VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 45378

Last change on this file since 45378 was 45378, checked in by vboxsync, 12 years ago

VMM/VMMR0: HM bits. Some stats and adjustments.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 228.6 KB
Line 
1/* $Id: HWVMXR0.cpp 45378 2013-04-05 14:43:12Z vboxsync $ */
2/** @file
3 * HM VMX (VT-x) - Host Context Ring-0.
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_HM
23#include <iprt/asm-amd64-x86.h>
24#include <VBox/vmm/hm.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/dbgf.h>
27#include <VBox/vmm/dbgftrace.h>
28#include <VBox/vmm/selm.h>
29#include <VBox/vmm/iom.h>
30#ifdef VBOX_WITH_REM
31# include <VBox/vmm/rem.h>
32#endif
33#include <VBox/vmm/tm.h>
34#include "HMInternal.h"
35#include <VBox/vmm/vm.h>
36#include <VBox/vmm/pdmapi.h>
37#include <VBox/err.h>
38#include <VBox/log.h>
39#include <iprt/assert.h>
40#include <iprt/param.h>
41#include <iprt/string.h>
42#include <iprt/time.h>
43#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
44# include <iprt/thread.h>
45#endif
46#include <iprt/x86.h>
47#include "HWVMXR0.h"
48
49#include "dtrace/VBoxVMM.h"
50
51
52/*******************************************************************************
53* Defined Constants And Macros *
54*******************************************************************************/
55#if defined(RT_ARCH_AMD64)
56# define VMX_IS_64BIT_HOST_MODE() (true)
57#elif defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
58# define VMX_IS_64BIT_HOST_MODE() (g_fVMXIs64bitHost != 0)
59#else
60# define VMX_IS_64BIT_HOST_MODE() (false)
61#endif
62
63# define VMX_WRITE_SELREG(REG, reg) \
64 do \
65 { \
66 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_##REG, pCtx->reg.Sel); \
67 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, pCtx->reg.u32Limit); \
68 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_##REG##_BASE, pCtx->reg.u64Base); \
69 if ((pCtx->eflags.u32 & X86_EFL_VM)) \
70 { \
71 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
72 /* DPL=3, present, code/data, r/w/accessed. */ \
73 /** @todo we shouldn't have to do this, if it is not 0xf3 it means we screwed up elsewhere (recompiler). */ \
74 /** @todo VT-x docs explicitly mentions 0xF3. Why not just val = 0xf3 ??. */ \
75 val = (pCtx->reg.Attr.u & ~0xFF) | 0xF3; \
76 } \
77 else \
78 if ( CPUMIsGuestInRealModeEx(pCtx) \
79 && !pVM->hm.s.vmx.fUnrestrictedGuest) \
80 { \
81 /** @todo shouldn't the 'if' condition above check for 'pRealModeTSS' ? */ \
82 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
83 /* DPL=3, present, code/data, r/w/accessed. */ \
84 val = 0xf3; \
85 } \
86 else \
87 if ( ( pCtx->reg.Sel \
88 || !CPUMIsGuestInPagedProtectedModeEx(pCtx) \
89 || (!pCtx->cs.Attr.n.u1DefBig && !CPUMIsGuestIn64BitCodeEx(pCtx)) \
90 ) \
91 && pCtx->reg.Attr.n.u1Present == 1) \
92 { \
93 val = pCtx->reg.Attr.u | X86_SEL_TYPE_ACCESSED; \
94 } \
95 else \
96 val = 0x10000; /* Invalid guest state error otherwise. (BIT(16) = Unusable) */ \
97 \
98 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, val); \
99 } while (0)
100
101# define VMX_READ_SELREG(REG, reg) \
102 do \
103 { \
104 VMXReadCachedVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &val); \
105 pCtx->reg.Sel = val; \
106 pCtx->reg.ValidSel = val; \
107 pCtx->reg.fFlags = CPUMSELREG_FLAGS_VALID; \
108 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &val); \
109 pCtx->reg.u32Limit = val; \
110 VMXReadCachedVmcs(VMX_VMCS_GUEST_##REG##_BASE, &val); \
111 pCtx->reg.u64Base = val; \
112 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &val); \
113 pCtx->reg.Attr.u = val; \
114 } while (0)
115
116/* Don't read from the cache in this macro; used only in case of failure where the cache is out of sync. */
117# define VMX_LOG_SELREG(REG, szSelReg, val) \
118 do \
119 { \
120 VMXReadVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &(val)); \
121 Log(("%s Selector %x\n", szSelReg, (val))); \
122 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &(val)); \
123 Log(("%s Limit %x\n", szSelReg, (val))); \
124 VMXReadVmcs(VMX_VMCS_GUEST_##REG##_BASE, &(val)); \
125 Log(("%s Base %RX64\n", szSelReg, (uint64_t)(val))); \
126 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &(val)); \
127 Log(("%s Attributes %x\n", szSelReg, (val))); \
128 } while (0)
129
130#define VMXSetupCachedReadVmcs(pCache, idxField) \
131{ \
132 Assert(pCache->Read.aField[idxField##_CACHE_IDX] == 0); \
133 pCache->Read.aField[idxField##_CACHE_IDX] = idxField; \
134 pCache->Read.aFieldVal[idxField##_CACHE_IDX] = 0; \
135}
136#define VMX_SETUP_SELREG(REG, pCache) \
137{ \
138 VMXSetupCachedReadVmcs(pCache, VMX_VMCS16_GUEST_FIELD_##REG); \
139 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_LIMIT); \
140 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_##REG##_BASE); \
141 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS); \
142}
143
144
145/*******************************************************************************
146* Global Variables *
147*******************************************************************************/
148/* IO operation lookup arrays. */
149static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
150static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
151
152#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
153/** See HMR0A.asm. */
154extern "C" uint32_t g_fVMXIs64bitHost;
155#endif
156
157
158/*******************************************************************************
159* Local Functions *
160*******************************************************************************/
161static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu);
162static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu);
163static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu);
164static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu);
165static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush);
166static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr);
167static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
168static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
169static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx);
170
171
172/**
173 * Updates error from VMCS to HMCPU's lasterror record.
174 *
175 * @param pVM Pointer to the VM.
176 * @param pVCpu Pointer to the VMCPU.
177 * @param rc The error code.
178 */
179static void hmR0VmxCheckError(PVM pVM, PVMCPU pVCpu, int rc)
180{
181 if (rc == VERR_VMX_GENERIC)
182 {
183 RTCCUINTREG instrError;
184
185 VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
186 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
187 }
188 pVM->hm.s.lLastError = rc;
189}
190
191
192/**
193 * Sets up and activates VT-x on the current CPU.
194 *
195 * @returns VBox status code.
196 * @param pCpu Pointer to the CPU info struct.
197 * @param pVM Pointer to the VM. (can be NULL after a resume!!)
198 * @param pvCpuPage Pointer to the global CPU page.
199 * @param HCPhysCpuPage Physical address of the global CPU page.
200 * @param fEnabledByHost Set if SUPR0EnableVTx or similar was used to enable
201 * VT-x/AMD-V on the host.
202 */
203VMMR0DECL(int) VMXR0EnableCpu(PHMGLOBLCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage, bool fEnabledByHost)
204{
205 if (!fEnabledByHost)
206 {
207 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
208 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
209
210 if (pVM)
211 {
212 /* Set revision dword at the beginning of the VMXON structure. */
213 *(uint32_t *)pvCpuPage = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
214 }
215
216 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
217 * (which can have very bad consequences!!!)
218 */
219
220 /** @todo r=bird: Why is this code different than the probing code earlier
221 * on? It just sets VMXE if needed and doesn't check that it isn't
222 * set. Mac OS X host_vmxoff may leave this set and we'll fail here
223 * and debug-assert in the calling code. This is what caused the
224 * "regression" after backing out the SUPR0EnableVTx code hours before
225 * 4.2.0GA (reboot fixed the issue). I've changed here to do the same
226 * as the init code. */
227 uint64_t uCr4 = ASMGetCR4();
228 if (!(uCr4 & X86_CR4_VMXE))
229 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE); /* Make sure the VMX instructions don't cause #UD faults. */
230
231 /*
232 * Enter VM root mode.
233 */
234 int rc = VMXEnable(HCPhysCpuPage);
235 if (RT_FAILURE(rc))
236 {
237 ASMSetCR4(uCr4);
238 return VERR_VMX_VMXON_FAILED;
239 }
240 }
241
242 /*
243 * Flush all VPIDs (in case we or any other hypervisor have been using VPIDs) so that
244 * we can avoid an explicit flush while using new VPIDs. We would still need to flush
245 * each time while reusing a VPID after hitting the MaxASID limit once.
246 */
247 if ( pVM
248 && pVM->hm.s.vmx.fVpid
249 && (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS))
250 {
251 hmR0VmxFlushVPID(pVM, NULL /* pvCpu */, VMX_FLUSH_VPID_ALL_CONTEXTS, 0 /* GCPtr */);
252 pCpu->fFlushAsidBeforeUse = false;
253 }
254 else
255 pCpu->fFlushAsidBeforeUse = true;
256
257 /*
258 * Ensure each VCPU scheduled on this CPU gets a new VPID on resume. See @bugref{6255}.
259 */
260 ++pCpu->cTlbFlushes;
261
262 return VINF_SUCCESS;
263}
264
265
266/**
267 * Deactivates VT-x on the current CPU.
268 *
269 * @returns VBox status code.
270 * @param pCpu Pointer to the CPU info struct.
271 * @param pvCpuPage Pointer to the global CPU page.
272 * @param HCPhysCpuPage Physical address of the global CPU page.
273 */
274VMMR0DECL(int) VMXR0DisableCpu(PHMGLOBLCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
275{
276 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
277 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
278 NOREF(pCpu);
279
280 /* If we're somehow not in VMX root mode, then we shouldn't dare leaving it. */
281 if (!(ASMGetCR4() & X86_CR4_VMXE))
282 return VERR_VMX_NOT_IN_VMX_ROOT_MODE;
283
284 /* Leave VMX Root Mode. */
285 VMXDisable();
286
287 /* And clear the X86_CR4_VMXE bit. */
288 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
289 return VINF_SUCCESS;
290}
291
292VMMR0DECL(int) VMXR0GlobalInit(void)
293{
294 /* Nothing to do. */
295 return VINF_SUCCESS;
296}
297
298VMMR0DECL(void) VMXR0GlobalTerm(void)
299{
300 /* Nothing to do. */
301}
302
303/**
304 * Does Ring-0 per VM VT-x initialization.
305 *
306 * @returns VBox status code.
307 * @param pVM Pointer to the VM.
308 */
309VMMR0DECL(int) VMXR0InitVM(PVM pVM)
310{
311 int rc;
312
313#ifdef LOG_ENABLED
314 SUPR0Printf("VMXR0InitVM %p\n", pVM);
315#endif
316
317 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
318
319 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
320 {
321 /* Allocate one page for the APIC physical page (serves for filtering accesses). */
322 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjApicAccess, PAGE_SIZE, false /* fExecutable */);
323 AssertRC(rc);
324 if (RT_FAILURE(rc))
325 return rc;
326
327 pVM->hm.s.vmx.pbApicAccess = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjApicAccess);
328 pVM->hm.s.vmx.HCPhysApicAccess = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjApicAccess, 0);
329 ASMMemZero32(pVM->hm.s.vmx.pbApicAccess, PAGE_SIZE);
330 }
331 else
332 {
333 pVM->hm.s.vmx.hMemObjApicAccess = 0;
334 pVM->hm.s.vmx.pbApicAccess = 0;
335 pVM->hm.s.vmx.HCPhysApicAccess = 0;
336 }
337
338#ifdef VBOX_WITH_CRASHDUMP_MAGIC
339 {
340 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjScratch, PAGE_SIZE, false /* fExecutable */);
341 AssertRC(rc);
342 if (RT_FAILURE(rc))
343 return rc;
344
345 pVM->hm.s.vmx.pScratch = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjScratch);
346 pVM->hm.s.vmx.pScratchPhys = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjScratch, 0);
347
348 ASMMemZero32(pVM->hm.s.vmx.pbScratch, PAGE_SIZE);
349 strcpy((char *)pVM->hm.s.vmx.pbScratch, "SCRATCH Magic");
350 *(uint64_t *)(pVM->hm.s.vmx.pbScratch + 16) = UINT64_C(0xDEADBEEFDEADBEEF);
351 }
352#endif
353
354 /* Allocate VMCSs for all guest CPUs. */
355 for (VMCPUID i = 0; i < pVM->cCpus; i++)
356 {
357 PVMCPU pVCpu = &pVM->aCpus[i];
358
359 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
360
361 /* Allocate one page for the VM control structure (VMCS). */
362 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVmcs, PAGE_SIZE, false /* fExecutable */);
363 AssertRC(rc);
364 if (RT_FAILURE(rc))
365 return rc;
366
367 pVCpu->hm.s.vmx.pvVmcs = RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVmcs);
368 pVCpu->hm.s.vmx.HCPhysVmcs = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVmcs, 0);
369 ASMMemZeroPage(pVCpu->hm.s.vmx.pvVmcs);
370
371 pVCpu->hm.s.vmx.cr0_mask = 0;
372 pVCpu->hm.s.vmx.cr4_mask = 0;
373
374 /* Allocate one page for the virtual APIC page for TPR caching. */
375 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVirtApic, PAGE_SIZE, false /* fExecutable */);
376 AssertRC(rc);
377 if (RT_FAILURE(rc))
378 return rc;
379
380 pVCpu->hm.s.vmx.pbVirtApic = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVirtApic);
381 pVCpu->hm.s.vmx.HCPhysVirtApic = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVirtApic, 0);
382 ASMMemZeroPage(pVCpu->hm.s.vmx.pbVirtApic);
383
384 /* Allocate the MSR bitmap if this feature is supported. */
385 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
386 {
387 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjMsrBitmap, PAGE_SIZE, false /* fExecutable */);
388 AssertRC(rc);
389 if (RT_FAILURE(rc))
390 return rc;
391
392 pVCpu->hm.s.vmx.pvMsrBitmap = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjMsrBitmap);
393 pVCpu->hm.s.vmx.HCPhysMsrBitmap = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjMsrBitmap, 0);
394 memset(pVCpu->hm.s.vmx.pvMsrBitmap, 0xff, PAGE_SIZE);
395 }
396
397#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
398 /* Allocate one page for the guest MSR load area (for preloading guest MSRs during the world switch). */
399 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjGuestMsr, PAGE_SIZE, false /* fExecutable */);
400 AssertRC(rc);
401 if (RT_FAILURE(rc))
402 return rc;
403
404 pVCpu->hm.s.vmx.pvGuestMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjGuestMsr);
405 pVCpu->hm.s.vmx.HCPhysGuestMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjGuestMsr, 0);
406 Assert(!(pVCpu->hm.s.vmx.HCPhysGuestMsr & 0xf));
407 memset(pVCpu->hm.s.vmx.pvGuestMsr, 0, PAGE_SIZE);
408
409 /* Allocate one page for the host MSR load area (for restoring host MSRs after the world switch back). */
410 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjHostMsr, PAGE_SIZE, false /* fExecutable */);
411 AssertRC(rc);
412 if (RT_FAILURE(rc))
413 return rc;
414
415 pVCpu->hm.s.vmx.pvHostMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjHostMsr);
416 pVCpu->hm.s.vmx.HCPhysHostMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjHostMsr, 0);
417 Assert(!(pVCpu->hm.s.vmx.HCPhysHostMsr & 0xf));
418 memset(pVCpu->hm.s.vmx.pvHostMsr, 0, PAGE_SIZE);
419#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
420
421 /* Current guest paging mode. */
422 pVCpu->hm.s.vmx.enmLastSeenGuestMode = PGMMODE_REAL;
423
424#ifdef LOG_ENABLED
425 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hm.s.vmx.pvVmcs, (uint32_t)pVCpu->hm.s.vmx.HCPhysVmcs);
426#endif
427 }
428
429 return VINF_SUCCESS;
430}
431
432
433/**
434 * Does Ring-0 per VM VT-x termination.
435 *
436 * @returns VBox status code.
437 * @param pVM Pointer to the VM.
438 */
439VMMR0DECL(int) VMXR0TermVM(PVM pVM)
440{
441 for (VMCPUID i = 0; i < pVM->cCpus; i++)
442 {
443 PVMCPU pVCpu = &pVM->aCpus[i];
444
445 if (pVCpu->hm.s.vmx.hMemObjVmcs != NIL_RTR0MEMOBJ)
446 {
447 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVmcs, false);
448 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
449 pVCpu->hm.s.vmx.pvVmcs = 0;
450 pVCpu->hm.s.vmx.HCPhysVmcs = 0;
451 }
452 if (pVCpu->hm.s.vmx.hMemObjVirtApic != NIL_RTR0MEMOBJ)
453 {
454 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVirtApic, false);
455 pVCpu->hm.s.vmx.hMemObjVirtApic = NIL_RTR0MEMOBJ;
456 pVCpu->hm.s.vmx.pbVirtApic = 0;
457 pVCpu->hm.s.vmx.HCPhysVirtApic = 0;
458 }
459 if (pVCpu->hm.s.vmx.hMemObjMsrBitmap != NIL_RTR0MEMOBJ)
460 {
461 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjMsrBitmap, false);
462 pVCpu->hm.s.vmx.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
463 pVCpu->hm.s.vmx.pvMsrBitmap = 0;
464 pVCpu->hm.s.vmx.HCPhysMsrBitmap = 0;
465 }
466#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
467 if (pVCpu->hm.s.vmx.hMemObjHostMsr != NIL_RTR0MEMOBJ)
468 {
469 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjHostMsr, false);
470 pVCpu->hm.s.vmx.hMemObjHostMsr = NIL_RTR0MEMOBJ;
471 pVCpu->hm.s.vmx.pvHostMsr = 0;
472 pVCpu->hm.s.vmx.HCPhysHostMsr = 0;
473 }
474 if (pVCpu->hm.s.vmx.hMemObjGuestMsr != NIL_RTR0MEMOBJ)
475 {
476 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjGuestMsr, false);
477 pVCpu->hm.s.vmx.hMemObjGuestMsr = NIL_RTR0MEMOBJ;
478 pVCpu->hm.s.vmx.pvGuestMsr = 0;
479 pVCpu->hm.s.vmx.HCPhysGuestMsr = 0;
480 }
481#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
482 }
483 if (pVM->hm.s.vmx.hMemObjApicAccess != NIL_RTR0MEMOBJ)
484 {
485 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjApicAccess, false);
486 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
487 pVM->hm.s.vmx.pbApicAccess = 0;
488 pVM->hm.s.vmx.HCPhysApicAccess = 0;
489 }
490#ifdef VBOX_WITH_CRASHDUMP_MAGIC
491 if (pVM->hm.s.vmx.hMemObjScratch != NIL_RTR0MEMOBJ)
492 {
493 ASMMemZero32(pVM->hm.s.vmx.pScratch, PAGE_SIZE);
494 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjScratch, false);
495 pVM->hm.s.vmx.hMemObjScratch = NIL_RTR0MEMOBJ;
496 pVM->hm.s.vmx.pScratch = 0;
497 pVM->hm.s.vmx.pScratchPhys = 0;
498 }
499#endif
500 return VINF_SUCCESS;
501}
502
503
504/**
505 * Sets up VT-x for the specified VM.
506 *
507 * @returns VBox status code.
508 * @param pVM Pointer to the VM.
509 */
510VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
511{
512 int rc = VINF_SUCCESS;
513 uint32_t val;
514
515 AssertReturn(pVM, VERR_INVALID_PARAMETER);
516
517 /* Initialize these always, see hmR3InitFinalizeR0().*/
518 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NONE;
519 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NONE;
520
521 /* Determine optimal flush type for EPT. */
522 if (pVM->hm.s.fNestedPaging)
523 {
524 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT)
525 {
526 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_SINGLE_CONTEXT)
527 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_SINGLE_CONTEXT;
528 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_ALL_CONTEXTS)
529 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_ALL_CONTEXTS;
530 else
531 {
532 /*
533 * Should never really happen. EPT is supported but no suitable flush types supported.
534 * We cannot ignore EPT at this point as we've already setup Unrestricted Guest execution.
535 */
536 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
537 return VERR_VMX_GENERIC;
538 }
539 }
540 else
541 {
542 /*
543 * Should never really happen. EPT is supported but INVEPT instruction is not supported.
544 */
545 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
546 return VERR_VMX_GENERIC;
547 }
548 }
549
550 /* Determine optimal flush type for VPID. */
551 if (pVM->hm.s.vmx.fVpid)
552 {
553 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID)
554 {
555 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
556 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_SINGLE_CONTEXT;
557 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS)
558 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_ALL_CONTEXTS;
559 else
560 {
561 /*
562 * Neither SINGLE nor ALL context flush types for VPID supported by the CPU.
563 * We do not handle other flush type combinations, ignore VPID capabilities.
564 */
565 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
566 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_INDIV_ADDR supported. Ignoring VPID.\n"));
567 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT_RETAIN_GLOBALS)
568 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_SINGLE_CONTEXT_RETAIN_GLOBALS supported. Ignoring VPID.\n"));
569 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
570 pVM->hm.s.vmx.fVpid = false;
571 }
572 }
573 else
574 {
575 /*
576 * Should not really happen. EPT is supported but INVEPT is not supported.
577 * Ignore VPID capabilities as our code relies on using INVEPT for selective flushing.
578 */
579 Log(("VMXR0SetupVM: VPID supported without INVEPT support. Ignoring VPID.\n"));
580 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
581 pVM->hm.s.vmx.fVpid = false;
582 }
583 }
584
585 for (VMCPUID i = 0; i < pVM->cCpus; i++)
586 {
587 PVMCPU pVCpu = &pVM->aCpus[i];
588
589 AssertPtr(pVCpu->hm.s.vmx.pvVmcs);
590
591 /* Set revision dword at the beginning of the VMCS structure. */
592 *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
593
594 /*
595 * Clear and activate the VMCS.
596 */
597 Log(("HCPhysVmcs = %RHp\n", pVCpu->hm.s.vmx.HCPhysVmcs));
598 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
599 if (RT_FAILURE(rc))
600 goto vmx_end;
601
602 rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
603 if (RT_FAILURE(rc))
604 goto vmx_end;
605
606 /*
607 * VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
608 * Set required bits to one and zero according to the MSR capabilities.
609 */
610 val = pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
611 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT /* External interrupts */
612 | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT; /* Non-maskable interrupts */
613
614 /*
615 * Enable the VMX preemption timer.
616 */
617 if (pVM->hm.s.vmx.fUsePreemptTimer)
618 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_PREEMPT_TIMER;
619 val &= pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
620
621 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, val);
622 AssertRC(rc);
623 pVCpu->hm.s.vmx.u32PinCtls = val;
624
625 /*
626 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
627 * Set required bits to one and zero according to the MSR capabilities.
628 */
629 val = pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
630 /* Program which event cause VM-exits and which features we want to use. */
631 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
632 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TSC_OFFSETTING
633 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
634 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
635 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDPMC_EXIT
636 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_EXIT
637 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside
638 the guest (host thinks the cpu load is high) */
639
640 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
641 if (!pVM->hm.s.fNestedPaging)
642 {
643 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
644 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
645 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
646 }
647
648 /*
649 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch
650 * failure with an invalid control fields error. (combined with some other exit reasons)
651 */
652 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
653 {
654 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
655 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
656 Assert(pVM->hm.s.vmx.pbApicAccess);
657 }
658 else
659 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
660 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
661
662 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
663 {
664 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
665 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
666 }
667
668 /* We will use the secondary control if it's present. */
669 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
670
671 /* Mask away the bits that the CPU doesn't support */
672 /** @todo make sure they don't conflict with the above requirements. */
673 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
674 pVCpu->hm.s.vmx.u32ProcCtls = val;
675
676 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, val);
677 AssertRC(rc);
678
679 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
680 {
681 /*
682 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
683 * Set required bits to one and zero according to the MSR capabilities.
684 */
685 val = pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
686 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
687
688 if (pVM->hm.s.fNestedPaging)
689 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
690
691 if (pVM->hm.s.vmx.fVpid)
692 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
693
694 if (pVM->hm.s.fHasIoApic)
695 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
696
697 if (pVM->hm.s.vmx.fUnrestrictedGuest)
698 val |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;
699
700 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
701 val |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;
702
703 /* Mask away the bits that the CPU doesn't support */
704 /** @todo make sure they don't conflict with the above requirements. */
705 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
706 pVCpu->hm.s.vmx.u32ProcCtls2 = val;
707 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS2, val);
708 AssertRC(rc);
709 }
710
711 /*
712 * VMX_VMCS_CTRL_CR3_TARGET_COUNT
713 * Set required bits to one and zero according to the MSR capabilities.
714 */
715 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_CR3_TARGET_COUNT, 0);
716 AssertRC(rc);
717
718 /*
719 * Forward all exception except #NM & #PF to the guest.
720 * We always need to check pagefaults since our shadow page table can be out of sync.
721 * And we always lazily sync the FPU & XMM state. .
722 */
723
724 /** @todo Possible optimization:
725 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
726 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
727 * registers ourselves of course.
728 *
729 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
730 */
731
732 /*
733 * Don't filter page faults, all of them should cause a world switch.
734 */
735 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK, 0);
736 AssertRC(rc);
737 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH, 0);
738 AssertRC(rc);
739
740 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0);
741 AssertRC(rc);
742 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_A_FULL, 0);
743 AssertRC(rc);
744 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_B_FULL, 0);
745 AssertRC(rc);
746
747 /*
748 * Set the MSR bitmap address.
749 */
750 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
751 {
752 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
753
754 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_MSR_BITMAP_FULL, pVCpu->hm.s.vmx.HCPhysMsrBitmap);
755 AssertRC(rc);
756
757 /*
758 * Allow the guest to directly modify these MSRs; they are loaded/stored automatically
759 * using MSR-load/store areas in the VMCS.
760 */
761 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
762 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
763 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
764 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
765 hmR0VmxSetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
766 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
767 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
768 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
769 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
770 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
771 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_TSC_AUX, true, true);
772 }
773
774#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
775 /*
776 * Set the guest & host MSR load/store physical addresses.
777 */
778 Assert(pVCpu->hm.s.vmx.HCPhysGuestMsr);
779 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
780 AssertRC(rc);
781 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
782 AssertRC(rc);
783 Assert(pVCpu->hm.s.vmx.HCPhysHostMsr);
784 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysHostMsr);
785 AssertRC(rc);
786#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
787
788 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, 0);
789 AssertRC(rc);
790 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, 0);
791 AssertRC(rc);
792 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, 0);
793 AssertRC(rc);
794
795 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
796 {
797 Assert(pVM->hm.s.vmx.hMemObjApicAccess);
798 /* Optional */
799 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, 0);
800 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hm.s.vmx.HCPhysVirtApic);
801
802 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
803 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL, pVM->hm.s.vmx.HCPhysApicAccess);
804
805 AssertRC(rc);
806 }
807
808 /* Set link pointer to -1. Not currently used. */
809 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
810 AssertRC(rc);
811
812 /*
813 * Clear VMCS, marking it inactive. Clear implementation specific data and writing back
814 * VMCS data back to memory.
815 */
816 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
817 AssertRC(rc);
818
819 /*
820 * Configure the VMCS read cache.
821 */
822 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
823
824 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RIP);
825 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RSP);
826 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RFLAGS);
827 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE);
828 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR0_READ_SHADOW);
829 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR0);
830 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR4_READ_SHADOW);
831 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR4);
832 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_DR7);
833 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_SYSENTER_CS);
834 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_EIP);
835 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_ESP);
836 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_GDTR_LIMIT);
837 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_GDTR_BASE);
838 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_IDTR_LIMIT);
839 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_IDTR_BASE);
840
841 VMX_SETUP_SELREG(ES, pCache);
842 VMX_SETUP_SELREG(SS, pCache);
843 VMX_SETUP_SELREG(CS, pCache);
844 VMX_SETUP_SELREG(DS, pCache);
845 VMX_SETUP_SELREG(FS, pCache);
846 VMX_SETUP_SELREG(GS, pCache);
847 VMX_SETUP_SELREG(LDTR, pCache);
848 VMX_SETUP_SELREG(TR, pCache);
849
850 /*
851 * Status code VMCS reads.
852 */
853 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_REASON);
854 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_VM_INSTR_ERROR);
855 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_LENGTH);
856 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE);
857 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO);
858 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_INFO);
859 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_RO_EXIT_QUALIFICATION);
860 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_INFO);
861 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_ERROR_CODE);
862
863 if (pVM->hm.s.fNestedPaging)
864 {
865 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR3);
866 VMXSetupCachedReadVmcs(pCache, VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL);
867 pCache->Read.cValidEntries = VMX_VMCS_MAX_NESTED_PAGING_CACHE_IDX;
868 }
869 else
870 pCache->Read.cValidEntries = VMX_VMCS_MAX_CACHE_IDX;
871 } /* for each VMCPU */
872
873 /*
874 * Setup the right TLB function based on CPU capabilities.
875 */
876 if (pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid)
877 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBBoth;
878 else if (pVM->hm.s.fNestedPaging)
879 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBEPT;
880 else if (pVM->hm.s.vmx.fVpid)
881 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBVPID;
882 else
883 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBDummy;
884
885vmx_end:
886 hmR0VmxCheckError(pVM, &pVM->aCpus[0], rc);
887 return rc;
888}
889
890
891/**
892 * Sets the permission bits for the specified MSR.
893 *
894 * @param pVCpu Pointer to the VMCPU.
895 * @param ulMSR The MSR value.
896 * @param fRead Whether reading is allowed.
897 * @param fWrite Whether writing is allowed.
898 */
899static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
900{
901 unsigned ulBit;
902 uint8_t *pvMsrBitmap = (uint8_t *)pVCpu->hm.s.vmx.pvMsrBitmap;
903
904 /*
905 * Layout:
906 * 0x000 - 0x3ff - Low MSR read bits
907 * 0x400 - 0x7ff - High MSR read bits
908 * 0x800 - 0xbff - Low MSR write bits
909 * 0xc00 - 0xfff - High MSR write bits
910 */
911 if (ulMSR <= 0x00001FFF)
912 {
913 /* Pentium-compatible MSRs */
914 ulBit = ulMSR;
915 }
916 else if ( ulMSR >= 0xC0000000
917 && ulMSR <= 0xC0001FFF)
918 {
919 /* AMD Sixth Generation x86 Processor MSRs */
920 ulBit = (ulMSR - 0xC0000000);
921 pvMsrBitmap += 0x400;
922 }
923 else
924 {
925 AssertFailed();
926 return;
927 }
928
929 Assert(ulBit <= 0x1fff);
930 if (fRead)
931 ASMBitClear(pvMsrBitmap, ulBit);
932 else
933 ASMBitSet(pvMsrBitmap, ulBit);
934
935 if (fWrite)
936 ASMBitClear(pvMsrBitmap + 0x800, ulBit);
937 else
938 ASMBitSet(pvMsrBitmap + 0x800, ulBit);
939}
940
941
942/**
943 * Injects an event (trap or external interrupt).
944 *
945 * @returns VBox status code. Note that it may return VINF_EM_RESET to
946 * indicate a triple fault when injecting X86_XCPT_DF.
947 *
948 * @param pVM Pointer to the VM.
949 * @param pVCpu Pointer to the VMCPU.
950 * @param pCtx Pointer to the guest CPU Context.
951 * @param intInfo VMX interrupt info.
952 * @param cbInstr Opcode length of faulting instruction.
953 * @param errCode Error code (optional).
954 */
955static int hmR0VmxInjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
956{
957 int rc;
958 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
959
960#ifdef VBOX_WITH_STATISTICS
961 STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[iGate & MASK_INJECT_IRQ_STAT]);
962#endif
963
964#ifdef VBOX_STRICT
965 if (iGate == 0xE)
966 {
967 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%RGv intInfo=%08x\n", iGate,
968 (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
969 }
970 else if (iGate < 0x20)
971 {
972 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip,
973 errCode));
974 }
975 else
976 {
977 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
978 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
979 || !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
980 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
981 || pCtx->eflags.u32 & X86_EFL_IF);
982 }
983#endif
984
985 if ( CPUMIsGuestInRealModeEx(pCtx)
986 && pVM->hm.s.vmx.pRealModeTSS)
987 {
988 RTGCPHYS GCPhysHandler;
989 uint16_t offset, ip;
990 RTSEL sel;
991
992 /*
993 * Injecting events doesn't work right with real mode emulation.
994 * (#GP if we try to inject external hardware interrupts)
995 * Inject the interrupt or trap directly instead.
996 *
997 * ASSUMES no access handlers for the bits we read or write below (should be safe).
998 */
999 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
1000
1001 /*
1002 * Check if the interrupt handler is present.
1003 */
1004 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
1005 {
1006 Log(("IDT cbIdt violation\n"));
1007 if (iGate != X86_XCPT_DF)
1008 {
1009 uint32_t intInfo2;
1010
1011 intInfo2 = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : (uint32_t)X86_XCPT_GP;
1012 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1013 intInfo2 |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1014 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1015
1016 return hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, 0, 0 /* no error code according to the Intel docs */);
1017 }
1018 Log(("Triple fault -> reset the VM!\n"));
1019 return VINF_EM_RESET;
1020 }
1021 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
1022 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
1023 || iGate == 4)
1024 {
1025 ip = pCtx->ip + cbInstr;
1026 }
1027 else
1028 ip = pCtx->ip;
1029
1030 /*
1031 * Read the selector:offset pair of the interrupt handler.
1032 */
1033 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
1034 rc = PGMPhysSimpleReadGCPhys(pVM, &offset, GCPhysHandler, sizeof(offset)); AssertRC(rc);
1035 rc = PGMPhysSimpleReadGCPhys(pVM, &sel, GCPhysHandler + 2, sizeof(sel)); AssertRC(rc);
1036
1037 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
1038
1039 /*
1040 * Construct the stack frame.
1041 */
1042 /** @todo Check stack limit. */
1043 pCtx->sp -= 2;
1044 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->eflags.u));
1045 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t)); AssertRC(rc);
1046 pCtx->sp -= 2;
1047 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->cs.Sel));
1048 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t)); AssertRC(rc);
1049 pCtx->sp -= 2;
1050 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss.Sel, pCtx->sp, ip));
1051 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &ip, sizeof(ip)); AssertRC(rc);
1052
1053 /*
1054 * Update the CPU state for executing the handler.
1055 */
1056 pCtx->rip = offset;
1057 pCtx->cs.Sel = sel;
1058 pCtx->cs.u64Base = sel << 4;
1059 pCtx->eflags.u &= ~(X86_EFL_IF | X86_EFL_TF | X86_EFL_RF | X86_EFL_AC);
1060
1061 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_SEGMENT_REGS;
1062 return VINF_SUCCESS;
1063 }
1064
1065 /*
1066 * Set event injection state.
1067 */
1068 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
1069 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
1070 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
1071
1072 AssertRC(rc);
1073 return rc;
1074}
1075
1076
1077/**
1078 * Checks for pending guest interrupts and injects them.
1079 *
1080 * @returns VBox status code.
1081 * @param pVM Pointer to the VM.
1082 * @param pVCpu Pointer to the VMCPU.
1083 * @param pCtx Pointer to the guest CPU context.
1084 */
1085static int hmR0VmxCheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
1086{
1087 int rc;
1088
1089 /*
1090 * Dispatch any pending interrupts (injected before, but a VM exit occurred prematurely).
1091 */
1092 if (pVCpu->hm.s.Event.fPending)
1093 {
1094 Log(("CPU%d: Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntrInfo,
1095 pVCpu->hm.s.Event.u32ErrCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
1096 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntReinject);
1097 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, pVCpu->hm.s.Event.u64IntrInfo, 0, pVCpu->hm.s.Event.u32ErrCode);
1098 AssertRC(rc);
1099
1100 pVCpu->hm.s.Event.fPending = false;
1101 return VINF_SUCCESS;
1102 }
1103
1104 /*
1105 * If an active trap is already pending, we must forward it first!
1106 */
1107 if (!TRPMHasTrap(pVCpu))
1108 {
1109 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
1110 {
1111 RTGCUINTPTR intInfo;
1112
1113 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
1114
1115 intInfo = X86_XCPT_NMI;
1116 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1117 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1118
1119 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
1120 AssertRC(rc);
1121
1122 return VINF_SUCCESS;
1123 }
1124
1125 /** @todo SMI interrupts. */
1126
1127 /*
1128 * When external interrupts are pending, we should exit the VM when IF is set.
1129 */
1130 if (VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
1131 {
1132 if (!(pCtx->eflags.u32 & X86_EFL_IF))
1133 {
1134 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT))
1135 {
1136 LogFlow(("Enable irq window exit!\n"));
1137 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
1138 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1139 AssertRC(rc);
1140 }
1141 /* else nothing to do but wait */
1142 }
1143 else if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1144 {
1145 uint8_t u8Interrupt;
1146
1147 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
1148 Log(("CPU%d: Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", pVCpu->idCpu,
1149 u8Interrupt, u8Interrupt, rc, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
1150 if (RT_SUCCESS(rc))
1151 {
1152 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
1153 AssertRC(rc);
1154 }
1155 else
1156 {
1157 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
1158 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
1159 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
1160 /* Just continue */
1161 }
1162 }
1163 else
1164 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
1165 }
1166 }
1167
1168#ifdef VBOX_STRICT
1169 if (TRPMHasTrap(pVCpu))
1170 {
1171 uint8_t u8Vector;
1172 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
1173 AssertRC(rc);
1174 }
1175#endif
1176
1177 if ( (pCtx->eflags.u32 & X86_EFL_IF)
1178 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1179 && TRPMHasTrap(pVCpu)
1180 )
1181 {
1182 uint8_t u8Vector;
1183 TRPMEVENT enmType;
1184 RTGCUINTPTR intInfo;
1185 RTGCUINT errCode;
1186
1187 /*
1188 * If a new event is pending, dispatch it now.
1189 */
1190 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &errCode, 0);
1191 AssertRC(rc);
1192 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
1193 Assert(enmType != TRPM_SOFTWARE_INT);
1194
1195 /*
1196 * Clear the pending trap.
1197 */
1198 rc = TRPMResetTrap(pVCpu);
1199 AssertRC(rc);
1200
1201 intInfo = u8Vector;
1202 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1203
1204 if (enmType == TRPM_TRAP)
1205 {
1206 switch (u8Vector)
1207 {
1208 case X86_XCPT_DF:
1209 case X86_XCPT_TS:
1210 case X86_XCPT_NP:
1211 case X86_XCPT_SS:
1212 case X86_XCPT_GP:
1213 case X86_XCPT_PF:
1214 case X86_XCPT_AC:
1215 {
1216 /** @todo r=ramshankar: setting this bit would blow up for real-mode guests with
1217 * unrestricted guest execution. */
1218 /* Valid error codes. */
1219 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1220 break;
1221 }
1222
1223 default:
1224 break;
1225 }
1226
1227 if ( u8Vector == X86_XCPT_BP
1228 || u8Vector == X86_XCPT_OF)
1229 {
1230 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1231 }
1232 else
1233 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1234 }
1235 else
1236 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1237
1238 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntInject);
1239 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
1240 AssertRC(rc);
1241 } /* if (interrupts can be dispatched) */
1242
1243 return VINF_SUCCESS;
1244}
1245
1246/**
1247 * Checks for pending VMX events and converts them to TRPM. Before we execute any instruction
1248 * outside of VMX, any pending VMX event must be converted so that it can be delivered properly.
1249 *
1250 * @returns VBox status code.
1251 * @param pVCpu Pointer to the VMCPU.
1252 */
1253static int hmR0VmxCheckPendingEvent(PVMCPU pVCpu)
1254{
1255 if (pVCpu->hm.s.Event.fPending)
1256 {
1257 TRPMEVENT enmTrapType;
1258
1259 /* If a trap was already pending, we did something wrong! */
1260 Assert((TRPMQueryTrap(pVCpu, NULL, NULL) == VERR_TRPM_NO_ACTIVE_TRAP));
1261
1262 /*
1263 * Clear the pending event and move it over to TRPM for the rest
1264 * of the world to see.
1265 */
1266 pVCpu->hm.s.Event.fPending = false;
1267 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo))
1268 {
1269 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT:
1270 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI:
1271 enmTrapType = TRPM_HARDWARE_INT;
1272 break;
1273 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT:
1274 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /** @todo Is classifying #BP, #OF as TRPM_SOFTWARE_INT correct? */
1275 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT:
1276 enmTrapType = TRPM_SOFTWARE_INT;
1277 break;
1278 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT:
1279 enmTrapType = TRPM_TRAP;
1280 break;
1281 default:
1282 enmTrapType = TRPM_32BIT_HACK; /* Can't get here. */
1283 AssertFailed();
1284 }
1285 TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), enmTrapType);
1286 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
1287 TRPMSetErrorCode(pVCpu, pVCpu->hm.s.Event.u32ErrCode);
1288 //@todo: Is there any situation where we need to call TRPMSetFaultAddress()?
1289 }
1290 return VINF_SUCCESS;
1291}
1292
1293/**
1294 * Save the host state into the VMCS.
1295 *
1296 * @returns VBox status code.
1297 * @param pVM Pointer to the VM.
1298 * @param pVCpu Pointer to the VMCPU.
1299 */
1300VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
1301{
1302 int rc = VINF_SUCCESS;
1303 NOREF(pVM);
1304
1305 /*
1306 * Host CPU Context.
1307 */
1308 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
1309 {
1310 RTIDTR idtr;
1311 RTGDTR gdtr;
1312 RTSEL SelTR;
1313 PCX86DESCHC pDesc;
1314 uintptr_t trBase;
1315 RTSEL cs;
1316 RTSEL ss;
1317 uint64_t cr3;
1318
1319 /*
1320 * Control registers.
1321 */
1322 rc = VMXWriteVmcs(VMX_VMCS_HOST_CR0, ASMGetCR0());
1323 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
1324#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1325 if (VMX_IS_64BIT_HOST_MODE())
1326 {
1327 cr3 = hmR0Get64bitCR3();
1328 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_CR3, cr3);
1329 }
1330 else
1331#endif
1332 {
1333 cr3 = ASMGetCR3();
1334 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR3, cr3);
1335 }
1336 Log2(("VMX_VMCS_HOST_CR3 %08RX64\n", cr3));
1337 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR4, ASMGetCR4());
1338 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
1339 AssertRC(rc);
1340
1341 /*
1342 * Selector registers.
1343 */
1344#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1345 if (VMX_IS_64BIT_HOST_MODE())
1346 {
1347 cs = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelCS;
1348 ss = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelSS;
1349 }
1350 else
1351 {
1352 /* sysenter loads LDT cs & ss, VMX doesn't like this. Load the GDT ones (safe). */
1353 cs = (RTSEL)(uintptr_t)&SUPR0AbsKernelCS;
1354 ss = (RTSEL)(uintptr_t)&SUPR0AbsKernelSS;
1355 }
1356#else
1357 cs = ASMGetCS();
1358 ss = ASMGetSS();
1359#endif
1360 Assert(!(cs & X86_SEL_LDT)); Assert((cs & X86_SEL_RPL) == 0);
1361 Assert(!(ss & X86_SEL_LDT)); Assert((ss & X86_SEL_RPL) == 0);
1362 rc = VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_CS, cs);
1363 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
1364 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_DS, 0);
1365 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_ES, 0);
1366#if HC_ARCH_BITS == 32
1367 if (!VMX_IS_64BIT_HOST_MODE())
1368 {
1369 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_FS, 0);
1370 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_GS, 0);
1371 }
1372#endif
1373 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_SS, ss);
1374 SelTR = ASMGetTR();
1375 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_TR, SelTR);
1376 AssertRC(rc);
1377 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
1378 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
1379 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
1380 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
1381 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
1382 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", ss, ASMGetSS()));
1383 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
1384
1385 /*
1386 * GDTR & IDTR.
1387 */
1388#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1389 if (VMX_IS_64BIT_HOST_MODE())
1390 {
1391 X86XDTR64 gdtr64, idtr64;
1392 hmR0Get64bitGdtrAndIdtr(&gdtr64, &idtr64);
1393 rc = VMXWriteVmcs64(VMX_VMCS_HOST_GDTR_BASE, gdtr64.uAddr);
1394 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_IDTR_BASE, idtr64.uAddr);
1395 AssertRC(rc);
1396 Log2(("VMX_VMCS_HOST_GDTR_BASE %RX64\n", gdtr64.uAddr));
1397 Log2(("VMX_VMCS_HOST_IDTR_BASE %RX64\n", idtr64.uAddr));
1398 gdtr.cbGdt = gdtr64.cb;
1399 gdtr.pGdt = (uintptr_t)gdtr64.uAddr;
1400 }
1401 else
1402#endif
1403 {
1404 ASMGetGDTR(&gdtr);
1405 rc = VMXWriteVmcs(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
1406 ASMGetIDTR(&idtr);
1407 rc |= VMXWriteVmcs(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
1408 AssertRC(rc);
1409 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
1410 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
1411 }
1412
1413 /*
1414 * Save the base address of the TR selector.
1415 */
1416 if (SelTR > gdtr.cbGdt)
1417 {
1418 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
1419 return VERR_VMX_INVALID_HOST_STATE;
1420 }
1421
1422 pDesc = (PCX86DESCHC)(gdtr.pGdt + (SelTR & X86_SEL_MASK));
1423#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1424 if (VMX_IS_64BIT_HOST_MODE())
1425 {
1426 uint64_t trBase64 = X86DESC64_BASE((PX86DESC64)pDesc);
1427 rc = VMXWriteVmcs64(VMX_VMCS_HOST_TR_BASE, trBase64);
1428 Log2(("VMX_VMCS_HOST_TR_BASE %RX64\n", trBase64));
1429 AssertRC(rc);
1430 }
1431 else
1432#endif
1433 {
1434#if HC_ARCH_BITS == 64
1435 trBase = X86DESC64_BASE(pDesc);
1436#else
1437 trBase = X86DESC_BASE(pDesc);
1438#endif
1439 rc = VMXWriteVmcs(VMX_VMCS_HOST_TR_BASE, trBase);
1440 AssertRC(rc);
1441 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
1442 }
1443
1444 /*
1445 * FS base and GS base.
1446 */
1447#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1448 if (VMX_IS_64BIT_HOST_MODE())
1449 {
1450 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
1451 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
1452 rc = VMXWriteVmcs64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
1453 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
1454 }
1455#endif
1456 AssertRC(rc);
1457
1458 /*
1459 * Sysenter MSRs.
1460 */
1461 /** @todo expensive!! */
1462 rc = VMXWriteVmcs(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
1463 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
1464#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1465 if (VMX_IS_64BIT_HOST_MODE())
1466 {
1467 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1468 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1469 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1470 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1471 }
1472 else
1473 {
1474 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1475 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1476 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1477 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1478 }
1479#elif HC_ARCH_BITS == 32
1480 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1481 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1482 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1483 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1484#else
1485 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1486 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1487 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1488 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1489#endif
1490 AssertRC(rc);
1491
1492
1493#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1494 /*
1495 * Store all host MSRs in the VM-Exit load area, so they will be reloaded after
1496 * the world switch back to the host.
1497 */
1498 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvHostMsr;
1499 unsigned idxMsr = 0;
1500
1501 uint32_t u32HostExtFeatures = ASMCpuId_EDX(0x80000001);
1502 if (u32HostExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
1503 {
1504 pMsr->u32IndexMSR = MSR_K6_EFER;
1505 pMsr->u32Reserved = 0;
1506# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1507 if (CPUMIsGuestInLongMode(pVCpu))
1508 {
1509 /* Must match the EFER value in our 64 bits switcher. */
1510 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER) | MSR_K6_EFER_LME | MSR_K6_EFER_SCE | MSR_K6_EFER_NXE;
1511 }
1512 else
1513# endif
1514 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER);
1515 pMsr++; idxMsr++;
1516 }
1517
1518# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1519 if (VMX_IS_64BIT_HOST_MODE())
1520 {
1521 pMsr->u32IndexMSR = MSR_K6_STAR;
1522 pMsr->u32Reserved = 0;
1523 pMsr->u64Value = ASMRdMsr(MSR_K6_STAR); /* legacy syscall eip, cs & ss */
1524 pMsr++; idxMsr++;
1525 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1526 pMsr->u32Reserved = 0;
1527 pMsr->u64Value = ASMRdMsr(MSR_K8_LSTAR); /* 64 bits mode syscall rip */
1528 pMsr++; idxMsr++;
1529 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1530 pMsr->u32Reserved = 0;
1531 pMsr->u64Value = ASMRdMsr(MSR_K8_SF_MASK); /* syscall flag mask */
1532 pMsr++; idxMsr++;
1533
1534 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
1535#if 0
1536 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1537 pMsr->u32Reserved = 0;
1538 pMsr->u64Value = ASMRdMsr(MSR_K8_KERNEL_GS_BASE); /* swapgs exchange value */
1539 pMsr++; idxMsr++;
1540#endif
1541 }
1542# endif
1543
1544 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
1545 {
1546 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
1547 pMsr->u32Reserved = 0;
1548 pMsr->u64Value = ASMRdMsr(MSR_K8_TSC_AUX);
1549 pMsr++; idxMsr++;
1550 }
1551
1552 /** @todo r=ramshankar: check IA32_VMX_MISC bits 27:25 for valid idxMsr
1553 * range. */
1554 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, idxMsr);
1555 AssertRC(rc);
1556#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1557
1558 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_HOST_CONTEXT;
1559 }
1560 return rc;
1561}
1562
1563
1564/**
1565 * Loads the 4 PDPEs into the guest state when nested paging is used and the
1566 * guest operates in PAE mode.
1567 *
1568 * @returns VBox status code.
1569 * @param pVCpu Pointer to the VMCPU.
1570 * @param pCtx Pointer to the guest CPU context.
1571 */
1572static int hmR0VmxLoadPaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1573{
1574 if (CPUMIsGuestInPAEModeEx(pCtx))
1575 {
1576 X86PDPE aPdpes[4];
1577 int rc = PGMGstGetPaePdpes(pVCpu, &aPdpes[0]);
1578 AssertRCReturn(rc, rc);
1579
1580 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, aPdpes[0].u); AssertRCReturn(rc, rc);
1581 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, aPdpes[1].u); AssertRCReturn(rc, rc);
1582 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, aPdpes[2].u); AssertRCReturn(rc, rc);
1583 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, aPdpes[3].u); AssertRCReturn(rc, rc);
1584 }
1585 return VINF_SUCCESS;
1586}
1587
1588
1589/**
1590 * Saves the 4 PDPEs into the guest state when nested paging is used and the
1591 * guest operates in PAE mode.
1592 *
1593 * @returns VBox status code.
1594 * @param pVCpu Pointer to the VM CPU.
1595 * @param pCtx Pointer to the guest CPU context.
1596 *
1597 * @remarks Tell PGM about CR3 changes before calling this helper.
1598 */
1599static int hmR0VmxSavePaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1600{
1601 if (CPUMIsGuestInPAEModeEx(pCtx))
1602 {
1603 int rc;
1604 X86PDPE aPdpes[4];
1605 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &aPdpes[0].u); AssertRCReturn(rc, rc);
1606 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &aPdpes[1].u); AssertRCReturn(rc, rc);
1607 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &aPdpes[2].u); AssertRCReturn(rc, rc);
1608 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &aPdpes[3].u); AssertRCReturn(rc, rc);
1609
1610 rc = PGMGstUpdatePaePdpes(pVCpu, &aPdpes[0]);
1611 AssertRCReturn(rc, rc);
1612 }
1613 return VINF_SUCCESS;
1614}
1615
1616
1617/**
1618 * Update the exception bitmap according to the current CPU state.
1619 *
1620 * @param pVM Pointer to the VM.
1621 * @param pVCpu Pointer to the VMCPU.
1622 * @param pCtx Pointer to the guest CPU context.
1623 */
1624static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1625{
1626 uint32_t u32TrapMask;
1627 Assert(pCtx);
1628
1629 /*
1630 * Set up a mask for intercepting traps.
1631 */
1632 /** @todo Do we really need to always intercept #DB? */
1633 u32TrapMask = RT_BIT(X86_XCPT_DB)
1634 | RT_BIT(X86_XCPT_NM)
1635#ifdef VBOX_ALWAYS_TRAP_PF
1636 | RT_BIT(X86_XCPT_PF)
1637#endif
1638#ifdef VBOX_STRICT
1639 | RT_BIT(X86_XCPT_BP)
1640 | RT_BIT(X86_XCPT_DB)
1641 | RT_BIT(X86_XCPT_DE)
1642 | RT_BIT(X86_XCPT_NM)
1643 | RT_BIT(X86_XCPT_UD)
1644 | RT_BIT(X86_XCPT_NP)
1645 | RT_BIT(X86_XCPT_SS)
1646 | RT_BIT(X86_XCPT_GP)
1647 | RT_BIT(X86_XCPT_MF)
1648#endif
1649 ;
1650
1651 /*
1652 * Without nested paging, #PF must be intercepted to implement shadow paging.
1653 */
1654 /** @todo NP state won't change so maybe we should build the initial trap mask up front? */
1655 if (!pVM->hm.s.fNestedPaging)
1656 u32TrapMask |= RT_BIT(X86_XCPT_PF);
1657
1658 /* Catch floating point exceptions if we need to report them to the guest in a different way. */
1659 if (!(pCtx->cr0 & X86_CR0_NE))
1660 u32TrapMask |= RT_BIT(X86_XCPT_MF);
1661
1662#ifdef VBOX_STRICT
1663 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
1664#endif
1665
1666 /*
1667 * Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise).
1668 */
1669 /** @todo Despite the claim to intercept everything, with NP we do not intercept #PF. Should we? */
1670 if ( CPUMIsGuestInRealModeEx(pCtx)
1671 && pVM->hm.s.vmx.pRealModeTSS)
1672 {
1673 u32TrapMask |= RT_BIT(X86_XCPT_DE)
1674 | RT_BIT(X86_XCPT_DB)
1675 | RT_BIT(X86_XCPT_NMI)
1676 | RT_BIT(X86_XCPT_BP)
1677 | RT_BIT(X86_XCPT_OF)
1678 | RT_BIT(X86_XCPT_BR)
1679 | RT_BIT(X86_XCPT_UD)
1680 | RT_BIT(X86_XCPT_DF)
1681 | RT_BIT(X86_XCPT_CO_SEG_OVERRUN)
1682 | RT_BIT(X86_XCPT_TS)
1683 | RT_BIT(X86_XCPT_NP)
1684 | RT_BIT(X86_XCPT_SS)
1685 | RT_BIT(X86_XCPT_GP)
1686 | RT_BIT(X86_XCPT_MF)
1687 | RT_BIT(X86_XCPT_AC)
1688 | RT_BIT(X86_XCPT_MC)
1689 | RT_BIT(X86_XCPT_XF)
1690 ;
1691 }
1692
1693 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, u32TrapMask);
1694 AssertRC(rc);
1695}
1696
1697
1698/**
1699 * Loads a minimal guest state.
1700 *
1701 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1702 *
1703 * @param pVM Pointer to the VM.
1704 * @param pVCpu Pointer to the VMCPU.
1705 * @param pCtx Pointer to the guest CPU context.
1706 */
1707VMMR0DECL(void) VMXR0LoadMinimalGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1708{
1709 int rc;
1710 X86EFLAGS eflags;
1711
1712 Assert(!(pVCpu->hm.s.fContextUseFlags & HM_CHANGED_ALL_GUEST));
1713
1714 /*
1715 * Load EIP, ESP and EFLAGS.
1716 */
1717 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_RIP, pCtx->rip);
1718 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1719 AssertRC(rc);
1720
1721 /*
1722 * Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1.
1723 */
1724 eflags = pCtx->eflags;
1725 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1726 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1727
1728 /*
1729 * Check if real mode emulation using v86 mode.
1730 */
1731 if ( CPUMIsGuestInRealModeEx(pCtx)
1732 && pVM->hm.s.vmx.pRealModeTSS)
1733 {
1734 pVCpu->hm.s.vmx.RealMode.eflags = eflags;
1735
1736 eflags.Bits.u1VM = 1;
1737 eflags.Bits.u2IOPL = 0; /* must always be 0 or else certain instructions won't cause faults. */
1738 }
1739 rc = VMXWriteVmcs(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1740 AssertRC(rc);
1741}
1742
1743
1744/**
1745 * Sets up TSC offsetting and VMX preemption, if supported/configured/available.
1746 *
1747 * NOTE: This function reads the host TSC value. Therefore it must be executed very
1748 * shortly before a VM entry and execution MUST NOT be rescheduled between a call to
1749 * this function and a VM entry without calling this function again.
1750 *
1751 * @returns VBox status code.
1752 * @param pVM Pointer to the VM.
1753 * @param pVCpu Pointer to the VMCPU.
1754 */
1755VMMR0DECL(int) VMXR0SetupTscOffsetAndPreemption(PVM pVM, PVMCPU pVCpu)
1756{
1757 int rc = VINF_SUCCESS;
1758 bool fOffsettedTsc;
1759
1760 if (pVM->hm.s.vmx.fUsePreemptTimer)
1761 {
1762 uint64_t cTicksToDeadline = TMCpuTickGetDeadlineAndTscOffset(pVCpu, &fOffsettedTsc, &pVCpu->hm.s.vmx.u64TSCOffset);
1763
1764 /* Make sure the returned values have sane upper and lower boundaries. */
1765 uint64_t u64CpuHz = SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage);
1766
1767 cTicksToDeadline = RT_MIN(cTicksToDeadline, u64CpuHz / 64); /* 1/64 of a second */
1768 cTicksToDeadline = RT_MAX(cTicksToDeadline, u64CpuHz / 2048); /* 1/2048th of a second */
1769
1770 cTicksToDeadline >>= pVM->hm.s.vmx.cPreemptTimerShift;
1771 uint32_t cPreemptionTickCount = (uint32_t)RT_MIN(cTicksToDeadline, UINT32_MAX - 16);
1772 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_PREEMPTION_TIMER_VALUE, cPreemptionTickCount);
1773 AssertRC(rc);
1774 }
1775 else
1776 fOffsettedTsc = TMCpuTickCanUseRealTSC(pVCpu, &pVCpu->hm.s.vmx.u64TSCOffset);
1777
1778 if (fOffsettedTsc)
1779 {
1780 uint64_t u64CurTSC = ASMReadTSC();
1781 if (u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset > TMCpuTickGetLastSeen(pVCpu))
1782 {
1783 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET, applies to RDTSCP too. */
1784 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, pVCpu->hm.s.vmx.u64TSCOffset);
1785 AssertRC(rc);
1786
1787 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1788 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1789 AssertRC(rc);
1790 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscOffset);
1791 }
1792 else
1793 {
1794 /* Fall back to rdtsc, rdtscp emulation as we would otherwise pass decreasing tsc values to the guest. */
1795 LogFlow(("TSC %RX64 offset %RX64 time=%RX64 last=%RX64 (diff=%RX64, virt_tsc=%RX64)\n", u64CurTSC,
1796 pVCpu->hm.s.vmx.u64TSCOffset, u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset,
1797 TMCpuTickGetLastSeen(pVCpu), TMCpuTickGetLastSeen(pVCpu) - u64CurTSC - pVCpu->hm.s.vmx.u64TSCOffset,
1798 TMCpuTickGet(pVCpu)));
1799 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1800 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1801 AssertRC(rc);
1802 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscInterceptOverFlow);
1803 }
1804 }
1805 else
1806 {
1807 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1808 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1809 AssertRC(rc);
1810 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscIntercept);
1811 }
1812 return rc;
1813}
1814
1815/**
1816 * Loads the guest state.
1817 *
1818 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1819 *
1820 * @returns VBox status code.
1821 * @param pVM Pointer to the VM.
1822 * @param pVCpu Pointer to the VMCPU.
1823 * @param pCtx Pointer to the guest CPU context.
1824 */
1825VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1826{
1827 int rc = VINF_SUCCESS;
1828 RTGCUINTPTR val;
1829
1830 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
1831
1832 /*
1833 * VMX_VMCS_CTRL_ENTRY_CONTROLS
1834 * Set required bits to one and zero according to the MSR capabilities.
1835 */
1836 val = pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0;
1837
1838 /*
1839 * Load guest debug controls (DR7 & IA32_DEBUGCTL_MSR).
1840 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1841 */
1842 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1843
1844 if (CPUMIsGuestInLongModeEx(pCtx))
1845 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA32E_MODE_GUEST;
1846 /* else Must be zero when AMD64 is not available. */
1847
1848 /*
1849 * Mask away the bits that the CPU doesn't support.
1850 */
1851 val &= pVM->hm.s.vmx.msr.vmx_entry.n.allowed1;
1852 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, val);
1853 AssertRC(rc);
1854
1855 /*
1856 * VMX_VMCS_CTRL_EXIT_CONTROLS
1857 * Set required bits to one and zero according to the MSR capabilities.
1858 */
1859 val = pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0;
1860
1861 /*
1862 * Save debug controls (DR7 & IA32_DEBUGCTL_MSR)
1863 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1864 */
1865 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
1866
1867#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1868 if (VMX_IS_64BIT_HOST_MODE())
1869 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE;
1870 /* else Must be zero when AMD64 is not available. */
1871#elif HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1872 if (CPUMIsGuestInLongModeEx(pCtx))
1873 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE; /* our switcher goes to long mode */
1874 else
1875 Assert(!(val & VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE));
1876#endif
1877 val &= pVM->hm.s.vmx.msr.vmx_exit.n.allowed1;
1878
1879 /*
1880 * Don't acknowledge external interrupts on VM-exit.
1881 */
1882 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, val);
1883 AssertRC(rc);
1884
1885 /*
1886 * Guest CPU context: ES, CS, SS, DS, FS, GS.
1887 */
1888 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_SEGMENT_REGS)
1889 {
1890 if (pVM->hm.s.vmx.pRealModeTSS)
1891 {
1892 PGMMODE enmGuestMode = PGMGetGuestMode(pVCpu);
1893 if (pVCpu->hm.s.vmx.enmLastSeenGuestMode != enmGuestMode)
1894 {
1895 /*
1896 * Correct weird requirements for switching to protected mode.
1897 */
1898 if ( pVCpu->hm.s.vmx.enmLastSeenGuestMode == PGMMODE_REAL
1899 && enmGuestMode >= PGMMODE_PROTECTED)
1900 {
1901#ifdef VBOX_WITH_REM
1902 /*
1903 * Flush the recompiler code cache as it's not unlikely the guest will rewrite code
1904 * it will later execute in real mode (OpenBSD 4.0 is one such example)
1905 */
1906 REMFlushTBs(pVM);
1907#endif
1908
1909 /*
1910 * DPL of all hidden selector registers must match the current CPL (0).
1911 */
1912 pCtx->cs.Attr.n.u2Dpl = 0;
1913 pCtx->cs.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
1914
1915 pCtx->ds.Attr.n.u2Dpl = 0;
1916 pCtx->es.Attr.n.u2Dpl = 0;
1917 pCtx->fs.Attr.n.u2Dpl = 0;
1918 pCtx->gs.Attr.n.u2Dpl = 0;
1919 pCtx->ss.Attr.n.u2Dpl = 0;
1920 }
1921 pVCpu->hm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
1922 }
1923 }
1924
1925 VMX_WRITE_SELREG(ES, es);
1926 AssertRC(rc);
1927
1928 VMX_WRITE_SELREG(CS, cs);
1929 AssertRC(rc);
1930
1931 VMX_WRITE_SELREG(SS, ss);
1932 AssertRC(rc);
1933
1934 VMX_WRITE_SELREG(DS, ds);
1935 AssertRC(rc);
1936
1937 VMX_WRITE_SELREG(FS, fs);
1938 AssertRC(rc);
1939
1940 VMX_WRITE_SELREG(GS, gs);
1941 AssertRC(rc);
1942 }
1943
1944 /*
1945 * Guest CPU context: LDTR.
1946 */
1947 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_LDTR)
1948 {
1949 if (pCtx->ldtr.Sel == 0)
1950 {
1951 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1952 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1953 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, 0); /* @todo removing "64" in the function should be the same. */
1954 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1955 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1956 }
1957 else
1958 {
1959 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr.Sel);
1960 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtr.u32Limit);
1961 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtr.u64Base); /* @todo removing "64" and it should be the same */
1962 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtr.Attr.u);
1963 }
1964 AssertRC(rc);
1965 }
1966
1967 /*
1968 * Guest CPU context: TR.
1969 */
1970 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_TR)
1971 {
1972 /*
1973 * Real mode emulation using v86 mode with CR4.VME (interrupt redirection
1974 * using the int bitmap in the TSS).
1975 */
1976 if ( CPUMIsGuestInRealModeEx(pCtx)
1977 && pVM->hm.s.vmx.pRealModeTSS)
1978 {
1979 RTGCPHYS GCPhys;
1980
1981 /* We convert it here every time as PCI regions could be reconfigured. */
1982 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pRealModeTSS, &GCPhys);
1983 AssertRC(rc);
1984
1985 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, 0);
1986 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, HM_VTX_TSS_SIZE);
1987 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1988
1989 X86DESCATTR attr;
1990
1991 attr.u = 0;
1992 attr.n.u1Present = 1;
1993 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1994 val = attr.u;
1995 }
1996 else
1997 {
1998 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr.Sel);
1999 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->tr.u32Limit);
2000 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, pCtx->tr.u64Base);
2001
2002 val = pCtx->tr.Attr.u;
2003
2004 /* The TSS selector must be busy (REM bugs? see defect #XXXX). */
2005 if (!(val & X86_SEL_TYPE_SYS_TSS_BUSY_MASK))
2006 {
2007 if (val & 0xf)
2008 val |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2009 else
2010 /* Default if no TR selector has been set (otherwise vmlaunch will fail!) */
2011 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
2012 }
2013 AssertMsg((val & 0xf) == X86_SEL_TYPE_SYS_386_TSS_BUSY || (val & 0xf) == X86_SEL_TYPE_SYS_286_TSS_BUSY,
2014 ("%#x\n", val));
2015 }
2016 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
2017 AssertRC(rc);
2018 }
2019
2020 /*
2021 * Guest CPU context: GDTR.
2022 */
2023 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_GDTR)
2024 {
2025 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
2026 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
2027 AssertRC(rc);
2028 }
2029
2030 /*
2031 * Guest CPU context: IDTR.
2032 */
2033 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_IDTR)
2034 {
2035 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
2036 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
2037 AssertRC(rc);
2038 }
2039
2040 /*
2041 * Sysenter MSRs.
2042 */
2043 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2044 {
2045 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
2046 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
2047 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
2048 AssertRC(rc);
2049 }
2050
2051 /*
2052 * Guest CPU context: Control registers.
2053 */
2054 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR0)
2055 {
2056 val = pCtx->cr0;
2057 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
2058 Log2(("Guest CR0-shadow %08x\n", val));
2059 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2060 {
2061 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
2062 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
2063 }
2064 else
2065 {
2066 /** @todo check if we support the old style mess correctly. */
2067 if (!(val & X86_CR0_NE))
2068 Log(("Forcing X86_CR0_NE!!!\n"));
2069
2070 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
2071 }
2072 /* Protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
2073 if (!pVM->hm.s.vmx.fUnrestrictedGuest)
2074 val |= X86_CR0_PE | X86_CR0_PG;
2075
2076 if (pVM->hm.s.fNestedPaging)
2077 {
2078 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
2079 {
2080 /* Disable CR3 read/write monitoring as we don't need it for EPT. */
2081 pVCpu->hm.s.vmx.u32ProcCtls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2082 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
2083 }
2084 else
2085 {
2086 /* Reenable CR3 read/write monitoring as our identity mapped page table is active. */
2087 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2088 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2089 }
2090 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2091 AssertRC(rc);
2092 }
2093 else
2094 {
2095 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
2096 val |= X86_CR0_WP;
2097 }
2098
2099 /* Always enable caching. */
2100 val &= ~(X86_CR0_CD|X86_CR0_NW);
2101
2102 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR0, val);
2103 Log2(("Guest CR0 %08x\n", val));
2104
2105 /*
2106 * CR0 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2107 */
2108 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
2109 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
2110 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
2111 | X86_CR0_CD /* Bit not restored during VM-exit! */
2112 | X86_CR0_NW /* Bit not restored during VM-exit! */
2113 | X86_CR0_NE;
2114
2115 /*
2116 * When the guest's FPU state is active, then we no longer care about the FPU related bits.
2117 */
2118 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2119 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_MP;
2120
2121 pVCpu->hm.s.vmx.cr0_mask = val;
2122
2123 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR0_MASK, val);
2124 Log2(("Guest CR0-mask %08x\n", val));
2125 AssertRC(rc);
2126 }
2127
2128 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR4)
2129 {
2130 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
2131 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
2132 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
2133 val = pCtx->cr4 | (uint32_t)pVM->hm.s.vmx.msr.vmx_cr4_fixed0;
2134
2135 if (!pVM->hm.s.fNestedPaging)
2136 {
2137 switch (pVCpu->hm.s.enmShadowMode)
2138 {
2139 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
2140 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
2141 case PGMMODE_32_BIT: /* 32-bit paging. */
2142 val &= ~X86_CR4_PAE;
2143 break;
2144
2145 case PGMMODE_PAE: /* PAE paging. */
2146 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
2147 /** Must use PAE paging as we could use physical memory > 4 GB */
2148 val |= X86_CR4_PAE;
2149 break;
2150
2151 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
2152 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
2153#ifdef VBOX_ENABLE_64_BITS_GUESTS
2154 break;
2155#else
2156 AssertFailed();
2157 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2158#endif
2159 default: /* shut up gcc */
2160 AssertFailed();
2161 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2162 }
2163 }
2164 else if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2165 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2166 {
2167 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
2168 val |= X86_CR4_PSE;
2169 /* Our identity mapping is a 32 bits page directory. */
2170 val &= ~X86_CR4_PAE;
2171 }
2172
2173 /*
2174 * Turn off VME if we're in emulated real mode.
2175 */
2176 if ( CPUMIsGuestInRealModeEx(pCtx)
2177 && pVM->hm.s.vmx.pRealModeTSS)
2178 {
2179 val &= ~X86_CR4_VME;
2180 }
2181
2182 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR4, val);
2183 Log2(("Guest CR4 %08x\n", val));
2184
2185 /*
2186 * CR4 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2187 */
2188 val = 0
2189 | X86_CR4_VME
2190 | X86_CR4_PAE
2191 | X86_CR4_PGE
2192 | X86_CR4_PSE
2193 | X86_CR4_VMXE;
2194 pVCpu->hm.s.vmx.cr4_mask = val;
2195
2196 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR4_MASK, val);
2197 Log2(("Guest CR4-mask %08x\n", val));
2198 AssertRC(rc);
2199 }
2200
2201#if 0
2202 /* Enable single stepping if requested and CPU supports it. */
2203 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG)
2204 if (DBGFIsStepping(pVCpu))
2205 {
2206 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
2207 rc = VMXWriteVmcs(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2208 AssertRC(rc);
2209 }
2210#endif
2211
2212 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR3)
2213 {
2214 if (pVM->hm.s.fNestedPaging)
2215 {
2216 Assert(PGMGetHyperCR3(pVCpu));
2217 pVCpu->hm.s.vmx.GCPhysEPTP = PGMGetHyperCR3(pVCpu);
2218
2219 Assert(!(pVCpu->hm.s.vmx.GCPhysEPTP & 0xfff));
2220 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
2221 pVCpu->hm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
2222 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
2223
2224 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.GCPhysEPTP);
2225 AssertRC(rc);
2226
2227 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2228 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2229 {
2230 RTGCPHYS GCPhys;
2231
2232 /* We convert it here every time as PCI regions could be reconfigured. */
2233 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
2234 AssertMsgRC(rc, ("pNonPagingModeEPTPageTable = %RGv\n", pVM->hm.s.vmx.pNonPagingModeEPTPageTable));
2235
2236 /*
2237 * We use our identity mapping page table here as we need to map guest virtual to
2238 * guest physical addresses; EPT will take care of the translation to host physical addresses.
2239 */
2240 val = GCPhys;
2241 }
2242 else
2243 {
2244 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
2245 val = pCtx->cr3;
2246 rc = hmR0VmxLoadPaePdpes(pVCpu, pCtx);
2247 AssertRCReturn(rc, rc);
2248 }
2249 }
2250 else
2251 {
2252 val = PGMGetHyperCR3(pVCpu);
2253 Assert(val || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
2254 }
2255
2256 /* Save our shadow CR3 register. */
2257 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_CR3, val);
2258 AssertRC(rc);
2259 }
2260
2261 /*
2262 * Guest CPU context: Debug registers.
2263 */
2264 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_DEBUG)
2265 {
2266 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
2267 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
2268
2269 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2270 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2271 pCtx->dr[7] |= 0x400; /* must be one */
2272
2273 /* Resync DR7 */
2274 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2275 AssertRC(rc);
2276
2277#ifdef DEBUG
2278 /* Sync the hypervisor debug state now if any breakpoint is armed. */
2279 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
2280 && !CPUMIsHyperDebugStateActive(pVCpu)
2281 && !DBGFIsStepping(pVCpu))
2282 {
2283 /* Save the host and load the hypervisor debug state. */
2284 rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2285 AssertRC(rc);
2286
2287 /* DRx intercepts remain enabled. */
2288
2289 /* Override dr7 with the hypervisor value. */
2290 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, CPUMGetHyperDR7(pVCpu));
2291 AssertRC(rc);
2292 }
2293 else
2294#endif
2295 /* Sync the debug state now if any breakpoint is armed. */
2296 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
2297 && !CPUMIsGuestDebugStateActive(pVCpu)
2298 && !DBGFIsStepping(pVCpu))
2299 {
2300 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2301
2302 /* Disable DRx move intercepts. */
2303 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2304 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2305 AssertRC(rc);
2306
2307 /* Save the host and load the guest debug state. */
2308 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2309 AssertRC(rc);
2310 }
2311
2312 /* IA32_DEBUGCTL MSR. */
2313 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);
2314 AssertRC(rc);
2315
2316 /** @todo do we really ever need this? */
2317 rc |= VMXWriteVmcs(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, 0);
2318 AssertRC(rc);
2319 }
2320
2321 /*
2322 * 64-bit guest mode.
2323 */
2324 if (CPUMIsGuestInLongModeEx(pCtx))
2325 {
2326#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
2327 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2328#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2329 pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
2330#else
2331# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
2332 if (!pVM->hm.s.fAllow64BitGuests)
2333 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2334# endif
2335 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM64;
2336#endif
2337 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2338 {
2339 /* Update these as wrmsr might have changed them. */
2340 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_FS_BASE, pCtx->fs.u64Base);
2341 AssertRC(rc);
2342 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_GS_BASE, pCtx->gs.u64Base);
2343 AssertRC(rc);
2344 }
2345 }
2346 else
2347 {
2348 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
2349 }
2350
2351 hmR0VmxUpdateExceptionBitmap(pVM, pVCpu, pCtx);
2352
2353#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2354 /*
2355 * Store all guest MSRs in the VM-entry load area, so they will be loaded
2356 * during VM-entry and restored into the VM-exit store area during VM-exit.
2357 */
2358 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2359 unsigned idxMsr = 0;
2360
2361 uint32_t u32GstExtFeatures;
2362 uint32_t u32Temp;
2363 CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Temp, &u32Temp, &u32Temp, &u32GstExtFeatures);
2364
2365 if (u32GstExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
2366 {
2367 pMsr->u32IndexMSR = MSR_K6_EFER;
2368 pMsr->u32Reserved = 0;
2369 pMsr->u64Value = pCtx->msrEFER;
2370 /* VT-x will complain if only MSR_K6_EFER_LME is set. */
2371 if (!CPUMIsGuestInLongModeEx(pCtx))
2372 pMsr->u64Value &= ~(MSR_K6_EFER_LMA | MSR_K6_EFER_LME);
2373 pMsr++; idxMsr++;
2374
2375 if (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE)
2376 {
2377 pMsr->u32IndexMSR = MSR_K8_LSTAR;
2378 pMsr->u32Reserved = 0;
2379 pMsr->u64Value = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
2380 pMsr++; idxMsr++;
2381 pMsr->u32IndexMSR = MSR_K6_STAR;
2382 pMsr->u32Reserved = 0;
2383 pMsr->u64Value = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
2384 pMsr++; idxMsr++;
2385 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
2386 pMsr->u32Reserved = 0;
2387 pMsr->u64Value = pCtx->msrSFMASK; /* syscall flag mask */
2388 pMsr++; idxMsr++;
2389
2390 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2391#if 0
2392 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
2393 pMsr->u32Reserved = 0;
2394 pMsr->u64Value = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
2395 pMsr++; idxMsr++;
2396#endif
2397 }
2398 }
2399
2400 if ( pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP
2401 && (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP))
2402 {
2403 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
2404 pMsr->u32Reserved = 0;
2405 rc = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pMsr->u64Value);
2406 AssertRC(rc);
2407 pMsr++; idxMsr++;
2408 }
2409
2410 pVCpu->hm.s.vmx.cGuestMsrs = idxMsr;
2411
2412 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, idxMsr);
2413 AssertRC(rc);
2414
2415 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, idxMsr);
2416 AssertRC(rc);
2417#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2418
2419 /* Done with the major changes */
2420 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_ALL_GUEST;
2421
2422 /* Minimal guest state update (ESP, EIP, EFLAGS mostly) */
2423 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
2424
2425 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
2426 return rc;
2427}
2428
2429
2430/**
2431 * Syncs back the guest state from VMCS.
2432 *
2433 * @returns VBox status code.
2434 * @param pVM Pointer to the VM.
2435 * @param pVCpu Pointer to the VMCPU.
2436 * @param pCtx Pointer to the guest CPU context.
2437 */
2438DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2439{
2440 RTGCUINTREG val, valShadow;
2441 RTGCUINTPTR uInterruptState;
2442 int rc;
2443
2444 /* First sync back EIP, ESP, and EFLAGS. */
2445 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RIP, &val);
2446 AssertRC(rc);
2447 pCtx->rip = val;
2448 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RSP, &val);
2449 AssertRC(rc);
2450 pCtx->rsp = val;
2451 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
2452 AssertRC(rc);
2453 pCtx->eflags.u32 = val;
2454
2455 /* Take care of instruction fusing (sti, mov ss) */
2456 rc |= VMXReadCachedVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
2457 uInterruptState = val;
2458 if (uInterruptState != 0)
2459 {
2460 Assert(uInterruptState <= 2); /* only sti & mov ss */
2461 Log(("uInterruptState %x eip=%RGv\n", (uint32_t)uInterruptState, pCtx->rip));
2462 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
2463 }
2464 else
2465 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2466
2467 /* Control registers. */
2468 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
2469 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR0, &val);
2470 val = (valShadow & pVCpu->hm.s.vmx.cr0_mask) | (val & ~pVCpu->hm.s.vmx.cr0_mask);
2471 CPUMSetGuestCR0(pVCpu, val);
2472
2473 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
2474 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR4, &val);
2475 val = (valShadow & pVCpu->hm.s.vmx.cr4_mask) | (val & ~pVCpu->hm.s.vmx.cr4_mask);
2476 CPUMSetGuestCR4(pVCpu, val);
2477
2478 /*
2479 * No reason to sync back the CRx registers. They can't be changed by the guest unless in
2480 * the nested paging case where CR3 & CR4 can be changed by the guest.
2481 */
2482 if ( pVM->hm.s.fNestedPaging
2483 && CPUMIsGuestInPagedProtectedModeEx(pCtx)) /** @todo check if we will always catch mode switches and such... */
2484 {
2485 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
2486
2487 /* Can be updated behind our back in the nested paging case. */
2488 CPUMSetGuestCR2(pVCpu, pCache->cr2);
2489
2490 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR3, &val);
2491
2492 if (val != pCtx->cr3)
2493 {
2494 CPUMSetGuestCR3(pVCpu, val);
2495 PGMUpdateCR3(pVCpu, val);
2496 }
2497 rc = hmR0VmxSavePaePdpes(pVCpu, pCtx);
2498 AssertRCReturn(rc, rc);
2499 }
2500
2501 /* Sync back DR7. */
2502 VMXReadCachedVmcs(VMX_VMCS_GUEST_DR7, &val);
2503 pCtx->dr[7] = val;
2504
2505 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
2506 VMX_READ_SELREG(ES, es);
2507 VMX_READ_SELREG(SS, ss);
2508 VMX_READ_SELREG(CS, cs);
2509 VMX_READ_SELREG(DS, ds);
2510 VMX_READ_SELREG(FS, fs);
2511 VMX_READ_SELREG(GS, gs);
2512
2513 /* System MSRs */
2514 VMXReadCachedVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
2515 pCtx->SysEnter.cs = val;
2516 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
2517 pCtx->SysEnter.eip = val;
2518 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
2519 pCtx->SysEnter.esp = val;
2520
2521 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
2522 VMX_READ_SELREG(LDTR, ldtr);
2523
2524 VMXReadCachedVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
2525 pCtx->gdtr.cbGdt = val;
2526 VMXReadCachedVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val);
2527 pCtx->gdtr.pGdt = val;
2528
2529 VMXReadCachedVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
2530 pCtx->idtr.cbIdt = val;
2531 VMXReadCachedVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val);
2532 pCtx->idtr.pIdt = val;
2533
2534 /* Real mode emulation using v86 mode. */
2535 if ( CPUMIsGuestInRealModeEx(pCtx)
2536 && pVM->hm.s.vmx.pRealModeTSS)
2537 {
2538 /* Hide our emulation flags */
2539 pCtx->eflags.Bits.u1VM = 0;
2540
2541 /* Restore original IOPL setting as we always use 0. */
2542 pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.eflags.Bits.u2IOPL;
2543
2544 /* Force a TR resync every time in case we switch modes. */
2545 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_TR;
2546 }
2547 else
2548 {
2549 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
2550 VMX_READ_SELREG(TR, tr);
2551 }
2552
2553#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2554 /*
2555 * Save the possibly changed MSRs that we automatically restore and save during a world switch.
2556 */
2557 for (unsigned i = 0; i < pVCpu->hm.s.vmx.cGuestMsrs; i++)
2558 {
2559 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2560 pMsr += i;
2561
2562 switch (pMsr->u32IndexMSR)
2563 {
2564 case MSR_K8_LSTAR:
2565 pCtx->msrLSTAR = pMsr->u64Value;
2566 break;
2567 case MSR_K6_STAR:
2568 pCtx->msrSTAR = pMsr->u64Value;
2569 break;
2570 case MSR_K8_SF_MASK:
2571 pCtx->msrSFMASK = pMsr->u64Value;
2572 break;
2573 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2574#if 0
2575 case MSR_K8_KERNEL_GS_BASE:
2576 pCtx->msrKERNELGSBASE = pMsr->u64Value;
2577 break;
2578#endif
2579 case MSR_K8_TSC_AUX:
2580 CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, pMsr->u64Value);
2581 break;
2582
2583 case MSR_K6_EFER:
2584 /* EFER can't be changed without causing a VM-exit. */
2585 /* Assert(pCtx->msrEFER == pMsr->u64Value); */
2586 break;
2587
2588 default:
2589 AssertFailed();
2590 return VERR_HM_UNEXPECTED_LD_ST_MSR;
2591 }
2592 }
2593#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2594 return VINF_SUCCESS;
2595}
2596
2597
2598/**
2599 * Dummy placeholder for TLB flush handling before VM-entry. Used in the case
2600 * where neither EPT nor VPID is supported by the CPU.
2601 *
2602 * @param pVM Pointer to the VM.
2603 * @param pVCpu Pointer to the VMCPU.
2604 */
2605static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu)
2606{
2607 NOREF(pVM);
2608 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH);
2609 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2610 pVCpu->hm.s.TlbShootdown.cPages = 0;
2611 return;
2612}
2613
2614
2615/**
2616 * Setup the tagged TLB for EPT+VPID.
2617 *
2618 * @param pVM Pointer to the VM.
2619 * @param pVCpu Pointer to the VMCPU.
2620 */
2621static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu)
2622{
2623 PHMGLOBLCPUINFO pCpu;
2624
2625 Assert(pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid);
2626
2627 pCpu = HMR0GetCurrentCpu();
2628
2629 /*
2630 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2631 * This can happen both for start & resume due to long jumps back to ring-3.
2632 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2633 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2634 */
2635 bool fNewAsid = false;
2636 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2637 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2638 {
2639 pVCpu->hm.s.fForceTLBFlush = true;
2640 fNewAsid = true;
2641 }
2642
2643 /*
2644 * Check for explicit TLB shootdowns.
2645 */
2646 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2647 pVCpu->hm.s.fForceTLBFlush = true;
2648
2649 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2650
2651 if (pVCpu->hm.s.fForceTLBFlush)
2652 {
2653 if (fNewAsid)
2654 {
2655 ++pCpu->uCurrentAsid;
2656 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2657 {
2658 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2659 pCpu->cTlbFlushes++;
2660 pCpu->fFlushAsidBeforeUse = true;
2661 }
2662
2663 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2664 if (pCpu->fFlushAsidBeforeUse)
2665 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2666 }
2667 else
2668 {
2669 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
2670 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_SINGLE_CONTEXT, 0 /* GCPtr */);
2671 else
2672 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2673 }
2674
2675 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2676 pVCpu->hm.s.fForceTLBFlush = false;
2677 }
2678 else
2679 {
2680 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2681 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2682 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2683 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2684
2685 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2686 * not be executed. See hmQueueInvlPage() where it is commented
2687 * out. Support individual entry flushing someday. */
2688 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2689 {
2690 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2691
2692 /*
2693 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2694 * as supported by the CPU.
2695 */
2696 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2697 {
2698 for (unsigned i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2699 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2700 }
2701 else
2702 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2703 }
2704 else
2705 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2706 }
2707
2708 pVCpu->hm.s.TlbShootdown.cPages = 0;
2709 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2710
2711 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2712 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2713 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2714 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2715 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2716 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2717
2718 /* Update VMCS with the VPID. */
2719 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2720 AssertRC(rc);
2721}
2722
2723
2724/**
2725 * Setup the tagged TLB for EPT only.
2726 *
2727 * @returns VBox status code.
2728 * @param pVM Pointer to the VM.
2729 * @param pVCpu Pointer to the VMCPU.
2730 */
2731static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu)
2732{
2733 PHMGLOBLCPUINFO pCpu;
2734
2735 Assert(pVM->hm.s.fNestedPaging);
2736 Assert(!pVM->hm.s.vmx.fVpid);
2737
2738 pCpu = HMR0GetCurrentCpu();
2739
2740 /*
2741 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2742 * This can happen both for start & resume due to long jumps back to ring-3.
2743 * A change in the TLB flush count implies the host Cpu is online after a suspend/resume.
2744 */
2745 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2746 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2747 {
2748 pVCpu->hm.s.fForceTLBFlush = true;
2749 }
2750
2751 /*
2752 * Check for explicit TLB shootdown flushes.
2753 */
2754 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2755 pVCpu->hm.s.fForceTLBFlush = true;
2756
2757 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2758 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2759
2760 if (pVCpu->hm.s.fForceTLBFlush)
2761 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2762 else
2763 {
2764 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2765 * not be executed. See hmQueueInvlPage() where it is commented
2766 * out. Support individual entry flushing someday. */
2767 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2768 {
2769 /*
2770 * We cannot flush individual entries without VPID support. Flush using EPT.
2771 */
2772 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2773 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2774 }
2775 }
2776 pVCpu->hm.s.TlbShootdown.cPages= 0;
2777 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2778
2779#ifdef VBOX_WITH_STATISTICS
2780 /** @todo r=ramshankar: this is not accurate anymore with the VPID+EPT
2781 * handling. Should be fixed later. */
2782 if (pVCpu->hm.s.fForceTLBFlush)
2783 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2784 else
2785 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2786#endif
2787}
2788
2789
2790/**
2791 * Setup the tagged TLB for VPID.
2792 *
2793 * @returns VBox status code.
2794 * @param pVM Pointer to the VM.
2795 * @param pVCpu Pointer to the VMCPU.
2796 */
2797static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu)
2798{
2799 PHMGLOBLCPUINFO pCpu;
2800
2801 Assert(pVM->hm.s.vmx.fVpid);
2802 Assert(!pVM->hm.s.fNestedPaging);
2803
2804 pCpu = HMR0GetCurrentCpu();
2805
2806 /*
2807 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2808 * This can happen both for start & resume due to long jumps back to ring-3.
2809 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2810 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2811 */
2812 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2813 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2814 {
2815 /* Force a TLB flush on VM entry. */
2816 pVCpu->hm.s.fForceTLBFlush = true;
2817 }
2818
2819 /*
2820 * Check for explicit TLB shootdown flushes.
2821 */
2822 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2823 pVCpu->hm.s.fForceTLBFlush = true;
2824
2825 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2826
2827 if (pVCpu->hm.s.fForceTLBFlush)
2828 {
2829 ++pCpu->uCurrentAsid;
2830 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2831 {
2832 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2833 pCpu->cTlbFlushes++;
2834 pCpu->fFlushAsidBeforeUse = true;
2835 }
2836
2837 pVCpu->hm.s.fForceTLBFlush = false;
2838 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2839 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2840 if (pCpu->fFlushAsidBeforeUse)
2841 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2842 }
2843 else
2844 {
2845 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2846 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2847 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2848 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2849
2850 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2851 * not be executed. See hmQueueInvlPage() where it is commented
2852 * out. Support individual entry flushing someday. */
2853 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2854 {
2855 /*
2856 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2857 * as supported by the CPU.
2858 */
2859 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2860 {
2861 for (unsigned i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2862 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2863 }
2864 else
2865 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2866 }
2867 }
2868 pVCpu->hm.s.TlbShootdown.cPages = 0;
2869 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2870
2871 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2872 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2873 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2874 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2875 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2876 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2877
2878 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2879 AssertRC(rc);
2880
2881# ifdef VBOX_WITH_STATISTICS
2882 /** @todo r=ramshankar: this is not accurate anymore with EPT+VPID handling.
2883 * Should be fixed later. */
2884 if (pVCpu->hm.s.fForceTLBFlush)
2885 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2886 else
2887 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2888# endif
2889}
2890
2891
2892/**
2893 * Runs guest code in a VT-x VM.
2894 *
2895 * @returns VBox status code.
2896 * @param pVM Pointer to the VM.
2897 * @param pVCpu Pointer to the VMCPU.
2898 * @param pCtx Pointer to the guest CPU context.
2899 */
2900VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2901{
2902 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
2903 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
2904 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
2905
2906 VBOXSTRICTRC rc = VINF_SUCCESS;
2907 int rc2;
2908 RTGCUINTREG val;
2909 RTGCUINTREG exitReason = (RTGCUINTREG)VMX_EXIT_INVALID;
2910 RTGCUINTREG instrError, cbInstr;
2911 RTGCUINTPTR exitQualification = 0;
2912 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
2913 RTGCUINTPTR errCode, instrInfo;
2914 bool fSetupTPRCaching = false;
2915 bool fNeedTscSetup = true;
2916 uint64_t u64OldLSTAR = 0;
2917 uint8_t u8LastTPR = 0;
2918 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
2919 unsigned cResume = 0;
2920#ifdef VBOX_STRICT
2921 RTCPUID idCpuCheck;
2922 bool fWasInLongMode = false;
2923#endif
2924#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2925 uint64_t u64LastTime = RTTimeMilliTS();
2926#endif
2927
2928 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2929 || (pVCpu->hm.s.vmx.pbVirtApic && pVM->hm.s.vmx.pbApicAccess));
2930
2931 /*
2932 * Check if we need to use TPR shadowing.
2933 */
2934 if ( CPUMIsGuestInLongModeEx(pCtx)
2935 || ( (( pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2936 || pVM->hm.s.fTRPPatchingAllowed)
2937 && pVM->hm.s.fHasIoApic)
2938 )
2939 {
2940 fSetupTPRCaching = true;
2941 }
2942
2943 Log2(("\nE"));
2944
2945 /* This is not ideal, but if we don't clear the event injection in the VMCS right here,
2946 * we may end up injecting some stale event into a VM, including injecting an event that
2947 * originated before a VM reset *after* the VM has been reset. See @bugref{6220}.
2948 */
2949 VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, 0);
2950
2951#ifdef VBOX_STRICT
2952 {
2953 RTCCUINTREG val2;
2954
2955 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val2);
2956 AssertRC(rc2);
2957 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val2));
2958
2959 /* allowed zero */
2960 if ((val2 & pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
2961 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
2962
2963 /* allowed one */
2964 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
2965 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
2966
2967 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val2);
2968 AssertRC(rc2);
2969 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val2));
2970
2971 /*
2972 * Must be set according to the MSR, but can be cleared if nested paging is used.
2973 */
2974 if (pVM->hm.s.fNestedPaging)
2975 {
2976 val2 |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
2977 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2978 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2979 }
2980
2981 /* allowed zero */
2982 if ((val2 & pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
2983 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
2984
2985 /* allowed one */
2986 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
2987 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
2988
2989 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val2);
2990 AssertRC(rc2);
2991 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val2));
2992
2993 /* allowed zero */
2994 if ((val2 & pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0)
2995 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
2996
2997 /* allowed one */
2998 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
2999 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
3000
3001 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val2);
3002 AssertRC(rc2);
3003 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val2));
3004
3005 /* allowed zero */
3006 if ((val2 & pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0)
3007 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
3008
3009 /* allowed one */
3010 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
3011 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
3012 }
3013 fWasInLongMode = CPUMIsGuestInLongModeEx(pCtx);
3014#endif /* VBOX_STRICT */
3015
3016#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3017 pVCpu->hm.s.vmx.VMCSCache.u64TimeEntry = RTTimeNanoTS();
3018#endif
3019
3020 /*
3021 * We can jump to this point to resume execution after determining that a VM-exit is innocent.
3022 */
3023ResumeExecution:
3024 if (!STAM_REL_PROFILE_ADV_IS_RUNNING(&pVCpu->hm.s.StatEntry))
3025 STAM_REL_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit2, &pVCpu->hm.s.StatEntry, x);
3026 AssertMsg(pVCpu->hm.s.idEnteredCpu == RTMpCpuId(),
3027 ("Expected %d, I'm %d; cResume=%d exitReason=%RGv exitQualification=%RGv\n",
3028 (int)pVCpu->hm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
3029 Assert(!HMR0SuspendPending());
3030 /* Not allowed to switch modes without reloading the host state (32->64 switcher)!! */
3031 Assert(fWasInLongMode == CPUMIsGuestInLongModeEx(pCtx));
3032
3033 /*
3034 * Safety precaution; looping for too long here can have a very bad effect on the host.
3035 */
3036 if (RT_UNLIKELY(++cResume > pVM->hm.s.cMaxResumeLoops))
3037 {
3038 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMaxResume);
3039 rc = VINF_EM_RAW_INTERRUPT;
3040 goto end;
3041 }
3042
3043 /*
3044 * Check for IRQ inhibition due to instruction fusing (sti, mov ss).
3045 */
3046 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
3047 {
3048 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
3049 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
3050 {
3051 /*
3052 * Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
3053 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
3054 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
3055 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
3056 */
3057 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3058 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3059 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3060 AssertRC(rc2);
3061 }
3062 }
3063 else
3064 {
3065 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3066 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3067 AssertRC(rc2);
3068 }
3069
3070#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
3071 if (RT_UNLIKELY((cResume & 0xf) == 0))
3072 {
3073 uint64_t u64CurTime = RTTimeMilliTS();
3074
3075 if (RT_UNLIKELY(u64CurTime > u64LastTime))
3076 {
3077 u64LastTime = u64CurTime;
3078 TMTimerPollVoid(pVM, pVCpu);
3079 }
3080 }
3081#endif
3082
3083 /*
3084 * Check for pending actions that force us to go back to ring-3.
3085 */
3086 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK | VM_FF_REQUEST | VM_FF_PGM_POOL_FLUSH_PENDING | VM_FF_PDM_DMA)
3087 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL | VMCPU_FF_REQUEST))
3088 {
3089 /* Check if a sync operation is pending. */
3090 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
3091 {
3092 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
3093 if (rc != VINF_SUCCESS)
3094 {
3095 AssertRC(VBOXSTRICTRC_VAL(rc));
3096 Log(("Pending pool sync is forcing us back to ring 3; rc=%d\n", VBOXSTRICTRC_VAL(rc)));
3097 goto end;
3098 }
3099 }
3100
3101#ifdef DEBUG
3102 /* Intercept X86_XCPT_DB if stepping is enabled */
3103 if (!DBGFIsStepping(pVCpu))
3104#endif
3105 {
3106 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK)
3107 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
3108 {
3109 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
3110 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
3111 goto end;
3112 }
3113 }
3114
3115 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
3116 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
3117 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
3118 {
3119 rc = VINF_EM_PENDING_REQUEST;
3120 goto end;
3121 }
3122
3123 /* Check if a pgm pool flush is in progress. */
3124 if (VM_FF_ISPENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
3125 {
3126 rc = VINF_PGM_POOL_FLUSH_PENDING;
3127 goto end;
3128 }
3129
3130 /* Check if DMA work is pending (2nd+ run). */
3131 if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA) && cResume > 1)
3132 {
3133 rc = VINF_EM_RAW_TO_R3;
3134 goto end;
3135 }
3136 }
3137
3138#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3139 /*
3140 * Exit to ring-3 preemption/work is pending.
3141 *
3142 * Interrupts are disabled before the call to make sure we don't miss any interrupt
3143 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
3144 * further down, but hmR0VmxCheckPendingInterrupt makes that impossible.)
3145 *
3146 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
3147 * shootdowns rely on this.
3148 */
3149 uOldEFlags = ASMIntDisableFlags();
3150 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
3151 {
3152 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPreemptPending);
3153 rc = VINF_EM_RAW_INTERRUPT;
3154 goto end;
3155 }
3156 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3157#endif
3158
3159 /*
3160 * When external interrupts are pending, we should exit the VM when IF is set.
3161 * Note: *After* VM_FF_INHIBIT_INTERRUPTS check!
3162 */
3163 rc = hmR0VmxCheckPendingInterrupt(pVM, pVCpu, pCtx);
3164 if (RT_FAILURE(rc))
3165 goto end;
3166
3167 /** @todo check timers?? */
3168
3169 /*
3170 * TPR caching using CR8 is only available in 64-bit mode.
3171 * Note: The 32-bit exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but this appears missing in Intel CPUs.
3172 * Note: We can't do this in LoadGuestState() as PDMApicGetTPR can jump back to ring-3 (lock)!! (no longer true) .
3173 */
3174 /** @todo query and update the TPR only when it could have been changed (mmio
3175 * access & wrsmr (x2apic) */
3176 if (fSetupTPRCaching)
3177 {
3178 /* TPR caching in CR8 */
3179 bool fPending;
3180
3181 rc2 = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
3182 AssertRC(rc2);
3183 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
3184 pVCpu->hm.s.vmx.pbVirtApic[0x80] = u8LastTPR;
3185
3186 /*
3187 * Two options here:
3188 * - external interrupt pending, but masked by the TPR value.
3189 * -> a CR8 update that lower the current TPR value should cause an exit
3190 * - no pending interrupts
3191 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
3192 */
3193
3194 /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
3195 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, (fPending) ? (u8LastTPR >> 4) : 0);
3196 AssertRC(VBOXSTRICTRC_VAL(rc));
3197
3198 if (pVM->hm.s.fTPRPatchingActive)
3199 {
3200 Assert(!CPUMIsGuestInLongModeEx(pCtx));
3201 /* Our patch code uses LSTAR for TPR caching. */
3202 pCtx->msrLSTAR = u8LastTPR;
3203
3204 /** @todo r=ramshankar: we should check for MSR-bitmap support here. */
3205 if (fPending)
3206 {
3207 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
3208 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
3209 }
3210 else
3211 {
3212 /*
3213 * No interrupts are pending, so we don't need to be explicitely notified.
3214 * There are enough world switches for detecting pending interrupts.
3215 */
3216 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
3217 }
3218 }
3219 }
3220
3221#ifdef LOG_ENABLED
3222 if ( pVM->hm.s.fNestedPaging
3223 || pVM->hm.s.vmx.fVpid)
3224 {
3225 PHMGLOBLCPUINFO pCpu = HMR0GetCurrentCpu();
3226 if (pVCpu->hm.s.idLastCpu != pCpu->idCpu)
3227 {
3228 LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hm.s.idLastCpu,
3229 pCpu->idCpu));
3230 }
3231 else if (pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
3232 {
3233 LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hm.s.cTlbFlushes,
3234 pCpu->cTlbFlushes));
3235 }
3236 else if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH))
3237 LogFlow(("Manual TLB flush\n"));
3238 }
3239#endif
3240#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
3241 PGMRZDynMapFlushAutoSet(pVCpu);
3242#endif
3243
3244 /*
3245 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING-3!
3246 * (until the actual world switch)
3247 */
3248#ifdef VBOX_STRICT
3249 idCpuCheck = RTMpCpuId();
3250#endif
3251#ifdef LOG_ENABLED
3252 VMMR0LogFlushDisable(pVCpu);
3253#endif
3254
3255 /*
3256 * Save the host state first.
3257 */
3258 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
3259 {
3260 rc = VMXR0SaveHostState(pVM, pVCpu);
3261 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3262 {
3263 VMMR0LogFlushEnable(pVCpu);
3264 goto end;
3265 }
3266 }
3267
3268 /*
3269 * Load the guest state.
3270 */
3271 if (!pVCpu->hm.s.fContextUseFlags)
3272 {
3273 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
3274 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadMinimal);
3275 if (fNeedTscSetup)
3276 {
3277 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3278 fNeedTscSetup = false;
3279 }
3280 }
3281 else
3282 {
3283 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
3284 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3285 {
3286 VMMR0LogFlushEnable(pVCpu);
3287 goto end;
3288 }
3289 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
3290 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3291 }
3292
3293#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3294 /*
3295 * Disable interrupts to make sure a poke will interrupt execution.
3296 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
3297 */
3298 uOldEFlags = ASMIntDisableFlags();
3299 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3300#endif
3301
3302 /* Non-register state Guest Context */
3303 /** @todo change me according to cpu state */
3304 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_VMCS_GUEST_ACTIVITY_ACTIVE);
3305 AssertRC(rc2);
3306
3307 /* Set TLB flush state as checked until we return from the world switch. */
3308 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);
3309 /* Deal with tagged TLB setup and invalidation. */
3310 pVM->hm.s.vmx.pfnFlushTaggedTlb(pVM, pVCpu);
3311
3312 /*
3313 * Manual save and restore:
3314 * - General purpose registers except RIP, RSP
3315 *
3316 * Trashed:
3317 * - CR2 (we don't care)
3318 * - LDTR (reset to 0)
3319 * - DRx (presumably not changed at all)
3320 * - DR7 (reset to 0x400)
3321 * - EFLAGS (reset to RT_BIT(1); not relevant)
3322 */
3323
3324 /* All done! Let's start VM execution. */
3325 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatEntry, &pVCpu->hm.s.StatInGC, x);
3326 Assert(idCpuCheck == RTMpCpuId());
3327
3328#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3329 pVCpu->hm.s.vmx.VMCSCache.cResume = cResume;
3330 pVCpu->hm.s.vmx.VMCSCache.u64TimeSwitch = RTTimeNanoTS();
3331#endif
3332
3333 /*
3334 * Save the current TPR value in the LSTAR MSR so our patches can access it.
3335 */
3336 if (pVM->hm.s.fTPRPatchingActive)
3337 {
3338 Assert(pVM->hm.s.fTPRPatchingActive);
3339 u64OldLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3340 ASMWrMsr(MSR_K8_LSTAR, u8LastTPR);
3341 }
3342
3343 TMNotifyStartOfExecution(pVCpu);
3344
3345#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3346 /*
3347 * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
3348 * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
3349 */
3350 if ( (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3351 && !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3352 {
3353 pVCpu->hm.s.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
3354 uint64_t u64GuestTSCAux = 0;
3355 rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64GuestTSCAux);
3356 AssertRC(rc2);
3357 ASMWrMsr(MSR_K8_TSC_AUX, u64GuestTSCAux);
3358 }
3359#endif
3360
3361#ifdef VBOX_WITH_KERNEL_USING_XMM
3362 rc = hmR0VMXStartVMWrapXMM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu, pVCpu->hm.s.vmx.pfnStartVM);
3363#else
3364 rc = pVCpu->hm.s.vmx.pfnStartVM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu);
3365#endif
3366 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false);
3367 ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits);
3368
3369 /* Possibly the last TSC value seen by the guest (too high) (only when we're in TSC offset mode). */
3370 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3371 {
3372#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3373 /* Restore host's TSC_AUX. */
3374 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3375 ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hm.s.u64HostTSCAux);
3376#endif
3377
3378 TMCpuTickSetLastSeen(pVCpu,
3379 ASMReadTSC() + pVCpu->hm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
3380 }
3381
3382 TMNotifyEndOfExecution(pVCpu);
3383 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
3384 Assert(!(ASMGetFlags() & X86_EFL_IF));
3385
3386 /*
3387 * Restore the host LSTAR MSR if the guest could have changed it.
3388 */
3389 if (pVM->hm.s.fTPRPatchingActive)
3390 {
3391 Assert(pVM->hm.s.fTPRPatchingActive);
3392 pVCpu->hm.s.vmx.pbVirtApic[0x80] = pCtx->msrLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3393 ASMWrMsr(MSR_K8_LSTAR, u64OldLSTAR);
3394 }
3395
3396 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
3397 ASMSetFlags(uOldEFlags);
3398#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3399 uOldEFlags = ~(RTCCUINTREG)0;
3400#endif
3401
3402 AssertMsg(!pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries, ("pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries=%d\n",
3403 pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries));
3404
3405 /* In case we execute a goto ResumeExecution later on. */
3406 pVCpu->hm.s.fResumeVM = true;
3407 pVCpu->hm.s.fForceTLBFlush = false;
3408
3409 /*
3410 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3411 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
3412 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3413 */
3414
3415 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3416 {
3417 hmR0VmxReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
3418 VMMR0LogFlushEnable(pVCpu);
3419 goto end;
3420 }
3421
3422 /* Success. Query the guest state and figure out what has happened. */
3423
3424 /* Investigate why there was a VM-exit. */
3425 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3426 STAM_COUNTER_INC(&pVCpu->hm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
3427
3428 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
3429 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3430 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
3431 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &intInfo);
3432 /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
3433 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE, &errCode);
3434 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_INFO, &instrInfo);
3435 rc2 |= VMXReadCachedVmcs(VMX_VMCS_RO_EXIT_QUALIFICATION, &exitQualification);
3436 AssertRC(rc2);
3437
3438 /*
3439 * Sync back the guest state.
3440 */
3441 rc2 = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
3442 AssertRC(rc2);
3443
3444 /* Note! NOW IT'S SAFE FOR LOGGING! */
3445 VMMR0LogFlushEnable(pVCpu);
3446 Log2(("Raw exit reason %08x\n", exitReason));
3447#if ARCH_BITS == 64 /* for the time being */
3448 VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pCtx, exitReason);
3449#endif
3450
3451 /*
3452 * Check if an injected event was interrupted prematurely.
3453 */
3454 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_INFO, &val);
3455 AssertRC(rc2);
3456 pVCpu->hm.s.Event.u64IntrInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
3457 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3458 /* Ignore 'int xx' as they'll be restarted anyway. */
3459 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
3460 /* Ignore software exceptions (such as int3) as they'll reoccur when we restart the instruction anyway. */
3461 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3462 {
3463 Assert(!pVCpu->hm.s.Event.fPending);
3464 pVCpu->hm.s.Event.fPending = true;
3465 /* Error code present? */
3466 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
3467 {
3468 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_ERROR_CODE, &val);
3469 AssertRC(rc2);
3470 pVCpu->hm.s.Event.u32ErrCode = val;
3471 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv pending error=%RX64\n",
3472 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
3473 }
3474 else
3475 {
3476 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hm.s.Event.u64IntrInfo,
3477 (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3478 pVCpu->hm.s.Event.u32ErrCode = 0;
3479 }
3480 }
3481#ifdef VBOX_STRICT
3482 else if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3483 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
3484 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3485 {
3486 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n",
3487 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3488 }
3489
3490 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
3491 HMDumpRegs(pVM, pVCpu, pCtx);
3492#endif
3493
3494 Log2(("E%d: New EIP=%x:%RGv\n", (uint32_t)exitReason, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3495 Log2(("Exit reason %d, exitQualification %RGv\n", (uint32_t)exitReason, exitQualification));
3496 Log2(("instrInfo=%d instrError=%d instr length=%d\n", (uint32_t)instrInfo, (uint32_t)instrError, (uint32_t)cbInstr));
3497 Log2(("Interruption error code %d\n", (uint32_t)errCode));
3498 Log2(("IntInfo = %08x\n", (uint32_t)intInfo));
3499
3500 /*
3501 * Sync back the TPR if it was changed.
3502 */
3503 if ( fSetupTPRCaching
3504 && u8LastTPR != pVCpu->hm.s.vmx.pbVirtApic[0x80])
3505 {
3506 rc2 = PDMApicSetTPR(pVCpu, pVCpu->hm.s.vmx.pbVirtApic[0x80]);
3507 AssertRC(rc2);
3508 }
3509
3510#ifdef DBGFTRACE_ENABLED /** @todo DTrace later. */
3511 RTTraceBufAddMsgF(pVM->CTX_SUFF(hTraceBuf), "vmexit %08x %016RX64 at %04:%08RX64 %RX64",
3512 exitReason, (uint64_t)exitQualification, pCtx->cs.Sel, pCtx->rip, (uint64_t)intInfo);
3513#endif
3514 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
3515
3516 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
3517 Assert(rc == VINF_SUCCESS); /* might consider VERR_IPE_UNINITIALIZED_STATUS here later... */
3518 switch (exitReason)
3519 {
3520 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
3521 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
3522 {
3523 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
3524
3525 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
3526 {
3527 Assert(exitReason == VMX_EXIT_EXT_INT);
3528 /* External interrupt; leave to allow it to be dispatched again. */
3529 rc = VINF_EM_RAW_INTERRUPT;
3530 break;
3531 }
3532 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub3, y3);
3533 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
3534 {
3535 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
3536 /* External interrupt; leave to allow it to be dispatched again. */
3537 rc = VINF_EM_RAW_INTERRUPT;
3538 break;
3539
3540 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT: /* External hardware interrupt. */
3541 AssertFailed(); /* can't come here; fails the first check. */
3542 break;
3543
3544 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT: /* Unknown why we get this type for #DB */
3545 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /* Software exception. (#BP or #OF) */
3546 Assert(vector == 1 || vector == 3 || vector == 4);
3547 /* no break */
3548 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT: /* Hardware exception. */
3549 Log2(("Hardware/software interrupt %d\n", vector));
3550 switch (vector)
3551 {
3552 case X86_XCPT_NM:
3553 {
3554 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
3555
3556 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
3557 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
3558 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
3559 if (rc == VINF_SUCCESS)
3560 {
3561 Assert(CPUMIsGuestFPUStateActive(pVCpu));
3562
3563 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowNM);
3564
3565 /* Continue execution. */
3566 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
3567
3568 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3569 goto ResumeExecution;
3570 }
3571
3572 Log(("Forward #NM fault to the guest\n"));
3573 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNM);
3574 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3575 cbInstr, 0);
3576 AssertRC(rc2);
3577 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3578 goto ResumeExecution;
3579 }
3580
3581 case X86_XCPT_PF: /* Page fault */
3582 {
3583#ifdef VBOX_ALWAYS_TRAP_PF
3584 if (pVM->hm.s.fNestedPaging)
3585 {
3586 /*
3587 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3588 */
3589 Log(("Guest page fault at %RGv cr2=%RGv error code %RGv rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification,
3590 errCode, (RTGCPTR)pCtx->rsp));
3591
3592 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
3593
3594 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3595
3596 /* Now we must update CR2. */
3597 pCtx->cr2 = exitQualification;
3598 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3599 cbInstr, errCode);
3600 AssertRC(rc2);
3601
3602 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3603 goto ResumeExecution;
3604 }
3605#else
3606 Assert(!pVM->hm.s.fNestedPaging);
3607#endif
3608
3609#ifdef VBOX_HM_WITH_GUEST_PATCHING
3610 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
3611 if ( pVM->hm.s.fTRPPatchingAllowed
3612 && pVM->hm.s.pGuestPatchMem
3613 && (exitQualification & 0xfff) == 0x080
3614 && !(errCode & X86_TRAP_PF_P) /* not present */
3615 && CPUMGetGuestCPL(pVCpu) == 0
3616 && !CPUMIsGuestInLongModeEx(pCtx)
3617 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
3618 {
3619 RTGCPHYS GCPhysApicBase, GCPhys;
3620 GCPhysApicBase = pCtx->msrApicBase;
3621 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3622
3623 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3624 if ( rc == VINF_SUCCESS
3625 && GCPhys == GCPhysApicBase)
3626 {
3627 /* Only attempt to patch the instruction once. */
3628 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
3629 if (!pPatch)
3630 {
3631 rc = VINF_EM_HM_PATCH_TPR_INSTR;
3632 break;
3633 }
3634 }
3635 }
3636#endif
3637
3638 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
3639 /* Exit qualification contains the linear address of the page fault. */
3640 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3641 TRPMSetErrorCode(pVCpu, errCode);
3642 TRPMSetFaultAddress(pVCpu, exitQualification);
3643
3644 /* Shortcut for APIC TPR reads and writes. */
3645 if ( (exitQualification & 0xfff) == 0x080
3646 && !(errCode & X86_TRAP_PF_P) /* not present */
3647 && fSetupTPRCaching
3648 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3649 {
3650 RTGCPHYS GCPhysApicBase, GCPhys;
3651 GCPhysApicBase = pCtx->msrApicBase;
3652 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3653
3654 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3655 if ( rc == VINF_SUCCESS
3656 && GCPhys == GCPhysApicBase)
3657 {
3658 Log(("Enable VT-x virtual APIC access filtering\n"));
3659 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
3660 X86_PTE_RW | X86_PTE_P);
3661 AssertRC(rc2);
3662 }
3663 }
3664
3665 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
3666 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
3667 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3668
3669 if (rc == VINF_SUCCESS)
3670 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3671 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
3672 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
3673
3674 TRPMResetTrap(pVCpu);
3675 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3676 goto ResumeExecution;
3677 }
3678 else if (rc == VINF_EM_RAW_GUEST_TRAP)
3679 {
3680 /*
3681 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3682 */
3683 Log2(("Forward page fault to the guest\n"));
3684
3685 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3686 /* The error code might have been changed. */
3687 errCode = TRPMGetErrorCode(pVCpu);
3688
3689 TRPMResetTrap(pVCpu);
3690
3691 /* Now we must update CR2. */
3692 pCtx->cr2 = exitQualification;
3693 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3694 cbInstr, errCode);
3695 AssertRC(rc2);
3696
3697 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3698 goto ResumeExecution;
3699 }
3700#ifdef VBOX_STRICT
3701 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
3702 Log2(("PGMTrap0eHandler failed with %d\n", VBOXSTRICTRC_VAL(rc)));
3703#endif
3704 /* Need to go back to the recompiler to emulate the instruction. */
3705 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPFEM);
3706 TRPMResetTrap(pVCpu);
3707
3708 /* If event delivery caused the #PF (shadow or not), tell TRPM. */
3709 hmR0VmxCheckPendingEvent(pVCpu);
3710 break;
3711 }
3712
3713 case X86_XCPT_MF: /* Floating point exception. */
3714 {
3715 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
3716 if (!(pCtx->cr0 & X86_CR0_NE))
3717 {
3718 /* old style FPU error reporting needs some extra work. */
3719 /** @todo don't fall back to the recompiler, but do it manually. */
3720 rc = VINF_EM_RAW_EMULATE_INSTR;
3721 break;
3722 }
3723 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3724 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3725 cbInstr, errCode);
3726 AssertRC(rc2);
3727
3728 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3729 goto ResumeExecution;
3730 }
3731
3732 case X86_XCPT_DB: /* Debug exception. */
3733 {
3734 uint64_t uDR6;
3735
3736 /*
3737 * DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
3738 *
3739 * Exit qualification bits:
3740 * 3:0 B0-B3 which breakpoint condition was met
3741 * 12:4 Reserved (0)
3742 * 13 BD - debug register access detected
3743 * 14 BS - single step execution or branch taken
3744 * 63:15 Reserved (0)
3745 */
3746 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
3747
3748 /* Note that we don't support guest and host-initiated debugging at the same time. */
3749
3750 uDR6 = X86_DR6_INIT_VAL;
3751 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
3752 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), uDR6);
3753 if (rc == VINF_EM_RAW_GUEST_TRAP)
3754 {
3755 /* Update DR6 here. */
3756 pCtx->dr[6] = uDR6;
3757
3758 /* Resync DR6 if the debug state is active. */
3759 if (CPUMIsGuestDebugStateActive(pVCpu))
3760 ASMSetDR6(pCtx->dr[6]);
3761
3762 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
3763 pCtx->dr[7] &= ~X86_DR7_GD;
3764
3765 /* Paranoia. */
3766 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
3767 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
3768 pCtx->dr[7] |= 0x400; /* must be one */
3769
3770 /* Resync DR7 */
3771 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
3772 AssertRC(rc2);
3773
3774 Log(("Trap %x (debug) at %RGv exit qualification %RX64 dr6=%x dr7=%x\n", vector, (RTGCPTR)pCtx->rip,
3775 exitQualification, (uint32_t)pCtx->dr[6], (uint32_t)pCtx->dr[7]));
3776 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3777 cbInstr, errCode);
3778 AssertRC(rc2);
3779
3780 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3781 goto ResumeExecution;
3782 }
3783 /* Return to ring 3 to deal with the debug exit code. */
3784 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3785 break;
3786 }
3787
3788 case X86_XCPT_BP: /* Breakpoint. */
3789 {
3790 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
3791 rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3792 if (rc == VINF_EM_RAW_GUEST_TRAP)
3793 {
3794 Log(("Guest #BP at %04x:%RGv\n", pCtx->cs.Sel, pCtx->rip));
3795 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3796 cbInstr, errCode);
3797 AssertRC(rc2);
3798 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3799 goto ResumeExecution;
3800 }
3801 if (rc == VINF_SUCCESS)
3802 {
3803 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3804 goto ResumeExecution;
3805 }
3806 Log(("Debugger BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3807 break;
3808 }
3809
3810 case X86_XCPT_GP: /* General protection failure exception. */
3811 {
3812 uint32_t cbOp;
3813 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
3814
3815 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestGP);
3816#ifdef VBOX_STRICT
3817 if ( !CPUMIsGuestInRealModeEx(pCtx)
3818 || !pVM->hm.s.vmx.pRealModeTSS)
3819 {
3820 Log(("Trap %x at %04X:%RGv errorCode=%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip, errCode));
3821 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3822 cbInstr, errCode);
3823 AssertRC(rc2);
3824 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3825 goto ResumeExecution;
3826 }
3827#endif
3828 Assert(CPUMIsGuestInRealModeEx(pCtx));
3829
3830 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %x:%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3831
3832 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
3833 if (RT_SUCCESS(rc2))
3834 {
3835 bool fUpdateRIP = true;
3836
3837 rc = VINF_SUCCESS;
3838 Assert(cbOp == pDis->cbInstr);
3839 switch (pDis->pCurInstr->uOpcode)
3840 {
3841 case OP_CLI:
3842 pCtx->eflags.Bits.u1IF = 0;
3843 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCli);
3844 break;
3845
3846 case OP_STI:
3847 pCtx->eflags.Bits.u1IF = 1;
3848 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + pDis->cbInstr);
3849 Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
3850 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE,
3851 VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
3852 AssertRC(rc2);
3853 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitSti);
3854 break;
3855
3856 case OP_HLT:
3857 fUpdateRIP = false;
3858 rc = VINF_EM_HALT;
3859 pCtx->rip += pDis->cbInstr;
3860 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
3861 break;
3862
3863 case OP_POPF:
3864 {
3865 RTGCPTR GCPtrStack;
3866 uint32_t cbParm;
3867 uint32_t uMask;
3868 X86EFLAGS eflags;
3869
3870 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3871 {
3872 cbParm = 4;
3873 uMask = 0xffffffff;
3874 }
3875 else
3876 {
3877 cbParm = 2;
3878 uMask = 0xffff;
3879 }
3880
3881 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3882 if (RT_FAILURE(rc2))
3883 {
3884 rc = VERR_EM_INTERPRETER;
3885 break;
3886 }
3887 eflags.u = 0;
3888 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3889 if (RT_FAILURE(rc2))
3890 {
3891 rc = VERR_EM_INTERPRETER;
3892 break;
3893 }
3894 LogFlow(("POPF %x -> %RGv mask=%x\n", eflags.u, pCtx->rsp, uMask));
3895 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3896 | (eflags.u & X86_EFL_POPF_BITS & uMask);
3897 /* RF cleared when popped in real mode; see pushf description in AMD manual. */
3898 pCtx->eflags.Bits.u1RF = 0;
3899 pCtx->esp += cbParm;
3900 pCtx->esp &= uMask;
3901
3902 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPopf);
3903 break;
3904 }
3905
3906 case OP_PUSHF:
3907 {
3908 RTGCPTR GCPtrStack;
3909 uint32_t cbParm;
3910 uint32_t uMask;
3911 X86EFLAGS eflags;
3912
3913 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3914 {
3915 cbParm = 4;
3916 uMask = 0xffffffff;
3917 }
3918 else
3919 {
3920 cbParm = 2;
3921 uMask = 0xffff;
3922 }
3923
3924 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), (pCtx->esp - cbParm) & uMask, 0,
3925 &GCPtrStack);
3926 if (RT_FAILURE(rc2))
3927 {
3928 rc = VERR_EM_INTERPRETER;
3929 break;
3930 }
3931 eflags = pCtx->eflags;
3932 /* RF & VM cleared when pushed in real mode; see pushf description in AMD manual. */
3933 eflags.Bits.u1RF = 0;
3934 eflags.Bits.u1VM = 0;
3935
3936 rc2 = PGMPhysWrite(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3937 if (RT_FAILURE(rc2))
3938 {
3939 rc = VERR_EM_INTERPRETER;
3940 break;
3941 }
3942 LogFlow(("PUSHF %x -> %RGv\n", eflags.u, GCPtrStack));
3943 pCtx->esp -= cbParm;
3944 pCtx->esp &= uMask;
3945 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPushf);
3946 break;
3947 }
3948
3949 case OP_IRET:
3950 {
3951 RTGCPTR GCPtrStack;
3952 uint32_t uMask = 0xffff;
3953 uint16_t aIretFrame[3];
3954
3955 if (pDis->fPrefix & (DISPREFIX_OPSIZE | DISPREFIX_ADDRSIZE))
3956 {
3957 rc = VERR_EM_INTERPRETER;
3958 break;
3959 }
3960
3961 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3962 if (RT_FAILURE(rc2))
3963 {
3964 rc = VERR_EM_INTERPRETER;
3965 break;
3966 }
3967 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &aIretFrame[0], sizeof(aIretFrame));
3968 if (RT_FAILURE(rc2))
3969 {
3970 rc = VERR_EM_INTERPRETER;
3971 break;
3972 }
3973 pCtx->ip = aIretFrame[0];
3974 pCtx->cs.Sel = aIretFrame[1];
3975 pCtx->cs.ValidSel = aIretFrame[1];
3976 pCtx->cs.u64Base = (uint32_t)pCtx->cs.Sel << 4;
3977 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3978 | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
3979 pCtx->sp += sizeof(aIretFrame);
3980
3981 LogFlow(("iret to %04x:%x\n", pCtx->cs.Sel, pCtx->ip));
3982 fUpdateRIP = false;
3983 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIret);
3984 break;
3985 }
3986
3987 case OP_INT:
3988 {
3989 uint32_t intInfo2;
3990
3991 LogFlow(("Realmode: INT %x\n", pDis->Param1.uValue & 0xff));
3992 intInfo2 = pDis->Param1.uValue & 0xff;
3993 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3994 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3995
3996 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3997 AssertRC(VBOXSTRICTRC_VAL(rc));
3998 fUpdateRIP = false;
3999 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4000 break;
4001 }
4002
4003 case OP_INTO:
4004 {
4005 if (pCtx->eflags.Bits.u1OF)
4006 {
4007 uint32_t intInfo2;
4008
4009 LogFlow(("Realmode: INTO\n"));
4010 intInfo2 = X86_XCPT_OF;
4011 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4012 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4013
4014 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4015 AssertRC(VBOXSTRICTRC_VAL(rc));
4016 fUpdateRIP = false;
4017 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4018 }
4019 break;
4020 }
4021
4022 case OP_INT3:
4023 {
4024 uint32_t intInfo2;
4025
4026 LogFlow(("Realmode: INT 3\n"));
4027 intInfo2 = 3;
4028 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4029 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4030
4031 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4032 AssertRC(VBOXSTRICTRC_VAL(rc));
4033 fUpdateRIP = false;
4034 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4035 break;
4036 }
4037
4038 default:
4039 rc = EMInterpretInstructionDisasState(pVCpu, pDis, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR);
4040 fUpdateRIP = false;
4041 break;
4042 }
4043
4044 if (rc == VINF_SUCCESS)
4045 {
4046 if (fUpdateRIP)
4047 pCtx->rip += cbOp; /* Move on to the next instruction. */
4048
4049 /*
4050 * LIDT, LGDT can end up here. In the future CRx changes as well. Just reload the
4051 * whole context to be done with it.
4052 */
4053 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
4054
4055 /* Only resume if successful. */
4056 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4057 goto ResumeExecution;
4058 }
4059 }
4060 else
4061 rc = VERR_EM_INTERPRETER;
4062
4063 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT,
4064 ("Unexpected rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4065 break;
4066 }
4067
4068#ifdef VBOX_STRICT
4069 case X86_XCPT_XF: /* SIMD exception. */
4070 case X86_XCPT_DE: /* Divide error. */
4071 case X86_XCPT_UD: /* Unknown opcode exception. */
4072 case X86_XCPT_SS: /* Stack segment exception. */
4073 case X86_XCPT_NP: /* Segment not present exception. */
4074 {
4075 switch (vector)
4076 {
4077 case X86_XCPT_DE: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDE); break;
4078 case X86_XCPT_UD: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestUD); break;
4079 case X86_XCPT_SS: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestSS); break;
4080 case X86_XCPT_NP: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNP); break;
4081 case X86_XCPT_XF: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXF); break;
4082 }
4083
4084 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
4085 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4086 cbInstr, errCode);
4087 AssertRC(rc2);
4088
4089 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4090 goto ResumeExecution;
4091 }
4092#endif
4093 default:
4094 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXcpUnk);
4095 if ( CPUMIsGuestInRealModeEx(pCtx)
4096 && pVM->hm.s.vmx.pRealModeTSS)
4097 {
4098 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs.Sel, pCtx->eip, errCode));
4099 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4100 cbInstr, errCode);
4101 AssertRC(VBOXSTRICTRC_VAL(rc)); /* Strict RC check below. */
4102
4103 /* Go back to ring-3 in case of a triple fault. */
4104 if ( vector == X86_XCPT_DF
4105 && rc == VINF_EM_RESET)
4106 {
4107 break;
4108 }
4109
4110 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4111 goto ResumeExecution;
4112 }
4113 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
4114 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
4115 break;
4116 } /* switch (vector) */
4117
4118 break;
4119
4120 default:
4121 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
4122 AssertMsgFailed(("Unexpected interruption code %x\n", intInfo));
4123 break;
4124 }
4125
4126 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4127 break;
4128 }
4129
4130 /*
4131 * 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed
4132 * by the configuration of the EPT paging structures.
4133 */
4134 case VMX_EXIT_EPT_VIOLATION:
4135 {
4136 RTGCPHYS GCPhys;
4137
4138 Assert(pVM->hm.s.fNestedPaging);
4139
4140 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4141 AssertRC(rc2);
4142 Assert(((exitQualification >> 7) & 3) != 2);
4143
4144 /* Determine the kind of violation. */
4145 errCode = 0;
4146 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
4147 errCode |= X86_TRAP_PF_ID;
4148
4149 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
4150 errCode |= X86_TRAP_PF_RW;
4151
4152 /* If the page is present, then it's a page level protection fault. */
4153 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
4154 errCode |= X86_TRAP_PF_P;
4155 else
4156 {
4157 /* Shortcut for APIC TPR reads and writes. */
4158 if ( (GCPhys & 0xfff) == 0x080
4159 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4160 && fSetupTPRCaching
4161 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4162 {
4163 RTGCPHYS GCPhysApicBase;
4164 GCPhysApicBase = pCtx->msrApicBase;
4165 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4166 if (GCPhys == GCPhysApicBase + 0x80)
4167 {
4168 Log(("Enable VT-x virtual APIC access filtering\n"));
4169 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4170 X86_PTE_RW | X86_PTE_P);
4171 AssertRC(rc2);
4172 }
4173 }
4174 }
4175 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
4176
4177 /* GCPhys contains the guest physical address of the page fault. */
4178 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
4179 TRPMSetErrorCode(pVCpu, errCode);
4180 TRPMSetFaultAddress(pVCpu, GCPhys);
4181
4182 /* Handle the pagefault trap for the nested shadow table. */
4183 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
4184
4185 /*
4186 * Same case as PGMR0Trap0eHandlerNPMisconfig(). See comment below, @bugref{6043}.
4187 */
4188 if ( rc == VINF_SUCCESS
4189 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4190 || rc == VERR_PAGE_NOT_PRESENT)
4191 {
4192 /* We've successfully synced our shadow pages, so let's just continue execution. */
4193 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
4194 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf);
4195
4196 TRPMResetTrap(pVCpu);
4197 goto ResumeExecution;
4198 }
4199
4200#ifdef VBOX_STRICT
4201 if (rc != VINF_EM_RAW_EMULATE_INSTR)
4202 LogFlow(("PGMTrap0eHandlerNestedPaging at %RGv failed with %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4203#endif
4204 /* Need to go back to the recompiler to emulate the instruction. */
4205 TRPMResetTrap(pVCpu);
4206 break;
4207 }
4208
4209 case VMX_EXIT_EPT_MISCONFIG:
4210 {
4211 RTGCPHYS GCPhys;
4212
4213 Assert(pVM->hm.s.fNestedPaging);
4214
4215 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4216 AssertRC(rc2);
4217 Log(("VMX_EXIT_EPT_MISCONFIG for %RGp\n", GCPhys));
4218
4219 /* Shortcut for APIC TPR reads and writes. */
4220 if ( (GCPhys & 0xfff) == 0x080
4221 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4222 && fSetupTPRCaching
4223 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4224 {
4225 RTGCPHYS GCPhysApicBase = pCtx->msrApicBase;
4226 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4227 if (GCPhys == GCPhysApicBase + 0x80)
4228 {
4229 Log(("Enable VT-x virtual APIC access filtering\n"));
4230 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4231 X86_PTE_RW | X86_PTE_P);
4232 AssertRC(rc2);
4233 }
4234 }
4235
4236 rc = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, PGMMODE_EPT, CPUMCTX2CORE(pCtx), GCPhys, UINT32_MAX);
4237
4238 /*
4239 * If we succeed, resume execution.
4240 * Or, if fail in interpreting the instruction because we couldn't get the guest physical address
4241 * of the page containing the instruction via the guest's page tables (we would invalidate the guest page
4242 * in the host TLB), resume execution which would cause a guest page fault to let the guest handle this
4243 * weird case. See @bugref{6043}.
4244 */
4245 if ( rc == VINF_SUCCESS
4246 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4247 || rc == VERR_PAGE_NOT_PRESENT)
4248 {
4249 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> resume\n", GCPhys, (RTGCPTR)pCtx->rip));
4250 goto ResumeExecution;
4251 }
4252
4253 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> %Rrc\n", GCPhys, (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4254 break;
4255 }
4256
4257 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window exiting. */
4258 /* Clear VM-exit on IF=1 change. */
4259 LogFlow(("VMX_EXIT_INT_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip,
4260 VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
4261 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
4262 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4263 AssertRC(rc2);
4264 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIntWindow);
4265 goto ResumeExecution; /* we check for pending guest interrupts there */
4266
4267 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
4268 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
4269 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
4270 /* Skip instruction and continue directly. */
4271 pCtx->rip += cbInstr;
4272 /* Continue execution.*/
4273 goto ResumeExecution;
4274
4275 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4276 {
4277 Log2(("VMX: Cpuid %x\n", pCtx->eax));
4278 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
4279 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4280 if (rc == VINF_SUCCESS)
4281 {
4282 /* Update EIP and continue execution. */
4283 Assert(cbInstr == 2);
4284 pCtx->rip += cbInstr;
4285 goto ResumeExecution;
4286 }
4287 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4288 rc = VINF_EM_RAW_EMULATE_INSTR;
4289 break;
4290 }
4291
4292 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4293 {
4294 Log2(("VMX: Rdpmc %x\n", pCtx->ecx));
4295 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
4296 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4297 if (rc == VINF_SUCCESS)
4298 {
4299 /* Update EIP and continue execution. */
4300 Assert(cbInstr == 2);
4301 pCtx->rip += cbInstr;
4302 goto ResumeExecution;
4303 }
4304 rc = VINF_EM_RAW_EMULATE_INSTR;
4305 break;
4306 }
4307
4308 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4309 {
4310 Log2(("VMX: Rdtsc\n"));
4311 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
4312 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4313 if (rc == VINF_SUCCESS)
4314 {
4315 /* Update EIP and continue execution. */
4316 Assert(cbInstr == 2);
4317 pCtx->rip += cbInstr;
4318 fNeedTscSetup = true; /* See @bugref{6634}. */
4319 goto ResumeExecution;
4320 }
4321 rc = VINF_EM_RAW_EMULATE_INSTR;
4322 break;
4323 }
4324
4325 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4326 {
4327 Log2(("VMX: Rdtscp\n"));
4328 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
4329 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
4330 if (rc == VINF_SUCCESS)
4331 {
4332 /* Update EIP and continue execution. */
4333 Assert(cbInstr == 3);
4334 pCtx->rip += cbInstr;
4335 fNeedTscSetup = true; /* See @bugref{6634}. */
4336 goto ResumeExecution;
4337 }
4338 rc = VINF_EM_RAW_EMULATE_INSTR;
4339 break;
4340 }
4341
4342 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4343 {
4344 Log2(("VMX: invlpg\n"));
4345 Assert(!pVM->hm.s.fNestedPaging);
4346
4347 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
4348 rc = EMInterpretInvlpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), exitQualification);
4349 if (rc == VINF_SUCCESS)
4350 {
4351 /* Update EIP and continue execution. */
4352 pCtx->rip += cbInstr;
4353 goto ResumeExecution;
4354 }
4355 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, VBOXSTRICTRC_VAL(rc)));
4356 break;
4357 }
4358
4359 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4360 {
4361 Log2(("VMX: monitor\n"));
4362
4363 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMonitor);
4364 rc = EMInterpretMonitor(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4365 if (rc == VINF_SUCCESS)
4366 {
4367 /* Update EIP and continue execution. */
4368 pCtx->rip += cbInstr;
4369 goto ResumeExecution;
4370 }
4371 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: monitor failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4372 break;
4373 }
4374
4375 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4376 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
4377 if ( pVM->hm.s.fTPRPatchingActive
4378 && pCtx->ecx == MSR_K8_LSTAR)
4379 {
4380 Assert(!CPUMIsGuestInLongModeEx(pCtx));
4381 if ((pCtx->eax & 0xff) != u8LastTPR)
4382 {
4383 Log(("VMX: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
4384
4385 /* Our patch code uses LSTAR for TPR caching. */
4386 rc2 = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
4387 AssertRC(rc2);
4388 }
4389
4390 /* Skip the instruction and continue. */
4391 pCtx->rip += cbInstr; /* wrmsr = [0F 30] */
4392
4393 /* Only resume if successful. */
4394 goto ResumeExecution;
4395 }
4396 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_MSR;
4397 /* no break */
4398 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4399 {
4400 STAM_COUNTER_INC((exitReason == VMX_EXIT_RDMSR) ? &pVCpu->hm.s.StatExitRdmsr : &pVCpu->hm.s.StatExitWrmsr);
4401
4402 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
4403 rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0);
4404 if (rc == VINF_SUCCESS)
4405 {
4406 /* EIP has been updated already. */
4407 /* Only resume if successful. */
4408 goto ResumeExecution;
4409 }
4410 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n",
4411 (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", VBOXSTRICTRC_VAL(rc)));
4412 break;
4413 }
4414
4415 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4416 {
4417 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub2, y2);
4418
4419 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
4420 {
4421 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
4422 {
4423 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
4424 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4425 rc = EMInterpretCRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4426 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
4427 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
4428 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
4429 {
4430 case 0:
4431 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0 | HM_CHANGED_GUEST_CR3;
4432 break;
4433 case 2:
4434 break;
4435 case 3:
4436 Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
4437 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR3;
4438 break;
4439 case 4:
4440 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR4;
4441 break;
4442 case 8:
4443 /* CR8 contains the APIC TPR */
4444 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1
4445 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4446 break;
4447
4448 default:
4449 AssertFailed();
4450 break;
4451 }
4452 break;
4453 }
4454
4455 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
4456 {
4457 Log2(("VMX: mov x, crx\n"));
4458 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4459
4460 Assert( !pVM->hm.s.fNestedPaging
4461 || !CPUMIsGuestInPagedProtectedModeEx(pCtx)
4462 || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != DISCREG_CR3);
4463
4464 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
4465 Assert( VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8
4466 || !(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4467
4468 rc = EMInterpretCRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4469 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
4470 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
4471 break;
4472 }
4473
4474 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
4475 {
4476 Log2(("VMX: clts\n"));
4477 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClts);
4478 rc = EMInterpretCLTS(pVM, pVCpu);
4479 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4480 break;
4481 }
4482
4483 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
4484 {
4485 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
4486 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitLmsw);
4487 rc = EMInterpretLMSW(pVM, pVCpu, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
4488 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4489 break;
4490 }
4491 }
4492
4493 /* Update EIP if no error occurred. */
4494 if (RT_SUCCESS(rc))
4495 pCtx->rip += cbInstr;
4496
4497 if (rc == VINF_SUCCESS)
4498 {
4499 /* Only resume if successful. */
4500 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
4501 goto ResumeExecution;
4502 }
4503 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
4504 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
4505 break;
4506 }
4507
4508 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4509 {
4510 if ( !DBGFIsStepping(pVCpu)
4511 && !CPUMIsHyperDebugStateActive(pVCpu))
4512 {
4513 /* Disable DRx move intercepts. */
4514 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
4515 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4516 AssertRC(rc2);
4517
4518 /* Save the host and load the guest debug state. */
4519 rc2 = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
4520 AssertRC(rc2);
4521
4522#ifdef LOG_ENABLED
4523 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4524 {
4525 Log(("VMX_EXIT_MOV_DRX: write DR%d genreg %d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4526 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4527 }
4528 else
4529 Log(("VMX_EXIT_MOV_DRX: read DR%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification)));
4530#endif
4531
4532#ifdef VBOX_WITH_STATISTICS
4533 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxContextSwitch);
4534 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4535 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4536 else
4537 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4538#endif
4539
4540 goto ResumeExecution;
4541 }
4542
4543 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first
4544 * time and restore DRx registers afterwards */
4545 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4546 {
4547 Log2(("VMX: mov DRx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4548 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4549 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4550 rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4551 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4552 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
4553 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
4554 Log2(("DR7=%08x\n", pCtx->dr[7]));
4555 }
4556 else
4557 {
4558 Log2(("VMX: mov x, DRx\n"));
4559 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4560 rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4561 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
4562 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
4563 }
4564 /* Update EIP if no error occurred. */
4565 if (RT_SUCCESS(rc))
4566 pCtx->rip += cbInstr;
4567
4568 if (rc == VINF_SUCCESS)
4569 {
4570 /* Only resume if successful. */
4571 goto ResumeExecution;
4572 }
4573 Assert(rc == VERR_EM_INTERPRETER);
4574 break;
4575 }
4576
4577 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
4578 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4579 {
4580 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub1, y1);
4581 uint32_t uPort;
4582 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
4583 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
4584
4585 /** @todo necessary to make the distinction? */
4586 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
4587 uPort = pCtx->edx & 0xffff;
4588 else
4589 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
4590
4591 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4)) /* paranoia */
4592 {
4593 rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
4594 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4595 break;
4596 }
4597
4598 uint32_t cbSize = g_aIOSize[uIOWidth];
4599 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
4600 {
4601 /* ins/outs */
4602 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
4603
4604 /* Disassemble manually to deal with segment prefixes. */
4605 /** @todo VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR contains the flat pointer
4606 * operand of the instruction. */
4607 /** @todo VMX_VMCS32_RO_EXIT_INSTR_INFO also contains segment prefix info. */
4608 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL);
4609 if (RT_SUCCESS(rc))
4610 {
4611 if (fIOWrite)
4612 {
4613 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4614 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringWrite);
4615 rc = IOMInterpretOUTSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4616 (DISCPUMODE)pDis->uAddrMode, cbSize);
4617 }
4618 else
4619 {
4620 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4621 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringRead);
4622 rc = IOMInterpretINSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4623 (DISCPUMODE)pDis->uAddrMode, cbSize);
4624 }
4625 }
4626 else
4627 rc = VINF_EM_RAW_EMULATE_INSTR;
4628 }
4629 else
4630 {
4631 /* Normal in/out */
4632 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
4633
4634 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
4635
4636 if (fIOWrite)
4637 {
4638 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOWrite);
4639 rc = IOMIOPortWrite(pVM, pVCpu, uPort, pCtx->eax & uAndVal, cbSize);
4640 if (rc == VINF_IOM_R3_IOPORT_WRITE)
4641 HMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4642 }
4643 else
4644 {
4645 uint32_t u32Val = 0;
4646
4647 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);
4648 rc = IOMIOPortRead(pVM, pVCpu, uPort, &u32Val, cbSize);
4649 if (IOM_SUCCESS(rc))
4650 {
4651 /* Write back to the EAX register. */
4652 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
4653 }
4654 else
4655 if (rc == VINF_IOM_R3_IOPORT_READ)
4656 HMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4657 }
4658 }
4659
4660 /*
4661 * Handled the I/O return codes.
4662 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
4663 */
4664 if (IOM_SUCCESS(rc))
4665 {
4666 /* Update EIP and continue execution. */
4667 pCtx->rip += cbInstr;
4668 if (RT_LIKELY(rc == VINF_SUCCESS))
4669 {
4670 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
4671 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
4672 {
4673 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxIoCheck);
4674 for (unsigned i = 0; i < 4; i++)
4675 {
4676 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
4677
4678 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
4679 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
4680 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
4681 {
4682 uint64_t uDR6;
4683
4684 Assert(CPUMIsGuestDebugStateActive(pVCpu));
4685
4686 uDR6 = ASMGetDR6();
4687
4688 /* Clear all breakpoint status flags and set the one we just hit. */
4689 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
4690 uDR6 |= (uint64_t)RT_BIT(i);
4691
4692 /*
4693 * Note: AMD64 Architecture Programmer's Manual 13.1:
4694 * Bits 15:13 of the DR6 register is never cleared by the processor and must
4695 * be cleared by software after the contents have been read.
4696 */
4697 ASMSetDR6(uDR6);
4698
4699 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
4700 pCtx->dr[7] &= ~X86_DR7_GD;
4701
4702 /* Paranoia. */
4703 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
4704 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
4705 pCtx->dr[7] |= 0x400; /* must be one */
4706
4707 /* Resync DR7 */
4708 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
4709 AssertRC(rc2);
4710
4711 /* Construct inject info. */
4712 intInfo = X86_XCPT_DB;
4713 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4714 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4715
4716 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
4717 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4718 0 /* cbInstr */, 0 /* errCode */);
4719 AssertRC(rc2);
4720
4721 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4722 goto ResumeExecution;
4723 }
4724 }
4725 }
4726 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4727 goto ResumeExecution;
4728 }
4729 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4730 break;
4731 }
4732
4733#ifdef VBOX_STRICT
4734 if (rc == VINF_IOM_R3_IOPORT_READ)
4735 Assert(!fIOWrite);
4736 else if (rc == VINF_IOM_R3_IOPORT_WRITE)
4737 Assert(fIOWrite);
4738 else
4739 {
4740 AssertMsg( RT_FAILURE(rc)
4741 || rc == VINF_EM_RAW_EMULATE_INSTR
4742 || rc == VINF_EM_RAW_GUEST_TRAP
4743 || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4744 }
4745#endif
4746 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4747 break;
4748 }
4749
4750 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4751 LogFlow(("VMX_EXIT_TPR_BELOW_THRESHOLD\n"));
4752 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
4753 goto ResumeExecution;
4754
4755 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4756 on the APIC-access page. */
4757 {
4758 LogFlow(("VMX_EXIT_APIC_ACCESS\n"));
4759 unsigned uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(exitQualification);
4760
4761 switch (uAccessType)
4762 {
4763 case VMX_APIC_ACCESS_TYPE_LINEAR_READ:
4764 case VMX_APIC_ACCESS_TYPE_LINEAR_WRITE:
4765 {
4766 RTGCPHYS GCPhys = pCtx->msrApicBase;
4767 GCPhys &= PAGE_BASE_GC_MASK;
4768 GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(exitQualification);
4769
4770 LogFlow(("Apic access at %RGp\n", GCPhys));
4771 rc = IOMMMIOPhysHandler(pVM, pVCpu, (uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ) ? 0 : X86_TRAP_PF_RW,
4772 CPUMCTX2CORE(pCtx), GCPhys);
4773 if (rc == VINF_SUCCESS)
4774 goto ResumeExecution; /* rip already updated */
4775 break;
4776 }
4777
4778 default:
4779 rc = VINF_EM_RAW_EMULATE_INSTR;
4780 break;
4781 }
4782 break;
4783 }
4784
4785 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4786 if (!TMTimerPollBool(pVM, pVCpu))
4787 goto ResumeExecution;
4788 rc = VINF_EM_RAW_TIMER_PENDING;
4789 break;
4790
4791 default:
4792 /* The rest is handled after syncing the entire CPU state. */
4793 break;
4794 }
4795
4796
4797 /*
4798 * Note: The guest state is not entirely synced back at this stage!
4799 */
4800
4801 /* Investigate why there was a VM-exit. (part 2) */
4802 switch (exitReason)
4803 {
4804 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
4805 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
4806 case VMX_EXIT_EPT_VIOLATION:
4807 case VMX_EXIT_EPT_MISCONFIG: /* 49 EPT misconfig is used by the PGM/MMIO optimizations. */
4808 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4809 /* Already handled above. */
4810 break;
4811
4812 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
4813 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
4814 break;
4815
4816 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
4817 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
4818 rc = VINF_EM_RAW_INTERRUPT;
4819 AssertFailed(); /* Can't happen. Yet. */
4820 break;
4821
4822 case VMX_EXIT_IO_SMI: /* 5 I/O system-management interrupt (SMI). */
4823 case VMX_EXIT_SMI: /* 6 Other SMI. */
4824 rc = VINF_EM_RAW_INTERRUPT;
4825 AssertFailed(); /* Can't happen afaik. */
4826 break;
4827
4828 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch: too complicated to emulate, so fall back to the recompiler */
4829 Log(("VMX_EXIT_TASK_SWITCH: exit=%RX64\n", exitQualification));
4830 if ( (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(exitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
4831 && pVCpu->hm.s.Event.fPending)
4832 {
4833 /* Caused by an injected interrupt. */
4834 pVCpu->hm.s.Event.fPending = false;
4835
4836 Log(("VMX_EXIT_TASK_SWITCH: reassert trap %d\n", VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo)));
4837 Assert(!VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo));
4838 //@todo: Why do we assume this had to be a hardware interrupt? What about software interrupts or exceptions?
4839 rc2 = TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), TRPM_HARDWARE_INT);
4840 AssertRC(rc2);
4841 }
4842 /* else Exceptions and software interrupts can just be restarted. */
4843 rc = VERR_EM_INTERPRETER;
4844 break;
4845
4846 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
4847 /* Check if external interrupts are pending; if so, don't switch back. */
4848 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
4849 pCtx->rip++; /* skip hlt */
4850 if (EMShouldContinueAfterHalt(pVCpu, pCtx))
4851 goto ResumeExecution;
4852
4853 rc = VINF_EM_HALT;
4854 break;
4855
4856 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
4857 Log2(("VMX: mwait\n"));
4858 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMwait);
4859 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4860 if ( rc == VINF_EM_HALT
4861 || rc == VINF_SUCCESS)
4862 {
4863 /* Update EIP and continue execution. */
4864 pCtx->rip += cbInstr;
4865
4866 /* Check if external interrupts are pending; if so, don't switch back. */
4867 if ( rc == VINF_SUCCESS
4868 || ( rc == VINF_EM_HALT
4869 && EMShouldContinueAfterHalt(pVCpu, pCtx))
4870 )
4871 goto ResumeExecution;
4872 }
4873 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4874 break;
4875
4876 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
4877 AssertFailed(); /* can't happen. */
4878 rc = VERR_EM_INTERPRETER;
4879 break;
4880
4881 case VMX_EXIT_MTF: /* 37 Exit due to Monitor Trap Flag. */
4882 LogFlow(("VMX_EXIT_MTF at %RGv\n", (RTGCPTR)pCtx->rip));
4883 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
4884 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4885 AssertRC(rc2);
4886 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMtf);
4887#if 0
4888 DBGFDoneStepping(pVCpu);
4889#endif
4890 rc = VINF_EM_DBG_STOP;
4891 break;
4892
4893 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
4894 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
4895 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
4896 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
4897 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
4898 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
4899 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
4900 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
4901 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
4902 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
4903 /** @todo inject #UD immediately */
4904 rc = VERR_EM_INTERPRETER;
4905 break;
4906
4907 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4908 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4909 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4910 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4911 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4912 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4913 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4914 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4915 /* already handled above */
4916 AssertMsg( rc == VINF_PGM_CHANGE_MODE
4917 || rc == VINF_EM_RAW_INTERRUPT
4918 || rc == VERR_EM_INTERPRETER
4919 || rc == VINF_EM_RAW_EMULATE_INSTR
4920 || rc == VINF_PGM_SYNC_CR3
4921 || rc == VINF_IOM_R3_IOPORT_READ
4922 || rc == VINF_IOM_R3_IOPORT_WRITE
4923 || rc == VINF_EM_RAW_GUEST_TRAP
4924 || rc == VINF_TRPM_XCPT_DISPATCHED
4925 || rc == VINF_EM_RESCHEDULE_REM,
4926 ("rc = %d\n", VBOXSTRICTRC_VAL(rc)));
4927 break;
4928
4929 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4930 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4931 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4932 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
4933 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4934 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4935 on the APIC-access page. */
4936 {
4937 /*
4938 * If we decided to emulate them here, then we must sync the MSRs that could have been changed (sysenter, FS/GS base)
4939 */
4940 rc = VERR_EM_INTERPRETER;
4941 break;
4942 }
4943
4944 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window. */
4945 Assert(rc == VINF_EM_RAW_INTERRUPT);
4946 break;
4947
4948 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
4949 {
4950#ifdef VBOX_STRICT
4951 RTCCUINTREG val2 = 0;
4952
4953 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
4954
4955 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val2);
4956 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val2));
4957
4958 VMXReadVmcs(VMX_VMCS_GUEST_CR0, &val2);
4959 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", (uint64_t)val2));
4960
4961 VMXReadVmcs(VMX_VMCS_GUEST_CR3, &val2);
4962 Log(("VMX_VMCS_GUEST_CR3 %RX64\n", (uint64_t)val2));
4963
4964 VMXReadVmcs(VMX_VMCS_GUEST_CR4, &val2);
4965 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", (uint64_t)val2));
4966
4967 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val2);
4968 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val2));
4969
4970 VMX_LOG_SELREG(CS, "CS", val2);
4971 VMX_LOG_SELREG(DS, "DS", val2);
4972 VMX_LOG_SELREG(ES, "ES", val2);
4973 VMX_LOG_SELREG(FS, "FS", val2);
4974 VMX_LOG_SELREG(GS, "GS", val2);
4975 VMX_LOG_SELREG(SS, "SS", val2);
4976 VMX_LOG_SELREG(TR, "TR", val2);
4977 VMX_LOG_SELREG(LDTR, "LDTR", val2);
4978
4979 VMXReadVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val2);
4980 Log(("VMX_VMCS_GUEST_GDTR_BASE %RX64\n", (uint64_t)val2));
4981 VMXReadVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val2);
4982 Log(("VMX_VMCS_GUEST_IDTR_BASE %RX64\n", (uint64_t)val2));
4983#endif /* VBOX_STRICT */
4984 rc = VERR_VMX_INVALID_GUEST_STATE;
4985 break;
4986 }
4987
4988 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
4989 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
4990 default:
4991 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
4992 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
4993 break;
4994
4995 }
4996
4997end:
4998 /* We now going back to ring-3, so clear the action flag. */
4999 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
5000
5001 /*
5002 * Signal changes for the recompiler.
5003 */
5004 CPUMSetChangedFlags(pVCpu,
5005 CPUM_CHANGED_SYSENTER_MSR
5006 | CPUM_CHANGED_LDTR
5007 | CPUM_CHANGED_GDTR
5008 | CPUM_CHANGED_IDTR
5009 | CPUM_CHANGED_TR
5010 | CPUM_CHANGED_HIDDEN_SEL_REGS);
5011
5012 /*
5013 * If we executed vmlaunch/vmresume and an external IRQ was pending, then we don't have to do a full sync the next time.
5014 */
5015 if ( exitReason == VMX_EXIT_EXT_INT
5016 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
5017 {
5018 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
5019 /* On the next entry we'll only sync the host context. */
5020 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT;
5021 }
5022 else
5023 {
5024 /* On the next entry we'll sync everything. */
5025 /** @todo we can do better than this */
5026 /* Not in the VINF_PGM_CHANGE_MODE though! */
5027 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
5028 }
5029
5030 /* Translate into a less severe return code */
5031 if (rc == VERR_EM_INTERPRETER)
5032 rc = VINF_EM_RAW_EMULATE_INSTR;
5033 else if (rc == VERR_VMX_INVALID_VMCS_PTR)
5034 {
5035 /* Try to extract more information about what might have gone wrong here. */
5036 VMXGetActivateVMCS(&pVCpu->hm.s.vmx.lasterror.u64VMCSPhys);
5037 pVCpu->hm.s.vmx.lasterror.u32VMCSRevision = *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs;
5038 pVCpu->hm.s.vmx.lasterror.idEnteredCpu = pVCpu->hm.s.idEnteredCpu;
5039 pVCpu->hm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
5040 }
5041
5042 /* Just set the correct state here instead of trying to catch every goto above. */
5043 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
5044
5045#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
5046 /* Restore interrupts if we exited after disabling them. */
5047 if (uOldEFlags != ~(RTCCUINTREG)0)
5048 ASMSetFlags(uOldEFlags);
5049#endif
5050
5051 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5052 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
5053 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5054 Log2(("X"));
5055 return VBOXSTRICTRC_TODO(rc);
5056}
5057
5058
5059/**
5060 * Enters the VT-x session.
5061 *
5062 * @returns VBox status code.
5063 * @param pVM Pointer to the VM.
5064 * @param pVCpu Pointer to the VMCPU.
5065 * @param pCpu Pointer to the CPU info struct.
5066 */
5067VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBLCPUINFO pCpu)
5068{
5069 Assert(pVM->hm.s.vmx.fSupported);
5070 NOREF(pCpu);
5071
5072 unsigned cr4 = ASMGetCR4();
5073 if (!(cr4 & X86_CR4_VMXE))
5074 {
5075 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
5076 return VERR_VMX_X86_CR4_VMXE_CLEARED;
5077 }
5078
5079 /* Activate the VMCS. */
5080 int rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5081 if (RT_FAILURE(rc))
5082 return rc;
5083
5084 pVCpu->hm.s.fResumeVM = false;
5085 return VINF_SUCCESS;
5086}
5087
5088
5089/**
5090 * Leaves the VT-x session.
5091 *
5092 * @returns VBox status code.
5093 * @param pVM Pointer to the VM.
5094 * @param pVCpu Pointer to the VMCPU.
5095 * @param pCtx Pointer to the guests CPU context.
5096 */
5097VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5098{
5099 Assert(pVM->hm.s.vmx.fSupported);
5100
5101#ifdef DEBUG
5102 if (CPUMIsHyperDebugStateActive(pVCpu))
5103 {
5104 CPUMR0LoadHostDebugState(pVM, pVCpu);
5105 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5106 }
5107 else
5108#endif
5109
5110 /*
5111 * Save the guest debug state if necessary.
5112 */
5113 if (CPUMIsGuestDebugStateActive(pVCpu))
5114 {
5115 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
5116
5117 /* Enable DRx move intercepts again. */
5118 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
5119 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
5120 AssertRC(rc);
5121
5122 /* Resync the debug registers the next time. */
5123 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
5124 }
5125 else
5126 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5127
5128 /*
5129 * Clear VMCS, marking it inactive, clearing implementation-specific data and writing
5130 * VMCS data back to memory.
5131 */
5132 int rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5133 AssertRC(rc);
5134
5135 return VINF_SUCCESS;
5136}
5137
5138
5139/**
5140 * Flush the TLB using EPT.
5141 *
5142 * @returns VBox status code.
5143 * @param pVM Pointer to the VM.
5144 * @param pVCpu Pointer to the VMCPU.
5145 * @param enmFlush Type of flush.
5146 */
5147static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush)
5148{
5149 uint64_t descriptor[2];
5150
5151 LogFlow(("hmR0VmxFlushEPT %d\n", enmFlush));
5152 Assert(pVM->hm.s.fNestedPaging);
5153 descriptor[0] = pVCpu->hm.s.vmx.GCPhysEPTP;
5154 descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
5155 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
5156 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.GCPhysEPTP, rc));
5157#ifdef VBOX_WITH_STATISTICS
5158 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
5159#endif
5160}
5161
5162
5163/**
5164 * Flush the TLB using VPID.
5165 *
5166 * @returns VBox status code.
5167 * @param pVM Pointer to the VM.
5168 * @param pVCpu Pointer to the VMCPU (can be NULL depending on @a
5169 * enmFlush).
5170 * @param enmFlush Type of flush.
5171 * @param GCPtr Virtual address of the page to flush (can be 0 depending
5172 * on @a enmFlush).
5173 */
5174static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr)
5175{
5176 uint64_t descriptor[2];
5177
5178 Assert(pVM->hm.s.vmx.fVpid);
5179 if (enmFlush == VMX_FLUSH_VPID_ALL_CONTEXTS)
5180 {
5181 descriptor[0] = 0;
5182 descriptor[1] = 0;
5183 }
5184 else
5185 {
5186 AssertPtr(pVCpu);
5187 AssertMsg(pVCpu->hm.s.uCurrentAsid != 0, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5188 AssertMsg(pVCpu->hm.s.uCurrentAsid <= UINT16_MAX, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5189 descriptor[0] = pVCpu->hm.s.uCurrentAsid;
5190 descriptor[1] = GCPtr;
5191 }
5192 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]); NOREF(rc);
5193 AssertMsg(rc == VINF_SUCCESS,
5194 ("VMXR0InvVPID %x %x %RGv failed with %d\n", enmFlush, pVCpu ? pVCpu->hm.s.uCurrentAsid : 0, GCPtr, rc));
5195#ifdef VBOX_WITH_STATISTICS
5196 if (pVCpu)
5197 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushAsid);
5198#endif
5199}
5200
5201
5202/**
5203 * Invalidates a guest page by guest virtual address. Only relevant for
5204 * EPT/VPID, otherwise there is nothing really to invalidate.
5205 *
5206 * @returns VBox status code.
5207 * @param pVM Pointer to the VM.
5208 * @param pVCpu Pointer to the VMCPU.
5209 * @param GCVirt Guest virtual address of the page to invalidate.
5210 */
5211VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
5212{
5213 bool fFlushPending = VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
5214
5215 Log2(("VMXR0InvalidatePage %RGv\n", GCVirt));
5216
5217 if (!fFlushPending)
5218 {
5219 /*
5220 * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
5221 * See @bugref{6043} and @bugref{6177}
5222 *
5223 * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VMENTRY in hmR0VmxSetupTLB*() as this
5224 * function maybe called in a loop with individual addresses.
5225 */
5226 if (pVM->hm.s.vmx.fVpid)
5227 {
5228 /* If we can flush just this page do it, otherwise flush as little as possible. */
5229 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
5230 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, GCVirt);
5231 else
5232 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5233 }
5234 else if (pVM->hm.s.fNestedPaging)
5235 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5236 }
5237
5238 return VINF_SUCCESS;
5239}
5240
5241
5242/**
5243 * Invalidates a guest page by physical address. Only relevant for EPT/VPID,
5244 * otherwise there is nothing really to invalidate.
5245 *
5246 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
5247 *
5248 * @returns VBox status code.
5249 * @param pVM Pointer to the VM.
5250 * @param pVCpu Pointer to the VMCPU.
5251 * @param GCPhys Guest physical address of the page to invalidate.
5252 */
5253VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
5254{
5255 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
5256
5257 /*
5258 * We cannot flush a page by guest-physical address. invvpid takes only a linear address
5259 * while invept only flushes by EPT not individual addresses. We update the force flag here
5260 * and flush before VMENTRY in hmR0VmxSetupTLB*(). This function might be called in a loop.
5261 */
5262 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5263 return VINF_SUCCESS;
5264}
5265
5266
5267/**
5268 * Report world switch error and dump some useful debug info.
5269 *
5270 * @param pVM Pointer to the VM.
5271 * @param pVCpu Pointer to the VMCPU.
5272 * @param rc Return code.
5273 * @param pCtx Pointer to the current guest CPU context (not updated).
5274 */
5275static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx)
5276{
5277 NOREF(pVM);
5278
5279 switch (VBOXSTRICTRC_VAL(rc))
5280 {
5281 case VERR_VMX_INVALID_VMXON_PTR:
5282 AssertFailed();
5283 break;
5284
5285 case VERR_VMX_UNABLE_TO_START_VM:
5286 case VERR_VMX_UNABLE_TO_RESUME_VM:
5287 {
5288 int rc2;
5289 RTCCUINTREG exitReason, instrError;
5290
5291 rc2 = VMXReadVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
5292 rc2 |= VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
5293 AssertRC(rc2);
5294 if (rc2 == VINF_SUCCESS)
5295 {
5296 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason,
5297 (uint32_t)instrError));
5298 Log(("Current stack %08x\n", &rc2));
5299
5300 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
5301 pVCpu->hm.s.vmx.lasterror.u32ExitReason = exitReason;
5302
5303#ifdef VBOX_STRICT
5304 RTGDTR gdtr;
5305 PCX86DESCHC pDesc;
5306 RTCCUINTREG val;
5307
5308 ASMGetGDTR(&gdtr);
5309
5310 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val);
5311 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
5312 VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val);
5313 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
5314 VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val);
5315 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
5316 VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val);
5317 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
5318 VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val);
5319 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
5320
5321 VMXReadVmcs(VMX_VMCS_HOST_CR0, &val);
5322 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
5323 VMXReadVmcs(VMX_VMCS_HOST_CR3, &val);
5324 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
5325 VMXReadVmcs(VMX_VMCS_HOST_CR4, &val);
5326 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
5327
5328 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_CS, &val);
5329 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
5330 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
5331 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
5332
5333 if (val < gdtr.cbGdt)
5334 {
5335 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5336 HMR0DumpDescriptor(pDesc, val, "CS: ");
5337 }
5338
5339 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_DS, &val);
5340 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
5341 if (val < gdtr.cbGdt)
5342 {
5343 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5344 HMR0DumpDescriptor(pDesc, val, "DS: ");
5345 }
5346
5347 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_ES, &val);
5348 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
5349 if (val < gdtr.cbGdt)
5350 {
5351 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5352 HMR0DumpDescriptor(pDesc, val, "ES: ");
5353 }
5354
5355 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_FS, &val);
5356 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
5357 if (val < gdtr.cbGdt)
5358 {
5359 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5360 HMR0DumpDescriptor(pDesc, val, "FS: ");
5361 }
5362
5363 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_GS, &val);
5364 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
5365 if (val < gdtr.cbGdt)
5366 {
5367 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5368 HMR0DumpDescriptor(pDesc, val, "GS: ");
5369 }
5370
5371 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_SS, &val);
5372 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
5373 if (val < gdtr.cbGdt)
5374 {
5375 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5376 HMR0DumpDescriptor(pDesc, val, "SS: ");
5377 }
5378
5379 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_TR, &val);
5380 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
5381 if (val < gdtr.cbGdt)
5382 {
5383 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5384 HMR0DumpDescriptor(pDesc, val, "TR: ");
5385 }
5386
5387 VMXReadVmcs(VMX_VMCS_HOST_TR_BASE, &val);
5388 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
5389 VMXReadVmcs(VMX_VMCS_HOST_GDTR_BASE, &val);
5390 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
5391 VMXReadVmcs(VMX_VMCS_HOST_IDTR_BASE, &val);
5392 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
5393 VMXReadVmcs(VMX_VMCS32_HOST_SYSENTER_CS, &val);
5394 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
5395 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_EIP, &val);
5396 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
5397 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_ESP, &val);
5398 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
5399 VMXReadVmcs(VMX_VMCS_HOST_RSP, &val);
5400 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
5401 VMXReadVmcs(VMX_VMCS_HOST_RIP, &val);
5402 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
5403# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5404 if (VMX_IS_64BIT_HOST_MODE())
5405 {
5406 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
5407 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
5408 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
5409 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
5410 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
5411 Log(("MSR_K8_KERNEL_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_KERNEL_GS_BASE)));
5412 }
5413# endif
5414#endif /* VBOX_STRICT */
5415 }
5416 break;
5417 }
5418
5419 default:
5420 /* impossible */
5421 AssertMsgFailed(("%Rrc (%#x)\n", VBOXSTRICTRC_VAL(rc), VBOXSTRICTRC_VAL(rc)));
5422 break;
5423 }
5424}
5425
5426
5427#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5428/**
5429 * Prepares for and executes VMLAUNCH (64 bits guest mode).
5430 *
5431 * @returns VBox status code.
5432 * @param fResume Whether to vmlauch/vmresume.
5433 * @param pCtx Pointer to the guest CPU context.
5434 * @param pCache Pointer to the VMCS cache.
5435 * @param pVM Pointer to the VM.
5436 * @param pVCpu Pointer to the VMCPU.
5437 */
5438DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu)
5439{
5440 uint32_t aParam[6];
5441 PHMGLOBLCPUINFO pCpu;
5442 RTHCPHYS HCPhysCpuPage;
5443 int rc;
5444
5445 pCpu = HMR0GetCurrentCpu();
5446 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5447
5448#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5449 pCache->uPos = 1;
5450 pCache->interPD = PGMGetInterPaeCR3(pVM);
5451 pCache->pSwitcher = (uint64_t)pVM->hm.s.pfnHost32ToGuest64R0;
5452#endif
5453
5454#ifdef DEBUG
5455 pCache->TestIn.HCPhysCpuPage= 0;
5456 pCache->TestIn.HCPhysVmcs = 0;
5457 pCache->TestIn.pCache = 0;
5458 pCache->TestOut.HCPhysVmcs = 0;
5459 pCache->TestOut.pCache = 0;
5460 pCache->TestOut.pCtx = 0;
5461 pCache->TestOut.eflags = 0;
5462#endif
5463
5464 aParam[0] = (uint32_t)(HCPhysCpuPage); /* Param 1: VMXON physical address - Lo. */
5465 aParam[1] = (uint32_t)(HCPhysCpuPage >> 32); /* Param 1: VMXON physical address - Hi. */
5466 aParam[2] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs); /* Param 2: VMCS physical address - Lo. */
5467 aParam[3] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs >> 32); /* Param 2: VMCS physical address - Hi. */
5468 aParam[4] = VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache);
5469 aParam[5] = 0;
5470
5471#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5472 pCtx->dr[4] = pVM->hm.s.vmx.pScratchPhys + 16 + 8;
5473 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 1;
5474#endif
5475 rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hm.s.pfnVMXGCStartVM64, 6, &aParam[0]);
5476
5477#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5478 Assert(*(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) == 5);
5479 Assert(pCtx->dr[4] == 10);
5480 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 0xff;
5481#endif
5482
5483#ifdef DEBUG
5484 AssertMsg(pCache->TestIn.HCPhysCpuPage== HCPhysCpuPage, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysCpuPage, HCPhysCpuPage));
5485 AssertMsg(pCache->TestIn.HCPhysVmcs == pVCpu->hm.s.vmx.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5486 pVCpu->hm.s.vmx.HCPhysVmcs));
5487 AssertMsg(pCache->TestIn.HCPhysVmcs == pCache->TestOut.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5488 pCache->TestOut.HCPhysVmcs));
5489 AssertMsg(pCache->TestIn.pCache == pCache->TestOut.pCache, ("%RGv vs %RGv\n", pCache->TestIn.pCache,
5490 pCache->TestOut.pCache));
5491 AssertMsg(pCache->TestIn.pCache == VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache),
5492 ("%RGv vs %RGv\n", pCache->TestIn.pCache, VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache)));
5493 AssertMsg(pCache->TestIn.pCtx == pCache->TestOut.pCtx, ("%RGv vs %RGv\n", pCache->TestIn.pCtx,
5494 pCache->TestOut.pCtx));
5495 Assert(!(pCache->TestOut.eflags & X86_EFL_IF));
5496#endif
5497 return rc;
5498}
5499
5500
5501# ifdef VBOX_STRICT
5502static bool hmR0VmxIsValidReadField(uint32_t idxField)
5503{
5504 switch (idxField)
5505 {
5506 case VMX_VMCS_GUEST_RIP:
5507 case VMX_VMCS_GUEST_RSP:
5508 case VMX_VMCS_GUEST_RFLAGS:
5509 case VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE:
5510 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
5511 case VMX_VMCS_GUEST_CR0:
5512 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
5513 case VMX_VMCS_GUEST_CR4:
5514 case VMX_VMCS_GUEST_DR7:
5515 case VMX_VMCS32_GUEST_SYSENTER_CS:
5516 case VMX_VMCS_GUEST_SYSENTER_EIP:
5517 case VMX_VMCS_GUEST_SYSENTER_ESP:
5518 case VMX_VMCS32_GUEST_GDTR_LIMIT:
5519 case VMX_VMCS_GUEST_GDTR_BASE:
5520 case VMX_VMCS32_GUEST_IDTR_LIMIT:
5521 case VMX_VMCS_GUEST_IDTR_BASE:
5522 case VMX_VMCS16_GUEST_FIELD_CS:
5523 case VMX_VMCS32_GUEST_CS_LIMIT:
5524 case VMX_VMCS_GUEST_CS_BASE:
5525 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
5526 case VMX_VMCS16_GUEST_FIELD_DS:
5527 case VMX_VMCS32_GUEST_DS_LIMIT:
5528 case VMX_VMCS_GUEST_DS_BASE:
5529 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
5530 case VMX_VMCS16_GUEST_FIELD_ES:
5531 case VMX_VMCS32_GUEST_ES_LIMIT:
5532 case VMX_VMCS_GUEST_ES_BASE:
5533 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
5534 case VMX_VMCS16_GUEST_FIELD_FS:
5535 case VMX_VMCS32_GUEST_FS_LIMIT:
5536 case VMX_VMCS_GUEST_FS_BASE:
5537 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
5538 case VMX_VMCS16_GUEST_FIELD_GS:
5539 case VMX_VMCS32_GUEST_GS_LIMIT:
5540 case VMX_VMCS_GUEST_GS_BASE:
5541 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
5542 case VMX_VMCS16_GUEST_FIELD_SS:
5543 case VMX_VMCS32_GUEST_SS_LIMIT:
5544 case VMX_VMCS_GUEST_SS_BASE:
5545 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
5546 case VMX_VMCS16_GUEST_FIELD_LDTR:
5547 case VMX_VMCS32_GUEST_LDTR_LIMIT:
5548 case VMX_VMCS_GUEST_LDTR_BASE:
5549 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
5550 case VMX_VMCS16_GUEST_FIELD_TR:
5551 case VMX_VMCS32_GUEST_TR_LIMIT:
5552 case VMX_VMCS_GUEST_TR_BASE:
5553 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
5554 case VMX_VMCS32_RO_EXIT_REASON:
5555 case VMX_VMCS32_RO_VM_INSTR_ERROR:
5556 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
5557 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
5558 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
5559 case VMX_VMCS32_RO_EXIT_INSTR_INFO:
5560 case VMX_VMCS_RO_EXIT_QUALIFICATION:
5561 case VMX_VMCS32_RO_IDT_INFO:
5562 case VMX_VMCS32_RO_IDT_ERROR_CODE:
5563 case VMX_VMCS_GUEST_CR3:
5564 case VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL:
5565 return true;
5566 }
5567 return false;
5568}
5569
5570
5571static bool hmR0VmxIsValidWriteField(uint32_t idxField)
5572{
5573 switch (idxField)
5574 {
5575 case VMX_VMCS_GUEST_LDTR_BASE:
5576 case VMX_VMCS_GUEST_TR_BASE:
5577 case VMX_VMCS_GUEST_GDTR_BASE:
5578 case VMX_VMCS_GUEST_IDTR_BASE:
5579 case VMX_VMCS_GUEST_SYSENTER_EIP:
5580 case VMX_VMCS_GUEST_SYSENTER_ESP:
5581 case VMX_VMCS_GUEST_CR0:
5582 case VMX_VMCS_GUEST_CR4:
5583 case VMX_VMCS_GUEST_CR3:
5584 case VMX_VMCS_GUEST_DR7:
5585 case VMX_VMCS_GUEST_RIP:
5586 case VMX_VMCS_GUEST_RSP:
5587 case VMX_VMCS_GUEST_CS_BASE:
5588 case VMX_VMCS_GUEST_DS_BASE:
5589 case VMX_VMCS_GUEST_ES_BASE:
5590 case VMX_VMCS_GUEST_FS_BASE:
5591 case VMX_VMCS_GUEST_GS_BASE:
5592 case VMX_VMCS_GUEST_SS_BASE:
5593 return true;
5594 }
5595 return false;
5596}
5597# endif /* VBOX_STRICT */
5598
5599
5600/**
5601 * Executes the specified handler in 64-bit mode.
5602 *
5603 * @returns VBox status code.
5604 * @param pVM Pointer to the VM.
5605 * @param pVCpu Pointer to the VMCPU.
5606 * @param pCtx Pointer to the guest CPU context.
5607 * @param pfnHandler Pointer to the RC handler function.
5608 * @param cbParam Number of parameters.
5609 * @param paParam Array of 32-bit parameters.
5610 */
5611VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam,
5612 uint32_t *paParam)
5613{
5614 int rc, rc2;
5615 PHMGLOBLCPUINFO pCpu;
5616 RTHCPHYS HCPhysCpuPage;
5617 RTHCUINTREG uOldEFlags;
5618
5619 AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
5620 Assert(pfnHandler);
5621 Assert(pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Write.aField));
5622 Assert(pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Read.aField));
5623
5624#ifdef VBOX_STRICT
5625 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries;i++)
5626 Assert(hmR0VmxIsValidWriteField(pVCpu->hm.s.vmx.VMCSCache.Write.aField[i]));
5627
5628 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries;i++)
5629 Assert(hmR0VmxIsValidReadField(pVCpu->hm.s.vmx.VMCSCache.Read.aField[i]));
5630#endif
5631
5632 /* Disable interrupts. */
5633 uOldEFlags = ASMIntDisableFlags();
5634
5635#ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
5636 RTCPUID idHostCpu = RTMpCpuId();
5637 CPUMR0SetLApic(pVM, idHostCpu);
5638#endif
5639
5640 pCpu = HMR0GetCurrentCpu();
5641 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5642
5643 /* Clear VMCS. Marking it inactive, clearing implementation-specific data and writing VMCS data back to memory. */
5644 VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5645
5646 /* Leave VMX Root Mode. */
5647 VMXDisable();
5648
5649 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5650
5651 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
5652 CPUMSetHyperEIP(pVCpu, pfnHandler);
5653 for (int i=(int)cbParam-1;i>=0;i--)
5654 CPUMPushHyper(pVCpu, paParam[i]);
5655
5656 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
5657
5658 /* Call switcher. */
5659 rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
5660 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
5661
5662 /* Make sure the VMX instructions don't cause #UD faults. */
5663 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
5664
5665 /* Enter VMX Root Mode */
5666 rc2 = VMXEnable(HCPhysCpuPage);
5667 if (RT_FAILURE(rc2))
5668 {
5669 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5670 ASMSetFlags(uOldEFlags);
5671 return VERR_VMX_VMXON_FAILED;
5672 }
5673
5674 rc2 = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5675 AssertRC(rc2);
5676 Assert(!(ASMGetFlags() & X86_EFL_IF));
5677 ASMSetFlags(uOldEFlags);
5678 return rc;
5679}
5680#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL) */
5681
5682
5683#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5684/**
5685 * Executes VMWRITE.
5686 *
5687 * @returns VBox status code
5688 * @param pVCpu Pointer to the VMCPU.
5689 * @param idxField VMCS field index.
5690 * @param u64Val 16, 32 or 64 bits value.
5691 */
5692VMMR0DECL(int) VMXWriteVmcs64Ex(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5693{
5694 int rc;
5695 switch (idxField)
5696 {
5697 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
5698 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
5699 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
5700 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
5701 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
5702 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
5703 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
5704 case VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL:
5705 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
5706 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
5707 case VMX_VMCS64_GUEST_PDPTE0_FULL:
5708 case VMX_VMCS64_GUEST_PDPTE1_FULL:
5709 case VMX_VMCS64_GUEST_PDPTE2_FULL:
5710 case VMX_VMCS64_GUEST_PDPTE3_FULL:
5711 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
5712 case VMX_VMCS64_GUEST_EFER_FULL:
5713 case VMX_VMCS64_CTRL_EPTP_FULL:
5714 /* These fields consist of two parts, which are both writable in 32 bits mode. */
5715 rc = VMXWriteVmcs32(idxField, u64Val);
5716 rc |= VMXWriteVmcs32(idxField + 1, (uint32_t)(u64Val >> 32ULL));
5717 AssertRC(rc);
5718 return rc;
5719
5720 case VMX_VMCS_GUEST_LDTR_BASE:
5721 case VMX_VMCS_GUEST_TR_BASE:
5722 case VMX_VMCS_GUEST_GDTR_BASE:
5723 case VMX_VMCS_GUEST_IDTR_BASE:
5724 case VMX_VMCS_GUEST_SYSENTER_EIP:
5725 case VMX_VMCS_GUEST_SYSENTER_ESP:
5726 case VMX_VMCS_GUEST_CR0:
5727 case VMX_VMCS_GUEST_CR4:
5728 case VMX_VMCS_GUEST_CR3:
5729 case VMX_VMCS_GUEST_DR7:
5730 case VMX_VMCS_GUEST_RIP:
5731 case VMX_VMCS_GUEST_RSP:
5732 case VMX_VMCS_GUEST_CS_BASE:
5733 case VMX_VMCS_GUEST_DS_BASE:
5734 case VMX_VMCS_GUEST_ES_BASE:
5735 case VMX_VMCS_GUEST_FS_BASE:
5736 case VMX_VMCS_GUEST_GS_BASE:
5737 case VMX_VMCS_GUEST_SS_BASE:
5738 /* Queue a 64 bits value as we can't set it in 32 bits host mode. */
5739 if (u64Val >> 32ULL)
5740 rc = VMXWriteCachedVmcsEx(pVCpu, idxField, u64Val);
5741 else
5742 rc = VMXWriteVmcs32(idxField, (uint32_t)u64Val);
5743
5744 return rc;
5745
5746 default:
5747 AssertMsgFailed(("Unexpected field %x\n", idxField));
5748 return VERR_INVALID_PARAMETER;
5749 }
5750}
5751
5752
5753/**
5754 * Cache VMCS writes for running 64 bits guests on 32 bits hosts.
5755 *
5756 * @param pVCpu Pointer to the VMCPU.
5757 * @param idxField VMCS field index.
5758 * @param u64Val 16, 32 or 64 bits value.
5759 */
5760VMMR0DECL(int) VMXWriteCachedVmcsEx(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5761{
5762 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
5763
5764 AssertMsgReturn(pCache->Write.cValidEntries < VMCSCACHE_MAX_ENTRY - 1,
5765 ("entries=%x\n", pCache->Write.cValidEntries), VERR_ACCESS_DENIED);
5766
5767 /* Make sure there are no duplicates. */
5768 for (unsigned i = 0; i < pCache->Write.cValidEntries; i++)
5769 {
5770 if (pCache->Write.aField[i] == idxField)
5771 {
5772 pCache->Write.aFieldVal[i] = u64Val;
5773 return VINF_SUCCESS;
5774 }
5775 }
5776
5777 pCache->Write.aField[pCache->Write.cValidEntries] = idxField;
5778 pCache->Write.aFieldVal[pCache->Write.cValidEntries] = u64Val;
5779 pCache->Write.cValidEntries++;
5780 return VINF_SUCCESS;
5781}
5782
5783#endif /* HC_ARCH_BITS == 32 && !VBOX_WITH_HYBRID_32BIT_KERNEL */
5784
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette