VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 21994

Last change on this file since 21994 was 21988, checked in by vboxsync, 16 years ago

Updates
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 110.4 KB
Line 
1/* $Id: HWSVMR0.cpp 21988 2009-08-05 12:16:49Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include <iprt/time.h>
47#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
48# include <iprt/thread.h>
49#endif
50#include "HWSVMR0.h"
51
52/*******************************************************************************
53* Internal Functions *
54*******************************************************************************/
55static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID);
56static int svmR0EmulateTprVMMCall(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
57static void svmR0SetMSRPermission(PVM pVM, unsigned ulMSR, bool fRead, bool fWrite);
58
59/*******************************************************************************
60* Global Variables *
61*******************************************************************************/
62/* IO operation lookup arrays. */
63static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
64
65/**
66 * Sets up and activates AMD-V on the current CPU
67 *
68 * @returns VBox status code.
69 * @param pCpu CPU info struct
70 * @param pVM The VM to operate on. (can be NULL after a resume!!)
71 * @param pvPageCpu Pointer to the global cpu page
72 * @param pPageCpuPhys Physical address of the global cpu page
73 */
74VMMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
75{
76 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
77 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
78
79 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
80
81#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
82 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
83#endif
84
85 /* Turn on AMD-V in the EFER MSR. */
86 uint64_t val = ASMRdMsr(MSR_K6_EFER);
87 if (!(val & MSR_K6_EFER_SVME))
88 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
89
90 /* Write the physical page address where the CPU will store the host state while executing the VM. */
91 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
92
93 return VINF_SUCCESS;
94}
95
96/**
97 * Deactivates AMD-V on the current CPU
98 *
99 * @returns VBox status code.
100 * @param pCpu CPU info struct
101 * @param pvPageCpu Pointer to the global cpu page
102 * @param pPageCpuPhys Physical address of the global cpu page
103 */
104VMMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
105{
106 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
107 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
108
109#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
110 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
111#endif
112
113 /* Turn off AMD-V in the EFER MSR. */
114 uint64_t val = ASMRdMsr(MSR_K6_EFER);
115 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
116
117 /* Invalidate host state physical address. */
118 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
119
120 return VINF_SUCCESS;
121}
122
123/**
124 * Does Ring-0 per VM AMD-V init.
125 *
126 * @returns VBox status code.
127 * @param pVM The VM to operate on.
128 */
129VMMR0DECL(int) SVMR0InitVM(PVM pVM)
130{
131 int rc;
132
133 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
134 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
135
136 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
137 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
138 if (RT_FAILURE(rc))
139 return rc;
140
141 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
142 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
143 /* Set all bits to intercept all IO accesses. */
144 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
145
146 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
147 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
148 if (RT_FAILURE(rc))
149 return rc;
150
151 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
152 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
153 /* Set all bits to intercept all MSR accesses. */
154 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
155
156 /* Erratum 170 which requires a forced TLB flush for each world switch:
157 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
158 *
159 * All BH-G1/2 and DH-G1/2 models include a fix:
160 * Athlon X2: 0x6b 1/2
161 * 0x68 1/2
162 * Athlon 64: 0x7f 1
163 * 0x6f 2
164 * Sempron: 0x7f 1/2
165 * 0x6f 2
166 * 0x6c 2
167 * 0x7c 2
168 * Turion 64: 0x68 2
169 *
170 */
171 uint32_t u32Dummy;
172 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
173 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
174 u32BaseFamily= (u32Version >> 8) & 0xf;
175 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
176 u32Model = ((u32Version >> 4) & 0xf);
177 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
178 u32Stepping = u32Version & 0xf;
179 if ( u32Family == 0xf
180 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
181 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
182 {
183 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
184 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
185 }
186
187 /* Allocate VMCBs for all guest CPUs. */
188 for (unsigned i=0;i<pVM->cCPUs;i++)
189 {
190 PVMCPU pVCpu = &pVM->aCpus[i];
191
192 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
193 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
194
195 /* Allocate one page for the host context */
196 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
197 if (RT_FAILURE(rc))
198 return rc;
199
200 pVCpu->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCBHost);
201 pVCpu->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 0);
202 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCBHost);
203
204 /* Allocate one page for the VM control block (VMCB). */
205 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
206 if (RT_FAILURE(rc))
207 return rc;
208
209 pVCpu->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCB);
210 pVCpu->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCB, 0);
211 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCB);
212 }
213
214 return VINF_SUCCESS;
215}
216
217/**
218 * Does Ring-0 per VM AMD-V termination.
219 *
220 * @returns VBox status code.
221 * @param pVM The VM to operate on.
222 */
223VMMR0DECL(int) SVMR0TermVM(PVM pVM)
224{
225 for (unsigned i=0;i<pVM->cCPUs;i++)
226 {
227 PVMCPU pVCpu = &pVM->aCpus[i];
228
229 if (pVCpu->hwaccm.s.svm.pMemObjVMCBHost != NIL_RTR0MEMOBJ)
230 {
231 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, false);
232 pVCpu->hwaccm.s.svm.pVMCBHost = 0;
233 pVCpu->hwaccm.s.svm.pVMCBHostPhys = 0;
234 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
235 }
236
237 if (pVCpu->hwaccm.s.svm.pMemObjVMCB != NIL_RTR0MEMOBJ)
238 {
239 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCB, false);
240 pVCpu->hwaccm.s.svm.pVMCB = 0;
241 pVCpu->hwaccm.s.svm.pVMCBPhys = 0;
242 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
243 }
244 }
245 if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
248 pVM->hwaccm.s.svm.pIOBitmap = 0;
249 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
250 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
251 }
252 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
253 {
254 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
255 pVM->hwaccm.s.svm.pMSRBitmap = 0;
256 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
257 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
258 }
259 return VINF_SUCCESS;
260}
261
262/**
263 * Sets up AMD-V for the specified VM
264 *
265 * @returns VBox status code.
266 * @param pVM The VM to operate on.
267 */
268VMMR0DECL(int) SVMR0SetupVM(PVM pVM)
269{
270 int rc = VINF_SUCCESS;
271 SVM_VMCB *pVMCB;
272
273 AssertReturn(pVM, VERR_INVALID_PARAMETER);
274
275 Assert(pVM->hwaccm.s.svm.fSupported);
276
277 for (unsigned i=0;i<pVM->cCPUs;i++)
278 {
279 pVMCB = (SVM_VMCB *)pVM->aCpus[i].hwaccm.s.svm.pVMCB;
280 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
281
282 /* Program the control fields. Most of them never have to be changed again. */
283 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
284 /* Note: CR0 & CR4 can be safely read when guest and shadow copies are identical. */
285 if (!pVM->hwaccm.s.fNestedPaging)
286 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
287 else
288 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(4);
289
290 /*
291 * CR0/3/4 writes must be intercepted for obvious reasons.
292 */
293 if (!pVM->hwaccm.s.fNestedPaging)
294 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
295 else
296 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(4) | RT_BIT(8);
297
298 /* Intercept all DRx reads and writes by default. Changed later on. */
299 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
300 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
301
302 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
303 * All breakpoints are automatically cleared when the VM exits.
304 */
305
306 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
307#ifndef DEBUG
308 if (pVM->hwaccm.s.fNestedPaging)
309 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
310#endif
311
312 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
313 | SVM_CTRL1_INTERCEPT_VINTR
314 | SVM_CTRL1_INTERCEPT_NMI
315 | SVM_CTRL1_INTERCEPT_SMI
316 | SVM_CTRL1_INTERCEPT_INIT
317 | SVM_CTRL1_INTERCEPT_RDPMC
318 | SVM_CTRL1_INTERCEPT_CPUID
319 | SVM_CTRL1_INTERCEPT_RSM
320 | SVM_CTRL1_INTERCEPT_HLT
321 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
322 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
323 | SVM_CTRL1_INTERCEPT_INVLPG
324 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
325 | SVM_CTRL1_INTERCEPT_TASK_SWITCH
326 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
327 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
328 ;
329 /* With nested paging we don't care about invlpg anymore. */
330 if (pVM->hwaccm.s.fNestedPaging)
331 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_INVLPG;
332
333 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
334 | SVM_CTRL2_INTERCEPT_VMMCALL
335 | SVM_CTRL2_INTERCEPT_VMLOAD
336 | SVM_CTRL2_INTERCEPT_VMSAVE
337 | SVM_CTRL2_INTERCEPT_STGI
338 | SVM_CTRL2_INTERCEPT_CLGI
339 | SVM_CTRL2_INTERCEPT_SKINIT
340 | SVM_CTRL2_INTERCEPT_WBINVD
341 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
342 ;
343 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
344 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
345 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
346
347 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
348 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
349 /* Ignore the priority in the TPR; just deliver it when we tell it to. */
350 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1;
351
352 /* Set IO and MSR bitmap addresses. */
353 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
354 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
355
356 /* No LBR virtualization. */
357 pVMCB->ctrl.u64LBRVirt = 0;
358
359 /** The ASID must start at 1; the host uses 0. */
360 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
361
362 /** Setup the PAT msr (nested paging only) */
363 pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
364 }
365
366 /* The following MSRs are saved automatically by vmload/vmsave, so we allow the guest
367 * to modify them directly.
368 */
369 svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, true);
370 svmR0SetMSRPermission(pVM, MSR_K8_CSTAR, true, true);
371 svmR0SetMSRPermission(pVM, MSR_K6_STAR, true, true);
372 svmR0SetMSRPermission(pVM, MSR_K8_SF_MASK, true, true);
373 svmR0SetMSRPermission(pVM, MSR_K8_FS_BASE, true, true);
374 svmR0SetMSRPermission(pVM, MSR_K8_GS_BASE, true, true);
375 svmR0SetMSRPermission(pVM, MSR_K8_KERNEL_GS_BASE, true, true);
376 svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_CS, true, true);
377 svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_ESP, true, true);
378 svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_EIP, true, true);
379 return rc;
380}
381
382
383/**
384 * Sets the permission bits for the specified MSR
385 *
386 * @param pVM The VM to operate on.
387 * @param ulMSR MSR value
388 * @param fRead Reading allowed/disallowed
389 * @param fWrite Writing allowed/disallowed
390 */
391static void svmR0SetMSRPermission(PVM pVM, unsigned ulMSR, bool fRead, bool fWrite)
392{
393 unsigned ulBit;
394 uint8_t *pMSRBitmap = (uint8_t *)pVM->hwaccm.s.svm.pMSRBitmap;
395
396 if (ulMSR <= 0x00001FFF)
397 {
398 /* Pentium-compatible MSRs */
399 ulBit = ulMSR * 2;
400 }
401 else
402 if ( ulMSR >= 0xC0000000
403 && ulMSR <= 0xC0001FFF)
404 {
405 /* AMD Sixth Generation x86 Processor MSRs and SYSCALL */
406 ulBit = (ulMSR - 0xC0000000) * 2;
407 pMSRBitmap += 0x800;
408 }
409 else
410 if ( ulMSR >= 0xC0010000
411 && ulMSR <= 0xC0011FFF)
412 {
413 /* AMD Seventh and Eighth Generation Processor MSRs */
414 ulBit = (ulMSR - 0xC0001000) * 2;
415 pMSRBitmap += 0x1000;
416 }
417 else
418 {
419 AssertFailed();
420 return;
421 }
422 Assert(ulBit < 16 * 1024 - 1);
423 if (fRead)
424 ASMBitClear(pMSRBitmap, ulBit);
425 else
426 ASMBitSet(pMSRBitmap, ulBit);
427
428 if (fWrite)
429 ASMBitClear(pMSRBitmap, ulBit + 1);
430 else
431 ASMBitSet(pMSRBitmap, ulBit + 1);
432}
433
434/**
435 * Injects an event (trap or external interrupt)
436 *
437 * @param pVCpu The VMCPU to operate on.
438 * @param pVMCB SVM control block
439 * @param pCtx CPU Context
440 * @param pIntInfo SVM interrupt info
441 */
442inline void SVMR0InjectEvent(PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
443{
444#ifdef VBOX_WITH_STATISTICS
445 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatInjectedIrqsR0[pEvent->n.u8Vector & MASK_INJECT_IRQ_STAT]);
446#endif
447
448#ifdef VBOX_STRICT
449 if (pEvent->n.u8Vector == 0xE)
450 Log(("SVM: Inject int %d at %RGv error code=%02x CR2=%RGv intInfo=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode, (RTGCPTR)pCtx->cr2, pEvent->au64[0]));
451 else
452 if (pEvent->n.u8Vector < 0x20)
453 Log(("SVM: Inject int %d at %RGv error code=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode));
454 else
455 {
456 Log(("INJ-EI: %x at %RGv\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip));
457 Assert(!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
458 Assert(pCtx->eflags.u32 & X86_EFL_IF);
459 }
460#endif
461
462 /* Set event injection state. */
463 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
464}
465
466
467/**
468 * Checks for pending guest interrupts and injects them
469 *
470 * @returns VBox status code.
471 * @param pVM The VM to operate on.
472 * @param pVCpu The VM CPU to operate on.
473 * @param pVMCB SVM control block
474 * @param pCtx CPU Context
475 */
476static int SVMR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
477{
478 int rc;
479
480 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
481 if (pVCpu->hwaccm.s.Event.fPending)
482 {
483 SVM_EVENT Event;
484
485 Log(("Reinjecting event %08x %08x at %RGv\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip));
486 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
487 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
488 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
489
490 pVCpu->hwaccm.s.Event.fPending = false;
491 return VINF_SUCCESS;
492 }
493
494 /* If an active trap is already pending, then we must forward it first! */
495 if (!TRPMHasTrap(pVCpu))
496 {
497 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
498 {
499 SVM_EVENT Event;
500
501 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
502 Event.n.u8Vector = X86_XCPT_NMI;
503 Event.n.u1Valid = 1;
504 Event.n.u32ErrorCode = 0;
505 Event.n.u3Type = SVM_EVENT_NMI;
506
507 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
508 return VINF_SUCCESS;
509 }
510
511 /* @todo SMI interrupts. */
512
513 /* When external interrupts are pending, we should exit the VM when IF is set. */
514 if (VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
515 {
516 if ( !(pCtx->eflags.u32 & X86_EFL_IF)
517 || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
518 {
519 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
520 {
521 if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
522 LogFlow(("Enable irq window exit!\n"));
523 else
524 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS -> irq window exit\n", (RTGCPTR)pCtx->rip));
525
526 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
527 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
528 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
529 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
530 }
531 }
532 else
533 {
534 uint8_t u8Interrupt;
535
536 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
537 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
538 if (RT_SUCCESS(rc))
539 {
540 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
541 AssertRC(rc);
542 }
543 else
544 {
545 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
546 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
547 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
548 /* Just continue */
549 }
550 }
551 }
552 }
553
554#ifdef VBOX_STRICT
555 if (TRPMHasTrap(pVCpu))
556 {
557 uint8_t u8Vector;
558 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
559 AssertRC(rc);
560 }
561#endif
562
563 if ( (pCtx->eflags.u32 & X86_EFL_IF)
564 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
565 && TRPMHasTrap(pVCpu)
566 )
567 {
568 uint8_t u8Vector;
569 int rc;
570 TRPMEVENT enmType;
571 SVM_EVENT Event;
572 RTGCUINT u32ErrorCode;
573
574 Event.au64[0] = 0;
575
576 /* If a new event is pending, then dispatch it now. */
577 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &u32ErrorCode, 0);
578 AssertRC(rc);
579 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
580 Assert(enmType != TRPM_SOFTWARE_INT);
581
582 /* Clear the pending trap. */
583 rc = TRPMResetTrap(pVCpu);
584 AssertRC(rc);
585
586 Event.n.u8Vector = u8Vector;
587 Event.n.u1Valid = 1;
588 Event.n.u32ErrorCode = u32ErrorCode;
589
590 if (enmType == TRPM_TRAP)
591 {
592 switch (u8Vector) {
593 case 8:
594 case 10:
595 case 11:
596 case 12:
597 case 13:
598 case 14:
599 case 17:
600 /* Valid error codes. */
601 Event.n.u1ErrorCodeValid = 1;
602 break;
603 default:
604 break;
605 }
606 if (u8Vector == X86_XCPT_NMI)
607 Event.n.u3Type = SVM_EVENT_NMI;
608 else
609 Event.n.u3Type = SVM_EVENT_EXCEPTION;
610 }
611 else
612 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
613
614 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
615 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
616 } /* if (interrupts can be dispatched) */
617
618 return VINF_SUCCESS;
619}
620
621/**
622 * Save the host state
623 *
624 * @returns VBox status code.
625 * @param pVM The VM to operate on.
626 * @param pVCpu The VM CPU to operate on.
627 */
628VMMR0DECL(int) SVMR0SaveHostState(PVM pVM, PVMCPU pVCpu)
629{
630 NOREF(pVM);
631 NOREF(pVCpu);
632 /* Nothing to do here. */
633 return VINF_SUCCESS;
634}
635
636/**
637 * Loads the guest state
638 *
639 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
640 *
641 * @returns VBox status code.
642 * @param pVM The VM to operate on.
643 * @param pVCpu The VM CPU to operate on.
644 * @param pCtx Guest context
645 */
646VMMR0DECL(int) SVMR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
647{
648 RTGCUINTPTR val;
649 SVM_VMCB *pVMCB;
650
651 if (pVM == NULL)
652 return VERR_INVALID_PARAMETER;
653
654 /* Setup AMD SVM. */
655 Assert(pVM->hwaccm.s.svm.fSupported);
656
657 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
658 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
659
660 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
661 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
662 {
663 SVM_WRITE_SELREG(CS, cs);
664 SVM_WRITE_SELREG(SS, ss);
665 SVM_WRITE_SELREG(DS, ds);
666 SVM_WRITE_SELREG(ES, es);
667 SVM_WRITE_SELREG(FS, fs);
668 SVM_WRITE_SELREG(GS, gs);
669 }
670
671 /* Guest CPU context: LDTR. */
672 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
673 {
674 SVM_WRITE_SELREG(LDTR, ldtr);
675 }
676
677 /* Guest CPU context: TR. */
678 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
679 {
680 SVM_WRITE_SELREG(TR, tr);
681 }
682
683 /* Guest CPU context: GDTR. */
684 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
685 {
686 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
687 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
688 }
689
690 /* Guest CPU context: IDTR. */
691 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
692 {
693 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
694 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
695 }
696
697 /*
698 * Sysenter MSRs (unconditional)
699 */
700 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
701 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
702 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
703
704 /* Control registers */
705 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
706 {
707 val = pCtx->cr0;
708 if (!CPUMIsGuestFPUStateActive(pVCpu))
709 {
710 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
711 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
712 }
713 else
714 {
715 /** @todo check if we support the old style mess correctly. */
716 if (!(val & X86_CR0_NE))
717 {
718 Log(("Forcing X86_CR0_NE!!!\n"));
719
720 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
721 if (!pVCpu->hwaccm.s.fFPUOldStyleOverride)
722 {
723 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_MF);
724 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
725 }
726 }
727 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
728 }
729 /* Always enable caching. */
730 val &= ~(X86_CR0_CD|X86_CR0_NW);
731
732 /* Note: WP is not relevant in nested paging mode as we catch accesses on the (guest) physical level. */
733 /* Note: In nested paging mode the guest is allowed to run with paging disabled; the guest physical to host physical translation will remain active. */
734 if (!pVM->hwaccm.s.fNestedPaging)
735 {
736 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
737 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
738 }
739 pVMCB->guest.u64CR0 = val;
740 }
741 /* CR2 as well */
742 pVMCB->guest.u64CR2 = pCtx->cr2;
743
744 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
745 {
746 /* Save our shadow CR3 register. */
747 if (pVM->hwaccm.s.fNestedPaging)
748 {
749 PGMMODE enmShwPagingMode;
750
751#if HC_ARCH_BITS == 32
752 if (CPUMIsGuestInLongModeEx(pCtx))
753 enmShwPagingMode = PGMMODE_AMD64_NX;
754 else
755#endif
756 enmShwPagingMode = PGMGetHostMode(pVM);
757
758 pVMCB->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
759 Assert(pVMCB->ctrl.u64NestedPagingCR3);
760 pVMCB->guest.u64CR3 = pCtx->cr3;
761 }
762 else
763 {
764 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
765 Assert(pVMCB->guest.u64CR3 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
766 }
767 }
768
769 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
770 {
771 val = pCtx->cr4;
772 if (!pVM->hwaccm.s.fNestedPaging)
773 {
774 switch(pVCpu->hwaccm.s.enmShadowMode)
775 {
776 case PGMMODE_REAL:
777 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
778 AssertFailed();
779 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
780
781 case PGMMODE_32_BIT: /* 32-bit paging. */
782 val &= ~X86_CR4_PAE;
783 break;
784
785 case PGMMODE_PAE: /* PAE paging. */
786 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
787 /** @todo use normal 32 bits paging */
788 val |= X86_CR4_PAE;
789 break;
790
791 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
792 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
793#ifdef VBOX_ENABLE_64_BITS_GUESTS
794 break;
795#else
796 AssertFailed();
797 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
798#endif
799
800 default: /* shut up gcc */
801 AssertFailed();
802 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
803 }
804 }
805 pVMCB->guest.u64CR4 = val;
806 }
807
808 /* Debug registers. */
809 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
810 {
811 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
812 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
813
814 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
815 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
816 pCtx->dr[7] |= 0x400; /* must be one */
817
818 pVMCB->guest.u64DR7 = pCtx->dr[7];
819 pVMCB->guest.u64DR6 = pCtx->dr[6];
820
821#ifdef DEBUG
822 /* Sync the hypervisor debug state now if any breakpoint is armed. */
823 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
824 && !CPUMIsHyperDebugStateActive(pVCpu)
825 && !DBGFIsStepping(pVCpu))
826 {
827 /* Save the host and load the hypervisor debug state. */
828 int rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
829 AssertRC(rc);
830
831 /* DRx intercepts remain enabled. */
832
833 /* Override dr6 & dr7 with the hypervisor values. */
834 pVMCB->guest.u64DR7 = CPUMGetHyperDR7(pVCpu);
835 pVMCB->guest.u64DR6 = CPUMGetHyperDR6(pVCpu);
836 }
837 else
838#endif
839 /* Sync the debug state now if any breakpoint is armed. */
840 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
841 && !CPUMIsGuestDebugStateActive(pVCpu)
842 && !DBGFIsStepping(pVCpu))
843 {
844 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
845
846 /* Disable drx move intercepts. */
847 pVMCB->ctrl.u16InterceptRdDRx = 0;
848 pVMCB->ctrl.u16InterceptWrDRx = 0;
849
850 /* Save the host and load the guest debug state. */
851 int rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
852 AssertRC(rc);
853 }
854 }
855
856 /* EIP, ESP and EFLAGS */
857 pVMCB->guest.u64RIP = pCtx->rip;
858 pVMCB->guest.u64RSP = pCtx->rsp;
859 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
860
861 /* Set CPL */
862 pVMCB->guest.u8CPL = pCtx->csHid.Attr.n.u2Dpl;
863
864 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
865 pVMCB->guest.u64RAX = pCtx->rax;
866
867 /* vmrun will fail without MSR_K6_EFER_SVME. */
868 pVMCB->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
869
870 /* 64 bits guest mode? */
871 if (CPUMIsGuestInLongModeEx(pCtx))
872 {
873#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
874 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
875#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
876 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMSwitcherRun64;
877#else
878# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
879 if (!pVM->hwaccm.s.fAllow64BitGuests)
880 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
881# endif
882 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun64;
883#endif
884 /* Unconditionally update these as wrmsr might have changed them. (HWACCM_CHANGED_GUEST_SEGMENT_REGS will not be set) */
885 pVMCB->guest.FS.u64Base = pCtx->fsHid.u64Base;
886 pVMCB->guest.GS.u64Base = pCtx->gsHid.u64Base;
887 }
888 else
889 {
890 /* Filter out the MSR_K6_LME bit or else AMD-V expects amd64 shadow paging. */
891 pVMCB->guest.u64EFER &= ~MSR_K6_EFER_LME;
892
893 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun;
894 }
895
896 /* TSC offset. */
897 if (TMCpuTickCanUseRealTSC(pVCpu, &pVMCB->ctrl.u64TSCOffset))
898 {
899 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
900 pVMCB->ctrl.u32InterceptCtrl2 &= ~SVM_CTRL2_INTERCEPT_RDTSCP;
901 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
902 }
903 else
904 {
905 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
906 pVMCB->ctrl.u32InterceptCtrl2 |= SVM_CTRL2_INTERCEPT_RDTSCP;
907 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
908 }
909
910 /* Sync the various msrs for 64 bits mode. */
911 pVMCB->guest.u64STAR = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
912 pVMCB->guest.u64LSTAR = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
913 pVMCB->guest.u64CSTAR = pCtx->msrCSTAR; /* compatibility mode syscall rip */
914 pVMCB->guest.u64SFMASK = pCtx->msrSFMASK; /* syscall flag mask */
915 pVMCB->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
916
917#ifdef DEBUG
918 /* Intercept X86_XCPT_DB if stepping is enabled */
919 if ( DBGFIsStepping(pVCpu)
920 || CPUMIsHyperDebugStateActive(pVCpu))
921 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_DB);
922 else
923 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_DB);
924#endif
925
926 /* Done. */
927 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
928
929 return VINF_SUCCESS;
930}
931
932
933/**
934 * Runs guest code in an AMD-V VM.
935 *
936 * @returns VBox status code.
937 * @param pVM The VM to operate on.
938 * @param pVCpu The VM CPU to operate on.
939 * @param pCtx Guest context
940 */
941VMMR0DECL(int) SVMR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
942{
943 int rc = VINF_SUCCESS;
944 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
945 SVM_VMCB *pVMCB;
946 bool fSyncTPR = false;
947 unsigned cResume = 0;
948 uint8_t u8LastTPR;
949 PHWACCM_CPUINFO pCpu = 0;
950 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
951#ifdef VBOX_STRICT
952 RTCPUID idCpuCheck;
953#endif
954#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
955 uint64_t u64LastTime = RTTimeMilliTS();
956#endif
957
958 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
959
960 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
961 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
962
963 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
964 */
965ResumeExecution:
966 Assert(!HWACCMR0SuspendPending());
967
968 /* Safety precaution; looping for too long here can have a very bad effect on the host */
969 if (RT_UNLIKELY(++cResume > pVM->hwaccm.s.cMaxResumeLoops))
970 {
971 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
972 rc = VINF_EM_RAW_INTERRUPT;
973 goto end;
974 }
975
976 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
977 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
978 {
979 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
980 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
981 {
982 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
983 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
984 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
985 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
986 */
987 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
988 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
989 pVMCB->ctrl.u64IntShadow = 0;
990 }
991 }
992 else
993 {
994 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
995 pVMCB->ctrl.u64IntShadow = 0;
996 }
997
998#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
999 if (RT_UNLIKELY(cResume & 0xf) == 0)
1000 {
1001 uint64_t u64CurTime = RTTimeMilliTS();
1002
1003 if (RT_UNLIKELY(u64CurTime > u64LastTime))
1004 {
1005 u64LastTime = u64CurTime;
1006 TMTimerPollVoid(pVM, pVCpu);
1007 }
1008 }
1009#endif
1010
1011 /* Check for pending actions that force us to go back to ring 3. */
1012#ifdef DEBUG
1013 /* Intercept X86_XCPT_DB if stepping is enabled */
1014 if (!DBGFIsStepping(pVCpu))
1015#endif
1016 {
1017 if ( VM_FF_ISPENDING(pVM, VM_FF_HWACCM_TO_R3_MASK)
1018 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HWACCM_TO_R3_MASK))
1019 {
1020 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
1021 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1022 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1023 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
1024 goto end;
1025 }
1026 }
1027
1028 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1029 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
1030 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
1031 {
1032 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1033 rc = VINF_EM_PENDING_REQUEST;
1034 goto end;
1035 }
1036
1037#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1038 /*
1039 * Exit to ring-3 preemption/work is pending.
1040 *
1041 * Interrupts are disabled before the call to make sure we don't miss any interrupt
1042 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
1043 * further down, but SVMR0CheckPendingInterrupt makes that impossible.)
1044 *
1045 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
1046 * shootdowns rely on this.
1047 */
1048 uOldEFlags = ASMIntDisableFlags();
1049 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
1050 {
1051 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPreemptPending);
1052 rc = VINF_EM_RAW_INTERRUPT;
1053 goto end;
1054 }
1055 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
1056#endif
1057
1058 /* When external interrupts are pending, we should exit the VM when IF is set. */
1059 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1060 rc = SVMR0CheckPendingInterrupt(pVM, pVCpu, pVMCB, pCtx);
1061 if (RT_FAILURE(rc))
1062 {
1063 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1064 goto end;
1065 }
1066
1067 /* TPR caching using CR8 is only available in 64 bits mode or with 32 bits guests when X86_CPUID_AMD_FEATURE_ECX_CR8L is supported. */
1068 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!!!!! (no longer true)
1069 * @todo query and update the TPR only when it could have been changed (mmio access)
1070 */
1071 if (pVM->hwaccm.s.fHasIoApic)
1072 {
1073 bool fPending;
1074
1075 /* TPR caching in CR8 */
1076 int rc = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
1077 AssertRC(rc);
1078
1079 if (pVM->hwaccm.s.svm.fTPRPatchingActive)
1080 {
1081 /* Our patch code uses LSTAR for TPR caching. */
1082 pCtx->msrLSTAR = u8LastTPR;
1083
1084 if (fPending)
1085 {
1086 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
1087 svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, false);
1088 }
1089 else
1090 /* No interrupts are pending, so we don't need to be explicitely notified.
1091 * There are enough world switches for detecting pending interrupts.
1092 */
1093 svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, true);
1094 }
1095 else
1096 {
1097 pVMCB->ctrl.IntCtrl.n.u8VTPR = (u8LastTPR >> 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
1098
1099 if (fPending)
1100 {
1101 /* A TPR change could activate a pending interrupt, so catch cr8 writes. */
1102 pVMCB->ctrl.u16InterceptWrCRx |= RT_BIT(8);
1103 }
1104 else
1105 /* No interrupts are pending, so we don't need to be explicitely notified.
1106 * There are enough world switches for detecting pending interrupts.
1107 */
1108 pVMCB->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
1109 }
1110 fSyncTPR = !fPending;
1111 }
1112
1113 /* All done! Let's start VM execution. */
1114 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1115
1116 /* Enable nested paging if necessary (disabled each time after #VMEXIT). */
1117 pVMCB->ctrl.NestedPaging.n.u1NestedPaging = pVM->hwaccm.s.fNestedPaging;
1118
1119#ifdef LOG_ENABLED
1120 pCpu = HWACCMR0GetCurrentCpu();
1121 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1122 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1123 {
1124 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1125 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1126 else
1127 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1128 }
1129 if (pCpu->fFlushTLB)
1130 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1131#endif
1132
1133 /*
1134 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1135 * (until the actual world switch)
1136 */
1137#ifdef VBOX_STRICT
1138 idCpuCheck = RTMpCpuId();
1139#endif
1140 VMMR0LogFlushDisable(pVCpu);
1141
1142 /* Load the guest state; *must* be here as it sets up the shadow cr0 for lazy fpu syncing! */
1143 rc = SVMR0LoadGuestState(pVM, pVCpu, pCtx);
1144 if (RT_UNLIKELY(rc != VINF_SUCCESS))
1145 {
1146 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1147 VMMR0LogFlushEnable(pVCpu);
1148 goto end;
1149 }
1150
1151#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1152 /* Disable interrupts to make sure a poke will interrupt execution.
1153 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
1154 */
1155 uOldEFlags = ASMIntDisableFlags();
1156 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
1157#endif
1158
1159 pCpu = HWACCMR0GetCurrentCpu();
1160 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1161 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1162 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1163 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1164 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1165 {
1166 /* Force a TLB flush on VM entry. */
1167 pVCpu->hwaccm.s.fForceTLBFlush = true;
1168 }
1169 else
1170 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1171
1172 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1173
1174 /* Check for tlb shootdown flushes. */
1175 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
1176 pVCpu->hwaccm.s.fForceTLBFlush = true;
1177
1178 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1179 if ( pVCpu->hwaccm.s.fForceTLBFlush
1180 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
1181 {
1182 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1183 || pCpu->fFlushTLB)
1184 {
1185 pCpu->fFlushTLB = false;
1186 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1187 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
1188 pCpu->cTLBFlushes++;
1189 }
1190 else
1191 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1192
1193 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1194 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1195 }
1196 else
1197 {
1198 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1199
1200 /* We never increase uCurrentASID in the fAlwaysFlushTLB (erratum 170) case. */
1201 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1202 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1203
1204 Assert(!pVM->hwaccm.s.svm.fAlwaysFlushTLB || pVCpu->hwaccm.s.fForceTLBFlush);
1205 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVCpu->hwaccm.s.fForceTLBFlush;
1206
1207 if ( !pVM->hwaccm.s.svm.fAlwaysFlushTLB
1208 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
1209 {
1210 /* Deal with pending TLB shootdown actions which were queued when we were not executing code. */
1211 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTlbShootdown);
1212 for (unsigned i=0;i<pVCpu->hwaccm.s.TlbShootdown.cPages;i++)
1213 SVMR0InvlpgA(pVCpu->hwaccm.s.TlbShootdown.aPages[i], pVMCB->ctrl.TLBCtrl.n.u32ASID);
1214 }
1215 }
1216 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
1217 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
1218
1219 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1220 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1221 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1222 pVMCB->ctrl.TLBCtrl.n.u32ASID = pVCpu->hwaccm.s.uCurrentASID;
1223
1224#ifdef VBOX_WITH_STATISTICS
1225 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
1226 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1227 else
1228 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1229#endif
1230
1231 /* In case we execute a goto ResumeExecution later on. */
1232 pVCpu->hwaccm.s.fResumeVM = true;
1233 pVCpu->hwaccm.s.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
1234
1235 Assert(sizeof(pVCpu->hwaccm.s.svm.pVMCBPhys) == 8);
1236 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
1237 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
1238 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
1239 Assert(pVMCB->ctrl.u64LBRVirt == 0);
1240
1241#ifdef VBOX_STRICT
1242 Assert(idCpuCheck == RTMpCpuId());
1243#endif
1244 TMNotifyStartOfExecution(pVCpu);
1245#ifdef VBOX_WITH_KERNEL_USING_XMM
1246 hwaccmR0SVMRunWrapXMM(pVCpu->hwaccm.s.svm.pVMCBHostPhys, pVCpu->hwaccm.s.svm.pVMCBPhys, pCtx, pVM, pVCpu, pVCpu->hwaccm.s.svm.pfnVMRun);
1247#else
1248 pVCpu->hwaccm.s.svm.pfnVMRun(pVCpu->hwaccm.s.svm.pVMCBHostPhys, pVCpu->hwaccm.s.svm.pVMCBPhys, pCtx, pVM, pVCpu);
1249#endif
1250 TMNotifyEndOfExecution(pVCpu);
1251 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
1252 ASMSetFlags(uOldEFlags);
1253#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1254 uOldEFlags = ~(RTCCUINTREG)0;
1255#endif
1256 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1257
1258 /*
1259 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1260 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1261 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1262 */
1263
1264 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit1, x);
1265
1266 /* Reason for the VM exit */
1267 exitCode = pVMCB->ctrl.u64ExitCode;
1268
1269 if (RT_UNLIKELY(exitCode == (uint64_t)SVM_EXIT_INVALID)) /* Invalid guest state. */
1270 {
1271 HWACCMDumpRegs(pVM, pVCpu, pCtx);
1272#ifdef DEBUG
1273 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
1274 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
1275 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
1276 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
1277 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
1278 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
1279 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
1280 Log(("ctrl.u64IOPMPhysAddr %RX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
1281 Log(("ctrl.u64MSRPMPhysAddr %RX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
1282 Log(("ctrl.u64TSCOffset %RX64\n", pVMCB->ctrl.u64TSCOffset));
1283
1284 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
1285 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
1286 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
1287 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
1288
1289 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
1290 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
1291 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
1292 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
1293 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
1294 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
1295 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
1296 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
1297 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
1298 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
1299
1300 Log(("ctrl.u64IntShadow %RX64\n", pVMCB->ctrl.u64IntShadow));
1301 Log(("ctrl.u64ExitCode %RX64\n", pVMCB->ctrl.u64ExitCode));
1302 Log(("ctrl.u64ExitInfo1 %RX64\n", pVMCB->ctrl.u64ExitInfo1));
1303 Log(("ctrl.u64ExitInfo2 %RX64\n", pVMCB->ctrl.u64ExitInfo2));
1304 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
1305 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
1306 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
1307 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
1308 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
1309 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
1310 Log(("ctrl.NestedPaging %RX64\n", pVMCB->ctrl.NestedPaging.au64));
1311 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
1312 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
1313 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
1314 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
1315 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
1316 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
1317
1318 Log(("ctrl.u64NestedPagingCR3 %RX64\n", pVMCB->ctrl.u64NestedPagingCR3));
1319 Log(("ctrl.u64LBRVirt %RX64\n", pVMCB->ctrl.u64LBRVirt));
1320
1321 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
1322 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
1323 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
1324 Log(("guest.CS.u64Base %RX64\n", pVMCB->guest.CS.u64Base));
1325 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
1326 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
1327 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
1328 Log(("guest.DS.u64Base %RX64\n", pVMCB->guest.DS.u64Base));
1329 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
1330 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
1331 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
1332 Log(("guest.ES.u64Base %RX64\n", pVMCB->guest.ES.u64Base));
1333 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
1334 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
1335 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
1336 Log(("guest.FS.u64Base %RX64\n", pVMCB->guest.FS.u64Base));
1337 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
1338 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
1339 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
1340 Log(("guest.GS.u64Base %RX64\n", pVMCB->guest.GS.u64Base));
1341
1342 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
1343 Log(("guest.GDTR.u64Base %RX64\n", pVMCB->guest.GDTR.u64Base));
1344
1345 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
1346 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
1347 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
1348 Log(("guest.LDTR.u64Base %RX64\n", pVMCB->guest.LDTR.u64Base));
1349
1350 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
1351 Log(("guest.IDTR.u64Base %RX64\n", pVMCB->guest.IDTR.u64Base));
1352
1353 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
1354 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
1355 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
1356 Log(("guest.TR.u64Base %RX64\n", pVMCB->guest.TR.u64Base));
1357
1358 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
1359 Log(("guest.u64CR0 %RX64\n", pVMCB->guest.u64CR0));
1360 Log(("guest.u64CR2 %RX64\n", pVMCB->guest.u64CR2));
1361 Log(("guest.u64CR3 %RX64\n", pVMCB->guest.u64CR3));
1362 Log(("guest.u64CR4 %RX64\n", pVMCB->guest.u64CR4));
1363 Log(("guest.u64DR6 %RX64\n", pVMCB->guest.u64DR6));
1364 Log(("guest.u64DR7 %RX64\n", pVMCB->guest.u64DR7));
1365
1366 Log(("guest.u64RIP %RX64\n", pVMCB->guest.u64RIP));
1367 Log(("guest.u64RSP %RX64\n", pVMCB->guest.u64RSP));
1368 Log(("guest.u64RAX %RX64\n", pVMCB->guest.u64RAX));
1369 Log(("guest.u64RFlags %RX64\n", pVMCB->guest.u64RFlags));
1370
1371 Log(("guest.u64SysEnterCS %RX64\n", pVMCB->guest.u64SysEnterCS));
1372 Log(("guest.u64SysEnterEIP %RX64\n", pVMCB->guest.u64SysEnterEIP));
1373 Log(("guest.u64SysEnterESP %RX64\n", pVMCB->guest.u64SysEnterESP));
1374
1375 Log(("guest.u64EFER %RX64\n", pVMCB->guest.u64EFER));
1376 Log(("guest.u64STAR %RX64\n", pVMCB->guest.u64STAR));
1377 Log(("guest.u64LSTAR %RX64\n", pVMCB->guest.u64LSTAR));
1378 Log(("guest.u64CSTAR %RX64\n", pVMCB->guest.u64CSTAR));
1379 Log(("guest.u64SFMASK %RX64\n", pVMCB->guest.u64SFMASK));
1380 Log(("guest.u64KernelGSBase %RX64\n", pVMCB->guest.u64KernelGSBase));
1381 Log(("guest.u64GPAT %RX64\n", pVMCB->guest.u64GPAT));
1382 Log(("guest.u64DBGCTL %RX64\n", pVMCB->guest.u64DBGCTL));
1383 Log(("guest.u64BR_FROM %RX64\n", pVMCB->guest.u64BR_FROM));
1384 Log(("guest.u64BR_TO %RX64\n", pVMCB->guest.u64BR_TO));
1385 Log(("guest.u64LASTEXCPFROM %RX64\n", pVMCB->guest.u64LASTEXCPFROM));
1386 Log(("guest.u64LASTEXCPTO %RX64\n", pVMCB->guest.u64LASTEXCPTO));
1387
1388#endif
1389 rc = VERR_SVM_UNABLE_TO_START_VM;
1390 VMMR0LogFlushEnable(pVCpu);
1391 goto end;
1392 }
1393
1394 /* Let's first sync back eip, esp, and eflags. */
1395 pCtx->rip = pVMCB->guest.u64RIP;
1396 pCtx->rsp = pVMCB->guest.u64RSP;
1397 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
1398 /* eax is saved/restore across the vmrun instruction */
1399 pCtx->rax = pVMCB->guest.u64RAX;
1400
1401 /* Save all the MSRs that can be changed by the guest without causing a world switch. (fs & gs base are saved with SVM_READ_SELREG) */
1402 pCtx->msrSTAR = pVMCB->guest.u64STAR; /* legacy syscall eip, cs & ss */
1403 pCtx->msrLSTAR = pVMCB->guest.u64LSTAR; /* 64 bits mode syscall rip */
1404 pCtx->msrCSTAR = pVMCB->guest.u64CSTAR; /* compatibility mode syscall rip */
1405 pCtx->msrSFMASK = pVMCB->guest.u64SFMASK; /* syscall flag mask */
1406 pCtx->msrKERNELGSBASE = pVMCB->guest.u64KernelGSBase; /* swapgs exchange value */
1407 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1408 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1409 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1410
1411 /* Can be updated behind our back in the nested paging case. */
1412 pCtx->cr2 = pVMCB->guest.u64CR2;
1413
1414 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1415 SVM_READ_SELREG(SS, ss);
1416 SVM_READ_SELREG(CS, cs);
1417 SVM_READ_SELREG(DS, ds);
1418 SVM_READ_SELREG(ES, es);
1419 SVM_READ_SELREG(FS, fs);
1420 SVM_READ_SELREG(GS, gs);
1421
1422 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1423 SVM_READ_SELREG(LDTR, ldtr);
1424 SVM_READ_SELREG(TR, tr);
1425
1426 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1427 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1428
1429 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1430 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1431
1432 /* Note: no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
1433 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1434 if ( pVM->hwaccm.s.fNestedPaging
1435 && pCtx->cr3 != pVMCB->guest.u64CR3)
1436 {
1437 CPUMSetGuestCR3(pVCpu, pVMCB->guest.u64CR3);
1438 PGMUpdateCR3(pVCpu, pVMCB->guest.u64CR3);
1439 }
1440
1441 /* Note! NOW IT'S SAFE FOR LOGGING! */
1442 VMMR0LogFlushEnable(pVCpu);
1443
1444 /* Take care of instruction fusing (sti, mov ss) (see 15.20.5 Interrupt Shadows) */
1445 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
1446 {
1447 Log(("uInterruptState %x rip=%RGv\n", pVMCB->ctrl.u64IntShadow, (RTGCPTR)pCtx->rip));
1448 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
1449 }
1450 else
1451 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
1452
1453 Log2(("exitCode = %x\n", exitCode));
1454
1455 /* Sync back DR6 as it could have been changed by hitting breakpoints. */
1456 pCtx->dr[6] = pVMCB->guest.u64DR6;
1457 /* DR7.GD can be cleared by debug exceptions, so sync it back as well. */
1458 pCtx->dr[7] = pVMCB->guest.u64DR7;
1459
1460 /* Check if an injected event was interrupted prematurely. */
1461 pVCpu->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1462 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1463 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1464 {
1465 Log(("Pending inject %RX64 at %RGv exit=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitCode));
1466
1467#ifdef LOG_ENABLED
1468 SVM_EVENT Event;
1469 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
1470
1471 if ( exitCode == SVM_EXIT_EXCEPTION_E
1472 && Event.n.u8Vector == 0xE)
1473 {
1474 Log(("Double fault!\n"));
1475 }
1476#endif
1477
1478 pVCpu->hwaccm.s.Event.fPending = true;
1479 /* Error code present? (redundant) */
1480 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1481 pVCpu->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1482 else
1483 pVCpu->hwaccm.s.Event.errCode = 0;
1484 }
1485#ifdef VBOX_WITH_STATISTICS
1486 if (exitCode == SVM_EXIT_NPF)
1487 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
1488 else
1489 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1490#endif
1491
1492 /* Sync back the TPR if it was changed. */
1493 if (fSyncTPR)
1494 {
1495 if (pVM->hwaccm.s.svm.fTPRPatchingActive)
1496 {
1497 if ((pCtx->msrLSTAR & 0xff) != u8LastTPR)
1498 {
1499 /* Our patch code uses LSTAR for TPR caching. */
1500 rc = PDMApicSetTPR(pVCpu, pCtx->msrLSTAR & 0xff);
1501 AssertRC(rc);
1502 }
1503 }
1504 else
1505 {
1506 if ((u8LastTPR >> 4) != pVMCB->ctrl.IntCtrl.n.u8VTPR)
1507 {
1508 rc = PDMApicSetTPR(pVCpu, pVMCB->ctrl.IntCtrl.n.u8VTPR << 4); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
1509 AssertRC(rc);
1510 }
1511 }
1512 }
1513
1514 /* Deal with the reason of the VM-exit. */
1515 switch (exitCode)
1516 {
1517 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1518 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1519 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1520 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1521 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1522 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1523 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1524 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1525 {
1526 /* Pending trap. */
1527 SVM_EVENT Event;
1528 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1529
1530 Log2(("Hardware/software interrupt %d\n", vector));
1531 switch (vector)
1532 {
1533 case X86_XCPT_DB:
1534 {
1535 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
1536
1537 /* Note that we don't support guest and host-initiated debugging at the same time. */
1538 Assert(DBGFIsStepping(pVCpu) || CPUMIsHyperDebugStateActive(pVCpu));
1539
1540 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), pCtx->dr[6]);
1541 if (rc == VINF_EM_RAW_GUEST_TRAP)
1542 {
1543 Log(("Trap %x (debug) at %016RX64\n", vector, pCtx->rip));
1544
1545 /* Reinject the exception. */
1546 Event.au64[0] = 0;
1547 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1548 Event.n.u1Valid = 1;
1549 Event.n.u8Vector = X86_XCPT_DB;
1550
1551 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1552
1553 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1554 goto ResumeExecution;
1555 }
1556 /* Return to ring 3 to deal with the debug exit code. */
1557 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs, pCtx->rip, rc));
1558 break;
1559 }
1560
1561 case X86_XCPT_NM:
1562 {
1563 Log(("#NM fault at %RGv\n", (RTGCPTR)pCtx->rip));
1564
1565 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1566 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1567 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
1568 if (rc == VINF_SUCCESS)
1569 {
1570 Assert(CPUMIsGuestFPUStateActive(pVCpu));
1571 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
1572
1573 /* Continue execution. */
1574 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1575 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1576
1577 goto ResumeExecution;
1578 }
1579
1580 Log(("Forward #NM fault to the guest\n"));
1581 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
1582
1583 Event.au64[0] = 0;
1584 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1585 Event.n.u1Valid = 1;
1586 Event.n.u8Vector = X86_XCPT_NM;
1587
1588 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1589 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1590 goto ResumeExecution;
1591 }
1592
1593 case X86_XCPT_PF: /* Page fault */
1594 {
1595 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1596 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1597
1598#ifdef DEBUG
1599 if (pVM->hwaccm.s.fNestedPaging)
1600 { /* A genuine pagefault.
1601 * Forward the trap to the guest by injecting the exception and resuming execution.
1602 */
1603 Log(("Guest page fault at %04X:%RGv cr2=%RGv error code %x rsp=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
1604 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1605
1606 /* Now we must update CR2. */
1607 pCtx->cr2 = uFaultAddress;
1608
1609 Event.au64[0] = 0;
1610 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1611 Event.n.u1Valid = 1;
1612 Event.n.u8Vector = X86_XCPT_PF;
1613 Event.n.u1ErrorCodeValid = 1;
1614 Event.n.u32ErrorCode = errCode;
1615
1616 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1617
1618 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1619 goto ResumeExecution;
1620 }
1621#endif
1622 Assert(!pVM->hwaccm.s.fNestedPaging);
1623
1624#ifdef VBOX_HWACCM_WITH_GUEST_PATCHING
1625 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1626 if ( (uFaultAddress & 0xfff) == 0x080
1627 && pVM->hwaccm.s.fHasIoApic
1628 && !(errCode & X86_TRAP_PF_P) /* not present */
1629 && CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx)) == 0
1630 && !CPUMIsGuestInLongModeEx(pCtx)
1631 && pVM->hwaccm.s.svm.cPatches < RT_ELEMENTS(pVM->hwaccm.s.svm.aPatches))
1632 {
1633 RTGCPHYS GCPhysApicBase, GCPhys;
1634 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1635 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1636
1637 rc = PGMGstGetPage(pVCpu, (RTGCPTR)uFaultAddress, NULL, &GCPhys);
1638 if ( rc == VINF_SUCCESS
1639 && GCPhys == GCPhysApicBase)
1640 {
1641 /* Only attempt to patch the instruction once. */
1642 PHWACCMTPRPATCH pPatch = (PHWACCMTPRPATCH)RTAvloU32Get(&pVM->hwaccm.s.svm.PatchTree, (AVLOU32KEY)pCtx->eip);
1643 if (!pPatch)
1644 {
1645 rc = VINF_EM_HWACCM_PATCH_TPR_INSTR;
1646 break;
1647 }
1648 }
1649 }
1650#endif
1651
1652 Log2(("Page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1653 /* Exit qualification contains the linear address of the page fault. */
1654 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1655 TRPMSetErrorCode(pVCpu, errCode);
1656 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1657
1658 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1659 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1660 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1661 if (rc == VINF_SUCCESS)
1662 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1663 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1664 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1665
1666 TRPMResetTrap(pVCpu);
1667
1668 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1669 goto ResumeExecution;
1670 }
1671 else
1672 if (rc == VINF_EM_RAW_GUEST_TRAP)
1673 { /* A genuine pagefault.
1674 * Forward the trap to the guest by injecting the exception and resuming execution.
1675 */
1676 Log2(("Forward page fault to the guest\n"));
1677 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1678 /* The error code might have been changed. */
1679 errCode = TRPMGetErrorCode(pVCpu);
1680
1681 TRPMResetTrap(pVCpu);
1682
1683 /* Now we must update CR2. */
1684 pCtx->cr2 = uFaultAddress;
1685
1686 Event.au64[0] = 0;
1687 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1688 Event.n.u1Valid = 1;
1689 Event.n.u8Vector = X86_XCPT_PF;
1690 Event.n.u1ErrorCodeValid = 1;
1691 Event.n.u32ErrorCode = errCode;
1692
1693 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1694
1695 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1696 goto ResumeExecution;
1697 }
1698#ifdef VBOX_STRICT
1699 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
1700 LogFlow(("PGMTrap0eHandler failed with %d\n", rc));
1701#endif
1702 /* Need to go back to the recompiler to emulate the instruction. */
1703 TRPMResetTrap(pVCpu);
1704 break;
1705 }
1706
1707 case X86_XCPT_MF: /* Floating point exception. */
1708 {
1709 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
1710 if (!(pCtx->cr0 & X86_CR0_NE))
1711 {
1712 /* old style FPU error reporting needs some extra work. */
1713 /** @todo don't fall back to the recompiler, but do it manually. */
1714 rc = VINF_EM_RAW_EMULATE_INSTR;
1715 break;
1716 }
1717 Log(("Trap %x at %RGv\n", vector, (RTGCPTR)pCtx->rip));
1718
1719 Event.au64[0] = 0;
1720 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1721 Event.n.u1Valid = 1;
1722 Event.n.u8Vector = X86_XCPT_MF;
1723
1724 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1725
1726 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1727 goto ResumeExecution;
1728 }
1729
1730#ifdef VBOX_STRICT
1731 case X86_XCPT_GP: /* General protection failure exception.*/
1732 case X86_XCPT_UD: /* Unknown opcode exception. */
1733 case X86_XCPT_DE: /* Divide error. */
1734 case X86_XCPT_SS: /* Stack segment exception. */
1735 case X86_XCPT_NP: /* Segment not present exception. */
1736 {
1737 Event.au64[0] = 0;
1738 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1739 Event.n.u1Valid = 1;
1740 Event.n.u8Vector = vector;
1741
1742 switch(vector)
1743 {
1744 case X86_XCPT_GP:
1745 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
1746 Event.n.u1ErrorCodeValid = 1;
1747 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1748 break;
1749 case X86_XCPT_DE:
1750 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
1751 break;
1752 case X86_XCPT_UD:
1753 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
1754 break;
1755 case X86_XCPT_SS:
1756 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
1757 Event.n.u1ErrorCodeValid = 1;
1758 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1759 break;
1760 case X86_XCPT_NP:
1761 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
1762 Event.n.u1ErrorCodeValid = 1;
1763 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1764 break;
1765 }
1766 Log(("Trap %x at %04x:%RGv esi=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, pCtx->esi));
1767 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1768
1769 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1770 goto ResumeExecution;
1771 }
1772#endif
1773 default:
1774 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1775 rc = VERR_EM_INTERNAL_ERROR;
1776 break;
1777
1778 } /* switch (vector) */
1779 break;
1780 }
1781
1782 case SVM_EXIT_NPF:
1783 {
1784 /* EXITINFO1 contains fault errorcode; EXITINFO2 contains the guest physical address causing the fault. */
1785 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1786 RTGCPHYS uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1787 PGMMODE enmShwPagingMode;
1788
1789 Assert(pVM->hwaccm.s.fNestedPaging);
1790 LogFlow(("Nested page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1791
1792#ifdef VBOX_HWACCM_WITH_GUEST_PATCHING
1793 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1794 if ( (uFaultAddress & 0xfff) == 0x080
1795 && pVM->hwaccm.s.fHasIoApic
1796 && !(errCode & X86_TRAP_PF_P) /* not present */
1797 && CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx)) == 0
1798 && !CPUMIsGuestInLongModeEx(pCtx)
1799 && pVM->hwaccm.s.svm.cPatches < RT_ELEMENTS(pVM->hwaccm.s.svm.aPatches))
1800 {
1801 RTGCPHYS GCPhysApicBase;
1802 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1803 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1804
1805 if (uFaultAddress == GCPhysApicBase + 0x80)
1806 {
1807 /* Only attempt to patch the instruction once. */
1808 PHWACCMTPRPATCH pPatch = (PHWACCMTPRPATCH)RTAvloU32Get(&pVM->hwaccm.s.svm.PatchTree, (AVLOU32KEY)pCtx->eip);
1809 if (!pPatch)
1810 {
1811 rc = VINF_EM_HWACCM_PATCH_TPR_INSTR;
1812 break;
1813 }
1814 }
1815 }
1816#endif
1817
1818 /* Exit qualification contains the linear address of the page fault. */
1819 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1820 TRPMSetErrorCode(pVCpu, errCode);
1821 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1822
1823 /* Handle the pagefault trap for the nested shadow table. */
1824#if HC_ARCH_BITS == 32
1825 if (CPUMIsGuestInLongModeEx(pCtx))
1826 enmShwPagingMode = PGMMODE_AMD64_NX;
1827 else
1828#endif
1829 enmShwPagingMode = PGMGetHostMode(pVM);
1830
1831 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, enmShwPagingMode, errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1832 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1833 if (rc == VINF_SUCCESS)
1834 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1835 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1836 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1837
1838 TRPMResetTrap(pVCpu);
1839
1840 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1841 goto ResumeExecution;
1842 }
1843
1844#ifdef VBOX_STRICT
1845 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1846 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
1847#endif
1848 /* Need to go back to the recompiler to emulate the instruction. */
1849 TRPMResetTrap(pVCpu);
1850 break;
1851 }
1852
1853 case SVM_EXIT_VINTR:
1854 /* A virtual interrupt is about to be delivered, which means IF=1. */
1855 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1856 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1857 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1858 goto ResumeExecution;
1859
1860 case SVM_EXIT_FERR_FREEZE:
1861 case SVM_EXIT_INTR:
1862 case SVM_EXIT_NMI:
1863 case SVM_EXIT_SMI:
1864 case SVM_EXIT_INIT:
1865 /* External interrupt; leave to allow it to be dispatched again. */
1866 rc = VINF_EM_RAW_INTERRUPT;
1867 break;
1868
1869 case SVM_EXIT_WBINVD:
1870 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1871 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
1872 /* Skip instruction and continue directly. */
1873 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1874 /* Continue execution.*/
1875 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1876 goto ResumeExecution;
1877
1878 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1879 {
1880 Log2(("SVM: Cpuid at %RGv for %x\n", (RTGCPTR)pCtx->rip, pCtx->eax));
1881 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
1882 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1883 if (rc == VINF_SUCCESS)
1884 {
1885 /* Update EIP and continue execution. */
1886 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1887 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1888 goto ResumeExecution;
1889 }
1890 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
1891 rc = VINF_EM_RAW_EMULATE_INSTR;
1892 break;
1893 }
1894
1895 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1896 {
1897 Log2(("SVM: Rdtsc\n"));
1898 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1899 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1900 if (rc == VINF_SUCCESS)
1901 {
1902 /* Update EIP and continue execution. */
1903 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1904 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1905 goto ResumeExecution;
1906 }
1907 rc = VINF_EM_RAW_EMULATE_INSTR;
1908 break;
1909 }
1910
1911 case SVM_EXIT_RDPMC: /* Guest software attempted to execute RDPMC. */
1912 {
1913 Log2(("SVM: Rdpmc %x\n", pCtx->ecx));
1914 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdpmc);
1915 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1916 if (rc == VINF_SUCCESS)
1917 {
1918 /* Update EIP and continue execution. */
1919 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1920 goto ResumeExecution;
1921 }
1922 rc = VINF_EM_RAW_EMULATE_INSTR;
1923 break;
1924 }
1925
1926 case SVM_EXIT_RDTSCP: /* Guest software attempted to execute RDTSCP. */
1927 {
1928 Log2(("SVM: Rdtscp\n"));
1929 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1930 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
1931 if (rc == VINF_SUCCESS)
1932 {
1933 /* Update EIP and continue execution. */
1934 pCtx->rip += 3; /* Note! hardcoded opcode size! */
1935 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1936 goto ResumeExecution;
1937 }
1938 AssertMsgFailed(("EMU: rdtscp failed with %Rrc\n", rc));
1939 rc = VINF_EM_RAW_EMULATE_INSTR;
1940 break;
1941 }
1942
1943 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1944 {
1945 Log2(("SVM: invlpg\n"));
1946 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
1947
1948 Assert(!pVM->hwaccm.s.fNestedPaging);
1949
1950 /* Truly a pita. Why can't SVM give the same information as VT-x? */
1951 rc = svmR0InterpretInvpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1952 if (rc == VINF_SUCCESS)
1953 {
1954 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushPageInvlpg);
1955 goto ResumeExecution; /* eip already updated */
1956 }
1957 break;
1958 }
1959
1960 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1961 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1962 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1963 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1964 {
1965 uint32_t cbSize;
1966
1967 Log2(("SVM: %RGv mov cr%d, \n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_CR0));
1968 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite[exitCode - SVM_EXIT_WRITE_CR0]);
1969 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1970
1971 switch (exitCode - SVM_EXIT_WRITE_CR0)
1972 {
1973 case 0:
1974 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1975 break;
1976 case 2:
1977 break;
1978 case 3:
1979 Assert(!pVM->hwaccm.s.fNestedPaging);
1980 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1981 break;
1982 case 4:
1983 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1984 break;
1985 case 8:
1986 break;
1987 default:
1988 AssertFailed();
1989 }
1990 /* Check if a sync operation is pending. */
1991 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1992 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1993 {
1994 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1995 AssertRC(rc);
1996
1997 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBCRxChange);
1998
1999 /* Must be set by PGMSyncCR3 */
2000 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 || PGMGetGuestMode(pVCpu) <= PGMMODE_PROTECTED || pVCpu->hwaccm.s.fForceTLBFlush,
2001 ("rc=%Rrc mode=%d fForceTLBFlush=%RTbool\n", rc, PGMGetGuestMode(pVCpu), pVCpu->hwaccm.s.fForceTLBFlush));
2002 }
2003 if (rc == VINF_SUCCESS)
2004 {
2005 /* EIP has been updated already. */
2006
2007 /* Only resume if successful. */
2008 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2009 goto ResumeExecution;
2010 }
2011 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2012 break;
2013 }
2014
2015 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
2016 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
2017 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
2018 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
2019 {
2020 uint32_t cbSize;
2021
2022 Log2(("SVM: %RGv mov x, cr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_CR0));
2023 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead[exitCode - SVM_EXIT_READ_CR0]);
2024 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2025 if (rc == VINF_SUCCESS)
2026 {
2027 /* EIP has been updated already. */
2028
2029 /* Only resume if successful. */
2030 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2031 goto ResumeExecution;
2032 }
2033 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2034 break;
2035 }
2036
2037 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
2038 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
2039 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
2040 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
2041 {
2042 uint32_t cbSize;
2043
2044 Log2(("SVM: %RGv mov dr%d, x\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_DR0));
2045 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2046
2047 if ( !DBGFIsStepping(pVCpu)
2048 && !CPUMIsHyperDebugStateActive(pVCpu))
2049 {
2050 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2051
2052 /* Disable drx move intercepts. */
2053 pVMCB->ctrl.u16InterceptRdDRx = 0;
2054 pVMCB->ctrl.u16InterceptWrDRx = 0;
2055
2056 /* Save the host and load the guest debug state. */
2057 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
2058 AssertRC(rc);
2059
2060 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2061 goto ResumeExecution;
2062 }
2063
2064 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2065 if (rc == VINF_SUCCESS)
2066 {
2067 /* EIP has been updated already. */
2068 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2069
2070 /* Only resume if successful. */
2071 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2072 goto ResumeExecution;
2073 }
2074 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2075 break;
2076 }
2077
2078 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
2079 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
2080 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
2081 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
2082 {
2083 uint32_t cbSize;
2084
2085 Log2(("SVM: %RGv mov x, dr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_DR0));
2086 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2087
2088 if (!DBGFIsStepping(pVCpu))
2089 {
2090 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2091
2092 /* Disable drx move intercepts. */
2093 pVMCB->ctrl.u16InterceptRdDRx = 0;
2094 pVMCB->ctrl.u16InterceptWrDRx = 0;
2095
2096 /* Save the host and load the guest debug state. */
2097 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
2098 AssertRC(rc);
2099
2100 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2101 goto ResumeExecution;
2102 }
2103
2104 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2105 if (rc == VINF_SUCCESS)
2106 {
2107 /* EIP has been updated already. */
2108
2109 /* Only resume if successful. */
2110 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2111 goto ResumeExecution;
2112 }
2113 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2114 break;
2115 }
2116
2117 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2118 case SVM_EXIT_IOIO: /* I/O instruction. */
2119 {
2120 SVM_IOIO_EXIT IoExitInfo;
2121 uint32_t uIOSize, uAndVal;
2122
2123 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
2124
2125 /** @todo could use a lookup table here */
2126 if (IoExitInfo.n.u1OP8)
2127 {
2128 uIOSize = 1;
2129 uAndVal = 0xff;
2130 }
2131 else
2132 if (IoExitInfo.n.u1OP16)
2133 {
2134 uIOSize = 2;
2135 uAndVal = 0xffff;
2136 }
2137 else
2138 if (IoExitInfo.n.u1OP32)
2139 {
2140 uIOSize = 4;
2141 uAndVal = 0xffffffff;
2142 }
2143 else
2144 {
2145 AssertFailed(); /* should be fatal. */
2146 rc = VINF_EM_RAW_EMULATE_INSTR;
2147 break;
2148 }
2149
2150 if (IoExitInfo.n.u1STR)
2151 {
2152 /* ins/outs */
2153 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2154
2155 /* Disassemble manually to deal with segment prefixes. */
2156 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, NULL);
2157 if (rc == VINF_SUCCESS)
2158 {
2159 if (IoExitInfo.n.u1Type == 0)
2160 {
2161 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2162 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2163 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2164 }
2165 else
2166 {
2167 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2168 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2169 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2170 }
2171 }
2172 else
2173 rc = VINF_EM_RAW_EMULATE_INSTR;
2174 }
2175 else
2176 {
2177 /* normal in/out */
2178 Assert(!IoExitInfo.n.u1REP);
2179
2180 if (IoExitInfo.n.u1Type == 0)
2181 {
2182 Log2(("IOMIOPortWrite %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
2183 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2184 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
2185 if (rc == VINF_IOM_HC_IOPORT_WRITE)
2186 HWACCMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pVMCB->ctrl.u64ExitInfo2, IoExitInfo.n.u16Port, uAndVal, uIOSize);
2187 }
2188 else
2189 {
2190 uint32_t u32Val = 0;
2191
2192 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2193 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
2194 if (IOM_SUCCESS(rc))
2195 {
2196 /* Write back to the EAX register. */
2197 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2198 Log2(("IOMIOPortRead %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
2199 }
2200 else
2201 if (rc == VINF_IOM_HC_IOPORT_READ)
2202 HWACCMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pVMCB->ctrl.u64ExitInfo2, IoExitInfo.n.u16Port, uAndVal, uIOSize);
2203 }
2204 }
2205 /*
2206 * Handled the I/O return codes.
2207 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2208 */
2209 if (IOM_SUCCESS(rc))
2210 {
2211 /* Update EIP and continue execution. */
2212 pCtx->rip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
2213 if (RT_LIKELY(rc == VINF_SUCCESS))
2214 {
2215 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2216 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2217 {
2218 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2219 for (unsigned i=0;i<4;i++)
2220 {
2221 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2222
2223 if ( (IoExitInfo.n.u16Port >= pCtx->dr[i] && IoExitInfo.n.u16Port < pCtx->dr[i] + uBPLen)
2224 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2225 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2226 {
2227 SVM_EVENT Event;
2228
2229 Assert(CPUMIsGuestDebugStateActive(pVCpu));
2230
2231 /* Clear all breakpoint status flags and set the one we just hit. */
2232 pCtx->dr[6] &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2233 pCtx->dr[6] |= (uint64_t)RT_BIT(i);
2234
2235 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2236 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2237 * the contents have been read.
2238 */
2239 pVMCB->guest.u64DR6 = pCtx->dr[6];
2240
2241 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2242 pCtx->dr[7] &= ~X86_DR7_GD;
2243
2244 /* Paranoia. */
2245 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2246 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2247 pCtx->dr[7] |= 0x400; /* must be one */
2248
2249 pVMCB->guest.u64DR7 = pCtx->dr[7];
2250
2251 /* Inject the exception. */
2252 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2253
2254 Event.au64[0] = 0;
2255 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
2256 Event.n.u1Valid = 1;
2257 Event.n.u8Vector = X86_XCPT_DB;
2258
2259 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2260
2261 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2262 goto ResumeExecution;
2263 }
2264 }
2265 }
2266
2267 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2268 goto ResumeExecution;
2269 }
2270 Log2(("EM status from IO at %RGv %x size %d: %Rrc\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize, rc));
2271 break;
2272 }
2273
2274#ifdef VBOX_STRICT
2275 if (rc == VINF_IOM_HC_IOPORT_READ)
2276 Assert(IoExitInfo.n.u1Type != 0);
2277 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2278 Assert(IoExitInfo.n.u1Type == 0);
2279 else
2280 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2281#endif
2282 Log2(("Failed IO at %RGv %x size %d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2283 break;
2284 }
2285
2286 case SVM_EXIT_HLT:
2287 /** Check if external interrupts are pending; if so, don't switch back. */
2288 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitHlt);
2289 pCtx->rip++; /* skip hlt */
2290 if ( pCtx->eflags.Bits.u1IF
2291 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2292 goto ResumeExecution;
2293
2294 rc = VINF_EM_HALT;
2295 break;
2296
2297 case SVM_EXIT_MWAIT_UNCOND:
2298 Log2(("SVM: mwait\n"));
2299 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMwait);
2300 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
2301 if ( rc == VINF_EM_HALT
2302 || rc == VINF_SUCCESS)
2303 {
2304 /* Update EIP and continue execution. */
2305 pCtx->rip += 3; /* Note: hardcoded opcode size assumption! */
2306
2307 /** Check if external interrupts are pending; if so, don't switch back. */
2308 if ( rc == VINF_SUCCESS
2309 || ( rc == VINF_EM_HALT
2310 && pCtx->eflags.Bits.u1IF
2311 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2312 )
2313 goto ResumeExecution;
2314 }
2315 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", rc));
2316 break;
2317
2318 case SVM_EXIT_VMMCALL:
2319 rc = svmR0EmulateTprVMMCall(pVM, pVCpu, pCtx);
2320 if (rc == VINF_SUCCESS)
2321 {
2322 goto ResumeExecution; /* rip already updated. */
2323 }
2324 /* no break */
2325
2326 case SVM_EXIT_RSM:
2327 case SVM_EXIT_INVLPGA:
2328 case SVM_EXIT_VMRUN:
2329 case SVM_EXIT_VMLOAD:
2330 case SVM_EXIT_VMSAVE:
2331 case SVM_EXIT_STGI:
2332 case SVM_EXIT_CLGI:
2333 case SVM_EXIT_SKINIT:
2334 {
2335 /* Unsupported instructions. */
2336 SVM_EVENT Event;
2337
2338 Event.au64[0] = 0;
2339 Event.n.u3Type = SVM_EVENT_EXCEPTION;
2340 Event.n.u1Valid = 1;
2341 Event.n.u8Vector = X86_XCPT_UD;
2342
2343 Log(("Forced #UD trap at %RGv\n", (RTGCPTR)pCtx->rip));
2344 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2345
2346 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2347 goto ResumeExecution;
2348 }
2349
2350 /* Emulate in ring 3. */
2351 case SVM_EXIT_MSR:
2352 {
2353 uint32_t cbSize;
2354
2355 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
2356 if ( pVM->hwaccm.s.svm.fTPRPatchingActive
2357 && pCtx->ecx == MSR_K8_LSTAR
2358 && pVMCB->ctrl.u64ExitInfo1 == 1 /* wrmsr */)
2359 {
2360 if ((pCtx->eax & 0xff) != u8LastTPR)
2361 {
2362 Log(("SVM: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
2363
2364 /* Our patch code uses LSTAR for TPR caching. */
2365 rc = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
2366 AssertRC(rc);
2367 }
2368
2369 /* Skip the instruction and continue. */
2370 pCtx->rip += 2; /* wrmsr = [0F 30] */
2371
2372 /* Only resume if successful. */
2373 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2374 goto ResumeExecution;
2375 }
2376
2377 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2378 STAM_COUNTER_INC((pVMCB->ctrl.u64ExitInfo1 == 0) ? &pVCpu->hwaccm.s.StatExitRdmsr : &pVCpu->hwaccm.s.StatExitWrmsr);
2379 Log(("SVM: %s\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr"));
2380 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2381 if (rc == VINF_SUCCESS)
2382 {
2383 /* EIP has been updated already. */
2384
2385 /* Only resume if successful. */
2386 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2387 goto ResumeExecution;
2388 }
2389 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr", rc));
2390 break;
2391 }
2392
2393 case SVM_EXIT_MONITOR:
2394 case SVM_EXIT_PAUSE:
2395 case SVM_EXIT_MWAIT_ARMED:
2396 case SVM_EXIT_TASK_SWITCH: /* can change CR3; emulate */
2397 rc = VERR_EM_INTERPRETER;
2398 break;
2399
2400 case SVM_EXIT_SHUTDOWN:
2401 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2402 break;
2403
2404 case SVM_EXIT_IDTR_READ:
2405 case SVM_EXIT_GDTR_READ:
2406 case SVM_EXIT_LDTR_READ:
2407 case SVM_EXIT_TR_READ:
2408 case SVM_EXIT_IDTR_WRITE:
2409 case SVM_EXIT_GDTR_WRITE:
2410 case SVM_EXIT_LDTR_WRITE:
2411 case SVM_EXIT_TR_WRITE:
2412 case SVM_EXIT_CR0_SEL_WRITE:
2413 default:
2414 /* Unexpected exit codes. */
2415 rc = VERR_EM_INTERNAL_ERROR;
2416 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
2417 break;
2418 }
2419
2420end:
2421
2422 /* Signal changes for the recompiler. */
2423 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2424
2425 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
2426 if (exitCode == SVM_EXIT_INTR)
2427 {
2428 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2429 /* On the next entry we'll only sync the host context. */
2430 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2431 }
2432 else
2433 {
2434 /* On the next entry we'll sync everything. */
2435 /** @todo we can do better than this */
2436 /* Not in the VINF_PGM_CHANGE_MODE though! */
2437 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2438 }
2439
2440 /* translate into a less severe return code */
2441 if (rc == VERR_EM_INTERPRETER)
2442 rc = VINF_EM_RAW_EMULATE_INSTR;
2443
2444 /* Just set the correct state here instead of trying to catch every goto above. */
2445 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
2446
2447#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2448 /* Restore interrupts if we exitted after disabling them. */
2449 if (uOldEFlags != ~(RTCCUINTREG)0)
2450 ASMSetFlags(uOldEFlags);
2451#endif
2452
2453 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2454 return rc;
2455}
2456
2457/**
2458 * Emulate simple mov tpr instruction
2459 *
2460 * @returns VBox status code.
2461 * @param pVM The VM to operate on.
2462 * @param pVCpu The VM CPU to operate on.
2463 * @param pCtx CPU context
2464 */
2465static int svmR0EmulateTprVMMCall(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2466{
2467 int rc;
2468
2469 LogFlow(("Emulated VMMCall TPR access replacement at %RGv\n", pCtx->rip));
2470
2471 while (true)
2472 {
2473 bool fPending;
2474 uint8_t u8Tpr;
2475
2476 PHWACCMTPRPATCH pPatch = (PHWACCMTPRPATCH)RTAvloU32Get(&pVM->hwaccm.s.svm.PatchTree, (AVLOU32KEY)pCtx->eip);
2477 if (!pPatch)
2478 break;
2479
2480 switch(pPatch->enmType)
2481 {
2482 case HWACCMTPRINSTR_READ:
2483 /* TPR caching in CR8 */
2484 rc = PDMApicGetTPR(pVCpu, &u8Tpr, &fPending);
2485 AssertRC(rc);
2486
2487 rc = DISWriteReg32(CPUMCTX2CORE(pCtx), pPatch->uDstOperand, u8Tpr);
2488 AssertRC(rc);
2489
2490 LogFlow(("Emulated read successfully\n"));
2491 pCtx->rip += pPatch->cbOp;
2492 break;
2493
2494 case HWACCMTPRINSTR_WRITE_REG:
2495 case HWACCMTPRINSTR_WRITE_IMM:
2496 /* Fetch the new TPR value */
2497 if (pPatch->enmType == HWACCMTPRINSTR_WRITE_REG)
2498 {
2499 uint32_t val;
2500
2501 rc = DISFetchReg32(CPUMCTX2CORE(pCtx), pPatch->uSrcOperand, &val);
2502 AssertRC(rc);
2503 u8Tpr = val;
2504 }
2505 else
2506 u8Tpr = (uint8_t)pPatch->uSrcOperand;
2507
2508 rc = PDMApicSetTPR(pVCpu, u8Tpr);
2509 AssertRC(rc);
2510 LogFlow(("Emulated write successfully\n"));
2511 pCtx->rip += pPatch->cbOp;
2512 break;
2513 default:
2514 AssertFailedReturn(VERR_INTERNAL_ERROR);
2515 }
2516 }
2517 return VINF_SUCCESS;
2518}
2519
2520
2521/**
2522 * Enters the AMD-V session
2523 *
2524 * @returns VBox status code.
2525 * @param pVM The VM to operate on.
2526 * @param pVCpu The VM CPU to operate on.
2527 * @param pCpu CPU info struct
2528 */
2529VMMR0DECL(int) SVMR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
2530{
2531 Assert(pVM->hwaccm.s.svm.fSupported);
2532
2533 LogFlow(("SVMR0Enter cpu%d last=%d asid=%d\n", pCpu->idCpu, pVCpu->hwaccm.s.idLastCpu, pVCpu->hwaccm.s.uCurrentASID));
2534 pVCpu->hwaccm.s.fResumeVM = false;
2535
2536 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
2537 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
2538
2539 return VINF_SUCCESS;
2540}
2541
2542
2543/**
2544 * Leaves the AMD-V session
2545 *
2546 * @returns VBox status code.
2547 * @param pVM The VM to operate on.
2548 * @param pVCpu The VM CPU to operate on.
2549 * @param pCtx CPU context
2550 */
2551VMMR0DECL(int) SVMR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2552{
2553 SVM_VMCB *pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
2554
2555 Assert(pVM->hwaccm.s.svm.fSupported);
2556
2557#ifdef DEBUG
2558 if (CPUMIsHyperDebugStateActive(pVCpu))
2559 {
2560 CPUMR0LoadHostDebugState(pVM, pVCpu);
2561 }
2562 else
2563#endif
2564 /* Save the guest debug state if necessary. */
2565 if (CPUMIsGuestDebugStateActive(pVCpu))
2566 {
2567 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, false /* skip DR6 */);
2568
2569 /* Intercept all DRx reads and writes again. Changed later on. */
2570 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
2571 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
2572
2573 /* Resync the debug registers the next time. */
2574 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2575 }
2576 else
2577 Assert(pVMCB->ctrl.u16InterceptRdDRx == 0xFFFF && pVMCB->ctrl.u16InterceptWrDRx == 0xFFFF);
2578
2579 return VINF_SUCCESS;
2580}
2581
2582
2583static int svmR0InterpretInvlPg(PVMCPU pVCpu, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2584{
2585 OP_PARAMVAL param1;
2586 RTGCPTR addr;
2587
2588 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2589 if(RT_FAILURE(rc))
2590 return VERR_EM_INTERPRETER;
2591
2592 switch(param1.type)
2593 {
2594 case PARMTYPE_IMMEDIATE:
2595 case PARMTYPE_ADDRESS:
2596 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
2597 return VERR_EM_INTERPRETER;
2598 addr = param1.val.val64;
2599 break;
2600
2601 default:
2602 return VERR_EM_INTERPRETER;
2603 }
2604
2605 /** @todo is addr always a flat linear address or ds based
2606 * (in absence of segment override prefixes)????
2607 */
2608 rc = PGMInvalidatePage(pVCpu, addr);
2609 if (RT_SUCCESS(rc))
2610 {
2611 /* Manually invalidate the page for the VM's TLB. */
2612 Log(("SVMR0InvlpgA %RGv ASID=%d\n", addr, uASID));
2613 SVMR0InvlpgA(addr, uASID);
2614 return VINF_SUCCESS;
2615 }
2616 AssertRC(rc);
2617 return rc;
2618}
2619
2620/**
2621 * Interprets INVLPG
2622 *
2623 * @returns VBox status code.
2624 * @retval VINF_* Scheduling instructions.
2625 * @retval VERR_EM_INTERPRETER Something we can't cope with.
2626 * @retval VERR_* Fatal errors.
2627 *
2628 * @param pVM The VM handle.
2629 * @param pRegFrame The register frame.
2630 * @param ASID Tagged TLB id for the guest
2631 *
2632 * Updates the EIP if an instruction was executed successfully.
2633 */
2634static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2635{
2636 /*
2637 * Only allow 32 & 64 bits code.
2638 */
2639 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
2640 if (enmMode != CPUMODE_16BIT)
2641 {
2642 RTGCPTR pbCode;
2643 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->rip, &pbCode);
2644 if (RT_SUCCESS(rc))
2645 {
2646 uint32_t cbOp;
2647 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2648
2649 pDis->mode = enmMode;
2650 rc = EMInterpretDisasOneEx(pVM, pVCpu, pbCode, pRegFrame, pDis, &cbOp);
2651 Assert(RT_FAILURE(rc) || pDis->pCurInstr->opcode == OP_INVLPG);
2652 if (RT_SUCCESS(rc) && pDis->pCurInstr->opcode == OP_INVLPG)
2653 {
2654 Assert(cbOp == pDis->opsize);
2655 rc = svmR0InterpretInvlPg(pVCpu, pDis, pRegFrame, uASID);
2656 if (RT_SUCCESS(rc))
2657 {
2658 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
2659 }
2660 return rc;
2661 }
2662 }
2663 }
2664 return VERR_EM_INTERPRETER;
2665}
2666
2667
2668/**
2669 * Invalidates a guest page
2670 *
2671 * @returns VBox status code.
2672 * @param pVM The VM to operate on.
2673 * @param pVCpu The VM CPU to operate on.
2674 * @param GCVirt Page to invalidate
2675 */
2676VMMR0DECL(int) SVMR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
2677{
2678 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
2679
2680 /* Skip it if a TLB flush is already pending. */
2681 if (!fFlushPending)
2682 {
2683 SVM_VMCB *pVMCB;
2684
2685 Log2(("SVMR0InvalidatePage %RGv\n", GCVirt));
2686 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2687 Assert(pVM->hwaccm.s.svm.fSupported);
2688
2689 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
2690 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2691
2692#if HC_ARCH_BITS == 32
2693 /* If we get a flush in 64 bits guest mode, then force a full TLB flush. Invlpga takes only 32 bits addresses. */
2694 if (CPUMIsGuestInLongMode(pVCpu))
2695 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
2696 else
2697#endif
2698 SVMR0InvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2699 }
2700 return VINF_SUCCESS;
2701}
2702
2703
2704#if 0 /* obsolete, but left here for clarification. */
2705/**
2706 * Invalidates a guest page by physical address
2707 *
2708 * @returns VBox status code.
2709 * @param pVM The VM to operate on.
2710 * @param pVCpu The VM CPU to operate on.
2711 * @param GCPhys Page to invalidate
2712 */
2713VMMR0DECL(int) SVMR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2714{
2715 Assert(pVM->hwaccm.s.fNestedPaging);
2716 /* invlpga only invalidates TLB entries for guest virtual addresses; we have no choice but to force a TLB flush here. */
2717 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
2718 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBInvlpga);
2719 return VINF_SUCCESS;
2720}
2721#endif
2722
2723#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2724/**
2725 * Prepares for and executes VMRUN (64 bits guests from a 32 bits hosts).
2726 *
2727 * @returns VBox status code.
2728 * @param pVMCBHostPhys Physical address of host VMCB.
2729 * @param pVMCBPhys Physical address of the VMCB.
2730 * @param pCtx Guest context.
2731 * @param pVM The VM to operate on.
2732 * @param pVCpu The VMCPU to operate on.
2733 */
2734DECLASM(int) SVMR0VMSwitcherRun64(RTHCPHYS pVMCBHostPhys, RTHCPHYS pVMCBPhys, PCPUMCTX pCtx, PVM pVM, PVMCPU pVCpu)
2735{
2736 uint32_t aParam[4];
2737
2738 aParam[0] = (uint32_t)(pVMCBHostPhys); /* Param 1: pVMCBHostPhys - Lo. */
2739 aParam[1] = (uint32_t)(pVMCBHostPhys >> 32); /* Param 1: pVMCBHostPhys - Hi. */
2740 aParam[2] = (uint32_t)(pVMCBPhys); /* Param 2: pVMCBPhys - Lo. */
2741 aParam[3] = (uint32_t)(pVMCBPhys >> 32); /* Param 2: pVMCBPhys - Hi. */
2742
2743 return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hwaccm.s.pfnSVMGCVMRun64, 4, &aParam[0]);
2744}
2745
2746/**
2747 * Executes the specified handler in 64 mode
2748 *
2749 * @returns VBox status code.
2750 * @param pVM The VM to operate on.
2751 * @param pVCpu The VMCPU to operate on.
2752 * @param pCtx Guest context
2753 * @param pfnHandler RC handler
2754 * @param cbParam Number of parameters
2755 * @param paParam Array of 32 bits parameters
2756 */
2757VMMR0DECL(int) SVMR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam, uint32_t *paParam)
2758{
2759 int rc;
2760 RTHCUINTREG uOldEFlags;
2761
2762 /* @todo This code is not guest SMP safe (hyper stack and switchers) */
2763 AssertReturn(pVM->cCPUs == 1, VERR_TOO_MANY_CPUS);
2764 Assert(pfnHandler);
2765
2766 uOldEFlags = ASMIntDisableFlags();
2767
2768 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVM));
2769 CPUMSetHyperEIP(pVCpu, pfnHandler);
2770 for (int i=(int)cbParam-1;i>=0;i--)
2771 CPUMPushHyper(pVCpu, paParam[i]);
2772
2773 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2774 /* Call switcher. */
2775 rc = pVM->hwaccm.s.pfnHost32ToGuest64R0(pVM);
2776 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2777
2778 ASMSetFlags(uOldEFlags);
2779 return rc;
2780}
2781
2782#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) */
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette