VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 12227

Last change on this file since 12227 was 12122, checked in by vboxsync, 16 years ago

Fixed regression for AMD-V cpus with erratum 170.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 87.1 KB
Line 
1/* $Id: HWSVMR0.cpp 12122 2008-09-05 09:49:06Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include "HWSVMR0.h"
47
48static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID);
49
50/**
51 * Sets up and activates AMD-V on the current CPU
52 *
53 * @returns VBox status code.
54 * @param pCpu CPU info struct
55 * @param pVM The VM to operate on.
56 * @param pvPageCpu Pointer to the global cpu page
57 * @param pPageCpuPhys Physical address of the global cpu page
58 */
59HWACCMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
60{
61 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
62 AssertReturn(pVM, VERR_INVALID_PARAMETER);
63 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
64
65 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
66
67#ifdef LOG_ENABLED
68 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
69#endif
70
71 /* Turn on AMD-V in the EFER MSR. */
72 uint64_t val = ASMRdMsr(MSR_K6_EFER);
73 if (!(val & MSR_K6_EFER_SVME))
74 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
75
76 /* Write the physical page address where the CPU will store the host state while executing the VM. */
77 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
78
79 pCpu->uCurrentASID = 0; /* we'll aways increment this the first time (host uses ASID 0) */
80 pCpu->cTLBFlushes = 0;
81 return VINF_SUCCESS;
82}
83
84/**
85 * Deactivates AMD-V on the current CPU
86 *
87 * @returns VBox status code.
88 * @param pCpu CPU info struct
89 * @param pvPageCpu Pointer to the global cpu page
90 * @param pPageCpuPhys Physical address of the global cpu page
91 */
92HWACCMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
93{
94 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
95 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
96
97#ifdef LOG_ENABLED
98 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
99#endif
100
101 /* Turn off AMD-V in the EFER MSR. */
102 uint64_t val = ASMRdMsr(MSR_K6_EFER);
103 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
104
105 /* Invalidate host state physical address. */
106 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
107 pCpu->uCurrentASID = 0;
108
109 return VINF_SUCCESS;
110}
111
112/**
113 * Does Ring-0 per VM AMD-V init.
114 *
115 * @returns VBox status code.
116 * @param pVM The VM to operate on.
117 */
118HWACCMR0DECL(int) SVMR0InitVM(PVM pVM)
119{
120 int rc;
121
122 pVM->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
123 pVM->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
124 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
125 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
126
127
128 /* Allocate one page for the VM control block (VMCB). */
129 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
130 if (RT_FAILURE(rc))
131 return rc;
132
133 pVM->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCB);
134 pVM->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCB, 0);
135 ASMMemZeroPage(pVM->hwaccm.s.svm.pVMCB);
136
137 /* Allocate one page for the host context */
138 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
139 if (RT_FAILURE(rc))
140 return rc;
141
142 pVM->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCBHost);
143 pVM->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCBHost, 0);
144 ASMMemZeroPage(pVM->hwaccm.s.svm.pVMCBHost);
145
146 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
147 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
148 if (RT_FAILURE(rc))
149 return rc;
150
151 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
152 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
153 /* Set all bits to intercept all IO accesses. */
154 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
155
156 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
157 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
158 if (RT_FAILURE(rc))
159 return rc;
160
161 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
162 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
163 /* Set all bits to intercept all MSR accesses. */
164 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
165
166 /* Erratum 170 which requires a forced TLB flush for each world switch:
167 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
168 *
169 * All BH-G1/2 and DH-G1/2 models include a fix:
170 * Athlon X2: 0x6b 1/2
171 * 0x68 1/2
172 * Athlon 64: 0x7f 1
173 * 0x6f 2
174 * Sempron: 0x7f 1/2
175 * 0x6f 2
176 * 0x6c 2
177 * 0x7c 2
178 * Turion 64: 0x68 2
179 *
180 */
181 uint32_t u32Dummy;
182 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
183 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
184 u32BaseFamily= (u32Version >> 8) & 0xf;
185 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
186 u32Model = ((u32Version >> 4) & 0xf);
187 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
188 u32Stepping = u32Version & 0xf;
189 if ( u32Family == 0xf
190 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
191 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
192 {
193 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
194 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
195 }
196
197 /* Invalidate the last cpu we were running on. */
198 pVM->hwaccm.s.svm.idLastCpu = NIL_RTCPUID;
199
200 /* we'll aways increment this the first time (host uses ASID 0) */
201 pVM->hwaccm.s.svm.uCurrentASID = 0;
202 return VINF_SUCCESS;
203}
204
205/**
206 * Does Ring-0 per VM AMD-V termination.
207 *
208 * @returns VBox status code.
209 * @param pVM The VM to operate on.
210 */
211HWACCMR0DECL(int) SVMR0TermVM(PVM pVM)
212{
213 if (pVM->hwaccm.s.svm.pMemObjVMCB != NIL_RTR0MEMOBJ)
214 {
215 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCB, false);
216 pVM->hwaccm.s.svm.pVMCB = 0;
217 pVM->hwaccm.s.svm.pVMCBPhys = 0;
218 pVM->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
219 }
220 if (pVM->hwaccm.s.svm.pMemObjVMCBHost != NIL_RTR0MEMOBJ)
221 {
222 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCBHost, false);
223 pVM->hwaccm.s.svm.pVMCBHost = 0;
224 pVM->hwaccm.s.svm.pVMCBHostPhys = 0;
225 pVM->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
226 }
227 if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
228 {
229 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
230 pVM->hwaccm.s.svm.pIOBitmap = 0;
231 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
232 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
233 }
234 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
235 {
236 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
237 pVM->hwaccm.s.svm.pMSRBitmap = 0;
238 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
239 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
240 }
241 return VINF_SUCCESS;
242}
243
244/**
245 * Sets up AMD-V for the specified VM
246 *
247 * @returns VBox status code.
248 * @param pVM The VM to operate on.
249 */
250HWACCMR0DECL(int) SVMR0SetupVM(PVM pVM)
251{
252 int rc = VINF_SUCCESS;
253 SVM_VMCB *pVMCB;
254
255 AssertReturn(pVM, VERR_INVALID_PARAMETER);
256
257 Assert(pVM->hwaccm.s.svm.fSupported);
258
259 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
260 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
261
262 /* Program the control fields. Most of them never have to be changed again. */
263 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
264 /** @note CR0 & CR4 can be safely read when guest and shadow copies are identical. */
265 if (!pVM->hwaccm.s.fNestedPaging)
266 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
267 else
268 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(4);
269
270 /*
271 * CR0/3/4 writes must be intercepted for obvious reasons.
272 */
273 if (!pVM->hwaccm.s.fNestedPaging)
274 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
275 else
276 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(4) | RT_BIT(8);
277
278 /* Intercept all DRx reads and writes. (@todo not necessary to intercept all) */
279 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
280 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
281
282 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
283 * All breakpoints are automatically cleared when the VM exits.
284 */
285
286 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
287#ifndef DEBUG
288 if (pVM->hwaccm.s.fNestedPaging)
289 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
290#endif
291
292 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
293 | SVM_CTRL1_INTERCEPT_VINTR
294 | SVM_CTRL1_INTERCEPT_NMI
295 | SVM_CTRL1_INTERCEPT_SMI
296 | SVM_CTRL1_INTERCEPT_INIT
297 | SVM_CTRL1_INTERCEPT_RDPMC
298 | SVM_CTRL1_INTERCEPT_CPUID
299 | SVM_CTRL1_INTERCEPT_RSM
300 | SVM_CTRL1_INTERCEPT_HLT
301 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
302 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
303 | SVM_CTRL1_INTERCEPT_INVLPG
304 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
305 | SVM_CTRL1_INTERCEPT_TASK_SWITCH
306 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
307 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
308 ;
309 /* With nested paging we don't care about invlpg anymore. */
310 if (pVM->hwaccm.s.fNestedPaging)
311 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_INVLPG;
312
313 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
314 | SVM_CTRL2_INTERCEPT_VMMCALL
315 | SVM_CTRL2_INTERCEPT_VMLOAD
316 | SVM_CTRL2_INTERCEPT_VMSAVE
317 | SVM_CTRL2_INTERCEPT_STGI
318 | SVM_CTRL2_INTERCEPT_CLGI
319 | SVM_CTRL2_INTERCEPT_SKINIT
320 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
321 | SVM_CTRL2_INTERCEPT_WBINVD
322 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
323 ;
324 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
325 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
326 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
327
328 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
329 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
330 /* Ignore the priority in the TPR; just deliver it when we tell it to. */
331 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1;
332
333 /* Set IO and MSR bitmap addresses. */
334 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
335 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
336
337 /* No LBR virtualization. */
338 pVMCB->ctrl.u64LBRVirt = 0;
339
340 /** The ASID must start at 1; the host uses 0. */
341 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
342
343 /** Setup the PAT msr (nested paging only) */
344 pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
345 return rc;
346}
347
348
349/**
350 * Injects an event (trap or external interrupt)
351 *
352 * @param pVM The VM to operate on.
353 * @param pVMCB SVM control block
354 * @param pCtx CPU Context
355 * @param pIntInfo SVM interrupt info
356 */
357inline void SVMR0InjectEvent(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
358{
359#ifdef VBOX_STRICT
360 if (pEvent->n.u8Vector == 0xE)
361 Log(("SVM: Inject int %d at %VGv error code=%02x CR2=%VGv intInfo=%08x\n", pEvent->n.u8Vector, pCtx->rip, pEvent->n.u32ErrorCode, pCtx->cr2, pEvent->au64[0]));
362 else
363 if (pEvent->n.u8Vector < 0x20)
364 Log(("SVM: Inject int %d at %VGv error code=%08x\n", pEvent->n.u8Vector, pCtx->rip, pEvent->n.u32ErrorCode));
365 else
366 {
367 Log(("INJ-EI: %x at %VGv\n", pEvent->n.u8Vector, pCtx->rip));
368 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
369 Assert(pCtx->eflags.u32 & X86_EFL_IF);
370 }
371#endif
372
373 /* Set event injection state. */
374 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
375}
376
377
378/**
379 * Checks for pending guest interrupts and injects them
380 *
381 * @returns VBox status code.
382 * @param pVM The VM to operate on.
383 * @param pVMCB SVM control block
384 * @param pCtx CPU Context
385 */
386static int SVMR0CheckPendingInterrupt(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
387{
388 int rc;
389
390 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
391 if (pVM->hwaccm.s.Event.fPending)
392 {
393 SVM_EVENT Event;
394
395 Log(("Reinjecting event %08x %08x at %VGv\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->rip));
396 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
397 Event.au64[0] = pVM->hwaccm.s.Event.intInfo;
398 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
399
400 pVM->hwaccm.s.Event.fPending = false;
401 return VINF_SUCCESS;
402 }
403
404 /* When external interrupts are pending, we should exit the VM when IF is set. */
405 if ( !TRPMHasTrap(pVM)
406 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
407 {
408 if ( !(pCtx->eflags.u32 & X86_EFL_IF)
409 || VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
410 {
411 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
412 {
413 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
414 LogFlow(("Enable irq window exit!\n"));
415 else
416 Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS -> irq window exit\n", pCtx->rip));
417
418 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
419 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
420 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
421 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
422 }
423 }
424 else
425 {
426 uint8_t u8Interrupt;
427
428 rc = PDMGetInterrupt(pVM, &u8Interrupt);
429 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
430 if (VBOX_SUCCESS(rc))
431 {
432 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
433 AssertRC(rc);
434 }
435 else
436 {
437 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
438 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
439 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
440 /* Just continue */
441 }
442 }
443 }
444
445#ifdef VBOX_STRICT
446 if (TRPMHasTrap(pVM))
447 {
448 uint8_t u8Vector;
449 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
450 AssertRC(rc);
451 }
452#endif
453
454 if ( pCtx->eflags.u32 & X86_EFL_IF
455 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
456 && TRPMHasTrap(pVM)
457 )
458 {
459 uint8_t u8Vector;
460 int rc;
461 TRPMEVENT enmType;
462 SVM_EVENT Event;
463 RTGCUINT u32ErrorCode;
464
465 Event.au64[0] = 0;
466
467 /* If a new event is pending, then dispatch it now. */
468 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &u32ErrorCode, 0);
469 AssertRC(rc);
470 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
471 Assert(enmType != TRPM_SOFTWARE_INT);
472
473 /* Clear the pending trap. */
474 rc = TRPMResetTrap(pVM);
475 AssertRC(rc);
476
477 Event.n.u8Vector = u8Vector;
478 Event.n.u1Valid = 1;
479 Event.n.u32ErrorCode = u32ErrorCode;
480
481 if (enmType == TRPM_TRAP)
482 {
483 switch (u8Vector) {
484 case 8:
485 case 10:
486 case 11:
487 case 12:
488 case 13:
489 case 14:
490 case 17:
491 /* Valid error codes. */
492 Event.n.u1ErrorCodeValid = 1;
493 break;
494 default:
495 break;
496 }
497 if (u8Vector == X86_XCPT_NMI)
498 Event.n.u3Type = SVM_EVENT_NMI;
499 else
500 Event.n.u3Type = SVM_EVENT_EXCEPTION;
501 }
502 else
503 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
504
505 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
506 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
507 } /* if (interrupts can be dispatched) */
508
509 return VINF_SUCCESS;
510}
511
512/**
513 * Save the host state
514 *
515 * @returns VBox status code.
516 * @param pVM The VM to operate on.
517 */
518HWACCMR0DECL(int) SVMR0SaveHostState(PVM pVM)
519{
520 /* Nothing to do here. */
521 return VINF_SUCCESS;
522}
523
524/**
525 * Loads the guest state
526 *
527 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
528 *
529 * @returns VBox status code.
530 * @param pVM The VM to operate on.
531 * @param pCtx Guest context
532 */
533HWACCMR0DECL(int) SVMR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
534{
535 RTGCUINTPTR val;
536 SVM_VMCB *pVMCB;
537
538 if (pVM == NULL)
539 return VERR_INVALID_PARAMETER;
540
541 /* Setup AMD SVM. */
542 Assert(pVM->hwaccm.s.svm.fSupported);
543
544 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
545 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
546
547 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
548 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
549 {
550 SVM_WRITE_SELREG(CS, cs);
551 SVM_WRITE_SELREG(SS, ss);
552 SVM_WRITE_SELREG(DS, ds);
553 SVM_WRITE_SELREG(ES, es);
554 SVM_WRITE_SELREG(FS, fs);
555 SVM_WRITE_SELREG(GS, gs);
556 }
557
558 /* Guest CPU context: LDTR. */
559 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
560 {
561 SVM_WRITE_SELREG(LDTR, ldtr);
562 }
563
564 /* Guest CPU context: TR. */
565 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
566 {
567 SVM_WRITE_SELREG(TR, tr);
568 }
569
570 /* Guest CPU context: GDTR. */
571 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
572 {
573 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
574 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
575 }
576
577 /* Guest CPU context: IDTR. */
578 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
579 {
580 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
581 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
582 }
583
584 /*
585 * Sysenter MSRs (unconditional)
586 */
587 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
588 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
589 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
590
591 /* Control registers */
592 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
593 {
594 val = pCtx->cr0;
595 if (!CPUMIsGuestFPUStateActive(pVM))
596 {
597 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
598 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
599 }
600 else
601 {
602 /** @todo check if we support the old style mess correctly. */
603 if (!(val & X86_CR0_NE))
604 {
605 Log(("Forcing X86_CR0_NE!!!\n"));
606
607 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
608 if (!pVM->hwaccm.s.fFPUOldStyleOverride)
609 {
610 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_MF);
611 pVM->hwaccm.s.fFPUOldStyleOverride = true;
612 }
613 }
614 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
615 }
616 /* Always enable caching. */
617 val &= ~(X86_CR0_CD|X86_CR0_NW);
618
619 /* Note: WP is not relevant in nested paging mode as we catch accesses on the (guest) physical level. */
620 /* Note: In nested paging mode the guest is allowed to run with paging disabled; the guest physical to host physical translation will remain active. */
621 if (!pVM->hwaccm.s.fNestedPaging)
622 {
623 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
624 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
625 }
626 pVMCB->guest.u64CR0 = val;
627 }
628 /* CR2 as well */
629 pVMCB->guest.u64CR2 = pCtx->cr2;
630
631 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
632 {
633 /* Save our shadow CR3 register. */
634 if (pVM->hwaccm.s.fNestedPaging)
635 {
636 pVMCB->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVM, PGMGetHostMode(pVM));
637 Assert(pVMCB->ctrl.u64NestedPagingCR3);
638 pVMCB->guest.u64CR3 = pCtx->cr3;
639 }
640 else
641 {
642 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVM);
643 Assert(pVMCB->guest.u64CR3);
644 }
645 }
646
647 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
648 {
649 val = pCtx->cr4;
650 if (!pVM->hwaccm.s.fNestedPaging)
651 {
652 switch(pVM->hwaccm.s.enmShadowMode)
653 {
654 case PGMMODE_REAL:
655 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
656 AssertFailed();
657 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
658
659 case PGMMODE_32_BIT: /* 32-bit paging. */
660 break;
661
662 case PGMMODE_PAE: /* PAE paging. */
663 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
664 /** @todo use normal 32 bits paging */
665 val |= X86_CR4_PAE;
666 break;
667
668 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
669 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
670#ifdef VBOX_ENABLE_64_BITS_GUESTS
671 break;
672#else
673 AssertFailed();
674 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
675#endif
676
677 default: /* shut up gcc */
678 AssertFailed();
679 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
680 }
681 }
682 pVMCB->guest.u64CR4 = val;
683 }
684
685 /* Debug registers. */
686 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
687 {
688 pCtx->dr7 &= 0xffffffff; /* upper 32 bits reserved */
689 pCtx->dr7 &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
690 pCtx->dr7 |= 0x400; /* must be one */
691#ifdef VBOX_WITH_HWACCM_DEBUG_REGISTER_SUPPORT
692 pVMCB->guest.u64DR7 = pCtx->dr7;
693#else
694 pVMCB->guest.u64DR7 = 0x400;
695#endif
696 pVMCB->guest.u64DR6 = pCtx->dr6;
697
698#ifdef VBOX_WITH_HWACCM_DEBUG_REGISTER_SUPPORT
699 /* Any guest breakpoints enabled? */
700 if ( (pCtx->dr7 & X86_DR7_ENABLED_MASK)
701 && !pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved)
702 {
703 /* Save the host debug register; a bit paranoid if the host has no active breakpoints set in dr7, but we
704 * do not want anything from the guest to leak into the host!
705 */
706 pVM->hwaccm.s.savedhoststate.dr0 = ASMGetDR0();
707 pVM->hwaccm.s.savedhoststate.dr1 = ASMGetDR1();
708 pVM->hwaccm.s.savedhoststate.dr2 = ASMGetDR2();
709 pVM->hwaccm.s.savedhoststate.dr3 = ASMGetDR3();
710 pVM->hwaccm.s.savedhoststate.dr6 = ASMGetDR6();
711 pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved = true;
712
713 /* Make sure DR7 is harmless or else we could trigger breakpoints when restoring dr0-3 (!) */
714 ASMSetDR7(0x400);
715 }
716
717 if (pCtx->dr7 & (X86_DR7_L0|X86_DR7_G0))
718 {
719 ASMSetDR0(pCtx->dr0);
720 Assert(pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved);
721 }
722 if (pCtx->dr7 & (X86_DR7_L1|X86_DR7_G1))
723 {
724 ASMSetDR1(pCtx->dr1);
725 Assert(pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved);
726 }
727 if (pCtx->dr7 & (X86_DR7_L2|X86_DR7_G2))
728 {
729 ASMSetDR2(pCtx->dr2);
730 Assert(pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved);
731 }
732 if (pCtx->dr7 & (X86_DR7_L3|X86_DR7_G3))
733 {
734 ASMSetDR3(pCtx->dr3);
735 Assert(pVM->hwaccm.s.savedhoststate.fHostDebugRegsSaved);
736 }
737
738 /* No need to sync DR6; all DR6 reads are intercepted. */
739#endif /* VBOX_WITH_HWACCM_DEBUG_REGISTER_SUPPORT */
740 }
741
742 /* EIP, ESP and EFLAGS */
743 pVMCB->guest.u64RIP = pCtx->rip;
744 pVMCB->guest.u64RSP = pCtx->rsp;
745 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
746
747 /* Set CPL */
748 pVMCB->guest.u8CPL = pCtx->csHid.Attr.n.u2Dpl;
749
750 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
751 pVMCB->guest.u64RAX = pCtx->rax;
752
753 /* vmrun will fail without MSR_K6_EFER_SVME. */
754 pVMCB->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
755
756 /* 64 bits guest mode? */
757 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
758 {
759#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
760 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
761#else
762 pVM->hwaccm.s.svm.pfnVMRun = SVMVMRun64;
763#endif
764 /* Unconditionally update these as wrmsr might have changed them. (HWACCM_CHANGED_GUEST_SEGMENT_REGS will not be set) */
765 pVMCB->guest.FS.u64Base = pCtx->fsHid.u64Base;
766 pVMCB->guest.GS.u64Base = pCtx->gsHid.u64Base;
767 }
768 else
769 {
770 /* Filter out the MSR_K6_LME bit or else AMD-V expects amd64 shadow paging. */
771 pVMCB->guest.u64EFER &= ~MSR_K6_EFER_LME;
772
773 pVM->hwaccm.s.svm.pfnVMRun = SVMVMRun;
774 }
775
776 /** TSC offset. */
777 if (TMCpuTickCanUseRealTSC(pVM, &pVMCB->ctrl.u64TSCOffset))
778 {
779 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
780 STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCOffset);
781 }
782 else
783 {
784 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
785 STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCIntercept);
786 }
787
788 /* Sync the various msrs for 64 bits mode. */
789 pVMCB->guest.u64STAR = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
790 pVMCB->guest.u64LSTAR = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
791 pVMCB->guest.u64CSTAR = pCtx->msrCSTAR; /* compatibility mode syscall rip */
792 pVMCB->guest.u64SFMASK = pCtx->msrSFMASK; /* syscall flag mask */
793 pVMCB->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
794
795#ifdef DEBUG
796 /* Intercept X86_XCPT_DB if stepping is enabled */
797 if (DBGFIsStepping(pVM))
798 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_DB);
799 else
800 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_DB);
801#endif
802
803 /* Done. */
804 pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
805
806 return VINF_SUCCESS;
807}
808
809
810/**
811 * Runs guest code in an SVM VM.
812 *
813 * @todo This can be much more efficient, when we only sync that which has actually changed. (this is the first attempt only)
814 *
815 * @returns VBox status code.
816 * @param pVM The VM to operate on.
817 * @param pCtx Guest context
818 */
819HWACCMR0DECL(int) SVMR0RunGuestCode(PVM pVM, CPUMCTX *pCtx)
820{
821 int rc = VINF_SUCCESS;
822 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
823 SVM_VMCB *pVMCB;
824 bool fGuestStateSynced = false;
825 bool fSyncTPR = false;
826 unsigned cResume = 0;
827 uint8_t u8LastVTPR;
828 PHWACCM_CPUINFO pCpu = 0;
829#ifdef VBOX_STRICT
830 RTCPUID idCpuCheck;
831#endif
832
833 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
834
835 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
836 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
837
838 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
839 */
840ResumeExecution:
841 /* Safety precaution; looping for too long here can have a very bad effect on the host */
842 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
843 {
844 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
845 rc = VINF_EM_RAW_INTERRUPT;
846 goto end;
847 }
848
849 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
850 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
851 {
852 Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
853 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
854 {
855 /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
856 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
857 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
858 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
859 */
860 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
861 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
862 pVMCB->ctrl.u64IntShadow = 0;
863 }
864 }
865 else
866 {
867 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
868 pVMCB->ctrl.u64IntShadow = 0;
869 }
870
871 /* Check for pending actions that force us to go back to ring 3. */
872#ifdef DEBUG
873 /* Intercept X86_XCPT_DB if stepping is enabled */
874 if (!DBGFIsStepping(pVM))
875#endif
876 {
877 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
878 {
879 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
880 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
881 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
882 rc = VINF_EM_RAW_TO_R3;
883 goto end;
884 }
885 }
886
887 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
888 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
889 {
890 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
891 rc = VINF_EM_PENDING_REQUEST;
892 goto end;
893 }
894
895 /* When external interrupts are pending, we should exit the VM when IF is set. */
896 /** @note *after* VM_FF_INHIBIT_INTERRUPTS check!!! */
897 rc = SVMR0CheckPendingInterrupt(pVM, pVMCB, pCtx);
898 if (VBOX_FAILURE(rc))
899 {
900 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
901 goto end;
902 }
903
904 /* TPR caching using CR8 is only available in 64 bits mode */
905 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
906 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!!!!! */
907 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
908 {
909 bool fPending;
910
911 /* TPR caching in CR8 */
912 int rc = PDMApicGetTPR(pVM, &u8LastVTPR, &fPending);
913 AssertRC(rc);
914 pVMCB->ctrl.IntCtrl.n.u8VTPR = u8LastVTPR;
915
916 if (fPending)
917 {
918 /* A TPR change could activate a pending interrupt, so catch cr8 writes. */
919 pVMCB->ctrl.u16InterceptWrCRx |= RT_BIT(8);
920 }
921 else
922 /* No interrupts are pending, so we don't need to be explicitely notified.
923 * There are enough world switches for detecting pending interrupts.
924 */
925 pVMCB->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
926
927 fSyncTPR = !fPending;
928 }
929
930 /* All done! Let's start VM execution. */
931 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
932
933 /* Enable nested paging if necessary (disabled each time after #VMEXIT). */
934 pVMCB->ctrl.NestedPaging.n.u1NestedPaging = pVM->hwaccm.s.fNestedPaging;
935
936#ifdef LOG_ENABLED
937 pCpu = HWACCMR0GetCurrentCpu();
938 if ( pVM->hwaccm.s.svm.idLastCpu != pCpu->idCpu
939 || pVM->hwaccm.s.svm.cTLBFlushes != pCpu->cTLBFlushes)
940 {
941 if (pVM->hwaccm.s.svm.idLastCpu != pCpu->idCpu)
942 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVM->hwaccm.s.svm.idLastCpu, pCpu->idCpu));
943 else
944 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVM->hwaccm.s.svm.cTLBFlushes, pCpu->cTLBFlushes));
945 }
946 if (pCpu->fFlushTLB)
947 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
948#endif
949
950 /*
951 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
952 * (until the actual world switch)
953 */
954
955#ifdef VBOX_STRICT
956 idCpuCheck = RTMpCpuId();
957#endif
958
959 /* Load the guest state; *must* be here as it sets up the shadow cr0 for lazy fpu syncing! */
960 rc = SVMR0LoadGuestState(pVM, pCtx);
961 if (rc != VINF_SUCCESS)
962 {
963 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
964 goto end;
965 }
966 fGuestStateSynced = true;
967
968 pCpu = HWACCMR0GetCurrentCpu();
969 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
970 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
971 if ( pVM->hwaccm.s.svm.idLastCpu != pCpu->idCpu
972 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
973 || pVM->hwaccm.s.svm.cTLBFlushes != pCpu->cTLBFlushes)
974 {
975 /* Force a TLB flush on VM entry. */
976 pVM->hwaccm.s.svm.fForceTLBFlush = true;
977 }
978 else
979 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
980
981 pVM->hwaccm.s.svm.idLastCpu = pCpu->idCpu;
982
983 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
984 if ( pVM->hwaccm.s.svm.fForceTLBFlush
985 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
986 {
987 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.svm.u32MaxASID
988 || pCpu->fFlushTLB)
989 {
990 pCpu->fFlushTLB = false;
991 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
992 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
993 pCpu->cTLBFlushes++;
994 }
995 else
996 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushASID);
997
998 pVM->hwaccm.s.svm.cTLBFlushes = pCpu->cTLBFlushes;
999 pVM->hwaccm.s.svm.uCurrentASID = pCpu->uCurrentASID;
1000 }
1001 else
1002 {
1003 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1004
1005 /* We never increase uCurrentASID in the fAlwaysFlushTLB (erratum 170) case. */
1006 if (!pCpu->uCurrentASID || !pVM->hwaccm.s.svm.uCurrentASID)
1007 pVM->hwaccm.s.svm.uCurrentASID = pCpu->uCurrentASID = 1;
1008
1009 Assert(!pVM->hwaccm.s.svm.fAlwaysFlushTLB || pVM->hwaccm.s.svm.fForceTLBFlush);
1010 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVM->hwaccm.s.svm.fForceTLBFlush;
1011 }
1012 AssertMsg(pVM->hwaccm.s.svm.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVM->hwaccm.s.svm.cTLBFlushes, pCpu->cTLBFlushes));
1013 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.svm.u32MaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1014 AssertMsg(pVM->hwaccm.s.svm.uCurrentASID >= 1 && pVM->hwaccm.s.svm.uCurrentASID < pVM->hwaccm.s.svm.u32MaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVM->hwaccm.s.svm.uCurrentASID));
1015 pVMCB->ctrl.TLBCtrl.n.u32ASID = pVM->hwaccm.s.svm.uCurrentASID;
1016
1017#ifdef VBOX_WITH_STATISTICS
1018 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
1019 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBWorldSwitch);
1020 else
1021 STAM_COUNTER_INC(&pVM->hwaccm.s.StatNoFlushTLBWorldSwitch);
1022#endif
1023
1024 /* In case we execute a goto ResumeExecution later on. */
1025 pVM->hwaccm.s.svm.fResumeVM = true;
1026 pVM->hwaccm.s.svm.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
1027
1028 Assert(sizeof(pVM->hwaccm.s.svm.pVMCBPhys) == 8);
1029 Assert(pVMCB->ctrl.u32InterceptCtrl2 == ( SVM_CTRL2_INTERCEPT_VMRUN /* required */
1030 | SVM_CTRL2_INTERCEPT_VMMCALL
1031 | SVM_CTRL2_INTERCEPT_VMLOAD
1032 | SVM_CTRL2_INTERCEPT_VMSAVE
1033 | SVM_CTRL2_INTERCEPT_STGI
1034 | SVM_CTRL2_INTERCEPT_CLGI
1035 | SVM_CTRL2_INTERCEPT_SKINIT
1036 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
1037 | SVM_CTRL2_INTERCEPT_WBINVD
1038 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
1039 ));
1040 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
1041 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
1042 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
1043 Assert(pVMCB->ctrl.u64LBRVirt == 0);
1044
1045#ifdef VBOX_STRICT
1046 Assert(idCpuCheck == RTMpCpuId());
1047#endif
1048 pVM->hwaccm.s.svm.pfnVMRun(pVM->hwaccm.s.svm.pVMCBHostPhys, pVM->hwaccm.s.svm.pVMCBPhys, pCtx);
1049 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
1050
1051 /**
1052 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1053 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1054 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1055 */
1056
1057 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
1058
1059 /* Reason for the VM exit */
1060 exitCode = pVMCB->ctrl.u64ExitCode;
1061
1062 if (exitCode == (uint64_t)SVM_EXIT_INVALID) /* Invalid guest state. */
1063 {
1064 HWACCMDumpRegs(pVM, pCtx);
1065#ifdef DEBUG
1066 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
1067 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
1068 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
1069 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
1070 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
1071 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
1072 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
1073 Log(("ctrl.u64IOPMPhysAddr %VX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
1074 Log(("ctrl.u64MSRPMPhysAddr %VX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
1075 Log(("ctrl.u64TSCOffset %VX64\n", pVMCB->ctrl.u64TSCOffset));
1076
1077 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
1078 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
1079 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
1080 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
1081
1082 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
1083 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
1084 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
1085 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
1086 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
1087 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
1088 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
1089 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
1090 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
1091 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
1092
1093 Log(("ctrl.u64IntShadow %VX64\n", pVMCB->ctrl.u64IntShadow));
1094 Log(("ctrl.u64ExitCode %VX64\n", pVMCB->ctrl.u64ExitCode));
1095 Log(("ctrl.u64ExitInfo1 %VX64\n", pVMCB->ctrl.u64ExitInfo1));
1096 Log(("ctrl.u64ExitInfo2 %VX64\n", pVMCB->ctrl.u64ExitInfo2));
1097 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
1098 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
1099 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
1100 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
1101 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
1102 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
1103 Log(("ctrl.NestedPaging %VX64\n", pVMCB->ctrl.NestedPaging.au64));
1104 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
1105 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
1106 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
1107 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
1108 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
1109 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
1110
1111 Log(("ctrl.u64NestedPagingCR3 %VX64\n", pVMCB->ctrl.u64NestedPagingCR3));
1112 Log(("ctrl.u64LBRVirt %VX64\n", pVMCB->ctrl.u64LBRVirt));
1113
1114 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
1115 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
1116 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
1117 Log(("guest.CS.u64Base %VX64\n", pVMCB->guest.CS.u64Base));
1118 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
1119 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
1120 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
1121 Log(("guest.DS.u64Base %VX64\n", pVMCB->guest.DS.u64Base));
1122 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
1123 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
1124 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
1125 Log(("guest.ES.u64Base %VX64\n", pVMCB->guest.ES.u64Base));
1126 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
1127 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
1128 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
1129 Log(("guest.FS.u64Base %VX64\n", pVMCB->guest.FS.u64Base));
1130 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
1131 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
1132 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
1133 Log(("guest.GS.u64Base %VX64\n", pVMCB->guest.GS.u64Base));
1134
1135 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
1136 Log(("guest.GDTR.u64Base %VX64\n", pVMCB->guest.GDTR.u64Base));
1137
1138 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
1139 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
1140 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
1141 Log(("guest.LDTR.u64Base %VX64\n", pVMCB->guest.LDTR.u64Base));
1142
1143 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
1144 Log(("guest.IDTR.u64Base %VX64\n", pVMCB->guest.IDTR.u64Base));
1145
1146 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
1147 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
1148 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
1149 Log(("guest.TR.u64Base %VX64\n", pVMCB->guest.TR.u64Base));
1150
1151 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
1152 Log(("guest.u64CR0 %VX64\n", pVMCB->guest.u64CR0));
1153 Log(("guest.u64CR2 %VX64\n", pVMCB->guest.u64CR2));
1154 Log(("guest.u64CR3 %VX64\n", pVMCB->guest.u64CR3));
1155 Log(("guest.u64CR4 %VX64\n", pVMCB->guest.u64CR4));
1156 Log(("guest.u64DR6 %VX64\n", pVMCB->guest.u64DR6));
1157 Log(("guest.u64DR7 %VX64\n", pVMCB->guest.u64DR7));
1158
1159 Log(("guest.u64RIP %VX64\n", pVMCB->guest.u64RIP));
1160 Log(("guest.u64RSP %VX64\n", pVMCB->guest.u64RSP));
1161 Log(("guest.u64RAX %VX64\n", pVMCB->guest.u64RAX));
1162 Log(("guest.u64RFlags %VX64\n", pVMCB->guest.u64RFlags));
1163
1164 Log(("guest.u64SysEnterCS %VX64\n", pVMCB->guest.u64SysEnterCS));
1165 Log(("guest.u64SysEnterEIP %VX64\n", pVMCB->guest.u64SysEnterEIP));
1166 Log(("guest.u64SysEnterESP %VX64\n", pVMCB->guest.u64SysEnterESP));
1167
1168 Log(("guest.u64EFER %VX64\n", pVMCB->guest.u64EFER));
1169 Log(("guest.u64STAR %VX64\n", pVMCB->guest.u64STAR));
1170 Log(("guest.u64LSTAR %VX64\n", pVMCB->guest.u64LSTAR));
1171 Log(("guest.u64CSTAR %VX64\n", pVMCB->guest.u64CSTAR));
1172 Log(("guest.u64SFMASK %VX64\n", pVMCB->guest.u64SFMASK));
1173 Log(("guest.u64KernelGSBase %VX64\n", pVMCB->guest.u64KernelGSBase));
1174 Log(("guest.u64GPAT %VX64\n", pVMCB->guest.u64GPAT));
1175 Log(("guest.u64DBGCTL %VX64\n", pVMCB->guest.u64DBGCTL));
1176 Log(("guest.u64BR_FROM %VX64\n", pVMCB->guest.u64BR_FROM));
1177 Log(("guest.u64BR_TO %VX64\n", pVMCB->guest.u64BR_TO));
1178 Log(("guest.u64LASTEXCPFROM %VX64\n", pVMCB->guest.u64LASTEXCPFROM));
1179 Log(("guest.u64LASTEXCPTO %VX64\n", pVMCB->guest.u64LASTEXCPTO));
1180
1181#endif
1182 rc = VERR_SVM_UNABLE_TO_START_VM;
1183 goto end;
1184 }
1185
1186 /* Let's first sync back eip, esp, and eflags. */
1187 pCtx->rip = pVMCB->guest.u64RIP;
1188 pCtx->rsp = pVMCB->guest.u64RSP;
1189 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
1190 /* eax is saved/restore across the vmrun instruction */
1191 pCtx->rax = pVMCB->guest.u64RAX;
1192
1193 pCtx->msrKERNELGSBASE = pVMCB->guest.u64KernelGSBase; /* swapgs exchange value */
1194
1195 /* Can be updated behind our back in the nested paging case. */
1196 pCtx->cr2 = pVMCB->guest.u64CR2;
1197
1198 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1199 SVM_READ_SELREG(SS, ss);
1200 SVM_READ_SELREG(CS, cs);
1201 SVM_READ_SELREG(DS, ds);
1202 SVM_READ_SELREG(ES, es);
1203 SVM_READ_SELREG(FS, fs);
1204 SVM_READ_SELREG(GS, gs);
1205
1206 /*
1207 * System MSRs
1208 */
1209 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1210 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1211 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1212
1213 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1214 SVM_READ_SELREG(LDTR, ldtr);
1215 SVM_READ_SELREG(TR, tr);
1216
1217 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1218 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1219
1220 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1221 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1222
1223 /* Note: no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
1224 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1225 if ( pVM->hwaccm.s.fNestedPaging
1226 && pCtx->cr3 != pVMCB->guest.u64CR3)
1227 {
1228 CPUMSetGuestCR3(pVM, pVMCB->guest.u64CR3);
1229 PGMUpdateCR3(pVM, pVMCB->guest.u64CR3);
1230 }
1231
1232 /** @note NOW IT'S SAFE FOR LOGGING! */
1233
1234 /* Take care of instruction fusing (sti, mov ss) (see 15.20.5 Interrupt Shadows) */
1235 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
1236 {
1237 Log(("uInterruptState %x eip=%VGv\n", pVMCB->ctrl.u64IntShadow, pCtx->rip));
1238 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1239 }
1240 else
1241 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1242
1243 Log2(("exitCode = %x\n", exitCode));
1244
1245 /* Sync back DR6 as it could have been changed by hitting breakpoints. */
1246 pCtx->dr6 = pVMCB->guest.u64DR6;
1247 /* DR7.GD can be cleared by debug exceptions, so sync it back as well. */
1248 pCtx->dr7 = pVMCB->guest.u64DR7;
1249
1250 /* Check if an injected event was interrupted prematurely. */
1251 pVM->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1252 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1253 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1254 {
1255 Log(("Pending inject %VX64 at %VGv exit=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitCode));
1256
1257#ifdef LOG_ENABLED
1258 SVM_EVENT Event;
1259 Event.au64[0] = pVM->hwaccm.s.Event.intInfo;
1260
1261 if ( exitCode == SVM_EXIT_EXCEPTION_E
1262 && Event.n.u8Vector == 0xE)
1263 {
1264 Log(("Double fault!\n"));
1265 }
1266#endif
1267
1268 pVM->hwaccm.s.Event.fPending = true;
1269 /* Error code present? (redundant) */
1270 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1271 {
1272 pVM->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1273 }
1274 else
1275 pVM->hwaccm.s.Event.errCode = 0;
1276 }
1277#ifdef VBOX_WITH_STATISTICS
1278 if (exitCode == SVM_EXIT_NPF)
1279 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitReasonNPF);
1280 else
1281 STAM_COUNTER_INC(&pVM->hwaccm.s.pStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1282#endif
1283
1284 if (fSyncTPR)
1285 {
1286 rc = PDMApicSetTPR(pVM, pVMCB->ctrl.IntCtrl.n.u8VTPR);
1287 AssertRC(rc);
1288 }
1289
1290 /* Deal with the reason of the VM-exit. */
1291 switch (exitCode)
1292 {
1293 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1294 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1295 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1296 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1297 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1298 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1299 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1300 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1301 {
1302 /* Pending trap. */
1303 SVM_EVENT Event;
1304 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1305
1306 Log2(("Hardware/software interrupt %d\n", vector));
1307 switch (vector)
1308 {
1309#ifdef DEBUG
1310 case X86_XCPT_DB:
1311 {
1312#if 0 /* revisit */
1313 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), pVMCB->guest.u64DR6);
1314 Assert(rc != VINF_EM_RAW_GUEST_TRAP);
1315 break;
1316#endif
1317 /* @todo we don't really need to intercept this here. It's easy to sync back dr7 & dr6 after each world switch. */
1318 /* Sync back DR6 and DR7 here. */
1319 pCtx->dr6 = pVMCB->guest.u64DR6;
1320 pCtx->dr7 = pVMCB->guest.u64DR7;
1321
1322 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDB);
1323 Log(("Trap %x (debug) at %VGv\n", vector, pCtx->rip));
1324
1325 /* Reinject the exception. */
1326 Event.au64[0] = 0;
1327 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1328 Event.n.u1Valid = 1;
1329 Event.n.u8Vector = X86_XCPT_DB;
1330
1331 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1332
1333 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1334 goto ResumeExecution;
1335 }
1336#endif
1337
1338 case X86_XCPT_NM:
1339 {
1340 Log(("#NM fault at %VGv\n", pCtx->rip));
1341
1342 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1343 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1344 rc = CPUMR0LoadGuestFPU(pVM, pCtx);
1345 if (rc == VINF_SUCCESS)
1346 {
1347 Assert(CPUMIsGuestFPUStateActive(pVM));
1348 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1349
1350 /* Continue execution. */
1351 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1352 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1353
1354 goto ResumeExecution;
1355 }
1356
1357 Log(("Forward #NM fault to the guest\n"));
1358 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1359
1360 Event.au64[0] = 0;
1361 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1362 Event.n.u1Valid = 1;
1363 Event.n.u8Vector = X86_XCPT_NM;
1364
1365 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1366 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1367 goto ResumeExecution;
1368 }
1369
1370 case X86_XCPT_PF: /* Page fault */
1371 {
1372 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1373 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1374
1375#ifdef DEBUG
1376 if (pVM->hwaccm.s.fNestedPaging)
1377 { /* A genuine pagefault.
1378 * Forward the trap to the guest by injecting the exception and resuming execution.
1379 */
1380 Log(("Guest page fault at %VGv cr2=%VGv error code %x rsp=%VGv\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
1381 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1382
1383 /* Now we must update CR2. */
1384 pCtx->cr2 = uFaultAddress;
1385
1386 Event.au64[0] = 0;
1387 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1388 Event.n.u1Valid = 1;
1389 Event.n.u8Vector = X86_XCPT_PF;
1390 Event.n.u1ErrorCodeValid = 1;
1391 Event.n.u32ErrorCode = errCode;
1392
1393 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1394
1395 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1396 goto ResumeExecution;
1397 }
1398#endif
1399 Assert(!pVM->hwaccm.s.fNestedPaging);
1400
1401 Log2(("Page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, uFaultAddress, errCode));
1402 /* Exit qualification contains the linear address of the page fault. */
1403 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1404 TRPMSetErrorCode(pVM, errCode);
1405 TRPMSetFaultAddress(pVM, uFaultAddress);
1406
1407 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1408 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1409 Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->rip, rc));
1410 if (rc == VINF_SUCCESS)
1411 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1412 Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, uFaultAddress, errCode));
1413 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1414
1415 TRPMResetTrap(pVM);
1416
1417 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1418 goto ResumeExecution;
1419 }
1420 else
1421 if (rc == VINF_EM_RAW_GUEST_TRAP)
1422 { /* A genuine pagefault.
1423 * Forward the trap to the guest by injecting the exception and resuming execution.
1424 */
1425 Log2(("Forward page fault to the guest\n"));
1426 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1427 /* The error code might have been changed. */
1428 errCode = TRPMGetErrorCode(pVM);
1429
1430 TRPMResetTrap(pVM);
1431
1432 /* Now we must update CR2. */
1433 pCtx->cr2 = uFaultAddress;
1434
1435 Event.au64[0] = 0;
1436 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1437 Event.n.u1Valid = 1;
1438 Event.n.u8Vector = X86_XCPT_PF;
1439 Event.n.u1ErrorCodeValid = 1;
1440 Event.n.u32ErrorCode = errCode;
1441
1442 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1443
1444 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1445 goto ResumeExecution;
1446 }
1447#ifdef VBOX_STRICT
1448 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1449 LogFlow(("PGMTrap0eHandler failed with %d\n", rc));
1450#endif
1451 /* Need to go back to the recompiler to emulate the instruction. */
1452 TRPMResetTrap(pVM);
1453 break;
1454 }
1455
1456 case X86_XCPT_MF: /* Floating point exception. */
1457 {
1458 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1459 if (!(pCtx->cr0 & X86_CR0_NE))
1460 {
1461 /* old style FPU error reporting needs some extra work. */
1462 /** @todo don't fall back to the recompiler, but do it manually. */
1463 rc = VINF_EM_RAW_EMULATE_INSTR;
1464 break;
1465 }
1466 Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1467
1468 Event.au64[0] = 0;
1469 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1470 Event.n.u1Valid = 1;
1471 Event.n.u8Vector = X86_XCPT_MF;
1472
1473 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1474
1475 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1476 goto ResumeExecution;
1477 }
1478
1479#ifdef VBOX_STRICT
1480 case X86_XCPT_GP: /* General protection failure exception.*/
1481 case X86_XCPT_UD: /* Unknown opcode exception. */
1482 case X86_XCPT_DE: /* Divide error. */
1483 case X86_XCPT_SS: /* Stack segment exception. */
1484 case X86_XCPT_NP: /* Segment not present exception. */
1485 {
1486 Event.au64[0] = 0;
1487 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1488 Event.n.u1Valid = 1;
1489 Event.n.u8Vector = vector;
1490
1491 switch(vector)
1492 {
1493 case X86_XCPT_GP:
1494 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1495 Event.n.u1ErrorCodeValid = 1;
1496 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1497 break;
1498 case X86_XCPT_DE:
1499 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
1500 break;
1501 case X86_XCPT_UD:
1502 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
1503 break;
1504 case X86_XCPT_SS:
1505 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
1506 Event.n.u1ErrorCodeValid = 1;
1507 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1508 break;
1509 case X86_XCPT_NP:
1510 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
1511 Event.n.u1ErrorCodeValid = 1;
1512 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1513 break;
1514 }
1515 Log(("Trap %x at %VGv esi=%x\n", vector, pCtx->rip, pCtx->esi));
1516 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1517
1518 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1519 goto ResumeExecution;
1520 }
1521#endif
1522 default:
1523 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1524 rc = VERR_EM_INTERNAL_ERROR;
1525 break;
1526
1527 } /* switch (vector) */
1528 break;
1529 }
1530
1531 case SVM_EXIT_NPF:
1532 {
1533 /* EXITINFO1 contains fault errorcode; EXITINFO2 contains the guest physical address causing the fault. */
1534 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1535 RTGCPHYS uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1536
1537 Assert(pVM->hwaccm.s.fNestedPaging);
1538 Log(("Nested page fault at %VGv cr2=%VGp error code %x\n", pCtx->rip, uFaultAddress, errCode));
1539 /* Exit qualification contains the linear address of the page fault. */
1540 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1541 TRPMSetErrorCode(pVM, errCode);
1542 TRPMSetFaultAddress(pVM, uFaultAddress);
1543
1544 /* Handle the pagefault trap for the nested shadow table. */
1545 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMGetHostMode(pVM), errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1546 Log2(("PGMR0Trap0eHandlerNestedPaging %VGv returned %Vrc\n", pCtx->rip, rc));
1547 if (rc == VINF_SUCCESS)
1548 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1549 Log2(("Shadow page fault at %VGv cr2=%VGp error code %x\n", pCtx->rip, uFaultAddress, errCode));
1550 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1551
1552 TRPMResetTrap(pVM);
1553
1554 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1555 goto ResumeExecution;
1556 }
1557
1558#ifdef VBOX_STRICT
1559 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1560 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
1561#endif
1562 /* Need to go back to the recompiler to emulate the instruction. */
1563 TRPMResetTrap(pVM);
1564 break;
1565 }
1566
1567 case SVM_EXIT_VINTR:
1568 /* A virtual interrupt is about to be delivered, which means IF=1. */
1569 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1570 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1571 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1572 goto ResumeExecution;
1573
1574 case SVM_EXIT_FERR_FREEZE:
1575 case SVM_EXIT_INTR:
1576 case SVM_EXIT_NMI:
1577 case SVM_EXIT_SMI:
1578 case SVM_EXIT_INIT:
1579 /* External interrupt; leave to allow it to be dispatched again. */
1580 rc = VINF_EM_RAW_INTERRUPT;
1581 break;
1582
1583 case SVM_EXIT_WBINVD:
1584 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1585 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
1586 /* Skip instruction and continue directly. */
1587 pCtx->rip += 2; /** @note hardcoded opcode size! */
1588 /* Continue execution.*/
1589 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1590 goto ResumeExecution;
1591
1592 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1593 {
1594 Log2(("SVM: Cpuid at %VGv for %x\n", pCtx->rip, pCtx->eax));
1595 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
1596 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
1597 if (rc == VINF_SUCCESS)
1598 {
1599 /* Update EIP and continue execution. */
1600 pCtx->rip += 2; /** @note hardcoded opcode size! */
1601 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1602 goto ResumeExecution;
1603 }
1604 AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
1605 rc = VINF_EM_RAW_EMULATE_INSTR;
1606 break;
1607 }
1608
1609 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1610 {
1611 Log2(("SVM: Rdtsc\n"));
1612 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
1613 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
1614 if (rc == VINF_SUCCESS)
1615 {
1616 /* Update EIP and continue execution. */
1617 pCtx->rip += 2; /** @note hardcoded opcode size! */
1618 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1619 goto ResumeExecution;
1620 }
1621 AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
1622 rc = VINF_EM_RAW_EMULATE_INSTR;
1623 break;
1624 }
1625
1626 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1627 {
1628 Log2(("SVM: invlpg\n"));
1629 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
1630
1631 Assert(!pVM->hwaccm.s.fNestedPaging);
1632
1633 /* Truly a pita. Why can't SVM give the same information as VT-x? */
1634 rc = SVMR0InterpretInvpg(pVM, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1635 if (rc == VINF_SUCCESS)
1636 {
1637 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageInvlpg);
1638 goto ResumeExecution; /* eip already updated */
1639 }
1640 break;
1641 }
1642
1643 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1644 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1645 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1646 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1647 {
1648 uint32_t cbSize;
1649
1650 Log2(("SVM: %VGv mov cr%d, \n", pCtx->rip, exitCode - SVM_EXIT_WRITE_CR0));
1651 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
1652 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1653
1654 switch (exitCode - SVM_EXIT_WRITE_CR0)
1655 {
1656 case 0:
1657 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1658 break;
1659 case 2:
1660 break;
1661 case 3:
1662 Assert(!pVM->hwaccm.s.fNestedPaging);
1663 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1664 break;
1665 case 4:
1666 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1667 break;
1668 case 8:
1669 break;
1670 default:
1671 AssertFailed();
1672 }
1673 /* Check if a sync operation is pending. */
1674 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1675 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
1676 {
1677 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
1678 AssertRC(rc);
1679
1680 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBCRxChange);
1681
1682 /* Must be set by PGMSyncCR3 */
1683 Assert(PGMGetGuestMode(pVM) <= PGMMODE_PROTECTED || pVM->hwaccm.s.svm.fForceTLBFlush);
1684 }
1685 if (rc == VINF_SUCCESS)
1686 {
1687 /* EIP has been updated already. */
1688
1689 /* Only resume if successful. */
1690 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1691 goto ResumeExecution;
1692 }
1693 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1694 break;
1695 }
1696
1697 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
1698 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
1699 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
1700 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
1701 {
1702 uint32_t cbSize;
1703
1704 Log2(("SVM: %VGv mov x, cr%d\n", pCtx->rip, exitCode - SVM_EXIT_READ_CR0));
1705 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
1706 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1707 if (rc == VINF_SUCCESS)
1708 {
1709 /* EIP has been updated already. */
1710
1711 /* Only resume if successful. */
1712 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1713 goto ResumeExecution;
1714 }
1715 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1716 break;
1717 }
1718
1719 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
1720 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
1721 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
1722 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
1723 {
1724 uint32_t cbSize;
1725
1726 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->rip, exitCode - SVM_EXIT_WRITE_DR0));
1727 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1728 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1729 if (rc == VINF_SUCCESS)
1730 {
1731 /* EIP has been updated already. */
1732 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
1733
1734 /* Only resume if successful. */
1735 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1736 goto ResumeExecution;
1737 }
1738 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1739 break;
1740 }
1741
1742 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
1743 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
1744 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
1745 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
1746 {
1747 uint32_t cbSize;
1748
1749 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->rip, exitCode - SVM_EXIT_READ_DR0));
1750 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1751 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1752 if (rc == VINF_SUCCESS)
1753 {
1754 /* EIP has been updated already. */
1755
1756 /* Only resume if successful. */
1757 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1758 goto ResumeExecution;
1759 }
1760 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1761 break;
1762 }
1763
1764 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
1765 case SVM_EXIT_IOIO: /* I/O instruction. */
1766 {
1767 SVM_IOIO_EXIT IoExitInfo;
1768 uint32_t uIOSize, uAndVal;
1769
1770 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
1771
1772 /** @todo could use a lookup table here */
1773 if (IoExitInfo.n.u1OP8)
1774 {
1775 uIOSize = 1;
1776 uAndVal = 0xff;
1777 }
1778 else
1779 if (IoExitInfo.n.u1OP16)
1780 {
1781 uIOSize = 2;
1782 uAndVal = 0xffff;
1783 }
1784 else
1785 if (IoExitInfo.n.u1OP32)
1786 {
1787 uIOSize = 4;
1788 uAndVal = 0xffffffff;
1789 }
1790 else
1791 {
1792 AssertFailed(); /* should be fatal. */
1793 rc = VINF_EM_RAW_EMULATE_INSTR;
1794 break;
1795 }
1796
1797 if (IoExitInfo.n.u1STR)
1798 {
1799 /* ins/outs */
1800 uint32_t prefix = 0;
1801 if (IoExitInfo.n.u1REP)
1802 prefix |= PREFIX_REP;
1803
1804 if (IoExitInfo.n.u1Type == 0)
1805 {
1806 Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1807 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
1808 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1809 }
1810 else
1811 {
1812 Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1813 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
1814 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1815 }
1816 }
1817 else
1818 {
1819 /* normal in/out */
1820 Assert(!IoExitInfo.n.u1REP);
1821
1822 if (IoExitInfo.n.u1Type == 0)
1823 {
1824 Log2(("IOMIOPortWrite %VGv %x %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
1825 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
1826 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
1827 }
1828 else
1829 {
1830 uint32_t u32Val = 0;
1831
1832 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
1833 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
1834 if (IOM_SUCCESS(rc))
1835 {
1836 /* Write back to the EAX register. */
1837 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
1838 Log2(("IOMIOPortRead %VGv %x %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
1839 }
1840 }
1841 }
1842 /*
1843 * Handled the I/O return codes.
1844 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
1845 */
1846 if (IOM_SUCCESS(rc))
1847 {
1848 /* Update EIP and continue execution. */
1849 pCtx->rip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
1850 if (RT_LIKELY(rc == VINF_SUCCESS))
1851 {
1852 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1853 goto ResumeExecution;
1854 }
1855 Log2(("EM status from IO at %VGv %x size %d: %Vrc\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize, rc));
1856 break;
1857 }
1858
1859#ifdef VBOX_STRICT
1860 if (rc == VINF_IOM_HC_IOPORT_READ)
1861 Assert(IoExitInfo.n.u1Type != 0);
1862 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
1863 Assert(IoExitInfo.n.u1Type == 0);
1864 else
1865 AssertMsg(VBOX_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
1866#endif
1867 Log2(("Failed IO at %VGv %x size %d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1868 break;
1869 }
1870
1871 case SVM_EXIT_HLT:
1872 /** Check if external interrupts are pending; if so, don't switch back. */
1873 pCtx->rip++; /* skip hlt */
1874 if ( pCtx->eflags.Bits.u1IF
1875 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
1876 goto ResumeExecution;
1877
1878 rc = VINF_EM_HALT;
1879 break;
1880
1881 case SVM_EXIT_RSM:
1882 case SVM_EXIT_INVLPGA:
1883 case SVM_EXIT_VMRUN:
1884 case SVM_EXIT_VMMCALL:
1885 case SVM_EXIT_VMLOAD:
1886 case SVM_EXIT_VMSAVE:
1887 case SVM_EXIT_STGI:
1888 case SVM_EXIT_CLGI:
1889 case SVM_EXIT_SKINIT:
1890 case SVM_EXIT_RDTSCP:
1891 {
1892 /* Unsupported instructions. */
1893 SVM_EVENT Event;
1894
1895 Event.au64[0] = 0;
1896 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1897 Event.n.u1Valid = 1;
1898 Event.n.u8Vector = X86_XCPT_UD;
1899
1900 Log(("Forced #UD trap at %VGv\n", pCtx->rip));
1901 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1902
1903 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1904 goto ResumeExecution;
1905 }
1906
1907 /* Emulate in ring 3. */
1908 case SVM_EXIT_MSR:
1909 {
1910 uint32_t cbSize;
1911
1912 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
1913 Log(("SVM: %s\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr"));
1914 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1915 if (rc == VINF_SUCCESS)
1916 {
1917 /* EIP has been updated already. */
1918
1919 /* Only resume if successful. */
1920 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1921 goto ResumeExecution;
1922 }
1923 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Vrc\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr", rc));
1924 break;
1925 }
1926
1927 case SVM_EXIT_MONITOR:
1928 case SVM_EXIT_RDPMC:
1929 case SVM_EXIT_PAUSE:
1930 case SVM_EXIT_MWAIT_UNCOND:
1931 case SVM_EXIT_MWAIT_ARMED:
1932 case SVM_EXIT_TASK_SWITCH: /* can change CR3; emulate */
1933 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
1934 break;
1935
1936 case SVM_EXIT_SHUTDOWN:
1937 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
1938 break;
1939
1940 case SVM_EXIT_IDTR_READ:
1941 case SVM_EXIT_GDTR_READ:
1942 case SVM_EXIT_LDTR_READ:
1943 case SVM_EXIT_TR_READ:
1944 case SVM_EXIT_IDTR_WRITE:
1945 case SVM_EXIT_GDTR_WRITE:
1946 case SVM_EXIT_LDTR_WRITE:
1947 case SVM_EXIT_TR_WRITE:
1948 case SVM_EXIT_CR0_SEL_WRITE:
1949 default:
1950 /* Unexpected exit codes. */
1951 rc = VERR_EM_INTERNAL_ERROR;
1952 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
1953 break;
1954 }
1955
1956end:
1957
1958 /* Signal changes for the recompiler. */
1959 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
1960
1961 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
1962 if (exitCode == SVM_EXIT_INTR)
1963 {
1964 STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
1965 /* On the next entry we'll only sync the host context. */
1966 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
1967 }
1968 else
1969 {
1970 /* On the next entry we'll sync everything. */
1971 /** @todo we can do better than this */
1972 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
1973 }
1974
1975 /* translate into a less severe return code */
1976 if (rc == VERR_EM_INTERPRETER)
1977 rc = VINF_EM_RAW_EMULATE_INSTR;
1978
1979 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1980 return rc;
1981}
1982
1983/**
1984 * Enters the AMD-V session
1985 *
1986 * @returns VBox status code.
1987 * @param pVM The VM to operate on.
1988 * @param pCpu CPU info struct
1989 */
1990HWACCMR0DECL(int) SVMR0Enter(PVM pVM, PHWACCM_CPUINFO pCpu)
1991{
1992 Assert(pVM->hwaccm.s.svm.fSupported);
1993
1994 LogFlow(("SVMR0Enter cpu%d last=%d asid=%d\n", pCpu->idCpu, pVM->hwaccm.s.svm.idLastCpu, pVM->hwaccm.s.svm.uCurrentASID));
1995 pVM->hwaccm.s.svm.fResumeVM = false;
1996
1997 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
1998 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
1999
2000 return VINF_SUCCESS;
2001}
2002
2003
2004/**
2005 * Leaves the AMD-V session
2006 *
2007 * @returns VBox status code.
2008 * @param pVM The VM to operate on.
2009 */
2010HWACCMR0DECL(int) SVMR0Leave(PVM pVM)
2011{
2012 Assert(pVM->hwaccm.s.svm.fSupported);
2013 return VINF_SUCCESS;
2014}
2015
2016
2017static int svmInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2018{
2019 OP_PARAMVAL param1;
2020 RTGCPTR addr;
2021
2022 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2023 if(VBOX_FAILURE(rc))
2024 return VERR_EM_INTERPRETER;
2025
2026 switch(param1.type)
2027 {
2028 case PARMTYPE_IMMEDIATE:
2029 case PARMTYPE_ADDRESS:
2030 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
2031 return VERR_EM_INTERPRETER;
2032 addr = param1.val.val64;
2033 break;
2034
2035 default:
2036 return VERR_EM_INTERPRETER;
2037 }
2038
2039 /** @todo is addr always a flat linear address or ds based
2040 * (in absence of segment override prefixes)????
2041 */
2042 rc = PGMInvalidatePage(pVM, addr);
2043 if (VBOX_SUCCESS(rc))
2044 {
2045 /* Manually invalidate the page for the VM's TLB. */
2046 Log(("SVMInvlpgA %VGv ASID=%d\n", addr, uASID));
2047 SVMInvlpgA(addr, uASID);
2048 return VINF_SUCCESS;
2049 }
2050 Assert(rc == VERR_REM_FLUSHED_PAGES_OVERFLOW);
2051 return rc;
2052}
2053
2054/**
2055 * Interprets INVLPG
2056 *
2057 * @returns VBox status code.
2058 * @retval VINF_* Scheduling instructions.
2059 * @retval VERR_EM_INTERPRETER Something we can't cope with.
2060 * @retval VERR_* Fatal errors.
2061 *
2062 * @param pVM The VM handle.
2063 * @param pRegFrame The register frame.
2064 * @param ASID Tagged TLB id for the guest
2065 *
2066 * Updates the EIP if an instruction was executed successfully.
2067 */
2068static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2069{
2070 /*
2071 * Only allow 32 & 64 bits code.
2072 */
2073 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
2074 if (enmMode != CPUMODE_16BIT)
2075 {
2076 RTGCPTR pbCode;
2077 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->rip, &pbCode);
2078 if (VBOX_SUCCESS(rc))
2079 {
2080 uint32_t cbOp;
2081 DISCPUSTATE Cpu;
2082
2083 Cpu.mode = enmMode;
2084 rc = EMInterpretDisasOneEx(pVM, pbCode, pRegFrame, &Cpu, &cbOp);
2085 Assert(VBOX_FAILURE(rc) || Cpu.pCurInstr->opcode == OP_INVLPG);
2086 if (VBOX_SUCCESS(rc) && Cpu.pCurInstr->opcode == OP_INVLPG)
2087 {
2088 Assert(cbOp == Cpu.opsize);
2089 rc = svmInterpretInvlPg(pVM, &Cpu, pRegFrame, uASID);
2090 if (VBOX_SUCCESS(rc))
2091 {
2092 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
2093 }
2094 return rc;
2095 }
2096 }
2097 }
2098 return VERR_EM_INTERPRETER;
2099}
2100
2101
2102/**
2103 * Invalidates a guest page
2104 *
2105 * @returns VBox status code.
2106 * @param pVM The VM to operate on.
2107 * @param GCVirt Page to invalidate
2108 */
2109HWACCMR0DECL(int) SVMR0InvalidatePage(PVM pVM, RTGCPTR GCVirt)
2110{
2111 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVM->hwaccm.s.svm.fForceTLBFlush;
2112
2113 /* Skip it if a TLB flush is already pending. */
2114 if (!fFlushPending)
2115 {
2116 SVM_VMCB *pVMCB;
2117
2118 Log2(("SVMR0InvalidatePage %VGv\n", GCVirt));
2119 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2120 Assert(pVM->hwaccm.s.svm.fSupported);
2121
2122 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
2123 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2124
2125 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageManual);
2126 SVMInvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2127 }
2128 return VINF_SUCCESS;
2129}
2130
2131
2132/**
2133 * Invalidates a guest page by physical address
2134 *
2135 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
2136 *
2137 * @returns VBox status code.
2138 * @param pVM The VM to operate on.
2139 * @param GCPhys Page to invalidate
2140 */
2141HWACCMR0DECL(int) SVMR0InvalidatePhysPage(PVM pVM, RTGCPHYS GCPhys)
2142{
2143 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVM->hwaccm.s.svm.fForceTLBFlush;
2144
2145 Assert(pVM->hwaccm.s.fNestedPaging);
2146
2147 /* Skip it if a TLB flush is already pending. */
2148 if (!fFlushPending)
2149 {
2150 CPUMCTX *pCtx;
2151 int rc;
2152 SVM_VMCB *pVMCB;
2153
2154 rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2155 AssertRCReturn(rc, rc);
2156
2157 Log2(("SVMR0InvalidatePhysPage %VGp\n", GCPhys));
2158 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2159 Assert(pVM->hwaccm.s.svm.fSupported);
2160
2161 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
2162 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2163
2164 /*
2165 * Only allow 32 & 64 bits code.
2166 */
2167 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid);
2168 if (enmMode != CPUMODE_16BIT)
2169 {
2170 RTGCPTR pbCode;
2171 int rc = SELMValidateAndConvertCSAddr(pVM, pCtx->eflags, pCtx->ss, pCtx->cs, &pCtx->csHid, (RTGCPTR)pCtx->rip, &pbCode);
2172 if (VBOX_SUCCESS(rc))
2173 {
2174 uint32_t cbOp;
2175 DISCPUSTATE Cpu;
2176 OP_PARAMVAL param1;
2177 RTGCPTR addr;
2178
2179 Cpu.mode = enmMode;
2180 rc = EMInterpretDisasOneEx(pVM, pbCode, CPUMCTX2CORE(pCtx), &Cpu, &cbOp);
2181 AssertRCReturn(rc, rc);
2182 Assert(cbOp == Cpu.opsize);
2183
2184 int rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), &Cpu, &Cpu.param1, &param1, PARAM_SOURCE);
2185 AssertRCReturn(rc, VERR_EM_INTERPRETER);
2186
2187 switch(param1.type)
2188 {
2189 case PARMTYPE_IMMEDIATE:
2190 case PARMTYPE_ADDRESS:
2191 AssertReturn((param1.flags & (PARAM_VAL32|PARAM_VAL64)), VERR_EM_INTERPRETER);
2192
2193 addr = param1.val.val64;
2194 break;
2195
2196 default:
2197 AssertFailed();
2198 return VERR_EM_INTERPRETER;
2199 }
2200
2201 /* Manually invalidate the page for the VM's TLB. */
2202 Log(("SVMR0InvalidatePhysPage Phys=%VGp Virt=%VGv ASID=%d\n", GCPhys, addr, pVMCB->ctrl.TLBCtrl.n.u32ASID));
2203 SVMInvlpgA(addr, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2204 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPhysPageManual);
2205
2206 return VINF_SUCCESS;
2207 }
2208 }
2209 AssertFailed();
2210 return VERR_EM_INTERPRETER;
2211 }
2212 return VINF_SUCCESS;
2213}
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette