VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 8876

Last change on this file since 8876 was 8876, checked in by vboxsync, 17 years ago

ASID based TLB flushing
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 69.9 KB
Line 
1/* $Id: HWSVMR0.cpp 8876 2008-05-16 09:59:07Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include "HWSVMR0.h"
47
48static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID);
49
50/**
51 * Sets up and activates AMD-V on the current CPU
52 *
53 * @returns VBox status code.
54 * @param pCpu CPU info struct
55 * @param pVM The VM to operate on.
56 * @param pvPageCpu Pointer to the global cpu page
57 * @param pPageCpuPhys Physical address of the global cpu page
58 */
59HWACCMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
60{
61 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
62 AssertReturn(pVM, VERR_INVALID_PARAMETER);
63 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
64
65 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
66
67#ifdef LOG_ENABLED
68 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
69#endif
70
71 /* Turn on AMD-V in the EFER MSR. */
72 uint64_t val = ASMRdMsr(MSR_K6_EFER);
73 if (!(val & MSR_K6_EFER_SVME))
74 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
75
76 /* Write the physical page address where the CPU will store the host state while executing the VM. */
77 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
78
79 pCpu->uCurrentASID = 0; /* we'll aways increment this the first time (host uses ASID 0) */
80 return VINF_SUCCESS;
81}
82
83/**
84 * Deactivates AMD-V on the current CPU
85 *
86 * @returns VBox status code.
87 * @param pCpu CPU info struct
88 * @param pvPageCpu Pointer to the global cpu page
89 * @param pPageCpuPhys Physical address of the global cpu page
90 */
91HWACCMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
92{
93 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
94 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
95
96#ifdef LOG_ENABLED
97 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
98#endif
99
100 /* Turn off AMD-V in the EFER MSR. */
101 uint64_t val = ASMRdMsr(MSR_K6_EFER);
102 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
103
104 /* Invalidate host state physical address. */
105 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
106 pCpu->uCurrentASID = 0;
107
108 return VINF_SUCCESS;
109}
110
111/**
112 * Does Ring-0 per VM AMD-V init.
113 *
114 * @returns VBox status code.
115 * @param pVM The VM to operate on.
116 */
117HWACCMR0DECL(int) SVMR0InitVM(PVM pVM)
118{
119 int rc;
120
121 /* Allocate one page for the VM control block (VMCB). */
122 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
123 if (RT_FAILURE(rc))
124 return rc;
125
126 pVM->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCB);
127 pVM->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCB, 0);
128 ASMMemZero32(pVM->hwaccm.s.svm.pVMCB, PAGE_SIZE);
129
130 /* Allocate one page for the host context */
131 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
132 if (RT_FAILURE(rc))
133 return rc;
134
135 pVM->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjVMCBHost);
136 pVM->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjVMCBHost, 0);
137 ASMMemZero32(pVM->hwaccm.s.svm.pVMCBHost, PAGE_SIZE);
138
139 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
140 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
141 if (RT_FAILURE(rc))
142 return rc;
143
144 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
145 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
146 /* Set all bits to intercept all IO accesses. */
147 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
148
149 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
150 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
151 if (RT_FAILURE(rc))
152 return rc;
153
154 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
155 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
156 /* Set all bits to intercept all MSR accesses. */
157 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
158
159 /* Erratum 170 which requires a forced TLB flush for each world switch:
160 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
161 *
162 * All BH-G1/2 and DH-G1/2 models include a fix:
163 * Athlon X2: 0x6b 1/2
164 * 0x68 1/2
165 * Athlon 64: 0x7f 1
166 * 0x6f 2
167 * Sempron: 0x7f 1/2
168 * 0x6f 2
169 * 0x6c 2
170 * 0x7c 2
171 * Turion 64: 0x68 2
172 *
173 */
174 uint32_t u32Dummy;
175 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
176 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
177 u32BaseFamily= (u32Version >> 8) & 0xf;
178 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
179 u32Model = ((u32Version >> 4) & 0xf);
180 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
181 u32Stepping = u32Version & 0xf;
182 if ( u32Family == 0xf
183 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
184 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
185 {
186 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
187 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
188 }
189
190 return VINF_SUCCESS;
191}
192
193/**
194 * Does Ring-0 per VM AMD-V termination.
195 *
196 * @returns VBox status code.
197 * @param pVM The VM to operate on.
198 */
199HWACCMR0DECL(int) SVMR0TermVM(PVM pVM)
200{
201 if (pVM->hwaccm.s.svm.pMemObjVMCB)
202 {
203 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCB, false);
204 pVM->hwaccm.s.svm.pVMCB = 0;
205 pVM->hwaccm.s.svm.pVMCBPhys = 0;
206 pVM->hwaccm.s.svm.pMemObjVMCB = 0;
207 }
208 if (pVM->hwaccm.s.svm.pMemObjVMCBHost)
209 {
210 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjVMCBHost, false);
211 pVM->hwaccm.s.svm.pVMCBHost = 0;
212 pVM->hwaccm.s.svm.pVMCBHostPhys = 0;
213 pVM->hwaccm.s.svm.pMemObjVMCBHost = 0;
214 }
215 if (pVM->hwaccm.s.svm.pMemObjIOBitmap)
216 {
217 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
218 pVM->hwaccm.s.svm.pIOBitmap = 0;
219 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
220 pVM->hwaccm.s.svm.pMemObjIOBitmap = 0;
221 }
222 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap)
223 {
224 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
225 pVM->hwaccm.s.svm.pMSRBitmap = 0;
226 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
227 pVM->hwaccm.s.svm.pMemObjMSRBitmap = 0;
228 }
229 return VINF_SUCCESS;
230}
231
232/**
233 * Sets up AMD-V for the specified VM
234 *
235 * @returns VBox status code.
236 * @param pVM The VM to operate on.
237 */
238HWACCMR0DECL(int) SVMR0SetupVM(PVM pVM)
239{
240 int rc = VINF_SUCCESS;
241 SVM_VMCB *pVMCB;
242
243 AssertReturn(pVM, VERR_INVALID_PARAMETER);
244
245 Assert(pVM->hwaccm.s.svm.fSupported);
246
247 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
248 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
249
250 /* Program the control fields. Most of them never have to be changed again. */
251 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
252 /** @note CR0 & CR4 can be safely read when guest and shadow copies are identical. */
253 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4) | RT_BIT(8);
254
255 /*
256 * CR0/3/4 writes must be intercepted for obvious reasons.
257 */
258 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4) | RT_BIT(8);
259
260 /* Intercept all DRx reads and writes. */
261 pVMCB->ctrl.u16InterceptRdDRx = RT_BIT(0) | RT_BIT(1) | RT_BIT(2) | RT_BIT(3) | RT_BIT(4) | RT_BIT(5) | RT_BIT(6) | RT_BIT(7);
262 pVMCB->ctrl.u16InterceptWrDRx = RT_BIT(0) | RT_BIT(1) | RT_BIT(2) | RT_BIT(3) | RT_BIT(4) | RT_BIT(5) | RT_BIT(6) | RT_BIT(7);
263
264 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
265 * All breakpoints are automatically cleared when the VM exits.
266 */
267
268 /** @todo nested paging */
269 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
270
271 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
272 | SVM_CTRL1_INTERCEPT_VINTR
273 | SVM_CTRL1_INTERCEPT_NMI
274 | SVM_CTRL1_INTERCEPT_SMI
275 | SVM_CTRL1_INTERCEPT_INIT
276 | SVM_CTRL1_INTERCEPT_CR0 /** @todo redundant? */
277 | SVM_CTRL1_INTERCEPT_RDPMC
278 | SVM_CTRL1_INTERCEPT_CPUID
279 | SVM_CTRL1_INTERCEPT_RSM
280 | SVM_CTRL1_INTERCEPT_HLT
281 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
282 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
283 | SVM_CTRL1_INTERCEPT_INVLPG
284 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
285 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
286 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
287 ;
288 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
289 | SVM_CTRL2_INTERCEPT_VMMCALL
290 | SVM_CTRL2_INTERCEPT_VMLOAD
291 | SVM_CTRL2_INTERCEPT_VMSAVE
292 | SVM_CTRL2_INTERCEPT_STGI
293 | SVM_CTRL2_INTERCEPT_CLGI
294 | SVM_CTRL2_INTERCEPT_SKINIT
295 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
296 | SVM_CTRL2_INTERCEPT_WBINVD
297 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
298 ;
299 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
300 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
301 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
302
303 /* Virtualize masking of INTR interrupts. */
304 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
305
306 /* Set IO and MSR bitmap addresses. */
307 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
308 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
309
310 /* Enable nested paging. */
311 /** @todo how to detect support for this?? */
312 pVMCB->ctrl.u64NestedPaging = 0; /** @todo SVM_NESTED_PAGING_ENABLE; */
313
314 /* No LBR virtualization. */
315 pVMCB->ctrl.u64LBRVirt = 0;
316
317 /** The ASID must start at 1; the host uses 0. */
318 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
319
320 return rc;
321}
322
323
324/**
325 * Injects an event (trap or external interrupt)
326 *
327 * @param pVM The VM to operate on.
328 * @param pVMCB SVM control block
329 * @param pCtx CPU Context
330 * @param pIntInfo SVM interrupt info
331 */
332inline void SVMR0InjectEvent(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
333{
334#ifdef VBOX_STRICT
335 if (pEvent->n.u8Vector == 0xE)
336 Log(("SVM: Inject int %d at %VGv error code=%08x CR2=%08x intInfo=%08x\n", pEvent->n.u8Vector, pCtx->eip, pEvent->n.u32ErrorCode, pCtx->cr2, pEvent->au64[0]));
337 else
338 if (pEvent->n.u8Vector < 0x20)
339 Log(("SVM: Inject int %d at %VGv error code=%08x\n", pEvent->n.u8Vector, pCtx->eip, pEvent->n.u32ErrorCode));
340 else
341 {
342 Log(("INJ-EI: %x at %VGv\n", pEvent->n.u8Vector, pCtx->eip));
343 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
344 Assert(pCtx->eflags.u32 & X86_EFL_IF);
345 }
346#endif
347
348 /* Set event injection state. */
349 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
350}
351
352
353/**
354 * Checks for pending guest interrupts and injects them
355 *
356 * @returns VBox status code.
357 * @param pVM The VM to operate on.
358 * @param pVMCB SVM control block
359 * @param pCtx CPU Context
360 */
361static int SVMR0CheckPendingInterrupt(PVM pVM, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
362{
363 int rc;
364
365 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
366 if (pVM->hwaccm.s.Event.fPending)
367 {
368 SVM_EVENT Event;
369
370 Log(("Reinjecting event %08x %08x at %VGv\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->eip));
371 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
372 Event.au64[0] = pVM->hwaccm.s.Event.intInfo;
373 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
374
375 pVM->hwaccm.s.Event.fPending = false;
376 return VINF_SUCCESS;
377 }
378
379 /* When external interrupts are pending, we should exit the VM when IF is set. */
380 if ( !TRPMHasTrap(pVM)
381 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
382 {
383 if (!(pCtx->eflags.u32 & X86_EFL_IF))
384 {
385 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
386 {
387 Log(("Enable irq window exit!\n"));
388 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
389 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
390 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
391 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1; /* ignore the priority in the TPR; just deliver it */
392 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
393 }
394 }
395 else
396 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
397 {
398 uint8_t u8Interrupt;
399
400 rc = PDMGetInterrupt(pVM, &u8Interrupt);
401 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
402 if (VBOX_SUCCESS(rc))
403 {
404 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
405 AssertRC(rc);
406 }
407 else
408 {
409 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
410 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
411 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
412 /* Just continue */
413 }
414 }
415 else
416 Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS!!\n", pCtx->eip));
417 }
418
419#ifdef VBOX_STRICT
420 if (TRPMHasTrap(pVM))
421 {
422 uint8_t u8Vector;
423 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
424 AssertRC(rc);
425 }
426#endif
427
428 if ( pCtx->eflags.u32 & X86_EFL_IF
429 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
430 && TRPMHasTrap(pVM)
431 )
432 {
433 uint8_t u8Vector;
434 int rc;
435 TRPMEVENT enmType;
436 SVM_EVENT Event;
437 uint32_t u32ErrorCode;
438
439 Event.au64[0] = 0;
440
441 /* If a new event is pending, then dispatch it now. */
442 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &u32ErrorCode, 0);
443 AssertRC(rc);
444 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
445 Assert(enmType != TRPM_SOFTWARE_INT);
446
447 /* Clear the pending trap. */
448 rc = TRPMResetTrap(pVM);
449 AssertRC(rc);
450
451 Event.n.u8Vector = u8Vector;
452 Event.n.u1Valid = 1;
453 Event.n.u32ErrorCode = u32ErrorCode;
454
455 if (enmType == TRPM_TRAP)
456 {
457 switch (u8Vector) {
458 case 8:
459 case 10:
460 case 11:
461 case 12:
462 case 13:
463 case 14:
464 case 17:
465 /* Valid error codes. */
466 Event.n.u1ErrorCodeValid = 1;
467 break;
468 default:
469 break;
470 }
471 if (u8Vector == X86_XCPT_NMI)
472 Event.n.u3Type = SVM_EVENT_NMI;
473 else
474 Event.n.u3Type = SVM_EVENT_EXCEPTION;
475 }
476 else
477 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
478
479 STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
480 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
481 } /* if (interrupts can be dispatched) */
482
483 return VINF_SUCCESS;
484}
485
486
487/**
488 * Loads the guest state
489 *
490 * @returns VBox status code.
491 * @param pVM The VM to operate on.
492 * @param pCtx Guest context
493 */
494HWACCMR0DECL(int) SVMR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
495{
496 RTGCUINTPTR val;
497 SVM_VMCB *pVMCB;
498
499 if (pVM == NULL)
500 return VERR_INVALID_PARAMETER;
501
502 /* Setup AMD SVM. */
503 Assert(pVM->hwaccm.s.svm.fSupported);
504
505 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
506 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
507
508 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
509 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
510 {
511 SVM_WRITE_SELREG(CS, cs);
512 SVM_WRITE_SELREG(SS, ss);
513 SVM_WRITE_SELREG(DS, ds);
514 SVM_WRITE_SELREG(ES, es);
515 SVM_WRITE_SELREG(FS, fs);
516 SVM_WRITE_SELREG(GS, gs);
517 }
518
519 /* Guest CPU context: LDTR. */
520 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
521 {
522 SVM_WRITE_SELREG(LDTR, ldtr);
523 }
524
525 /* Guest CPU context: TR. */
526 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
527 {
528 SVM_WRITE_SELREG(TR, tr);
529 }
530
531 /* Guest CPU context: GDTR. */
532 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
533 {
534 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
535 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
536 }
537
538 /* Guest CPU context: IDTR. */
539 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
540 {
541 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
542 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
543 }
544
545 /*
546 * Sysenter MSRs
547 */
548 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SYSENTER_MSR)
549 {
550 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
551 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
552 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
553 }
554
555 /* Control registers */
556 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
557 {
558 val = pCtx->cr0;
559 if (CPUMIsGuestFPUStateActive(pVM) == false)
560 {
561 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
562 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
563 }
564 else
565 {
566 Assert(pVM->hwaccm.s.svm.fResumeVM == true);
567 /** @todo check if we support the old style mess correctly. */
568 if (!(val & X86_CR0_NE))
569 {
570 Log(("Forcing X86_CR0_NE!!!\n"));
571
572 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
573 if (!pVM->hwaccm.s.fFPUOldStyleOverride)
574 {
575 pVMCB->ctrl.u32InterceptException |= RT_BIT(16);
576 pVM->hwaccm.s.fFPUOldStyleOverride = true;
577 }
578 }
579 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
580 }
581 if (!(val & X86_CR0_CD))
582 val &= ~X86_CR0_NW; /* Illegal when cache is turned on. */
583
584 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
585 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
586 pVMCB->guest.u64CR0 = val;
587 }
588 /* CR2 as well */
589 pVMCB->guest.u64CR2 = pCtx->cr2;
590
591 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
592 {
593 /* Save our shadow CR3 register. */
594 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVM);
595 }
596
597 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
598 {
599 val = pCtx->cr4;
600 switch(pVM->hwaccm.s.enmShadowMode)
601 {
602 case PGMMODE_REAL:
603 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
604 AssertFailed();
605 return VERR_PGM_UNSUPPORTED_HOST_PAGING_MODE;
606
607 case PGMMODE_32_BIT: /* 32-bit paging. */
608 break;
609
610 case PGMMODE_PAE: /* PAE paging. */
611 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
612 /** @todo use normal 32 bits paging */
613 val |= X86_CR4_PAE;
614 break;
615
616 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
617 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
618 AssertFailed();
619 return VERR_PGM_UNSUPPORTED_HOST_PAGING_MODE;
620
621 default: /* shut up gcc */
622 AssertFailed();
623 return VERR_PGM_UNSUPPORTED_HOST_PAGING_MODE;
624 }
625 pVMCB->guest.u64CR4 = val;
626 }
627
628 /* Debug registers. */
629 if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
630 {
631 /** @todo DR0-6 */
632 val = pCtx->dr7;
633 val &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
634 val |= 0x400; /* must be one */
635#ifdef VBOX_STRICT
636 val = 0x400;
637#endif
638 pVMCB->guest.u64DR7 = val;
639
640 pVMCB->guest.u64DR6 = pCtx->dr6;
641 }
642
643 /* EIP, ESP and EFLAGS */
644 pVMCB->guest.u64RIP = pCtx->eip;
645 pVMCB->guest.u64RSP = pCtx->esp;
646 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
647
648 /* Set CPL */
649 pVMCB->guest.u8CPL = pCtx->ssHid.Attr.n.u2Dpl;
650
651 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
652 pVMCB->guest.u64RAX = pCtx->eax;
653
654 /* vmrun will fail otherwise. */
655 pVMCB->guest.u64EFER = MSR_K6_EFER_SVME;
656
657 /** TSC offset. */
658 if (TMCpuTickCanUseRealTSC(pVM, &pVMCB->ctrl.u64TSCOffset))
659 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
660 else
661 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
662
663 /** @todo 64 bits stuff (?):
664 * - STAR
665 * - LSTAR
666 * - CSTAR
667 * - SFMASK
668 * - KernelGSBase
669 */
670
671#ifdef DEBUG
672 /* Intercept X86_XCPT_DB if stepping is enabled */
673 if (DBGFIsStepping(pVM))
674 pVMCB->ctrl.u32InterceptException |= RT_BIT(1);
675 else
676 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(1);
677#endif
678
679 /* Done. */
680 pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
681
682 return VINF_SUCCESS;
683}
684
685
686/**
687 * Runs guest code in an SVM VM.
688 *
689 * @todo This can be much more efficient, when we only sync that which has actually changed. (this is the first attempt only)
690 *
691 * @returns VBox status code.
692 * @param pVM The VM to operate on.
693 * @param pCtx Guest context
694 * @param pCpu CPU info struct
695 */
696HWACCMR0DECL(int) SVMR0RunGuestCode(PVM pVM, CPUMCTX *pCtx, PHWACCM_CPUINFO pCpu)
697{
698 int rc = VINF_SUCCESS;
699 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
700 SVM_VMCB *pVMCB;
701 bool fGuestStateSynced = false;
702 unsigned cResume = 0;
703
704 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
705
706 AssertReturn(pCpu->fSVMConfigured, VERR_EM_INTERNAL_ERROR);
707
708 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
709 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
710
711 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
712 */
713ResumeExecution:
714 /* Safety precaution; looping for too long here can have a very bad effect on the host */
715 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
716 {
717 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
718 rc = VINF_EM_RAW_INTERRUPT;
719 goto end;
720 }
721
722 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
723 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
724 {
725 Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->eip, EMGetInhibitInterruptsPC(pVM)));
726 if (pCtx->eip != EMGetInhibitInterruptsPC(pVM))
727 {
728 /** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
729 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
730 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
731 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
732 */
733 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
734 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
735 pVMCB->ctrl.u64IntShadow = 0;
736 }
737 }
738 else
739 {
740 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
741 pVMCB->ctrl.u64IntShadow = 0;
742 }
743
744 /* Check for pending actions that force us to go back to ring 3. */
745#ifdef DEBUG
746 /* Intercept X86_XCPT_DB if stepping is enabled */
747 if (!DBGFIsStepping(pVM))
748#endif
749 {
750 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
751 {
752 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
753 STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
754 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
755 rc = VINF_EM_RAW_TO_R3;
756 goto end;
757 }
758 }
759
760 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
761 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
762 {
763 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
764 rc = VINF_EM_PENDING_REQUEST;
765 goto end;
766 }
767
768 /* When external interrupts are pending, we should exit the VM when IF is set. */
769 /** @note *after* VM_FF_INHIBIT_INTERRUPTS check!!! */
770 rc = SVMR0CheckPendingInterrupt(pVM, pVMCB, pCtx);
771 if (VBOX_FAILURE(rc))
772 {
773 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
774 goto end;
775 }
776
777 /* Load the guest state */
778 rc = SVMR0LoadGuestState(pVM, pCtx);
779 if (rc != VINF_SUCCESS)
780 {
781 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
782 goto end;
783 }
784 fGuestStateSynced = true;
785
786 /* All done! Let's start VM execution. */
787 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
788
789 /* Make sure we flush the TLB when required. */
790 if ( pVM->hwaccm.s.svm.fForceTLBFlush
791 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
792 {
793 if (++pCpu->uCurrentASID >= pVM->hwaccm.s.svm.u32MaxASID)
794 {
795 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
796 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
797 }
798 else
799 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushASID);
800 }
801 else
802 {
803 Assert(pVM->hwaccm.s.svm.fForceTLBFlush == pVM->hwaccm.s.svm.fAlwaysFlushTLB);
804 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVM->hwaccm.s.svm.fForceTLBFlush;
805 }
806
807 Assert(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.svm.u32MaxASID);
808 pVMCB->ctrl.TLBCtrl.n.u32ASID = pCpu->uCurrentASID;
809
810#ifdef VBOX_WITH_STATISTICS
811 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
812 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBWorldSwitch);
813 else
814 STAM_COUNTER_INC(&pVM->hwaccm.s.StatNoFlushTLBWorldSwitch);
815#endif
816
817 /* In case we execute a goto ResumeExecution later on. */
818 pVM->hwaccm.s.svm.fResumeVM = true;
819 pVM->hwaccm.s.svm.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
820
821 Assert(sizeof(pVM->hwaccm.s.svm.pVMCBPhys) == 8);
822 Assert(pVMCB->ctrl.u32InterceptCtrl2 == ( SVM_CTRL2_INTERCEPT_VMRUN /* required */
823 | SVM_CTRL2_INTERCEPT_VMMCALL
824 | SVM_CTRL2_INTERCEPT_VMLOAD
825 | SVM_CTRL2_INTERCEPT_VMSAVE
826 | SVM_CTRL2_INTERCEPT_STGI
827 | SVM_CTRL2_INTERCEPT_CLGI
828 | SVM_CTRL2_INTERCEPT_SKINIT
829 | SVM_CTRL2_INTERCEPT_RDTSCP /* AMD only; we don't support this one */
830 | SVM_CTRL2_INTERCEPT_WBINVD
831 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
832 ));
833 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
834 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
835 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
836 Assert(pVMCB->ctrl.u64NestedPaging == 0);
837 Assert(pVMCB->ctrl.u64LBRVirt == 0);
838
839 SVMVMRun(pVM->hwaccm.s.svm.pVMCBHostPhys, pVM->hwaccm.s.svm.pVMCBPhys, pCtx);
840 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
841
842 /**
843 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
844 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
845 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
846 */
847
848 STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
849
850 /* Reason for the VM exit */
851 exitCode = pVMCB->ctrl.u64ExitCode;
852
853 if (exitCode == (uint64_t)SVM_EXIT_INVALID) /* Invalid guest state. */
854 {
855 HWACCMDumpRegs(pCtx);
856#ifdef DEBUG
857 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
858 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
859 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
860 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
861 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
862 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
863 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
864 Log(("ctrl.u64IOPMPhysAddr %VX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
865 Log(("ctrl.u64MSRPMPhysAddr %VX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
866 Log(("ctrl.u64TSCOffset %VX64\n", pVMCB->ctrl.u64TSCOffset));
867
868 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
869 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
870 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
871 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
872
873 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
874 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
875 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
876 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
877 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
878 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
879 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
880 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
881 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
882 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
883
884 Log(("ctrl.u64IntShadow %VX64\n", pVMCB->ctrl.u64IntShadow));
885 Log(("ctrl.u64ExitCode %VX64\n", pVMCB->ctrl.u64ExitCode));
886 Log(("ctrl.u64ExitInfo1 %VX64\n", pVMCB->ctrl.u64ExitInfo1));
887 Log(("ctrl.u64ExitInfo2 %VX64\n", pVMCB->ctrl.u64ExitInfo2));
888 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
889 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
890 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
891 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
892 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
893 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
894 Log(("ctrl.u64NestedPaging %VX64\n", pVMCB->ctrl.u64NestedPaging));
895 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
896 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
897 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
898 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
899 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
900 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
901
902 Log(("ctrl.u64HostCR3 %VX64\n", pVMCB->ctrl.u64HostCR3));
903 Log(("ctrl.u64LBRVirt %VX64\n", pVMCB->ctrl.u64LBRVirt));
904
905 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
906 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
907 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
908 Log(("guest.CS.u64Base %VX64\n", pVMCB->guest.CS.u64Base));
909 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
910 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
911 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
912 Log(("guest.DS.u64Base %VX64\n", pVMCB->guest.DS.u64Base));
913 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
914 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
915 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
916 Log(("guest.ES.u64Base %VX64\n", pVMCB->guest.ES.u64Base));
917 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
918 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
919 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
920 Log(("guest.FS.u64Base %VX64\n", pVMCB->guest.FS.u64Base));
921 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
922 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
923 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
924 Log(("guest.GS.u64Base %VX64\n", pVMCB->guest.GS.u64Base));
925
926 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
927 Log(("guest.GDTR.u64Base %VX64\n", pVMCB->guest.GDTR.u64Base));
928
929 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
930 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
931 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
932 Log(("guest.LDTR.u64Base %VX64\n", pVMCB->guest.LDTR.u64Base));
933
934 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
935 Log(("guest.IDTR.u64Base %VX64\n", pVMCB->guest.IDTR.u64Base));
936
937 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
938 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
939 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
940 Log(("guest.TR.u64Base %VX64\n", pVMCB->guest.TR.u64Base));
941
942 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
943 Log(("guest.u64CR0 %VX64\n", pVMCB->guest.u64CR0));
944 Log(("guest.u64CR2 %VX64\n", pVMCB->guest.u64CR2));
945 Log(("guest.u64CR3 %VX64\n", pVMCB->guest.u64CR3));
946 Log(("guest.u64CR4 %VX64\n", pVMCB->guest.u64CR4));
947 Log(("guest.u64DR6 %VX64\n", pVMCB->guest.u64DR6));
948 Log(("guest.u64DR7 %VX64\n", pVMCB->guest.u64DR7));
949
950 Log(("guest.u64RIP %VX64\n", pVMCB->guest.u64RIP));
951 Log(("guest.u64RSP %VX64\n", pVMCB->guest.u64RSP));
952 Log(("guest.u64RAX %VX64\n", pVMCB->guest.u64RAX));
953 Log(("guest.u64RFlags %VX64\n", pVMCB->guest.u64RFlags));
954
955 Log(("guest.u64SysEnterCS %VX64\n", pVMCB->guest.u64SysEnterCS));
956 Log(("guest.u64SysEnterEIP %VX64\n", pVMCB->guest.u64SysEnterEIP));
957 Log(("guest.u64SysEnterESP %VX64\n", pVMCB->guest.u64SysEnterESP));
958
959 Log(("guest.u64EFER %VX64\n", pVMCB->guest.u64EFER));
960 Log(("guest.u64STAR %VX64\n", pVMCB->guest.u64STAR));
961 Log(("guest.u64LSTAR %VX64\n", pVMCB->guest.u64LSTAR));
962 Log(("guest.u64CSTAR %VX64\n", pVMCB->guest.u64CSTAR));
963 Log(("guest.u64SFMASK %VX64\n", pVMCB->guest.u64SFMASK));
964 Log(("guest.u64KernelGSBase %VX64\n", pVMCB->guest.u64KernelGSBase));
965 Log(("guest.u64GPAT %VX64\n", pVMCB->guest.u64GPAT));
966 Log(("guest.u64DBGCTL %VX64\n", pVMCB->guest.u64DBGCTL));
967 Log(("guest.u64BR_FROM %VX64\n", pVMCB->guest.u64BR_FROM));
968 Log(("guest.u64BR_TO %VX64\n", pVMCB->guest.u64BR_TO));
969 Log(("guest.u64LASTEXCPFROM %VX64\n", pVMCB->guest.u64LASTEXCPFROM));
970 Log(("guest.u64LASTEXCPTO %VX64\n", pVMCB->guest.u64LASTEXCPTO));
971
972#endif
973 rc = VERR_SVM_UNABLE_TO_START_VM;
974 goto end;
975 }
976
977 /* Let's first sync back eip, esp, and eflags. */
978 pCtx->eip = pVMCB->guest.u64RIP;
979 pCtx->esp = pVMCB->guest.u64RSP;
980 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
981 /* eax is saved/restore across the vmrun instruction */
982 pCtx->eax = pVMCB->guest.u64RAX;
983
984 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
985 SVM_READ_SELREG(SS, ss);
986 SVM_READ_SELREG(CS, cs);
987 SVM_READ_SELREG(DS, ds);
988 SVM_READ_SELREG(ES, es);
989 SVM_READ_SELREG(FS, fs);
990 SVM_READ_SELREG(GS, gs);
991
992 /** @note no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
993
994 /** @note NOW IT'S SAFE FOR LOGGING! */
995
996 /* Take care of instruction fusing (sti, mov ss) */
997 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
998 {
999 Log(("uInterruptState %x eip=%VGv\n", pVMCB->ctrl.u64IntShadow, pCtx->eip));
1000 EMSetInhibitInterruptsPC(pVM, pCtx->eip);
1001 }
1002 else
1003 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1004
1005 Log2(("exitCode = %x\n", exitCode));
1006
1007 /* Check if an injected event was interrupted prematurely. */
1008 pVM->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1009 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1010 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1011 {
1012 Log(("Pending inject %VX64 at %08x exit=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->eip, exitCode));
1013 pVM->hwaccm.s.Event.fPending = true;
1014 /* Error code present? (redundant) */
1015 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1016 {
1017 pVM->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1018 }
1019 else
1020 pVM->hwaccm.s.Event.errCode = 0;
1021 }
1022 STAM_COUNTER_INC(&pVM->hwaccm.s.pStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1023
1024 /* Deal with the reason of the VM-exit. */
1025 switch (exitCode)
1026 {
1027 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1028 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1029 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1030 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1031 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1032 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1033 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1034 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1035 {
1036 /* Pending trap. */
1037 SVM_EVENT Event;
1038 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1039
1040 Log2(("Hardware/software interrupt %d\n", vector));
1041 switch (vector)
1042 {
1043#ifdef DEBUG
1044 case X86_XCPT_DB:
1045 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), pVMCB->guest.u64DR6);
1046 Assert(rc != VINF_EM_RAW_GUEST_TRAP);
1047 break;
1048#endif
1049
1050 case X86_XCPT_NM:
1051 {
1052 uint32_t oldCR0;
1053
1054 Log(("#NM fault at %VGv\n", pCtx->eip));
1055
1056 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1057 oldCR0 = ASMGetCR0();
1058 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1059 rc = CPUMHandleLazyFPU(pVM);
1060 if (rc == VINF_SUCCESS)
1061 {
1062 Assert(CPUMIsGuestFPUStateActive(pVM));
1063
1064 /* CPUMHandleLazyFPU could have changed CR0; restore it. */
1065 ASMSetCR0(oldCR0);
1066
1067 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1068
1069 /* Continue execution. */
1070 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1071 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1072
1073 goto ResumeExecution;
1074 }
1075
1076 Log(("Forward #NM fault to the guest\n"));
1077 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1078
1079 Event.au64[0] = 0;
1080 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1081 Event.n.u1Valid = 1;
1082 Event.n.u8Vector = X86_XCPT_NM;
1083
1084 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1085 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1086 goto ResumeExecution;
1087 }
1088
1089 case X86_XCPT_PF: /* Page fault */
1090 {
1091 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1092 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1093
1094 Log2(("Page fault at %VGv cr2=%VGv error code %x\n", pCtx->eip, uFaultAddress, errCode));
1095 /* Exit qualification contains the linear address of the page fault. */
1096 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1097 TRPMSetErrorCode(pVM, errCode);
1098 TRPMSetFaultAddress(pVM, uFaultAddress);
1099
1100 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1101 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1102 Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->eip, rc));
1103 if (rc == VINF_SUCCESS)
1104 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1105 Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->eip, uFaultAddress, errCode));
1106 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1107
1108 TRPMResetTrap(pVM);
1109
1110 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1111 goto ResumeExecution;
1112 }
1113 else
1114 if (rc == VINF_EM_RAW_GUEST_TRAP)
1115 { /* A genuine pagefault.
1116 * Forward the trap to the guest by injecting the exception and resuming execution.
1117 */
1118 Log2(("Forward page fault to the guest\n"));
1119 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1120 /* The error code might have been changed. */
1121 errCode = TRPMGetErrorCode(pVM);
1122
1123 TRPMResetTrap(pVM);
1124
1125 /* Now we must update CR2. */
1126 pCtx->cr2 = uFaultAddress;
1127
1128 Event.au64[0] = 0;
1129 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1130 Event.n.u1Valid = 1;
1131 Event.n.u8Vector = X86_XCPT_PF;
1132 Event.n.u1ErrorCodeValid = 1;
1133 Event.n.u32ErrorCode = errCode;
1134
1135 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1136
1137 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1138 goto ResumeExecution;
1139 }
1140#ifdef VBOX_STRICT
1141 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1142 Log(("PGMTrap0eHandler failed with %d\n", rc));
1143#endif
1144 /* Need to go back to the recompiler to emulate the instruction. */
1145 TRPMResetTrap(pVM);
1146 break;
1147 }
1148
1149 case X86_XCPT_MF: /* Floating point exception. */
1150 {
1151 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1152 if (!(pCtx->cr0 & X86_CR0_NE))
1153 {
1154 /* old style FPU error reporting needs some extra work. */
1155 /** @todo don't fall back to the recompiler, but do it manually. */
1156 rc = VINF_EM_RAW_EMULATE_INSTR;
1157 break;
1158 }
1159 Log(("Trap %x at %VGv\n", vector, pCtx->eip));
1160
1161 Event.au64[0] = 0;
1162 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1163 Event.n.u1Valid = 1;
1164 Event.n.u8Vector = X86_XCPT_MF;
1165
1166 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1167
1168 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1169 goto ResumeExecution;
1170 }
1171
1172#ifdef VBOX_STRICT
1173 case X86_XCPT_GP: /* General protection failure exception.*/
1174 case X86_XCPT_UD: /* Unknown opcode exception. */
1175 case X86_XCPT_DE: /* Debug exception. */
1176 case X86_XCPT_SS: /* Stack segment exception. */
1177 case X86_XCPT_NP: /* Segment not present exception. */
1178 {
1179 Event.au64[0] = 0;
1180 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1181 Event.n.u1Valid = 1;
1182 Event.n.u8Vector = vector;
1183
1184 switch(vector)
1185 {
1186 case X86_XCPT_GP:
1187 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1188 Event.n.u1ErrorCodeValid = 1;
1189 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1190 break;
1191 case X86_XCPT_DE:
1192 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
1193 break;
1194 case X86_XCPT_UD:
1195 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
1196 break;
1197 case X86_XCPT_SS:
1198 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
1199 Event.n.u1ErrorCodeValid = 1;
1200 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1201 break;
1202 case X86_XCPT_NP:
1203 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
1204 Event.n.u1ErrorCodeValid = 1;
1205 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1206 break;
1207 }
1208 Log(("Trap %x at %VGv\n", vector, pCtx->eip));
1209 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1210
1211 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1212 goto ResumeExecution;
1213 }
1214#endif
1215 default:
1216 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1217 rc = VERR_EM_INTERNAL_ERROR;
1218 break;
1219
1220 } /* switch (vector) */
1221 break;
1222 }
1223
1224 case SVM_EXIT_VINTR:
1225 /* A virtual interrupt is about to be delivered, which means IF=1. */
1226 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1227 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1228 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 0;
1229 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1230 goto ResumeExecution;
1231
1232 case SVM_EXIT_FERR_FREEZE:
1233 case SVM_EXIT_INTR:
1234 case SVM_EXIT_NMI:
1235 case SVM_EXIT_SMI:
1236 case SVM_EXIT_INIT:
1237 /* External interrupt; leave to allow it to be dispatched again. */
1238 rc = VINF_EM_RAW_INTERRUPT;
1239 break;
1240
1241 case SVM_EXIT_WBINVD:
1242 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1243 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
1244 /* Skip instruction and continue directly. */
1245 pCtx->eip += 2; /** @note hardcoded opcode size! */
1246 /* Continue execution.*/
1247 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1248 goto ResumeExecution;
1249
1250 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1251 {
1252 Log2(("SVM: Cpuid %x\n", pCtx->eax));
1253 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
1254 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
1255 if (rc == VINF_SUCCESS)
1256 {
1257 /* Update EIP and continue execution. */
1258 pCtx->eip += 2; /** @note hardcoded opcode size! */
1259 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1260 goto ResumeExecution;
1261 }
1262 AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
1263 rc = VINF_EM_RAW_EMULATE_INSTR;
1264 break;
1265 }
1266
1267 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1268 {
1269 Log2(("SVM: Rdtsc\n"));
1270 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
1271 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
1272 if (rc == VINF_SUCCESS)
1273 {
1274 /* Update EIP and continue execution. */
1275 pCtx->eip += 2; /** @note hardcoded opcode size! */
1276 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1277 goto ResumeExecution;
1278 }
1279 AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
1280 rc = VINF_EM_RAW_EMULATE_INSTR;
1281 break;
1282 }
1283
1284 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1285 {
1286 Log2(("SVM: invlpg\n"));
1287 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
1288
1289 /* Truly a pita. Why can't SVM give the same information as VMX? */
1290 rc = SVMR0InterpretInvpg(pVM, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1291 if (rc == VINF_SUCCESS)
1292 {
1293 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageInvlpg);
1294 goto ResumeExecution; /* eip already updated */
1295 }
1296 break;
1297 }
1298
1299 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1300 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1301 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1302 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1303 {
1304 uint32_t cbSize;
1305
1306 Log2(("SVM: %VGv mov cr%d, \n", pCtx->eip, exitCode - SVM_EXIT_WRITE_CR0));
1307 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
1308 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1309
1310 switch (exitCode - SVM_EXIT_WRITE_CR0)
1311 {
1312 case 0:
1313 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1314 break;
1315 case 2:
1316 break;
1317 case 3:
1318 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1319 break;
1320 case 4:
1321 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1322 break;
1323 default:
1324 AssertFailed();
1325 }
1326 /* Check if a sync operation is pending. */
1327 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1328 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
1329 {
1330 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
1331 AssertRC(rc);
1332
1333 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBCRxChange);
1334
1335 /** @note Force a TLB flush. SVM requires us to do it manually. */
1336 pVM->hwaccm.s.svm.fForceTLBFlush = true;
1337 }
1338 if (rc == VINF_SUCCESS)
1339 {
1340 /* EIP has been updated already. */
1341
1342 /* Only resume if successful. */
1343 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1344 goto ResumeExecution;
1345 }
1346 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1347 break;
1348 }
1349
1350 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
1351 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
1352 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
1353 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
1354 {
1355 uint32_t cbSize;
1356
1357 Log2(("SVM: %VGv mov x, cr%d\n", pCtx->eip, exitCode - SVM_EXIT_READ_CR0));
1358 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
1359 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1360 if (rc == VINF_SUCCESS)
1361 {
1362 /* EIP has been updated already. */
1363
1364 /* Only resume if successful. */
1365 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1366 goto ResumeExecution;
1367 }
1368 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1369 break;
1370 }
1371
1372 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
1373 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
1374 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
1375 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
1376 {
1377 uint32_t cbSize;
1378
1379 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->eip, exitCode - SVM_EXIT_WRITE_DR0));
1380 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1381 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1382 if (rc == VINF_SUCCESS)
1383 {
1384 /* EIP has been updated already. */
1385
1386 /* Only resume if successful. */
1387 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1388 goto ResumeExecution;
1389 }
1390 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1391 break;
1392 }
1393
1394 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
1395 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
1396 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
1397 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
1398 {
1399 uint32_t cbSize;
1400
1401 Log2(("SVM: %VGv mov dr%d, x\n", pCtx->eip, exitCode - SVM_EXIT_READ_DR0));
1402 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1403 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1404 if (rc == VINF_SUCCESS)
1405 {
1406 /* EIP has been updated already. */
1407
1408 /* Only resume if successful. */
1409 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1410 goto ResumeExecution;
1411 }
1412 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1413 break;
1414 }
1415
1416 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
1417 case SVM_EXIT_IOIO: /* I/O instruction. */
1418 {
1419 SVM_IOIO_EXIT IoExitInfo;
1420 uint32_t uIOSize, uAndVal;
1421
1422 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
1423
1424 /** @todo could use a lookup table here */
1425 if (IoExitInfo.n.u1OP8)
1426 {
1427 uIOSize = 1;
1428 uAndVal = 0xff;
1429 }
1430 else
1431 if (IoExitInfo.n.u1OP16)
1432 {
1433 uIOSize = 2;
1434 uAndVal = 0xffff;
1435 }
1436 else
1437 if (IoExitInfo.n.u1OP32)
1438 {
1439 uIOSize = 4;
1440 uAndVal = 0xffffffff;
1441 }
1442 else
1443 {
1444 AssertFailed(); /* should be fatal. */
1445 rc = VINF_EM_RAW_EMULATE_INSTR;
1446 break;
1447 }
1448
1449 if (IoExitInfo.n.u1STR)
1450 {
1451 /* ins/outs */
1452 uint32_t prefix = 0;
1453 if (IoExitInfo.n.u1REP)
1454 prefix |= PREFIX_REP;
1455
1456 if (IoExitInfo.n.u1Type == 0)
1457 {
1458 Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->eip, IoExitInfo.n.u16Port, uIOSize));
1459 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
1460 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1461 }
1462 else
1463 {
1464 Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->eip, IoExitInfo.n.u16Port, uIOSize));
1465 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
1466 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, prefix, uIOSize);
1467 }
1468 }
1469 else
1470 {
1471 /* normal in/out */
1472 Assert(!IoExitInfo.n.u1REP);
1473
1474 if (IoExitInfo.n.u1Type == 0)
1475 {
1476 Log2(("IOMIOPortWrite %VGv %x %x size=%d\n", pCtx->eip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
1477 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
1478 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
1479 }
1480 else
1481 {
1482 uint32_t u32Val = 0;
1483
1484 STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
1485 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
1486 if (IOM_SUCCESS(rc))
1487 {
1488 /* Write back to the EAX register. */
1489 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
1490 Log2(("IOMIOPortRead %VGv %x %x size=%d\n", pCtx->eip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
1491 }
1492 }
1493 }
1494 /*
1495 * Handled the I/O return codes.
1496 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
1497 */
1498 if (IOM_SUCCESS(rc))
1499 {
1500 /* Update EIP and continue execution. */
1501 pCtx->eip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
1502 if (RT_LIKELY(rc == VINF_SUCCESS))
1503 {
1504 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1505 goto ResumeExecution;
1506 }
1507 Log2(("EM status from IO at %VGv %x size %d: %Vrc\n", pCtx->eip, IoExitInfo.n.u16Port, uIOSize, rc));
1508 break;
1509 }
1510
1511#ifdef VBOX_STRICT
1512 if (rc == VINF_IOM_HC_IOPORT_READ)
1513 Assert(IoExitInfo.n.u1Type != 0);
1514 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
1515 Assert(IoExitInfo.n.u1Type == 0);
1516 else
1517 AssertMsg(VBOX_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
1518#endif
1519 Log2(("Failed IO at %VGv %x size %d\n", pCtx->eip, IoExitInfo.n.u16Port, uIOSize));
1520 break;
1521 }
1522
1523 case SVM_EXIT_HLT:
1524 /** Check if external interrupts are pending; if so, don't switch back. */
1525 if (VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
1526 {
1527 pCtx->eip++; /* skip hlt */
1528 goto ResumeExecution;
1529 }
1530
1531 rc = VINF_EM_RAW_EMULATE_INSTR_HLT;
1532 break;
1533
1534 case SVM_EXIT_RSM:
1535 case SVM_EXIT_INVLPGA:
1536 case SVM_EXIT_VMRUN:
1537 case SVM_EXIT_VMMCALL:
1538 case SVM_EXIT_VMLOAD:
1539 case SVM_EXIT_VMSAVE:
1540 case SVM_EXIT_STGI:
1541 case SVM_EXIT_CLGI:
1542 case SVM_EXIT_SKINIT:
1543 case SVM_EXIT_RDTSCP:
1544 {
1545 /* Unsupported instructions. */
1546 SVM_EVENT Event;
1547
1548 Event.au64[0] = 0;
1549 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1550 Event.n.u1Valid = 1;
1551 Event.n.u8Vector = X86_XCPT_UD;
1552
1553 Log(("Forced #UD trap at %VGv\n", pCtx->eip));
1554 SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);
1555
1556 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1557 goto ResumeExecution;
1558 }
1559
1560 /* Emulate in ring 3. */
1561 case SVM_EXIT_MONITOR:
1562 case SVM_EXIT_RDPMC:
1563 case SVM_EXIT_PAUSE:
1564 case SVM_EXIT_MWAIT_UNCOND:
1565 case SVM_EXIT_MWAIT_ARMED:
1566 case SVM_EXIT_MSR:
1567 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
1568 break;
1569
1570 case SVM_EXIT_NPF:
1571 AssertFailed(); /* unexpected */
1572 break;
1573
1574 case SVM_EXIT_SHUTDOWN:
1575 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
1576 break;
1577
1578 case SVM_EXIT_IDTR_READ:
1579 case SVM_EXIT_GDTR_READ:
1580 case SVM_EXIT_LDTR_READ:
1581 case SVM_EXIT_TR_READ:
1582 case SVM_EXIT_IDTR_WRITE:
1583 case SVM_EXIT_GDTR_WRITE:
1584 case SVM_EXIT_LDTR_WRITE:
1585 case SVM_EXIT_TR_WRITE:
1586 case SVM_EXIT_CR0_SEL_WRITE:
1587 default:
1588 /* Unexpected exit codes. */
1589 rc = VERR_EM_INTERNAL_ERROR;
1590 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
1591 break;
1592 }
1593
1594end:
1595 if (fGuestStateSynced)
1596 {
1597 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR. */
1598 SVM_READ_SELREG(LDTR, ldtr);
1599 SVM_READ_SELREG(TR, tr);
1600
1601 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1602 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1603
1604 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1605 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1606
1607 /*
1608 * System MSRs
1609 */
1610 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1611 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1612 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1613 }
1614
1615 /* Signal changes for the recompiler. */
1616 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
1617
1618 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
1619 if (exitCode == SVM_EXIT_INTR)
1620 {
1621 STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
1622 /* On the next entry we'll only sync the host context. */
1623 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
1624 }
1625 else
1626 {
1627 /* On the next entry we'll sync everything. */
1628 /** @todo we can do better than this */
1629 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
1630 }
1631
1632 /* translate into a less severe return code */
1633 if (rc == VERR_EM_INTERPRETER)
1634 rc = VINF_EM_RAW_EMULATE_INSTR;
1635
1636 STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1637 return rc;
1638}
1639
1640/**
1641 * Enters the AMD-V session
1642 *
1643 * @returns VBox status code.
1644 * @param pVM The VM to operate on.
1645 */
1646HWACCMR0DECL(int) SVMR0Enter(PVM pVM)
1647{
1648 Assert(pVM->hwaccm.s.svm.fSupported);
1649
1650 /* Force a TLB flush on VM entry. */
1651 pVM->hwaccm.s.svm.fForceTLBFlush = true;
1652
1653 pVM->hwaccm.s.svm.fResumeVM = false;
1654
1655 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
1656 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
1657
1658 return VINF_SUCCESS;
1659}
1660
1661
1662/**
1663 * Leaves the AMD-V session
1664 *
1665 * @returns VBox status code.
1666 * @param pVM The VM to operate on.
1667 */
1668HWACCMR0DECL(int) SVMR0Leave(PVM pVM)
1669{
1670 Assert(pVM->hwaccm.s.svm.fSupported);
1671 return VINF_SUCCESS;
1672}
1673
1674
1675static int svmInterpretInvlPg(PVM pVM, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
1676{
1677 OP_PARAMVAL param1;
1678 RTGCPTR addr;
1679
1680 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
1681 if(VBOX_FAILURE(rc))
1682 return VERR_EM_INTERPRETER;
1683
1684 switch(param1.type)
1685 {
1686 case PARMTYPE_IMMEDIATE:
1687 case PARMTYPE_ADDRESS:
1688 if(!(param1.flags & PARAM_VAL32))
1689 return VERR_EM_INTERPRETER;
1690 addr = (RTGCPTR)param1.val.val32;
1691 break;
1692
1693 default:
1694 return VERR_EM_INTERPRETER;
1695 }
1696
1697 /** @todo is addr always a flat linear address or ds based
1698 * (in absence of segment override prefixes)????
1699 */
1700 rc = PGMInvalidatePage(pVM, addr);
1701 if (VBOX_SUCCESS(rc))
1702 {
1703 /* Manually invalidate the page for the VM's TLB. */
1704 Log(("SVMInvlpgA %VGv ASID=%d\n", addr, uASID));
1705 SVMInvlpgA(addr, uASID);
1706 return VINF_SUCCESS;
1707 }
1708 Assert(rc == VERR_REM_FLUSHED_PAGES_OVERFLOW);
1709 return rc;
1710}
1711
1712/**
1713 * Interprets INVLPG
1714 *
1715 * @returns VBox status code.
1716 * @retval VINF_* Scheduling instructions.
1717 * @retval VERR_EM_INTERPRETER Something we can't cope with.
1718 * @retval VERR_* Fatal errors.
1719 *
1720 * @param pVM The VM handle.
1721 * @param pRegFrame The register frame.
1722 * @param ASID Tagged TLB id for the guest
1723 *
1724 * Updates the EIP if an instruction was executed successfully.
1725 */
1726static int SVMR0InterpretInvpg(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t uASID)
1727{
1728 /*
1729 * Only allow 32-bit code.
1730 */
1731 if (SELMIsSelector32Bit(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid))
1732 {
1733 RTGCPTR pbCode;
1734 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->eip, &pbCode);
1735 if (VBOX_SUCCESS(rc))
1736 {
1737 uint32_t cbOp;
1738 DISCPUSTATE Cpu;
1739
1740 Cpu.mode = CPUMODE_32BIT;
1741 rc = EMInterpretDisasOneEx(pVM, pbCode, pRegFrame, &Cpu, &cbOp);
1742 Assert(VBOX_FAILURE(rc) || Cpu.pCurInstr->opcode == OP_INVLPG);
1743 if (VBOX_SUCCESS(rc) && Cpu.pCurInstr->opcode == OP_INVLPG)
1744 {
1745 Assert(cbOp == Cpu.opsize);
1746 rc = svmInterpretInvlPg(pVM, &Cpu, pRegFrame, uASID);
1747 if (VBOX_SUCCESS(rc))
1748 {
1749 pRegFrame->eip += cbOp; /* Move on to the next instruction. */
1750 }
1751 return rc;
1752 }
1753 }
1754 }
1755 return VERR_EM_INTERPRETER;
1756}
1757
1758
1759/**
1760 * Invalidates a guest page
1761 *
1762 * @returns VBox status code.
1763 * @param pVM The VM to operate on.
1764 * @param GCVirt Page to invalidate
1765 */
1766HWACCMR0DECL(int) SVMR0InvalidatePage(PVM pVM, RTGCPTR GCVirt)
1767{
1768 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVM->hwaccm.s.svm.fForceTLBFlush;
1769
1770 /* Skip it if a TLB flush is already pending. */
1771 if (!fFlushPending)
1772 {
1773 SVM_VMCB *pVMCB;
1774
1775 Log2(("SVMR0InvalidatePage %VGv\n", GCVirt));
1776 AssertReturn(pVM, VERR_INVALID_PARAMETER);
1777 Assert(pVM->hwaccm.s.svm.fSupported);
1778
1779 pVMCB = (SVM_VMCB *)pVM->hwaccm.s.svm.pVMCB;
1780 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
1781
1782 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushPageManual);
1783 SVMInvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
1784 }
1785 return VINF_SUCCESS;
1786}
1787
1788/**
1789 * Flushes the guest TLB
1790 *
1791 * @returns VBox status code.
1792 * @param pVM The VM to operate on.
1793 */
1794HWACCMR0DECL(int) SVMR0FlushTLB(PVM pVM)
1795{
1796 Log2(("SVMR0FlushTLB\n"));
1797 pVM->hwaccm.s.svm.fForceTLBFlush = true;
1798 STAM_COUNTER_INC(&pVM->hwaccm.s.StatFlushTLBManual);
1799 return VINF_SUCCESS;
1800}
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette