VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 41189

Last change on this file since 41189 was 41189, checked in by vboxsync, 13 years ago

VMM/VMMR0/HWVMXR0: Implemented EPT+VPID TLB flushing before VM entry.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id
File size: 206.6 KB
Line 
1/* $Id: HWVMXR0.cpp 41189 2012-05-07 15:39:30Z vboxsync $ */
2/** @file
3 * HM VMX (VT-x) - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2011 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_HWACCM
23#include <iprt/asm-amd64-x86.h>
24#include <VBox/vmm/hwaccm.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/dbgf.h>
27#include <VBox/vmm/dbgftrace.h>
28#include <VBox/vmm/selm.h>
29#include <VBox/vmm/iom.h>
30#ifdef VBOX_WITH_REM
31# include <VBox/vmm/rem.h>
32#endif
33#include <VBox/vmm/tm.h>
34#include "HWACCMInternal.h"
35#include <VBox/vmm/vm.h>
36#include <VBox/vmm/pdmapi.h>
37#include <VBox/err.h>
38#include <VBox/log.h>
39#include <iprt/assert.h>
40#include <iprt/param.h>
41#include <iprt/string.h>
42#include <iprt/time.h>
43#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
44# include <iprt/thread.h>
45#endif
46#include <iprt/x86.h>
47#include "HWVMXR0.h"
48
49#include "dtrace/VBoxVMM.h"
50
51
52/*******************************************************************************
53* Defined Constants And Macros *
54*******************************************************************************/
55#if defined(RT_ARCH_AMD64)
56# define VMX_IS_64BIT_HOST_MODE() (true)
57#elif defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
58# define VMX_IS_64BIT_HOST_MODE() (g_fVMXIs64bitHost != 0)
59#else
60# define VMX_IS_64BIT_HOST_MODE() (false)
61#endif
62
63/*******************************************************************************
64* Global Variables *
65*******************************************************************************/
66/* IO operation lookup arrays. */
67static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
68static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
69
70#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
71/** See HWACCMR0A.asm. */
72extern "C" uint32_t g_fVMXIs64bitHost;
73#endif
74
75/*******************************************************************************
76* Local Functions *
77*******************************************************************************/
78static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx);
79static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu);
80static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu);
81static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu);
82static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu);
83static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush);
84static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr);
85static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
86static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
87
88
89static void hmR0VmxCheckError(PVM pVM, PVMCPU pVCpu, int rc)
90{
91 if (rc == VERR_VMX_GENERIC)
92 {
93 RTCCUINTREG instrError;
94
95 VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
96 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
97 }
98 pVM->hwaccm.s.lLastError = rc;
99}
100
101/**
102 * Sets up and activates VT-x on the current CPU
103 *
104 * @returns VBox status code.
105 * @param pCpu CPU info struct
106 * @param pVM The VM to operate on. (can be NULL after a resume!!)
107 * @param pvCpuPage Pointer to the global cpu page.
108 * @param HCPhysCpuPage Physical address of the global cpu page.
109 */
110VMMR0DECL(int) VMXR0EnableCpu(PHMGLOBLCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
111{
112 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
113 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
114 NOREF(pCpu);
115
116 if (pVM)
117 {
118 /* Set revision dword at the beginning of the VMXON structure. */
119 *(uint32_t *)pvCpuPage = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
120 }
121
122 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
123 * (which can have very bad consequences!!!)
124 */
125
126 if (ASMGetCR4() & X86_CR4_VMXE)
127 return VERR_VMX_IN_VMX_ROOT_MODE;
128
129 /* Make sure the VMX instructions don't cause #UD faults. */
130 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
131
132 /* Enter VMX Root Mode. */
133 int rc = VMXEnable(HCPhysCpuPage);
134 if (RT_FAILURE(rc))
135 {
136 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
137 return VERR_VMX_VMXON_FAILED;
138 }
139 return VINF_SUCCESS;
140}
141
142/**
143 * Deactivates VT-x on the current CPU
144 *
145 * @returns VBox status code.
146 * @param pCpu CPU info struct
147 * @param pvCpuPage Pointer to the global cpu page.
148 * @param HCPhysCpuPage Physical address of the global cpu page.
149 */
150VMMR0DECL(int) VMXR0DisableCpu(PHMGLOBLCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
151{
152 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
153 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
154 NOREF(pCpu);
155
156 /* If we're somehow not in VMX root mode, then we shouldn't dare leaving it. */
157 if (!(ASMGetCR4() & X86_CR4_VMXE))
158 return VERR_VMX_NOT_IN_VMX_ROOT_MODE;
159
160 /* Leave VMX Root Mode. */
161 VMXDisable();
162
163 /* And clear the X86_CR4_VMXE bit. */
164 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
165 return VINF_SUCCESS;
166}
167
168/**
169 * Does Ring-0 per VM VT-x init.
170 *
171 * @returns VBox status code.
172 * @param pVM The VM to operate on.
173 */
174VMMR0DECL(int) VMXR0InitVM(PVM pVM)
175{
176 int rc;
177
178#ifdef LOG_ENABLED
179 SUPR0Printf("VMXR0InitVM %x\n", pVM);
180#endif
181
182 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
183
184 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
185 {
186 /* Allocate one page for the APIC physical page (serves for filtering accesses). */
187 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, PAGE_SIZE, true /* executable R0 mapping */);
188 AssertRC(rc);
189 if (RT_FAILURE(rc))
190 return rc;
191
192 pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
193 pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
194 ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
195 }
196 else
197 {
198 pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
199 pVM->hwaccm.s.vmx.pAPIC = 0;
200 pVM->hwaccm.s.vmx.pAPICPhys = 0;
201 }
202
203#ifdef VBOX_WITH_CRASHDUMP_MAGIC
204 {
205 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjScratch, PAGE_SIZE, true /* executable R0 mapping */);
206 AssertRC(rc);
207 if (RT_FAILURE(rc))
208 return rc;
209
210 pVM->hwaccm.s.vmx.pScratch = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjScratch);
211 pVM->hwaccm.s.vmx.pScratchPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjScratch, 0);
212
213 ASMMemZero32(pVM->hwaccm.s.vmx.pScratch, PAGE_SIZE);
214 strcpy((char *)pVM->hwaccm.s.vmx.pScratch, "SCRATCH Magic");
215 *(uint64_t *)(pVM->hwaccm.s.vmx.pScratch + 16) = UINT64_C(0xDEADBEEFDEADBEEF);
216 }
217#endif
218
219 /* Allocate VMCBs for all guest CPUs. */
220 for (VMCPUID i = 0; i < pVM->cCpus; i++)
221 {
222 PVMCPU pVCpu = &pVM->aCpus[i];
223
224 pVCpu->hwaccm.s.vmx.hMemObjVMCS = NIL_RTR0MEMOBJ;
225
226 /* Allocate one page for the VM control structure (VMCS). */
227 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.hMemObjVMCS, PAGE_SIZE, true /* executable R0 mapping */);
228 AssertRC(rc);
229 if (RT_FAILURE(rc))
230 return rc;
231
232 pVCpu->hwaccm.s.vmx.pvVMCS = RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.hMemObjVMCS);
233 pVCpu->hwaccm.s.vmx.HCPhysVMCS = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.hMemObjVMCS, 0);
234 ASMMemZeroPage(pVCpu->hwaccm.s.vmx.pvVMCS);
235
236 pVCpu->hwaccm.s.vmx.cr0_mask = 0;
237 pVCpu->hwaccm.s.vmx.cr4_mask = 0;
238
239 /* Allocate one page for the virtual APIC page for TPR caching. */
240 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.hMemObjVAPIC, PAGE_SIZE, true /* executable R0 mapping */);
241 AssertRC(rc);
242 if (RT_FAILURE(rc))
243 return rc;
244
245 pVCpu->hwaccm.s.vmx.pbVAPIC = (uint8_t *)RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.hMemObjVAPIC);
246 pVCpu->hwaccm.s.vmx.HCPhysVAPIC = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.hMemObjVAPIC, 0);
247 ASMMemZeroPage(pVCpu->hwaccm.s.vmx.pbVAPIC);
248
249 /* Allocate the MSR bitmap if this feature is supported. */
250 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
251 {
252 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap, PAGE_SIZE, true /* executable R0 mapping */);
253 AssertRC(rc);
254 if (RT_FAILURE(rc))
255 return rc;
256
257 pVCpu->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap);
258 pVCpu->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
259 memset(pVCpu->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
260 }
261
262#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
263 /* Allocate one page for the guest MSR load area (for preloading guest MSRs during the world switch). */
264 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjGuestMSR, PAGE_SIZE, true /* executable R0 mapping */);
265 AssertRC(rc);
266 if (RT_FAILURE(rc))
267 return rc;
268
269 pVCpu->hwaccm.s.vmx.pGuestMSR = (uint8_t *)RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjGuestMSR);
270 pVCpu->hwaccm.s.vmx.pGuestMSRPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjGuestMSR, 0);
271 memset(pVCpu->hwaccm.s.vmx.pGuestMSR, 0, PAGE_SIZE);
272
273 /* Allocate one page for the host MSR load area (for restoring host MSRs after the world switch back). */
274 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.vmx.pMemObjHostMSR, PAGE_SIZE, true /* executable R0 mapping */);
275 AssertRC(rc);
276 if (RT_FAILURE(rc))
277 return rc;
278
279 pVCpu->hwaccm.s.vmx.pHostMSR = (uint8_t *)RTR0MemObjAddress(pVCpu->hwaccm.s.vmx.pMemObjHostMSR);
280 pVCpu->hwaccm.s.vmx.pHostMSRPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.vmx.pMemObjHostMSR, 0);
281 memset(pVCpu->hwaccm.s.vmx.pHostMSR, 0, PAGE_SIZE);
282#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
283
284 /* Current guest paging mode. */
285 pVCpu->hwaccm.s.vmx.enmLastSeenGuestMode = PGMMODE_REAL;
286
287#ifdef LOG_ENABLED
288 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hwaccm.s.vmx.pvVMCS, (uint32_t)pVCpu->hwaccm.s.vmx.HCPhysVMCS);
289#endif
290 }
291
292 return VINF_SUCCESS;
293}
294
295/**
296 * Does Ring-0 per VM VT-x termination.
297 *
298 * @returns VBox status code.
299 * @param pVM The VM to operate on.
300 */
301VMMR0DECL(int) VMXR0TermVM(PVM pVM)
302{
303 for (VMCPUID i = 0; i < pVM->cCpus; i++)
304 {
305 PVMCPU pVCpu = &pVM->aCpus[i];
306
307 if (pVCpu->hwaccm.s.vmx.hMemObjVMCS != NIL_RTR0MEMOBJ)
308 {
309 RTR0MemObjFree(pVCpu->hwaccm.s.vmx.hMemObjVMCS, false);
310 pVCpu->hwaccm.s.vmx.hMemObjVMCS = NIL_RTR0MEMOBJ;
311 pVCpu->hwaccm.s.vmx.pvVMCS = 0;
312 pVCpu->hwaccm.s.vmx.HCPhysVMCS = 0;
313 }
314 if (pVCpu->hwaccm.s.vmx.hMemObjVAPIC != NIL_RTR0MEMOBJ)
315 {
316 RTR0MemObjFree(pVCpu->hwaccm.s.vmx.hMemObjVAPIC, false);
317 pVCpu->hwaccm.s.vmx.hMemObjVAPIC = NIL_RTR0MEMOBJ;
318 pVCpu->hwaccm.s.vmx.pbVAPIC = 0;
319 pVCpu->hwaccm.s.vmx.HCPhysVAPIC = 0;
320 }
321 if (pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
322 {
323 RTR0MemObjFree(pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap, false);
324 pVCpu->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
325 pVCpu->hwaccm.s.vmx.pMSRBitmap = 0;
326 pVCpu->hwaccm.s.vmx.pMSRBitmapPhys = 0;
327 }
328#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
329 if (pVCpu->hwaccm.s.vmx.pMemObjHostMSR != NIL_RTR0MEMOBJ)
330 {
331 RTR0MemObjFree(pVCpu->hwaccm.s.vmx.pMemObjHostMSR, false);
332 pVCpu->hwaccm.s.vmx.pMemObjHostMSR = NIL_RTR0MEMOBJ;
333 pVCpu->hwaccm.s.vmx.pHostMSR = 0;
334 pVCpu->hwaccm.s.vmx.pHostMSRPhys = 0;
335 }
336 if (pVCpu->hwaccm.s.vmx.pMemObjGuestMSR != NIL_RTR0MEMOBJ)
337 {
338 RTR0MemObjFree(pVCpu->hwaccm.s.vmx.pMemObjGuestMSR, false);
339 pVCpu->hwaccm.s.vmx.pMemObjGuestMSR = NIL_RTR0MEMOBJ;
340 pVCpu->hwaccm.s.vmx.pGuestMSR = 0;
341 pVCpu->hwaccm.s.vmx.pGuestMSRPhys = 0;
342 }
343#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
344 }
345 if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
346 {
347 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
348 pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
349 pVM->hwaccm.s.vmx.pAPIC = 0;
350 pVM->hwaccm.s.vmx.pAPICPhys = 0;
351 }
352#ifdef VBOX_WITH_CRASHDUMP_MAGIC
353 if (pVM->hwaccm.s.vmx.pMemObjScratch != NIL_RTR0MEMOBJ)
354 {
355 ASMMemZero32(pVM->hwaccm.s.vmx.pScratch, PAGE_SIZE);
356 RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjScratch, false);
357 pVM->hwaccm.s.vmx.pMemObjScratch = NIL_RTR0MEMOBJ;
358 pVM->hwaccm.s.vmx.pScratch = 0;
359 pVM->hwaccm.s.vmx.pScratchPhys = 0;
360 }
361#endif
362 return VINF_SUCCESS;
363}
364
365/**
366 * Sets up VT-x for the specified VM
367 *
368 * @returns VBox status code.
369 * @param pVM The VM to operate on.
370 */
371VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
372{
373 int rc = VINF_SUCCESS;
374 uint32_t val;
375
376 AssertReturn(pVM, VERR_INVALID_PARAMETER);
377
378 /* Initialize these always.*/
379 pVM->hwaccm.s.vmx.enmFlushEPT = VMX_FLUSH_EPT_NONE;
380 pVM->hwaccm.s.vmx.enmFlushVPID = VMX_FLUSH_VPID_NONE;
381
382 /* Determine optimal flush type for EPT. */
383 if (pVM->hwaccm.s.fNestedPaging)
384 {
385 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_SINGLE_CONTEXT)
386 pVM->hwaccm.s.vmx.enmFlushEPT = VMX_FLUSH_EPT_SINGLE_CONTEXT;
387 else if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVEPT_CAPS_ALL_CONTEXTS)
388 pVM->hwaccm.s.vmx.enmFlushEPT = VMX_FLUSH_EPT_ALL_CONTEXTS;
389 else
390 {
391 /*
392 * Should never really happen. EPT is supported but no suitable flush types supported.
393 * We cannot ignore EPT at this point as we've already setup Unrestricted Guest execution.
394 */
395 pVM->hwaccm.s.vmx.enmFlushEPT = VMX_FLUSH_EPT_NOT_SUPPORTED;
396 return VERR_VMX_GENERIC;
397 }
398 }
399
400 /* Determine optimal flush type for VPID. */
401 if (pVM->hwaccm.s.vmx.fVPID)
402 {
403 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_SINGLE_CONTEXT)
404 pVM->hwaccm.s.vmx.enmFlushVPID = VMX_FLUSH_VPID_SINGLE_CONTEXT;
405 else if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_ALL_CONTEXTS)
406 pVM->hwaccm.s.vmx.enmFlushVPID = VMX_FLUSH_VPID_ALL_CONTEXTS;
407 else
408 {
409 /*
410 * Neither SINGLE nor ALL context flush types for VPID supported by the CPU.
411 * We do not handle other flush type combinations, ignore VPID capabilities.
412 */
413 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV_ADDR)
414 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_INDIV_ADDR supported. Ignoring VPID.\n"));
415 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_SINGLE_CONTEXT_RETAIN_GLOBALS)
416 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_SINGLE_CONTEXT_RETAIN_GLOBALS supported. Ignoring VPID.\n"));
417 pVM->hwaccm.s.vmx.enmFlushVPID = VMX_FLUSH_VPID_NOT_SUPPORTED;
418 pVM->hwaccm.s.vmx.fVPID = false;
419 }
420 }
421
422 for (VMCPUID i = 0; i < pVM->cCpus; i++)
423 {
424 PVMCPU pVCpu = &pVM->aCpus[i];
425
426 AssertPtr(pVCpu->hwaccm.s.vmx.pvVMCS);
427
428 /* Set revision dword at the beginning of the VMCS structure. */
429 *(uint32_t *)pVCpu->hwaccm.s.vmx.pvVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
430
431 /* Clear VM Control Structure. */
432 Log(("HCPhysVMCS = %RHp\n", pVCpu->hwaccm.s.vmx.HCPhysVMCS));
433 rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
434 if (RT_FAILURE(rc))
435 goto vmx_end;
436
437 /* Activate the VM Control Structure. */
438 rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
439 if (RT_FAILURE(rc))
440 goto vmx_end;
441
442 /* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
443 * Set required bits to one and zero according to the MSR capabilities.
444 */
445 val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
446 /* External and non-maskable interrupts cause VM-exits. */
447 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
448 /* enable the preemption timer. */
449 if (pVM->hwaccm.s.vmx.fUsePreemptTimer)
450 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_PREEMPT_TIMER;
451 val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
452
453 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
454 AssertRC(rc);
455
456 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
457 * Set required bits to one and zero according to the MSR capabilities.
458 */
459 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
460 /* Program which event cause VM-exits and which features we want to use. */
461 val = val | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
462 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
463 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
464 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
465 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDPMC_EXIT
466 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_EXIT
467 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
468
469 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
470 if (!pVM->hwaccm.s.fNestedPaging)
471 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
472 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
473 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
474
475 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
476 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
477 {
478 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
479 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
480 Assert(pVM->hwaccm.s.vmx.pAPIC);
481 }
482 else
483 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
484 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
485
486 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
487 {
488 Assert(pVCpu->hwaccm.s.vmx.pMSRBitmapPhys);
489 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
490 }
491
492 /* We will use the secondary control if it's present. */
493 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
494
495 /* Mask away the bits that the CPU doesn't support */
496 /** @todo make sure they don't conflict with the above requirements. */
497 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
498 pVCpu->hwaccm.s.vmx.proc_ctls = val;
499
500 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
501 AssertRC(rc);
502
503 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
504 {
505 /* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
506 * Set required bits to one and zero according to the MSR capabilities.
507 */
508 val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
509 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
510
511 if (pVM->hwaccm.s.fNestedPaging)
512 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
513
514 if (pVM->hwaccm.s.vmx.fVPID)
515 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
516
517 if (pVM->hwaccm.s.fHasIoApic)
518 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
519
520 if (pVM->hwaccm.s.vmx.fUnrestrictedGuest)
521 val |= VMX_VMCS_CTRL_PROC_EXEC2_REAL_MODE;
522
523 /* Mask away the bits that the CPU doesn't support */
524 /** @todo make sure they don't conflict with the above requirements. */
525 val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
526 pVCpu->hwaccm.s.vmx.proc_ctls2 = val;
527 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
528 AssertRC(rc);
529 }
530
531 /* VMX_VMCS_CTRL_CR3_TARGET_COUNT
532 * Set required bits to one and zero according to the MSR capabilities.
533 */
534 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
535 AssertRC(rc);
536
537 /* Forward all exception except #NM & #PF to the guest.
538 * We always need to check pagefaults since our shadow page table can be out of sync.
539 * And we always lazily sync the FPU & XMM state.
540 */
541
542 /** @todo Possible optimization:
543 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
544 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
545 * registers ourselves of course.
546 *
547 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
548 */
549
550 /* Don't filter page faults; all of them should cause a switch. */
551 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
552 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
553 AssertRC(rc);
554
555 /* Init TSC offset to zero. */
556 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
557 AssertRC(rc);
558
559 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
560 AssertRC(rc);
561
562 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
563 AssertRC(rc);
564
565 /* Set the MSR bitmap address. */
566 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
567 {
568 Assert(pVCpu->hwaccm.s.vmx.pMSRBitmapPhys);
569
570 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVCpu->hwaccm.s.vmx.pMSRBitmapPhys);
571 AssertRC(rc);
572
573 /* Allow the guest to directly modify these MSRs; they are restored and saved automatically. */
574 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
575 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
576 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
577 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
578 hmR0VmxSetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
579 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
580 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
581 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
582 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
583 }
584
585#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
586 /* Set the guest & host MSR load/store physical addresses. */
587 Assert(pVCpu->hwaccm.s.vmx.pGuestMSRPhys);
588 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, pVCpu->hwaccm.s.vmx.pGuestMSRPhys);
589 AssertRC(rc);
590 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, pVCpu->hwaccm.s.vmx.pGuestMSRPhys);
591 AssertRC(rc);
592
593 Assert(pVCpu->hwaccm.s.vmx.pHostMSRPhys);
594 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, pVCpu->hwaccm.s.vmx.pHostMSRPhys);
595 AssertRC(rc);
596#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
597
598 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_MSR_LOAD_COUNT, 0);
599 AssertRC(rc);
600
601 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
602 AssertRC(rc);
603
604 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
605 {
606 Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
607 /* Optional */
608 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
609 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hwaccm.s.vmx.HCPhysVAPIC);
610
611 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
612 rc |= VMXWriteVMCS64(VMX_VMCS_CTRL_APIC_ACCESSADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
613
614 AssertRC(rc);
615 }
616
617 /* Set link pointer to -1. Not currently used. */
618 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
619 AssertRC(rc);
620
621 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
622 rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
623 AssertRC(rc);
624
625 /* Configure the VMCS read cache. */
626 PVMCSCACHE pCache = &pVCpu->hwaccm.s.vmx.VMCSCache;
627
628 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_RIP);
629 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_RSP);
630 VMXSetupCachedReadVMCS(pCache, VMX_VMCS_GUEST_RFLAGS);
631 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE);
632 VMXSetupCachedReadVMCS(pCache, VMX_VMCS_CTRL_CR0_READ_SHADOW);
633 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_CR0);
634 VMXSetupCachedReadVMCS(pCache, VMX_VMCS_CTRL_CR4_READ_SHADOW);
635 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_CR4);
636 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_DR7);
637 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_GUEST_SYSENTER_CS);
638 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_SYSENTER_EIP);
639 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_SYSENTER_ESP);
640 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_GUEST_GDTR_LIMIT);
641 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_GDTR_BASE);
642 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_GUEST_IDTR_LIMIT);
643 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_IDTR_BASE);
644
645 VMX_SETUP_SELREG(ES, pCache);
646 VMX_SETUP_SELREG(SS, pCache);
647 VMX_SETUP_SELREG(CS, pCache);
648 VMX_SETUP_SELREG(DS, pCache);
649 VMX_SETUP_SELREG(FS, pCache);
650 VMX_SETUP_SELREG(GS, pCache);
651 VMX_SETUP_SELREG(LDTR, pCache);
652 VMX_SETUP_SELREG(TR, pCache);
653
654 /* Status code VMCS reads. */
655 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_EXIT_REASON);
656 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_VM_INSTR_ERROR);
657 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_EXIT_INSTR_LENGTH);
658 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_ERRCODE);
659 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO);
660 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_EXIT_INSTR_INFO);
661 VMXSetupCachedReadVMCS(pCache, VMX_VMCS_RO_EXIT_QUALIFICATION);
662 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_IDT_INFO);
663 VMXSetupCachedReadVMCS(pCache, VMX_VMCS32_RO_IDT_ERRCODE);
664
665 if (pVM->hwaccm.s.fNestedPaging)
666 {
667 VMXSetupCachedReadVMCS(pCache, VMX_VMCS64_GUEST_CR3);
668 VMXSetupCachedReadVMCS(pCache, VMX_VMCS_EXIT_PHYS_ADDR_FULL);
669 pCache->Read.cValidEntries = VMX_VMCS_MAX_NESTED_PAGING_CACHE_IDX;
670 }
671 else
672 pCache->Read.cValidEntries = VMX_VMCS_MAX_CACHE_IDX;
673 } /* for each VMCPU */
674
675 /* Choose the right TLB setup function. */
676 if (pVM->hwaccm.s.fNestedPaging && pVM->hwaccm.s.vmx.fVPID)
677 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = hmR0VmxSetupTLBBoth;
678 else if (pVM->hwaccm.s.fNestedPaging)
679 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = hmR0VmxSetupTLBEPT;
680 else if (pVM->hwaccm.s.vmx.fVPID)
681 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = hmR0VmxSetupTLBVPID;
682 else
683 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB = hmR0VmxSetupTLBDummy;
684
685vmx_end:
686 hmR0VmxCheckError(pVM, &pVM->aCpus[0], rc);
687 return rc;
688}
689
690/**
691 * Sets the permission bits for the specified MSR
692 *
693 * @param pVCpu The VMCPU to operate on.
694 * @param ulMSR MSR value
695 * @param fRead Reading allowed/disallowed
696 * @param fWrite Writing allowed/disallowed
697 */
698static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
699{
700 unsigned ulBit;
701 uint8_t *pMSRBitmap = (uint8_t *)pVCpu->hwaccm.s.vmx.pMSRBitmap;
702
703 /* Layout:
704 * 0x000 - 0x3ff - Low MSR read bits
705 * 0x400 - 0x7ff - High MSR read bits
706 * 0x800 - 0xbff - Low MSR write bits
707 * 0xc00 - 0xfff - High MSR write bits
708 */
709 if (ulMSR <= 0x00001FFF)
710 {
711 /* Pentium-compatible MSRs */
712 ulBit = ulMSR;
713 }
714 else
715 if ( ulMSR >= 0xC0000000
716 && ulMSR <= 0xC0001FFF)
717 {
718 /* AMD Sixth Generation x86 Processor MSRs */
719 ulBit = (ulMSR - 0xC0000000);
720 pMSRBitmap += 0x400;
721 }
722 else
723 {
724 AssertFailed();
725 return;
726 }
727
728 Assert(ulBit <= 0x1fff);
729 if (fRead)
730 ASMBitClear(pMSRBitmap, ulBit);
731 else
732 ASMBitSet(pMSRBitmap, ulBit);
733
734 if (fWrite)
735 ASMBitClear(pMSRBitmap + 0x800, ulBit);
736 else
737 ASMBitSet(pMSRBitmap + 0x800, ulBit);
738}
739
740
741/**
742 * Injects an event (trap or external interrupt)
743 *
744 * @returns VBox status code. Note that it may return VINF_EM_RESET to
745 * indicate a triple fault when injecting X86_XCPT_DF.
746 *
747 * @param pVM The VM to operate on.
748 * @param pVCpu The VMCPU to operate on.
749 * @param pCtx CPU Context
750 * @param intInfo VMX interrupt info
751 * @param cbInstr Opcode length of faulting instruction
752 * @param errCode Error code (optional)
753 */
754static int hmR0VmxInjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
755{
756 int rc;
757 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
758
759#ifdef VBOX_WITH_STATISTICS
760 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatInjectedIrqsR0[iGate & MASK_INJECT_IRQ_STAT]);
761#endif
762
763#ifdef VBOX_STRICT
764 if (iGate == 0xE)
765 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%RGv intInfo=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
766 else
767 if (iGate < 0x20)
768 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip, errCode));
769 else
770 {
771 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
772 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
773 || !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
774 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
775 || pCtx->eflags.u32 & X86_EFL_IF);
776 }
777#endif
778
779 if ( CPUMIsGuestInRealModeEx(pCtx)
780 && pVM->hwaccm.s.vmx.pRealModeTSS)
781 {
782 RTGCPHYS GCPhysHandler;
783 uint16_t offset, ip;
784 RTSEL sel;
785
786 /* Injecting events doesn't work right with real mode emulation.
787 * (#GP if we try to inject external hardware interrupts)
788 * Inject the interrupt or trap directly instead.
789 *
790 * ASSUMES no access handlers for the bits we read or write below (should be safe).
791 */
792 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
793
794 /* Check if the interrupt handler is present. */
795 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
796 {
797 Log(("IDT cbIdt violation\n"));
798 if (iGate != X86_XCPT_DF)
799 {
800 uint32_t intInfo2;
801
802 intInfo2 = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : iGate;
803 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
804 intInfo2 |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
805 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
806
807 return hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, 0, 0 /* no error code according to the Intel docs */);
808 }
809 Log(("Triple fault -> reset the VM!\n"));
810 return VINF_EM_RESET;
811 }
812 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
813 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
814 || iGate == 4)
815 {
816 ip = pCtx->ip + cbInstr;
817 }
818 else
819 ip = pCtx->ip;
820
821 /* Read the selector:offset pair of the interrupt handler. */
822 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
823 rc = PGMPhysSimpleReadGCPhys(pVM, &offset, GCPhysHandler, sizeof(offset)); AssertRC(rc);
824 rc = PGMPhysSimpleReadGCPhys(pVM, &sel, GCPhysHandler + 2, sizeof(sel)); AssertRC(rc);
825
826 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
827
828 /* Construct the stack frame. */
829 /** @todo should check stack limit. */
830 pCtx->sp -= 2;
831 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss, pCtx->sp, pCtx->eflags.u));
832 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t)); AssertRC(rc);
833 pCtx->sp -= 2;
834 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss, pCtx->sp, pCtx->cs));
835 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ssHid.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t)); AssertRC(rc);
836 pCtx->sp -= 2;
837 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss, pCtx->sp, ip));
838 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ssHid.u64Base + pCtx->sp, &ip, sizeof(ip)); AssertRC(rc);
839
840 /* Update the CPU state for executing the handler. */
841 pCtx->rip = offset;
842 pCtx->cs = sel;
843 pCtx->csHid.u64Base = sel << 4;
844 pCtx->eflags.u &= ~(X86_EFL_IF|X86_EFL_TF|X86_EFL_RF|X86_EFL_AC);
845
846 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_SEGMENT_REGS;
847 return VINF_SUCCESS;
848 }
849
850 /* Set event injection state. */
851 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
852
853 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
854 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
855
856 AssertRC(rc);
857 return rc;
858}
859
860
861/**
862 * Checks for pending guest interrupts and injects them
863 *
864 * @returns VBox status code.
865 * @param pVM The VM to operate on.
866 * @param pVCpu The VMCPU to operate on.
867 * @param pCtx CPU Context
868 */
869static int hmR0VmxCheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
870{
871 int rc;
872
873 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
874 if (pVCpu->hwaccm.s.Event.fPending)
875 {
876 Log(("CPU%d: Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->idCpu, pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
877 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
878 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, pVCpu->hwaccm.s.Event.intInfo, 0, pVCpu->hwaccm.s.Event.errCode);
879 AssertRC(rc);
880
881 pVCpu->hwaccm.s.Event.fPending = false;
882 return VINF_SUCCESS;
883 }
884
885 /* If an active trap is already pending, then we must forward it first! */
886 if (!TRPMHasTrap(pVCpu))
887 {
888 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
889 {
890 RTGCUINTPTR intInfo;
891
892 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
893
894 intInfo = X86_XCPT_NMI;
895 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
896 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
897
898 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
899 AssertRC(rc);
900
901 return VINF_SUCCESS;
902 }
903
904 /* @todo SMI interrupts. */
905
906 /* When external interrupts are pending, we should exit the VM when IF is set. */
907 if (VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
908 {
909 if (!(pCtx->eflags.u32 & X86_EFL_IF))
910 {
911 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
912 {
913 LogFlow(("Enable irq window exit!\n"));
914 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
915 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
916 AssertRC(rc);
917 }
918 /* else nothing to do but wait */
919 }
920 else
921 if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
922 {
923 uint8_t u8Interrupt;
924
925 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
926 Log(("CPU%d: Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", pVCpu->idCpu, u8Interrupt, u8Interrupt, rc, pCtx->cs, (RTGCPTR)pCtx->rip));
927 if (RT_SUCCESS(rc))
928 {
929 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
930 AssertRC(rc);
931 }
932 else
933 {
934 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
935 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
936 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
937 /* Just continue */
938 }
939 }
940 else
941 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
942 }
943 }
944
945#ifdef VBOX_STRICT
946 if (TRPMHasTrap(pVCpu))
947 {
948 uint8_t u8Vector;
949 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
950 AssertRC(rc);
951 }
952#endif
953
954 if ( (pCtx->eflags.u32 & X86_EFL_IF)
955 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
956 && TRPMHasTrap(pVCpu)
957 )
958 {
959 uint8_t u8Vector;
960 TRPMEVENT enmType;
961 RTGCUINTPTR intInfo;
962 RTGCUINT errCode;
963
964 /* If a new event is pending, then dispatch it now. */
965 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &errCode, 0);
966 AssertRC(rc);
967 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
968 Assert(enmType != TRPM_SOFTWARE_INT);
969
970 /* Clear the pending trap. */
971 rc = TRPMResetTrap(pVCpu);
972 AssertRC(rc);
973
974 intInfo = u8Vector;
975 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
976
977 if (enmType == TRPM_TRAP)
978 {
979 switch (u8Vector) {
980 case X86_XCPT_DF:
981 case X86_XCPT_TS:
982 case X86_XCPT_NP:
983 case X86_XCPT_SS:
984 case X86_XCPT_GP:
985 case X86_XCPT_PF:
986 case X86_XCPT_AC:
987 /* Valid error codes. */
988 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
989 break;
990 default:
991 break;
992 }
993 if (u8Vector == X86_XCPT_BP || u8Vector == X86_XCPT_OF)
994 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
995 else
996 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
997 }
998 else
999 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1000
1001 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
1002 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
1003 AssertRC(rc);
1004 } /* if (interrupts can be dispatched) */
1005
1006 return VINF_SUCCESS;
1007}
1008
1009/**
1010 * Save the host state
1011 *
1012 * @returns VBox status code.
1013 * @param pVM The VM to operate on.
1014 * @param pVCpu The VMCPU to operate on.
1015 */
1016VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
1017{
1018 int rc = VINF_SUCCESS;
1019 NOREF(pVM);
1020
1021 /*
1022 * Host CPU Context
1023 */
1024 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
1025 {
1026 RTIDTR idtr;
1027 RTGDTR gdtr;
1028 RTSEL SelTR;
1029 PCX86DESCHC pDesc;
1030 uintptr_t trBase;
1031 RTSEL cs;
1032 RTSEL ss;
1033 uint64_t cr3;
1034
1035 /* Control registers */
1036 rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
1037#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1038 if (VMX_IS_64BIT_HOST_MODE())
1039 {
1040 cr3 = hwaccmR0Get64bitCR3();
1041 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_CR3, cr3);
1042 }
1043 else
1044#endif
1045 {
1046 cr3 = ASMGetCR3();
1047 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR3, cr3);
1048 }
1049 rc |= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
1050 AssertRC(rc);
1051 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
1052 Log2(("VMX_VMCS_HOST_CR3 %08RX64\n", cr3));
1053 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
1054
1055 /* Selector registers. */
1056#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1057 if (VMX_IS_64BIT_HOST_MODE())
1058 {
1059 cs = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelCS;
1060 ss = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelSS;
1061 }
1062 else
1063 {
1064 /* sysenter loads LDT cs & ss, VMX doesn't like this. Load the GDT ones (safe). */
1065 cs = (RTSEL)(uintptr_t)&SUPR0AbsKernelCS;
1066 ss = (RTSEL)(uintptr_t)&SUPR0AbsKernelSS;
1067 }
1068#else
1069 cs = ASMGetCS();
1070 ss = ASMGetSS();
1071#endif
1072 Assert(!(cs & X86_SEL_LDT)); Assert((cs & X86_SEL_RPL) == 0);
1073 Assert(!(ss & X86_SEL_LDT)); Assert((ss & X86_SEL_RPL) == 0);
1074 rc = VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_CS, cs);
1075 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
1076 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_DS, 0);
1077 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_ES, 0);
1078#if HC_ARCH_BITS == 32
1079 if (!VMX_IS_64BIT_HOST_MODE())
1080 {
1081 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_FS, 0);
1082 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_GS, 0);
1083 }
1084#endif
1085 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_SS, ss);
1086 SelTR = ASMGetTR();
1087 rc |= VMXWriteVMCS(VMX_VMCS16_HOST_FIELD_TR, SelTR);
1088 AssertRC(rc);
1089 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
1090 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
1091 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
1092 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
1093 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
1094 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", ss, ASMGetSS()));
1095 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
1096
1097 /* GDTR & IDTR */
1098#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1099 if (VMX_IS_64BIT_HOST_MODE())
1100 {
1101 X86XDTR64 gdtr64, idtr64;
1102 hwaccmR0Get64bitGDTRandIDTR(&gdtr64, &idtr64);
1103 rc = VMXWriteVMCS64(VMX_VMCS_HOST_GDTR_BASE, gdtr64.uAddr);
1104 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_IDTR_BASE, gdtr64.uAddr);
1105 AssertRC(rc);
1106 Log2(("VMX_VMCS_HOST_GDTR_BASE %RX64\n", gdtr64.uAddr));
1107 Log2(("VMX_VMCS_HOST_IDTR_BASE %RX64\n", idtr64.uAddr));
1108 gdtr.cbGdt = gdtr64.cb;
1109 gdtr.pGdt = (uintptr_t)gdtr64.uAddr;
1110 }
1111 else
1112#endif
1113 {
1114 ASMGetGDTR(&gdtr);
1115 rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
1116 ASMGetIDTR(&idtr);
1117 rc |= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
1118 AssertRC(rc);
1119 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
1120 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
1121 }
1122
1123 /* Save the base address of the TR selector. */
1124 if (SelTR > gdtr.cbGdt)
1125 {
1126 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
1127 return VERR_VMX_INVALID_HOST_STATE;
1128 }
1129
1130 pDesc = (PCX86DESCHC)(gdtr.pGdt + (SelTR & X86_SEL_MASK));
1131#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1132 if (VMX_IS_64BIT_HOST_MODE())
1133 {
1134 uint64_t trBase64 = X86DESC64_BASE(*(PX86DESC64)pDesc);
1135 rc = VMXWriteVMCS64(VMX_VMCS_HOST_TR_BASE, trBase64);
1136 Log2(("VMX_VMCS_HOST_TR_BASE %RX64\n", trBase64));
1137 AssertRC(rc);
1138 }
1139 else
1140#endif
1141 {
1142#if HC_ARCH_BITS == 64
1143 trBase = X86DESC64_BASE(*pDesc);
1144#else
1145 trBase = X86DESC_BASE(*pDesc);
1146#endif
1147 rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
1148 AssertRC(rc);
1149 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
1150 }
1151
1152 /* FS and GS base. */
1153#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1154 if (VMX_IS_64BIT_HOST_MODE())
1155 {
1156 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
1157 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
1158 rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
1159 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
1160 }
1161#endif
1162 AssertRC(rc);
1163
1164 /* Sysenter MSRs. */
1165 /** @todo expensive!! */
1166 rc = VMXWriteVMCS(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
1167 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
1168#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1169 if (VMX_IS_64BIT_HOST_MODE())
1170 {
1171 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1172 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1173 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1174 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1175 }
1176 else
1177 {
1178 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1179 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1180 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1181 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1182 }
1183#elif HC_ARCH_BITS == 32
1184 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1185 rc |= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1186 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1187 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1188#else
1189 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1190 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1191 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1192 rc |= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1193#endif
1194 AssertRC(rc);
1195
1196#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1197 /* Store all host MSRs in the VM-Exit load area, so they will be reloaded after the world switch back to the host. */
1198 PVMXMSR pMsr = (PVMXMSR)pVCpu->hwaccm.s.vmx.pHostMSR;
1199 unsigned idxMsr = 0;
1200
1201 /* EFER MSR present? */
1202 if (ASMCpuId_EDX(0x80000001) & (X86_CPUID_AMD_FEATURE_EDX_NX|X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
1203 {
1204 if (ASMCpuId_EDX(0x80000001) & X86_CPUID_AMD_FEATURE_EDX_SEP)
1205 {
1206 pMsr->u32IndexMSR = MSR_K6_STAR;
1207 pMsr->u32Reserved = 0;
1208 pMsr->u64Value = ASMRdMsr(MSR_K6_STAR); /* legacy syscall eip, cs & ss */
1209 pMsr++; idxMsr++;
1210 }
1211
1212 pMsr->u32IndexMSR = MSR_K6_EFER;
1213 pMsr->u32Reserved = 0;
1214# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1215 if (CPUMIsGuestInLongMode(pVCpu))
1216 {
1217 /* Must match the efer value in our 64 bits switcher. */
1218 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER) | MSR_K6_EFER_LME | MSR_K6_EFER_SCE | MSR_K6_EFER_NXE;
1219 }
1220 else
1221# endif
1222 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER);
1223 pMsr++; idxMsr++;
1224 }
1225
1226# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1227 if (VMX_IS_64BIT_HOST_MODE())
1228 {
1229 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1230 pMsr->u32Reserved = 0;
1231 pMsr->u64Value = ASMRdMsr(MSR_K8_LSTAR); /* 64 bits mode syscall rip */
1232 pMsr++; idxMsr++;
1233 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1234 pMsr->u32Reserved = 0;
1235 pMsr->u64Value = ASMRdMsr(MSR_K8_SF_MASK); /* syscall flag mask */
1236 pMsr++; idxMsr++;
1237 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1238 pMsr->u32Reserved = 0;
1239 pMsr->u64Value = ASMRdMsr(MSR_K8_KERNEL_GS_BASE); /* swapgs exchange value */
1240 pMsr++; idxMsr++;
1241 }
1242# endif
1243 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, idxMsr);
1244 AssertRC(rc);
1245#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1246
1247 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
1248 }
1249 return rc;
1250}
1251
1252/**
1253 * Loads the 4 PDPEs into the guest state when nested paging is used and the
1254 * guest operates in PAE mode.
1255 *
1256 * @returns VINF_SUCCESS or fatal error.
1257 * @param pVCpu The VMCPU to operate on.
1258 * @param pCtx Guest context
1259 */
1260static int hmR0VmxLoadPaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1261{
1262 if (CPUMIsGuestInPAEModeEx(pCtx))
1263 {
1264 X86PDPE aPdpes[4];
1265 int rc = PGMGstGetPaePdpes(pVCpu, &aPdpes[0]);
1266 AssertRCReturn(rc, rc);
1267
1268 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR0_FULL, aPdpes[0].u); AssertRCReturn(rc, rc);
1269 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR1_FULL, aPdpes[1].u); AssertRCReturn(rc, rc);
1270 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR2_FULL, aPdpes[2].u); AssertRCReturn(rc, rc);
1271 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_PDPTR3_FULL, aPdpes[3].u); AssertRCReturn(rc, rc);
1272 }
1273 return VINF_SUCCESS;
1274}
1275
1276/**
1277 * Saves the 4 PDPEs into the guest state when nested paging is used and the
1278 * guest operates in PAE mode.
1279 *
1280 * @returns VINF_SUCCESS or fatal error.
1281 * @param pVCpu The VMCPU to operate on.
1282 * @param pCtx Guest context
1283 *
1284 * @remarks Tell PGM about CR3 changes before calling this helper.
1285 */
1286static int hmR0VmxSavePaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1287{
1288 if (CPUMIsGuestInPAEModeEx(pCtx))
1289 {
1290 int rc;
1291 X86PDPE aPdpes[4];
1292 rc = VMXReadVMCS64(VMX_VMCS_GUEST_PDPTR0_FULL, &aPdpes[0].u); AssertRCReturn(rc, rc);
1293 rc = VMXReadVMCS64(VMX_VMCS_GUEST_PDPTR1_FULL, &aPdpes[1].u); AssertRCReturn(rc, rc);
1294 rc = VMXReadVMCS64(VMX_VMCS_GUEST_PDPTR2_FULL, &aPdpes[2].u); AssertRCReturn(rc, rc);
1295 rc = VMXReadVMCS64(VMX_VMCS_GUEST_PDPTR3_FULL, &aPdpes[3].u); AssertRCReturn(rc, rc);
1296
1297 rc = PGMGstUpdatePaePdpes(pVCpu, &aPdpes[0]);
1298 AssertRCReturn(rc, rc);
1299 }
1300 return VINF_SUCCESS;
1301}
1302
1303
1304/**
1305 * Update the exception bitmap according to the current CPU state
1306 *
1307 * @param pVM The VM to operate on.
1308 * @param pVCpu The VMCPU to operate on.
1309 * @param pCtx Guest context
1310 */
1311static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1312{
1313 uint32_t u32TrapMask;
1314 Assert(pCtx);
1315
1316 u32TrapMask = HWACCM_VMX_TRAP_MASK;
1317#ifndef DEBUG
1318 if (pVM->hwaccm.s.fNestedPaging)
1319 u32TrapMask &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
1320#endif
1321
1322 /* Also catch floating point exceptions if we need to report them to the guest in a different way. */
1323 if (!(pCtx->cr0 & X86_CR0_NE))
1324 {
1325 u32TrapMask |= RT_BIT(X86_XCPT_MF);
1326 }
1327
1328#ifdef VBOX_STRICT
1329 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
1330#endif
1331
1332 /* Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise). */
1333 if ( CPUMIsGuestInRealModeEx(pCtx)
1334 && pVM->hwaccm.s.vmx.pRealModeTSS)
1335 u32TrapMask |= HWACCM_VMX_TRAP_MASK_REALMODE;
1336
1337 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, u32TrapMask);
1338 AssertRC(rc);
1339}
1340
1341/**
1342 * Loads a minimal guest state
1343 *
1344 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1345 *
1346 * @param pVM The VM to operate on.
1347 * @param pVCpu The VMCPU to operate on.
1348 * @param pCtx Guest context
1349 */
1350VMMR0DECL(void) VMXR0LoadMinimalGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1351{
1352 int rc;
1353 X86EFLAGS eflags;
1354
1355 Assert(!(pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_ALL_GUEST));
1356
1357 /* EIP, ESP and EFLAGS */
1358 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_RIP, pCtx->rip);
1359 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_RSP, pCtx->rsp);
1360 AssertRC(rc);
1361
1362 /* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1363 eflags = pCtx->eflags;
1364 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1365 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1366
1367 /* Real mode emulation using v86 mode. */
1368 if ( CPUMIsGuestInRealModeEx(pCtx)
1369 && pVM->hwaccm.s.vmx.pRealModeTSS)
1370 {
1371 pVCpu->hwaccm.s.vmx.RealMode.eflags = eflags;
1372
1373 eflags.Bits.u1VM = 1;
1374 eflags.Bits.u2IOPL = 0; /* must always be 0 or else certain instructions won't cause faults. */
1375 }
1376 rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1377 AssertRC(rc);
1378}
1379
1380/**
1381 * Loads the guest state
1382 *
1383 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1384 *
1385 * @returns VBox status code.
1386 * @param pVM The VM to operate on.
1387 * @param pVCpu The VMCPU to operate on.
1388 * @param pCtx Guest context
1389 */
1390VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1391{
1392 int rc = VINF_SUCCESS;
1393 RTGCUINTPTR val;
1394
1395 /* VMX_VMCS_CTRL_ENTRY_CONTROLS
1396 * Set required bits to one and zero according to the MSR capabilities.
1397 */
1398 val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1399 /* Load guest debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1400 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1401 /* 64 bits guest mode? */
1402 if (CPUMIsGuestInLongModeEx(pCtx))
1403 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1404 /* else Must be zero when AMD64 is not available. */
1405
1406 /* Mask away the bits that the CPU doesn't support */
1407 val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1408 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1409 AssertRC(rc);
1410
1411 /* VMX_VMCS_CTRL_EXIT_CONTROLS
1412 * Set required bits to one and zero according to the MSR capabilities.
1413 */
1414 val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
1415
1416 /* Save debug controls (dr7 & IA32_DEBUGCTL_MSR) (forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs) */
1417 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
1418
1419#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1420 if (VMX_IS_64BIT_HOST_MODE())
1421 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
1422 /* else: Must be zero when AMD64 is not available. */
1423#elif HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1424 if (CPUMIsGuestInLongModeEx(pCtx))
1425 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64; /* our switcher goes to long mode */
1426 else
1427 Assert(!(val & VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64));
1428#endif
1429 val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
1430 /* Don't acknowledge external interrupts on VM-exit. */
1431 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
1432 AssertRC(rc);
1433
1434 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1435 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
1436 {
1437 if (pVM->hwaccm.s.vmx.pRealModeTSS)
1438 {
1439 PGMMODE enmGuestMode = PGMGetGuestMode(pVCpu);
1440 if (pVCpu->hwaccm.s.vmx.enmLastSeenGuestMode != enmGuestMode)
1441 {
1442 /* Correct weird requirements for switching to protected mode. */
1443 if ( pVCpu->hwaccm.s.vmx.enmLastSeenGuestMode == PGMMODE_REAL
1444 && enmGuestMode >= PGMMODE_PROTECTED)
1445 {
1446#ifdef VBOX_WITH_REM
1447 /* Flush the recompiler code cache as it's not unlikely
1448 * the guest will rewrite code it will later execute in real
1449 * mode (OpenBSD 4.0 is one such example)
1450 */
1451 REMFlushTBs(pVM);
1452#endif
1453
1454 /* DPL of all hidden selector registers must match the current CPL (0). */
1455 pCtx->csHid.Attr.n.u2Dpl = 0;
1456 pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
1457
1458 pCtx->dsHid.Attr.n.u2Dpl = 0;
1459 pCtx->esHid.Attr.n.u2Dpl = 0;
1460 pCtx->fsHid.Attr.n.u2Dpl = 0;
1461 pCtx->gsHid.Attr.n.u2Dpl = 0;
1462 pCtx->ssHid.Attr.n.u2Dpl = 0;
1463 }
1464 pVCpu->hwaccm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
1465 }
1466 else
1467 /* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
1468 if ( CPUMIsGuestInRealModeEx(pCtx)
1469 && pCtx->csHid.u64Base == 0xffff0000)
1470 {
1471 pCtx->csHid.u64Base = 0xf0000;
1472 pCtx->cs = 0xf000;
1473 }
1474 }
1475
1476 VMX_WRITE_SELREG(ES, es);
1477 AssertRC(rc);
1478
1479 VMX_WRITE_SELREG(CS, cs);
1480 AssertRC(rc);
1481
1482 VMX_WRITE_SELREG(SS, ss);
1483 AssertRC(rc);
1484
1485 VMX_WRITE_SELREG(DS, ds);
1486 AssertRC(rc);
1487
1488 VMX_WRITE_SELREG(FS, fs);
1489 AssertRC(rc);
1490
1491 VMX_WRITE_SELREG(GS, gs);
1492 AssertRC(rc);
1493 }
1494
1495 /* Guest CPU context: LDTR. */
1496 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
1497 {
1498 if (pCtx->ldtr == 0)
1499 {
1500 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1501 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1502 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_LDTR_BASE, 0);
1503 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1504 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1505 }
1506 else
1507 {
1508 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr);
1509 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
1510 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
1511 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
1512 }
1513 AssertRC(rc);
1514 }
1515 /* Guest CPU context: TR. */
1516 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
1517 {
1518 /* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1519 if ( CPUMIsGuestInRealModeEx(pCtx)
1520 && pVM->hwaccm.s.vmx.pRealModeTSS)
1521 {
1522 RTGCPHYS GCPhys;
1523
1524 /* We convert it here every time as pci regions could be reconfigured. */
1525 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
1526 AssertRC(rc);
1527
1528 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, 0);
1529 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
1530 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1531
1532 X86DESCATTR attr;
1533
1534 attr.u = 0;
1535 attr.n.u1Present = 1;
1536 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1537 val = attr.u;
1538 }
1539 else
1540 {
1541 rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr);
1542 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
1543 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_TR_BASE, pCtx->trHid.u64Base);
1544
1545 val = pCtx->trHid.Attr.u;
1546
1547 /* The TSS selector must be busy (REM bugs? see defect #XXXX). */
1548 if (!(val & X86_SEL_TYPE_SYS_TSS_BUSY_MASK))
1549 {
1550 if (val & 0xf)
1551 val |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
1552 else
1553 /* Default if no TR selector has been set (otherwise vmlaunch will fail!) */
1554 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
1555 }
1556 AssertMsg((val & 0xf) == X86_SEL_TYPE_SYS_386_TSS_BUSY || (val & 0xf) == X86_SEL_TYPE_SYS_286_TSS_BUSY, ("%#x\n", val));
1557 }
1558 rc |= VMXWriteVMCS(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
1559 AssertRC(rc);
1560 }
1561 /* Guest CPU context: GDTR. */
1562 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
1563 {
1564 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
1565 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
1566 AssertRC(rc);
1567 }
1568 /* Guest CPU context: IDTR. */
1569 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
1570 {
1571 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
1572 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
1573 AssertRC(rc);
1574 }
1575
1576 /*
1577 * Sysenter MSRs
1578 */
1579 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_MSR)
1580 {
1581 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
1582 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
1583 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
1584 AssertRC(rc);
1585 }
1586
1587 /* Control registers */
1588 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
1589 {
1590 val = pCtx->cr0;
1591 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
1592 Log2(("Guest CR0-shadow %08x\n", val));
1593 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1594 {
1595 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
1596 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
1597 }
1598 else
1599 {
1600 /** @todo check if we support the old style mess correctly. */
1601 if (!(val & X86_CR0_NE))
1602 Log(("Forcing X86_CR0_NE!!!\n"));
1603
1604 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
1605 }
1606 /* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
1607 if (!pVM->hwaccm.s.vmx.fUnrestrictedGuest)
1608 val |= X86_CR0_PE | X86_CR0_PG;
1609
1610 if (pVM->hwaccm.s.fNestedPaging)
1611 {
1612 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
1613 {
1614 /* Disable cr3 read/write monitoring as we don't need it for EPT. */
1615 pVCpu->hwaccm.s.vmx.proc_ctls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1616 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
1617 }
1618 else
1619 {
1620 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
1621 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
1622 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
1623 }
1624 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1625 AssertRC(rc);
1626 }
1627 else
1628 {
1629 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
1630 val |= X86_CR0_WP;
1631 }
1632
1633 /* Always enable caching. */
1634 val &= ~(X86_CR0_CD|X86_CR0_NW);
1635
1636 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_CR0, val);
1637 Log2(("Guest CR0 %08x\n", val));
1638 /* CR0 flags owned by the host; if the guests attempts to change them, then
1639 * the VM will exit.
1640 */
1641 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1642 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1643 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1644 | X86_CR0_CD /* Bit not restored during VM-exit! */
1645 | X86_CR0_NW /* Bit not restored during VM-exit! */
1646 | X86_CR0_NE;
1647
1648 /* When the guest's FPU state is active, then we no longer care about
1649 * the FPU related bits.
1650 */
1651 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
1652 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_MP;
1653
1654 pVCpu->hwaccm.s.vmx.cr0_mask = val;
1655
1656 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1657 Log2(("Guest CR0-mask %08x\n", val));
1658 AssertRC(rc);
1659 }
1660 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1661 {
1662 /* CR4 */
1663 rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1664 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1665 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1666 val = pCtx->cr4 | (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1667
1668 if (!pVM->hwaccm.s.fNestedPaging)
1669 {
1670 switch(pVCpu->hwaccm.s.enmShadowMode)
1671 {
1672 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1673 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1674 case PGMMODE_32_BIT: /* 32-bit paging. */
1675 val &= ~X86_CR4_PAE;
1676 break;
1677
1678 case PGMMODE_PAE: /* PAE paging. */
1679 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1680 /** Must use PAE paging as we could use physical memory > 4 GB */
1681 val |= X86_CR4_PAE;
1682 break;
1683
1684 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1685 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1686#ifdef VBOX_ENABLE_64_BITS_GUESTS
1687 break;
1688#else
1689 AssertFailed();
1690 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1691#endif
1692 default: /* shut up gcc */
1693 AssertFailed();
1694 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1695 }
1696 }
1697 else
1698 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
1699 && !pVM->hwaccm.s.vmx.fUnrestrictedGuest)
1700 {
1701 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
1702 val |= X86_CR4_PSE;
1703 /* Our identity mapping is a 32 bits page directory. */
1704 val &= ~X86_CR4_PAE;
1705 }
1706
1707 /* Turn off VME if we're in emulated real mode. */
1708 if ( CPUMIsGuestInRealModeEx(pCtx)
1709 && pVM->hwaccm.s.vmx.pRealModeTSS)
1710 val &= ~X86_CR4_VME;
1711
1712 rc |= VMXWriteVMCS64(VMX_VMCS64_GUEST_CR4, val);
1713 Log2(("Guest CR4 %08x\n", val));
1714 /* CR4 flags owned by the host; if the guests attempts to change them, then
1715 * the VM will exit.
1716 */
1717 val = 0
1718 | X86_CR4_VME
1719 | X86_CR4_PAE
1720 | X86_CR4_PGE
1721 | X86_CR4_PSE
1722 | X86_CR4_VMXE;
1723 pVCpu->hwaccm.s.vmx.cr4_mask = val;
1724
1725 rc |= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1726 Log2(("Guest CR4-mask %08x\n", val));
1727 AssertRC(rc);
1728 }
1729
1730#if 0
1731 /* Enable single stepping if requested and CPU supports it. */
1732 if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG)
1733 if (DBGFIsStepping(pVCpu))
1734 {
1735 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
1736 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1737 AssertRC(rc);
1738 }
1739#endif
1740
1741 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1742 {
1743 if (pVM->hwaccm.s.fNestedPaging)
1744 {
1745 Assert(PGMGetHyperCR3(pVCpu));
1746 pVCpu->hwaccm.s.vmx.GCPhysEPTP = PGMGetHyperCR3(pVCpu);
1747
1748 Assert(!(pVCpu->hwaccm.s.vmx.GCPhysEPTP & 0xfff));
1749 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
1750 pVCpu->hwaccm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
1751 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
1752
1753 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_EPTP_FULL, pVCpu->hwaccm.s.vmx.GCPhysEPTP);
1754 AssertRC(rc);
1755
1756 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
1757 && !pVM->hwaccm.s.vmx.fUnrestrictedGuest)
1758 {
1759 RTGCPHYS GCPhys;
1760
1761 /* We convert it here every time as pci regions could be reconfigured. */
1762 rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1763 AssertMsgRC(rc, ("pNonPagingModeEPTPageTable = %RGv\n", pVM->hwaccm.s.vmx.pNonPagingModeEPTPageTable));
1764
1765 /* We use our identity mapping page table here as we need to map guest virtual to guest physical addresses; EPT will
1766 * take care of the translation to host physical addresses.
1767 */
1768 val = GCPhys;
1769 }
1770 else
1771 {
1772 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
1773 val = pCtx->cr3;
1774 rc = hmR0VmxLoadPaePdpes(pVCpu, pCtx);
1775 AssertRCReturn(rc, rc);
1776 }
1777 }
1778 else
1779 {
1780 val = PGMGetHyperCR3(pVCpu);
1781 Assert(val || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
1782 }
1783
1784 /* Save our shadow CR3 register. */
1785 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_CR3, val);
1786 AssertRC(rc);
1787 }
1788
1789 /* Debug registers. */
1790 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1791 {
1792 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1793 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1794
1795 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1796 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
1797 pCtx->dr[7] |= 0x400; /* must be one */
1798
1799 /* Resync DR7 */
1800 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_DR7, pCtx->dr[7]);
1801 AssertRC(rc);
1802
1803#ifdef DEBUG
1804 /* Sync the hypervisor debug state now if any breakpoint is armed. */
1805 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
1806 && !CPUMIsHyperDebugStateActive(pVCpu)
1807 && !DBGFIsStepping(pVCpu))
1808 {
1809 /* Save the host and load the hypervisor debug state. */
1810 rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1811 AssertRC(rc);
1812
1813 /* DRx intercepts remain enabled. */
1814
1815 /* Override dr7 with the hypervisor value. */
1816 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_DR7, CPUMGetHyperDR7(pVCpu));
1817 AssertRC(rc);
1818 }
1819 else
1820#endif
1821 /* Sync the debug state now if any breakpoint is armed. */
1822 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
1823 && !CPUMIsGuestDebugStateActive(pVCpu)
1824 && !DBGFIsStepping(pVCpu))
1825 {
1826 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
1827
1828 /* Disable drx move intercepts. */
1829 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1830 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1831 AssertRC(rc);
1832
1833 /* Save the host and load the guest debug state. */
1834 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
1835 AssertRC(rc);
1836 }
1837
1838 /* IA32_DEBUGCTL MSR. */
1839 rc = VMXWriteVMCS64(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1840 AssertRC(rc);
1841
1842 /** @todo do we really ever need this? */
1843 rc |= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1844 AssertRC(rc);
1845 }
1846
1847 /* 64 bits guest mode? */
1848 if (CPUMIsGuestInLongModeEx(pCtx))
1849 {
1850#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
1851 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1852#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1853 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
1854#else
1855# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1856 if (!pVM->hwaccm.s.fAllow64BitGuests)
1857 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1858# endif
1859 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1860#endif
1861 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_MSR)
1862 {
1863 /* Update these as wrmsr might have changed them. */
1864 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1865 AssertRC(rc);
1866 rc = VMXWriteVMCS64(VMX_VMCS64_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1867 AssertRC(rc);
1868 }
1869 }
1870 else
1871 {
1872 pVCpu->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1873 }
1874
1875 hmR0VmxUpdateExceptionBitmap(pVM, pVCpu, pCtx);
1876
1877#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1878 /* Store all guest MSRs in the VM-Entry load area, so they will be loaded during the world switch. */
1879 PVMXMSR pMsr = (PVMXMSR)pVCpu->hwaccm.s.vmx.pGuestMSR;
1880 unsigned idxMsr = 0;
1881
1882 uint32_t ulEdx;
1883 uint32_t ulTemp;
1884 CPUMGetGuestCpuId(pVCpu, 0x80000001, &ulTemp, &ulTemp, &ulTemp, &ulEdx);
1885 /* EFER MSR present? */
1886 if (ulEdx & (X86_CPUID_AMD_FEATURE_EDX_NX|X86_CPUID_AMD_FEATURE_EDX_LONG_MODE))
1887 {
1888 pMsr->u32IndexMSR = MSR_K6_EFER;
1889 pMsr->u32Reserved = 0;
1890 pMsr->u64Value = pCtx->msrEFER;
1891 /* VT-x will complain if only MSR_K6_EFER_LME is set. */
1892 if (!CPUMIsGuestInLongModeEx(pCtx))
1893 pMsr->u64Value &= ~(MSR_K6_EFER_LMA|MSR_K6_EFER_LME);
1894 pMsr++; idxMsr++;
1895
1896 if (ulEdx & X86_CPUID_AMD_FEATURE_EDX_LONG_MODE)
1897 {
1898 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1899 pMsr->u32Reserved = 0;
1900 pMsr->u64Value = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
1901 pMsr++; idxMsr++;
1902 pMsr->u32IndexMSR = MSR_K6_STAR;
1903 pMsr->u32Reserved = 0;
1904 pMsr->u64Value = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
1905 pMsr++; idxMsr++;
1906 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1907 pMsr->u32Reserved = 0;
1908 pMsr->u64Value = pCtx->msrSFMASK; /* syscall flag mask */
1909 pMsr++; idxMsr++;
1910 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1911 pMsr->u32Reserved = 0;
1912 pMsr->u64Value = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
1913 pMsr++; idxMsr++;
1914 }
1915 }
1916 pVCpu->hwaccm.s.vmx.cCachedMSRs = idxMsr;
1917
1918 rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_MSR_LOAD_COUNT, idxMsr);
1919 AssertRC(rc);
1920
1921 rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, idxMsr);
1922 AssertRC(rc);
1923#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1924
1925 bool fOffsettedTsc;
1926 if (pVM->hwaccm.s.vmx.fUsePreemptTimer)
1927 {
1928 uint64_t cTicksToDeadline = TMCpuTickGetDeadlineAndTscOffset(pVCpu, &fOffsettedTsc, &pVCpu->hwaccm.s.vmx.u64TSCOffset);
1929
1930 /* Make sure the returned values have sane upper and lower boundaries. */
1931 uint64_t u64CpuHz = SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage);
1932
1933 cTicksToDeadline = RT_MIN(cTicksToDeadline, u64CpuHz / 64); /* 1/64 of a second */
1934 cTicksToDeadline = RT_MAX(cTicksToDeadline, u64CpuHz / 2048); /* 1/2048th of a second */
1935
1936 cTicksToDeadline >>= pVM->hwaccm.s.vmx.cPreemptTimerShift;
1937 uint32_t cPreemptionTickCount = (uint32_t)RT_MIN(cTicksToDeadline, UINT32_MAX - 16);
1938 rc = VMXWriteVMCS(VMX_VMCS32_GUEST_PREEMPTION_TIMER_VALUE, cPreemptionTickCount);
1939 AssertRC(rc);
1940 }
1941 else
1942 fOffsettedTsc = TMCpuTickCanUseRealTSC(pVCpu, &pVCpu->hwaccm.s.vmx.u64TSCOffset);
1943 if (fOffsettedTsc)
1944 {
1945 uint64_t u64CurTSC = ASMReadTSC();
1946 if (u64CurTSC + pVCpu->hwaccm.s.vmx.u64TSCOffset >= TMCpuTickGetLastSeen(pVCpu))
1947 {
1948 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1949 rc = VMXWriteVMCS64(VMX_VMCS_CTRL_TSC_OFFSET_FULL, pVCpu->hwaccm.s.vmx.u64TSCOffset);
1950 AssertRC(rc);
1951
1952 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1953 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1954 AssertRC(rc);
1955 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
1956 }
1957 else
1958 {
1959 /* Fall back to rdtsc emulation as we would otherwise pass decreasing tsc values to the guest. */
1960 LogFlow(("TSC %RX64 offset %RX64 time=%RX64 last=%RX64 (diff=%RX64, virt_tsc=%RX64)\n", u64CurTSC, pVCpu->hwaccm.s.vmx.u64TSCOffset, u64CurTSC + pVCpu->hwaccm.s.vmx.u64TSCOffset, TMCpuTickGetLastSeen(pVCpu), TMCpuTickGetLastSeen(pVCpu) - u64CurTSC - pVCpu->hwaccm.s.vmx.u64TSCOffset, TMCpuTickGet(pVCpu)));
1961 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1962 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1963 AssertRC(rc);
1964 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCInterceptOverFlow);
1965 }
1966 }
1967 else
1968 {
1969 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1970 rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
1971 AssertRC(rc);
1972 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
1973 }
1974
1975 /* Done with the major changes */
1976 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1977
1978 /* Minimal guest state update (esp, eip, eflags mostly) */
1979 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
1980 return rc;
1981}
1982
1983/**
1984 * Syncs back the guest state
1985 *
1986 * @returns VBox status code.
1987 * @param pVM The VM to operate on.
1988 * @param pVCpu The VMCPU to operate on.
1989 * @param pCtx Guest context
1990 */
1991DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1992{
1993 RTGCUINTREG val, valShadow;
1994 RTGCUINTPTR uInterruptState;
1995 int rc;
1996
1997 /* Let's first sync back eip, esp, and eflags. */
1998 rc = VMXReadCachedVMCS(VMX_VMCS64_GUEST_RIP, &val);
1999 AssertRC(rc);
2000 pCtx->rip = val;
2001 rc = VMXReadCachedVMCS(VMX_VMCS64_GUEST_RSP, &val);
2002 AssertRC(rc);
2003 pCtx->rsp = val;
2004 rc = VMXReadCachedVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2005 AssertRC(rc);
2006 pCtx->eflags.u32 = val;
2007
2008 /* Take care of instruction fusing (sti, mov ss) */
2009 rc |= VMXReadCachedVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
2010 uInterruptState = val;
2011 if (uInterruptState != 0)
2012 {
2013 Assert(uInterruptState <= 2); /* only sti & mov ss */
2014 Log(("uInterruptState %x eip=%RGv\n", (uint32_t)uInterruptState, pCtx->rip));
2015 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
2016 }
2017 else
2018 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2019
2020 /* Control registers. */
2021 VMXReadCachedVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
2022 VMXReadCachedVMCS(VMX_VMCS64_GUEST_CR0, &val);
2023 val = (valShadow & pVCpu->hwaccm.s.vmx.cr0_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr0_mask);
2024 CPUMSetGuestCR0(pVCpu, val);
2025
2026 VMXReadCachedVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
2027 VMXReadCachedVMCS(VMX_VMCS64_GUEST_CR4, &val);
2028 val = (valShadow & pVCpu->hwaccm.s.vmx.cr4_mask) | (val & ~pVCpu->hwaccm.s.vmx.cr4_mask);
2029 CPUMSetGuestCR4(pVCpu, val);
2030
2031 /* Note: no reason to sync back the CRx registers. They can't be changed by the guest. */
2032 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
2033 if ( pVM->hwaccm.s.fNestedPaging
2034 && CPUMIsGuestInPagedProtectedModeEx(pCtx)) /** @todo check if we will always catch mode switches and such... */
2035 {
2036 PVMCSCACHE pCache = &pVCpu->hwaccm.s.vmx.VMCSCache;
2037
2038 /* Can be updated behind our back in the nested paging case. */
2039 CPUMSetGuestCR2(pVCpu, pCache->cr2);
2040
2041 VMXReadCachedVMCS(VMX_VMCS64_GUEST_CR3, &val);
2042
2043 if (val != pCtx->cr3)
2044 {
2045 CPUMSetGuestCR3(pVCpu, val);
2046 PGMUpdateCR3(pVCpu, val);
2047 }
2048 rc = hmR0VmxSavePaePdpes(pVCpu, pCtx);
2049 AssertRCReturn(rc, rc);
2050 }
2051
2052 /* Sync back DR7 here. */
2053 VMXReadCachedVMCS(VMX_VMCS64_GUEST_DR7, &val);
2054 pCtx->dr[7] = val;
2055
2056 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
2057 VMX_READ_SELREG(ES, es);
2058 VMX_READ_SELREG(SS, ss);
2059 VMX_READ_SELREG(CS, cs);
2060 VMX_READ_SELREG(DS, ds);
2061 VMX_READ_SELREG(FS, fs);
2062 VMX_READ_SELREG(GS, gs);
2063
2064 /*
2065 * System MSRs
2066 */
2067 VMXReadCachedVMCS(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
2068 pCtx->SysEnter.cs = val;
2069 VMXReadCachedVMCS(VMX_VMCS64_GUEST_SYSENTER_EIP, &val);
2070 pCtx->SysEnter.eip = val;
2071 VMXReadCachedVMCS(VMX_VMCS64_GUEST_SYSENTER_ESP, &val);
2072 pCtx->SysEnter.esp = val;
2073
2074 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
2075 VMX_READ_SELREG(LDTR, ldtr);
2076
2077 VMXReadCachedVMCS(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
2078 pCtx->gdtr.cbGdt = val;
2079 VMXReadCachedVMCS(VMX_VMCS64_GUEST_GDTR_BASE, &val);
2080 pCtx->gdtr.pGdt = val;
2081
2082 VMXReadCachedVMCS(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
2083 pCtx->idtr.cbIdt = val;
2084 VMXReadCachedVMCS(VMX_VMCS64_GUEST_IDTR_BASE, &val);
2085 pCtx->idtr.pIdt = val;
2086
2087 /* Real mode emulation using v86 mode. */
2088 if ( CPUMIsGuestInRealModeEx(pCtx)
2089 && pVM->hwaccm.s.vmx.pRealModeTSS)
2090 {
2091 /* Hide our emulation flags */
2092 pCtx->eflags.Bits.u1VM = 0;
2093
2094 /* Restore original IOPL setting as we always use 0. */
2095 pCtx->eflags.Bits.u2IOPL = pVCpu->hwaccm.s.vmx.RealMode.eflags.Bits.u2IOPL;
2096
2097 /* Force a TR resync every time in case we switch modes. */
2098 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_TR;
2099 }
2100 else
2101 {
2102 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
2103 VMX_READ_SELREG(TR, tr);
2104 }
2105
2106#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2107 /* Save the possibly changed MSRs that we automatically restore and save during a world switch. */
2108 for (unsigned i = 0; i < pVCpu->hwaccm.s.vmx.cCachedMSRs; i++)
2109 {
2110 PVMXMSR pMsr = (PVMXMSR)pVCpu->hwaccm.s.vmx.pGuestMSR;
2111 pMsr += i;
2112
2113 switch (pMsr->u32IndexMSR)
2114 {
2115 case MSR_K8_LSTAR:
2116 pCtx->msrLSTAR = pMsr->u64Value;
2117 break;
2118 case MSR_K6_STAR:
2119 pCtx->msrSTAR = pMsr->u64Value;
2120 break;
2121 case MSR_K8_SF_MASK:
2122 pCtx->msrSFMASK = pMsr->u64Value;
2123 break;
2124 case MSR_K8_KERNEL_GS_BASE:
2125 pCtx->msrKERNELGSBASE = pMsr->u64Value;
2126 break;
2127 case MSR_K6_EFER:
2128 /* EFER can't be changed without causing a VM-exit. */
2129// Assert(pCtx->msrEFER == pMsr->u64Value);
2130 break;
2131 default:
2132 AssertFailed();
2133 return VERR_HM_UNEXPECTED_LD_ST_MSR;
2134 }
2135 }
2136#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2137 return VINF_SUCCESS;
2138}
2139
2140/**
2141 * Dummy placeholder
2142 *
2143 * @param pVM The VM to operate on.
2144 * @param pVCpu The VMCPU to operate on.
2145 */
2146static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu)
2147{
2148 NOREF(pVM);
2149 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH);
2150 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2151 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
2152 return;
2153}
2154
2155
2156/**
2157 * Setup the tagged TLB for EPT+VPID.
2158 *
2159 * @param pVM The VM to operate on.
2160 * @param pVCpu The VMCPU to operate on.
2161 */
2162static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu)
2163{
2164 PHMGLOBLCPUINFO pCpu;
2165
2166 Assert(pVM->hwaccm.s.fNestedPaging && pVM->hwaccm.s.vmx.fVPID);
2167
2168 pCpu = HWACCMR0GetCurrentCpu();
2169
2170 /*
2171 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2172 * This can happen both for start & resume due to long jumps back to ring-3.
2173 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB,
2174 * so we cannot reuse the current ASID anymore.
2175 */
2176 bool fNewASID = false;
2177 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
2178 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
2179 {
2180 pVCpu->hwaccm.s.fForceTLBFlush = true;
2181 fNewASID = true;
2182 }
2183
2184 /*
2185 * Check for explicit TLB shootdowns.
2186 */
2187 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2188 pVCpu->hwaccm.s.fForceTLBFlush = true;
2189
2190 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
2191 pCpu->fFlushTLB = false;
2192
2193#ifdef VBOX_WITH_STATISTICS
2194 if (pVCpu->hwaccm.s.fForceTLBFlush)
2195 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
2196 else
2197 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
2198#endif
2199
2200 if (pVCpu->hwaccm.s.fForceTLBFlush)
2201 {
2202 if (fNewASID)
2203 {
2204 ++pCpu->uCurrentASID;
2205 if (pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID)
2206 {
2207 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
2208 pCpu->cTLBFlushes++;
2209 }
2210
2211 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
2212 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushVPID, 0 /* GCPtr */);
2213 }
2214 else
2215 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushEPT);
2216
2217 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
2218 pVCpu->hwaccm.s.fForceTLBFlush = false;
2219 }
2220 else
2221 {
2222 Assert(pVCpu->hwaccm.s.uCurrentASID && pCpu->uCurrentASID);
2223
2224 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2225 * not be executed. See hwaccmQueueInvlPage() where it is commented
2226 * out. Support individual entry flushing someday. */
2227 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2228 {
2229 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTlbShootdown);
2230
2231 /*
2232 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2233 * as supported by the CPU.
2234 */
2235 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV_ADDR)
2236 {
2237 for (unsigned i = 0; i < pVCpu->hwaccm.s.TlbShootdown.cPages; i++)
2238 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hwaccm.s.TlbShootdown.aPages[i]);
2239 }
2240 else
2241 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushEPT);
2242 }
2243 }
2244 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
2245 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2246
2247 Assert(pCpu->fFlushTLB == false);
2248 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes,
2249 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
2250 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID,
2251 ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
2252 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID,
2253 ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
2254
2255 /* Update VMCS with the VPID. */
2256 int rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
2257 AssertRC(rc);
2258}
2259
2260
2261/**
2262 * Setup the tagged TLB for EPT only.
2263 *
2264 * @returns VBox status code.
2265 * @param pVM The VM to operate on.
2266 * @param pVCpu The VMCPU to operate on.
2267 */
2268static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu)
2269{
2270 PHMGLOBLCPUINFO pCpu;
2271
2272 Assert(pVM->hwaccm.s.fNestedPaging);
2273 Assert(!pVM->hwaccm.s.vmx.fVPID);
2274
2275 /* Deal with tagged TLBs if VPID or EPT is supported. */
2276 pCpu = HWACCMR0GetCurrentCpu();
2277 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
2278 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
2279 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
2280 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
2281 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
2282 {
2283 /* Force a TLB flush on VM entry. */
2284 pVCpu->hwaccm.s.fForceTLBFlush = true;
2285 }
2286 /* Disabled because this has triggered every time I have suspended my
2287 * laptop with a VM running for the past three months or more. */
2288 // else
2289 // Assert(!pCpu->fFlushTLB);
2290
2291 /* Check for tlb shootdown flushes. */
2292 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2293 pVCpu->hwaccm.s.fForceTLBFlush = true;
2294
2295 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
2296 pCpu->fFlushTLB = false;
2297
2298 if (pVCpu->hwaccm.s.fForceTLBFlush)
2299 {
2300 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushEPT);
2301 }
2302 else
2303 {
2304 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2305 * not be executed. See hwaccmQueueInvlPage() where it is commented
2306 * out. Support individual entry flushing someday. */
2307 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2308 {
2309 /*
2310 * We cannot flush individual entries without VPID support. Flush using EPT.
2311 */
2312 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTlbShootdown);
2313 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushEPT);
2314 }
2315 }
2316 pVCpu->hwaccm.s.TlbShootdown.cPages= 0;
2317 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2318
2319#ifdef VBOX_WITH_STATISTICS
2320 if (pVCpu->hwaccm.s.fForceTLBFlush)
2321 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
2322 else
2323 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
2324#endif
2325}
2326
2327
2328/**
2329 * Setup the tagged TLB for VPID
2330 *
2331 * @returns VBox status code.
2332 * @param pVM The VM to operate on.
2333 * @param pVCpu The VMCPU to operate on.
2334 */
2335static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu)
2336{
2337 PHMGLOBLCPUINFO pCpu;
2338
2339 Assert(pVM->hwaccm.s.vmx.fVPID);
2340 Assert(!pVM->hwaccm.s.fNestedPaging);
2341
2342 /* Deal with tagged TLBs if VPID or EPT is supported. */
2343 pCpu = HWACCMR0GetCurrentCpu();
2344 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
2345 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
2346 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
2347 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
2348 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
2349 {
2350 /* Force a TLB flush on VM entry. */
2351 pVCpu->hwaccm.s.fForceTLBFlush = true;
2352 }
2353 else
2354 Assert(!pCpu->fFlushTLB);
2355
2356 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
2357
2358 /* Check for tlb shootdown flushes. */
2359 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2360 pVCpu->hwaccm.s.fForceTLBFlush = true;
2361
2362 /* Make sure we flush the TLB when required. */
2363 if (pVCpu->hwaccm.s.fForceTLBFlush)
2364 {
2365 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
2366 || pCpu->fFlushTLB)
2367 {
2368 pCpu->fFlushTLB = false;
2369 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
2370 pCpu->cTLBFlushes++;
2371 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushVPID, 0 /* GCPtr */);
2372 }
2373 else
2374 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
2375
2376 pVCpu->hwaccm.s.fForceTLBFlush = false;
2377 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
2378 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
2379 }
2380 else
2381 {
2382 Assert(!pCpu->fFlushTLB);
2383 Assert(pVCpu->hwaccm.s.uCurrentASID && pCpu->uCurrentASID);
2384
2385 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2386 * not be executed. See hwaccmQueueInvlPage() where it is commented
2387 * out. Support individual entry flushing someday. */
2388 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2389 {
2390 /*
2391 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2392 * as supported by the CPU.
2393 */
2394 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV_ADDR)
2395 {
2396 for (unsigned i = 0; i < pVCpu->hwaccm.s.TlbShootdown.cPages; i++)
2397 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hwaccm.s.TlbShootdown.aPages[i]);
2398 }
2399 else
2400 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushVPID, 0 /* GCPtr */);
2401 }
2402 }
2403 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
2404 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2405
2406 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
2407 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
2408 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
2409
2410 int rc = VMXWriteVMCS(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hwaccm.s.uCurrentASID);
2411 AssertRC(rc);
2412
2413 if (pVCpu->hwaccm.s.fForceTLBFlush)
2414 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hwaccm.s.vmx.enmFlushVPID, 0 /* GCPtr */);
2415
2416# ifdef VBOX_WITH_STATISTICS
2417 if (pVCpu->hwaccm.s.fForceTLBFlush)
2418 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
2419 else
2420 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
2421# endif
2422}
2423
2424
2425/**
2426 * Runs guest code in a VT-x VM.
2427 *
2428 * @returns VBox status code.
2429 * @param pVM The VM to operate on.
2430 * @param pVCpu The VMCPU to operate on.
2431 * @param pCtx Guest context
2432 */
2433VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2434{
2435 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
2436 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hwaccm.s.StatExit1);
2437 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hwaccm.s.StatExit2);
2438
2439 VBOXSTRICTRC rc = VINF_SUCCESS;
2440 int rc2;
2441 RTGCUINTREG val;
2442 RTGCUINTREG exitReason = (RTGCUINTREG)VMX_EXIT_INVALID;
2443 RTGCUINTREG instrError, cbInstr;
2444 RTGCUINTPTR exitQualification = 0;
2445 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
2446 RTGCUINTPTR errCode, instrInfo;
2447 bool fSetupTPRCaching = false;
2448 uint64_t u64OldLSTAR = 0;
2449 uint8_t u8LastTPR = 0;
2450 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
2451 unsigned cResume = 0;
2452#ifdef VBOX_STRICT
2453 RTCPUID idCpuCheck;
2454 bool fWasInLongMode = false;
2455#endif
2456#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2457 uint64_t u64LastTime = RTTimeMilliTS();
2458#endif
2459
2460 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC) || (pVCpu->hwaccm.s.vmx.pbVAPIC && pVM->hwaccm.s.vmx.pAPIC));
2461
2462 /* Check if we need to use TPR shadowing. */
2463 if ( CPUMIsGuestInLongModeEx(pCtx)
2464 || ( ((pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC) || pVM->hwaccm.s.fTRPPatchingAllowed)
2465 && pVM->hwaccm.s.fHasIoApic)
2466 )
2467 {
2468 fSetupTPRCaching = true;
2469 }
2470
2471 Log2(("\nE"));
2472
2473#ifdef VBOX_STRICT
2474 {
2475 RTCCUINTREG val2;
2476
2477 rc2 = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val2);
2478 AssertRC(rc2);
2479 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val2));
2480
2481 /* allowed zero */
2482 if ((val2 & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
2483 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
2484
2485 /* allowed one */
2486 if ((val2 & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
2487 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
2488
2489 rc2 = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val2);
2490 AssertRC(rc2);
2491 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val2));
2492
2493 /* Must be set according to the MSR, but can be cleared in case of EPT. */
2494 if (pVM->hwaccm.s.fNestedPaging)
2495 val2 |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
2496 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2497 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2498
2499 /* allowed zero */
2500 if ((val2 & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
2501 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
2502
2503 /* allowed one */
2504 if ((val2 & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
2505 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
2506
2507 rc2 = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val2);
2508 AssertRC(rc2);
2509 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val2));
2510
2511 /* allowed zero */
2512 if ((val2 & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
2513 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
2514
2515 /* allowed one */
2516 if ((val2 & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
2517 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
2518
2519 rc2 = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val2);
2520 AssertRC(rc2);
2521 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val2));
2522
2523 /* allowed zero */
2524 if ((val2 & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
2525 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
2526
2527 /* allowed one */
2528 if ((val2 & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
2529 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
2530 }
2531 fWasInLongMode = CPUMIsGuestInLongModeEx(pCtx);
2532#endif /* VBOX_STRICT */
2533
2534#ifdef VBOX_WITH_CRASHDUMP_MAGIC
2535 pVCpu->hwaccm.s.vmx.VMCSCache.u64TimeEntry = RTTimeNanoTS();
2536#endif
2537
2538 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
2539 */
2540ResumeExecution:
2541 if (!STAM_REL_PROFILE_ADV_IS_RUNNING(&pVCpu->hwaccm.s.StatEntry))
2542 STAM_REL_PROFILE_ADV_STOP_START(&pVCpu->hwaccm.s.StatExit2, &pVCpu->hwaccm.s.StatEntry, x);
2543 AssertMsg(pVCpu->hwaccm.s.idEnteredCpu == RTMpCpuId(),
2544 ("Expected %d, I'm %d; cResume=%d exitReason=%RGv exitQualification=%RGv\n",
2545 (int)pVCpu->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
2546 Assert(!HWACCMR0SuspendPending());
2547 /* Not allowed to switch modes without reloading the host state (32->64 switcher)!! */
2548 Assert(fWasInLongMode == CPUMIsGuestInLongModeEx(pCtx));
2549
2550 /* Safety precaution; looping for too long here can have a very bad effect on the host */
2551 if (RT_UNLIKELY(++cResume > pVM->hwaccm.s.cMaxResumeLoops))
2552 {
2553 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
2554 rc = VINF_EM_RAW_INTERRUPT;
2555 goto end;
2556 }
2557
2558 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
2559 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
2560 {
2561 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
2562 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
2563 {
2564 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
2565 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
2566 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
2567 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
2568 */
2569 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2570 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
2571 rc2 = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
2572 AssertRC(rc2);
2573 }
2574 }
2575 else
2576 {
2577 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
2578 rc2 = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
2579 AssertRC(rc2);
2580 }
2581
2582#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2583 if (RT_UNLIKELY((cResume & 0xf) == 0))
2584 {
2585 uint64_t u64CurTime = RTTimeMilliTS();
2586
2587 if (RT_UNLIKELY(u64CurTime > u64LastTime))
2588 {
2589 u64LastTime = u64CurTime;
2590 TMTimerPollVoid(pVM, pVCpu);
2591 }
2592 }
2593#endif
2594
2595 /* Check for pending actions that force us to go back to ring 3. */
2596 if ( VM_FF_ISPENDING(pVM, VM_FF_HWACCM_TO_R3_MASK | VM_FF_REQUEST | VM_FF_PGM_POOL_FLUSH_PENDING | VM_FF_PDM_DMA)
2597 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HWACCM_TO_R3_MASK | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL | VMCPU_FF_REQUEST))
2598 {
2599 /* Check if a sync operation is pending. */
2600 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
2601 {
2602 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
2603 if (rc != VINF_SUCCESS)
2604 {
2605 AssertRC(VBOXSTRICTRC_VAL(rc));
2606 Log(("Pending pool sync is forcing us back to ring 3; rc=%d\n", VBOXSTRICTRC_VAL(rc)));
2607 goto end;
2608 }
2609 }
2610
2611#ifdef DEBUG
2612 /* Intercept X86_XCPT_DB if stepping is enabled */
2613 if (!DBGFIsStepping(pVCpu))
2614#endif
2615 {
2616 if ( VM_FF_ISPENDING(pVM, VM_FF_HWACCM_TO_R3_MASK)
2617 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HWACCM_TO_R3_MASK))
2618 {
2619 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
2620 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
2621 goto end;
2622 }
2623 }
2624
2625 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
2626 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
2627 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
2628 {
2629 rc = VINF_EM_PENDING_REQUEST;
2630 goto end;
2631 }
2632
2633 /* Check if a pgm pool flush is in progress. */
2634 if (VM_FF_ISPENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
2635 {
2636 rc = VINF_PGM_POOL_FLUSH_PENDING;
2637 goto end;
2638 }
2639
2640 /* Check if DMA work is pending (2nd+ run). */
2641 if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA) && cResume > 1)
2642 {
2643 rc = VINF_EM_RAW_TO_R3;
2644 goto end;
2645 }
2646 }
2647
2648#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2649 /*
2650 * Exit to ring-3 preemption/work is pending.
2651 *
2652 * Interrupts are disabled before the call to make sure we don't miss any interrupt
2653 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
2654 * further down, but hmR0VmxCheckPendingInterrupt makes that impossible.)
2655 *
2656 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
2657 * shootdowns rely on this.
2658 */
2659 uOldEFlags = ASMIntDisableFlags();
2660 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
2661 {
2662 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPreemptPending);
2663 rc = VINF_EM_RAW_INTERRUPT;
2664 goto end;
2665 }
2666 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
2667#endif
2668
2669 /* When external interrupts are pending, we should exit the VM when IF is set. */
2670 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
2671 rc = hmR0VmxCheckPendingInterrupt(pVM, pVCpu, pCtx);
2672 if (RT_FAILURE(rc))
2673 goto end;
2674
2675 /** @todo check timers?? */
2676
2677 /* TPR caching using CR8 is only available in 64 bits mode */
2678 /* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
2679 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! (no longer true) */
2680 /**
2681 * @todo query and update the TPR only when it could have been changed (mmio access & wrmsr (x2apic))
2682 */
2683 if (fSetupTPRCaching)
2684 {
2685 /* TPR caching in CR8 */
2686 bool fPending;
2687
2688 rc2 = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
2689 AssertRC(rc2);
2690 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
2691 pVCpu->hwaccm.s.vmx.pbVAPIC[0x80] = u8LastTPR;
2692
2693 /* Two options here:
2694 * - external interrupt pending, but masked by the TPR value.
2695 * -> a CR8 update that lower the current TPR value should cause an exit
2696 * - no pending interrupts
2697 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
2698 */
2699 rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? (u8LastTPR >> 4) : 0); /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
2700 AssertRC(VBOXSTRICTRC_VAL(rc));
2701
2702 if (pVM->hwaccm.s.fTPRPatchingActive)
2703 {
2704 Assert(!CPUMIsGuestInLongModeEx(pCtx));
2705 /* Our patch code uses LSTAR for TPR caching. */
2706 pCtx->msrLSTAR = u8LastTPR;
2707
2708 if (fPending)
2709 {
2710 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
2711 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
2712 }
2713 else
2714 {
2715 /* No interrupts are pending, so we don't need to be explicitely notified.
2716 * There are enough world switches for detecting pending interrupts.
2717 */
2718 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
2719 }
2720 }
2721 }
2722
2723#ifdef LOG_ENABLED
2724 if ( pVM->hwaccm.s.fNestedPaging
2725 || pVM->hwaccm.s.vmx.fVPID)
2726 {
2727 PHMGLOBLCPUINFO pCpu = HWACCMR0GetCurrentCpu();
2728 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
2729 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
2730 {
2731 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
2732 LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
2733 else
2734 LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
2735 }
2736 if (pCpu->fFlushTLB)
2737 LogFlow(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
2738 else if (pVCpu->hwaccm.s.fForceTLBFlush)
2739 LogFlow(("Manual TLB flush\n"));
2740 }
2741#endif
2742#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
2743 PGMRZDynMapFlushAutoSet(pVCpu);
2744#endif
2745
2746 /*
2747 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
2748 * (until the actual world switch)
2749 */
2750#ifdef VBOX_STRICT
2751 idCpuCheck = RTMpCpuId();
2752#endif
2753#ifdef LOG_ENABLED
2754 VMMR0LogFlushDisable(pVCpu);
2755#endif
2756 /* Save the host state first. */
2757 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
2758 {
2759 rc = VMXR0SaveHostState(pVM, pVCpu);
2760 if (RT_UNLIKELY(rc != VINF_SUCCESS))
2761 {
2762 VMMR0LogFlushEnable(pVCpu);
2763 goto end;
2764 }
2765 }
2766
2767 /* Load the guest state */
2768 if (!pVCpu->hwaccm.s.fContextUseFlags)
2769 {
2770 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
2771 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatLoadMinimal);
2772 }
2773 else
2774 {
2775 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
2776 if (RT_UNLIKELY(rc != VINF_SUCCESS))
2777 {
2778 VMMR0LogFlushEnable(pVCpu);
2779 goto end;
2780 }
2781 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatLoadFull);
2782 }
2783
2784#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2785 /* Disable interrupts to make sure a poke will interrupt execution.
2786 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
2787 */
2788 uOldEFlags = ASMIntDisableFlags();
2789 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
2790#endif
2791
2792 /* Non-register state Guest Context */
2793 /** @todo change me according to cpu state */
2794 rc2 = VMXWriteVMCS(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
2795 AssertRC(rc2);
2796
2797 /* Set TLB flush state as checked until we return from the world switch. */
2798 ASMAtomicWriteBool(&pVCpu->hwaccm.s.fCheckedTLBFlush, true);
2799 /* Deal with tagged TLB setup and invalidation. */
2800 pVM->hwaccm.s.vmx.pfnSetupTaggedTLB(pVM, pVCpu);
2801
2802 /* Manual save and restore:
2803 * - General purpose registers except RIP, RSP
2804 *
2805 * Trashed:
2806 * - CR2 (we don't care)
2807 * - LDTR (reset to 0)
2808 * - DRx (presumably not changed at all)
2809 * - DR7 (reset to 0x400)
2810 * - EFLAGS (reset to RT_BIT(1); not relevant)
2811 *
2812 */
2813
2814 /* All done! Let's start VM execution. */
2815 STAM_PROFILE_ADV_STOP_START(&pVCpu->hwaccm.s.StatEntry, &pVCpu->hwaccm.s.StatInGC, x);
2816 Assert(idCpuCheck == RTMpCpuId());
2817
2818#ifdef VBOX_WITH_CRASHDUMP_MAGIC
2819 pVCpu->hwaccm.s.vmx.VMCSCache.cResume = cResume;
2820 pVCpu->hwaccm.s.vmx.VMCSCache.u64TimeSwitch = RTTimeNanoTS();
2821#endif
2822
2823 /* Save the current TPR value in the LSTAR msr so our patches can access it. */
2824 if (pVM->hwaccm.s.fTPRPatchingActive)
2825 {
2826 Assert(pVM->hwaccm.s.fTPRPatchingActive);
2827 u64OldLSTAR = ASMRdMsr(MSR_K8_LSTAR);
2828 ASMWrMsr(MSR_K8_LSTAR, u8LastTPR);
2829 }
2830
2831 TMNotifyStartOfExecution(pVCpu);
2832#ifdef VBOX_WITH_KERNEL_USING_XMM
2833 rc = hwaccmR0VMXStartVMWrapXMM(pVCpu->hwaccm.s.fResumeVM, pCtx, &pVCpu->hwaccm.s.vmx.VMCSCache, pVM, pVCpu, pVCpu->hwaccm.s.vmx.pfnStartVM);
2834#else
2835 rc = pVCpu->hwaccm.s.vmx.pfnStartVM(pVCpu->hwaccm.s.fResumeVM, pCtx, &pVCpu->hwaccm.s.vmx.VMCSCache, pVM, pVCpu);
2836#endif
2837 ASMAtomicWriteBool(&pVCpu->hwaccm.s.fCheckedTLBFlush, false);
2838 ASMAtomicIncU32(&pVCpu->hwaccm.s.cWorldSwitchExits);
2839 /* Possibly the last TSC value seen by the guest (too high) (only when we're in tsc offset mode). */
2840 if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
2841 TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() + pVCpu->hwaccm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
2842
2843 TMNotifyEndOfExecution(pVCpu);
2844 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
2845 Assert(!(ASMGetFlags() & X86_EFL_IF));
2846
2847 /* Restore the host LSTAR msr if the guest could have changed it. */
2848 if (pVM->hwaccm.s.fTPRPatchingActive)
2849 {
2850 Assert(pVM->hwaccm.s.fTPRPatchingActive);
2851 pVCpu->hwaccm.s.vmx.pbVAPIC[0x80] = pCtx->msrLSTAR = ASMRdMsr(MSR_K8_LSTAR);
2852 ASMWrMsr(MSR_K8_LSTAR, u64OldLSTAR);
2853 }
2854
2855 STAM_PROFILE_ADV_STOP_START(&pVCpu->hwaccm.s.StatInGC, &pVCpu->hwaccm.s.StatExit1, x);
2856 ASMSetFlags(uOldEFlags);
2857#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2858 uOldEFlags = ~(RTCCUINTREG)0;
2859#endif
2860
2861 AssertMsg(!pVCpu->hwaccm.s.vmx.VMCSCache.Write.cValidEntries, ("pVCpu->hwaccm.s.vmx.VMCSCache.Write.cValidEntries=%d\n", pVCpu->hwaccm.s.vmx.VMCSCache.Write.cValidEntries));
2862
2863 /* In case we execute a goto ResumeExecution later on. */
2864 pVCpu->hwaccm.s.fResumeVM = true;
2865 pVCpu->hwaccm.s.fForceTLBFlush = false;
2866
2867 /*
2868 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2869 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
2870 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
2871 */
2872
2873 if (RT_UNLIKELY(rc != VINF_SUCCESS))
2874 {
2875 hmR0VmxReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
2876 VMMR0LogFlushEnable(pVCpu);
2877 goto end;
2878 }
2879
2880 /* Success. Query the guest state and figure out what has happened. */
2881
2882 /* Investigate why there was a VM-exit. */
2883 rc2 = VMXReadCachedVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
2884 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
2885
2886 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
2887 rc2 |= VMXReadCachedVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
2888 rc2 |= VMXReadCachedVMCS(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
2889 rc2 |= VMXReadCachedVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &intInfo);
2890 /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
2891 rc2 |= VMXReadCachedVMCS(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERRCODE, &errCode);
2892 rc2 |= VMXReadCachedVMCS(VMX_VMCS32_RO_EXIT_INSTR_INFO, &instrInfo);
2893 rc2 |= VMXReadCachedVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &exitQualification);
2894 AssertRC(rc2);
2895
2896 /* Sync back the guest state */
2897 rc2 = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
2898 AssertRC(rc2);
2899
2900 /* Note! NOW IT'S SAFE FOR LOGGING! */
2901 VMMR0LogFlushEnable(pVCpu);
2902 Log2(("Raw exit reason %08x\n", exitReason));
2903#if ARCH_BITS == 64 /* for the time being */
2904 VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pCtx, exitReason);
2905#endif
2906
2907 /* Check if an injected event was interrupted prematurely. */
2908 rc2 = VMXReadCachedVMCS(VMX_VMCS32_RO_IDT_INFO, &val);
2909 AssertRC(rc2);
2910 pVCpu->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
2911 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2912 /* Ignore 'int xx' as they'll be restarted anyway. */
2913 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW
2914 /* Ignore software exceptions (such as int3) as they'll reoccur when we restart the instruction anyway. */
2915 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2916 {
2917 Assert(!pVCpu->hwaccm.s.Event.fPending);
2918 pVCpu->hwaccm.s.Event.fPending = true;
2919 /* Error code present? */
2920 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo))
2921 {
2922 rc2 = VMXReadCachedVMCS(VMX_VMCS32_RO_IDT_ERRCODE, &val);
2923 AssertRC(rc2);
2924 pVCpu->hwaccm.s.Event.errCode = val;
2925 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv pending error=%RX64\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
2926 }
2927 else
2928 {
2929 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2930 pVCpu->hwaccm.s.Event.errCode = 0;
2931 }
2932 }
2933#ifdef VBOX_STRICT
2934 else
2935 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hwaccm.s.Event.intInfo)
2936 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
2937 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hwaccm.s.Event.intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT)
2938 {
2939 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
2940 }
2941
2942 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
2943 HWACCMDumpRegs(pVM, pVCpu, pCtx);
2944#endif
2945
2946 Log2(("E%d: New EIP=%x:%RGv\n", (uint32_t)exitReason, pCtx->cs, (RTGCPTR)pCtx->rip));
2947 Log2(("Exit reason %d, exitQualification %RGv\n", (uint32_t)exitReason, exitQualification));
2948 Log2(("instrInfo=%d instrError=%d instr length=%d\n", (uint32_t)instrInfo, (uint32_t)instrError, (uint32_t)cbInstr));
2949 Log2(("Interruption error code %d\n", (uint32_t)errCode));
2950 Log2(("IntInfo = %08x\n", (uint32_t)intInfo));
2951
2952 /* Sync back the TPR if it was changed. */
2953 if ( fSetupTPRCaching
2954 && u8LastTPR != pVCpu->hwaccm.s.vmx.pbVAPIC[0x80])
2955 {
2956 rc2 = PDMApicSetTPR(pVCpu, pVCpu->hwaccm.s.vmx.pbVAPIC[0x80]);
2957 AssertRC(rc2);
2958 }
2959
2960#ifdef DBGFTRACE_ENABLED /** @todo DTrace later. */
2961 RTTraceBufAddMsgF(pVM->CTX_SUFF(hTraceBuf), "vmexit %08x %016RX64 at %04:%08RX64 %RX64",
2962 exitReason, (uint64_t)exitQualification, pCtx->cs, pCtx->rip, (uint64_t)intInfo);
2963#endif
2964 STAM_PROFILE_ADV_STOP_START(&pVCpu->hwaccm.s.StatExit1, &pVCpu->hwaccm.s.StatExit2, x);
2965
2966 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
2967 Assert(rc == VINF_SUCCESS); /* might consider VERR_IPE_UNINITIALIZED_STATUS here later... */
2968 switch (exitReason)
2969 {
2970 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2971 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2972 {
2973 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
2974
2975 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2976 {
2977 Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
2978#if 0 //def VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2979 if ( RTThreadPreemptIsPendingTrusty()
2980 && !RTThreadPreemptIsPending(NIL_RTTHREAD))
2981 goto ResumeExecution;
2982#endif
2983 /* External interrupt; leave to allow it to be dispatched again. */
2984 rc = VINF_EM_RAW_INTERRUPT;
2985 break;
2986 }
2987 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
2988 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
2989 {
2990 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
2991 /* External interrupt; leave to allow it to be dispatched again. */
2992 rc = VINF_EM_RAW_INTERRUPT;
2993 break;
2994
2995 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
2996 AssertFailed(); /* can't come here; fails the first check. */
2997 break;
2998
2999 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DBEXCPT: /* Unknown why we get this type for #DB */
3000 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
3001 Assert(vector == 1 || vector == 3 || vector == 4);
3002 /* no break */
3003 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
3004 Log2(("Hardware/software interrupt %d\n", vector));
3005 switch (vector)
3006 {
3007 case X86_XCPT_NM:
3008 {
3009 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
3010
3011 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
3012 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
3013 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
3014 if (rc == VINF_SUCCESS)
3015 {
3016 Assert(CPUMIsGuestFPUStateActive(pVCpu));
3017
3018 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
3019
3020 /* Continue execution. */
3021 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
3022
3023 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3024 goto ResumeExecution;
3025 }
3026
3027 Log(("Forward #NM fault to the guest\n"));
3028 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
3029 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
3030 AssertRC(rc2);
3031 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3032 goto ResumeExecution;
3033 }
3034
3035 case X86_XCPT_PF: /* Page fault */
3036 {
3037#ifdef DEBUG
3038 if (pVM->hwaccm.s.fNestedPaging)
3039 { /* A genuine pagefault.
3040 * Forward the trap to the guest by injecting the exception and resuming execution.
3041 */
3042 Log(("Guest page fault at %RGv cr2=%RGv error code %RGv rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification, errCode, (RTGCPTR)pCtx->rsp));
3043
3044 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
3045
3046 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
3047
3048 /* Now we must update CR2. */
3049 pCtx->cr2 = exitQualification;
3050 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3051 AssertRC(rc2);
3052
3053 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3054 goto ResumeExecution;
3055 }
3056#endif
3057 Assert(!pVM->hwaccm.s.fNestedPaging);
3058
3059#ifdef VBOX_HWACCM_WITH_GUEST_PATCHING
3060 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
3061 if ( pVM->hwaccm.s.fTRPPatchingAllowed
3062 && pVM->hwaccm.s.pGuestPatchMem
3063 && (exitQualification & 0xfff) == 0x080
3064 && !(errCode & X86_TRAP_PF_P) /* not present */
3065 && CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx)) == 0
3066 && !CPUMIsGuestInLongModeEx(pCtx)
3067 && pVM->hwaccm.s.cPatches < RT_ELEMENTS(pVM->hwaccm.s.aPatches))
3068 {
3069 RTGCPHYS GCPhysApicBase, GCPhys;
3070 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
3071 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3072
3073 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3074 if ( rc == VINF_SUCCESS
3075 && GCPhys == GCPhysApicBase)
3076 {
3077 /* Only attempt to patch the instruction once. */
3078 PHWACCMTPRPATCH pPatch = (PHWACCMTPRPATCH)RTAvloU32Get(&pVM->hwaccm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
3079 if (!pPatch)
3080 {
3081 rc = VINF_EM_HWACCM_PATCH_TPR_INSTR;
3082 break;
3083 }
3084 }
3085 }
3086#endif
3087
3088 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
3089 /* Exit qualification contains the linear address of the page fault. */
3090 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3091 TRPMSetErrorCode(pVCpu, errCode);
3092 TRPMSetFaultAddress(pVCpu, exitQualification);
3093
3094 /* Shortcut for APIC TPR reads and writes. */
3095 if ( (exitQualification & 0xfff) == 0x080
3096 && !(errCode & X86_TRAP_PF_P) /* not present */
3097 && fSetupTPRCaching
3098 && (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3099 {
3100 RTGCPHYS GCPhysApicBase, GCPhys;
3101 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
3102 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3103
3104 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3105 if ( rc == VINF_SUCCESS
3106 && GCPhys == GCPhysApicBase)
3107 {
3108 Log(("Enable VT-x virtual APIC access filtering\n"));
3109 rc2 = IOMMMIOMapMMIOHCPage(pVM, GCPhysApicBase, pVM->hwaccm.s.vmx.pAPICPhys, X86_PTE_RW | X86_PTE_P);
3110 AssertRC(rc2);
3111 }
3112 }
3113
3114 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
3115 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
3116 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3117
3118 if (rc == VINF_SUCCESS)
3119 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3120 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
3121 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
3122
3123 TRPMResetTrap(pVCpu);
3124 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3125 goto ResumeExecution;
3126 }
3127 else
3128 if (rc == VINF_EM_RAW_GUEST_TRAP)
3129 { /* A genuine pagefault.
3130 * Forward the trap to the guest by injecting the exception and resuming execution.
3131 */
3132 Log2(("Forward page fault to the guest\n"));
3133
3134 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
3135 /* The error code might have been changed. */
3136 errCode = TRPMGetErrorCode(pVCpu);
3137
3138 TRPMResetTrap(pVCpu);
3139
3140 /* Now we must update CR2. */
3141 pCtx->cr2 = exitQualification;
3142 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3143 AssertRC(rc2);
3144
3145 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3146 goto ResumeExecution;
3147 }
3148#ifdef VBOX_STRICT
3149 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
3150 Log2(("PGMTrap0eHandler failed with %d\n", VBOXSTRICTRC_VAL(rc)));
3151#endif
3152 /* Need to go back to the recompiler to emulate the instruction. */
3153 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPFEM);
3154 TRPMResetTrap(pVCpu);
3155 break;
3156 }
3157
3158 case X86_XCPT_MF: /* Floating point exception. */
3159 {
3160 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
3161 if (!(pCtx->cr0 & X86_CR0_NE))
3162 {
3163 /* old style FPU error reporting needs some extra work. */
3164 /** @todo don't fall back to the recompiler, but do it manually. */
3165 rc = VINF_EM_RAW_EMULATE_INSTR;
3166 break;
3167 }
3168 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
3169 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3170 AssertRC(rc2);
3171
3172 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3173 goto ResumeExecution;
3174 }
3175
3176 case X86_XCPT_DB: /* Debug exception. */
3177 {
3178 uint64_t uDR6;
3179
3180 /* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
3181 *
3182 * Exit qualification bits:
3183 * 3:0 B0-B3 which breakpoint condition was met
3184 * 12:4 Reserved (0)
3185 * 13 BD - debug register access detected
3186 * 14 BS - single step execution or branch taken
3187 * 63:15 Reserved (0)
3188 */
3189 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
3190
3191 /* Note that we don't support guest and host-initiated debugging at the same time. */
3192
3193 uDR6 = X86_DR6_INIT_VAL;
3194 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
3195 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), uDR6);
3196 if (rc == VINF_EM_RAW_GUEST_TRAP)
3197 {
3198 /* Update DR6 here. */
3199 pCtx->dr[6] = uDR6;
3200
3201 /* Resync DR6 if the debug state is active. */
3202 if (CPUMIsGuestDebugStateActive(pVCpu))
3203 ASMSetDR6(pCtx->dr[6]);
3204
3205 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
3206 pCtx->dr[7] &= ~X86_DR7_GD;
3207
3208 /* Paranoia. */
3209 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
3210 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
3211 pCtx->dr[7] |= 0x400; /* must be one */
3212
3213 /* Resync DR7 */
3214 rc2 = VMXWriteVMCS64(VMX_VMCS64_GUEST_DR7, pCtx->dr[7]);
3215 AssertRC(rc2);
3216
3217 Log(("Trap %x (debug) at %RGv exit qualification %RX64 dr6=%x dr7=%x\n", vector, (RTGCPTR)pCtx->rip, exitQualification, (uint32_t)pCtx->dr[6], (uint32_t)pCtx->dr[7]));
3218 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3219 AssertRC(rc2);
3220
3221 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3222 goto ResumeExecution;
3223 }
3224 /* Return to ring 3 to deal with the debug exit code. */
3225 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3226 break;
3227 }
3228
3229 case X86_XCPT_BP: /* Breakpoint. */
3230 {
3231 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestBP);
3232 rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3233 if (rc == VINF_EM_RAW_GUEST_TRAP)
3234 {
3235 Log(("Guest #BP at %04x:%RGv\n", pCtx->cs, pCtx->rip));
3236 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3237 AssertRC(rc2);
3238 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3239 goto ResumeExecution;
3240 }
3241 if (rc == VINF_SUCCESS)
3242 {
3243 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3244 goto ResumeExecution;
3245 }
3246 Log(("Debugger BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3247 break;
3248 }
3249
3250 case X86_XCPT_GP: /* General protection failure exception.*/
3251 {
3252 uint32_t cbOp;
3253 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
3254
3255 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
3256#ifdef VBOX_STRICT
3257 if ( !CPUMIsGuestInRealModeEx(pCtx)
3258 || !pVM->hwaccm.s.vmx.pRealModeTSS)
3259 {
3260 Log(("Trap %x at %04X:%RGv errorCode=%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, errCode));
3261 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3262 AssertRC(rc2);
3263 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3264 goto ResumeExecution;
3265 }
3266#endif
3267 Assert(CPUMIsGuestInRealModeEx(pCtx));
3268
3269 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %x:%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip));
3270
3271 rc2 = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
3272 if (RT_SUCCESS(rc2))
3273 {
3274 bool fUpdateRIP = true;
3275
3276 rc = VINF_SUCCESS;
3277 Assert(cbOp == pDis->opsize);
3278 switch (pDis->pCurInstr->opcode)
3279 {
3280 case OP_CLI:
3281 pCtx->eflags.Bits.u1IF = 0;
3282 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCli);
3283 break;
3284
3285 case OP_STI:
3286 pCtx->eflags.Bits.u1IF = 1;
3287 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + pDis->opsize);
3288 Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
3289 rc2 = VMXWriteVMCS(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
3290 AssertRC(rc2);
3291 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitSti);
3292 break;
3293
3294 case OP_HLT:
3295 fUpdateRIP = false;
3296 rc = VINF_EM_HALT;
3297 pCtx->rip += pDis->opsize;
3298 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitHlt);
3299 break;
3300
3301 case OP_POPF:
3302 {
3303 RTGCPTR GCPtrStack;
3304 uint32_t cbParm;
3305 uint32_t uMask;
3306 X86EFLAGS eflags;
3307
3308 if (pDis->prefix & PREFIX_OPSIZE)
3309 {
3310 cbParm = 4;
3311 uMask = 0xffffffff;
3312 }
3313 else
3314 {
3315 cbParm = 2;
3316 uMask = 0xffff;
3317 }
3318
3319 rc2 = SELMToFlatEx(pVCpu, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3320 if (RT_FAILURE(rc2))
3321 {
3322 rc = VERR_EM_INTERPRETER;
3323 break;
3324 }
3325 eflags.u = 0;
3326 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3327 if (RT_FAILURE(rc2))
3328 {
3329 rc = VERR_EM_INTERPRETER;
3330 break;
3331 }
3332 LogFlow(("POPF %x -> %RGv mask=%x\n", eflags.u, pCtx->rsp, uMask));
3333 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask)) | (eflags.u & X86_EFL_POPF_BITS & uMask);
3334 /* RF cleared when popped in real mode; see pushf description in AMD manual. */
3335 pCtx->eflags.Bits.u1RF = 0;
3336 pCtx->esp += cbParm;
3337 pCtx->esp &= uMask;
3338
3339 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPopf);
3340 break;
3341 }
3342
3343 case OP_PUSHF:
3344 {
3345 RTGCPTR GCPtrStack;
3346 uint32_t cbParm;
3347 uint32_t uMask;
3348 X86EFLAGS eflags;
3349
3350 if (pDis->prefix & PREFIX_OPSIZE)
3351 {
3352 cbParm = 4;
3353 uMask = 0xffffffff;
3354 }
3355 else
3356 {
3357 cbParm = 2;
3358 uMask = 0xffff;
3359 }
3360
3361 rc2 = SELMToFlatEx(pVCpu, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), (pCtx->esp - cbParm) & uMask, 0, &GCPtrStack);
3362 if (RT_FAILURE(rc2))
3363 {
3364 rc = VERR_EM_INTERPRETER;
3365 break;
3366 }
3367 eflags = pCtx->eflags;
3368 /* RF & VM cleared when pushed in real mode; see pushf description in AMD manual. */
3369 eflags.Bits.u1RF = 0;
3370 eflags.Bits.u1VM = 0;
3371
3372 rc2 = PGMPhysWrite(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3373 if (RT_FAILURE(rc2))
3374 {
3375 rc = VERR_EM_INTERPRETER;
3376 break;
3377 }
3378 LogFlow(("PUSHF %x -> %RGv\n", eflags.u, GCPtrStack));
3379 pCtx->esp -= cbParm;
3380 pCtx->esp &= uMask;
3381 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPushf);
3382 break;
3383 }
3384
3385 case OP_IRET:
3386 {
3387 RTGCPTR GCPtrStack;
3388 uint32_t uMask = 0xffff;
3389 uint16_t aIretFrame[3];
3390
3391 if (pDis->prefix & (PREFIX_OPSIZE | PREFIX_ADDRSIZE))
3392 {
3393 rc = VERR_EM_INTERPRETER;
3394 break;
3395 }
3396
3397 rc2 = SELMToFlatEx(pVCpu, DIS_SELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3398 if (RT_FAILURE(rc2))
3399 {
3400 rc = VERR_EM_INTERPRETER;
3401 break;
3402 }
3403 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &aIretFrame[0], sizeof(aIretFrame));
3404 if (RT_FAILURE(rc2))
3405 {
3406 rc = VERR_EM_INTERPRETER;
3407 break;
3408 }
3409 pCtx->ip = aIretFrame[0];
3410 pCtx->cs = aIretFrame[1];
3411 pCtx->csHid.u64Base = pCtx->cs << 4;
3412 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask)) | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
3413 pCtx->sp += sizeof(aIretFrame);
3414
3415 LogFlow(("iret to %04x:%x\n", pCtx->cs, pCtx->ip));
3416 fUpdateRIP = false;
3417 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIret);
3418 break;
3419 }
3420
3421 case OP_INT:
3422 {
3423 uint32_t intInfo2;
3424
3425 LogFlow(("Realmode: INT %x\n", pDis->param1.parval & 0xff));
3426 intInfo2 = pDis->param1.parval & 0xff;
3427 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3428 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3429
3430 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3431 AssertRC(VBOXSTRICTRC_VAL(rc));
3432 fUpdateRIP = false;
3433 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInt);
3434 break;
3435 }
3436
3437 case OP_INTO:
3438 {
3439 if (pCtx->eflags.Bits.u1OF)
3440 {
3441 uint32_t intInfo2;
3442
3443 LogFlow(("Realmode: INTO\n"));
3444 intInfo2 = X86_XCPT_OF;
3445 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3446 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3447
3448 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3449 AssertRC(VBOXSTRICTRC_VAL(rc));
3450 fUpdateRIP = false;
3451 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInt);
3452 }
3453 break;
3454 }
3455
3456 case OP_INT3:
3457 {
3458 uint32_t intInfo2;
3459
3460 LogFlow(("Realmode: INT 3\n"));
3461 intInfo2 = 3;
3462 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3463 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3464
3465 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3466 AssertRC(VBOXSTRICTRC_VAL(rc));
3467 fUpdateRIP = false;
3468 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInt);
3469 break;
3470 }
3471
3472 default:
3473 rc = EMInterpretInstructionDisasState(pVCpu, pDis, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR);
3474 fUpdateRIP = false;
3475 break;
3476 }
3477
3478 if (rc == VINF_SUCCESS)
3479 {
3480 if (fUpdateRIP)
3481 pCtx->rip += cbOp; /* Move on to the next instruction. */
3482
3483 /* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
3484 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
3485
3486 /* Only resume if successful. */
3487 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3488 goto ResumeExecution;
3489 }
3490 }
3491 else
3492 rc = VERR_EM_INTERPRETER;
3493
3494 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT, ("Unexpected rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
3495 break;
3496 }
3497
3498#ifdef VBOX_STRICT
3499 case X86_XCPT_XF: /* SIMD exception. */
3500 case X86_XCPT_DE: /* Divide error. */
3501 case X86_XCPT_UD: /* Unknown opcode exception. */
3502 case X86_XCPT_SS: /* Stack segment exception. */
3503 case X86_XCPT_NP: /* Segment not present exception. */
3504 {
3505 switch(vector)
3506 {
3507 case X86_XCPT_DE:
3508 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
3509 break;
3510 case X86_XCPT_UD:
3511 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
3512 break;
3513 case X86_XCPT_SS:
3514 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
3515 break;
3516 case X86_XCPT_NP:
3517 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
3518 break;
3519 case X86_XCPT_XF:
3520 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestXF);
3521 break;
3522 }
3523
3524 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip));
3525 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3526 AssertRC(rc2);
3527
3528 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3529 goto ResumeExecution;
3530 }
3531#endif
3532 default:
3533 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestXcpUnk);
3534 if ( CPUMIsGuestInRealModeEx(pCtx)
3535 && pVM->hwaccm.s.vmx.pRealModeTSS)
3536 {
3537 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs, pCtx->eip, errCode));
3538 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
3539 AssertRC(VBOXSTRICTRC_VAL(rc)); /* Strict RC check below. */
3540
3541 /* Go back to ring 3 in case of a triple fault. */
3542 if ( vector == X86_XCPT_DF
3543 && rc == VINF_EM_RESET)
3544 break;
3545
3546 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3547 goto ResumeExecution;
3548 }
3549 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
3550 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
3551 break;
3552 } /* switch (vector) */
3553
3554 break;
3555
3556 default:
3557 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
3558 AssertMsgFailed(("Unexpected interruption code %x\n", intInfo));
3559 break;
3560 }
3561
3562 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub3, y3);
3563 break;
3564 }
3565
3566 case VMX_EXIT_EPT_VIOLATION: /* 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed by the configuration of the EPT paging structures. */
3567 {
3568 RTGCPHYS GCPhys;
3569
3570 Assert(pVM->hwaccm.s.fNestedPaging);
3571
3572 rc2 = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
3573 AssertRC(rc2);
3574 Assert(((exitQualification >> 7) & 3) != 2);
3575
3576 /* Determine the kind of violation. */
3577 errCode = 0;
3578 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
3579 errCode |= X86_TRAP_PF_ID;
3580
3581 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
3582 errCode |= X86_TRAP_PF_RW;
3583
3584 /* If the page is present, then it's a page level protection fault. */
3585 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
3586 {
3587 errCode |= X86_TRAP_PF_P;
3588 }
3589 else
3590 {
3591 /* Shortcut for APIC TPR reads and writes. */
3592 if ( (GCPhys & 0xfff) == 0x080
3593 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
3594 && fSetupTPRCaching
3595 && (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3596 {
3597 RTGCPHYS GCPhysApicBase;
3598 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
3599 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3600 if (GCPhys == GCPhysApicBase + 0x80)
3601 {
3602 Log(("Enable VT-x virtual APIC access filtering\n"));
3603 rc2 = IOMMMIOMapMMIOHCPage(pVM, GCPhysApicBase, pVM->hwaccm.s.vmx.pAPICPhys, X86_PTE_RW | X86_PTE_P);
3604 AssertRC(rc2);
3605 }
3606 }
3607 }
3608 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
3609
3610 /* GCPhys contains the guest physical address of the page fault. */
3611 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3612 TRPMSetErrorCode(pVCpu, errCode);
3613 TRPMSetFaultAddress(pVCpu, GCPhys);
3614
3615 /* Handle the pagefault trap for the nested shadow table. */
3616 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
3617 if (rc == VINF_SUCCESS)
3618 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3619 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
3620 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
3621
3622 TRPMResetTrap(pVCpu);
3623 goto ResumeExecution;
3624 }
3625 /** @todo We probably should handle failure to get the instruction page
3626 * (VERR_PAGE_NOT_PRESENT, VERR_PAGE_TABLE_NOT_PRESENT). See
3627 * @bugref{6043}. */
3628
3629#ifdef VBOX_STRICT
3630 if (rc != VINF_EM_RAW_EMULATE_INSTR)
3631 LogFlow(("PGMTrap0eHandlerNestedPaging at %RGv failed with %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3632#endif
3633 /* Need to go back to the recompiler to emulate the instruction. */
3634 TRPMResetTrap(pVCpu);
3635 break;
3636 }
3637
3638 case VMX_EXIT_EPT_MISCONFIG:
3639 {
3640 RTGCPHYS GCPhys;
3641
3642 Assert(pVM->hwaccm.s.fNestedPaging);
3643
3644 rc2 = VMXReadVMCS64(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
3645 AssertRC(rc2);
3646 Log(("VMX_EXIT_EPT_MISCONFIG for %RGp\n", GCPhys));
3647
3648 /* Shortcut for APIC TPR reads and writes. */
3649 if ( (GCPhys & 0xfff) == 0x080
3650 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
3651 && fSetupTPRCaching
3652 && (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3653 {
3654 RTGCPHYS GCPhysApicBase;
3655 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
3656 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3657 if (GCPhys == GCPhysApicBase + 0x80)
3658 {
3659 Log(("Enable VT-x virtual APIC access filtering\n"));
3660 rc2 = IOMMMIOMapMMIOHCPage(pVM, GCPhysApicBase, pVM->hwaccm.s.vmx.pAPICPhys, X86_PTE_RW | X86_PTE_P);
3661 AssertRC(rc2);
3662 }
3663 }
3664
3665 rc = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, PGMMODE_EPT, CPUMCTX2CORE(pCtx), GCPhys, UINT32_MAX);
3666 if (rc == VINF_SUCCESS)
3667 {
3668 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> resume\n", GCPhys, (RTGCPTR)pCtx->rip));
3669 goto ResumeExecution;
3670 }
3671 /** @todo We probably should handle failure to get the instruction page
3672 * (VERR_PAGE_NOT_PRESENT, VERR_PAGE_TABLE_NOT_PRESENT). See
3673 * @bugref{6043}. */
3674
3675 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> %Rrc\n", GCPhys, (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3676 break;
3677 }
3678
3679 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
3680 /* Clear VM-exit on IF=1 change. */
3681 LogFlow(("VMX_EXIT_IRQ_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip, VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
3682 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
3683 rc2 = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3684 AssertRC(rc2);
3685 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIrqWindow);
3686 goto ResumeExecution; /* we check for pending guest interrupts there */
3687
3688 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
3689 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
3690 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
3691 /* Skip instruction and continue directly. */
3692 pCtx->rip += cbInstr;
3693 /* Continue execution.*/
3694 goto ResumeExecution;
3695
3696 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
3697 {
3698 Log2(("VMX: Cpuid %x\n", pCtx->eax));
3699 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
3700 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3701 if (rc == VINF_SUCCESS)
3702 {
3703 /* Update EIP and continue execution. */
3704 Assert(cbInstr == 2);
3705 pCtx->rip += cbInstr;
3706 goto ResumeExecution;
3707 }
3708 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
3709 rc = VINF_EM_RAW_EMULATE_INSTR;
3710 break;
3711 }
3712
3713 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
3714 {
3715 Log2(("VMX: Rdpmc %x\n", pCtx->ecx));
3716 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdpmc);
3717 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3718 if (rc == VINF_SUCCESS)
3719 {
3720 /* Update EIP and continue execution. */
3721 Assert(cbInstr == 2);
3722 pCtx->rip += cbInstr;
3723 goto ResumeExecution;
3724 }
3725 rc = VINF_EM_RAW_EMULATE_INSTR;
3726 break;
3727 }
3728
3729 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
3730 {
3731 Log2(("VMX: Rdtsc\n"));
3732 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
3733 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3734 if (rc == VINF_SUCCESS)
3735 {
3736 /* Update EIP and continue execution. */
3737 Assert(cbInstr == 2);
3738 pCtx->rip += cbInstr;
3739 goto ResumeExecution;
3740 }
3741 rc = VINF_EM_RAW_EMULATE_INSTR;
3742 break;
3743 }
3744
3745 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
3746 {
3747 Log2(("VMX: invlpg\n"));
3748 Assert(!pVM->hwaccm.s.fNestedPaging);
3749
3750 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
3751 rc = EMInterpretInvlpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), exitQualification);
3752 if (rc == VINF_SUCCESS)
3753 {
3754 /* Update EIP and continue execution. */
3755 pCtx->rip += cbInstr;
3756 goto ResumeExecution;
3757 }
3758 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, VBOXSTRICTRC_VAL(rc)));
3759 break;
3760 }
3761
3762 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
3763 {
3764 Log2(("VMX: monitor\n"));
3765
3766 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMonitor);
3767 rc = EMInterpretMonitor(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3768 if (rc == VINF_SUCCESS)
3769 {
3770 /* Update EIP and continue execution. */
3771 pCtx->rip += cbInstr;
3772 goto ResumeExecution;
3773 }
3774 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: monitor failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
3775 break;
3776 }
3777
3778 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
3779 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
3780 if ( pVM->hwaccm.s.fTPRPatchingActive
3781 && pCtx->ecx == MSR_K8_LSTAR)
3782 {
3783 Assert(!CPUMIsGuestInLongModeEx(pCtx));
3784 if ((pCtx->eax & 0xff) != u8LastTPR)
3785 {
3786 Log(("VMX: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
3787
3788 /* Our patch code uses LSTAR for TPR caching. */
3789 rc2 = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
3790 AssertRC(rc2);
3791 }
3792
3793 /* Skip the instruction and continue. */
3794 pCtx->rip += cbInstr; /* wrmsr = [0F 30] */
3795
3796 /* Only resume if successful. */
3797 goto ResumeExecution;
3798 }
3799 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_MSR;
3800 /* no break */
3801 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
3802 {
3803 STAM_COUNTER_INC((exitReason == VMX_EXIT_RDMSR) ? &pVCpu->hwaccm.s.StatExitRdmsr : &pVCpu->hwaccm.s.StatExitWrmsr);
3804
3805 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
3806 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
3807 rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0);
3808 if (rc == VINF_SUCCESS)
3809 {
3810 /* EIP has been updated already. */
3811
3812 /* Only resume if successful. */
3813 goto ResumeExecution;
3814 }
3815 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", VBOXSTRICTRC_VAL(rc)));
3816 break;
3817 }
3818
3819 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
3820 {
3821 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit2Sub2, y2);
3822
3823 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
3824 {
3825 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
3826 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
3827 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
3828 rc = EMInterpretCRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
3829 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
3830 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
3831
3832 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
3833 {
3834 case 0:
3835 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0 | HWACCM_CHANGED_GUEST_CR3;
3836 break;
3837 case 2:
3838 break;
3839 case 3:
3840 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
3841 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
3842 break;
3843 case 4:
3844 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
3845 break;
3846 case 8:
3847 /* CR8 contains the APIC TPR */
3848 Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
3849 break;
3850
3851 default:
3852 AssertFailed();
3853 break;
3854 }
3855 break;
3856
3857 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
3858 Log2(("VMX: mov x, crx\n"));
3859 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
3860
3861 Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
3862
3863 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
3864 Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 || !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
3865
3866 rc = EMInterpretCRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
3867 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
3868 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
3869 break;
3870
3871 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
3872 Log2(("VMX: clts\n"));
3873 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCLTS);
3874 rc = EMInterpretCLTS(pVM, pVCpu);
3875 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
3876 break;
3877
3878 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
3879 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
3880 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitLMSW);
3881 rc = EMInterpretLMSW(pVM, pVCpu, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
3882 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
3883 break;
3884 }
3885
3886 /* Update EIP if no error occurred. */
3887 if (RT_SUCCESS(rc))
3888 pCtx->rip += cbInstr;
3889
3890 if (rc == VINF_SUCCESS)
3891 {
3892 /* Only resume if successful. */
3893 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub2, y2);
3894 goto ResumeExecution;
3895 }
3896 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
3897 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub2, y2);
3898 break;
3899 }
3900
3901 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
3902 {
3903 if ( !DBGFIsStepping(pVCpu)
3904 && !CPUMIsHyperDebugStateActive(pVCpu))
3905 {
3906 /* Disable drx move intercepts. */
3907 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
3908 rc2 = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
3909 AssertRC(rc2);
3910
3911 /* Save the host and load the guest debug state. */
3912 rc2 = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
3913 AssertRC(rc2);
3914
3915#ifdef LOG_ENABLED
3916 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
3917 Log(("VMX_EXIT_DRX_MOVE: write DR%d genreg %d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
3918 else
3919 Log(("VMX_EXIT_DRX_MOVE: read DR%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification)));
3920#endif
3921
3922#ifdef VBOX_WITH_STATISTICS
3923 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
3924 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
3925 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
3926 else
3927 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
3928#endif
3929
3930 goto ResumeExecution;
3931 }
3932
3933 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
3934 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
3935 {
3936 Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
3937 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
3938 rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
3939 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
3940 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
3941 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
3942 Log2(("DR7=%08x\n", pCtx->dr[7]));
3943 }
3944 else
3945 {
3946 Log2(("VMX: mov x, drx\n"));
3947 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
3948 rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
3949 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
3950 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
3951 }
3952 /* Update EIP if no error occurred. */
3953 if (RT_SUCCESS(rc))
3954 pCtx->rip += cbInstr;
3955
3956 if (rc == VINF_SUCCESS)
3957 {
3958 /* Only resume if successful. */
3959 goto ResumeExecution;
3960 }
3961 Assert(rc == VERR_EM_INTERPRETER);
3962 break;
3963 }
3964
3965 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
3966 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
3967 {
3968 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
3969 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
3970 uint32_t uPort;
3971 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
3972
3973 /** @todo necessary to make the distinction? */
3974 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
3975 {
3976 uPort = pCtx->edx & 0xffff;
3977 }
3978 else
3979 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
3980
3981 /* paranoia */
3982 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4))
3983 {
3984 rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
3985 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
3986 break;
3987 }
3988
3989 uint32_t cbSize = g_aIOSize[uIOWidth];
3990
3991 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
3992 {
3993 /* ins/outs */
3994 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
3995
3996 /* Disassemble manually to deal with segment prefixes. */
3997 /** @todo VMX_VMCS_EXIT_GUEST_LINEAR_ADDR contains the flat pointer operand of the instruction. */
3998 /** @todo VMX_VMCS32_RO_EXIT_INSTR_INFO also contains segment prefix info. */
3999 rc2 = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, NULL);
4000 if (RT_SUCCESS(rc))
4001 {
4002 if (fIOWrite)
4003 {
4004 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4005 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
4006 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, pDis->prefix, pDis->addrmode, cbSize);
4007 }
4008 else
4009 {
4010 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4011 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
4012 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, pDis->prefix, pDis->addrmode, cbSize);
4013 }
4014 }
4015 else
4016 rc = VINF_EM_RAW_EMULATE_INSTR;
4017 }
4018 else
4019 {
4020 /* normal in/out */
4021 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
4022
4023 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
4024
4025 if (fIOWrite)
4026 {
4027 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
4028 rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
4029 if (rc == VINF_IOM_R3_IOPORT_WRITE)
4030 HWACCMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4031 }
4032 else
4033 {
4034 uint32_t u32Val = 0;
4035
4036 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
4037 rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
4038 if (IOM_SUCCESS(rc))
4039 {
4040 /* Write back to the EAX register. */
4041 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
4042 }
4043 else
4044 if (rc == VINF_IOM_R3_IOPORT_READ)
4045 HWACCMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4046 }
4047 }
4048 /*
4049 * Handled the I/O return codes.
4050 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
4051 */
4052 if (IOM_SUCCESS(rc))
4053 {
4054 /* Update EIP and continue execution. */
4055 pCtx->rip += cbInstr;
4056 if (RT_LIKELY(rc == VINF_SUCCESS))
4057 {
4058 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
4059 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
4060 {
4061 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
4062 for (unsigned i=0;i<4;i++)
4063 {
4064 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
4065
4066 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
4067 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
4068 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
4069 {
4070 uint64_t uDR6;
4071
4072 Assert(CPUMIsGuestDebugStateActive(pVCpu));
4073
4074 uDR6 = ASMGetDR6();
4075
4076 /* Clear all breakpoint status flags and set the one we just hit. */
4077 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
4078 uDR6 |= (uint64_t)RT_BIT(i);
4079
4080 /* Note: AMD64 Architecture Programmer's Manual 13.1:
4081 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
4082 * the contents have been read.
4083 */
4084 ASMSetDR6(uDR6);
4085
4086 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
4087 pCtx->dr[7] &= ~X86_DR7_GD;
4088
4089 /* Paranoia. */
4090 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
4091 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
4092 pCtx->dr[7] |= 0x400; /* must be one */
4093
4094 /* Resync DR7 */
4095 rc2 = VMXWriteVMCS64(VMX_VMCS64_GUEST_DR7, pCtx->dr[7]);
4096 AssertRC(rc2);
4097
4098 /* Construct inject info. */
4099 intInfo = X86_XCPT_DB;
4100 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4101 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4102
4103 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
4104 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
4105 AssertRC(rc2);
4106
4107 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
4108 goto ResumeExecution;
4109 }
4110 }
4111 }
4112 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
4113 goto ResumeExecution;
4114 }
4115 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
4116 break;
4117 }
4118
4119#ifdef VBOX_STRICT
4120 if (rc == VINF_IOM_R3_IOPORT_READ)
4121 Assert(!fIOWrite);
4122 else if (rc == VINF_IOM_R3_IOPORT_WRITE)
4123 Assert(fIOWrite);
4124 else
4125 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4126#endif
4127 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2Sub1, y1);
4128 break;
4129 }
4130
4131 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4132 LogFlow(("VMX_EXIT_TPR\n"));
4133 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
4134 goto ResumeExecution;
4135
4136 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address on the APIC-access page. */
4137 {
4138 LogFlow(("VMX_EXIT_APIC_ACCESS\n"));
4139 unsigned uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(exitQualification);
4140
4141 switch(uAccessType)
4142 {
4143 case VMX_APIC_ACCESS_TYPE_LINEAR_READ:
4144 case VMX_APIC_ACCESS_TYPE_LINEAR_WRITE:
4145 {
4146 RTGCPHYS GCPhys;
4147 PDMApicGetBase(pVM, &GCPhys);
4148 GCPhys &= PAGE_BASE_GC_MASK;
4149 GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(exitQualification);
4150
4151 LogFlow(("Apic access at %RGp\n", GCPhys));
4152 rc = IOMMMIOPhysHandler(pVM, (uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ) ? 0 : X86_TRAP_PF_RW, CPUMCTX2CORE(pCtx), GCPhys);
4153 if (rc == VINF_SUCCESS)
4154 goto ResumeExecution; /* rip already updated */
4155 break;
4156 }
4157
4158 default:
4159 rc = VINF_EM_RAW_EMULATE_INSTR;
4160 break;
4161 }
4162 break;
4163 }
4164
4165 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4166 if (!TMTimerPollBool(pVM, pVCpu))
4167 goto ResumeExecution;
4168 rc = VINF_EM_RAW_TIMER_PENDING;
4169 break;
4170
4171 default:
4172 /* The rest is handled after syncing the entire CPU state. */
4173 break;
4174 }
4175
4176 /* Note: the guest state isn't entirely synced back at this stage. */
4177
4178 /* Investigate why there was a VM-exit. (part 2) */
4179 switch (exitReason)
4180 {
4181 case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
4182 case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
4183 case VMX_EXIT_EPT_VIOLATION:
4184 case VMX_EXIT_EPT_MISCONFIG: /* 49 EPT misconfig is used by the PGM/MMIO optimizations. */
4185 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4186 /* Already handled above. */
4187 break;
4188
4189 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
4190 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
4191 break;
4192
4193 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
4194 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
4195 rc = VINF_EM_RAW_INTERRUPT;
4196 AssertFailed(); /* Can't happen. Yet. */
4197 break;
4198
4199 case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
4200 case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
4201 rc = VINF_EM_RAW_INTERRUPT;
4202 AssertFailed(); /* Can't happen afaik. */
4203 break;
4204
4205 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch: too complicated to emulate, so fall back to the recompiler */
4206 Log(("VMX_EXIT_TASK_SWITCH: exit=%RX64\n", exitQualification));
4207 if ( (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(exitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
4208 && pVCpu->hwaccm.s.Event.fPending)
4209 {
4210 /* Caused by an injected interrupt. */
4211 pVCpu->hwaccm.s.Event.fPending = false;
4212
4213 Log(("VMX_EXIT_TASK_SWITCH: reassert trap %d\n", VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hwaccm.s.Event.intInfo)));
4214 Assert(!VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hwaccm.s.Event.intInfo));
4215 rc2 = TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hwaccm.s.Event.intInfo), TRPM_HARDWARE_INT);
4216 AssertRC(rc2);
4217 }
4218 /* else Exceptions and software interrupts can just be restarted. */
4219 rc = VERR_EM_INTERPRETER;
4220 break;
4221
4222 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
4223 /* Check if external interrupts are pending; if so, don't switch back. */
4224 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitHlt);
4225 pCtx->rip++; /* skip hlt */
4226 if (EMShouldContinueAfterHalt(pVCpu, pCtx))
4227 goto ResumeExecution;
4228
4229 rc = VINF_EM_HALT;
4230 break;
4231
4232 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
4233 Log2(("VMX: mwait\n"));
4234 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMwait);
4235 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4236 if ( rc == VINF_EM_HALT
4237 || rc == VINF_SUCCESS)
4238 {
4239 /* Update EIP and continue execution. */
4240 pCtx->rip += cbInstr;
4241
4242 /* Check if external interrupts are pending; if so, don't switch back. */
4243 if ( rc == VINF_SUCCESS
4244 || ( rc == VINF_EM_HALT
4245 && EMShouldContinueAfterHalt(pVCpu, pCtx))
4246 )
4247 goto ResumeExecution;
4248 }
4249 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4250 break;
4251
4252 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
4253 AssertFailed(); /* can't happen. */
4254 rc = VERR_EM_INTERPRETER;
4255 break;
4256
4257 case VMX_EXIT_MTF: /* 37 Exit due to Monitor Trap Flag. */
4258 LogFlow(("VMX_EXIT_MTF at %RGv\n", (RTGCPTR)pCtx->rip));
4259 pVCpu->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
4260 rc2 = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
4261 AssertRC(rc2);
4262 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMTF);
4263#if 0
4264 DBGFDoneStepping(pVCpu);
4265#endif
4266 rc = VINF_EM_DBG_STOP;
4267 break;
4268
4269 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
4270 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
4271 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
4272 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
4273 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
4274 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
4275 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
4276 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
4277 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
4278 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
4279 /** @todo inject #UD immediately */
4280 rc = VERR_EM_INTERPRETER;
4281 break;
4282
4283 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4284 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4285 case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
4286 case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
4287 case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
4288 case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
4289 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4290 /* already handled above */
4291 AssertMsg( rc == VINF_PGM_CHANGE_MODE
4292 || rc == VINF_EM_RAW_INTERRUPT
4293 || rc == VERR_EM_INTERPRETER
4294 || rc == VINF_EM_RAW_EMULATE_INSTR
4295 || rc == VINF_PGM_SYNC_CR3
4296 || rc == VINF_IOM_R3_IOPORT_READ
4297 || rc == VINF_IOM_R3_IOPORT_WRITE
4298 || rc == VINF_EM_RAW_GUEST_TRAP
4299 || rc == VINF_TRPM_XCPT_DISPATCHED
4300 || rc == VINF_EM_RESCHEDULE_REM,
4301 ("rc = %d\n", VBOXSTRICTRC_VAL(rc)));
4302 break;
4303
4304 case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4305 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address on the APIC-access page. */
4306 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4307 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4308 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
4309 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4310 /* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
4311 rc = VERR_EM_INTERPRETER;
4312 break;
4313
4314 case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
4315 Assert(rc == VINF_EM_RAW_INTERRUPT);
4316 break;
4317
4318 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
4319 {
4320#ifdef VBOX_STRICT
4321 RTCCUINTREG val2 = 0;
4322
4323 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
4324
4325 VMXReadVMCS(VMX_VMCS64_GUEST_RIP, &val2);
4326 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val2));
4327
4328 VMXReadVMCS(VMX_VMCS64_GUEST_CR0, &val2);
4329 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", (uint64_t)val2));
4330
4331 VMXReadVMCS(VMX_VMCS64_GUEST_CR3, &val2);
4332 Log(("VMX_VMCS_GUEST_CR3 %RX64\n", (uint64_t)val2));
4333
4334 VMXReadVMCS(VMX_VMCS64_GUEST_CR4, &val2);
4335 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", (uint64_t)val2));
4336
4337 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val2);
4338 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val2));
4339
4340 VMX_LOG_SELREG(CS, "CS", val2);
4341 VMX_LOG_SELREG(DS, "DS", val2);
4342 VMX_LOG_SELREG(ES, "ES", val2);
4343 VMX_LOG_SELREG(FS, "FS", val2);
4344 VMX_LOG_SELREG(GS, "GS", val2);
4345 VMX_LOG_SELREG(SS, "SS", val2);
4346 VMX_LOG_SELREG(TR, "TR", val2);
4347 VMX_LOG_SELREG(LDTR, "LDTR", val2);
4348
4349 VMXReadVMCS(VMX_VMCS64_GUEST_GDTR_BASE, &val2);
4350 Log(("VMX_VMCS_GUEST_GDTR_BASE %RX64\n", (uint64_t)val2));
4351 VMXReadVMCS(VMX_VMCS64_GUEST_IDTR_BASE, &val2);
4352 Log(("VMX_VMCS_GUEST_IDTR_BASE %RX64\n", (uint64_t)val2));
4353#endif /* VBOX_STRICT */
4354 rc = VERR_VMX_INVALID_GUEST_STATE;
4355 break;
4356 }
4357
4358 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
4359 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
4360 default:
4361 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
4362 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
4363 break;
4364
4365 }
4366end:
4367
4368 /* We now going back to ring-3, so clear the action flag. */
4369 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
4370
4371 /* Signal changes for the recompiler. */
4372 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
4373
4374 /* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
4375 if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
4376 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
4377 {
4378 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
4379 /* On the next entry we'll only sync the host context. */
4380 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
4381 }
4382 else
4383 {
4384 /* On the next entry we'll sync everything. */
4385 /** @todo we can do better than this */
4386 /* Not in the VINF_PGM_CHANGE_MODE though! */
4387 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
4388 }
4389
4390 /* translate into a less severe return code */
4391 if (rc == VERR_EM_INTERPRETER)
4392 rc = VINF_EM_RAW_EMULATE_INSTR;
4393 else
4394 /* Try to extract more information about what might have gone wrong here. */
4395 if (rc == VERR_VMX_INVALID_VMCS_PTR)
4396 {
4397 VMXGetActivateVMCS(&pVCpu->hwaccm.s.vmx.lasterror.u64VMCSPhys);
4398 pVCpu->hwaccm.s.vmx.lasterror.ulVMCSRevision = *(uint32_t *)pVCpu->hwaccm.s.vmx.pvVMCS;
4399 pVCpu->hwaccm.s.vmx.lasterror.idEnteredCpu = pVCpu->hwaccm.s.idEnteredCpu;
4400 pVCpu->hwaccm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
4401 }
4402
4403 /* Just set the correct state here instead of trying to catch every goto above. */
4404 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
4405
4406#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
4407 /* Restore interrupts if we exitted after disabling them. */
4408 if (uOldEFlags != ~(RTCCUINTREG)0)
4409 ASMSetFlags(uOldEFlags);
4410#endif
4411
4412 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit2, x);
4413 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
4414 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
4415 Log2(("X"));
4416 return VBOXSTRICTRC_TODO(rc);
4417}
4418
4419
4420/**
4421 * Enters the VT-x session
4422 *
4423 * @returns VBox status code.
4424 * @param pVM The VM to operate on.
4425 * @param pVCpu The VMCPU to operate on.
4426 * @param pCpu CPU info struct
4427 */
4428VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBLCPUINFO pCpu)
4429{
4430 Assert(pVM->hwaccm.s.vmx.fSupported);
4431 NOREF(pCpu);
4432
4433 unsigned cr4 = ASMGetCR4();
4434 if (!(cr4 & X86_CR4_VMXE))
4435 {
4436 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
4437 return VERR_VMX_X86_CR4_VMXE_CLEARED;
4438 }
4439
4440 /* Activate the VM Control Structure. */
4441 int rc = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
4442 if (RT_FAILURE(rc))
4443 return rc;
4444
4445 pVCpu->hwaccm.s.fResumeVM = false;
4446 return VINF_SUCCESS;
4447}
4448
4449
4450/**
4451 * Leaves the VT-x session
4452 *
4453 * @returns VBox status code.
4454 * @param pVM The VM to operate on.
4455 * @param pVCpu The VMCPU to operate on.
4456 * @param pCtx CPU context
4457 */
4458VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
4459{
4460 Assert(pVM->hwaccm.s.vmx.fSupported);
4461
4462#ifdef DEBUG
4463 if (CPUMIsHyperDebugStateActive(pVCpu))
4464 {
4465 CPUMR0LoadHostDebugState(pVM, pVCpu);
4466 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
4467 }
4468 else
4469#endif
4470 /* Save the guest debug state if necessary. */
4471 if (CPUMIsGuestDebugStateActive(pVCpu))
4472 {
4473 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
4474
4475 /* Enable drx move intercepts again. */
4476 pVCpu->hwaccm.s.vmx.proc_ctls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
4477 int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hwaccm.s.vmx.proc_ctls);
4478 AssertRC(rc);
4479
4480 /* Resync the debug registers the next time. */
4481 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
4482 }
4483 else
4484 Assert(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
4485
4486 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
4487 int rc = VMXClearVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
4488 AssertRC(rc);
4489
4490 return VINF_SUCCESS;
4491}
4492
4493
4494/**
4495 * Flush the TLB using EPT.
4496 *
4497 * @returns VBox status code.
4498 * @param pVM The VM to operate on.
4499 * @param pVCpu The VM CPU to operate on.
4500 * @param enmFlush Type of flush.
4501 */
4502static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush)
4503{
4504 uint64_t descriptor[2];
4505
4506 LogFlow(("hmR0VmxFlushEPT %d %RGv\n", enmFlush, GCPhys));
4507 Assert(pVM->hwaccm.s.fNestedPaging);
4508 descriptor[0] = pVCpu->hwaccm.s.vmx.GCPhysEPTP;
4509 descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
4510 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
4511 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hwaccm.s.vmx.GCPhysEPTP, rc));
4512}
4513
4514
4515/**
4516 * Flush the TLB using VPID.
4517 *
4518 * @returns VBox status code.
4519 * @param pVM The VM to operate on.
4520 * @param pVCpu The VM CPU to operate on.
4521 * @param enmFlush Type of flush.
4522 * @param GCPtr Virtual address of the page to flush.
4523 */
4524static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr)
4525{
4526#if HC_ARCH_BITS == 32
4527 /* If we get a flush in 64 bits guest mode, then force a full TLB flush. Invvpid probably takes only 32 bits addresses. (@todo) */
4528 if ( CPUMIsGuestInLongMode(pVCpu)
4529 && !VMX_IS_64BIT_HOST_MODE())
4530 {
4531 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
4532 }
4533 else
4534#endif
4535 {
4536 uint64_t descriptor[2];
4537
4538 Assert(pVM->hwaccm.s.vmx.fVPID);
4539 if (enmFlush == VMX_FLUSH_VPID_ALL_CONTEXTS)
4540 {
4541 descriptor[0] = 0;
4542 descriptor[1] = 0;
4543 }
4544 else
4545 {
4546 Assert(pVCpu->hwaccm.s.uCurrentASID != 0);
4547 descriptor[0] = pVCpu->hwaccm.s.uCurrentASID;
4548 descriptor[1] = GCPtr;
4549 }
4550 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]); NOREF(rc);
4551 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvVPID %x %x %RGv failed with %d\n", enmFlush, pVCpu->hwaccm.s.uCurrentASID, GCPtr, rc));
4552 }
4553}
4554
4555
4556/**
4557 * Invalidates a guest page by guest virtual address. Only relevant for
4558 * EPT/VPID, otherwise there is nothing really to invalidate.
4559 *
4560 * @returns VBox status code.
4561 * @param pVM The VM to operate on.
4562 * @param pVCpu The VM CPU to operate on.
4563 * @param GCVirt Page to invalidate.
4564 */
4565VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
4566{
4567 bool fFlushPending = VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
4568
4569 Log2(("VMXR0InvalidatePage %RGv\n", GCVirt));
4570
4571 if (!fFlushPending)
4572 {
4573 /*
4574 * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
4575 * See @bugref{6043} and @bugref{6177}
4576 *
4577 * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VMENTRY in hmR0VmxSetupTLB*() as this
4578 * function maybe called in a loop with individual addresses.
4579 */
4580 if (pVM->hwaccm.s.vmx.fVPID)
4581 {
4582 /* If we can flush just this page do it, otherwise flush as little as possible. */
4583 if (pVM->hwaccm.s.vmx.msr.vmx_eptcaps & MSR_IA32_VMX_EPT_CAPS_INVVPID_CAPS_INDIV_ADDR)
4584 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, GCVirt);
4585 else
4586 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
4587 }
4588 else if (pVM->hwaccm.s.fNestedPaging)
4589 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
4590 }
4591
4592 return VINF_SUCCESS;
4593}
4594
4595
4596/**
4597 * Invalidates a guest page by physical address. Only relevant for EPT/VPID,
4598 * otherwise ther eis nothing really to invalidate.
4599 *
4600 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
4601 *
4602 * @returns VBox status code.
4603 * @param pVM The VM to operate on.
4604 * @param pVCpu The VM CPU to operate on.
4605 * @param GCPhys Page to invalidate.
4606 */
4607VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
4608{
4609 bool fFlushPending = VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
4610
4611 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
4612
4613 /*
4614 * We cannot flush a page by guest-physical address. invvpid takes only a linear address
4615 * while invept only flushes by EPT not individual addresses. We update the force flag here
4616 * and flush before VMENTRY in hmR0VmxSetupTLB*(). This function might be called in a loop.
4617 */
4618 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
4619 return VINF_SUCCESS;
4620}
4621
4622
4623/**
4624 * Report world switch error and dump some useful debug info
4625 *
4626 * @param pVM The VM to operate on.
4627 * @param pVCpu The VMCPU to operate on.
4628 * @param rc Return code
4629 * @param pCtx Current CPU context (not updated)
4630 */
4631static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx)
4632{
4633 NOREF(pVM);
4634
4635 switch (VBOXSTRICTRC_VAL(rc))
4636 {
4637 case VERR_VMX_INVALID_VMXON_PTR:
4638 AssertFailed();
4639 break;
4640
4641 case VERR_VMX_UNABLE_TO_START_VM:
4642 case VERR_VMX_UNABLE_TO_RESUME_VM:
4643 {
4644 int rc2;
4645 RTCCUINTREG exitReason, instrError;
4646
4647 rc2 = VMXReadVMCS(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
4648 rc2 |= VMXReadVMCS(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
4649 AssertRC(rc2);
4650 if (rc2 == VINF_SUCCESS)
4651 {
4652 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
4653 Log(("Current stack %08x\n", &rc2));
4654
4655 pVCpu->hwaccm.s.vmx.lasterror.ulInstrError = instrError;
4656 pVCpu->hwaccm.s.vmx.lasterror.ulExitReason = exitReason;
4657
4658#ifdef VBOX_STRICT
4659 RTGDTR gdtr;
4660 PCX86DESCHC pDesc;
4661 RTCCUINTREG val;
4662
4663 ASMGetGDTR(&gdtr);
4664
4665 VMXReadVMCS(VMX_VMCS64_GUEST_RIP, &val);
4666 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
4667 VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
4668 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
4669 VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
4670 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
4671 VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
4672 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
4673 VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
4674 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
4675
4676 VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
4677 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
4678
4679 VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
4680 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
4681
4682 VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
4683 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
4684
4685 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_CS, &val);
4686 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
4687
4688 VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
4689 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
4690
4691 if (val < gdtr.cbGdt)
4692 {
4693 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4694 HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
4695 }
4696
4697 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_DS, &val);
4698 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
4699 if (val < gdtr.cbGdt)
4700 {
4701 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4702 HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
4703 }
4704
4705 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_ES, &val);
4706 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
4707 if (val < gdtr.cbGdt)
4708 {
4709 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4710 HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
4711 }
4712
4713 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_FS, &val);
4714 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
4715 if (val < gdtr.cbGdt)
4716 {
4717 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4718 HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
4719 }
4720
4721 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_GS, &val);
4722 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
4723 if (val < gdtr.cbGdt)
4724 {
4725 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4726 HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
4727 }
4728
4729 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_SS, &val);
4730 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
4731 if (val < gdtr.cbGdt)
4732 {
4733 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4734 HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
4735 }
4736
4737 VMXReadVMCS(VMX_VMCS16_HOST_FIELD_TR, &val);
4738 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
4739 if (val < gdtr.cbGdt)
4740 {
4741 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
4742 HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
4743 }
4744
4745 VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
4746 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
4747
4748 VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
4749 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
4750 VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
4751 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
4752
4753 VMXReadVMCS(VMX_VMCS32_HOST_SYSENTER_CS, &val);
4754 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
4755
4756 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
4757 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
4758
4759 VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
4760 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
4761
4762 VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
4763 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
4764 VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
4765 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
4766
4767# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
4768 if (VMX_IS_64BIT_HOST_MODE())
4769 {
4770 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
4771 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
4772 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
4773 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
4774 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
4775 }
4776# endif
4777#endif /* VBOX_STRICT */
4778 }
4779 break;
4780 }
4781
4782 default:
4783 /* impossible */
4784 AssertMsgFailed(("%Rrc (%#x)\n", VBOXSTRICTRC_VAL(rc), VBOXSTRICTRC_VAL(rc)));
4785 break;
4786 }
4787}
4788
4789#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
4790
4791/**
4792 * Prepares for and executes VMLAUNCH (64 bits guest mode)
4793 *
4794 * @returns VBox status code
4795 * @param fResume vmlauch/vmresume
4796 * @param pCtx Guest context
4797 * @param pCache VMCS cache
4798 * @param pVM The VM to operate on.
4799 * @param pVCpu The VMCPU to operate on.
4800 */
4801DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu)
4802{
4803 uint32_t aParam[6];
4804 PHMGLOBLCPUINFO pCpu;
4805 RTHCPHYS HCPhysCpuPage;
4806 int rc;
4807
4808 pCpu = HWACCMR0GetCurrentCpu();
4809 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
4810
4811#ifdef VBOX_WITH_CRASHDUMP_MAGIC
4812 pCache->uPos = 1;
4813 pCache->interPD = PGMGetInterPaeCR3(pVM);
4814 pCache->pSwitcher = (uint64_t)pVM->hwaccm.s.pfnHost32ToGuest64R0;
4815#endif
4816
4817#ifdef DEBUG
4818 pCache->TestIn.HCPhysCpuPage= 0;
4819 pCache->TestIn.HCPhysVMCS = 0;
4820 pCache->TestIn.pCache = 0;
4821 pCache->TestOut.HCPhysVMCS = 0;
4822 pCache->TestOut.pCache = 0;
4823 pCache->TestOut.pCtx = 0;
4824 pCache->TestOut.eflags = 0;
4825#endif
4826
4827 aParam[0] = (uint32_t)(HCPhysCpuPage); /* Param 1: VMXON physical address - Lo. */
4828 aParam[1] = (uint32_t)(HCPhysCpuPage >> 32); /* Param 1: VMXON physical address - Hi. */
4829 aParam[2] = (uint32_t)(pVCpu->hwaccm.s.vmx.HCPhysVMCS); /* Param 2: VMCS physical address - Lo. */
4830 aParam[3] = (uint32_t)(pVCpu->hwaccm.s.vmx.HCPhysVMCS >> 32); /* Param 2: VMCS physical address - Hi. */
4831 aParam[4] = VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hwaccm.s.vmx.VMCSCache);
4832 aParam[5] = 0;
4833
4834#ifdef VBOX_WITH_CRASHDUMP_MAGIC
4835 pCtx->dr[4] = pVM->hwaccm.s.vmx.pScratchPhys + 16 + 8;
4836 *(uint32_t *)(pVM->hwaccm.s.vmx.pScratch + 16 + 8) = 1;
4837#endif
4838 rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hwaccm.s.pfnVMXGCStartVM64, 6, &aParam[0]);
4839
4840#ifdef VBOX_WITH_CRASHDUMP_MAGIC
4841 Assert(*(uint32_t *)(pVM->hwaccm.s.vmx.pScratch + 16 + 8) == 5);
4842 Assert(pCtx->dr[4] == 10);
4843 *(uint32_t *)(pVM->hwaccm.s.vmx.pScratch + 16 + 8) = 0xff;
4844#endif
4845
4846#ifdef DEBUG
4847 AssertMsg(pCache->TestIn.HCPhysCpuPage== HCPhysCpuPage, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysCpuPage, HCPhysCpuPage));
4848 AssertMsg(pCache->TestIn.HCPhysVMCS == pVCpu->hwaccm.s.vmx.HCPhysVMCS, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVMCS, pVCpu->hwaccm.s.vmx.HCPhysVMCS));
4849 AssertMsg(pCache->TestIn.HCPhysVMCS == pCache->TestOut.HCPhysVMCS, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVMCS, pCache->TestOut.HCPhysVMCS));
4850 AssertMsg(pCache->TestIn.pCache == pCache->TestOut.pCache, ("%RGv vs %RGv\n", pCache->TestIn.pCache, pCache->TestOut.pCache));
4851 AssertMsg(pCache->TestIn.pCache == VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hwaccm.s.vmx.VMCSCache), ("%RGv vs %RGv\n", pCache->TestIn.pCache, VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hwaccm.s.vmx.VMCSCache)));
4852 AssertMsg(pCache->TestIn.pCtx == pCache->TestOut.pCtx, ("%RGv vs %RGv\n", pCache->TestIn.pCtx, pCache->TestOut.pCtx));
4853 Assert(!(pCache->TestOut.eflags & X86_EFL_IF));
4854#endif
4855 return rc;
4856}
4857
4858# ifdef VBOX_STRICT
4859
4860static bool hmR0VmxIsValidReadField(uint32_t idxField)
4861{
4862 switch(idxField)
4863 {
4864 case VMX_VMCS64_GUEST_RIP:
4865 case VMX_VMCS64_GUEST_RSP:
4866 case VMX_VMCS_GUEST_RFLAGS:
4867 case VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE:
4868 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
4869 case VMX_VMCS64_GUEST_CR0:
4870 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
4871 case VMX_VMCS64_GUEST_CR4:
4872 case VMX_VMCS64_GUEST_DR7:
4873 case VMX_VMCS32_GUEST_SYSENTER_CS:
4874 case VMX_VMCS64_GUEST_SYSENTER_EIP:
4875 case VMX_VMCS64_GUEST_SYSENTER_ESP:
4876 case VMX_VMCS32_GUEST_GDTR_LIMIT:
4877 case VMX_VMCS64_GUEST_GDTR_BASE:
4878 case VMX_VMCS32_GUEST_IDTR_LIMIT:
4879 case VMX_VMCS64_GUEST_IDTR_BASE:
4880 case VMX_VMCS16_GUEST_FIELD_CS:
4881 case VMX_VMCS32_GUEST_CS_LIMIT:
4882 case VMX_VMCS64_GUEST_CS_BASE:
4883 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
4884 case VMX_VMCS16_GUEST_FIELD_DS:
4885 case VMX_VMCS32_GUEST_DS_LIMIT:
4886 case VMX_VMCS64_GUEST_DS_BASE:
4887 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
4888 case VMX_VMCS16_GUEST_FIELD_ES:
4889 case VMX_VMCS32_GUEST_ES_LIMIT:
4890 case VMX_VMCS64_GUEST_ES_BASE:
4891 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
4892 case VMX_VMCS16_GUEST_FIELD_FS:
4893 case VMX_VMCS32_GUEST_FS_LIMIT:
4894 case VMX_VMCS64_GUEST_FS_BASE:
4895 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
4896 case VMX_VMCS16_GUEST_FIELD_GS:
4897 case VMX_VMCS32_GUEST_GS_LIMIT:
4898 case VMX_VMCS64_GUEST_GS_BASE:
4899 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
4900 case VMX_VMCS16_GUEST_FIELD_SS:
4901 case VMX_VMCS32_GUEST_SS_LIMIT:
4902 case VMX_VMCS64_GUEST_SS_BASE:
4903 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
4904 case VMX_VMCS16_GUEST_FIELD_LDTR:
4905 case VMX_VMCS32_GUEST_LDTR_LIMIT:
4906 case VMX_VMCS64_GUEST_LDTR_BASE:
4907 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
4908 case VMX_VMCS16_GUEST_FIELD_TR:
4909 case VMX_VMCS32_GUEST_TR_LIMIT:
4910 case VMX_VMCS64_GUEST_TR_BASE:
4911 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
4912 case VMX_VMCS32_RO_EXIT_REASON:
4913 case VMX_VMCS32_RO_VM_INSTR_ERROR:
4914 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
4915 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERRCODE:
4916 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
4917 case VMX_VMCS32_RO_EXIT_INSTR_INFO:
4918 case VMX_VMCS_RO_EXIT_QUALIFICATION:
4919 case VMX_VMCS32_RO_IDT_INFO:
4920 case VMX_VMCS32_RO_IDT_ERRCODE:
4921 case VMX_VMCS64_GUEST_CR3:
4922 case VMX_VMCS_EXIT_PHYS_ADDR_FULL:
4923 return true;
4924 }
4925 return false;
4926}
4927
4928static bool hmR0VmxIsValidWriteField(uint32_t idxField)
4929{
4930 switch(idxField)
4931 {
4932 case VMX_VMCS64_GUEST_LDTR_BASE:
4933 case VMX_VMCS64_GUEST_TR_BASE:
4934 case VMX_VMCS64_GUEST_GDTR_BASE:
4935 case VMX_VMCS64_GUEST_IDTR_BASE:
4936 case VMX_VMCS64_GUEST_SYSENTER_EIP:
4937 case VMX_VMCS64_GUEST_SYSENTER_ESP:
4938 case VMX_VMCS64_GUEST_CR0:
4939 case VMX_VMCS64_GUEST_CR4:
4940 case VMX_VMCS64_GUEST_CR3:
4941 case VMX_VMCS64_GUEST_DR7:
4942 case VMX_VMCS64_GUEST_RIP:
4943 case VMX_VMCS64_GUEST_RSP:
4944 case VMX_VMCS64_GUEST_CS_BASE:
4945 case VMX_VMCS64_GUEST_DS_BASE:
4946 case VMX_VMCS64_GUEST_ES_BASE:
4947 case VMX_VMCS64_GUEST_FS_BASE:
4948 case VMX_VMCS64_GUEST_GS_BASE:
4949 case VMX_VMCS64_GUEST_SS_BASE:
4950 return true;
4951 }
4952 return false;
4953}
4954
4955# endif /* VBOX_STRICT */
4956
4957/**
4958 * Executes the specified handler in 64 mode
4959 *
4960 * @returns VBox status code.
4961 * @param pVM The VM to operate on.
4962 * @param pVCpu The VMCPU to operate on.
4963 * @param pCtx Guest context
4964 * @param pfnHandler RC handler
4965 * @param cbParam Number of parameters
4966 * @param paParam Array of 32 bits parameters
4967 */
4968VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam, uint32_t *paParam)
4969{
4970 int rc, rc2;
4971 PHMGLOBLCPUINFO pCpu;
4972 RTHCPHYS HCPhysCpuPage;
4973 RTHCUINTREG uOldEFlags;
4974
4975 AssertReturn(pVM->hwaccm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
4976 Assert(pfnHandler);
4977 Assert(pVCpu->hwaccm.s.vmx.VMCSCache.Write.cValidEntries <= RT_ELEMENTS(pVCpu->hwaccm.s.vmx.VMCSCache.Write.aField));
4978 Assert(pVCpu->hwaccm.s.vmx.VMCSCache.Read.cValidEntries <= RT_ELEMENTS(pVCpu->hwaccm.s.vmx.VMCSCache.Read.aField));
4979
4980#ifdef VBOX_STRICT
4981 for (unsigned i=0;i<pVCpu->hwaccm.s.vmx.VMCSCache.Write.cValidEntries;i++)
4982 Assert(hmR0VmxIsValidWriteField(pVCpu->hwaccm.s.vmx.VMCSCache.Write.aField[i]));
4983
4984 for (unsigned i=0;i<pVCpu->hwaccm.s.vmx.VMCSCache.Read.cValidEntries;i++)
4985 Assert(hmR0VmxIsValidReadField(pVCpu->hwaccm.s.vmx.VMCSCache.Read.aField[i]));
4986#endif
4987
4988 /* Disable interrupts. */
4989 uOldEFlags = ASMIntDisableFlags();
4990
4991 pCpu = HWACCMR0GetCurrentCpu();
4992 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
4993
4994 /* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
4995 VMXClearVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
4996
4997 /* Leave VMX Root Mode. */
4998 VMXDisable();
4999
5000 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5001
5002 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
5003 CPUMSetHyperEIP(pVCpu, pfnHandler);
5004 for (int i=(int)cbParam-1;i>=0;i--)
5005 CPUMPushHyper(pVCpu, paParam[i]);
5006
5007 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
5008 /* Call switcher. */
5009 rc = pVM->hwaccm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
5010 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
5011
5012 /* Make sure the VMX instructions don't cause #UD faults. */
5013 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
5014
5015 /* Enter VMX Root Mode */
5016 rc2 = VMXEnable(HCPhysCpuPage);
5017 if (RT_FAILURE(rc2))
5018 {
5019 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5020 ASMSetFlags(uOldEFlags);
5021 return VERR_VMX_VMXON_FAILED;
5022 }
5023
5024 rc2 = VMXActivateVMCS(pVCpu->hwaccm.s.vmx.HCPhysVMCS);
5025 AssertRC(rc2);
5026 Assert(!(ASMGetFlags() & X86_EFL_IF));
5027 ASMSetFlags(uOldEFlags);
5028 return rc;
5029}
5030
5031#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL) */
5032
5033
5034#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0)
5035/**
5036 * Executes VMWRITE
5037 *
5038 * @returns VBox status code
5039 * @param pVCpu The VMCPU to operate on.
5040 * @param idxField VMCS index
5041 * @param u64Val 16, 32 or 64 bits value
5042 */
5043VMMR0DECL(int) VMXWriteVMCS64Ex(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5044{
5045 int rc;
5046
5047 switch (idxField)
5048 {
5049 case VMX_VMCS_CTRL_TSC_OFFSET_FULL:
5050 case VMX_VMCS_CTRL_IO_BITMAP_A_FULL:
5051 case VMX_VMCS_CTRL_IO_BITMAP_B_FULL:
5052 case VMX_VMCS_CTRL_MSR_BITMAP_FULL:
5053 case VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL:
5054 case VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL:
5055 case VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL:
5056 case VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL:
5057 case VMX_VMCS_CTRL_APIC_ACCESSADDR_FULL:
5058 case VMX_VMCS_GUEST_LINK_PTR_FULL:
5059 case VMX_VMCS_GUEST_PDPTR0_FULL:
5060 case VMX_VMCS_GUEST_PDPTR1_FULL:
5061 case VMX_VMCS_GUEST_PDPTR2_FULL:
5062 case VMX_VMCS_GUEST_PDPTR3_FULL:
5063 case VMX_VMCS_GUEST_DEBUGCTL_FULL:
5064 case VMX_VMCS_GUEST_EFER_FULL:
5065 case VMX_VMCS_CTRL_EPTP_FULL:
5066 /* These fields consist of two parts, which are both writable in 32 bits mode. */
5067 rc = VMXWriteVMCS32(idxField, u64Val);
5068 rc |= VMXWriteVMCS32(idxField + 1, (uint32_t)(u64Val >> 32ULL));
5069 AssertRC(rc);
5070 return rc;
5071
5072 case VMX_VMCS64_GUEST_LDTR_BASE:
5073 case VMX_VMCS64_GUEST_TR_BASE:
5074 case VMX_VMCS64_GUEST_GDTR_BASE:
5075 case VMX_VMCS64_GUEST_IDTR_BASE:
5076 case VMX_VMCS64_GUEST_SYSENTER_EIP:
5077 case VMX_VMCS64_GUEST_SYSENTER_ESP:
5078 case VMX_VMCS64_GUEST_CR0:
5079 case VMX_VMCS64_GUEST_CR4:
5080 case VMX_VMCS64_GUEST_CR3:
5081 case VMX_VMCS64_GUEST_DR7:
5082 case VMX_VMCS64_GUEST_RIP:
5083 case VMX_VMCS64_GUEST_RSP:
5084 case VMX_VMCS64_GUEST_CS_BASE:
5085 case VMX_VMCS64_GUEST_DS_BASE:
5086 case VMX_VMCS64_GUEST_ES_BASE:
5087 case VMX_VMCS64_GUEST_FS_BASE:
5088 case VMX_VMCS64_GUEST_GS_BASE:
5089 case VMX_VMCS64_GUEST_SS_BASE:
5090 /* Queue a 64 bits value as we can't set it in 32 bits host mode. */
5091 if (u64Val >> 32ULL)
5092 rc = VMXWriteCachedVMCSEx(pVCpu, idxField, u64Val);
5093 else
5094 rc = VMXWriteVMCS32(idxField, (uint32_t)u64Val);
5095
5096 return rc;
5097
5098 default:
5099 AssertMsgFailed(("Unexpected field %x\n", idxField));
5100 return VERR_INVALID_PARAMETER;
5101 }
5102}
5103
5104/**
5105 * Cache VMCS writes for performance reasons (Darwin) and for running 64 bits guests on 32 bits hosts.
5106 *
5107 * @param pVCpu The VMCPU to operate on.
5108 * @param idxField VMCS field
5109 * @param u64Val Value
5110 */
5111VMMR0DECL(int) VMXWriteCachedVMCSEx(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5112{
5113 PVMCSCACHE pCache = &pVCpu->hwaccm.s.vmx.VMCSCache;
5114
5115 AssertMsgReturn(pCache->Write.cValidEntries < VMCSCACHE_MAX_ENTRY - 1, ("entries=%x\n", pCache->Write.cValidEntries), VERR_ACCESS_DENIED);
5116
5117 /* Make sure there are no duplicates. */
5118 for (unsigned i=0;i<pCache->Write.cValidEntries;i++)
5119 {
5120 if (pCache->Write.aField[i] == idxField)
5121 {
5122 pCache->Write.aFieldVal[i] = u64Val;
5123 return VINF_SUCCESS;
5124 }
5125 }
5126
5127 pCache->Write.aField[pCache->Write.cValidEntries] = idxField;
5128 pCache->Write.aFieldVal[pCache->Write.cValidEntries] = u64Val;
5129 pCache->Write.cValidEntries++;
5130 return VINF_SUCCESS;
5131}
5132
5133#endif /* HC_ARCH_BITS == 32 && !VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0 */
5134
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette