HWVMXR0.cpp@ 10607

Last change on this file since 10607 was 10607, checked in by vboxsync, 17 years ago
Guest state loading and host state saving must be done after TPR handling as that code can jump back to ring 3 (!).
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 85.2 KB

Line
1	/* $Id: HWVMXR0.cpp 10607 2008-07-14 16:17:10Z vboxsync $ */
2	/** @file
3	* HWACCM VMX - Host Context Ring 0.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_HWACCM
27	#include <VBox/hwaccm.h>
28	#include "HWACCMInternal.h"
29	#include <VBox/vm.h>
30	#include <VBox/x86.h>
31	#include <VBox/pgm.h>
32	#include <VBox/pdm.h>
33	#include <VBox/err.h>
34	#include <VBox/log.h>
35	#include <VBox/selm.h>
36	#include <VBox/iom.h>
37	#include <iprt/param.h>
38	#include <iprt/assert.h>
39	#include <iprt/asm.h>
40	#include <iprt/string.h>
41	#include "HWVMXR0.h"
42
43
44	/* IO operation lookup arrays. */
45	static uint32_t aIOSize[4] = {1, 2, 0, 4};
46	static uint32_t aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
47
48
49	static void VMXR0CheckError(PVM pVM, int rc)
50	{
51	if (rc == VERR_VMX_GENERIC)
52	{
53	RTCCUINTREG instrError;
54
55	VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
56	pVM->hwaccm.s.vmx.ulLastInstrError = instrError;
57	}
58	pVM->hwaccm.s.lLastError = rc;
59	}
60
61	/**
62	* Sets up and activates VT-x on the current CPU
63	*
64	* @returns VBox status code.
65	* @param pCpu CPU info struct
66	* @param pVM The VM to operate on.
67	* @param pvPageCpu Pointer to the global cpu page
68	* @param pPageCpuPhys Physical address of the global cpu page
69	*/
70	HWACCMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
71	{
72	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
73	AssertReturn(pVM, VERR_INVALID_PARAMETER);
74	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
75
76	/* Setup Intel VMX. */
77	Assert(pVM->hwaccm.s.vmx.fSupported);
78
79	#ifdef LOG_ENABLED
80	SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
81	#endif
82	/* Set revision dword at the beginning of the VMXON structure. */
83	(uint32_t )pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
84
85	/* @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
86	* (which can have very bad consequences!!!)
87	*/
88
89	/* Make sure the VMX instructions don't cause #UD faults. */
90	ASMSetCR4(ASMGetCR4() \| X86_CR4_VMXE);
91
92	/* Enter VMX Root Mode */
93	int rc = VMXEnable(pPageCpuPhys);
94	if (VBOX_FAILURE(rc))
95	{
96	VMXR0CheckError(pVM, rc);
97	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
98	return VERR_VMX_VMXON_FAILED;
99	}
100	return VINF_SUCCESS;
101	}
102
103	/**
104	* Deactivates VT-x on the current CPU
105	*
106	* @returns VBox status code.
107	* @param pCpu CPU info struct
108	* @param pvPageCpu Pointer to the global cpu page
109	* @param pPageCpuPhys Physical address of the global cpu page
110	*/
111	HWACCMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
112	{
113	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
114	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
115
116	/* Leave VMX Root Mode. */
117	VMXDisable();
118
119	/* And clear the X86_CR4_VMXE bit */
120	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
121
122	#ifdef LOG_ENABLED
123	SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
124	#endif
125	return VINF_SUCCESS;
126	}
127
128	/**
129	* Does Ring-0 per VM VT-x init.
130	*
131	* @returns VBox status code.
132	* @param pVM The VM to operate on.
133	*/
134	HWACCMR0DECL(int) VMXR0InitVM(PVM pVM)
135	{
136	int rc;
137
138	#ifdef LOG_ENABLED
139	SUPR0Printf("VMXR0InitVM %x\n", pVM);
140	#endif
141	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
142	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
143	pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
144
145
146	/* Allocate one page for the VM control structure (VMCS). */
147	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
148	AssertRC(rc);
149	if (RT_FAILURE(rc))
150	return rc;
151
152	pVM->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjVMCS);
153	pVM->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjVMCS, 0);
154	ASMMemZero32(pVM->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
155
156	/* Allocate one page for the TSS we need for real mode emulation. */
157	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
158	AssertRC(rc);
159	if (RT_FAILURE(rc))
160	return rc;
161
162	pVM->hwaccm.s.vmx.pRealModeTSS = (PVBOXTSS)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjRealModeTSS);
163	pVM->hwaccm.s.vmx.pRealModeTSSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 0);
164
165	/* The I/O bitmap starts right after the virtual interrupt redirection bitmap. Outside the TSS on purpose; the CPU will not check it
166	* for I/O operations. */
167	ASMMemZero32(pVM->hwaccm.s.vmx.pRealModeTSS, PAGE_SIZE);
168	pVM->hwaccm.s.vmx.pRealModeTSS->offIoBitmap = sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS);
169	/* Bit set to 0 means redirection enabled. */
170	memset(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap, 0x0, sizeof(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap));
171
172	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
173	{
174	/* Allocate one page for the virtual APIC mmio cache. */
175	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
176	AssertRC(rc);
177	if (RT_FAILURE(rc))
178	return rc;
179
180	pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
181	pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
182	ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
183	}
184	else
185	{
186	pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
187	pVM->hwaccm.s.vmx.pAPIC = 0;
188	pVM->hwaccm.s.vmx.pAPICPhys = 0;
189	}
190
191	#ifdef LOG_ENABLED
192	SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x) RealModeTSS=%x (%x)\n", pVM, pVM->hwaccm.s.vmx.pVMCS, (uint32_t)pVM->hwaccm.s.vmx.pVMCSPhys, pVM->hwaccm.s.vmx.pRealModeTSS, (uint32_t)pVM->hwaccm.s.vmx.pRealModeTSSPhys);
193	#endif
194	return VINF_SUCCESS;
195	}
196
197	/**
198	* Does Ring-0 per VM VT-x termination.
199	*
200	* @returns VBox status code.
201	* @param pVM The VM to operate on.
202	*/
203	HWACCMR0DECL(int) VMXR0TermVM(PVM pVM)
204	{
205	if (pVM->hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
206	{
207	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjVMCS, false);
208	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
209	pVM->hwaccm.s.vmx.pVMCS = 0;
210	pVM->hwaccm.s.vmx.pVMCSPhys = 0;
211	}
212	if (pVM->hwaccm.s.vmx.pMemObjRealModeTSS != NIL_RTR0MEMOBJ)
213	{
214	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, false);
215	pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
216	pVM->hwaccm.s.vmx.pRealModeTSS = 0;
217	pVM->hwaccm.s.vmx.pRealModeTSSPhys = 0;
218	}
219	if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
220	{
221	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
222	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
223	pVM->hwaccm.s.vmx.pAPIC = 0;
224	pVM->hwaccm.s.vmx.pAPICPhys = 0;
225	}
226	return VINF_SUCCESS;
227	}
228
229	/**
230	* Sets up VT-x for the specified VM
231	*
232	* @returns VBox status code.
233	* @param pVM The VM to operate on.
234	*/
235	HWACCMR0DECL(int) VMXR0SetupVM(PVM pVM)
236	{
237	int rc = VINF_SUCCESS;
238	uint32_t val;
239
240	AssertReturn(pVM, VERR_INVALID_PARAMETER);
241	Assert(pVM->hwaccm.s.vmx.pVMCS);
242
243	/* Set revision dword at the beginning of the VMCS structure. */
244	(uint32_t )pVM->hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
245
246	/* Clear VM Control Structure. */
247	Log(("pVMCSPhys = %VHp\n", pVM->hwaccm.s.vmx.pVMCSPhys));
248	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
249	if (VBOX_FAILURE(rc))
250	goto vmx_end;
251
252	/* Activate the VM Control Structure. */
253	rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
254	if (VBOX_FAILURE(rc))
255	goto vmx_end;
256
257	/* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
258	* Set required bits to one and zero according to the MSR capabilities.
259	*/
260	val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
261	/* External and non-maskable interrupts cause VM-exits. */
262	val = val \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
263	val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
264
265	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
266	AssertRC(rc);
267
268	/* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
269	* Set required bits to one and zero according to the MSR capabilities.
270	*/
271	val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
272	/* Program which event cause VM-exits and which features we want to use. */
273	val = val \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
274	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
275	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
276	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
277	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
278	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
279
280	/** @note VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
281
282	#if HC_ARCH_BITS == 64
283	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
284	{
285	/* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
286	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
287	Assert(pVM->hwaccm.s.vmx.pAPIC);
288	}
289	else
290	/* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
291	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
292	#endif
293	/* Mask away the bits that the CPU doesn't support */
294	/** @todo make sure they don't conflict with the above requirements. */
295	val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
296	pVM->hwaccm.s.vmx.proc_ctls = val;
297
298	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
299	AssertRC(rc);
300
301	/* VMX_VMCS_CTRL_CR3_TARGET_COUNT
302	* Set required bits to one and zero according to the MSR capabilities.
303	*/
304	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
305	AssertRC(rc);
306
307	/* VMX_VMCS_CTRL_EXIT_CONTROLS
308	* Set required bits to one and zero according to the MSR capabilities.
309	*/
310	val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
311	#if HC_ARCH_BITS == 64
312	val \|= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
313	#else
314	/* else Must be zero when AMD64 is not available. */
315	#endif
316	val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
317	/* Don't acknowledge external interrupts on VM-exit. */
318	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
319	AssertRC(rc);
320
321	/* Forward all exception except #NM & #PF to the guest.
322	* We always need to check pagefaults since our shadow page table can be out of sync.
323	* And we always lazily sync the FPU & XMM state.
324	*/
325
326	/*
327	* @todo Possible optimization:
328	* Keep the FPU and XMM state current in the EM thread. That way there's no need to
329	* lazily sync anything, but the downside is that we can't use the FPU stack or XMM
330	* registers ourselves of course.
331	*
332	* @note only possible if the current state is actually ours (X86_CR0_TS flag)
333	*/
334	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, HWACCM_VMX_TRAP_MASK);
335	AssertRC(rc);
336
337	/* Don't filter page faults; all of them should cause a switch. */
338	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
339	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
340	AssertRC(rc);
341
342	/* Init TSC offset to zero. */
343	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
344	#if HC_ARCH_BITS == 32
345	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
346	#endif
347	AssertRC(rc);
348
349	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
350	#if HC_ARCH_BITS == 32
351	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
352	#endif
353	AssertRC(rc);
354
355	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
356	#if HC_ARCH_BITS == 32
357	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
358	#endif
359	AssertRC(rc);
360
361	/* Clear MSR controls. */
362	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
363	{
364	/* Optional */
365	rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, 0);
366	#if HC_ARCH_BITS == 32
367	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, 0);
368	#endif
369	AssertRC(rc);
370	}
371	rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
372	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
373	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
374	#if HC_ARCH_BITS == 32
375	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
376	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
377	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
378	#endif
379	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
380	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
381	AssertRC(rc);
382
383	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
384	{
385	Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
386	/* Optional */
387	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
388	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
389	#if HC_ARCH_BITS == 32
390	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32);
391	#endif
392	AssertRC(rc);
393	}
394
395	/* Set link pointer to -1. Not currently used. */
396	#if HC_ARCH_BITS == 32
397	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
398	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
399	#else
400	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
401	#endif
402	AssertRC(rc);
403
404	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
405	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
406	AssertRC(rc);
407
408	vmx_end:
409	VMXR0CheckError(pVM, rc);
410	return rc;
411	}
412
413
414	/**
415	* Injects an event (trap or external interrupt)
416	*
417	* @returns VBox status code.
418	* @param pVM The VM to operate on.
419	* @param pCtx CPU Context
420	* @param intInfo VMX interrupt info
421	* @param cbInstr Opcode length of faulting instruction
422	* @param errCode Error code (optional)
423	*/
424	static int VMXR0InjectEvent(PVM pVM, CPUMCTX *pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
425	{
426	int rc;
427
428	#ifdef VBOX_STRICT
429	uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
430	if (iGate == 0xE)
431	Log2(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, pCtx->rip, errCode, pCtx->cr2, intInfo));
432	else
433	if (iGate < 0x20)
434	Log2(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x\n", iGate, pCtx->rip, errCode));
435	else
436	{
437	Log2(("INJ-EI: %x at %VGv\n", iGate, pCtx->rip));
438	Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
439	Assert(pCtx->eflags.u32 & X86_EFL_IF);
440	}
441	#endif
442
443	/* Set event injection state. */
444	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO,
445	intInfo \| (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT)
446	);
447
448	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
449	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
450
451	AssertRC(rc);
452	return rc;
453	}
454
455
456	/**
457	* Checks for pending guest interrupts and injects them
458	*
459	* @returns VBox status code.
460	* @param pVM The VM to operate on.
461	* @param pCtx CPU Context
462	*/
463	static int VMXR0CheckPendingInterrupt(PVM pVM, CPUMCTX *pCtx)
464	{
465	int rc;
466
467	/* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
468	if (pVM->hwaccm.s.Event.fPending)
469	{
470	Log(("Reinjecting event %VX64 %08x at %VGv cr2=%RX64\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->rip, pCtx->cr2));
471	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
472	rc = VMXR0InjectEvent(pVM, pCtx, pVM->hwaccm.s.Event.intInfo, 0, pVM->hwaccm.s.Event.errCode);
473	AssertRC(rc);
474
475	pVM->hwaccm.s.Event.fPending = false;
476	return VINF_SUCCESS;
477	}
478
479	/* When external interrupts are pending, we should exit the VM when IF is set. */
480	if ( !TRPMHasTrap(pVM)
481	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
482	{
483	if (!(pCtx->eflags.u32 & X86_EFL_IF))
484	{
485	Log2(("Enable irq window exit!\n"));
486	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
487	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
488	AssertRC(rc);
489	}
490	else
491	if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
492	{
493	uint8_t u8Interrupt;
494
495	rc = PDMGetInterrupt(pVM, &u8Interrupt);
496	Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
497	if (VBOX_SUCCESS(rc))
498	{
499	rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
500	AssertRC(rc);
501	}
502	else
503	{
504	/* Can only happen in rare cases where a pending interrupt is cleared behind our back */
505	Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)));
506	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
507	/* Just continue */
508	}
509	}
510	else
511	Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS!!\n", pCtx->rip));
512	}
513
514	#ifdef VBOX_STRICT
515	if (TRPMHasTrap(pVM))
516	{
517	uint8_t u8Vector;
518	rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
519	AssertRC(rc);
520	}
521	#endif
522
523	if ( pCtx->eflags.u32 & X86_EFL_IF
524	&& (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
525	&& TRPMHasTrap(pVM)
526	)
527	{
528	uint8_t u8Vector;
529	int rc;
530	TRPMEVENT enmType;
531	RTGCUINTPTR intInfo;
532	RTGCUINT errCode;
533
534	/* If a new event is pending, then dispatch it now. */
535	rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
536	AssertRC(rc);
537	Assert(pCtx->eflags.Bits.u1IF == 1 \|\| enmType == TRPM_TRAP);
538	Assert(enmType != TRPM_SOFTWARE_INT);
539
540	/* Clear the pending trap. */
541	rc = TRPMResetTrap(pVM);
542	AssertRC(rc);
543
544	intInfo = u8Vector;
545	intInfo \|= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
546
547	if (enmType == TRPM_TRAP)
548	{
549	switch (u8Vector) {
550	case 8:
551	case 10:
552	case 11:
553	case 12:
554	case 13:
555	case 14:
556	case 17:
557	/* Valid error codes. */
558	intInfo \|= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
559	break;
560	default:
561	break;
562	}
563	if (u8Vector == X86_XCPT_BP \|\| u8Vector == X86_XCPT_OF)
564	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
565	else
566	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
567	}
568	else
569	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
570
571	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
572	rc = VMXR0InjectEvent(pVM, pCtx, intInfo, 0, errCode);
573	AssertRC(rc);
574	} /* if (interrupts can be dispatched) */
575
576	return VINF_SUCCESS;
577	}
578
579	/**
580	* Save the host state
581	*
582	* @returns VBox status code.
583	* @param pVM The VM to operate on.
584	*/
585	HWACCMR0DECL(int) VMXR0SaveHostState(PVM pVM)
586	{
587	int rc = VINF_SUCCESS;
588
589	/*
590	* Host CPU Context
591	*/
592	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
593	{
594	RTIDTR idtr;
595	RTGDTR gdtr;
596	RTSEL SelTR;
597	PX86DESCHC pDesc;
598	uintptr_t trBase;
599
600	/* Control registers */
601	rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
602	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
603	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
604	AssertRC(rc);
605	Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
606	Log2(("VMX_VMCS_HOST_CR3 %VHp\n", ASMGetCR3()));
607	Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
608
609	/* Selector registers. */
610	rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
611	/** @note VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
612	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
613	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
614	#if HC_ARCH_BITS == 32
615	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
616	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
617	#endif
618	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
619	SelTR = ASMGetTR();
620	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
621	AssertRC(rc);
622	Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
623	Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
624	Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
625	Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
626	Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
627	Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
628	Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
629
630	/* GDTR & IDTR */
631	ASMGetGDTR(&gdtr);
632	rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
633	ASMGetIDTR(&idtr);
634	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
635	AssertRC(rc);
636	Log2(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", gdtr.pGdt));
637	Log2(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", idtr.pIdt));
638
639	/* Save the base address of the TR selector. */
640	if (SelTR > gdtr.cbGdt)
641	{
642	AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
643	return VERR_VMX_INVALID_HOST_STATE;
644	}
645
646	pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
647	#if HC_ARCH_BITS == 64
648	trBase = X86DESC64_BASE(*pDesc);
649	#else
650	trBase = X86DESC_BASE(*pDesc);
651	#endif
652	rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
653	AssertRC(rc);
654	Log2(("VMX_VMCS_HOST_TR_BASE %VHv\n", trBase));
655
656	/* FS and GS base. */
657	#if HC_ARCH_BITS == 64
658	Log2(("MSR_K8_FS_BASE = %VHv\n", ASMRdMsr(MSR_K8_FS_BASE)));
659	Log2(("MSR_K8_GS_BASE = %VHv\n", ASMRdMsr(MSR_K8_GS_BASE)));
660	rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
661	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
662	#endif
663	AssertRC(rc);
664
665	/* Sysenter MSRs. */
666	/** @todo expensive!! */
667	rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
668	Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
669	#if HC_ARCH_BITS == 32
670	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
671	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
672	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
673	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
674	#else
675	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
676	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
677	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
678	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
679	#endif
680	AssertRC(rc);
681
682	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
683	}
684	return rc;
685	}
686
687
688	/**
689	* Loads the guest state
690	*
691	* NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
692	*
693	* @returns VBox status code.
694	* @param pVM The VM to operate on.
695	* @param pCtx Guest context
696	*/
697	HWACCMR0DECL(int) VMXR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
698	{
699	int rc = VINF_SUCCESS;
700	RTGCUINTPTR val;
701	X86EFLAGS eflags;
702
703	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
704	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
705	{
706	VMX_WRITE_SELREG(ES, es);
707	AssertRC(rc);
708
709	VMX_WRITE_SELREG(CS, cs);
710	AssertRC(rc);
711
712	VMX_WRITE_SELREG(SS, ss);
713	AssertRC(rc);
714
715	VMX_WRITE_SELREG(DS, ds);
716	AssertRC(rc);
717
718	/* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
719	VMX_WRITE_SELREG(FS, fs);
720	AssertRC(rc);
721
722	VMX_WRITE_SELREG(GS, gs);
723	AssertRC(rc);
724	}
725
726	/* Guest CPU context: LDTR. */
727	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
728	{
729	if (pCtx->ldtr == 0)
730	{
731	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
732	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
733	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
734	/** @note vmlaunch will fail with 0 or just 0x02. No idea why. */
735	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
736	}
737	else
738	{
739	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
740	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
741	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
742	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
743	}
744	AssertRC(rc);
745	}
746	/* Guest CPU context: TR. */
747	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
748	{
749	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
750
751	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
752	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
753	{
754	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS));
755	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, 0);
756	}
757	else
758	{
759	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
760	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
761	}
762	val = pCtx->trHid.Attr.u;
763
764	/* The TSS selector must be busy. */
765	if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
766	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_286_TSS_BUSY;
767	else
768	/* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
769	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_386_TSS_BUSY;
770
771	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
772	AssertRC(rc);
773	}
774	/* Guest CPU context: GDTR. */
775	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
776	{
777	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
778	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
779	AssertRC(rc);
780	}
781	/* Guest CPU context: IDTR. */
782	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
783	{
784	rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
785	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
786	AssertRC(rc);
787	}
788
789	/*
790	* Sysenter MSRs (unconditional)
791	*/
792	rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
793	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
794	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
795	AssertRC(rc);
796
797	/* Control registers */
798	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
799	{
800	val = pCtx->cr0;
801	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
802	Log2(("Guest CR0-shadow %08x\n", val));
803	if (CPUMIsGuestFPUStateActive(pVM) == false)
804	{
805	/* Always use #NM exceptions to load the FPU/XMM state on demand. */
806	val \|= X86_CR0_TS \| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_MP;
807	}
808	else
809	{
810	/** @todo check if we support the old style mess correctly. */
811	if (!(val & X86_CR0_NE))
812	{
813	Log(("Forcing X86_CR0_NE!!!\n"));
814
815	/* Also catch floating point exceptions as we need to report them to the guest in a different way. */
816	if (!pVM->hwaccm.s.fFPUOldStyleOverride)
817	{
818	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, HWACCM_VMX_TRAP_MASK \| RT_BIT(X86_XCPT_MF));
819	AssertRC(rc);
820	pVM->hwaccm.s.fFPUOldStyleOverride = true;
821	}
822	}
823
824	val \|= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
825	}
826	/* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
827	val \|= X86_CR0_PE \| X86_CR0_PG;
828	/* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
829	val \|= X86_CR0_WP;
830
831	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
832	Log2(("Guest CR0 %08x\n", val));
833	/* CR0 flags owned by the host; if the guests attempts to change them, then
834	* the VM will exit.
835	*/
836	val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
837	\| X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
838	\| X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
839	\| X86_CR0_TS
840	\| X86_CR0_ET
841	\| X86_CR0_NE
842	\| X86_CR0_MP;
843	pVM->hwaccm.s.vmx.cr0_mask = val;
844
845	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
846	Log2(("Guest CR0-mask %08x\n", val));
847	AssertRC(rc);
848	}
849	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
850	{
851	/* CR4 */
852	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
853	Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
854	/* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
855	val = pCtx->cr4 \| (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
856	switch(pVM->hwaccm.s.enmShadowMode)
857	{
858	case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
859	case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
860	case PGMMODE_32_BIT: /* 32-bit paging. */
861	break;
862
863	case PGMMODE_PAE: /* PAE paging. */
864	case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
865	/** @todo use normal 32 bits paging */
866	val \|= X86_CR4_PAE;
867	break;
868
869	case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
870	case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
871	#ifdef VBOX_ENABLE_64_BITS_GUESTS
872	break;
873	#else
874	AssertFailed();
875	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
876	#endif
877	default: /* shut up gcc */
878	AssertFailed();
879	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
880	}
881	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
882	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
883	val \|= X86_CR4_VME;
884
885	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
886	Log2(("Guest CR4 %08x\n", val));
887	/* CR4 flags owned by the host; if the guests attempts to change them, then
888	* the VM will exit.
889	*/
890	val = X86_CR4_PAE
891	\| X86_CR4_PGE
892	\| X86_CR4_PSE
893	\| X86_CR4_VMXE;
894	pVM->hwaccm.s.vmx.cr4_mask = val;
895
896	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
897	Log2(("Guest CR4-mask %08x\n", val));
898	AssertRC(rc);
899	}
900
901	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
902	{
903	/* Save our shadow CR3 register. */
904	val = PGMGetHyperCR3(pVM);
905	Assert(val);
906	rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
907	AssertRC(rc);
908	}
909
910	/* Debug registers. */
911	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
912	{
913	/** @todo DR0-6 */
914	val = pCtx->dr7;
915	val &= ~(RT_BIT(11) \| RT_BIT(12) \| RT_BIT(14) \| RT_BIT(15)); /* must be zero */
916	val \|= 0x400; /* must be one */
917	#ifdef VBOX_STRICT
918	val = 0x400;
919	#endif
920	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DR7, val);
921	AssertRC(rc);
922
923	/* IA32_DEBUGCTL MSR. */
924	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
925	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
926	AssertRC(rc);
927
928	/** @todo */
929	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
930	AssertRC(rc);
931	}
932
933	/* EIP, ESP and EFLAGS */
934	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
935	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
936	AssertRC(rc);
937
938	/* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
939	eflags = pCtx->eflags;
940	eflags.u32 &= VMX_EFLAGS_RESERVED_0;
941	eflags.u32 \|= VMX_EFLAGS_RESERVED_1;
942
943	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
944	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
945	{
946	eflags.Bits.u1VM = 1;
947	eflags.Bits.u1VIF = pCtx->eflags.Bits.u1IF;
948	eflags.Bits.u2IOPL = 3;
949	}
950
951	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
952	AssertRC(rc);
953
954	/** TSC offset. */
955	uint64_t u64TSCOffset;
956
957	if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
958	{
959	/* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
960	#if HC_ARCH_BITS == 64
961	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
962	#else
963	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, (uint32_t)u64TSCOffset);
964	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
965	#endif
966	AssertRC(rc);
967
968	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
969	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
970	AssertRC(rc);
971	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCOffset);
972	}
973	else
974	{
975	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
976	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
977	AssertRC(rc);
978	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCIntercept);
979	}
980
981	/* VMX_VMCS_CTRL_ENTRY_CONTROLS
982	* Set required bits to one and zero according to the MSR capabilities.
983	*/
984	val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
985	/* 64 bits guest mode? */
986	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
987	val \|= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
988	/* else Must be zero when AMD64 is not available. */
989
990	/* Mask away the bits that the CPU doesn't support */
991	val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
992	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
993	AssertRC(rc);
994
995	/* 64 bits guest mode? */
996	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
997	{
998	#if !defined(VBOX_WITH_64_BITS_GUESTS) \|\| HC_ARCH_BITS != 64
999	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1000	#else
1001	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1002	#endif
1003	/* Unconditionally update these as wrmsr might have changed them. */
1004	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1005	AssertRC(rc);
1006	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1007	AssertRC(rc);
1008	}
1009	else
1010	{
1011	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1012	}
1013
1014	/* Done. */
1015	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1016
1017	return rc;
1018	}
1019
1020	/**
1021	* Runs guest code in a VT-x VM.
1022	*
1023	* @note NEVER EVER turn on interrupts here. Due to our illegal entry into the kernel, it might mess things up. (XP kernel traps have been frequently observed)
1024	*
1025	* @returns VBox status code.
1026	* @param pVM The VM to operate on.
1027	* @param pCtx Guest context
1028	*/
1029	HWACCMR0DECL(int) VMXR0RunGuestCode(PVM pVM, CPUMCTX *pCtx)
1030	{
1031	int rc = VINF_SUCCESS;
1032	RTCCUINTREG val, valShadow;
1033	RTCCUINTREG exitReason, instrError, cbInstr;
1034	RTGCUINTPTR exitQualification;
1035	RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1036	RTGCUINTPTR errCode, instrInfo, uInterruptState;
1037	bool fGuestStateSynced = false;
1038	unsigned cResume = 0;
1039
1040	Log2(("\nE"));
1041
1042	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
1043
1044	#ifdef VBOX_STRICT
1045	rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1046	AssertRC(rc);
1047	Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1048
1049	/* allowed zero */
1050	if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1051	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1052
1053	/* allowed one */
1054	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1055	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1056
1057	rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1058	AssertRC(rc);
1059	Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1060
1061	/* allowed zero */
1062	if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1063	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1064
1065	/* allowed one */
1066	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1067	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1068
1069	rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1070	AssertRC(rc);
1071	Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1072
1073	/* allowed zero */
1074	if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1075	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1076
1077	/* allowed one */
1078	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1079	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1080
1081	rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1082	AssertRC(rc);
1083	Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1084
1085	/* allowed zero */
1086	if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1087	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1088
1089	/* allowed one */
1090	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1091	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1092	#endif
1093
1094	#if 0
1095	/*
1096	* Check if debug registers are armed.
1097	*/
1098	uint32_t u32DR7 = ASMGetDR7();
1099	if (u32DR7 & X86_DR7_ENABLED_MASK)
1100	{
1101	pVM->cpum.s.fUseFlags \|= CPUM_USE_DEBUG_REGS_HOST;
1102	}
1103	else
1104	pVM->cpum.s.fUseFlags &= ~CPUM_USE_DEBUG_REGS_HOST;
1105	#endif
1106
1107	/* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1108	*/
1109	ResumeExecution:
1110	/* Safety precaution; looping for too long here can have a very bad effect on the host */
1111	if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1112	{
1113	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
1114	rc = VINF_EM_RAW_INTERRUPT;
1115	goto end;
1116	}
1117
1118	/* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1119	if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1120	{
1121	Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1122	if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1123	{
1124	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1125	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1126	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1127	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1128	*/
1129	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1130	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1131	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1132	AssertRC(rc);
1133	}
1134	}
1135	else
1136	{
1137	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1138	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1139	AssertRC(rc);
1140	}
1141
1142	/* Check for pending actions that force us to go back to ring 3. */
1143	if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 \| VM_FF_TIMER))
1144	{
1145	VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1146	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
1147	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1148	rc = VINF_EM_RAW_TO_R3;
1149	goto end;
1150	}
1151	/* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1152	if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1153	{
1154	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1155	rc = VINF_EM_PENDING_REQUEST;
1156	goto end;
1157	}
1158
1159	/* When external interrupts are pending, we should exit the VM when IF is set. */
1160	/** @note after VM_FF_INHIBIT_INTERRUPTS check!!! */
1161	rc = VMXR0CheckPendingInterrupt(pVM, pCtx);
1162	if (VBOX_FAILURE(rc))
1163	{
1164	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1165	goto end;
1166	}
1167
1168	/** @todo check timers?? */
1169
1170	/* TPR caching using CR8 is only available in 64 bits mode */
1171	/* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1172	/* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1173	/*
1174	* @todo reduce overhead
1175	*/
1176	if ( pCtx->msrEFER & MSR_K6_EFER_LMA
1177	&& pVM->hwaccm.s.vmx.pAPIC)
1178	{
1179	/* TPR caching in CR8 */
1180	uint8_t u8TPR;
1181	int rc = PDMApicGetTPR(pVM, &u8TPR);
1182	AssertRC(rc);
1183	/* The TPR can be found at offset 0x80 in the APIC mmio page. */
1184	pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1185
1186	/* CR8 updates that lower the TPR value to below the current value should cause an exit. */
1187	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, u8TPR);
1188	AssertRC(rc);
1189	}
1190
1191	/*
1192	* NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1193	* (until the actual world switch)
1194	*/
1195	/* Save the host state first. */
1196	rc = VMXR0SaveHostState(pVM);
1197	if (rc != VINF_SUCCESS)
1198	{
1199	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1200	goto end;
1201	}
1202	/* Load the guest state */
1203	rc = VMXR0LoadGuestState(pVM, pCtx);
1204	if (rc != VINF_SUCCESS)
1205	{
1206	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1207	goto end;
1208	}
1209	fGuestStateSynced = true;
1210
1211	/* Non-register state Guest Context */
1212	/** @todo change me according to cpu state */
1213	rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1214	AssertRC(rc);
1215
1216	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1217
1218	/* Manual save and restore:
1219	* - General purpose registers except RIP, RSP
1220	*
1221	* Trashed:
1222	* - CR2 (we don't care)
1223	* - LDTR (reset to 0)
1224	* - DRx (presumably not changed at all)
1225	* - DR7 (reset to 0x400)
1226	* - EFLAGS (reset to RT_BIT(1); not relevant)
1227	*
1228	*/
1229
1230	/* All done! Let's start VM execution. */
1231	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
1232	rc = pVM->hwaccm.s.vmx.pfnStartVM(pVM->hwaccm.s.vmx.fResumeVM, pCtx);
1233
1234	/* In case we execute a goto ResumeExecution later on. */
1235	pVM->hwaccm.s.vmx.fResumeVM = true;
1236
1237	/**
1238	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1239	* IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 BEFORE WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1240	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1241	*/
1242
1243	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
1244	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
1245
1246	switch (rc)
1247	{
1248	case VINF_SUCCESS:
1249	break;
1250
1251	case VERR_VMX_INVALID_VMXON_PTR:
1252	AssertFailed();
1253	goto end;
1254
1255	case VERR_VMX_UNABLE_TO_START_VM:
1256	case VERR_VMX_UNABLE_TO_RESUME_VM:
1257	{
1258	#ifdef VBOX_STRICT
1259	int rc1;
1260
1261	rc1 = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1262	rc1 \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1263	AssertRC(rc1);
1264	if (rc1 == VINF_SUCCESS)
1265	{
1266	RTGDTR gdtr;
1267	PX86DESCHC pDesc;
1268
1269	ASMGetGDTR(&gdtr);
1270
1271	Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
1272	Log(("Current stack %08x\n", &rc1));
1273
1274
1275	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1276	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
1277	VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1278	Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
1279	VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1280	Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
1281	VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1282	Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
1283	VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1284	Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
1285
1286	VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
1287	Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
1288
1289	VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
1290	Log(("VMX_VMCS_HOST_CR3 %VHp\n", val));
1291
1292	VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
1293	Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
1294
1295	VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
1296	Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
1297	if (val < gdtr.cbGdt)
1298	{
1299	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1300	HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
1301	}
1302
1303	VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
1304	Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
1305	if (val < gdtr.cbGdt)
1306	{
1307	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1308	HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
1309	}
1310
1311	VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
1312	Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
1313	if (val < gdtr.cbGdt)
1314	{
1315	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1316	HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
1317	}
1318
1319	VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
1320	Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
1321	if (val < gdtr.cbGdt)
1322	{
1323	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1324	HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
1325	}
1326
1327	VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
1328	Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
1329	if (val < gdtr.cbGdt)
1330	{
1331	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1332	HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
1333	}
1334
1335	VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
1336	Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
1337	if (val < gdtr.cbGdt)
1338	{
1339	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1340	HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
1341	}
1342
1343	VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
1344	Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
1345	if (val < gdtr.cbGdt)
1346	{
1347	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1348	HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
1349	}
1350
1351	VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
1352	Log(("VMX_VMCS_HOST_TR_BASE %VHv\n", val));
1353
1354	VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
1355	Log(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", val));
1356	VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
1357	Log(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", val));
1358
1359	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
1360	Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
1361
1362	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
1363	Log(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", val));
1364
1365	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
1366	Log(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", val));
1367
1368	VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
1369	Log(("VMX_VMCS_HOST_RSP %VHv\n", val));
1370	VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
1371	Log(("VMX_VMCS_HOST_RIP %VHv\n", val));
1372
1373	#if HC_ARCH_BITS == 64
1374	Log(("MSR_K6_EFER = %VX64\n", ASMRdMsr(MSR_K6_EFER)));
1375	Log(("MSR_K6_STAR = %VX64\n", ASMRdMsr(MSR_K6_STAR)));
1376	Log(("MSR_K8_LSTAR = %VX64\n", ASMRdMsr(MSR_K8_LSTAR)));
1377	Log(("MSR_K8_CSTAR = %VX64\n", ASMRdMsr(MSR_K8_CSTAR)));
1378	Log(("MSR_K8_SF_MASK = %VX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
1379	#endif
1380	}
1381	#endif /* VBOX_STRICT */
1382	goto end;
1383	}
1384
1385	default:
1386	/* impossible */
1387	AssertFailed();
1388	goto end;
1389	}
1390	/* Success. Query the guest state and figure out what has happened. */
1391
1392	/* Investigate why there was a VM-exit. */
1393	rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1394	STAM_COUNTER_INC(&pVM->hwaccm.s.pStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1395
1396	exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1397	rc \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1398	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
1399	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
1400	intInfo = val;
1401	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1402	errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1403	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
1404	instrInfo = val;
1405	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1406	exitQualification = val;
1407	AssertRC(rc);
1408
1409	/* Let's first sync back eip, esp, and eflags. */
1410	rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1411	AssertRC(rc);
1412	pCtx->rip = val;
1413	rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1414	AssertRC(rc);
1415	pCtx->rsp = val;
1416	rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1417	AssertRC(rc);
1418	pCtx->eflags.u32 = val;
1419
1420	/* Update the APIC with the cached TPR value.
1421	* @todo reduce overhead
1422	*/
1423	if ( pCtx->msrEFER & MSR_K6_EFER_LMA
1424	&& pVM->hwaccm.s.vmx.pAPIC)
1425	{
1426	rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
1427	AssertRC(rc);
1428	}
1429
1430	/* Take care of instruction fusing (sti, mov ss) */
1431	rc \|= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1432	uInterruptState = val;
1433	if (uInterruptState != 0)
1434	{
1435	Assert(uInterruptState <= 2); /* only sti & mov ss */
1436	Log(("uInterruptState %x eip=%VGv\n", uInterruptState, pCtx->rip));
1437	EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1438	}
1439	else
1440	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1441
1442	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1443	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
1444	{
1445	/* Hide our emulation flags */
1446	pCtx->eflags.Bits.u1VM = 0;
1447	pCtx->eflags.Bits.u1IF = pCtx->eflags.Bits.u1VIF;
1448	pCtx->eflags.Bits.u1VIF = 0;
1449	pCtx->eflags.Bits.u2IOPL = 0;
1450	}
1451
1452	/* Control registers. */
1453	VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1454	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1455	val = (valShadow & pVM->hwaccm.s.vmx.cr0_mask) \| (val & ~pVM->hwaccm.s.vmx.cr0_mask);
1456	CPUMSetGuestCR0(pVM, val);
1457
1458	VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1459	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1460	val = (valShadow & pVM->hwaccm.s.vmx.cr4_mask) \| (val & ~pVM->hwaccm.s.vmx.cr4_mask);
1461	CPUMSetGuestCR4(pVM, val);
1462
1463	CPUMSetGuestCR2(pVM, ASMGetCR2());
1464
1465	VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1466	CPUMSetGuestDR7(pVM, val);
1467
1468	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1469	VMX_READ_SELREG(ES, es);
1470	VMX_READ_SELREG(SS, ss);
1471	VMX_READ_SELREG(CS, cs);
1472	VMX_READ_SELREG(DS, ds);
1473	VMX_READ_SELREG(FS, fs);
1474	VMX_READ_SELREG(GS, gs);
1475
1476	/** @note NOW IT'S SAFE FOR LOGGING! */
1477	Log2(("Raw exit reason %08x\n", exitReason));
1478
1479	/* Check if an injected event was interrupted prematurely. */
1480	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
1481	AssertRC(rc);
1482	pVM->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
1483	if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVM->hwaccm.s.Event.intInfo)
1484	&& VMX_EXIT_INTERRUPTION_INFO_TYPE(pVM->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW)
1485	{
1486	pVM->hwaccm.s.Event.fPending = true;
1487	/* Error code present? */
1488	if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVM->hwaccm.s.Event.intInfo))
1489	{
1490	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
1491	AssertRC(rc);
1492	pVM->hwaccm.s.Event.errCode = val;
1493	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification, val));
1494	}
1495	else
1496	{
1497	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification));
1498	pVM->hwaccm.s.Event.errCode = 0;
1499	}
1500	}
1501
1502	#ifdef VBOX_STRICT
1503	if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
1504	HWACCMDumpRegs(pVM, pCtx);
1505	#endif
1506
1507	Log2(("E%d", exitReason));
1508	Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
1509	Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
1510	Log2(("Interruption error code %d\n", errCode));
1511	Log2(("IntInfo = %08x\n", intInfo));
1512	Log2(("New EIP=%VGv\n", pCtx->rip));
1513
1514	/* Some cases don't need a complete resync of the guest CPU state; handle them here. */
1515	switch (exitReason)
1516	{
1517	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
1518	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
1519	{
1520	uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
1521
1522	if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
1523	{
1524	Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
1525	/* External interrupt; leave to allow it to be dispatched again. */
1526	rc = VINF_EM_RAW_INTERRUPT;
1527	break;
1528	}
1529	switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
1530	{
1531	case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
1532	/* External interrupt; leave to allow it to be dispatched again. */
1533	rc = VINF_EM_RAW_INTERRUPT;
1534	break;
1535
1536	case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
1537	AssertFailed(); /* can't come here; fails the first check. */
1538	break;
1539
1540	case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
1541	Assert(vector == 3 \|\| vector == 4);
1542	/* no break */
1543	case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
1544	Log2(("Hardware/software interrupt %d\n", vector));
1545	switch (vector)
1546	{
1547	case X86_XCPT_NM:
1548	{
1549	uint32_t oldCR0;
1550
1551	Log(("#NM fault at %VGv error code %x\n", pCtx->rip, errCode));
1552
1553	/** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1554	oldCR0 = ASMGetCR0();
1555	/* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1556	rc = CPUMHandleLazyFPU(pVM);
1557	if (rc == VINF_SUCCESS)
1558	{
1559	Assert(CPUMIsGuestFPUStateActive(pVM));
1560
1561	/* CPUMHandleLazyFPU could have changed CR0; restore it. */
1562	ASMSetCR0(oldCR0);
1563
1564	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1565
1566	/* Continue execution. */
1567	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1568	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1569
1570	goto ResumeExecution;
1571	}
1572
1573	Log(("Forward #NM fault to the guest\n"));
1574	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1575	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
1576	AssertRC(rc);
1577	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1578	goto ResumeExecution;
1579	}
1580
1581	case X86_XCPT_PF: /* Page fault */
1582	{
1583	Log2(("Page fault at %VGv error code %x\n", exitQualification ,errCode));
1584	/* Exit qualification contains the linear address of the page fault. */
1585	TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1586	TRPMSetErrorCode(pVM, errCode);
1587	TRPMSetFaultAddress(pVM, exitQualification);
1588
1589	/* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1590	rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
1591	Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->rip, rc));
1592	if (rc == VINF_SUCCESS)
1593	{ /* We've successfully synced our shadow pages, so let's just continue execution. */
1594	Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, exitQualification ,errCode));
1595	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1596
1597	TRPMResetTrap(pVM);
1598
1599	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1600	goto ResumeExecution;
1601	}
1602	else
1603	if (rc == VINF_EM_RAW_GUEST_TRAP)
1604	{ /* A genuine pagefault.
1605	* Forward the trap to the guest by injecting the exception and resuming execution.
1606	*/
1607	Log2(("Forward page fault to the guest\n"));
1608	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1609	/* The error code might have been changed. */
1610	errCode = TRPMGetErrorCode(pVM);
1611
1612	TRPMResetTrap(pVM);
1613
1614	/* Now we must update CR2. */
1615	pCtx->cr2 = exitQualification;
1616	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1617	AssertRC(rc);
1618
1619	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1620	goto ResumeExecution;
1621	}
1622	#ifdef VBOX_STRICT
1623	if (rc != VINF_EM_RAW_EMULATE_INSTR)
1624	Log2(("PGMTrap0eHandler failed with %d\n", rc));
1625	#endif
1626	/* Need to go back to the recompiler to emulate the instruction. */
1627	TRPMResetTrap(pVM);
1628	break;
1629	}
1630
1631	case X86_XCPT_MF: /* Floating point exception. */
1632	{
1633	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1634	if (!(pCtx->cr0 & X86_CR0_NE))
1635	{
1636	/* old style FPU error reporting needs some extra work. */
1637	/** @todo don't fall back to the recompiler, but do it manually. */
1638	rc = VINF_EM_RAW_EMULATE_INSTR;
1639	break;
1640	}
1641	Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1642	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1643	AssertRC(rc);
1644
1645	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1646	goto ResumeExecution;
1647	}
1648
1649	#ifdef VBOX_STRICT
1650	case X86_XCPT_GP: /* General protection failure exception.*/
1651	case X86_XCPT_UD: /* Unknown opcode exception. */
1652	case X86_XCPT_DE: /* Debug exception. */
1653	case X86_XCPT_SS: /* Stack segment exception. */
1654	case X86_XCPT_NP: /* Segment not present exception. */
1655	{
1656	switch(vector)
1657	{
1658	case X86_XCPT_DE:
1659	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
1660	break;
1661	case X86_XCPT_UD:
1662	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
1663	break;
1664	case X86_XCPT_SS:
1665	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
1666	break;
1667	case X86_XCPT_NP:
1668	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
1669	break;
1670	case X86_XCPT_GP:
1671	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1672	break;
1673	}
1674
1675	Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1676	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1677	AssertRC(rc);
1678
1679	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1680	goto ResumeExecution;
1681	}
1682	#endif
1683	default:
1684	AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1685	rc = VERR_EM_INTERNAL_ERROR;
1686	break;
1687	} /* switch (vector) */
1688
1689	break;
1690
1691	default:
1692	rc = VERR_EM_INTERNAL_ERROR;
1693	AssertFailed();
1694	break;
1695	}
1696
1697	break;
1698	}
1699
1700	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
1701	/* Clear VM-exit on IF=1 change. */
1702	Log2(("VMX_EXIT_IRQ_WINDOW %VGv\n", pCtx->rip));
1703	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
1704	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1705	AssertRC(rc);
1706	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIrqWindow);
1707	goto ResumeExecution; /* we check for pending guest interrupts there */
1708
1709	case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. */
1710	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
1711	/* Skip instruction and continue directly. */
1712	pCtx->rip += cbInstr;
1713	/* Continue execution.*/
1714	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1715	goto ResumeExecution;
1716
1717	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
1718	{
1719	Log2(("VMX: Cpuid %x\n", pCtx->eax));
1720	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
1721	rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
1722	if (rc == VINF_SUCCESS)
1723	{
1724	/* Update EIP and continue execution. */
1725	Assert(cbInstr == 2);
1726	pCtx->rip += cbInstr;
1727	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1728	goto ResumeExecution;
1729	}
1730	AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
1731	rc = VINF_EM_RAW_EMULATE_INSTR;
1732	break;
1733	}
1734
1735	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
1736	{
1737	Log2(("VMX: Rdtsc\n"));
1738	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
1739	rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
1740	if (rc == VINF_SUCCESS)
1741	{
1742	/* Update EIP and continue execution. */
1743	Assert(cbInstr == 2);
1744	pCtx->rip += cbInstr;
1745	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1746	goto ResumeExecution;
1747	}
1748	AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
1749	rc = VINF_EM_RAW_EMULATE_INSTR;
1750	break;
1751	}
1752
1753	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
1754	{
1755	Log2(("VMX: invlpg\n"));
1756	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
1757	rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
1758	if (rc == VINF_SUCCESS)
1759	{
1760	/* Update EIP and continue execution. */
1761	pCtx->rip += cbInstr;
1762	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1763	goto ResumeExecution;
1764	}
1765	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %VGv failed with %Vrc\n", exitQualification, rc));
1766	break;
1767	}
1768
1769	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
1770	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
1771	{
1772	uint32_t cbSize;
1773
1774	/* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
1775	Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
1776	rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1777	if (rc == VINF_SUCCESS)
1778	{
1779	/* EIP has been updated already. */
1780
1781	/* Only resume if successful. */
1782	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1783	goto ResumeExecution;
1784	}
1785	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Vrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
1786	break;
1787	}
1788
1789	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
1790	{
1791	switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
1792	{
1793	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
1794	Log2(("VMX: %VGv mov cr%d, x\n", pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
1795	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
1796	rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
1797	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
1798	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
1799
1800	switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
1801	{
1802	case 0:
1803	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1804	break;
1805	case 2:
1806	break;
1807	case 3:
1808	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR3;
1809	break;
1810	case 4:
1811	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR4;
1812	break;
1813	case 8:
1814	/* CR8 contains the APIC TPR */
1815	Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
1816	break;
1817
1818	default:
1819	AssertFailed();
1820	break;
1821	}
1822	/* Check if a sync operation is pending. */
1823	if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1824	&& VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
1825	{
1826	rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
1827	AssertRC(rc);
1828	}
1829	break;
1830
1831	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
1832	Log2(("VMX: mov x, crx\n"));
1833	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
1834
1835	/* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
1836	Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 \|\| !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
1837
1838	rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
1839	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
1840	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
1841	break;
1842
1843	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
1844	Log2(("VMX: clts\n"));
1845	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCLTS);
1846	rc = EMInterpretCLTS(pVM);
1847	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1848	break;
1849
1850	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
1851	Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
1852	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitLMSW);
1853	rc = EMInterpretLMSW(pVM, VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
1854	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1855	break;
1856	}
1857
1858	/* Update EIP if no error occurred. */
1859	if (VBOX_SUCCESS(rc))
1860	pCtx->rip += cbInstr;
1861
1862	if (rc == VINF_SUCCESS)
1863	{
1864	/* Only resume if successful. */
1865	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1866	goto ResumeExecution;
1867	}
1868	Assert(rc == VERR_EM_INTERPRETER \|\| rc == VINF_PGM_CHANGE_MODE \|\| rc == VINF_PGM_SYNC_CR3);
1869	break;
1870	}
1871
1872	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
1873	{
1874	/** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
1875	if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
1876	{
1877	Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
1878	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxWrite);
1879	rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
1880	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
1881	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
1882	Log2(("DR7=%08x\n", pCtx->dr7));
1883	}
1884	else
1885	{
1886	Log2(("VMX: mov x, drx\n"));
1887	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1888	rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
1889	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
1890	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
1891	}
1892	/* Update EIP if no error occurred. */
1893	if (VBOX_SUCCESS(rc))
1894	pCtx->rip += cbInstr;
1895
1896	if (rc == VINF_SUCCESS)
1897	{
1898	/* Only resume if successful. */
1899	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1900	goto ResumeExecution;
1901	}
1902	Assert(rc == VERR_EM_INTERPRETER);
1903	break;
1904	}
1905
1906	/** @note We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
1907	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
1908	{
1909	uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
1910	uint32_t uPort;
1911	bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
1912
1913	/** @todo necessary to make the distinction? */
1914	if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
1915	{
1916	uPort = pCtx->edx & 0xffff;
1917	}
1918	else
1919	uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
1920
1921	/* paranoia */
1922	if (RT_UNLIKELY(uIOWidth == 2 \|\| uIOWidth >= 4))
1923	{
1924	rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
1925	break;
1926	}
1927
1928	uint32_t cbSize = aIOSize[uIOWidth];
1929
1930	if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
1931	{
1932	/* ins/outs */
1933	uint32_t prefix = 0;
1934	if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
1935	prefix \|= PREFIX_REP;
1936
1937	if (fIOWrite)
1938	{
1939	Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
1940	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
1941	rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
1942	}
1943	else
1944	{
1945	Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
1946	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
1947	rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
1948	}
1949	}
1950	else
1951	{
1952	/* normal in/out */
1953	uint32_t uAndVal = aIOOpAnd[uIOWidth];
1954
1955	Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
1956
1957	if (fIOWrite)
1958	{
1959	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
1960	rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
1961	}
1962	else
1963	{
1964	uint32_t u32Val = 0;
1965
1966	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
1967	rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
1968	if (IOM_SUCCESS(rc))
1969	{
1970	/* Write back to the EAX register. */
1971	pCtx->eax = (pCtx->eax & ~uAndVal) \| (u32Val & uAndVal);
1972	}
1973	}
1974	}
1975	/*
1976	* Handled the I/O return codes.
1977	* (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
1978	*/
1979	if (IOM_SUCCESS(rc))
1980	{
1981	/* Update EIP and continue execution. */
1982	pCtx->rip += cbInstr;
1983	if (RT_LIKELY(rc == VINF_SUCCESS))
1984	{
1985	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1986	goto ResumeExecution;
1987	}
1988	break;
1989	}
1990
1991	#ifdef VBOX_STRICT
1992	if (rc == VINF_IOM_HC_IOPORT_READ)
1993	Assert(!fIOWrite);
1994	else if (rc == VINF_IOM_HC_IOPORT_WRITE)
1995	Assert(fIOWrite);
1996	else
1997	AssertMsg(VBOX_FAILURE(rc) \|\| rc == VINF_EM_RAW_EMULATE_INSTR \|\| rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
1998	#endif
1999	break;
2000	}
2001
2002	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2003	LogFlow(("VMX_EXIT_TPR\n"));
2004	/* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2005	goto ResumeExecution;
2006
2007	default:
2008	/* The rest is handled after syncing the entire CPU state. */
2009	break;
2010	}
2011
2012	/* Note: the guest state isn't entirely synced back at this stage. */
2013
2014	/* Investigate why there was a VM-exit. (part 2) */
2015	switch (exitReason)
2016	{
2017	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2018	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2019	/* Already handled above. */
2020	break;
2021
2022	case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2023	rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2024	break;
2025
2026	case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2027	case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2028	rc = VINF_EM_RAW_INTERRUPT;
2029	AssertFailed(); /* Can't happen. Yet. */
2030	break;
2031
2032	case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2033	case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2034	rc = VINF_EM_RAW_INTERRUPT;
2035	AssertFailed(); /* Can't happen afaik. */
2036	break;
2037
2038	case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2039	rc = VERR_EM_INTERPRETER;
2040	break;
2041
2042	case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2043	/** Check if external interrupts are pending; if so, don't switch back. */
2044	pCtx->rip++; /* skip hlt */
2045	if ( pCtx->eflags.Bits.u1IF
2046	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
2047	goto ResumeExecution;
2048
2049	rc = VINF_EM_HALT;
2050	break;
2051
2052	case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2053	AssertFailed(); /* can't happen. */
2054	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2055	break;
2056
2057	case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2058	case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2059	case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2060	case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2061	case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2062	case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2063	case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2064	case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2065	case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2066	case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2067	/** @todo inject #UD immediately */
2068	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2069	break;
2070
2071	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2072	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2073	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2074	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2075	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2076	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2077	/* already handled above */
2078	AssertMsg( rc == VINF_PGM_CHANGE_MODE
2079	\|\| rc == VINF_EM_RAW_INTERRUPT
2080	\|\| rc == VERR_EM_INTERPRETER
2081	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
2082	\|\| rc == VINF_PGM_SYNC_CR3
2083	\|\| rc == VINF_IOM_HC_IOPORT_READ
2084	\|\| rc == VINF_IOM_HC_IOPORT_WRITE
2085	\|\| rc == VINF_EM_RAW_GUEST_TRAP
2086	\|\| rc == VINF_TRPM_XCPT_DISPATCHED
2087	\|\| rc == VINF_EM_RESCHEDULE_REM,
2088	("rc = %d\n", rc));
2089	break;
2090
2091	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2092	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2093	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2094	/* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2095	rc = VERR_EM_INTERPRETER;
2096	break;
2097
2098	case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2099	case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2100	case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2101	case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2102	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2103	break;
2104
2105	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2106	Assert(rc == VINF_EM_RAW_INTERRUPT);
2107	break;
2108
2109	case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2110	{
2111	#ifdef VBOX_STRICT
2112	Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2113
2114	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2115	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
2116
2117	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2118	Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2119
2120	VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2121	Log(("VMX_VMCS_HOST_CR3 %VGp\n", val));
2122
2123	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2124	Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2125
2126	VMX_LOG_SELREG(CS, "CS");
2127	VMX_LOG_SELREG(DS, "DS");
2128	VMX_LOG_SELREG(ES, "ES");
2129	VMX_LOG_SELREG(FS, "FS");
2130	VMX_LOG_SELREG(GS, "GS");
2131	VMX_LOG_SELREG(SS, "SS");
2132	VMX_LOG_SELREG(TR, "TR");
2133	VMX_LOG_SELREG(LDTR, "LDTR");
2134
2135	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2136	Log(("VMX_VMCS_GUEST_GDTR_BASE %VGv\n", val));
2137	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2138	Log(("VMX_VMCS_GUEST_IDTR_BASE %VGv\n", val));
2139	#endif /* VBOX_STRICT */
2140	rc = VERR_EM_INTERNAL_ERROR;
2141	break;
2142	}
2143
2144	case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2145	case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2146	default:
2147	rc = VERR_EM_INTERNAL_ERROR;
2148	AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2149	break;
2150
2151	}
2152	end:
2153	if (fGuestStateSynced)
2154	{
2155	/* Remaining guest CPU context: TR, IDTR, GDTR, LDTR. */
2156	VMX_READ_SELREG(LDTR, ldtr);
2157	VMX_READ_SELREG(TR, tr);
2158
2159	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
2160	pCtx->gdtr.cbGdt = val;
2161	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2162	pCtx->gdtr.pGdt = val;
2163
2164	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
2165	pCtx->idtr.cbIdt = val;
2166	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2167	pCtx->idtr.pIdt = val;
2168
2169	/*
2170	* System MSRs
2171	*/
2172	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
2173	pCtx->SysEnter.cs = val;
2174	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
2175	pCtx->SysEnter.eip = val;
2176	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
2177	pCtx->SysEnter.esp = val;
2178	}
2179
2180	/* Signal changes for the recompiler. */
2181	CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_TR \| CPUM_CHANGED_HIDDEN_SEL_REGS);
2182
2183	/* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2184	if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2185	&& !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2186	{
2187	STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
2188	/* On the next entry we'll only sync the host context. */
2189	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_HOST_CONTEXT;
2190	}
2191	else
2192	{
2193	/* On the next entry we'll sync everything. */
2194	/** @todo we can do better than this */
2195	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_ALL;
2196	}
2197
2198	/* translate into a less severe return code */
2199	if (rc == VERR_EM_INTERPRETER)
2200	rc = VINF_EM_RAW_EMULATE_INSTR;
2201
2202	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2203	Log2(("X"));
2204	return rc;
2205	}
2206
2207
2208	/**
2209	* Enters the VT-x session
2210	*
2211	* @returns VBox status code.
2212	* @param pVM The VM to operate on.
2213	* @param pCpu CPU info struct
2214	*/
2215	HWACCMR0DECL(int) VMXR0Enter(PVM pVM, PHWACCM_CPUINFO pCpu)
2216	{
2217	Assert(pVM->hwaccm.s.vmx.fSupported);
2218
2219	unsigned cr4 = ASMGetCR4();
2220	if (!(cr4 & X86_CR4_VMXE))
2221	{
2222	AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
2223	return VERR_VMX_X86_CR4_VMXE_CLEARED;
2224	}
2225
2226	/* Activate the VM Control Structure. */
2227	int rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2228	if (VBOX_FAILURE(rc))
2229	return rc;
2230
2231	pVM->hwaccm.s.vmx.fResumeVM = false;
2232	return VINF_SUCCESS;
2233	}
2234
2235
2236	/**
2237	* Leaves the VT-x session
2238	*
2239	* @returns VBox status code.
2240	* @param pVM The VM to operate on.
2241	*/
2242	HWACCMR0DECL(int) VMXR0Leave(PVM pVM)
2243	{
2244	Assert(pVM->hwaccm.s.vmx.fSupported);
2245
2246	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
2247	int rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2248	AssertRC(rc);
2249
2250	return VINF_SUCCESS;
2251	}
2252

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 10607

Download in other formats: