VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 13972

Last change on this file since 13972 was 13960, checked in by vboxsync, 16 years ago

Moved guest and host CPU contexts into per-VCPU array.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 128.4 KB
Line 
1/* $Id: HWVMXR0.cpp 13960 2008-11-07 13:04:45Z vboxsync $ */
2/** @file
3 * HWACCM VMX - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/pgm.h>
32#include <VBox/pdm.h>
33#include <VBox/err.h>
34#include <VBox/log.h>
35#include <VBox/selm.h>
36#include <VBox/iom.h>
37#include <iprt/param.h>
38#include <iprt/assert.h>
39#include <iprt/asm.h>
40#include <iprt/string.h>
41#include "HWVMXR0.h"
42
43/*******************************************************************************
44* Global Variables *
45*******************************************************************************/
46/* IO operation lookup arrays. */
47static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
48static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
49
50/*******************************************************************************
51* Local Functions *
52*******************************************************************************/
53static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx);
54static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu);
55static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu);
56static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu);
57static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys);
58static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr);
59static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
60
61
62static void VMXR0CheckError(PVM pVM, PVMCPU pVCpu, int rc)
63{
64 if (rc == VERR_VMX_GENERIC)
65 {
66 RTCCUINTREG instrError;
67
68 VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
69 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
70 }
71 pVM->hwaccm.s.lLastError = rc;
72}
73
74/**
75 * Sets up and activates VT-x on the current CPU
76 *
77 * @returns VBox status code.
78 * @param pCpu CPU info struct
79 * @param pVM The VM to operate on. (can be NULL after a resume!!)
80 * @param pvPageCpu Pointer to the global cpu page
81 * @param pPageCpuPhys Physical address of the global cpu page
82 */
83VMMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
84{
85 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
86 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
87
88#ifdef LOG_ENABLED
89 SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
90#endif
91 if (pVM)
92 {
93 /* Set revision dword at the beginning of the VMXON structure. */
94 *(uint32_t *)pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
95 }
96
97 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
98 * (which can have very bad consequences!!!)
99 */
100
101 /* Make sure the VMX instructions don't cause #UD faults. */
102 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
103
104 /* Enter VMX Root Mode */
105 int rc = VMXEnable(pPageCpuPhys);
106 if (RT_FAILURE(rc))
107 {
108 if (pVM)
109 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
110 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
111 return VERR_VMX_VMXON_FAILED;
112 }
113 return VINF_SUCCESS;
114}
115
116/**
117 * Deactivates VT-x on the current CPU
118 *
119 * @returns VBox status code.
120 * @param pCpu CPU info struct
121 * @param pvPageCpu Pointer to the global cpu page
122 * @param pPageCpuPhys Physical address of the global cpu page
123 */
124VMMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
125{
126 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
127 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
128
129 /* Leave VMX Root Mode. */
130 VMXDisable();
131
132 /* And clear the X86_CR4_VMXE bit */
133 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
134
135#ifdef LOG_ENABLED
136 SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
137#endif
138 return VINF_SUCCESS;
139}
140
141/**
142 * Does Ring-0 per VM VT-x init.
143 *
144 * @returns VBox status code.
145 * @param pVM The VM to operate on.
146 */
147VMMR0DECL(int) VMXR0InitVM(PVM pVM)
148{
149 int rc;
150
151#ifdef LOG_ENABLED
152 SUPR0Printf("VMXR0InitVM %x\n", pVM);
153#endif
154
155 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
156
157 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
158 {
159 /* Allocate one page for the virtual APIC mmio cache. */
160 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
161 AssertRC(rc);
162 if (RT_FAILURE(rc))
163 return rc;
164
165 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
166 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
167 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
168 }
169 else
170 {
171 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
172 pVM->hwaccm.s.vmx.pAPIC = 0;
173 pVM->hwaccm.s.vmx.pAPICPhys = 0;
174 }
175
176 /* Allocate the MSR bitmap if this feature is supported. */
177 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
178 {
179 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
180 AssertRC(rc);
181 if (RT_FAILURE(rc))
182 return rc;
183
184 pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
185 pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
186 memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
187 }
188
189 /* Allocate VMCBs for all guest CPUs. */
190 for (unsigned i=0;i<pVM->cCPUs;i++)
191 {
192 PVMCPU pVCpu = &pVM->aCpus[i];
193
194 pVCpu->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
195
196 /* Allocate one page for the VM control structure (VMCS). */
197 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
198 AssertRC(rc);
199 if (RT_FAILURE(rc))
200 return rc;
201
202 pVCpu->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjVMCS);
203 pVCpu->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjVMCS, 0);
204 ASMMemZero32(pVCpu->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
205
206 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
207 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
208
209 /* Current guest paging mode. */
210 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
211
212#ifdef LOG_ENABLED
213 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.pVMCSPhys);
214#endif
215 }
216
217 return VINF_SUCCESS;
218}
219
220/**
221 * Does Ring-0 per VM VT-x termination.
222 *
223 * @returns VBox status code.
224 * @param pVM The VM to operate on.
225 */
226VMMR0DECL(int) VMXR0TermVM(PVM pVM)
227{
228 for (unsigned i=0;i<pVM->cCPUs;i++)
229 {
230 if (pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
231 {
232 RTR0MemObjFree(pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS, false);
233 pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
234 pVM->aCpus[i].hwaccm.s.vmx.pVMCS = 0;
235 pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys = 0;
236 }
237 }
238 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
239 {
240 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
241 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
242 pVM->hwaccm.s.vmx.pAPIC = 0;
243 pVM->hwaccm.s.vmx.pAPICPhys = 0;
244 }
245 if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
248 pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
249 pVM->hwaccm.s.vmx.pMSRBitmap = 0;
250 pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
251 }
252 return VINF_SUCCESS;
253}
254
255/**
256 * Sets up VT-x for the specified VM
257 *
258 * @returns VBox status code.
259 * @param pVM The VM to operate on.
260 */
261VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
262{
263 int rc = VINF_SUCCESS;
264 uint32_t val;
265
266 AssertReturn(pVM, VERR_INVALID_PARAMETER);
267
268 for (unsigned i=0;i<pVM->cCPUs;i++)
269 {
270 Assert(pVM->aCpus[i].hwaccm.s.vmx.pVMCS);
271
272 /* Set revision dword at the beginning of the VMCS structure. */
273 *(uint32_t *)pVM->aCpus[i].hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
274
275 /* Clear VM Control Structure. */
276 Log(("pVMCSPhys = %RHp\n", pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys));
277 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
278 if (RT_FAILURE(rc))
279 goto vmx_end;
280
281 /* Activate the VM Control Structure. */
282 rc = VMXActivateVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
283 if (RT_FAILURE(rc))
284 goto vmx_end;
285
286 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
287 * Set required bits to one and zero according to the MSR capabilities.
288 */
289 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
290 /* External and non-maskable interrupts cause VM-exits. */
291 val = val | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
292 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
293
294 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
295 AssertRC(rc);
296
297 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
298 * Set required bits to one and zero according to the MSR capabilities.
299 */
300 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
301 /* Program which event cause VM-exits and which features we want to use. */
302 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
303 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
304 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
305 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
306 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
307
308 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
309 if (!pVM->hwaccm.s.fNestedPaging)
310 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
311 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
312 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
313
314 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
315
316#if HC_ARCH_BITS == 64
317 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
318 {
319 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
320 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
321 Assert(pVM->hwaccm.s.vmx.pAPIC);
322 }
323 else
324 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
325 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
326#endif
327
328#ifdef VBOX_WITH_VTX_MSR_BITMAPS
329 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
330 {
331 Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
332 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
333 }
334#endif
335
336 /* We will use the secondary control if it's present. */
337 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
338
339 /* Mask away the bits that the CPU doesn't support */
340 /** @todo make sure they don't conflict with the above requirements. */
341 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
342 pVM->aCpus[i].hwaccm.s.vmx.proc_ctls = val;
343
344 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
345 AssertRC(rc);
346
347 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
348 {
349 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
350 * Set required bits to one and zero according to the MSR capabilities.
351 */
352 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
353 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
354
355#ifdef HWACCM_VTX_WITH_EPT
356 if (pVM->hwaccm.s.fNestedPaging)
357 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
358#endif /* HWACCM_VTX_WITH_EPT */
359#ifdef HWACCM_VTX_WITH_VPID
360 else
361 if (pVM->hwaccm.s.vmx.fVPID)
362 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
363#endif /* HWACCM_VTX_WITH_VPID */
364
365 /* Mask away the bits that the CPU doesn't support */
366 /** @todo make sure they don't conflict with the above requirements. */
367 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
368
369 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
370 AssertRC(rc);
371 }
372
373 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
374 * Set required bits to one and zero according to the MSR capabilities.
375 */
376 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
377 AssertRC(rc);
378
379 /* VMX_VMCS_CTRL_EXIT_CONTROLS
380 * Set required bits to one and zero according to the MSR capabilities.
381 */
382 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
383
384 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
385 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
386#if HC_ARCH_BITS == 64
387 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
388#else
389 /* else Must be zero when AMD64 is not available. */
390#endif
391 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
392 /* Don't acknowledge external interrupts on VM-exit. */
393 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
394 AssertRC(rc);
395
396 /* Forward all exception except #NM & #PF to the guest.
397 * We always need to check pagefaults since our shadow page table can be out of sync.
398 * And we always lazily sync the FPU & XMM state.
399 */
400
401 /** @todo Possible optimization:
402 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
403 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
404 * registers ourselves of course.
405 *
406 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
407 */
408
409 /* Don't filter page faults; all of them should cause a switch. */
410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
411 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
412 AssertRC(rc);
413
414 /* Init TSC offset to zero. */
415 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
416#if HC_ARCH_BITS == 32
417 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
418#endif
419 AssertRC(rc);
420
421 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
422#if HC_ARCH_BITS == 32
423 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
424#endif
425 AssertRC(rc);
426
427 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
428#if HC_ARCH_BITS == 32
429 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
430#endif
431 AssertRC(rc);
432
433 /* Set the MSR bitmap address. */
434 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
435 {
436 /* Optional */
437 rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
438#if HC_ARCH_BITS == 32
439 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, pVM->hwaccm.s.vmx.pMSRBitmapPhys >> 32ULL);
440#endif
441 AssertRC(rc);
442 }
443
444 /* Clear MSR controls. */
445 rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
446 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
447 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
448#if HC_ARCH_BITS == 32
449 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
450 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
451 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
452#endif
453 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
454 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
455 AssertRC(rc);
456
457 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
458 {
459 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
460 /* Optional */
461 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
462 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
463#if HC_ARCH_BITS == 32
464 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32ULL);
465#endif
466 AssertRC(rc);
467 }
468
469 /* Set link pointer to -1. Not currently used. */
470#if HC_ARCH_BITS == 32
471 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
472 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
473#else
474 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
475#endif
476 AssertRC(rc);
477
478 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
479 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
480 AssertRC(rc);
481 } /* for each VMCPU */
482
483 /* Choose the right TLB setup function. */
484 if (pVM->hwaccm.s.fNestedPaging)
485 {
486 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBEPT;
487
488 /* Default values for flushing. */
489 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
490 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
491
492 /* If the capabilities specify we can do more, then make use of it. */
493 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_INDIV)
494 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
495 else
496 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
497 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
498
499 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
500 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
501 }
502#ifdef HWACCM_VTX_WITH_VPID
503 else
504 if (pVM->hwaccm.s.vmx.fVPID)
505 {
506 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBVPID;
507
508 /* Default values for flushing. */
509 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
510 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
511
512 /* If the capabilities specify we can do more, then make use of it. */
513 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV)
514 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
515 else
516 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
517 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
518
519 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
520 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
521 }
522#endif /* HWACCM_VTX_WITH_VPID */
523 else
524 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBDummy;
525
526vmx_end:
527 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
528 return rc;
529}
530
531
532/**
533 * Injects an event (trap or external interrupt)
534 *
535 * @returns VBox status code.
536 * @param pVM The VM to operate on.
537 * @param pVCpu The VMCPU to operate on.
538 * @param pCtx CPU Context
539 * @param intInfo VMX interrupt info
540 * @param cbInstr Opcode length of faulting instruction
541 * @param errCode Error code (optional)
542 */
543static int VMXR0InjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
544{
545 int rc;
546 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
547
548#ifdef VBOX_STRICT
549 if (iGate == 0xE)
550 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
551 else
552 if (iGate < 0x20)
553 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
554 else
555 {
556 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
557 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
558 Assert(pCtx->eflags.u32 & X86_EFL_IF);
559 }
560#endif
561
562#ifdef HWACCM_VMX_EMULATE_REALMODE
563 if (CPUMIsGuestInRealModeEx(pCtx))
564 {
565 RTGCPHYS GCPhysHandler;
566 uint16_t offset, ip;
567 RTSEL sel;
568
569 /* Injecting events doesn't work right with real mode emulation.
570 * (#GP if we try to inject external hardware interrupts)
571 * Inject the interrupt or trap directly instead.
572 */
573 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
574
575 /* Check if the interrupt handler is present. */
576 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
577 {
578 Log(("IDT cbIdt violation\n"));
579 if (iGate != X86_XCPT_DF)
580 {
581 RTGCUINTPTR intInfo;
582
583 intInfo = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
584 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
585 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
586 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
587
588 return VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0 /* no error code according to the Intel docs */);
589 }
590 Log(("Triple fault -> reset the VM!\n"));
591 return VINF_EM_RESET;
592 }
593 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
594 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
595 || iGate == 4)
596 {
597 ip = pCtx->ip + cbInstr;
598 }
599 else
600 ip = pCtx->ip;
601
602 /* Read the selector:offset pair of the interrupt handler. */
603 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
604 PGMPhysRead(pVM, GCPhysHandler, &offset, sizeof(offset));
605 PGMPhysRead(pVM, GCPhysHandler + 2, &sel, sizeof(sel));
606
607 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
608
609 /* Construct the stack frame. */
610 /** @todo should check stack limit. */
611 pCtx->sp -= 2;
612 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
613 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t));
614 pCtx->sp -= 2;
615 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
616 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t));
617 pCtx->sp -= 2;
618 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
619 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip));
620
621 /* Update the CPU state for executing the handler. */
622 pCtx->rip = offset;
623 pCtx->cs = sel;
624 pCtx->csHid.u64Base = sel << 4;
625 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
626
627 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
628 return VINF_SUCCESS;
629 }
630#endif /* HWACCM_VMX_EMULATE_REALMODE */
631
632 /* Set event injection state. */
633 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
634
635 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
636 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
637
638 AssertRC(rc);
639 return rc;
640}
641
642
643/**
644 * Checks for pending guest interrupts and injects them
645 *
646 * @returns VBox status code.
647 * @param pVM The VM to operate on.
648 * @param pVCpu The VMCPU to operate on.
649 * @param pCtx CPU Context
650 */
651static int VMXR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
652{
653 int rc;
654
655 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
656 if (pVCpu->hwaccm.s.Event.fPending)
657 {
658 Log(("Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
659 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
660 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
661 AssertRC(rc);
662
663 pVCpu->hwaccm.s.Event.fPending = false;
664 return VINF_SUCCESS;
665 }
666
667 /* When external interrupts are pending, we should exit the VM when IF is set. */
668 if ( !TRPMHasTrap(pVM)
669 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
670 {
671 if (!(pCtx->eflags.u32 & X86_EFL_IF))
672 {
673 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
674 {
675 LogFlow(("Enable irq window exit!\n"));
676 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
677 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
678 AssertRC(rc);
679 }
680 /* else nothing to do but wait */
681 }
682 else
683 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
684 {
685 uint8_t u8Interrupt;
686
687 rc = PDMGetInterrupt(pVM, &u8Interrupt);
688 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
689 if (RT_SUCCESS(rc))
690 {
691 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
692 AssertRC(rc);
693 }
694 else
695 {
696 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
697 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
698 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
699 /* Just continue */
700 }
701 }
702 else
703 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
704 }
705
706#ifdef VBOX_STRICT
707 if (TRPMHasTrap(pVM))
708 {
709 uint8_t u8Vector;
710 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
711 AssertRC(rc);
712 }
713#endif
714
715 if ( pCtx->eflags.u32 & X86_EFL_IF
716 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
717 && TRPMHasTrap(pVM)
718 )
719 {
720 uint8_t u8Vector;
721 int rc;
722 TRPMEVENT enmType;
723 RTGCUINTPTR intInfo;
724 RTGCUINT errCode;
725
726 /* If a new event is pending, then dispatch it now. */
727 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
728 AssertRC(rc);
729 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
730 Assert(enmType != TRPM_SOFTWARE_INT);
731
732 /* Clear the pending trap. */
733 rc = TRPMResetTrap(pVM);
734 AssertRC(rc);
735
736 intInfo = u8Vector;
737 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
738
739 if (enmType == TRPM_TRAP)
740 {
741 switch (u8Vector) {
742 case 8:
743 case 10:
744 case 11:
745 case 12:
746 case 13:
747 case 14:
748 case 17:
749 /* Valid error codes. */
750 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
751 break;
752 default:
753 break;
754 }
755 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
756 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
757 else
758 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
759 }
760 else
761 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
762
763 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
764 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
765 AssertRC(rc);
766 } /* if (interrupts can be dispatched) */
767
768 return VINF_SUCCESS;
769}
770
771/**
772 * Save the host state
773 *
774 * @returns VBox status code.
775 * @param pVM The VM to operate on.
776 * @param pVCpu The VMCPU to operate on.
777 */
778VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
779{
780 int rc = VINF_SUCCESS;
781
782 /*
783 * Host CPU Context
784 */
785 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
786 {
787 RTIDTR idtr;
788 RTGDTR gdtr;
789 RTSEL SelTR;
790 PX86DESCHC pDesc;
791 uintptr_t trBase;
792
793 /* Control registers */
794 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
795 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
796 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
797 AssertRC(rc);
798 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
799 Log2(("VMX_VMCS_HOST_CR3 %RHp\n", ASMGetCR3()));
800 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
801
802 /* Selector registers. */
803 rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
804 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
805 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
806 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
807#if HC_ARCH_BITS == 32
808 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
809 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
810#endif
811 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
812 SelTR = ASMGetTR();
813 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
814 AssertRC(rc);
815 Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
816 Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
817 Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
818 Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
819 Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
820 Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
821 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
822
823 /* GDTR & IDTR */
824 ASMGetGDTR(&gdtr);
825 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
826 ASMGetIDTR(&idtr);
827 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
828 AssertRC(rc);
829 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
830 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
831
832 /* Save the base address of the TR selector. */
833 if (SelTR > gdtr.cbGdt)
834 {
835 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
836 return VERR_VMX_INVALID_HOST_STATE;
837 }
838
839 pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
840#if HC_ARCH_BITS == 64
841 trBase = X86DESC64_BASE(*pDesc);
842#else
843 trBase = X86DESC_BASE(*pDesc);
844#endif
845 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
846 AssertRC(rc);
847 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
848
849 /* FS and GS base. */
850#if HC_ARCH_BITS == 64
851 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
852 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
853 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
854 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
855#endif
856 AssertRC(rc);
857
858 /* Sysenter MSRs. */
859 /** @todo expensive!! */
860 rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
861 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
862#if HC_ARCH_BITS == 32
863 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
864 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
865 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
866 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
867#else
868 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
869 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
870 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
871 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
872#endif
873 AssertRC(rc);
874
875 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
876 }
877 return rc;
878}
879
880/**
881 * Prefetch the 4 PDPT pointers (PAE and nested paging only)
882 *
883 * @param pVM The VM to operate on.
884 * @param pCtx Guest context
885 */
886static void vmxR0PrefetchPAEPdptrs(PVM pVM, PCPUMCTX pCtx)
887{
888 if (CPUMIsGuestInPAEModeEx(pCtx))
889 {
890 X86PDPE Pdpe;
891
892 for (unsigned i=0;i<4;i++)
893 {
894 Pdpe = PGMGstGetPaePDPtr(pVM, i);
895 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2, Pdpe.u);
896#if HC_ARCH_BITS == 32
897 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2 + 1, Pdpe.u >> 32ULL);
898#endif
899 AssertRC(rc);
900 }
901 }
902}
903
904/**
905 * Update the exception bitmap according to the current CPU state
906 *
907 * @param pVM The VM to operate on.
908 * @param pVCpu The VMCPU to operate on.
909 * @param pCtx Guest context
910 */
911static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
912{
913 uint32_t u32TrapMask;
914 Assert(pCtx);
915
916 u32TrapMask = HWACCM_VMX_TRAP_MASK;
917#ifndef DEBUG
918 if (pVM->hwaccm.s.fNestedPaging)
919 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
920#endif
921
922 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
923 if ( CPUMIsGuestFPUStateActive(pVCpu) == true
924 && !(pCtx->cr0 & X86_CR0_NE)
925 && !pVCpu->hwaccm.s.fFPUOldStyleOverride)
926 {
927 u32TrapMask |= RT_BIT(X86_XCPT_MF);
928 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
929 }
930
931#ifdef DEBUG
932 /* Intercept X86_XCPT_DB if stepping is enabled */
933 if (DBGFIsStepping(pVM))
934 u32TrapMask |= RT_BIT(X86_XCPT_DB);
935#endif
936
937#ifdef VBOX_STRICT
938 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
939#endif
940
941# ifdef HWACCM_VMX_EMULATE_REALMODE
942 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
943 if (CPUMIsGuestInRealModeEx(pCtx))
944 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
945# endif /* HWACCM_VMX_EMULATE_REALMODE */
946
947 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
948 AssertRC(rc);
949}
950
951/**
952 * Loads the guest state
953 *
954 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
955 *
956 * @returns VBox status code.
957 * @param pVM The VM to operate on.
958 * @param pVCpu The VMCPU to operate on.
959 * @param pCtx Guest context
960 */
961VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
962{
963 int rc = VINF_SUCCESS;
964 RTGCUINTPTR val;
965 X86EFLAGS eflags;
966
967 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
968 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
969 {
970#ifdef HWACCM_VMX_EMULATE_REALMODE
971 PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
972 if (pVCpu->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
973 {
974 /* Correct weird requirements for switching to protected mode. */
975 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
976 && enmGuestMode >= PGMMODE_PROTECTED)
977 {
978 /* DPL of all hidden selector registers must match the current CPL (0). */
979 pCtx->csHid.Attr.n.u2Dpl = 0;
980 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
981
982 pCtx->dsHid.Attr.n.u2Dpl = 0;
983 pCtx->esHid.Attr.n.u2Dpl = 0;
984 pCtx->fsHid.Attr.n.u2Dpl = 0;
985 pCtx->gsHid.Attr.n.u2Dpl = 0;
986 pCtx->ssHid.Attr.n.u2Dpl = 0;
987 }
988 else
989 /* Switching from protected mode to real mode. */
990 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
991 && enmGuestMode == PGMMODE_REAL)
992 {
993 /* The limit must also be adjusted. */
994 pCtx->csHid.u32Limit &= 0xffff;
995 pCtx->dsHid.u32Limit &= 0xffff;
996 pCtx->esHid.u32Limit &= 0xffff;
997 pCtx->fsHid.u32Limit &= 0xffff;
998 pCtx->gsHid.u32Limit &= 0xffff;
999 pCtx->ssHid.u32Limit &= 0xffff;
1000
1001 Assert(pCtx->csHid.u64Base <= 0xfffff);
1002 Assert(pCtx->dsHid.u64Base <= 0xfffff);
1003 Assert(pCtx->esHid.u64Base <= 0xfffff);
1004 Assert(pCtx->fsHid.u64Base <= 0xfffff);
1005 Assert(pCtx->gsHid.u64Base <= 0xfffff);
1006 }
1007 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
1008 }
1009 else
1010 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1011 if ( CPUMIsGuestInRealModeEx(pCtx)
1012 && pCtx->csHid.u64Base == 0xffff0000)
1013 {
1014 pCtx->csHid.u64Base = 0xf0000;
1015 pCtx->cs = 0xf000;
1016 }
1017#endif /* HWACCM_VMX_EMULATE_REALMODE */
1018
1019 VMX_WRITE_SELREG(ES, es);
1020 AssertRC(rc);
1021
1022 VMX_WRITE_SELREG(CS, cs);
1023 AssertRC(rc);
1024
1025 VMX_WRITE_SELREG(SS, ss);
1026 AssertRC(rc);
1027
1028 VMX_WRITE_SELREG(DS, ds);
1029 AssertRC(rc);
1030
1031 /* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
1032 VMX_WRITE_SELREG(FS, fs);
1033 AssertRC(rc);
1034
1035 VMX_WRITE_SELREG(GS, gs);
1036 AssertRC(rc);
1037 }
1038
1039 /* Guest CPU context: LDTR. */
1040 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1041 {
1042 if (pCtx->ldtr == 0)
1043 {
1044 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
1045 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
1046 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
1047 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1048 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1049 }
1050 else
1051 {
1052 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
1053 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1054 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1055 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1056 }
1057 AssertRC(rc);
1058 }
1059 /* Guest CPU context: TR. */
1060 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1061 {
1062#ifdef HWACCM_VMX_EMULATE_REALMODE
1063 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1064 if (CPUMIsGuestInRealModeEx(pCtx))
1065 {
1066 RTGCPHYS GCPhys;
1067
1068 /* We convert it here every time as pci regions could be reconfigured. */
1069 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1070 AssertRC(rc);
1071
1072 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, 0);
1073 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1074 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1075
1076 X86DESCATTR attr;
1077
1078 attr.u = 0;
1079 attr.n.u1Present = 1;
1080 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1081 val = attr.u;
1082 }
1083 else
1084#endif /* HWACCM_VMX_EMULATE_REALMODE */
1085 {
1086 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
1087 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1088 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
1089
1090 val = pCtx->trHid.Attr.u;
1091
1092 /* The TSS selector must be busy. */
1093 if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
1094 val = (val & ~0xF) | X86_SEL_TYPE_SYS_286_TSS_BUSY;
1095 else
1096 /* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
1097 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1098
1099 }
1100 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
1101 AssertRC(rc);
1102 }
1103 /* Guest CPU context: GDTR. */
1104 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1105 {
1106 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1107 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1108 AssertRC(rc);
1109 }
1110 /* Guest CPU context: IDTR. */
1111 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1112 {
1113 rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1114 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1115 AssertRC(rc);
1116 }
1117
1118 /*
1119 * Sysenter MSRs (unconditional)
1120 */
1121 rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1122 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1123 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1124 AssertRC(rc);
1125
1126 /* Control registers */
1127 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1128 {
1129 val = pCtx->cr0;
1130 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1131 Log2(("Guest CR0-shadow %08x\n", val));
1132 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1133 {
1134 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1135 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1136 }
1137 else
1138 {
1139 /** @todo check if we support the old style mess correctly. */
1140 if (!(val & X86_CR0_NE))
1141 Log(("Forcing X86_CR0_NE!!!\n"));
1142
1143 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1144 }
1145 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1146 val |= X86_CR0_PE | X86_CR0_PG;
1147 if (pVM->hwaccm.s.fNestedPaging)
1148 {
1149 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1150 {
1151 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1152 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1153 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1154 }
1155 else
1156 {
1157 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1158 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1159 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1160 }
1161 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1162 AssertRC(rc);
1163 }
1164 else
1165 {
1166 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1167 val |= X86_CR0_WP;
1168 }
1169
1170 /* Always enable caching. */
1171 val &= ~(X86_CR0_CD|X86_CR0_NW);
1172
1173 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1174 Log2(("Guest CR0 %08x\n", val));
1175 /* CR0 flags owned by the host; if the guests attempts to change them, then
1176 * the VM will exit.
1177 */
1178 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1179 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1180 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1181 | X86_CR0_TS
1182 | X86_CR0_ET /* Bit not restored during VM-exit! */
1183 | X86_CR0_CD /* Bit not restored during VM-exit! */
1184 | X86_CR0_NW /* Bit not restored during VM-exit! */
1185 | X86_CR0_NE
1186 | X86_CR0_MP;
1187 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1188
1189 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1190 Log2(("Guest CR0-mask %08x\n", val));
1191 AssertRC(rc);
1192 }
1193 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1194 {
1195 /* CR4 */
1196 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1197 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1198 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1199 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1200
1201 if (!pVM->hwaccm.s.fNestedPaging)
1202 {
1203 switch(pVCpu->hwaccm.s.enmShadowMode)
1204 {
1205 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1206 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1207 case PGMMODE_32_BIT: /* 32-bit paging. */
1208 break;
1209
1210 case PGMMODE_PAE: /* PAE paging. */
1211 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1212 /** @todo use normal 32 bits paging */
1213 val |= X86_CR4_PAE;
1214 break;
1215
1216 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1217 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1218#ifdef VBOX_ENABLE_64_BITS_GUESTS
1219 break;
1220#else
1221 AssertFailed();
1222 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1223#endif
1224 default: /* shut up gcc */
1225 AssertFailed();
1226 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1227 }
1228 }
1229 else
1230 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1231 {
1232 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1233 val |= X86_CR4_PSE;
1234 /* Our identity mapping is a 32 bits page directory. */
1235 val &= ~X86_CR4_PAE;
1236 }
1237
1238#ifdef HWACCM_VMX_EMULATE_REALMODE
1239 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1240 if (CPUMIsGuestInRealModeEx(pCtx))
1241 val |= X86_CR4_VME;
1242#endif /* HWACCM_VMX_EMULATE_REALMODE */
1243
1244 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1245 Log2(("Guest CR4 %08x\n", val));
1246 /* CR4 flags owned by the host; if the guests attempts to change them, then
1247 * the VM will exit.
1248 */
1249 val = 0
1250#ifdef HWACCM_VMX_EMULATE_REALMODE
1251 | X86_CR4_VME
1252#endif
1253 | X86_CR4_PAE
1254 | X86_CR4_PGE
1255 | X86_CR4_PSE
1256 | X86_CR4_VMXE;
1257 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1258
1259 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1260 Log2(("Guest CR4-mask %08x\n", val));
1261 AssertRC(rc);
1262 }
1263
1264 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1265 {
1266 if (pVM->hwaccm.s.fNestedPaging)
1267 {
1268 AssertMsg(PGMGetEPTCR3(pVM) == PGMGetHyperCR3(pVM), ("%RHp vs %RHp\n", PGMGetEPTCR3(pVM), PGMGetHyperCR3(pVM)));
1269 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetEPTCR3(pVM);
1270
1271 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1272 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1273 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1274 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1275
1276 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1277#if HC_ARCH_BITS == 32
1278 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_HIGH, (uint32_t)(pVCpu->hwaccm.s.vmx.GCPhysEPTP >> 32ULL));
1279#endif
1280 AssertRC(rc);
1281
1282 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1283 {
1284 RTGCPHYS GCPhys;
1285
1286 /* We convert it here every time as pci regions could be reconfigured. */
1287 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1288 AssertRC(rc);
1289
1290 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1291 * take care of the translation to host physical addresses.
1292 */
1293 val = GCPhys;
1294 }
1295 else
1296 {
1297 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1298 val = pCtx->cr3;
1299 /* Prefetch the four PDPT entries in PAE mode. */
1300 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1301 }
1302 }
1303 else
1304 {
1305 val = PGMGetHyperCR3(pVM);
1306 Assert(val);
1307 }
1308
1309 /* Save our shadow CR3 register. */
1310 rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1311 AssertRC(rc);
1312 }
1313
1314 /* Debug registers. */
1315 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1316 {
1317 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1318 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1319
1320 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1321 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1322 pCtx->dr[7] |= 0x400; /* must be one */
1323
1324 /* Resync DR7 */
1325 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1326 AssertRC(rc);
1327
1328 /* Sync the debug state now if any breakpoint is armed. */
1329 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1330 && !CPUMIsGuestDebugStateActive(pVM)
1331 && !DBGFIsStepping(pVM))
1332 {
1333 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1334
1335 /* Disable drx move intercepts. */
1336 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1337 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1338 AssertRC(rc);
1339
1340 /* Save the host and load the guest debug state. */
1341 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1342 AssertRC(rc);
1343 }
1344
1345 /* IA32_DEBUGCTL MSR. */
1346 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1347 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
1348 AssertRC(rc);
1349
1350 /** @todo do we really ever need this? */
1351 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1352 AssertRC(rc);
1353 }
1354
1355 /* EIP, ESP and EFLAGS */
1356 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1357 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1358 AssertRC(rc);
1359
1360 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1361 eflags = pCtx->eflags;
1362 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1363 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1364
1365#ifdef HWACCM_VMX_EMULATE_REALMODE
1366 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1367 if (CPUMIsGuestInRealModeEx(pCtx))
1368 {
1369 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1370
1371 eflags.Bits.u1VM = 1;
1372 eflags.Bits.u2IOPL = 3;
1373 }
1374#endif /* HWACCM_VMX_EMULATE_REALMODE */
1375 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1376 AssertRC(rc);
1377
1378 /* TSC offset. */
1379 uint64_t u64TSCOffset;
1380
1381 if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1382 {
1383 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1384 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1385#if HC_ARCH_BITS == 32
1386 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
1387#endif
1388 AssertRC(rc);
1389
1390 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1391 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1392 AssertRC(rc);
1393 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1394 }
1395 else
1396 {
1397 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1398 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1399 AssertRC(rc);
1400 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1401 }
1402
1403 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1404 * Set required bits to one and zero according to the MSR capabilities.
1405 */
1406 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1407 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1408 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1409
1410 /* 64 bits guest mode? */
1411 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1412 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1413 /* else Must be zero when AMD64 is not available. */
1414
1415 /* Mask away the bits that the CPU doesn't support */
1416 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1417 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1418 AssertRC(rc);
1419
1420 /* 64 bits guest mode? */
1421 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1422 {
1423#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
1424 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1425#else
1426 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1427#endif
1428 /* Unconditionally update these as wrmsr might have changed them. */
1429 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1430 AssertRC(rc);
1431 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1432 AssertRC(rc);
1433 }
1434 else
1435 {
1436 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1437 }
1438
1439 vmxR0UpdateExceptionBitmap(pVM, pVCpu, pCtx);
1440
1441 /* Done. */
1442 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1443
1444 return rc;
1445}
1446
1447/**
1448 * Syncs back the guest state
1449 *
1450 * @returns VBox status code.
1451 * @param pVM The VM to operate on.
1452 * @param pVCpu The VMCPU to operate on.
1453 * @param pCtx Guest context
1454 */
1455DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1456{
1457 RTCCUINTREG val, valShadow;
1458 RTGCUINTPTR uInterruptState;
1459 int rc;
1460
1461 /* Let's first sync back eip, esp, and eflags. */
1462 rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1463 AssertRC(rc);
1464 pCtx->rip = val;
1465 rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1466 AssertRC(rc);
1467 pCtx->rsp = val;
1468 rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1469 AssertRC(rc);
1470 pCtx->eflags.u32 = val;
1471
1472 /* Take care of instruction fusing (sti, mov ss) */
1473 rc |= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1474 uInterruptState = val;
1475 if (uInterruptState != 0)
1476 {
1477 Assert(uInterruptState <= 2); /* only sti & mov ss */
1478 Log(("uInterruptState %x eip=%RGv\n", uInterruptState, pCtx->rip));
1479 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1480 }
1481 else
1482 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1483
1484 /* Control registers. */
1485 VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1486 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1487 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
1488 CPUMSetGuestCR0(pVM, val);
1489
1490 VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1491 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1492 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
1493 CPUMSetGuestCR4(pVM, val);
1494
1495 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
1496 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1497 if ( pVM->hwaccm.s.fNestedPaging
1498 && CPUMIsGuestInPagedProtectedModeEx(pCtx))
1499 {
1500 /* Can be updated behind our back in the nested paging case. */
1501 CPUMSetGuestCR2(pVM, ASMGetCR2());
1502
1503 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
1504
1505 if (val != pCtx->cr3)
1506 {
1507 CPUMSetGuestCR3(pVM, val);
1508 PGMUpdateCR3(pVM, val);
1509 }
1510 /* Prefetch the four PDPT entries in PAE mode. */
1511 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1512 }
1513
1514 /* Sync back DR7 here. */
1515 VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1516 pCtx->dr[7] = val;
1517
1518 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1519 VMX_READ_SELREG(ES, es);
1520 VMX_READ_SELREG(SS, ss);
1521 VMX_READ_SELREG(CS, cs);
1522 VMX_READ_SELREG(DS, ds);
1523 VMX_READ_SELREG(FS, fs);
1524 VMX_READ_SELREG(GS, gs);
1525
1526 /*
1527 * System MSRs
1528 */
1529 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
1530 pCtx->SysEnter.cs = val;
1531 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1532 pCtx->SysEnter.eip = val;
1533 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1534 pCtx->SysEnter.esp = val;
1535
1536 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1537 VMX_READ_SELREG(LDTR, ldtr);
1538
1539 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
1540 pCtx->gdtr.cbGdt = val;
1541 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1542 pCtx->gdtr.pGdt = val;
1543
1544 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
1545 pCtx->idtr.cbIdt = val;
1546 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1547 pCtx->idtr.pIdt = val;
1548
1549#ifdef HWACCM_VMX_EMULATE_REALMODE
1550 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1551 if (CPUMIsGuestInRealModeEx(pCtx))
1552 {
1553 /* Hide our emulation flags */
1554 pCtx->eflags.Bits.u1VM = 0;
1555 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
1556
1557 /* Force a TR resync every time in case we switch modes. */
1558 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
1559 }
1560 else
1561#endif /* HWACCM_VMX_EMULATE_REALMODE */
1562 {
1563 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1564 VMX_READ_SELREG(TR, tr);
1565 }
1566 return VINF_SUCCESS;
1567}
1568
1569/**
1570 * Dummy placeholder
1571 *
1572 * @param pVM The VM to operate on.
1573 * @param pVCpu The VMCPU to operate on.
1574 */
1575static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu)
1576{
1577 NOREF(pVM);
1578 NOREF(pVCpu);
1579 return;
1580}
1581
1582/**
1583 * Setup the tagged TLB for EPT
1584 *
1585 * @returns VBox status code.
1586 * @param pVM The VM to operate on.
1587 * @param pVCpu The VMCPU to operate on.
1588 */
1589static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu)
1590{
1591 PHWACCM_CPUINFO pCpu;
1592
1593 Assert(pVM->hwaccm.s.fNestedPaging);
1594 Assert(!pVM->hwaccm.s.vmx.fVPID);
1595
1596 /* Deal with tagged TLBs if VPID or EPT is supported. */
1597 pCpu = HWACCMR0GetCurrentCpu();
1598 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1599 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1600 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1601 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1602 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1603 {
1604 /* Force a TLB flush on VM entry. */
1605 pVCpu->hwaccm.s.fForceTLBFlush = true;
1606 }
1607 else
1608 Assert(!pCpu->fFlushTLB);
1609
1610 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1611 pCpu->fFlushTLB = false;
1612
1613 if (pVCpu->hwaccm.s.fForceTLBFlush)
1614 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1615
1616#ifdef VBOX_WITH_STATISTICS
1617 if (pVCpu->hwaccm.s.fForceTLBFlush)
1618 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1619 else
1620 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1621#endif
1622}
1623
1624#ifdef HWACCM_VTX_WITH_VPID
1625/**
1626 * Setup the tagged TLB for VPID
1627 *
1628 * @returns VBox status code.
1629 * @param pVM The VM to operate on.
1630 * @param pVCpu The VMCPU to operate on.
1631 */
1632static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu)
1633{
1634 PHWACCM_CPUINFO pCpu;
1635
1636 Assert(pVM->hwaccm.s.vmx.fVPID);
1637 Assert(!pVM->hwaccm.s.fNestedPaging);
1638
1639 /* Deal with tagged TLBs if VPID or EPT is supported. */
1640 pCpu = HWACCMR0GetCurrentCpu();
1641 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1642 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1643 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1644 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1645 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1646 {
1647 /* Force a TLB flush on VM entry. */
1648 pVCpu->hwaccm.s.fForceTLBFlush = true;
1649 }
1650 else
1651 Assert(!pCpu->fFlushTLB);
1652
1653 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1654
1655 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1656 if (pVCpu->hwaccm.s.fForceTLBFlush)
1657 {
1658 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1659 || pCpu->fFlushTLB)
1660 {
1661 pCpu->fFlushTLB = false;
1662 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1663 pCpu->cTLBFlushes++;
1664 }
1665 else
1666 {
1667 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1668 pVCpu->hwaccm.s.fForceTLBFlush = false;
1669 }
1670
1671 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1672 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1673 }
1674 else
1675 {
1676 Assert(!pCpu->fFlushTLB);
1677
1678 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1679 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1680 }
1681 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1682 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1683 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1684
1685 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
1686 AssertRC(rc);
1687
1688 if (pVCpu->hwaccm.s.fForceTLBFlush)
1689 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1690
1691#ifdef VBOX_WITH_STATISTICS
1692 if (pVCpu->hwaccm.s.fForceTLBFlush)
1693 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1694 else
1695 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1696#endif
1697}
1698#endif /* HWACCM_VTX_WITH_VPID */
1699
1700/**
1701 * Runs guest code in a VT-x VM.
1702 *
1703 * @returns VBox status code.
1704 * @param pVM The VM to operate on.
1705 * @param pVCpu The VMCPU to operate on.
1706 * @param pCtx Guest context
1707 */
1708VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1709{
1710 int rc = VINF_SUCCESS;
1711 RTCCUINTREG val;
1712 RTCCUINTREG exitReason, instrError, cbInstr;
1713 RTGCUINTPTR exitQualification;
1714 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1715 RTGCUINTPTR errCode, instrInfo;
1716 bool fSyncTPR = false;
1717 PHWACCM_CPUINFO pCpu = 0;
1718 unsigned cResume = 0;
1719#ifdef VBOX_STRICT
1720 RTCPUID idCpuCheck;
1721#endif
1722
1723 Log2(("\nE"));
1724
1725 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
1726
1727#ifdef VBOX_STRICT
1728 rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1729 AssertRC(rc);
1730 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1731
1732 /* allowed zero */
1733 if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1734 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1735
1736 /* allowed one */
1737 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1738 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1739
1740 rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1741 AssertRC(rc);
1742 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1743
1744 /* Must be set according to the MSR, but can be cleared in case of EPT. */
1745 if (pVM->hwaccm.s.fNestedPaging)
1746 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
1747 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1748 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1749
1750 /* allowed zero */
1751 if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1752 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1753
1754 /* allowed one */
1755 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1756 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1757
1758 rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1759 AssertRC(rc);
1760 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1761
1762 /* allowed zero */
1763 if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1764 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1765
1766 /* allowed one */
1767 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1768 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1769
1770 rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1771 AssertRC(rc);
1772 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1773
1774 /* allowed zero */
1775 if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1776 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1777
1778 /* allowed one */
1779 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1780 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1781#endif
1782
1783 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1784 */
1785ResumeExecution:
1786 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1787 ("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1788 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1789 Assert(!HWACCMR0SuspendPending());
1790
1791 /* Safety precaution; looping for too long here can have a very bad effect on the host */
1792 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1793 {
1794 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
1795 rc = VINF_EM_RAW_INTERRUPT;
1796 goto end;
1797 }
1798
1799 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1800 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1801 {
1802 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1803 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1804 {
1805 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1806 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1807 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1808 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1809 */
1810 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1811 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1812 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1813 AssertRC(rc);
1814 }
1815 }
1816 else
1817 {
1818 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1819 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1820 AssertRC(rc);
1821 }
1822
1823 /* Check for pending actions that force us to go back to ring 3. */
1824 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
1825 {
1826 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1827 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1828 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1829 rc = VINF_EM_RAW_TO_R3;
1830 goto end;
1831 }
1832 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1833 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1834 {
1835 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1836 rc = VINF_EM_PENDING_REQUEST;
1837 goto end;
1838 }
1839
1840 /* When external interrupts are pending, we should exit the VM when IF is set. */
1841 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1842 rc = VMXR0CheckPendingInterrupt(pVM, pVCpu, pCtx);
1843 if (RT_FAILURE(rc))
1844 {
1845 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1846 goto end;
1847 }
1848
1849 /** @todo check timers?? */
1850
1851 /* TPR caching using CR8 is only available in 64 bits mode */
1852 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1853 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1854 /**
1855 * @todo reduce overhead
1856 */
1857 if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1858 && pVM->hwaccm.s.vmx.pAPIC)
1859 {
1860 /* TPR caching in CR8 */
1861 uint8_t u8TPR;
1862 bool fPending;
1863
1864 int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1865 AssertRC(rc);
1866 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
1867 pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1868
1869 /* Two options here:
1870 * - external interrupt pending, but masked by the TPR value.
1871 * -> a CR8 update that lower the current TPR value should cause an exit
1872 * - no pending interrupts
1873 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1874 */
1875 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1876 AssertRC(rc);
1877
1878 /* Always sync back the TPR; we should optimize this though */ /** @todo optimize TPR sync. */
1879 fSyncTPR = true;
1880 }
1881
1882#if defined(HWACCM_VTX_WITH_EPT) && defined(LOG_ENABLED)
1883 if ( pVM->hwaccm.s.fNestedPaging
1884# ifdef HWACCM_VTX_WITH_VPID
1885 || pVM->hwaccm.s.vmx.fVPID
1886# endif /* HWACCM_VTX_WITH_VPID */
1887 )
1888 {
1889 pCpu = HWACCMR0GetCurrentCpu();
1890 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1891 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1892 {
1893 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1894 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1895 else
1896 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1897 }
1898 if (pCpu->fFlushTLB)
1899 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1900 else
1901 if (pVCpu->hwaccm.s.fForceTLBFlush)
1902 LogFlow(("Manual TLB flush\n"));
1903 }
1904#endif
1905
1906 /*
1907 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1908 * (until the actual world switch)
1909 */
1910#ifdef VBOX_STRICT
1911 idCpuCheck = RTMpCpuId();
1912#endif
1913 /* Save the host state first. */
1914 rc = VMXR0SaveHostState(pVM, pVCpu);
1915 if (rc != VINF_SUCCESS)
1916 {
1917 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1918 goto end;
1919 }
1920 /* Load the guest state */
1921 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
1922 if (rc != VINF_SUCCESS)
1923 {
1924 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1925 goto end;
1926 }
1927
1928 /* Deal with tagged TLB setup and invalidation. */
1929 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
1930
1931 /* Non-register state Guest Context */
1932 /** @todo change me according to cpu state */
1933 rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1934 AssertRC(rc);
1935
1936 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1937
1938 /* Manual save and restore:
1939 * - General purpose registers except RIP, RSP
1940 *
1941 * Trashed:
1942 * - CR2 (we don't care)
1943 * - LDTR (reset to 0)
1944 * - DRx (presumably not changed at all)
1945 * - DR7 (reset to 0x400)
1946 * - EFLAGS (reset to RT_BIT(1); not relevant)
1947 *
1948 */
1949
1950 /* All done! Let's start VM execution. */
1951 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1952#ifdef VBOX_STRICT
1953 Assert(idCpuCheck == RTMpCpuId());
1954#endif
1955 TMNotifyStartOfExecution(pVM);
1956 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx);
1957 TMNotifyEndOfExecution(pVM);
1958
1959 /* In case we execute a goto ResumeExecution later on. */
1960 pVCpu->hwaccm.s.fResumeVM = true;
1961 pVCpu->hwaccm.s.fForceTLBFlush = false;
1962
1963 /*
1964 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1965 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1966 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1967 */
1968
1969 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1970 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit, x);
1971
1972 if (rc != VINF_SUCCESS)
1973 {
1974 VMXR0ReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
1975 goto end;
1976 }
1977 /* Success. Query the guest state and figure out what has happened. */
1978
1979 /* Investigate why there was a VM-exit. */
1980 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1981 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1982
1983 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1984 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1985 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
1986 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
1987 intInfo = val;
1988 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1989 errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1990 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
1991 instrInfo = val;
1992 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1993 exitQualification = val;
1994 AssertRC(rc);
1995
1996 /* Sync back the guest state */
1997 rc = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
1998 AssertRC(rc);
1999
2000 /* Note! NOW IT'S SAFE FOR LOGGING! */
2001 Log2(("Raw exit reason %08x\n", exitReason));
2002
2003 /* Check if an injected event was interrupted prematurely. */
2004 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
2005 AssertRC(rc);
2006 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
2007 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2008 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW)
2009 {
2010 pVCpu->hwaccm.s.Event.fPending = true;
2011 /* Error code present? */
2012 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2013 {
2014 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
2015 AssertRC(rc);
2016 pVCpu->hwaccm.s.Event.errCode = val;
2017 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2018 }
2019 else
2020 {
2021 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2022 pVCpu->hwaccm.s.Event.errCode = 0;
2023 }
2024 }
2025
2026#ifdef VBOX_STRICT
2027 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2028 HWACCMDumpRegs(pVM, pCtx);
2029#endif
2030
2031 Log2(("E%d", exitReason));
2032 Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
2033 Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
2034 Log2(("Interruption error code %d\n", errCode));
2035 Log2(("IntInfo = %08x\n", intInfo));
2036 Log2(("New EIP=%RGv\n", (RTGCPTR)pCtx->rip));
2037
2038 if (fSyncTPR)
2039 {
2040 rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
2041 AssertRC(rc);
2042 }
2043
2044 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2045 switch (exitReason)
2046 {
2047 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2048 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2049 {
2050 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2051
2052 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2053 {
2054 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2055 /* External interrupt; leave to allow it to be dispatched again. */
2056 rc = VINF_EM_RAW_INTERRUPT;
2057 break;
2058 }
2059 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2060 {
2061 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2062 /* External interrupt; leave to allow it to be dispatched again. */
2063 rc = VINF_EM_RAW_INTERRUPT;
2064 break;
2065
2066 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2067 AssertFailed(); /* can't come here; fails the first check. */
2068 break;
2069
2070 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
2071 Assert(vector == 3 || vector == 4);
2072 /* no break */
2073 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
2074 Log2(("Hardware/software interrupt %d\n", vector));
2075 switch (vector)
2076 {
2077 case X86_XCPT_NM:
2078 {
2079 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
2080
2081 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
2082 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
2083 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
2084 if (rc == VINF_SUCCESS)
2085 {
2086 Assert(CPUMIsGuestFPUStateActive(pVCpu));
2087
2088 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
2089
2090 /* Continue execution. */
2091 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2092 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2093
2094 goto ResumeExecution;
2095 }
2096
2097 Log(("Forward #NM fault to the guest\n"));
2098 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
2099 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
2100 AssertRC(rc);
2101 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2102 goto ResumeExecution;
2103 }
2104
2105 case X86_XCPT_PF: /* Page fault */
2106 {
2107#ifdef DEBUG
2108 if (pVM->hwaccm.s.fNestedPaging)
2109 { /* A genuine pagefault.
2110 * Forward the trap to the guest by injecting the exception and resuming execution.
2111 */
2112 Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
2113
2114 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
2115
2116 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2117
2118 /* Now we must update CR2. */
2119 pCtx->cr2 = exitQualification;
2120 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2121 AssertRC(rc);
2122
2123 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2124 goto ResumeExecution;
2125 }
2126#endif
2127 Assert(!pVM->hwaccm.s.fNestedPaging);
2128
2129 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
2130 /* Exit qualification contains the linear address of the page fault. */
2131 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2132 TRPMSetErrorCode(pVM, errCode);
2133 TRPMSetFaultAddress(pVM, exitQualification);
2134
2135 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
2136 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
2137 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2138 if (rc == VINF_SUCCESS)
2139 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2140 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
2141 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2142
2143 TRPMResetTrap(pVM);
2144
2145 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2146 goto ResumeExecution;
2147 }
2148 else
2149 if (rc == VINF_EM_RAW_GUEST_TRAP)
2150 { /* A genuine pagefault.
2151 * Forward the trap to the guest by injecting the exception and resuming execution.
2152 */
2153 Log2(("Forward page fault to the guest\n"));
2154
2155 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2156 /* The error code might have been changed. */
2157 errCode = TRPMGetErrorCode(pVM);
2158
2159 TRPMResetTrap(pVM);
2160
2161 /* Now we must update CR2. */
2162 pCtx->cr2 = exitQualification;
2163 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2164 AssertRC(rc);
2165
2166 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2167 goto ResumeExecution;
2168 }
2169#ifdef VBOX_STRICT
2170 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2171 Log2(("PGMTrap0eHandler failed with %d\n", rc));
2172#endif
2173 /* Need to go back to the recompiler to emulate the instruction. */
2174 TRPMResetTrap(pVM);
2175 break;
2176 }
2177
2178 case X86_XCPT_MF: /* Floating point exception. */
2179 {
2180 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
2181 if (!(pCtx->cr0 & X86_CR0_NE))
2182 {
2183 /* old style FPU error reporting needs some extra work. */
2184 /** @todo don't fall back to the recompiler, but do it manually. */
2185 rc = VINF_EM_RAW_EMULATE_INSTR;
2186 break;
2187 }
2188 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2189 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2190 AssertRC(rc);
2191
2192 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2193 goto ResumeExecution;
2194 }
2195
2196 case X86_XCPT_DB: /* Debug exception. */
2197 {
2198 uint64_t uDR6;
2199
2200 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
2201 *
2202 * Exit qualification bits:
2203 * 3:0 B0-B3 which breakpoint condition was met
2204 * 12:4 Reserved (0)
2205 * 13 BD - debug register access detected
2206 * 14 BS - single step execution or branch taken
2207 * 63:15 Reserved (0)
2208 */
2209 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
2210
2211 /* Note that we don't support guest and host-initiated debugging at the same time. */
2212 Assert(DBGFIsStepping(pVM) || CPUMIsGuestInRealModeEx(pCtx));
2213
2214 uDR6 = X86_DR6_INIT_VAL;
2215 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
2216 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
2217 if (rc == VINF_EM_RAW_GUEST_TRAP)
2218 {
2219 /** @todo this isn't working, but we'll never get here normally. */
2220
2221 /* Update DR6 here. */
2222 pCtx->dr[6] = uDR6;
2223
2224 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2225 pCtx->dr[7] &= ~X86_DR7_GD;
2226
2227 /* Paranoia. */
2228 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2229 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2230 pCtx->dr[7] |= 0x400; /* must be one */
2231
2232 /* Resync DR7 */
2233 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2234 AssertRC(rc);
2235
2236 Log(("Trap %x (debug) at %RGv exit qualification %RX64\n", vector, (RTGCPTR)pCtx->rip, exitQualification));
2237 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2238 AssertRC(rc);
2239
2240 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2241 goto ResumeExecution;
2242 }
2243 /* Return to ring 3 to deal with the debug exit code. */
2244 break;
2245 }
2246
2247 case X86_XCPT_GP: /* General protection failure exception.*/
2248 {
2249 uint32_t cbSize;
2250
2251 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
2252#ifdef VBOX_STRICT
2253 if (!CPUMIsGuestInRealModeEx(pCtx))
2254 {
2255 Log(("Trap %x at %04X:%RGv errorCode=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
2256 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2257 AssertRC(rc);
2258 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2259 goto ResumeExecution;
2260 }
2261#endif
2262 Assert(CPUMIsGuestInRealModeEx(pCtx));
2263
2264 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %RGv\n", (RTGCPTR)pCtx->rip));
2265 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2266 if (rc == VINF_SUCCESS)
2267 {
2268 /* EIP has been updated already. */
2269
2270 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2271 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2272
2273 /* Only resume if successful. */
2274 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2275 goto ResumeExecution;
2276 }
2277 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", rc));
2278 break;
2279 }
2280
2281#ifdef VBOX_STRICT
2282 case X86_XCPT_DE: /* Divide error. */
2283 case X86_XCPT_UD: /* Unknown opcode exception. */
2284 case X86_XCPT_SS: /* Stack segment exception. */
2285 case X86_XCPT_NP: /* Segment not present exception. */
2286 {
2287 switch(vector)
2288 {
2289 case X86_XCPT_DE:
2290 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
2291 break;
2292 case X86_XCPT_UD:
2293 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
2294 break;
2295 case X86_XCPT_SS:
2296 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
2297 break;
2298 case X86_XCPT_NP:
2299 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
2300 break;
2301 }
2302
2303 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2304 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2305 AssertRC(rc);
2306
2307 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2308 goto ResumeExecution;
2309 }
2310#endif
2311 default:
2312#ifdef HWACCM_VMX_EMULATE_REALMODE
2313 if (CPUMIsGuestInRealModeEx(pCtx))
2314 {
2315 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
2316 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2317 AssertRC(rc);
2318
2319 /* Go back to ring 3 in case of a triple fault. */
2320 if ( vector == X86_XCPT_DF
2321 && rc == VINF_EM_RESET)
2322 break;
2323
2324 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2325 goto ResumeExecution;
2326 }
2327#endif
2328 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2329 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2330 break;
2331 } /* switch (vector) */
2332
2333 break;
2334
2335 default:
2336 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2337 AssertFailed();
2338 break;
2339 }
2340
2341 break;
2342 }
2343
2344 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
2345 {
2346 RTGCPHYS GCPhys;
2347
2348 Assert(pVM->hwaccm.s.fNestedPaging);
2349
2350#if HC_ARCH_BITS == 64
2351 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2352 AssertRC(rc);
2353#else
2354 uint32_t val_hi;
2355 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &val);
2356 AssertRC(rc);
2357 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_HIGH, &val_hi);
2358 AssertRC(rc);
2359 GCPhys = RT_MAKE_U64(val, val_hi);
2360#endif
2361
2362 Assert(((exitQualification >> 7) & 3) != 2);
2363
2364 /* Determine the kind of violation. */
2365 errCode = 0;
2366 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
2367 errCode |= X86_TRAP_PF_ID;
2368
2369 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
2370 errCode |= X86_TRAP_PF_RW;
2371
2372 /* If the page is present, then it's a page level protection fault. */
2373 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
2374 errCode |= X86_TRAP_PF_P;
2375
2376 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
2377
2378 /* GCPhys contains the guest physical address of the page fault. */
2379 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2380 TRPMSetErrorCode(pVM, errCode);
2381 TRPMSetFaultAddress(pVM, GCPhys);
2382
2383 /* Handle the pagefault trap for the nested shadow table. */
2384 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
2385 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2386 if (rc == VINF_SUCCESS)
2387 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2388 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
2389 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2390
2391 TRPMResetTrap(pVM);
2392
2393 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2394 goto ResumeExecution;
2395 }
2396
2397#ifdef VBOX_STRICT
2398 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2399 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
2400#endif
2401 /* Need to go back to the recompiler to emulate the instruction. */
2402 TRPMResetTrap(pVM);
2403 break;
2404 }
2405
2406 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2407 /* Clear VM-exit on IF=1 change. */
2408 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2409 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2411 AssertRC(rc);
2412 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
2413 goto ResumeExecution; /* we check for pending guest interrupts there */
2414
2415 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2416 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2417 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
2418 /* Skip instruction and continue directly. */
2419 pCtx->rip += cbInstr;
2420 /* Continue execution.*/
2421 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2422 goto ResumeExecution;
2423
2424 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2425 {
2426 Log2(("VMX: Cpuid %x\n", pCtx->eax));
2427 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
2428 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2429 if (rc == VINF_SUCCESS)
2430 {
2431 /* Update EIP and continue execution. */
2432 Assert(cbInstr == 2);
2433 pCtx->rip += cbInstr;
2434 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2435 goto ResumeExecution;
2436 }
2437 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
2438 rc = VINF_EM_RAW_EMULATE_INSTR;
2439 break;
2440 }
2441
2442 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2443 {
2444 Log2(("VMX: Rdtsc\n"));
2445 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
2446 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2447 if (rc == VINF_SUCCESS)
2448 {
2449 /* Update EIP and continue execution. */
2450 Assert(cbInstr == 2);
2451 pCtx->rip += cbInstr;
2452 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2453 goto ResumeExecution;
2454 }
2455 AssertMsgFailed(("EMU: rdtsc failed with %Rrc\n", rc));
2456 rc = VINF_EM_RAW_EMULATE_INSTR;
2457 break;
2458 }
2459
2460 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2461 {
2462 Log2(("VMX: invlpg\n"));
2463 Assert(!pVM->hwaccm.s.fNestedPaging);
2464
2465 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
2466 rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2467 if (rc == VINF_SUCCESS)
2468 {
2469 /* Update EIP and continue execution. */
2470 pCtx->rip += cbInstr;
2471 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2472 goto ResumeExecution;
2473 }
2474 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, rc));
2475 break;
2476 }
2477
2478 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2479 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2480 {
2481 uint32_t cbSize;
2482
2483 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2484 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2485 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2486 if (rc == VINF_SUCCESS)
2487 {
2488 /* EIP has been updated already. */
2489
2490 /* Only resume if successful. */
2491 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2492 goto ResumeExecution;
2493 }
2494 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2495 break;
2496 }
2497
2498 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2499 {
2500 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2501 {
2502 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2503 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2504 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite);
2505 rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2506 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2507 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2508
2509 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2510 {
2511 case 0:
2512 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
2513 break;
2514 case 2:
2515 break;
2516 case 3:
2517 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
2518 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
2519 break;
2520 case 4:
2521 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
2522 break;
2523 case 8:
2524 /* CR8 contains the APIC TPR */
2525 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2526 break;
2527
2528 default:
2529 AssertFailed();
2530 break;
2531 }
2532 /* Check if a sync operation is pending. */
2533 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2534 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2535 {
2536 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2537 AssertRC(rc);
2538 }
2539 break;
2540
2541 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2542 Log2(("VMX: mov x, crx\n"));
2543 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead);
2544
2545 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
2546
2547 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2548 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2549
2550 rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2551 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2552 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2553 break;
2554
2555 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2556 Log2(("VMX: clts\n"));
2557 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
2558 rc = EMInterpretCLTS(pVM);
2559 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2560 break;
2561
2562 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2563 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2564 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
2565 rc = EMInterpretLMSW(pVM, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2566 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2567 break;
2568 }
2569
2570 /* Update EIP if no error occurred. */
2571 if (RT_SUCCESS(rc))
2572 pCtx->rip += cbInstr;
2573
2574 if (rc == VINF_SUCCESS)
2575 {
2576 /* Only resume if successful. */
2577 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2578 goto ResumeExecution;
2579 }
2580 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2581 break;
2582 }
2583
2584 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2585 {
2586 if (!DBGFIsStepping(pVM))
2587 {
2588 /* Disable drx move intercepts. */
2589 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2590 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2591 AssertRC(rc);
2592
2593 /* Save the host and load the guest debug state. */
2594 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2595 AssertRC(rc);
2596
2597#ifdef VBOX_WITH_STATISTICS
2598 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2599 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2600 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2601 else
2602 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2603#endif
2604
2605 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2606 goto ResumeExecution;
2607 }
2608
2609 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2610 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2611 {
2612 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2613 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2614 rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2615 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2616 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2617 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2618 Log2(("DR7=%08x\n", pCtx->dr[7]));
2619 }
2620 else
2621 {
2622 Log2(("VMX: mov x, drx\n"));
2623 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2624 rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2625 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2626 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2627 }
2628 /* Update EIP if no error occurred. */
2629 if (RT_SUCCESS(rc))
2630 pCtx->rip += cbInstr;
2631
2632 if (rc == VINF_SUCCESS)
2633 {
2634 /* Only resume if successful. */
2635 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2636 goto ResumeExecution;
2637 }
2638 Assert(rc == VERR_EM_INTERPRETER);
2639 break;
2640 }
2641
2642 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2643 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2644 {
2645 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2646 uint32_t uPort;
2647 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2648
2649 /** @todo necessary to make the distinction? */
2650 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2651 {
2652 uPort = pCtx->edx & 0xffff;
2653 }
2654 else
2655 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2656
2657 /* paranoia */
2658 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
2659 {
2660 rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2661 break;
2662 }
2663
2664 uint32_t cbSize = g_aIOSize[uIOWidth];
2665
2666 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2667 {
2668 /* ins/outs */
2669 uint32_t prefix = 0;
2670 if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2671 prefix |= PREFIX_REP;
2672
2673 if (fIOWrite)
2674 {
2675 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2676 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2677 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2678 }
2679 else
2680 {
2681 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2682 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2683 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2684 }
2685 }
2686 else
2687 {
2688 /* normal in/out */
2689 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2690
2691 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2692
2693 if (fIOWrite)
2694 {
2695 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2696 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2697 }
2698 else
2699 {
2700 uint32_t u32Val = 0;
2701
2702 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2703 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2704 if (IOM_SUCCESS(rc))
2705 {
2706 /* Write back to the EAX register. */
2707 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2708 }
2709 }
2710 }
2711 /*
2712 * Handled the I/O return codes.
2713 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2714 */
2715 if (IOM_SUCCESS(rc))
2716 {
2717 /* Update EIP and continue execution. */
2718 pCtx->rip += cbInstr;
2719 if (RT_LIKELY(rc == VINF_SUCCESS))
2720 {
2721 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2722 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2723 {
2724 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2725 for (unsigned i=0;i<4;i++)
2726 {
2727 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2728
2729 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2730 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2731 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2732 {
2733 uint64_t uDR6;
2734
2735 Assert(CPUMIsGuestDebugStateActive(pVM));
2736
2737 uDR6 = ASMGetDR6();
2738
2739 /* Clear all breakpoint status flags and set the one we just hit. */
2740 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2741 uDR6 |= (uint64_t)RT_BIT(i);
2742
2743 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2744 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2745 * the contents have been read.
2746 */
2747 ASMSetDR6(uDR6);
2748
2749 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2750 pCtx->dr[7] &= ~X86_DR7_GD;
2751
2752 /* Paranoia. */
2753 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2754 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2755 pCtx->dr[7] |= 0x400; /* must be one */
2756
2757 /* Resync DR7 */
2758 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2759 AssertRC(rc);
2760
2761 /* Construct inject info. */
2762 intInfo = X86_XCPT_DB;
2763 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2764 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2765
2766 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2767 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2768 AssertRC(rc);
2769
2770 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2771 goto ResumeExecution;
2772 }
2773 }
2774 }
2775
2776 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2777 goto ResumeExecution;
2778 }
2779 break;
2780 }
2781
2782#ifdef VBOX_STRICT
2783 if (rc == VINF_IOM_HC_IOPORT_READ)
2784 Assert(!fIOWrite);
2785 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2786 Assert(fIOWrite);
2787 else
2788 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2789#endif
2790 break;
2791 }
2792
2793 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2794 LogFlow(("VMX_EXIT_TPR\n"));
2795 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2796 goto ResumeExecution;
2797
2798 default:
2799 /* The rest is handled after syncing the entire CPU state. */
2800 break;
2801 }
2802
2803 /* Note: the guest state isn't entirely synced back at this stage. */
2804
2805 /* Investigate why there was a VM-exit. (part 2) */
2806 switch (exitReason)
2807 {
2808 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2809 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2810 case VMX_EXIT_EPT_VIOLATION:
2811 /* Already handled above. */
2812 break;
2813
2814 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2815 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2816 break;
2817
2818 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2819 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2820 rc = VINF_EM_RAW_INTERRUPT;
2821 AssertFailed(); /* Can't happen. Yet. */
2822 break;
2823
2824 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2825 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2826 rc = VINF_EM_RAW_INTERRUPT;
2827 AssertFailed(); /* Can't happen afaik. */
2828 break;
2829
2830 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2831 rc = VERR_EM_INTERPRETER;
2832 break;
2833
2834 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2835 /** Check if external interrupts are pending; if so, don't switch back. */
2836 pCtx->rip++; /* skip hlt */
2837 if ( pCtx->eflags.Bits.u1IF
2838 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
2839 goto ResumeExecution;
2840
2841 rc = VINF_EM_HALT;
2842 break;
2843
2844 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2845 AssertFailed(); /* can't happen. */
2846 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2847 break;
2848
2849 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2850 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2851 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2852 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2853 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2854 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2855 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2856 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2857 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2858 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2859 /** @todo inject #UD immediately */
2860 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2861 break;
2862
2863 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2864 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2865 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2866 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2867 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2868 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2869 /* already handled above */
2870 AssertMsg( rc == VINF_PGM_CHANGE_MODE
2871 || rc == VINF_EM_RAW_INTERRUPT
2872 || rc == VERR_EM_INTERPRETER
2873 || rc == VINF_EM_RAW_EMULATE_INSTR
2874 || rc == VINF_PGM_SYNC_CR3
2875 || rc == VINF_IOM_HC_IOPORT_READ
2876 || rc == VINF_IOM_HC_IOPORT_WRITE
2877 || rc == VINF_EM_RAW_GUEST_TRAP
2878 || rc == VINF_TRPM_XCPT_DISPATCHED
2879 || rc == VINF_EM_RESCHEDULE_REM,
2880 ("rc = %d\n", rc));
2881 break;
2882
2883 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2884 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2885 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2886 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2887 rc = VERR_EM_INTERPRETER;
2888 break;
2889
2890 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2891 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2892 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2893 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2894 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2895 break;
2896
2897 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2898 Assert(rc == VINF_EM_RAW_INTERRUPT);
2899 break;
2900
2901 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2902 {
2903#ifdef VBOX_STRICT
2904 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2905
2906 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2907 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
2908
2909 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2910 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2911
2912 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2913 Log(("VMX_VMCS_GUEST_CR3 %RGp\n", val));
2914
2915 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2916 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2917
2918 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2919 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2920
2921 VMX_LOG_SELREG(CS, "CS");
2922 VMX_LOG_SELREG(DS, "DS");
2923 VMX_LOG_SELREG(ES, "ES");
2924 VMX_LOG_SELREG(FS, "FS");
2925 VMX_LOG_SELREG(GS, "GS");
2926 VMX_LOG_SELREG(SS, "SS");
2927 VMX_LOG_SELREG(TR, "TR");
2928 VMX_LOG_SELREG(LDTR, "LDTR");
2929
2930 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2931 Log(("VMX_VMCS_GUEST_GDTR_BASE %RGv\n", val));
2932 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2933 Log(("VMX_VMCS_GUEST_IDTR_BASE %RGv\n", val));
2934#endif /* VBOX_STRICT */
2935 rc = VERR_VMX_INVALID_GUEST_STATE;
2936 break;
2937 }
2938
2939 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2940 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2941 default:
2942 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2943 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2944 break;
2945
2946 }
2947end:
2948
2949 /* Signal changes for the recompiler. */
2950 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2951
2952 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2953 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2954 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2955 {
2956 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2957 /* On the next entry we'll only sync the host context. */
2958 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2959 }
2960 else
2961 {
2962 /* On the next entry we'll sync everything. */
2963 /** @todo we can do better than this */
2964 /* Not in the VINF_PGM_CHANGE_MODE though! */
2965 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2966 }
2967
2968 /* translate into a less severe return code */
2969 if (rc == VERR_EM_INTERPRETER)
2970 rc = VINF_EM_RAW_EMULATE_INSTR;
2971 else
2972 /* Try to extract more information about what might have gone wrong here. */
2973 if (rc == VERR_VMX_INVALID_VMCS_PTR)
2974 {
2975 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
2976 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pVMCS;
2977 }
2978
2979 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2980
2981 Log2(("X"));
2982 return rc;
2983}
2984
2985
2986/**
2987 * Enters the VT-x session
2988 *
2989 * @returns VBox status code.
2990 * @param pVM The VM to operate on.
2991 * @param pVCpu The VMCPU to operate on.
2992 * @param pCpu CPU info struct
2993 */
2994VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
2995{
2996 Assert(pVM->hwaccm.s.vmx.fSupported);
2997
2998 unsigned cr4 = ASMGetCR4();
2999 if (!(cr4 & X86_CR4_VMXE))
3000 {
3001 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
3002 return VERR_VMX_X86_CR4_VMXE_CLEARED;
3003 }
3004
3005 /* Activate the VM Control Structure. */
3006 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3007 if (RT_FAILURE(rc))
3008 return rc;
3009
3010 pVCpu->hwaccm.s.fResumeVM = false;
3011 return VINF_SUCCESS;
3012}
3013
3014
3015/**
3016 * Leaves the VT-x session
3017 *
3018 * @returns VBox status code.
3019 * @param pVM The VM to operate on.
3020 * @param pVCpu The VMCPU to operate on.
3021 * @param pCtx CPU context
3022 */
3023VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
3024{
3025 Assert(pVM->hwaccm.s.vmx.fSupported);
3026
3027 /* Save the guest debug state if necessary. */
3028 if (CPUMIsGuestDebugStateActive(pVM))
3029 {
3030 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
3031
3032 /* Enable drx move intercepts again. */
3033 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3034 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3035 AssertRC(rc);
3036
3037 /* Resync the debug registers the next time. */
3038 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3039 }
3040 else
3041 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
3042
3043 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
3044 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3045 AssertRC(rc);
3046
3047 return VINF_SUCCESS;
3048}
3049
3050/**
3051 * Flush the TLB (EPT)
3052 *
3053 * @returns VBox status code.
3054 * @param pVM The VM to operate on.
3055 * @param pVCpu The VM CPU to operate on.
3056 * @param enmFlush Type of flush
3057 * @param GCPhys Physical address of the page to flush
3058 */
3059static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys)
3060{
3061 uint64_t descriptor[2];
3062
3063 LogFlow(("vmxR0FlushEPT %d %RGv\n", enmFlush, GCPhys));
3064 Assert(pVM->hwaccm.s.fNestedPaging);
3065 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
3066 descriptor[1] = GCPhys;
3067 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
3068 AssertRC(rc);
3069}
3070
3071#ifdef HWACCM_VTX_WITH_VPID
3072/**
3073 * Flush the TLB (EPT)
3074 *
3075 * @returns VBox status code.
3076 * @param pVM The VM to operate on.
3077 * @param pVCpu The VM CPU to operate on.
3078 * @param enmFlush Type of flush
3079 * @param GCPtr Virtual address of the page to flush
3080 */
3081static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr)
3082{
3083 uint64_t descriptor[2];
3084
3085 Assert(pVM->hwaccm.s.vmx.fVPID);
3086 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
3087 descriptor[1] = GCPtr;
3088 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]);
3089 AssertRC(rc);
3090}
3091#endif /* HWACCM_VTX_WITH_VPID */
3092
3093/**
3094 * Invalidates a guest page
3095 *
3096 * @returns VBox status code.
3097 * @param pVM The VM to operate on.
3098 * @param pVCpu The VM CPU to operate on.
3099 * @param GCVirt Page to invalidate
3100 */
3101VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
3102{
3103 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3104
3105 LogFlow(("VMXR0InvalidatePage %RGv\n", GCVirt));
3106
3107 /* Only relevant if we want to use VPID.
3108 * In the nested paging case we still see such calls, but
3109 * can safely ignore them. (e.g. after cr3 updates)
3110 */
3111#ifdef HWACCM_VTX_WITH_VPID
3112 /* Skip it if a TLB flush is already pending. */
3113 if ( !fFlushPending
3114 && pVM->hwaccm.s.vmx.fVPID)
3115 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCVirt);
3116#endif /* HWACCM_VTX_WITH_VPID */
3117
3118 return VINF_SUCCESS;
3119}
3120
3121/**
3122 * Invalidates a guest page by physical address
3123 *
3124 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
3125 *
3126 * @returns VBox status code.
3127 * @param pVM The VM to operate on.
3128 * @param pVCpu The VM CPU to operate on.
3129 * @param GCPhys Page to invalidate
3130 */
3131VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
3132{
3133 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3134
3135 Assert(pVM->hwaccm.s.fNestedPaging);
3136
3137 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
3138
3139 /* Skip it if a TLB flush is already pending. */
3140 if (!fFlushPending)
3141 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCPhys);
3142
3143 return VINF_SUCCESS;
3144}
3145
3146/**
3147 * Report world switch error and dump some useful debug info
3148 *
3149 * @param pVM The VM to operate on.
3150 * @param pVCpu The VMCPU to operate on.
3151 * @param rc Return code
3152 * @param pCtx Current CPU context (not updated)
3153 */
3154static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx)
3155{
3156 switch (rc)
3157 {
3158 case VERR_VMX_INVALID_VMXON_PTR:
3159 AssertFailed();
3160 break;
3161
3162 case VERR_VMX_UNABLE_TO_START_VM:
3163 case VERR_VMX_UNABLE_TO_RESUME_VM:
3164 {
3165 int rc;
3166 RTCCUINTREG exitReason, instrError, val;
3167
3168 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
3169 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
3170 AssertRC(rc);
3171 if (rc == VINF_SUCCESS)
3172 {
3173 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
3174 Log(("Current stack %08x\n", &rc));
3175
3176 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
3177 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
3178
3179#ifdef VBOX_STRICT
3180 RTGDTR gdtr;
3181 PX86DESCHC pDesc;
3182
3183 ASMGetGDTR(&gdtr);
3184
3185 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
3186 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
3187 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
3188 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
3189 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
3190 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
3191 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
3192 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
3193 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
3194 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
3195
3196 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
3197 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
3198
3199 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
3200 Log(("VMX_VMCS_HOST_CR3 %RHp\n", val));
3201
3202 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
3203 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
3204
3205 VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
3206 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
3207
3208 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
3209 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
3210
3211 if (val < gdtr.cbGdt)
3212 {
3213 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3214 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
3215 }
3216
3217 VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
3218 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
3219 if (val < gdtr.cbGdt)
3220 {
3221 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3222 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
3223 }
3224
3225 VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
3226 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
3227 if (val < gdtr.cbGdt)
3228 {
3229 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3230 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
3231 }
3232
3233 VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
3234 Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
3235 if (val < gdtr.cbGdt)
3236 {
3237 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3238 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
3239 }
3240
3241 VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
3242 Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
3243 if (val < gdtr.cbGdt)
3244 {
3245 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3246 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
3247 }
3248
3249 VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
3250 Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
3251 if (val < gdtr.cbGdt)
3252 {
3253 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3254 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
3255 }
3256
3257 VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
3258 Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
3259 if (val < gdtr.cbGdt)
3260 {
3261 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3262 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
3263 }
3264
3265 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
3266 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
3267
3268 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
3269 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
3270 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
3271 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
3272
3273 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
3274 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
3275
3276 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
3277 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
3278
3279 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
3280 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
3281
3282 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
3283 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
3284 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
3285 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
3286
3287# if HC_ARCH_BITS == 64
3288 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
3289 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
3290 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
3291 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
3292 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
3293# endif
3294#endif /* VBOX_STRICT */
3295 }
3296 break;
3297 }
3298
3299 default:
3300 /* impossible */
3301 AssertFailed();
3302 break;
3303 }
3304}
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette