HWVMXR0.cpp@ 11706

Last change on this file since 11706 was 11706, checked in by vboxsync, 17 years ago
No need to enable VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 86.7 KB

Line
1	/* $Id: HWVMXR0.cpp 11706 2008-08-27 14:58:27Z vboxsync $ */
2	/** @file
3	* HWACCM VMX - Host Context Ring 0.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_HWACCM
27	#include <VBox/hwaccm.h>
28	#include "HWACCMInternal.h"
29	#include <VBox/vm.h>
30	#include <VBox/x86.h>
31	#include <VBox/pgm.h>
32	#include <VBox/pdm.h>
33	#include <VBox/err.h>
34	#include <VBox/log.h>
35	#include <VBox/selm.h>
36	#include <VBox/iom.h>
37	#include <iprt/param.h>
38	#include <iprt/assert.h>
39	#include <iprt/asm.h>
40	#include <iprt/string.h>
41	#include "HWVMXR0.h"
42
43
44	/* IO operation lookup arrays. */
45	static uint32_t aIOSize[4] = {1, 2, 0, 4};
46	static uint32_t aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
47
48
49	static void VMXR0CheckError(PVM pVM, int rc)
50	{
51	if (rc == VERR_VMX_GENERIC)
52	{
53	RTCCUINTREG instrError;
54
55	VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
56	pVM->hwaccm.s.vmx.ulLastInstrError = instrError;
57	}
58	pVM->hwaccm.s.lLastError = rc;
59	}
60
61	/**
62	* Sets up and activates VT-x on the current CPU
63	*
64	* @returns VBox status code.
65	* @param pCpu CPU info struct
66	* @param pVM The VM to operate on.
67	* @param pvPageCpu Pointer to the global cpu page
68	* @param pPageCpuPhys Physical address of the global cpu page
69	*/
70	HWACCMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
71	{
72	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
73	AssertReturn(pVM, VERR_INVALID_PARAMETER);
74	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
75
76	/* Setup Intel VMX. */
77	Assert(pVM->hwaccm.s.vmx.fSupported);
78
79	#ifdef LOG_ENABLED
80	SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
81	#endif
82	/* Set revision dword at the beginning of the VMXON structure. */
83	(uint32_t )pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
84
85	/* @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
86	* (which can have very bad consequences!!!)
87	*/
88
89	/* Make sure the VMX instructions don't cause #UD faults. */
90	ASMSetCR4(ASMGetCR4() \| X86_CR4_VMXE);
91
92	/* Enter VMX Root Mode */
93	int rc = VMXEnable(pPageCpuPhys);
94	if (VBOX_FAILURE(rc))
95	{
96	VMXR0CheckError(pVM, rc);
97	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
98	return VERR_VMX_VMXON_FAILED;
99	}
100	return VINF_SUCCESS;
101	}
102
103	/**
104	* Deactivates VT-x on the current CPU
105	*
106	* @returns VBox status code.
107	* @param pCpu CPU info struct
108	* @param pvPageCpu Pointer to the global cpu page
109	* @param pPageCpuPhys Physical address of the global cpu page
110	*/
111	HWACCMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
112	{
113	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
114	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
115
116	/* Leave VMX Root Mode. */
117	VMXDisable();
118
119	/* And clear the X86_CR4_VMXE bit */
120	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
121
122	#ifdef LOG_ENABLED
123	SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
124	#endif
125	return VINF_SUCCESS;
126	}
127
128	/**
129	* Does Ring-0 per VM VT-x init.
130	*
131	* @returns VBox status code.
132	* @param pVM The VM to operate on.
133	*/
134	HWACCMR0DECL(int) VMXR0InitVM(PVM pVM)
135	{
136	int rc;
137
138	#ifdef LOG_ENABLED
139	SUPR0Printf("VMXR0InitVM %x\n", pVM);
140	#endif
141	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
142	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
143	pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
144
145
146	/* Allocate one page for the VM control structure (VMCS). */
147	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
148	AssertRC(rc);
149	if (RT_FAILURE(rc))
150	return rc;
151
152	pVM->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjVMCS);
153	pVM->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjVMCS, 0);
154	ASMMemZero32(pVM->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
155
156	/* Allocate one page for the TSS we need for real mode emulation. */
157	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
158	AssertRC(rc);
159	if (RT_FAILURE(rc))
160	return rc;
161
162	pVM->hwaccm.s.vmx.pRealModeTSS = (PVBOXTSS)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjRealModeTSS);
163	pVM->hwaccm.s.vmx.pRealModeTSSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 0);
164
165	/* The I/O bitmap starts right after the virtual interrupt redirection bitmap. Outside the TSS on purpose; the CPU will not check it
166	* for I/O operations. */
167	ASMMemZero32(pVM->hwaccm.s.vmx.pRealModeTSS, PAGE_SIZE);
168	pVM->hwaccm.s.vmx.pRealModeTSS->offIoBitmap = sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS);
169	/* Bit set to 0 means redirection enabled. */
170	memset(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap, 0x0, sizeof(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap));
171
172	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
173	{
174	/* Allocate one page for the virtual APIC mmio cache. */
175	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
176	AssertRC(rc);
177	if (RT_FAILURE(rc))
178	return rc;
179
180	pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
181	pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
182	ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
183	}
184	else
185	{
186	pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
187	pVM->hwaccm.s.vmx.pAPIC = 0;
188	pVM->hwaccm.s.vmx.pAPICPhys = 0;
189	}
190
191	/* Allocate the MSR bitmap if this feature is supported. */
192	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
193	{
194	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
195	AssertRC(rc);
196	if (RT_FAILURE(rc))
197	return rc;
198
199	pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
200	pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
201	memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
202	}
203
204	#ifdef LOG_ENABLED
205	SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x) RealModeTSS=%x (%x)\n", pVM, pVM->hwaccm.s.vmx.pVMCS, (uint32_t)pVM->hwaccm.s.vmx.pVMCSPhys, pVM->hwaccm.s.vmx.pRealModeTSS, (uint32_t)pVM->hwaccm.s.vmx.pRealModeTSSPhys);
206	#endif
207	return VINF_SUCCESS;
208	}
209
210	/**
211	* Does Ring-0 per VM VT-x termination.
212	*
213	* @returns VBox status code.
214	* @param pVM The VM to operate on.
215	*/
216	HWACCMR0DECL(int) VMXR0TermVM(PVM pVM)
217	{
218	if (pVM->hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
219	{
220	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjVMCS, false);
221	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
222	pVM->hwaccm.s.vmx.pVMCS = 0;
223	pVM->hwaccm.s.vmx.pVMCSPhys = 0;
224	}
225	if (pVM->hwaccm.s.vmx.pMemObjRealModeTSS != NIL_RTR0MEMOBJ)
226	{
227	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, false);
228	pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
229	pVM->hwaccm.s.vmx.pRealModeTSS = 0;
230	pVM->hwaccm.s.vmx.pRealModeTSSPhys = 0;
231	}
232	if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
233	{
234	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
235	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
236	pVM->hwaccm.s.vmx.pAPIC = 0;
237	pVM->hwaccm.s.vmx.pAPICPhys = 0;
238	}
239	if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
240	{
241	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
242	pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
243	pVM->hwaccm.s.vmx.pMSRBitmap = 0;
244	pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
245	}
246	return VINF_SUCCESS;
247	}
248
249	/**
250	* Sets up VT-x for the specified VM
251	*
252	* @returns VBox status code.
253	* @param pVM The VM to operate on.
254	*/
255	HWACCMR0DECL(int) VMXR0SetupVM(PVM pVM)
256	{
257	int rc = VINF_SUCCESS;
258	uint32_t val;
259
260	AssertReturn(pVM, VERR_INVALID_PARAMETER);
261	Assert(pVM->hwaccm.s.vmx.pVMCS);
262
263	/* Set revision dword at the beginning of the VMCS structure. */
264	(uint32_t )pVM->hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
265
266	/* Clear VM Control Structure. */
267	Log(("pVMCSPhys = %VHp\n", pVM->hwaccm.s.vmx.pVMCSPhys));
268	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
269	if (VBOX_FAILURE(rc))
270	goto vmx_end;
271
272	/* Activate the VM Control Structure. */
273	rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
274	if (VBOX_FAILURE(rc))
275	goto vmx_end;
276
277	/* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
278	* Set required bits to one and zero according to the MSR capabilities.
279	*/
280	val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
281	/* External and non-maskable interrupts cause VM-exits. */
282	val = val \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
283	val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
284
285	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
286	AssertRC(rc);
287
288	/* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
289	* Set required bits to one and zero according to the MSR capabilities.
290	*/
291	val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
292	/* Program which event cause VM-exits and which features we want to use. */
293	val = val \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
294	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
295	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
296	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
297	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
298	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
299
300	/** @note VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
301
302	#if HC_ARCH_BITS == 64
303	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
304	{
305	/* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
306	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
307	Assert(pVM->hwaccm.s.vmx.pAPIC);
308	}
309	else
310	/* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
311	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
312	#endif
313
314	#ifdef VBOX_WITH_VTX_MSR_BITMAPS
315	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
316	{
317	Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
318	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
319	}
320	#endif
321
322	/* Mask away the bits that the CPU doesn't support */
323	/** @todo make sure they don't conflict with the above requirements. */
324	val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
325	pVM->hwaccm.s.vmx.proc_ctls = val;
326
327	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
328	AssertRC(rc);
329
330	/* VMX_VMCS_CTRL_CR3_TARGET_COUNT
331	* Set required bits to one and zero according to the MSR capabilities.
332	*/
333	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
334	AssertRC(rc);
335
336	/* VMX_VMCS_CTRL_EXIT_CONTROLS
337	* Set required bits to one and zero according to the MSR capabilities.
338	*/
339	val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
340	#if HC_ARCH_BITS == 64
341	val \|= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
342	#else
343	/* else Must be zero when AMD64 is not available. */
344	#endif
345	val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
346	/* Don't acknowledge external interrupts on VM-exit. */
347	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
348	AssertRC(rc);
349
350	/* Forward all exception except #NM & #PF to the guest.
351	* We always need to check pagefaults since our shadow page table can be out of sync.
352	* And we always lazily sync the FPU & XMM state.
353	*/
354
355	/*
356	* @todo Possible optimization:
357	* Keep the FPU and XMM state current in the EM thread. That way there's no need to
358	* lazily sync anything, but the downside is that we can't use the FPU stack or XMM
359	* registers ourselves of course.
360	*
361	* @note only possible if the current state is actually ours (X86_CR0_TS flag)
362	*/
363	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, HWACCM_VMX_TRAP_MASK);
364	AssertRC(rc);
365
366	/* Don't filter page faults; all of them should cause a switch. */
367	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
368	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
369	AssertRC(rc);
370
371	/* Init TSC offset to zero. */
372	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
373	#if HC_ARCH_BITS == 32
374	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
375	#endif
376	AssertRC(rc);
377
378	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
379	#if HC_ARCH_BITS == 32
380	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
381	#endif
382	AssertRC(rc);
383
384	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
385	#if HC_ARCH_BITS == 32
386	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
387	#endif
388	AssertRC(rc);
389
390	/* Set the MSR bitmap address. */
391	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
392	{
393	/* Optional */
394	rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
395	#if HC_ARCH_BITS == 32
396	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, pVM->hwaccm.s.vmx.pMSRBitmapPhys >> 32);
397	#endif
398	AssertRC(rc);
399	}
400
401	/* Clear MSR controls. */
402	rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
403	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
404	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
405	#if HC_ARCH_BITS == 32
406	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
407	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
408	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
409	#endif
410	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
411	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
412	AssertRC(rc);
413
414	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
415	{
416	Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
417	/* Optional */
418	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
419	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
420	#if HC_ARCH_BITS == 32
421	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32);
422	#endif
423	AssertRC(rc);
424	}
425
426	/* Set link pointer to -1. Not currently used. */
427	#if HC_ARCH_BITS == 32
428	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
429	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
430	#else
431	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
432	#endif
433	AssertRC(rc);
434
435	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
436	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
437	AssertRC(rc);
438
439	vmx_end:
440	VMXR0CheckError(pVM, rc);
441	return rc;
442	}
443
444
445	/**
446	* Injects an event (trap or external interrupt)
447	*
448	* @returns VBox status code.
449	* @param pVM The VM to operate on.
450	* @param pCtx CPU Context
451	* @param intInfo VMX interrupt info
452	* @param cbInstr Opcode length of faulting instruction
453	* @param errCode Error code (optional)
454	*/
455	static int VMXR0InjectEvent(PVM pVM, CPUMCTX *pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
456	{
457	int rc;
458
459	#ifdef VBOX_STRICT
460	uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
461	if (iGate == 0xE)
462	Log2(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, pCtx->rip, errCode, pCtx->cr2, intInfo));
463	else
464	if (iGate < 0x20)
465	Log2(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x\n", iGate, pCtx->rip, errCode));
466	else
467	{
468	Log2(("INJ-EI: %x at %VGv\n", iGate, pCtx->rip));
469	Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
470	Assert(pCtx->eflags.u32 & X86_EFL_IF);
471	}
472	#endif
473
474	/* Set event injection state. */
475	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO,
476	intInfo \| (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT)
477	);
478
479	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
480	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
481
482	AssertRC(rc);
483	return rc;
484	}
485
486
487	/**
488	* Checks for pending guest interrupts and injects them
489	*
490	* @returns VBox status code.
491	* @param pVM The VM to operate on.
492	* @param pCtx CPU Context
493	*/
494	static int VMXR0CheckPendingInterrupt(PVM pVM, CPUMCTX *pCtx)
495	{
496	int rc;
497
498	/* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
499	if (pVM->hwaccm.s.Event.fPending)
500	{
501	Log(("Reinjecting event %VX64 %08x at %VGv cr2=%RX64\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->rip, pCtx->cr2));
502	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
503	rc = VMXR0InjectEvent(pVM, pCtx, pVM->hwaccm.s.Event.intInfo, 0, pVM->hwaccm.s.Event.errCode);
504	AssertRC(rc);
505
506	pVM->hwaccm.s.Event.fPending = false;
507	return VINF_SUCCESS;
508	}
509
510	/* When external interrupts are pending, we should exit the VM when IF is set. */
511	if ( !TRPMHasTrap(pVM)
512	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
513	{
514	if (!(pCtx->eflags.u32 & X86_EFL_IF))
515	{
516	Log2(("Enable irq window exit!\n"));
517	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
518	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
519	AssertRC(rc);
520	}
521	else
522	if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
523	{
524	uint8_t u8Interrupt;
525
526	rc = PDMGetInterrupt(pVM, &u8Interrupt);
527	Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc cs:eip=%04X:%VGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, pCtx->rip));
528	if (VBOX_SUCCESS(rc))
529	{
530	rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
531	AssertRC(rc);
532	}
533	else
534	{
535	/* Can only happen in rare cases where a pending interrupt is cleared behind our back */
536	Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)));
537	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
538	/* Just continue */
539	}
540	}
541	else
542	Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS!!\n", pCtx->rip));
543	}
544
545	#ifdef VBOX_STRICT
546	if (TRPMHasTrap(pVM))
547	{
548	uint8_t u8Vector;
549	rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
550	AssertRC(rc);
551	}
552	#endif
553
554	if ( pCtx->eflags.u32 & X86_EFL_IF
555	&& (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
556	&& TRPMHasTrap(pVM)
557	)
558	{
559	uint8_t u8Vector;
560	int rc;
561	TRPMEVENT enmType;
562	RTGCUINTPTR intInfo;
563	RTGCUINT errCode;
564
565	/* If a new event is pending, then dispatch it now. */
566	rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
567	AssertRC(rc);
568	Assert(pCtx->eflags.Bits.u1IF == 1 \|\| enmType == TRPM_TRAP);
569	Assert(enmType != TRPM_SOFTWARE_INT);
570
571	/* Clear the pending trap. */
572	rc = TRPMResetTrap(pVM);
573	AssertRC(rc);
574
575	intInfo = u8Vector;
576	intInfo \|= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
577
578	if (enmType == TRPM_TRAP)
579	{
580	switch (u8Vector) {
581	case 8:
582	case 10:
583	case 11:
584	case 12:
585	case 13:
586	case 14:
587	case 17:
588	/* Valid error codes. */
589	intInfo \|= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
590	break;
591	default:
592	break;
593	}
594	if (u8Vector == X86_XCPT_BP \|\| u8Vector == X86_XCPT_OF)
595	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
596	else
597	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
598	}
599	else
600	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
601
602	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
603	rc = VMXR0InjectEvent(pVM, pCtx, intInfo, 0, errCode);
604	AssertRC(rc);
605	} /* if (interrupts can be dispatched) */
606
607	return VINF_SUCCESS;
608	}
609
610	/**
611	* Save the host state
612	*
613	* @returns VBox status code.
614	* @param pVM The VM to operate on.
615	*/
616	HWACCMR0DECL(int) VMXR0SaveHostState(PVM pVM)
617	{
618	int rc = VINF_SUCCESS;
619
620	/*
621	* Host CPU Context
622	*/
623	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
624	{
625	RTIDTR idtr;
626	RTGDTR gdtr;
627	RTSEL SelTR;
628	PX86DESCHC pDesc;
629	uintptr_t trBase;
630
631	/* Control registers */
632	rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
633	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
634	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
635	AssertRC(rc);
636	Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
637	Log2(("VMX_VMCS_HOST_CR3 %VHp\n", ASMGetCR3()));
638	Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
639
640	/* Selector registers. */
641	rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
642	/** @note VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
643	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
644	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
645	#if HC_ARCH_BITS == 32
646	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
647	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
648	#endif
649	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
650	SelTR = ASMGetTR();
651	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
652	AssertRC(rc);
653	Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
654	Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
655	Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
656	Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
657	Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
658	Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
659	Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
660
661	/* GDTR & IDTR */
662	ASMGetGDTR(&gdtr);
663	rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
664	ASMGetIDTR(&idtr);
665	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
666	AssertRC(rc);
667	Log2(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", gdtr.pGdt));
668	Log2(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", idtr.pIdt));
669
670	/* Save the base address of the TR selector. */
671	if (SelTR > gdtr.cbGdt)
672	{
673	AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
674	return VERR_VMX_INVALID_HOST_STATE;
675	}
676
677	pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
678	#if HC_ARCH_BITS == 64
679	trBase = X86DESC64_BASE(*pDesc);
680	#else
681	trBase = X86DESC_BASE(*pDesc);
682	#endif
683	rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
684	AssertRC(rc);
685	Log2(("VMX_VMCS_HOST_TR_BASE %VHv\n", trBase));
686
687	/* FS and GS base. */
688	#if HC_ARCH_BITS == 64
689	Log2(("MSR_K8_FS_BASE = %VHv\n", ASMRdMsr(MSR_K8_FS_BASE)));
690	Log2(("MSR_K8_GS_BASE = %VHv\n", ASMRdMsr(MSR_K8_GS_BASE)));
691	rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
692	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
693	#endif
694	AssertRC(rc);
695
696	/* Sysenter MSRs. */
697	/** @todo expensive!! */
698	rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
699	Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
700	#if HC_ARCH_BITS == 32
701	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
702	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
703	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
704	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
705	#else
706	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
707	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
708	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
709	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
710	#endif
711	AssertRC(rc);
712
713	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
714	}
715	return rc;
716	}
717
718
719	/**
720	* Loads the guest state
721	*
722	* NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
723	*
724	* @returns VBox status code.
725	* @param pVM The VM to operate on.
726	* @param pCtx Guest context
727	*/
728	HWACCMR0DECL(int) VMXR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
729	{
730	int rc = VINF_SUCCESS;
731	RTGCUINTPTR val;
732	X86EFLAGS eflags;
733
734	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
735	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
736	{
737	VMX_WRITE_SELREG(ES, es);
738	AssertRC(rc);
739
740	VMX_WRITE_SELREG(CS, cs);
741	AssertRC(rc);
742
743	VMX_WRITE_SELREG(SS, ss);
744	AssertRC(rc);
745
746	VMX_WRITE_SELREG(DS, ds);
747	AssertRC(rc);
748
749	/* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
750	VMX_WRITE_SELREG(FS, fs);
751	AssertRC(rc);
752
753	VMX_WRITE_SELREG(GS, gs);
754	AssertRC(rc);
755	}
756
757	/* Guest CPU context: LDTR. */
758	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
759	{
760	if (pCtx->ldtr == 0)
761	{
762	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
763	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
764	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
765	/** @note vmlaunch will fail with 0 or just 0x02. No idea why. */
766	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
767	}
768	else
769	{
770	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
771	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
772	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
773	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
774	}
775	AssertRC(rc);
776	}
777	/* Guest CPU context: TR. */
778	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
779	{
780	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
781
782	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
783	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
784	{
785	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS));
786	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, 0);
787	}
788	else
789	{
790	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
791	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
792	}
793	val = pCtx->trHid.Attr.u;
794
795	/* The TSS selector must be busy. */
796	if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
797	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_286_TSS_BUSY;
798	else
799	/* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
800	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_386_TSS_BUSY;
801
802	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
803	AssertRC(rc);
804	}
805	/* Guest CPU context: GDTR. */
806	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
807	{
808	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
809	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
810	AssertRC(rc);
811	}
812	/* Guest CPU context: IDTR. */
813	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
814	{
815	rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
816	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
817	AssertRC(rc);
818	}
819
820	/*
821	* Sysenter MSRs (unconditional)
822	*/
823	rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
824	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
825	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
826	AssertRC(rc);
827
828	/* Control registers */
829	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
830	{
831	val = pCtx->cr0;
832	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
833	Log2(("Guest CR0-shadow %08x\n", val));
834	if (CPUMIsGuestFPUStateActive(pVM) == false)
835	{
836	/* Always use #NM exceptions to load the FPU/XMM state on demand. */
837	val \|= X86_CR0_TS \| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_MP;
838	}
839	else
840	{
841	/** @todo check if we support the old style mess correctly. */
842	if (!(val & X86_CR0_NE))
843	{
844	Log(("Forcing X86_CR0_NE!!!\n"));
845
846	/* Also catch floating point exceptions as we need to report them to the guest in a different way. */
847	if (!pVM->hwaccm.s.fFPUOldStyleOverride)
848	{
849	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, HWACCM_VMX_TRAP_MASK \| RT_BIT(X86_XCPT_MF));
850	AssertRC(rc);
851	pVM->hwaccm.s.fFPUOldStyleOverride = true;
852	}
853	}
854
855	val \|= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
856	}
857	/* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
858	val \|= X86_CR0_PE \| X86_CR0_PG;
859	/* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
860	val \|= X86_CR0_WP;
861
862	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
863	Log2(("Guest CR0 %08x\n", val));
864	/* CR0 flags owned by the host; if the guests attempts to change them, then
865	* the VM will exit.
866	*/
867	val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
868	\| X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
869	\| X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
870	\| X86_CR0_TS
871	\| X86_CR0_ET
872	\| X86_CR0_NE
873	\| X86_CR0_MP;
874	pVM->hwaccm.s.vmx.cr0_mask = val;
875
876	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
877	Log2(("Guest CR0-mask %08x\n", val));
878	AssertRC(rc);
879	}
880	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
881	{
882	/* CR4 */
883	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
884	Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
885	/* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
886	val = pCtx->cr4 \| (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
887	switch(pVM->hwaccm.s.enmShadowMode)
888	{
889	case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
890	case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
891	case PGMMODE_32_BIT: /* 32-bit paging. */
892	break;
893
894	case PGMMODE_PAE: /* PAE paging. */
895	case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
896	/** @todo use normal 32 bits paging */
897	val \|= X86_CR4_PAE;
898	break;
899
900	case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
901	case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
902	#ifdef VBOX_ENABLE_64_BITS_GUESTS
903	break;
904	#else
905	AssertFailed();
906	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
907	#endif
908	default: /* shut up gcc */
909	AssertFailed();
910	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
911	}
912	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
913	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
914	val \|= X86_CR4_VME;
915
916	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
917	Log2(("Guest CR4 %08x\n", val));
918	/* CR4 flags owned by the host; if the guests attempts to change them, then
919	* the VM will exit.
920	*/
921	val = X86_CR4_PAE
922	\| X86_CR4_PGE
923	\| X86_CR4_PSE
924	\| X86_CR4_VMXE;
925	pVM->hwaccm.s.vmx.cr4_mask = val;
926
927	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
928	Log2(("Guest CR4-mask %08x\n", val));
929	AssertRC(rc);
930	}
931
932	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
933	{
934	/* Save our shadow CR3 register. */
935	val = PGMGetHyperCR3(pVM);
936	Assert(val);
937	rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
938	AssertRC(rc);
939	}
940
941	/* Debug registers. */
942	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
943	{
944	val = pCtx->dr7 & 0xffffffff; /* upper 32 bits reserved */
945	val &= ~(RT_BIT(11) \| RT_BIT(12) \| RT_BIT(14) \| RT_BIT(15)); /* must be zero */
946	val \|= 0x400; /* must be one */
947	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DR7, val);
948	AssertRC(rc);
949
950	/* IA32_DEBUGCTL MSR. */
951	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
952	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
953	AssertRC(rc);
954
955	/** @todo do we really ever need this? */
956	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
957	AssertRC(rc);
958	}
959
960	/* EIP, ESP and EFLAGS */
961	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
962	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
963	AssertRC(rc);
964
965	/* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
966	eflags = pCtx->eflags;
967	eflags.u32 &= VMX_EFLAGS_RESERVED_0;
968	eflags.u32 \|= VMX_EFLAGS_RESERVED_1;
969
970	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
971	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
972	{
973	eflags.Bits.u1VM = 1;
974	eflags.Bits.u1VIF = pCtx->eflags.Bits.u1IF;
975	eflags.Bits.u2IOPL = 3;
976	}
977
978	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
979	AssertRC(rc);
980
981	/** TSC offset. */
982	uint64_t u64TSCOffset;
983
984	if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
985	{
986	/* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
987	#if HC_ARCH_BITS == 64
988	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
989	#else
990	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, (uint32_t)u64TSCOffset);
991	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
992	#endif
993	AssertRC(rc);
994
995	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
996	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
997	AssertRC(rc);
998	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCOffset);
999	}
1000	else
1001	{
1002	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1003	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1004	AssertRC(rc);
1005	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCIntercept);
1006	}
1007
1008	/* VMX_VMCS_CTRL_ENTRY_CONTROLS
1009	* Set required bits to one and zero according to the MSR capabilities.
1010	*/
1011	val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1012	/* 64 bits guest mode? */
1013	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1014	val \|= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1015	/* else Must be zero when AMD64 is not available. */
1016
1017	/* Mask away the bits that the CPU doesn't support */
1018	val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1019	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1020	AssertRC(rc);
1021
1022	/* 64 bits guest mode? */
1023	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1024	{
1025	#if !defined(VBOX_WITH_64_BITS_GUESTS) \|\| HC_ARCH_BITS != 64
1026	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1027	#else
1028	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1029	#endif
1030	/* Unconditionally update these as wrmsr might have changed them. */
1031	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1032	AssertRC(rc);
1033	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1034	AssertRC(rc);
1035	}
1036	else
1037	{
1038	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1039	}
1040
1041	/* Done. */
1042	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1043
1044	return rc;
1045	}
1046
1047	/**
1048	* Runs guest code in a VT-x VM.
1049	*
1050	* @returns VBox status code.
1051	* @param pVM The VM to operate on.
1052	* @param pCtx Guest context
1053	*/
1054	HWACCMR0DECL(int) VMXR0RunGuestCode(PVM pVM, CPUMCTX *pCtx)
1055	{
1056	int rc = VINF_SUCCESS;
1057	RTCCUINTREG val, valShadow;
1058	RTCCUINTREG exitReason, instrError, cbInstr;
1059	RTGCUINTPTR exitQualification;
1060	RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1061	RTGCUINTPTR errCode, instrInfo, uInterruptState;
1062	bool fGuestStateSynced = false;
1063	bool fSyncTPR = false;
1064	unsigned cResume = 0;
1065	#ifdef VBOX_STRICT
1066	RTCPUID idCpuCheck;
1067	#endif
1068
1069	Log2(("\nE"));
1070
1071	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
1072
1073	#ifdef VBOX_STRICT
1074	rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1075	AssertRC(rc);
1076	Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1077
1078	/* allowed zero */
1079	if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1080	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1081
1082	/* allowed one */
1083	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1084	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1085
1086	rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1087	AssertRC(rc);
1088	Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1089
1090	/* allowed zero */
1091	if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1092	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1093
1094	/* allowed one */
1095	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1096	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1097
1098	rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1099	AssertRC(rc);
1100	Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1101
1102	/* allowed zero */
1103	if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1104	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1105
1106	/* allowed one */
1107	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1108	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1109
1110	rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1111	AssertRC(rc);
1112	Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1113
1114	/* allowed zero */
1115	if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1116	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1117
1118	/* allowed one */
1119	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1120	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1121	#endif
1122
1123	#if 0
1124	/*
1125	* Check if debug registers are armed.
1126	*/
1127	uint32_t u32DR7 = ASMGetDR7();
1128	if (u32DR7 & X86_DR7_ENABLED_MASK)
1129	{
1130	pVM->cpum.s.fUseFlags \|= CPUM_USE_DEBUG_REGS_HOST;
1131	}
1132	else
1133	pVM->cpum.s.fUseFlags &= ~CPUM_USE_DEBUG_REGS_HOST;
1134	#endif
1135
1136	/* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1137	*/
1138	ResumeExecution:
1139	/* Safety precaution; looping for too long here can have a very bad effect on the host */
1140	if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1141	{
1142	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
1143	rc = VINF_EM_RAW_INTERRUPT;
1144	goto end;
1145	}
1146
1147	/* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1148	if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1149	{
1150	Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1151	if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1152	{
1153	/** @note we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1154	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1155	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1156	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1157	*/
1158	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1159	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1160	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1161	AssertRC(rc);
1162	}
1163	}
1164	else
1165	{
1166	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1167	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1168	AssertRC(rc);
1169	}
1170
1171	/* Check for pending actions that force us to go back to ring 3. */
1172	if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 \| VM_FF_TIMER))
1173	{
1174	VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1175	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
1176	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1177	rc = VINF_EM_RAW_TO_R3;
1178	goto end;
1179	}
1180	/* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1181	if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1182	{
1183	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1184	rc = VINF_EM_PENDING_REQUEST;
1185	goto end;
1186	}
1187
1188	/* When external interrupts are pending, we should exit the VM when IF is set. */
1189	/** @note after VM_FF_INHIBIT_INTERRUPTS check!!! */
1190	rc = VMXR0CheckPendingInterrupt(pVM, pCtx);
1191	if (VBOX_FAILURE(rc))
1192	{
1193	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1194	goto end;
1195	}
1196
1197	/** @todo check timers?? */
1198
1199	/* TPR caching using CR8 is only available in 64 bits mode */
1200	/* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1201	/* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1202	/*
1203	* @todo reduce overhead
1204	*/
1205	if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1206	&& pVM->hwaccm.s.vmx.pAPIC)
1207	{
1208	/* TPR caching in CR8 */
1209	uint8_t u8TPR;
1210	bool fPending;
1211
1212	int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1213	AssertRC(rc);
1214	/* The TPR can be found at offset 0x80 in the APIC mmio page. */
1215	pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1216
1217	/* Two options here:
1218	* - external interrupt pending, but masked by the TPR value.
1219	* -> a CR8 update that lower the current TPR value should cause an exit
1220	* - no pending interrupts
1221	* -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1222	*/
1223	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1224	AssertRC(rc);
1225
1226	/* Always sync back the TPR; we should optimize this though (@todo) */
1227	fSyncTPR = true;
1228	}
1229
1230	/*
1231	* NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1232	* (until the actual world switch)
1233	*/
1234	#ifdef VBOX_STRICT
1235	idCpuCheck = RTMpCpuId();
1236	#endif
1237	/* Save the host state first. */
1238	rc = VMXR0SaveHostState(pVM);
1239	if (rc != VINF_SUCCESS)
1240	{
1241	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1242	goto end;
1243	}
1244	/* Load the guest state */
1245	rc = VMXR0LoadGuestState(pVM, pCtx);
1246	if (rc != VINF_SUCCESS)
1247	{
1248	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1249	goto end;
1250	}
1251	fGuestStateSynced = true;
1252
1253	/* Non-register state Guest Context */
1254	/** @todo change me according to cpu state */
1255	rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1256	AssertRC(rc);
1257
1258	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1259
1260	/* Manual save and restore:
1261	* - General purpose registers except RIP, RSP
1262	*
1263	* Trashed:
1264	* - CR2 (we don't care)
1265	* - LDTR (reset to 0)
1266	* - DRx (presumably not changed at all)
1267	* - DR7 (reset to 0x400)
1268	* - EFLAGS (reset to RT_BIT(1); not relevant)
1269	*
1270	*/
1271
1272	/* All done! Let's start VM execution. */
1273	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
1274	#ifdef VBOX_STRICT
1275	Assert(idCpuCheck == RTMpCpuId());
1276	#endif
1277	rc = pVM->hwaccm.s.vmx.pfnStartVM(pVM->hwaccm.s.vmx.fResumeVM, pCtx);
1278
1279	/* In case we execute a goto ResumeExecution later on. */
1280	pVM->hwaccm.s.vmx.fResumeVM = true;
1281
1282	/**
1283	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1284	* IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 BEFORE WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1285	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1286	*/
1287
1288	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
1289	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
1290
1291	switch (rc)
1292	{
1293	case VINF_SUCCESS:
1294	break;
1295
1296	case VERR_VMX_INVALID_VMXON_PTR:
1297	AssertFailed();
1298	goto end;
1299
1300	case VERR_VMX_UNABLE_TO_START_VM:
1301	case VERR_VMX_UNABLE_TO_RESUME_VM:
1302	{
1303	#ifdef VBOX_STRICT
1304	int rc1;
1305
1306	rc1 = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1307	rc1 \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1308	AssertRC(rc1);
1309	if (rc1 == VINF_SUCCESS)
1310	{
1311	RTGDTR gdtr;
1312	PX86DESCHC pDesc;
1313
1314	ASMGetGDTR(&gdtr);
1315
1316	Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
1317	Log(("Current stack %08x\n", &rc1));
1318
1319
1320	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1321	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
1322	VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1323	Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
1324	VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1325	Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
1326	VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1327	Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
1328	VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1329	Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
1330
1331	VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
1332	Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
1333
1334	VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
1335	Log(("VMX_VMCS_HOST_CR3 %VHp\n", val));
1336
1337	VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
1338	Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
1339
1340	VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
1341	Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
1342	if (val < gdtr.cbGdt)
1343	{
1344	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1345	HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
1346	}
1347
1348	VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
1349	Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
1350	if (val < gdtr.cbGdt)
1351	{
1352	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1353	HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
1354	}
1355
1356	VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
1357	Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
1358	if (val < gdtr.cbGdt)
1359	{
1360	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1361	HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
1362	}
1363
1364	VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
1365	Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
1366	if (val < gdtr.cbGdt)
1367	{
1368	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1369	HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
1370	}
1371
1372	VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
1373	Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
1374	if (val < gdtr.cbGdt)
1375	{
1376	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1377	HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
1378	}
1379
1380	VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
1381	Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
1382	if (val < gdtr.cbGdt)
1383	{
1384	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1385	HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
1386	}
1387
1388	VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
1389	Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
1390	if (val < gdtr.cbGdt)
1391	{
1392	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1393	HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
1394	}
1395
1396	VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
1397	Log(("VMX_VMCS_HOST_TR_BASE %VHv\n", val));
1398
1399	VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
1400	Log(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", val));
1401	VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
1402	Log(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", val));
1403
1404	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
1405	Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
1406
1407	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
1408	Log(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", val));
1409
1410	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
1411	Log(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", val));
1412
1413	VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
1414	Log(("VMX_VMCS_HOST_RSP %VHv\n", val));
1415	VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
1416	Log(("VMX_VMCS_HOST_RIP %VHv\n", val));
1417
1418	#if HC_ARCH_BITS == 64
1419	Log(("MSR_K6_EFER = %VX64\n", ASMRdMsr(MSR_K6_EFER)));
1420	Log(("MSR_K6_STAR = %VX64\n", ASMRdMsr(MSR_K6_STAR)));
1421	Log(("MSR_K8_LSTAR = %VX64\n", ASMRdMsr(MSR_K8_LSTAR)));
1422	Log(("MSR_K8_CSTAR = %VX64\n", ASMRdMsr(MSR_K8_CSTAR)));
1423	Log(("MSR_K8_SF_MASK = %VX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
1424	#endif
1425	}
1426	#endif /* VBOX_STRICT */
1427	goto end;
1428	}
1429
1430	default:
1431	/* impossible */
1432	AssertFailed();
1433	goto end;
1434	}
1435	/* Success. Query the guest state and figure out what has happened. */
1436
1437	/* Investigate why there was a VM-exit. */
1438	rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1439	STAM_COUNTER_INC(&pVM->hwaccm.s.pStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1440
1441	exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1442	rc \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1443	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
1444	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
1445	intInfo = val;
1446	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1447	errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1448	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
1449	instrInfo = val;
1450	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1451	exitQualification = val;
1452	AssertRC(rc);
1453
1454	/* Let's first sync back eip, esp, and eflags. */
1455	rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1456	AssertRC(rc);
1457	pCtx->rip = val;
1458	rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1459	AssertRC(rc);
1460	pCtx->rsp = val;
1461	rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1462	AssertRC(rc);
1463	pCtx->eflags.u32 = val;
1464
1465	/* Take care of instruction fusing (sti, mov ss) */
1466	rc \|= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1467	uInterruptState = val;
1468	if (uInterruptState != 0)
1469	{
1470	Assert(uInterruptState <= 2); /* only sti & mov ss */
1471	Log(("uInterruptState %x eip=%VGv\n", uInterruptState, pCtx->rip));
1472	EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1473	}
1474	else
1475	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1476
1477	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1478	if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
1479	{
1480	/* Hide our emulation flags */
1481	pCtx->eflags.Bits.u1VM = 0;
1482	pCtx->eflags.Bits.u1IF = pCtx->eflags.Bits.u1VIF;
1483	pCtx->eflags.Bits.u1VIF = 0;
1484	pCtx->eflags.Bits.u2IOPL = 0;
1485	}
1486
1487	/* Control registers. */
1488	VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1489	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1490	val = (valShadow & pVM->hwaccm.s.vmx.cr0_mask) \| (val & ~pVM->hwaccm.s.vmx.cr0_mask);
1491	CPUMSetGuestCR0(pVM, val);
1492
1493	VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1494	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1495	val = (valShadow & pVM->hwaccm.s.vmx.cr4_mask) \| (val & ~pVM->hwaccm.s.vmx.cr4_mask);
1496	CPUMSetGuestCR4(pVM, val);
1497
1498	CPUMSetGuestCR2(pVM, ASMGetCR2());
1499
1500	VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1501	CPUMSetGuestDR7(pVM, val);
1502
1503	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1504	VMX_READ_SELREG(ES, es);
1505	VMX_READ_SELREG(SS, ss);
1506	VMX_READ_SELREG(CS, cs);
1507	VMX_READ_SELREG(DS, ds);
1508	VMX_READ_SELREG(FS, fs);
1509	VMX_READ_SELREG(GS, gs);
1510
1511	/*
1512	* System MSRs
1513	*/
1514	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
1515	pCtx->SysEnter.cs = val;
1516	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1517	pCtx->SysEnter.eip = val;
1518	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1519	pCtx->SysEnter.esp = val;
1520
1521	/** @note NOW IT'S SAFE FOR LOGGING! */
1522	Log2(("Raw exit reason %08x\n", exitReason));
1523
1524	/* Check if an injected event was interrupted prematurely. */
1525	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
1526	AssertRC(rc);
1527	pVM->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
1528	if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVM->hwaccm.s.Event.intInfo)
1529	&& VMX_EXIT_INTERRUPTION_INFO_TYPE(pVM->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW)
1530	{
1531	pVM->hwaccm.s.Event.fPending = true;
1532	/* Error code present? */
1533	if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVM->hwaccm.s.Event.intInfo))
1534	{
1535	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
1536	AssertRC(rc);
1537	pVM->hwaccm.s.Event.errCode = val;
1538	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification, val));
1539	}
1540	else
1541	{
1542	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification));
1543	pVM->hwaccm.s.Event.errCode = 0;
1544	}
1545	}
1546
1547	#ifdef VBOX_STRICT
1548	if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
1549	HWACCMDumpRegs(pVM, pCtx);
1550	#endif
1551
1552	Log2(("E%d", exitReason));
1553	Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
1554	Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
1555	Log2(("Interruption error code %d\n", errCode));
1556	Log2(("IntInfo = %08x\n", intInfo));
1557	Log2(("New EIP=%VGv\n", pCtx->rip));
1558
1559	if (fSyncTPR)
1560	{
1561	rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
1562	AssertRC(rc);
1563	}
1564
1565	/* Some cases don't need a complete resync of the guest CPU state; handle them here. */
1566	switch (exitReason)
1567	{
1568	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
1569	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
1570	{
1571	uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
1572
1573	if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
1574	{
1575	Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
1576	/* External interrupt; leave to allow it to be dispatched again. */
1577	rc = VINF_EM_RAW_INTERRUPT;
1578	break;
1579	}
1580	switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
1581	{
1582	case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
1583	/* External interrupt; leave to allow it to be dispatched again. */
1584	rc = VINF_EM_RAW_INTERRUPT;
1585	break;
1586
1587	case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
1588	AssertFailed(); /* can't come here; fails the first check. */
1589	break;
1590
1591	case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
1592	Assert(vector == 3 \|\| vector == 4);
1593	/* no break */
1594	case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
1595	Log2(("Hardware/software interrupt %d\n", vector));
1596	switch (vector)
1597	{
1598	case X86_XCPT_NM:
1599	{
1600	Log(("#NM fault at %VGv error code %x\n", pCtx->rip, errCode));
1601
1602	/** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1603	/* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1604	rc = CPUMR0LoadGuestFPU(pVM, pCtx);
1605	if (rc == VINF_SUCCESS)
1606	{
1607	Assert(CPUMIsGuestFPUStateActive(pVM));
1608
1609	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1610
1611	/* Continue execution. */
1612	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1613	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1614
1615	goto ResumeExecution;
1616	}
1617
1618	Log(("Forward #NM fault to the guest\n"));
1619	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1620	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
1621	AssertRC(rc);
1622	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1623	goto ResumeExecution;
1624	}
1625
1626	case X86_XCPT_PF: /* Page fault */
1627	{
1628	Log2(("Page fault at %VGv error code %x\n", exitQualification ,errCode));
1629	/* Exit qualification contains the linear address of the page fault. */
1630	TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1631	TRPMSetErrorCode(pVM, errCode);
1632	TRPMSetFaultAddress(pVM, exitQualification);
1633
1634	/* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1635	rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
1636	Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->rip, rc));
1637	if (rc == VINF_SUCCESS)
1638	{ /* We've successfully synced our shadow pages, so let's just continue execution. */
1639	Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, exitQualification ,errCode));
1640	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1641
1642	TRPMResetTrap(pVM);
1643
1644	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1645	goto ResumeExecution;
1646	}
1647	else
1648	if (rc == VINF_EM_RAW_GUEST_TRAP)
1649	{ /* A genuine pagefault.
1650	* Forward the trap to the guest by injecting the exception and resuming execution.
1651	*/
1652	Log2(("Forward page fault to the guest\n"));
1653	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1654	/* The error code might have been changed. */
1655	errCode = TRPMGetErrorCode(pVM);
1656
1657	TRPMResetTrap(pVM);
1658
1659	/* Now we must update CR2. */
1660	pCtx->cr2 = exitQualification;
1661	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1662	AssertRC(rc);
1663
1664	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1665	goto ResumeExecution;
1666	}
1667	#ifdef VBOX_STRICT
1668	if (rc != VINF_EM_RAW_EMULATE_INSTR)
1669	Log2(("PGMTrap0eHandler failed with %d\n", rc));
1670	#endif
1671	/* Need to go back to the recompiler to emulate the instruction. */
1672	TRPMResetTrap(pVM);
1673	break;
1674	}
1675
1676	case X86_XCPT_MF: /* Floating point exception. */
1677	{
1678	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1679	if (!(pCtx->cr0 & X86_CR0_NE))
1680	{
1681	/* old style FPU error reporting needs some extra work. */
1682	/** @todo don't fall back to the recompiler, but do it manually. */
1683	rc = VINF_EM_RAW_EMULATE_INSTR;
1684	break;
1685	}
1686	Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1687	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1688	AssertRC(rc);
1689
1690	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1691	goto ResumeExecution;
1692	}
1693
1694	#ifdef VBOX_STRICT
1695	case X86_XCPT_GP: /* General protection failure exception.*/
1696	case X86_XCPT_UD: /* Unknown opcode exception. */
1697	case X86_XCPT_DE: /* Debug exception. */
1698	case X86_XCPT_SS: /* Stack segment exception. */
1699	case X86_XCPT_NP: /* Segment not present exception. */
1700	{
1701	switch(vector)
1702	{
1703	case X86_XCPT_DE:
1704	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
1705	break;
1706	case X86_XCPT_UD:
1707	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
1708	break;
1709	case X86_XCPT_SS:
1710	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
1711	break;
1712	case X86_XCPT_NP:
1713	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
1714	break;
1715	case X86_XCPT_GP:
1716	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1717	break;
1718	}
1719
1720	Log(("Trap %x at %VGv error code %x\n", vector, pCtx->rip, errCode));
1721	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1722	AssertRC(rc);
1723
1724	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1725	goto ResumeExecution;
1726	}
1727	#endif
1728	default:
1729	AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1730	rc = VERR_EM_INTERNAL_ERROR;
1731	break;
1732	} /* switch (vector) */
1733
1734	break;
1735
1736	default:
1737	rc = VERR_EM_INTERNAL_ERROR;
1738	AssertFailed();
1739	break;
1740	}
1741
1742	break;
1743	}
1744
1745	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
1746	/* Clear VM-exit on IF=1 change. */
1747	Log2(("VMX_EXIT_IRQ_WINDOW %VGv\n", pCtx->rip));
1748	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
1749	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1750	AssertRC(rc);
1751	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIrqWindow);
1752	goto ResumeExecution; /* we check for pending guest interrupts there */
1753
1754	case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. */
1755	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
1756	/* Skip instruction and continue directly. */
1757	pCtx->rip += cbInstr;
1758	/* Continue execution.*/
1759	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1760	goto ResumeExecution;
1761
1762	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
1763	{
1764	Log2(("VMX: Cpuid %x\n", pCtx->eax));
1765	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
1766	rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
1767	if (rc == VINF_SUCCESS)
1768	{
1769	/* Update EIP and continue execution. */
1770	Assert(cbInstr == 2);
1771	pCtx->rip += cbInstr;
1772	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1773	goto ResumeExecution;
1774	}
1775	AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
1776	rc = VINF_EM_RAW_EMULATE_INSTR;
1777	break;
1778	}
1779
1780	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
1781	{
1782	Log2(("VMX: Rdtsc\n"));
1783	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
1784	rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
1785	if (rc == VINF_SUCCESS)
1786	{
1787	/* Update EIP and continue execution. */
1788	Assert(cbInstr == 2);
1789	pCtx->rip += cbInstr;
1790	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1791	goto ResumeExecution;
1792	}
1793	AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
1794	rc = VINF_EM_RAW_EMULATE_INSTR;
1795	break;
1796	}
1797
1798	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
1799	{
1800	Log2(("VMX: invlpg\n"));
1801	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
1802	rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
1803	if (rc == VINF_SUCCESS)
1804	{
1805	/* Update EIP and continue execution. */
1806	pCtx->rip += cbInstr;
1807	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1808	goto ResumeExecution;
1809	}
1810	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %VGv failed with %Vrc\n", exitQualification, rc));
1811	break;
1812	}
1813
1814	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
1815	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
1816	{
1817	uint32_t cbSize;
1818
1819	/* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
1820	Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
1821	rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1822	if (rc == VINF_SUCCESS)
1823	{
1824	/* EIP has been updated already. */
1825
1826	/* Only resume if successful. */
1827	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1828	goto ResumeExecution;
1829	}
1830	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Vrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
1831	break;
1832	}
1833
1834	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
1835	{
1836	switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
1837	{
1838	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
1839	Log2(("VMX: %VGv mov cr%d, x\n", pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
1840	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
1841	rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
1842	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
1843	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
1844
1845	switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
1846	{
1847	case 0:
1848	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1849	break;
1850	case 2:
1851	break;
1852	case 3:
1853	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR3;
1854	break;
1855	case 4:
1856	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR4;
1857	break;
1858	case 8:
1859	/* CR8 contains the APIC TPR */
1860	Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
1861	break;
1862
1863	default:
1864	AssertFailed();
1865	break;
1866	}
1867	/* Check if a sync operation is pending. */
1868	if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1869	&& VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
1870	{
1871	rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
1872	AssertRC(rc);
1873	}
1874	break;
1875
1876	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
1877	Log2(("VMX: mov x, crx\n"));
1878	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
1879
1880	/* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
1881	Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 \|\| !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
1882
1883	rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
1884	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
1885	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
1886	break;
1887
1888	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
1889	Log2(("VMX: clts\n"));
1890	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCLTS);
1891	rc = EMInterpretCLTS(pVM);
1892	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1893	break;
1894
1895	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
1896	Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
1897	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitLMSW);
1898	rc = EMInterpretLMSW(pVM, VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
1899	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1900	break;
1901	}
1902
1903	/* Update EIP if no error occurred. */
1904	if (VBOX_SUCCESS(rc))
1905	pCtx->rip += cbInstr;
1906
1907	if (rc == VINF_SUCCESS)
1908	{
1909	/* Only resume if successful. */
1910	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1911	goto ResumeExecution;
1912	}
1913	Assert(rc == VERR_EM_INTERPRETER \|\| rc == VINF_PGM_CHANGE_MODE \|\| rc == VINF_PGM_SYNC_CR3);
1914	break;
1915	}
1916
1917	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
1918	{
1919	/** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
1920	if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
1921	{
1922	Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
1923	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxWrite);
1924	rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
1925	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
1926	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
1927	Log2(("DR7=%08x\n", pCtx->dr7));
1928	}
1929	else
1930	{
1931	Log2(("VMX: mov x, drx\n"));
1932	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
1933	rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
1934	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
1935	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
1936	}
1937	/* Update EIP if no error occurred. */
1938	if (VBOX_SUCCESS(rc))
1939	pCtx->rip += cbInstr;
1940
1941	if (rc == VINF_SUCCESS)
1942	{
1943	/* Only resume if successful. */
1944	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1945	goto ResumeExecution;
1946	}
1947	Assert(rc == VERR_EM_INTERPRETER);
1948	break;
1949	}
1950
1951	/** @note We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
1952	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
1953	{
1954	uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
1955	uint32_t uPort;
1956	bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
1957
1958	/** @todo necessary to make the distinction? */
1959	if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
1960	{
1961	uPort = pCtx->edx & 0xffff;
1962	}
1963	else
1964	uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
1965
1966	/* paranoia */
1967	if (RT_UNLIKELY(uIOWidth == 2 \|\| uIOWidth >= 4))
1968	{
1969	rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
1970	break;
1971	}
1972
1973	uint32_t cbSize = aIOSize[uIOWidth];
1974
1975	if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
1976	{
1977	/* ins/outs */
1978	uint32_t prefix = 0;
1979	if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
1980	prefix \|= PREFIX_REP;
1981
1982	if (fIOWrite)
1983	{
1984	Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
1985	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
1986	rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
1987	}
1988	else
1989	{
1990	Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
1991	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
1992	rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
1993	}
1994	}
1995	else
1996	{
1997	/* normal in/out */
1998	uint32_t uAndVal = aIOOpAnd[uIOWidth];
1999
2000	Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2001
2002	if (fIOWrite)
2003	{
2004	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
2005	rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2006	}
2007	else
2008	{
2009	uint32_t u32Val = 0;
2010
2011	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
2012	rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2013	if (IOM_SUCCESS(rc))
2014	{
2015	/* Write back to the EAX register. */
2016	pCtx->eax = (pCtx->eax & ~uAndVal) \| (u32Val & uAndVal);
2017	}
2018	}
2019	}
2020	/*
2021	* Handled the I/O return codes.
2022	* (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2023	*/
2024	if (IOM_SUCCESS(rc))
2025	{
2026	/* Update EIP and continue execution. */
2027	pCtx->rip += cbInstr;
2028	if (RT_LIKELY(rc == VINF_SUCCESS))
2029	{
2030	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2031	goto ResumeExecution;
2032	}
2033	break;
2034	}
2035
2036	#ifdef VBOX_STRICT
2037	if (rc == VINF_IOM_HC_IOPORT_READ)
2038	Assert(!fIOWrite);
2039	else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2040	Assert(fIOWrite);
2041	else
2042	AssertMsg(VBOX_FAILURE(rc) \|\| rc == VINF_EM_RAW_EMULATE_INSTR \|\| rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
2043	#endif
2044	break;
2045	}
2046
2047	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2048	LogFlow(("VMX_EXIT_TPR\n"));
2049	/* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2050	goto ResumeExecution;
2051
2052	default:
2053	/* The rest is handled after syncing the entire CPU state. */
2054	break;
2055	}
2056
2057	/* Note: the guest state isn't entirely synced back at this stage. */
2058
2059	/* Investigate why there was a VM-exit. (part 2) */
2060	switch (exitReason)
2061	{
2062	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2063	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2064	/* Already handled above. */
2065	break;
2066
2067	case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2068	rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2069	break;
2070
2071	case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2072	case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2073	rc = VINF_EM_RAW_INTERRUPT;
2074	AssertFailed(); /* Can't happen. Yet. */
2075	break;
2076
2077	case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2078	case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2079	rc = VINF_EM_RAW_INTERRUPT;
2080	AssertFailed(); /* Can't happen afaik. */
2081	break;
2082
2083	case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2084	rc = VERR_EM_INTERPRETER;
2085	break;
2086
2087	case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2088	/** Check if external interrupts are pending; if so, don't switch back. */
2089	pCtx->rip++; /* skip hlt */
2090	if ( pCtx->eflags.Bits.u1IF
2091	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
2092	goto ResumeExecution;
2093
2094	rc = VINF_EM_HALT;
2095	break;
2096
2097	case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2098	AssertFailed(); /* can't happen. */
2099	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2100	break;
2101
2102	case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2103	case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2104	case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2105	case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2106	case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2107	case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2108	case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2109	case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2110	case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2111	case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2112	/** @todo inject #UD immediately */
2113	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2114	break;
2115
2116	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2117	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2118	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2119	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2120	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2121	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2122	/* already handled above */
2123	AssertMsg( rc == VINF_PGM_CHANGE_MODE
2124	\|\| rc == VINF_EM_RAW_INTERRUPT
2125	\|\| rc == VERR_EM_INTERPRETER
2126	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
2127	\|\| rc == VINF_PGM_SYNC_CR3
2128	\|\| rc == VINF_IOM_HC_IOPORT_READ
2129	\|\| rc == VINF_IOM_HC_IOPORT_WRITE
2130	\|\| rc == VINF_EM_RAW_GUEST_TRAP
2131	\|\| rc == VINF_TRPM_XCPT_DISPATCHED
2132	\|\| rc == VINF_EM_RESCHEDULE_REM,
2133	("rc = %d\n", rc));
2134	break;
2135
2136	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2137	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2138	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2139	/* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2140	rc = VERR_EM_INTERPRETER;
2141	break;
2142
2143	case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2144	case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2145	case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2146	case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2147	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2148	break;
2149
2150	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2151	Assert(rc == VINF_EM_RAW_INTERRUPT);
2152	break;
2153
2154	case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2155	{
2156	#ifdef VBOX_STRICT
2157	Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2158
2159	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2160	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
2161
2162	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2163	Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2164
2165	VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2166	Log(("VMX_VMCS_HOST_CR3 %VGp\n", val));
2167
2168	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2169	Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2170
2171	VMX_LOG_SELREG(CS, "CS");
2172	VMX_LOG_SELREG(DS, "DS");
2173	VMX_LOG_SELREG(ES, "ES");
2174	VMX_LOG_SELREG(FS, "FS");
2175	VMX_LOG_SELREG(GS, "GS");
2176	VMX_LOG_SELREG(SS, "SS");
2177	VMX_LOG_SELREG(TR, "TR");
2178	VMX_LOG_SELREG(LDTR, "LDTR");
2179
2180	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2181	Log(("VMX_VMCS_GUEST_GDTR_BASE %VGv\n", val));
2182	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2183	Log(("VMX_VMCS_GUEST_IDTR_BASE %VGv\n", val));
2184	#endif /* VBOX_STRICT */
2185	rc = VERR_EM_INTERNAL_ERROR;
2186	break;
2187	}
2188
2189	case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2190	case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2191	default:
2192	rc = VERR_EM_INTERNAL_ERROR;
2193	AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2194	break;
2195
2196	}
2197	end:
2198	if (fGuestStateSynced)
2199	{
2200	/* Remaining guest CPU context: TR, IDTR, GDTR, LDTR. */
2201	VMX_READ_SELREG(LDTR, ldtr);
2202	VMX_READ_SELREG(TR, tr);
2203
2204	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
2205	pCtx->gdtr.cbGdt = val;
2206	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2207	pCtx->gdtr.pGdt = val;
2208
2209	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
2210	pCtx->idtr.cbIdt = val;
2211	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2212	pCtx->idtr.pIdt = val;
2213	}
2214
2215	/* Signal changes for the recompiler. */
2216	CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_TR \| CPUM_CHANGED_HIDDEN_SEL_REGS);
2217
2218	/* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2219	if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2220	&& !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2221	{
2222	STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
2223	/* On the next entry we'll only sync the host context. */
2224	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_HOST_CONTEXT;
2225	}
2226	else
2227	{
2228	/* On the next entry we'll sync everything. */
2229	/** @todo we can do better than this */
2230	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_ALL;
2231	}
2232
2233	/* translate into a less severe return code */
2234	if (rc == VERR_EM_INTERPRETER)
2235	rc = VINF_EM_RAW_EMULATE_INSTR;
2236
2237	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2238	Log2(("X"));
2239	return rc;
2240	}
2241
2242
2243	/**
2244	* Enters the VT-x session
2245	*
2246	* @returns VBox status code.
2247	* @param pVM The VM to operate on.
2248	* @param pCpu CPU info struct
2249	*/
2250	HWACCMR0DECL(int) VMXR0Enter(PVM pVM, PHWACCM_CPUINFO pCpu)
2251	{
2252	Assert(pVM->hwaccm.s.vmx.fSupported);
2253
2254	unsigned cr4 = ASMGetCR4();
2255	if (!(cr4 & X86_CR4_VMXE))
2256	{
2257	AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
2258	return VERR_VMX_X86_CR4_VMXE_CLEARED;
2259	}
2260
2261	/* Activate the VM Control Structure. */
2262	int rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2263	if (VBOX_FAILURE(rc))
2264	return rc;
2265
2266	pVM->hwaccm.s.vmx.fResumeVM = false;
2267	return VINF_SUCCESS;
2268	}
2269
2270
2271	/**
2272	* Leaves the VT-x session
2273	*
2274	* @returns VBox status code.
2275	* @param pVM The VM to operate on.
2276	*/
2277	HWACCMR0DECL(int) VMXR0Leave(PVM pVM)
2278	{
2279	Assert(pVM->hwaccm.s.vmx.fSupported);
2280
2281	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
2282	int rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2283	AssertRC(rc);
2284
2285	return VINF_SUCCESS;
2286	}
2287

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 11706

Download in other formats: