VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 14757

Last change on this file since 14757 was 14757, checked in by vboxsync, 16 years ago

#3202: do PGMDynMapReleaseAutoSet/PGMDynMapStartAutoSet in the VMXR0RunGuestCode loop or we'll run out of entries very quickly (xp/pgmpool).
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 129.6 KB
Line 
1/* $Id: HWVMXR0.cpp 14757 2008-11-28 03:24:01Z vboxsync $ */
2/** @file
3 * HWACCM VMX - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/pgm.h>
32#include <VBox/pdm.h>
33#include <VBox/err.h>
34#include <VBox/log.h>
35#include <VBox/selm.h>
36#include <VBox/iom.h>
37#include <iprt/param.h>
38#include <iprt/assert.h>
39#include <iprt/asm.h>
40#include <iprt/string.h>
41#include "HWVMXR0.h"
42
43/*******************************************************************************
44* Global Variables *
45*******************************************************************************/
46/* IO operation lookup arrays. */
47static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
48static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
49
50/*******************************************************************************
51* Local Functions *
52*******************************************************************************/
53static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx);
54static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu);
55static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu);
56static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu);
57static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys);
58static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr);
59static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
60
61
62static void VMXR0CheckError(PVM pVM, PVMCPU pVCpu, int rc)
63{
64 if (rc == VERR_VMX_GENERIC)
65 {
66 RTCCUINTREG instrError;
67
68 VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
69 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
70 }
71 pVM->hwaccm.s.lLastError = rc;
72}
73
74/**
75 * Sets up and activates VT-x on the current CPU
76 *
77 * @returns VBox status code.
78 * @param pCpu CPU info struct
79 * @param pVM The VM to operate on. (can be NULL after a resume!!)
80 * @param pvPageCpu Pointer to the global cpu page
81 * @param pPageCpuPhys Physical address of the global cpu page
82 */
83VMMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
84{
85 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
86 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
87
88#ifdef LOG_ENABLED
89 SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
90#endif
91 if (pVM)
92 {
93 /* Set revision dword at the beginning of the VMXON structure. */
94 *(uint32_t *)pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
95 }
96
97 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
98 * (which can have very bad consequences!!!)
99 */
100
101 /* Make sure the VMX instructions don't cause #UD faults. */
102 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
103
104 /* Enter VMX Root Mode */
105 int rc = VMXEnable(pPageCpuPhys);
106 if (RT_FAILURE(rc))
107 {
108 if (pVM)
109 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
110 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
111 return VERR_VMX_VMXON_FAILED;
112 }
113 return VINF_SUCCESS;
114}
115
116/**
117 * Deactivates VT-x on the current CPU
118 *
119 * @returns VBox status code.
120 * @param pCpu CPU info struct
121 * @param pvPageCpu Pointer to the global cpu page
122 * @param pPageCpuPhys Physical address of the global cpu page
123 */
124VMMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
125{
126 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
127 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
128
129 /* Leave VMX Root Mode. */
130 VMXDisable();
131
132 /* And clear the X86_CR4_VMXE bit */
133 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
134
135#ifdef LOG_ENABLED
136 SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
137#endif
138 return VINF_SUCCESS;
139}
140
141/**
142 * Does Ring-0 per VM VT-x init.
143 *
144 * @returns VBox status code.
145 * @param pVM The VM to operate on.
146 */
147VMMR0DECL(int) VMXR0InitVM(PVM pVM)
148{
149 int rc;
150
151#ifdef LOG_ENABLED
152 SUPR0Printf("VMXR0InitVM %x\n", pVM);
153#endif
154
155 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
156
157 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
158 {
159 /* Allocate one page for the virtual APIC mmio cache. */
160 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
161 AssertRC(rc);
162 if (RT_FAILURE(rc))
163 return rc;
164
165 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
166 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
167 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
168 }
169 else
170 {
171 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
172 pVM->hwaccm.s.vmx.pAPIC = 0;
173 pVM->hwaccm.s.vmx.pAPICPhys = 0;
174 }
175
176 /* Allocate the MSR bitmap if this feature is supported. */
177 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
178 {
179 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
180 AssertRC(rc);
181 if (RT_FAILURE(rc))
182 return rc;
183
184 pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
185 pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
186 memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
187 }
188
189 /* Allocate VMCBs for all guest CPUs. */
190 for (unsigned i=0;i<pVM->cCPUs;i++)
191 {
192 PVMCPU pVCpu = &pVM->aCpus[i];
193
194 pVCpu->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
195
196 /* Allocate one page for the VM control structure (VMCS). */
197 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
198 AssertRC(rc);
199 if (RT_FAILURE(rc))
200 return rc;
201
202 pVCpu->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjVMCS);
203 pVCpu->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjVMCS, 0);
204 ASMMemZero32(pVCpu->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
205
206 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
207 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
208
209 /* Current guest paging mode. */
210 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
211
212#ifdef LOG_ENABLED
213 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.pVMCSPhys);
214#endif
215 }
216
217 return VINF_SUCCESS;
218}
219
220/**
221 * Does Ring-0 per VM VT-x termination.
222 *
223 * @returns VBox status code.
224 * @param pVM The VM to operate on.
225 */
226VMMR0DECL(int) VMXR0TermVM(PVM pVM)
227{
228 for (unsigned i=0;i<pVM->cCPUs;i++)
229 {
230 if (pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
231 {
232 RTR0MemObjFree(pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS, false);
233 pVM->aCpus[i].hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
234 pVM->aCpus[i].hwaccm.s.vmx.pVMCS = 0;
235 pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys = 0;
236 }
237 }
238 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
239 {
240 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
241 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
242 pVM->hwaccm.s.vmx.pAPIC = 0;
243 pVM->hwaccm.s.vmx.pAPICPhys = 0;
244 }
245 if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
246 {
247 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
248 pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
249 pVM->hwaccm.s.vmx.pMSRBitmap = 0;
250 pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
251 }
252 return VINF_SUCCESS;
253}
254
255/**
256 * Sets up VT-x for the specified VM
257 *
258 * @returns VBox status code.
259 * @param pVM The VM to operate on.
260 */
261VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
262{
263 int rc = VINF_SUCCESS;
264 uint32_t val;
265
266 AssertReturn(pVM, VERR_INVALID_PARAMETER);
267
268 for (unsigned i=0;i<pVM->cCPUs;i++)
269 {
270 Assert(pVM->aCpus[i].hwaccm.s.vmx.pVMCS);
271
272 /* Set revision dword at the beginning of the VMCS structure. */
273 *(uint32_t *)pVM->aCpus[i].hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
274
275 /* Clear VM Control Structure. */
276 Log(("pVMCSPhys = %RHp\n", pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys));
277 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
278 if (RT_FAILURE(rc))
279 goto vmx_end;
280
281 /* Activate the VM Control Structure. */
282 rc = VMXActivateVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
283 if (RT_FAILURE(rc))
284 goto vmx_end;
285
286 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
287 * Set required bits to one and zero according to the MSR capabilities.
288 */
289 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
290 /* External and non-maskable interrupts cause VM-exits. */
291 val = val | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
292 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
293
294 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
295 AssertRC(rc);
296
297 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
298 * Set required bits to one and zero according to the MSR capabilities.
299 */
300 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
301 /* Program which event cause VM-exits and which features we want to use. */
302 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
303 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
304 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
305 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
306 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
307
308 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
309 if (!pVM->hwaccm.s.fNestedPaging)
310 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
311 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
312 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
313
314 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
315
316#if HC_ARCH_BITS == 64
317 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
318 {
319 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
320 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
321 Assert(pVM->hwaccm.s.vmx.pAPIC);
322 }
323 else
324 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
325 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
326#endif
327
328#ifdef VBOX_WITH_VTX_MSR_BITMAPS
329 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
330 {
331 Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
332 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
333 }
334#endif
335
336 /* We will use the secondary control if it's present. */
337 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
338
339 /* Mask away the bits that the CPU doesn't support */
340 /** @todo make sure they don't conflict with the above requirements. */
341 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
342 pVM->aCpus[i].hwaccm.s.vmx.proc_ctls = val;
343
344 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
345 AssertRC(rc);
346
347 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
348 {
349 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
350 * Set required bits to one and zero according to the MSR capabilities.
351 */
352 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
353 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
354
355#ifdef HWACCM_VTX_WITH_EPT
356 if (pVM->hwaccm.s.fNestedPaging)
357 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
358#endif /* HWACCM_VTX_WITH_EPT */
359#ifdef HWACCM_VTX_WITH_VPID
360 else
361 if (pVM->hwaccm.s.vmx.fVPID)
362 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
363#endif /* HWACCM_VTX_WITH_VPID */
364
365 /* Mask away the bits that the CPU doesn't support */
366 /** @todo make sure they don't conflict with the above requirements. */
367 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
368
369 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
370 AssertRC(rc);
371 }
372
373 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
374 * Set required bits to one and zero according to the MSR capabilities.
375 */
376 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
377 AssertRC(rc);
378
379 /* VMX_VMCS_CTRL_EXIT_CONTROLS
380 * Set required bits to one and zero according to the MSR capabilities.
381 */
382 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
383
384 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
385 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
386#if HC_ARCH_BITS == 64
387 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
388#else
389 /* else Must be zero when AMD64 is not available. */
390#endif
391 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
392 /* Don't acknowledge external interrupts on VM-exit. */
393 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
394 AssertRC(rc);
395
396 /* Forward all exception except #NM & #PF to the guest.
397 * We always need to check pagefaults since our shadow page table can be out of sync.
398 * And we always lazily sync the FPU & XMM state.
399 */
400
401 /** @todo Possible optimization:
402 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
403 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
404 * registers ourselves of course.
405 *
406 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
407 */
408
409 /* Don't filter page faults; all of them should cause a switch. */
410 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
411 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
412 AssertRC(rc);
413
414 /* Init TSC offset to zero. */
415 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
416 AssertRC(rc);
417
418 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
419 AssertRC(rc);
420
421 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
422 AssertRC(rc);
423
424 /* Set the MSR bitmap address. */
425 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
426 {
427 /* Optional */
428 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
429 AssertRC(rc);
430 }
431
432 /* Clear MSR controls. */
433 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
434 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
435 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
436 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
437 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
438 AssertRC(rc);
439
440 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
441 {
442 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
443 /* Optional */
444 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
445 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
446 AssertRC(rc);
447 }
448
449 /* Set link pointer to -1. Not currently used. */
450 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
451 AssertRC(rc);
452
453 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
454 rc = VMXClearVMCS(pVM->aCpus[i].hwaccm.s.vmx.pVMCSPhys);
455 AssertRC(rc);
456 } /* for each VMCPU */
457
458 /* Choose the right TLB setup function. */
459 if (pVM->hwaccm.s.fNestedPaging)
460 {
461 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBEPT;
462
463 /* Default values for flushing. */
464 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
465 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
466
467 /* If the capabilities specify we can do more, then make use of it. */
468 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_INDIV)
469 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
470 else
471 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
472 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
473
474 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_CONTEXT)
475 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
476 }
477#ifdef HWACCM_VTX_WITH_VPID
478 else
479 if (pVM->hwaccm.s.vmx.fVPID)
480 {
481 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBVPID;
482
483 /* Default values for flushing. */
484 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_ALL_CONTEXTS;
485 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_ALL_CONTEXTS;
486
487 /* If the capabilities specify we can do more, then make use of it. */
488 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV)
489 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_PAGE;
490 else
491 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
492 pVM->hwaccm.s.vmx.enmFlushPage = VMX_FLUSH_SINGLE_CONTEXT;
493
494 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_CONTEXT)
495 pVM->hwaccm.s.vmx.enmFlushContext = VMX_FLUSH_SINGLE_CONTEXT;
496 }
497#endif /* HWACCM_VTX_WITH_VPID */
498 else
499 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = vmxR0SetupTLBDummy;
500
501vmx_end:
502 VMXR0CheckError(pVM, &pVM->aCpus[0], rc);
503 return rc;
504}
505
506
507/**
508 * Injects an event (trap or external interrupt)
509 *
510 * @returns VBox status code.
511 * @param pVM The VM to operate on.
512 * @param pVCpu The VMCPU to operate on.
513 * @param pCtx CPU Context
514 * @param intInfo VMX interrupt info
515 * @param cbInstr Opcode length of faulting instruction
516 * @param errCode Error code (optional)
517 */
518static int VMXR0InjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
519{
520 int rc;
521 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
522
523#ifdef VBOX_STRICT
524 if (iGate == 0xE)
525 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
526 else
527 if (iGate < 0x20)
528 LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
529 else
530 {
531 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
532 Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
533 Assert(pCtx->eflags.u32 & X86_EFL_IF);
534 }
535#endif
536
537#ifdef HWACCM_VMX_EMULATE_REALMODE
538 if (CPUMIsGuestInRealModeEx(pCtx))
539 {
540 RTGCPHYS GCPhysHandler;
541 uint16_t offset, ip;
542 RTSEL sel;
543
544 /* Injecting events doesn't work right with real mode emulation.
545 * (#GP if we try to inject external hardware interrupts)
546 * Inject the interrupt or trap directly instead.
547 */
548 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
549
550 /* Check if the interrupt handler is present. */
551 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
552 {
553 Log(("IDT cbIdt violation\n"));
554 if (iGate != X86_XCPT_DF)
555 {
556 RTGCUINTPTR intInfo;
557
558 intInfo = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
559 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
560 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
561 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
562
563 return VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0 /* no error code according to the Intel docs */);
564 }
565 Log(("Triple fault -> reset the VM!\n"));
566 return VINF_EM_RESET;
567 }
568 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
569 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
570 || iGate == 4)
571 {
572 ip = pCtx->ip + cbInstr;
573 }
574 else
575 ip = pCtx->ip;
576
577 /* Read the selector:offset pair of the interrupt handler. */
578 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
579 PGMPhysRead(pVM, GCPhysHandler, &offset, sizeof(offset));
580 PGMPhysRead(pVM, GCPhysHandler + 2, &sel, sizeof(sel));
581
582 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
583
584 /* Construct the stack frame. */
585 /** @todo should check stack limit. */
586 pCtx->sp -= 2;
587 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
588 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t));
589 pCtx->sp -= 2;
590 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
591 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t));
592 pCtx->sp -= 2;
593 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
594 PGMPhysWrite(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip));
595
596 /* Update the CPU state for executing the handler. */
597 pCtx->rip = offset;
598 pCtx->cs = sel;
599 pCtx->csHid.u64Base = sel << 4;
600 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
601
602 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
603 return VINF_SUCCESS;
604 }
605#endif /* HWACCM_VMX_EMULATE_REALMODE */
606
607 /* Set event injection state. */
608 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
609
610 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
611 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
612
613 AssertRC(rc);
614 return rc;
615}
616
617
618/**
619 * Checks for pending guest interrupts and injects them
620 *
621 * @returns VBox status code.
622 * @param pVM The VM to operate on.
623 * @param pVCpu The VMCPU to operate on.
624 * @param pCtx CPU Context
625 */
626static int VMXR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
627{
628 int rc;
629
630 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
631 if (pVCpu->hwaccm.s.Event.fPending)
632 {
633 Log(("Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
634 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
635 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
636 AssertRC(rc);
637
638 pVCpu->hwaccm.s.Event.fPending = false;
639 return VINF_SUCCESS;
640 }
641
642 if (pVM->hwaccm.s.fInjectNMI)
643 {
644 RTGCUINTPTR intInfo;
645
646 intInfo = X86_XCPT_NMI;
647 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
648 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
649
650 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
651 AssertRC(rc);
652
653 pVM->hwaccm.s.fInjectNMI = false;
654 return VINF_SUCCESS;
655 }
656
657 /* When external interrupts are pending, we should exit the VM when IF is set. */
658 if ( !TRPMHasTrap(pVM)
659 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
660 {
661 if (!(pCtx->eflags.u32 & X86_EFL_IF))
662 {
663 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
664 {
665 LogFlow(("Enable irq window exit!\n"));
666 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
667 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
668 AssertRC(rc);
669 }
670 /* else nothing to do but wait */
671 }
672 else
673 if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
674 {
675 uint8_t u8Interrupt;
676
677 rc = PDMGetInterrupt(pVM, &u8Interrupt);
678 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
679 if (RT_SUCCESS(rc))
680 {
681 rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
682 AssertRC(rc);
683 }
684 else
685 {
686 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
687 Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)));
688 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
689 /* Just continue */
690 }
691 }
692 else
693 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
694 }
695
696#ifdef VBOX_STRICT
697 if (TRPMHasTrap(pVM))
698 {
699 uint8_t u8Vector;
700 rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
701 AssertRC(rc);
702 }
703#endif
704
705 if ( pCtx->eflags.u32 & X86_EFL_IF
706 && (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
707 && TRPMHasTrap(pVM)
708 )
709 {
710 uint8_t u8Vector;
711 int rc;
712 TRPMEVENT enmType;
713 RTGCUINTPTR intInfo;
714 RTGCUINT errCode;
715
716 /* If a new event is pending, then dispatch it now. */
717 rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
718 AssertRC(rc);
719 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
720 Assert(enmType != TRPM_SOFTWARE_INT);
721
722 /* Clear the pending trap. */
723 rc = TRPMResetTrap(pVM);
724 AssertRC(rc);
725
726 intInfo = u8Vector;
727 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
728
729 if (enmType == TRPM_TRAP)
730 {
731 switch (u8Vector) {
732 case 8:
733 case 10:
734 case 11:
735 case 12:
736 case 13:
737 case 14:
738 case 17:
739 /* Valid error codes. */
740 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
741 break;
742 default:
743 break;
744 }
745 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
746 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
747 else
748 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
749 }
750 else
751 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
752
753 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
754 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
755 AssertRC(rc);
756 } /* if (interrupts can be dispatched) */
757
758 return VINF_SUCCESS;
759}
760
761/**
762 * Save the host state
763 *
764 * @returns VBox status code.
765 * @param pVM The VM to operate on.
766 * @param pVCpu The VMCPU to operate on.
767 */
768VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
769{
770 int rc = VINF_SUCCESS;
771
772 /*
773 * Host CPU Context
774 */
775 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
776 {
777 RTIDTR idtr;
778 RTGDTR gdtr;
779 RTSEL SelTR;
780 PX86DESCHC pDesc;
781 uintptr_t trBase;
782 RTSEL cs;
783 RTSEL ss;
784
785 /* Control registers */
786 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
787 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
788 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
789 AssertRC(rc);
790 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
791 Log2(("VMX_VMCS_HOST_CR3 %08x\n", ASMGetCR3()));
792 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
793
794 /* Selector registers. */
795 cs = ASMGetCS();
796 ss = ASMGetSS();
797#ifdef RT_OS_DARWIN
798 /* VMX doesn't like LDT cs and ss, so switch to the GDT ones. Weird kernel. */
799 if (cs == 0x04) /* SYSENTER_CS & ~3 */
800 cs = 0x08; /* KERNEL_CS */
801 if (ss == 0x0c) /* (SYSENTER_CS & ~3) + 8 */
802 ss = 0x10; /* KERNEL_DS */
803#endif
804 rc = VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_CS, cs);
805 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
806 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_DS, 0);
807 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_ES, 0);
808#if HC_ARCH_BITS == 32
809 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_FS, 0);
810 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_GS, 0);
811#endif
812 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_SS, ss);
813 SelTR = ASMGetTR();
814 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_TR, SelTR);
815 AssertRC(rc);
816 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
817 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
818 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
819 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
820 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
821 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", cs, ASMGetSS()));
822 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
823
824 /* GDTR & IDTR */
825 ASMGetGDTR(&gdtr);
826 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
827 ASMGetIDTR(&idtr);
828 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
829 AssertRC(rc);
830 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
831 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
832
833 /* Save the base address of the TR selector. */
834 if (SelTR > gdtr.cbGdt)
835 {
836 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
837 return VERR_VMX_INVALID_HOST_STATE;
838 }
839
840 pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
841#if HC_ARCH_BITS == 64
842 trBase = X86DESC64_BASE(*pDesc);
843#else
844 trBase = X86DESC_BASE(*pDesc);
845#endif
846 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
847 AssertRC(rc);
848 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
849
850 /* FS and GS base. */
851#if HC_ARCH_BITS == 64
852 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
853 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
854 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
855 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
856#endif
857 AssertRC(rc);
858
859 /* Sysenter MSRs. */
860 /** @todo expensive!! */
861 rc = VMXWriteVMCS(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
862 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
863#if HC_ARCH_BITS == 32
864 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
865 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
866 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
867 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
868#else
869 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
870 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
871 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
872 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
873#endif
874 AssertRC(rc);
875
876 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
877 }
878 return rc;
879}
880
881/**
882 * Prefetch the 4 PDPT pointers (PAE and nested paging only)
883 *
884 * @param pVM The VM to operate on.
885 * @param pCtx Guest context
886 */
887static void vmxR0PrefetchPAEPdptrs(PVM pVM, PCPUMCTX pCtx)
888{
889 if (CPUMIsGuestInPAEModeEx(pCtx))
890 {
891 X86PDPE Pdpe;
892
893 for (unsigned i=0;i<4;i++)
894 {
895 Pdpe = PGMGstGetPaePDPtr(pVM, i);
896 int rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR0_FULL + i*2, Pdpe.u);
897 AssertRC(rc);
898 }
899 }
900}
901
902/**
903 * Update the exception bitmap according to the current CPU state
904 *
905 * @param pVM The VM to operate on.
906 * @param pVCpu The VMCPU to operate on.
907 * @param pCtx Guest context
908 */
909static void vmxR0UpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
910{
911 uint32_t u32TrapMask;
912 Assert(pCtx);
913
914 u32TrapMask = HWACCM_VMX_TRAP_MASK;
915#ifndef DEBUG
916 if (pVM->hwaccm.s.fNestedPaging)
917 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
918#endif
919
920 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
921 if ( CPUMIsGuestFPUStateActive(pVCpu) == true
922 && !(pCtx->cr0 & X86_CR0_NE)
923 && !pVCpu->hwaccm.s.fFPUOldStyleOverride)
924 {
925 u32TrapMask |= RT_BIT(X86_XCPT_MF);
926 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
927 }
928
929#ifdef DEBUG
930 /* Intercept X86_XCPT_DB if stepping is enabled */
931 if (DBGFIsStepping(pVM))
932 u32TrapMask |= RT_BIT(X86_XCPT_DB);
933#endif
934
935#ifdef VBOX_STRICT
936 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
937#endif
938
939# ifdef HWACCM_VMX_EMULATE_REALMODE
940 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
941 if (CPUMIsGuestInRealModeEx(pCtx))
942 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
943# endif /* HWACCM_VMX_EMULATE_REALMODE */
944
945 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
946 AssertRC(rc);
947}
948
949/**
950 * Loads the guest state
951 *
952 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
953 *
954 * @returns VBox status code.
955 * @param pVM The VM to operate on.
956 * @param pVCpu The VMCPU to operate on.
957 * @param pCtx Guest context
958 */
959VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
960{
961 int rc = VINF_SUCCESS;
962 RTGCUINTPTR val;
963 X86EFLAGS eflags;
964
965 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
966 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
967 {
968#ifdef HWACCM_VMX_EMULATE_REALMODE
969 PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
970 if (pVCpu->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
971 {
972 /* Correct weird requirements for switching to protected mode. */
973 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
974 && enmGuestMode >= PGMMODE_PROTECTED)
975 {
976 /* DPL of all hidden selector registers must match the current CPL (0). */
977 pCtx->csHid.Attr.n.u2Dpl = 0;
978 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
979
980 pCtx->dsHid.Attr.n.u2Dpl = 0;
981 pCtx->esHid.Attr.n.u2Dpl = 0;
982 pCtx->fsHid.Attr.n.u2Dpl = 0;
983 pCtx->gsHid.Attr.n.u2Dpl = 0;
984 pCtx->ssHid.Attr.n.u2Dpl = 0;
985 }
986 else
987 /* Switching from protected mode to real mode. */
988 if ( pVCpu->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
989 && enmGuestMode == PGMMODE_REAL)
990 {
991 /* The limit must also be adjusted. */
992 pCtx->csHid.u32Limit &= 0xffff;
993 pCtx->dsHid.u32Limit &= 0xffff;
994 pCtx->esHid.u32Limit &= 0xffff;
995 pCtx->fsHid.u32Limit &= 0xffff;
996 pCtx->gsHid.u32Limit &= 0xffff;
997 pCtx->ssHid.u32Limit &= 0xffff;
998
999 Assert(pCtx->csHid.u64Base <= 0xfffff);
1000 Assert(pCtx->dsHid.u64Base <= 0xfffff);
1001 Assert(pCtx->esHid.u64Base <= 0xfffff);
1002 Assert(pCtx->fsHid.u64Base <= 0xfffff);
1003 Assert(pCtx->gsHid.u64Base <= 0xfffff);
1004 }
1005 pVCpu->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
1006 }
1007 else
1008 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1009 if ( CPUMIsGuestInRealModeEx(pCtx)
1010 && pCtx->csHid.u64Base == 0xffff0000)
1011 {
1012 pCtx->csHid.u64Base = 0xf0000;
1013 pCtx->cs = 0xf000;
1014 }
1015#endif /* HWACCM_VMX_EMULATE_REALMODE */
1016
1017 VMX_WRITE_SELREG(ES, es);
1018 AssertRC(rc);
1019
1020 VMX_WRITE_SELREG(CS, cs);
1021 AssertRC(rc);
1022
1023 VMX_WRITE_SELREG(SS, ss);
1024 AssertRC(rc);
1025
1026 VMX_WRITE_SELREG(DS, ds);
1027 AssertRC(rc);
1028
1029 /* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
1030 VMX_WRITE_SELREG(FS, fs);
1031 AssertRC(rc);
1032
1033 VMX_WRITE_SELREG(GS, gs);
1034 AssertRC(rc);
1035 }
1036
1037 /* Guest CPU context: LDTR. */
1038 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1039 {
1040 if (pCtx->ldtr == 0)
1041 {
1042 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1043 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1044 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
1045 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1046 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1047 }
1048 else
1049 {
1050 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr);
1051 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1052 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1053 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1054 }
1055 AssertRC(rc);
1056 }
1057 /* Guest CPU context: TR. */
1058 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1059 {
1060#ifdef HWACCM_VMX_EMULATE_REALMODE
1061 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1062 if (CPUMIsGuestInRealModeEx(pCtx))
1063 {
1064 RTGCPHYS GCPhys;
1065
1066 /* We convert it here every time as pci regions could be reconfigured. */
1067 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1068 AssertRC(rc);
1069
1070 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, 0);
1071 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1072 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1073
1074 X86DESCATTR attr;
1075
1076 attr.u = 0;
1077 attr.n.u1Present = 1;
1078 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1079 val = attr.u;
1080 }
1081 else
1082#endif /* HWACCM_VMX_EMULATE_REALMODE */
1083 {
1084 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr);
1085 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1086 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
1087
1088 val = pCtx->trHid.Attr.u;
1089
1090 /* The TSS selector must be busy. */
1091 if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
1092 val = (val & ~0xF) | X86_SEL_TYPE_SYS_286_TSS_BUSY;
1093 else
1094 /* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
1095 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1096
1097 }
1098 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
1099 AssertRC(rc);
1100 }
1101 /* Guest CPU context: GDTR. */
1102 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1103 {
1104 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1105 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1106 AssertRC(rc);
1107 }
1108 /* Guest CPU context: IDTR. */
1109 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1110 {
1111 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1112 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1113 AssertRC(rc);
1114 }
1115
1116 /*
1117 * Sysenter MSRs (unconditional)
1118 */
1119 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1120 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1121 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1122 AssertRC(rc);
1123
1124 /* Control registers */
1125 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1126 {
1127 val = pCtx->cr0;
1128 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1129 Log2(("Guest CR0-shadow %08x\n", val));
1130 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1131 {
1132 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1133 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1134 }
1135 else
1136 {
1137 /** @todo check if we support the old style mess correctly. */
1138 if (!(val & X86_CR0_NE))
1139 Log(("Forcing X86_CR0_NE!!!\n"));
1140
1141 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1142 }
1143 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1144 val |= X86_CR0_PE | X86_CR0_PG;
1145 if (pVM->hwaccm.s.fNestedPaging)
1146 {
1147 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1148 {
1149 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1150 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1151 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1152 }
1153 else
1154 {
1155 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1156 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1157 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1158 }
1159 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1160 AssertRC(rc);
1161 }
1162 else
1163 {
1164 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1165 val |= X86_CR0_WP;
1166 }
1167
1168 /* Always enable caching. */
1169 val &= ~(X86_CR0_CD|X86_CR0_NW);
1170
1171 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1172 Log2(("Guest CR0 %08x\n", val));
1173 /* CR0 flags owned by the host; if the guests attempts to change them, then
1174 * the VM will exit.
1175 */
1176 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1177 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1178 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1179 | X86_CR0_TS
1180 | X86_CR0_ET /* Bit not restored during VM-exit! */
1181 | X86_CR0_CD /* Bit not restored during VM-exit! */
1182 | X86_CR0_NW /* Bit not restored during VM-exit! */
1183 | X86_CR0_NE
1184 | X86_CR0_MP;
1185 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1186
1187 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1188 Log2(("Guest CR0-mask %08x\n", val));
1189 AssertRC(rc);
1190 }
1191 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1192 {
1193 /* CR4 */
1194 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1195 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1196 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1197 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1198
1199 if (!pVM->hwaccm.s.fNestedPaging)
1200 {
1201 switch(pVCpu->hwaccm.s.enmShadowMode)
1202 {
1203 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1204 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1205 case PGMMODE_32_BIT: /* 32-bit paging. */
1206 break;
1207
1208 case PGMMODE_PAE: /* PAE paging. */
1209 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1210 /** @todo use normal 32 bits paging */
1211 val |= X86_CR4_PAE;
1212 break;
1213
1214 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1215 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1216#ifdef VBOX_ENABLE_64_BITS_GUESTS
1217 break;
1218#else
1219 AssertFailed();
1220 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1221#endif
1222 default: /* shut up gcc */
1223 AssertFailed();
1224 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1225 }
1226 }
1227 else
1228 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1229 {
1230 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1231 val |= X86_CR4_PSE;
1232 /* Our identity mapping is a 32 bits page directory. */
1233 val &= ~X86_CR4_PAE;
1234 }
1235
1236#ifdef HWACCM_VMX_EMULATE_REALMODE
1237 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1238 if (CPUMIsGuestInRealModeEx(pCtx))
1239 val |= X86_CR4_VME;
1240#endif /* HWACCM_VMX_EMULATE_REALMODE */
1241
1242 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1243 Log2(("Guest CR4 %08x\n", val));
1244 /* CR4 flags owned by the host; if the guests attempts to change them, then
1245 * the VM will exit.
1246 */
1247 val = 0
1248#ifdef HWACCM_VMX_EMULATE_REALMODE
1249 | X86_CR4_VME
1250#endif
1251 | X86_CR4_PAE
1252 | X86_CR4_PGE
1253 | X86_CR4_PSE
1254 | X86_CR4_VMXE;
1255 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1256
1257 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1258 Log2(("Guest CR4-mask %08x\n", val));
1259 AssertRC(rc);
1260 }
1261
1262 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1263 {
1264 if (pVM->hwaccm.s.fNestedPaging)
1265 {
1266 AssertMsg(PGMGetEPTCR3(pVM) == PGMGetHyperCR3(pVM), ("%RHp vs %RHp\n", PGMGetEPTCR3(pVM), PGMGetHyperCR3(pVM)));
1267 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetEPTCR3(pVM);
1268
1269 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1270 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1271 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1272 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1273
1274 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1275 AssertRC(rc);
1276
1277 if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
1278 {
1279 RTGCPHYS GCPhys;
1280
1281 /* We convert it here every time as pci regions could be reconfigured. */
1282 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1283 AssertRC(rc);
1284
1285 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1286 * take care of the translation to host physical addresses.
1287 */
1288 val = GCPhys;
1289 }
1290 else
1291 {
1292 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1293 val = pCtx->cr3;
1294 /* Prefetch the four PDPT entries in PAE mode. */
1295 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1296 }
1297 }
1298 else
1299 {
1300 val = PGMGetHyperCR3(pVM);
1301 Assert(val);
1302 }
1303
1304 /* Save our shadow CR3 register. */
1305 rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1306 AssertRC(rc);
1307 }
1308
1309 /* Debug registers. */
1310 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1311 {
1312 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1313 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1314
1315 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1316 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1317 pCtx->dr[7] |= 0x400; /* must be one */
1318
1319 /* Resync DR7 */
1320 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1321 AssertRC(rc);
1322
1323 /* Sync the debug state now if any breakpoint is armed. */
1324 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1325 && !CPUMIsGuestDebugStateActive(pVM)
1326 && !DBGFIsStepping(pVM))
1327 {
1328 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1329
1330 /* Disable drx move intercepts. */
1331 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1332 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1333 AssertRC(rc);
1334
1335 /* Save the host and load the guest debug state. */
1336 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1337 AssertRC(rc);
1338 }
1339
1340 /* IA32_DEBUGCTL MSR. */
1341 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1342 AssertRC(rc);
1343
1344 /** @todo do we really ever need this? */
1345 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1346 AssertRC(rc);
1347 }
1348
1349 /* EIP, ESP and EFLAGS */
1350 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1351 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1352 AssertRC(rc);
1353
1354 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1355 eflags = pCtx->eflags;
1356 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1357 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1358
1359#ifdef HWACCM_VMX_EMULATE_REALMODE
1360 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1361 if (CPUMIsGuestInRealModeEx(pCtx))
1362 {
1363 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1364
1365 eflags.Bits.u1VM = 1;
1366 eflags.Bits.u2IOPL = 3;
1367 }
1368#endif /* HWACCM_VMX_EMULATE_REALMODE */
1369 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1370 AssertRC(rc);
1371
1372 /* TSC offset. */
1373 uint64_t u64TSCOffset;
1374
1375 if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1376 {
1377 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1378 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1379 AssertRC(rc);
1380
1381 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1382 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1383 AssertRC(rc);
1384 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1385 }
1386 else
1387 {
1388 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1389 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1390 AssertRC(rc);
1391 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1392 }
1393
1394 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1395 * Set required bits to one and zero according to the MSR capabilities.
1396 */
1397 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1398 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1399 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1400
1401 /* 64 bits guest mode? */
1402 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1403 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1404 /* else Must be zero when AMD64 is not available. */
1405
1406 /* Mask away the bits that the CPU doesn't support */
1407 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1408 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1409 AssertRC(rc);
1410
1411 /* 64 bits guest mode? */
1412 if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1413 {
1414#if !defined(VBOX_WITH_64_BITS_GUESTS) || HC_ARCH_BITS != 64
1415 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1416#else
1417 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1418#endif
1419 /* Unconditionally update these as wrmsr might have changed them. */
1420 rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1421 AssertRC(rc);
1422 rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1423 AssertRC(rc);
1424 }
1425 else
1426 {
1427 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1428 }
1429
1430 vmxR0UpdateExceptionBitmap(pVM, pVCpu, pCtx);
1431
1432 /* Done. */
1433 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1434
1435 return rc;
1436}
1437
1438/**
1439 * Syncs back the guest state
1440 *
1441 * @returns VBox status code.
1442 * @param pVM The VM to operate on.
1443 * @param pVCpu The VMCPU to operate on.
1444 * @param pCtx Guest context
1445 */
1446DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1447{
1448 RTCCUINTREG val, valShadow;
1449 RTGCUINTPTR uInterruptState;
1450 int rc;
1451
1452 /* Let's first sync back eip, esp, and eflags. */
1453 rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1454 AssertRC(rc);
1455 pCtx->rip = val;
1456 rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1457 AssertRC(rc);
1458 pCtx->rsp = val;
1459 rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1460 AssertRC(rc);
1461 pCtx->eflags.u32 = val;
1462
1463 /* Take care of instruction fusing (sti, mov ss) */
1464 rc |= VMXReadVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
1465 uInterruptState = val;
1466 if (uInterruptState != 0)
1467 {
1468 Assert(uInterruptState <= 2); /* only sti & mov ss */
1469 Log(("uInterruptState %x eip=%RGv\n", uInterruptState, pCtx->rip));
1470 EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1471 }
1472 else
1473 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1474
1475 /* Control registers. */
1476 VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1477 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1478 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
1479 CPUMSetGuestCR0(pVM, val);
1480
1481 VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1482 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1483 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
1484 CPUMSetGuestCR4(pVM, val);
1485
1486 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
1487 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1488 if ( pVM->hwaccm.s.fNestedPaging
1489 && CPUMIsGuestInPagedProtectedModeEx(pCtx))
1490 {
1491 /* Can be updated behind our back in the nested paging case. */
1492 CPUMSetGuestCR2(pVM, ASMGetCR2());
1493
1494 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
1495
1496 if (val != pCtx->cr3)
1497 {
1498 CPUMSetGuestCR3(pVM, val);
1499 PGMUpdateCR3(pVM, val);
1500 }
1501 /* Prefetch the four PDPT entries in PAE mode. */
1502 vmxR0PrefetchPAEPdptrs(pVM, pCtx);
1503 }
1504
1505 /* Sync back DR7 here. */
1506 VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1507 pCtx->dr[7] = val;
1508
1509 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1510 VMX_READ_SELREG(ES, es);
1511 VMX_READ_SELREG(SS, ss);
1512 VMX_READ_SELREG(CS, cs);
1513 VMX_READ_SELREG(DS, ds);
1514 VMX_READ_SELREG(FS, fs);
1515 VMX_READ_SELREG(GS, gs);
1516
1517 /*
1518 * System MSRs
1519 */
1520 VMXReadVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
1521 pCtx->SysEnter.cs = val;
1522 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1523 pCtx->SysEnter.eip = val;
1524 VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1525 pCtx->SysEnter.esp = val;
1526
1527 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1528 VMX_READ_SELREG(LDTR, ldtr);
1529
1530 VMXReadVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
1531 pCtx->gdtr.cbGdt = val;
1532 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1533 pCtx->gdtr.pGdt = val;
1534
1535 VMXReadVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
1536 pCtx->idtr.cbIdt = val;
1537 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1538 pCtx->idtr.pIdt = val;
1539
1540#ifdef HWACCM_VMX_EMULATE_REALMODE
1541 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1542 if (CPUMIsGuestInRealModeEx(pCtx))
1543 {
1544 /* Hide our emulation flags */
1545 pCtx->eflags.Bits.u1VM = 0;
1546 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
1547
1548 /* Force a TR resync every time in case we switch modes. */
1549 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
1550 }
1551 else
1552#endif /* HWACCM_VMX_EMULATE_REALMODE */
1553 {
1554 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1555 VMX_READ_SELREG(TR, tr);
1556 }
1557 return VINF_SUCCESS;
1558}
1559
1560/**
1561 * Dummy placeholder
1562 *
1563 * @param pVM The VM to operate on.
1564 * @param pVCpu The VMCPU to operate on.
1565 */
1566static void vmxR0SetupTLBDummy(PVM pVM, PVMCPU pVCpu)
1567{
1568 NOREF(pVM);
1569 NOREF(pVCpu);
1570 return;
1571}
1572
1573/**
1574 * Setup the tagged TLB for EPT
1575 *
1576 * @returns VBox status code.
1577 * @param pVM The VM to operate on.
1578 * @param pVCpu The VMCPU to operate on.
1579 */
1580static void vmxR0SetupTLBEPT(PVM pVM, PVMCPU pVCpu)
1581{
1582 PHWACCM_CPUINFO pCpu;
1583
1584 Assert(pVM->hwaccm.s.fNestedPaging);
1585 Assert(!pVM->hwaccm.s.vmx.fVPID);
1586
1587 /* Deal with tagged TLBs if VPID or EPT is supported. */
1588 pCpu = HWACCMR0GetCurrentCpu();
1589 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1590 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1591 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1592 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1593 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1594 {
1595 /* Force a TLB flush on VM entry. */
1596 pVCpu->hwaccm.s.fForceTLBFlush = true;
1597 }
1598 else
1599 Assert(!pCpu->fFlushTLB);
1600
1601 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1602 pCpu->fFlushTLB = false;
1603
1604 if (pVCpu->hwaccm.s.fForceTLBFlush)
1605 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1606
1607#ifdef VBOX_WITH_STATISTICS
1608 if (pVCpu->hwaccm.s.fForceTLBFlush)
1609 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1610 else
1611 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1612#endif
1613}
1614
1615#ifdef HWACCM_VTX_WITH_VPID
1616/**
1617 * Setup the tagged TLB for VPID
1618 *
1619 * @returns VBox status code.
1620 * @param pVM The VM to operate on.
1621 * @param pVCpu The VMCPU to operate on.
1622 */
1623static void vmxR0SetupTLBVPID(PVM pVM, PVMCPU pVCpu)
1624{
1625 PHWACCM_CPUINFO pCpu;
1626
1627 Assert(pVM->hwaccm.s.vmx.fVPID);
1628 Assert(!pVM->hwaccm.s.fNestedPaging);
1629
1630 /* Deal with tagged TLBs if VPID or EPT is supported. */
1631 pCpu = HWACCMR0GetCurrentCpu();
1632 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1633 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1634 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1635 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1636 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1637 {
1638 /* Force a TLB flush on VM entry. */
1639 pVCpu->hwaccm.s.fForceTLBFlush = true;
1640 }
1641 else
1642 Assert(!pCpu->fFlushTLB);
1643
1644 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1645
1646 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1647 if (pVCpu->hwaccm.s.fForceTLBFlush)
1648 {
1649 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1650 || pCpu->fFlushTLB)
1651 {
1652 pCpu->fFlushTLB = false;
1653 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1654 pCpu->cTLBFlushes++;
1655 }
1656 else
1657 {
1658 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1659 pVCpu->hwaccm.s.fForceTLBFlush = false;
1660 }
1661
1662 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1663 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1664 }
1665 else
1666 {
1667 Assert(!pCpu->fFlushTLB);
1668
1669 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1670 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1671 }
1672 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1673 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1674 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1675
1676 int rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
1677 AssertRC(rc);
1678
1679 if (pVCpu->hwaccm.s.fForceTLBFlush)
1680 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushContext, 0);
1681
1682#ifdef VBOX_WITH_STATISTICS
1683 if (pVCpu->hwaccm.s.fForceTLBFlush)
1684 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1685 else
1686 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1687#endif
1688}
1689#endif /* HWACCM_VTX_WITH_VPID */
1690
1691/**
1692 * Runs guest code in a VT-x VM.
1693 *
1694 * @returns VBox status code.
1695 * @param pVM The VM to operate on.
1696 * @param pVCpu The VMCPU to operate on.
1697 * @param pCtx Guest context
1698 */
1699VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1700{
1701 int rc = VINF_SUCCESS;
1702 RTCCUINTREG val;
1703 RTCCUINTREG exitReason, instrError, cbInstr;
1704 RTGCUINTPTR exitQualification;
1705 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1706 RTGCUINTPTR errCode, instrInfo;
1707 bool fSyncTPR = false;
1708 PHWACCM_CPUINFO pCpu = 0;
1709 unsigned cResume = 0;
1710#ifdef VBOX_STRICT
1711 RTCPUID idCpuCheck;
1712#endif
1713
1714 Log2(("\nE"));
1715
1716 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
1717
1718#ifdef VBOX_STRICT
1719 rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1720 AssertRC(rc);
1721 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1722
1723 /* allowed zero */
1724 if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1725 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1726
1727 /* allowed one */
1728 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1729 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1730
1731 rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1732 AssertRC(rc);
1733 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1734
1735 /* Must be set according to the MSR, but can be cleared in case of EPT. */
1736 if (pVM->hwaccm.s.fNestedPaging)
1737 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
1738 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1739 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1740
1741 /* allowed zero */
1742 if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1743 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1744
1745 /* allowed one */
1746 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1747 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1748
1749 rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1750 AssertRC(rc);
1751 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1752
1753 /* allowed zero */
1754 if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1755 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1756
1757 /* allowed one */
1758 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1759 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1760
1761 rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1762 AssertRC(rc);
1763 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1764
1765 /* allowed zero */
1766 if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1767 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1768
1769 /* allowed one */
1770 if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1771 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1772#endif
1773
1774 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1775 */
1776ResumeExecution:
1777 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1778 ("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1779 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1780 Assert(!HWACCMR0SuspendPending());
1781
1782 /* Safety precaution; looping for too long here can have a very bad effect on the host */
1783 if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1784 {
1785 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
1786 rc = VINF_EM_RAW_INTERRUPT;
1787 goto end;
1788 }
1789
1790 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1791 if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1792 {
1793 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1794 if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1795 {
1796 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1797 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1798 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1799 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
1800 */
1801 VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1802 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1803 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
1804 AssertRC(rc);
1805 }
1806 }
1807 else
1808 {
1809 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
1810 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
1811 AssertRC(rc);
1812 }
1813
1814 /* Check for pending actions that force us to go back to ring 3. */
1815 if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 | VM_FF_TIMER))
1816 {
1817 VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1818 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
1819 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1820 rc = VINF_EM_RAW_TO_R3;
1821 goto end;
1822 }
1823 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1824 if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1825 {
1826 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1827 rc = VINF_EM_PENDING_REQUEST;
1828 goto end;
1829 }
1830
1831 /* When external interrupts are pending, we should exit the VM when IF is set. */
1832 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
1833 rc = VMXR0CheckPendingInterrupt(pVM, pVCpu, pCtx);
1834 if (RT_FAILURE(rc))
1835 {
1836 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1837 goto end;
1838 }
1839
1840 /** @todo check timers?? */
1841
1842 /* TPR caching using CR8 is only available in 64 bits mode */
1843 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1844 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1845 /**
1846 * @todo reduce overhead
1847 */
1848 if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1849 && pVM->hwaccm.s.vmx.pAPIC)
1850 {
1851 /* TPR caching in CR8 */
1852 uint8_t u8TPR;
1853 bool fPending;
1854
1855 int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1856 AssertRC(rc);
1857 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
1858 pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1859
1860 /* Two options here:
1861 * - external interrupt pending, but masked by the TPR value.
1862 * -> a CR8 update that lower the current TPR value should cause an exit
1863 * - no pending interrupts
1864 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1865 */
1866 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1867 AssertRC(rc);
1868
1869 /* Always sync back the TPR; we should optimize this though */ /** @todo optimize TPR sync. */
1870 fSyncTPR = true;
1871 }
1872
1873#if defined(HWACCM_VTX_WITH_EPT) && defined(LOG_ENABLED)
1874 if ( pVM->hwaccm.s.fNestedPaging
1875# ifdef HWACCM_VTX_WITH_VPID
1876 || pVM->hwaccm.s.vmx.fVPID
1877# endif /* HWACCM_VTX_WITH_VPID */
1878 )
1879 {
1880 pCpu = HWACCMR0GetCurrentCpu();
1881 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1882 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1883 {
1884 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
1885 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
1886 else
1887 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1888 }
1889 if (pCpu->fFlushTLB)
1890 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
1891 else
1892 if (pVCpu->hwaccm.s.fForceTLBFlush)
1893 LogFlow(("Manual TLB flush\n"));
1894 }
1895#endif
1896#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
1897 PGMDynMapReleaseAutoSet(pVCpu);
1898#endif
1899
1900 /*
1901 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1902 * (until the actual world switch)
1903 */
1904#ifdef VBOX_STRICT
1905 idCpuCheck = RTMpCpuId();
1906#endif
1907#ifdef LOG_LOGGING
1908 VMMR0LogFlushDisable(pVCpu);
1909#endif
1910 /* Save the host state first. */
1911 rc = VMXR0SaveHostState(pVM, pVCpu);
1912 if (rc != VINF_SUCCESS)
1913 {
1914 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1915 goto end;
1916 }
1917 /* Load the guest state */
1918 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
1919 if (rc != VINF_SUCCESS)
1920 {
1921 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1922 goto end;
1923 }
1924
1925 /* Deal with tagged TLB setup and invalidation. */
1926 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
1927
1928 /* Non-register state Guest Context */
1929 /** @todo change me according to cpu state */
1930 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1931 AssertRC(rc);
1932
1933 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1934
1935 /* Manual save and restore:
1936 * - General purpose registers except RIP, RSP
1937 *
1938 * Trashed:
1939 * - CR2 (we don't care)
1940 * - LDTR (reset to 0)
1941 * - DRx (presumably not changed at all)
1942 * - DR7 (reset to 0x400)
1943 * - EFLAGS (reset to RT_BIT(1); not relevant)
1944 *
1945 */
1946
1947 /* All done! Let's start VM execution. */
1948 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
1949#ifdef VBOX_STRICT
1950 Assert(idCpuCheck == RTMpCpuId());
1951#endif
1952 TMNotifyStartOfExecution(pVM);
1953 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx);
1954 TMNotifyEndOfExecution(pVM);
1955
1956 /* In case we execute a goto ResumeExecution later on. */
1957 pVCpu->hwaccm.s.fResumeVM = true;
1958 pVCpu->hwaccm.s.fForceTLBFlush = false;
1959
1960 /*
1961 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1962 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1963 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1964 */
1965
1966 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1967 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit, x);
1968
1969 if (rc != VINF_SUCCESS)
1970 {
1971 VMXR0ReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
1972 goto end;
1973 }
1974 /* Success. Query the guest state and figure out what has happened. */
1975
1976 /* Investigate why there was a VM-exit. */
1977 rc = VMXReadVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
1978 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1979
1980 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1981 rc |= VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
1982 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
1983 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &val);
1984 intInfo = val;
1985 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1986 errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1987 rc |= VMXReadVMCS(VMX_VMCS32_RO_EXIT_INSTR_INFO, &val);
1988 instrInfo = val;
1989 rc |= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1990 exitQualification = val;
1991 AssertRC(rc);
1992
1993 /* Sync back the guest state */
1994 rc = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
1995 AssertRC(rc);
1996
1997 /* Note! NOW IT'S SAFE FOR LOGGING! */
1998#ifdef LOG_LOGGING
1999 VMMR0LogFlushEnable(pVCpu);
2000#endif
2001 Log2(("Raw exit reason %08x\n", exitReason));
2002
2003 /* Check if an injected event was interrupted prematurely. */
2004 rc = VMXReadVMCS(VMX_VMCS32_RO_IDT_INFO, &val);
2005 AssertRC(rc);
2006 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
2007 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2008 /* Ignore 'int xx' as they'll be restarted anyway. */
2009 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
2010 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2011 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2012 {
2013 pVCpu->hwaccm.s.Event.fPending = true;
2014 /* Error code present? */
2015 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2016 {
2017 rc = VMXReadVMCS(VMX_VMCS32_RO_IDT_ERRCODE, &val);
2018 AssertRC(rc);
2019 pVCpu->hwaccm.s.Event.errCode = val;
2020 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2021 }
2022 else
2023 {
2024 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2025 pVCpu->hwaccm.s.Event.errCode = 0;
2026 }
2027 }
2028#ifdef VBOX_STRICT
2029 else
2030 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2031 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2032 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2033 {
2034 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2035 }
2036
2037 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2038 HWACCMDumpRegs(pVM, pCtx);
2039#endif
2040
2041 Log2(("E%d", exitReason));
2042 Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
2043 Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
2044 Log2(("Interruption error code %d\n", errCode));
2045 Log2(("IntInfo = %08x\n", intInfo));
2046 Log2(("New EIP=%RGv\n", (RTGCPTR)pCtx->rip));
2047
2048 if (fSyncTPR)
2049 {
2050 rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
2051 AssertRC(rc);
2052 }
2053#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
2054 PGMDynMapStartAutoSet(pVCpu);
2055#endif
2056
2057 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2058 switch (exitReason)
2059 {
2060 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2061 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2062 {
2063 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2064
2065 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2066 {
2067 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2068 /* External interrupt; leave to allow it to be dispatched again. */
2069 rc = VINF_EM_RAW_INTERRUPT;
2070 break;
2071 }
2072 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2073 {
2074 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2075 /* External interrupt; leave to allow it to be dispatched again. */
2076 rc = VINF_EM_RAW_INTERRUPT;
2077 break;
2078
2079 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2080 AssertFailed(); /* can't come here; fails the first check. */
2081 break;
2082
2083 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
2084 Assert(vector == 3 || vector == 4);
2085 /* no break */
2086 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
2087 Log2(("Hardware/software interrupt %d\n", vector));
2088 switch (vector)
2089 {
2090 case X86_XCPT_NM:
2091 {
2092 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
2093
2094 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
2095 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
2096 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
2097 if (rc == VINF_SUCCESS)
2098 {
2099 Assert(CPUMIsGuestFPUStateActive(pVCpu));
2100
2101 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
2102
2103 /* Continue execution. */
2104 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2105 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2106
2107 goto ResumeExecution;
2108 }
2109
2110 Log(("Forward #NM fault to the guest\n"));
2111 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
2112 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
2113 AssertRC(rc);
2114 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2115 goto ResumeExecution;
2116 }
2117
2118 case X86_XCPT_PF: /* Page fault */
2119 {
2120#ifdef DEBUG
2121 if (pVM->hwaccm.s.fNestedPaging)
2122 { /* A genuine pagefault.
2123 * Forward the trap to the guest by injecting the exception and resuming execution.
2124 */
2125 Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
2126
2127 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
2128
2129 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2130
2131 /* Now we must update CR2. */
2132 pCtx->cr2 = exitQualification;
2133 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2134 AssertRC(rc);
2135
2136 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2137 goto ResumeExecution;
2138 }
2139#endif
2140 Assert(!pVM->hwaccm.s.fNestedPaging);
2141
2142 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
2143 /* Exit qualification contains the linear address of the page fault. */
2144 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2145 TRPMSetErrorCode(pVM, errCode);
2146 TRPMSetFaultAddress(pVM, exitQualification);
2147
2148 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
2149 rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
2150 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2151 if (rc == VINF_SUCCESS)
2152 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2153 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
2154 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
2155
2156 TRPMResetTrap(pVM);
2157
2158 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2159 goto ResumeExecution;
2160 }
2161 else
2162 if (rc == VINF_EM_RAW_GUEST_TRAP)
2163 { /* A genuine pagefault.
2164 * Forward the trap to the guest by injecting the exception and resuming execution.
2165 */
2166 Log2(("Forward page fault to the guest\n"));
2167
2168 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
2169 /* The error code might have been changed. */
2170 errCode = TRPMGetErrorCode(pVM);
2171
2172 TRPMResetTrap(pVM);
2173
2174 /* Now we must update CR2. */
2175 pCtx->cr2 = exitQualification;
2176 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2177 AssertRC(rc);
2178
2179 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2180 goto ResumeExecution;
2181 }
2182#ifdef VBOX_STRICT
2183 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2184 Log2(("PGMTrap0eHandler failed with %d\n", rc));
2185#endif
2186 /* Need to go back to the recompiler to emulate the instruction. */
2187 TRPMResetTrap(pVM);
2188 break;
2189 }
2190
2191 case X86_XCPT_MF: /* Floating point exception. */
2192 {
2193 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
2194 if (!(pCtx->cr0 & X86_CR0_NE))
2195 {
2196 /* old style FPU error reporting needs some extra work. */
2197 /** @todo don't fall back to the recompiler, but do it manually. */
2198 rc = VINF_EM_RAW_EMULATE_INSTR;
2199 break;
2200 }
2201 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2202 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2203 AssertRC(rc);
2204
2205 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2206 goto ResumeExecution;
2207 }
2208
2209 case X86_XCPT_DB: /* Debug exception. */
2210 {
2211 uint64_t uDR6;
2212
2213 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
2214 *
2215 * Exit qualification bits:
2216 * 3:0 B0-B3 which breakpoint condition was met
2217 * 12:4 Reserved (0)
2218 * 13 BD - debug register access detected
2219 * 14 BS - single step execution or branch taken
2220 * 63:15 Reserved (0)
2221 */
2222 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
2223
2224 /* Note that we don't support guest and host-initiated debugging at the same time. */
2225 Assert(DBGFIsStepping(pVM) || CPUMIsGuestInRealModeEx(pCtx));
2226
2227 uDR6 = X86_DR6_INIT_VAL;
2228 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
2229 rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
2230 if (rc == VINF_EM_RAW_GUEST_TRAP)
2231 {
2232 /** @todo this isn't working, but we'll never get here normally. */
2233
2234 /* Update DR6 here. */
2235 pCtx->dr[6] = uDR6;
2236
2237 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2238 pCtx->dr[7] &= ~X86_DR7_GD;
2239
2240 /* Paranoia. */
2241 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2242 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2243 pCtx->dr[7] |= 0x400; /* must be one */
2244
2245 /* Resync DR7 */
2246 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2247 AssertRC(rc);
2248
2249 Log(("Trap %x (debug) at %RGv exit qualification %RX64\n", vector, (RTGCPTR)pCtx->rip, exitQualification));
2250 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2251 AssertRC(rc);
2252
2253 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2254 goto ResumeExecution;
2255 }
2256 /* Return to ring 3 to deal with the debug exit code. */
2257 break;
2258 }
2259
2260 case X86_XCPT_GP: /* General protection failure exception.*/
2261 {
2262 uint32_t cbSize;
2263
2264 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
2265#ifdef VBOX_STRICT
2266 if (!CPUMIsGuestInRealModeEx(pCtx))
2267 {
2268 Log(("Trap %x at %04X:%RGv errorCode=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
2269 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2270 AssertRC(rc);
2271 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2272 goto ResumeExecution;
2273 }
2274#endif
2275 Assert(CPUMIsGuestInRealModeEx(pCtx));
2276
2277 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %RGv\n", (RTGCPTR)pCtx->rip));
2278 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2279 if (rc == VINF_SUCCESS)
2280 {
2281 /* EIP has been updated already. */
2282
2283 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2284 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2285
2286 /* Only resume if successful. */
2287 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2288 goto ResumeExecution;
2289 }
2290 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", rc));
2291 break;
2292 }
2293
2294#ifdef VBOX_STRICT
2295 case X86_XCPT_DE: /* Divide error. */
2296 case X86_XCPT_UD: /* Unknown opcode exception. */
2297 case X86_XCPT_SS: /* Stack segment exception. */
2298 case X86_XCPT_NP: /* Segment not present exception. */
2299 {
2300 switch(vector)
2301 {
2302 case X86_XCPT_DE:
2303 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
2304 break;
2305 case X86_XCPT_UD:
2306 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
2307 break;
2308 case X86_XCPT_SS:
2309 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
2310 break;
2311 case X86_XCPT_NP:
2312 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
2313 break;
2314 }
2315
2316 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
2317 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2318 AssertRC(rc);
2319
2320 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2321 goto ResumeExecution;
2322 }
2323#endif
2324 default:
2325#ifdef HWACCM_VMX_EMULATE_REALMODE
2326 if (CPUMIsGuestInRealModeEx(pCtx))
2327 {
2328 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
2329 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2330 AssertRC(rc);
2331
2332 /* Go back to ring 3 in case of a triple fault. */
2333 if ( vector == X86_XCPT_DF
2334 && rc == VINF_EM_RESET)
2335 break;
2336
2337 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2338 goto ResumeExecution;
2339 }
2340#endif
2341 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2342 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2343 break;
2344 } /* switch (vector) */
2345
2346 break;
2347
2348 default:
2349 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2350 AssertFailed();
2351 break;
2352 }
2353
2354 break;
2355 }
2356
2357 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
2358 {
2359 RTGCPHYS GCPhys;
2360
2361 Assert(pVM->hwaccm.s.fNestedPaging);
2362
2363 rc = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2364 AssertRC(rc);
2365 Assert(((exitQualification >> 7) & 3) != 2);
2366
2367 /* Determine the kind of violation. */
2368 errCode = 0;
2369 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
2370 errCode |= X86_TRAP_PF_ID;
2371
2372 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
2373 errCode |= X86_TRAP_PF_RW;
2374
2375 /* If the page is present, then it's a page level protection fault. */
2376 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
2377 errCode |= X86_TRAP_PF_P;
2378
2379 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
2380
2381 /* GCPhys contains the guest physical address of the page fault. */
2382 TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
2383 TRPMSetErrorCode(pVM, errCode);
2384 TRPMSetFaultAddress(pVM, GCPhys);
2385
2386 /* Handle the pagefault trap for the nested shadow table. */
2387 rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
2388 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
2389 if (rc == VINF_SUCCESS)
2390 { /* We've successfully synced our shadow pages, so let's just continue execution. */
2391 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
2392 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
2393
2394 TRPMResetTrap(pVM);
2395
2396 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2397 goto ResumeExecution;
2398 }
2399
2400#ifdef VBOX_STRICT
2401 if (rc != VINF_EM_RAW_EMULATE_INSTR)
2402 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
2403#endif
2404 /* Need to go back to the recompiler to emulate the instruction. */
2405 TRPMResetTrap(pVM);
2406 break;
2407 }
2408
2409 case VMX_EXIT_EPT_MISCONFIG:
2410 {
2411 RTGCPHYS GCPhys;
2412
2413 Assert(pVM->hwaccm.s.fNestedPaging);
2414
2415 rc = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
2416 AssertRC(rc);
2417
2418 Log(("VMX_EXIT_EPT_MISCONFIG for %VGp\n", GCPhys));
2419 break;
2420 }
2421
2422 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2423 /* Clear VM-exit on IF=1 change. */
2424 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2425 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2426 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2427 AssertRC(rc);
2428 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
2429 goto ResumeExecution; /* we check for pending guest interrupts there */
2430
2431 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2432 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2433 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
2434 /* Skip instruction and continue directly. */
2435 pCtx->rip += cbInstr;
2436 /* Continue execution.*/
2437 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2438 goto ResumeExecution;
2439
2440 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2441 {
2442 Log2(("VMX: Cpuid %x\n", pCtx->eax));
2443 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
2444 rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2445 if (rc == VINF_SUCCESS)
2446 {
2447 /* Update EIP and continue execution. */
2448 Assert(cbInstr == 2);
2449 pCtx->rip += cbInstr;
2450 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2451 goto ResumeExecution;
2452 }
2453 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
2454 rc = VINF_EM_RAW_EMULATE_INSTR;
2455 break;
2456 }
2457
2458 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2459 {
2460 Log2(("VMX: Rdtsc\n"));
2461 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
2462 rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2463 if (rc == VINF_SUCCESS)
2464 {
2465 /* Update EIP and continue execution. */
2466 Assert(cbInstr == 2);
2467 pCtx->rip += cbInstr;
2468 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2469 goto ResumeExecution;
2470 }
2471 AssertMsgFailed(("EMU: rdtsc failed with %Rrc\n", rc));
2472 rc = VINF_EM_RAW_EMULATE_INSTR;
2473 break;
2474 }
2475
2476 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2477 {
2478 Log2(("VMX: invlpg\n"));
2479 Assert(!pVM->hwaccm.s.fNestedPaging);
2480
2481 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
2482 rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2483 if (rc == VINF_SUCCESS)
2484 {
2485 /* Update EIP and continue execution. */
2486 pCtx->rip += cbInstr;
2487 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2488 goto ResumeExecution;
2489 }
2490 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, rc));
2491 break;
2492 }
2493
2494 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2495 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2496 {
2497 uint32_t cbSize;
2498
2499 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2500 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2501 rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2502 if (rc == VINF_SUCCESS)
2503 {
2504 /* EIP has been updated already. */
2505
2506 /* Only resume if successful. */
2507 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2508 goto ResumeExecution;
2509 }
2510 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2511 break;
2512 }
2513
2514 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2515 {
2516 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2517 {
2518 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2519 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2520 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite);
2521 rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2522 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2523 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2524
2525 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2526 {
2527 case 0:
2528 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
2529 break;
2530 case 2:
2531 break;
2532 case 3:
2533 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
2534 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
2535 break;
2536 case 4:
2537 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
2538 break;
2539 case 8:
2540 /* CR8 contains the APIC TPR */
2541 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2542 break;
2543
2544 default:
2545 AssertFailed();
2546 break;
2547 }
2548 /* Check if a sync operation is pending. */
2549 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2550 && VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2551 {
2552 rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2553 AssertRC(rc);
2554 }
2555 break;
2556
2557 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2558 Log2(("VMX: mov x, crx\n"));
2559 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead);
2560
2561 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
2562
2563 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2564 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2565
2566 rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2567 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2568 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2569 break;
2570
2571 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2572 Log2(("VMX: clts\n"));
2573 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
2574 rc = EMInterpretCLTS(pVM);
2575 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2576 break;
2577
2578 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2579 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2580 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
2581 rc = EMInterpretLMSW(pVM, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2582 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
2583 break;
2584 }
2585
2586 /* Update EIP if no error occurred. */
2587 if (RT_SUCCESS(rc))
2588 pCtx->rip += cbInstr;
2589
2590 if (rc == VINF_SUCCESS)
2591 {
2592 /* Only resume if successful. */
2593 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2594 goto ResumeExecution;
2595 }
2596 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2597 break;
2598 }
2599
2600 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2601 {
2602 if (!DBGFIsStepping(pVM))
2603 {
2604 /* Disable drx move intercepts. */
2605 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2606 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
2607 AssertRC(rc);
2608
2609 /* Save the host and load the guest debug state. */
2610 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2611 AssertRC(rc);
2612
2613#ifdef VBOX_WITH_STATISTICS
2614 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2615 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2616 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2617 else
2618 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2619#endif
2620
2621 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2622 goto ResumeExecution;
2623 }
2624
2625 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2626 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2627 {
2628 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2629 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
2630 rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2631 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2632 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2633 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2634 Log2(("DR7=%08x\n", pCtx->dr[7]));
2635 }
2636 else
2637 {
2638 Log2(("VMX: mov x, drx\n"));
2639 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
2640 rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2641 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2642 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2643 }
2644 /* Update EIP if no error occurred. */
2645 if (RT_SUCCESS(rc))
2646 pCtx->rip += cbInstr;
2647
2648 if (rc == VINF_SUCCESS)
2649 {
2650 /* Only resume if successful. */
2651 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2652 goto ResumeExecution;
2653 }
2654 Assert(rc == VERR_EM_INTERPRETER);
2655 break;
2656 }
2657
2658 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2659 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2660 {
2661 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2662 uint32_t uPort;
2663 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2664
2665 /** @todo necessary to make the distinction? */
2666 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2667 {
2668 uPort = pCtx->edx & 0xffff;
2669 }
2670 else
2671 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2672
2673 /* paranoia */
2674 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
2675 {
2676 rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2677 break;
2678 }
2679
2680 uint32_t cbSize = g_aIOSize[uIOWidth];
2681
2682 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2683 {
2684 /* ins/outs */
2685 uint32_t prefix = 0;
2686 if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2687 prefix |= PREFIX_REP;
2688
2689 if (fIOWrite)
2690 {
2691 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2692 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2693 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2694 }
2695 else
2696 {
2697 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
2698 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2699 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2700 }
2701 }
2702 else
2703 {
2704 /* normal in/out */
2705 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2706
2707 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2708
2709 if (fIOWrite)
2710 {
2711 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2712 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2713 }
2714 else
2715 {
2716 uint32_t u32Val = 0;
2717
2718 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2719 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2720 if (IOM_SUCCESS(rc))
2721 {
2722 /* Write back to the EAX register. */
2723 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2724 }
2725 }
2726 }
2727 /*
2728 * Handled the I/O return codes.
2729 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2730 */
2731 if (IOM_SUCCESS(rc))
2732 {
2733 /* Update EIP and continue execution. */
2734 pCtx->rip += cbInstr;
2735 if (RT_LIKELY(rc == VINF_SUCCESS))
2736 {
2737 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2738 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2739 {
2740 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2741 for (unsigned i=0;i<4;i++)
2742 {
2743 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2744
2745 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2746 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2747 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2748 {
2749 uint64_t uDR6;
2750
2751 Assert(CPUMIsGuestDebugStateActive(pVM));
2752
2753 uDR6 = ASMGetDR6();
2754
2755 /* Clear all breakpoint status flags and set the one we just hit. */
2756 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2757 uDR6 |= (uint64_t)RT_BIT(i);
2758
2759 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2760 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2761 * the contents have been read.
2762 */
2763 ASMSetDR6(uDR6);
2764
2765 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2766 pCtx->dr[7] &= ~X86_DR7_GD;
2767
2768 /* Paranoia. */
2769 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2770 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2771 pCtx->dr[7] |= 0x400; /* must be one */
2772
2773 /* Resync DR7 */
2774 rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2775 AssertRC(rc);
2776
2777 /* Construct inject info. */
2778 intInfo = X86_XCPT_DB;
2779 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2780 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2781
2782 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2783 rc = VMXR0InjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2784 AssertRC(rc);
2785
2786 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2787 goto ResumeExecution;
2788 }
2789 }
2790 }
2791
2792 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2793 goto ResumeExecution;
2794 }
2795 break;
2796 }
2797
2798#ifdef VBOX_STRICT
2799 if (rc == VINF_IOM_HC_IOPORT_READ)
2800 Assert(!fIOWrite);
2801 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2802 Assert(fIOWrite);
2803 else
2804 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2805#endif
2806 break;
2807 }
2808
2809 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2810 LogFlow(("VMX_EXIT_TPR\n"));
2811 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2812 goto ResumeExecution;
2813
2814 default:
2815 /* The rest is handled after syncing the entire CPU state. */
2816 break;
2817 }
2818
2819 /* Note: the guest state isn't entirely synced back at this stage. */
2820
2821 /* Investigate why there was a VM-exit. (part 2) */
2822 switch (exitReason)
2823 {
2824 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2825 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2826 case VMX_EXIT_EPT_VIOLATION:
2827 /* Already handled above. */
2828 break;
2829
2830 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2831 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2832 break;
2833
2834 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2835 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2836 rc = VINF_EM_RAW_INTERRUPT;
2837 AssertFailed(); /* Can't happen. Yet. */
2838 break;
2839
2840 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2841 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2842 rc = VINF_EM_RAW_INTERRUPT;
2843 AssertFailed(); /* Can't happen afaik. */
2844 break;
2845
2846 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2847 rc = VERR_EM_INTERPRETER;
2848 break;
2849
2850 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2851 /** Check if external interrupts are pending; if so, don't switch back. */
2852 pCtx->rip++; /* skip hlt */
2853 if ( pCtx->eflags.Bits.u1IF
2854 && VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC|VM_FF_INTERRUPT_PIC)))
2855 goto ResumeExecution;
2856
2857 rc = VINF_EM_HALT;
2858 break;
2859
2860 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2861 AssertFailed(); /* can't happen. */
2862 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2863 break;
2864
2865 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2866 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2867 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2868 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2869 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2870 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2871 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2872 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2873 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2874 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2875 /** @todo inject #UD immediately */
2876 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2877 break;
2878
2879 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2880 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2881 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2882 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2883 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2884 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2885 /* already handled above */
2886 AssertMsg( rc == VINF_PGM_CHANGE_MODE
2887 || rc == VINF_EM_RAW_INTERRUPT
2888 || rc == VERR_EM_INTERPRETER
2889 || rc == VINF_EM_RAW_EMULATE_INSTR
2890 || rc == VINF_PGM_SYNC_CR3
2891 || rc == VINF_IOM_HC_IOPORT_READ
2892 || rc == VINF_IOM_HC_IOPORT_WRITE
2893 || rc == VINF_EM_RAW_GUEST_TRAP
2894 || rc == VINF_TRPM_XCPT_DISPATCHED
2895 || rc == VINF_EM_RESCHEDULE_REM,
2896 ("rc = %d\n", rc));
2897 break;
2898
2899 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2900 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2901 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2902 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2903 rc = VERR_EM_INTERPRETER;
2904 break;
2905
2906 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2907 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2908 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2909 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2910 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2911 break;
2912
2913 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2914 Assert(rc == VINF_EM_RAW_INTERRUPT);
2915 break;
2916
2917 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2918 {
2919#ifdef VBOX_STRICT
2920 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2921
2922 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2923 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
2924
2925 VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2926 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2927
2928 VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2929 Log(("VMX_VMCS_GUEST_CR3 %RGp\n", val));
2930
2931 VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2932 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2933
2934 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2935 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2936
2937 VMX_LOG_SELREG(CS, "CS");
2938 VMX_LOG_SELREG(DS, "DS");
2939 VMX_LOG_SELREG(ES, "ES");
2940 VMX_LOG_SELREG(FS, "FS");
2941 VMX_LOG_SELREG(GS, "GS");
2942 VMX_LOG_SELREG(SS, "SS");
2943 VMX_LOG_SELREG(TR, "TR");
2944 VMX_LOG_SELREG(LDTR, "LDTR");
2945
2946 VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2947 Log(("VMX_VMCS_GUEST_GDTR_BASE %RGv\n", val));
2948 VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2949 Log(("VMX_VMCS_GUEST_IDTR_BASE %RGv\n", val));
2950#endif /* VBOX_STRICT */
2951 rc = VERR_VMX_INVALID_GUEST_STATE;
2952 break;
2953 }
2954
2955 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2956 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2957 default:
2958 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2959 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2960 break;
2961
2962 }
2963end:
2964
2965 /* Signal changes for the recompiler. */
2966 CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2967
2968 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2969 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2970 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2971 {
2972 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2973 /* On the next entry we'll only sync the host context. */
2974 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2975 }
2976 else
2977 {
2978 /* On the next entry we'll sync everything. */
2979 /** @todo we can do better than this */
2980 /* Not in the VINF_PGM_CHANGE_MODE though! */
2981 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2982 }
2983
2984 /* translate into a less severe return code */
2985 if (rc == VERR_EM_INTERPRETER)
2986 rc = VINF_EM_RAW_EMULATE_INSTR;
2987 else
2988 /* Try to extract more information about what might have gone wrong here. */
2989 if (rc == VERR_VMX_INVALID_VMCS_PTR)
2990 {
2991 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
2992 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pVMCS;
2993 pVCpu->hwaccm.s.vmx.lasterror.idEnteredCpu = pVCpu->hwaccm.s.idEnteredCpu;
2994 pVCpu->hwaccm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
2995 }
2996
2997 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit, x);
2998
2999 Log2(("X"));
3000 return rc;
3001}
3002
3003
3004/**
3005 * Enters the VT-x session
3006 *
3007 * @returns VBox status code.
3008 * @param pVM The VM to operate on.
3009 * @param pVCpu The VMCPU to operate on.
3010 * @param pCpu CPU info struct
3011 */
3012VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
3013{
3014 Assert(pVM->hwaccm.s.vmx.fSupported);
3015
3016 unsigned cr4 = ASMGetCR4();
3017 if (!(cr4 & X86_CR4_VMXE))
3018 {
3019 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
3020 return VERR_VMX_X86_CR4_VMXE_CLEARED;
3021 }
3022
3023 /* Activate the VM Control Structure. */
3024 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3025 if (RT_FAILURE(rc))
3026 return rc;
3027
3028 pVCpu->hwaccm.s.fResumeVM = false;
3029 return VINF_SUCCESS;
3030}
3031
3032
3033/**
3034 * Leaves the VT-x session
3035 *
3036 * @returns VBox status code.
3037 * @param pVM The VM to operate on.
3038 * @param pVCpu The VMCPU to operate on.
3039 * @param pCtx CPU context
3040 */
3041VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
3042{
3043 Assert(pVM->hwaccm.s.vmx.fSupported);
3044
3045 /* Save the guest debug state if necessary. */
3046 if (CPUMIsGuestDebugStateActive(pVM))
3047 {
3048 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
3049
3050 /* Enable drx move intercepts again. */
3051 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3052 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3053 AssertRC(rc);
3054
3055 /* Resync the debug registers the next time. */
3056 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3057 }
3058 else
3059 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
3060
3061 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
3062 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.pVMCSPhys);
3063 AssertRC(rc);
3064
3065 return VINF_SUCCESS;
3066}
3067
3068/**
3069 * Flush the TLB (EPT)
3070 *
3071 * @returns VBox status code.
3072 * @param pVM The VM to operate on.
3073 * @param pVCpu The VM CPU to operate on.
3074 * @param enmFlush Type of flush
3075 * @param GCPhys Physical address of the page to flush
3076 */
3077static void vmxR0FlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPHYS GCPhys)
3078{
3079 uint64_t descriptor[2];
3080
3081 LogFlow(("vmxR0FlushEPT %d %RGv\n", enmFlush, GCPhys));
3082 Assert(pVM->hwaccm.s.fNestedPaging);
3083 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
3084 descriptor[1] = GCPhys;
3085 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
3086 AssertRC(rc);
3087}
3088
3089#ifdef HWACCM_VTX_WITH_VPID
3090/**
3091 * Flush the TLB (EPT)
3092 *
3093 * @returns VBox status code.
3094 * @param pVM The VM to operate on.
3095 * @param pVCpu The VM CPU to operate on.
3096 * @param enmFlush Type of flush
3097 * @param GCPtr Virtual address of the page to flush
3098 */
3099static void vmxR0FlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH enmFlush, RTGCPTR GCPtr)
3100{
3101 uint64_t descriptor[2];
3102
3103 Assert(pVM->hwaccm.s.vmx.fVPID);
3104 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
3105 descriptor[1] = GCPtr;
3106 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]);
3107 AssertRC(rc);
3108}
3109#endif /* HWACCM_VTX_WITH_VPID */
3110
3111/**
3112 * Invalidates a guest page
3113 *
3114 * @returns VBox status code.
3115 * @param pVM The VM to operate on.
3116 * @param pVCpu The VM CPU to operate on.
3117 * @param GCVirt Page to invalidate
3118 */
3119VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
3120{
3121 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3122
3123 LogFlow(("VMXR0InvalidatePage %RGv\n", GCVirt));
3124
3125 /* Only relevant if we want to use VPID.
3126 * In the nested paging case we still see such calls, but
3127 * can safely ignore them. (e.g. after cr3 updates)
3128 */
3129#ifdef HWACCM_VTX_WITH_VPID
3130 /* Skip it if a TLB flush is already pending. */
3131 if ( !fFlushPending
3132 && pVM->hwaccm.s.vmx.fVPID)
3133 vmxR0FlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCVirt);
3134#endif /* HWACCM_VTX_WITH_VPID */
3135
3136 return VINF_SUCCESS;
3137}
3138
3139/**
3140 * Invalidates a guest page by physical address
3141 *
3142 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
3143 *
3144 * @returns VBox status code.
3145 * @param pVM The VM to operate on.
3146 * @param pVCpu The VM CPU to operate on.
3147 * @param GCPhys Page to invalidate
3148 */
3149VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
3150{
3151 bool fFlushPending = pVCpu->hwaccm.s.fForceTLBFlush;
3152
3153 Assert(pVM->hwaccm.s.fNestedPaging);
3154
3155 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
3156
3157 /* Skip it if a TLB flush is already pending. */
3158 if (!fFlushPending)
3159 vmxR0FlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushPage, GCPhys);
3160
3161 return VINF_SUCCESS;
3162}
3163
3164/**
3165 * Report world switch error and dump some useful debug info
3166 *
3167 * @param pVM The VM to operate on.
3168 * @param pVCpu The VMCPU to operate on.
3169 * @param rc Return code
3170 * @param pCtx Current CPU context (not updated)
3171 */
3172static void VMXR0ReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, int rc, PCPUMCTX pCtx)
3173{
3174 switch (rc)
3175 {
3176 case VERR_VMX_INVALID_VMXON_PTR:
3177 AssertFailed();
3178 break;
3179
3180 case VERR_VMX_UNABLE_TO_START_VM:
3181 case VERR_VMX_UNABLE_TO_RESUME_VM:
3182 {
3183 int rc;
3184 RTCCUINTREG exitReason, instrError, val;
3185
3186 rc = VMXReadVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3187 rc |= VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3188 AssertRC(rc);
3189 if (rc == VINF_SUCCESS)
3190 {
3191 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
3192 Log(("Current stack %08x\n", &rc));
3193
3194 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
3195 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
3196
3197#ifdef VBOX_STRICT
3198 RTGDTR gdtr;
3199 PX86DESCHC pDesc;
3200
3201 ASMGetGDTR(&gdtr);
3202
3203 VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
3204 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
3205 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
3206 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
3207 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
3208 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
3209 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
3210 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
3211 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
3212 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
3213
3214 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
3215 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
3216
3217 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
3218 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
3219
3220 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
3221 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
3222
3223 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_CS, &val);
3224 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
3225
3226 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
3227 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
3228
3229 if (val < gdtr.cbGdt)
3230 {
3231 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3232 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
3233 }
3234
3235 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_DS, &val);
3236 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
3237 if (val < gdtr.cbGdt)
3238 {
3239 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3240 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
3241 }
3242
3243 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_ES, &val);
3244 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
3245 if (val < gdtr.cbGdt)
3246 {
3247 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3248 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
3249 }
3250
3251 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_FS, &val);
3252 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
3253 if (val < gdtr.cbGdt)
3254 {
3255 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3256 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
3257 }
3258
3259 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_GS, &val);
3260 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
3261 if (val < gdtr.cbGdt)
3262 {
3263 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3264 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
3265 }
3266
3267 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_SS, &val);
3268 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
3269 if (val < gdtr.cbGdt)
3270 {
3271 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3272 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
3273 }
3274
3275 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_TR, &val);
3276 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
3277 if (val < gdtr.cbGdt)
3278 {
3279 pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
3280 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
3281 }
3282
3283 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
3284 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
3285
3286 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
3287 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
3288 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
3289 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
3290
3291 VMXReadVMCS(VMX_VMCS32_HOST_SYSENTER_CS, &val);
3292 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
3293
3294 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
3295 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
3296
3297 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
3298 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
3299
3300 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
3301 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
3302 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
3303 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
3304
3305# if HC_ARCH_BITS == 64
3306 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
3307 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
3308 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
3309 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
3310 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
3311# endif
3312#endif /* VBOX_STRICT */
3313 }
3314 break;
3315 }
3316
3317 default:
3318 /* impossible */
3319 AssertFailed();
3320 break;
3321 }
3322}
3323
3324#if HC_ARCH_BITS == 32
3325/**
3326 * Prepares for and executes VMLAUNCH (64 bits guest mode)
3327 *
3328 * @returns VBox status code
3329 * @param fResume vmlauch/vmresume
3330 * @param pCtx Guest context
3331 */
3332DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx)
3333{
3334 return VERR_NOT_IMPLEMENTED;
3335}
3336#endif
3337
3338
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette