStrict = IEMExecDecodedMovCRxRead(pVCpu, cbInstr, iGReg, iCrReg);
6616 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6617 return VBOXSTRICTRC_VAL(rcStrict);
6618 }
6619 /* else: SMSW instruction, fall back below to IEM for this. */
6620 }
6621
6622 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6623 VBOXSTRICTRC rc2 = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */);
6624 int rc = VBOXSTRICTRC_VAL(rc2);
6625 AssertMsg(rc == VINF_SUCCESS || rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3,
6626 ("hmR0SvmExitReadCRx: EMInterpretInstruction failed rc=%Rrc\n", rc));
6627 Assert((pSvmTransient->u64ExitCode - SVM_EXIT_READ_CR0) <= 15);
6628 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6629 return rc;
6630}
6631
6632
6633/**
6634 * \#VMEXIT handler for CRx writes (SVM_EXIT_WRITE_CR*). Conditional \#VMEXIT.
6635 */
6636HMSVM_EXIT_DECL hmR0SvmExitWriteCRx(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6637{
6638 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6639
6640 uint64_t const uExitCode = pSvmTransient->u64ExitCode;
6641 uint8_t const iCrReg = uExitCode == SVM_EXIT_CR0_SEL_WRITE ? 0 : (pSvmTransient->u64ExitCode - SVM_EXIT_WRITE_CR0);
6642 Assert(iCrReg <= 15);
6643
6644 VBOXSTRICTRC rcStrict = VERR_SVM_IPE_5;
6645 bool fDecodedInstr = false;
6646 bool const fSupportsDecodeAssists = hmR0SvmSupportsDecodeAssists(pVCpu, pCtx);
6647 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6648 if ( fSupportsDecodeAssists
6649 && fSupportsNextRipSave)
6650 {
6651 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6652 bool const fMovCRx = RT_BOOL(pVmcb->ctrl.u64ExitInfo1 & SVM_EXIT1_MOV_CRX_MASK);
6653 if (fMovCRx)
6654 {
6655 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6656 uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
6657 uint8_t const iGReg = pVmcb->ctrl.u64ExitInfo1 & SVM_EXIT1_MOV_CRX_GPR_NUMBER;
6658 Log4Func(("Mov CR%u w/ iGReg=%#x\n", iCrReg, iGReg));
6659 rcStrict = IEMExecDecodedMovCRxWrite(pVCpu, cbInstr, iCrReg, iGReg);
6660 fDecodedInstr = true;
6661 }
6662 /* else: LMSW or CLTS instruction, fall back below to IEM for this. */
6663 }
6664
6665 if (!fDecodedInstr)
6666 {
6667 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6668 Log4Func(("iCrReg=%#x\n", iCrReg));
6669 rcStrict = IEMExecOneBypassEx(pVCpu, CPUMCTX2CORE(pCtx), NULL);
6670 if (RT_UNLIKELY( rcStrict == VERR_IEM_ASPECT_NOT_IMPLEMENTED
6671 || rcStrict == VERR_IEM_INSTR_NOT_IMPLEMENTED))
6672 rcStrict = VERR_EM_INTERPRETER;
6673 }
6674
6675 if (rcStrict == VINF_SUCCESS)
6676 {
6677 switch (iCrReg)
6678 {
6679 case 0:
6680 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
6681 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Write);
6682 break;
6683
6684 case 2:
6685 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR2);
6686 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Write);
6687 break;
6688
6689 case 3:
6690 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR3);
6691 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Write);
6692 break;
6693
6694 case 4:
6695 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR4);
6696 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Write);
6697 break;
6698
6699 case 8:
6700 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
6701 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Write);
6702 break;
6703
6704 default:
6705 {
6706 AssertMsgFailed(("hmR0SvmExitWriteCRx: Invalid/Unexpected Write-CRx exit. u64ExitCode=%#RX64 %#x\n",
6707 pSvmTransient->u64ExitCode, iCrReg));
6708 break;
6709 }
6710 }
6711 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6712 }
6713 else
6714 Assert(rcStrict == VERR_EM_INTERPRETER || rcStrict == VINF_PGM_CHANGE_MODE || rcStrict == VINF_PGM_SYNC_CR3);
6715 return VBOXSTRICTRC_TODO(rcStrict);
6716}
6717
6718
6719/**
6720 * \#VMEXIT helper for read MSRs, see hmR0SvmExitMsr.
6721 *
6722 * @returns VBox status code.
6723 * @param pVCpu The cross context virtual CPU structure.
6724 * @param pVmcb Pointer to the VM control block.
6725 */
6726static int hmR0SvmExitReadMsr(PVMCPU pVCpu, PSVMVMCB pVmcb)
6727{
6728 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
6729 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0
6730 | CPUMCTX_EXTRN_RFLAGS
6731 | CPUMCTX_EXTRN_SS
6732 | CPUMCTX_EXTRN_ALL_MSRS);
6733
6734 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdmsr);
6735 Log4Func(("idMsr=%#RX32\n", pCtx->ecx));
6736
6737 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6738 if (fSupportsNextRipSave)
6739 {
6740 int rc = EMInterpretRdmsr(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
6741 if (RT_LIKELY(rc == VINF_SUCCESS))
6742 {
6743 pCtx->rip = pVmcb->ctrl.u64NextRIP;
6744 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6745 return VINF_SUCCESS;
6746 }
6747
6748 AssertMsg( rc == VERR_EM_INTERPRETER
6749 || rc == VINF_CPUM_R3_MSR_READ, ("EMInterpretRdmsr failed rc=%Rrc\n", rc));
6750 return rc;
6751 }
6752
6753 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6754 int rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0));
6755 if (RT_UNLIKELY(rc != VINF_SUCCESS))
6756 {
6757 AssertMsg( rc == VERR_EM_INTERPRETER
6758 || rc == VINF_CPUM_R3_MSR_READ, ("EMInterpretInstruction failed rc=%Rrc\n", rc));
6759 }
6760 /* RIP updated by EMInterpretInstruction(). */
6761 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6762 return rc;
6763}
6764
6765
6766/**
6767 * \#VMEXIT helper for write MSRs, see hmR0SvmExitMsr.
6768 *
6769 * @returns VBox status code.
6770 * @param pVCpu The cross context virtual CPU structure.
6771 * @param pVmcb Pointer to the VM control block.
6772 * @param pSvmTransient Pointer to the SVM-transient structure.
6773 */
6774static int hmR0SvmExitWriteMsr(PVMCPU pVCpu, PSVMVMCB pVmcb, PSVMTRANSIENT pSvmTransient)
6775{
6776 PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
6777 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0
6778 | CPUMCTX_EXTRN_RFLAGS
6779 | CPUMCTX_EXTRN_SS
6780 | CPUMCTX_EXTRN_ALL_MSRS);
6781
6782 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitWrmsr);
6783 Log4Func(("idMsr=%#RX32\n", pCtx->ecx));
6784
6785 /*
6786 * Handle TPR patching MSR writes.
6787 * We utilitize the LSTAR MSR for patching.
6788 */
6789 if ( pVCpu->CTX_SUFF(pVM)->hm.s.fTPRPatchingActive
6790 && pCtx->ecx == MSR_K8_LSTAR)
6791 {
6792 if ((pCtx->eax & 0xff) != pSvmTransient->u8GuestTpr)
6793 {
6794 /* Our patch code uses LSTAR for TPR caching for 32-bit guests. */
6795 int rc2 = APICSetTpr(pVCpu, pCtx->eax & 0xff);
6796 AssertRC(rc2);
6797 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
6798 }
6799
6800 int rc = VINF_SUCCESS;
6801 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
6802 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6803 return rc;
6804 }
6805
6806 /*
6807 * Handle regular MSR writes.
6808 */
6809 int rc;
6810 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
6811 if (fSupportsNextRipSave)
6812 {
6813 rc = EMInterpretWrmsr(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
6814 if (RT_LIKELY(rc == VINF_SUCCESS))
6815 {
6816 pCtx->rip = pVmcb->ctrl.u64NextRIP;
6817 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6818 }
6819 else
6820 AssertMsg( rc == VERR_EM_INTERPRETER
6821 || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: EMInterpretWrmsr failed rc=%Rrc\n", rc));
6822 }
6823 else
6824 {
6825 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6826 rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */));
6827 if (RT_LIKELY(rc == VINF_SUCCESS))
6828 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc); /* RIP updated by EMInterpretInstruction(). */
6829 else
6830 AssertMsg( rc == VERR_EM_INTERPRETER
6831 || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: WrMsr. EMInterpretInstruction failed rc=%Rrc\n", rc));
6832 }
6833
6834 if (rc == VINF_SUCCESS)
6835 {
6836 /* If this is an X2APIC WRMSR access, update the APIC TPR state. */
6837 if ( pCtx->ecx >= MSR_IA32_X2APIC_START
6838 && pCtx->ecx <= MSR_IA32_X2APIC_END)
6839 {
6840 /*
6841 * We've already saved the APIC related guest-state (TPR) in hmR0SvmPostRunGuest().
6842 * When full APIC register virtualization is implemented we'll have to make sure
6843 * APIC state is saved from the VMCB before EMInterpretWrmsr() changes it.
6844 */
6845 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
6846 }
6847 else
6848 {
6849 switch (pCtx->ecx)
6850 {
6851 case MSR_IA32_TSC: pSvmTransient->fUpdateTscOffsetting = true; break;
6852 case MSR_K6_EFER: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_EFER_MSR); break;
6853 case MSR_K8_FS_BASE: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_FS); break;
6854 case MSR_K8_GS_BASE: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_GS); break;
6855 case MSR_IA32_SYSENTER_CS: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_CS_MSR); break;
6856 case MSR_IA32_SYSENTER_EIP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_EIP_MSR); break;
6857 case MSR_IA32_SYSENTER_ESP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_ESP_MSR); break;
6858 }
6859 }
6860 }
6861
6862 /* RIP has been updated by above after EMInterpretWrmsr() or by EMInterpretInstruction(). */
6863 return rc;
6864}
6865
6866
6867/**
6868 * \#VMEXIT handler for MSR read and writes (SVM_EXIT_MSR). Conditional
6869 * \#VMEXIT.
6870 */
6871HMSVM_EXIT_DECL hmR0SvmExitMsr(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6872{
6873 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6874
6875 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
6876 if (pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_READ)
6877 return hmR0SvmExitReadMsr(pVCpu, pVmcb);
6878
6879 Assert(pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_WRITE);
6880 return hmR0SvmExitWriteMsr(pVCpu, pVmcb, pSvmTransient);
6881}
6882
6883
6884/**
6885 * \#VMEXIT handler for DRx read (SVM_EXIT_READ_DRx). Conditional \#VMEXIT.
6886 */
6887HMSVM_EXIT_DECL hmR0SvmExitReadDRx(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6888{
6889 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6890 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
6891
6892 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
6893
6894 /** @todo Stepping with nested-guest. */
6895 if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
6896 {
6897 /* We should -not- get this #VMEXIT if the guest's debug registers were active. */
6898 if (pSvmTransient->fWasGuestDebugStateActive)
6899 {
6900 AssertMsgFailed(("hmR0SvmExitReadDRx: Unexpected exit %#RX32\n", (uint32_t)pSvmTransient->u64ExitCode));
6901 pVCpu->hm.s.u32HMError = (uint32_t)pSvmTransient->u64ExitCode;
6902 return VERR_SVM_UNEXPECTED_EXIT;
6903 }
6904
6905 /*
6906 * Lazy DR0-3 loading.
6907 */
6908 if (!pSvmTransient->fWasHyperDebugStateActive)
6909 {
6910 Assert(!DBGFIsStepping(pVCpu)); Assert(!pVCpu->hm.s.fSingleInstruction);
6911 Log5(("hmR0SvmExitReadDRx: Lazy loading guest debug registers\n"));
6912
6913 /* Don't intercept DRx read and writes. */
6914 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
6915 pVmcb->ctrl.u16InterceptRdDRx = 0;
6916 pVmcb->ctrl.u16InterceptWrDRx = 0;
6917 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_INTERCEPTS;
6918
6919 /* We're playing with the host CPU state here, make sure we don't preempt or longjmp. */
6920 VMMRZCallRing3Disable(pVCpu);
6921 HM_DISABLE_PREEMPT();
6922
6923 /* Save the host & load the guest debug state, restart execution of the MOV DRx instruction. */
6924 CPUMR0LoadGuestDebugState(pVCpu, false /* include DR6 */);
6925 Assert(CPUMIsGuestDebugStateActive(pVCpu) || HC_ARCH_BITS == 32);
6926
6927 HM_RESTORE_PREEMPT();
6928 VMMRZCallRing3Enable(pVCpu);
6929
6930 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxContextSwitch);
6931 return VINF_SUCCESS;
6932 }
6933 }
6934
6935 /*
6936 * Interpret the read/writing of DRx.
6937 */
6938 /** @todo Decode assist. */
6939 VBOXSTRICTRC rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */);
6940 Log5(("hmR0SvmExitReadDRx: Emulated DRx access: rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
6941 if (RT_LIKELY(rc == VINF_SUCCESS))
6942 {
6943 /* Not necessary for read accesses but whatever doesn't hurt for now, will be fixed with decode assist. */
6944 /** @todo CPUM should set this flag! */
6945 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_DR_MASK);
6946 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
6947 }
6948 else
6949 Assert(rc == VERR_EM_INTERPRETER);
6950 return VBOXSTRICTRC_TODO(rc);
6951}
6952
6953
6954/**
6955 * \#VMEXIT handler for DRx write (SVM_EXIT_WRITE_DRx). Conditional \#VMEXIT.
6956 */
6957HMSVM_EXIT_DECL hmR0SvmExitWriteDRx(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6958{
6959 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6960 /* For now it's the same since we interpret the instruction anyway. Will change when using of Decode Assist is implemented. */
6961 int rc = hmR0SvmExitReadDRx(pVCpu, pCtx, pSvmTransient);
6962 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
6963 STAM_COUNTER_DEC(&pVCpu->hm.s.StatExitDRxRead);
6964 return rc;
6965}
6966
6967
6968/**
6969 * \#VMEXIT handler for XCRx write (SVM_EXIT_XSETBV). Conditional \#VMEXIT.
6970 */
6971HMSVM_EXIT_DECL hmR0SvmExitXsetbv(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6972{
6973 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6974 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
6975
6976 /** @todo decode assists... */
6977 VBOXSTRICTRC rcStrict = IEMExecOne(pVCpu);
6978 if (rcStrict == VINF_IEM_RAISED_XCPT)
6979 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_XCPT_RAISED_MASK);
6980
6981 pVCpu->hm.s.fLoadSaveGuestXcr0 = (pCtx->cr4 & X86_CR4_OSXSAVE) && pCtx->aXcr[0] != ASMGetXcr0();
6982 Log4Func(("New XCR0=%#RX64 fLoadSaveGuestXcr0=%d (cr4=%RX64) rcStrict=%Rrc\n", pCtx->aXcr[0], pVCpu->hm.s.fLoadSaveGuestXcr0,
6983 pCtx->cr4, VBOXSTRICTRC_VAL(rcStrict)));
6984
6985 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
6986 return VBOXSTRICTRC_TODO(rcStrict);
6987}
6988
6989
6990/**
6991 * \#VMEXIT handler for I/O instructions (SVM_EXIT_IOIO). Conditional \#VMEXIT.
6992 */
6993HMSVM_EXIT_DECL hmR0SvmExitIOInstr(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
6994{
6995 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
6996 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK
6997 | CPUMCTX_EXTRN_SREG_MASK);
6998
6999 /* I/O operation lookup arrays. */
7000 static uint32_t const s_aIOSize[8] = { 0, 1, 2, 0, 4, 0, 0, 0 }; /* Size of the I/O accesses in bytes. */
7001 static uint32_t const s_aIOOpAnd[8] = { 0, 0xff, 0xffff, 0, 0xffffffff, 0, 0, 0 }; /* AND masks for saving
7002 the result (in AL/AX/EAX). */
7003 Log4Func(("CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
7004
7005 PVM pVM = pVCpu->CTX_SUFF(pVM);
7006 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7007
7008 /* Refer AMD spec. 15.10.2 "IN and OUT Behaviour" and Figure 15-2. "EXITINFO1 for IOIO Intercept" for the format. */
7009 SVMIOIOEXITINFO IoExitInfo;
7010 IoExitInfo.u = (uint32_t)pVmcb->ctrl.u64ExitInfo1;
7011 uint32_t uIOWidth = (IoExitInfo.u >> 4) & 0x7;
7012 uint32_t cbValue = s_aIOSize[uIOWidth];
7013 uint32_t uAndVal = s_aIOOpAnd[uIOWidth];
7014
7015 if (RT_UNLIKELY(!cbValue))
7016 {
7017 AssertMsgFailed(("hmR0SvmExitIOInstr: Invalid IO operation. uIOWidth=%u\n", uIOWidth));
7018 return VERR_EM_INTERPRETER;
7019 }
7020
7021 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_RIP
7022 | CPUMCTX_EXTRN_CS
7023 | CPUMCTX_EXTRN_RFLAGS);
7024 VBOXSTRICTRC rcStrict;
7025 PCEMEXITREC pExitRec = NULL;
7026 if ( !pVCpu->hm.s.fSingleInstruction
7027 && !pVCpu->cpum.GstCtx.eflags.Bits.u1TF)
7028 pExitRec = EMHistoryUpdateFlagsAndTypeAndPC(pVCpu,
7029 !IoExitInfo.n.u1Str
7030 ? IoExitInfo.n.u1Type == SVM_IOIO_READ
7031 ? EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_IO_PORT_READ)
7032 : EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_IO_PORT_WRITE)
7033 : IoExitInfo.n.u1Type == SVM_IOIO_READ
7034 ? EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_IO_PORT_STR_READ)
7035 : EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_IO_PORT_STR_WRITE),
7036 pVCpu->cpum.GstCtx.rip + pVCpu->cpum.GstCtx.cs.u64Base);
7037 if (!pExitRec)
7038 {
7039 bool fUpdateRipAlready = false;
7040 if (IoExitInfo.n.u1Str)
7041 {
7042 /* INS/OUTS - I/O String instruction. */
7043 /** @todo Huh? why can't we use the segment prefix information given by AMD-V
7044 * in EXITINFO1? Investigate once this thing is up and running. */
7045 Log4Func(("CS:RIP=%04x:%08RX64 %#06x/%u %c str\n", pCtx->cs.Sel, pCtx->rip, IoExitInfo.n.u16Port, cbValue,
7046 IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? 'w' : 'r'));
7047 AssertReturn(pCtx->dx == IoExitInfo.n.u16Port, VERR_SVM_IPE_2);
7048 static IEMMODE const s_aenmAddrMode[8] =
7049 {
7050 (IEMMODE)-1, IEMMODE_16BIT, IEMMODE_32BIT, (IEMMODE)-1, IEMMODE_64BIT, (IEMMODE)-1, (IEMMODE)-1, (IEMMODE)-1
7051 };
7052 IEMMODE enmAddrMode = s_aenmAddrMode[(IoExitInfo.u >> 7) & 0x7];
7053 if (enmAddrMode != (IEMMODE)-1)
7054 {
7055 uint64_t cbInstr = pVmcb->ctrl.u64ExitInfo2 - pCtx->rip;
7056 if (cbInstr <= 15 && cbInstr >= 1)
7057 {
7058 Assert(cbInstr >= 1U + IoExitInfo.n.u1Rep);
7059 if (IoExitInfo.n.u1Type == SVM_IOIO_WRITE)
7060 {
7061 /* Don't know exactly how to detect whether u3Seg is valid, currently
7062 only enabling it for Bulldozer and later with NRIP. OS/2 broke on
7063 2384 Opterons when only checking NRIP. */
7064 bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
7065 if ( fSupportsNextRipSave
7066 && pVM->cpum.ro.GuestFeatures.enmMicroarch >= kCpumMicroarch_AMD_15h_First)
7067 {
7068 AssertMsg(IoExitInfo.n.u3Seg == X86_SREG_DS || cbInstr > 1U + IoExitInfo.n.u1Rep,
7069 ("u32Seg=%d cbInstr=%d u1REP=%d", IoExitInfo.n.u3Seg, cbInstr, IoExitInfo.n.u1Rep));
7070 rcStrict = IEMExecStringIoWrite(pVCpu, cbValue, enmAddrMode, IoExitInfo.n.u1Rep, (uint8_t)cbInstr,
7071 IoExitInfo.n.u3Seg, true /*fIoChecked*/);
7072 }
7073 else if (cbInstr == 1U + IoExitInfo.n.u1Rep)
7074 rcStrict = IEMExecStringIoWrite(pVCpu, cbValue, enmAddrMode, IoExitInfo.n.u1Rep, (uint8_t)cbInstr,
7075 X86_SREG_DS, true /*fIoChecked*/);
7076 else
7077 rcStrict = IEMExecOne(pVCpu);
7078 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringWrite);
7079 }
7080 else
7081 {
7082 AssertMsg(IoExitInfo.n.u3Seg == X86_SREG_ES /*=0*/, ("%#x\n", IoExitInfo.n.u3Seg));
7083 rcStrict = IEMExecStringIoRead(pVCpu, cbValue, enmAddrMode, IoExitInfo.n.u1Rep, (uint8_t)cbInstr,
7084 true /*fIoChecked*/);
7085 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringRead);
7086 }
7087 }
7088 else
7089 {
7090 AssertMsgFailed(("rip=%RX64 nrip=%#RX64 cbInstr=%#RX64\n", pCtx->rip, pVmcb->ctrl.u64ExitInfo2, cbInstr));
7091 rcStrict = IEMExecOne(pVCpu);
7092 }
7093 }
7094 else
7095 {
7096 AssertMsgFailed(("IoExitInfo=%RX64\n", IoExitInfo.u));
7097 rcStrict = IEMExecOne(pVCpu);
7098 }
7099 fUpdateRipAlready = true;
7100 }
7101 else
7102 {
7103 /* IN/OUT - I/O instruction. */
7104 Assert(!IoExitInfo.n.u1Rep);
7105
7106 if (IoExitInfo.n.u1Type == SVM_IOIO_WRITE)
7107 {
7108 rcStrict = IOMIOPortWrite(pVM, pVCpu, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, cbValue);
7109 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOWrite);
7110 }
7111 else
7112 {
7113 uint32_t u32Val = 0;
7114 rcStrict = IOMIOPortRead(pVM, pVCpu, IoExitInfo.n.u16Port, &u32Val, cbValue);
7115 if (IOM_SUCCESS(rcStrict))
7116 {
7117 /* Save result of I/O IN instr. in AL/AX/EAX. */
7118 /** @todo r=bird: 32-bit op size should clear high bits of rax! */
7119 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
7120 }
7121 else if (rcStrict == VINF_IOM_R3_IOPORT_READ)
7122 HMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pVmcb->ctrl.u64ExitInfo2, IoExitInfo.n.u16Port, uAndVal, cbValue);
7123
7124 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);
7125 }
7126 }
7127
7128 if (IOM_SUCCESS(rcStrict))
7129 {
7130 /* AMD-V saves the RIP of the instruction following the IO instruction in EXITINFO2. */
7131 if (!fUpdateRipAlready)
7132 pCtx->rip = pVmcb->ctrl.u64ExitInfo2;
7133
7134 /*
7135 * If any I/O breakpoints are armed, we need to check if one triggered
7136 * and take appropriate action.
7137 * Note that the I/O breakpoint type is undefined if CR4.DE is 0.
7138 */
7139 /** @todo Optimize away the DBGFBpIsHwIoArmed call by having DBGF tell the
7140 * execution engines about whether hyper BPs and such are pending. */
7141 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_DR7);
7142 uint32_t const uDr7 = pCtx->dr[7];
7143 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7144 && X86_DR7_ANY_RW_IO(uDr7)
7145 && (pCtx->cr4 & X86_CR4_DE))
7146 || DBGFBpIsHwIoArmed(pVM)))
7147 {
7148 /* We're playing with the host CPU state here, make sure we don't preempt or longjmp. */
7149 VMMRZCallRing3Disable(pVCpu);
7150 HM_DISABLE_PREEMPT();
7151
7152 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxIoCheck);
7153 CPUMR0DebugStateMaybeSaveGuest(pVCpu, false /*fDr6*/);
7154
7155 VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, pCtx, IoExitInfo.n.u16Port, cbValue);
7156 if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
7157 {
7158 /* Raise #DB. */
7159 pVmcb->guest.u64DR6 = pCtx->dr[6];
7160 pVmcb->guest.u64DR7 = pCtx->dr[7];
7161 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
7162 hmR0SvmSetPendingXcptDB(pVCpu);
7163 }
7164 /* rcStrict is VINF_SUCCESS, VINF_IOM_R3_IOPORT_COMMIT_WRITE, or in [VINF_EM_FIRST..VINF_EM_LAST],
7165 however we can ditch VINF_IOM_R3_IOPORT_COMMIT_WRITE as it has VMCPU_FF_IOM as backup. */
7166 else if ( rcStrict2 != VINF_SUCCESS
7167 && (rcStrict == VINF_SUCCESS || rcStrict2 < rcStrict))
7168 rcStrict = rcStrict2;
7169 AssertCompile(VINF_EM_LAST < VINF_IOM_R3_IOPORT_COMMIT_WRITE);
7170
7171 HM_RESTORE_PREEMPT();
7172 VMMRZCallRing3Enable(pVCpu);
7173 }
7174
7175 HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
7176 }
7177
7178#ifdef VBOX_STRICT
7179 if (rcStrict == VINF_IOM_R3_IOPORT_READ)
7180 Assert(IoExitInfo.n.u1Type == SVM_IOIO_READ);
7181 else if (rcStrict == VINF_IOM_R3_IOPORT_WRITE || rcStrict == VINF_IOM_R3_IOPORT_COMMIT_WRITE)
7182 Assert(IoExitInfo.n.u1Type == SVM_IOIO_WRITE);
7183 else
7184 {
7185 /** @todo r=bird: This is missing a bunch of VINF_EM_FIRST..VINF_EM_LAST
7186 * statuses, that the VMM device and some others may return. See
7187 * IOM_SUCCESS() for guidance. */
7188 AssertMsg( RT_FAILURE(rcStrict)
7189 || rcStrict == VINF_SUCCESS
7190 || rcStrict == VINF_EM_RAW_EMULATE_INSTR
7191 || rcStrict == VINF_EM_DBG_BREAKPOINT
7192 || rcStrict == VINF_EM_RAW_GUEST_TRAP
7193 || rcStrict == VINF_EM_RAW_TO_R3
7194 || rcStrict == VINF_TRPM_XCPT_DISPATCHED
7195 || rcStrict == VINF_EM_TRIPLE_FAULT, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
7196 }
7197#endif
7198 }
7199 else
7200 {
7201 /*
7202 * Frequent exit or something needing probing. Get state and call EMHistoryExec.
7203 */
7204 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7205 STAM_COUNTER_INC(!IoExitInfo.n.u1Str
7206 ? IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? &pVCpu->hm.s.StatExitIOWrite : &pVCpu->hm.s.StatExitIORead
7207 : IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? &pVCpu->hm.s.StatExitIOStringWrite : &pVCpu->hm.s.StatExitIOStringRead);
7208 Log4(("IOExit/%u: %04x:%08RX64: %s%s%s %#x LB %u -> EMHistoryExec\n",
7209 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, IoExitInfo.n.u1Rep ? "REP " : "",
7210 IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? "OUT" : "IN", IoExitInfo.n.u1Str ? "S" : "", IoExitInfo.n.u16Port, uIOWidth));
7211
7212 rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
7213 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
7214
7215 Log4(("IOExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
7216 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
7217 VBOXSTRICTRC_VAL(rcStrict), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip));
7218 }
7219 return VBOXSTRICTRC_TODO(rcStrict);
7220}
7221
7222
7223/**
7224 * \#VMEXIT handler for Nested Page-faults (SVM_EXIT_NPF). Conditional \#VMEXIT.
7225 */
7226HMSVM_EXIT_DECL hmR0SvmExitNestedPF(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7227{
7228 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7229 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7230 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7231
7232 PVM pVM = pVCpu->CTX_SUFF(pVM);
7233 Assert(pVM->hm.s.fNestedPaging);
7234
7235 /* See AMD spec. 15.25.6 "Nested versus Guest Page Faults, Fault Ordering" for VMCB details for #NPF. */
7236 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7237 RTGCPHYS GCPhysFaultAddr = pVmcb->ctrl.u64ExitInfo2;
7238 uint32_t u32ErrCode = pVmcb->ctrl.u64ExitInfo1; /* Note! High bits in EXITINFO1 may contain additional info and are
7239 thus intentionally not copied into u32ErrCode. */
7240
7241 Log4Func(("#NPF at CS:RIP=%04x:%#RX64 GCPhysFaultAddr=%RGp ErrCode=%#x \n", pCtx->cs.Sel, pCtx->rip, GCPhysFaultAddr,
7242 u32ErrCode));
7243
7244 /*
7245 * TPR patching for 32-bit guests, using the reserved bit in the page tables for MMIO regions.
7246 */
7247 if ( pVM->hm.s.fTprPatchingAllowed
7248 && !CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
7249 && (GCPhysFaultAddr & PAGE_OFFSET_MASK) == XAPIC_OFF_TPR
7250 && ( !(u32ErrCode & X86_TRAP_PF_P) /* Not present */
7251 || (u32ErrCode & (X86_TRAP_PF_P | X86_TRAP_PF_RSVD)) == (X86_TRAP_PF_P | X86_TRAP_PF_RSVD)) /* MMIO page. */
7252 && !CPUMIsGuestInLongModeEx(pCtx)
7253 && !CPUMGetGuestCPL(pVCpu)
7254 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
7255 {
7256 RTGCPHYS GCPhysApicBase = APICGetBaseMsrNoCheck(pVCpu);
7257 GCPhysApicBase &= PAGE_BASE_GC_MASK;
7258
7259 if (GCPhysFaultAddr == GCPhysApicBase + XAPIC_OFF_TPR)
7260 {
7261 /* Only attempt to patch the instruction once. */
7262 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
7263 if (!pPatch)
7264 return VINF_EM_HM_PATCH_TPR_INSTR;
7265 }
7266 }
7267
7268 /*
7269 * Determine the nested paging mode.
7270 */
7271 PGMMODE enmNestedPagingMode;
7272#if HC_ARCH_BITS == 32
7273 if (CPUMIsGuestInLongModeEx(pCtx))
7274 enmNestedPagingMode = PGMMODE_AMD64_NX;
7275 else
7276#endif
7277 enmNestedPagingMode = PGMGetHostMode(pVM);
7278
7279 /*
7280 * MMIO optimization using the reserved (RSVD) bit in the guest page tables for MMIO pages.
7281 */
7282 Assert((u32ErrCode & (X86_TRAP_PF_RSVD | X86_TRAP_PF_P)) != X86_TRAP_PF_RSVD);
7283 if ((u32ErrCode & (X86_TRAP_PF_RSVD | X86_TRAP_PF_P)) == (X86_TRAP_PF_RSVD | X86_TRAP_PF_P))
7284 {
7285 /*
7286 * If event delivery causes an MMIO #NPF, go back to instruction emulation as otherwise
7287 * injecting the original pending event would most likely cause the same MMIO #NPF.
7288 */
7289 if (pVCpu->hm.s.Event.fPending)
7290 return VINF_EM_RAW_INJECT_TRPM_EVENT;
7291
7292 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_RIP
7293 | CPUMCTX_EXTRN_CS);
7294 VBOXSTRICTRC rcStrict;
7295 PCEMEXITREC pExitRec = EMHistoryUpdateFlagsAndTypeAndPC(pVCpu,
7296 EMEXIT_MAKE_FT(EMEXIT_F_KIND_EM | EMEXIT_F_HM, EMEXITTYPE_MMIO),
7297 pVCpu->cpum.GstCtx.rip + pVCpu->cpum.GstCtx.cs.u64Base);
7298 if (!pExitRec)
7299 {
7300
7301 rcStrict = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, enmNestedPagingMode, CPUMCTX2CORE(pCtx), GCPhysFaultAddr,
7302 u32ErrCode);
7303
7304 /*
7305 * If we succeed, resume guest execution.
7306 *
7307 * If we fail in interpreting the instruction because we couldn't get the guest
7308 * physical address of the page containing the instruction via the guest's page
7309 * tables (we would invalidate the guest page in the host TLB), resume execution
7310 * which would cause a guest page fault to let the guest handle this weird case.
7311 *
7312 * See @bugref{6043}.
7313 */
7314 if ( rcStrict == VINF_SUCCESS
7315 || rcStrict == VERR_PAGE_TABLE_NOT_PRESENT
7316 || rcStrict == VERR_PAGE_NOT_PRESENT)
7317 {
7318 /* Successfully handled MMIO operation. */
7319 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
7320 rcStrict = VINF_SUCCESS;
7321 }
7322 }
7323 else
7324 {
7325 /*
7326 * Frequent exit or something needing probing. Get state and call EMHistoryExec.
7327 */
7328 Assert(pCtx == &pVCpu->cpum.GstCtx);
7329 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7330 Log4(("EptMisscfgExit/%u: %04x:%08RX64: %RGp -> EMHistoryExec\n",
7331 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, GCPhysFaultAddr));
7332
7333 rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
7334 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
7335
7336 Log4(("EptMisscfgExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
7337 pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
7338 VBOXSTRICTRC_VAL(rcStrict), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip));
7339 }
7340 return VBOXSTRICTRC_TODO(rcStrict);
7341 }
7342
7343 TRPMAssertXcptPF(pVCpu, GCPhysFaultAddr, u32ErrCode);
7344 int rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, enmNestedPagingMode, u32ErrCode, CPUMCTX2CORE(pCtx), GCPhysFaultAddr);
7345 TRPMResetTrap(pVCpu);
7346
7347 Log4Func(("#NPF: PGMR0Trap0eHandlerNestedPaging returns %Rrc CS:RIP=%04x:%#RX64\n", rc, pCtx->cs.Sel, pCtx->rip));
7348
7349 /*
7350 * Same case as PGMR0Trap0eHandlerNPMisconfig(). See comment above, @bugref{6043}.
7351 */
7352 if ( rc == VINF_SUCCESS
7353 || rc == VERR_PAGE_TABLE_NOT_PRESENT
7354 || rc == VERR_PAGE_NOT_PRESENT)
7355 {
7356 /* We've successfully synced our shadow page tables. */
7357 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
7358 rc = VINF_SUCCESS;
7359 }
7360
7361 return rc;
7362}
7363
7364
7365/**
7366 * \#VMEXIT handler for virtual interrupt (SVM_EXIT_VINTR). Conditional
7367 * \#VMEXIT.
7368 */
7369HMSVM_EXIT_DECL hmR0SvmExitVIntr(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7370{
7371 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7372 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
7373
7374 /* Indicate that we no longer need to #VMEXIT when the guest is ready to receive NMIs, it is now ready. */
7375 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7376 hmR0SvmClearIntWindowExiting(pVCpu, pVmcb, pCtx);
7377
7378 /* Deliver the pending interrupt via hmR0SvmEvaluatePendingEvent() and resume guest execution. */
7379 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIntWindow);
7380 return VINF_SUCCESS;
7381}
7382
7383
7384/**
7385 * \#VMEXIT handler for task switches (SVM_EXIT_TASK_SWITCH). Conditional
7386 * \#VMEXIT.
7387 */
7388HMSVM_EXIT_DECL hmR0SvmExitTaskSwitch(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7389{
7390 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7391 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7392
7393#ifndef HMSVM_ALWAYS_TRAP_TASK_SWITCH
7394 Assert(!pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging);
7395#endif
7396
7397 /* Check if this task-switch occurred while delivering an event through the guest IDT. */
7398 if (pVCpu->hm.s.Event.fPending) /* Can happen with exceptions/NMI. See @bugref{8411}. */
7399 {
7400 /*
7401 * AMD-V provides us with the exception which caused the TS; we collect
7402 * the information in the call to hmR0SvmCheckExitDueToEventDelivery().
7403 */
7404 Log4Func(("TS occurred during event delivery\n"));
7405 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitTaskSwitch);
7406 return VINF_EM_RAW_INJECT_TRPM_EVENT;
7407 }
7408
7409 /** @todo Emulate task switch someday, currently just going back to ring-3 for
7410 * emulation. */
7411 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitTaskSwitch);
7412 return VERR_EM_INTERPRETER;
7413}
7414
7415
7416/**
7417 * \#VMEXIT handler for VMMCALL (SVM_EXIT_VMMCALL). Conditional \#VMEXIT.
7418 */
7419HMSVM_EXIT_DECL hmR0SvmExitVmmCall(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7420{
7421 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7422 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7423
7424 if (pVCpu->CTX_SUFF(pVM)->hm.s.fTprPatchingAllowed)
7425 {
7426 int rc = hmSvmEmulateMovTpr(pVCpu, pCtx);
7427 if (rc != VERR_NOT_FOUND)
7428 {
7429 Log4Func(("hmSvmEmulateMovTpr returns %Rrc\n", rc));
7430 return rc;
7431 }
7432 }
7433
7434 if (EMAreHypercallInstructionsEnabled(pVCpu))
7435 {
7436 VBOXSTRICTRC rcStrict = GIMHypercall(pVCpu, pCtx);
7437 if (RT_SUCCESS(rcStrict))
7438 {
7439 /* Only update the RIP if we're continuing guest execution and not in the case
7440 of say VINF_GIM_R3_HYPERCALL. */
7441 if (rcStrict == VINF_SUCCESS)
7442 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 3 /* cbInstr */);
7443
7444 return VBOXSTRICTRC_VAL(rcStrict);
7445 }
7446 else
7447 Log4Func(("GIMHypercall returns %Rrc -> #UD\n", VBOXSTRICTRC_VAL(rcStrict)));
7448 }
7449
7450 hmR0SvmSetPendingXcptUD(pVCpu);
7451 return VINF_SUCCESS;
7452}
7453
7454
7455/**
7456 * \#VMEXIT handler for VMMCALL (SVM_EXIT_VMMCALL). Conditional \#VMEXIT.
7457 */
7458HMSVM_EXIT_DECL hmR0SvmExitPause(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7459{
7460 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7461 hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
7462 /** @todo The guest has likely hit a contended spinlock. We might want to
7463 * poke a schedule different guest VCPU. */
7464 return VINF_EM_RAW_INTERRUPT;
7465}
7466
7467
7468/**
7469 * \#VMEXIT handler for FERR intercept (SVM_EXIT_FERR_FREEZE). Conditional
7470 * \#VMEXIT.
7471 */
7472HMSVM_EXIT_DECL hmR0SvmExitFerrFreeze(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7473{
7474 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7475 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0);
7476 Assert(!(pCtx->cr0 & X86_CR0_NE));
7477
7478 Log4Func(("Raising IRQ 13 in response to #FERR\n"));
7479 return PDMIsaSetIrq(pVCpu->CTX_SUFF(pVM), 13 /* u8Irq */, 1 /* u8Level */, 0 /* uTagSrc */);
7480}
7481
7482
7483/**
7484 * \#VMEXIT handler for IRET (SVM_EXIT_IRET). Conditional \#VMEXIT.
7485 */
7486HMSVM_EXIT_DECL hmR0SvmExitIret(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7487{
7488 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7489
7490 /* Clear NMI blocking. */
7491 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
7492 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
7493
7494 /* Indicate that we no longer need to #VMEXIT when the guest is ready to receive NMIs, it is now ready. */
7495 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7496 hmR0SvmClearCtrlIntercept(pVCpu, pCtx, pVmcb, SVM_CTRL_INTERCEPT_IRET);
7497
7498 /* Deliver the pending NMI via hmR0SvmEvaluatePendingEvent() and resume guest execution. */
7499 return VINF_SUCCESS;
7500}
7501
7502
7503/**
7504 * \#VMEXIT handler for page-fault exceptions (SVM_EXIT_XCPT_14).
7505 * Conditional \#VMEXIT.
7506 */
7507HMSVM_EXIT_DECL hmR0SvmExitXcptPF(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7508{
7509 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7510 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7511 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7512
7513 /* See AMD spec. 15.12.15 "#PF (Page Fault)". */
7514 PVM pVM = pVCpu->CTX_SUFF(pVM);
7515 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7516 uint32_t uErrCode = pVmcb->ctrl.u64ExitInfo1;
7517 uint64_t const uFaultAddress = pVmcb->ctrl.u64ExitInfo2;
7518
7519#if defined(HMSVM_ALWAYS_TRAP_ALL_XCPTS) || defined(HMSVM_ALWAYS_TRAP_PF)
7520 if (pVM->hm.s.fNestedPaging)
7521 {
7522 pVCpu->hm.s.Event.fPending = false; /* In case it's a contributory or vectoring #PF. */
7523 if ( !pSvmTransient->fVectoringDoublePF
7524 || CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
7525 {
7526 /* A genuine guest #PF, reflect it to the guest. */
7527 hmR0SvmSetPendingXcptPF(pVCpu, pCtx, uErrCode, uFaultAddress);
7528 Log4Func(("#PF: Guest page fault at %04X:%RGv FaultAddr=%RX64 ErrCode=%#x\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip,
7529 uFaultAddress, uErrCode));
7530 }
7531 else
7532 {
7533 /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
7534 hmR0SvmSetPendingXcptDF(pVCpu);
7535 Log4Func(("Pending #DF due to vectoring #PF. NP\n"));
7536 }
7537 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
7538 return VINF_SUCCESS;
7539 }
7540#endif
7541
7542 Assert(!pVM->hm.s.fNestedPaging);
7543
7544 /*
7545 * TPR patching shortcut for APIC TPR reads and writes; only applicable to 32-bit guests.
7546 */
7547 if ( pVM->hm.s.fTprPatchingAllowed
7548 && (uFaultAddress & 0xfff) == XAPIC_OFF_TPR
7549 && !(uErrCode & X86_TRAP_PF_P) /* Not present. */
7550 && !CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
7551 && !CPUMIsGuestInLongModeEx(pCtx)
7552 && !CPUMGetGuestCPL(pVCpu)
7553 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
7554 {
7555 RTGCPHYS GCPhysApicBase;
7556 GCPhysApicBase = APICGetBaseMsrNoCheck(pVCpu);
7557 GCPhysApicBase &= PAGE_BASE_GC_MASK;
7558
7559 /* Check if the page at the fault-address is the APIC base. */
7560 RTGCPHYS GCPhysPage;
7561 int rc2 = PGMGstGetPage(pVCpu, (RTGCPTR)uFaultAddress, NULL /* pfFlags */, &GCPhysPage);
7562 if ( rc2 == VINF_SUCCESS
7563 && GCPhysPage == GCPhysApicBase)
7564 {
7565 /* Only attempt to patch the instruction once. */
7566 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
7567 if (!pPatch)
7568 return VINF_EM_HM_PATCH_TPR_INSTR;
7569 }
7570 }
7571
7572 Log4Func(("#PF: uFaultAddress=%#RX64 CS:RIP=%#04x:%#RX64 uErrCode %#RX32 cr3=%#RX64\n", uFaultAddress, pCtx->cs.Sel,
7573 pCtx->rip, uErrCode, pCtx->cr3));
7574
7575 /*
7576 * If it's a vectoring #PF, emulate injecting the original event injection as
7577 * PGMTrap0eHandler() is incapable of differentiating between instruction emulation and
7578 * event injection that caused a #PF. See @bugref{6607}.
7579 */
7580 if (pSvmTransient->fVectoringPF)
7581 {
7582 Assert(pVCpu->hm.s.Event.fPending);
7583 return VINF_EM_RAW_INJECT_TRPM_EVENT;
7584 }
7585
7586 TRPMAssertXcptPF(pVCpu, uFaultAddress, uErrCode);
7587 int rc = PGMTrap0eHandler(pVCpu, uErrCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
7588
7589 Log4Func(("#PF: rc=%Rrc\n", rc));
7590
7591 if (rc == VINF_SUCCESS)
7592 {
7593 /* Successfully synced shadow pages tables or emulated an MMIO instruction. */
7594 TRPMResetTrap(pVCpu);
7595 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
7596 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
7597 return rc;
7598 }
7599
7600 if (rc == VINF_EM_RAW_GUEST_TRAP)
7601 {
7602 pVCpu->hm.s.Event.fPending = false; /* In case it's a contributory or vectoring #PF. */
7603
7604 /*
7605 * If a nested-guest delivers a #PF and that causes a #PF which is -not- a shadow #PF,
7606 * we should simply forward the #PF to the guest and is up to the nested-hypervisor to
7607 * determine whether it is a nested-shadow #PF or a #DF, see @bugref{7243#c121}.
7608 */
7609 if ( !pSvmTransient->fVectoringDoublePF
7610 || CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
7611 {
7612 /* It's a guest (or nested-guest) page fault and needs to be reflected. */
7613 uErrCode = TRPMGetErrorCode(pVCpu); /* The error code might have been changed. */
7614 TRPMResetTrap(pVCpu);
7615
7616#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7617 /* If the nested-guest is intercepting #PFs, cause a #PF #VMEXIT. */
7618 if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
7619 && HMIsGuestSvmXcptInterceptSet(pVCpu, X86_XCPT_PF))
7620 return VBOXSTRICTRC_TODO(IEMExecSvmVmexit(pVCpu, SVM_EXIT_XCPT_PF, uErrCode, uFaultAddress));
7621#endif
7622
7623 hmR0SvmSetPendingXcptPF(pVCpu, pCtx, uErrCode, uFaultAddress);
7624 }
7625 else
7626 {
7627 /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
7628 TRPMResetTrap(pVCpu);
7629 hmR0SvmSetPendingXcptDF(pVCpu);
7630 Log4Func(("#PF: Pending #DF due to vectoring #PF\n"));
7631 }
7632
7633 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
7634 return VINF_SUCCESS;
7635 }
7636
7637 TRPMResetTrap(pVCpu);
7638 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPFEM);
7639 return rc;
7640}
7641
7642
7643/**
7644 * \#VMEXIT handler for undefined opcode (SVM_EXIT_XCPT_6).
7645 * Conditional \#VMEXIT.
7646 */
7647HMSVM_EXIT_DECL hmR0SvmExitXcptUD(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7648{
7649 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7650 HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
7651
7652 /* Paranoia; Ensure we cannot be called as a result of event delivery. */
7653 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
7654 Assert(!pVmcb->ctrl.ExitIntInfo.n.u1Valid); NOREF(pVmcb);
7655
7656 int rc = VERR_SVM_UNEXPECTED_XCPT_EXIT;
7657 if (pVCpu->hm.s.fGIMTrapXcptUD)
7658 {
7659 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7660 uint8_t cbInstr = 0;
7661 VBOXSTRICTRC rcStrict = GIMXcptUD(pVCpu, pCtx, NULL /* pDis */, &cbInstr);
7662 if (rcStrict == VINF_SUCCESS)
7663 {
7664 /* #UD #VMEXIT does not have valid NRIP information, manually advance RIP. See @bugref{7270#c170}. */
7665 hmR0SvmAdvanceRipDumb(pVCpu, pCtx, cbInstr);
7666 rc = VINF_SUCCESS;
7667 HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
7668 }
7669 else if (rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
7670 rc = VINF_SUCCESS;
7671 else if (rcStrict == VINF_GIM_R3_HYPERCALL)
7672 rc = VINF_GIM_R3_HYPERCALL;
7673 else
7674 Assert(RT_FAILURE(VBOXSTRICTRC_VAL(rcStrict)));
7675 }
7676
7677 /* If the GIM #UD exception handler didn't succeed for some reason or wasn't needed, raise #UD. */
7678 if (RT_FAILURE(rc))
7679 {
7680 hmR0SvmSetPendingXcptUD(pVCpu);
7681 rc = VINF_SUCCESS;
7682 }
7683
7684 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestUD);
7685 return rc;
7686}
7687
7688
7689/**
7690 * \#VMEXIT handler for math-fault exceptions (SVM_EXIT_XCPT_16).
7691 * Conditional \#VMEXIT.
7692 */
7693HMSVM_EXIT_DECL hmR0SvmExitXcptMF(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7694{
7695 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7696 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7697
7698 /* Paranoia; Ensure we cannot be called as a result of event delivery. */
7699 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7700 Assert(!pVmcb->ctrl.ExitIntInfo.n.u1Valid); NOREF(pVmcb);
7701
7702 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
7703
7704 if (!(pCtx->cr0 & X86_CR0_NE))
7705 {
7706 PVM pVM = pVCpu->CTX_SUFF(pVM);
7707 PDISSTATE pDis = &pVCpu->hm.s.DisState;
7708 unsigned cbOp;
7709 int rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
7710 if (RT_SUCCESS(rc))
7711 {
7712 /* Convert a #MF into a FERR -> IRQ 13. See @bugref{6117}. */
7713 rc = PDMIsaSetIrq(pVCpu->CTX_SUFF(pVM), 13 /* u8Irq */, 1 /* u8Level */, 0 /* uTagSrc */);
7714 if (RT_SUCCESS(rc))
7715 pCtx->rip += cbOp;
7716 }
7717 else
7718 Log4Func(("EMInterpretDisasCurrent returned %Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
7719 return rc;
7720 }
7721
7722 hmR0SvmSetPendingXcptMF(pVCpu);
7723 return VINF_SUCCESS;
7724}
7725
7726
7727/**
7728 * \#VMEXIT handler for debug exceptions (SVM_EXIT_XCPT_1). Conditional
7729 * \#VMEXIT.
7730 */
7731HMSVM_EXIT_DECL hmR0SvmExitXcptDB(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7732{
7733 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7734 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7735 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7736
7737 if (RT_UNLIKELY(pVCpu->hm.s.Event.fPending))
7738 {
7739 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingInterpret);
7740 return VINF_EM_RAW_INJECT_TRPM_EVENT;
7741 }
7742
7743 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
7744
7745 /*
7746 * This can be a fault-type #DB (instruction breakpoint) or a trap-type #DB (data
7747 * breakpoint). However, for both cases DR6 and DR7 are updated to what the exception
7748 * handler expects. See AMD spec. 15.12.2 "#DB (Debug)".
7749 */
7750 PVM pVM = pVCpu->CTX_SUFF(pVM);
7751 PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
7752 int rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), pVmcb->guest.u64DR6, pVCpu->hm.s.fSingleInstruction);
7753 if (rc == VINF_EM_RAW_GUEST_TRAP)
7754 {
7755 Log5(("hmR0SvmExitXcptDB: DR6=%#RX64 -> guest trap\n", pVmcb->guest.u64DR6));
7756 if (CPUMIsHyperDebugStateActive(pVCpu))
7757 CPUMSetGuestDR6(pVCpu, CPUMGetGuestDR6(pVCpu) | pVmcb->guest.u64DR6);
7758
7759 /* Reflect the exception back to the guest. */
7760 hmR0SvmSetPendingXcptDB(pVCpu);
7761 rc = VINF_SUCCESS;
7762 }
7763
7764 /*
7765 * Update DR6.
7766 */
7767 if (CPUMIsHyperDebugStateActive(pVCpu))
7768 {
7769 Log5(("hmR0SvmExitXcptDB: DR6=%#RX64 -> %Rrc\n", pVmcb->guest.u64DR6, rc));
7770 pVmcb->guest.u64DR6 = X86_DR6_INIT_VAL;
7771 pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
7772 }
7773 else
7774 {
7775 AssertMsg(rc == VINF_SUCCESS, ("rc=%Rrc\n", rc));
7776 Assert(!pVCpu->hm.s.fSingleInstruction && !DBGFIsStepping(pVCpu));
7777 }
7778
7779 return rc;
7780}
7781
7782
7783/**
7784 * \#VMEXIT handler for alignment check exceptions (SVM_EXIT_XCPT_17).
7785 * Conditional \#VMEXIT.
7786 */
7787HMSVM_EXIT_DECL hmR0SvmExitXcptAC(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7788{
7789 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7790 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7791
7792 SVMEVENT Event;
7793 Event.u = 0;
7794 Event.n.u1Valid = 1;
7795 Event.n.u3Type = SVM_EVENT_EXCEPTION;
7796 Event.n.u8Vector = X86_XCPT_AC;
7797 Event.n.u1ErrorCodeValid = 1;
7798 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
7799 return VINF_SUCCESS;
7800}
7801
7802
7803/**
7804 * \#VMEXIT handler for breakpoint exceptions (SVM_EXIT_XCPT_3).
7805 * Conditional \#VMEXIT.
7806 */
7807HMSVM_EXIT_DECL hmR0SvmExitXcptBP(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7808{
7809 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7810 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
7811 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7812
7813 int rc = DBGFRZTrap03Handler(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
7814 if (rc == VINF_EM_RAW_GUEST_TRAP)
7815 {
7816 SVMEVENT Event;
7817 Event.u = 0;
7818 Event.n.u1Valid = 1;
7819 Event.n.u3Type = SVM_EVENT_EXCEPTION;
7820 Event.n.u8Vector = X86_XCPT_BP;
7821 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
7822 }
7823
7824 Assert(rc == VINF_SUCCESS || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_EM_DBG_BREAKPOINT);
7825 return rc;
7826}
7827
7828
7829#if defined(HMSVM_ALWAYS_TRAP_ALL_XCPTS) || defined(VBOX_WITH_NESTED_HWVIRT_SVM)
7830/**
7831 * \#VMEXIT handler for generic exceptions. Conditional \#VMEXIT.
7832 */
7833HMSVM_EXIT_DECL hmR0SvmExitXcptGeneric(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7834{
7835 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7836 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
7837
7838 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7839 uint8_t const uVector = pVmcb->ctrl.u64ExitCode - SVM_EXIT_XCPT_0;
7840 uint32_t const uErrCode = pVmcb->ctrl.u64ExitInfo1;
7841 Assert(pSvmTransient->u64ExitCode == pVmcb->ctrl.u64ExitCode);
7842 Assert(uVector <= X86_XCPT_LAST);
7843 Log4Func(("uVector=%#x uErrCode=%u\n", uVector, uErrCode));
7844
7845 SVMEVENT Event;
7846 Event.u = 0;
7847 Event.n.u1Valid = 1;
7848 Event.n.u3Type = SVM_EVENT_EXCEPTION;
7849 Event.n.u8Vector = uVector;
7850 switch (uVector)
7851 {
7852 /* Shouldn't be here for reflecting #PFs (among other things, the fault address isn't passed along). */
7853 case X86_XCPT_PF: AssertMsgFailed(("hmR0SvmExitXcptGeneric: Unexpected exception")); return VERR_SVM_IPE_5;
7854 case X86_XCPT_DF:
7855 case X86_XCPT_TS:
7856 case X86_XCPT_NP:
7857 case X86_XCPT_SS:
7858 case X86_XCPT_GP:
7859 case X86_XCPT_AC:
7860 {
7861 Event.n.u1ErrorCodeValid = 1;
7862 Event.n.u32ErrorCode = uErrCode;
7863 break;
7864 }
7865 }
7866
7867 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
7868 return VINF_SUCCESS;
7869}
7870#endif
7871
7872#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
7873/**
7874 * \#VMEXIT handler for CLGI (SVM_EXIT_CLGI). Conditional \#VMEXIT.
7875 */
7876HMSVM_EXIT_DECL hmR0SvmExitClgi(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7877{
7878 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7879 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK
7880 | CPUMCTX_EXTRN_HWVIRT);
7881
7882#ifdef VBOX_STRICT
7883 PCSVMVMCB pVmcbTmp = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7884 Assert(pVmcbTmp);
7885 Assert(!pVmcbTmp->ctrl.IntCtrl.n.u1VGifEnable);
7886 RT_NOREF(pVmcbTmp);
7887#endif
7888
7889 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
7890 VBOXSTRICTRC rcStrict = IEMExecDecodedClgi(pVCpu, cbInstr);
7891 if (rcStrict == VINF_SUCCESS)
7892 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_HWVIRT);
7893 return VBOXSTRICTRC_VAL(rcStrict);
7894}
7895
7896
7897/**
7898 * \#VMEXIT handler for STGI (SVM_EXIT_STGI). Conditional \#VMEXIT.
7899 */
7900HMSVM_EXIT_DECL hmR0SvmExitStgi(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7901{
7902 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7903 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK
7904 | CPUMCTX_EXTRN_HWVIRT);
7905
7906 /*
7907 * When VGIF is not used we always intercept STGI instructions. When VGIF is used,
7908 * we only intercept STGI when events are pending for GIF to become 1.
7909 */
7910 PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7911 if (pVmcb->ctrl.IntCtrl.n.u1VGifEnable)
7912 hmR0SvmClearCtrlIntercept(pVCpu, pCtx, pVmcb, SVM_CTRL_INTERCEPT_STGI);
7913
7914 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
7915 VBOXSTRICTRC rcStrict = IEMExecDecodedStgi(pVCpu, cbInstr);
7916 if (rcStrict == VINF_SUCCESS)
7917 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_HWVIRT);
7918 return VBOXSTRICTRC_VAL(rcStrict);
7919}
7920
7921
7922/**
7923 * \#VMEXIT handler for VMLOAD (SVM_EXIT_VMLOAD). Conditional \#VMEXIT.
7924 */
7925HMSVM_EXIT_DECL hmR0SvmExitVmload(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7926{
7927 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7928 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK
7929 | CPUMCTX_EXTRN_FS
7930 | CPUMCTX_EXTRN_GS
7931 | CPUMCTX_EXTRN_TR
7932 | CPUMCTX_EXTRN_LDTR
7933 | CPUMCTX_EXTRN_KERNEL_GS_BASE
7934 | CPUMCTX_EXTRN_SYSCALL_MSRS
7935 | CPUMCTX_EXTRN_SYSENTER_MSRS);
7936
7937#ifdef VBOX_STRICT
7938 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7939 Assert(pVmcb);
7940 Assert(!pVmcb->ctrl.LbrVirt.n.u1VirtVmsaveVmload);
7941 RT_NOREF(pVmcb);
7942#endif
7943
7944 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
7945 VBOXSTRICTRC rcStrict = IEMExecDecodedVmload(pVCpu, cbInstr);
7946 if (rcStrict == VINF_SUCCESS)
7947 {
7948 /* We skip flagging changes made to LSTAR, STAR, SFMASK and other MSRs as they are always re-loaded. */
7949 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_FS
7950 | HM_CHANGED_GUEST_GS
7951 | HM_CHANGED_GUEST_TR
7952 | HM_CHANGED_GUEST_LDTR
7953 | HM_CHANGED_GUEST_SYSENTER_CS_MSR
7954 | HM_CHANGED_GUEST_SYSENTER_EIP_MSR
7955 | HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
7956 }
7957 return VBOXSTRICTRC_VAL(rcStrict);
7958}
7959
7960
7961/**
7962 * \#VMEXIT handler for VMSAVE (SVM_EXIT_VMSAVE). Conditional \#VMEXIT.
7963 */
7964HMSVM_EXIT_DECL hmR0SvmExitVmsave(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7965{
7966 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7967 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
7968
7969#ifdef VBOX_STRICT
7970 PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
7971 Assert(pVmcb);
7972 Assert(!pVmcb->ctrl.LbrVirt.n.u1VirtVmsaveVmload);
7973 RT_NOREF(pVmcb);
7974#endif
7975
7976 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
7977 VBOXSTRICTRC rcStrict = IEMExecDecodedVmsave(pVCpu, cbInstr);
7978 return VBOXSTRICTRC_VAL(rcStrict);
7979}
7980
7981
7982/**
7983 * \#VMEXIT handler for INVLPGA (SVM_EXIT_INVLPGA). Conditional \#VMEXIT.
7984 */
7985HMSVM_EXIT_DECL hmR0SvmExitInvlpga(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
7986{
7987 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
7988 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
7989
7990 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
7991 VBOXSTRICTRC rcStrict = IEMExecDecodedInvlpga(pVCpu, cbInstr);
7992 return VBOXSTRICTRC_VAL(rcStrict);
7993}
7994
7995
7996/**
7997 * \#VMEXIT handler for STGI (SVM_EXIT_VMRUN). Conditional \#VMEXIT.
7998 */
7999HMSVM_EXIT_DECL hmR0SvmExitVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
8000{
8001 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
8002 HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK
8003 | IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
8004 VBOXSTRICTRC rcStrict;
8005 uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
8006 rcStrict = IEMExecDecodedVmrun(pVCpu, cbInstr);
8007 Log4Func(("IEMExecDecodedVmrun returns %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8008 if (rcStrict == VINF_SUCCESS)
8009 {
8010 rcStrict = VINF_SVM_VMRUN;
8011 ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_SVM_VMRUN_MASK);
8012 }
8013 return VBOXSTRICTRC_VAL(rcStrict);
8014}
8015
8016
8017/**
8018 * Nested-guest \#VMEXIT handler for debug exceptions (SVM_EXIT_XCPT_1).
8019 * Unconditional \#VMEXIT.
8020 */
8021HMSVM_EXIT_DECL hmR0SvmNestedExitXcptDB(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
8022{
8023 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
8024 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
8025
8026 if (pVCpu->hm.s.Event.fPending)
8027 {
8028 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingInterpret);
8029 return VINF_EM_RAW_INJECT_TRPM_EVENT;
8030 }
8031
8032 hmR0SvmSetPendingXcptDB(pVCpu);
8033 return VINF_SUCCESS;
8034}
8035
8036
8037/**
8038 * Nested-guest \#VMEXIT handler for breakpoint exceptions (SVM_EXIT_XCPT_3).
8039 * Conditional \#VMEXIT.
8040 */
8041HMSVM_EXIT_DECL hmR0SvmNestedExitXcptBP(PVMCPU pVCpu, PCPUMCTX pCtx, PSVMTRANSIENT pSvmTransient)
8042{
8043 HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
8044 HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
8045
8046 SVMEVENT Event;
8047 Event.u = 0;
8048 Event.n.u1Valid = 1;
8049 Event.n.u3Type = SVM_EVENT_EXCEPTION;
8050 Event.n.u8Vector = X86_XCPT_BP;
8051 hmR0SvmSetPendingEvent(pVCpu, &Event, 0 /* GCPtrFaultAddress */);
8052 return VINF_SUCCESS;
8053}
8054
8055#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
8056
8057
8058/** @} */
8059
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette