VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 14299

Last change on this file since 14299 was 14110, checked in by vboxsync, 16 years ago

Compile fix
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 128.8 KB
Line 
1/* $Id: HWVMXR0.cpp 14110 2008-11-11 19:42:05Z vboxsync $ */
2/** @file
3 * HWACCM VMX - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/pgm.h>
32#include <VBox/pdm.h>
33#include <VBox/err.h>
34#include <VBox/log.h>
35#include <VBox/selm.h>
36#include <VBox/iom.h>
37#include <iprt/param.h>
38#include <iprt/assert.h>
39#include <iprt/asm.h>
40#include <iprt/string.h>
41#include "HWVMXR0.h"
42
43/*******************************************************************************
44* Global Variables *
45*******************************************************************************/
46/* IO operation lookup arrays. */
47static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
48static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
49
50/*******************************************************************************
51* Local Functions *
52*******************************************************************************/
53static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx);
54static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu);
55static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu);
56static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu);
57static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys);
58static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr);
59static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
60
61
62static void VMXR0CheckError(PVM pVM, PVMCPU pVCpu, int rc)
63{
64 if (rc == VERR_VMX_GENERIC)
65 {
66 RTCCUINTREG instrError;
67
68 VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
69 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
70 }
71 pVM->hwaccm.s.lLastError = rc;
72}
73
74/**
75 * Sets up and activates VT-x on the current CPU
76 *
77 * @returns VBox status code.
78 * @param pCpu CPU info struct
79 * @param pVM The VM to operate on. (can be NULL after a resume!!)
80 * @param pvPageCpu Pointer to the global cpu page
81 * @param pPageCpuPhys Physical address of the global cpu page
82 */
83VMMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
84{
85 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
86 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
87
88#ifdef LOG_ENABLED
89 SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
90#endif
91 if (pVM)
92 {
93 /* Set revision dword at the beginning of the VMXON structure. */
94 *(uint32_t *)pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
95 }
96
97 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
98 * (which can have very bad consequences!!!)
99 */
100
101 /* Make sure the VMX instructions don't cause #UD faults. */
102 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
103
104 /* Enter VMX Root Mode */
105 int rc = VMXEnable(pPageCpuPhys);
106 if (RT_FAILURE(rc))
107 {
108 if (pVM)
109 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
110 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
111 return VERR_VMX_VMXON_FAILED;
112 }
113 return VINF_SUCCESS;
114}
115
116/**
117 * Deactivates VT-x on the current CPU
118 *
119 * @returns VBox status code.
120 * @param pCpu CPU info struct
121 * @param pvPageCpu Pointer to the global cpu page
122 * @param pPageCpuPhys Physical address of the global cpu page
123 */
124VMMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
125{
126 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
127 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
128
129 /* Leave VMX Root Mode. */
130 VMXDisable();
131
132 /* And clear the X86_CR4_VMXE bit */
133 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
134
135#ifdef LOG_ENABLED
136 SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
137#endif
138 return VINF_SUCCESS;
139}
140
141/**
142 * Does Ring-0 per VM VT-x init.
143 *
144 * @returns VBox status code.
145 * @param pVM The VM to operate on.
146 */
147VMMR0DECL(int) VMXR0InitVM(PVM pVM)
148{
149 int rc;
150
151#ifdef LOG_ENABLED
152 SUPR0Printf("VMXR0InitVM %x\n", pVM);
153#endif
154
155 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
156
157 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
158 {
159 /* Allocate one page for the virtual APIC mmio cache. */
160 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
161 AssertRC(rc);
162 if (RT_FAILURE(rc))
163 return rc;
164
165 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
166 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
167 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
168 }
169 else
170 {
171 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
172 pVM->hwaccm.s.vmx.pAPIC = 0;
173 pVM->hwaccm.s.vmx.pAPICPhys = 0;
174 }
175
176 /* Allocate the MSR bitmap if this feature is supported. */
177 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
178 {
179 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
180 AssertRC(rc);
181 if (RT_FAILURE(rc))
182 return rc;
183
184 pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
185 pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
186 memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
187 }
188
189 /* Allocate VMCBs for all guest CPUs. */
190 for (unsigned i=0;i<pVM->cCPUs;i++)
191 {
192 PVMCPU pVCpu = &pVM->aCpus[i];
193
194 pVCpu->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
195
196 /* Allocate one page for the VM control structure (VMCS). */
197 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
198 AssertRC(rc);
199 if (RT_FAILURE(rc))
200 return rc;
201
202 pVCpu->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjVMCS);
203 pVCpu->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjVMCS, 0);
204 ASMMemZero32(pVCpu->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
205
206 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
207 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
208
209 /* Current guest paging mode. */
210 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
211
212#ifdef LOG_ENABLED
213 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.pVMCSPhys);
214#endif
215 }
216
217 return VINF_SUCCESS;
218}
219
220/**
221 * Does Ring-0 per VM VT-x termination.
222 *
223 * @returns VBox status code.
224 * @param pVM The VM to operate on.
225 */
226VMMR0DECL(int) VMXR0TermVM(PVM pVM)
227{
228 for (unsigned i=0;i<pVM->cCPUs;i++)
229 {
230 if (pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
231 {
232 RTR0MemObjFree(pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS, false);
233 pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
234 pVM->aCpus[i].hwaccm.s.vmx.pVMCS = 0;
235 pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys = 0;
236 }
237 }
238 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
239 {
240 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
241 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
242 pVM->hwaccm.s.vmx.pAPIC = 0;
243 pVM->hwaccm.s.vmx.pAPICPhys = 0;
244 }
245 if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
248 pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
249 pVM->hwaccm.s.vmx.pMSRBitmap = 0;
250 pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
251 }
252 return VINF_SUCCESS;
253}
254
255/**
256 * Sets up VT-x for the specified VM
257 *
258 * @returns VBox status code.
259 * @param pVM The VM to operate on.
260 */
261VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
262{
263 int rc = VINF_SUCCESS;
264 uint32_t val;
265
266 AssertReturn(pVM, VERR_INVALID_PARAMETER);
267
268 for (unsigned i=0;i<pVM->cCPUs;i++)
269 {
270 Assert(pVM->aCpus[i].hwaccm.s.vmx.pVMCS);
271
272 /* Set revision dword at the beginning of the VMCS structure. */
273 *(uint32_t *)pVM->aCpus[i].hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
274
275 /* Clear VM Control Structure. */
276 Log(("pVMCSPhys = %RHp\n", pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys));
277 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
278 if (RT_FAILURE(rc))
279 goto vmx_end;
280
281 /* Activate the VM Control Structure. */
282 rc = VMXActivateVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
283 if (RT_FAILURE(rc))
284 goto vmx_end;
285
286 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
287 * Set required bits to one and zero according to the MSR capabilities.
288 */
289 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
290 /* External and non-maskable interrupts cause VM-exits. */
291 val = val | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
292 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
293
294 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
295 AssertRC(rc);
296
297 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
298 * Set required bits to one and zero according to the MSR capabilities.
299 */
300 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
301 /* Program which event cause VM-exits and which features we want to use. */
302 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
303 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
304 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
305 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
306 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
307
308 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
309 if (!pVM->hwaccm.s.fNestedPaging)
310 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
311 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
312 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
313
314 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
315
316#if HC_ARCH_BITS == 64
317 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
318 {
319 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
320 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
321 Assert(pVM->hwaccm.s.vmx.pAPIC);
322 }
323 else
324 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
325 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
326#endif
327
328#ifdef VBOX_WITH_VTX_MSR_BITMAPS
329 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
330 {
331 Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
332 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
333 }
334#endif
335
336 /* We will use the secondary control if it's present. */
337 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
338
339 /* Mask away the bits that the CPU doesn't support */
340 /** @todo make sure they don't conflict with the above requirements. */
341 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
342 pVM->aCpus[i].hwaccm.s.vmx.proc_ctls = val;
343
344 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
345 AssertRC(rc);
346
347 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
348 {
349 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
350 * Set required bits to one and zero according to the MSR capabilities.
351 */
352 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
353 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
354
355#ifdef HWACCM_VTX_WITH_EPT
356 if (pVM->hwaccm.s.fNestedPaging)
357 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
358#endif /* HWACCM_VTX_WITH_EPT */
359#ifdef HWACCM_VTX_WITH_VPID
360 else
361 if (pVM->hwaccm.s.vmx.fVPID)
362 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
363#endif /* HWACCM_VTX_WITH_VPID */
364
365 /* Mask away the bits that the CPU doesn't support */
366 /** @todo make sure they don't conflict with the above requirements. */
367 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
368
369 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
370 AssertRC(rc);
371 }
372
373 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
374 * Set required bits to one and zero according to the MSR capabilities.
375 */
376 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
377 AssertRC(rc);
378
379 /* VMX_VMCS_CTRL_EXIT_CONTROLS
380 * Set required bits to one and zero according to the MSR capabilities.
381 */
382 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
383
384 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
385 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
386#if HC_ARCH_BITS == 64
387 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
388#else
389 /* else Must be zero when AMD64 is not available. */
390#endif
391 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
392 /* Don't acknowledge external interrupts on VM-exit. */
393 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
394 AssertRC(rc);
395
396 /* Forward all exception except #NM & #PF to the guest.
397 * We always need to check pagefaults since our shadow page table can be out of sync.
398 * And we always lazily sync the FPU & XMM state.
399 */
400
401 /** @todo Possible optimization:
402 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
403 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
404 * registers ourselves of course.
405 *
406 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
407 */
408
409 /* Don't filter page faults; all of them should cause a switch. */
410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
411 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
412 AssertRC(rc);
413
414 /* Init TSC offset to zero. */
415 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
416#if HC_ARCH_BITS == 32
417 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
418#endif
419 AssertRC(rc);
420
421 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
422#if HC_ARCH_BITS == 32
423 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
424#endif
425 AssertRC(rc);
426
427 rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
428#if HC_ARCH_BITS == 32
429 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
430#endif
431 AssertRC(rc);
432
433 /* Set the MSR bitmap address. */
434 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
435 {
436 /* Optional */
437 rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
438#if HC_ARCH_BITS == 32
439 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, pVM->hwaccm.s.vmx.pMSRBitmapPhys >> 32ULL);
440#endif
441 AssertRC(rc);
442 }
443
444 /* Clear MSR controls. */
445 rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
446 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
447 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
448#if HC_ARCH_BITS == 32
449 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
450 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
451 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
452#endif
453 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
454 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
455 AssertRC(rc);
456
457 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
458 {
459 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
460 /* Optional */
461 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
462 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
463#if HC_ARCH_BITS == 32
464 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32ULL);
465#endif
466 AssertRC(rc);
467 }
468
469 /* Set link pointer to -1. Not currently used. */
470#if HC_ARCH_BITS == 32
471 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
472 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
473#else
474 rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
475#endif
476 AssertRC(rc);
477
478 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
479 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
480 AssertRC(rc);
481 } /* for each VMCPU */
482
483 /* Choose the right TLB setup function. */
484 if (pVM->hwaccm.s.fNestedPaging)
485 {
486 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBEPT;
487
488 /* Default values for flushing. */
489 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
490 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
491
492 /* If the capabilities specify we can do more, then make use of it. */
493 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_INDIV)
494 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
495 else
496 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
497 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
498
499 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
500 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
501 }
502#ifdef HWACCM_VTX_WITH_VPID
503 else
504 if (pVM->hwaccm.s.vmx.fVPID)
505 {
506 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBVPID;
507
508 /* Default values for flushing. */
509 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
510 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
511
512 /* If the capabilities specify we can do more, then make use of it. */
513 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV)
514 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
515 else
516 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
517 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
518
519 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
520 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
521 }
522#endif /* HWACCM_VTX_WITH_VPID */
523 else
524 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBDummy;
525
526vmx_end:
527 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
528 return rc;
529}
530
531
532/**
533 * Injects an event (trap or external interrupt)
534 *
535 * @returns VBox status code.
536 * @param pVM The VM to operate on.
537 * @param pVCpu The VMCPU to operate on.
538 * @param pCtx CPU Context
539 * @param intInfo VMX interrupt info
540 * @param cbInstr Opcode length of faulting instruction
541 * @param errCode Error code (optional)
542 */
543static int VMXR0InjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
544{
545 int rc;
546 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
547
548#ifdef VBOX_STRICT
549 if (iGate == 0xE)
550 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
551 else
552 if (iGate < 0x20)
553 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
554 else
555 {
556 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
557 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
558 Assert(pCtx->eflags.u32 & X86_EFL_IF);
559 }
560#endif
561
562#ifdef HWACCM_VMX_EMULATE_REALMODE
563 if (CPUMIsGuestInRealModeEx(pCtx))
564 {
565 RTGCPHYS GCPhysHandler;
566 uint16_t offset, ip;
567 RTSEL sel;
568
569 /* Injecting events doesn't work right with real mode emulation.
570 * (#GP if we try to inject external hardware interrupts)
571 * Inject the interrupt or trap directly instead.
572 */
573 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
574
575 /* Check if the interrupt handler is present. */
576 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
577 {
578 Log(("IDT cbIdt violation\n"));
579 if (iGate != X86_XCPT_DF)
580 {
581 RTGCUINTPTR intInfo;
582
583 intInfo = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
584 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
585 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
586 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
587
588 return VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0 /* no error code according to the Intel docs */);
589 }
590 Log(("Triple fault -> reset the VM!\n"));
591 return VINF_EM_RESET;
592 }
593 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
594 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
595 || iGate == 4)
596 {
597 ip = pCtx->ip + cbInstr;
598 }
599 else
600 ip = pCtx->ip;
601
602 /* Read the selector:offset pair of the interrupt handler. */
603 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
604 PGMPhysRead(pVM, GCPhysHandler, &offset, sizeof(offset));
605 PGMPhysRead(pVM, GCPhysHandler + 2, &sel, sizeof(sel));
606
607 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
608
609 /* Construct the stack frame. */
610 /** @todo should check stack limit. */
611 pCtx->sp -= 2;
612 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
613 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t));
614 pCtx->sp -= 2;
615 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
616 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t));
617 pCtx->sp -= 2;
618 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
619 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip));
620
621 /* Update the CPU state for executing the handler. */
622 pCtx->rip = offset;
623 pCtx->cs = sel;
624 pCtx->csHid.u64Base = sel << 4;
625 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
626
627 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
628 return VINF_SUCCESS;
629 }
630#endif /* HWACCM_VMX_EMULATE_REALMODE */
631
632 /* Set event injection state. */
633 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
634
635 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
636 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
637
638 AssertRC(rc);
639 return rc;
640}
641
642
643/**
644 * Checks for pending guest interrupts and injects them
645 *
646 * @returns VBox status code.
647 * @param pVM The VM to operate on.
648 * @param pVCpu The VMCPU to operate on.
649 * @param pCtx CPU Context
650 */
651static int VMXR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
652{
653 int rc;
654
655 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
656 if (pVCpu->hwaccm.s.Event.fPending)
657 {
658 Log(("Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
659 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
660 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
661 AssertRC(rc);
662
663 pVCpu->hwaccm.s.Event.fPending = false;
664 return VINF_SUCCESS;
665 }
666
667 if (pVM->hwaccm.s.fInjectNMI)
668 {
669 RTGCUINTPTR intInfo;
670
671 intInfo = X86_XCPT_NMI;
672 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
673 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
674
675 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
676 AssertRC(rc);
677
678 pVM->hwaccm.s.fInjectNMI = false;
679 return VINF_SUCCESS;
680 }
681
682 /* When external interrupts are pending, we should exit the VM when IF is set. */
683 if ( !TRPMHasTrap(pVM)
684 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
685 {
686 if (!(pCtx->eflags.u32 & X86_EFL_IF))
687 {
688 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
689 {
690 LogFlow(("Enable irq window exit!\n"));
691 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
692 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
693 AssertRC(rc);
694 }
695 /* else nothing to do but wait */
696 }
697 else
698 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
699 {
700 uint8_t u8Interrupt;
701
702 rc = PDMGetInterrupt(pVM, &u8Interrupt);
703 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
704 if (RT_SUCCESS(rc))
705 {
706 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
707 AssertRC(rc);
708 }
709 else
710 {
711 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
712 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
713 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
714 /* Just continue */
715 }
716 }
717 else
718 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
719 }
720
721#ifdef VBOX_STRICT
722 if (TRPMHasTrap(pVM))
723 {
724 uint8_t u8Vector;
725 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
726 AssertRC(rc);
727 }
728#endif
729
730 if ( pCtx->eflags.u32 & X86_EFL_IF
731 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
732 && TRPMHasTrap(pVM)
733 )
734 {
735 uint8_t u8Vector;
736 int rc;
737 TRPMEVENT enmType;
738 RTGCUINTPTR intInfo;
739 RTGCUINT errCode;
740
741 /* If a new event is pending, then dispatch it now. */
742 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
743 AssertRC(rc);
744 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
745 Assert(enmType != TRPM_SOFTWARE_INT);
746
747 /* Clear the pending trap. */
748 rc = TRPMResetTrap(pVM);
749 AssertRC(rc);
750
751 intInfo = u8Vector;
752 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
753
754 if (enmType == TRPM_TRAP)
755 {
756 switch (u8Vector) {
757 case 8:
758 case 10:
759 case 11:
760 case 12:
761 case 13:
762 case 14:
763 case 17:
764 /* Valid error codes. */
765 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
766 break;
767 default:
768 break;
769 }
770 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
771 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
772 else
773 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
774 }
775 else
776 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
777
778 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
779 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
780 AssertRC(rc);
781 } /* if (interrupts can be dispatched) */
782
783 return VINF_SUCCESS;
784}
785
786/**
787 * Save the host state
788 *
789 * @returns VBox status code.
790 * @param pVM The VM to operate on.
791 * @param pVCpu The VMCPU to operate on.
792 */
793VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
794{
795 int rc = VINF_SUCCESS;
796
797 /*
798 * Host CPU Context
799 */
800 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
801 {
802 RTIDTR idtr;
803 RTGDTR gdtr;
804 RTSEL SelTR;
805 PX86DESCHC pDesc;
806 uintptr_t trBase;
807
808 /* Control registers */
809 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
810 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
811 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
812 AssertRC(rc);
813 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
814 Log2(("VMX_VMCS_HOST_CR3 %RHp\n", ASMGetCR3()));
815 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
816
817 /* Selector registers. */
818 rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
819 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
820 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
821 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
822#if HC_ARCH_BITS == 32
823 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
824 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
825#endif
826 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
827 SelTR = ASMGetTR();
828 rc |= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
829 AssertRC(rc);
830 Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
831 Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
832 Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
833 Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
834 Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
835 Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
836 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
837
838 /* GDTR & IDTR */
839 ASMGetGDTR(&gdtr);
840 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
841 ASMGetIDTR(&idtr);
842 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
843 AssertRC(rc);
844 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
845 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
846
847 /* Save the base address of the TR selector. */
848 if (SelTR > gdtr.cbGdt)
849 {
850 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
851 return VERR_VMX_INVALID_HOST_STATE;
852 }
853
854 pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
855#if HC_ARCH_BITS == 64
856 trBase = X86DESC64_BASE(*pDesc);
857#else
858 trBase = X86DESC_BASE(*pDesc);
859#endif
860 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
861 AssertRC(rc);
862 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
863
864 /* FS and GS base. */
865#if HC_ARCH_BITS == 64
866 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
867 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
868 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
869 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
870#endif
871 AssertRC(rc);
872
873 /* Sysenter MSRs. */
874 /** @todo expensive!! */
875 rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
876 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
877#if HC_ARCH_BITS == 32
878 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
879 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
880 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
881 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
882#else
883 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
884 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
885 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
886 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
887#endif
888 AssertRC(rc);
889
890 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
891 }
892 return rc;
893}
894
895/**
896 * Prefetch the 4 PDPT pointers (PAE and nested paging only)
897 *
898 * @param pVM The VM to operate on.
899 * @param pCtx Guest context
900 */
901static void vmxR0PrefetchPAEPdptrs(PVM pVM, PCPUMCTX pCtx)
902{
903 if (CPUMIsGuestInPAEModeEx(pCtx))
904 {
905 X86PDPE Pdpe;
906
907 for (unsigned i=0;i<4;i++)
908 {
909 Pdpe = PGMGstGetPaePDPtr(pVM, i);
910 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2, Pdpe.u);
911#if HC_ARCH_BITS == 32
912 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_PDPTR0_FULL + i*2 + 1, Pdpe.u >> 32ULL);
913#endif
914 AssertRC(rc);
915 }
916 }
917}
918
919/**
920 * Update the exception bitmap according to the current CPU state
921 *
922 * @param pVM The VM to operate on.
923 * @param pVCpu The VMCPU to operate on.
924 * @param pCtx Guest context
925 */
926static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
927{
928 uint32_t u32TrapMask;
929 Assert(pCtx);
930
931 u32TrapMask = HWACCM_VMX_TRAP_MASK;
932#ifndef DEBUG
933 if (pVM->hwaccm.s.fNestedPaging)
934 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
935#endif
936
937 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
938 if ( CPUMIsGuestFPUStateActive(pVCpu) == true
939 && !(pCtx->cr0 & X86_CR0_NE)
940 && !pVCpu->hwaccm.s.fFPUOldStyleOverride)
941 {
942 u32TrapMask |= RT_BIT(X86_XCPT_MF);
943 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
944 }
945
946#ifdef DEBUG
947 /* Intercept X86_XCPT_DB if stepping is enabled */
948 if (DBGFIsStepping(pVM))
949 u32TrapMask |= RT_BIT(X86_XCPT_DB);
950#endif
951
952#ifdef VBOX_STRICT
953 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
954#endif
955
956# ifdef HWACCM_VMX_EMULATE_REALMODE
957 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
958 if (CPUMIsGuestInRealModeEx(pCtx))
959 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
960# endif /* HWACCM_VMX_EMULATE_REALMODE */
961
962 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
963 AssertRC(rc);
964}
965
966/**
967 * Loads the guest state
968 *
969 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
970 *
971 * @returns VBox status code.
972 * @param pVM The VM to operate on.
973 * @param pVCpu The VMCPU to operate on.
974 * @param pCtx Guest context
975 */
976VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
977{
978 int rc = VINF_SUCCESS;
979 RTGCUINTPTR val;
980 X86EFLAGS eflags;
981
982 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
983 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
984 {
985#ifdef HWACCM_VMX_EMULATE_REALMODE
986 PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
987 if (pVCpu->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
988 {
989 /* Correct weird requirements for switching to protected mode. */
990 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
991 && enmGuestMode >= PGMMODE_PROTECTED)
992 {
993 /* DPL of all hidden selector registers must match the current CPL (0). */
994 pCtx->csHid.Attr.n.u2Dpl = 0;
995 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
996
997 pCtx->dsHid.Attr.n.u2Dpl = 0;
998 pCtx->esHid.Attr.n.u2Dpl = 0;
999 pCtx->fsHid.Attr.n.u2Dpl = 0;
1000 pCtx->gsHid.Attr.n.u2Dpl = 0;
1001 pCtx->ssHid.Attr.n.u2Dpl = 0;
1002 }
1003 else
1004 /* Switching from protected mode to real mode. */
1005 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
1006 && enmGuestMode == PGMMODE_REAL)
1007 {
1008 /* The limit must also be adjusted. */
1009 pCtx->csHid.u32Limit &= 0xffff;
1010 pCtx->dsHid.u32Limit &= 0xffff;
1011 pCtx->esHid.u32Limit &= 0xffff;
1012 pCtx->fsHid.u32Limit &= 0xffff;
1013 pCtx->gsHid.u32Limit &= 0xffff;
1014 pCtx->ssHid.u32Limit &= 0xffff;
1015
1016 Assert(pCtx->csHid.u64Base <= 0xfffff);
1017 Assert(pCtx->dsHid.u64Base <= 0xfffff);
1018 Assert(pCtx->esHid.u64Base <= 0xfffff);
1019 Assert(pCtx->fsHid.u64Base <= 0xfffff);
1020 Assert(pCtx->gsHid.u64Base <= 0xfffff);
1021 }
1022 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
1023 }
1024 else
1025 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1026 if ( CPUMIsGuestInRealModeEx(pCtx)
1027 && pCtx->csHid.u64Base == 0xffff0000)
1028 {
1029 pCtx->csHid.u64Base = 0xf0000;
1030 pCtx->cs = 0xf000;
1031 }
1032#endif /* HWACCM_VMX_EMULATE_REALMODE */
1033
1034 VMX_WRITE_SELREG(ES, es);
1035 AssertRC(rc);
1036
1037 VMX_WRITE_SELREG(CS, cs);
1038 AssertRC(rc);
1039
1040 VMX_WRITE_SELREG(SS, ss);
1041 AssertRC(rc);
1042
1043 VMX_WRITE_SELREG(DS, ds);
1044 AssertRC(rc);
1045
1046 /* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
1047 VMX_WRITE_SELREG(FS, fs);
1048 AssertRC(rc);
1049
1050 VMX_WRITE_SELREG(GS, gs);
1051 AssertRC(rc);
1052 }
1053
1054 /* Guest CPU context: LDTR. */
1055 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1056 {
1057 if (pCtx->ldtr == 0)
1058 {
1059 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
1060 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
1061 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
1062 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1063 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1064 }
1065 else
1066 {
1067 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
1068 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1069 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1070 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1071 }
1072 AssertRC(rc);
1073 }
1074 /* Guest CPU context: TR. */
1075 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1076 {
1077#ifdef HWACCM_VMX_EMULATE_REALMODE
1078 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1079 if (CPUMIsGuestInRealModeEx(pCtx))
1080 {
1081 RTGCPHYS GCPhys;
1082
1083 /* We convert it here every time as pci regions could be reconfigured. */
1084 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1085 AssertRC(rc);
1086
1087 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, 0);
1088 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1089 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1090
1091 X86DESCATTR attr;
1092
1093 attr.u = 0;
1094 attr.n.u1Present = 1;
1095 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1096 val = attr.u;
1097 }
1098 else
1099#endif /* HWACCM_VMX_EMULATE_REALMODE */
1100 {
1101 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
1102 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1103 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
1104
1105 val = pCtx->trHid.Attr.u;
1106
1107 /* The TSS selector must be busy. */
1108 if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
1109 val = (val & ~0xF) | X86_SEL_TYPE_SYS_286_TSS_BUSY;
1110 else
1111 /* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
1112 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1113
1114 }
1115 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
1116 AssertRC(rc);
1117 }
1118 /* Guest CPU context: GDTR. */
1119 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1120 {
1121 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1122 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1123 AssertRC(rc);
1124 }
1125 /* Guest CPU context: IDTR. */
1126 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1127 {
1128 rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1129 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1130 AssertRC(rc);
1131 }
1132
1133 /*
1134 * Sysenter MSRs (unconditional)
1135 */
1136 rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1137 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1138 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1139 AssertRC(rc);
1140
1141 /* Control registers */
1142 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1143 {
1144 val = pCtx->cr0;
1145 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1146 Log2(("Guest CR0-shadow %08x\n", val));
1147 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1148 {
1149 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1150 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1151 }
1152 else
1153 {
1154 /** @todo check if we support the old style mess correctly. */
1155 if (!(val & X86_CR0_NE))
1156 Log(("Forcing X86_CR0_NE!!!\n"));
1157
1158 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1159 }
1160 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1161 val |= X86_CR0_PE | X86_CR0_PG;
1162 if (pVM->hwaccm.s.fNestedPaging)
1163 {
1164 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1165 {
1166 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1167 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1168 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1169 }
1170 else
1171 {
1172 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1173 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1174 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1175 }
1176 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1177 AssertRC(rc);
1178 }
1179 else
1180 {
1181 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1182 val |= X86_CR0_WP;
1183 }
1184
1185 /* Always enable caching. */
1186 val &= ~(X86_CR0_CD|X86_CR0_NW);
1187
1188 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1189 Log2(("Guest CR0 %08x\n", val));
1190 /* CR0 flags owned by the host; if the guests attempts to change them, then
1191 * the VM will exit.
1192 */
1193 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1194 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1195 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1196 | X86_CR0_TS
1197 | X86_CR0_ET /* Bit not restored during VM-exit! */
1198 | X86_CR0_CD /* Bit not restored during VM-exit! */
1199 | X86_CR0_NW /* Bit not restored during VM-exit! */
1200 | X86_CR0_NE
1201 | X86_CR0_MP;
1202 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1203
1204 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1205 Log2(("Guest CR0-mask %08x\n", val));
1206 AssertRC(rc);
1207 }
1208 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1209 {
1210 /* CR4 */
1211 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1212 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1213 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1214 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1215
1216 if (!pVM->hwaccm.s.fNestedPaging)
1217 {
1218 switch(pVCpu->hwaccm.s.enmShadowMode)
1219 {
1220 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1221 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1222 case PGMMODE_32_BIT: /* 32-bit paging. */
1223 break;
1224
1225 case PGMMODE_PAE: /* PAE paging. */
1226 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1227 /** @todo use normal 32 bits paging */
1228 val |= X86_CR4_PAE;
1229 break;
1230
1231 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1232 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1233#ifdef VBOX_ENABLE_64_BITS_GUESTS
1234 break;
1235#else
1236 AssertFailed();
1237 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1238#endif
1239 default: /* shut up gcc */
1240 AssertFailed();
1241 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1242 }
1243 }
1244 else
1245 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1246 {
1247 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1248 val |= X86_CR4_PSE;
1249 /* Our identity mapping is a 32 bits page directory. */
1250 val &= ~X86_CR4_PAE;
1251 }
1252
1253#ifdef HWACCM_VMX_EMULATE_REALMODE
1254 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1255 if (CPUMIsGuestInRealModeEx(pCtx))
1256 val |= X86_CR4_VME;
1257#endif /* HWACCM_VMX_EMULATE_REALMODE */
1258
1259 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1260 Log2(("Guest CR4 %08x\n", val));
1261 /* CR4 flags owned by the host; if the guests attempts to change them, then
1262 * the VM will exit.
1263 */
1264 val = 0
1265#ifdef HWACCM_VMX_EMULATE_REALMODE
1266 | X86_CR4_VME
1267#endif
1268 | X86_CR4_PAE
1269 | X86_CR4_PGE
1270 | X86_CR4_PSE
1271 | X86_CR4_VMXE;
1272 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1273
1274 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1275 Log2(("Guest CR4-mask %08x\n", val));
1276 AssertRC(rc);
1277 }
1278
1279 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1280 {
1281 if (pVM->hwaccm.s.fNestedPaging)
1282 {
1283 AssertMsg(PGMGetEPTCR3(pVM) == PGMGetHyperCR3(pVM), ("%RHp vs %RHp\n", PGMGetEPTCR3(pVM), PGMGetHyperCR3(pVM)));
1284 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetEPTCR3(pVM);
1285
1286 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1287 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1288 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1289 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1290
1291 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1292#if HC_ARCH_BITS == 32
1293 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EPTP_HIGH, (uint32_t)(pVCpu->hwaccm.s.vmx.GCPhysEPTP >> 32ULL));
1294#endif
1295 AssertRC(rc);
1296
1297 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1298 {
1299 RTGCPHYS GCPhys;
1300
1301 /* We convert it here every time as pci regions could be reconfigured. */
1302 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1303 AssertRC(rc);
1304
1305 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1306 * take care of the translation to host physical addresses.
1307 */
1308 val = GCPhys;
1309 }
1310 else
1311 {
1312 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1313 val = pCtx->cr3;
1314 /* Prefetch the four PDPT entries in PAE mode. */
1315 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1316 }
1317 }
1318 else
1319 {
1320 val = PGMGetHyperCR3(pVM);
1321 Assert(val);
1322 }
1323
1324 /* Save our shadow CR3 register. */
1325 rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1326 AssertRC(rc);
1327 }
1328
1329 /* Debug registers. */
1330 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1331 {
1332 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1333 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1334
1335 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1336 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1337 pCtx->dr[7] |= 0x400; /* must be one */
1338
1339 /* Resync DR7 */
1340 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1341 AssertRC(rc);
1342
1343 /* Sync the debug state now if any breakpoint is armed. */
1344 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1345 && !CPUMIsGuestDebugStateActive(pVM)
1346 && !DBGFIsStepping(pVM))
1347 {
1348 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1349
1350 /* Disable drx move intercepts. */
1351 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1352 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1353 AssertRC(rc);
1354
1355 /* Save the host and load the guest debug state. */
1356 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1357 AssertRC(rc);
1358 }
1359
1360 /* IA32_DEBUGCTL MSR. */
1361 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1362 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
1363 AssertRC(rc);
1364
1365 /** @todo do we really ever need this? */
1366 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1367 AssertRC(rc);
1368 }
1369
1370 /* EIP, ESP and EFLAGS */
1371 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1372 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1373 AssertRC(rc);
1374
1375 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1376 eflags = pCtx->eflags;
1377 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1378 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1379
1380#ifdef HWACCM_VMX_EMULATE_REALMODE
1381 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1382 if (CPUMIsGuestInRealModeEx(pCtx))
1383 {
1384 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1385
1386 eflags.Bits.u1VM = 1;
1387 eflags.Bits.u2IOPL = 3;
1388 }
1389#endif /* HWACCM_VMX_EMULATE_REALMODE */
1390 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1391 AssertRC(rc);
1392
1393 /* TSC offset. */
1394 uint64_t u64TSCOffset;
1395
1396 if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1397 {
1398 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1399 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1400#if HC_ARCH_BITS == 32
1401 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
1402#endif
1403 AssertRC(rc);
1404
1405 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1406 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1407 AssertRC(rc);
1408 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1409 }
1410 else
1411 {
1412 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1413 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1414 AssertRC(rc);
1415 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1416 }
1417
1418 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1419 * Set required bits to one and zero according to the MSR capabilities.
1420 */
1421 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1422 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1423 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1424
1425 /* 64 bits guest mode? */
1426 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1427 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1428 /* else Must be zero when AMD64 is not available. */
1429
1430 /* Mask away the bits that the CPU doesn't support */
1431 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1432 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1433 AssertRC(rc);
1434
1435 /* 64 bits guest mode? */
1436 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1437 {
1438#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
1439 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1440#else
1441 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1442#endif
1443 /* Unconditionally update these as wrmsr might have changed them. */
1444 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1445 AssertRC(rc);
1446 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1447 AssertRC(rc);
1448 }
1449 else
1450 {
1451 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1452 }
1453
1454 vmxR0UpdateExceptionBitmap(pVM, pVCpu, pCtx);
1455
1456 /* Done. */
1457 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1458
1459 return rc;
1460}
1461
1462/**
1463 * Syncs back the guest state
1464 *
1465 * @returns VBox status code.
1466 * @param pVM The VM to operate on.
1467 * @param pVCpu The VMCPU to operate on.
1468 * @param pCtx Guest context
1469 */
1470DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1471{
1472 RTCCUINTREG val, valShadow;
1473 RTGCUINTPTR uInterruptState;
1474 int rc;
1475
1476 /* Let's first sync back eip, esp, and eflags. */
1477 rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1478 AssertRC(rc);
1479 pCtx->rip = val;
1480 rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1481 AssertRC(rc);
1482 pCtx->rsp = val;
1483 rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1484 AssertRC(rc);
1485 pCtx->eflags.u32 = val;
1486
1487 /* Take care of instruction fusing (sti, mov ss) */
1488 rc |= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1489 uInterruptState = val;
1490 if (uInterruptState != 0)
1491 {
1492 Assert(uInterruptState <= 2); /* only sti & mov ss */
1493 Log(("uInterruptState %x eip=%RGv\n", uInterruptState, pCtx->rip));
1494 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1495 }
1496 else
1497 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1498
1499 /* Control registers. */
1500 VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1501 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1502 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
1503 CPUMSetGuestCR0(pVM, val);
1504
1505 VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1506 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1507 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
1508 CPUMSetGuestCR4(pVM, val);
1509
1510 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
1511 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1512 if ( pVM->hwaccm.s.fNestedPaging
1513 && CPUMIsGuestInPagedProtectedModeEx(pCtx))
1514 {
1515 /* Can be updated behind our back in the nested paging case. */
1516 CPUMSetGuestCR2(pVM, ASMGetCR2());
1517
1518 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
1519
1520 if (val != pCtx->cr3)
1521 {
1522 CPUMSetGuestCR3(pVM, val);
1523 PGMUpdateCR3(pVM, val);
1524 }
1525 /* Prefetch the four PDPT entries in PAE mode. */
1526 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1527 }
1528
1529 /* Sync back DR7 here. */
1530 VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1531 pCtx->dr[7] = val;
1532
1533 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1534 VMX_READ_SELREG(ES, es);
1535 VMX_READ_SELREG(SS, ss);
1536 VMX_READ_SELREG(CS, cs);
1537 VMX_READ_SELREG(DS, ds);
1538 VMX_READ_SELREG(FS, fs);
1539 VMX_READ_SELREG(GS, gs);
1540
1541 /*
1542 * System MSRs
1543 */
1544 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
1545 pCtx->SysEnter.cs = val;
1546 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1547 pCtx->SysEnter.eip = val;
1548 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1549 pCtx->SysEnter.esp = val;
1550
1551 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1552 VMX_READ_SELREG(LDTR, ldtr);
1553
1554 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
1555 pCtx->gdtr.cbGdt = val;
1556 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1557 pCtx->gdtr.pGdt = val;
1558
1559 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
1560 pCtx->idtr.cbIdt = val;
1561 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1562 pCtx->idtr.pIdt = val;
1563
1564#ifdef HWACCM_VMX_EMULATE_REALMODE
1565 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1566 if (CPUMIsGuestInRealModeEx(pCtx))
1567 {
1568 /* Hide our emulation flags */
1569 pCtx->eflags.Bits.u1VM = 0;
1570 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
1571
1572 /* Force a TR resync every time in case we switch modes. */
1573 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
1574 }
1575 else
1576#endif /* HWACCM_VMX_EMULATE_REALMODE */
1577 {
1578 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1579 VMX_READ_SELREG(TR, tr);
1580 }
1581 return VINF_SUCCESS;
1582}
1583
1584/**
1585 * Dummy placeholder
1586 *
1587 * @param pVM The VM to operate on.
1588 * @param pVCpu The VMCPU to operate on.
1589 */
1590static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu)
1591{
1592 NOREF(pVM);
1593 NOREF(pVCpu);
1594 return;
1595}
1596
1597/**
1598 * Setup the tagged TLB for EPT
1599 *
1600 * @returns VBox status code.
1601 * @param pVM The VM to operate on.
1602 * @param pVCpu The VMCPU to operate on.
1603 */
1604static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu)
1605{
1606 PHWACCM_CPUINFO pCpu;
1607
1608 Assert(pVM->hwaccm.s.fNestedPaging);
1609 Assert(!pVM->hwaccm.s.vmx.fVPID);
1610
1611 /* Deal with tagged TLBs if VPID or EPT is supported. */
1612 pCpu = HWACCMR0GetCurrentCpu();
1613 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1614 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1615 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1616 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1617 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1618 {
1619 /* Force a TLB flush on VM entry. */
1620 pVCpu->hwaccm.s.fForceTLBFlush = true;
1621 }
1622 else
1623 Assert(!pCpu->fFlushTLB);
1624
1625 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1626 pCpu->fFlushTLB = false;
1627
1628 if (pVCpu->hwaccm.s.fForceTLBFlush)
1629 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1630
1631#ifdef VBOX_WITH_STATISTICS
1632 if (pVCpu->hwaccm.s.fForceTLBFlush)
1633 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1634 else
1635 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1636#endif
1637}
1638
1639#ifdef HWACCM_VTX_WITH_VPID
1640/**
1641 * Setup the tagged TLB for VPID
1642 *
1643 * @returns VBox status code.
1644 * @param pVM The VM to operate on.
1645 * @param pVCpu The VMCPU to operate on.
1646 */
1647static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu)
1648{
1649 PHWACCM_CPUINFO pCpu;
1650
1651 Assert(pVM->hwaccm.s.vmx.fVPID);
1652 Assert(!pVM->hwaccm.s.fNestedPaging);
1653
1654 /* Deal with tagged TLBs if VPID or EPT is supported. */
1655 pCpu = HWACCMR0GetCurrentCpu();
1656 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1657 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1658 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1659 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1660 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1661 {
1662 /* Force a TLB flush on VM entry. */
1663 pVCpu->hwaccm.s.fForceTLBFlush = true;
1664 }
1665 else
1666 Assert(!pCpu->fFlushTLB);
1667
1668 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1669
1670 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1671 if (pVCpu->hwaccm.s.fForceTLBFlush)
1672 {
1673 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1674 || pCpu->fFlushTLB)
1675 {
1676 pCpu->fFlushTLB = false;
1677 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1678 pCpu->cTLBFlushes++;
1679 }
1680 else
1681 {
1682 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1683 pVCpu->hwaccm.s.fForceTLBFlush = false;
1684 }
1685
1686 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1687 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1688 }
1689 else
1690 {
1691 Assert(!pCpu->fFlushTLB);
1692
1693 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1694 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1695 }
1696 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1697 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1698 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1699
1700 int rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
1701 AssertRC(rc);
1702
1703 if (pVCpu->hwaccm.s.fForceTLBFlush)
1704 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1705
1706#ifdef VBOX_WITH_STATISTICS
1707 if (pVCpu->hwaccm.s.fForceTLBFlush)
1708 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1709 else
1710 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1711#endif
1712}
1713#endif /* HWACCM_VTX_WITH_VPID */
1714
1715/**
1716 * Runs guest code in a VT-x VM.
1717 *
1718 * @returns VBox status code.
1719 * @param pVM The VM to operate on.
1720 * @param pVCpu The VMCPU to operate on.
1721 * @param pCtx Guest context
1722 */
1723VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1724{
1725 int rc = VINF_SUCCESS;
1726 RTCCUINTREG val;
1727 RTCCUINTREG exitReason, instrError, cbInstr;
1728 RTGCUINTPTR exitQualification;
1729 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1730 RTGCUINTPTR errCode, instrInfo;
1731 bool fSyncTPR = false;
1732 PHWACCM_CPUINFO pCpu = 0;
1733 unsigned cResume = 0;
1734#ifdef VBOX_STRICT
1735 RTCPUID idCpuCheck;
1736#endif
1737
1738 Log2(("\nE"));
1739
1740 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
1741
1742#ifdef VBOX_STRICT
1743 rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1744 AssertRC(rc);
1745 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1746
1747 /* allowed zero */
1748 if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1749 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1750
1751 /* allowed one */
1752 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1753 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1754
1755 rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1756 AssertRC(rc);
1757 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1758
1759 /* Must be set according to the MSR, but can be cleared in case of EPT. */
1760 if (pVM->hwaccm.s.fNestedPaging)
1761 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
1762 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1763 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1764
1765 /* allowed zero */
1766 if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1767 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1768
1769 /* allowed one */
1770 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1771 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1772
1773 rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1774 AssertRC(rc);
1775 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1776
1777 /* allowed zero */
1778 if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1779 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1780
1781 /* allowed one */
1782 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1783 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1784
1785 rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1786 AssertRC(rc);
1787 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1788
1789 /* allowed zero */
1790 if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1791 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1792
1793 /* allowed one */
1794 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1795 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1796#endif
1797
1798 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1799 */
1800ResumeExecution:
1801 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1802 ("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1803 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1804 Assert(!HWACCMR0SuspendPending());
1805
1806 /* Safety precaution; looping for too long here can have a very bad effect on the host */
1807 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1808 {
1809 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
1810 rc = VINF_EM_RAW_INTERRUPT;
1811 goto end;
1812 }
1813
1814 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1815 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1816 {
1817 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1818 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1819 {
1820 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1821 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1822 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1823 * break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1824 */
1825 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1826 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1827 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1828 AssertRC(rc);
1829 }
1830 }
1831 else
1832 {
1833 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1834 rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1835 AssertRC(rc);
1836 }
1837
1838 /* Check for pending actions that force us to go back to ring 3. */
1839 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
1840 {
1841 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1842 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1843 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1844 rc = VINF_EM_RAW_TO_R3;
1845 goto end;
1846 }
1847 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1848 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1849 {
1850 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1851 rc = VINF_EM_PENDING_REQUEST;
1852 goto end;
1853 }
1854
1855 /* When external interrupts are pending, we should exit the VM when IF is set. */
1856 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1857 rc = VMXR0CheckPendingInterrupt(pVM, pVCpu, pCtx);
1858 if (RT_FAILURE(rc))
1859 {
1860 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1861 goto end;
1862 }
1863
1864 /** @todo check timers?? */
1865
1866 /* TPR caching using CR8 is only available in 64 bits mode */
1867 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1868 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1869 /**
1870 * @todo reduce overhead
1871 */
1872 if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1873 && pVM->hwaccm.s.vmx.pAPIC)
1874 {
1875 /* TPR caching in CR8 */
1876 uint8_t u8TPR;
1877 bool fPending;
1878
1879 int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1880 AssertRC(rc);
1881 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
1882 pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1883
1884 /* Two options here:
1885 * - external interrupt pending, but masked by the TPR value.
1886 * -> a CR8 update that lower the current TPR value should cause an exit
1887 * - no pending interrupts
1888 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1889 */
1890 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1891 AssertRC(rc);
1892
1893 /* Always sync back the TPR; we should optimize this though */ /** @todo optimize TPR sync. */
1894 fSyncTPR = true;
1895 }
1896
1897#if defined(HWACCM_VTX_WITH_EPT) && defined(LOG_ENABLED)
1898 if ( pVM->hwaccm.s.fNestedPaging
1899# ifdef HWACCM_VTX_WITH_VPID
1900 || pVM->hwaccm.s.vmx.fVPID
1901# endif /* HWACCM_VTX_WITH_VPID */
1902 )
1903 {
1904 pCpu = HWACCMR0GetCurrentCpu();
1905 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1906 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1907 {
1908 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1909 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1910 else
1911 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1912 }
1913 if (pCpu->fFlushTLB)
1914 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1915 else
1916 if (pVCpu->hwaccm.s.fForceTLBFlush)
1917 LogFlow(("Manual TLB flush\n"));
1918 }
1919#endif
1920
1921 /*
1922 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1923 * (until the actual world switch)
1924 */
1925#ifdef VBOX_STRICT
1926 idCpuCheck = RTMpCpuId();
1927#endif
1928 /* Save the host state first. */
1929 rc = VMXR0SaveHostState(pVM, pVCpu);
1930 if (rc != VINF_SUCCESS)
1931 {
1932 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1933 goto end;
1934 }
1935 /* Load the guest state */
1936 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
1937 if (rc != VINF_SUCCESS)
1938 {
1939 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1940 goto end;
1941 }
1942
1943 /* Deal with tagged TLB setup and invalidation. */
1944 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
1945
1946 /* Non-register state Guest Context */
1947 /** @todo change me according to cpu state */
1948 rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1949 AssertRC(rc);
1950
1951 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1952
1953 /* Manual save and restore:
1954 * - General purpose registers except RIP, RSP
1955 *
1956 * Trashed:
1957 * - CR2 (we don't care)
1958 * - LDTR (reset to 0)
1959 * - DRx (presumably not changed at all)
1960 * - DR7 (reset to 0x400)
1961 * - EFLAGS (reset to RT_BIT(1); not relevant)
1962 *
1963 */
1964
1965 /* All done! Let's start VM execution. */
1966 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1967#ifdef VBOX_STRICT
1968 Assert(idCpuCheck == RTMpCpuId());
1969#endif
1970 TMNotifyStartOfExecution(pVM);
1971 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx);
1972 TMNotifyEndOfExecution(pVM);
1973
1974 /* In case we execute a goto ResumeExecution later on. */
1975 pVCpu->hwaccm.s.fResumeVM = true;
1976 pVCpu->hwaccm.s.fForceTLBFlush = false;
1977
1978 /*
1979 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1980 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1981 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1982 */
1983
1984 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1985 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit, x);
1986
1987 if (rc != VINF_SUCCESS)
1988 {
1989 VMXR0ReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
1990 goto end;
1991 }
1992 /* Success. Query the guest state and figure out what has happened. */
1993
1994 /* Investigate why there was a VM-exit. */
1995 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1996 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1997
1998 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1999 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
2000 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
2001 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
2002 intInfo = val;
2003 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
2004 errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
2005 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
2006 instrInfo = val;
2007 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
2008 exitQualification = val;
2009 AssertRC(rc);
2010
2011 /* Sync back the guest state */
2012 rc = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
2013 AssertRC(rc);
2014
2015 /* Note! NOW IT'S SAFE FOR LOGGING! */
2016 Log2(("Raw exit reason %08x\n", exitReason));
2017
2018 /* Check if an injected event was interrupted prematurely. */
2019 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
2020 AssertRC(rc);
2021 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
2022 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2023 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW)
2024 {
2025 pVCpu->hwaccm.s.Event.fPending = true;
2026 /* Error code present? */
2027 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2028 {
2029 rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
2030 AssertRC(rc);
2031 pVCpu->hwaccm.s.Event.errCode = val;
2032 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2033 }
2034 else
2035 {
2036 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2037 pVCpu->hwaccm.s.Event.errCode = 0;
2038 }
2039 }
2040
2041#ifdef VBOX_STRICT
2042 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2043 HWACCMDumpRegs(pVM, pCtx);
2044#endif
2045
2046 Log2(("E%d", exitReason));
2047 Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
2048 Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
2049 Log2(("Interruption error code %d\n", errCode));
2050 Log2(("IntInfo = %08x\n", intInfo));
2051 Log2(("New EIP=%RGv\n", (RTGCPTR)pCtx->rip));
2052
2053 if (fSyncTPR)
2054 {
2055 rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
2056 AssertRC(rc);
2057 }
2058
2059 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2060 switch (exitReason)
2061 {
2062 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2063 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2064 {
2065 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2066
2067 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2068 {
2069 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2070 /* External interrupt; leave to allow it to be dispatched again. */
2071 rc = VINF_EM_RAW_INTERRUPT;
2072 break;
2073 }
2074 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2075 {
2076 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2077 /* External interrupt; leave to allow it to be dispatched again. */
2078 rc = VINF_EM_RAW_INTERRUPT;
2079 break;
2080
2081 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2082 AssertFailed(); /* can't come here; fails the first check. */
2083 break;
2084
2085 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
2086 Assert(vector == 3 || vector == 4);
2087 /* no break */
2088 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
2089 Log2(("Hardware/software interrupt %d\n", vector));
2090 switch (vector)
2091 {
2092 case X86_XCPT_NM:
2093 {
2094 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
2095
2096 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
2097 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
2098 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
2099 if (rc == VINF_SUCCESS)
2100 {
2101 Assert(CPUMIsGuestFPUStateActive(pVCpu));
2102
2103 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
2104
2105 /* Continue execution. */
2106 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2107 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2108
2109 goto ResumeExecution;
2110 }
2111
2112 Log(("Forward #NM fault to the guest\n"));
2113 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
2114 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
2115 AssertRC(rc);
2116 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2117 goto ResumeExecution;
2118 }
2119
2120 case X86_XCPT_PF: /* Page fault */
2121 {
2122#ifdef DEBUG
2123 if (pVM->hwaccm.s.fNestedPaging)
2124 { /* A genuine pagefault.
2125 * Forward the trap to the guest by injecting the exception and resuming execution.
2126 */
2127 Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
2128
2129 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
2130
2131 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2132
2133 /* Now we must update CR2. */
2134 pCtx->cr2 = exitQualification;
2135 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2136 AssertRC(rc);
2137
2138 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2139 goto ResumeExecution;
2140 }
2141#endif
2142 Assert(!pVM->hwaccm.s.fNestedPaging);
2143
2144 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
2145 /* Exit qualification contains the linear address of the page fault. */
2146 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2147 TRPMSetErrorCode(pVM, errCode);
2148 TRPMSetFaultAddress(pVM, exitQualification);
2149
2150 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
2151 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
2152 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2153 if (rc == VINF_SUCCESS)
2154 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2155 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
2156 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2157
2158 TRPMResetTrap(pVM);
2159
2160 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2161 goto ResumeExecution;
2162 }
2163 else
2164 if (rc == VINF_EM_RAW_GUEST_TRAP)
2165 { /* A genuine pagefault.
2166 * Forward the trap to the guest by injecting the exception and resuming execution.
2167 */
2168 Log2(("Forward page fault to the guest\n"));
2169
2170 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2171 /* The error code might have been changed. */
2172 errCode = TRPMGetErrorCode(pVM);
2173
2174 TRPMResetTrap(pVM);
2175
2176 /* Now we must update CR2. */
2177 pCtx->cr2 = exitQualification;
2178 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2179 AssertRC(rc);
2180
2181 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2182 goto ResumeExecution;
2183 }
2184#ifdef VBOX_STRICT
2185 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2186 Log2(("PGMTrap0eHandler failed with %d\n", rc));
2187#endif
2188 /* Need to go back to the recompiler to emulate the instruction. */
2189 TRPMResetTrap(pVM);
2190 break;
2191 }
2192
2193 case X86_XCPT_MF: /* Floating point exception. */
2194 {
2195 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
2196 if (!(pCtx->cr0 & X86_CR0_NE))
2197 {
2198 /* old style FPU error reporting needs some extra work. */
2199 /** @todo don't fall back to the recompiler, but do it manually. */
2200 rc = VINF_EM_RAW_EMULATE_INSTR;
2201 break;
2202 }
2203 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2204 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2205 AssertRC(rc);
2206
2207 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2208 goto ResumeExecution;
2209 }
2210
2211 case X86_XCPT_DB: /* Debug exception. */
2212 {
2213 uint64_t uDR6;
2214
2215 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
2216 *
2217 * Exit qualification bits:
2218 * 3:0 B0-B3 which breakpoint condition was met
2219 * 12:4 Reserved (0)
2220 * 13 BD - debug register access detected
2221 * 14 BS - single step execution or branch taken
2222 * 63:15 Reserved (0)
2223 */
2224 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
2225
2226 /* Note that we don't support guest and host-initiated debugging at the same time. */
2227 Assert(DBGFIsStepping(pVM) || CPUMIsGuestInRealModeEx(pCtx));
2228
2229 uDR6 = X86_DR6_INIT_VAL;
2230 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
2231 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
2232 if (rc == VINF_EM_RAW_GUEST_TRAP)
2233 {
2234 /** @todo this isn't working, but we'll never get here normally. */
2235
2236 /* Update DR6 here. */
2237 pCtx->dr[6] = uDR6;
2238
2239 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2240 pCtx->dr[7] &= ~X86_DR7_GD;
2241
2242 /* Paranoia. */
2243 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2244 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2245 pCtx->dr[7] |= 0x400; /* must be one */
2246
2247 /* Resync DR7 */
2248 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2249 AssertRC(rc);
2250
2251 Log(("Trap %x (debug) at %RGv exit qualification %RX64\n", vector, (RTGCPTR)pCtx->rip, exitQualification));
2252 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2253 AssertRC(rc);
2254
2255 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2256 goto ResumeExecution;
2257 }
2258 /* Return to ring 3 to deal with the debug exit code. */
2259 break;
2260 }
2261
2262 case X86_XCPT_GP: /* General protection failure exception.*/
2263 {
2264 uint32_t cbSize;
2265
2266 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
2267#ifdef VBOX_STRICT
2268 if (!CPUMIsGuestInRealModeEx(pCtx))
2269 {
2270 Log(("Trap %x at %04X:%RGv errorCode=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
2271 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2272 AssertRC(rc);
2273 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2274 goto ResumeExecution;
2275 }
2276#endif
2277 Assert(CPUMIsGuestInRealModeEx(pCtx));
2278
2279 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %RGv\n", (RTGCPTR)pCtx->rip));
2280 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2281 if (rc == VINF_SUCCESS)
2282 {
2283 /* EIP has been updated already. */
2284
2285 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2286 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2287
2288 /* Only resume if successful. */
2289 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2290 goto ResumeExecution;
2291 }
2292 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", rc));
2293 break;
2294 }
2295
2296#ifdef VBOX_STRICT
2297 case X86_XCPT_DE: /* Divide error. */
2298 case X86_XCPT_UD: /* Unknown opcode exception. */
2299 case X86_XCPT_SS: /* Stack segment exception. */
2300 case X86_XCPT_NP: /* Segment not present exception. */
2301 {
2302 switch(vector)
2303 {
2304 case X86_XCPT_DE:
2305 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
2306 break;
2307 case X86_XCPT_UD:
2308 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
2309 break;
2310 case X86_XCPT_SS:
2311 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
2312 break;
2313 case X86_XCPT_NP:
2314 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
2315 break;
2316 }
2317
2318 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2319 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2320 AssertRC(rc);
2321
2322 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2323 goto ResumeExecution;
2324 }
2325#endif
2326 default:
2327#ifdef HWACCM_VMX_EMULATE_REALMODE
2328 if (CPUMIsGuestInRealModeEx(pCtx))
2329 {
2330 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
2331 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2332 AssertRC(rc);
2333
2334 /* Go back to ring 3 in case of a triple fault. */
2335 if ( vector == X86_XCPT_DF
2336 && rc == VINF_EM_RESET)
2337 break;
2338
2339 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2340 goto ResumeExecution;
2341 }
2342#endif
2343 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2344 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2345 break;
2346 } /* switch (vector) */
2347
2348 break;
2349
2350 default:
2351 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2352 AssertFailed();
2353 break;
2354 }
2355
2356 break;
2357 }
2358
2359 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
2360 {
2361 RTGCPHYS GCPhys;
2362
2363 Assert(pVM->hwaccm.s.fNestedPaging);
2364
2365#if HC_ARCH_BITS == 64
2366 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2367 AssertRC(rc);
2368#else
2369 uint32_t val_hi;
2370 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &val);
2371 AssertRC(rc);
2372 rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_HIGH, &val_hi);
2373 AssertRC(rc);
2374 GCPhys = RT_MAKE_U64(val, val_hi);
2375#endif
2376
2377 Assert(((exitQualification >> 7) & 3) != 2);
2378
2379 /* Determine the kind of violation. */
2380 errCode = 0;
2381 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
2382 errCode |= X86_TRAP_PF_ID;
2383
2384 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
2385 errCode |= X86_TRAP_PF_RW;
2386
2387 /* If the page is present, then it's a page level protection fault. */
2388 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
2389 errCode |= X86_TRAP_PF_P;
2390
2391 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
2392
2393 /* GCPhys contains the guest physical address of the page fault. */
2394 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2395 TRPMSetErrorCode(pVM, errCode);
2396 TRPMSetFaultAddress(pVM, GCPhys);
2397
2398 /* Handle the pagefault trap for the nested shadow table. */
2399 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
2400 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2401 if (rc == VINF_SUCCESS)
2402 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2403 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
2404 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2405
2406 TRPMResetTrap(pVM);
2407
2408 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2409 goto ResumeExecution;
2410 }
2411
2412#ifdef VBOX_STRICT
2413 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2414 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
2415#endif
2416 /* Need to go back to the recompiler to emulate the instruction. */
2417 TRPMResetTrap(pVM);
2418 break;
2419 }
2420
2421 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2422 /* Clear VM-exit on IF=1 change. */
2423 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2424 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2425 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2426 AssertRC(rc);
2427 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
2428 goto ResumeExecution; /* we check for pending guest interrupts there */
2429
2430 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2431 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2432 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
2433 /* Skip instruction and continue directly. */
2434 pCtx->rip += cbInstr;
2435 /* Continue execution.*/
2436 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2437 goto ResumeExecution;
2438
2439 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2440 {
2441 Log2(("VMX: Cpuid %x\n", pCtx->eax));
2442 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
2443 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2444 if (rc == VINF_SUCCESS)
2445 {
2446 /* Update EIP and continue execution. */
2447 Assert(cbInstr == 2);
2448 pCtx->rip += cbInstr;
2449 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2450 goto ResumeExecution;
2451 }
2452 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
2453 rc = VINF_EM_RAW_EMULATE_INSTR;
2454 break;
2455 }
2456
2457 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2458 {
2459 Log2(("VMX: Rdtsc\n"));
2460 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
2461 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2462 if (rc == VINF_SUCCESS)
2463 {
2464 /* Update EIP and continue execution. */
2465 Assert(cbInstr == 2);
2466 pCtx->rip += cbInstr;
2467 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2468 goto ResumeExecution;
2469 }
2470 AssertMsgFailed(("EMU: rdtsc failed with %Rrc\n", rc));
2471 rc = VINF_EM_RAW_EMULATE_INSTR;
2472 break;
2473 }
2474
2475 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2476 {
2477 Log2(("VMX: invlpg\n"));
2478 Assert(!pVM->hwaccm.s.fNestedPaging);
2479
2480 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
2481 rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2482 if (rc == VINF_SUCCESS)
2483 {
2484 /* Update EIP and continue execution. */
2485 pCtx->rip += cbInstr;
2486 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2487 goto ResumeExecution;
2488 }
2489 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, rc));
2490 break;
2491 }
2492
2493 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2494 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2495 {
2496 uint32_t cbSize;
2497
2498 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2499 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2500 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2501 if (rc == VINF_SUCCESS)
2502 {
2503 /* EIP has been updated already. */
2504
2505 /* Only resume if successful. */
2506 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2507 goto ResumeExecution;
2508 }
2509 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2510 break;
2511 }
2512
2513 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2514 {
2515 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2516 {
2517 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2518 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2519 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite);
2520 rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2521 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2522 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2523
2524 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2525 {
2526 case 0:
2527 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
2528 break;
2529 case 2:
2530 break;
2531 case 3:
2532 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
2533 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
2534 break;
2535 case 4:
2536 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
2537 break;
2538 case 8:
2539 /* CR8 contains the APIC TPR */
2540 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2541 break;
2542
2543 default:
2544 AssertFailed();
2545 break;
2546 }
2547 /* Check if a sync operation is pending. */
2548 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2549 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2550 {
2551 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2552 AssertRC(rc);
2553 }
2554 break;
2555
2556 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2557 Log2(("VMX: mov x, crx\n"));
2558 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead);
2559
2560 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
2561
2562 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2563 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2564
2565 rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2566 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2567 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2568 break;
2569
2570 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2571 Log2(("VMX: clts\n"));
2572 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
2573 rc = EMInterpretCLTS(pVM);
2574 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2575 break;
2576
2577 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2578 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2579 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
2580 rc = EMInterpretLMSW(pVM, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2581 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2582 break;
2583 }
2584
2585 /* Update EIP if no error occurred. */
2586 if (RT_SUCCESS(rc))
2587 pCtx->rip += cbInstr;
2588
2589 if (rc == VINF_SUCCESS)
2590 {
2591 /* Only resume if successful. */
2592 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2593 goto ResumeExecution;
2594 }
2595 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2596 break;
2597 }
2598
2599 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2600 {
2601 if (!DBGFIsStepping(pVM))
2602 {
2603 /* Disable drx move intercepts. */
2604 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2605 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2606 AssertRC(rc);
2607
2608 /* Save the host and load the guest debug state. */
2609 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2610 AssertRC(rc);
2611
2612#ifdef VBOX_WITH_STATISTICS
2613 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2614 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2615 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2616 else
2617 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2618#endif
2619
2620 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2621 goto ResumeExecution;
2622 }
2623
2624 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2625 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2626 {
2627 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2628 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2629 rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2630 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2631 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2632 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2633 Log2(("DR7=%08x\n", pCtx->dr[7]));
2634 }
2635 else
2636 {
2637 Log2(("VMX: mov x, drx\n"));
2638 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2639 rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2640 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2641 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2642 }
2643 /* Update EIP if no error occurred. */
2644 if (RT_SUCCESS(rc))
2645 pCtx->rip += cbInstr;
2646
2647 if (rc == VINF_SUCCESS)
2648 {
2649 /* Only resume if successful. */
2650 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2651 goto ResumeExecution;
2652 }
2653 Assert(rc == VERR_EM_INTERPRETER);
2654 break;
2655 }
2656
2657 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2658 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2659 {
2660 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2661 uint32_t uPort;
2662 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2663
2664 /** @todo necessary to make the distinction? */
2665 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2666 {
2667 uPort = pCtx->edx & 0xffff;
2668 }
2669 else
2670 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2671
2672 /* paranoia */
2673 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
2674 {
2675 rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2676 break;
2677 }
2678
2679 uint32_t cbSize = g_aIOSize[uIOWidth];
2680
2681 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2682 {
2683 /* ins/outs */
2684 uint32_t prefix = 0;
2685 if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2686 prefix |= PREFIX_REP;
2687
2688 if (fIOWrite)
2689 {
2690 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2691 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2692 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2693 }
2694 else
2695 {
2696 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2697 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2698 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2699 }
2700 }
2701 else
2702 {
2703 /* normal in/out */
2704 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2705
2706 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2707
2708 if (fIOWrite)
2709 {
2710 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2711 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2712 }
2713 else
2714 {
2715 uint32_t u32Val = 0;
2716
2717 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2718 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2719 if (IOM_SUCCESS(rc))
2720 {
2721 /* Write back to the EAX register. */
2722 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2723 }
2724 }
2725 }
2726 /*
2727 * Handled the I/O return codes.
2728 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2729 */
2730 if (IOM_SUCCESS(rc))
2731 {
2732 /* Update EIP and continue execution. */
2733 pCtx->rip += cbInstr;
2734 if (RT_LIKELY(rc == VINF_SUCCESS))
2735 {
2736 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2737 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2738 {
2739 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2740 for (unsigned i=0;i<4;i++)
2741 {
2742 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2743
2744 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2745 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2746 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2747 {
2748 uint64_t uDR6;
2749
2750 Assert(CPUMIsGuestDebugStateActive(pVM));
2751
2752 uDR6 = ASMGetDR6();
2753
2754 /* Clear all breakpoint status flags and set the one we just hit. */
2755 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2756 uDR6 |= (uint64_t)RT_BIT(i);
2757
2758 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2759 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2760 * the contents have been read.
2761 */
2762 ASMSetDR6(uDR6);
2763
2764 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2765 pCtx->dr[7] &= ~X86_DR7_GD;
2766
2767 /* Paranoia. */
2768 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2769 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2770 pCtx->dr[7] |= 0x400; /* must be one */
2771
2772 /* Resync DR7 */
2773 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2774 AssertRC(rc);
2775
2776 /* Construct inject info. */
2777 intInfo = X86_XCPT_DB;
2778 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2779 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2780
2781 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2782 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2783 AssertRC(rc);
2784
2785 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2786 goto ResumeExecution;
2787 }
2788 }
2789 }
2790
2791 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2792 goto ResumeExecution;
2793 }
2794 break;
2795 }
2796
2797#ifdef VBOX_STRICT
2798 if (rc == VINF_IOM_HC_IOPORT_READ)
2799 Assert(!fIOWrite);
2800 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2801 Assert(fIOWrite);
2802 else
2803 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2804#endif
2805 break;
2806 }
2807
2808 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2809 LogFlow(("VMX_EXIT_TPR\n"));
2810 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2811 goto ResumeExecution;
2812
2813 default:
2814 /* The rest is handled after syncing the entire CPU state. */
2815 break;
2816 }
2817
2818 /* Note: the guest state isn't entirely synced back at this stage. */
2819
2820 /* Investigate why there was a VM-exit. (part 2) */
2821 switch (exitReason)
2822 {
2823 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2824 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2825 case VMX_EXIT_EPT_VIOLATION:
2826 /* Already handled above. */
2827 break;
2828
2829 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2830 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2831 break;
2832
2833 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2834 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2835 rc = VINF_EM_RAW_INTERRUPT;
2836 AssertFailed(); /* Can't happen. Yet. */
2837 break;
2838
2839 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2840 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2841 rc = VINF_EM_RAW_INTERRUPT;
2842 AssertFailed(); /* Can't happen afaik. */
2843 break;
2844
2845 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2846 rc = VERR_EM_INTERPRETER;
2847 break;
2848
2849 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2850 /** Check if external interrupts are pending; if so, don't switch back. */
2851 pCtx->rip++; /* skip hlt */
2852 if ( pCtx->eflags.Bits.u1IF
2853 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
2854 goto ResumeExecution;
2855
2856 rc = VINF_EM_HALT;
2857 break;
2858
2859 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2860 AssertFailed(); /* can't happen. */
2861 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2862 break;
2863
2864 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2865 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2866 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2867 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2868 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2869 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2870 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2871 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2872 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2873 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2874 /** @todo inject #UD immediately */
2875 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2876 break;
2877
2878 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2879 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2880 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2881 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2882 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2883 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2884 /* already handled above */
2885 AssertMsg( rc == VINF_PGM_CHANGE_MODE
2886 || rc == VINF_EM_RAW_INTERRUPT
2887 || rc == VERR_EM_INTERPRETER
2888 || rc == VINF_EM_RAW_EMULATE_INSTR
2889 || rc == VINF_PGM_SYNC_CR3
2890 || rc == VINF_IOM_HC_IOPORT_READ
2891 || rc == VINF_IOM_HC_IOPORT_WRITE
2892 || rc == VINF_EM_RAW_GUEST_TRAP
2893 || rc == VINF_TRPM_XCPT_DISPATCHED
2894 || rc == VINF_EM_RESCHEDULE_REM,
2895 ("rc = %d\n", rc));
2896 break;
2897
2898 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2899 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2900 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2901 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2902 rc = VERR_EM_INTERPRETER;
2903 break;
2904
2905 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2906 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2907 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2908 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2909 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2910 break;
2911
2912 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2913 Assert(rc == VINF_EM_RAW_INTERRUPT);
2914 break;
2915
2916 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2917 {
2918#ifdef VBOX_STRICT
2919 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2920
2921 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2922 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
2923
2924 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2925 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2926
2927 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2928 Log(("VMX_VMCS_GUEST_CR3 %RGp\n", val));
2929
2930 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2931 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2932
2933 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2934 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2935
2936 VMX_LOG_SELREG(CS, "CS");
2937 VMX_LOG_SELREG(DS, "DS");
2938 VMX_LOG_SELREG(ES, "ES");
2939 VMX_LOG_SELREG(FS, "FS");
2940 VMX_LOG_SELREG(GS, "GS");
2941 VMX_LOG_SELREG(SS, "SS");
2942 VMX_LOG_SELREG(TR, "TR");
2943 VMX_LOG_SELREG(LDTR, "LDTR");
2944
2945 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2946 Log(("VMX_VMCS_GUEST_GDTR_BASE %RGv\n", val));
2947 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2948 Log(("VMX_VMCS_GUEST_IDTR_BASE %RGv\n", val));
2949#endif /* VBOX_STRICT */
2950 rc = VERR_VMX_INVALID_GUEST_STATE;
2951 break;
2952 }
2953
2954 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2955 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2956 default:
2957 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2958 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2959 break;
2960
2961 }
2962end:
2963
2964 /* Signal changes for the recompiler. */
2965 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2966
2967 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2968 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2969 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2970 {
2971 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2972 /* On the next entry we'll only sync the host context. */
2973 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2974 }
2975 else
2976 {
2977 /* On the next entry we'll sync everything. */
2978 /** @todo we can do better than this */
2979 /* Not in the VINF_PGM_CHANGE_MODE though! */
2980 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2981 }
2982
2983 /* translate into a less severe return code */
2984 if (rc == VERR_EM_INTERPRETER)
2985 rc = VINF_EM_RAW_EMULATE_INSTR;
2986 else
2987 /* Try to extract more information about what might have gone wrong here. */
2988 if (rc == VERR_VMX_INVALID_VMCS_PTR)
2989 {
2990 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
2991 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pVMCS;
2992 }
2993
2994 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2995
2996 Log2(("X"));
2997 return rc;
2998}
2999
3000
3001/**
3002 * Enters the VT-x session
3003 *
3004 * @returns VBox status code.
3005 * @param pVM The VM to operate on.
3006 * @param pVCpu The VMCPU to operate on.
3007 * @param pCpu CPU info struct
3008 */
3009VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
3010{
3011 Assert(pVM->hwaccm.s.vmx.fSupported);
3012
3013 unsigned cr4 = ASMGetCR4();
3014 if (!(cr4 & X86_CR4_VMXE))
3015 {
3016 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
3017 return VERR_VMX_X86_CR4_VMXE_CLEARED;
3018 }
3019
3020 /* Activate the VM Control Structure. */
3021 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3022 if (RT_FAILURE(rc))
3023 return rc;
3024
3025 pVCpu->hwaccm.s.fResumeVM = false;
3026 return VINF_SUCCESS;
3027}
3028
3029
3030/**
3031 * Leaves the VT-x session
3032 *
3033 * @returns VBox status code.
3034 * @param pVM The VM to operate on.
3035 * @param pVCpu The VMCPU to operate on.
3036 * @param pCtx CPU context
3037 */
3038VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
3039{
3040 Assert(pVM->hwaccm.s.vmx.fSupported);
3041
3042 /* Save the guest debug state if necessary. */
3043 if (CPUMIsGuestDebugStateActive(pVM))
3044 {
3045 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
3046
3047 /* Enable drx move intercepts again. */
3048 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3049 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3050 AssertRC(rc);
3051
3052 /* Resync the debug registers the next time. */
3053 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3054 }
3055 else
3056 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
3057
3058 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
3059 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3060 AssertRC(rc);
3061
3062 return VINF_SUCCESS;
3063}
3064
3065/**
3066 * Flush the TLB (EPT)
3067 *
3068 * @returns VBox status code.
3069 * @param pVM The VM to operate on.
3070 * @param pVCpu The VM CPU to operate on.
3071 * @param enmFlush Type of flush
3072 * @param GCPhys Physical address of the page to flush
3073 */
3074static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys)
3075{
3076 uint64_t descriptor[2];
3077
3078 LogFlow(("vmxR0FlushEPT %d %RGv\n", enmFlush, GCPhys));
3079 Assert(pVM->hwaccm.s.fNestedPaging);
3080 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
3081 descriptor[1] = GCPhys;
3082 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
3083 AssertRC(rc);
3084}
3085
3086#ifdef HWACCM_VTX_WITH_VPID
3087/**
3088 * Flush the TLB (EPT)
3089 *
3090 * @returns VBox status code.
3091 * @param pVM The VM to operate on.
3092 * @param pVCpu The VM CPU to operate on.
3093 * @param enmFlush Type of flush
3094 * @param GCPtr Virtual address of the page to flush
3095 */
3096static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr)
3097{
3098 uint64_t descriptor[2];
3099
3100 Assert(pVM->hwaccm.s.vmx.fVPID);
3101 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
3102 descriptor[1] = GCPtr;
3103 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]);
3104 AssertRC(rc);
3105}
3106#endif /* HWACCM_VTX_WITH_VPID */
3107
3108/**
3109 * Invalidates a guest page
3110 *
3111 * @returns VBox status code.
3112 * @param pVM The VM to operate on.
3113 * @param pVCpu The VM CPU to operate on.
3114 * @param GCVirt Page to invalidate
3115 */
3116VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
3117{
3118 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3119
3120 LogFlow(("VMXR0InvalidatePage %RGv\n", GCVirt));
3121
3122 /* Only relevant if we want to use VPID.
3123 * In the nested paging case we still see such calls, but
3124 * can safely ignore them. (e.g. after cr3 updates)
3125 */
3126#ifdef HWACCM_VTX_WITH_VPID
3127 /* Skip it if a TLB flush is already pending. */
3128 if ( !fFlushPending
3129 && pVM->hwaccm.s.vmx.fVPID)
3130 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCVirt);
3131#endif /* HWACCM_VTX_WITH_VPID */
3132
3133 return VINF_SUCCESS;
3134}
3135
3136/**
3137 * Invalidates a guest page by physical address
3138 *
3139 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
3140 *
3141 * @returns VBox status code.
3142 * @param pVM The VM to operate on.
3143 * @param pVCpu The VM CPU to operate on.
3144 * @param GCPhys Page to invalidate
3145 */
3146VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
3147{
3148 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3149
3150 Assert(pVM->hwaccm.s.fNestedPaging);
3151
3152 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
3153
3154 /* Skip it if a TLB flush is already pending. */
3155 if (!fFlushPending)
3156 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCPhys);
3157
3158 return VINF_SUCCESS;
3159}
3160
3161/**
3162 * Report world switch error and dump some useful debug info
3163 *
3164 * @param pVM The VM to operate on.
3165 * @param pVCpu The VMCPU to operate on.
3166 * @param rc Return code
3167 * @param pCtx Current CPU context (not updated)
3168 */
3169static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx)
3170{
3171 switch (rc)
3172 {
3173 case VERR_VMX_INVALID_VMXON_PTR:
3174 AssertFailed();
3175 break;
3176
3177 case VERR_VMX_UNABLE_TO_START_VM:
3178 case VERR_VMX_UNABLE_TO_RESUME_VM:
3179 {
3180 int rc;
3181 RTCCUINTREG exitReason, instrError, val;
3182
3183 rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
3184 rc |= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
3185 AssertRC(rc);
3186 if (rc == VINF_SUCCESS)
3187 {
3188 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
3189 Log(("Current stack %08x\n", &rc));
3190
3191 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
3192 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
3193
3194#ifdef VBOX_STRICT
3195 RTGDTR gdtr;
3196 PX86DESCHC pDesc;
3197
3198 ASMGetGDTR(&gdtr);
3199
3200 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
3201 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
3202 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
3203 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
3204 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
3205 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
3206 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
3207 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
3208 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
3209 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
3210
3211 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
3212 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
3213
3214 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
3215 Log(("VMX_VMCS_HOST_CR3 %RHp\n", val));
3216
3217 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
3218 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
3219
3220 VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
3221 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
3222
3223 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
3224 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
3225
3226 if (val < gdtr.cbGdt)
3227 {
3228 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3229 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
3230 }
3231
3232 VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
3233 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
3234 if (val < gdtr.cbGdt)
3235 {
3236 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3237 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
3238 }
3239
3240 VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
3241 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
3242 if (val < gdtr.cbGdt)
3243 {
3244 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3245 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
3246 }
3247
3248 VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
3249 Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
3250 if (val < gdtr.cbGdt)
3251 {
3252 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3253 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
3254 }
3255
3256 VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
3257 Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
3258 if (val < gdtr.cbGdt)
3259 {
3260 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3261 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
3262 }
3263
3264 VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
3265 Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
3266 if (val < gdtr.cbGdt)
3267 {
3268 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3269 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
3270 }
3271
3272 VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
3273 Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
3274 if (val < gdtr.cbGdt)
3275 {
3276 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3277 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
3278 }
3279
3280 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
3281 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
3282
3283 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
3284 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
3285 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
3286 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
3287
3288 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
3289 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
3290
3291 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
3292 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
3293
3294 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
3295 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
3296
3297 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
3298 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
3299 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
3300 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
3301
3302# if HC_ARCH_BITS == 64
3303 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
3304 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
3305 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
3306 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
3307 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
3308# endif
3309#endif /* VBOX_STRICT */
3310 }
3311 break;
3312 }
3313
3314 default:
3315 /* impossible */
3316 AssertFailed();
3317 break;
3318 }
3319}
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette