VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 20666

Last change on this file since 20666 was 20666, checked in by vboxsync, 16 years ago

Changed PDMApicGet/SetTPR to get/set the full task priority register.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 111.8 KB
Line 
1/* $Id: HWSVMR0.cpp 20666 2009-06-17 13:01:56Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include <iprt/time.h>
47#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
48# include <iprt/thread.h>
49#endif
50#include "HWSVMR0.h"
51
52/*******************************************************************************
53* Internal Functions *
54*******************************************************************************/
55static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID);
56static int svmR0ReplaceTprInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
57
58/*******************************************************************************
59* Global Variables *
60*******************************************************************************/
61/* IO operation lookup arrays. */
62static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
63
64/**
65 * Sets up and activates AMD-V on the current CPU
66 *
67 * @returns VBox status code.
68 * @param pCpu CPU info struct
69 * @param pVM The VM to operate on. (can be NULL after a resume!!)
70 * @param pvPageCpu Pointer to the global cpu page
71 * @param pPageCpuPhys Physical address of the global cpu page
72 */
73VMMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
74{
75 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
76 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
77
78 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
79
80#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
81 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
82#endif
83
84 /* Turn on AMD-V in the EFER MSR. */
85 uint64_t val = ASMRdMsr(MSR_K6_EFER);
86 if (!(val & MSR_K6_EFER_SVME))
87 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
88
89 /* Write the physical page address where the CPU will store the host state while executing the VM. */
90 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
91
92 return VINF_SUCCESS;
93}
94
95/**
96 * Deactivates AMD-V on the current CPU
97 *
98 * @returns VBox status code.
99 * @param pCpu CPU info struct
100 * @param pvPageCpu Pointer to the global cpu page
101 * @param pPageCpuPhys Physical address of the global cpu page
102 */
103VMMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
104{
105 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
106 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
107
108#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
109 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
110#endif
111
112 /* Turn off AMD-V in the EFER MSR. */
113 uint64_t val = ASMRdMsr(MSR_K6_EFER);
114 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
115
116 /* Invalidate host state physical address. */
117 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
118
119 return VINF_SUCCESS;
120}
121
122/**
123 * Does Ring-0 per VM AMD-V init.
124 *
125 * @returns VBox status code.
126 * @param pVM The VM to operate on.
127 */
128VMMR0DECL(int) SVMR0InitVM(PVM pVM)
129{
130 int rc;
131
132 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
133 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
134
135 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
136 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
137 if (RT_FAILURE(rc))
138 return rc;
139
140 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
141 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
142 /* Set all bits to intercept all IO accesses. */
143 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
144
145 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
146 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
147 if (RT_FAILURE(rc))
148 return rc;
149
150 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
151 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
152 /* Set all bits to intercept all MSR accesses. */
153 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
154
155 /* Erratum 170 which requires a forced TLB flush for each world switch:
156 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
157 *
158 * All BH-G1/2 and DH-G1/2 models include a fix:
159 * Athlon X2: 0x6b 1/2
160 * 0x68 1/2
161 * Athlon 64: 0x7f 1
162 * 0x6f 2
163 * Sempron: 0x7f 1/2
164 * 0x6f 2
165 * 0x6c 2
166 * 0x7c 2
167 * Turion 64: 0x68 2
168 *
169 */
170 uint32_t u32Dummy;
171 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
172 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
173 u32BaseFamily= (u32Version >> 8) & 0xf;
174 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
175 u32Model = ((u32Version >> 4) & 0xf);
176 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
177 u32Stepping = u32Version & 0xf;
178 if ( u32Family == 0xf
179 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
180 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
181 {
182 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
183 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
184 }
185
186 /* Allocate VMCBs for all guest CPUs. */
187 for (unsigned i=0;i<pVM->cCPUs;i++)
188 {
189 PVMCPU pVCpu = &pVM->aCpus[i];
190
191 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
192 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
193
194 /* Allocate one page for the host context */
195 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
196 if (RT_FAILURE(rc))
197 return rc;
198
199 pVCpu->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCBHost);
200 pVCpu->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 0);
201 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCBHost);
202
203 /* Allocate one page for the VM control block (VMCB). */
204 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
205 if (RT_FAILURE(rc))
206 return rc;
207
208 pVCpu->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCB);
209 pVCpu->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCB, 0);
210 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCB);
211 }
212
213 return VINF_SUCCESS;
214}
215
216/**
217 * Does Ring-0 per VM AMD-V termination.
218 *
219 * @returns VBox status code.
220 * @param pVM The VM to operate on.
221 */
222VMMR0DECL(int) SVMR0TermVM(PVM pVM)
223{
224 for (unsigned i=0;i<pVM->cCPUs;i++)
225 {
226 PVMCPU pVCpu = &pVM->aCpus[i];
227
228 if (pVCpu->hwaccm.s.svm.pMemObjVMCBHost != NIL_RTR0MEMOBJ)
229 {
230 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, false);
231 pVCpu->hwaccm.s.svm.pVMCBHost = 0;
232 pVCpu->hwaccm.s.svm.pVMCBHostPhys = 0;
233 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
234 }
235
236 if (pVCpu->hwaccm.s.svm.pMemObjVMCB != NIL_RTR0MEMOBJ)
237 {
238 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCB, false);
239 pVCpu->hwaccm.s.svm.pVMCB = 0;
240 pVCpu->hwaccm.s.svm.pVMCBPhys = 0;
241 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
242 }
243 }
244 if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
245 {
246 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
247 pVM->hwaccm.s.svm.pIOBitmap = 0;
248 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
249 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
250 }
251 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
252 {
253 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
254 pVM->hwaccm.s.svm.pMSRBitmap = 0;
255 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
256 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
257 }
258 return VINF_SUCCESS;
259}
260
261/**
262 * Sets up AMD-V for the specified VM
263 *
264 * @returns VBox status code.
265 * @param pVM The VM to operate on.
266 */
267VMMR0DECL(int) SVMR0SetupVM(PVM pVM)
268{
269 int rc = VINF_SUCCESS;
270 SVM_VMCB *pVMCB;
271
272 AssertReturn(pVM, VERR_INVALID_PARAMETER);
273
274 Assert(pVM->hwaccm.s.svm.fSupported);
275
276 for (unsigned i=0;i<pVM->cCPUs;i++)
277 {
278 pVMCB = (SVM_VMCB *)pVM->aCpus[i].hwaccm.s.svm.pVMCB;
279 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
280
281 /* Program the control fields. Most of them never have to be changed again. */
282 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
283 /* Note: CR0 & CR4 can be safely read when guest and shadow copies are identical. */
284 if (!pVM->hwaccm.s.fNestedPaging)
285 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
286 else
287 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(4);
288
289 /*
290 * CR0/3/4 writes must be intercepted for obvious reasons.
291 */
292 if (!pVM->hwaccm.s.fNestedPaging)
293 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
294 else
295 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(4) | RT_BIT(8);
296
297 /* Intercept all DRx reads and writes by default. Changed later on. */
298 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
299 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
300
301 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
302 * All breakpoints are automatically cleared when the VM exits.
303 */
304
305 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
306#ifndef DEBUG
307 if (pVM->hwaccm.s.fNestedPaging)
308 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
309#endif
310
311 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
312 | SVM_CTRL1_INTERCEPT_VINTR
313 | SVM_CTRL1_INTERCEPT_NMI
314 | SVM_CTRL1_INTERCEPT_SMI
315 | SVM_CTRL1_INTERCEPT_INIT
316 | SVM_CTRL1_INTERCEPT_RDPMC
317 | SVM_CTRL1_INTERCEPT_CPUID
318 | SVM_CTRL1_INTERCEPT_RSM
319 | SVM_CTRL1_INTERCEPT_HLT
320 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
321 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
322 | SVM_CTRL1_INTERCEPT_INVLPG
323 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
324 | SVM_CTRL1_INTERCEPT_TASK_SWITCH
325 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
326 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
327 ;
328 /* With nested paging we don't care about invlpg anymore. */
329 if (pVM->hwaccm.s.fNestedPaging)
330 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_INVLPG;
331
332 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
333 | SVM_CTRL2_INTERCEPT_VMMCALL
334 | SVM_CTRL2_INTERCEPT_VMLOAD
335 | SVM_CTRL2_INTERCEPT_VMSAVE
336 | SVM_CTRL2_INTERCEPT_STGI
337 | SVM_CTRL2_INTERCEPT_CLGI
338 | SVM_CTRL2_INTERCEPT_SKINIT
339 | SVM_CTRL2_INTERCEPT_WBINVD
340 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
341 ;
342 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
343 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
344 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
345
346 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
347 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
348 /* Ignore the priority in the TPR; just deliver it when we tell it to. */
349 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1;
350
351 /* Set IO and MSR bitmap addresses. */
352 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
353 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
354
355 /* No LBR virtualization. */
356 pVMCB->ctrl.u64LBRVirt = 0;
357
358 /** The ASID must start at 1; the host uses 0. */
359 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
360
361 /** Setup the PAT msr (nested paging only) */
362 pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
363 }
364 return rc;
365}
366
367
368/**
369 * Injects an event (trap or external interrupt)
370 *
371 * @param pVCpu The VMCPU to operate on.
372 * @param pVMCB SVM control block
373 * @param pCtx CPU Context
374 * @param pIntInfo SVM interrupt info
375 */
376inline void SVMR0InjectEvent(PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
377{
378#ifdef VBOX_WITH_STATISTICS
379 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatInjectedIrqsR0[pEvent->n.u8Vector & MASK_INJECT_IRQ_STAT]);
380#endif
381
382#ifdef VBOX_STRICT
383 if (pEvent->n.u8Vector == 0xE)
384 Log(("SVM: Inject int %d at %RGv error code=%02x CR2=%RGv intInfo=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode, (RTGCPTR)pCtx->cr2, pEvent->au64[0]));
385 else
386 if (pEvent->n.u8Vector < 0x20)
387 Log(("SVM: Inject int %d at %RGv error code=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode));
388 else
389 {
390 Log(("INJ-EI: %x at %RGv\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip));
391 Assert(!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
392 Assert(pCtx->eflags.u32 & X86_EFL_IF);
393 }
394#endif
395
396 /* Set event injection state. */
397 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
398}
399
400
401/**
402 * Checks for pending guest interrupts and injects them
403 *
404 * @returns VBox status code.
405 * @param pVM The VM to operate on.
406 * @param pVCpu The VM CPU to operate on.
407 * @param pVMCB SVM control block
408 * @param pCtx CPU Context
409 */
410static int SVMR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
411{
412 int rc;
413
414 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
415 if (pVCpu->hwaccm.s.Event.fPending)
416 {
417 SVM_EVENT Event;
418
419 Log(("Reinjecting event %08x %08x at %RGv\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip));
420 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
421 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
422 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
423
424 pVCpu->hwaccm.s.Event.fPending = false;
425 return VINF_SUCCESS;
426 }
427
428 if (pVM->hwaccm.s.fInjectNMI)
429 {
430 SVM_EVENT Event;
431
432 Event.n.u8Vector = X86_XCPT_NMI;
433 Event.n.u1Valid = 1;
434 Event.n.u32ErrorCode = 0;
435 Event.n.u3Type = SVM_EVENT_NMI;
436
437 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
438 pVM->hwaccm.s.fInjectNMI = false;
439 return VINF_SUCCESS;
440 }
441
442 /* When external interrupts are pending, we should exit the VM when IF is set. */
443 if ( !TRPMHasTrap(pVCpu)
444 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
445 {
446 if ( !(pCtx->eflags.u32 & X86_EFL_IF)
447 || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
448 {
449 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
450 {
451 if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
452 LogFlow(("Enable irq window exit!\n"));
453 else
454 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS -> irq window exit\n", (RTGCPTR)pCtx->rip));
455
456 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
457 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
458 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
459 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
460 }
461 }
462 else
463 {
464 uint8_t u8Interrupt;
465
466 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
467 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
468 if (RT_SUCCESS(rc))
469 {
470 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
471 AssertRC(rc);
472 }
473 else
474 {
475 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
476 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
477 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
478 /* Just continue */
479 }
480 }
481 }
482
483#ifdef VBOX_STRICT
484 if (TRPMHasTrap(pVCpu))
485 {
486 uint8_t u8Vector;
487 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
488 AssertRC(rc);
489 }
490#endif
491
492 if ( (pCtx->eflags.u32 & X86_EFL_IF)
493 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
494 && TRPMHasTrap(pVCpu)
495 )
496 {
497 uint8_t u8Vector;
498 int rc;
499 TRPMEVENT enmType;
500 SVM_EVENT Event;
501 RTGCUINT u32ErrorCode;
502
503 Event.au64[0] = 0;
504
505 /* If a new event is pending, then dispatch it now. */
506 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &u32ErrorCode, 0);
507 AssertRC(rc);
508 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
509 Assert(enmType != TRPM_SOFTWARE_INT);
510
511 /* Clear the pending trap. */
512 rc = TRPMResetTrap(pVCpu);
513 AssertRC(rc);
514
515 Event.n.u8Vector = u8Vector;
516 Event.n.u1Valid = 1;
517 Event.n.u32ErrorCode = u32ErrorCode;
518
519 if (enmType == TRPM_TRAP)
520 {
521 switch (u8Vector) {
522 case 8:
523 case 10:
524 case 11:
525 case 12:
526 case 13:
527 case 14:
528 case 17:
529 /* Valid error codes. */
530 Event.n.u1ErrorCodeValid = 1;
531 break;
532 default:
533 break;
534 }
535 if (u8Vector == X86_XCPT_NMI)
536 Event.n.u3Type = SVM_EVENT_NMI;
537 else
538 Event.n.u3Type = SVM_EVENT_EXCEPTION;
539 }
540 else
541 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
542
543 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
544 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
545 } /* if (interrupts can be dispatched) */
546
547 return VINF_SUCCESS;
548}
549
550/**
551 * Save the host state
552 *
553 * @returns VBox status code.
554 * @param pVM The VM to operate on.
555 * @param pVCpu The VM CPU to operate on.
556 */
557VMMR0DECL(int) SVMR0SaveHostState(PVM pVM, PVMCPU pVCpu)
558{
559 NOREF(pVM);
560 NOREF(pVCpu);
561 /* Nothing to do here. */
562 return VINF_SUCCESS;
563}
564
565/**
566 * Loads the guest state
567 *
568 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
569 *
570 * @returns VBox status code.
571 * @param pVM The VM to operate on.
572 * @param pVCpu The VM CPU to operate on.
573 * @param pCtx Guest context
574 */
575VMMR0DECL(int) SVMR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
576{
577 RTGCUINTPTR val;
578 SVM_VMCB *pVMCB;
579
580 if (pVM == NULL)
581 return VERR_INVALID_PARAMETER;
582
583 /* Setup AMD SVM. */
584 Assert(pVM->hwaccm.s.svm.fSupported);
585
586 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
587 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
588
589 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
590 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
591 {
592 SVM_WRITE_SELREG(CS, cs);
593 SVM_WRITE_SELREG(SS, ss);
594 SVM_WRITE_SELREG(DS, ds);
595 SVM_WRITE_SELREG(ES, es);
596 SVM_WRITE_SELREG(FS, fs);
597 SVM_WRITE_SELREG(GS, gs);
598 }
599
600 /* Guest CPU context: LDTR. */
601 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
602 {
603 SVM_WRITE_SELREG(LDTR, ldtr);
604 }
605
606 /* Guest CPU context: TR. */
607 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
608 {
609 SVM_WRITE_SELREG(TR, tr);
610 }
611
612 /* Guest CPU context: GDTR. */
613 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
614 {
615 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
616 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
617 }
618
619 /* Guest CPU context: IDTR. */
620 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
621 {
622 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
623 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
624 }
625
626 /*
627 * Sysenter MSRs (unconditional)
628 */
629 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
630 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
631 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
632
633 /* Control registers */
634 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
635 {
636 val = pCtx->cr0;
637 if (!CPUMIsGuestFPUStateActive(pVCpu))
638 {
639 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
640 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
641 }
642 else
643 {
644 /** @todo check if we support the old style mess correctly. */
645 if (!(val & X86_CR0_NE))
646 {
647 Log(("Forcing X86_CR0_NE!!!\n"));
648
649 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
650 if (!pVCpu->hwaccm.s.fFPUOldStyleOverride)
651 {
652 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_MF);
653 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
654 }
655 }
656 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
657 }
658 /* Always enable caching. */
659 val &= ~(X86_CR0_CD|X86_CR0_NW);
660
661 /* Note: WP is not relevant in nested paging mode as we catch accesses on the (guest) physical level. */
662 /* Note: In nested paging mode the guest is allowed to run with paging disabled; the guest physical to host physical translation will remain active. */
663 if (!pVM->hwaccm.s.fNestedPaging)
664 {
665 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
666 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
667 }
668 pVMCB->guest.u64CR0 = val;
669 }
670 /* CR2 as well */
671 pVMCB->guest.u64CR2 = pCtx->cr2;
672
673 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
674 {
675 /* Save our shadow CR3 register. */
676 if (pVM->hwaccm.s.fNestedPaging)
677 {
678 PGMMODE enmShwPagingMode;
679
680#if HC_ARCH_BITS == 32
681 if (CPUMIsGuestInLongModeEx(pCtx))
682 enmShwPagingMode = PGMMODE_AMD64_NX;
683 else
684#endif
685 enmShwPagingMode = PGMGetHostMode(pVM);
686
687 pVMCB->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
688 Assert(pVMCB->ctrl.u64NestedPagingCR3);
689 pVMCB->guest.u64CR3 = pCtx->cr3;
690 }
691 else
692 {
693 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
694 Assert(pVMCB->guest.u64CR3 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
695 }
696 }
697
698 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
699 {
700 val = pCtx->cr4;
701 if (!pVM->hwaccm.s.fNestedPaging)
702 {
703 switch(pVCpu->hwaccm.s.enmShadowMode)
704 {
705 case PGMMODE_REAL:
706 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
707 AssertFailed();
708 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
709
710 case PGMMODE_32_BIT: /* 32-bit paging. */
711 val &= ~X86_CR4_PAE;
712 break;
713
714 case PGMMODE_PAE: /* PAE paging. */
715 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
716 /** @todo use normal 32 bits paging */
717 val |= X86_CR4_PAE;
718 break;
719
720 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
721 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
722#ifdef VBOX_ENABLE_64_BITS_GUESTS
723 break;
724#else
725 AssertFailed();
726 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
727#endif
728
729 default: /* shut up gcc */
730 AssertFailed();
731 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
732 }
733 }
734 pVMCB->guest.u64CR4 = val;
735 }
736
737 /* Debug registers. */
738 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
739 {
740 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
741 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
742
743 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
744 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
745 pCtx->dr[7] |= 0x400; /* must be one */
746
747 pVMCB->guest.u64DR7 = pCtx->dr[7];
748 pVMCB->guest.u64DR6 = pCtx->dr[6];
749
750 /* Sync the debug state now if any breakpoint is armed. */
751 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
752 && !CPUMIsGuestDebugStateActive(pVCpu)
753 && !DBGFIsStepping(pVCpu))
754 {
755 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
756
757 /* Disable drx move intercepts. */
758 pVMCB->ctrl.u16InterceptRdDRx = 0;
759 pVMCB->ctrl.u16InterceptWrDRx = 0;
760
761 /* Save the host and load the guest debug state. */
762 int rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
763 AssertRC(rc);
764 }
765 }
766
767 /* EIP, ESP and EFLAGS */
768 pVMCB->guest.u64RIP = pCtx->rip;
769 pVMCB->guest.u64RSP = pCtx->rsp;
770 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
771
772 /* Set CPL */
773 pVMCB->guest.u8CPL = pCtx->csHid.Attr.n.u2Dpl;
774
775 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
776 pVMCB->guest.u64RAX = pCtx->rax;
777
778 /* vmrun will fail without MSR_K6_EFER_SVME. */
779 pVMCB->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
780
781 /* 64 bits guest mode? */
782 if (CPUMIsGuestInLongModeEx(pCtx))
783 {
784#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
785 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
786#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
787 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMSwitcherRun64;
788#else
789# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
790 if (!pVM->hwaccm.s.fAllow64BitGuests)
791 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
792# endif
793 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun64;
794#endif
795 /* Unconditionally update these as wrmsr might have changed them. (HWACCM_CHANGED_GUEST_SEGMENT_REGS will not be set) */
796 pVMCB->guest.FS.u64Base = pCtx->fsHid.u64Base;
797 pVMCB->guest.GS.u64Base = pCtx->gsHid.u64Base;
798 }
799 else
800 {
801 /* Filter out the MSR_K6_LME bit or else AMD-V expects amd64 shadow paging. */
802 pVMCB->guest.u64EFER &= ~MSR_K6_EFER_LME;
803
804 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun;
805 }
806
807 /* TSC offset. */
808 if (TMCpuTickCanUseRealTSC(pVCpu, &pVMCB->ctrl.u64TSCOffset))
809 {
810 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
811 pVMCB->ctrl.u32InterceptCtrl2 &= ~SVM_CTRL2_INTERCEPT_RDTSCP;
812 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
813 }
814 else
815 {
816 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
817 pVMCB->ctrl.u32InterceptCtrl2 |= SVM_CTRL2_INTERCEPT_RDTSCP;
818 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
819 }
820
821 /* Sync the various msrs for 64 bits mode. */
822 pVMCB->guest.u64STAR = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
823 pVMCB->guest.u64LSTAR = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
824 pVMCB->guest.u64CSTAR = pCtx->msrCSTAR; /* compatibility mode syscall rip */
825 pVMCB->guest.u64SFMASK = pCtx->msrSFMASK; /* syscall flag mask */
826 pVMCB->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
827
828#ifdef DEBUG
829 /* Intercept X86_XCPT_DB if stepping is enabled */
830 if (DBGFIsStepping(pVCpu))
831 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_DB);
832 else
833 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_DB);
834#endif
835
836 /* Done. */
837 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
838
839 return VINF_SUCCESS;
840}
841
842
843/**
844 * Runs guest code in an AMD-V VM.
845 *
846 * @returns VBox status code.
847 * @param pVM The VM to operate on.
848 * @param pVCpu The VM CPU to operate on.
849 * @param pCtx Guest context
850 */
851VMMR0DECL(int) SVMR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
852{
853 int rc = VINF_SUCCESS;
854 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
855 SVM_VMCB *pVMCB;
856 bool fSyncTPR = false;
857 unsigned cResume = 0;
858 uint8_t u8LastTPR;
859 PHWACCM_CPUINFO pCpu = 0;
860 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
861#ifdef VBOX_STRICT
862 RTCPUID idCpuCheck;
863#endif
864#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
865 uint64_t u64LastTime = RTTimeMilliTS();
866#endif
867
868 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
869
870 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
871 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
872
873 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
874 */
875ResumeExecution:
876 Assert(!HWACCMR0SuspendPending());
877
878 /* Safety precaution; looping for too long here can have a very bad effect on the host */
879 if (RT_UNLIKELY(++cResume > pVM->hwaccm.s.cMaxResumeLoops))
880 {
881 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
882 rc = VINF_EM_RAW_INTERRUPT;
883 goto end;
884 }
885
886 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
887 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
888 {
889 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
890 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
891 {
892 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
893 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
894 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
895 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
896 */
897 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
898 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
899 pVMCB->ctrl.u64IntShadow = 0;
900 }
901 }
902 else
903 {
904 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
905 pVMCB->ctrl.u64IntShadow = 0;
906 }
907
908#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
909 if (RT_UNLIKELY(cResume & 0xf) == 0)
910 {
911 uint64_t u64CurTime = RTTimeMilliTS();
912
913 if (RT_UNLIKELY(u64CurTime > u64LastTime))
914 {
915 u64LastTime = u64CurTime;
916 TMTimerPollVoid(pVM, pVCpu);
917 }
918 }
919#endif
920
921 /* Check for pending actions that force us to go back to ring 3. */
922#ifdef DEBUG
923 /* Intercept X86_XCPT_DB if stepping is enabled */
924 if (!DBGFIsStepping(pVCpu))
925#endif
926 {
927 if ( VM_FF_ISPENDING(pVM, VM_FF_HWACCM_TO_R3_MASK)
928 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HWACCM_TO_R3_MASK))
929 {
930 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
931 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
932 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
933 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
934 goto end;
935 }
936 }
937
938 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
939 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
940 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
941 {
942 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
943 rc = VINF_EM_PENDING_REQUEST;
944 goto end;
945 }
946
947#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
948 /*
949 * Exit to ring-3 preemption/work is pending.
950 *
951 * Interrupts are disabled before the call to make sure we don't miss any interrupt
952 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
953 * further down, but SVMR0CheckPendingInterrupt makes that impossible.)
954 *
955 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
956 * shootdowns rely on this.
957 */
958 uOldEFlags = ASMIntDisableFlags();
959 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
960 {
961 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPreemptPending);
962 rc = VINF_EM_RAW_INTERRUPT;
963 goto end;
964 }
965 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
966#endif
967
968 /* When external interrupts are pending, we should exit the VM when IF is set. */
969 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
970 rc = SVMR0CheckPendingInterrupt(pVM, pVCpu, pVMCB, pCtx);
971 if (RT_FAILURE(rc))
972 {
973 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
974 goto end;
975 }
976
977 /* TPR caching using CR8 is only available in 64 bits mode or with 32 bits guests when X86_CPUID_AMD_FEATURE_ECX_CR8L is supported. */
978 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!!!!!
979 * @todo query and update the TPR only when it could have been changed (mmio access)
980 */
981 if (pVM->hwaccm.s.fHasIoApic)
982 {
983 bool fPending;
984
985 /* TPR caching in CR8 */
986 int rc = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
987 AssertRC(rc);
988 pVMCB->ctrl.IntCtrl.n.u8VTPR = (u8LastTPR >> 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
989
990 if (fPending)
991 {
992 /* A TPR change could activate a pending interrupt, so catch cr8 writes. */
993 pVMCB->ctrl.u16InterceptWrCRx |= RT_BIT(8);
994 }
995 else
996 /* No interrupts are pending, so we don't need to be explicitely notified.
997 * There are enough world switches for detecting pending interrupts.
998 */
999 pVMCB->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
1000
1001 fSyncTPR = !fPending;
1002 }
1003
1004 /* All done! Let's start VM execution. */
1005 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1006
1007 /* Enable nested paging if necessary (disabled each time after #VMEXIT). */
1008 pVMCB->ctrl.NestedPaging.n.u1NestedPaging = pVM->hwaccm.s.fNestedPaging;
1009
1010#ifdef LOG_ENABLED
1011 pCpu = HWACCMR0GetCurrentCpu();
1012 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1013 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1014 {
1015 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1016 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1017 else
1018 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1019 }
1020 if (pCpu->fFlushTLB)
1021 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1022#endif
1023
1024 /*
1025 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1026 * (until the actual world switch)
1027 */
1028#ifdef VBOX_STRICT
1029 idCpuCheck = RTMpCpuId();
1030#endif
1031#ifdef LOG_ENABLED
1032 VMMR0LogFlushDisable(pVCpu);
1033#endif
1034
1035 /* Load the guest state; *must* be here as it sets up the shadow cr0 for lazy fpu syncing! */
1036 rc = SVMR0LoadGuestState(pVM, pVCpu, pCtx);
1037 if (rc != VINF_SUCCESS)
1038 {
1039 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1040 goto end;
1041 }
1042
1043#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1044 /* Disable interrupts to make sure a poke will interrupt execution.
1045 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
1046 */
1047 uOldEFlags = ASMIntDisableFlags();
1048 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
1049#endif
1050
1051 pCpu = HWACCMR0GetCurrentCpu();
1052 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1053 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1054 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1055 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1056 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1057 {
1058 /* Force a TLB flush on VM entry. */
1059 pVCpu->hwaccm.s.fForceTLBFlush = true;
1060 }
1061 else
1062 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1063
1064 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1065
1066 /* Check for tlb shootdown flushes. */
1067 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH_BIT))
1068 pVCpu->hwaccm.s.fForceTLBFlush = true;
1069
1070 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1071 if ( pVCpu->hwaccm.s.fForceTLBFlush
1072 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
1073 {
1074 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1075 || pCpu->fFlushTLB)
1076 {
1077 pCpu->fFlushTLB = false;
1078 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1079 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
1080 pCpu->cTLBFlushes++;
1081 }
1082 else
1083 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1084
1085 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1086 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1087 }
1088 else
1089 {
1090 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1091
1092 /* We never increase uCurrentASID in the fAlwaysFlushTLB (erratum 170) case. */
1093 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1094 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1095
1096 Assert(!pVM->hwaccm.s.svm.fAlwaysFlushTLB || pVCpu->hwaccm.s.fForceTLBFlush);
1097 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVCpu->hwaccm.s.fForceTLBFlush;
1098
1099 if ( !pVM->hwaccm.s.svm.fAlwaysFlushTLB
1100 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
1101 {
1102 /* Deal with pending TLB shootdown actions which were queued when we were not executing code. */
1103 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTlbShootdown);
1104 for (unsigned i=0;i<pVCpu->hwaccm.s.TlbShootdown.cPages;i++)
1105 SVMR0InvlpgA(pVCpu->hwaccm.s.TlbShootdown.aPages[i], pVMCB->ctrl.TLBCtrl.n.u32ASID);
1106 }
1107 }
1108 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
1109 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
1110
1111 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1112 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1113 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1114 pVMCB->ctrl.TLBCtrl.n.u32ASID = pVCpu->hwaccm.s.uCurrentASID;
1115
1116#ifdef VBOX_WITH_STATISTICS
1117 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
1118 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1119 else
1120 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1121#endif
1122
1123 /* In case we execute a goto ResumeExecution later on. */
1124 pVCpu->hwaccm.s.fResumeVM = true;
1125 pVCpu->hwaccm.s.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
1126
1127 Assert(sizeof(pVCpu->hwaccm.s.svm.pVMCBPhys) == 8);
1128 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
1129 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
1130 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
1131 Assert(pVMCB->ctrl.u64LBRVirt == 0);
1132
1133#ifdef VBOX_STRICT
1134 Assert(idCpuCheck == RTMpCpuId());
1135#endif
1136 TMNotifyStartOfExecution(pVCpu);
1137 pVCpu->hwaccm.s.svm.pfnVMRun(pVCpu->hwaccm.s.svm.pVMCBHostPhys, pVCpu->hwaccm.s.svm.pVMCBPhys, pCtx, pVM, pVCpu);
1138 TMNotifyEndOfExecution(pVCpu);
1139 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
1140 ASMSetFlags(uOldEFlags);
1141#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1142 uOldEFlags = ~(RTCCUINTREG)0;
1143#endif
1144 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1145
1146 /*
1147 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1148 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1149 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1150 */
1151
1152 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit1, x);
1153
1154 /* Reason for the VM exit */
1155 exitCode = pVMCB->ctrl.u64ExitCode;
1156
1157 if (exitCode == (uint64_t)SVM_EXIT_INVALID) /* Invalid guest state. */
1158 {
1159 HWACCMDumpRegs(pVM, pVCpu, pCtx);
1160#ifdef DEBUG
1161 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
1162 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
1163 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
1164 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
1165 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
1166 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
1167 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
1168 Log(("ctrl.u64IOPMPhysAddr %RX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
1169 Log(("ctrl.u64MSRPMPhysAddr %RX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
1170 Log(("ctrl.u64TSCOffset %RX64\n", pVMCB->ctrl.u64TSCOffset));
1171
1172 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
1173 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
1174 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
1175 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
1176
1177 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
1178 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
1179 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
1180 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
1181 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
1182 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
1183 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
1184 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
1185 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
1186 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
1187
1188 Log(("ctrl.u64IntShadow %RX64\n", pVMCB->ctrl.u64IntShadow));
1189 Log(("ctrl.u64ExitCode %RX64\n", pVMCB->ctrl.u64ExitCode));
1190 Log(("ctrl.u64ExitInfo1 %RX64\n", pVMCB->ctrl.u64ExitInfo1));
1191 Log(("ctrl.u64ExitInfo2 %RX64\n", pVMCB->ctrl.u64ExitInfo2));
1192 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
1193 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
1194 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
1195 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
1196 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
1197 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
1198 Log(("ctrl.NestedPaging %RX64\n", pVMCB->ctrl.NestedPaging.au64));
1199 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
1200 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
1201 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
1202 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
1203 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
1204 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
1205
1206 Log(("ctrl.u64NestedPagingCR3 %RX64\n", pVMCB->ctrl.u64NestedPagingCR3));
1207 Log(("ctrl.u64LBRVirt %RX64\n", pVMCB->ctrl.u64LBRVirt));
1208
1209 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
1210 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
1211 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
1212 Log(("guest.CS.u64Base %RX64\n", pVMCB->guest.CS.u64Base));
1213 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
1214 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
1215 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
1216 Log(("guest.DS.u64Base %RX64\n", pVMCB->guest.DS.u64Base));
1217 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
1218 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
1219 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
1220 Log(("guest.ES.u64Base %RX64\n", pVMCB->guest.ES.u64Base));
1221 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
1222 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
1223 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
1224 Log(("guest.FS.u64Base %RX64\n", pVMCB->guest.FS.u64Base));
1225 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
1226 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
1227 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
1228 Log(("guest.GS.u64Base %RX64\n", pVMCB->guest.GS.u64Base));
1229
1230 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
1231 Log(("guest.GDTR.u64Base %RX64\n", pVMCB->guest.GDTR.u64Base));
1232
1233 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
1234 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
1235 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
1236 Log(("guest.LDTR.u64Base %RX64\n", pVMCB->guest.LDTR.u64Base));
1237
1238 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
1239 Log(("guest.IDTR.u64Base %RX64\n", pVMCB->guest.IDTR.u64Base));
1240
1241 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
1242 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
1243 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
1244 Log(("guest.TR.u64Base %RX64\n", pVMCB->guest.TR.u64Base));
1245
1246 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
1247 Log(("guest.u64CR0 %RX64\n", pVMCB->guest.u64CR0));
1248 Log(("guest.u64CR2 %RX64\n", pVMCB->guest.u64CR2));
1249 Log(("guest.u64CR3 %RX64\n", pVMCB->guest.u64CR3));
1250 Log(("guest.u64CR4 %RX64\n", pVMCB->guest.u64CR4));
1251 Log(("guest.u64DR6 %RX64\n", pVMCB->guest.u64DR6));
1252 Log(("guest.u64DR7 %RX64\n", pVMCB->guest.u64DR7));
1253
1254 Log(("guest.u64RIP %RX64\n", pVMCB->guest.u64RIP));
1255 Log(("guest.u64RSP %RX64\n", pVMCB->guest.u64RSP));
1256 Log(("guest.u64RAX %RX64\n", pVMCB->guest.u64RAX));
1257 Log(("guest.u64RFlags %RX64\n", pVMCB->guest.u64RFlags));
1258
1259 Log(("guest.u64SysEnterCS %RX64\n", pVMCB->guest.u64SysEnterCS));
1260 Log(("guest.u64SysEnterEIP %RX64\n", pVMCB->guest.u64SysEnterEIP));
1261 Log(("guest.u64SysEnterESP %RX64\n", pVMCB->guest.u64SysEnterESP));
1262
1263 Log(("guest.u64EFER %RX64\n", pVMCB->guest.u64EFER));
1264 Log(("guest.u64STAR %RX64\n", pVMCB->guest.u64STAR));
1265 Log(("guest.u64LSTAR %RX64\n", pVMCB->guest.u64LSTAR));
1266 Log(("guest.u64CSTAR %RX64\n", pVMCB->guest.u64CSTAR));
1267 Log(("guest.u64SFMASK %RX64\n", pVMCB->guest.u64SFMASK));
1268 Log(("guest.u64KernelGSBase %RX64\n", pVMCB->guest.u64KernelGSBase));
1269 Log(("guest.u64GPAT %RX64\n", pVMCB->guest.u64GPAT));
1270 Log(("guest.u64DBGCTL %RX64\n", pVMCB->guest.u64DBGCTL));
1271 Log(("guest.u64BR_FROM %RX64\n", pVMCB->guest.u64BR_FROM));
1272 Log(("guest.u64BR_TO %RX64\n", pVMCB->guest.u64BR_TO));
1273 Log(("guest.u64LASTEXCPFROM %RX64\n", pVMCB->guest.u64LASTEXCPFROM));
1274 Log(("guest.u64LASTEXCPTO %RX64\n", pVMCB->guest.u64LASTEXCPTO));
1275
1276#endif
1277 rc = VERR_SVM_UNABLE_TO_START_VM;
1278 goto end;
1279 }
1280
1281 /* Let's first sync back eip, esp, and eflags. */
1282 pCtx->rip = pVMCB->guest.u64RIP;
1283 pCtx->rsp = pVMCB->guest.u64RSP;
1284 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
1285 /* eax is saved/restore across the vmrun instruction */
1286 pCtx->rax = pVMCB->guest.u64RAX;
1287
1288 pCtx->msrKERNELGSBASE = pVMCB->guest.u64KernelGSBase; /* swapgs exchange value */
1289
1290 /* Can be updated behind our back in the nested paging case. */
1291 pCtx->cr2 = pVMCB->guest.u64CR2;
1292
1293 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1294 SVM_READ_SELREG(SS, ss);
1295 SVM_READ_SELREG(CS, cs);
1296 SVM_READ_SELREG(DS, ds);
1297 SVM_READ_SELREG(ES, es);
1298 SVM_READ_SELREG(FS, fs);
1299 SVM_READ_SELREG(GS, gs);
1300
1301 /*
1302 * System MSRs
1303 */
1304 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1305 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1306 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1307
1308 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1309 SVM_READ_SELREG(LDTR, ldtr);
1310 SVM_READ_SELREG(TR, tr);
1311
1312 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1313 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1314
1315 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1316 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1317
1318 /* Note: no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
1319 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1320 if ( pVM->hwaccm.s.fNestedPaging
1321 && pCtx->cr3 != pVMCB->guest.u64CR3)
1322 {
1323 CPUMSetGuestCR3(pVCpu, pVMCB->guest.u64CR3);
1324 PGMUpdateCR3(pVCpu, pVMCB->guest.u64CR3);
1325 }
1326
1327 /* Note! NOW IT'S SAFE FOR LOGGING! */
1328#ifdef LOG_ENABLED
1329 VMMR0LogFlushEnable(pVCpu);
1330#endif
1331
1332 /* Take care of instruction fusing (sti, mov ss) (see 15.20.5 Interrupt Shadows) */
1333 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
1334 {
1335 Log(("uInterruptState %x rip=%RGv\n", pVMCB->ctrl.u64IntShadow, (RTGCPTR)pCtx->rip));
1336 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
1337 }
1338 else
1339 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
1340
1341 Log2(("exitCode = %x\n", exitCode));
1342
1343 /* Sync back DR6 as it could have been changed by hitting breakpoints. */
1344 pCtx->dr[6] = pVMCB->guest.u64DR6;
1345 /* DR7.GD can be cleared by debug exceptions, so sync it back as well. */
1346 pCtx->dr[7] = pVMCB->guest.u64DR7;
1347
1348 /* Check if an injected event was interrupted prematurely. */
1349 pVCpu->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1350 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1351 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1352 {
1353 Log(("Pending inject %RX64 at %RGv exit=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitCode));
1354
1355#ifdef LOG_ENABLED
1356 SVM_EVENT Event;
1357 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
1358
1359 if ( exitCode == SVM_EXIT_EXCEPTION_E
1360 && Event.n.u8Vector == 0xE)
1361 {
1362 Log(("Double fault!\n"));
1363 }
1364#endif
1365
1366 pVCpu->hwaccm.s.Event.fPending = true;
1367 /* Error code present? (redundant) */
1368 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1369 pVCpu->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1370 else
1371 pVCpu->hwaccm.s.Event.errCode = 0;
1372 }
1373#ifdef VBOX_WITH_STATISTICS
1374 if (exitCode == SVM_EXIT_NPF)
1375 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
1376 else
1377 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1378#endif
1379
1380 /* Sync back the TPR if it was changed. */
1381 if ( fSyncTPR
1382 && (u8LastTPR >> 4) != pVMCB->ctrl.IntCtrl.n.u8VTPR)
1383 {
1384 rc = PDMApicSetTPR(pVCpu, pVMCB->ctrl.IntCtrl.n.u8VTPR << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
1385 AssertRC(rc);
1386 }
1387
1388 /* Deal with the reason of the VM-exit. */
1389 switch (exitCode)
1390 {
1391 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1392 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1393 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1394 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1395 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1396 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1397 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1398 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1399 {
1400 /* Pending trap. */
1401 SVM_EVENT Event;
1402 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1403
1404 Log2(("Hardware/software interrupt %d\n", vector));
1405 switch (vector)
1406 {
1407 case X86_XCPT_DB:
1408 {
1409 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
1410
1411 /* Note that we don't support guest and host-initiated debugging at the same time. */
1412 Assert(DBGFIsStepping(pVCpu));
1413
1414 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), pCtx->dr[6]);
1415 if (rc == VINF_EM_RAW_GUEST_TRAP)
1416 {
1417 Log(("Trap %x (debug) at %016RX64\n", vector, pCtx->rip));
1418
1419 /* Reinject the exception. */
1420 Event.au64[0] = 0;
1421 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1422 Event.n.u1Valid = 1;
1423 Event.n.u8Vector = X86_XCPT_DB;
1424
1425 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1426
1427 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1428 goto ResumeExecution;
1429 }
1430 /* Return to ring 3 to deal with the debug exit code. */
1431 break;
1432 }
1433
1434 case X86_XCPT_NM:
1435 {
1436 Log(("#NM fault at %RGv\n", (RTGCPTR)pCtx->rip));
1437
1438 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1439 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1440 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
1441 if (rc == VINF_SUCCESS)
1442 {
1443 Assert(CPUMIsGuestFPUStateActive(pVCpu));
1444 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
1445
1446 /* Continue execution. */
1447 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1448 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1449
1450 goto ResumeExecution;
1451 }
1452
1453 Log(("Forward #NM fault to the guest\n"));
1454 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
1455
1456 Event.au64[0] = 0;
1457 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1458 Event.n.u1Valid = 1;
1459 Event.n.u8Vector = X86_XCPT_NM;
1460
1461 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1462 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1463 goto ResumeExecution;
1464 }
1465
1466 case X86_XCPT_PF: /* Page fault */
1467 {
1468 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1469 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1470
1471#ifdef DEBUG
1472 if (pVM->hwaccm.s.fNestedPaging)
1473 { /* A genuine pagefault.
1474 * Forward the trap to the guest by injecting the exception and resuming execution.
1475 */
1476 Log(("Guest page fault at %04X:%RGv cr2=%RGv error code %x rsp=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
1477 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1478
1479 /* Now we must update CR2. */
1480 pCtx->cr2 = uFaultAddress;
1481
1482 Event.au64[0] = 0;
1483 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1484 Event.n.u1Valid = 1;
1485 Event.n.u8Vector = X86_XCPT_PF;
1486 Event.n.u1ErrorCodeValid = 1;
1487 Event.n.u32ErrorCode = errCode;
1488
1489 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1490
1491 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1492 goto ResumeExecution;
1493 }
1494#endif
1495 Assert(!pVM->hwaccm.s.fNestedPaging);
1496
1497#if 0
1498 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1499 if ( (uFaultAddress & 0xfff) == 0x080
1500 && pVM->hwaccm.s.fHasIoApic
1501 && !(errCode & X86_TRAP_PF_P) /* not present */
1502 && !CPUMIsGuestInLongModeEx(pCtx))
1503 {
1504 RTGCPHYS GCPhysApicBase, GCPhys;
1505 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1506 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1507
1508 rc = PGMGstGetPage(pVCpu, (RTGCPTR)uFaultAddress, NULL, &GCPhys);
1509 if ( rc == VINF_SUCCESS
1510 && GCPhys == GCPhysApicBase)
1511 {
1512 Log(("Replace TPR access at %RGv\n", pCtx->rip));
1513
1514 DISCPUSTATE Cpu;
1515 unsigned cbOp;
1516 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu, &cbOp);
1517 AssertRC(rc);
1518 if ( rc == VINF_SUCCESS
1519 && Cpu.pCurInstr->opcode == OP_MOV
1520 && (cbOp == 5 || cbOp == 6))
1521 {
1522 uint8_t szInstr[15];
1523 if ( (errCode & X86_TRAP_PF_RW)
1524 && Cpu.param1.disp32 == (uint32_t)uFaultAddress
1525 && Cpu.param2.flags == USE_REG_GEN32)
1526 {
1527 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
1528 szInstr[0] = 0xF0;
1529 szInstr[1] = 0x0F;
1530 szInstr[2] = 0x22;
1531 szInstr[3] = 0xC0 | Cpu.param2.base.reg_gen;
1532 for (unsigned i = 4; i < cbOp; i++)
1533 szInstr[i] = 0x90; /* nop */
1534
1535 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, cbOp);
1536 AssertRC(rc);
1537
1538 Log(("Acceptable write candidate!\n"));
1539 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1540 goto ResumeExecution;
1541 }
1542 else
1543 if ( Cpu.param2.disp32 == (uint32_t)uFaultAddress
1544 && Cpu.param1.flags == USE_REG_GEN32)
1545 {
1546 /* 0xF0, 0x0F, 0x20, 0xC0 = mov eax, cr8 */
1547 szInstr[0] = 0xF0;
1548 szInstr[1] = 0x0F;
1549 szInstr[2] = 0x20;
1550 szInstr[3] = 0xC0 | Cpu.param1.base.reg_gen;
1551 for (unsigned i = 4; i < cbOp; i++)
1552 szInstr[i] = 0x90; /* nop */
1553
1554 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, cbOp);
1555 AssertRC(rc);
1556
1557 Log(("Acceptable read candidate!\n"));
1558 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1559 goto ResumeExecution;
1560 }
1561 }
1562 }
1563 }
1564#endif
1565
1566 Log2(("Page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1567 /* Exit qualification contains the linear address of the page fault. */
1568 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1569 TRPMSetErrorCode(pVCpu, errCode);
1570 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1571
1572 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1573 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1574 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1575 if (rc == VINF_SUCCESS)
1576 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1577 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1578 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1579
1580 TRPMResetTrap(pVCpu);
1581
1582 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1583 goto ResumeExecution;
1584 }
1585 else
1586 if (rc == VINF_EM_RAW_GUEST_TRAP)
1587 { /* A genuine pagefault.
1588 * Forward the trap to the guest by injecting the exception and resuming execution.
1589 */
1590 Log2(("Forward page fault to the guest\n"));
1591 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1592 /* The error code might have been changed. */
1593 errCode = TRPMGetErrorCode(pVCpu);
1594
1595 TRPMResetTrap(pVCpu);
1596
1597 /* Now we must update CR2. */
1598 pCtx->cr2 = uFaultAddress;
1599
1600 Event.au64[0] = 0;
1601 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1602 Event.n.u1Valid = 1;
1603 Event.n.u8Vector = X86_XCPT_PF;
1604 Event.n.u1ErrorCodeValid = 1;
1605 Event.n.u32ErrorCode = errCode;
1606
1607 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1608
1609 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1610 goto ResumeExecution;
1611 }
1612#ifdef VBOX_STRICT
1613 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
1614 LogFlow(("PGMTrap0eHandler failed with %d\n", rc));
1615#endif
1616 /* Need to go back to the recompiler to emulate the instruction. */
1617 TRPMResetTrap(pVCpu);
1618 break;
1619 }
1620
1621 case X86_XCPT_MF: /* Floating point exception. */
1622 {
1623 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
1624 if (!(pCtx->cr0 & X86_CR0_NE))
1625 {
1626 /* old style FPU error reporting needs some extra work. */
1627 /** @todo don't fall back to the recompiler, but do it manually. */
1628 rc = VINF_EM_RAW_EMULATE_INSTR;
1629 break;
1630 }
1631 Log(("Trap %x at %RGv\n", vector, (RTGCPTR)pCtx->rip));
1632
1633 Event.au64[0] = 0;
1634 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1635 Event.n.u1Valid = 1;
1636 Event.n.u8Vector = X86_XCPT_MF;
1637
1638 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1639
1640 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1641 goto ResumeExecution;
1642 }
1643
1644#ifdef VBOX_STRICT
1645 case X86_XCPT_GP: /* General protection failure exception.*/
1646 case X86_XCPT_UD: /* Unknown opcode exception. */
1647 case X86_XCPT_DE: /* Divide error. */
1648 case X86_XCPT_SS: /* Stack segment exception. */
1649 case X86_XCPT_NP: /* Segment not present exception. */
1650 {
1651 Event.au64[0] = 0;
1652 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1653 Event.n.u1Valid = 1;
1654 Event.n.u8Vector = vector;
1655
1656 switch(vector)
1657 {
1658 case X86_XCPT_GP:
1659 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
1660 Event.n.u1ErrorCodeValid = 1;
1661 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1662 break;
1663 case X86_XCPT_DE:
1664 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
1665 break;
1666 case X86_XCPT_UD:
1667 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
1668 break;
1669 case X86_XCPT_SS:
1670 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
1671 Event.n.u1ErrorCodeValid = 1;
1672 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1673 break;
1674 case X86_XCPT_NP:
1675 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
1676 Event.n.u1ErrorCodeValid = 1;
1677 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1678 break;
1679 }
1680 Log(("Trap %x at %04x:%RGv esi=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, pCtx->esi));
1681 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1682
1683 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1684 goto ResumeExecution;
1685 }
1686#endif
1687 default:
1688 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1689 rc = VERR_EM_INTERNAL_ERROR;
1690 break;
1691
1692 } /* switch (vector) */
1693 break;
1694 }
1695
1696 case SVM_EXIT_NPF:
1697 {
1698 /* EXITINFO1 contains fault errorcode; EXITINFO2 contains the guest physical address causing the fault. */
1699 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1700 RTGCPHYS uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1701 PGMMODE enmShwPagingMode;
1702
1703 Assert(pVM->hwaccm.s.fNestedPaging);
1704 LogFlow(("Nested page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1705
1706#if 0
1707 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1708 if ( (uFaultAddress & 0xfff) == 0x080
1709 && pVM->hwaccm.s.fHasIoApic
1710 && !(errCode & X86_TRAP_PF_P) /* not present */
1711 && CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx)) == 0
1712 && !CPUMIsGuestInLongModeEx(pCtx))
1713 {
1714 RTGCPHYS GCPhysApicBase;
1715 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1716 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1717
1718 if (uFaultAddress == GCPhysApicBase + 0x80)
1719 {
1720 rc = svmR0ReplaceTprInstr(pVM, pVCpu, pCtx);
1721 if (rc == VINF_SUCCESS)
1722 {
1723 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1724 goto ResumeExecution;
1725 }
1726
1727 rc = IOMMMIOPhysHandler(pVM, errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1728 if (rc == VINF_SUCCESS)
1729 {
1730 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1731 goto ResumeExecution; /* rip already updated */
1732 }
1733 }
1734 }
1735#endif
1736
1737 /* Exit qualification contains the linear address of the page fault. */
1738 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1739 TRPMSetErrorCode(pVCpu, errCode);
1740 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1741
1742 /* Handle the pagefault trap for the nested shadow table. */
1743#if HC_ARCH_BITS == 32
1744 if (CPUMIsGuestInLongModeEx(pCtx))
1745 enmShwPagingMode = PGMMODE_AMD64_NX;
1746 else
1747#endif
1748 enmShwPagingMode = PGMGetHostMode(pVM);
1749
1750 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, enmShwPagingMode, errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1751 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1752 if (rc == VINF_SUCCESS)
1753 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1754 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1755 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1756
1757 TRPMResetTrap(pVCpu);
1758
1759 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1760 goto ResumeExecution;
1761 }
1762
1763#ifdef VBOX_STRICT
1764 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1765 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
1766#endif
1767 /* Need to go back to the recompiler to emulate the instruction. */
1768 TRPMResetTrap(pVCpu);
1769 break;
1770 }
1771
1772 case SVM_EXIT_VINTR:
1773 /* A virtual interrupt is about to be delivered, which means IF=1. */
1774 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1775 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1776 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1777 goto ResumeExecution;
1778
1779 case SVM_EXIT_FERR_FREEZE:
1780 case SVM_EXIT_INTR:
1781 case SVM_EXIT_NMI:
1782 case SVM_EXIT_SMI:
1783 case SVM_EXIT_INIT:
1784 /* External interrupt; leave to allow it to be dispatched again. */
1785 rc = VINF_EM_RAW_INTERRUPT;
1786 break;
1787
1788 case SVM_EXIT_WBINVD:
1789 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1790 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
1791 /* Skip instruction and continue directly. */
1792 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1793 /* Continue execution.*/
1794 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1795 goto ResumeExecution;
1796
1797 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1798 {
1799 Log2(("SVM: Cpuid at %RGv for %x\n", (RTGCPTR)pCtx->rip, pCtx->eax));
1800 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
1801 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1802 if (rc == VINF_SUCCESS)
1803 {
1804 /* Update EIP and continue execution. */
1805 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1806 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1807 goto ResumeExecution;
1808 }
1809 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
1810 rc = VINF_EM_RAW_EMULATE_INSTR;
1811 break;
1812 }
1813
1814 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1815 {
1816 Log2(("SVM: Rdtsc\n"));
1817 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1818 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1819 if (rc == VINF_SUCCESS)
1820 {
1821 /* Update EIP and continue execution. */
1822 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1823 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1824 goto ResumeExecution;
1825 }
1826 rc = VINF_EM_RAW_EMULATE_INSTR;
1827 break;
1828 }
1829
1830 case SVM_EXIT_RDPMC: /* Guest software attempted to execute RDPMC. */
1831 {
1832 Log2(("SVM: Rdpmc %x\n", pCtx->ecx));
1833 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdpmc);
1834 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1835 if (rc == VINF_SUCCESS)
1836 {
1837 /* Update EIP and continue execution. */
1838 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1839 goto ResumeExecution;
1840 }
1841 rc = VINF_EM_RAW_EMULATE_INSTR;
1842 break;
1843 }
1844
1845 case SVM_EXIT_RDTSCP: /* Guest software attempted to execute RDTSCP. */
1846 {
1847 Log2(("SVM: Rdtscp\n"));
1848 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1849 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
1850 if (rc == VINF_SUCCESS)
1851 {
1852 /* Update EIP and continue execution. */
1853 pCtx->rip += 3; /* Note! hardcoded opcode size! */
1854 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1855 goto ResumeExecution;
1856 }
1857 AssertMsgFailed(("EMU: rdtscp failed with %Rrc\n", rc));
1858 rc = VINF_EM_RAW_EMULATE_INSTR;
1859 break;
1860 }
1861
1862 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1863 {
1864 Log2(("SVM: invlpg\n"));
1865 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
1866
1867 Assert(!pVM->hwaccm.s.fNestedPaging);
1868
1869 /* Truly a pita. Why can't SVM give the same information as VT-x? */
1870 rc = svmR0InterpretInvpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1871 if (rc == VINF_SUCCESS)
1872 {
1873 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushPageInvlpg);
1874 goto ResumeExecution; /* eip already updated */
1875 }
1876 break;
1877 }
1878
1879 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1880 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1881 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1882 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1883 {
1884 uint32_t cbSize;
1885
1886 Log2(("SVM: %RGv mov cr%d, \n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_CR0));
1887 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite[exitCode - SVM_EXIT_WRITE_CR0]);
1888 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1889
1890 switch (exitCode - SVM_EXIT_WRITE_CR0)
1891 {
1892 case 0:
1893 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1894 break;
1895 case 2:
1896 break;
1897 case 3:
1898 Assert(!pVM->hwaccm.s.fNestedPaging);
1899 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1900 break;
1901 case 4:
1902 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1903 break;
1904 case 8:
1905 break;
1906 default:
1907 AssertFailed();
1908 }
1909 /* Check if a sync operation is pending. */
1910 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1911 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1912 {
1913 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1914 AssertRC(rc);
1915
1916 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBCRxChange);
1917
1918 /* Must be set by PGMSyncCR3 */
1919 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 || PGMGetGuestMode(pVCpu) <= PGMMODE_PROTECTED || pVCpu->hwaccm.s.fForceTLBFlush,
1920 ("rc=%Rrc mode=%d fForceTLBFlush=%RTbool\n", rc, PGMGetGuestMode(pVCpu), pVCpu->hwaccm.s.fForceTLBFlush));
1921 }
1922 if (rc == VINF_SUCCESS)
1923 {
1924 /* EIP has been updated already. */
1925
1926 /* Only resume if successful. */
1927 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1928 goto ResumeExecution;
1929 }
1930 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1931 break;
1932 }
1933
1934 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
1935 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
1936 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
1937 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
1938 {
1939 uint32_t cbSize;
1940
1941 Log2(("SVM: %RGv mov x, cr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_CR0));
1942 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead[exitCode - SVM_EXIT_READ_CR0]);
1943 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1944 if (rc == VINF_SUCCESS)
1945 {
1946 /* EIP has been updated already. */
1947
1948 /* Only resume if successful. */
1949 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1950 goto ResumeExecution;
1951 }
1952 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1953 break;
1954 }
1955
1956 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
1957 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
1958 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
1959 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
1960 {
1961 uint32_t cbSize;
1962
1963 Log2(("SVM: %RGv mov dr%d, x\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_DR0));
1964 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
1965
1966 if (!DBGFIsStepping(pVCpu))
1967 {
1968 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
1969
1970 /* Disable drx move intercepts. */
1971 pVMCB->ctrl.u16InterceptRdDRx = 0;
1972 pVMCB->ctrl.u16InterceptWrDRx = 0;
1973
1974 /* Save the host and load the guest debug state. */
1975 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
1976 AssertRC(rc);
1977
1978 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1979 goto ResumeExecution;
1980 }
1981
1982 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1983 if (rc == VINF_SUCCESS)
1984 {
1985 /* EIP has been updated already. */
1986 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
1987
1988 /* Only resume if successful. */
1989 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1990 goto ResumeExecution;
1991 }
1992 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1993 break;
1994 }
1995
1996 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
1997 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
1998 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
1999 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
2000 {
2001 uint32_t cbSize;
2002
2003 Log2(("SVM: %RGv mov x, dr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_DR0));
2004 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2005
2006 if (!DBGFIsStepping(pVCpu))
2007 {
2008 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2009
2010 /* Disable drx move intercepts. */
2011 pVMCB->ctrl.u16InterceptRdDRx = 0;
2012 pVMCB->ctrl.u16InterceptWrDRx = 0;
2013
2014 /* Save the host and load the guest debug state. */
2015 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
2016 AssertRC(rc);
2017
2018 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2019 goto ResumeExecution;
2020 }
2021
2022 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2023 if (rc == VINF_SUCCESS)
2024 {
2025 /* EIP has been updated already. */
2026
2027 /* Only resume if successful. */
2028 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2029 goto ResumeExecution;
2030 }
2031 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2032 break;
2033 }
2034
2035 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2036 case SVM_EXIT_IOIO: /* I/O instruction. */
2037 {
2038 SVM_IOIO_EXIT IoExitInfo;
2039 uint32_t uIOSize, uAndVal;
2040
2041 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
2042
2043 /** @todo could use a lookup table here */
2044 if (IoExitInfo.n.u1OP8)
2045 {
2046 uIOSize = 1;
2047 uAndVal = 0xff;
2048 }
2049 else
2050 if (IoExitInfo.n.u1OP16)
2051 {
2052 uIOSize = 2;
2053 uAndVal = 0xffff;
2054 }
2055 else
2056 if (IoExitInfo.n.u1OP32)
2057 {
2058 uIOSize = 4;
2059 uAndVal = 0xffffffff;
2060 }
2061 else
2062 {
2063 AssertFailed(); /* should be fatal. */
2064 rc = VINF_EM_RAW_EMULATE_INSTR;
2065 break;
2066 }
2067
2068 if (IoExitInfo.n.u1STR)
2069 {
2070 /* ins/outs */
2071 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2072
2073 /* Disassemble manually to deal with segment prefixes. */
2074 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, NULL);
2075 if (rc == VINF_SUCCESS)
2076 {
2077 if (IoExitInfo.n.u1Type == 0)
2078 {
2079 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2080 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2081 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2082 }
2083 else
2084 {
2085 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2086 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2087 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2088 }
2089 }
2090 else
2091 rc = VINF_EM_RAW_EMULATE_INSTR;
2092 }
2093 else
2094 {
2095 /* normal in/out */
2096 Assert(!IoExitInfo.n.u1REP);
2097
2098 if (IoExitInfo.n.u1Type == 0)
2099 {
2100 Log2(("IOMIOPortWrite %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
2101 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2102 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
2103 }
2104 else
2105 {
2106 uint32_t u32Val = 0;
2107
2108 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2109 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
2110 if (IOM_SUCCESS(rc))
2111 {
2112 /* Write back to the EAX register. */
2113 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2114 Log2(("IOMIOPortRead %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
2115 }
2116 }
2117 }
2118 /*
2119 * Handled the I/O return codes.
2120 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2121 */
2122 if (IOM_SUCCESS(rc))
2123 {
2124 /* Update EIP and continue execution. */
2125 pCtx->rip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
2126 if (RT_LIKELY(rc == VINF_SUCCESS))
2127 {
2128 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2129 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2130 {
2131 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2132 for (unsigned i=0;i<4;i++)
2133 {
2134 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2135
2136 if ( (IoExitInfo.n.u16Port >= pCtx->dr[i] && IoExitInfo.n.u16Port < pCtx->dr[i] + uBPLen)
2137 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2138 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2139 {
2140 SVM_EVENT Event;
2141
2142 Assert(CPUMIsGuestDebugStateActive(pVCpu));
2143
2144 /* Clear all breakpoint status flags and set the one we just hit. */
2145 pCtx->dr[6] &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2146 pCtx->dr[6] |= (uint64_t)RT_BIT(i);
2147
2148 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2149 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2150 * the contents have been read.
2151 */
2152 pVMCB->guest.u64DR6 = pCtx->dr[6];
2153
2154 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2155 pCtx->dr[7] &= ~X86_DR7_GD;
2156
2157 /* Paranoia. */
2158 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2159 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2160 pCtx->dr[7] |= 0x400; /* must be one */
2161
2162 pVMCB->guest.u64DR7 = pCtx->dr[7];
2163
2164 /* Inject the exception. */
2165 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2166
2167 Event.au64[0] = 0;
2168 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
2169 Event.n.u1Valid = 1;
2170 Event.n.u8Vector = X86_XCPT_DB;
2171
2172 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2173
2174 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2175 goto ResumeExecution;
2176 }
2177 }
2178 }
2179
2180 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2181 goto ResumeExecution;
2182 }
2183 Log2(("EM status from IO at %RGv %x size %d: %Rrc\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize, rc));
2184 break;
2185 }
2186
2187#ifdef VBOX_STRICT
2188 if (rc == VINF_IOM_HC_IOPORT_READ)
2189 Assert(IoExitInfo.n.u1Type != 0);
2190 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2191 Assert(IoExitInfo.n.u1Type == 0);
2192 else
2193 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2194#endif
2195 Log2(("Failed IO at %RGv %x size %d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2196 break;
2197 }
2198
2199 case SVM_EXIT_HLT:
2200 /** Check if external interrupts are pending; if so, don't switch back. */
2201 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitHlt);
2202 pCtx->rip++; /* skip hlt */
2203 if ( pCtx->eflags.Bits.u1IF
2204 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2205 goto ResumeExecution;
2206
2207 rc = VINF_EM_HALT;
2208 break;
2209
2210 case SVM_EXIT_MWAIT_UNCOND:
2211 Log2(("SVM: mwait\n"));
2212 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMwait);
2213 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
2214 if ( rc == VINF_EM_HALT
2215 || rc == VINF_SUCCESS)
2216 {
2217 /* Update EIP and continue execution. */
2218 pCtx->rip += 3; /* Note: hardcoded opcode size assumption! */
2219
2220 /** Check if external interrupts are pending; if so, don't switch back. */
2221 if ( rc == VINF_SUCCESS
2222 || ( rc == VINF_EM_HALT
2223 && pCtx->eflags.Bits.u1IF
2224 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2225 )
2226 goto ResumeExecution;
2227 }
2228 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", rc));
2229 break;
2230
2231 case SVM_EXIT_RSM:
2232 case SVM_EXIT_INVLPGA:
2233 case SVM_EXIT_VMRUN:
2234 case SVM_EXIT_VMMCALL:
2235 case SVM_EXIT_VMLOAD:
2236 case SVM_EXIT_VMSAVE:
2237 case SVM_EXIT_STGI:
2238 case SVM_EXIT_CLGI:
2239 case SVM_EXIT_SKINIT:
2240 {
2241 /* Unsupported instructions. */
2242 SVM_EVENT Event;
2243
2244 Event.au64[0] = 0;
2245 Event.n.u3Type = SVM_EVENT_EXCEPTION;
2246 Event.n.u1Valid = 1;
2247 Event.n.u8Vector = X86_XCPT_UD;
2248
2249 Log(("Forced #UD trap at %RGv\n", (RTGCPTR)pCtx->rip));
2250 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2251
2252 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2253 goto ResumeExecution;
2254 }
2255
2256 /* Emulate in ring 3. */
2257 case SVM_EXIT_MSR:
2258 {
2259 uint32_t cbSize;
2260
2261 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2262 STAM_COUNTER_INC((pVMCB->ctrl.u64ExitInfo1 == 0) ? &pVCpu->hwaccm.s.StatExitRdmsr : &pVCpu->hwaccm.s.StatExitWrmsr);
2263 Log(("SVM: %s\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr"));
2264 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2265 if (rc == VINF_SUCCESS)
2266 {
2267 /* EIP has been updated already. */
2268
2269 /* Only resume if successful. */
2270 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2271 goto ResumeExecution;
2272 }
2273 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr", rc));
2274 break;
2275 }
2276
2277 case SVM_EXIT_MONITOR:
2278 case SVM_EXIT_PAUSE:
2279 case SVM_EXIT_MWAIT_ARMED:
2280 case SVM_EXIT_TASK_SWITCH: /* can change CR3; emulate */
2281 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2282 break;
2283
2284 case SVM_EXIT_SHUTDOWN:
2285 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2286 break;
2287
2288 case SVM_EXIT_IDTR_READ:
2289 case SVM_EXIT_GDTR_READ:
2290 case SVM_EXIT_LDTR_READ:
2291 case SVM_EXIT_TR_READ:
2292 case SVM_EXIT_IDTR_WRITE:
2293 case SVM_EXIT_GDTR_WRITE:
2294 case SVM_EXIT_LDTR_WRITE:
2295 case SVM_EXIT_TR_WRITE:
2296 case SVM_EXIT_CR0_SEL_WRITE:
2297 default:
2298 /* Unexpected exit codes. */
2299 rc = VERR_EM_INTERNAL_ERROR;
2300 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
2301 break;
2302 }
2303
2304end:
2305
2306 /* Signal changes for the recompiler. */
2307 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2308
2309 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
2310 if (exitCode == SVM_EXIT_INTR)
2311 {
2312 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2313 /* On the next entry we'll only sync the host context. */
2314 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2315 }
2316 else
2317 {
2318 /* On the next entry we'll sync everything. */
2319 /** @todo we can do better than this */
2320 /* Not in the VINF_PGM_CHANGE_MODE though! */
2321 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2322 }
2323
2324 /* translate into a less severe return code */
2325 if (rc == VERR_EM_INTERPRETER)
2326 rc = VINF_EM_RAW_EMULATE_INSTR;
2327
2328 /* Just set the correct state here instead of trying to catch every goto above. */
2329 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
2330
2331#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2332 /* Restore interrupts if we exitted after disabling them. */
2333 if (uOldEFlags != ~(RTCCUINTREG)0)
2334 ASMSetFlags(uOldEFlags);
2335#endif
2336
2337 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2338 return rc;
2339}
2340
2341/**
2342 * Emulate simple mov tpr instruction
2343 *
2344 * @returns VBox status code.
2345 * @param pVCpu The VM CPU to operate on.
2346 * @param pDis Disassembly state
2347 * @param pCtx CPU context
2348 * @param cbOp Opcode size
2349 */
2350static int svmR0EmulateTprMov(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTX pCtx, unsigned cbOp)
2351{
2352 int rc;
2353
2354 if (pDis->param1.flags == USE_DISPLACEMENT32)
2355 {
2356 /* write */
2357 uint8_t u8Tpr;
2358
2359 /* Fetch the new TPR value */
2360 if (pDis->param2.flags == USE_REG_GEN32)
2361 {
2362 uint32_t val;
2363
2364 rc = DISFetchReg32(CPUMCTX2CORE(pCtx), pDis->param2.base.reg_gen, &val);
2365 AssertRC(rc);
2366 u8Tpr = val;
2367 }
2368 else
2369 if (pDis->param2.flags == USE_IMMEDIATE32)
2370 {
2371 u8Tpr = (uint8_t)pDis->param2.parval;
2372 }
2373 else
2374 return VERR_EM_INTERPRETER;
2375
2376 rc = PDMApicSetTPR(pVCpu, u8Tpr);
2377 AssertRC(rc);
2378
2379 Log(("Emulated write successfully\n"));
2380 pCtx->rip += cbOp;
2381 return VINF_SUCCESS;
2382 }
2383 else
2384 if (pDis->param2.flags == USE_DISPLACEMENT32)
2385 {
2386 /* read */
2387 bool fPending;
2388 uint8_t u8Tpr;
2389
2390 /* TPR caching in CR8 */
2391 rc = PDMApicGetTPR(pVCpu, &u8Tpr, &fPending);
2392 AssertRC(rc);
2393
2394 rc = DISWriteReg32(CPUMCTX2CORE(pCtx), pDis->param1.base.reg_gen, u8Tpr);
2395 AssertRC(rc);
2396
2397 Log(("Emulated read successfully\n"));
2398 pCtx->rip += cbOp;
2399 return VINF_SUCCESS;
2400 }
2401 return VERR_EM_INTERPRETER;
2402}
2403
2404/**
2405 * Attempt to patch TPR mmio instructions
2406 *
2407 * @returns VBox status code.
2408 * @param pVM The VM to operate on.
2409 * @param pVCpu The VM CPU to operate on.
2410 * @param pCtx CPU context
2411 */
2412static int svmR0ReplaceTprInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2413{
2414 RTGCPTR oldrip = pCtx->rip;
2415 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2416 unsigned cbOp;
2417
2418 Log(("Replace TPR access at %RGv\n", pCtx->rip));
2419
2420 int rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2421 AssertRC(rc);
2422 if ( rc == VINF_SUCCESS
2423 && pDis->pCurInstr->opcode == OP_MOV)
2424 {
2425#if 0
2426 uint8_t szInstr[15];
2427 if ( cbOp == 10
2428 && pDis->param1.flags == USE_DISPLACEMENT32
2429 && pDis->param2.flags == USE_IMMEDIATE32)
2430 {
2431 /* Found:
2432 * mov [fffe0080], immediate_dword (10 bytes)
2433 *
2434 * Replace with:
2435 * mov free_register, immediate_dword >> 4 (5 bytes)
2436 * mov cr8, free_register (4 bytes)
2437 * nop (1 byte)
2438 *
2439 */
2440 uint32_t u32tpr = (uint32_t)pDis->param2.parval;
2441
2442 u32tpr = (u32tpr >> 4) & 0xf;
2443
2444 /* Check if the next instruction overwrites a general purpose register. If
2445 * it does, then we can safely use it ourselves.
2446 */
2447 pCtx->rip += cbOp;
2448 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2449 pCtx->rip = oldrip;
2450 if ( rc == VINF_SUCCESS
2451 && pDis->pCurInstr->opcode == OP_MOV
2452 && pDis->param1.flags == USE_REG_GEN32)
2453 {
2454 /* 0xB8, dword immediate = mov eax, dword immediate */
2455 szInstr[0] = 0xB8 + pDis->param1.base.reg_gen;
2456 szInstr[1] = (uint8_t)u32tpr;
2457 szInstr[2] = 0;
2458 szInstr[3] = 0;
2459 szInstr[4] = 0;
2460
2461 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
2462 szInstr[5] = 0xF0;
2463 szInstr[6] = 0x0F;
2464 szInstr[7] = 0x22;
2465 szInstr[8] = 0xC0 | pDis->param1.base.reg_gen;
2466 szInstr[9] = 0x90; /* nop */
2467
2468 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 10);
2469 AssertRC(rc);
2470
2471 Log(("Acceptable write candidate!\n"));
2472 return VINF_SUCCESS;
2473 }
2474 }
2475 else
2476 {
2477 if ( pDis->param2.flags == USE_REG_GEN32
2478 && cbOp == 6)
2479 {
2480 RTGCPTR GCPtrTpr = (uint32_t)pDis->param1.disp32;
2481 uint32_t uMmioReg = pDis->param2.base.reg_gen;
2482
2483 /* Found:
2484 * mov dword [fffe0080], eax (6 bytes)
2485 * Check if next instruction is a TPR read:
2486 * mov ecx, dword [fffe0080] (5 bytes)
2487 */
2488 pCtx->rip += cbOp;
2489 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2490 pCtx->rip = oldrip;
2491 if ( rc == VINF_SUCCESS
2492 && pDis->pCurInstr->opcode == OP_MOV
2493 && pDis->param1.flags == USE_REG_GEN32
2494 && pDis->param2.flags == USE_DISPLACEMENT32
2495 && pDis->param2.disp32 == (uint32_t)GCPtrTpr
2496 && cbOp == 5)
2497 {
2498 /* mov new_reg, uMmioReg */
2499 szInstr[0] = 0x89;
2500 szInstr[1] = MAKE_MODRM(3, uMmioReg, pDis->param1.base.reg_gen);
2501
2502 /* Let's hope the guest won't mind us trashing the source register...
2503 * shr uMmioReg, 4
2504 */
2505 szInstr[2] = 0xC1;
2506 szInstr[3] = 0xE8 | uMmioReg;
2507 szInstr[4] = 4;
2508
2509 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
2510 szInstr[5] = 0xF0;
2511 szInstr[6] = 0x0F;
2512 szInstr[7] = 0x22;
2513 szInstr[8] = 0xC0 | uMmioReg;
2514
2515 /* Two nop instructions */
2516 szInstr[9] = 0x90;
2517 szInstr[10] = 0x90;
2518
2519 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 6+cbOp);
2520 AssertRC(rc);
2521
2522 Log(("Acceptable read/write candidate!\n"));
2523 return VINF_SUCCESS;
2524 }
2525 }
2526 else
2527 if ( pDis->param1.flags == USE_REG_GEN32
2528 && cbOp == 5)
2529 {
2530 uint32_t uMmioReg = pDis->param1.base.reg_gen;
2531
2532 /* Found:
2533 * mov eax, dword [fffe0080] (5 bytes)
2534 * Check if next instruction is:
2535 * shr eax, 4
2536 */
2537 pCtx->rip += cbOp;
2538 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2539 pCtx->rip = oldrip;
2540 if ( rc == VINF_SUCCESS
2541 && pDis->pCurInstr->opcode == OP_SHR
2542 && pDis->param1.flags == USE_REG_GEN32
2543 && pDis->param1.base.reg_gen == uMmioReg
2544 && pDis->param2.flags == USE_IMMEDIATE8
2545 && pDis->param2.parval == 4)
2546 {
2547 /* 0xF0, 0x0F, 0x20, 0xC0 = mov eax, cr8 */
2548 szInstr[0] = 0xF0;
2549 szInstr[1] = 0x0F;
2550 szInstr[2] = 0x20;
2551 szInstr[3] = 0xC0 | pDis->param1.base.reg_gen;
2552 for (unsigned i = 4; i < 5+cbOp; i++)
2553 szInstr[i] = 0x90; /* nop */
2554
2555 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 5+cbOp);
2556 AssertRC(rc);
2557
2558 Log(("Acceptable read candidate!\n"));
2559 return VINF_SUCCESS;
2560 }
2561 }
2562 }
2563#endif
2564 rc = svmR0EmulateTprMov(pVCpu, pDis, pCtx, cbOp);
2565 if (rc != VINF_SUCCESS)
2566 return rc;
2567
2568 /* Emulated successfully, so continue. */
2569 return VINF_SUCCESS;
2570 }
2571 return VERR_ACCESS_DENIED;
2572}
2573
2574/**
2575 * Enters the AMD-V session
2576 *
2577 * @returns VBox status code.
2578 * @param pVM The VM to operate on.
2579 * @param pVCpu The VM CPU to operate on.
2580 * @param pCpu CPU info struct
2581 */
2582VMMR0DECL(int) SVMR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
2583{
2584 Assert(pVM->hwaccm.s.svm.fSupported);
2585
2586 LogFlow(("SVMR0Enter cpu%d last=%d asid=%d\n", pCpu->idCpu, pVCpu->hwaccm.s.idLastCpu, pVCpu->hwaccm.s.uCurrentASID));
2587 pVCpu->hwaccm.s.fResumeVM = false;
2588
2589 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
2590 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
2591
2592 return VINF_SUCCESS;
2593}
2594
2595
2596/**
2597 * Leaves the AMD-V session
2598 *
2599 * @returns VBox status code.
2600 * @param pVM The VM to operate on.
2601 * @param pVCpu The VM CPU to operate on.
2602 * @param pCtx CPU context
2603 */
2604VMMR0DECL(int) SVMR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2605{
2606 SVM_VMCB *pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
2607
2608 Assert(pVM->hwaccm.s.svm.fSupported);
2609
2610 /* Save the guest debug state if necessary. */
2611 if (CPUMIsGuestDebugStateActive(pVCpu))
2612 {
2613 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, false /* skip DR6 */);
2614
2615 /* Intercept all DRx reads and writes again. Changed later on. */
2616 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
2617 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
2618
2619 /* Resync the debug registers the next time. */
2620 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2621 }
2622 else
2623 Assert(pVMCB->ctrl.u16InterceptRdDRx == 0xFFFF && pVMCB->ctrl.u16InterceptWrDRx == 0xFFFF);
2624
2625 return VINF_SUCCESS;
2626}
2627
2628
2629static int svmR0InterpretInvlPg(PVMCPU pVCpu, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2630{
2631 OP_PARAMVAL param1;
2632 RTGCPTR addr;
2633
2634 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2635 if(RT_FAILURE(rc))
2636 return VERR_EM_INTERPRETER;
2637
2638 switch(param1.type)
2639 {
2640 case PARMTYPE_IMMEDIATE:
2641 case PARMTYPE_ADDRESS:
2642 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
2643 return VERR_EM_INTERPRETER;
2644 addr = param1.val.val64;
2645 break;
2646
2647 default:
2648 return VERR_EM_INTERPRETER;
2649 }
2650
2651 /** @todo is addr always a flat linear address or ds based
2652 * (in absence of segment override prefixes)????
2653 */
2654 rc = PGMInvalidatePage(pVCpu, addr);
2655 if (RT_SUCCESS(rc))
2656 {
2657 /* Manually invalidate the page for the VM's TLB. */
2658 Log(("SVMR0InvlpgA %RGv ASID=%d\n", addr, uASID));
2659 SVMR0InvlpgA(addr, uASID);
2660 return VINF_SUCCESS;
2661 }
2662 AssertRC(rc);
2663 return rc;
2664}
2665
2666/**
2667 * Interprets INVLPG
2668 *
2669 * @returns VBox status code.
2670 * @retval VINF_* Scheduling instructions.
2671 * @retval VERR_EM_INTERPRETER Something we can't cope with.
2672 * @retval VERR_* Fatal errors.
2673 *
2674 * @param pVM The VM handle.
2675 * @param pRegFrame The register frame.
2676 * @param ASID Tagged TLB id for the guest
2677 *
2678 * Updates the EIP if an instruction was executed successfully.
2679 */
2680static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2681{
2682 /*
2683 * Only allow 32 & 64 bits code.
2684 */
2685 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
2686 if (enmMode != CPUMODE_16BIT)
2687 {
2688 RTGCPTR pbCode;
2689 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->rip, &pbCode);
2690 if (RT_SUCCESS(rc))
2691 {
2692 uint32_t cbOp;
2693 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2694
2695 pDis->mode = enmMode;
2696 rc = EMInterpretDisasOneEx(pVM, pVCpu, pbCode, pRegFrame, pDis, &cbOp);
2697 Assert(RT_FAILURE(rc) || pDis->pCurInstr->opcode == OP_INVLPG);
2698 if (RT_SUCCESS(rc) && pDis->pCurInstr->opcode == OP_INVLPG)
2699 {
2700 Assert(cbOp == pDis->opsize);
2701 rc = svmR0InterpretInvlPg(pVCpu, pDis, pRegFrame, uASID);
2702 if (RT_SUCCESS(rc))
2703 {
2704 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
2705 }
2706 return rc;
2707 }
2708 }
2709 }
2710 return VERR_EM_INTERPRETER;
2711}
2712
2713
2714/**
2715 * Invalidates a guest page
2716 *
2717 * @returns VBox status code.
2718 * @param pVM The VM to operate on.
2719 * @param pVCpu The VM CPU to operate on.
2720 * @param GCVirt Page to invalidate
2721 */
2722VMMR0DECL(int) SVMR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
2723{
2724 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVCpu->hwaccm.s.fForceTLBFlush;
2725
2726 /* Skip it if a TLB flush is already pending. */
2727 if (!fFlushPending)
2728 {
2729 SVM_VMCB *pVMCB;
2730
2731 Log2(("SVMR0InvalidatePage %RGv\n", GCVirt));
2732 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2733 Assert(pVM->hwaccm.s.svm.fSupported);
2734
2735 /* @todo SMP */
2736 pVMCB = (SVM_VMCB *)pVM->aCpus[0].hwaccm.s.svm.pVMCB;
2737 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2738
2739#if HC_ARCH_BITS == 32
2740 /* If we get a flush in 64 bits guest mode, then force a full TLB flush. Invlpga takes only 32 bits addresses. */
2741 if (CPUMIsGuestInLongMode(pVCpu))
2742 pVCpu->hwaccm.s.fForceTLBFlush = true;
2743 else
2744#endif
2745 SVMR0InvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2746 }
2747 return VINF_SUCCESS;
2748}
2749
2750
2751#if 0 /* obsolete, but left here for clarification. */
2752/**
2753 * Invalidates a guest page by physical address
2754 *
2755 * @returns VBox status code.
2756 * @param pVM The VM to operate on.
2757 * @param pVCpu The VM CPU to operate on.
2758 * @param GCPhys Page to invalidate
2759 */
2760VMMR0DECL(int) SVMR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2761{
2762 Assert(pVM->hwaccm.s.fNestedPaging);
2763 /* invlpga only invalidates TLB entries for guest virtual addresses; we have no choice but to force a TLB flush here. */
2764 pVCpu->hwaccm.s.fForceTLBFlush = true;
2765 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBInvlpga);
2766 return VINF_SUCCESS;
2767}
2768#endif
2769
2770#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2771/**
2772 * Prepares for and executes VMRUN (64 bits guests from a 32 bits hosts).
2773 *
2774 * @returns VBox status code.
2775 * @param pVMCBHostPhys Physical address of host VMCB.
2776 * @param pVMCBPhys Physical address of the VMCB.
2777 * @param pCtx Guest context.
2778 * @param pVM The VM to operate on.
2779 * @param pVCpu The VMCPU to operate on.
2780 */
2781DECLASM(int) SVMR0VMSwitcherRun64(RTHCPHYS pVMCBHostPhys, RTHCPHYS pVMCBPhys, PCPUMCTX pCtx, PVM pVM, PVMCPU pVCpu)
2782{
2783 uint32_t aParam[4];
2784
2785 aParam[0] = (uint32_t)(pVMCBHostPhys); /* Param 1: pVMCBHostPhys - Lo. */
2786 aParam[1] = (uint32_t)(pVMCBHostPhys >> 32); /* Param 1: pVMCBHostPhys - Hi. */
2787 aParam[2] = (uint32_t)(pVMCBPhys); /* Param 2: pVMCBPhys - Lo. */
2788 aParam[3] = (uint32_t)(pVMCBPhys >> 32); /* Param 2: pVMCBPhys - Hi. */
2789
2790 return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hwaccm.s.pfnSVMGCVMRun64, 4, &aParam[0]);
2791}
2792
2793/**
2794 * Executes the specified handler in 64 mode
2795 *
2796 * @returns VBox status code.
2797 * @param pVM The VM to operate on.
2798 * @param pVCpu The VMCPU to operate on.
2799 * @param pCtx Guest context
2800 * @param pfnHandler RC handler
2801 * @param cbParam Number of parameters
2802 * @param paParam Array of 32 bits parameters
2803 */
2804VMMR0DECL(int) SVMR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam, uint32_t *paParam)
2805{
2806 int rc;
2807 RTHCUINTREG uOldEFlags;
2808
2809 /* @todo This code is not guest SMP safe (hyper stack and switchers) */
2810 AssertReturn(pVM->cCPUs == 1, VERR_TOO_MANY_CPUS);
2811 Assert(pfnHandler);
2812
2813 uOldEFlags = ASMIntDisableFlags();
2814
2815 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVM));
2816 CPUMSetHyperEIP(pVCpu, pfnHandler);
2817 for (int i=(int)cbParam-1;i>=0;i--)
2818 CPUMPushHyper(pVCpu, paParam[i]);
2819
2820 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2821 /* Call switcher. */
2822 rc = pVM->hwaccm.s.pfnHost32ToGuest64R0(pVM);
2823 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2824
2825 ASMSetFlags(uOldEFlags);
2826 return rc;
2827}
2828
2829#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) */
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette