VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 14414

Last change on this file since 14414 was 14385, checked in by vboxsync, 16 years ago

Removed debug logging
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 130.4 KB
Line 
1/* $Id: HWVMXR0.cpp 14385 2008-11-20 08:48:14Z vboxsync $ */
2/** @file
3 * HWACCM VMX - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/pgm.h>
32#include <VBox/pdm.h>
33#include <VBox/err.h>
34#include <VBox/log.h>
35#include <VBox/selm.h>
36#include <VBox/iom.h>
37#include <iprt/param.h>
38#include <iprt/assert.h>
39#include <iprt/asm.h>
40#include <iprt/string.h>
41#include "HWVMXR0.h"
42
43/*******************************************************************************
44* Global Variables *
45*******************************************************************************/
46/* IO operation lookup arrays. */
47static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
48static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
49
50/*******************************************************************************
51* Local Functions *
52*******************************************************************************/
53static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx);
54static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu);
55static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu);
56static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu);
57static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys);
58static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr);
59static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
60
61
62static void VMXR0CheckError(PVM pVM, PVMCPU pVCpu, int rc)
63{
64 if (rc == VERR_VMX_GENERIC)
65 {
66 RTCCUINTREG instrError;
67
68 VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
69 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
70 }
71 pVM->hwaccm.s.lLastError = rc;
72}
73
74/**
75 * Sets up and activates VT-x on the current CPU
76 *
77 * @returns VBox status code.
78 * @param pCpu CPU info struct
79 * @param pVM The VM to operate on. (can be NULL after a resume!!)
80 * @param pvPageCpu Pointer to the global cpu page
81 * @param pPageCpuPhys Physical address of the global cpu page
82 */
83VMMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
84{
85 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
86 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
87
88#ifdef LOG_ENABLED
89 SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
90#endif
91 if (pVM)
92 {
93 /* Set revision dword at the beginning of the VMXON structure. */
94 *(uint32_t *)pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
95 }
96
97 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
98 * (which can have very bad consequences!!!)
99 */
100
101 /* Make sure the VMX instructions don't cause #UD faults. */
102 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
103
104 /* Enter VMX Root Mode */
105 int rc = VMXEnable(pPageCpuPhys);
106 if (RT_FAILURE(rc))
107 {
108 if (pVM)
109 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
110 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
111 return VERR_VMX_VMXON_FAILED;
112 }
113 return VINF_SUCCESS;
114}
115
116/**
117 * Deactivates VT-x on the current CPU
118 *
119 * @returns VBox status code.
120 * @param pCpu CPU info struct
121 * @param pvPageCpu Pointer to the global cpu page
122 * @param pPageCpuPhys Physical address of the global cpu page
123 */
124VMMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
125{
126 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
127 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
128
129 /* Leave VMX Root Mode. */
130 VMXDisable();
131
132 /* And clear the X86_CR4_VMXE bit */
133 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
134
135#ifdef LOG_ENABLED
136 SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
137#endif
138 return VINF_SUCCESS;
139}
140
141/**
142 * Does Ring-0 per VM VT-x init.
143 *
144 * @returns VBox status code.
145 * @param pVM The VM to operate on.
146 */
147VMMR0DECL(int) VMXR0InitVM(PVM pVM)
148{
149 int rc;
150
151#ifdef LOG_ENABLED
152 SUPR0Printf("VMXR0InitVM %x\n", pVM);
153#endif
154
155 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
156
157 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
158 {
159 /* Allocate one page for the virtual APIC mmio cache. */
160 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
161 AssertRC(rc);
162 if (RT_FAILURE(rc))
163 return rc;
164
165 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
166 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
167 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
168 }
169 else
170 {
171 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
172 pVM->hwaccm.s.vmx.pAPIC = 0;
173 pVM->hwaccm.s.vmx.pAPICPhys = 0;
174 }
175
176 /* Allocate the MSR bitmap if this feature is supported. */
177 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
178 {
179 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
180 AssertRC(rc);
181 if (RT_FAILURE(rc))
182 return rc;
183
184 pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
185 pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
186 memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
187 }
188
189 /* Allocate VMCBs for all guest CPUs. */
190 for (unsigned i=0;i<pVM->cCPUs;i++)
191 {
192 PVMCPU pVCpu = &pVM->aCpus[i];
193
194 pVCpu->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
195
196 /* Allocate one page for the VM control structure (VMCS). */
197 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
198 AssertRC(rc);
199 if (RT_FAILURE(rc))
200 return rc;
201
202 pVCpu->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjVMCS);
203 pVCpu->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjVMCS, 0);
204 ASMMemZero32(pVCpu->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
205
206 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
207 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
208
209 /* Current guest paging mode. */
210 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
211
212#ifdef LOG_ENABLED
213 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.pVMCSPhys);
214#endif
215 }
216
217 return VINF_SUCCESS;
218}
219
220/**
221 * Does Ring-0 per VM VT-x termination.
222 *
223 * @returns VBox status code.
224 * @param pVM The VM to operate on.
225 */
226VMMR0DECL(int) VMXR0TermVM(PVM pVM)
227{
228 for (unsigned i=0;i<pVM->cCPUs;i++)
229 {
230 if (pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
231 {
232 RTR0MemObjFree(pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS, false);
233 pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
234 pVM->aCpus[i].hwaccm.s.vmx.pVMCS = 0;
235 pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys = 0;
236 }
237 }
238 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
239 {
240 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
241 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
242 pVM->hwaccm.s.vmx.pAPIC = 0;
243 pVM->hwaccm.s.vmx.pAPICPhys = 0;
244 }
245 if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
248 pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
249 pVM->hwaccm.s.vmx.pMSRBitmap = 0;
250 pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
251 }
252 return VINF_SUCCESS;
253}
254
255/**
256 * Sets up VT-x for the specified VM
257 *
258 * @returns VBox status code.
259 * @param pVM The VM to operate on.
260 */
261VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
262{
263 int rc = VINF_SUCCESS;
264 uint32_t val;
265
266 AssertReturn(pVM, VERR_INVALID_PARAMETER);
267
268 for (unsigned i=0;i<pVM->cCPUs;i++)
269 {
270 Assert(pVM->aCpus[i].hwaccm.s.vmx.pVMCS);
271
272 /* Set revision dword at the beginning of the VMCS structure. */
273 *(uint32_t *)pVM->aCpus[i].hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
274
275 /* Clear VM Control Structure. */
276 Log(("pVMCSPhys = %RHp\n", pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys));
277 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
278 if (RT_FAILURE(rc))
279 goto vmx_end;
280
281 /* Activate the VM Control Structure. */
282 rc = VMXActivateVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
283 if (RT_FAILURE(rc))
284 goto vmx_end;
285
286 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
287 * Set required bits to one and zero according to the MSR capabilities.
288 */
289 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
290 /* External and non-maskable interrupts cause VM-exits. */
291 val = val | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
292 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
293
294 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
295 AssertRC(rc);
296
297 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
298 * Set required bits to one and zero according to the MSR capabilities.
299 */
300 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
301 /* Program which event cause VM-exits and which features we want to use. */
302 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
303 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
304 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
305 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
306 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
307
308 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
309 if (!pVM->hwaccm.s.fNestedPaging)
310 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
311 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
312 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
313
314 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
315
316#if HC_ARCH_BITS == 64
317 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
318 {
319 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
320 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
321 Assert(pVM->hwaccm.s.vmx.pAPIC);
322 }
323 else
324 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
325 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
326#endif
327
328#ifdef VBOX_WITH_VTX_MSR_BITMAPS
329 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
330 {
331 Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
332 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
333 }
334#endif
335
336 /* We will use the secondary control if it's present. */
337 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
338
339 /* Mask away the bits that the CPU doesn't support */
340 /** @todo make sure they don't conflict with the above requirements. */
341 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
342 pVM->aCpus[i].hwaccm.s.vmx.proc_ctls = val;
343
344 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
345 AssertRC(rc);
346
347 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
348 {
349 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
350 * Set required bits to one and zero according to the MSR capabilities.
351 */
352 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
353 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
354
355#ifdef HWACCM_VTX_WITH_EPT
356 if (pVM->hwaccm.s.fNestedPaging)
357 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
358#endif /* HWACCM_VTX_WITH_EPT */
359#ifdef HWACCM_VTX_WITH_VPID
360 else
361 if (pVM->hwaccm.s.vmx.fVPID)
362 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
363#endif /* HWACCM_VTX_WITH_VPID */
364
365 /* Mask away the bits that the CPU doesn't support */
366 /** @todo make sure they don't conflict with the above requirements. */
367 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
368
369 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
370 AssertRC(rc);
371 }
372
373 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
374 * Set required bits to one and zero according to the MSR capabilities.
375 */
376 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
377 AssertRC(rc);
378
379 /* VMX_VMCS_CTRL_EXIT_CONTROLS
380 * Set required bits to one and zero according to the MSR capabilities.
381 */
382 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
383
384 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
385 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
386#if HC_ARCH_BITS == 64
387 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
388#else
389 /* else Must be zero when AMD64 is not available. */
390#endif
391 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
392 /* Don't acknowledge external interrupts on VM-exit. */
393 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
394 AssertRC(rc);
395
396 /* Forward all exception except #NM & #PF to the guest.
397 * We always need to check pagefaults since our shadow page table can be out of sync.
398 * And we always lazily sync the FPU & XMM state.
399 */
400
401 /** @todo Possible optimization:
402 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
403 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
404 * registers ourselves of course.
405 *
406 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
407 */
408
409 /* Don't filter page faults; all of them should cause a switch. */
410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
411 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
412 AssertRC(rc);
413
414 /* Init TSC offset to zero. */
415 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
416#if HC_ARCH_BITS == 32
417 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
418#endif
419 AssertRC(rc);
420
421 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
422#if HC_ARCH_BITS == 32
423 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
424#endif
425 AssertRC(rc);
426
427 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
428#if HC_ARCH_BITS == 32
429 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
430#endif
431 AssertRC(rc);
432
433 /* Set the MSR bitmap address. */
434 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
435 {
436 /* Optional */
437 rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
438#if HC_ARCH_BITS == 32
439 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, pVM->hwaccm.s.vmx.pMSRBitmapPhys >> 32ULL);
440#endif
441 AssertRC(rc);
442 }
443
444 /* Clear MSR controls. */
445 rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
446 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
447 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
448#if HC_ARCH_BITS == 32
449 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
450 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
451 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
452#endif
453 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
454 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
455 AssertRC(rc);
456
457 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
458 {
459 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
460 /* Optional */
461 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
462 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
463#if HC_ARCH_BITS == 32
464 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32ULL);
465#endif
466 AssertRC(rc);
467 }
468
469 /* Set link pointer to -1. Not currently used. */
470#if HC_ARCH_BITS == 32
471 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
472 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
473#else
474 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
475#endif
476 AssertRC(rc);
477
478 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
479 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
480 AssertRC(rc);
481 } /* for each VMCPU */
482
483 /* Choose the right TLB setup function. */
484 if (pVM->hwaccm.s.fNestedPaging)
485 {
486 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBEPT;
487
488 /* Default values for flushing. */
489 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
490 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
491
492 /* If the capabilities specify we can do more, then make use of it. */
493 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_INDIV)
494 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
495 else
496 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
497 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
498
499 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
500 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
501 }
502#ifdef HWACCM_VTX_WITH_VPID
503 else
504 if (pVM->hwaccm.s.vmx.fVPID)
505 {
506 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBVPID;
507
508 /* Default values for flushing. */
509 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
510 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
511
512 /* If the capabilities specify we can do more, then make use of it. */
513 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV)
514 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
515 else
516 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
517 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
518
519 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
520 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
521 }
522#endif /* HWACCM_VTX_WITH_VPID */
523 else
524 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBDummy;
525
526vmx_end:
527 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
528 return rc;
529}
530
531
532/**
533 * Injects an event (trap or external interrupt)
534 *
535 * @returns VBox status code.
536 * @param pVM The VM to operate on.
537 * @param pVCpu The VMCPU to operate on.
538 * @param pCtx CPU Context
539 * @param intInfo VMX interrupt info
540 * @param cbInstr Opcode length of faulting instruction
541 * @param errCode Error code (optional)
542 */
543static int VMXR0InjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
544{
545 int rc;
546 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
547
548#ifdef VBOX_STRICT
549 if (iGate == 0xE)
550 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
551 else
552 if (iGate < 0x20)
553 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
554 else
555 {
556 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
557 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
558 Assert(pCtx->eflags.u32 & X86_EFL_IF);
559 }
560#endif
561
562#ifdef HWACCM_VMX_EMULATE_REALMODE
563 if (CPUMIsGuestInRealModeEx(pCtx))
564 {
565 RTGCPHYS GCPhysHandler;
566 uint16_t offset, ip;
567 RTSEL sel;
568
569 /* Injecting events doesn't work right with real mode emulation.
570 * (#GP if we try to inject external hardware interrupts)
571 * Inject the interrupt or trap directly instead.
572 */
573 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
574
575 /* Check if the interrupt handler is present. */
576 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
577 {
578 Log(("IDT cbIdt violation\n"));
579 if (iGate != X86_XCPT_DF)
580 {
581 RTGCUINTPTR intInfo;
582
583 intInfo = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
584 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
585 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
586 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
587
588 return VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0 /* no error code according to the Intel docs */);
589 }
590 Log(("Triple fault -> reset the VM!\n"));
591 return VINF_EM_RESET;
592 }
593 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
594 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
595 || iGate == 4)
596 {
597 ip = pCtx->ip + cbInstr;
598 }
599 else
600 ip = pCtx->ip;
601
602 /* Read the selector:offset pair of the interrupt handler. */
603 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
604 PGMPhysRead(pVM, GCPhysHandler, &offset, sizeof(offset));
605 PGMPhysRead(pVM, GCPhysHandler + 2, &sel, sizeof(sel));
606
607 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
608
609 /* Construct the stack frame. */
610 /** @todo should check stack limit. */
611 pCtx->sp -= 2;
612 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
613 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t));
614 pCtx->sp -= 2;
615 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
616 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t));
617 pCtx->sp -= 2;
618 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
619 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip));
620
621 /* Update the CPU state for executing the handler. */
622 pCtx->rip = offset;
623 pCtx->cs = sel;
624 pCtx->csHid.u64Base = sel << 4;
625 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
626
627 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
628 return VINF_SUCCESS;
629 }
630#endif /* HWACCM_VMX_EMULATE_REALMODE */
631
632 /* Set event injection state. */
633 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
634
635 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
636 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
637
638 AssertRC(rc);
639 return rc;
640}
641
642
643/**
644 * Checks for pending guest interrupts and injects them
645 *
646 * @returns VBox status code.
647 * @param pVM The VM to operate on.
648 * @param pVCpu The VMCPU to operate on.
649 * @param pCtx CPU Context
650 */
651static int VMXR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
652{
653 int rc;
654
655 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
656 if (pVCpu->hwaccm.s.Event.fPending)
657 {
658 Log(("Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
659 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
660 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
661 AssertRC(rc);
662
663 pVCpu->hwaccm.s.Event.fPending = false;
664 return VINF_SUCCESS;
665 }
666
667 if (pVM->hwaccm.s.fInjectNMI)
668 {
669 RTGCUINTPTR intInfo;
670
671 intInfo = X86_XCPT_NMI;
672 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
673 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
674
675 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
676 AssertRC(rc);
677
678 pVM->hwaccm.s.fInjectNMI = false;
679 return VINF_SUCCESS;
680 }
681
682 /* When external interrupts are pending, we should exit the VM when IF is set. */
683 if ( !TRPMHasTrap(pVM)
684 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
685 {
686 if (!(pCtx->eflags.u32 & X86_EFL_IF))
687 {
688 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
689 {
690 LogFlow(("Enable irq window exit!\n"));
691 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
692 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
693 AssertRC(rc);
694 }
695 /* else nothing to do but wait */
696 }
697 else
698 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
699 {
700 uint8_t u8Interrupt;
701
702 rc = PDMGetInterrupt(pVM, &u8Interrupt);
703 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
704 if (RT_SUCCESS(rc))
705 {
706 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
707 AssertRC(rc);
708 }
709 else
710 {
711 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
712 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
713 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
714 /* Just continue */
715 }
716 }
717 else
718 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
719 }
720
721#ifdef VBOX_STRICT
722 if (TRPMHasTrap(pVM))
723 {
724 uint8_t u8Vector;
725 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
726 AssertRC(rc);
727 }
728#endif
729
730 if ( pCtx->eflags.u32 & X86_EFL_IF
731 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
732 && TRPMHasTrap(pVM)
733 )
734 {
735 uint8_t u8Vector;
736 int rc;
737 TRPMEVENT enmType;
738 RTGCUINTPTR intInfo;
739 RTGCUINT errCode;
740
741 /* If a new event is pending, then dispatch it now. */
742 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
743 AssertRC(rc);
744 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
745 Assert(enmType != TRPM_SOFTWARE_INT);
746
747 /* Clear the pending trap. */
748 rc = TRPMResetTrap(pVM);
749 AssertRC(rc);
750
751 intInfo = u8Vector;
752 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
753
754 if (enmType == TRPM_TRAP)
755 {
756 switch (u8Vector) {
757 case 8:
758 case 10:
759 case 11:
760 case 12:
761 case 13:
762 case 14:
763 case 17:
764 /* Valid error codes. */
765 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
766 break;
767 default:
768 break;
769 }
770 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
771 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
772 else
773 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
774 }
775 else
776 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
777
778 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
779 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
780 AssertRC(rc);
781 } /* if (interrupts can be dispatched) */
782
783 return VINF_SUCCESS;
784}
785
786/**
787 * Save the host state
788 *
789 * @returns VBox status code.
790 * @param pVM The VM to operate on.
791 * @param pVCpu The VMCPU to operate on.
792 */
793VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
794{
795 int rc = VINF_SUCCESS;
796
797 /*
798 * Host CPU Context
799 */
800 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
801 {
802 RTIDTR idtr;
803 RTGDTR gdtr;
804 RTSEL SelTR;
805 PX86DESCHC pDesc;
806 uintptr_t trBase;
807
808 /* Control registers */
809 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
810 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
811 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
812 AssertRC(rc);
813 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
814 Log2(("VMX_VMCS_HOST_CR3 %RHp\n", ASMGetCR3()));
815 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
816
817 /* Selector registers. */
818 rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
819 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
820 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
821 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
822#if HC_ARCH_BITS == 32
823 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
824 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
825#endif
826 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
827 SelTR = ASMGetTR();
828 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
829 AssertRC(rc);
830 Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
831 Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
832 Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
833 Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
834 Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
835 Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
836 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
837
838 /* GDTR & IDTR */
839 ASMGetGDTR(&gdtr);
840 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
841 ASMGetIDTR(&idtr);
842 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
843 AssertRC(rc);
844 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
845 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
846
847 /* Save the base address of the TR selector. */
848 if (SelTR > gdtr.cbGdt)
849 {
850 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
851 return VERR_VMX_INVALID_HOST_STATE;
852 }
853
854 pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
855#if HC_ARCH_BITS == 64
856 trBase = X86DESC64_BASE(*pDesc);
857#else
858 trBase = X86DESC_BASE(*pDesc);
859#endif
860 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
861 AssertRC(rc);
862 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
863
864 /* FS and GS base. */
865#if HC_ARCH_BITS == 64
866 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
867 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
868 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
869 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
870#endif
871 AssertRC(rc);
872
873 /* Sysenter MSRs. */
874 /** @todo expensive!! */
875 rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
876 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
877#if HC_ARCH_BITS == 32
878 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
879 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
880 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
881 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
882#else
883 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
884 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
885 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
886 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
887#endif
888 AssertRC(rc);
889
890 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
891 }
892 return rc;
893}
894
895/**
896 * Prefetch the 4 PDPT pointers (PAE and nested paging only)
897 *
898 * @param pVM The VM to operate on.
899 * @param pCtx Guest context
900 */
901static void vmxR0PrefetchPAEPdptrs(PVM pVM, PCPUMCTX pCtx)
902{
903 if (CPUMIsGuestInPAEModeEx(pCtx))
904 {
905 X86PDPE Pdpe;
906
907 for (unsigned i=0;i<4;i++)
908 {
909 Pdpe = PGMGstGetPaePDPtr(pVM, i);
910 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2, Pdpe.u);
911#if HC_ARCH_BITS == 32
912 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2 + 1, Pdpe.u >> 32ULL);
913#endif
914 AssertRC(rc);
915 }
916 }
917}
918
919/**
920 * Update the exception bitmap according to the current CPU state
921 *
922 * @param pVM The VM to operate on.
923 * @param pVCpu The VMCPU to operate on.
924 * @param pCtx Guest context
925 */
926static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
927{
928 uint32_t u32TrapMask;
929 Assert(pCtx);
930
931 u32TrapMask = HWACCM_VMX_TRAP_MASK;
932#ifndef DEBUG
933 if (pVM->hwaccm.s.fNestedPaging)
934 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
935#endif
936
937 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
938 if ( CPUMIsGuestFPUStateActive(pVCpu) == true
939 && !(pCtx->cr0 & X86_CR0_NE)
940 && !pVCpu->hwaccm.s.fFPUOldStyleOverride)
941 {
942 u32TrapMask |= RT_BIT(X86_XCPT_MF);
943 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
944 }
945
946#ifdef DEBUG
947 /* Intercept X86_XCPT_DB if stepping is enabled */
948 if (DBGFIsStepping(pVM))
949 u32TrapMask |= RT_BIT(X86_XCPT_DB);
950#endif
951
952#ifdef VBOX_STRICT
953 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
954#endif
955
956# ifdef HWACCM_VMX_EMULATE_REALMODE
957 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
958 if (CPUMIsGuestInRealModeEx(pCtx))
959 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
960# endif /* HWACCM_VMX_EMULATE_REALMODE */
961
962 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
963 AssertRC(rc);
964}
965
966/**
967 * Loads the guest state
968 *
969 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
970 *
971 * @returns VBox status code.
972 * @param pVM The VM to operate on.
973 * @param pVCpu The VMCPU to operate on.
974 * @param pCtx Guest context
975 */
976VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
977{
978 int rc = VINF_SUCCESS;
979 RTGCUINTPTR val;
980 X86EFLAGS eflags;
981
982 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
983 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
984 {
985#ifdef HWACCM_VMX_EMULATE_REALMODE
986 PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
987 if (pVCpu->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
988 {
989 /* Correct weird requirements for switching to protected mode. */
990 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
991 && enmGuestMode >= PGMMODE_PROTECTED)
992 {
993 /* DPL of all hidden selector registers must match the current CPL (0). */
994 pCtx->csHid.Attr.n.u2Dpl = 0;
995 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
996
997 pCtx->dsHid.Attr.n.u2Dpl = 0;
998 pCtx->esHid.Attr.n.u2Dpl = 0;
999 pCtx->fsHid.Attr.n.u2Dpl = 0;
1000 pCtx->gsHid.Attr.n.u2Dpl = 0;
1001 pCtx->ssHid.Attr.n.u2Dpl = 0;
1002 }
1003 else
1004 /* Switching from protected mode to real mode. */
1005 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
1006 && enmGuestMode == PGMMODE_REAL)
1007 {
1008 /* The limit must also be adjusted. */
1009 pCtx->csHid.u32Limit &= 0xffff;
1010 pCtx->dsHid.u32Limit &= 0xffff;
1011 pCtx->esHid.u32Limit &= 0xffff;
1012 pCtx->fsHid.u32Limit &= 0xffff;
1013 pCtx->gsHid.u32Limit &= 0xffff;
1014 pCtx->ssHid.u32Limit &= 0xffff;
1015
1016 Assert(pCtx->csHid.u64Base <= 0xfffff);
1017 Assert(pCtx->dsHid.u64Base <= 0xfffff);
1018 Assert(pCtx->esHid.u64Base <= 0xfffff);
1019 Assert(pCtx->fsHid.u64Base <= 0xfffff);
1020 Assert(pCtx->gsHid.u64Base <= 0xfffff);
1021 }
1022 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
1023 }
1024 else
1025 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1026 if ( CPUMIsGuestInRealModeEx(pCtx)
1027 && pCtx->csHid.u64Base == 0xffff0000)
1028 {
1029 pCtx->csHid.u64Base = 0xf0000;
1030 pCtx->cs = 0xf000;
1031 }
1032#endif /* HWACCM_VMX_EMULATE_REALMODE */
1033
1034 VMX_WRITE_SELREG(ES, es);
1035 AssertRC(rc);
1036
1037 VMX_WRITE_SELREG(CS, cs);
1038 AssertRC(rc);
1039
1040 VMX_WRITE_SELREG(SS, ss);
1041 AssertRC(rc);
1042
1043 VMX_WRITE_SELREG(DS, ds);
1044 AssertRC(rc);
1045
1046 /* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
1047 VMX_WRITE_SELREG(FS, fs);
1048 AssertRC(rc);
1049
1050 VMX_WRITE_SELREG(GS, gs);
1051 AssertRC(rc);
1052 }
1053
1054 /* Guest CPU context: LDTR. */
1055 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1056 {
1057 if (pCtx->ldtr == 0)
1058 {
1059 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
1060 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
1061 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
1062 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1063 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1064 }
1065 else
1066 {
1067 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
1068 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1069 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1070 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1071 }
1072 AssertRC(rc);
1073 }
1074 /* Guest CPU context: TR. */
1075 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1076 {
1077#ifdef HWACCM_VMX_EMULATE_REALMODE
1078 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1079 if (CPUMIsGuestInRealModeEx(pCtx))
1080 {
1081 RTGCPHYS GCPhys;
1082
1083 /* We convert it here every time as pci regions could be reconfigured. */
1084 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1085 AssertRC(rc);
1086
1087 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, 0);
1088 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1089 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1090
1091 X86DESCATTR attr;
1092
1093 attr.u = 0;
1094 attr.n.u1Present = 1;
1095 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1096 val = attr.u;
1097 }
1098 else
1099#endif /* HWACCM_VMX_EMULATE_REALMODE */
1100 {
1101 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
1102 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1103 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
1104
1105 val = pCtx->trHid.Attr.u;
1106
1107 /* The TSS selector must be busy. */
1108 if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
1109 val = (val & ~0xF) | X86_SEL_TYPE_SYS_286_TSS_BUSY;
1110 else
1111 /* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
1112 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1113
1114 }
1115 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
1116 AssertRC(rc);
1117 }
1118 /* Guest CPU context: GDTR. */
1119 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1120 {
1121 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1122 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1123 AssertRC(rc);
1124 }
1125 /* Guest CPU context: IDTR. */
1126 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1127 {
1128 rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1129 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1130 AssertRC(rc);
1131 }
1132
1133 /*
1134 * Sysenter MSRs (unconditional)
1135 */
1136 rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1137 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1138 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1139 AssertRC(rc);
1140
1141 /* Control registers */
1142 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1143 {
1144 val = pCtx->cr0;
1145 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1146 Log2(("Guest CR0-shadow %08x\n", val));
1147 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1148 {
1149 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1150 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1151 }
1152 else
1153 {
1154 /** @todo check if we support the old style mess correctly. */
1155 if (!(val & X86_CR0_NE))
1156 Log(("Forcing X86_CR0_NE!!!\n"));
1157
1158 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1159 }
1160 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1161 val |= X86_CR0_PE | X86_CR0_PG;
1162 if (pVM->hwaccm.s.fNestedPaging)
1163 {
1164 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1165 {
1166 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1167 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1168 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1169 }
1170 else
1171 {
1172 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1173 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1174 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1175 }
1176 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1177 AssertRC(rc);
1178 }
1179 else
1180 {
1181 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1182 val |= X86_CR0_WP;
1183 }
1184
1185 /* Always enable caching. */
1186 val &= ~(X86_CR0_CD|X86_CR0_NW);
1187
1188 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1189 Log2(("Guest CR0 %08x\n", val));
1190 /* CR0 flags owned by the host; if the guests attempts to change them, then
1191 * the VM will exit.
1192 */
1193 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1194 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1195 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1196 | X86_CR0_TS
1197 | X86_CR0_ET /* Bit not restored during VM-exit! */
1198 | X86_CR0_CD /* Bit not restored during VM-exit! */
1199 | X86_CR0_NW /* Bit not restored during VM-exit! */
1200 | X86_CR0_NE
1201 | X86_CR0_MP;
1202 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1203
1204 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1205 Log2(("Guest CR0-mask %08x\n", val));
1206 AssertRC(rc);
1207 }
1208 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1209 {
1210 /* CR4 */
1211 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1212 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1213 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1214 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1215
1216 if (!pVM->hwaccm.s.fNestedPaging)
1217 {
1218 switch(pVCpu->hwaccm.s.enmShadowMode)
1219 {
1220 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1221 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1222 case PGMMODE_32_BIT: /* 32-bit paging. */
1223 break;
1224
1225 case PGMMODE_PAE: /* PAE paging. */
1226 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1227 /** @todo use normal 32 bits paging */
1228 val |= X86_CR4_PAE;
1229 break;
1230
1231 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1232 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1233#ifdef VBOX_ENABLE_64_BITS_GUESTS
1234 break;
1235#else
1236 AssertFailed();
1237 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1238#endif
1239 default: /* shut up gcc */
1240 AssertFailed();
1241 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1242 }
1243 }
1244 else
1245 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1246 {
1247 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1248 val |= X86_CR4_PSE;
1249 /* Our identity mapping is a 32 bits page directory. */
1250 val &= ~X86_CR4_PAE;
1251 }
1252
1253#ifdef HWACCM_VMX_EMULATE_REALMODE
1254 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1255 if (CPUMIsGuestInRealModeEx(pCtx))
1256 val |= X86_CR4_VME;
1257#endif /* HWACCM_VMX_EMULATE_REALMODE */
1258
1259 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1260 Log2(("Guest CR4 %08x\n", val));
1261 /* CR4 flags owned by the host; if the guests attempts to change them, then
1262 * the VM will exit.
1263 */
1264 val = 0
1265#ifdef HWACCM_VMX_EMULATE_REALMODE
1266 | X86_CR4_VME
1267#endif
1268 | X86_CR4_PAE
1269 | X86_CR4_PGE
1270 | X86_CR4_PSE
1271 | X86_CR4_VMXE;
1272 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1273
1274 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1275 Log2(("Guest CR4-mask %08x\n", val));
1276 AssertRC(rc);
1277 }
1278
1279 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1280 {
1281 if (pVM->hwaccm.s.fNestedPaging)
1282 {
1283 AssertMsg(PGMGetEPTCR3(pVM) == PGMGetHyperCR3(pVM), ("%RHp vs %RHp\n", PGMGetEPTCR3(pVM), PGMGetHyperCR3(pVM)));
1284 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetEPTCR3(pVM);
1285
1286 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1287 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1288 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1289 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1290
1291 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1292#if HC_ARCH_BITS == 32
1293 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_HIGH, (uint32_t)(pVCpu->hwaccm.s.vmx.GCPhysEPTP >> 32ULL));
1294#endif
1295 AssertRC(rc);
1296
1297 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1298 {
1299 RTGCPHYS GCPhys;
1300
1301 /* We convert it here every time as pci regions could be reconfigured. */
1302 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1303 AssertRC(rc);
1304
1305 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1306 * take care of the translation to host physical addresses.
1307 */
1308 val = GCPhys;
1309 }
1310 else
1311 {
1312 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1313 val = pCtx->cr3;
1314 /* Prefetch the four PDPT entries in PAE mode. */
1315 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1316 }
1317 }
1318 else
1319 {
1320 val = PGMGetHyperCR3(pVM);
1321 Assert(val);
1322 }
1323
1324 /* Save our shadow CR3 register. */
1325 rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1326 AssertRC(rc);
1327 }
1328
1329 /* Debug registers. */
1330 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1331 {
1332 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1333 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1334
1335 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1336 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1337 pCtx->dr[7] |= 0x400; /* must be one */
1338
1339 /* Resync DR7 */
1340 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1341 AssertRC(rc);
1342
1343 /* Sync the debug state now if any breakpoint is armed. */
1344 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1345 && !CPUMIsGuestDebugStateActive(pVM)
1346 && !DBGFIsStepping(pVM))
1347 {
1348 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1349
1350 /* Disable drx move intercepts. */
1351 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1352 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1353 AssertRC(rc);
1354
1355 /* Save the host and load the guest debug state. */
1356 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1357 AssertRC(rc);
1358 }
1359
1360 /* IA32_DEBUGCTL MSR. */
1361 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1362 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
1363 AssertRC(rc);
1364
1365 /** @todo do we really ever need this? */
1366 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1367 AssertRC(rc);
1368 }
1369
1370 /* EIP, ESP and EFLAGS */
1371 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1372 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1373 AssertRC(rc);
1374
1375 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1376 eflags = pCtx->eflags;
1377 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1378 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1379
1380#ifdef HWACCM_VMX_EMULATE_REALMODE
1381 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1382 if (CPUMIsGuestInRealModeEx(pCtx))
1383 {
1384 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1385
1386 eflags.Bits.u1VM = 1;
1387 eflags.Bits.u2IOPL = 3;
1388 }
1389#endif /* HWACCM_VMX_EMULATE_REALMODE */
1390 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1391 AssertRC(rc);
1392
1393 /* TSC offset. */
1394 uint64_t u64TSCOffset;
1395
1396 if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1397 {
1398 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1399 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1400#if HC_ARCH_BITS == 32
1401 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
1402#endif
1403 AssertRC(rc);
1404
1405 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1406 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1407 AssertRC(rc);
1408 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1409 }
1410 else
1411 {
1412 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1413 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1414 AssertRC(rc);
1415 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1416 }
1417
1418 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1419 * Set required bits to one and zero according to the MSR capabilities.
1420 */
1421 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1422 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1423 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1424
1425 /* 64 bits guest mode? */
1426 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1427 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1428 /* else Must be zero when AMD64 is not available. */
1429
1430 /* Mask away the bits that the CPU doesn't support */
1431 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1432 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1433 AssertRC(rc);
1434
1435 /* 64 bits guest mode? */
1436 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1437 {
1438#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
1439 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1440#else
1441 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1442#endif
1443 /* Unconditionally update these as wrmsr might have changed them. */
1444 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1445 AssertRC(rc);
1446 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1447 AssertRC(rc);
1448 }
1449 else
1450 {
1451 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1452 }
1453
1454 vmxR0UpdateExceptionBitmap(pVM, pVCpu, pCtx);
1455
1456 /* Done. */
1457 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1458
1459 return rc;
1460}
1461
1462/**
1463 * Syncs back the guest state
1464 *
1465 * @returns VBox status code.
1466 * @param pVM The VM to operate on.
1467 * @param pVCpu The VMCPU to operate on.
1468 * @param pCtx Guest context
1469 */
1470DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1471{
1472 RTCCUINTREG val, valShadow;
1473 RTGCUINTPTR uInterruptState;
1474 int rc;
1475
1476 /* Let's first sync back eip, esp, and eflags. */
1477 rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1478 AssertRC(rc);
1479 pCtx->rip = val;
1480 rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1481 AssertRC(rc);
1482 pCtx->rsp = val;
1483 rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1484 AssertRC(rc);
1485 pCtx->eflags.u32 = val;
1486
1487 /* Take care of instruction fusing (sti, mov ss) */
1488 rc |= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1489 uInterruptState = val;
1490 if (uInterruptState != 0)
1491 {
1492 Assert(uInterruptState <= 2); /* only sti & mov ss */
1493 Log(("uInterruptState %x eip=%RGv\n", uInterruptState, pCtx->rip));
1494 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1495 }
1496 else
1497 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1498
1499 /* Control registers. */
1500 VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1501 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1502 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
1503 CPUMSetGuestCR0(pVM, val);
1504
1505 VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1506 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1507 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
1508 CPUMSetGuestCR4(pVM, val);
1509
1510 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
1511 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1512 if ( pVM->hwaccm.s.fNestedPaging
1513 && CPUMIsGuestInPagedProtectedModeEx(pCtx))
1514 {
1515 /* Can be updated behind our back in the nested paging case. */
1516 CPUMSetGuestCR2(pVM, ASMGetCR2());
1517
1518 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
1519
1520 if (val != pCtx->cr3)
1521 {
1522 CPUMSetGuestCR3(pVM, val);
1523 PGMUpdateCR3(pVM, val);
1524 }
1525 /* Prefetch the four PDPT entries in PAE mode. */
1526 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1527 }
1528
1529 /* Sync back DR7 here. */
1530 VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1531 pCtx->dr[7] = val;
1532
1533 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1534 VMX_READ_SELREG(ES, es);
1535 VMX_READ_SELREG(SS, ss);
1536 VMX_READ_SELREG(CS, cs);
1537 VMX_READ_SELREG(DS, ds);
1538 VMX_READ_SELREG(FS, fs);
1539 VMX_READ_SELREG(GS, gs);
1540
1541 /*
1542 * System MSRs
1543 */
1544 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
1545 pCtx->SysEnter.cs = val;
1546 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1547 pCtx->SysEnter.eip = val;
1548 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1549 pCtx->SysEnter.esp = val;
1550
1551 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1552 VMX_READ_SELREG(LDTR, ldtr);
1553
1554 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
1555 pCtx->gdtr.cbGdt = val;
1556 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1557 pCtx->gdtr.pGdt = val;
1558
1559 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
1560 pCtx->idtr.cbIdt = val;
1561 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1562 pCtx->idtr.pIdt = val;
1563
1564#ifdef HWACCM_VMX_EMULATE_REALMODE
1565 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1566 if (CPUMIsGuestInRealModeEx(pCtx))
1567 {
1568 /* Hide our emulation flags */
1569 pCtx->eflags.Bits.u1VM = 0;
1570 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
1571
1572 /* Force a TR resync every time in case we switch modes. */
1573 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
1574 }
1575 else
1576#endif /* HWACCM_VMX_EMULATE_REALMODE */
1577 {
1578 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1579 VMX_READ_SELREG(TR, tr);
1580 }
1581 return VINF_SUCCESS;
1582}
1583
1584/**
1585 * Dummy placeholder
1586 *
1587 * @param pVM The VM to operate on.
1588 * @param pVCpu The VMCPU to operate on.
1589 */
1590static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu)
1591{
1592 NOREF(pVM);
1593 NOREF(pVCpu);
1594 return;
1595}
1596
1597/**
1598 * Setup the tagged TLB for EPT
1599 *
1600 * @returns VBox status code.
1601 * @param pVM The VM to operate on.
1602 * @param pVCpu The VMCPU to operate on.
1603 */
1604static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu)
1605{
1606 PHWACCM_CPUINFO pCpu;
1607
1608 Assert(pVM->hwaccm.s.fNestedPaging);
1609 Assert(!pVM->hwaccm.s.vmx.fVPID);
1610
1611 /* Deal with tagged TLBs if VPID or EPT is supported. */
1612 pCpu = HWACCMR0GetCurrentCpu();
1613 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1614 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1615 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1616 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1617 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1618 {
1619 /* Force a TLB flush on VM entry. */
1620 pVCpu->hwaccm.s.fForceTLBFlush = true;
1621 }
1622 else
1623 Assert(!pCpu->fFlushTLB);
1624
1625 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1626 pCpu->fFlushTLB = false;
1627
1628 if (pVCpu->hwaccm.s.fForceTLBFlush)
1629 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1630
1631#ifdef VBOX_WITH_STATISTICS
1632 if (pVCpu->hwaccm.s.fForceTLBFlush)
1633 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1634 else
1635 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1636#endif
1637}
1638
1639#ifdef HWACCM_VTX_WITH_VPID
1640/**
1641 * Setup the tagged TLB for VPID
1642 *
1643 * @returns VBox status code.
1644 * @param pVM The VM to operate on.
1645 * @param pVCpu The VMCPU to operate on.
1646 */
1647static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu)
1648{
1649 PHWACCM_CPUINFO pCpu;
1650
1651 Assert(pVM->hwaccm.s.vmx.fVPID);
1652 Assert(!pVM->hwaccm.s.fNestedPaging);
1653
1654 /* Deal with tagged TLBs if VPID or EPT is supported. */
1655 pCpu = HWACCMR0GetCurrentCpu();
1656 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1657 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1658 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1659 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1660 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1661 {
1662 /* Force a TLB flush on VM entry. */
1663 pVCpu->hwaccm.s.fForceTLBFlush = true;
1664 }
1665 else
1666 Assert(!pCpu->fFlushTLB);
1667
1668 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1669
1670 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1671 if (pVCpu->hwaccm.s.fForceTLBFlush)
1672 {
1673 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1674 || pCpu->fFlushTLB)
1675 {
1676 pCpu->fFlushTLB = false;
1677 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1678 pCpu->cTLBFlushes++;
1679 }
1680 else
1681 {
1682 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1683 pVCpu->hwaccm.s.fForceTLBFlush = false;
1684 }
1685
1686 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1687 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1688 }
1689 else
1690 {
1691 Assert(!pCpu->fFlushTLB);
1692
1693 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1694 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1695 }
1696 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1697 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1698 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1699
1700 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
1701 AssertRC(rc);
1702
1703 if (pVCpu->hwaccm.s.fForceTLBFlush)
1704 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1705
1706#ifdef VBOX_WITH_STATISTICS
1707 if (pVCpu->hwaccm.s.fForceTLBFlush)
1708 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1709 else
1710 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1711#endif
1712}
1713#endif /* HWACCM_VTX_WITH_VPID */
1714
1715/**
1716 * Runs guest code in a VT-x VM.
1717 *
1718 * @returns VBox status code.
1719 * @param pVM The VM to operate on.
1720 * @param pVCpu The VMCPU to operate on.
1721 * @param pCtx Guest context
1722 */
1723VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1724{
1725 int rc = VINF_SUCCESS;
1726 RTCCUINTREG val;
1727 RTCCUINTREG exitReason, instrError, cbInstr;
1728 RTGCUINTPTR exitQualification;
1729 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1730 RTGCUINTPTR errCode, instrInfo;
1731 bool fSyncTPR = false;
1732 PHWACCM_CPUINFO pCpu = 0;
1733 unsigned cResume = 0;
1734#ifdef VBOX_STRICT
1735 RTCPUID idCpuCheck;
1736#endif
1737
1738 Log2(("\nE"));
1739
1740 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
1741
1742#ifdef VBOX_STRICT
1743 rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1744 AssertRC(rc);
1745 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1746
1747 /* allowed zero */
1748 if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1749 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1750
1751 /* allowed one */
1752 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1753 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1754
1755 rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1756 AssertRC(rc);
1757 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1758
1759 /* Must be set according to the MSR, but can be cleared in case of EPT. */
1760 if (pVM->hwaccm.s.fNestedPaging)
1761 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
1762 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1763 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1764
1765 /* allowed zero */
1766 if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1767 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1768
1769 /* allowed one */
1770 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1771 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1772
1773 rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1774 AssertRC(rc);
1775 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1776
1777 /* allowed zero */
1778 if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1779 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1780
1781 /* allowed one */
1782 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1783 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1784
1785 rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1786 AssertRC(rc);
1787 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1788
1789 /* allowed zero */
1790 if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1791 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1792
1793 /* allowed one */
1794 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1795 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1796#endif
1797
1798 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1799 */
1800ResumeExecution:
1801 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1802 ("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1803 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1804 Assert(!HWACCMR0SuspendPending());
1805
1806 /* Safety precaution; looping for too long here can have a very bad effect on the host */
1807 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1808 {
1809 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
1810 rc = VINF_EM_RAW_INTERRUPT;
1811 goto end;
1812 }
1813
1814 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1815 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1816 {
1817 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1818 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1819 {
1820 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1821 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1822 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1823 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1824 */
1825 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1826 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1827 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1828 AssertRC(rc);
1829 }
1830 }
1831 else
1832 {
1833 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1834 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1835 AssertRC(rc);
1836 }
1837
1838 /* Check for pending actions that force us to go back to ring 3. */
1839 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
1840 {
1841 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1842 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1843 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1844 rc = VINF_EM_RAW_TO_R3;
1845 goto end;
1846 }
1847 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1848 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1849 {
1850 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1851 rc = VINF_EM_PENDING_REQUEST;
1852 goto end;
1853 }
1854
1855 /* When external interrupts are pending, we should exit the VM when IF is set. */
1856 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1857 rc = VMXR0CheckPendingInterrupt(pVM, pVCpu, pCtx);
1858 if (RT_FAILURE(rc))
1859 {
1860 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1861 goto end;
1862 }
1863
1864 /** @todo check timers?? */
1865
1866 /* TPR caching using CR8 is only available in 64 bits mode */
1867 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1868 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1869 /**
1870 * @todo reduce overhead
1871 */
1872 if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1873 && pVM->hwaccm.s.vmx.pAPIC)
1874 {
1875 /* TPR caching in CR8 */
1876 uint8_t u8TPR;
1877 bool fPending;
1878
1879 int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1880 AssertRC(rc);
1881 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
1882 pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1883
1884 /* Two options here:
1885 * - external interrupt pending, but masked by the TPR value.
1886 * -> a CR8 update that lower the current TPR value should cause an exit
1887 * - no pending interrupts
1888 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1889 */
1890 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1891 AssertRC(rc);
1892
1893 /* Always sync back the TPR; we should optimize this though */ /** @todo optimize TPR sync. */
1894 fSyncTPR = true;
1895 }
1896
1897#if defined(HWACCM_VTX_WITH_EPT) && defined(LOG_ENABLED)
1898 if ( pVM->hwaccm.s.fNestedPaging
1899# ifdef HWACCM_VTX_WITH_VPID
1900 || pVM->hwaccm.s.vmx.fVPID
1901# endif /* HWACCM_VTX_WITH_VPID */
1902 )
1903 {
1904 pCpu = HWACCMR0GetCurrentCpu();
1905 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1906 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1907 {
1908 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1909 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1910 else
1911 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1912 }
1913 if (pCpu->fFlushTLB)
1914 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1915 else
1916 if (pVCpu->hwaccm.s.fForceTLBFlush)
1917 LogFlow(("Manual TLB flush\n"));
1918 }
1919#endif
1920
1921 /*
1922 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1923 * (until the actual world switch)
1924 */
1925#ifdef VBOX_STRICT
1926 idCpuCheck = RTMpCpuId();
1927#endif
1928 /* Save the host state first. */
1929 rc = VMXR0SaveHostState(pVM, pVCpu);
1930 if (rc != VINF_SUCCESS)
1931 {
1932 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1933 goto end;
1934 }
1935 /* Load the guest state */
1936 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
1937 if (rc != VINF_SUCCESS)
1938 {
1939 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1940 goto end;
1941 }
1942
1943 /* Deal with tagged TLB setup and invalidation. */
1944 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
1945
1946 /* Non-register state Guest Context */
1947 /** @todo change me according to cpu state */
1948 rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1949 AssertRC(rc);
1950
1951 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1952
1953 /* Manual save and restore:
1954 * - General purpose registers except RIP, RSP
1955 *
1956 * Trashed:
1957 * - CR2 (we don't care)
1958 * - LDTR (reset to 0)
1959 * - DRx (presumably not changed at all)
1960 * - DR7 (reset to 0x400)
1961 * - EFLAGS (reset to RT_BIT(1); not relevant)
1962 *
1963 */
1964
1965 /* All done! Let's start VM execution. */
1966 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1967#ifdef VBOX_STRICT
1968 Assert(idCpuCheck == RTMpCpuId());
1969#endif
1970 TMNotifyStartOfExecution(pVM);
1971 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx);
1972 TMNotifyEndOfExecution(pVM);
1973
1974 /* In case we execute a goto ResumeExecution later on. */
1975 pVCpu->hwaccm.s.fResumeVM = true;
1976 pVCpu->hwaccm.s.fForceTLBFlush = false;
1977
1978 /*
1979 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1980 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1981 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1982 */
1983
1984 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1985 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit, x);
1986
1987 if (rc != VINF_SUCCESS)
1988 {
1989 VMXR0ReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
1990 goto end;
1991 }
1992 /* Success. Query the guest state and figure out what has happened. */
1993
1994 /* Investigate why there was a VM-exit. */
1995 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1996 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1997
1998 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1999 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
2000 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
2001 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
2002 intInfo = val;
2003 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
2004 errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
2005 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
2006 instrInfo = val;
2007 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
2008 exitQualification = val;
2009 AssertRC(rc);
2010
2011 /* Sync back the guest state */
2012 rc = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
2013 AssertRC(rc);
2014
2015 /* Note! NOW IT'S SAFE FOR LOGGING! */
2016 Log2(("Raw exit reason %08x\n", exitReason));
2017
2018 /* Check if an injected event was interrupted prematurely. */
2019 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
2020 AssertRC(rc);
2021 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
2022 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2023 /* Ignore 'int xx' as they'll be restarted anyway. */
2024 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
2025 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2026 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2027 {
2028 pVCpu->hwaccm.s.Event.fPending = true;
2029 /* Error code present? */
2030 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2031 {
2032 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
2033 AssertRC(rc);
2034 pVCpu->hwaccm.s.Event.errCode = val;
2035 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2036 }
2037 else
2038 {
2039 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2040 pVCpu->hwaccm.s.Event.errCode = 0;
2041 }
2042 }
2043#ifdef VBOX_STRICT
2044 else
2045 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2046 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2047 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2048 {
2049 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2050 }
2051
2052 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2053 HWACCMDumpRegs(pVM, pCtx);
2054#endif
2055
2056 Log2(("E%d", exitReason));
2057 Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
2058 Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
2059 Log2(("Interruption error code %d\n", errCode));
2060 Log2(("IntInfo = %08x\n", intInfo));
2061 Log2(("New EIP=%RGv\n", (RTGCPTR)pCtx->rip));
2062
2063 if (fSyncTPR)
2064 {
2065 rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
2066 AssertRC(rc);
2067 }
2068
2069 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2070 switch (exitReason)
2071 {
2072 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2073 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2074 {
2075 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2076
2077 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2078 {
2079 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2080 /* External interrupt; leave to allow it to be dispatched again. */
2081 rc = VINF_EM_RAW_INTERRUPT;
2082 break;
2083 }
2084 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2085 {
2086 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2087 /* External interrupt; leave to allow it to be dispatched again. */
2088 rc = VINF_EM_RAW_INTERRUPT;
2089 break;
2090
2091 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2092 AssertFailed(); /* can't come here; fails the first check. */
2093 break;
2094
2095 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
2096 Assert(vector == 3 || vector == 4);
2097 /* no break */
2098 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
2099 Log2(("Hardware/software interrupt %d\n", vector));
2100 switch (vector)
2101 {
2102 case X86_XCPT_NM:
2103 {
2104 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
2105
2106 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
2107 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
2108 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
2109 if (rc == VINF_SUCCESS)
2110 {
2111 Assert(CPUMIsGuestFPUStateActive(pVCpu));
2112
2113 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
2114
2115 /* Continue execution. */
2116 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2117 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2118
2119 goto ResumeExecution;
2120 }
2121
2122 Log(("Forward #NM fault to the guest\n"));
2123 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
2124 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
2125 AssertRC(rc);
2126 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2127 goto ResumeExecution;
2128 }
2129
2130 case X86_XCPT_PF: /* Page fault */
2131 {
2132#ifdef DEBUG
2133 if (pVM->hwaccm.s.fNestedPaging)
2134 { /* A genuine pagefault.
2135 * Forward the trap to the guest by injecting the exception and resuming execution.
2136 */
2137 Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
2138
2139 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
2140
2141 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2142
2143 /* Now we must update CR2. */
2144 pCtx->cr2 = exitQualification;
2145 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2146 AssertRC(rc);
2147
2148 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2149 goto ResumeExecution;
2150 }
2151#endif
2152 Assert(!pVM->hwaccm.s.fNestedPaging);
2153
2154 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
2155 /* Exit qualification contains the linear address of the page fault. */
2156 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2157 TRPMSetErrorCode(pVM, errCode);
2158 TRPMSetFaultAddress(pVM, exitQualification);
2159
2160 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
2161 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
2162 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2163 if (rc == VINF_SUCCESS)
2164 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2165 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
2166 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2167
2168 TRPMResetTrap(pVM);
2169
2170 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2171 goto ResumeExecution;
2172 }
2173 else
2174 if (rc == VINF_EM_RAW_GUEST_TRAP)
2175 { /* A genuine pagefault.
2176 * Forward the trap to the guest by injecting the exception and resuming execution.
2177 */
2178 Log2(("Forward page fault to the guest\n"));
2179
2180 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2181 /* The error code might have been changed. */
2182 errCode = TRPMGetErrorCode(pVM);
2183
2184 TRPMResetTrap(pVM);
2185
2186 /* Now we must update CR2. */
2187 pCtx->cr2 = exitQualification;
2188 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2189 AssertRC(rc);
2190
2191 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2192 goto ResumeExecution;
2193 }
2194#ifdef VBOX_STRICT
2195 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2196 Log2(("PGMTrap0eHandler failed with %d\n", rc));
2197#endif
2198 /* Need to go back to the recompiler to emulate the instruction. */
2199 TRPMResetTrap(pVM);
2200 break;
2201 }
2202
2203 case X86_XCPT_MF: /* Floating point exception. */
2204 {
2205 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
2206 if (!(pCtx->cr0 & X86_CR0_NE))
2207 {
2208 /* old style FPU error reporting needs some extra work. */
2209 /** @todo don't fall back to the recompiler, but do it manually. */
2210 rc = VINF_EM_RAW_EMULATE_INSTR;
2211 break;
2212 }
2213 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2214 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2215 AssertRC(rc);
2216
2217 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2218 goto ResumeExecution;
2219 }
2220
2221 case X86_XCPT_DB: /* Debug exception. */
2222 {
2223 uint64_t uDR6;
2224
2225 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
2226 *
2227 * Exit qualification bits:
2228 * 3:0 B0-B3 which breakpoint condition was met
2229 * 12:4 Reserved (0)
2230 * 13 BD - debug register access detected
2231 * 14 BS - single step execution or branch taken
2232 * 63:15 Reserved (0)
2233 */
2234 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
2235
2236 /* Note that we don't support guest and host-initiated debugging at the same time. */
2237 Assert(DBGFIsStepping(pVM) || CPUMIsGuestInRealModeEx(pCtx));
2238
2239 uDR6 = X86_DR6_INIT_VAL;
2240 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
2241 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
2242 if (rc == VINF_EM_RAW_GUEST_TRAP)
2243 {
2244 /** @todo this isn't working, but we'll never get here normally. */
2245
2246 /* Update DR6 here. */
2247 pCtx->dr[6] = uDR6;
2248
2249 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2250 pCtx->dr[7] &= ~X86_DR7_GD;
2251
2252 /* Paranoia. */
2253 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2254 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2255 pCtx->dr[7] |= 0x400; /* must be one */
2256
2257 /* Resync DR7 */
2258 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2259 AssertRC(rc);
2260
2261 Log(("Trap %x (debug) at %RGv exit qualification %RX64\n", vector, (RTGCPTR)pCtx->rip, exitQualification));
2262 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2263 AssertRC(rc);
2264
2265 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2266 goto ResumeExecution;
2267 }
2268 /* Return to ring 3 to deal with the debug exit code. */
2269 break;
2270 }
2271
2272 case X86_XCPT_GP: /* General protection failure exception.*/
2273 {
2274 uint32_t cbSize;
2275
2276 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
2277#ifdef VBOX_STRICT
2278 if (!CPUMIsGuestInRealModeEx(pCtx))
2279 {
2280 Log(("Trap %x at %04X:%RGv errorCode=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
2281 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2282 AssertRC(rc);
2283 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2284 goto ResumeExecution;
2285 }
2286#endif
2287 Assert(CPUMIsGuestInRealModeEx(pCtx));
2288
2289 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %RGv\n", (RTGCPTR)pCtx->rip));
2290 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2291 if (rc == VINF_SUCCESS)
2292 {
2293 /* EIP has been updated already. */
2294
2295 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2296 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2297
2298 /* Only resume if successful. */
2299 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2300 goto ResumeExecution;
2301 }
2302 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", rc));
2303 break;
2304 }
2305
2306#ifdef VBOX_STRICT
2307 case X86_XCPT_DE: /* Divide error. */
2308 case X86_XCPT_UD: /* Unknown opcode exception. */
2309 case X86_XCPT_SS: /* Stack segment exception. */
2310 case X86_XCPT_NP: /* Segment not present exception. */
2311 {
2312 switch(vector)
2313 {
2314 case X86_XCPT_DE:
2315 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
2316 break;
2317 case X86_XCPT_UD:
2318 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
2319 break;
2320 case X86_XCPT_SS:
2321 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
2322 break;
2323 case X86_XCPT_NP:
2324 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
2325 break;
2326 }
2327
2328 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2329 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2330 AssertRC(rc);
2331
2332 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2333 goto ResumeExecution;
2334 }
2335#endif
2336 default:
2337#ifdef HWACCM_VMX_EMULATE_REALMODE
2338 if (CPUMIsGuestInRealModeEx(pCtx))
2339 {
2340 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
2341 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2342 AssertRC(rc);
2343
2344 /* Go back to ring 3 in case of a triple fault. */
2345 if ( vector == X86_XCPT_DF
2346 && rc == VINF_EM_RESET)
2347 break;
2348
2349 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2350 goto ResumeExecution;
2351 }
2352#endif
2353 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2354 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2355 break;
2356 } /* switch (vector) */
2357
2358 break;
2359
2360 default:
2361 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2362 AssertFailed();
2363 break;
2364 }
2365
2366 break;
2367 }
2368
2369 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
2370 {
2371 RTGCPHYS GCPhys;
2372
2373 Assert(pVM->hwaccm.s.fNestedPaging);
2374
2375#if HC_ARCH_BITS == 64
2376 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2377 AssertRC(rc);
2378#else
2379 uint32_t val_hi;
2380 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &val);
2381 AssertRC(rc);
2382 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_HIGH, &val_hi);
2383 AssertRC(rc);
2384 GCPhys = RT_MAKE_U64(val, val_hi);
2385#endif
2386
2387 Assert(((exitQualification >> 7) & 3) != 2);
2388
2389 /* Determine the kind of violation. */
2390 errCode = 0;
2391 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
2392 errCode |= X86_TRAP_PF_ID;
2393
2394 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
2395 errCode |= X86_TRAP_PF_RW;
2396
2397 /* If the page is present, then it's a page level protection fault. */
2398 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
2399 errCode |= X86_TRAP_PF_P;
2400
2401 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
2402
2403 /* GCPhys contains the guest physical address of the page fault. */
2404 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2405 TRPMSetErrorCode(pVM, errCode);
2406 TRPMSetFaultAddress(pVM, GCPhys);
2407
2408 /* Handle the pagefault trap for the nested shadow table. */
2409 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
2410 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2411 if (rc == VINF_SUCCESS)
2412 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2413 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
2414 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2415
2416 TRPMResetTrap(pVM);
2417
2418 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2419 goto ResumeExecution;
2420 }
2421
2422#ifdef VBOX_STRICT
2423 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2424 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
2425#endif
2426 /* Need to go back to the recompiler to emulate the instruction. */
2427 TRPMResetTrap(pVM);
2428 break;
2429 }
2430
2431 case VMX_EXIT_EPT_MISCONFIG:
2432 {
2433 RTGCPHYS GCPhys;
2434
2435 Assert(pVM->hwaccm.s.fNestedPaging);
2436
2437#if HC_ARCH_BITS == 64
2438 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2439 AssertRC(rc);
2440#else
2441 uint32_t val_hi;
2442 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &val);
2443 AssertRC(rc);
2444 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_HIGH, &val_hi);
2445 AssertRC(rc);
2446 GCPhys = RT_MAKE_U64(val, val_hi);
2447#endif
2448
2449 Log(("VMX_EXIT_EPT_MISCONFIG for %VGp\n", GCPhys));
2450 break;
2451 }
2452
2453 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2454 /* Clear VM-exit on IF=1 change. */
2455 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2456 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2457 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2458 AssertRC(rc);
2459 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
2460 goto ResumeExecution; /* we check for pending guest interrupts there */
2461
2462 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2463 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2464 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
2465 /* Skip instruction and continue directly. */
2466 pCtx->rip += cbInstr;
2467 /* Continue execution.*/
2468 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2469 goto ResumeExecution;
2470
2471 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2472 {
2473 Log2(("VMX: Cpuid %x\n", pCtx->eax));
2474 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
2475 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2476 if (rc == VINF_SUCCESS)
2477 {
2478 /* Update EIP and continue execution. */
2479 Assert(cbInstr == 2);
2480 pCtx->rip += cbInstr;
2481 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2482 goto ResumeExecution;
2483 }
2484 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
2485 rc = VINF_EM_RAW_EMULATE_INSTR;
2486 break;
2487 }
2488
2489 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2490 {
2491 Log2(("VMX: Rdtsc\n"));
2492 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
2493 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2494 if (rc == VINF_SUCCESS)
2495 {
2496 /* Update EIP and continue execution. */
2497 Assert(cbInstr == 2);
2498 pCtx->rip += cbInstr;
2499 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2500 goto ResumeExecution;
2501 }
2502 AssertMsgFailed(("EMU: rdtsc failed with %Rrc\n", rc));
2503 rc = VINF_EM_RAW_EMULATE_INSTR;
2504 break;
2505 }
2506
2507 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2508 {
2509 Log2(("VMX: invlpg\n"));
2510 Assert(!pVM->hwaccm.s.fNestedPaging);
2511
2512 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
2513 rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2514 if (rc == VINF_SUCCESS)
2515 {
2516 /* Update EIP and continue execution. */
2517 pCtx->rip += cbInstr;
2518 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2519 goto ResumeExecution;
2520 }
2521 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, rc));
2522 break;
2523 }
2524
2525 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2526 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2527 {
2528 uint32_t cbSize;
2529
2530 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2531 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2532 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2533 if (rc == VINF_SUCCESS)
2534 {
2535 /* EIP has been updated already. */
2536
2537 /* Only resume if successful. */
2538 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2539 goto ResumeExecution;
2540 }
2541 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2542 break;
2543 }
2544
2545 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2546 {
2547 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2548 {
2549 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2550 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2551 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite);
2552 rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2553 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2554 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2555
2556 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2557 {
2558 case 0:
2559 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
2560 break;
2561 case 2:
2562 break;
2563 case 3:
2564 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
2565 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
2566 break;
2567 case 4:
2568 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
2569 break;
2570 case 8:
2571 /* CR8 contains the APIC TPR */
2572 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2573 break;
2574
2575 default:
2576 AssertFailed();
2577 break;
2578 }
2579 /* Check if a sync operation is pending. */
2580 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2581 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2582 {
2583 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2584 AssertRC(rc);
2585 }
2586 break;
2587
2588 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2589 Log2(("VMX: mov x, crx\n"));
2590 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead);
2591
2592 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
2593
2594 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2595 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2596
2597 rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2598 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2599 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2600 break;
2601
2602 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2603 Log2(("VMX: clts\n"));
2604 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
2605 rc = EMInterpretCLTS(pVM);
2606 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2607 break;
2608
2609 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2610 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2611 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
2612 rc = EMInterpretLMSW(pVM, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2613 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2614 break;
2615 }
2616
2617 /* Update EIP if no error occurred. */
2618 if (RT_SUCCESS(rc))
2619 pCtx->rip += cbInstr;
2620
2621 if (rc == VINF_SUCCESS)
2622 {
2623 /* Only resume if successful. */
2624 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2625 goto ResumeExecution;
2626 }
2627 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2628 break;
2629 }
2630
2631 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2632 {
2633 if (!DBGFIsStepping(pVM))
2634 {
2635 /* Disable drx move intercepts. */
2636 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2637 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2638 AssertRC(rc);
2639
2640 /* Save the host and load the guest debug state. */
2641 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2642 AssertRC(rc);
2643
2644#ifdef VBOX_WITH_STATISTICS
2645 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2646 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2647 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2648 else
2649 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2650#endif
2651
2652 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2653 goto ResumeExecution;
2654 }
2655
2656 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2657 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2658 {
2659 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2660 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2661 rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2662 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2663 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2664 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2665 Log2(("DR7=%08x\n", pCtx->dr[7]));
2666 }
2667 else
2668 {
2669 Log2(("VMX: mov x, drx\n"));
2670 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2671 rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2672 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2673 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2674 }
2675 /* Update EIP if no error occurred. */
2676 if (RT_SUCCESS(rc))
2677 pCtx->rip += cbInstr;
2678
2679 if (rc == VINF_SUCCESS)
2680 {
2681 /* Only resume if successful. */
2682 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2683 goto ResumeExecution;
2684 }
2685 Assert(rc == VERR_EM_INTERPRETER);
2686 break;
2687 }
2688
2689 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2690 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2691 {
2692 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2693 uint32_t uPort;
2694 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2695
2696 /** @todo necessary to make the distinction? */
2697 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2698 {
2699 uPort = pCtx->edx & 0xffff;
2700 }
2701 else
2702 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2703
2704 /* paranoia */
2705 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
2706 {
2707 rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2708 break;
2709 }
2710
2711 uint32_t cbSize = g_aIOSize[uIOWidth];
2712
2713 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2714 {
2715 /* ins/outs */
2716 uint32_t prefix = 0;
2717 if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2718 prefix |= PREFIX_REP;
2719
2720 if (fIOWrite)
2721 {
2722 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2723 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2724 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2725 }
2726 else
2727 {
2728 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2729 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2730 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2731 }
2732 }
2733 else
2734 {
2735 /* normal in/out */
2736 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2737
2738 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2739
2740 if (fIOWrite)
2741 {
2742 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2743 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2744 }
2745 else
2746 {
2747 uint32_t u32Val = 0;
2748
2749 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2750 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2751 if (IOM_SUCCESS(rc))
2752 {
2753 /* Write back to the EAX register. */
2754 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2755 }
2756 }
2757 }
2758 /*
2759 * Handled the I/O return codes.
2760 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2761 */
2762 if (IOM_SUCCESS(rc))
2763 {
2764 /* Update EIP and continue execution. */
2765 pCtx->rip += cbInstr;
2766 if (RT_LIKELY(rc == VINF_SUCCESS))
2767 {
2768 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2769 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2770 {
2771 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2772 for (unsigned i=0;i<4;i++)
2773 {
2774 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2775
2776 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2777 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2778 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2779 {
2780 uint64_t uDR6;
2781
2782 Assert(CPUMIsGuestDebugStateActive(pVM));
2783
2784 uDR6 = ASMGetDR6();
2785
2786 /* Clear all breakpoint status flags and set the one we just hit. */
2787 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2788 uDR6 |= (uint64_t)RT_BIT(i);
2789
2790 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2791 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2792 * the contents have been read.
2793 */
2794 ASMSetDR6(uDR6);
2795
2796 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2797 pCtx->dr[7] &= ~X86_DR7_GD;
2798
2799 /* Paranoia. */
2800 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2801 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2802 pCtx->dr[7] |= 0x400; /* must be one */
2803
2804 /* Resync DR7 */
2805 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2806 AssertRC(rc);
2807
2808 /* Construct inject info. */
2809 intInfo = X86_XCPT_DB;
2810 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2811 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2812
2813 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2814 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2815 AssertRC(rc);
2816
2817 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2818 goto ResumeExecution;
2819 }
2820 }
2821 }
2822
2823 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2824 goto ResumeExecution;
2825 }
2826 break;
2827 }
2828
2829#ifdef VBOX_STRICT
2830 if (rc == VINF_IOM_HC_IOPORT_READ)
2831 Assert(!fIOWrite);
2832 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2833 Assert(fIOWrite);
2834 else
2835 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2836#endif
2837 break;
2838 }
2839
2840 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2841 LogFlow(("VMX_EXIT_TPR\n"));
2842 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2843 goto ResumeExecution;
2844
2845 default:
2846 /* The rest is handled after syncing the entire CPU state. */
2847 break;
2848 }
2849
2850 /* Note: the guest state isn't entirely synced back at this stage. */
2851
2852 /* Investigate why there was a VM-exit. (part 2) */
2853 switch (exitReason)
2854 {
2855 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2856 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2857 case VMX_EXIT_EPT_VIOLATION:
2858 /* Already handled above. */
2859 break;
2860
2861 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2862 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2863 break;
2864
2865 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2866 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2867 rc = VINF_EM_RAW_INTERRUPT;
2868 AssertFailed(); /* Can't happen. Yet. */
2869 break;
2870
2871 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2872 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2873 rc = VINF_EM_RAW_INTERRUPT;
2874 AssertFailed(); /* Can't happen afaik. */
2875 break;
2876
2877 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2878 rc = VERR_EM_INTERPRETER;
2879 break;
2880
2881 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2882 /** Check if external interrupts are pending; if so, don't switch back. */
2883 pCtx->rip++; /* skip hlt */
2884 if ( pCtx->eflags.Bits.u1IF
2885 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
2886 goto ResumeExecution;
2887
2888 rc = VINF_EM_HALT;
2889 break;
2890
2891 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2892 AssertFailed(); /* can't happen. */
2893 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2894 break;
2895
2896 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2897 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2898 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2899 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2900 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2901 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2902 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2903 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2904 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2905 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2906 /** @todo inject #UD immediately */
2907 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2908 break;
2909
2910 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2911 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2912 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2913 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2914 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2915 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2916 /* already handled above */
2917 AssertMsg( rc == VINF_PGM_CHANGE_MODE
2918 || rc == VINF_EM_RAW_INTERRUPT
2919 || rc == VERR_EM_INTERPRETER
2920 || rc == VINF_EM_RAW_EMULATE_INSTR
2921 || rc == VINF_PGM_SYNC_CR3
2922 || rc == VINF_IOM_HC_IOPORT_READ
2923 || rc == VINF_IOM_HC_IOPORT_WRITE
2924 || rc == VINF_EM_RAW_GUEST_TRAP
2925 || rc == VINF_TRPM_XCPT_DISPATCHED
2926 || rc == VINF_EM_RESCHEDULE_REM,
2927 ("rc = %d\n", rc));
2928 break;
2929
2930 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2931 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2932 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2933 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2934 rc = VERR_EM_INTERPRETER;
2935 break;
2936
2937 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2938 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2939 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2940 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2941 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2942 break;
2943
2944 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2945 Assert(rc == VINF_EM_RAW_INTERRUPT);
2946 break;
2947
2948 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2949 {
2950#ifdef VBOX_STRICT
2951 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2952
2953 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2954 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
2955
2956 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2957 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2958
2959 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2960 Log(("VMX_VMCS_GUEST_CR3 %RGp\n", val));
2961
2962 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2963 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2964
2965 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2966 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2967
2968 VMX_LOG_SELREG(CS, "CS");
2969 VMX_LOG_SELREG(DS, "DS");
2970 VMX_LOG_SELREG(ES, "ES");
2971 VMX_LOG_SELREG(FS, "FS");
2972 VMX_LOG_SELREG(GS, "GS");
2973 VMX_LOG_SELREG(SS, "SS");
2974 VMX_LOG_SELREG(TR, "TR");
2975 VMX_LOG_SELREG(LDTR, "LDTR");
2976
2977 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2978 Log(("VMX_VMCS_GUEST_GDTR_BASE %RGv\n", val));
2979 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2980 Log(("VMX_VMCS_GUEST_IDTR_BASE %RGv\n", val));
2981#endif /* VBOX_STRICT */
2982 rc = VERR_VMX_INVALID_GUEST_STATE;
2983 break;
2984 }
2985
2986 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2987 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2988 default:
2989 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2990 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2991 break;
2992
2993 }
2994end:
2995
2996 /* Signal changes for the recompiler. */
2997 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2998
2999 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
3000 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
3001 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
3002 {
3003 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
3004 /* On the next entry we'll only sync the host context. */
3005 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
3006 }
3007 else
3008 {
3009 /* On the next entry we'll sync everything. */
3010 /** @todo we can do better than this */
3011 /* Not in the VINF_PGM_CHANGE_MODE though! */
3012 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
3013 }
3014
3015 /* translate into a less severe return code */
3016 if (rc == VERR_EM_INTERPRETER)
3017 rc = VINF_EM_RAW_EMULATE_INSTR;
3018 else
3019 /* Try to extract more information about what might have gone wrong here. */
3020 if (rc == VERR_VMX_INVALID_VMCS_PTR)
3021 {
3022 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
3023 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pVMCS;
3024 }
3025
3026 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
3027
3028 Log2(("X"));
3029 return rc;
3030}
3031
3032
3033/**
3034 * Enters the VT-x session
3035 *
3036 * @returns VBox status code.
3037 * @param pVM The VM to operate on.
3038 * @param pVCpu The VMCPU to operate on.
3039 * @param pCpu CPU info struct
3040 */
3041VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
3042{
3043 Assert(pVM->hwaccm.s.vmx.fSupported);
3044
3045 unsigned cr4 = ASMGetCR4();
3046 if (!(cr4 & X86_CR4_VMXE))
3047 {
3048 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
3049 return VERR_VMX_X86_CR4_VMXE_CLEARED;
3050 }
3051
3052 /* Activate the VM Control Structure. */
3053 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3054 if (RT_FAILURE(rc))
3055 return rc;
3056
3057 pVCpu->hwaccm.s.fResumeVM = false;
3058 return VINF_SUCCESS;
3059}
3060
3061
3062/**
3063 * Leaves the VT-x session
3064 *
3065 * @returns VBox status code.
3066 * @param pVM The VM to operate on.
3067 * @param pVCpu The VMCPU to operate on.
3068 * @param pCtx CPU context
3069 */
3070VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
3071{
3072 Assert(pVM->hwaccm.s.vmx.fSupported);
3073
3074 /* Save the guest debug state if necessary. */
3075 if (CPUMIsGuestDebugStateActive(pVM))
3076 {
3077 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
3078
3079 /* Enable drx move intercepts again. */
3080 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3081 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3082 AssertRC(rc);
3083
3084 /* Resync the debug registers the next time. */
3085 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3086 }
3087 else
3088 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
3089
3090 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
3091 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3092 AssertRC(rc);
3093
3094 return VINF_SUCCESS;
3095}
3096
3097/**
3098 * Flush the TLB (EPT)
3099 *
3100 * @returns VBox status code.
3101 * @param pVM The VM to operate on.
3102 * @param pVCpu The VM CPU to operate on.
3103 * @param enmFlush Type of flush
3104 * @param GCPhys Physical address of the page to flush
3105 */
3106static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys)
3107{
3108 uint64_t descriptor[2];
3109
3110 LogFlow(("vmxR0FlushEPT %d %RGv\n", enmFlush, GCPhys));
3111 Assert(pVM->hwaccm.s.fNestedPaging);
3112 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
3113 descriptor[1] = GCPhys;
3114 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
3115 AssertRC(rc);
3116}
3117
3118#ifdef HWACCM_VTX_WITH_VPID
3119/**
3120 * Flush the TLB (EPT)
3121 *
3122 * @returns VBox status code.
3123 * @param pVM The VM to operate on.
3124 * @param pVCpu The VM CPU to operate on.
3125 * @param enmFlush Type of flush
3126 * @param GCPtr Virtual address of the page to flush
3127 */
3128static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr)
3129{
3130 uint64_t descriptor[2];
3131
3132 Assert(pVM->hwaccm.s.vmx.fVPID);
3133 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
3134 descriptor[1] = GCPtr;
3135 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]);
3136 AssertRC(rc);
3137}
3138#endif /* HWACCM_VTX_WITH_VPID */
3139
3140/**
3141 * Invalidates a guest page
3142 *
3143 * @returns VBox status code.
3144 * @param pVM The VM to operate on.
3145 * @param pVCpu The VM CPU to operate on.
3146 * @param GCVirt Page to invalidate
3147 */
3148VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
3149{
3150 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3151
3152 LogFlow(("VMXR0InvalidatePage %RGv\n", GCVirt));
3153
3154 /* Only relevant if we want to use VPID.
3155 * In the nested paging case we still see such calls, but
3156 * can safely ignore them. (e.g. after cr3 updates)
3157 */
3158#ifdef HWACCM_VTX_WITH_VPID
3159 /* Skip it if a TLB flush is already pending. */
3160 if ( !fFlushPending
3161 && pVM->hwaccm.s.vmx.fVPID)
3162 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCVirt);
3163#endif /* HWACCM_VTX_WITH_VPID */
3164
3165 return VINF_SUCCESS;
3166}
3167
3168/**
3169 * Invalidates a guest page by physical address
3170 *
3171 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
3172 *
3173 * @returns VBox status code.
3174 * @param pVM The VM to operate on.
3175 * @param pVCpu The VM CPU to operate on.
3176 * @param GCPhys Page to invalidate
3177 */
3178VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
3179{
3180 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3181
3182 Assert(pVM->hwaccm.s.fNestedPaging);
3183
3184 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
3185
3186 /* Skip it if a TLB flush is already pending. */
3187 if (!fFlushPending)
3188 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCPhys);
3189
3190 return VINF_SUCCESS;
3191}
3192
3193/**
3194 * Report world switch error and dump some useful debug info
3195 *
3196 * @param pVM The VM to operate on.
3197 * @param pVCpu The VMCPU to operate on.
3198 * @param rc Return code
3199 * @param pCtx Current CPU context (not updated)
3200 */
3201static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx)
3202{
3203 switch (rc)
3204 {
3205 case VERR_VMX_INVALID_VMXON_PTR:
3206 AssertFailed();
3207 break;
3208
3209 case VERR_VMX_UNABLE_TO_START_VM:
3210 case VERR_VMX_UNABLE_TO_RESUME_VM:
3211 {
3212 int rc;
3213 RTCCUINTREG exitReason, instrError, val;
3214
3215 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
3216 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
3217 AssertRC(rc);
3218 if (rc == VINF_SUCCESS)
3219 {
3220 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
3221 Log(("Current stack %08x\n", &rc));
3222
3223 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
3224 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
3225
3226#ifdef VBOX_STRICT
3227 RTGDTR gdtr;
3228 PX86DESCHC pDesc;
3229
3230 ASMGetGDTR(&gdtr);
3231
3232 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
3233 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
3234 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
3235 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
3236 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
3237 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
3238 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
3239 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
3240 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
3241 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
3242
3243 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
3244 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
3245
3246 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
3247 Log(("VMX_VMCS_HOST_CR3 %RHp\n", val));
3248
3249 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
3250 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
3251
3252 VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
3253 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
3254
3255 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
3256 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
3257
3258 if (val < gdtr.cbGdt)
3259 {
3260 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3261 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
3262 }
3263
3264 VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
3265 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
3266 if (val < gdtr.cbGdt)
3267 {
3268 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3269 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
3270 }
3271
3272 VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
3273 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
3274 if (val < gdtr.cbGdt)
3275 {
3276 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3277 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
3278 }
3279
3280 VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
3281 Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
3282 if (val < gdtr.cbGdt)
3283 {
3284 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3285 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
3286 }
3287
3288 VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
3289 Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
3290 if (val < gdtr.cbGdt)
3291 {
3292 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3293 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
3294 }
3295
3296 VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
3297 Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
3298 if (val < gdtr.cbGdt)
3299 {
3300 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3301 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
3302 }
3303
3304 VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
3305 Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
3306 if (val < gdtr.cbGdt)
3307 {
3308 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3309 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
3310 }
3311
3312 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
3313 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
3314
3315 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
3316 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
3317 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
3318 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
3319
3320 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
3321 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
3322
3323 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
3324 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
3325
3326 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
3327 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
3328
3329 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
3330 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
3331 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
3332 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
3333
3334# if HC_ARCH_BITS == 64
3335 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
3336 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
3337 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
3338 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
3339 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
3340# endif
3341#endif /* VBOX_STRICT */
3342 }
3343 break;
3344 }
3345
3346 default:
3347 /* impossible */
3348 AssertFailed();
3349 break;
3350 }
3351}
3352
3353#if HC_ARCH_BITS == 32
3354/**
3355 * Prepares for and executes VMLAUNCH (64 bits guest mode)
3356 *
3357 * @returns VBox status code
3358 * @param fResume vmlauch/vmresume
3359 * @param pCtx Guest context
3360 */
3361DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx)
3362{
3363 return VERR_NOT_IMPLEMENTED;
3364}
3365#endif
3366
3367
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette