VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 13197

Last change on this file since 13197 was 13089, checked in by vboxsync, 16 years ago

EPT updates

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 90.6 KB
Line 
1/* $Id: HWSVMR0.cpp 13089 2008-10-08 15:52:46Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include "HWSVMR0.h"
47
48/*******************************************************************************
49* Internal Functions *
50*******************************************************************************/
51static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID);
52
53/*******************************************************************************
54* Global Variables *
55*******************************************************************************/
56/* IO operation lookup arrays. */
57static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
58
59/**
60 * Sets up and activates AMD-V on the current CPU
61 *
62 * @returns VBox status code.
63 * @param pCpu CPU info struct
64 * @param pVM The VM to operate on.
65 * @param pvPageCpu Pointer to the global cpu page
66 * @param pPageCpuPhys Physical address of the global cpu page
67 */
68VMMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
69{
70 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
71 AssertReturn(pVM, VERR_INVALID_PARAMETER);
72 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
73
74 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
75
76#ifdef LOG_ENABLED
77 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
78#endif
79
80 /* Turn on AMD-V in the EFER MSR. */
81 uint64_t val = ASMRdMsr(MSR_K6_EFER);
82 if (!(val & MSR_K6_EFER_SVME))
83 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
84
85 /* Write the physical page address where the CPU will store the host state while executing the VM. */
86 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
87
88 return VINF_SUCCESS;
89}
90
91/**
92 * Deactivates AMD-V on the current CPU
93 *
94 * @returns VBox status code.
95 * @param pCpu CPU info struct
96 * @param pvPageCpu Pointer to the global cpu page
97 * @param pPageCpuPhys Physical address of the global cpu page
98 */
99VMMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
100{
101 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
102 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
103
104#ifdef LOG_ENABLED
105 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
106#endif
107
108 /* Turn off AMD-V in the EFER MSR. */
109 uint64_t val = ASMRdMsr(MSR_K6_EFER);
110 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
111
112 /* Invalidate host state physical address. */
113 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
114
115 return VINF_SUCCESS;
116}
117
118/**
119 * Does Ring-0 per VM AMD-V init.
120 *
121 * @returns VBox status code.
122 * @param pVM The VM to operate on.
123 */
124VMMR0DECL(int) SVMR0InitVM(PVM pVM)
125{
126 int rc;
127
128 pVM->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
129 pVM->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
130 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
131 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
132
133
134 /* Allocate one page for the VM control block (VMCB). */
135 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
136 if (RT_FAILURE(rc))
137 return rc;
138
139 pVM->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCB);
140 pVM->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCB, 0);
141 ASMMemZeroPage(pVM->hwaccm.s.svm.pVMCB);
142
143 /* Allocate one page for the host context */
144 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
145 if (RT_FAILURE(rc))
146 return rc;
147
148 pVM->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCBHost);
149 pVM->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCBHost, 0);
150 ASMMemZeroPage(pVM->hwaccm.s.svm.pVMCBHost);
151
152 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
153 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
154 if (RT_FAILURE(rc))
155 return rc;
156
157 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
158 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
159 /* Set all bits to intercept all IO accesses. */
160 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
161
162 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
163 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
164 if (RT_FAILURE(rc))
165 return rc;
166
167 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
168 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
169 /* Set all bits to intercept all MSR accesses. */
170 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
171
172 /* Erratum 170 which requires a forced TLB flush for each world switch:
173 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
174 *
175 * All BH-G1/2 and DH-G1/2 models include a fix:
176 * Athlon X2: 0x6b 1/2
177 * 0x68 1/2
178 * Athlon 64: 0x7f 1
179 * 0x6f 2
180 * Sempron: 0x7f 1/2
181 * 0x6f 2
182 * 0x6c 2
183 * 0x7c 2
184 * Turion 64: 0x68 2
185 *
186 */
187 uint32_t u32Dummy;
188 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
189 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
190 u32BaseFamily= (u32Version >> 8) & 0xf;
191 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
192 u32Model = ((u32Version >> 4) & 0xf);
193 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
194 u32Stepping = u32Version & 0xf;
195 if ( u32Family == 0xf
196 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
197 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
198 {
199 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
200 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
201 }
202 return VINF_SUCCESS;
203}
204
205/**
206 * Does Ring-0 per VM AMD-V termination.
207 *
208 * @returns VBox status code.
209 * @param pVM The VM to operate on.
210 */
211VMMR0DECL(int) SVMR0TermVM(PVM pVM)
212{
213 if (pVM->hwaccm.s.svm.pMemObjVMCB != NIL_RTR0MEMOBJ)
214 {
215 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCB, false);
216 pVM->hwaccm.s.svm.pVMCB = 0;
217 pVM->hwaccm.s.svm.pVMCBPhys = 0;
218 pVM->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
219 }
220 if (pVM->hwaccm.s.svm.pMemObjVMCBHost != NIL_RTR0MEMOBJ)
221 {
222 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCBHost, false);
223 pVM->hwaccm.s.svm.pVMCBHost = 0;
224 pVM->hwaccm.s.svm.pVMCBHostPhys = 0;
225 pVM->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
226 }
227 if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
228 {
229 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
230 pVM->hwaccm.s.svm.pIOBitmap = 0;
231 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
232 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
233 }
234 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
235 {
236 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
237 pVM->hwaccm.s.svm.pMSRBitmap = 0;
238 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
239 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
240 }
241 return VINF_SUCCESS;
242}
243
244/**
245 * Sets up AMD-V for the specified VM
246 *
247 * @returns VBox status code.
248 * @param pVM The VM to operate on.
249 */
250VMMR0DECL(int) SVMR0SetupVM(PVM pVM)
251{
252 int rc = VINF_SUCCESS;
253 SVM_VMCB *pVMCB;
254
255 AssertReturn(pVM, VERR_INVALID_PARAMETER);
256
257 Assert(pVM->hwaccm.s.svm.fSupported);
258
259 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
260 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
261
262 /* Program the control fields. Most of them never have to be changed again. */
263 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
264 /* Note: CR0 & CR4 can be safely read when guest and shadow copies are identical. */
265 if (!pVM->hwaccm.s.fNestedPaging)
266 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
267 else
268 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(4);
269
270 /*
271 * CR0/3/4 writes must be intercepted for obvious reasons.
272 */
273 if (!pVM->hwaccm.s.fNestedPaging)
274 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
275 else
276 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(4) | RT_BIT(8);
277
278 /* Intercept all DRx reads and writes by default. Changed later on. */
279 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
280 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
281
282 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
283 * All breakpoints are automatically cleared when the VM exits.
284 */
285
286 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
287#ifndef DEBUG
288 if (pVM->hwaccm.s.fNestedPaging)
289 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
290#endif
291
292 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
293 | SVM_CTRL1_INTERCEPT_VINTR
294 | SVM_CTRL1_INTERCEPT_NMI
295 | SVM_CTRL1_INTERCEPT_SMI
296 | SVM_CTRL1_INTERCEPT_INIT
297 | SVM_CTRL1_INTERCEPT_RDPMC
298 | SVM_CTRL1_INTERCEPT_CPUID
299 | SVM_CTRL1_INTERCEPT_RSM
300 | SVM_CTRL1_INTERCEPT_HLT
301 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
302 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
303 | SVM_CTRL1_INTERCEPT_INVLPG
304 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
305 | SVM_CTRL1_INTERCEPT_TASK_SWITCH
306 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
307 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
308 ;
309 /* With nested paging we don't care about invlpg anymore. */
310 if (pVM->hwaccm.s.fNestedPaging)
311 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_INVLPG;
312
313 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
314 | SVM_CTRL2_INTERCEPT_VMMCALL
315 | SVM_CTRL2_INTERCEPT_VMLOAD
316 | SVM_CTRL2_INTERCEPT_VMSAVE
317 | SVM_CTRL2_INTERCEPT_STGI
318 | SVM_CTRL2_INTERCEPT_CLGI
319 | SVM_CTRL2_INTERCEPT_SKINIT
320 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
321 | SVM_CTRL2_INTERCEPT_WBINVD
322 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
323 ;
324 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
325 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
326 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
327
328 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
329 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
330 /* Ignore the priority in the TPR; just deliver it when we tell it to. */
331 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1;
332
333 /* Set IO and MSR bitmap addresses. */
334 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
335 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
336
337 /* No LBR virtualization. */
338 pVMCB->ctrl.u64LBRVirt = 0;
339
340 /** The ASID must start at 1; the host uses 0. */
341 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
342
343 /** Setup the PAT msr (nested paging only) */
344 pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
345 return rc;
346}
347
348
349/**
350 * Injects an event (trap or external interrupt)
351 *
352 * @param pVM The VM to operate on.
353 * @param pVMCB SVM control block
354 * @param pCtx CPU Context
355 * @param pIntInfo SVM interrupt info
356 */
357inline void SVMR0InjectEvent(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
358{
359#ifdef VBOX_STRICT
360 if (pEvent->n.u8Vector == 0xE)
361 Log(("SVM: Inject int %d at %VGv error code=%02x CR2=%VGv intInfo=%08x\n", pEvent->n.u8Vector, pCtx->rip, pEvent->n.u32ErrorCode, pCtx->cr2, pEvent->au64[0]));
362 else
363 if (pEvent->n.u8Vector < 0x20)
364 Log(("SVM: Inject int %d at %VGv error code=%08x\n", pEvent->n.u8Vector, pCtx->rip, pEvent->n.u32ErrorCode));
365 else
366 {
367 Log(("INJ-EI: %x at %VGv\n", pEvent->n.u8Vector, pCtx->rip));
368 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
369 Assert(pCtx->eflags.u32 & X86_EFL_IF);
370 }
371#endif
372
373 /* Set event injection state. */
374 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
375}
376
377
378/**
379 * Checks for pending guest interrupts and injects them
380 *
381 * @returns VBox status code.
382 * @param pVM The VM to operate on.
383 * @param pVMCB SVM control block
384 * @param pCtx CPU Context
385 */
386static int SVMR0CheckPendingInterrupt(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
387{
388 int rc;
389
390 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
391 if (pVM->hwaccm.s.Event.fPending)
392 {
393 SVM_EVENT Event;
394
395 Log(("Reinjecting event %08x %08x at %VGv\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->rip));
396 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
397 Event.au64[0] = pVM->hwaccm.s.Event.intInfo;
398 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
399
400 pVM->hwaccm.s.Event.fPending = false;
401 return VINF_SUCCESS;
402 }
403
404 /* When external interrupts are pending, we should exit the VM when IF is set. */
405 if ( !TRPMHasTrap(pVM)
406 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
407 {
408 if ( !(pCtx->eflags.u32 & X86_EFL_IF)
409 || VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
410 {
411 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
412 {
413 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
414 LogFlow(("Enable irq window exit!\n"));
415 else
416 Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS -> irq window exit\n", pCtx->rip));
417
418 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
419 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
420 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
421 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
422 }
423 }
424 else
425 {
426 uint8_t u8Interrupt;
427
428 rc = PDMGetInterrupt(pVM, &u8Interrupt);
429 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
430 if (VBOX_SUCCESS(rc))
431 {
432 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
433 AssertRC(rc);
434 }
435 else
436 {
437 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
438 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
439 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
440 /* Just continue */
441 }
442 }
443 }
444
445#ifdef VBOX_STRICT
446 if (TRPMHasTrap(pVM))
447 {
448 uint8_t u8Vector;
449 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
450 AssertRC(rc);
451 }
452#endif
453
454 if ( pCtx->eflags.u32 & X86_EFL_IF
455 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
456 && TRPMHasTrap(pVM)
457 )
458 {
459 uint8_t u8Vector;
460 int rc;
461 TRPMEVENT enmType;
462 SVM_EVENT Event;
463 RTGCUINT u32ErrorCode;
464
465 Event.au64[0] = 0;
466
467 /* If a new event is pending, then dispatch it now. */
468 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &u32ErrorCode, 0);
469 AssertRC(rc);
470 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
471 Assert(enmType != TRPM_SOFTWARE_INT);
472
473 /* Clear the pending trap. */
474 rc = TRPMResetTrap(pVM);
475 AssertRC(rc);
476
477 Event.n.u8Vector = u8Vector;
478 Event.n.u1Valid = 1;
479 Event.n.u32ErrorCode = u32ErrorCode;
480
481 if (enmType == TRPM_TRAP)
482 {
483 switch (u8Vector) {
484 case 8:
485 case 10:
486 case 11:
487 case 12:
488 case 13:
489 case 14:
490 case 17:
491 /* Valid error codes. */
492 Event.n.u1ErrorCodeValid = 1;
493 break;
494 default:
495 break;
496 }
497 if (u8Vector == X86_XCPT_NMI)
498 Event.n.u3Type = SVM_EVENT_NMI;
499 else
500 Event.n.u3Type = SVM_EVENT_EXCEPTION;
501 }
502 else
503 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
504
505 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
506 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
507 } /* if (interrupts can be dispatched) */
508
509 return VINF_SUCCESS;
510}
511
512/**
513 * Save the host state
514 *
515 * @returns VBox status code.
516 * @param pVM The VM to operate on.
517 */
518VMMR0DECL(int) SVMR0SaveHostState(PVM pVM)
519{
520 /* Nothing to do here. */
521 return VINF_SUCCESS;
522}
523
524/**
525 * Loads the guest state
526 *
527 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
528 *
529 * @returns VBox status code.
530 * @param pVM The VM to operate on.
531 * @param pCtx Guest context
532 */
533VMMR0DECL(int) SVMR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
534{
535 RTGCUINTPTR val;
536 SVM_VMCB *pVMCB;
537
538 if (pVM == NULL)
539 return VERR_INVALID_PARAMETER;
540
541 /* Setup AMD SVM. */
542 Assert(pVM->hwaccm.s.svm.fSupported);
543
544 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
545 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
546
547 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
548 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
549 {
550 SVM_WRITE_SELREG(CS, cs);
551 SVM_WRITE_SELREG(SS, ss);
552 SVM_WRITE_SELREG(DS, ds);
553 SVM_WRITE_SELREG(ES, es);
554 SVM_WRITE_SELREG(FS, fs);
555 SVM_WRITE_SELREG(GS, gs);
556 }
557
558 /* Guest CPU context: LDTR. */
559 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
560 {
561 SVM_WRITE_SELREG(LDTR, ldtr);
562 }
563
564 /* Guest CPU context: TR. */
565 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
566 {
567 SVM_WRITE_SELREG(TR, tr);
568 }
569
570 /* Guest CPU context: GDTR. */
571 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
572 {
573 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
574 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
575 }
576
577 /* Guest CPU context: IDTR. */
578 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
579 {
580 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
581 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
582 }
583
584 /*
585 * Sysenter MSRs (unconditional)
586 */
587 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
588 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
589 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
590
591 /* Control registers */
592 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
593 {
594 val = pCtx->cr0;
595 if (!CPUMIsGuestFPUStateActive(pVM))
596 {
597 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
598 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
599 }
600 else
601 {
602 /** @todo check if we support the old style mess correctly. */
603 if (!(val & X86_CR0_NE))
604 {
605 Log(("Forcing X86_CR0_NE!!!\n"));
606
607 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
608 if (!pVM->hwaccm.s.fFPUOldStyleOverride)
609 {
610 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_MF);
611 pVM->hwaccm.s.fFPUOldStyleOverride = true;
612 }
613 }
614 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
615 }
616 /* Always enable caching. */
617 val &= ~(X86_CR0_CD|X86_CR0_NW);
618
619 /* Note: WP is not relevant in nested paging mode as we catch accesses on the (guest) physical level. */
620 /* Note: In nested paging mode the guest is allowed to run with paging disabled; the guest physical to host physical translation will remain active. */
621 if (!pVM->hwaccm.s.fNestedPaging)
622 {
623 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
624 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
625 }
626 pVMCB->guest.u64CR0 = val;
627 }
628 /* CR2 as well */
629 pVMCB->guest.u64CR2 = pCtx->cr2;
630
631 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
632 {
633 /* Save our shadow CR3 register. */
634 if (pVM->hwaccm.s.fNestedPaging)
635 {
636 pVMCB->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVM, PGMGetHostMode(pVM));
637 Assert(pVMCB->ctrl.u64NestedPagingCR3);
638 pVMCB->guest.u64CR3 = pCtx->cr3;
639 }
640 else
641 {
642 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVM);
643 Assert(pVMCB->guest.u64CR3);
644 }
645 }
646
647 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
648 {
649 val = pCtx->cr4;
650 if (!pVM->hwaccm.s.fNestedPaging)
651 {
652 switch(pVM->hwaccm.s.enmShadowMode)
653 {
654 case PGMMODE_REAL:
655 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
656 AssertFailed();
657 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
658
659 case PGMMODE_32_BIT: /* 32-bit paging. */
660 break;
661
662 case PGMMODE_PAE: /* PAE paging. */
663 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
664 /** @todo use normal 32 bits paging */
665 val |= X86_CR4_PAE;
666 break;
667
668 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
669 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
670#ifdef VBOX_ENABLE_64_BITS_GUESTS
671 break;
672#else
673 AssertFailed();
674 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
675#endif
676
677 default: /* shut up gcc */
678 AssertFailed();
679 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
680 }
681 }
682 pVMCB->guest.u64CR4 = val;
683 }
684
685 /* Debug registers. */
686 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
687 {
688 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
689 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
690
691 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
692 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
693 pCtx->dr[7] |= 0x400; /* must be one */
694
695 pVMCB->guest.u64DR7 = pCtx->dr[7];
696 pVMCB->guest.u64DR6 = pCtx->dr[6];
697
698 /* Sync the debug state now if any breakpoint is armed. */
699 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
700 && !CPUMIsGuestDebugStateActive(pVM)
701 && !DBGFIsStepping(pVM))
702 {
703 STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxArmed);
704
705 /* Disable drx move intercepts. */
706 pVMCB->ctrl.u16InterceptRdDRx = 0;
707 pVMCB->ctrl.u16InterceptWrDRx = 0;
708
709 /* Save the host and load the guest debug state. */
710 int rc = CPUMR0LoadGuestDebugState(pVM, pCtx, false /* exclude DR6 */);
711 AssertRC(rc);
712 }
713 }
714
715 /* EIP, ESP and EFLAGS */
716 pVMCB->guest.u64RIP = pCtx->rip;
717 pVMCB->guest.u64RSP = pCtx->rsp;
718 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
719
720 /* Set CPL */
721 pVMCB->guest.u8CPL = pCtx->csHid.Attr.n.u2Dpl;
722
723 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
724 pVMCB->guest.u64RAX = pCtx->rax;
725
726 /* vmrun will fail without MSR_K6_EFER_SVME. */
727 pVMCB->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
728
729 /* 64 bits guest mode? */
730 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
731 {
732#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
733 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
734#else
735 pVM->hwaccm.s.svm.pfnVMRun = SVMVMRun64;
736#endif
737 /* Unconditionally update these as wrmsr might have changed them. (HWACCM_CHANGED_GUEST_SEGMENT_REGS will not be set) */
738 pVMCB->guest.FS.u64Base = pCtx->fsHid.u64Base;
739 pVMCB->guest.GS.u64Base = pCtx->gsHid.u64Base;
740 }
741 else
742 {
743 /* Filter out the MSR_K6_LME bit or else AMD-V expects amd64 shadow paging. */
744 pVMCB->guest.u64EFER &= ~MSR_K6_EFER_LME;
745
746 pVM->hwaccm.s.svm.pfnVMRun = SVMVMRun;
747 }
748
749 /* TSC offset. */
750 if (TMCpuTickCanUseRealTSC(pVM, &pVMCB->ctrl.u64TSCOffset))
751 {
752 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
753 STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCOffset);
754 }
755 else
756 {
757 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
758 STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCIntercept);
759 }
760
761 /* Sync the various msrs for 64 bits mode. */
762 pVMCB->guest.u64STAR = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
763 pVMCB->guest.u64LSTAR = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
764 pVMCB->guest.u64CSTAR = pCtx->msrCSTAR; /* compatibility mode syscall rip */
765 pVMCB->guest.u64SFMASK = pCtx->msrSFMASK; /* syscall flag mask */
766 pVMCB->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
767
768#ifdef DEBUG
769 /* Intercept X86_XCPT_DB if stepping is enabled */
770 if (DBGFIsStepping(pVM))
771 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_DB);
772 else
773 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_DB);
774#endif
775
776 /* Done. */
777 pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
778
779 return VINF_SUCCESS;
780}
781
782
783/**
784 * Runs guest code in an SVM VM.
785 *
786 * @todo This can be much more efficient, when we only sync that which has actually changed. (this is the first attempt only)
787 *
788 * @returns VBox status code.
789 * @param pVM The VM to operate on.
790 * @param pCtx Guest context
791 */
792VMMR0DECL(int) SVMR0RunGuestCode(PVM pVM, CPUMCTX *pCtx)
793{
794 int rc = VINF_SUCCESS;
795 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
796 SVM_VMCB *pVMCB;
797 bool fSyncTPR = false;
798 unsigned cResume = 0;
799 uint8_t u8LastVTPR;
800 PHWACCM_CPUINFO pCpu = 0;
801#ifdef VBOX_STRICT
802 RTCPUID idCpuCheck;
803#endif
804
805 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
806
807 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
808 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
809
810 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
811 */
812ResumeExecution:
813 /* Safety precaution; looping for too long here can have a very bad effect on the host */
814 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
815 {
816 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
817 rc = VINF_EM_RAW_INTERRUPT;
818 goto end;
819 }
820
821 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
822 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
823 {
824 Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
825 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
826 {
827 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
828 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
829 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
830 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
831 */
832 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
833 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
834 pVMCB->ctrl.u64IntShadow = 0;
835 }
836 }
837 else
838 {
839 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
840 pVMCB->ctrl.u64IntShadow = 0;
841 }
842
843 /* Check for pending actions that force us to go back to ring 3. */
844#ifdef DEBUG
845 /* Intercept X86_XCPT_DB if stepping is enabled */
846 if (!DBGFIsStepping(pVM))
847#endif
848 {
849 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
850 {
851 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
852 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
853 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
854 rc = VINF_EM_RAW_TO_R3;
855 goto end;
856 }
857 }
858
859 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
860 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
861 {
862 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
863 rc = VINF_EM_PENDING_REQUEST;
864 goto end;
865 }
866
867 /* When external interrupts are pending, we should exit the VM when IF is set. */
868 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
869 rc = SVMR0CheckPendingInterrupt(pVM, pVMCB, pCtx);
870 if (VBOX_FAILURE(rc))
871 {
872 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
873 goto end;
874 }
875
876 /* TPR caching using CR8 is only available in 64 bits mode */
877 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
878 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!!!!! */
879 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
880 {
881 bool fPending;
882
883 /* TPR caching in CR8 */
884 int rc = PDMApicGetTPR(pVM, &u8LastVTPR, &fPending);
885 AssertRC(rc);
886 pVMCB->ctrl.IntCtrl.n.u8VTPR = u8LastVTPR;
887
888 if (fPending)
889 {
890 /* A TPR change could activate a pending interrupt, so catch cr8 writes. */
891 pVMCB->ctrl.u16InterceptWrCRx |= RT_BIT(8);
892 }
893 else
894 /* No interrupts are pending, so we don't need to be explicitely notified.
895 * There are enough world switches for detecting pending interrupts.
896 */
897 pVMCB->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
898
899 fSyncTPR = !fPending;
900 }
901
902 /* All done! Let's start VM execution. */
903 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
904
905 /* Enable nested paging if necessary (disabled each time after #VMEXIT). */
906 pVMCB->ctrl.NestedPaging.n.u1NestedPaging = pVM->hwaccm.s.fNestedPaging;
907
908#ifdef LOG_ENABLED
909 pCpu = HWACCMR0GetCurrentCpu();
910 if ( pVM->hwaccm.s.idLastCpu != pCpu->idCpu
911 || pVM->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
912 {
913 if (pVM->hwaccm.s.idLastCpu != pCpu->idCpu)
914 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVM->hwaccm.s.idLastCpu, pCpu->idCpu));
915 else
916 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVM->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
917 }
918 if (pCpu->fFlushTLB)
919 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
920#endif
921
922 /*
923 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
924 * (until the actual world switch)
925 */
926
927#ifdef VBOX_STRICT
928 idCpuCheck = RTMpCpuId();
929#endif
930
931 /* Load the guest state; *must* be here as it sets up the shadow cr0 for lazy fpu syncing! */
932 rc = SVMR0LoadGuestState(pVM, pCtx);
933 if (rc != VINF_SUCCESS)
934 {
935 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
936 goto end;
937 }
938
939 pCpu = HWACCMR0GetCurrentCpu();
940 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
941 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
942 if ( pVM->hwaccm.s.idLastCpu != pCpu->idCpu
943 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
944 || pVM->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
945 {
946 /* Force a TLB flush on VM entry. */
947 pVM->hwaccm.s.fForceTLBFlush = true;
948 }
949 else
950 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
951
952 pVM->hwaccm.s.idLastCpu = pCpu->idCpu;
953
954 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
955 if ( pVM->hwaccm.s.fForceTLBFlush
956 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
957 {
958 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
959 || pCpu->fFlushTLB)
960 {
961 pCpu->fFlushTLB = false;
962 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
963 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
964 pCpu->cTLBFlushes++;
965 }
966 else
967 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushASID);
968
969 pVM->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
970 pVM->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
971 }
972 else
973 {
974 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
975
976 /* We never increase uCurrentASID in the fAlwaysFlushTLB (erratum 170) case. */
977 if (!pCpu->uCurrentASID || !pVM->hwaccm.s.uCurrentASID)
978 pVM->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
979
980 Assert(!pVM->hwaccm.s.svm.fAlwaysFlushTLB || pVM->hwaccm.s.fForceTLBFlush);
981 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVM->hwaccm.s.fForceTLBFlush;
982 }
983 AssertMsg(pVM->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVM->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
984 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
985 AssertMsg(pVM->hwaccm.s.uCurrentASID >= 1 && pVM->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVM->hwaccm.s.uCurrentASID));
986 pVMCB->ctrl.TLBCtrl.n.u32ASID = pVM->hwaccm.s.uCurrentASID;
987
988#ifdef VBOX_WITH_STATISTICS
989 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
990 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBWorldSwitch);
991 else
992 STAM_COUNTER_INC(&pVM->hwaccm.s.StatNoFlushTLBWorldSwitch);
993#endif
994
995 /* In case we execute a goto ResumeExecution later on. */
996 pVM->hwaccm.s.svm.fResumeVM = true;
997 pVM->hwaccm.s.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
998
999 Assert(sizeof(pVM->hwaccm.s.svm.pVMCBPhys) == 8);
1000 Assert(pVMCB->ctrl.u32InterceptCtrl2 == ( SVM_CTRL2_INTERCEPT_VMRUN /* required */
1001 | SVM_CTRL2_INTERCEPT_VMMCALL
1002 | SVM_CTRL2_INTERCEPT_VMLOAD
1003 | SVM_CTRL2_INTERCEPT_VMSAVE
1004 | SVM_CTRL2_INTERCEPT_STGI
1005 | SVM_CTRL2_INTERCEPT_CLGI
1006 | SVM_CTRL2_INTERCEPT_SKINIT
1007 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
1008 | SVM_CTRL2_INTERCEPT_WBINVD
1009 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
1010 ));
1011 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
1012 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
1013 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
1014 Assert(pVMCB->ctrl.u64LBRVirt == 0);
1015
1016#ifdef VBOX_STRICT
1017 Assert(idCpuCheck == RTMpCpuId());
1018#endif
1019 TMNotifyStartOfExecution(pVM);
1020 pVM->hwaccm.s.svm.pfnVMRun(pVM->hwaccm.s.svm.pVMCBHostPhys, pVM->hwaccm.s.svm.pVMCBPhys, pCtx);
1021 TMNotifyEndOfExecution(pVM);
1022 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
1023
1024 /*
1025 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1026 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1027 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1028 */
1029
1030 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
1031
1032 /* Reason for the VM exit */
1033 exitCode = pVMCB->ctrl.u64ExitCode;
1034
1035 if (exitCode == (uint64_t)SVM_EXIT_INVALID) /* Invalid guest state. */
1036 {
1037 HWACCMDumpRegs(pVM, pCtx);
1038#ifdef DEBUG
1039 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
1040 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
1041 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
1042 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
1043 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
1044 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
1045 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
1046 Log(("ctrl.u64IOPMPhysAddr %VX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
1047 Log(("ctrl.u64MSRPMPhysAddr %VX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
1048 Log(("ctrl.u64TSCOffset %VX64\n", pVMCB->ctrl.u64TSCOffset));
1049
1050 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
1051 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
1052 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
1053 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
1054
1055 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
1056 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
1057 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
1058 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
1059 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
1060 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
1061 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
1062 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
1063 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
1064 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
1065
1066 Log(("ctrl.u64IntShadow %VX64\n", pVMCB->ctrl.u64IntShadow));
1067 Log(("ctrl.u64ExitCode %VX64\n", pVMCB->ctrl.u64ExitCode));
1068 Log(("ctrl.u64ExitInfo1 %VX64\n", pVMCB->ctrl.u64ExitInfo1));
1069 Log(("ctrl.u64ExitInfo2 %VX64\n", pVMCB->ctrl.u64ExitInfo2));
1070 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
1071 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
1072 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
1073 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
1074 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
1075 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
1076 Log(("ctrl.NestedPaging %VX64\n", pVMCB->ctrl.NestedPaging.au64));
1077 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
1078 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
1079 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
1080 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
1081 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
1082 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
1083
1084 Log(("ctrl.u64NestedPagingCR3 %VX64\n", pVMCB->ctrl.u64NestedPagingCR3));
1085 Log(("ctrl.u64LBRVirt %VX64\n", pVMCB->ctrl.u64LBRVirt));
1086
1087 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
1088 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
1089 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
1090 Log(("guest.CS.u64Base %VX64\n", pVMCB->guest.CS.u64Base));
1091 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
1092 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
1093 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
1094 Log(("guest.DS.u64Base %VX64\n", pVMCB->guest.DS.u64Base));
1095 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
1096 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
1097 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
1098 Log(("guest.ES.u64Base %VX64\n", pVMCB->guest.ES.u64Base));
1099 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
1100 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
1101 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
1102 Log(("guest.FS.u64Base %VX64\n", pVMCB->guest.FS.u64Base));
1103 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
1104 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
1105 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
1106 Log(("guest.GS.u64Base %VX64\n", pVMCB->guest.GS.u64Base));
1107
1108 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
1109 Log(("guest.GDTR.u64Base %VX64\n", pVMCB->guest.GDTR.u64Base));
1110
1111 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
1112 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
1113 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
1114 Log(("guest.LDTR.u64Base %VX64\n", pVMCB->guest.LDTR.u64Base));
1115
1116 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
1117 Log(("guest.IDTR.u64Base %VX64\n", pVMCB->guest.IDTR.u64Base));
1118
1119 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
1120 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
1121 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
1122 Log(("guest.TR.u64Base %VX64\n", pVMCB->guest.TR.u64Base));
1123
1124 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
1125 Log(("guest.u64CR0 %VX64\n", pVMCB->guest.u64CR0));
1126 Log(("guest.u64CR2 %VX64\n", pVMCB->guest.u64CR2));
1127 Log(("guest.u64CR3 %VX64\n", pVMCB->guest.u64CR3));
1128 Log(("guest.u64CR4 %VX64\n", pVMCB->guest.u64CR4));
1129 Log(("guest.u64DR6 %VX64\n", pVMCB->guest.u64DR6));
1130 Log(("guest.u64DR7 %VX64\n", pVMCB->guest.u64DR7));
1131
1132 Log(("guest.u64RIP %VX64\n", pVMCB->guest.u64RIP));
1133 Log(("guest.u64RSP %VX64\n", pVMCB->guest.u64RSP));
1134 Log(("guest.u64RAX %VX64\n", pVMCB->guest.u64RAX));
1135 Log(("guest.u64RFlags %VX64\n", pVMCB->guest.u64RFlags));
1136
1137 Log(("guest.u64SysEnterCS %VX64\n", pVMCB->guest.u64SysEnterCS));
1138 Log(("guest.u64SysEnterEIP %VX64\n", pVMCB->guest.u64SysEnterEIP));
1139 Log(("guest.u64SysEnterESP %VX64\n", pVMCB->guest.u64SysEnterESP));
1140
1141 Log(("guest.u64EFER %VX64\n", pVMCB->guest.u64EFER));
1142 Log(("guest.u64STAR %VX64\n", pVMCB->guest.u64STAR));
1143 Log(("guest.u64LSTAR %VX64\n", pVMCB->guest.u64LSTAR));
1144 Log(("guest.u64CSTAR %VX64\n", pVMCB->guest.u64CSTAR));
1145 Log(("guest.u64SFMASK %VX64\n", pVMCB->guest.u64SFMASK));
1146 Log(("guest.u64KernelGSBase %VX64\n", pVMCB->guest.u64KernelGSBase));
1147 Log(("guest.u64GPAT %VX64\n", pVMCB->guest.u64GPAT));
1148 Log(("guest.u64DBGCTL %VX64\n", pVMCB->guest.u64DBGCTL));
1149 Log(("guest.u64BR_FROM %VX64\n", pVMCB->guest.u64BR_FROM));
1150 Log(("guest.u64BR_TO %VX64\n", pVMCB->guest.u64BR_TO));
1151 Log(("guest.u64LASTEXCPFROM %VX64\n", pVMCB->guest.u64LASTEXCPFROM));
1152 Log(("guest.u64LASTEXCPTO %VX64\n", pVMCB->guest.u64LASTEXCPTO));
1153
1154#endif
1155 rc = VERR_SVM_UNABLE_TO_START_VM;
1156 goto end;
1157 }
1158
1159 /* Let's first sync back eip, esp, and eflags. */
1160 pCtx->rip = pVMCB->guest.u64RIP;
1161 pCtx->rsp = pVMCB->guest.u64RSP;
1162 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
1163 /* eax is saved/restore across the vmrun instruction */
1164 pCtx->rax = pVMCB->guest.u64RAX;
1165
1166 pCtx->msrKERNELGSBASE = pVMCB->guest.u64KernelGSBase; /* swapgs exchange value */
1167
1168 /* Can be updated behind our back in the nested paging case. */
1169 pCtx->cr2 = pVMCB->guest.u64CR2;
1170
1171 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1172 SVM_READ_SELREG(SS, ss);
1173 SVM_READ_SELREG(CS, cs);
1174 SVM_READ_SELREG(DS, ds);
1175 SVM_READ_SELREG(ES, es);
1176 SVM_READ_SELREG(FS, fs);
1177 SVM_READ_SELREG(GS, gs);
1178
1179 /*
1180 * System MSRs
1181 */
1182 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1183 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1184 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1185
1186 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1187 SVM_READ_SELREG(LDTR, ldtr);
1188 SVM_READ_SELREG(TR, tr);
1189
1190 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1191 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1192
1193 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1194 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1195
1196 /* Note: no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
1197 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1198 if ( pVM->hwaccm.s.fNestedPaging
1199 && pCtx->cr3 != pVMCB->guest.u64CR3)
1200 {
1201 CPUMSetGuestCR3(pVM, pVMCB->guest.u64CR3);
1202 PGMUpdateCR3(pVM, pVMCB->guest.u64CR3);
1203 }
1204
1205 /* Note! NOW IT'S SAFE FOR LOGGING! */
1206
1207 /* Take care of instruction fusing (sti, mov ss) (see 15.20.5 Interrupt Shadows) */
1208 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
1209 {
1210 Log(("uInterruptState %x eip=%VGv\n", pVMCB->ctrl.u64IntShadow, pCtx->rip));
1211 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1212 }
1213 else
1214 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1215
1216 Log2(("exitCode = %x\n", exitCode));
1217
1218 /* Sync back DR6 as it could have been changed by hitting breakpoints. */
1219 pCtx->dr[6] = pVMCB->guest.u64DR6;
1220 /* DR7.GD can be cleared by debug exceptions, so sync it back as well. */
1221 pCtx->dr[7] = pVMCB->guest.u64DR7;
1222
1223 /* Check if an injected event was interrupted prematurely. */
1224 pVM->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1225 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1226 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1227 {
1228 Log(("Pending inject %VX64 at %VGv exit=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitCode));
1229
1230#ifdef LOG_ENABLED
1231 SVM_EVENT Event;
1232 Event.au64[0] = pVM->hwaccm.s.Event.intInfo;
1233
1234 if ( exitCode == SVM_EXIT_EXCEPTION_E
1235 && Event.n.u8Vector == 0xE)
1236 {
1237 Log(("Double fault!\n"));
1238 }
1239#endif
1240
1241 pVM->hwaccm.s.Event.fPending = true;
1242 /* Error code present? (redundant) */
1243 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1244 {
1245 pVM->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1246 }
1247 else
1248 pVM->hwaccm.s.Event.errCode = 0;
1249 }
1250#ifdef VBOX_WITH_STATISTICS
1251 if (exitCode == SVM_EXIT_NPF)
1252 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitReasonNPF);
1253 else
1254 STAM_COUNTER_INC(&pVM->hwaccm.s.paStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1255#endif
1256
1257 if (fSyncTPR)
1258 {
1259 rc = PDMApicSetTPR(pVM, pVMCB->ctrl.IntCtrl.n.u8VTPR);
1260 AssertRC(rc);
1261 }
1262
1263 /* Deal with the reason of the VM-exit. */
1264 switch (exitCode)
1265 {
1266 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1267 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1268 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1269 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1270 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1271 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1272 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1273 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1274 {
1275 /* Pending trap. */
1276 SVM_EVENT Event;
1277 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1278
1279 Log2(("Hardware/software interrupt %d\n", vector));
1280 switch (vector)
1281 {
1282 case X86_XCPT_DB:
1283 {
1284 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDB);
1285
1286 /* Note that we don't support guest and host-initiated debugging at the same time. */
1287 Assert(DBGFIsStepping(pVM));
1288
1289 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), pCtx->dr[6]);
1290 if (rc == VINF_EM_RAW_GUEST_TRAP)
1291 {
1292 Log(("Trap %x (debug) at %VGv\n", vector, pCtx->rip));
1293
1294 /* Reinject the exception. */
1295 Event.au64[0] = 0;
1296 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1297 Event.n.u1Valid = 1;
1298 Event.n.u8Vector = X86_XCPT_DB;
1299
1300 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1301
1302 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1303 goto ResumeExecution;
1304 }
1305 /* Return to ring 3 to deal with the debug exit code. */
1306 break;
1307 }
1308
1309 case X86_XCPT_NM:
1310 {
1311 Log(("#NM fault at %VGv\n", pCtx->rip));
1312
1313 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1314 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1315 rc = CPUMR0LoadGuestFPU(pVM, pCtx);
1316 if (rc == VINF_SUCCESS)
1317 {
1318 Assert(CPUMIsGuestFPUStateActive(pVM));
1319 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1320
1321 /* Continue execution. */
1322 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1323 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1324
1325 goto ResumeExecution;
1326 }
1327
1328 Log(("Forward #NM fault to the guest\n"));
1329 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1330
1331 Event.au64[0] = 0;
1332 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1333 Event.n.u1Valid = 1;
1334 Event.n.u8Vector = X86_XCPT_NM;
1335
1336 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1337 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1338 goto ResumeExecution;
1339 }
1340
1341 case X86_XCPT_PF: /* Page fault */
1342 {
1343 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1344 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1345
1346#ifdef DEBUG
1347 if (pVM->hwaccm.s.fNestedPaging)
1348 { /* A genuine pagefault.
1349 * Forward the trap to the guest by injecting the exception and resuming execution.
1350 */
1351 Log(("Guest page fault at %VGv cr2=%VGv error code %x rsp=%VGv\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
1352 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1353
1354 /* Now we must update CR2. */
1355 pCtx->cr2 = uFaultAddress;
1356
1357 Event.au64[0] = 0;
1358 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1359 Event.n.u1Valid = 1;
1360 Event.n.u8Vector = X86_XCPT_PF;
1361 Event.n.u1ErrorCodeValid = 1;
1362 Event.n.u32ErrorCode = errCode;
1363
1364 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1365
1366 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1367 goto ResumeExecution;
1368 }
1369#endif
1370 Assert(!pVM->hwaccm.s.fNestedPaging);
1371
1372 Log2(("Page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, uFaultAddress, errCode));
1373 /* Exit qualification contains the linear address of the page fault. */
1374 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1375 TRPMSetErrorCode(pVM, errCode);
1376 TRPMSetFaultAddress(pVM, uFaultAddress);
1377
1378 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1379 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1380 Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->rip, rc));
1381 if (rc == VINF_SUCCESS)
1382 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1383 Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, uFaultAddress, errCode));
1384 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1385
1386 TRPMResetTrap(pVM);
1387
1388 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1389 goto ResumeExecution;
1390 }
1391 else
1392 if (rc == VINF_EM_RAW_GUEST_TRAP)
1393 { /* A genuine pagefault.
1394 * Forward the trap to the guest by injecting the exception and resuming execution.
1395 */
1396 Log2(("Forward page fault to the guest\n"));
1397 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1398 /* The error code might have been changed. */
1399 errCode = TRPMGetErrorCode(pVM);
1400
1401 TRPMResetTrap(pVM);
1402
1403 /* Now we must update CR2. */
1404 pCtx->cr2 = uFaultAddress;
1405
1406 Event.au64[0] = 0;
1407 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1408 Event.n.u1Valid = 1;
1409 Event.n.u8Vector = X86_XCPT_PF;
1410 Event.n.u1ErrorCodeValid = 1;
1411 Event.n.u32ErrorCode = errCode;
1412
1413 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1414
1415 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1416 goto ResumeExecution;
1417 }
1418#ifdef VBOX_STRICT
1419 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1420 LogFlow(("PGMTrap0eHandler failed with %d\n", rc));
1421#endif
1422 /* Need to go back to the recompiler to emulate the instruction. */
1423 TRPMResetTrap(pVM);
1424 break;
1425 }
1426
1427 case X86_XCPT_MF: /* Floating point exception. */
1428 {
1429 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1430 if (!(pCtx->cr0 & X86_CR0_NE))
1431 {
1432 /* old style FPU error reporting needs some extra work. */
1433 /** @todo don't fall back to the recompiler, but do it manually. */
1434 rc = VINF_EM_RAW_EMULATE_INSTR;
1435 break;
1436 }
1437 Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1438
1439 Event.au64[0] = 0;
1440 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1441 Event.n.u1Valid = 1;
1442 Event.n.u8Vector = X86_XCPT_MF;
1443
1444 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1445
1446 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1447 goto ResumeExecution;
1448 }
1449
1450#ifdef VBOX_STRICT
1451 case X86_XCPT_GP: /* General protection failure exception.*/
1452 case X86_XCPT_UD: /* Unknown opcode exception. */
1453 case X86_XCPT_DE: /* Divide error. */
1454 case X86_XCPT_SS: /* Stack segment exception. */
1455 case X86_XCPT_NP: /* Segment not present exception. */
1456 {
1457 Event.au64[0] = 0;
1458 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1459 Event.n.u1Valid = 1;
1460 Event.n.u8Vector = vector;
1461
1462 switch(vector)
1463 {
1464 case X86_XCPT_GP:
1465 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1466 Event.n.u1ErrorCodeValid = 1;
1467 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1468 break;
1469 case X86_XCPT_DE:
1470 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
1471 break;
1472 case X86_XCPT_UD:
1473 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
1474 break;
1475 case X86_XCPT_SS:
1476 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
1477 Event.n.u1ErrorCodeValid = 1;
1478 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1479 break;
1480 case X86_XCPT_NP:
1481 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
1482 Event.n.u1ErrorCodeValid = 1;
1483 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1484 break;
1485 }
1486 Log(("Trap %x at %VGv esi=%x\n", vector, pCtx->rip, pCtx->esi));
1487 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1488
1489 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1490 goto ResumeExecution;
1491 }
1492#endif
1493 default:
1494 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1495 rc = VERR_EM_INTERNAL_ERROR;
1496 break;
1497
1498 } /* switch (vector) */
1499 break;
1500 }
1501
1502 case SVM_EXIT_NPF:
1503 {
1504 /* EXITINFO1 contains fault errorcode; EXITINFO2 contains the guest physical address causing the fault. */
1505 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1506 RTGCPHYS uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1507
1508 Assert(pVM->hwaccm.s.fNestedPaging);
1509 Log(("Nested page fault at %VGv cr2=%VGp error code %x\n", pCtx->rip, uFaultAddress, errCode));
1510 /* Exit qualification contains the linear address of the page fault. */
1511 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1512 TRPMSetErrorCode(pVM, errCode);
1513 TRPMSetFaultAddress(pVM, uFaultAddress);
1514
1515 /* Handle the pagefault trap for the nested shadow table. */
1516 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMGetHostMode(pVM), errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1517 Log2(("PGMR0Trap0eHandlerNestedPaging %VGv returned %Vrc\n", pCtx->rip, rc));
1518 if (rc == VINF_SUCCESS)
1519 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1520 Log2(("Shadow page fault at %VGv cr2=%VGp error code %x\n", pCtx->rip, uFaultAddress, errCode));
1521 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1522
1523 TRPMResetTrap(pVM);
1524
1525 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1526 goto ResumeExecution;
1527 }
1528
1529#ifdef VBOX_STRICT
1530 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1531 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
1532#endif
1533 /* Need to go back to the recompiler to emulate the instruction. */
1534 TRPMResetTrap(pVM);
1535 break;
1536 }
1537
1538 case SVM_EXIT_VINTR:
1539 /* A virtual interrupt is about to be delivered, which means IF=1. */
1540 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1541 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1542 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1543 goto ResumeExecution;
1544
1545 case SVM_EXIT_FERR_FREEZE:
1546 case SVM_EXIT_INTR:
1547 case SVM_EXIT_NMI:
1548 case SVM_EXIT_SMI:
1549 case SVM_EXIT_INIT:
1550 /* External interrupt; leave to allow it to be dispatched again. */
1551 rc = VINF_EM_RAW_INTERRUPT;
1552 break;
1553
1554 case SVM_EXIT_WBINVD:
1555 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1556 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
1557 /* Skip instruction and continue directly. */
1558 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1559 /* Continue execution.*/
1560 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1561 goto ResumeExecution;
1562
1563 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1564 {
1565 Log2(("SVM: Cpuid at %VGv for %x\n", pCtx->rip, pCtx->eax));
1566 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
1567 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
1568 if (rc == VINF_SUCCESS)
1569 {
1570 /* Update EIP and continue execution. */
1571 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1572 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1573 goto ResumeExecution;
1574 }
1575 AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
1576 rc = VINF_EM_RAW_EMULATE_INSTR;
1577 break;
1578 }
1579
1580 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1581 {
1582 Log2(("SVM: Rdtsc\n"));
1583 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
1584 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
1585 if (rc == VINF_SUCCESS)
1586 {
1587 /* Update EIP and continue execution. */
1588 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1589 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1590 goto ResumeExecution;
1591 }
1592 AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
1593 rc = VINF_EM_RAW_EMULATE_INSTR;
1594 break;
1595 }
1596
1597 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1598 {
1599 Log2(("SVM: invlpg\n"));
1600 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
1601
1602 Assert(!pVM->hwaccm.s.fNestedPaging);
1603
1604 /* Truly a pita. Why can't SVM give the same information as VT-x? */
1605 rc = SVMR0InterpretInvpg(pVM, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1606 if (rc == VINF_SUCCESS)
1607 {
1608 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageInvlpg);
1609 goto ResumeExecution; /* eip already updated */
1610 }
1611 break;
1612 }
1613
1614 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1615 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1616 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1617 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1618 {
1619 uint32_t cbSize;
1620
1621 Log2(("SVM: %VGv mov cr%d, \n", pCtx->rip, exitCode - SVM_EXIT_WRITE_CR0));
1622 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
1623 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1624
1625 switch (exitCode - SVM_EXIT_WRITE_CR0)
1626 {
1627 case 0:
1628 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1629 break;
1630 case 2:
1631 break;
1632 case 3:
1633 Assert(!pVM->hwaccm.s.fNestedPaging);
1634 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1635 break;
1636 case 4:
1637 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1638 break;
1639 case 8:
1640 break;
1641 default:
1642 AssertFailed();
1643 }
1644 /* Check if a sync operation is pending. */
1645 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1646 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
1647 {
1648 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
1649 AssertRC(rc);
1650
1651 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBCRxChange);
1652
1653 /* Must be set by PGMSyncCR3 */
1654 Assert(PGMGetGuestMode(pVM) <= PGMMODE_PROTECTED || pVM->hwaccm.s.fForceTLBFlush);
1655 }
1656 if (rc == VINF_SUCCESS)
1657 {
1658 /* EIP has been updated already. */
1659
1660 /* Only resume if successful. */
1661 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1662 goto ResumeExecution;
1663 }
1664 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1665 break;
1666 }
1667
1668 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
1669 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
1670 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
1671 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
1672 {
1673 uint32_t cbSize;
1674
1675 Log2(("SVM: %VGv mov x, cr%d\n", pCtx->rip, exitCode - SVM_EXIT_READ_CR0));
1676 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
1677 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1678 if (rc == VINF_SUCCESS)
1679 {
1680 /* EIP has been updated already. */
1681
1682 /* Only resume if successful. */
1683 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1684 goto ResumeExecution;
1685 }
1686 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1687 break;
1688 }
1689
1690 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
1691 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
1692 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
1693 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
1694 {
1695 uint32_t cbSize;
1696
1697 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->rip, exitCode - SVM_EXIT_WRITE_DR0));
1698 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1699
1700 if (!DBGFIsStepping(pVM))
1701 {
1702 STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxContextSwitch);
1703
1704 /* Disable drx move intercepts. */
1705 pVMCB->ctrl.u16InterceptRdDRx = 0;
1706 pVMCB->ctrl.u16InterceptWrDRx = 0;
1707
1708 /* Save the host and load the guest debug state. */
1709 rc = CPUMR0LoadGuestDebugState(pVM, pCtx, false /* exclude DR6 */);
1710 AssertRC(rc);
1711
1712 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1713 goto ResumeExecution;
1714 }
1715
1716 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1717 if (rc == VINF_SUCCESS)
1718 {
1719 /* EIP has been updated already. */
1720 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
1721
1722 /* Only resume if successful. */
1723 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1724 goto ResumeExecution;
1725 }
1726 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1727 break;
1728 }
1729
1730 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
1731 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
1732 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
1733 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
1734 {
1735 uint32_t cbSize;
1736
1737 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->rip, exitCode - SVM_EXIT_READ_DR0));
1738 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1739
1740 if (!DBGFIsStepping(pVM))
1741 {
1742 STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxContextSwitch);
1743
1744 /* Disable drx move intercepts. */
1745 pVMCB->ctrl.u16InterceptRdDRx = 0;
1746 pVMCB->ctrl.u16InterceptWrDRx = 0;
1747
1748 /* Save the host and load the guest debug state. */
1749 rc = CPUMR0LoadGuestDebugState(pVM, pCtx, false /* exclude DR6 */);
1750 AssertRC(rc);
1751
1752 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1753 goto ResumeExecution;
1754 }
1755
1756 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1757 if (rc == VINF_SUCCESS)
1758 {
1759 /* EIP has been updated already. */
1760
1761 /* Only resume if successful. */
1762 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1763 goto ResumeExecution;
1764 }
1765 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1766 break;
1767 }
1768
1769 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
1770 case SVM_EXIT_IOIO: /* I/O instruction. */
1771 {
1772 SVM_IOIO_EXIT IoExitInfo;
1773 uint32_t uIOSize, uAndVal;
1774
1775 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
1776
1777 /** @todo could use a lookup table here */
1778 if (IoExitInfo.n.u1OP8)
1779 {
1780 uIOSize = 1;
1781 uAndVal = 0xff;
1782 }
1783 else
1784 if (IoExitInfo.n.u1OP16)
1785 {
1786 uIOSize = 2;
1787 uAndVal = 0xffff;
1788 }
1789 else
1790 if (IoExitInfo.n.u1OP32)
1791 {
1792 uIOSize = 4;
1793 uAndVal = 0xffffffff;
1794 }
1795 else
1796 {
1797 AssertFailed(); /* should be fatal. */
1798 rc = VINF_EM_RAW_EMULATE_INSTR;
1799 break;
1800 }
1801
1802 if (IoExitInfo.n.u1STR)
1803 {
1804 /* ins/outs */
1805 uint32_t prefix = 0;
1806 if (IoExitInfo.n.u1REP)
1807 prefix |= PREFIX_REP;
1808
1809 if (IoExitInfo.n.u1Type == 0)
1810 {
1811 Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1812 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
1813 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1814 }
1815 else
1816 {
1817 Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1818 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
1819 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1820 }
1821 }
1822 else
1823 {
1824 /* normal in/out */
1825 Assert(!IoExitInfo.n.u1REP);
1826
1827 if (IoExitInfo.n.u1Type == 0)
1828 {
1829 Log2(("IOMIOPortWrite %VGv %x %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
1830 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
1831 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
1832 }
1833 else
1834 {
1835 uint32_t u32Val = 0;
1836
1837 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
1838 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
1839 if (IOM_SUCCESS(rc))
1840 {
1841 /* Write back to the EAX register. */
1842 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
1843 Log2(("IOMIOPortRead %VGv %x %x size=%d\n", pCtx->rip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
1844 }
1845 }
1846 }
1847 /*
1848 * Handled the I/O return codes.
1849 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
1850 */
1851 if (IOM_SUCCESS(rc))
1852 {
1853 /* Update EIP and continue execution. */
1854 pCtx->rip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
1855 if (RT_LIKELY(rc == VINF_SUCCESS))
1856 {
1857 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
1858 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
1859 {
1860 STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxIOCheck);
1861 for (unsigned i=0;i<4;i++)
1862 {
1863 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
1864
1865 if ( (IoExitInfo.n.u16Port >= pCtx->dr[i] && IoExitInfo.n.u16Port < pCtx->dr[i] + uBPLen)
1866 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
1867 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
1868 {
1869 SVM_EVENT Event;
1870
1871 Assert(CPUMIsGuestDebugStateActive(pVM));
1872
1873 /* Clear all breakpoint status flags and set the one we just hit. */
1874 pCtx->dr[6] &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
1875 pCtx->dr[6] |= (uint64_t)RT_BIT(i);
1876
1877 /* Note: AMD64 Architecture Programmer's Manual 13.1:
1878 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
1879 * the contents have been read.
1880 */
1881 pVMCB->guest.u64DR6 = pCtx->dr[6];
1882
1883 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
1884 pCtx->dr[7] &= ~X86_DR7_GD;
1885
1886 /* Paranoia. */
1887 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1888 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1889 pCtx->dr[7] |= 0x400; /* must be one */
1890
1891 pVMCB->guest.u64DR7 = pCtx->dr[7];
1892
1893 /* Inject the exception. */
1894 Log(("Inject IO debug trap at %VGv\n", pCtx->rip));
1895
1896 Event.au64[0] = 0;
1897 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1898 Event.n.u1Valid = 1;
1899 Event.n.u8Vector = X86_XCPT_DB;
1900
1901 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1902
1903 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1904 goto ResumeExecution;
1905 }
1906 }
1907 }
1908
1909 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1910 goto ResumeExecution;
1911 }
1912 Log2(("EM status from IO at %VGv %x size %d: %Vrc\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize, rc));
1913 break;
1914 }
1915
1916#ifdef VBOX_STRICT
1917 if (rc == VINF_IOM_HC_IOPORT_READ)
1918 Assert(IoExitInfo.n.u1Type != 0);
1919 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
1920 Assert(IoExitInfo.n.u1Type == 0);
1921 else
1922 AssertMsg(VBOX_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
1923#endif
1924 Log2(("Failed IO at %VGv %x size %d\n", pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
1925 break;
1926 }
1927
1928 case SVM_EXIT_HLT:
1929 /** Check if external interrupts are pending; if so, don't switch back. */
1930 pCtx->rip++; /* skip hlt */
1931 if ( pCtx->eflags.Bits.u1IF
1932 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
1933 goto ResumeExecution;
1934
1935 rc = VINF_EM_HALT;
1936 break;
1937
1938 case SVM_EXIT_RSM:
1939 case SVM_EXIT_INVLPGA:
1940 case SVM_EXIT_VMRUN:
1941 case SVM_EXIT_VMMCALL:
1942 case SVM_EXIT_VMLOAD:
1943 case SVM_EXIT_VMSAVE:
1944 case SVM_EXIT_STGI:
1945 case SVM_EXIT_CLGI:
1946 case SVM_EXIT_SKINIT:
1947 case SVM_EXIT_RDTSCP:
1948 {
1949 /* Unsupported instructions. */
1950 SVM_EVENT Event;
1951
1952 Event.au64[0] = 0;
1953 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1954 Event.n.u1Valid = 1;
1955 Event.n.u8Vector = X86_XCPT_UD;
1956
1957 Log(("Forced #UD trap at %VGv\n", pCtx->rip));
1958 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1959
1960 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1961 goto ResumeExecution;
1962 }
1963
1964 /* Emulate in ring 3. */
1965 case SVM_EXIT_MSR:
1966 {
1967 uint32_t cbSize;
1968
1969 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
1970 Log(("SVM: %s\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr"));
1971 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1972 if (rc == VINF_SUCCESS)
1973 {
1974 /* EIP has been updated already. */
1975
1976 /* Only resume if successful. */
1977 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1978 goto ResumeExecution;
1979 }
1980 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Vrc\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr", rc));
1981 break;
1982 }
1983
1984 case SVM_EXIT_MONITOR:
1985 case SVM_EXIT_RDPMC:
1986 case SVM_EXIT_PAUSE:
1987 case SVM_EXIT_MWAIT_UNCOND:
1988 case SVM_EXIT_MWAIT_ARMED:
1989 case SVM_EXIT_TASK_SWITCH: /* can change CR3; emulate */
1990 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
1991 break;
1992
1993 case SVM_EXIT_SHUTDOWN:
1994 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
1995 break;
1996
1997 case SVM_EXIT_IDTR_READ:
1998 case SVM_EXIT_GDTR_READ:
1999 case SVM_EXIT_LDTR_READ:
2000 case SVM_EXIT_TR_READ:
2001 case SVM_EXIT_IDTR_WRITE:
2002 case SVM_EXIT_GDTR_WRITE:
2003 case SVM_EXIT_LDTR_WRITE:
2004 case SVM_EXIT_TR_WRITE:
2005 case SVM_EXIT_CR0_SEL_WRITE:
2006 default:
2007 /* Unexpected exit codes. */
2008 rc = VERR_EM_INTERNAL_ERROR;
2009 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
2010 break;
2011 }
2012
2013end:
2014
2015 /* Signal changes for the recompiler. */
2016 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2017
2018 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
2019 if (exitCode == SVM_EXIT_INTR)
2020 {
2021 STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
2022 /* On the next entry we'll only sync the host context. */
2023 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2024 }
2025 else
2026 {
2027 /* On the next entry we'll sync everything. */
2028 /** @todo we can do better than this */
2029 /* Not in the VINF_PGM_CHANGE_MODE though! */
2030 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2031 }
2032
2033 /* translate into a less severe return code */
2034 if (rc == VERR_EM_INTERPRETER)
2035 rc = VINF_EM_RAW_EMULATE_INSTR;
2036
2037 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2038 return rc;
2039}
2040
2041/**
2042 * Enters the AMD-V session
2043 *
2044 * @returns VBox status code.
2045 * @param pVM The VM to operate on.
2046 * @param pCpu CPU info struct
2047 */
2048VMMR0DECL(int) SVMR0Enter(PVM pVM, PHWACCM_CPUINFO pCpu)
2049{
2050 Assert(pVM->hwaccm.s.svm.fSupported);
2051
2052 LogFlow(("SVMR0Enter cpu%d last=%d asid=%d\n", pCpu->idCpu, pVM->hwaccm.s.idLastCpu, pVM->hwaccm.s.uCurrentASID));
2053 pVM->hwaccm.s.svm.fResumeVM = false;
2054
2055 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
2056 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
2057
2058 return VINF_SUCCESS;
2059}
2060
2061
2062/**
2063 * Leaves the AMD-V session
2064 *
2065 * @returns VBox status code.
2066 * @param pVM The VM to operate on.
2067 * @param pCtx CPU context
2068 */
2069VMMR0DECL(int) SVMR0Leave(PVM pVM, PCPUMCTX pCtx)
2070{
2071 SVM_VMCB *pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
2072
2073 Assert(pVM->hwaccm.s.svm.fSupported);
2074
2075 /* Save the guest debug state if necessary. */
2076 if (CPUMIsGuestDebugStateActive(pVM))
2077 {
2078 CPUMR0SaveGuestDebugState(pVM, pCtx, false /* skip DR6 */);
2079
2080 /* Intercept all DRx reads and writes again. Changed later on. */
2081 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
2082 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
2083
2084 /* Resync the debug registers the next time. */
2085 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2086 }
2087 else
2088 Assert(pVMCB->ctrl.u16InterceptRdDRx == 0xFFFF && pVMCB->ctrl.u16InterceptWrDRx == 0xFFFF);
2089
2090 return VINF_SUCCESS;
2091}
2092
2093
2094static int svmR0InterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2095{
2096 OP_PARAMVAL param1;
2097 RTGCPTR addr;
2098
2099 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2100 if(VBOX_FAILURE(rc))
2101 return VERR_EM_INTERPRETER;
2102
2103 switch(param1.type)
2104 {
2105 case PARMTYPE_IMMEDIATE:
2106 case PARMTYPE_ADDRESS:
2107 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
2108 return VERR_EM_INTERPRETER;
2109 addr = param1.val.val64;
2110 break;
2111
2112 default:
2113 return VERR_EM_INTERPRETER;
2114 }
2115
2116 /** @todo is addr always a flat linear address or ds based
2117 * (in absence of segment override prefixes)????
2118 */
2119 rc = PGMInvalidatePage(pVM, addr);
2120 if (VBOX_SUCCESS(rc))
2121 {
2122 /* Manually invalidate the page for the VM's TLB. */
2123 Log(("SVMInvlpgA %VGv ASID=%d\n", addr, uASID));
2124 SVMInvlpgA(addr, uASID);
2125 return VINF_SUCCESS;
2126 }
2127 Assert(rc == VERR_REM_FLUSHED_PAGES_OVERFLOW);
2128 return rc;
2129}
2130
2131/**
2132 * Interprets INVLPG
2133 *
2134 * @returns VBox status code.
2135 * @retval VINF_* Scheduling instructions.
2136 * @retval VERR_EM_INTERPRETER Something we can't cope with.
2137 * @retval VERR_* Fatal errors.
2138 *
2139 * @param pVM The VM handle.
2140 * @param pRegFrame The register frame.
2141 * @param ASID Tagged TLB id for the guest
2142 *
2143 * Updates the EIP if an instruction was executed successfully.
2144 */
2145static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2146{
2147 /*
2148 * Only allow 32 & 64 bits code.
2149 */
2150 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
2151 if (enmMode != CPUMODE_16BIT)
2152 {
2153 RTGCPTR pbCode;
2154 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->rip, &pbCode);
2155 if (VBOX_SUCCESS(rc))
2156 {
2157 uint32_t cbOp;
2158 DISCPUSTATE Cpu;
2159
2160 Cpu.mode = enmMode;
2161 rc = EMInterpretDisasOneEx(pVM, pbCode, pRegFrame, &Cpu, &cbOp);
2162 Assert(VBOX_FAILURE(rc) || Cpu.pCurInstr->opcode == OP_INVLPG);
2163 if (VBOX_SUCCESS(rc) && Cpu.pCurInstr->opcode == OP_INVLPG)
2164 {
2165 Assert(cbOp == Cpu.opsize);
2166 rc = svmR0InterpretInvlPg(pVM, &Cpu, pRegFrame, uASID);
2167 if (VBOX_SUCCESS(rc))
2168 {
2169 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
2170 }
2171 return rc;
2172 }
2173 }
2174 }
2175 return VERR_EM_INTERPRETER;
2176}
2177
2178
2179/**
2180 * Invalidates a guest page
2181 *
2182 * @returns VBox status code.
2183 * @param pVM The VM to operate on.
2184 * @param GCVirt Page to invalidate
2185 */
2186VMMR0DECL(int) SVMR0InvalidatePage(PVM pVM, RTGCPTR GCVirt)
2187{
2188 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVM->hwaccm.s.fForceTLBFlush;
2189
2190 /* Skip it if a TLB flush is already pending. */
2191 if (!fFlushPending)
2192 {
2193 SVM_VMCB *pVMCB;
2194
2195 Log2(("SVMR0InvalidatePage %VGv\n", GCVirt));
2196 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2197 Assert(pVM->hwaccm.s.svm.fSupported);
2198
2199 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
2200 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2201
2202 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageManual);
2203 SVMInvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2204 }
2205 return VINF_SUCCESS;
2206}
2207
2208
2209/**
2210 * Invalidates a guest page by physical address
2211 *
2212 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
2213 *
2214 * @returns VBox status code.
2215 * @param pVM The VM to operate on.
2216 * @param GCPhys Page to invalidate
2217 */
2218VMMR0DECL(int) SVMR0InvalidatePhysPage(PVM pVM, RTGCPHYS GCPhys)
2219{
2220 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVM->hwaccm.s.fForceTLBFlush;
2221
2222 Assert(pVM->hwaccm.s.fNestedPaging);
2223
2224 /* Skip it if a TLB flush is already pending. */
2225 if (!fFlushPending)
2226 {
2227 CPUMCTX *pCtx;
2228 int rc;
2229 SVM_VMCB *pVMCB;
2230
2231 rc = CPUMQueryGuestCtxPtr(pVM, &pCtx);
2232 AssertRCReturn(rc, rc);
2233
2234 Log2(("SVMR0InvalidatePhysPage %VGp\n", GCPhys));
2235 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2236 Assert(pVM->hwaccm.s.svm.fSupported);
2237
2238 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
2239 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2240
2241 /*
2242 * Only allow 32 & 64 bits code.
2243 */
2244 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pCtx->eflags, pCtx->cs, &pCtx->csHid);
2245 if (enmMode != CPUMODE_16BIT)
2246 {
2247 RTGCPTR pbCode;
2248 int rc = SELMValidateAndConvertCSAddr(pVM, pCtx->eflags, pCtx->ss, pCtx->cs, &pCtx->csHid, (RTGCPTR)pCtx->rip, &pbCode);
2249 if (VBOX_SUCCESS(rc))
2250 {
2251 uint32_t cbOp;
2252 DISCPUSTATE Cpu;
2253 OP_PARAMVAL param1;
2254 RTGCPTR addr;
2255
2256 Cpu.mode = enmMode;
2257 rc = EMInterpretDisasOneEx(pVM, pbCode, CPUMCTX2CORE(pCtx), &Cpu, &cbOp);
2258 AssertRCReturn(rc, rc);
2259 Assert(cbOp == Cpu.opsize);
2260
2261 int rc = DISQueryParamVal(CPUMCTX2CORE(pCtx), &Cpu, &Cpu.param1, &param1, PARAM_SOURCE);
2262 AssertRCReturn(rc, VERR_EM_INTERPRETER);
2263
2264 switch(param1.type)
2265 {
2266 case PARMTYPE_IMMEDIATE:
2267 case PARMTYPE_ADDRESS:
2268 AssertReturn((param1.flags & (PARAM_VAL32|PARAM_VAL64)), VERR_EM_INTERPRETER);
2269
2270 addr = param1.val.val64;
2271 break;
2272
2273 default:
2274 AssertFailed();
2275 return VERR_EM_INTERPRETER;
2276 }
2277
2278 /* Manually invalidate the page for the VM's TLB. */
2279 Log(("SVMR0InvalidatePhysPage Phys=%VGp Virt=%VGv ASID=%d\n", GCPhys, addr, pVMCB->ctrl.TLBCtrl.n.u32ASID));
2280 SVMInvlpgA(addr, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2281 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPhysPageManual);
2282
2283 return VINF_SUCCESS;
2284 }
2285 }
2286 AssertFailed();
2287 return VERR_EM_INTERPRETER;
2288 }
2289 return VINF_SUCCESS;
2290}
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette