VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 14671

Last change on this file since 14671 was 14654, checked in by vboxsync, 16 years ago

VMXR0SaveHostState: Mac CS/SS hacks.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 129.3 KB
Line 
1/* $Id: HWVMXR0.cpp 14654 2008-11-26 17:07:04Z vboxsync $ */
2/** @file
3 * HWACCM VMX - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/pgm.h>
32#include <VBox/pdm.h>
33#include <VBox/err.h>
34#include <VBox/log.h>
35#include <VBox/selm.h>
36#include <VBox/iom.h>
37#include <iprt/param.h>
38#include <iprt/assert.h>
39#include <iprt/asm.h>
40#include <iprt/string.h>
41#include "HWVMXR0.h"
42
43/*******************************************************************************
44* Global Variables *
45*******************************************************************************/
46/* IO operation lookup arrays. */
47static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
48static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
49
50/*******************************************************************************
51* Local Functions *
52*******************************************************************************/
53static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx);
54static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu);
55static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu);
56static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu);
57static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys);
58static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr);
59static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
60
61
62static void VMXR0CheckError(PVM pVM, PVMCPU pVCpu, int rc)
63{
64 if (rc == VERR_VMX_GENERIC)
65 {
66 RTCCUINTREG instrError;
67
68 VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
69 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
70 }
71 pVM->hwaccm.s.lLastError = rc;
72}
73
74/**
75 * Sets up and activates VT-x on the current CPU
76 *
77 * @returns VBox status code.
78 * @param pCpu CPU info struct
79 * @param pVM The VM to operate on. (can be NULL after a resume!!)
80 * @param pvPageCpu Pointer to the global cpu page
81 * @param pPageCpuPhys Physical address of the global cpu page
82 */
83VMMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
84{
85 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
86 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
87
88#ifdef LOG_ENABLED
89 SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
90#endif
91 if (pVM)
92 {
93 /* Set revision dword at the beginning of the VMXON structure. */
94 *(uint32_t *)pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
95 }
96
97 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
98 * (which can have very bad consequences!!!)
99 */
100
101 /* Make sure the VMX instructions don't cause #UD faults. */
102 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
103
104 /* Enter VMX Root Mode */
105 int rc = VMXEnable(pPageCpuPhys);
106 if (RT_FAILURE(rc))
107 {
108 if (pVM)
109 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
110 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
111 return VERR_VMX_VMXON_FAILED;
112 }
113 return VINF_SUCCESS;
114}
115
116/**
117 * Deactivates VT-x on the current CPU
118 *
119 * @returns VBox status code.
120 * @param pCpu CPU info struct
121 * @param pvPageCpu Pointer to the global cpu page
122 * @param pPageCpuPhys Physical address of the global cpu page
123 */
124VMMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
125{
126 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
127 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
128
129 /* Leave VMX Root Mode. */
130 VMXDisable();
131
132 /* And clear the X86_CR4_VMXE bit */
133 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
134
135#ifdef LOG_ENABLED
136 SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
137#endif
138 return VINF_SUCCESS;
139}
140
141/**
142 * Does Ring-0 per VM VT-x init.
143 *
144 * @returns VBox status code.
145 * @param pVM The VM to operate on.
146 */
147VMMR0DECL(int) VMXR0InitVM(PVM pVM)
148{
149 int rc;
150
151#ifdef LOG_ENABLED
152 SUPR0Printf("VMXR0InitVM %x\n", pVM);
153#endif
154
155 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
156
157 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
158 {
159 /* Allocate one page for the virtual APIC mmio cache. */
160 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
161 AssertRC(rc);
162 if (RT_FAILURE(rc))
163 return rc;
164
165 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
166 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
167 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
168 }
169 else
170 {
171 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
172 pVM->hwaccm.s.vmx.pAPIC = 0;
173 pVM->hwaccm.s.vmx.pAPICPhys = 0;
174 }
175
176 /* Allocate the MSR bitmap if this feature is supported. */
177 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
178 {
179 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
180 AssertRC(rc);
181 if (RT_FAILURE(rc))
182 return rc;
183
184 pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
185 pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
186 memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
187 }
188
189 /* Allocate VMCBs for all guest CPUs. */
190 for (unsigned i=0;i<pVM->cCPUs;i++)
191 {
192 PVMCPU pVCpu = &pVM->aCpus[i];
193
194 pVCpu->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
195
196 /* Allocate one page for the VM control structure (VMCS). */
197 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
198 AssertRC(rc);
199 if (RT_FAILURE(rc))
200 return rc;
201
202 pVCpu->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjVMCS);
203 pVCpu->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjVMCS, 0);
204 ASMMemZero32(pVCpu->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
205
206 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
207 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
208
209 /* Current guest paging mode. */
210 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
211
212#ifdef LOG_ENABLED
213 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.pVMCSPhys);
214#endif
215 }
216
217 return VINF_SUCCESS;
218}
219
220/**
221 * Does Ring-0 per VM VT-x termination.
222 *
223 * @returns VBox status code.
224 * @param pVM The VM to operate on.
225 */
226VMMR0DECL(int) VMXR0TermVM(PVM pVM)
227{
228 for (unsigned i=0;i<pVM->cCPUs;i++)
229 {
230 if (pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
231 {
232 RTR0MemObjFree(pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS, false);
233 pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
234 pVM->aCpus[i].hwaccm.s.vmx.pVMCS = 0;
235 pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys = 0;
236 }
237 }
238 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
239 {
240 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
241 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
242 pVM->hwaccm.s.vmx.pAPIC = 0;
243 pVM->hwaccm.s.vmx.pAPICPhys = 0;
244 }
245 if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
248 pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
249 pVM->hwaccm.s.vmx.pMSRBitmap = 0;
250 pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
251 }
252 return VINF_SUCCESS;
253}
254
255/**
256 * Sets up VT-x for the specified VM
257 *
258 * @returns VBox status code.
259 * @param pVM The VM to operate on.
260 */
261VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
262{
263 int rc = VINF_SUCCESS;
264 uint32_t val;
265
266 AssertReturn(pVM, VERR_INVALID_PARAMETER);
267
268 for (unsigned i=0;i<pVM->cCPUs;i++)
269 {
270 Assert(pVM->aCpus[i].hwaccm.s.vmx.pVMCS);
271
272 /* Set revision dword at the beginning of the VMCS structure. */
273 *(uint32_t *)pVM->aCpus[i].hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
274
275 /* Clear VM Control Structure. */
276 Log(("pVMCSPhys = %RHp\n", pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys));
277 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
278 if (RT_FAILURE(rc))
279 goto vmx_end;
280
281 /* Activate the VM Control Structure. */
282 rc = VMXActivateVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
283 if (RT_FAILURE(rc))
284 goto vmx_end;
285
286 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
287 * Set required bits to one and zero according to the MSR capabilities.
288 */
289 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
290 /* External and non-maskable interrupts cause VM-exits. */
291 val = val | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
292 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
293
294 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
295 AssertRC(rc);
296
297 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
298 * Set required bits to one and zero according to the MSR capabilities.
299 */
300 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
301 /* Program which event cause VM-exits and which features we want to use. */
302 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
303 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
304 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
305 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
306 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
307
308 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
309 if (!pVM->hwaccm.s.fNestedPaging)
310 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
311 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
312 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
313
314 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
315
316#if HC_ARCH_BITS == 64
317 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
318 {
319 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
320 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
321 Assert(pVM->hwaccm.s.vmx.pAPIC);
322 }
323 else
324 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
325 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
326#endif
327
328#ifdef VBOX_WITH_VTX_MSR_BITMAPS
329 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
330 {
331 Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
332 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
333 }
334#endif
335
336 /* We will use the secondary control if it's present. */
337 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
338
339 /* Mask away the bits that the CPU doesn't support */
340 /** @todo make sure they don't conflict with the above requirements. */
341 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
342 pVM->aCpus[i].hwaccm.s.vmx.proc_ctls = val;
343
344 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
345 AssertRC(rc);
346
347 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
348 {
349 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
350 * Set required bits to one and zero according to the MSR capabilities.
351 */
352 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
353 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
354
355#ifdef HWACCM_VTX_WITH_EPT
356 if (pVM->hwaccm.s.fNestedPaging)
357 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
358#endif /* HWACCM_VTX_WITH_EPT */
359#ifdef HWACCM_VTX_WITH_VPID
360 else
361 if (pVM->hwaccm.s.vmx.fVPID)
362 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
363#endif /* HWACCM_VTX_WITH_VPID */
364
365 /* Mask away the bits that the CPU doesn't support */
366 /** @todo make sure they don't conflict with the above requirements. */
367 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
368
369 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
370 AssertRC(rc);
371 }
372
373 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
374 * Set required bits to one and zero according to the MSR capabilities.
375 */
376 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
377 AssertRC(rc);
378
379 /* VMX_VMCS_CTRL_EXIT_CONTROLS
380 * Set required bits to one and zero according to the MSR capabilities.
381 */
382 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
383
384 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
385 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
386#if HC_ARCH_BITS == 64
387 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
388#else
389 /* else Must be zero when AMD64 is not available. */
390#endif
391 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
392 /* Don't acknowledge external interrupts on VM-exit. */
393 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
394 AssertRC(rc);
395
396 /* Forward all exception except #NM & #PF to the guest.
397 * We always need to check pagefaults since our shadow page table can be out of sync.
398 * And we always lazily sync the FPU & XMM state.
399 */
400
401 /** @todo Possible optimization:
402 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
403 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
404 * registers ourselves of course.
405 *
406 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
407 */
408
409 /* Don't filter page faults; all of them should cause a switch. */
410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
411 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
412 AssertRC(rc);
413
414 /* Init TSC offset to zero. */
415 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
416 AssertRC(rc);
417
418 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
419 AssertRC(rc);
420
421 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
422 AssertRC(rc);
423
424 /* Set the MSR bitmap address. */
425 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
426 {
427 /* Optional */
428 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
429 AssertRC(rc);
430 }
431
432 /* Clear MSR controls. */
433 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
434 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
435 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
436 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
437 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
438 AssertRC(rc);
439
440 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
441 {
442 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
443 /* Optional */
444 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
445 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
446 AssertRC(rc);
447 }
448
449 /* Set link pointer to -1. Not currently used. */
450 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
451 AssertRC(rc);
452
453 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
454 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
455 AssertRC(rc);
456 } /* for each VMCPU */
457
458 /* Choose the right TLB setup function. */
459 if (pVM->hwaccm.s.fNestedPaging)
460 {
461 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBEPT;
462
463 /* Default values for flushing. */
464 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
465 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
466
467 /* If the capabilities specify we can do more, then make use of it. */
468 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_INDIV)
469 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
470 else
471 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
472 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
473
474 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
475 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
476 }
477#ifdef HWACCM_VTX_WITH_VPID
478 else
479 if (pVM->hwaccm.s.vmx.fVPID)
480 {
481 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBVPID;
482
483 /* Default values for flushing. */
484 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
485 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
486
487 /* If the capabilities specify we can do more, then make use of it. */
488 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV)
489 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
490 else
491 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
492 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
493
494 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
495 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
496 }
497#endif /* HWACCM_VTX_WITH_VPID */
498 else
499 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBDummy;
500
501vmx_end:
502 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
503 return rc;
504}
505
506
507/**
508 * Injects an event (trap or external interrupt)
509 *
510 * @returns VBox status code.
511 * @param pVM The VM to operate on.
512 * @param pVCpu The VMCPU to operate on.
513 * @param pCtx CPU Context
514 * @param intInfo VMX interrupt info
515 * @param cbInstr Opcode length of faulting instruction
516 * @param errCode Error code (optional)
517 */
518static int VMXR0InjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
519{
520 int rc;
521 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
522
523#ifdef VBOX_STRICT
524 if (iGate == 0xE)
525 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
526 else
527 if (iGate < 0x20)
528 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
529 else
530 {
531 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
532 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
533 Assert(pCtx->eflags.u32 & X86_EFL_IF);
534 }
535#endif
536
537#ifdef HWACCM_VMX_EMULATE_REALMODE
538 if (CPUMIsGuestInRealModeEx(pCtx))
539 {
540 RTGCPHYS GCPhysHandler;
541 uint16_t offset, ip;
542 RTSEL sel;
543
544 /* Injecting events doesn't work right with real mode emulation.
545 * (#GP if we try to inject external hardware interrupts)
546 * Inject the interrupt or trap directly instead.
547 */
548 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
549
550 /* Check if the interrupt handler is present. */
551 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
552 {
553 Log(("IDT cbIdt violation\n"));
554 if (iGate != X86_XCPT_DF)
555 {
556 RTGCUINTPTR intInfo;
557
558 intInfo = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
559 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
560 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
561 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
562
563 return VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0 /* no error code according to the Intel docs */);
564 }
565 Log(("Triple fault -> reset the VM!\n"));
566 return VINF_EM_RESET;
567 }
568 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
569 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
570 || iGate == 4)
571 {
572 ip = pCtx->ip + cbInstr;
573 }
574 else
575 ip = pCtx->ip;
576
577 /* Read the selector:offset pair of the interrupt handler. */
578 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
579 PGMPhysRead(pVM, GCPhysHandler, &offset, sizeof(offset));
580 PGMPhysRead(pVM, GCPhysHandler + 2, &sel, sizeof(sel));
581
582 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
583
584 /* Construct the stack frame. */
585 /** @todo should check stack limit. */
586 pCtx->sp -= 2;
587 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
588 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t));
589 pCtx->sp -= 2;
590 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
591 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t));
592 pCtx->sp -= 2;
593 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
594 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip));
595
596 /* Update the CPU state for executing the handler. */
597 pCtx->rip = offset;
598 pCtx->cs = sel;
599 pCtx->csHid.u64Base = sel << 4;
600 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
601
602 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
603 return VINF_SUCCESS;
604 }
605#endif /* HWACCM_VMX_EMULATE_REALMODE */
606
607 /* Set event injection state. */
608 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
609
610 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
611 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
612
613 AssertRC(rc);
614 return rc;
615}
616
617
618/**
619 * Checks for pending guest interrupts and injects them
620 *
621 * @returns VBox status code.
622 * @param pVM The VM to operate on.
623 * @param pVCpu The VMCPU to operate on.
624 * @param pCtx CPU Context
625 */
626static int VMXR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
627{
628 int rc;
629
630 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
631 if (pVCpu->hwaccm.s.Event.fPending)
632 {
633 Log(("Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
634 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
635 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
636 AssertRC(rc);
637
638 pVCpu->hwaccm.s.Event.fPending = false;
639 return VINF_SUCCESS;
640 }
641
642 if (pVM->hwaccm.s.fInjectNMI)
643 {
644 RTGCUINTPTR intInfo;
645
646 intInfo = X86_XCPT_NMI;
647 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
648 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
649
650 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
651 AssertRC(rc);
652
653 pVM->hwaccm.s.fInjectNMI = false;
654 return VINF_SUCCESS;
655 }
656
657 /* When external interrupts are pending, we should exit the VM when IF is set. */
658 if ( !TRPMHasTrap(pVM)
659 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
660 {
661 if (!(pCtx->eflags.u32 & X86_EFL_IF))
662 {
663 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
664 {
665 LogFlow(("Enable irq window exit!\n"));
666 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
667 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
668 AssertRC(rc);
669 }
670 /* else nothing to do but wait */
671 }
672 else
673 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
674 {
675 uint8_t u8Interrupt;
676
677 rc = PDMGetInterrupt(pVM, &u8Interrupt);
678 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
679 if (RT_SUCCESS(rc))
680 {
681 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
682 AssertRC(rc);
683 }
684 else
685 {
686 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
687 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
688 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
689 /* Just continue */
690 }
691 }
692 else
693 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
694 }
695
696#ifdef VBOX_STRICT
697 if (TRPMHasTrap(pVM))
698 {
699 uint8_t u8Vector;
700 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
701 AssertRC(rc);
702 }
703#endif
704
705 if ( pCtx->eflags.u32 & X86_EFL_IF
706 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
707 && TRPMHasTrap(pVM)
708 )
709 {
710 uint8_t u8Vector;
711 int rc;
712 TRPMEVENT enmType;
713 RTGCUINTPTR intInfo;
714 RTGCUINT errCode;
715
716 /* If a new event is pending, then dispatch it now. */
717 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
718 AssertRC(rc);
719 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
720 Assert(enmType != TRPM_SOFTWARE_INT);
721
722 /* Clear the pending trap. */
723 rc = TRPMResetTrap(pVM);
724 AssertRC(rc);
725
726 intInfo = u8Vector;
727 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
728
729 if (enmType == TRPM_TRAP)
730 {
731 switch (u8Vector) {
732 case 8:
733 case 10:
734 case 11:
735 case 12:
736 case 13:
737 case 14:
738 case 17:
739 /* Valid error codes. */
740 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
741 break;
742 default:
743 break;
744 }
745 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
746 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
747 else
748 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
749 }
750 else
751 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
752
753 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
754 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
755 AssertRC(rc);
756 } /* if (interrupts can be dispatched) */
757
758 return VINF_SUCCESS;
759}
760
761/**
762 * Save the host state
763 *
764 * @returns VBox status code.
765 * @param pVM The VM to operate on.
766 * @param pVCpu The VMCPU to operate on.
767 */
768VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
769{
770 int rc = VINF_SUCCESS;
771
772 /*
773 * Host CPU Context
774 */
775 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
776 {
777 RTIDTR idtr;
778 RTGDTR gdtr;
779 RTSEL SelTR;
780 PX86DESCHC pDesc;
781 uintptr_t trBase;
782 RTSEL cs;
783 RTSEL ss;
784
785 /* Control registers */
786 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
787 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
788 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
789 AssertRC(rc);
790 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
791 Log2(("VMX_VMCS_HOST_CR3 %08x\n", ASMGetCR3()));
792 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
793
794 /* Selector registers. */
795 cs = ASMGetCS();
796 ss = ASMGetSS();
797#ifdef RT_OS_DARWIN
798 /* VMX doesn't like LDT cs and ss, so switch to the GDT ones. Weird kernel. */
799 if (cs == 0x04) /* SYSENTER_CS & ~3 */
800 cs = 0x08; /* KERNEL_CS */
801 if (ss == 0x0c) /* (SYSENTER_CS & ~3) + 8 */
802 ss = 0x10; /* KERNEL_DS */
803#endif
804 rc = VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_CS, cs);
805 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
806 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_DS, 0);
807 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_ES, 0);
808#if HC_ARCH_BITS == 32
809 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_FS, 0);
810 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_GS, 0);
811#endif
812 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_SS, ss);
813 SelTR = ASMGetTR();
814 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_TR, SelTR);
815 AssertRC(rc);
816 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
817 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
818 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
819 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
820 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
821 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", cs, ASMGetSS()));
822 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
823
824 /* GDTR & IDTR */
825 ASMGetGDTR(&gdtr);
826 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
827 ASMGetIDTR(&idtr);
828 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
829 AssertRC(rc);
830 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
831 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
832
833 /* Save the base address of the TR selector. */
834 if (SelTR > gdtr.cbGdt)
835 {
836 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
837 return VERR_VMX_INVALID_HOST_STATE;
838 }
839
840 pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
841#if HC_ARCH_BITS == 64
842 trBase = X86DESC64_BASE(*pDesc);
843#else
844 trBase = X86DESC_BASE(*pDesc);
845#endif
846 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
847 AssertRC(rc);
848 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
849
850 /* FS and GS base. */
851#if HC_ARCH_BITS == 64
852 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
853 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
854 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
855 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
856#endif
857 AssertRC(rc);
858
859 /* Sysenter MSRs. */
860 /** @todo expensive!! */
861 rc = VMXWriteVMCS(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
862 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
863#if HC_ARCH_BITS == 32
864 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
865 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
866 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
867 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
868#else
869 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
870 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
871 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
872 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
873#endif
874 AssertRC(rc);
875
876 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
877 }
878 return rc;
879}
880
881/**
882 * Prefetch the 4 PDPT pointers (PAE and nested paging only)
883 *
884 * @param pVM The VM to operate on.
885 * @param pCtx Guest context
886 */
887static void vmxR0PrefetchPAEPdptrs(PVM pVM, PCPUMCTX pCtx)
888{
889 if (CPUMIsGuestInPAEModeEx(pCtx))
890 {
891 X86PDPE Pdpe;
892
893 for (unsigned i=0;i<4;i++)
894 {
895 Pdpe = PGMGstGetPaePDPtr(pVM, i);
896 int rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR0_FULL + i*2, Pdpe.u);
897 AssertRC(rc);
898 }
899 }
900}
901
902/**
903 * Update the exception bitmap according to the current CPU state
904 *
905 * @param pVM The VM to operate on.
906 * @param pVCpu The VMCPU to operate on.
907 * @param pCtx Guest context
908 */
909static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
910{
911 uint32_t u32TrapMask;
912 Assert(pCtx);
913
914 u32TrapMask = HWACCM_VMX_TRAP_MASK;
915#ifndef DEBUG
916 if (pVM->hwaccm.s.fNestedPaging)
917 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
918#endif
919
920 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
921 if ( CPUMIsGuestFPUStateActive(pVCpu) == true
922 && !(pCtx->cr0 & X86_CR0_NE)
923 && !pVCpu->hwaccm.s.fFPUOldStyleOverride)
924 {
925 u32TrapMask |= RT_BIT(X86_XCPT_MF);
926 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
927 }
928
929#ifdef DEBUG
930 /* Intercept X86_XCPT_DB if stepping is enabled */
931 if (DBGFIsStepping(pVM))
932 u32TrapMask |= RT_BIT(X86_XCPT_DB);
933#endif
934
935#ifdef VBOX_STRICT
936 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
937#endif
938
939# ifdef HWACCM_VMX_EMULATE_REALMODE
940 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
941 if (CPUMIsGuestInRealModeEx(pCtx))
942 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
943# endif /* HWACCM_VMX_EMULATE_REALMODE */
944
945 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
946 AssertRC(rc);
947}
948
949/**
950 * Loads the guest state
951 *
952 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
953 *
954 * @returns VBox status code.
955 * @param pVM The VM to operate on.
956 * @param pVCpu The VMCPU to operate on.
957 * @param pCtx Guest context
958 */
959VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
960{
961 int rc = VINF_SUCCESS;
962 RTGCUINTPTR val;
963 X86EFLAGS eflags;
964
965 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
966 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
967 {
968#ifdef HWACCM_VMX_EMULATE_REALMODE
969 PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
970 if (pVCpu->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
971 {
972 /* Correct weird requirements for switching to protected mode. */
973 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
974 && enmGuestMode >= PGMMODE_PROTECTED)
975 {
976 /* DPL of all hidden selector registers must match the current CPL (0). */
977 pCtx->csHid.Attr.n.u2Dpl = 0;
978 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
979
980 pCtx->dsHid.Attr.n.u2Dpl = 0;
981 pCtx->esHid.Attr.n.u2Dpl = 0;
982 pCtx->fsHid.Attr.n.u2Dpl = 0;
983 pCtx->gsHid.Attr.n.u2Dpl = 0;
984 pCtx->ssHid.Attr.n.u2Dpl = 0;
985 }
986 else
987 /* Switching from protected mode to real mode. */
988 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
989 && enmGuestMode == PGMMODE_REAL)
990 {
991 /* The limit must also be adjusted. */
992 pCtx->csHid.u32Limit &= 0xffff;
993 pCtx->dsHid.u32Limit &= 0xffff;
994 pCtx->esHid.u32Limit &= 0xffff;
995 pCtx->fsHid.u32Limit &= 0xffff;
996 pCtx->gsHid.u32Limit &= 0xffff;
997 pCtx->ssHid.u32Limit &= 0xffff;
998
999 Assert(pCtx->csHid.u64Base <= 0xfffff);
1000 Assert(pCtx->dsHid.u64Base <= 0xfffff);
1001 Assert(pCtx->esHid.u64Base <= 0xfffff);
1002 Assert(pCtx->fsHid.u64Base <= 0xfffff);
1003 Assert(pCtx->gsHid.u64Base <= 0xfffff);
1004 }
1005 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
1006 }
1007 else
1008 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1009 if ( CPUMIsGuestInRealModeEx(pCtx)
1010 && pCtx->csHid.u64Base == 0xffff0000)
1011 {
1012 pCtx->csHid.u64Base = 0xf0000;
1013 pCtx->cs = 0xf000;
1014 }
1015#endif /* HWACCM_VMX_EMULATE_REALMODE */
1016
1017 VMX_WRITE_SELREG(ES, es);
1018 AssertRC(rc);
1019
1020 VMX_WRITE_SELREG(CS, cs);
1021 AssertRC(rc);
1022
1023 VMX_WRITE_SELREG(SS, ss);
1024 AssertRC(rc);
1025
1026 VMX_WRITE_SELREG(DS, ds);
1027 AssertRC(rc);
1028
1029 /* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
1030 VMX_WRITE_SELREG(FS, fs);
1031 AssertRC(rc);
1032
1033 VMX_WRITE_SELREG(GS, gs);
1034 AssertRC(rc);
1035 }
1036
1037 /* Guest CPU context: LDTR. */
1038 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1039 {
1040 if (pCtx->ldtr == 0)
1041 {
1042 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1043 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1044 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
1045 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1046 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1047 }
1048 else
1049 {
1050 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr);
1051 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1052 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1053 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1054 }
1055 AssertRC(rc);
1056 }
1057 /* Guest CPU context: TR. */
1058 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1059 {
1060#ifdef HWACCM_VMX_EMULATE_REALMODE
1061 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1062 if (CPUMIsGuestInRealModeEx(pCtx))
1063 {
1064 RTGCPHYS GCPhys;
1065
1066 /* We convert it here every time as pci regions could be reconfigured. */
1067 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1068 AssertRC(rc);
1069
1070 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, 0);
1071 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1072 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1073
1074 X86DESCATTR attr;
1075
1076 attr.u = 0;
1077 attr.n.u1Present = 1;
1078 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1079 val = attr.u;
1080 }
1081 else
1082#endif /* HWACCM_VMX_EMULATE_REALMODE */
1083 {
1084 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr);
1085 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1086 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
1087
1088 val = pCtx->trHid.Attr.u;
1089
1090 /* The TSS selector must be busy. */
1091 if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
1092 val = (val & ~0xF) | X86_SEL_TYPE_SYS_286_TSS_BUSY;
1093 else
1094 /* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
1095 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1096
1097 }
1098 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
1099 AssertRC(rc);
1100 }
1101 /* Guest CPU context: GDTR. */
1102 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1103 {
1104 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1105 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1106 AssertRC(rc);
1107 }
1108 /* Guest CPU context: IDTR. */
1109 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1110 {
1111 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1112 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1113 AssertRC(rc);
1114 }
1115
1116 /*
1117 * Sysenter MSRs (unconditional)
1118 */
1119 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1120 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1121 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1122 AssertRC(rc);
1123
1124 /* Control registers */
1125 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1126 {
1127 val = pCtx->cr0;
1128 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1129 Log2(("Guest CR0-shadow %08x\n", val));
1130 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1131 {
1132 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1133 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1134 }
1135 else
1136 {
1137 /** @todo check if we support the old style mess correctly. */
1138 if (!(val & X86_CR0_NE))
1139 Log(("Forcing X86_CR0_NE!!!\n"));
1140
1141 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1142 }
1143 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1144 val |= X86_CR0_PE | X86_CR0_PG;
1145 if (pVM->hwaccm.s.fNestedPaging)
1146 {
1147 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1148 {
1149 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1150 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1151 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1152 }
1153 else
1154 {
1155 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1156 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1157 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1158 }
1159 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1160 AssertRC(rc);
1161 }
1162 else
1163 {
1164 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1165 val |= X86_CR0_WP;
1166 }
1167
1168 /* Always enable caching. */
1169 val &= ~(X86_CR0_CD|X86_CR0_NW);
1170
1171 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1172 Log2(("Guest CR0 %08x\n", val));
1173 /* CR0 flags owned by the host; if the guests attempts to change them, then
1174 * the VM will exit.
1175 */
1176 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1177 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1178 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1179 | X86_CR0_TS
1180 | X86_CR0_ET /* Bit not restored during VM-exit! */
1181 | X86_CR0_CD /* Bit not restored during VM-exit! */
1182 | X86_CR0_NW /* Bit not restored during VM-exit! */
1183 | X86_CR0_NE
1184 | X86_CR0_MP;
1185 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1186
1187 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1188 Log2(("Guest CR0-mask %08x\n", val));
1189 AssertRC(rc);
1190 }
1191 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1192 {
1193 /* CR4 */
1194 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1195 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1196 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1197 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1198
1199 if (!pVM->hwaccm.s.fNestedPaging)
1200 {
1201 switch(pVCpu->hwaccm.s.enmShadowMode)
1202 {
1203 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1204 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1205 case PGMMODE_32_BIT: /* 32-bit paging. */
1206 break;
1207
1208 case PGMMODE_PAE: /* PAE paging. */
1209 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1210 /** @todo use normal 32 bits paging */
1211 val |= X86_CR4_PAE;
1212 break;
1213
1214 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1215 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1216#ifdef VBOX_ENABLE_64_BITS_GUESTS
1217 break;
1218#else
1219 AssertFailed();
1220 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1221#endif
1222 default: /* shut up gcc */
1223 AssertFailed();
1224 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1225 }
1226 }
1227 else
1228 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1229 {
1230 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1231 val |= X86_CR4_PSE;
1232 /* Our identity mapping is a 32 bits page directory. */
1233 val &= ~X86_CR4_PAE;
1234 }
1235
1236#ifdef HWACCM_VMX_EMULATE_REALMODE
1237 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1238 if (CPUMIsGuestInRealModeEx(pCtx))
1239 val |= X86_CR4_VME;
1240#endif /* HWACCM_VMX_EMULATE_REALMODE */
1241
1242 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1243 Log2(("Guest CR4 %08x\n", val));
1244 /* CR4 flags owned by the host; if the guests attempts to change them, then
1245 * the VM will exit.
1246 */
1247 val = 0
1248#ifdef HWACCM_VMX_EMULATE_REALMODE
1249 | X86_CR4_VME
1250#endif
1251 | X86_CR4_PAE
1252 | X86_CR4_PGE
1253 | X86_CR4_PSE
1254 | X86_CR4_VMXE;
1255 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1256
1257 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1258 Log2(("Guest CR4-mask %08x\n", val));
1259 AssertRC(rc);
1260 }
1261
1262 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1263 {
1264 if (pVM->hwaccm.s.fNestedPaging)
1265 {
1266 AssertMsg(PGMGetEPTCR3(pVM) == PGMGetHyperCR3(pVM), ("%RHp vs %RHp\n", PGMGetEPTCR3(pVM), PGMGetHyperCR3(pVM)));
1267 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetEPTCR3(pVM);
1268
1269 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1270 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1271 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1272 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1273
1274 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1275 AssertRC(rc);
1276
1277 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1278 {
1279 RTGCPHYS GCPhys;
1280
1281 /* We convert it here every time as pci regions could be reconfigured. */
1282 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1283 AssertRC(rc);
1284
1285 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1286 * take care of the translation to host physical addresses.
1287 */
1288 val = GCPhys;
1289 }
1290 else
1291 {
1292 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1293 val = pCtx->cr3;
1294 /* Prefetch the four PDPT entries in PAE mode. */
1295 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1296 }
1297 }
1298 else
1299 {
1300 val = PGMGetHyperCR3(pVM);
1301 Assert(val);
1302 }
1303
1304 /* Save our shadow CR3 register. */
1305 rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1306 AssertRC(rc);
1307 }
1308
1309 /* Debug registers. */
1310 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1311 {
1312 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1313 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1314
1315 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1316 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1317 pCtx->dr[7] |= 0x400; /* must be one */
1318
1319 /* Resync DR7 */
1320 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1321 AssertRC(rc);
1322
1323 /* Sync the debug state now if any breakpoint is armed. */
1324 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1325 && !CPUMIsGuestDebugStateActive(pVM)
1326 && !DBGFIsStepping(pVM))
1327 {
1328 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1329
1330 /* Disable drx move intercepts. */
1331 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1332 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1333 AssertRC(rc);
1334
1335 /* Save the host and load the guest debug state. */
1336 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1337 AssertRC(rc);
1338 }
1339
1340 /* IA32_DEBUGCTL MSR. */
1341 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1342 AssertRC(rc);
1343
1344 /** @todo do we really ever need this? */
1345 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1346 AssertRC(rc);
1347 }
1348
1349 /* EIP, ESP and EFLAGS */
1350 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1351 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1352 AssertRC(rc);
1353
1354 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1355 eflags = pCtx->eflags;
1356 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1357 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1358
1359#ifdef HWACCM_VMX_EMULATE_REALMODE
1360 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1361 if (CPUMIsGuestInRealModeEx(pCtx))
1362 {
1363 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1364
1365 eflags.Bits.u1VM = 1;
1366 eflags.Bits.u2IOPL = 3;
1367 }
1368#endif /* HWACCM_VMX_EMULATE_REALMODE */
1369 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1370 AssertRC(rc);
1371
1372 /* TSC offset. */
1373 uint64_t u64TSCOffset;
1374
1375 if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1376 {
1377 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1378 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1379 AssertRC(rc);
1380
1381 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1382 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1383 AssertRC(rc);
1384 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1385 }
1386 else
1387 {
1388 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1389 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1390 AssertRC(rc);
1391 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1392 }
1393
1394 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1395 * Set required bits to one and zero according to the MSR capabilities.
1396 */
1397 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1398 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1399 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1400
1401 /* 64 bits guest mode? */
1402 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1403 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1404 /* else Must be zero when AMD64 is not available. */
1405
1406 /* Mask away the bits that the CPU doesn't support */
1407 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1408 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1409 AssertRC(rc);
1410
1411 /* 64 bits guest mode? */
1412 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1413 {
1414#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
1415 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1416#else
1417 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1418#endif
1419 /* Unconditionally update these as wrmsr might have changed them. */
1420 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1421 AssertRC(rc);
1422 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1423 AssertRC(rc);
1424 }
1425 else
1426 {
1427 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1428 }
1429
1430 vmxR0UpdateExceptionBitmap(pVM, pVCpu, pCtx);
1431
1432 /* Done. */
1433 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1434
1435 return rc;
1436}
1437
1438/**
1439 * Syncs back the guest state
1440 *
1441 * @returns VBox status code.
1442 * @param pVM The VM to operate on.
1443 * @param pVCpu The VMCPU to operate on.
1444 * @param pCtx Guest context
1445 */
1446DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1447{
1448 RTCCUINTREG val, valShadow;
1449 RTGCUINTPTR uInterruptState;
1450 int rc;
1451
1452 /* Let's first sync back eip, esp, and eflags. */
1453 rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1454 AssertRC(rc);
1455 pCtx->rip = val;
1456 rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1457 AssertRC(rc);
1458 pCtx->rsp = val;
1459 rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1460 AssertRC(rc);
1461 pCtx->eflags.u32 = val;
1462
1463 /* Take care of instruction fusing (sti, mov ss) */
1464 rc |= VMXReadVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
1465 uInterruptState = val;
1466 if (uInterruptState != 0)
1467 {
1468 Assert(uInterruptState <= 2); /* only sti & mov ss */
1469 Log(("uInterruptState %x eip=%RGv\n", uInterruptState, pCtx->rip));
1470 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1471 }
1472 else
1473 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1474
1475 /* Control registers. */
1476 VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1477 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1478 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
1479 CPUMSetGuestCR0(pVM, val);
1480
1481 VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1482 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1483 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
1484 CPUMSetGuestCR4(pVM, val);
1485
1486 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
1487 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1488 if ( pVM->hwaccm.s.fNestedPaging
1489 && CPUMIsGuestInPagedProtectedModeEx(pCtx))
1490 {
1491 /* Can be updated behind our back in the nested paging case. */
1492 CPUMSetGuestCR2(pVM, ASMGetCR2());
1493
1494 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
1495
1496 if (val != pCtx->cr3)
1497 {
1498 CPUMSetGuestCR3(pVM, val);
1499 PGMUpdateCR3(pVM, val);
1500 }
1501 /* Prefetch the four PDPT entries in PAE mode. */
1502 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1503 }
1504
1505 /* Sync back DR7 here. */
1506 VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1507 pCtx->dr[7] = val;
1508
1509 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1510 VMX_READ_SELREG(ES, es);
1511 VMX_READ_SELREG(SS, ss);
1512 VMX_READ_SELREG(CS, cs);
1513 VMX_READ_SELREG(DS, ds);
1514 VMX_READ_SELREG(FS, fs);
1515 VMX_READ_SELREG(GS, gs);
1516
1517 /*
1518 * System MSRs
1519 */
1520 VMXReadVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
1521 pCtx->SysEnter.cs = val;
1522 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1523 pCtx->SysEnter.eip = val;
1524 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1525 pCtx->SysEnter.esp = val;
1526
1527 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1528 VMX_READ_SELREG(LDTR, ldtr);
1529
1530 VMXReadVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
1531 pCtx->gdtr.cbGdt = val;
1532 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1533 pCtx->gdtr.pGdt = val;
1534
1535 VMXReadVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
1536 pCtx->idtr.cbIdt = val;
1537 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1538 pCtx->idtr.pIdt = val;
1539
1540#ifdef HWACCM_VMX_EMULATE_REALMODE
1541 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1542 if (CPUMIsGuestInRealModeEx(pCtx))
1543 {
1544 /* Hide our emulation flags */
1545 pCtx->eflags.Bits.u1VM = 0;
1546 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
1547
1548 /* Force a TR resync every time in case we switch modes. */
1549 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
1550 }
1551 else
1552#endif /* HWACCM_VMX_EMULATE_REALMODE */
1553 {
1554 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1555 VMX_READ_SELREG(TR, tr);
1556 }
1557 return VINF_SUCCESS;
1558}
1559
1560/**
1561 * Dummy placeholder
1562 *
1563 * @param pVM The VM to operate on.
1564 * @param pVCpu The VMCPU to operate on.
1565 */
1566static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu)
1567{
1568 NOREF(pVM);
1569 NOREF(pVCpu);
1570 return;
1571}
1572
1573/**
1574 * Setup the tagged TLB for EPT
1575 *
1576 * @returns VBox status code.
1577 * @param pVM The VM to operate on.
1578 * @param pVCpu The VMCPU to operate on.
1579 */
1580static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu)
1581{
1582 PHWACCM_CPUINFO pCpu;
1583
1584 Assert(pVM->hwaccm.s.fNestedPaging);
1585 Assert(!pVM->hwaccm.s.vmx.fVPID);
1586
1587 /* Deal with tagged TLBs if VPID or EPT is supported. */
1588 pCpu = HWACCMR0GetCurrentCpu();
1589 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1590 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1591 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1592 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1593 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1594 {
1595 /* Force a TLB flush on VM entry. */
1596 pVCpu->hwaccm.s.fForceTLBFlush = true;
1597 }
1598 else
1599 Assert(!pCpu->fFlushTLB);
1600
1601 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1602 pCpu->fFlushTLB = false;
1603
1604 if (pVCpu->hwaccm.s.fForceTLBFlush)
1605 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1606
1607#ifdef VBOX_WITH_STATISTICS
1608 if (pVCpu->hwaccm.s.fForceTLBFlush)
1609 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1610 else
1611 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1612#endif
1613}
1614
1615#ifdef HWACCM_VTX_WITH_VPID
1616/**
1617 * Setup the tagged TLB for VPID
1618 *
1619 * @returns VBox status code.
1620 * @param pVM The VM to operate on.
1621 * @param pVCpu The VMCPU to operate on.
1622 */
1623static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu)
1624{
1625 PHWACCM_CPUINFO pCpu;
1626
1627 Assert(pVM->hwaccm.s.vmx.fVPID);
1628 Assert(!pVM->hwaccm.s.fNestedPaging);
1629
1630 /* Deal with tagged TLBs if VPID or EPT is supported. */
1631 pCpu = HWACCMR0GetCurrentCpu();
1632 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1633 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1634 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1635 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1636 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1637 {
1638 /* Force a TLB flush on VM entry. */
1639 pVCpu->hwaccm.s.fForceTLBFlush = true;
1640 }
1641 else
1642 Assert(!pCpu->fFlushTLB);
1643
1644 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1645
1646 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1647 if (pVCpu->hwaccm.s.fForceTLBFlush)
1648 {
1649 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1650 || pCpu->fFlushTLB)
1651 {
1652 pCpu->fFlushTLB = false;
1653 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1654 pCpu->cTLBFlushes++;
1655 }
1656 else
1657 {
1658 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1659 pVCpu->hwaccm.s.fForceTLBFlush = false;
1660 }
1661
1662 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1663 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1664 }
1665 else
1666 {
1667 Assert(!pCpu->fFlushTLB);
1668
1669 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1670 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1671 }
1672 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1673 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1674 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1675
1676 int rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
1677 AssertRC(rc);
1678
1679 if (pVCpu->hwaccm.s.fForceTLBFlush)
1680 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1681
1682#ifdef VBOX_WITH_STATISTICS
1683 if (pVCpu->hwaccm.s.fForceTLBFlush)
1684 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1685 else
1686 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1687#endif
1688}
1689#endif /* HWACCM_VTX_WITH_VPID */
1690
1691/**
1692 * Runs guest code in a VT-x VM.
1693 *
1694 * @returns VBox status code.
1695 * @param pVM The VM to operate on.
1696 * @param pVCpu The VMCPU to operate on.
1697 * @param pCtx Guest context
1698 */
1699VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1700{
1701 int rc = VINF_SUCCESS;
1702 RTCCUINTREG val;
1703 RTCCUINTREG exitReason, instrError, cbInstr;
1704 RTGCUINTPTR exitQualification;
1705 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1706 RTGCUINTPTR errCode, instrInfo;
1707 bool fSyncTPR = false;
1708 PHWACCM_CPUINFO pCpu = 0;
1709 unsigned cResume = 0;
1710#ifdef VBOX_STRICT
1711 RTCPUID idCpuCheck;
1712#endif
1713
1714 Log2(("\nE"));
1715
1716 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
1717
1718#ifdef VBOX_STRICT
1719 rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1720 AssertRC(rc);
1721 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1722
1723 /* allowed zero */
1724 if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1725 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1726
1727 /* allowed one */
1728 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1729 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1730
1731 rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1732 AssertRC(rc);
1733 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1734
1735 /* Must be set according to the MSR, but can be cleared in case of EPT. */
1736 if (pVM->hwaccm.s.fNestedPaging)
1737 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
1738 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1739 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1740
1741 /* allowed zero */
1742 if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1743 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1744
1745 /* allowed one */
1746 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1747 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1748
1749 rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1750 AssertRC(rc);
1751 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1752
1753 /* allowed zero */
1754 if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1755 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1756
1757 /* allowed one */
1758 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1759 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1760
1761 rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1762 AssertRC(rc);
1763 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1764
1765 /* allowed zero */
1766 if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1767 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1768
1769 /* allowed one */
1770 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1771 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1772#endif
1773
1774 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1775 */
1776ResumeExecution:
1777 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1778 ("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1779 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1780 Assert(!HWACCMR0SuspendPending());
1781
1782 /* Safety precaution; looping for too long here can have a very bad effect on the host */
1783 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1784 {
1785 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
1786 rc = VINF_EM_RAW_INTERRUPT;
1787 goto end;
1788 }
1789
1790 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1791 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1792 {
1793 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1794 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1795 {
1796 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1797 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1798 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1799 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
1800 */
1801 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1802 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1803 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
1804 AssertRC(rc);
1805 }
1806 }
1807 else
1808 {
1809 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1810 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
1811 AssertRC(rc);
1812 }
1813
1814 /* Check for pending actions that force us to go back to ring 3. */
1815 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
1816 {
1817 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1818 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1819 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1820 rc = VINF_EM_RAW_TO_R3;
1821 goto end;
1822 }
1823 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1824 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1825 {
1826 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1827 rc = VINF_EM_PENDING_REQUEST;
1828 goto end;
1829 }
1830
1831 /* When external interrupts are pending, we should exit the VM when IF is set. */
1832 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1833 rc = VMXR0CheckPendingInterrupt(pVM, pVCpu, pCtx);
1834 if (RT_FAILURE(rc))
1835 {
1836 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1837 goto end;
1838 }
1839
1840 /** @todo check timers?? */
1841
1842 /* TPR caching using CR8 is only available in 64 bits mode */
1843 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1844 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1845 /**
1846 * @todo reduce overhead
1847 */
1848 if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1849 && pVM->hwaccm.s.vmx.pAPIC)
1850 {
1851 /* TPR caching in CR8 */
1852 uint8_t u8TPR;
1853 bool fPending;
1854
1855 int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1856 AssertRC(rc);
1857 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
1858 pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1859
1860 /* Two options here:
1861 * - external interrupt pending, but masked by the TPR value.
1862 * -> a CR8 update that lower the current TPR value should cause an exit
1863 * - no pending interrupts
1864 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1865 */
1866 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1867 AssertRC(rc);
1868
1869 /* Always sync back the TPR; we should optimize this though */ /** @todo optimize TPR sync. */
1870 fSyncTPR = true;
1871 }
1872
1873#if defined(HWACCM_VTX_WITH_EPT) && defined(LOG_ENABLED)
1874 if ( pVM->hwaccm.s.fNestedPaging
1875# ifdef HWACCM_VTX_WITH_VPID
1876 || pVM->hwaccm.s.vmx.fVPID
1877# endif /* HWACCM_VTX_WITH_VPID */
1878 )
1879 {
1880 pCpu = HWACCMR0GetCurrentCpu();
1881 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1882 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1883 {
1884 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1885 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1886 else
1887 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1888 }
1889 if (pCpu->fFlushTLB)
1890 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1891 else
1892 if (pVCpu->hwaccm.s.fForceTLBFlush)
1893 LogFlow(("Manual TLB flush\n"));
1894 }
1895#endif
1896
1897 /*
1898 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1899 * (until the actual world switch)
1900 */
1901#ifdef VBOX_STRICT
1902 idCpuCheck = RTMpCpuId();
1903#endif
1904 /* Save the host state first. */
1905 rc = VMXR0SaveHostState(pVM, pVCpu);
1906 if (rc != VINF_SUCCESS)
1907 {
1908 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1909 goto end;
1910 }
1911 /* Load the guest state */
1912 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
1913 if (rc != VINF_SUCCESS)
1914 {
1915 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1916 goto end;
1917 }
1918
1919 /* Deal with tagged TLB setup and invalidation. */
1920 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
1921
1922 /* Non-register state Guest Context */
1923 /** @todo change me according to cpu state */
1924 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1925 AssertRC(rc);
1926
1927 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1928
1929 /* Manual save and restore:
1930 * - General purpose registers except RIP, RSP
1931 *
1932 * Trashed:
1933 * - CR2 (we don't care)
1934 * - LDTR (reset to 0)
1935 * - DRx (presumably not changed at all)
1936 * - DR7 (reset to 0x400)
1937 * - EFLAGS (reset to RT_BIT(1); not relevant)
1938 *
1939 */
1940
1941 /* All done! Let's start VM execution. */
1942 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1943#ifdef VBOX_STRICT
1944 Assert(idCpuCheck == RTMpCpuId());
1945#endif
1946 TMNotifyStartOfExecution(pVM);
1947 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx);
1948 TMNotifyEndOfExecution(pVM);
1949
1950 /* In case we execute a goto ResumeExecution later on. */
1951 pVCpu->hwaccm.s.fResumeVM = true;
1952 pVCpu->hwaccm.s.fForceTLBFlush = false;
1953
1954 /*
1955 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1956 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1957 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1958 */
1959
1960 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1961 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit, x);
1962
1963 if (rc != VINF_SUCCESS)
1964 {
1965 VMXR0ReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
1966 goto end;
1967 }
1968 /* Success. Query the guest state and figure out what has happened. */
1969
1970 /* Investigate why there was a VM-exit. */
1971 rc = VMXReadVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
1972 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1973
1974 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1975 rc |= VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
1976 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
1977 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &val);
1978 intInfo = val;
1979 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1980 errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1981 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INSTR_INFO, &val);
1982 instrInfo = val;
1983 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1984 exitQualification = val;
1985 AssertRC(rc);
1986
1987 /* Sync back the guest state */
1988 rc = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
1989 AssertRC(rc);
1990
1991 /* Note! NOW IT'S SAFE FOR LOGGING! */
1992 Log2(("Raw exit reason %08x\n", exitReason));
1993
1994 /* Check if an injected event was interrupted prematurely. */
1995 rc = VMXReadVMCS(VMX_VMCS32_RO_IDT_INFO, &val);
1996 AssertRC(rc);
1997 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
1998 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
1999 /* Ignore 'int xx' as they'll be restarted anyway. */
2000 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
2001 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2002 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2003 {
2004 pVCpu->hwaccm.s.Event.fPending = true;
2005 /* Error code present? */
2006 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2007 {
2008 rc = VMXReadVMCS(VMX_VMCS32_RO_IDT_ERRCODE, &val);
2009 AssertRC(rc);
2010 pVCpu->hwaccm.s.Event.errCode = val;
2011 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2012 }
2013 else
2014 {
2015 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2016 pVCpu->hwaccm.s.Event.errCode = 0;
2017 }
2018 }
2019#ifdef VBOX_STRICT
2020 else
2021 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2022 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2023 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2024 {
2025 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2026 }
2027
2028 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2029 HWACCMDumpRegs(pVM, pCtx);
2030#endif
2031
2032 Log2(("E%d", exitReason));
2033 Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
2034 Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
2035 Log2(("Interruption error code %d\n", errCode));
2036 Log2(("IntInfo = %08x\n", intInfo));
2037 Log2(("New EIP=%RGv\n", (RTGCPTR)pCtx->rip));
2038
2039 if (fSyncTPR)
2040 {
2041 rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
2042 AssertRC(rc);
2043 }
2044
2045 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2046 switch (exitReason)
2047 {
2048 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2049 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2050 {
2051 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2052
2053 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2054 {
2055 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2056 /* External interrupt; leave to allow it to be dispatched again. */
2057 rc = VINF_EM_RAW_INTERRUPT;
2058 break;
2059 }
2060 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2061 {
2062 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2063 /* External interrupt; leave to allow it to be dispatched again. */
2064 rc = VINF_EM_RAW_INTERRUPT;
2065 break;
2066
2067 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2068 AssertFailed(); /* can't come here; fails the first check. */
2069 break;
2070
2071 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
2072 Assert(vector == 3 || vector == 4);
2073 /* no break */
2074 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
2075 Log2(("Hardware/software interrupt %d\n", vector));
2076 switch (vector)
2077 {
2078 case X86_XCPT_NM:
2079 {
2080 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
2081
2082 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
2083 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
2084 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
2085 if (rc == VINF_SUCCESS)
2086 {
2087 Assert(CPUMIsGuestFPUStateActive(pVCpu));
2088
2089 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
2090
2091 /* Continue execution. */
2092 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2093 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2094
2095 goto ResumeExecution;
2096 }
2097
2098 Log(("Forward #NM fault to the guest\n"));
2099 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
2100 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
2101 AssertRC(rc);
2102 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2103 goto ResumeExecution;
2104 }
2105
2106 case X86_XCPT_PF: /* Page fault */
2107 {
2108#ifdef DEBUG
2109 if (pVM->hwaccm.s.fNestedPaging)
2110 { /* A genuine pagefault.
2111 * Forward the trap to the guest by injecting the exception and resuming execution.
2112 */
2113 Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
2114
2115 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
2116
2117 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2118
2119 /* Now we must update CR2. */
2120 pCtx->cr2 = exitQualification;
2121 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2122 AssertRC(rc);
2123
2124 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2125 goto ResumeExecution;
2126 }
2127#endif
2128 Assert(!pVM->hwaccm.s.fNestedPaging);
2129
2130 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
2131 /* Exit qualification contains the linear address of the page fault. */
2132 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2133 TRPMSetErrorCode(pVM, errCode);
2134 TRPMSetFaultAddress(pVM, exitQualification);
2135
2136 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
2137 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
2138 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2139 if (rc == VINF_SUCCESS)
2140 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2141 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
2142 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2143
2144 TRPMResetTrap(pVM);
2145
2146 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2147 goto ResumeExecution;
2148 }
2149 else
2150 if (rc == VINF_EM_RAW_GUEST_TRAP)
2151 { /* A genuine pagefault.
2152 * Forward the trap to the guest by injecting the exception and resuming execution.
2153 */
2154 Log2(("Forward page fault to the guest\n"));
2155
2156 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2157 /* The error code might have been changed. */
2158 errCode = TRPMGetErrorCode(pVM);
2159
2160 TRPMResetTrap(pVM);
2161
2162 /* Now we must update CR2. */
2163 pCtx->cr2 = exitQualification;
2164 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2165 AssertRC(rc);
2166
2167 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2168 goto ResumeExecution;
2169 }
2170#ifdef VBOX_STRICT
2171 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2172 Log2(("PGMTrap0eHandler failed with %d\n", rc));
2173#endif
2174 /* Need to go back to the recompiler to emulate the instruction. */
2175 TRPMResetTrap(pVM);
2176 break;
2177 }
2178
2179 case X86_XCPT_MF: /* Floating point exception. */
2180 {
2181 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
2182 if (!(pCtx->cr0 & X86_CR0_NE))
2183 {
2184 /* old style FPU error reporting needs some extra work. */
2185 /** @todo don't fall back to the recompiler, but do it manually. */
2186 rc = VINF_EM_RAW_EMULATE_INSTR;
2187 break;
2188 }
2189 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2190 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2191 AssertRC(rc);
2192
2193 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2194 goto ResumeExecution;
2195 }
2196
2197 case X86_XCPT_DB: /* Debug exception. */
2198 {
2199 uint64_t uDR6;
2200
2201 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
2202 *
2203 * Exit qualification bits:
2204 * 3:0 B0-B3 which breakpoint condition was met
2205 * 12:4 Reserved (0)
2206 * 13 BD - debug register access detected
2207 * 14 BS - single step execution or branch taken
2208 * 63:15 Reserved (0)
2209 */
2210 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
2211
2212 /* Note that we don't support guest and host-initiated debugging at the same time. */
2213 Assert(DBGFIsStepping(pVM) || CPUMIsGuestInRealModeEx(pCtx));
2214
2215 uDR6 = X86_DR6_INIT_VAL;
2216 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
2217 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
2218 if (rc == VINF_EM_RAW_GUEST_TRAP)
2219 {
2220 /** @todo this isn't working, but we'll never get here normally. */
2221
2222 /* Update DR6 here. */
2223 pCtx->dr[6] = uDR6;
2224
2225 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2226 pCtx->dr[7] &= ~X86_DR7_GD;
2227
2228 /* Paranoia. */
2229 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2230 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2231 pCtx->dr[7] |= 0x400; /* must be one */
2232
2233 /* Resync DR7 */
2234 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2235 AssertRC(rc);
2236
2237 Log(("Trap %x (debug) at %RGv exit qualification %RX64\n", vector, (RTGCPTR)pCtx->rip, exitQualification));
2238 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2239 AssertRC(rc);
2240
2241 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2242 goto ResumeExecution;
2243 }
2244 /* Return to ring 3 to deal with the debug exit code. */
2245 break;
2246 }
2247
2248 case X86_XCPT_GP: /* General protection failure exception.*/
2249 {
2250 uint32_t cbSize;
2251
2252 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
2253#ifdef VBOX_STRICT
2254 if (!CPUMIsGuestInRealModeEx(pCtx))
2255 {
2256 Log(("Trap %x at %04X:%RGv errorCode=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
2257 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2258 AssertRC(rc);
2259 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2260 goto ResumeExecution;
2261 }
2262#endif
2263 Assert(CPUMIsGuestInRealModeEx(pCtx));
2264
2265 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %RGv\n", (RTGCPTR)pCtx->rip));
2266 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2267 if (rc == VINF_SUCCESS)
2268 {
2269 /* EIP has been updated already. */
2270
2271 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2272 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2273
2274 /* Only resume if successful. */
2275 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2276 goto ResumeExecution;
2277 }
2278 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", rc));
2279 break;
2280 }
2281
2282#ifdef VBOX_STRICT
2283 case X86_XCPT_DE: /* Divide error. */
2284 case X86_XCPT_UD: /* Unknown opcode exception. */
2285 case X86_XCPT_SS: /* Stack segment exception. */
2286 case X86_XCPT_NP: /* Segment not present exception. */
2287 {
2288 switch(vector)
2289 {
2290 case X86_XCPT_DE:
2291 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
2292 break;
2293 case X86_XCPT_UD:
2294 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
2295 break;
2296 case X86_XCPT_SS:
2297 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
2298 break;
2299 case X86_XCPT_NP:
2300 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
2301 break;
2302 }
2303
2304 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2305 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2306 AssertRC(rc);
2307
2308 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2309 goto ResumeExecution;
2310 }
2311#endif
2312 default:
2313#ifdef HWACCM_VMX_EMULATE_REALMODE
2314 if (CPUMIsGuestInRealModeEx(pCtx))
2315 {
2316 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
2317 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2318 AssertRC(rc);
2319
2320 /* Go back to ring 3 in case of a triple fault. */
2321 if ( vector == X86_XCPT_DF
2322 && rc == VINF_EM_RESET)
2323 break;
2324
2325 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2326 goto ResumeExecution;
2327 }
2328#endif
2329 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2330 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2331 break;
2332 } /* switch (vector) */
2333
2334 break;
2335
2336 default:
2337 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2338 AssertFailed();
2339 break;
2340 }
2341
2342 break;
2343 }
2344
2345 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
2346 {
2347 RTGCPHYS GCPhys;
2348
2349 Assert(pVM->hwaccm.s.fNestedPaging);
2350
2351 rc = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2352 AssertRC(rc);
2353 Assert(((exitQualification >> 7) & 3) != 2);
2354
2355 /* Determine the kind of violation. */
2356 errCode = 0;
2357 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
2358 errCode |= X86_TRAP_PF_ID;
2359
2360 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
2361 errCode |= X86_TRAP_PF_RW;
2362
2363 /* If the page is present, then it's a page level protection fault. */
2364 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
2365 errCode |= X86_TRAP_PF_P;
2366
2367 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
2368
2369 /* GCPhys contains the guest physical address of the page fault. */
2370 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2371 TRPMSetErrorCode(pVM, errCode);
2372 TRPMSetFaultAddress(pVM, GCPhys);
2373
2374 /* Handle the pagefault trap for the nested shadow table. */
2375 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
2376 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2377 if (rc == VINF_SUCCESS)
2378 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2379 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
2380 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
2381
2382 TRPMResetTrap(pVM);
2383
2384 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2385 goto ResumeExecution;
2386 }
2387
2388#ifdef VBOX_STRICT
2389 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2390 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
2391#endif
2392 /* Need to go back to the recompiler to emulate the instruction. */
2393 TRPMResetTrap(pVM);
2394 break;
2395 }
2396
2397 case VMX_EXIT_EPT_MISCONFIG:
2398 {
2399 RTGCPHYS GCPhys;
2400
2401 Assert(pVM->hwaccm.s.fNestedPaging);
2402
2403 rc = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2404 AssertRC(rc);
2405
2406 Log(("VMX_EXIT_EPT_MISCONFIG for %VGp\n", GCPhys));
2407 break;
2408 }
2409
2410 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2411 /* Clear VM-exit on IF=1 change. */
2412 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2413 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2414 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2415 AssertRC(rc);
2416 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
2417 goto ResumeExecution; /* we check for pending guest interrupts there */
2418
2419 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2420 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2421 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
2422 /* Skip instruction and continue directly. */
2423 pCtx->rip += cbInstr;
2424 /* Continue execution.*/
2425 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2426 goto ResumeExecution;
2427
2428 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2429 {
2430 Log2(("VMX: Cpuid %x\n", pCtx->eax));
2431 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
2432 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2433 if (rc == VINF_SUCCESS)
2434 {
2435 /* Update EIP and continue execution. */
2436 Assert(cbInstr == 2);
2437 pCtx->rip += cbInstr;
2438 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2439 goto ResumeExecution;
2440 }
2441 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
2442 rc = VINF_EM_RAW_EMULATE_INSTR;
2443 break;
2444 }
2445
2446 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2447 {
2448 Log2(("VMX: Rdtsc\n"));
2449 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
2450 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2451 if (rc == VINF_SUCCESS)
2452 {
2453 /* Update EIP and continue execution. */
2454 Assert(cbInstr == 2);
2455 pCtx->rip += cbInstr;
2456 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2457 goto ResumeExecution;
2458 }
2459 AssertMsgFailed(("EMU: rdtsc failed with %Rrc\n", rc));
2460 rc = VINF_EM_RAW_EMULATE_INSTR;
2461 break;
2462 }
2463
2464 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2465 {
2466 Log2(("VMX: invlpg\n"));
2467 Assert(!pVM->hwaccm.s.fNestedPaging);
2468
2469 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
2470 rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2471 if (rc == VINF_SUCCESS)
2472 {
2473 /* Update EIP and continue execution. */
2474 pCtx->rip += cbInstr;
2475 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2476 goto ResumeExecution;
2477 }
2478 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, rc));
2479 break;
2480 }
2481
2482 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2483 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2484 {
2485 uint32_t cbSize;
2486
2487 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2488 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2489 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2490 if (rc == VINF_SUCCESS)
2491 {
2492 /* EIP has been updated already. */
2493
2494 /* Only resume if successful. */
2495 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2496 goto ResumeExecution;
2497 }
2498 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2499 break;
2500 }
2501
2502 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2503 {
2504 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2505 {
2506 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2507 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2508 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite);
2509 rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2510 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2511 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2512
2513 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2514 {
2515 case 0:
2516 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
2517 break;
2518 case 2:
2519 break;
2520 case 3:
2521 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
2522 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
2523 break;
2524 case 4:
2525 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
2526 break;
2527 case 8:
2528 /* CR8 contains the APIC TPR */
2529 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2530 break;
2531
2532 default:
2533 AssertFailed();
2534 break;
2535 }
2536 /* Check if a sync operation is pending. */
2537 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2538 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2539 {
2540 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2541 AssertRC(rc);
2542 }
2543 break;
2544
2545 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2546 Log2(("VMX: mov x, crx\n"));
2547 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead);
2548
2549 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
2550
2551 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2552 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2553
2554 rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2555 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2556 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2557 break;
2558
2559 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2560 Log2(("VMX: clts\n"));
2561 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
2562 rc = EMInterpretCLTS(pVM);
2563 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2564 break;
2565
2566 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2567 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2568 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
2569 rc = EMInterpretLMSW(pVM, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2570 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2571 break;
2572 }
2573
2574 /* Update EIP if no error occurred. */
2575 if (RT_SUCCESS(rc))
2576 pCtx->rip += cbInstr;
2577
2578 if (rc == VINF_SUCCESS)
2579 {
2580 /* Only resume if successful. */
2581 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2582 goto ResumeExecution;
2583 }
2584 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2585 break;
2586 }
2587
2588 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2589 {
2590 if (!DBGFIsStepping(pVM))
2591 {
2592 /* Disable drx move intercepts. */
2593 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2594 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2595 AssertRC(rc);
2596
2597 /* Save the host and load the guest debug state. */
2598 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2599 AssertRC(rc);
2600
2601#ifdef VBOX_WITH_STATISTICS
2602 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2603 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2604 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2605 else
2606 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2607#endif
2608
2609 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2610 goto ResumeExecution;
2611 }
2612
2613 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2614 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2615 {
2616 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2617 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2618 rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2619 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2620 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2621 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2622 Log2(("DR7=%08x\n", pCtx->dr[7]));
2623 }
2624 else
2625 {
2626 Log2(("VMX: mov x, drx\n"));
2627 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2628 rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2629 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2630 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2631 }
2632 /* Update EIP if no error occurred. */
2633 if (RT_SUCCESS(rc))
2634 pCtx->rip += cbInstr;
2635
2636 if (rc == VINF_SUCCESS)
2637 {
2638 /* Only resume if successful. */
2639 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2640 goto ResumeExecution;
2641 }
2642 Assert(rc == VERR_EM_INTERPRETER);
2643 break;
2644 }
2645
2646 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2647 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2648 {
2649 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2650 uint32_t uPort;
2651 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2652
2653 /** @todo necessary to make the distinction? */
2654 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2655 {
2656 uPort = pCtx->edx & 0xffff;
2657 }
2658 else
2659 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2660
2661 /* paranoia */
2662 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
2663 {
2664 rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2665 break;
2666 }
2667
2668 uint32_t cbSize = g_aIOSize[uIOWidth];
2669
2670 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2671 {
2672 /* ins/outs */
2673 uint32_t prefix = 0;
2674 if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2675 prefix |= PREFIX_REP;
2676
2677 if (fIOWrite)
2678 {
2679 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2680 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2681 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2682 }
2683 else
2684 {
2685 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2686 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2687 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2688 }
2689 }
2690 else
2691 {
2692 /* normal in/out */
2693 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2694
2695 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2696
2697 if (fIOWrite)
2698 {
2699 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2700 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2701 }
2702 else
2703 {
2704 uint32_t u32Val = 0;
2705
2706 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2707 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2708 if (IOM_SUCCESS(rc))
2709 {
2710 /* Write back to the EAX register. */
2711 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2712 }
2713 }
2714 }
2715 /*
2716 * Handled the I/O return codes.
2717 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2718 */
2719 if (IOM_SUCCESS(rc))
2720 {
2721 /* Update EIP and continue execution. */
2722 pCtx->rip += cbInstr;
2723 if (RT_LIKELY(rc == VINF_SUCCESS))
2724 {
2725 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2726 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2727 {
2728 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2729 for (unsigned i=0;i<4;i++)
2730 {
2731 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2732
2733 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2734 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2735 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2736 {
2737 uint64_t uDR6;
2738
2739 Assert(CPUMIsGuestDebugStateActive(pVM));
2740
2741 uDR6 = ASMGetDR6();
2742
2743 /* Clear all breakpoint status flags and set the one we just hit. */
2744 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2745 uDR6 |= (uint64_t)RT_BIT(i);
2746
2747 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2748 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2749 * the contents have been read.
2750 */
2751 ASMSetDR6(uDR6);
2752
2753 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2754 pCtx->dr[7] &= ~X86_DR7_GD;
2755
2756 /* Paranoia. */
2757 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2758 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2759 pCtx->dr[7] |= 0x400; /* must be one */
2760
2761 /* Resync DR7 */
2762 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2763 AssertRC(rc);
2764
2765 /* Construct inject info. */
2766 intInfo = X86_XCPT_DB;
2767 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2768 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2769
2770 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2771 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2772 AssertRC(rc);
2773
2774 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2775 goto ResumeExecution;
2776 }
2777 }
2778 }
2779
2780 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2781 goto ResumeExecution;
2782 }
2783 break;
2784 }
2785
2786#ifdef VBOX_STRICT
2787 if (rc == VINF_IOM_HC_IOPORT_READ)
2788 Assert(!fIOWrite);
2789 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2790 Assert(fIOWrite);
2791 else
2792 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2793#endif
2794 break;
2795 }
2796
2797 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2798 LogFlow(("VMX_EXIT_TPR\n"));
2799 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2800 goto ResumeExecution;
2801
2802 default:
2803 /* The rest is handled after syncing the entire CPU state. */
2804 break;
2805 }
2806
2807 /* Note: the guest state isn't entirely synced back at this stage. */
2808
2809 /* Investigate why there was a VM-exit. (part 2) */
2810 switch (exitReason)
2811 {
2812 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2813 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2814 case VMX_EXIT_EPT_VIOLATION:
2815 /* Already handled above. */
2816 break;
2817
2818 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2819 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2820 break;
2821
2822 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2823 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2824 rc = VINF_EM_RAW_INTERRUPT;
2825 AssertFailed(); /* Can't happen. Yet. */
2826 break;
2827
2828 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2829 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2830 rc = VINF_EM_RAW_INTERRUPT;
2831 AssertFailed(); /* Can't happen afaik. */
2832 break;
2833
2834 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2835 rc = VERR_EM_INTERPRETER;
2836 break;
2837
2838 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2839 /** Check if external interrupts are pending; if so, don't switch back. */
2840 pCtx->rip++; /* skip hlt */
2841 if ( pCtx->eflags.Bits.u1IF
2842 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
2843 goto ResumeExecution;
2844
2845 rc = VINF_EM_HALT;
2846 break;
2847
2848 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2849 AssertFailed(); /* can't happen. */
2850 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2851 break;
2852
2853 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2854 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2855 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2856 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2857 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2858 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2859 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2860 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2861 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2862 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2863 /** @todo inject #UD immediately */
2864 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2865 break;
2866
2867 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2868 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2869 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2870 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2871 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2872 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2873 /* already handled above */
2874 AssertMsg( rc == VINF_PGM_CHANGE_MODE
2875 || rc == VINF_EM_RAW_INTERRUPT
2876 || rc == VERR_EM_INTERPRETER
2877 || rc == VINF_EM_RAW_EMULATE_INSTR
2878 || rc == VINF_PGM_SYNC_CR3
2879 || rc == VINF_IOM_HC_IOPORT_READ
2880 || rc == VINF_IOM_HC_IOPORT_WRITE
2881 || rc == VINF_EM_RAW_GUEST_TRAP
2882 || rc == VINF_TRPM_XCPT_DISPATCHED
2883 || rc == VINF_EM_RESCHEDULE_REM,
2884 ("rc = %d\n", rc));
2885 break;
2886
2887 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2888 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2889 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2890 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2891 rc = VERR_EM_INTERPRETER;
2892 break;
2893
2894 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2895 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2896 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2897 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2898 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2899 break;
2900
2901 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2902 Assert(rc == VINF_EM_RAW_INTERRUPT);
2903 break;
2904
2905 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2906 {
2907#ifdef VBOX_STRICT
2908 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2909
2910 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2911 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
2912
2913 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2914 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2915
2916 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2917 Log(("VMX_VMCS_GUEST_CR3 %RGp\n", val));
2918
2919 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2920 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2921
2922 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2923 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2924
2925 VMX_LOG_SELREG(CS, "CS");
2926 VMX_LOG_SELREG(DS, "DS");
2927 VMX_LOG_SELREG(ES, "ES");
2928 VMX_LOG_SELREG(FS, "FS");
2929 VMX_LOG_SELREG(GS, "GS");
2930 VMX_LOG_SELREG(SS, "SS");
2931 VMX_LOG_SELREG(TR, "TR");
2932 VMX_LOG_SELREG(LDTR, "LDTR");
2933
2934 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2935 Log(("VMX_VMCS_GUEST_GDTR_BASE %RGv\n", val));
2936 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2937 Log(("VMX_VMCS_GUEST_IDTR_BASE %RGv\n", val));
2938#endif /* VBOX_STRICT */
2939 rc = VERR_VMX_INVALID_GUEST_STATE;
2940 break;
2941 }
2942
2943 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2944 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2945 default:
2946 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2947 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2948 break;
2949
2950 }
2951end:
2952
2953 /* Signal changes for the recompiler. */
2954 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2955
2956 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2957 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2958 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2959 {
2960 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2961 /* On the next entry we'll only sync the host context. */
2962 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2963 }
2964 else
2965 {
2966 /* On the next entry we'll sync everything. */
2967 /** @todo we can do better than this */
2968 /* Not in the VINF_PGM_CHANGE_MODE though! */
2969 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2970 }
2971
2972 /* translate into a less severe return code */
2973 if (rc == VERR_EM_INTERPRETER)
2974 rc = VINF_EM_RAW_EMULATE_INSTR;
2975 else
2976 /* Try to extract more information about what might have gone wrong here. */
2977 if (rc == VERR_VMX_INVALID_VMCS_PTR)
2978 {
2979 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
2980 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pVMCS;
2981 pVCpu->hwaccm.s.vmx.lasterror.idEnteredCpu = pVCpu->hwaccm.s.idEnteredCpu;
2982 pVCpu->hwaccm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
2983 }
2984
2985 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2986
2987 Log2(("X"));
2988 return rc;
2989}
2990
2991
2992/**
2993 * Enters the VT-x session
2994 *
2995 * @returns VBox status code.
2996 * @param pVM The VM to operate on.
2997 * @param pVCpu The VMCPU to operate on.
2998 * @param pCpu CPU info struct
2999 */
3000VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
3001{
3002 Assert(pVM->hwaccm.s.vmx.fSupported);
3003
3004 unsigned cr4 = ASMGetCR4();
3005 if (!(cr4 & X86_CR4_VMXE))
3006 {
3007 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
3008 return VERR_VMX_X86_CR4_VMXE_CLEARED;
3009 }
3010
3011 /* Activate the VM Control Structure. */
3012 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3013 if (RT_FAILURE(rc))
3014 return rc;
3015
3016 pVCpu->hwaccm.s.fResumeVM = false;
3017 return VINF_SUCCESS;
3018}
3019
3020
3021/**
3022 * Leaves the VT-x session
3023 *
3024 * @returns VBox status code.
3025 * @param pVM The VM to operate on.
3026 * @param pVCpu The VMCPU to operate on.
3027 * @param pCtx CPU context
3028 */
3029VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
3030{
3031 Assert(pVM->hwaccm.s.vmx.fSupported);
3032
3033 /* Save the guest debug state if necessary. */
3034 if (CPUMIsGuestDebugStateActive(pVM))
3035 {
3036 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
3037
3038 /* Enable drx move intercepts again. */
3039 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3040 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3041 AssertRC(rc);
3042
3043 /* Resync the debug registers the next time. */
3044 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3045 }
3046 else
3047 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
3048
3049 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
3050 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3051 AssertRC(rc);
3052
3053 return VINF_SUCCESS;
3054}
3055
3056/**
3057 * Flush the TLB (EPT)
3058 *
3059 * @returns VBox status code.
3060 * @param pVM The VM to operate on.
3061 * @param pVCpu The VM CPU to operate on.
3062 * @param enmFlush Type of flush
3063 * @param GCPhys Physical address of the page to flush
3064 */
3065static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys)
3066{
3067 uint64_t descriptor[2];
3068
3069 LogFlow(("vmxR0FlushEPT %d %RGv\n", enmFlush, GCPhys));
3070 Assert(pVM->hwaccm.s.fNestedPaging);
3071 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
3072 descriptor[1] = GCPhys;
3073 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
3074 AssertRC(rc);
3075}
3076
3077#ifdef HWACCM_VTX_WITH_VPID
3078/**
3079 * Flush the TLB (EPT)
3080 *
3081 * @returns VBox status code.
3082 * @param pVM The VM to operate on.
3083 * @param pVCpu The VM CPU to operate on.
3084 * @param enmFlush Type of flush
3085 * @param GCPtr Virtual address of the page to flush
3086 */
3087static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr)
3088{
3089 uint64_t descriptor[2];
3090
3091 Assert(pVM->hwaccm.s.vmx.fVPID);
3092 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
3093 descriptor[1] = GCPtr;
3094 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]);
3095 AssertRC(rc);
3096}
3097#endif /* HWACCM_VTX_WITH_VPID */
3098
3099/**
3100 * Invalidates a guest page
3101 *
3102 * @returns VBox status code.
3103 * @param pVM The VM to operate on.
3104 * @param pVCpu The VM CPU to operate on.
3105 * @param GCVirt Page to invalidate
3106 */
3107VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
3108{
3109 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3110
3111 LogFlow(("VMXR0InvalidatePage %RGv\n", GCVirt));
3112
3113 /* Only relevant if we want to use VPID.
3114 * In the nested paging case we still see such calls, but
3115 * can safely ignore them. (e.g. after cr3 updates)
3116 */
3117#ifdef HWACCM_VTX_WITH_VPID
3118 /* Skip it if a TLB flush is already pending. */
3119 if ( !fFlushPending
3120 && pVM->hwaccm.s.vmx.fVPID)
3121 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCVirt);
3122#endif /* HWACCM_VTX_WITH_VPID */
3123
3124 return VINF_SUCCESS;
3125}
3126
3127/**
3128 * Invalidates a guest page by physical address
3129 *
3130 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
3131 *
3132 * @returns VBox status code.
3133 * @param pVM The VM to operate on.
3134 * @param pVCpu The VM CPU to operate on.
3135 * @param GCPhys Page to invalidate
3136 */
3137VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
3138{
3139 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3140
3141 Assert(pVM->hwaccm.s.fNestedPaging);
3142
3143 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
3144
3145 /* Skip it if a TLB flush is already pending. */
3146 if (!fFlushPending)
3147 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCPhys);
3148
3149 return VINF_SUCCESS;
3150}
3151
3152/**
3153 * Report world switch error and dump some useful debug info
3154 *
3155 * @param pVM The VM to operate on.
3156 * @param pVCpu The VMCPU to operate on.
3157 * @param rc Return code
3158 * @param pCtx Current CPU context (not updated)
3159 */
3160static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx)
3161{
3162 switch (rc)
3163 {
3164 case VERR_VMX_INVALID_VMXON_PTR:
3165 AssertFailed();
3166 break;
3167
3168 case VERR_VMX_UNABLE_TO_START_VM:
3169 case VERR_VMX_UNABLE_TO_RESUME_VM:
3170 {
3171 int rc;
3172 RTCCUINTREG exitReason, instrError, val;
3173
3174 rc = VMXReadVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3175 rc |= VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3176 AssertRC(rc);
3177 if (rc == VINF_SUCCESS)
3178 {
3179 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
3180 Log(("Current stack %08x\n", &rc));
3181
3182 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
3183 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
3184
3185#ifdef VBOX_STRICT
3186 RTGDTR gdtr;
3187 PX86DESCHC pDesc;
3188
3189 ASMGetGDTR(&gdtr);
3190
3191 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
3192 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
3193 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
3194 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
3195 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
3196 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
3197 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
3198 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
3199 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
3200 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
3201
3202 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
3203 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
3204
3205 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
3206 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
3207
3208 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
3209 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
3210
3211 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_CS, &val);
3212 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
3213
3214 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
3215 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
3216
3217 if (val < gdtr.cbGdt)
3218 {
3219 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3220 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
3221 }
3222
3223 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_DS, &val);
3224 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
3225 if (val < gdtr.cbGdt)
3226 {
3227 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3228 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
3229 }
3230
3231 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_ES, &val);
3232 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
3233 if (val < gdtr.cbGdt)
3234 {
3235 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3236 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
3237 }
3238
3239 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_FS, &val);
3240 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
3241 if (val < gdtr.cbGdt)
3242 {
3243 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3244 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
3245 }
3246
3247 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_GS, &val);
3248 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
3249 if (val < gdtr.cbGdt)
3250 {
3251 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3252 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
3253 }
3254
3255 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_SS, &val);
3256 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
3257 if (val < gdtr.cbGdt)
3258 {
3259 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3260 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
3261 }
3262
3263 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_TR, &val);
3264 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
3265 if (val < gdtr.cbGdt)
3266 {
3267 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3268 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
3269 }
3270
3271 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
3272 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
3273
3274 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
3275 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
3276 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
3277 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
3278
3279 VMXReadVMCS(VMX_VMCS32_HOST_SYSENTER_CS, &val);
3280 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
3281
3282 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
3283 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
3284
3285 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
3286 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
3287
3288 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
3289 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
3290 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
3291 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
3292
3293# if HC_ARCH_BITS == 64
3294 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
3295 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
3296 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
3297 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
3298 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
3299# endif
3300#endif /* VBOX_STRICT */
3301 }
3302 break;
3303 }
3304
3305 default:
3306 /* impossible */
3307 AssertFailed();
3308 break;
3309 }
3310}
3311
3312#if HC_ARCH_BITS == 32
3313/**
3314 * Prepares for and executes VMLAUNCH (64 bits guest mode)
3315 *
3316 * @returns VBox status code
3317 * @param fResume vmlauch/vmresume
3318 * @param pCtx Guest context
3319 */
3320DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx)
3321{
3322 return VERR_NOT_IMPLEMENTED;
3323}
3324#endif
3325
3326
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette