VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 45387

Last change on this file since 45387 was 45387, checked in by vboxsync, 12 years ago

VMM/VMMR0: HM bits.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 228.6 KB
Line 
1/* $Id: HWVMXR0.cpp 45387 2013-04-05 21:37:40Z vboxsync $ */
2/** @file
3 * HM VMX (VT-x) - Host Context Ring-0.
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_HM
23#include <iprt/asm-amd64-x86.h>
24#include <VBox/vmm/hm.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/dbgf.h>
27#include <VBox/vmm/dbgftrace.h>
28#include <VBox/vmm/selm.h>
29#include <VBox/vmm/iom.h>
30#ifdef VBOX_WITH_REM
31# include <VBox/vmm/rem.h>
32#endif
33#include <VBox/vmm/tm.h>
34#include "HMInternal.h"
35#include <VBox/vmm/vm.h>
36#include <VBox/vmm/pdmapi.h>
37#include <VBox/err.h>
38#include <VBox/log.h>
39#include <iprt/assert.h>
40#include <iprt/param.h>
41#include <iprt/string.h>
42#include <iprt/time.h>
43#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
44# include <iprt/thread.h>
45#endif
46#include <iprt/x86.h>
47#include "HWVMXR0.h"
48
49#include "dtrace/VBoxVMM.h"
50
51
52/*******************************************************************************
53* Defined Constants And Macros *
54*******************************************************************************/
55#if defined(RT_ARCH_AMD64)
56# define VMX_IS_64BIT_HOST_MODE() (true)
57#elif defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
58# define VMX_IS_64BIT_HOST_MODE() (g_fVMXIs64bitHost != 0)
59#else
60# define VMX_IS_64BIT_HOST_MODE() (false)
61#endif
62
63# define VMX_WRITE_SELREG(REG, reg) \
64 do \
65 { \
66 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_##REG, pCtx->reg.Sel); \
67 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, pCtx->reg.u32Limit); \
68 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_##REG##_BASE, pCtx->reg.u64Base); \
69 if ((pCtx->eflags.u32 & X86_EFL_VM)) \
70 { \
71 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
72 /* DPL=3, present, code/data, r/w/accessed. */ \
73 /** @todo we shouldn't have to do this, if it is not 0xf3 it means we screwed up elsewhere (recompiler). */ \
74 /** @todo VT-x docs explicitly mentions 0xF3. Why not just val = 0xf3 ??. */ \
75 val = (pCtx->reg.Attr.u & ~0xFF) | 0xF3; \
76 } \
77 else \
78 if ( CPUMIsGuestInRealModeEx(pCtx) \
79 && !pVM->hm.s.vmx.fUnrestrictedGuest) \
80 { \
81 /** @todo shouldn't the 'if' condition above check for 'pRealModeTSS' ? */ \
82 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
83 /* DPL=3, present, code/data, r/w/accessed. */ \
84 val = 0xf3; \
85 } \
86 else \
87 if ( ( pCtx->reg.Sel \
88 || !CPUMIsGuestInPagedProtectedModeEx(pCtx) \
89 || (!pCtx->cs.Attr.n.u1DefBig && !CPUMIsGuestIn64BitCodeEx(pCtx)) \
90 ) \
91 && pCtx->reg.Attr.n.u1Present == 1) \
92 { \
93 val = pCtx->reg.Attr.u | X86_SEL_TYPE_ACCESSED; \
94 } \
95 else \
96 val = 0x10000; /* Invalid guest state error otherwise. (BIT(16) = Unusable) */ \
97 \
98 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, val); \
99 } while (0)
100
101# define VMX_READ_SELREG(REG, reg) \
102 do \
103 { \
104 VMXReadCachedVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &val); \
105 pCtx->reg.Sel = val; \
106 pCtx->reg.ValidSel = val; \
107 pCtx->reg.fFlags = CPUMSELREG_FLAGS_VALID; \
108 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &val); \
109 pCtx->reg.u32Limit = val; \
110 VMXReadCachedVmcs(VMX_VMCS_GUEST_##REG##_BASE, &val); \
111 pCtx->reg.u64Base = val; \
112 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &val); \
113 pCtx->reg.Attr.u = val; \
114 } while (0)
115
116/* Don't read from the cache in this macro; used only in case of failure where the cache is out of sync. */
117# define VMX_LOG_SELREG(REG, szSelReg, val) \
118 do \
119 { \
120 VMXReadVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &(val)); \
121 Log(("%s Selector %x\n", szSelReg, (val))); \
122 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &(val)); \
123 Log(("%s Limit %x\n", szSelReg, (val))); \
124 VMXReadVmcs(VMX_VMCS_GUEST_##REG##_BASE, &(val)); \
125 Log(("%s Base %RX64\n", szSelReg, (uint64_t)(val))); \
126 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &(val)); \
127 Log(("%s Attributes %x\n", szSelReg, (val))); \
128 } while (0)
129
130#define VMXSetupCachedReadVmcs(pCache, idxField) \
131{ \
132 Assert(pCache->Read.aField[idxField##_CACHE_IDX] == 0); \
133 pCache->Read.aField[idxField##_CACHE_IDX] = idxField; \
134 pCache->Read.aFieldVal[idxField##_CACHE_IDX] = 0; \
135}
136#define VMX_SETUP_SELREG(REG, pCache) \
137{ \
138 VMXSetupCachedReadVmcs(pCache, VMX_VMCS16_GUEST_FIELD_##REG); \
139 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_LIMIT); \
140 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_##REG##_BASE); \
141 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS); \
142}
143
144
145/*******************************************************************************
146* Global Variables *
147*******************************************************************************/
148/* IO operation lookup arrays. */
149static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
150static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
151
152#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
153/** See HMR0A.asm. */
154extern "C" uint32_t g_fVMXIs64bitHost;
155#endif
156
157
158/*******************************************************************************
159* Local Functions *
160*******************************************************************************/
161static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu);
162static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu);
163static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu);
164static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu);
165static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush);
166static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr);
167static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
168static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
169static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx);
170
171
172/**
173 * Updates error from VMCS to HMCPU's lasterror record.
174 *
175 * @param pVM Pointer to the VM.
176 * @param pVCpu Pointer to the VMCPU.
177 * @param rc The error code.
178 */
179static void hmR0VmxCheckError(PVM pVM, PVMCPU pVCpu, int rc)
180{
181 if (rc == VERR_VMX_GENERIC)
182 {
183 RTCCUINTREG instrError;
184
185 VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
186 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
187 }
188 pVM->hm.s.lLastError = rc;
189}
190
191
192/**
193 * Sets up and activates VT-x on the current CPU.
194 *
195 * @returns VBox status code.
196 * @param pCpu Pointer to the CPU info struct.
197 * @param pVM Pointer to the VM. (can be NULL after a resume!!)
198 * @param pvCpuPage Pointer to the global CPU page.
199 * @param HCPhysCpuPage Physical address of the global CPU page.
200 * @param fEnabledByHost Set if SUPR0EnableVTx or similar was used to enable
201 * VT-x/AMD-V on the host.
202 */
203VMMR0DECL(int) VMXR0EnableCpu(PHMGLOBLCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage, bool fEnabledByHost)
204{
205 if (!fEnabledByHost)
206 {
207 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
208 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
209
210 if (pVM)
211 {
212 /* Set revision dword at the beginning of the VMXON structure. */
213 *(uint32_t *)pvCpuPage = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
214 }
215
216 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
217 * (which can have very bad consequences!!!)
218 */
219
220 /** @todo r=bird: Why is this code different than the probing code earlier
221 * on? It just sets VMXE if needed and doesn't check that it isn't
222 * set. Mac OS X host_vmxoff may leave this set and we'll fail here
223 * and debug-assert in the calling code. This is what caused the
224 * "regression" after backing out the SUPR0EnableVTx code hours before
225 * 4.2.0GA (reboot fixed the issue). I've changed here to do the same
226 * as the init code. */
227 uint64_t uCr4 = ASMGetCR4();
228 if (!(uCr4 & X86_CR4_VMXE))
229 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE); /* Make sure the VMX instructions don't cause #UD faults. */
230
231 /*
232 * Enter VM root mode.
233 */
234 int rc = VMXEnable(HCPhysCpuPage);
235 if (RT_FAILURE(rc))
236 {
237 ASMSetCR4(uCr4);
238 return VERR_VMX_VMXON_FAILED;
239 }
240 }
241
242 /*
243 * Flush all VPIDs (in case we or any other hypervisor have been using VPIDs) so that
244 * we can avoid an explicit flush while using new VPIDs. We would still need to flush
245 * each time while reusing a VPID after hitting the MaxASID limit once.
246 */
247 if ( pVM
248 && pVM->hm.s.vmx.fVpid
249 && (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS))
250 {
251 hmR0VmxFlushVPID(pVM, NULL /* pvCpu */, VMX_FLUSH_VPID_ALL_CONTEXTS, 0 /* GCPtr */);
252 pCpu->fFlushAsidBeforeUse = false;
253 }
254 else
255 pCpu->fFlushAsidBeforeUse = true;
256
257 /*
258 * Ensure each VCPU scheduled on this CPU gets a new VPID on resume. See @bugref{6255}.
259 */
260 ++pCpu->cTlbFlushes;
261
262 return VINF_SUCCESS;
263}
264
265
266/**
267 * Deactivates VT-x on the current CPU.
268 *
269 * @returns VBox status code.
270 * @param pCpu Pointer to the CPU info struct.
271 * @param pvCpuPage Pointer to the global CPU page.
272 * @param HCPhysCpuPage Physical address of the global CPU page.
273 */
274VMMR0DECL(int) VMXR0DisableCpu(PHMGLOBLCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
275{
276 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
277 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
278 NOREF(pCpu);
279
280 /* If we're somehow not in VMX root mode, then we shouldn't dare leaving it. */
281 if (!(ASMGetCR4() & X86_CR4_VMXE))
282 return VERR_VMX_NOT_IN_VMX_ROOT_MODE;
283
284 /* Leave VMX Root Mode. */
285 VMXDisable();
286
287 /* And clear the X86_CR4_VMXE bit. */
288 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
289 return VINF_SUCCESS;
290}
291
292VMMR0DECL(int) VMXR0GlobalInit(void)
293{
294 /* Nothing to do. */
295 return VINF_SUCCESS;
296}
297
298VMMR0DECL(void) VMXR0GlobalTerm(void)
299{
300 /* Nothing to do. */
301}
302
303/**
304 * Does Ring-0 per VM VT-x initialization.
305 *
306 * @returns VBox status code.
307 * @param pVM Pointer to the VM.
308 */
309VMMR0DECL(int) VMXR0InitVM(PVM pVM)
310{
311 int rc;
312
313#ifdef LOG_ENABLED
314 SUPR0Printf("VMXR0InitVM %p\n", pVM);
315#endif
316
317 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
318
319 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
320 {
321 /* Allocate one page for the APIC physical page (serves for filtering accesses). */
322 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjApicAccess, PAGE_SIZE, false /* fExecutable */);
323 AssertRC(rc);
324 if (RT_FAILURE(rc))
325 return rc;
326
327 pVM->hm.s.vmx.pbApicAccess = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjApicAccess);
328 pVM->hm.s.vmx.HCPhysApicAccess = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjApicAccess, 0);
329 ASMMemZero32(pVM->hm.s.vmx.pbApicAccess, PAGE_SIZE);
330 }
331 else
332 {
333 pVM->hm.s.vmx.hMemObjApicAccess = 0;
334 pVM->hm.s.vmx.pbApicAccess = 0;
335 pVM->hm.s.vmx.HCPhysApicAccess = 0;
336 }
337
338#ifdef VBOX_WITH_CRASHDUMP_MAGIC
339 {
340 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjScratch, PAGE_SIZE, false /* fExecutable */);
341 AssertRC(rc);
342 if (RT_FAILURE(rc))
343 return rc;
344
345 pVM->hm.s.vmx.pScratch = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjScratch);
346 pVM->hm.s.vmx.pScratchPhys = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjScratch, 0);
347
348 ASMMemZero32(pVM->hm.s.vmx.pbScratch, PAGE_SIZE);
349 strcpy((char *)pVM->hm.s.vmx.pbScratch, "SCRATCH Magic");
350 *(uint64_t *)(pVM->hm.s.vmx.pbScratch + 16) = UINT64_C(0xDEADBEEFDEADBEEF);
351 }
352#endif
353
354 /* Allocate VMCSs for all guest CPUs. */
355 for (VMCPUID i = 0; i < pVM->cCpus; i++)
356 {
357 PVMCPU pVCpu = &pVM->aCpus[i];
358
359 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
360
361 /* Allocate one page for the VM control structure (VMCS). */
362 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVmcs, PAGE_SIZE, false /* fExecutable */);
363 AssertRC(rc);
364 if (RT_FAILURE(rc))
365 return rc;
366
367 pVCpu->hm.s.vmx.pvVmcs = RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVmcs);
368 pVCpu->hm.s.vmx.HCPhysVmcs = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVmcs, 0);
369 ASMMemZeroPage(pVCpu->hm.s.vmx.pvVmcs);
370
371 pVCpu->hm.s.vmx.cr0_mask = 0;
372 pVCpu->hm.s.vmx.cr4_mask = 0;
373
374 /* Allocate one page for the virtual APIC page for TPR caching. */
375 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVirtApic, PAGE_SIZE, false /* fExecutable */);
376 AssertRC(rc);
377 if (RT_FAILURE(rc))
378 return rc;
379
380 pVCpu->hm.s.vmx.pbVirtApic = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVirtApic);
381 pVCpu->hm.s.vmx.HCPhysVirtApic = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVirtApic, 0);
382 ASMMemZeroPage(pVCpu->hm.s.vmx.pbVirtApic);
383
384 /* Allocate the MSR bitmap if this feature is supported. */
385 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
386 {
387 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjMsrBitmap, PAGE_SIZE, false /* fExecutable */);
388 AssertRC(rc);
389 if (RT_FAILURE(rc))
390 return rc;
391
392 pVCpu->hm.s.vmx.pvMsrBitmap = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjMsrBitmap);
393 pVCpu->hm.s.vmx.HCPhysMsrBitmap = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjMsrBitmap, 0);
394 memset(pVCpu->hm.s.vmx.pvMsrBitmap, 0xff, PAGE_SIZE);
395 }
396
397#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
398 /* Allocate one page for the guest MSR load area (for preloading guest MSRs during the world switch). */
399 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjGuestMsr, PAGE_SIZE, false /* fExecutable */);
400 AssertRC(rc);
401 if (RT_FAILURE(rc))
402 return rc;
403
404 pVCpu->hm.s.vmx.pvGuestMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjGuestMsr);
405 pVCpu->hm.s.vmx.HCPhysGuestMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjGuestMsr, 0);
406 Assert(!(pVCpu->hm.s.vmx.HCPhysGuestMsr & 0xf));
407 memset(pVCpu->hm.s.vmx.pvGuestMsr, 0, PAGE_SIZE);
408
409 /* Allocate one page for the host MSR load area (for restoring host MSRs after the world switch back). */
410 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjHostMsr, PAGE_SIZE, false /* fExecutable */);
411 AssertRC(rc);
412 if (RT_FAILURE(rc))
413 return rc;
414
415 pVCpu->hm.s.vmx.pvHostMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjHostMsr);
416 pVCpu->hm.s.vmx.HCPhysHostMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjHostMsr, 0);
417 Assert(!(pVCpu->hm.s.vmx.HCPhysHostMsr & 0xf));
418 memset(pVCpu->hm.s.vmx.pvHostMsr, 0, PAGE_SIZE);
419#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
420
421 /* Current guest paging mode. */
422 pVCpu->hm.s.vmx.enmLastSeenGuestMode = PGMMODE_REAL;
423
424#ifdef LOG_ENABLED
425 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hm.s.vmx.pvVmcs, (uint32_t)pVCpu->hm.s.vmx.HCPhysVmcs);
426#endif
427 }
428
429 return VINF_SUCCESS;
430}
431
432
433/**
434 * Does Ring-0 per VM VT-x termination.
435 *
436 * @returns VBox status code.
437 * @param pVM Pointer to the VM.
438 */
439VMMR0DECL(int) VMXR0TermVM(PVM pVM)
440{
441 for (VMCPUID i = 0; i < pVM->cCpus; i++)
442 {
443 PVMCPU pVCpu = &pVM->aCpus[i];
444
445 if (pVCpu->hm.s.vmx.hMemObjVmcs != NIL_RTR0MEMOBJ)
446 {
447 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVmcs, false);
448 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
449 pVCpu->hm.s.vmx.pvVmcs = 0;
450 pVCpu->hm.s.vmx.HCPhysVmcs = 0;
451 }
452 if (pVCpu->hm.s.vmx.hMemObjVirtApic != NIL_RTR0MEMOBJ)
453 {
454 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVirtApic, false);
455 pVCpu->hm.s.vmx.hMemObjVirtApic = NIL_RTR0MEMOBJ;
456 pVCpu->hm.s.vmx.pbVirtApic = 0;
457 pVCpu->hm.s.vmx.HCPhysVirtApic = 0;
458 }
459 if (pVCpu->hm.s.vmx.hMemObjMsrBitmap != NIL_RTR0MEMOBJ)
460 {
461 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjMsrBitmap, false);
462 pVCpu->hm.s.vmx.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
463 pVCpu->hm.s.vmx.pvMsrBitmap = 0;
464 pVCpu->hm.s.vmx.HCPhysMsrBitmap = 0;
465 }
466#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
467 if (pVCpu->hm.s.vmx.hMemObjHostMsr != NIL_RTR0MEMOBJ)
468 {
469 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjHostMsr, false);
470 pVCpu->hm.s.vmx.hMemObjHostMsr = NIL_RTR0MEMOBJ;
471 pVCpu->hm.s.vmx.pvHostMsr = 0;
472 pVCpu->hm.s.vmx.HCPhysHostMsr = 0;
473 }
474 if (pVCpu->hm.s.vmx.hMemObjGuestMsr != NIL_RTR0MEMOBJ)
475 {
476 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjGuestMsr, false);
477 pVCpu->hm.s.vmx.hMemObjGuestMsr = NIL_RTR0MEMOBJ;
478 pVCpu->hm.s.vmx.pvGuestMsr = 0;
479 pVCpu->hm.s.vmx.HCPhysGuestMsr = 0;
480 }
481#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
482 }
483 if (pVM->hm.s.vmx.hMemObjApicAccess != NIL_RTR0MEMOBJ)
484 {
485 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjApicAccess, false);
486 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
487 pVM->hm.s.vmx.pbApicAccess = 0;
488 pVM->hm.s.vmx.HCPhysApicAccess = 0;
489 }
490#ifdef VBOX_WITH_CRASHDUMP_MAGIC
491 if (pVM->hm.s.vmx.hMemObjScratch != NIL_RTR0MEMOBJ)
492 {
493 ASMMemZero32(pVM->hm.s.vmx.pScratch, PAGE_SIZE);
494 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjScratch, false);
495 pVM->hm.s.vmx.hMemObjScratch = NIL_RTR0MEMOBJ;
496 pVM->hm.s.vmx.pScratch = 0;
497 pVM->hm.s.vmx.pScratchPhys = 0;
498 }
499#endif
500 return VINF_SUCCESS;
501}
502
503
504/**
505 * Sets up VT-x for the specified VM.
506 *
507 * @returns VBox status code.
508 * @param pVM Pointer to the VM.
509 */
510VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
511{
512 int rc = VINF_SUCCESS;
513 uint32_t val;
514
515 AssertReturn(pVM, VERR_INVALID_PARAMETER);
516
517 /* Initialize these always, see hmR3InitFinalizeR0().*/
518 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NONE;
519 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NONE;
520
521 /* Determine optimal flush type for EPT. */
522 if (pVM->hm.s.fNestedPaging)
523 {
524 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT)
525 {
526 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_SINGLE_CONTEXT)
527 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_SINGLE_CONTEXT;
528 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_ALL_CONTEXTS)
529 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_ALL_CONTEXTS;
530 else
531 {
532 /*
533 * Should never really happen. EPT is supported but no suitable flush types supported.
534 * We cannot ignore EPT at this point as we've already setup Unrestricted Guest execution.
535 */
536 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
537 return VERR_VMX_GENERIC;
538 }
539 }
540 else
541 {
542 /*
543 * Should never really happen. EPT is supported but INVEPT instruction is not supported.
544 */
545 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
546 return VERR_VMX_GENERIC;
547 }
548 }
549
550 /* Determine optimal flush type for VPID. */
551 if (pVM->hm.s.vmx.fVpid)
552 {
553 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID)
554 {
555 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
556 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_SINGLE_CONTEXT;
557 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS)
558 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_ALL_CONTEXTS;
559 else
560 {
561 /*
562 * Neither SINGLE nor ALL context flush types for VPID supported by the CPU.
563 * We do not handle other flush type combinations, ignore VPID capabilities.
564 */
565 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
566 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_INDIV_ADDR supported. Ignoring VPID.\n"));
567 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT_RETAIN_GLOBALS)
568 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_SINGLE_CONTEXT_RETAIN_GLOBALS supported. Ignoring VPID.\n"));
569 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
570 pVM->hm.s.vmx.fVpid = false;
571 }
572 }
573 else
574 {
575 /*
576 * Should not really happen. EPT is supported but INVEPT is not supported.
577 * Ignore VPID capabilities as our code relies on using INVEPT for selective flushing.
578 */
579 Log(("VMXR0SetupVM: VPID supported without INVEPT support. Ignoring VPID.\n"));
580 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
581 pVM->hm.s.vmx.fVpid = false;
582 }
583 }
584
585 for (VMCPUID i = 0; i < pVM->cCpus; i++)
586 {
587 PVMCPU pVCpu = &pVM->aCpus[i];
588
589 AssertPtr(pVCpu->hm.s.vmx.pvVmcs);
590
591 /* Set revision dword at the beginning of the VMCS structure. */
592 *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
593
594 /*
595 * Clear and activate the VMCS.
596 */
597 Log(("HCPhysVmcs = %RHp\n", pVCpu->hm.s.vmx.HCPhysVmcs));
598 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
599 if (RT_FAILURE(rc))
600 goto vmx_end;
601
602 rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
603 if (RT_FAILURE(rc))
604 goto vmx_end;
605
606 /*
607 * VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
608 * Set required bits to one and zero according to the MSR capabilities.
609 */
610 val = pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
611 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT /* External interrupts */
612 | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT; /* Non-maskable interrupts */
613
614 /*
615 * Enable the VMX preemption timer.
616 */
617 if (pVM->hm.s.vmx.fUsePreemptTimer)
618 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_PREEMPT_TIMER;
619 val &= pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
620
621 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, val);
622 AssertRC(rc);
623 pVCpu->hm.s.vmx.u32PinCtls = val;
624
625 /*
626 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
627 * Set required bits to one and zero according to the MSR capabilities.
628 */
629 val = pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
630 /* Program which event cause VM-exits and which features we want to use. */
631 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
632 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TSC_OFFSETTING
633 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
634 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
635 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDPMC_EXIT
636 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_EXIT
637 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside
638 the guest (host thinks the cpu load is high) */
639
640 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
641 if (!pVM->hm.s.fNestedPaging)
642 {
643 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
644 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
645 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
646 }
647
648 /*
649 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch
650 * failure with an invalid control fields error. (combined with some other exit reasons)
651 */
652 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
653 {
654 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
655 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
656 Assert(pVM->hm.s.vmx.pbApicAccess);
657 }
658 else
659 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
660 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
661
662 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
663 {
664 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
665 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
666 }
667
668 /* We will use the secondary control if it's present. */
669 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
670
671 /* Mask away the bits that the CPU doesn't support */
672 /** @todo make sure they don't conflict with the above requirements. */
673 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
674 pVCpu->hm.s.vmx.u32ProcCtls = val;
675
676 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, val);
677 AssertRC(rc);
678
679 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
680 {
681 /*
682 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
683 * Set required bits to one and zero according to the MSR capabilities.
684 */
685 val = pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
686 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
687
688 if (pVM->hm.s.fNestedPaging)
689 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
690
691 if (pVM->hm.s.vmx.fVpid)
692 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
693
694 if (pVM->hm.s.fHasIoApic)
695 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
696
697 if (pVM->hm.s.vmx.fUnrestrictedGuest)
698 val |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;
699
700 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
701 val |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;
702
703 /* Mask away the bits that the CPU doesn't support */
704 /** @todo make sure they don't conflict with the above requirements. */
705 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
706 pVCpu->hm.s.vmx.u32ProcCtls2 = val;
707 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS2, val);
708 AssertRC(rc);
709 }
710
711 /*
712 * VMX_VMCS_CTRL_CR3_TARGET_COUNT
713 * Set required bits to one and zero according to the MSR capabilities.
714 */
715 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_CR3_TARGET_COUNT, 0);
716 AssertRC(rc);
717
718 /*
719 * Forward all exception except #NM & #PF to the guest.
720 * We always need to check pagefaults since our shadow page table can be out of sync.
721 * And we always lazily sync the FPU & XMM state. .
722 */
723
724 /** @todo Possible optimization:
725 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
726 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
727 * registers ourselves of course.
728 *
729 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
730 */
731
732 /*
733 * Don't filter page faults, all of them should cause a world switch.
734 */
735 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK, 0);
736 AssertRC(rc);
737 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH, 0);
738 AssertRC(rc);
739
740 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0);
741 AssertRC(rc);
742 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_A_FULL, 0);
743 AssertRC(rc);
744 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_B_FULL, 0);
745 AssertRC(rc);
746
747 /*
748 * Set the MSR bitmap address.
749 */
750 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
751 {
752 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
753
754 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_MSR_BITMAP_FULL, pVCpu->hm.s.vmx.HCPhysMsrBitmap);
755 AssertRC(rc);
756
757 /*
758 * Allow the guest to directly modify these MSRs; they are loaded/stored automatically
759 * using MSR-load/store areas in the VMCS.
760 */
761 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
762 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
763 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
764 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
765 hmR0VmxSetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
766 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
767 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
768 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
769 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
770 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
771 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_TSC_AUX, true, true);
772 }
773
774#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
775 /*
776 * Set the guest & host MSR load/store physical addresses.
777 */
778 Assert(pVCpu->hm.s.vmx.HCPhysGuestMsr);
779 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
780 AssertRC(rc);
781 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
782 AssertRC(rc);
783 Assert(pVCpu->hm.s.vmx.HCPhysHostMsr);
784 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysHostMsr);
785 AssertRC(rc);
786#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
787
788 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, 0);
789 AssertRC(rc);
790 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, 0);
791 AssertRC(rc);
792 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, 0);
793 AssertRC(rc);
794
795 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
796 {
797 Assert(pVM->hm.s.vmx.hMemObjApicAccess);
798 /* Optional */
799 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, 0);
800 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hm.s.vmx.HCPhysVirtApic);
801
802 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
803 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL, pVM->hm.s.vmx.HCPhysApicAccess);
804
805 AssertRC(rc);
806 }
807
808 /* Set link pointer to -1. Not currently used. */
809 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
810 AssertRC(rc);
811
812 /*
813 * Clear VMCS, marking it inactive. Clear implementation specific data and writing back
814 * VMCS data back to memory.
815 */
816 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
817 AssertRC(rc);
818
819 /*
820 * Configure the VMCS read cache.
821 */
822 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
823
824 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RIP);
825 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RSP);
826 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RFLAGS);
827 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE);
828 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR0_READ_SHADOW);
829 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR0);
830 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR4_READ_SHADOW);
831 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR4);
832 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_DR7);
833 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_SYSENTER_CS);
834 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_EIP);
835 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_ESP);
836 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_GDTR_LIMIT);
837 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_GDTR_BASE);
838 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_IDTR_LIMIT);
839 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_IDTR_BASE);
840
841 VMX_SETUP_SELREG(ES, pCache);
842 VMX_SETUP_SELREG(SS, pCache);
843 VMX_SETUP_SELREG(CS, pCache);
844 VMX_SETUP_SELREG(DS, pCache);
845 VMX_SETUP_SELREG(FS, pCache);
846 VMX_SETUP_SELREG(GS, pCache);
847 VMX_SETUP_SELREG(LDTR, pCache);
848 VMX_SETUP_SELREG(TR, pCache);
849
850 /*
851 * Status code VMCS reads.
852 */
853 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_REASON);
854 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_VM_INSTR_ERROR);
855 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_LENGTH);
856 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE);
857 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO);
858 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_INFO);
859 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_RO_EXIT_QUALIFICATION);
860 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_INFO);
861 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_ERROR_CODE);
862
863 if (pVM->hm.s.fNestedPaging)
864 {
865 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR3);
866 VMXSetupCachedReadVmcs(pCache, VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL);
867 pCache->Read.cValidEntries = VMX_VMCS_MAX_NESTED_PAGING_CACHE_IDX;
868 }
869 else
870 pCache->Read.cValidEntries = VMX_VMCS_MAX_CACHE_IDX;
871 } /* for each VMCPU */
872
873 /*
874 * Setup the right TLB function based on CPU capabilities.
875 */
876 if (pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid)
877 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBBoth;
878 else if (pVM->hm.s.fNestedPaging)
879 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBEPT;
880 else if (pVM->hm.s.vmx.fVpid)
881 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBVPID;
882 else
883 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBDummy;
884
885vmx_end:
886 hmR0VmxCheckError(pVM, &pVM->aCpus[0], rc);
887 return rc;
888}
889
890
891/**
892 * Sets the permission bits for the specified MSR.
893 *
894 * @param pVCpu Pointer to the VMCPU.
895 * @param ulMSR The MSR value.
896 * @param fRead Whether reading is allowed.
897 * @param fWrite Whether writing is allowed.
898 */
899static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
900{
901 unsigned ulBit;
902 uint8_t *pvMsrBitmap = (uint8_t *)pVCpu->hm.s.vmx.pvMsrBitmap;
903
904 /*
905 * Layout:
906 * 0x000 - 0x3ff - Low MSR read bits
907 * 0x400 - 0x7ff - High MSR read bits
908 * 0x800 - 0xbff - Low MSR write bits
909 * 0xc00 - 0xfff - High MSR write bits
910 */
911 if (ulMSR <= 0x00001FFF)
912 {
913 /* Pentium-compatible MSRs */
914 ulBit = ulMSR;
915 }
916 else if ( ulMSR >= 0xC0000000
917 && ulMSR <= 0xC0001FFF)
918 {
919 /* AMD Sixth Generation x86 Processor MSRs */
920 ulBit = (ulMSR - 0xC0000000);
921 pvMsrBitmap += 0x400;
922 }
923 else
924 {
925 AssertFailed();
926 return;
927 }
928
929 Assert(ulBit <= 0x1fff);
930 if (fRead)
931 ASMBitClear(pvMsrBitmap, ulBit);
932 else
933 ASMBitSet(pvMsrBitmap, ulBit);
934
935 if (fWrite)
936 ASMBitClear(pvMsrBitmap + 0x800, ulBit);
937 else
938 ASMBitSet(pvMsrBitmap + 0x800, ulBit);
939}
940
941
942/**
943 * Injects an event (trap or external interrupt).
944 *
945 * @returns VBox status code. Note that it may return VINF_EM_RESET to
946 * indicate a triple fault when injecting X86_XCPT_DF.
947 *
948 * @param pVM Pointer to the VM.
949 * @param pVCpu Pointer to the VMCPU.
950 * @param pCtx Pointer to the guest CPU Context.
951 * @param intInfo VMX interrupt info.
952 * @param cbInstr Opcode length of faulting instruction.
953 * @param errCode Error code (optional).
954 */
955static int hmR0VmxInjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
956{
957 int rc;
958 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
959
960#ifdef VBOX_WITH_STATISTICS
961 STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[iGate & MASK_INJECT_IRQ_STAT]);
962#endif
963
964#ifdef VBOX_STRICT
965 if (iGate == 0xE)
966 {
967 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%RGv intInfo=%08x\n", iGate,
968 (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
969 }
970 else if (iGate < 0x20)
971 {
972 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip,
973 errCode));
974 }
975 else
976 {
977 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
978 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
979 || !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
980 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
981 || pCtx->eflags.u32 & X86_EFL_IF);
982 }
983#endif
984
985 if ( CPUMIsGuestInRealModeEx(pCtx)
986 && pVM->hm.s.vmx.pRealModeTSS)
987 {
988 RTGCPHYS GCPhysHandler;
989 uint16_t offset, ip;
990 RTSEL sel;
991
992 /*
993 * Injecting events doesn't work right with real mode emulation.
994 * (#GP if we try to inject external hardware interrupts)
995 * Inject the interrupt or trap directly instead.
996 *
997 * ASSUMES no access handlers for the bits we read or write below (should be safe).
998 */
999 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
1000
1001 /*
1002 * Check if the interrupt handler is present.
1003 */
1004 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
1005 {
1006 Log(("IDT cbIdt violation\n"));
1007 if (iGate != X86_XCPT_DF)
1008 {
1009 uint32_t intInfo2;
1010
1011 intInfo2 = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : (uint32_t)X86_XCPT_GP;
1012 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1013 intInfo2 |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1014 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1015
1016 return hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, 0, 0 /* no error code according to the Intel docs */);
1017 }
1018 Log(("Triple fault -> reset the VM!\n"));
1019 return VINF_EM_RESET;
1020 }
1021 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
1022 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
1023 || iGate == 4)
1024 {
1025 ip = pCtx->ip + cbInstr;
1026 }
1027 else
1028 ip = pCtx->ip;
1029
1030 /*
1031 * Read the selector:offset pair of the interrupt handler.
1032 */
1033 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
1034 rc = PGMPhysSimpleReadGCPhys(pVM, &offset, GCPhysHandler, sizeof(offset)); AssertRC(rc);
1035 rc = PGMPhysSimpleReadGCPhys(pVM, &sel, GCPhysHandler + 2, sizeof(sel)); AssertRC(rc);
1036
1037 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
1038
1039 /*
1040 * Construct the stack frame.
1041 */
1042 /** @todo Check stack limit. */
1043 pCtx->sp -= 2;
1044 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->eflags.u));
1045 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t)); AssertRC(rc);
1046 pCtx->sp -= 2;
1047 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->cs.Sel));
1048 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t)); AssertRC(rc);
1049 pCtx->sp -= 2;
1050 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss.Sel, pCtx->sp, ip));
1051 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &ip, sizeof(ip)); AssertRC(rc);
1052
1053 /*
1054 * Update the CPU state for executing the handler.
1055 */
1056 pCtx->rip = offset;
1057 pCtx->cs.Sel = sel;
1058 pCtx->cs.u64Base = sel << 4;
1059 pCtx->eflags.u &= ~(X86_EFL_IF | X86_EFL_TF | X86_EFL_RF | X86_EFL_AC);
1060
1061 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_SEGMENT_REGS;
1062 return VINF_SUCCESS;
1063 }
1064
1065 /*
1066 * Set event injection state.
1067 */
1068 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
1069 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
1070 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
1071
1072 AssertRC(rc);
1073 return rc;
1074}
1075
1076
1077/**
1078 * Checks for pending guest interrupts and injects them.
1079 *
1080 * @returns VBox status code.
1081 * @param pVM Pointer to the VM.
1082 * @param pVCpu Pointer to the VMCPU.
1083 * @param pCtx Pointer to the guest CPU context.
1084 */
1085static int hmR0VmxCheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
1086{
1087 int rc;
1088
1089 /*
1090 * Dispatch any pending interrupts (injected before, but a VM exit occurred prematurely).
1091 */
1092 if (pVCpu->hm.s.Event.fPending)
1093 {
1094 Log(("CPU%d: Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntrInfo,
1095 pVCpu->hm.s.Event.u32ErrCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
1096 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntReinject);
1097 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, pVCpu->hm.s.Event.u64IntrInfo, 0, pVCpu->hm.s.Event.u32ErrCode);
1098 AssertRC(rc);
1099
1100 pVCpu->hm.s.Event.fPending = false;
1101 return VINF_SUCCESS;
1102 }
1103
1104 /*
1105 * If an active trap is already pending, we must forward it first!
1106 */
1107 if (!TRPMHasTrap(pVCpu))
1108 {
1109 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
1110 {
1111 RTGCUINTPTR intInfo;
1112
1113 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
1114
1115 intInfo = X86_XCPT_NMI;
1116 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1117 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1118
1119 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
1120 AssertRC(rc);
1121
1122 return VINF_SUCCESS;
1123 }
1124
1125 /** @todo SMI interrupts. */
1126
1127 /*
1128 * When external interrupts are pending, we should exit the VM when IF is set.
1129 */
1130 if (VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
1131 {
1132 if (!(pCtx->eflags.u32 & X86_EFL_IF))
1133 {
1134 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT))
1135 {
1136 LogFlow(("Enable irq window exit!\n"));
1137 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
1138 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1139 AssertRC(rc);
1140 }
1141 /* else nothing to do but wait */
1142 }
1143 else if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1144 {
1145 uint8_t u8Interrupt;
1146
1147 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
1148 Log(("CPU%d: Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", pVCpu->idCpu,
1149 u8Interrupt, u8Interrupt, rc, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
1150 if (RT_SUCCESS(rc))
1151 {
1152 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
1153 AssertRC(rc);
1154 }
1155 else
1156 {
1157 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
1158 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
1159 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
1160 /* Just continue */
1161 }
1162 }
1163 else
1164 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
1165 }
1166 }
1167
1168#ifdef VBOX_STRICT
1169 if (TRPMHasTrap(pVCpu))
1170 {
1171 uint8_t u8Vector;
1172 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
1173 AssertRC(rc);
1174 }
1175#endif
1176
1177 if ( (pCtx->eflags.u32 & X86_EFL_IF)
1178 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1179 && TRPMHasTrap(pVCpu)
1180 )
1181 {
1182 uint8_t u8Vector;
1183 TRPMEVENT enmType;
1184 RTGCUINTPTR intInfo;
1185 RTGCUINT errCode;
1186
1187 /*
1188 * If a new event is pending, dispatch it now.
1189 */
1190 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &errCode, 0);
1191 AssertRC(rc);
1192 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
1193 Assert(enmType != TRPM_SOFTWARE_INT);
1194
1195 /*
1196 * Clear the pending trap.
1197 */
1198 rc = TRPMResetTrap(pVCpu);
1199 AssertRC(rc);
1200
1201 intInfo = u8Vector;
1202 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1203
1204 if (enmType == TRPM_TRAP)
1205 {
1206 switch (u8Vector)
1207 {
1208 case X86_XCPT_DF:
1209 case X86_XCPT_TS:
1210 case X86_XCPT_NP:
1211 case X86_XCPT_SS:
1212 case X86_XCPT_GP:
1213 case X86_XCPT_PF:
1214 case X86_XCPT_AC:
1215 {
1216 /** @todo r=ramshankar: setting this bit would blow up for real-mode guests with
1217 * unrestricted guest execution. */
1218 /* Valid error codes. */
1219 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1220 break;
1221 }
1222
1223 default:
1224 break;
1225 }
1226
1227 if ( u8Vector == X86_XCPT_BP
1228 || u8Vector == X86_XCPT_OF)
1229 {
1230 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1231 }
1232 else
1233 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1234 }
1235 else
1236 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1237
1238 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntInject);
1239 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
1240 AssertRC(rc);
1241 } /* if (interrupts can be dispatched) */
1242
1243 return VINF_SUCCESS;
1244}
1245
1246/**
1247 * Checks for pending VMX events and converts them to TRPM. Before we execute any instruction
1248 * outside of VMX, any pending VMX event must be converted so that it can be delivered properly.
1249 *
1250 * @returns VBox status code.
1251 * @param pVCpu Pointer to the VMCPU.
1252 */
1253static int hmR0VmxCheckPendingEvent(PVMCPU pVCpu)
1254{
1255 if (pVCpu->hm.s.Event.fPending)
1256 {
1257 TRPMEVENT enmTrapType;
1258
1259 /* If a trap was already pending, we did something wrong! */
1260 Assert((TRPMQueryTrap(pVCpu, NULL, NULL) == VERR_TRPM_NO_ACTIVE_TRAP));
1261
1262 /*
1263 * Clear the pending event and move it over to TRPM for the rest
1264 * of the world to see.
1265 */
1266 pVCpu->hm.s.Event.fPending = false;
1267 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo))
1268 {
1269 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT:
1270 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI:
1271 enmTrapType = TRPM_HARDWARE_INT;
1272 break;
1273 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT:
1274 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /** @todo Is classifying #BP, #OF as TRPM_SOFTWARE_INT correct? */
1275 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT:
1276 enmTrapType = TRPM_SOFTWARE_INT;
1277 break;
1278 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT:
1279 enmTrapType = TRPM_TRAP;
1280 break;
1281 default:
1282 enmTrapType = TRPM_32BIT_HACK; /* Can't get here. */
1283 AssertFailed();
1284 }
1285 TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), enmTrapType);
1286 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
1287 TRPMSetErrorCode(pVCpu, pVCpu->hm.s.Event.u32ErrCode);
1288 //@todo: Is there any situation where we need to call TRPMSetFaultAddress()?
1289 }
1290 return VINF_SUCCESS;
1291}
1292
1293/**
1294 * Save the host state into the VMCS.
1295 *
1296 * @returns VBox status code.
1297 * @param pVM Pointer to the VM.
1298 * @param pVCpu Pointer to the VMCPU.
1299 */
1300VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
1301{
1302 int rc = VINF_SUCCESS;
1303 NOREF(pVM);
1304
1305 /*
1306 * Host CPU Context.
1307 */
1308 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
1309 {
1310 RTIDTR idtr;
1311 RTGDTR gdtr;
1312 RTSEL SelTR;
1313 PCX86DESCHC pDesc;
1314 uintptr_t trBase;
1315 RTSEL cs;
1316 RTSEL ss;
1317 uint64_t cr3;
1318
1319 /*
1320 * Control registers.
1321 */
1322 rc = VMXWriteVmcs(VMX_VMCS_HOST_CR0, ASMGetCR0());
1323 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
1324#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1325 if (VMX_IS_64BIT_HOST_MODE())
1326 {
1327 cr3 = hmR0Get64bitCR3();
1328 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_CR3, cr3);
1329 }
1330 else
1331#endif
1332 {
1333 cr3 = ASMGetCR3();
1334 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR3, cr3);
1335 }
1336 Log2(("VMX_VMCS_HOST_CR3 %08RX64\n", cr3));
1337 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR4, ASMGetCR4());
1338 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
1339 AssertRC(rc);
1340
1341 /*
1342 * Selector registers.
1343 */
1344#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1345 if (VMX_IS_64BIT_HOST_MODE())
1346 {
1347 cs = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelCS;
1348 ss = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelSS;
1349 }
1350 else
1351 {
1352 /* sysenter loads LDT cs & ss, VMX doesn't like this. Load the GDT ones (safe). */
1353 cs = (RTSEL)(uintptr_t)&SUPR0AbsKernelCS;
1354 ss = (RTSEL)(uintptr_t)&SUPR0AbsKernelSS;
1355 }
1356#else
1357 cs = ASMGetCS();
1358 ss = ASMGetSS();
1359#endif
1360 Assert(!(cs & X86_SEL_LDT)); Assert((cs & X86_SEL_RPL) == 0);
1361 Assert(!(ss & X86_SEL_LDT)); Assert((ss & X86_SEL_RPL) == 0);
1362 rc = VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_CS, cs);
1363 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
1364 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_DS, 0);
1365 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_ES, 0);
1366#if HC_ARCH_BITS == 32
1367 if (!VMX_IS_64BIT_HOST_MODE())
1368 {
1369 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_FS, 0);
1370 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_GS, 0);
1371 }
1372#endif
1373 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_SS, ss);
1374 SelTR = ASMGetTR();
1375 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_TR, SelTR);
1376 AssertRC(rc);
1377 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
1378 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
1379 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
1380 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
1381 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
1382 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", ss, ASMGetSS()));
1383 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
1384
1385 /*
1386 * GDTR & IDTR.
1387 */
1388#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1389 if (VMX_IS_64BIT_HOST_MODE())
1390 {
1391 X86XDTR64 gdtr64, idtr64;
1392 hmR0Get64bitGdtrAndIdtr(&gdtr64, &idtr64);
1393 rc = VMXWriteVmcs64(VMX_VMCS_HOST_GDTR_BASE, gdtr64.uAddr);
1394 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_IDTR_BASE, idtr64.uAddr);
1395 AssertRC(rc);
1396 Log2(("VMX_VMCS_HOST_GDTR_BASE %RX64\n", gdtr64.uAddr));
1397 Log2(("VMX_VMCS_HOST_IDTR_BASE %RX64\n", idtr64.uAddr));
1398 gdtr.cbGdt = gdtr64.cb;
1399 gdtr.pGdt = (uintptr_t)gdtr64.uAddr;
1400 }
1401 else
1402#endif
1403 {
1404 ASMGetGDTR(&gdtr);
1405 rc = VMXWriteVmcs(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
1406 ASMGetIDTR(&idtr);
1407 rc |= VMXWriteVmcs(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
1408 AssertRC(rc);
1409 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
1410 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
1411 }
1412
1413 /*
1414 * Save the base address of the TR selector.
1415 */
1416 if (SelTR > gdtr.cbGdt)
1417 {
1418 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
1419 return VERR_VMX_INVALID_HOST_STATE;
1420 }
1421
1422 pDesc = (PCX86DESCHC)(gdtr.pGdt + (SelTR & X86_SEL_MASK));
1423#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1424 if (VMX_IS_64BIT_HOST_MODE())
1425 {
1426 uint64_t trBase64 = X86DESC64_BASE((PX86DESC64)pDesc);
1427 rc = VMXWriteVmcs64(VMX_VMCS_HOST_TR_BASE, trBase64);
1428 Log2(("VMX_VMCS_HOST_TR_BASE %RX64\n", trBase64));
1429 AssertRC(rc);
1430 }
1431 else
1432#endif
1433 {
1434#if HC_ARCH_BITS == 64
1435 trBase = X86DESC64_BASE(pDesc);
1436#else
1437 trBase = X86DESC_BASE(pDesc);
1438#endif
1439 rc = VMXWriteVmcs(VMX_VMCS_HOST_TR_BASE, trBase);
1440 AssertRC(rc);
1441 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
1442 }
1443
1444 /*
1445 * FS base and GS base.
1446 */
1447#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1448 if (VMX_IS_64BIT_HOST_MODE())
1449 {
1450 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
1451 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
1452 rc = VMXWriteVmcs64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
1453 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
1454 }
1455#endif
1456 AssertRC(rc);
1457
1458 /*
1459 * Sysenter MSRs.
1460 */
1461 /** @todo expensive!! */
1462 rc = VMXWriteVmcs(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
1463 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
1464#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1465 if (VMX_IS_64BIT_HOST_MODE())
1466 {
1467 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1468 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1469 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1470 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1471 }
1472 else
1473 {
1474 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1475 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1476 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1477 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1478 }
1479#elif HC_ARCH_BITS == 32
1480 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1481 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1482 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1483 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1484#else
1485 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1486 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1487 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1488 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1489#endif
1490 AssertRC(rc);
1491
1492
1493#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1494 /*
1495 * Store all host MSRs in the VM-Exit load area, so they will be reloaded after
1496 * the world switch back to the host.
1497 */
1498 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvHostMsr;
1499 unsigned idxMsr = 0;
1500
1501 uint32_t u32HostExtFeatures = ASMCpuId_EDX(0x80000001);
1502 if (u32HostExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
1503 {
1504 pMsr->u32IndexMSR = MSR_K6_EFER;
1505 pMsr->u32Reserved = 0;
1506# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1507 if (CPUMIsGuestInLongMode(pVCpu))
1508 {
1509 /* Must match the EFER value in our 64 bits switcher. */
1510 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER) | MSR_K6_EFER_LME | MSR_K6_EFER_SCE | MSR_K6_EFER_NXE;
1511 }
1512 else
1513# endif
1514 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER);
1515 pMsr++; idxMsr++;
1516 }
1517
1518# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1519 if (VMX_IS_64BIT_HOST_MODE())
1520 {
1521 pMsr->u32IndexMSR = MSR_K6_STAR;
1522 pMsr->u32Reserved = 0;
1523 pMsr->u64Value = ASMRdMsr(MSR_K6_STAR); /* legacy syscall eip, cs & ss */
1524 pMsr++; idxMsr++;
1525 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1526 pMsr->u32Reserved = 0;
1527 pMsr->u64Value = ASMRdMsr(MSR_K8_LSTAR); /* 64 bits mode syscall rip */
1528 pMsr++; idxMsr++;
1529 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1530 pMsr->u32Reserved = 0;
1531 pMsr->u64Value = ASMRdMsr(MSR_K8_SF_MASK); /* syscall flag mask */
1532 pMsr++; idxMsr++;
1533
1534 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
1535#if 0
1536 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1537 pMsr->u32Reserved = 0;
1538 pMsr->u64Value = ASMRdMsr(MSR_K8_KERNEL_GS_BASE); /* swapgs exchange value */
1539 pMsr++; idxMsr++;
1540#endif
1541 }
1542# endif
1543
1544 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
1545 {
1546 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
1547 pMsr->u32Reserved = 0;
1548 pMsr->u64Value = ASMRdMsr(MSR_K8_TSC_AUX);
1549 pMsr++; idxMsr++;
1550 }
1551
1552 /** @todo r=ramshankar: check IA32_VMX_MISC bits 27:25 for valid idxMsr
1553 * range. */
1554 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, idxMsr);
1555 AssertRC(rc);
1556#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1557
1558 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_HOST_CONTEXT;
1559 }
1560 return rc;
1561}
1562
1563
1564/**
1565 * Loads the 4 PDPEs into the guest state when nested paging is used and the
1566 * guest operates in PAE mode.
1567 *
1568 * @returns VBox status code.
1569 * @param pVCpu Pointer to the VMCPU.
1570 * @param pCtx Pointer to the guest CPU context.
1571 */
1572static int hmR0VmxLoadPaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1573{
1574 if (CPUMIsGuestInPAEModeEx(pCtx))
1575 {
1576 X86PDPE aPdpes[4];
1577 int rc = PGMGstGetPaePdpes(pVCpu, &aPdpes[0]);
1578 AssertRCReturn(rc, rc);
1579
1580 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, aPdpes[0].u); AssertRCReturn(rc, rc);
1581 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, aPdpes[1].u); AssertRCReturn(rc, rc);
1582 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, aPdpes[2].u); AssertRCReturn(rc, rc);
1583 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, aPdpes[3].u); AssertRCReturn(rc, rc);
1584 }
1585 return VINF_SUCCESS;
1586}
1587
1588
1589/**
1590 * Saves the 4 PDPEs into the guest state when nested paging is used and the
1591 * guest operates in PAE mode.
1592 *
1593 * @returns VBox status code.
1594 * @param pVCpu Pointer to the VM CPU.
1595 * @param pCtx Pointer to the guest CPU context.
1596 *
1597 * @remarks Tell PGM about CR3 changes before calling this helper.
1598 */
1599static int hmR0VmxSavePaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1600{
1601 if (CPUMIsGuestInPAEModeEx(pCtx))
1602 {
1603 int rc;
1604 X86PDPE aPdpes[4];
1605 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &aPdpes[0].u); AssertRCReturn(rc, rc);
1606 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &aPdpes[1].u); AssertRCReturn(rc, rc);
1607 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &aPdpes[2].u); AssertRCReturn(rc, rc);
1608 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &aPdpes[3].u); AssertRCReturn(rc, rc);
1609
1610 rc = PGMGstUpdatePaePdpes(pVCpu, &aPdpes[0]);
1611 AssertRCReturn(rc, rc);
1612 }
1613 return VINF_SUCCESS;
1614}
1615
1616
1617/**
1618 * Update the exception bitmap according to the current CPU state.
1619 *
1620 * @param pVM Pointer to the VM.
1621 * @param pVCpu Pointer to the VMCPU.
1622 * @param pCtx Pointer to the guest CPU context.
1623 */
1624static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1625{
1626 uint32_t u32TrapMask;
1627 Assert(pCtx);
1628
1629 /*
1630 * Set up a mask for intercepting traps.
1631 */
1632 /** @todo Do we really need to always intercept #DB? */
1633 u32TrapMask = RT_BIT(X86_XCPT_DB)
1634 | RT_BIT(X86_XCPT_NM)
1635#ifdef VBOX_ALWAYS_TRAP_PF
1636 | RT_BIT(X86_XCPT_PF)
1637#endif
1638#ifdef VBOX_STRICT
1639 | RT_BIT(X86_XCPT_BP)
1640 | RT_BIT(X86_XCPT_DB)
1641 | RT_BIT(X86_XCPT_DE)
1642 | RT_BIT(X86_XCPT_NM)
1643 | RT_BIT(X86_XCPT_UD)
1644 | RT_BIT(X86_XCPT_NP)
1645 | RT_BIT(X86_XCPT_SS)
1646 | RT_BIT(X86_XCPT_GP)
1647 | RT_BIT(X86_XCPT_MF)
1648#endif
1649 ;
1650
1651 /*
1652 * Without nested paging, #PF must be intercepted to implement shadow paging.
1653 */
1654 /** @todo NP state won't change so maybe we should build the initial trap mask up front? */
1655 if (!pVM->hm.s.fNestedPaging)
1656 u32TrapMask |= RT_BIT(X86_XCPT_PF);
1657
1658 /* Catch floating point exceptions if we need to report them to the guest in a different way. */
1659 if (!(pCtx->cr0 & X86_CR0_NE))
1660 u32TrapMask |= RT_BIT(X86_XCPT_MF);
1661
1662#ifdef VBOX_STRICT
1663 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
1664#endif
1665
1666 /*
1667 * Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise).
1668 */
1669 /** @todo Despite the claim to intercept everything, with NP we do not intercept #PF. Should we? */
1670 if ( CPUMIsGuestInRealModeEx(pCtx)
1671 && pVM->hm.s.vmx.pRealModeTSS)
1672 {
1673 u32TrapMask |= RT_BIT(X86_XCPT_DE)
1674 | RT_BIT(X86_XCPT_DB)
1675 | RT_BIT(X86_XCPT_NMI)
1676 | RT_BIT(X86_XCPT_BP)
1677 | RT_BIT(X86_XCPT_OF)
1678 | RT_BIT(X86_XCPT_BR)
1679 | RT_BIT(X86_XCPT_UD)
1680 | RT_BIT(X86_XCPT_DF)
1681 | RT_BIT(X86_XCPT_CO_SEG_OVERRUN)
1682 | RT_BIT(X86_XCPT_TS)
1683 | RT_BIT(X86_XCPT_NP)
1684 | RT_BIT(X86_XCPT_SS)
1685 | RT_BIT(X86_XCPT_GP)
1686 | RT_BIT(X86_XCPT_MF)
1687 | RT_BIT(X86_XCPT_AC)
1688 | RT_BIT(X86_XCPT_MC)
1689 | RT_BIT(X86_XCPT_XF)
1690 ;
1691 }
1692
1693 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, u32TrapMask);
1694 AssertRC(rc);
1695}
1696
1697
1698/**
1699 * Loads a minimal guest state.
1700 *
1701 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1702 *
1703 * @param pVM Pointer to the VM.
1704 * @param pVCpu Pointer to the VMCPU.
1705 * @param pCtx Pointer to the guest CPU context.
1706 */
1707VMMR0DECL(void) VMXR0LoadMinimalGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1708{
1709 int rc;
1710 X86EFLAGS eflags;
1711
1712 Assert(!(pVCpu->hm.s.fContextUseFlags & HM_CHANGED_ALL_GUEST));
1713
1714 /*
1715 * Load EIP, ESP and EFLAGS.
1716 */
1717 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_RIP, pCtx->rip);
1718 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1719 AssertRC(rc);
1720
1721 /*
1722 * Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1.
1723 */
1724 eflags = pCtx->eflags;
1725 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1726 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1727
1728 /*
1729 * Check if real mode emulation using v86 mode.
1730 */
1731 if ( CPUMIsGuestInRealModeEx(pCtx)
1732 && pVM->hm.s.vmx.pRealModeTSS)
1733 {
1734 pVCpu->hm.s.vmx.RealMode.eflags = eflags;
1735
1736 eflags.Bits.u1VM = 1;
1737 eflags.Bits.u2IOPL = 0; /* must always be 0 or else certain instructions won't cause faults. */
1738 }
1739 rc = VMXWriteVmcs(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1740 AssertRC(rc);
1741}
1742
1743
1744/**
1745 * Sets up TSC offsetting and VMX preemption, if supported/configured/available.
1746 *
1747 * NOTE: This function reads the host TSC value. Therefore it must be executed very
1748 * shortly before a VM entry and execution MUST NOT be rescheduled between a call to
1749 * this function and a VM entry without calling this function again.
1750 *
1751 * @returns VBox status code.
1752 * @param pVM Pointer to the VM.
1753 * @param pVCpu Pointer to the VMCPU.
1754 */
1755VMMR0DECL(int) VMXR0SetupTscOffsetAndPreemption(PVM pVM, PVMCPU pVCpu)
1756{
1757 int rc = VINF_SUCCESS;
1758 bool fOffsettedTsc;
1759
1760 if (pVM->hm.s.vmx.fUsePreemptTimer)
1761 {
1762 uint64_t cTicksToDeadline = TMCpuTickGetDeadlineAndTscOffset(pVCpu, &fOffsettedTsc, &pVCpu->hm.s.vmx.u64TSCOffset);
1763
1764 /* Make sure the returned values have sane upper and lower boundaries. */
1765 uint64_t u64CpuHz = SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage);
1766
1767 cTicksToDeadline = RT_MIN(cTicksToDeadline, u64CpuHz / 64); /* 1/64 of a second */
1768 cTicksToDeadline = RT_MAX(cTicksToDeadline, u64CpuHz / 2048); /* 1/2048th of a second */
1769
1770 cTicksToDeadline >>= pVM->hm.s.vmx.cPreemptTimerShift;
1771 uint32_t cPreemptionTickCount = (uint32_t)RT_MIN(cTicksToDeadline, UINT32_MAX - 16);
1772 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_PREEMPTION_TIMER_VALUE, cPreemptionTickCount);
1773 AssertRC(rc);
1774 }
1775 else
1776 fOffsettedTsc = TMCpuTickCanUseRealTSC(pVCpu, &pVCpu->hm.s.vmx.u64TSCOffset);
1777
1778 if (fOffsettedTsc)
1779 {
1780 uint64_t u64CurTSC = ASMReadTSC();
1781 if (u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset > TMCpuTickGetLastSeen(pVCpu))
1782 {
1783 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET, applies to RDTSCP too. */
1784 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, pVCpu->hm.s.vmx.u64TSCOffset);
1785 AssertRC(rc);
1786
1787 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1788 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1789 AssertRC(rc);
1790 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscOffset);
1791 }
1792 else
1793 {
1794 /* Fall back to rdtsc, rdtscp emulation as we would otherwise pass decreasing tsc values to the guest. */
1795 LogFlow(("TSC %RX64 offset %RX64 time=%RX64 last=%RX64 (diff=%RX64, virt_tsc=%RX64)\n", u64CurTSC,
1796 pVCpu->hm.s.vmx.u64TSCOffset, u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset,
1797 TMCpuTickGetLastSeen(pVCpu), TMCpuTickGetLastSeen(pVCpu) - u64CurTSC - pVCpu->hm.s.vmx.u64TSCOffset,
1798 TMCpuTickGet(pVCpu)));
1799 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1800 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1801 AssertRC(rc);
1802 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscInterceptOverFlow);
1803 }
1804 }
1805 else
1806 {
1807 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1808 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1809 AssertRC(rc);
1810 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscIntercept);
1811 }
1812 return rc;
1813}
1814
1815/**
1816 * Loads the guest state.
1817 *
1818 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1819 *
1820 * @returns VBox status code.
1821 * @param pVM Pointer to the VM.
1822 * @param pVCpu Pointer to the VMCPU.
1823 * @param pCtx Pointer to the guest CPU context.
1824 */
1825VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1826{
1827 int rc = VINF_SUCCESS;
1828 RTGCUINTPTR val;
1829
1830 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
1831
1832 /*
1833 * VMX_VMCS_CTRL_ENTRY_CONTROLS
1834 * Set required bits to one and zero according to the MSR capabilities.
1835 */
1836 val = pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0;
1837
1838 /*
1839 * Load guest debug controls (DR7 & IA32_DEBUGCTL_MSR).
1840 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1841 */
1842 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1843
1844 if (CPUMIsGuestInLongModeEx(pCtx))
1845 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA32E_MODE_GUEST;
1846 /* else Must be zero when AMD64 is not available. */
1847
1848 /*
1849 * Mask away the bits that the CPU doesn't support.
1850 */
1851 val &= pVM->hm.s.vmx.msr.vmx_entry.n.allowed1;
1852 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, val);
1853 AssertRC(rc);
1854
1855 /*
1856 * VMX_VMCS_CTRL_EXIT_CONTROLS
1857 * Set required bits to one and zero according to the MSR capabilities.
1858 */
1859 val = pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0;
1860
1861 /*
1862 * Save debug controls (DR7 & IA32_DEBUGCTL_MSR)
1863 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1864 */
1865 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
1866
1867#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1868 if (VMX_IS_64BIT_HOST_MODE())
1869 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE;
1870 /* else Must be zero when AMD64 is not available. */
1871#elif HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1872 if (CPUMIsGuestInLongModeEx(pCtx))
1873 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE; /* our switcher goes to long mode */
1874 else
1875 Assert(!(val & VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE));
1876#endif
1877 val &= pVM->hm.s.vmx.msr.vmx_exit.n.allowed1;
1878
1879 /*
1880 * Don't acknowledge external interrupts on VM-exit.
1881 */
1882 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, val);
1883 AssertRC(rc);
1884
1885 /*
1886 * Guest CPU context: ES, CS, SS, DS, FS, GS.
1887 */
1888 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_SEGMENT_REGS)
1889 {
1890 if (pVM->hm.s.vmx.pRealModeTSS)
1891 {
1892 PGMMODE enmGuestMode = PGMGetGuestMode(pVCpu);
1893 if (pVCpu->hm.s.vmx.enmLastSeenGuestMode != enmGuestMode)
1894 {
1895 /*
1896 * Correct weird requirements for switching to protected mode.
1897 */
1898 if ( pVCpu->hm.s.vmx.enmLastSeenGuestMode == PGMMODE_REAL
1899 && enmGuestMode >= PGMMODE_PROTECTED)
1900 {
1901#ifdef VBOX_WITH_REM
1902 /*
1903 * Flush the recompiler code cache as it's not unlikely the guest will rewrite code
1904 * it will later execute in real mode (OpenBSD 4.0 is one such example)
1905 */
1906 REMFlushTBs(pVM);
1907#endif
1908
1909 /*
1910 * DPL of all hidden selector registers must match the current CPL (0).
1911 */
1912 pCtx->cs.Attr.n.u2Dpl = 0;
1913 pCtx->cs.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
1914
1915 pCtx->ds.Attr.n.u2Dpl = 0;
1916 pCtx->es.Attr.n.u2Dpl = 0;
1917 pCtx->fs.Attr.n.u2Dpl = 0;
1918 pCtx->gs.Attr.n.u2Dpl = 0;
1919 pCtx->ss.Attr.n.u2Dpl = 0;
1920 }
1921 pVCpu->hm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
1922 }
1923 }
1924
1925 VMX_WRITE_SELREG(ES, es);
1926 AssertRC(rc);
1927
1928 VMX_WRITE_SELREG(CS, cs);
1929 AssertRC(rc);
1930
1931 VMX_WRITE_SELREG(SS, ss);
1932 AssertRC(rc);
1933
1934 VMX_WRITE_SELREG(DS, ds);
1935 AssertRC(rc);
1936
1937 VMX_WRITE_SELREG(FS, fs);
1938 AssertRC(rc);
1939
1940 VMX_WRITE_SELREG(GS, gs);
1941 AssertRC(rc);
1942 }
1943
1944 /*
1945 * Guest CPU context: LDTR.
1946 */
1947 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_LDTR)
1948 {
1949 if (pCtx->ldtr.Sel == 0)
1950 {
1951 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1952 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1953 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, 0); /* @todo removing "64" in the function should be the same. */
1954 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1955 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1956 }
1957 else
1958 {
1959 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr.Sel);
1960 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtr.u32Limit);
1961 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtr.u64Base); /* @todo removing "64" and it should be the same */
1962 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtr.Attr.u);
1963 }
1964 AssertRC(rc);
1965 }
1966
1967 /*
1968 * Guest CPU context: TR.
1969 */
1970 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_TR)
1971 {
1972 /*
1973 * Real mode emulation using v86 mode with CR4.VME (interrupt redirection
1974 * using the int bitmap in the TSS).
1975 */
1976 if ( CPUMIsGuestInRealModeEx(pCtx)
1977 && pVM->hm.s.vmx.pRealModeTSS)
1978 {
1979 RTGCPHYS GCPhys;
1980
1981 /* We convert it here every time as PCI regions could be reconfigured. */
1982 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pRealModeTSS, &GCPhys);
1983 AssertRC(rc);
1984
1985 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, 0);
1986 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, HM_VTX_TSS_SIZE);
1987 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1988
1989 X86DESCATTR attr;
1990
1991 attr.u = 0;
1992 attr.n.u1Present = 1;
1993 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1994 val = attr.u;
1995 }
1996 else
1997 {
1998 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr.Sel);
1999 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->tr.u32Limit);
2000 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, pCtx->tr.u64Base);
2001
2002 val = pCtx->tr.Attr.u;
2003
2004 /* The TSS selector must be busy (REM bugs? see defect #XXXX). */
2005 if (!(val & X86_SEL_TYPE_SYS_TSS_BUSY_MASK))
2006 {
2007 if (val & 0xf)
2008 val |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2009 else
2010 /* Default if no TR selector has been set (otherwise vmlaunch will fail!) */
2011 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
2012 }
2013 AssertMsg((val & 0xf) == X86_SEL_TYPE_SYS_386_TSS_BUSY || (val & 0xf) == X86_SEL_TYPE_SYS_286_TSS_BUSY,
2014 ("%#x\n", val));
2015 }
2016 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
2017 AssertRC(rc);
2018 }
2019
2020 /*
2021 * Guest CPU context: GDTR.
2022 */
2023 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_GDTR)
2024 {
2025 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
2026 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
2027 AssertRC(rc);
2028 }
2029
2030 /*
2031 * Guest CPU context: IDTR.
2032 */
2033 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_IDTR)
2034 {
2035 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
2036 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
2037 AssertRC(rc);
2038 }
2039
2040 /*
2041 * Sysenter MSRs.
2042 */
2043 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2044 {
2045 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
2046 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
2047 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
2048 AssertRC(rc);
2049 }
2050
2051 /*
2052 * Guest CPU context: Control registers.
2053 */
2054 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR0)
2055 {
2056 val = pCtx->cr0;
2057 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
2058 Log2(("Guest CR0-shadow %08x\n", val));
2059 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2060 {
2061 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
2062 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
2063 }
2064 else
2065 {
2066 /** @todo check if we support the old style mess correctly. */
2067 if (!(val & X86_CR0_NE))
2068 Log(("Forcing X86_CR0_NE!!!\n"));
2069
2070 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
2071 }
2072 /* Protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
2073 if (!pVM->hm.s.vmx.fUnrestrictedGuest)
2074 val |= X86_CR0_PE | X86_CR0_PG;
2075
2076 if (pVM->hm.s.fNestedPaging)
2077 {
2078 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
2079 {
2080 /* Disable CR3 read/write monitoring as we don't need it for EPT. */
2081 pVCpu->hm.s.vmx.u32ProcCtls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2082 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
2083 }
2084 else
2085 {
2086 /* Reenable CR3 read/write monitoring as our identity mapped page table is active. */
2087 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2088 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2089 }
2090 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2091 AssertRC(rc);
2092 }
2093 else
2094 {
2095 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
2096 val |= X86_CR0_WP;
2097 }
2098
2099 /* Always enable caching. */
2100 val &= ~(X86_CR0_CD|X86_CR0_NW);
2101
2102 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR0, val);
2103 Log2(("Guest CR0 %08x\n", val));
2104
2105 /*
2106 * CR0 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2107 */
2108 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
2109 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
2110 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
2111 | X86_CR0_CD /* Bit not restored during VM-exit! */
2112 | X86_CR0_NW /* Bit not restored during VM-exit! */
2113 | X86_CR0_NE;
2114
2115 /*
2116 * When the guest's FPU state is active, then we no longer care about the FPU related bits.
2117 */
2118 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2119 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_MP;
2120
2121 pVCpu->hm.s.vmx.cr0_mask = val;
2122
2123 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR0_MASK, val);
2124 Log2(("Guest CR0-mask %08x\n", val));
2125 AssertRC(rc);
2126 }
2127
2128 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR4)
2129 {
2130 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
2131 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
2132 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
2133 val = pCtx->cr4 | (uint32_t)pVM->hm.s.vmx.msr.vmx_cr4_fixed0;
2134
2135 if (!pVM->hm.s.fNestedPaging)
2136 {
2137 switch (pVCpu->hm.s.enmShadowMode)
2138 {
2139 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
2140 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
2141 case PGMMODE_32_BIT: /* 32-bit paging. */
2142 val &= ~X86_CR4_PAE;
2143 break;
2144
2145 case PGMMODE_PAE: /* PAE paging. */
2146 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
2147 /** Must use PAE paging as we could use physical memory > 4 GB */
2148 val |= X86_CR4_PAE;
2149 break;
2150
2151 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
2152 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
2153#ifdef VBOX_ENABLE_64_BITS_GUESTS
2154 break;
2155#else
2156 AssertFailed();
2157 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2158#endif
2159 default: /* shut up gcc */
2160 AssertFailed();
2161 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2162 }
2163 }
2164 else if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2165 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2166 {
2167 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
2168 val |= X86_CR4_PSE;
2169 /* Our identity mapping is a 32 bits page directory. */
2170 val &= ~X86_CR4_PAE;
2171 }
2172
2173 /*
2174 * Turn off VME if we're in emulated real mode.
2175 */
2176 if ( CPUMIsGuestInRealModeEx(pCtx)
2177 && pVM->hm.s.vmx.pRealModeTSS)
2178 {
2179 val &= ~X86_CR4_VME;
2180 }
2181
2182 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR4, val);
2183 Log2(("Guest CR4 %08x\n", val));
2184
2185 /*
2186 * CR4 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2187 */
2188 val = 0
2189 | X86_CR4_VME
2190 | X86_CR4_PAE
2191 | X86_CR4_PGE
2192 | X86_CR4_PSE
2193 | X86_CR4_VMXE;
2194 pVCpu->hm.s.vmx.cr4_mask = val;
2195
2196 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR4_MASK, val);
2197 Log2(("Guest CR4-mask %08x\n", val));
2198 AssertRC(rc);
2199 }
2200
2201#if 0
2202 /* Enable single stepping if requested and CPU supports it. */
2203 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG)
2204 if (DBGFIsStepping(pVCpu))
2205 {
2206 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
2207 rc = VMXWriteVmcs(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2208 AssertRC(rc);
2209 }
2210#endif
2211
2212 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR3)
2213 {
2214 if (pVM->hm.s.fNestedPaging)
2215 {
2216 Assert(PGMGetHyperCR3(pVCpu));
2217 pVCpu->hm.s.vmx.GCPhysEPTP = PGMGetHyperCR3(pVCpu);
2218
2219 Assert(!(pVCpu->hm.s.vmx.GCPhysEPTP & 0xfff));
2220 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
2221 pVCpu->hm.s.vmx.GCPhysEPTP |= VMX_EPT_MEMTYPE_WB
2222 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
2223
2224 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.GCPhysEPTP);
2225 AssertRC(rc);
2226
2227 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2228 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2229 {
2230 RTGCPHYS GCPhys;
2231
2232 /* We convert it here every time as PCI regions could be reconfigured. */
2233 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
2234 AssertMsgRC(rc, ("pNonPagingModeEPTPageTable = %RGv\n", pVM->hm.s.vmx.pNonPagingModeEPTPageTable));
2235
2236 /*
2237 * We use our identity mapping page table here as we need to map guest virtual to
2238 * guest physical addresses; EPT will take care of the translation to host physical addresses.
2239 */
2240 val = GCPhys;
2241 }
2242 else
2243 {
2244 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
2245 val = pCtx->cr3;
2246 rc = hmR0VmxLoadPaePdpes(pVCpu, pCtx);
2247 AssertRCReturn(rc, rc);
2248 }
2249 }
2250 else
2251 {
2252 val = PGMGetHyperCR3(pVCpu);
2253 Assert(val || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
2254 }
2255
2256 /* Save our shadow CR3 register. */
2257 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_CR3, val);
2258 AssertRC(rc);
2259 }
2260
2261 /*
2262 * Guest CPU context: Debug registers.
2263 */
2264 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_DEBUG)
2265 {
2266 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
2267 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
2268
2269 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2270 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2271 pCtx->dr[7] |= 0x400; /* must be one */
2272
2273 /* Resync DR7 */
2274 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2275 AssertRC(rc);
2276
2277#ifdef DEBUG
2278 /* Sync the hypervisor debug state now if any breakpoint is armed. */
2279 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
2280 && !CPUMIsHyperDebugStateActive(pVCpu)
2281 && !DBGFIsStepping(pVCpu))
2282 {
2283 /* Save the host and load the hypervisor debug state. */
2284 rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2285 AssertRC(rc);
2286
2287 /* DRx intercepts remain enabled. */
2288
2289 /* Override dr7 with the hypervisor value. */
2290 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, CPUMGetHyperDR7(pVCpu));
2291 AssertRC(rc);
2292 }
2293 else
2294#endif
2295 /* Sync the debug state now if any breakpoint is armed. */
2296 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
2297 && !CPUMIsGuestDebugStateActive(pVCpu)
2298 && !DBGFIsStepping(pVCpu))
2299 {
2300 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2301
2302 /* Disable DRx move intercepts. */
2303 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2304 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2305 AssertRC(rc);
2306
2307 /* Save the host and load the guest debug state. */
2308 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2309 AssertRC(rc);
2310 }
2311
2312 /* IA32_DEBUGCTL MSR. */
2313 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);
2314 AssertRC(rc);
2315
2316 /** @todo do we really ever need this? */
2317 rc |= VMXWriteVmcs(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, 0);
2318 AssertRC(rc);
2319 }
2320
2321 /*
2322 * 64-bit guest mode.
2323 */
2324 if (CPUMIsGuestInLongModeEx(pCtx))
2325 {
2326#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
2327 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2328#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2329 pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
2330#else
2331# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
2332 if (!pVM->hm.s.fAllow64BitGuests)
2333 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2334# endif
2335 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM64;
2336#endif
2337 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2338 {
2339 /* Update these as wrmsr might have changed them. */
2340 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_FS_BASE, pCtx->fs.u64Base);
2341 AssertRC(rc);
2342 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_GS_BASE, pCtx->gs.u64Base);
2343 AssertRC(rc);
2344 }
2345 }
2346 else
2347 {
2348 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
2349 }
2350
2351 hmR0VmxUpdateExceptionBitmap(pVM, pVCpu, pCtx);
2352
2353#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2354 /*
2355 * Store all guest MSRs in the VM-entry load area, so they will be loaded
2356 * during VM-entry and restored into the VM-exit store area during VM-exit.
2357 */
2358 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2359 unsigned idxMsr = 0;
2360
2361 uint32_t u32GstExtFeatures;
2362 uint32_t u32Temp;
2363 CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Temp, &u32Temp, &u32Temp, &u32GstExtFeatures);
2364
2365 if (u32GstExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
2366 {
2367 pMsr->u32IndexMSR = MSR_K6_EFER;
2368 pMsr->u32Reserved = 0;
2369 pMsr->u64Value = pCtx->msrEFER;
2370 /* VT-x will complain if only MSR_K6_EFER_LME is set. */
2371 if (!CPUMIsGuestInLongModeEx(pCtx))
2372 pMsr->u64Value &= ~(MSR_K6_EFER_LMA | MSR_K6_EFER_LME);
2373 pMsr++; idxMsr++;
2374
2375 if (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE)
2376 {
2377 pMsr->u32IndexMSR = MSR_K8_LSTAR;
2378 pMsr->u32Reserved = 0;
2379 pMsr->u64Value = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
2380 pMsr++; idxMsr++;
2381 pMsr->u32IndexMSR = MSR_K6_STAR;
2382 pMsr->u32Reserved = 0;
2383 pMsr->u64Value = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
2384 pMsr++; idxMsr++;
2385 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
2386 pMsr->u32Reserved = 0;
2387 pMsr->u64Value = pCtx->msrSFMASK; /* syscall flag mask */
2388 pMsr++; idxMsr++;
2389
2390 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2391#if 0
2392 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
2393 pMsr->u32Reserved = 0;
2394 pMsr->u64Value = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
2395 pMsr++; idxMsr++;
2396#endif
2397 }
2398 }
2399
2400 if ( pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP
2401 && (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP))
2402 {
2403 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
2404 pMsr->u32Reserved = 0;
2405 rc = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pMsr->u64Value);
2406 AssertRC(rc);
2407 pMsr++; idxMsr++;
2408 }
2409
2410 pVCpu->hm.s.vmx.cGuestMsrs = idxMsr;
2411
2412 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, idxMsr);
2413 AssertRC(rc);
2414
2415 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, idxMsr);
2416 AssertRC(rc);
2417#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2418
2419 /* Done with the major changes */
2420 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_ALL_GUEST;
2421
2422 /* Minimal guest state update (ESP, EIP, EFLAGS mostly) */
2423 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
2424
2425 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
2426 return rc;
2427}
2428
2429
2430/**
2431 * Syncs back the guest state from VMCS.
2432 *
2433 * @returns VBox status code.
2434 * @param pVM Pointer to the VM.
2435 * @param pVCpu Pointer to the VMCPU.
2436 * @param pCtx Pointer to the guest CPU context.
2437 */
2438DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2439{
2440 RTGCUINTREG val, valShadow;
2441 RTGCUINTPTR uInterruptState;
2442 int rc;
2443
2444 /* First sync back EIP, ESP, and EFLAGS. */
2445 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RIP, &val);
2446 AssertRC(rc);
2447 pCtx->rip = val;
2448 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RSP, &val);
2449 AssertRC(rc);
2450 pCtx->rsp = val;
2451 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
2452 AssertRC(rc);
2453 pCtx->eflags.u32 = val;
2454
2455 /* Take care of instruction fusing (sti, mov ss) */
2456 rc |= VMXReadCachedVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
2457 uInterruptState = val;
2458 if (uInterruptState != 0)
2459 {
2460 Assert(uInterruptState <= 2); /* only sti & mov ss */
2461 Log(("uInterruptState %x eip=%RGv\n", (uint32_t)uInterruptState, pCtx->rip));
2462 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
2463 }
2464 else
2465 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2466
2467 /* Control registers. */
2468 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
2469 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR0, &val);
2470 val = (valShadow & pVCpu->hm.s.vmx.cr0_mask) | (val & ~pVCpu->hm.s.vmx.cr0_mask);
2471 CPUMSetGuestCR0(pVCpu, val);
2472
2473 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
2474 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR4, &val);
2475 val = (valShadow & pVCpu->hm.s.vmx.cr4_mask) | (val & ~pVCpu->hm.s.vmx.cr4_mask);
2476 CPUMSetGuestCR4(pVCpu, val);
2477
2478 /*
2479 * No reason to sync back the CRx registers. They can't be changed by the guest unless in
2480 * the nested paging case where CR3 & CR4 can be changed by the guest.
2481 */
2482 if ( pVM->hm.s.fNestedPaging
2483 && CPUMIsGuestInPagedProtectedModeEx(pCtx)) /** @todo check if we will always catch mode switches and such... */
2484 {
2485 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
2486
2487 /* Can be updated behind our back in the nested paging case. */
2488 CPUMSetGuestCR2(pVCpu, pCache->cr2);
2489
2490 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR3, &val);
2491
2492 if (val != pCtx->cr3)
2493 {
2494 CPUMSetGuestCR3(pVCpu, val);
2495 PGMUpdateCR3(pVCpu, val);
2496 }
2497 rc = hmR0VmxSavePaePdpes(pVCpu, pCtx);
2498 AssertRCReturn(rc, rc);
2499 }
2500
2501 /* Sync back DR7. */
2502 VMXReadCachedVmcs(VMX_VMCS_GUEST_DR7, &val);
2503 pCtx->dr[7] = val;
2504
2505 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
2506 VMX_READ_SELREG(ES, es);
2507 VMX_READ_SELREG(SS, ss);
2508 VMX_READ_SELREG(CS, cs);
2509 VMX_READ_SELREG(DS, ds);
2510 VMX_READ_SELREG(FS, fs);
2511 VMX_READ_SELREG(GS, gs);
2512
2513 /* System MSRs */
2514 VMXReadCachedVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
2515 pCtx->SysEnter.cs = val;
2516 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
2517 pCtx->SysEnter.eip = val;
2518 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
2519 pCtx->SysEnter.esp = val;
2520
2521 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
2522 VMX_READ_SELREG(LDTR, ldtr);
2523
2524 VMXReadCachedVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
2525 pCtx->gdtr.cbGdt = val;
2526 VMXReadCachedVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val);
2527 pCtx->gdtr.pGdt = val;
2528
2529 VMXReadCachedVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
2530 pCtx->idtr.cbIdt = val;
2531 VMXReadCachedVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val);
2532 pCtx->idtr.pIdt = val;
2533
2534 /* Real mode emulation using v86 mode. */
2535 if ( CPUMIsGuestInRealModeEx(pCtx)
2536 && pVM->hm.s.vmx.pRealModeTSS)
2537 {
2538 /* Hide our emulation flags */
2539 pCtx->eflags.Bits.u1VM = 0;
2540
2541 /* Restore original IOPL setting as we always use 0. */
2542 pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.eflags.Bits.u2IOPL;
2543
2544 /* Force a TR resync every time in case we switch modes. */
2545 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_TR;
2546 }
2547 else
2548 {
2549 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
2550 VMX_READ_SELREG(TR, tr);
2551 }
2552
2553#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2554 /*
2555 * Save the possibly changed MSRs that we automatically restore and save during a world switch.
2556 */
2557 for (unsigned i = 0; i < pVCpu->hm.s.vmx.cGuestMsrs; i++)
2558 {
2559 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2560 pMsr += i;
2561
2562 switch (pMsr->u32IndexMSR)
2563 {
2564 case MSR_K8_LSTAR:
2565 pCtx->msrLSTAR = pMsr->u64Value;
2566 break;
2567 case MSR_K6_STAR:
2568 pCtx->msrSTAR = pMsr->u64Value;
2569 break;
2570 case MSR_K8_SF_MASK:
2571 pCtx->msrSFMASK = pMsr->u64Value;
2572 break;
2573 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2574#if 0
2575 case MSR_K8_KERNEL_GS_BASE:
2576 pCtx->msrKERNELGSBASE = pMsr->u64Value;
2577 break;
2578#endif
2579 case MSR_K8_TSC_AUX:
2580 CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, pMsr->u64Value);
2581 break;
2582
2583 case MSR_K6_EFER:
2584 /* EFER can't be changed without causing a VM-exit. */
2585 /* Assert(pCtx->msrEFER == pMsr->u64Value); */
2586 break;
2587
2588 default:
2589 AssertFailed();
2590 return VERR_HM_UNEXPECTED_LD_ST_MSR;
2591 }
2592 }
2593#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2594 return VINF_SUCCESS;
2595}
2596
2597
2598/**
2599 * Dummy placeholder for TLB flush handling before VM-entry. Used in the case
2600 * where neither EPT nor VPID is supported by the CPU.
2601 *
2602 * @param pVM Pointer to the VM.
2603 * @param pVCpu Pointer to the VMCPU.
2604 */
2605static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu)
2606{
2607 NOREF(pVM);
2608 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH);
2609 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2610 pVCpu->hm.s.TlbShootdown.cPages = 0;
2611 return;
2612}
2613
2614
2615/**
2616 * Setup the tagged TLB for EPT+VPID.
2617 *
2618 * @param pVM Pointer to the VM.
2619 * @param pVCpu Pointer to the VMCPU.
2620 */
2621static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu)
2622{
2623 PHMGLOBLCPUINFO pCpu;
2624
2625 Assert(pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid);
2626
2627 pCpu = HMR0GetCurrentCpu();
2628
2629 /*
2630 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2631 * This can happen both for start & resume due to long jumps back to ring-3.
2632 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2633 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2634 */
2635 bool fNewAsid = false;
2636 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2637 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2638 {
2639 pVCpu->hm.s.fForceTLBFlush = true;
2640 fNewAsid = true;
2641 }
2642
2643 /*
2644 * Check for explicit TLB shootdowns.
2645 */
2646 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2647 pVCpu->hm.s.fForceTLBFlush = true;
2648
2649 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2650
2651 if (pVCpu->hm.s.fForceTLBFlush)
2652 {
2653 if (fNewAsid)
2654 {
2655 ++pCpu->uCurrentAsid;
2656 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2657 {
2658 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2659 pCpu->cTlbFlushes++;
2660 pCpu->fFlushAsidBeforeUse = true;
2661 }
2662
2663 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2664 if (pCpu->fFlushAsidBeforeUse)
2665 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2666 }
2667 else
2668 {
2669 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
2670 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_SINGLE_CONTEXT, 0 /* GCPtr */);
2671 else
2672 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2673 }
2674
2675 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2676 pVCpu->hm.s.fForceTLBFlush = false;
2677 }
2678 else
2679 {
2680 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2681 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2682 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2683 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2684
2685 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2686 * not be executed. See hmQueueInvlPage() where it is commented
2687 * out. Support individual entry flushing someday. */
2688 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2689 {
2690 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2691
2692 /*
2693 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2694 * as supported by the CPU.
2695 */
2696 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2697 {
2698 for (unsigned i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2699 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2700 }
2701 else
2702 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2703 }
2704 else
2705 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2706 }
2707
2708 pVCpu->hm.s.TlbShootdown.cPages = 0;
2709 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2710
2711 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2712 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2713 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2714 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2715 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2716 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2717
2718 /* Update VMCS with the VPID. */
2719 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2720 AssertRC(rc);
2721}
2722
2723
2724/**
2725 * Setup the tagged TLB for EPT only.
2726 *
2727 * @returns VBox status code.
2728 * @param pVM Pointer to the VM.
2729 * @param pVCpu Pointer to the VMCPU.
2730 */
2731static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu)
2732{
2733 PHMGLOBLCPUINFO pCpu;
2734
2735 Assert(pVM->hm.s.fNestedPaging);
2736 Assert(!pVM->hm.s.vmx.fVpid);
2737
2738 pCpu = HMR0GetCurrentCpu();
2739
2740 /*
2741 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2742 * This can happen both for start & resume due to long jumps back to ring-3.
2743 * A change in the TLB flush count implies the host Cpu is online after a suspend/resume.
2744 */
2745 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2746 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2747 {
2748 pVCpu->hm.s.fForceTLBFlush = true;
2749 }
2750
2751 /*
2752 * Check for explicit TLB shootdown flushes.
2753 */
2754 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2755 pVCpu->hm.s.fForceTLBFlush = true;
2756
2757 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2758 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2759
2760 if (pVCpu->hm.s.fForceTLBFlush)
2761 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2762 else
2763 {
2764 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2765 * not be executed. See hmQueueInvlPage() where it is commented
2766 * out. Support individual entry flushing someday. */
2767 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2768 {
2769 /*
2770 * We cannot flush individual entries without VPID support. Flush using EPT.
2771 */
2772 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2773 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2774 }
2775 }
2776 pVCpu->hm.s.TlbShootdown.cPages= 0;
2777 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2778
2779#ifdef VBOX_WITH_STATISTICS
2780 /** @todo r=ramshankar: this is not accurate anymore with the VPID+EPT
2781 * handling. Should be fixed later. */
2782 if (pVCpu->hm.s.fForceTLBFlush)
2783 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2784 else
2785 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2786#endif
2787}
2788
2789
2790/**
2791 * Setup the tagged TLB for VPID.
2792 *
2793 * @returns VBox status code.
2794 * @param pVM Pointer to the VM.
2795 * @param pVCpu Pointer to the VMCPU.
2796 */
2797static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu)
2798{
2799 PHMGLOBLCPUINFO pCpu;
2800
2801 Assert(pVM->hm.s.vmx.fVpid);
2802 Assert(!pVM->hm.s.fNestedPaging);
2803
2804 pCpu = HMR0GetCurrentCpu();
2805
2806 /*
2807 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2808 * This can happen both for start & resume due to long jumps back to ring-3.
2809 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2810 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2811 */
2812 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2813 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2814 {
2815 /* Force a TLB flush on VM entry. */
2816 pVCpu->hm.s.fForceTLBFlush = true;
2817 }
2818
2819 /*
2820 * Check for explicit TLB shootdown flushes.
2821 */
2822 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2823 pVCpu->hm.s.fForceTLBFlush = true;
2824
2825 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2826
2827 if (pVCpu->hm.s.fForceTLBFlush)
2828 {
2829 ++pCpu->uCurrentAsid;
2830 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2831 {
2832 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2833 pCpu->cTlbFlushes++;
2834 pCpu->fFlushAsidBeforeUse = true;
2835 }
2836
2837 pVCpu->hm.s.fForceTLBFlush = false;
2838 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2839 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2840 if (pCpu->fFlushAsidBeforeUse)
2841 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2842 }
2843 else
2844 {
2845 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2846 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2847 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2848 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2849
2850 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2851 * not be executed. See hmQueueInvlPage() where it is commented
2852 * out. Support individual entry flushing someday. */
2853 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2854 {
2855 /*
2856 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2857 * as supported by the CPU.
2858 */
2859 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2860 {
2861 for (unsigned i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2862 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2863 }
2864 else
2865 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2866 }
2867 }
2868 pVCpu->hm.s.TlbShootdown.cPages = 0;
2869 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2870
2871 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2872 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2873 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2874 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2875 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2876 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2877
2878 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2879 AssertRC(rc);
2880
2881# ifdef VBOX_WITH_STATISTICS
2882 /** @todo r=ramshankar: this is not accurate anymore with EPT+VPID handling.
2883 * Should be fixed later. */
2884 if (pVCpu->hm.s.fForceTLBFlush)
2885 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2886 else
2887 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2888# endif
2889}
2890
2891
2892/**
2893 * Runs guest code in a VT-x VM.
2894 *
2895 * @returns VBox status code.
2896 * @param pVM Pointer to the VM.
2897 * @param pVCpu Pointer to the VMCPU.
2898 * @param pCtx Pointer to the guest CPU context.
2899 */
2900VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2901{
2902 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
2903 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
2904 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
2905
2906 VBOXSTRICTRC rc = VINF_SUCCESS;
2907 int rc2;
2908 RTGCUINTREG val;
2909 RTGCUINTREG exitReason = (RTGCUINTREG)VMX_EXIT_INVALID;
2910 RTGCUINTREG instrError, cbInstr;
2911 RTGCUINTPTR exitQualification = 0;
2912 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
2913 RTGCUINTPTR errCode, instrInfo;
2914 bool fSetupTPRCaching = false;
2915 bool fNeedTscSetup = true;
2916 uint64_t u64OldLSTAR = 0;
2917 uint8_t u8LastTPR = 0;
2918 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
2919 unsigned cResume = 0;
2920#ifdef VBOX_STRICT
2921 RTCPUID idCpuCheck;
2922 bool fWasInLongMode = false;
2923#endif
2924#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2925 uint64_t u64LastTime = RTTimeMilliTS();
2926#endif
2927
2928 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2929 || (pVCpu->hm.s.vmx.pbVirtApic && pVM->hm.s.vmx.pbApicAccess));
2930
2931 /*
2932 * Check if we need to use TPR shadowing.
2933 */
2934 if ( CPUMIsGuestInLongModeEx(pCtx)
2935 || ( (( pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2936 || pVM->hm.s.fTRPPatchingAllowed)
2937 && pVM->hm.s.fHasIoApic)
2938 )
2939 {
2940 fSetupTPRCaching = true;
2941 }
2942
2943 Log2(("\nE"));
2944
2945 /* This is not ideal, but if we don't clear the event injection in the VMCS right here,
2946 * we may end up injecting some stale event into a VM, including injecting an event that
2947 * originated before a VM reset *after* the VM has been reset. See @bugref{6220}.
2948 */
2949 VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, 0);
2950
2951#ifdef VBOX_STRICT
2952 {
2953 RTCCUINTREG val2;
2954
2955 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val2);
2956 AssertRC(rc2);
2957 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val2));
2958
2959 /* allowed zero */
2960 if ((val2 & pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
2961 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
2962
2963 /* allowed one */
2964 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
2965 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
2966
2967 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val2);
2968 AssertRC(rc2);
2969 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val2));
2970
2971 /*
2972 * Must be set according to the MSR, but can be cleared if nested paging is used.
2973 */
2974 if (pVM->hm.s.fNestedPaging)
2975 {
2976 val2 |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
2977 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2978 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2979 }
2980
2981 /* allowed zero */
2982 if ((val2 & pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
2983 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
2984
2985 /* allowed one */
2986 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
2987 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
2988
2989 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val2);
2990 AssertRC(rc2);
2991 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val2));
2992
2993 /* allowed zero */
2994 if ((val2 & pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0)
2995 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
2996
2997 /* allowed one */
2998 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
2999 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
3000
3001 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val2);
3002 AssertRC(rc2);
3003 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val2));
3004
3005 /* allowed zero */
3006 if ((val2 & pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0)
3007 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
3008
3009 /* allowed one */
3010 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
3011 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
3012 }
3013 fWasInLongMode = CPUMIsGuestInLongModeEx(pCtx);
3014#endif /* VBOX_STRICT */
3015
3016#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3017 pVCpu->hm.s.vmx.VMCSCache.u64TimeEntry = RTTimeNanoTS();
3018#endif
3019
3020 /*
3021 * We can jump to this point to resume execution after determining that a VM-exit is innocent.
3022 */
3023ResumeExecution:
3024 if (!STAM_REL_PROFILE_ADV_IS_RUNNING(&pVCpu->hm.s.StatEntry))
3025 STAM_REL_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit2, &pVCpu->hm.s.StatEntry, x);
3026 AssertMsg(pVCpu->hm.s.idEnteredCpu == RTMpCpuId(),
3027 ("Expected %d, I'm %d; cResume=%d exitReason=%RGv exitQualification=%RGv\n",
3028 (int)pVCpu->hm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
3029 Assert(!HMR0SuspendPending());
3030 /* Not allowed to switch modes without reloading the host state (32->64 switcher)!! */
3031 Assert(fWasInLongMode == CPUMIsGuestInLongModeEx(pCtx));
3032
3033 /*
3034 * Safety precaution; looping for too long here can have a very bad effect on the host.
3035 */
3036 if (RT_UNLIKELY(++cResume > pVM->hm.s.cMaxResumeLoops))
3037 {
3038 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMaxResume);
3039 rc = VINF_EM_RAW_INTERRUPT;
3040 goto end;
3041 }
3042
3043 /*
3044 * Check for IRQ inhibition due to instruction fusing (sti, mov ss).
3045 */
3046 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
3047 {
3048 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
3049 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
3050 {
3051 /*
3052 * Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
3053 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
3054 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
3055 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
3056 */
3057 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3058 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3059 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3060 AssertRC(rc2);
3061 }
3062 }
3063 else
3064 {
3065 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3066 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3067 AssertRC(rc2);
3068 }
3069
3070#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
3071 if (RT_UNLIKELY((cResume & 0xf) == 0))
3072 {
3073 uint64_t u64CurTime = RTTimeMilliTS();
3074
3075 if (RT_UNLIKELY(u64CurTime > u64LastTime))
3076 {
3077 u64LastTime = u64CurTime;
3078 TMTimerPollVoid(pVM, pVCpu);
3079 }
3080 }
3081#endif
3082
3083 /*
3084 * Check for pending actions that force us to go back to ring-3.
3085 */
3086 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK | VM_FF_REQUEST | VM_FF_PGM_POOL_FLUSH_PENDING | VM_FF_PDM_DMA)
3087 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL | VMCPU_FF_REQUEST))
3088 {
3089 /* Check if a sync operation is pending. */
3090 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
3091 {
3092 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
3093 if (rc != VINF_SUCCESS)
3094 {
3095 AssertRC(VBOXSTRICTRC_VAL(rc));
3096 Log(("Pending pool sync is forcing us back to ring 3; rc=%d\n", VBOXSTRICTRC_VAL(rc)));
3097 goto end;
3098 }
3099 }
3100
3101#ifdef DEBUG
3102 /* Intercept X86_XCPT_DB if stepping is enabled */
3103 if (!DBGFIsStepping(pVCpu))
3104#endif
3105 {
3106 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK)
3107 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
3108 {
3109 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
3110 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
3111 goto end;
3112 }
3113 }
3114
3115 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
3116 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
3117 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
3118 {
3119 rc = VINF_EM_PENDING_REQUEST;
3120 goto end;
3121 }
3122
3123 /* Check if a pgm pool flush is in progress. */
3124 if (VM_FF_ISPENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
3125 {
3126 rc = VINF_PGM_POOL_FLUSH_PENDING;
3127 goto end;
3128 }
3129
3130 /* Check if DMA work is pending (2nd+ run). */
3131 if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA) && cResume > 1)
3132 {
3133 rc = VINF_EM_RAW_TO_R3;
3134 goto end;
3135 }
3136 }
3137
3138#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3139 /*
3140 * Exit to ring-3 preemption/work is pending.
3141 *
3142 * Interrupts are disabled before the call to make sure we don't miss any interrupt
3143 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
3144 * further down, but hmR0VmxCheckPendingInterrupt makes that impossible.)
3145 *
3146 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
3147 * shootdowns rely on this.
3148 */
3149 uOldEFlags = ASMIntDisableFlags();
3150 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
3151 {
3152 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
3153 rc = VINF_EM_RAW_INTERRUPT;
3154 goto end;
3155 }
3156 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3157#endif
3158
3159 /*
3160 * When external interrupts are pending, we should exit the VM when IF is set.
3161 * Note: *After* VM_FF_INHIBIT_INTERRUPTS check!
3162 */
3163 rc = hmR0VmxCheckPendingInterrupt(pVM, pVCpu, pCtx);
3164 if (RT_FAILURE(rc))
3165 goto end;
3166
3167 /** @todo check timers?? */
3168
3169 /*
3170 * TPR caching using CR8 is only available in 64-bit mode.
3171 * Note: The 32-bit exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but this appears missing in Intel CPUs.
3172 * Note: We can't do this in LoadGuestState() as PDMApicGetTPR can jump back to ring-3 (lock)!! (no longer true) .
3173 */
3174 /** @todo query and update the TPR only when it could have been changed (mmio
3175 * access & wrsmr (x2apic) */
3176 if (fSetupTPRCaching)
3177 {
3178 /* TPR caching in CR8 */
3179 bool fPending;
3180
3181 rc2 = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
3182 AssertRC(rc2);
3183 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
3184 pVCpu->hm.s.vmx.pbVirtApic[0x80] = u8LastTPR;
3185
3186 /*
3187 * Two options here:
3188 * - external interrupt pending, but masked by the TPR value.
3189 * -> a CR8 update that lower the current TPR value should cause an exit
3190 * - no pending interrupts
3191 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
3192 */
3193
3194 /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
3195 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, (fPending) ? (u8LastTPR >> 4) : 0);
3196 AssertRC(VBOXSTRICTRC_VAL(rc));
3197
3198 if (pVM->hm.s.fTPRPatchingActive)
3199 {
3200 Assert(!CPUMIsGuestInLongModeEx(pCtx));
3201 /* Our patch code uses LSTAR for TPR caching. */
3202 pCtx->msrLSTAR = u8LastTPR;
3203
3204 /** @todo r=ramshankar: we should check for MSR-bitmap support here. */
3205 if (fPending)
3206 {
3207 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
3208 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
3209 }
3210 else
3211 {
3212 /*
3213 * No interrupts are pending, so we don't need to be explicitely notified.
3214 * There are enough world switches for detecting pending interrupts.
3215 */
3216 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
3217 }
3218 }
3219 }
3220
3221#ifdef LOG_ENABLED
3222 if ( pVM->hm.s.fNestedPaging
3223 || pVM->hm.s.vmx.fVpid)
3224 {
3225 PHMGLOBLCPUINFO pCpu = HMR0GetCurrentCpu();
3226 if (pVCpu->hm.s.idLastCpu != pCpu->idCpu)
3227 {
3228 LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hm.s.idLastCpu,
3229 pCpu->idCpu));
3230 }
3231 else if (pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
3232 {
3233 LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hm.s.cTlbFlushes,
3234 pCpu->cTlbFlushes));
3235 }
3236 else if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH))
3237 LogFlow(("Manual TLB flush\n"));
3238 }
3239#endif
3240#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
3241 PGMRZDynMapFlushAutoSet(pVCpu);
3242#endif
3243
3244 /*
3245 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING-3!
3246 * (until the actual world switch)
3247 */
3248#ifdef VBOX_STRICT
3249 idCpuCheck = RTMpCpuId();
3250#endif
3251#ifdef LOG_ENABLED
3252 VMMR0LogFlushDisable(pVCpu);
3253#endif
3254
3255 /*
3256 * Save the host state first.
3257 */
3258 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
3259 {
3260 rc = VMXR0SaveHostState(pVM, pVCpu);
3261 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3262 {
3263 VMMR0LogFlushEnable(pVCpu);
3264 goto end;
3265 }
3266 }
3267
3268 /*
3269 * Load the guest state.
3270 */
3271 if (!pVCpu->hm.s.fContextUseFlags)
3272 {
3273 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
3274 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadMinimal);
3275 if (fNeedTscSetup)
3276 {
3277 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3278 fNeedTscSetup = false;
3279 }
3280 }
3281 else
3282 {
3283 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
3284 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3285 {
3286 VMMR0LogFlushEnable(pVCpu);
3287 goto end;
3288 }
3289 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
3290 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3291 }
3292
3293#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3294 /*
3295 * Disable interrupts to make sure a poke will interrupt execution.
3296 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
3297 */
3298 uOldEFlags = ASMIntDisableFlags();
3299 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3300#endif
3301
3302 /* Non-register state Guest Context */
3303 /** @todo change me according to cpu state */
3304 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_VMCS_GUEST_ACTIVITY_ACTIVE);
3305 AssertRC(rc2);
3306
3307 /* Set TLB flush state as checked until we return from the world switch. */
3308 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);
3309 /* Deal with tagged TLB setup and invalidation. */
3310 pVM->hm.s.vmx.pfnFlushTaggedTlb(pVM, pVCpu);
3311
3312 /*
3313 * Manual save and restore:
3314 * - General purpose registers except RIP, RSP
3315 *
3316 * Trashed:
3317 * - CR2 (we don't care)
3318 * - LDTR (reset to 0)
3319 * - DRx (presumably not changed at all)
3320 * - DR7 (reset to 0x400)
3321 * - EFLAGS (reset to RT_BIT(1); not relevant)
3322 */
3323
3324 /* All done! Let's start VM execution. */
3325 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatEntry, &pVCpu->hm.s.StatInGC, x);
3326 Assert(idCpuCheck == RTMpCpuId());
3327
3328#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3329 pVCpu->hm.s.vmx.VMCSCache.cResume = cResume;
3330 pVCpu->hm.s.vmx.VMCSCache.u64TimeSwitch = RTTimeNanoTS();
3331#endif
3332
3333 /*
3334 * Save the current TPR value in the LSTAR MSR so our patches can access it.
3335 */
3336 if (pVM->hm.s.fTPRPatchingActive)
3337 {
3338 Assert(pVM->hm.s.fTPRPatchingActive);
3339 u64OldLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3340 ASMWrMsr(MSR_K8_LSTAR, u8LastTPR);
3341 }
3342
3343 TMNotifyStartOfExecution(pVCpu);
3344
3345#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3346 /*
3347 * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
3348 * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
3349 */
3350 if ( (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3351 && !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3352 {
3353 pVCpu->hm.s.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
3354 uint64_t u64GuestTSCAux = 0;
3355 rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64GuestTSCAux);
3356 AssertRC(rc2);
3357 ASMWrMsr(MSR_K8_TSC_AUX, u64GuestTSCAux);
3358 }
3359#endif
3360
3361#ifdef VBOX_WITH_KERNEL_USING_XMM
3362 rc = hmR0VMXStartVMWrapXMM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu, pVCpu->hm.s.vmx.pfnStartVM);
3363#else
3364 rc = pVCpu->hm.s.vmx.pfnStartVM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu);
3365#endif
3366 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false);
3367 ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits);
3368
3369 /* Possibly the last TSC value seen by the guest (too high) (only when we're in TSC offset mode). */
3370 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3371 {
3372#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3373 /* Restore host's TSC_AUX. */
3374 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3375 ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hm.s.u64HostTSCAux);
3376#endif
3377
3378 TMCpuTickSetLastSeen(pVCpu,
3379 ASMReadTSC() + pVCpu->hm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
3380 }
3381
3382 TMNotifyEndOfExecution(pVCpu);
3383 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
3384 Assert(!(ASMGetFlags() & X86_EFL_IF));
3385
3386 /*
3387 * Restore the host LSTAR MSR if the guest could have changed it.
3388 */
3389 if (pVM->hm.s.fTPRPatchingActive)
3390 {
3391 Assert(pVM->hm.s.fTPRPatchingActive);
3392 pVCpu->hm.s.vmx.pbVirtApic[0x80] = pCtx->msrLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3393 ASMWrMsr(MSR_K8_LSTAR, u64OldLSTAR);
3394 }
3395
3396 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
3397 ASMSetFlags(uOldEFlags);
3398#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3399 uOldEFlags = ~(RTCCUINTREG)0;
3400#endif
3401
3402 AssertMsg(!pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries, ("pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries=%d\n",
3403 pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries));
3404
3405 /* In case we execute a goto ResumeExecution later on. */
3406 pVCpu->hm.s.fResumeVM = true;
3407 pVCpu->hm.s.fForceTLBFlush = false;
3408
3409 /*
3410 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3411 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
3412 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3413 */
3414
3415 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3416 {
3417 hmR0VmxReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
3418 VMMR0LogFlushEnable(pVCpu);
3419 goto end;
3420 }
3421
3422 /* Success. Query the guest state and figure out what has happened. */
3423
3424 /* Investigate why there was a VM-exit. */
3425 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3426 STAM_COUNTER_INC(&pVCpu->hm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
3427
3428 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
3429 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3430 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
3431 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &intInfo);
3432 /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
3433 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE, &errCode);
3434 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_INFO, &instrInfo);
3435 rc2 |= VMXReadCachedVmcs(VMX_VMCS_RO_EXIT_QUALIFICATION, &exitQualification);
3436 AssertRC(rc2);
3437
3438 /*
3439 * Sync back the guest state.
3440 */
3441 rc2 = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
3442 AssertRC(rc2);
3443
3444 /* Note! NOW IT'S SAFE FOR LOGGING! */
3445 VMMR0LogFlushEnable(pVCpu);
3446 Log2(("Raw exit reason %08x\n", exitReason));
3447#if ARCH_BITS == 64 /* for the time being */
3448 VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pCtx, exitReason);
3449#endif
3450
3451 /*
3452 * Check if an injected event was interrupted prematurely.
3453 */
3454 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_INFO, &val);
3455 AssertRC(rc2);
3456 pVCpu->hm.s.Event.u64IntrInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
3457 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3458 /* Ignore 'int xx' as they'll be restarted anyway. */
3459 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
3460 /* Ignore software exceptions (such as int3) as they'll reoccur when we restart the instruction anyway. */
3461 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3462 {
3463 Assert(!pVCpu->hm.s.Event.fPending);
3464 pVCpu->hm.s.Event.fPending = true;
3465 /* Error code present? */
3466 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
3467 {
3468 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_ERROR_CODE, &val);
3469 AssertRC(rc2);
3470 pVCpu->hm.s.Event.u32ErrCode = val;
3471 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv pending error=%RX64\n",
3472 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
3473 }
3474 else
3475 {
3476 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hm.s.Event.u64IntrInfo,
3477 (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3478 pVCpu->hm.s.Event.u32ErrCode = 0;
3479 }
3480 }
3481#ifdef VBOX_STRICT
3482 else if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3483 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
3484 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3485 {
3486 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n",
3487 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3488 }
3489
3490 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
3491 HMDumpRegs(pVM, pVCpu, pCtx);
3492#endif
3493
3494 Log2(("E%d: New EIP=%x:%RGv\n", (uint32_t)exitReason, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3495 Log2(("Exit reason %d, exitQualification %RGv\n", (uint32_t)exitReason, exitQualification));
3496 Log2(("instrInfo=%d instrError=%d instr length=%d\n", (uint32_t)instrInfo, (uint32_t)instrError, (uint32_t)cbInstr));
3497 Log2(("Interruption error code %d\n", (uint32_t)errCode));
3498 Log2(("IntInfo = %08x\n", (uint32_t)intInfo));
3499
3500 /*
3501 * Sync back the TPR if it was changed.
3502 */
3503 if ( fSetupTPRCaching
3504 && u8LastTPR != pVCpu->hm.s.vmx.pbVirtApic[0x80])
3505 {
3506 rc2 = PDMApicSetTPR(pVCpu, pVCpu->hm.s.vmx.pbVirtApic[0x80]);
3507 AssertRC(rc2);
3508 }
3509
3510#ifdef DBGFTRACE_ENABLED /** @todo DTrace later. */
3511 RTTraceBufAddMsgF(pVM->CTX_SUFF(hTraceBuf), "vmexit %08x %016RX64 at %04:%08RX64 %RX64",
3512 exitReason, (uint64_t)exitQualification, pCtx->cs.Sel, pCtx->rip, (uint64_t)intInfo);
3513#endif
3514 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
3515
3516 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
3517 Assert(rc == VINF_SUCCESS); /* might consider VERR_IPE_UNINITIALIZED_STATUS here later... */
3518 switch (exitReason)
3519 {
3520 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
3521 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
3522 {
3523 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
3524
3525 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
3526 {
3527 Assert(exitReason == VMX_EXIT_EXT_INT);
3528 /* External interrupt; leave to allow it to be dispatched again. */
3529 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitExtInt);
3530 rc = VINF_EM_RAW_INTERRUPT;
3531 break;
3532 }
3533 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub3, y3);
3534 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
3535 {
3536 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
3537 /* External interrupt; leave to allow it to be dispatched again. */
3538 rc = VINF_EM_RAW_INTERRUPT;
3539 break;
3540
3541 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT: /* External hardware interrupt. */
3542 AssertFailed(); /* can't come here; fails the first check. */
3543 break;
3544
3545 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT: /* Unknown why we get this type for #DB */
3546 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /* Software exception. (#BP or #OF) */
3547 Assert(vector == 1 || vector == 3 || vector == 4);
3548 /* no break */
3549 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT: /* Hardware exception. */
3550 Log2(("Hardware/software interrupt %d\n", vector));
3551 switch (vector)
3552 {
3553 case X86_XCPT_NM:
3554 {
3555 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
3556
3557 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
3558 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
3559 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
3560 if (rc == VINF_SUCCESS)
3561 {
3562 Assert(CPUMIsGuestFPUStateActive(pVCpu));
3563
3564 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowNM);
3565
3566 /* Continue execution. */
3567 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
3568
3569 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3570 goto ResumeExecution;
3571 }
3572
3573 Log(("Forward #NM fault to the guest\n"));
3574 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNM);
3575 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3576 cbInstr, 0);
3577 AssertRC(rc2);
3578 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3579 goto ResumeExecution;
3580 }
3581
3582 case X86_XCPT_PF: /* Page fault */
3583 {
3584#ifdef VBOX_ALWAYS_TRAP_PF
3585 if (pVM->hm.s.fNestedPaging)
3586 {
3587 /*
3588 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3589 */
3590 Log(("Guest page fault at %RGv cr2=%RGv error code %RGv rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification,
3591 errCode, (RTGCPTR)pCtx->rsp));
3592
3593 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
3594
3595 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3596
3597 /* Now we must update CR2. */
3598 pCtx->cr2 = exitQualification;
3599 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3600 cbInstr, errCode);
3601 AssertRC(rc2);
3602
3603 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3604 goto ResumeExecution;
3605 }
3606#else
3607 Assert(!pVM->hm.s.fNestedPaging);
3608#endif
3609
3610#ifdef VBOX_HM_WITH_GUEST_PATCHING
3611 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
3612 if ( pVM->hm.s.fTRPPatchingAllowed
3613 && pVM->hm.s.pGuestPatchMem
3614 && (exitQualification & 0xfff) == 0x080
3615 && !(errCode & X86_TRAP_PF_P) /* not present */
3616 && CPUMGetGuestCPL(pVCpu) == 0
3617 && !CPUMIsGuestInLongModeEx(pCtx)
3618 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
3619 {
3620 RTGCPHYS GCPhysApicBase, GCPhys;
3621 GCPhysApicBase = pCtx->msrApicBase;
3622 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3623
3624 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3625 if ( rc == VINF_SUCCESS
3626 && GCPhys == GCPhysApicBase)
3627 {
3628 /* Only attempt to patch the instruction once. */
3629 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
3630 if (!pPatch)
3631 {
3632 rc = VINF_EM_HM_PATCH_TPR_INSTR;
3633 break;
3634 }
3635 }
3636 }
3637#endif
3638
3639 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
3640 /* Exit qualification contains the linear address of the page fault. */
3641 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3642 TRPMSetErrorCode(pVCpu, errCode);
3643 TRPMSetFaultAddress(pVCpu, exitQualification);
3644
3645 /* Shortcut for APIC TPR reads and writes. */
3646 if ( (exitQualification & 0xfff) == 0x080
3647 && !(errCode & X86_TRAP_PF_P) /* not present */
3648 && fSetupTPRCaching
3649 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3650 {
3651 RTGCPHYS GCPhysApicBase, GCPhys;
3652 GCPhysApicBase = pCtx->msrApicBase;
3653 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3654
3655 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3656 if ( rc == VINF_SUCCESS
3657 && GCPhys == GCPhysApicBase)
3658 {
3659 Log(("Enable VT-x virtual APIC access filtering\n"));
3660 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
3661 X86_PTE_RW | X86_PTE_P);
3662 AssertRC(rc2);
3663 }
3664 }
3665
3666 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
3667 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
3668 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3669
3670 if (rc == VINF_SUCCESS)
3671 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3672 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
3673 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
3674
3675 TRPMResetTrap(pVCpu);
3676 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3677 goto ResumeExecution;
3678 }
3679 else if (rc == VINF_EM_RAW_GUEST_TRAP)
3680 {
3681 /*
3682 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3683 */
3684 Log2(("Forward page fault to the guest\n"));
3685
3686 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3687 /* The error code might have been changed. */
3688 errCode = TRPMGetErrorCode(pVCpu);
3689
3690 TRPMResetTrap(pVCpu);
3691
3692 /* Now we must update CR2. */
3693 pCtx->cr2 = exitQualification;
3694 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3695 cbInstr, errCode);
3696 AssertRC(rc2);
3697
3698 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3699 goto ResumeExecution;
3700 }
3701#ifdef VBOX_STRICT
3702 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
3703 Log2(("PGMTrap0eHandler failed with %d\n", VBOXSTRICTRC_VAL(rc)));
3704#endif
3705 /* Need to go back to the recompiler to emulate the instruction. */
3706 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPFEM);
3707 TRPMResetTrap(pVCpu);
3708
3709 /* If event delivery caused the #PF (shadow or not), tell TRPM. */
3710 hmR0VmxCheckPendingEvent(pVCpu);
3711 break;
3712 }
3713
3714 case X86_XCPT_MF: /* Floating point exception. */
3715 {
3716 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
3717 if (!(pCtx->cr0 & X86_CR0_NE))
3718 {
3719 /* old style FPU error reporting needs some extra work. */
3720 /** @todo don't fall back to the recompiler, but do it manually. */
3721 rc = VINF_EM_RAW_EMULATE_INSTR;
3722 break;
3723 }
3724 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3725 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3726 cbInstr, errCode);
3727 AssertRC(rc2);
3728
3729 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3730 goto ResumeExecution;
3731 }
3732
3733 case X86_XCPT_DB: /* Debug exception. */
3734 {
3735 uint64_t uDR6;
3736
3737 /*
3738 * DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
3739 *
3740 * Exit qualification bits:
3741 * 3:0 B0-B3 which breakpoint condition was met
3742 * 12:4 Reserved (0)
3743 * 13 BD - debug register access detected
3744 * 14 BS - single step execution or branch taken
3745 * 63:15 Reserved (0)
3746 */
3747 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
3748
3749 /* Note that we don't support guest and host-initiated debugging at the same time. */
3750
3751 uDR6 = X86_DR6_INIT_VAL;
3752 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
3753 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), uDR6);
3754 if (rc == VINF_EM_RAW_GUEST_TRAP)
3755 {
3756 /* Update DR6 here. */
3757 pCtx->dr[6] = uDR6;
3758
3759 /* Resync DR6 if the debug state is active. */
3760 if (CPUMIsGuestDebugStateActive(pVCpu))
3761 ASMSetDR6(pCtx->dr[6]);
3762
3763 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
3764 pCtx->dr[7] &= ~X86_DR7_GD;
3765
3766 /* Paranoia. */
3767 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
3768 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
3769 pCtx->dr[7] |= 0x400; /* must be one */
3770
3771 /* Resync DR7 */
3772 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
3773 AssertRC(rc2);
3774
3775 Log(("Trap %x (debug) at %RGv exit qualification %RX64 dr6=%x dr7=%x\n", vector, (RTGCPTR)pCtx->rip,
3776 exitQualification, (uint32_t)pCtx->dr[6], (uint32_t)pCtx->dr[7]));
3777 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3778 cbInstr, errCode);
3779 AssertRC(rc2);
3780
3781 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3782 goto ResumeExecution;
3783 }
3784 /* Return to ring 3 to deal with the debug exit code. */
3785 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3786 break;
3787 }
3788
3789 case X86_XCPT_BP: /* Breakpoint. */
3790 {
3791 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
3792 rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3793 if (rc == VINF_EM_RAW_GUEST_TRAP)
3794 {
3795 Log(("Guest #BP at %04x:%RGv\n", pCtx->cs.Sel, pCtx->rip));
3796 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3797 cbInstr, errCode);
3798 AssertRC(rc2);
3799 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3800 goto ResumeExecution;
3801 }
3802 if (rc == VINF_SUCCESS)
3803 {
3804 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3805 goto ResumeExecution;
3806 }
3807 Log(("Debugger BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3808 break;
3809 }
3810
3811 case X86_XCPT_GP: /* General protection failure exception. */
3812 {
3813 uint32_t cbOp;
3814 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
3815
3816 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestGP);
3817#ifdef VBOX_STRICT
3818 if ( !CPUMIsGuestInRealModeEx(pCtx)
3819 || !pVM->hm.s.vmx.pRealModeTSS)
3820 {
3821 Log(("Trap %x at %04X:%RGv errorCode=%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip, errCode));
3822 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3823 cbInstr, errCode);
3824 AssertRC(rc2);
3825 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
3826 goto ResumeExecution;
3827 }
3828#endif
3829 Assert(CPUMIsGuestInRealModeEx(pCtx));
3830
3831 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %x:%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3832
3833 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
3834 if (RT_SUCCESS(rc2))
3835 {
3836 bool fUpdateRIP = true;
3837
3838 rc = VINF_SUCCESS;
3839 Assert(cbOp == pDis->cbInstr);
3840 switch (pDis->pCurInstr->uOpcode)
3841 {
3842 case OP_CLI:
3843 pCtx->eflags.Bits.u1IF = 0;
3844 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCli);
3845 break;
3846
3847 case OP_STI:
3848 pCtx->eflags.Bits.u1IF = 1;
3849 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + pDis->cbInstr);
3850 Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
3851 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE,
3852 VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
3853 AssertRC(rc2);
3854 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitSti);
3855 break;
3856
3857 case OP_HLT:
3858 fUpdateRIP = false;
3859 rc = VINF_EM_HALT;
3860 pCtx->rip += pDis->cbInstr;
3861 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
3862 break;
3863
3864 case OP_POPF:
3865 {
3866 RTGCPTR GCPtrStack;
3867 uint32_t cbParm;
3868 uint32_t uMask;
3869 X86EFLAGS eflags;
3870
3871 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3872 {
3873 cbParm = 4;
3874 uMask = 0xffffffff;
3875 }
3876 else
3877 {
3878 cbParm = 2;
3879 uMask = 0xffff;
3880 }
3881
3882 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3883 if (RT_FAILURE(rc2))
3884 {
3885 rc = VERR_EM_INTERPRETER;
3886 break;
3887 }
3888 eflags.u = 0;
3889 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3890 if (RT_FAILURE(rc2))
3891 {
3892 rc = VERR_EM_INTERPRETER;
3893 break;
3894 }
3895 LogFlow(("POPF %x -> %RGv mask=%x\n", eflags.u, pCtx->rsp, uMask));
3896 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3897 | (eflags.u & X86_EFL_POPF_BITS & uMask);
3898 /* RF cleared when popped in real mode; see pushf description in AMD manual. */
3899 pCtx->eflags.Bits.u1RF = 0;
3900 pCtx->esp += cbParm;
3901 pCtx->esp &= uMask;
3902
3903 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPopf);
3904 break;
3905 }
3906
3907 case OP_PUSHF:
3908 {
3909 RTGCPTR GCPtrStack;
3910 uint32_t cbParm;
3911 uint32_t uMask;
3912 X86EFLAGS eflags;
3913
3914 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3915 {
3916 cbParm = 4;
3917 uMask = 0xffffffff;
3918 }
3919 else
3920 {
3921 cbParm = 2;
3922 uMask = 0xffff;
3923 }
3924
3925 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), (pCtx->esp - cbParm) & uMask, 0,
3926 &GCPtrStack);
3927 if (RT_FAILURE(rc2))
3928 {
3929 rc = VERR_EM_INTERPRETER;
3930 break;
3931 }
3932 eflags = pCtx->eflags;
3933 /* RF & VM cleared when pushed in real mode; see pushf description in AMD manual. */
3934 eflags.Bits.u1RF = 0;
3935 eflags.Bits.u1VM = 0;
3936
3937 rc2 = PGMPhysWrite(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3938 if (RT_FAILURE(rc2))
3939 {
3940 rc = VERR_EM_INTERPRETER;
3941 break;
3942 }
3943 LogFlow(("PUSHF %x -> %RGv\n", eflags.u, GCPtrStack));
3944 pCtx->esp -= cbParm;
3945 pCtx->esp &= uMask;
3946 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPushf);
3947 break;
3948 }
3949
3950 case OP_IRET:
3951 {
3952 RTGCPTR GCPtrStack;
3953 uint32_t uMask = 0xffff;
3954 uint16_t aIretFrame[3];
3955
3956 if (pDis->fPrefix & (DISPREFIX_OPSIZE | DISPREFIX_ADDRSIZE))
3957 {
3958 rc = VERR_EM_INTERPRETER;
3959 break;
3960 }
3961
3962 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3963 if (RT_FAILURE(rc2))
3964 {
3965 rc = VERR_EM_INTERPRETER;
3966 break;
3967 }
3968 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &aIretFrame[0], sizeof(aIretFrame));
3969 if (RT_FAILURE(rc2))
3970 {
3971 rc = VERR_EM_INTERPRETER;
3972 break;
3973 }
3974 pCtx->ip = aIretFrame[0];
3975 pCtx->cs.Sel = aIretFrame[1];
3976 pCtx->cs.ValidSel = aIretFrame[1];
3977 pCtx->cs.u64Base = (uint32_t)pCtx->cs.Sel << 4;
3978 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3979 | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
3980 pCtx->sp += sizeof(aIretFrame);
3981
3982 LogFlow(("iret to %04x:%x\n", pCtx->cs.Sel, pCtx->ip));
3983 fUpdateRIP = false;
3984 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIret);
3985 break;
3986 }
3987
3988 case OP_INT:
3989 {
3990 uint32_t intInfo2;
3991
3992 LogFlow(("Realmode: INT %x\n", pDis->Param1.uValue & 0xff));
3993 intInfo2 = pDis->Param1.uValue & 0xff;
3994 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3995 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3996
3997 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3998 AssertRC(VBOXSTRICTRC_VAL(rc));
3999 fUpdateRIP = false;
4000 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4001 break;
4002 }
4003
4004 case OP_INTO:
4005 {
4006 if (pCtx->eflags.Bits.u1OF)
4007 {
4008 uint32_t intInfo2;
4009
4010 LogFlow(("Realmode: INTO\n"));
4011 intInfo2 = X86_XCPT_OF;
4012 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4013 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4014
4015 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4016 AssertRC(VBOXSTRICTRC_VAL(rc));
4017 fUpdateRIP = false;
4018 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4019 }
4020 break;
4021 }
4022
4023 case OP_INT3:
4024 {
4025 uint32_t intInfo2;
4026
4027 LogFlow(("Realmode: INT 3\n"));
4028 intInfo2 = 3;
4029 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4030 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4031
4032 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4033 AssertRC(VBOXSTRICTRC_VAL(rc));
4034 fUpdateRIP = false;
4035 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4036 break;
4037 }
4038
4039 default:
4040 rc = EMInterpretInstructionDisasState(pVCpu, pDis, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR);
4041 fUpdateRIP = false;
4042 break;
4043 }
4044
4045 if (rc == VINF_SUCCESS)
4046 {
4047 if (fUpdateRIP)
4048 pCtx->rip += cbOp; /* Move on to the next instruction. */
4049
4050 /*
4051 * LIDT, LGDT can end up here. In the future CRx changes as well. Just reload the
4052 * whole context to be done with it.
4053 */
4054 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
4055
4056 /* Only resume if successful. */
4057 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4058 goto ResumeExecution;
4059 }
4060 }
4061 else
4062 rc = VERR_EM_INTERPRETER;
4063
4064 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT,
4065 ("Unexpected rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4066 break;
4067 }
4068
4069#ifdef VBOX_STRICT
4070 case X86_XCPT_XF: /* SIMD exception. */
4071 case X86_XCPT_DE: /* Divide error. */
4072 case X86_XCPT_UD: /* Unknown opcode exception. */
4073 case X86_XCPT_SS: /* Stack segment exception. */
4074 case X86_XCPT_NP: /* Segment not present exception. */
4075 {
4076 switch (vector)
4077 {
4078 case X86_XCPT_DE: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDE); break;
4079 case X86_XCPT_UD: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestUD); break;
4080 case X86_XCPT_SS: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestSS); break;
4081 case X86_XCPT_NP: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNP); break;
4082 case X86_XCPT_XF: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXF); break;
4083 }
4084
4085 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
4086 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4087 cbInstr, errCode);
4088 AssertRC(rc2);
4089
4090 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4091 goto ResumeExecution;
4092 }
4093#endif
4094 default:
4095 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXcpUnk);
4096 if ( CPUMIsGuestInRealModeEx(pCtx)
4097 && pVM->hm.s.vmx.pRealModeTSS)
4098 {
4099 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs.Sel, pCtx->eip, errCode));
4100 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4101 cbInstr, errCode);
4102 AssertRC(VBOXSTRICTRC_VAL(rc)); /* Strict RC check below. */
4103
4104 /* Go back to ring-3 in case of a triple fault. */
4105 if ( vector == X86_XCPT_DF
4106 && rc == VINF_EM_RESET)
4107 {
4108 break;
4109 }
4110
4111 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4112 goto ResumeExecution;
4113 }
4114 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
4115 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
4116 break;
4117 } /* switch (vector) */
4118
4119 break;
4120
4121 default:
4122 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
4123 AssertMsgFailed(("Unexpected interruption code %x\n", intInfo));
4124 break;
4125 }
4126
4127 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
4128 break;
4129 }
4130
4131 /*
4132 * 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed
4133 * by the configuration of the EPT paging structures.
4134 */
4135 case VMX_EXIT_EPT_VIOLATION:
4136 {
4137 RTGCPHYS GCPhys;
4138
4139 Assert(pVM->hm.s.fNestedPaging);
4140
4141 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4142 AssertRC(rc2);
4143 Assert(((exitQualification >> 7) & 3) != 2);
4144
4145 /* Determine the kind of violation. */
4146 errCode = 0;
4147 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
4148 errCode |= X86_TRAP_PF_ID;
4149
4150 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
4151 errCode |= X86_TRAP_PF_RW;
4152
4153 /* If the page is present, then it's a page level protection fault. */
4154 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
4155 errCode |= X86_TRAP_PF_P;
4156 else
4157 {
4158 /* Shortcut for APIC TPR reads and writes. */
4159 if ( (GCPhys & 0xfff) == 0x080
4160 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4161 && fSetupTPRCaching
4162 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4163 {
4164 RTGCPHYS GCPhysApicBase;
4165 GCPhysApicBase = pCtx->msrApicBase;
4166 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4167 if (GCPhys == GCPhysApicBase + 0x80)
4168 {
4169 Log(("Enable VT-x virtual APIC access filtering\n"));
4170 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4171 X86_PTE_RW | X86_PTE_P);
4172 AssertRC(rc2);
4173 }
4174 }
4175 }
4176 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
4177
4178 /* GCPhys contains the guest physical address of the page fault. */
4179 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
4180 TRPMSetErrorCode(pVCpu, errCode);
4181 TRPMSetFaultAddress(pVCpu, GCPhys);
4182
4183 /* Handle the pagefault trap for the nested shadow table. */
4184 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
4185
4186 /*
4187 * Same case as PGMR0Trap0eHandlerNPMisconfig(). See comment below, @bugref{6043}.
4188 */
4189 if ( rc == VINF_SUCCESS
4190 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4191 || rc == VERR_PAGE_NOT_PRESENT)
4192 {
4193 /* We've successfully synced our shadow pages, so let's just continue execution. */
4194 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
4195 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf);
4196
4197 TRPMResetTrap(pVCpu);
4198 goto ResumeExecution;
4199 }
4200
4201#ifdef VBOX_STRICT
4202 if (rc != VINF_EM_RAW_EMULATE_INSTR)
4203 LogFlow(("PGMTrap0eHandlerNestedPaging at %RGv failed with %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4204#endif
4205 /* Need to go back to the recompiler to emulate the instruction. */
4206 TRPMResetTrap(pVCpu);
4207 break;
4208 }
4209
4210 case VMX_EXIT_EPT_MISCONFIG:
4211 {
4212 RTGCPHYS GCPhys;
4213
4214 Assert(pVM->hm.s.fNestedPaging);
4215
4216 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4217 AssertRC(rc2);
4218 Log(("VMX_EXIT_EPT_MISCONFIG for %RGp\n", GCPhys));
4219
4220 /* Shortcut for APIC TPR reads and writes. */
4221 if ( (GCPhys & 0xfff) == 0x080
4222 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4223 && fSetupTPRCaching
4224 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4225 {
4226 RTGCPHYS GCPhysApicBase = pCtx->msrApicBase;
4227 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4228 if (GCPhys == GCPhysApicBase + 0x80)
4229 {
4230 Log(("Enable VT-x virtual APIC access filtering\n"));
4231 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4232 X86_PTE_RW | X86_PTE_P);
4233 AssertRC(rc2);
4234 }
4235 }
4236
4237 rc = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, PGMMODE_EPT, CPUMCTX2CORE(pCtx), GCPhys, UINT32_MAX);
4238
4239 /*
4240 * If we succeed, resume execution.
4241 * Or, if fail in interpreting the instruction because we couldn't get the guest physical address
4242 * of the page containing the instruction via the guest's page tables (we would invalidate the guest page
4243 * in the host TLB), resume execution which would cause a guest page fault to let the guest handle this
4244 * weird case. See @bugref{6043}.
4245 */
4246 if ( rc == VINF_SUCCESS
4247 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4248 || rc == VERR_PAGE_NOT_PRESENT)
4249 {
4250 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> resume\n", GCPhys, (RTGCPTR)pCtx->rip));
4251 goto ResumeExecution;
4252 }
4253
4254 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> %Rrc\n", GCPhys, (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4255 break;
4256 }
4257
4258 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window exiting. */
4259 /* Clear VM-exit on IF=1 change. */
4260 LogFlow(("VMX_EXIT_INT_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip,
4261 VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
4262 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
4263 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4264 AssertRC(rc2);
4265 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIntWindow);
4266 goto ResumeExecution; /* we check for pending guest interrupts there */
4267
4268 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
4269 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
4270 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
4271 /* Skip instruction and continue directly. */
4272 pCtx->rip += cbInstr;
4273 /* Continue execution.*/
4274 goto ResumeExecution;
4275
4276 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4277 {
4278 Log2(("VMX: Cpuid %x\n", pCtx->eax));
4279 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
4280 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4281 if (rc == VINF_SUCCESS)
4282 {
4283 /* Update EIP and continue execution. */
4284 Assert(cbInstr == 2);
4285 pCtx->rip += cbInstr;
4286 goto ResumeExecution;
4287 }
4288 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4289 rc = VINF_EM_RAW_EMULATE_INSTR;
4290 break;
4291 }
4292
4293 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4294 {
4295 Log2(("VMX: Rdpmc %x\n", pCtx->ecx));
4296 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
4297 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4298 if (rc == VINF_SUCCESS)
4299 {
4300 /* Update EIP and continue execution. */
4301 Assert(cbInstr == 2);
4302 pCtx->rip += cbInstr;
4303 goto ResumeExecution;
4304 }
4305 rc = VINF_EM_RAW_EMULATE_INSTR;
4306 break;
4307 }
4308
4309 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4310 {
4311 Log2(("VMX: Rdtsc\n"));
4312 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
4313 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4314 if (rc == VINF_SUCCESS)
4315 {
4316 /* Update EIP and continue execution. */
4317 Assert(cbInstr == 2);
4318 pCtx->rip += cbInstr;
4319 fNeedTscSetup = true; /* See @bugref{6634}. */
4320 goto ResumeExecution;
4321 }
4322 rc = VINF_EM_RAW_EMULATE_INSTR;
4323 break;
4324 }
4325
4326 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4327 {
4328 Log2(("VMX: Rdtscp\n"));
4329 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
4330 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
4331 if (rc == VINF_SUCCESS)
4332 {
4333 /* Update EIP and continue execution. */
4334 Assert(cbInstr == 3);
4335 pCtx->rip += cbInstr;
4336 fNeedTscSetup = true; /* See @bugref{6634}. */
4337 goto ResumeExecution;
4338 }
4339 rc = VINF_EM_RAW_EMULATE_INSTR;
4340 break;
4341 }
4342
4343 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4344 {
4345 Log2(("VMX: invlpg\n"));
4346 Assert(!pVM->hm.s.fNestedPaging);
4347
4348 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
4349 rc = EMInterpretInvlpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), exitQualification);
4350 if (rc == VINF_SUCCESS)
4351 {
4352 /* Update EIP and continue execution. */
4353 pCtx->rip += cbInstr;
4354 goto ResumeExecution;
4355 }
4356 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, VBOXSTRICTRC_VAL(rc)));
4357 break;
4358 }
4359
4360 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4361 {
4362 Log2(("VMX: monitor\n"));
4363
4364 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMonitor);
4365 rc = EMInterpretMonitor(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4366 if (rc == VINF_SUCCESS)
4367 {
4368 /* Update EIP and continue execution. */
4369 pCtx->rip += cbInstr;
4370 goto ResumeExecution;
4371 }
4372 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: monitor failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4373 break;
4374 }
4375
4376 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4377 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
4378 if ( pVM->hm.s.fTPRPatchingActive
4379 && pCtx->ecx == MSR_K8_LSTAR)
4380 {
4381 Assert(!CPUMIsGuestInLongModeEx(pCtx));
4382 if ((pCtx->eax & 0xff) != u8LastTPR)
4383 {
4384 Log(("VMX: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
4385
4386 /* Our patch code uses LSTAR for TPR caching. */
4387 rc2 = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
4388 AssertRC(rc2);
4389 }
4390
4391 /* Skip the instruction and continue. */
4392 pCtx->rip += cbInstr; /* wrmsr = [0F 30] */
4393
4394 /* Only resume if successful. */
4395 goto ResumeExecution;
4396 }
4397 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_MSR;
4398 /* no break */
4399 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4400 {
4401 STAM_COUNTER_INC((exitReason == VMX_EXIT_RDMSR) ? &pVCpu->hm.s.StatExitRdmsr : &pVCpu->hm.s.StatExitWrmsr);
4402
4403 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
4404 rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0);
4405 if (rc == VINF_SUCCESS)
4406 {
4407 /* EIP has been updated already. */
4408 /* Only resume if successful. */
4409 goto ResumeExecution;
4410 }
4411 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n",
4412 (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", VBOXSTRICTRC_VAL(rc)));
4413 break;
4414 }
4415
4416 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4417 {
4418 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub2, y2);
4419
4420 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
4421 {
4422 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
4423 {
4424 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
4425 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4426 rc = EMInterpretCRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4427 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
4428 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
4429 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
4430 {
4431 case 0:
4432 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0 | HM_CHANGED_GUEST_CR3;
4433 break;
4434 case 2:
4435 break;
4436 case 3:
4437 Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
4438 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR3;
4439 break;
4440 case 4:
4441 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR4;
4442 break;
4443 case 8:
4444 /* CR8 contains the APIC TPR */
4445 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1
4446 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4447 break;
4448
4449 default:
4450 AssertFailed();
4451 break;
4452 }
4453 break;
4454 }
4455
4456 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
4457 {
4458 Log2(("VMX: mov x, crx\n"));
4459 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4460
4461 Assert( !pVM->hm.s.fNestedPaging
4462 || !CPUMIsGuestInPagedProtectedModeEx(pCtx)
4463 || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != DISCREG_CR3);
4464
4465 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
4466 Assert( VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8
4467 || !(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4468
4469 rc = EMInterpretCRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4470 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
4471 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
4472 break;
4473 }
4474
4475 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
4476 {
4477 Log2(("VMX: clts\n"));
4478 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClts);
4479 rc = EMInterpretCLTS(pVM, pVCpu);
4480 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4481 break;
4482 }
4483
4484 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
4485 {
4486 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
4487 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitLmsw);
4488 rc = EMInterpretLMSW(pVM, pVCpu, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
4489 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4490 break;
4491 }
4492 }
4493
4494 /* Update EIP if no error occurred. */
4495 if (RT_SUCCESS(rc))
4496 pCtx->rip += cbInstr;
4497
4498 if (rc == VINF_SUCCESS)
4499 {
4500 /* Only resume if successful. */
4501 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
4502 goto ResumeExecution;
4503 }
4504 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
4505 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
4506 break;
4507 }
4508
4509 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4510 {
4511 if ( !DBGFIsStepping(pVCpu)
4512 && !CPUMIsHyperDebugStateActive(pVCpu))
4513 {
4514 /* Disable DRx move intercepts. */
4515 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
4516 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4517 AssertRC(rc2);
4518
4519 /* Save the host and load the guest debug state. */
4520 rc2 = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
4521 AssertRC(rc2);
4522
4523#ifdef LOG_ENABLED
4524 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4525 {
4526 Log(("VMX_EXIT_MOV_DRX: write DR%d genreg %d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4527 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4528 }
4529 else
4530 Log(("VMX_EXIT_MOV_DRX: read DR%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification)));
4531#endif
4532
4533#ifdef VBOX_WITH_STATISTICS
4534 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxContextSwitch);
4535 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4536 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4537 else
4538 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4539#endif
4540
4541 goto ResumeExecution;
4542 }
4543
4544 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first
4545 * time and restore DRx registers afterwards */
4546 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4547 {
4548 Log2(("VMX: mov DRx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4549 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4550 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4551 rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4552 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4553 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
4554 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
4555 Log2(("DR7=%08x\n", pCtx->dr[7]));
4556 }
4557 else
4558 {
4559 Log2(("VMX: mov x, DRx\n"));
4560 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4561 rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4562 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
4563 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
4564 }
4565 /* Update EIP if no error occurred. */
4566 if (RT_SUCCESS(rc))
4567 pCtx->rip += cbInstr;
4568
4569 if (rc == VINF_SUCCESS)
4570 {
4571 /* Only resume if successful. */
4572 goto ResumeExecution;
4573 }
4574 Assert(rc == VERR_EM_INTERPRETER);
4575 break;
4576 }
4577
4578 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
4579 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4580 {
4581 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub1, y1);
4582 uint32_t uPort;
4583 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
4584 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
4585
4586 /** @todo necessary to make the distinction? */
4587 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
4588 uPort = pCtx->edx & 0xffff;
4589 else
4590 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
4591
4592 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4)) /* paranoia */
4593 {
4594 rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
4595 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4596 break;
4597 }
4598
4599 uint32_t cbSize = g_aIOSize[uIOWidth];
4600 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
4601 {
4602 /* ins/outs */
4603 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
4604
4605 /* Disassemble manually to deal with segment prefixes. */
4606 /** @todo VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR contains the flat pointer
4607 * operand of the instruction. */
4608 /** @todo VMX_VMCS32_RO_EXIT_INSTR_INFO also contains segment prefix info. */
4609 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL);
4610 if (RT_SUCCESS(rc))
4611 {
4612 if (fIOWrite)
4613 {
4614 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4615 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringWrite);
4616 rc = IOMInterpretOUTSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4617 (DISCPUMODE)pDis->uAddrMode, cbSize);
4618 }
4619 else
4620 {
4621 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4622 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringRead);
4623 rc = IOMInterpretINSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4624 (DISCPUMODE)pDis->uAddrMode, cbSize);
4625 }
4626 }
4627 else
4628 rc = VINF_EM_RAW_EMULATE_INSTR;
4629 }
4630 else
4631 {
4632 /* Normal in/out */
4633 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
4634
4635 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
4636
4637 if (fIOWrite)
4638 {
4639 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOWrite);
4640 rc = IOMIOPortWrite(pVM, pVCpu, uPort, pCtx->eax & uAndVal, cbSize);
4641 if (rc == VINF_IOM_R3_IOPORT_WRITE)
4642 HMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4643 }
4644 else
4645 {
4646 uint32_t u32Val = 0;
4647
4648 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);
4649 rc = IOMIOPortRead(pVM, pVCpu, uPort, &u32Val, cbSize);
4650 if (IOM_SUCCESS(rc))
4651 {
4652 /* Write back to the EAX register. */
4653 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
4654 }
4655 else
4656 if (rc == VINF_IOM_R3_IOPORT_READ)
4657 HMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4658 }
4659 }
4660
4661 /*
4662 * Handled the I/O return codes.
4663 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
4664 */
4665 if (IOM_SUCCESS(rc))
4666 {
4667 /* Update EIP and continue execution. */
4668 pCtx->rip += cbInstr;
4669 if (RT_LIKELY(rc == VINF_SUCCESS))
4670 {
4671 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
4672 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
4673 {
4674 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxIoCheck);
4675 for (unsigned i = 0; i < 4; i++)
4676 {
4677 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
4678
4679 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
4680 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
4681 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
4682 {
4683 uint64_t uDR6;
4684
4685 Assert(CPUMIsGuestDebugStateActive(pVCpu));
4686
4687 uDR6 = ASMGetDR6();
4688
4689 /* Clear all breakpoint status flags and set the one we just hit. */
4690 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
4691 uDR6 |= (uint64_t)RT_BIT(i);
4692
4693 /*
4694 * Note: AMD64 Architecture Programmer's Manual 13.1:
4695 * Bits 15:13 of the DR6 register is never cleared by the processor and must
4696 * be cleared by software after the contents have been read.
4697 */
4698 ASMSetDR6(uDR6);
4699
4700 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
4701 pCtx->dr[7] &= ~X86_DR7_GD;
4702
4703 /* Paranoia. */
4704 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
4705 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
4706 pCtx->dr[7] |= 0x400; /* must be one */
4707
4708 /* Resync DR7 */
4709 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
4710 AssertRC(rc2);
4711
4712 /* Construct inject info. */
4713 intInfo = X86_XCPT_DB;
4714 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4715 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4716
4717 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
4718 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4719 0 /* cbInstr */, 0 /* errCode */);
4720 AssertRC(rc2);
4721
4722 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4723 goto ResumeExecution;
4724 }
4725 }
4726 }
4727 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4728 goto ResumeExecution;
4729 }
4730 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4731 break;
4732 }
4733
4734#ifdef VBOX_STRICT
4735 if (rc == VINF_IOM_R3_IOPORT_READ)
4736 Assert(!fIOWrite);
4737 else if (rc == VINF_IOM_R3_IOPORT_WRITE)
4738 Assert(fIOWrite);
4739 else
4740 {
4741 AssertMsg( RT_FAILURE(rc)
4742 || rc == VINF_EM_RAW_EMULATE_INSTR
4743 || rc == VINF_EM_RAW_GUEST_TRAP
4744 || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4745 }
4746#endif
4747 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
4748 break;
4749 }
4750
4751 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4752 LogFlow(("VMX_EXIT_TPR_BELOW_THRESHOLD\n"));
4753 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
4754 goto ResumeExecution;
4755
4756 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4757 on the APIC-access page. */
4758 {
4759 LogFlow(("VMX_EXIT_APIC_ACCESS\n"));
4760 unsigned uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(exitQualification);
4761
4762 switch (uAccessType)
4763 {
4764 case VMX_APIC_ACCESS_TYPE_LINEAR_READ:
4765 case VMX_APIC_ACCESS_TYPE_LINEAR_WRITE:
4766 {
4767 RTGCPHYS GCPhys = pCtx->msrApicBase;
4768 GCPhys &= PAGE_BASE_GC_MASK;
4769 GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(exitQualification);
4770
4771 LogFlow(("Apic access at %RGp\n", GCPhys));
4772 rc = IOMMMIOPhysHandler(pVM, pVCpu, (uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ) ? 0 : X86_TRAP_PF_RW,
4773 CPUMCTX2CORE(pCtx), GCPhys);
4774 if (rc == VINF_SUCCESS)
4775 goto ResumeExecution; /* rip already updated */
4776 break;
4777 }
4778
4779 default:
4780 rc = VINF_EM_RAW_EMULATE_INSTR;
4781 break;
4782 }
4783 break;
4784 }
4785
4786 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4787 if (!TMTimerPollBool(pVM, pVCpu))
4788 goto ResumeExecution;
4789 rc = VINF_EM_RAW_TIMER_PENDING;
4790 break;
4791
4792 default:
4793 /* The rest is handled after syncing the entire CPU state. */
4794 break;
4795 }
4796
4797
4798 /*
4799 * Note: The guest state is not entirely synced back at this stage!
4800 */
4801
4802 /* Investigate why there was a VM-exit. (part 2) */
4803 switch (exitReason)
4804 {
4805 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
4806 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
4807 case VMX_EXIT_EPT_VIOLATION:
4808 case VMX_EXIT_EPT_MISCONFIG: /* 49 EPT misconfig is used by the PGM/MMIO optimizations. */
4809 case VMX_EXIT_PREEMPTION_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4810 /* Already handled above. */
4811 break;
4812
4813 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
4814 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
4815 break;
4816
4817 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
4818 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
4819 rc = VINF_EM_RAW_INTERRUPT;
4820 AssertFailed(); /* Can't happen. Yet. */
4821 break;
4822
4823 case VMX_EXIT_IO_SMI: /* 5 I/O system-management interrupt (SMI). */
4824 case VMX_EXIT_SMI: /* 6 Other SMI. */
4825 rc = VINF_EM_RAW_INTERRUPT;
4826 AssertFailed(); /* Can't happen afaik. */
4827 break;
4828
4829 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch: too complicated to emulate, so fall back to the recompiler */
4830 Log(("VMX_EXIT_TASK_SWITCH: exit=%RX64\n", exitQualification));
4831 if ( (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(exitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
4832 && pVCpu->hm.s.Event.fPending)
4833 {
4834 /* Caused by an injected interrupt. */
4835 pVCpu->hm.s.Event.fPending = false;
4836
4837 Log(("VMX_EXIT_TASK_SWITCH: reassert trap %d\n", VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo)));
4838 Assert(!VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo));
4839 //@todo: Why do we assume this had to be a hardware interrupt? What about software interrupts or exceptions?
4840 rc2 = TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), TRPM_HARDWARE_INT);
4841 AssertRC(rc2);
4842 }
4843 /* else Exceptions and software interrupts can just be restarted. */
4844 rc = VERR_EM_INTERPRETER;
4845 break;
4846
4847 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
4848 /* Check if external interrupts are pending; if so, don't switch back. */
4849 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
4850 pCtx->rip++; /* skip hlt */
4851 if (EMShouldContinueAfterHalt(pVCpu, pCtx))
4852 goto ResumeExecution;
4853
4854 rc = VINF_EM_HALT;
4855 break;
4856
4857 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
4858 Log2(("VMX: mwait\n"));
4859 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMwait);
4860 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4861 if ( rc == VINF_EM_HALT
4862 || rc == VINF_SUCCESS)
4863 {
4864 /* Update EIP and continue execution. */
4865 pCtx->rip += cbInstr;
4866
4867 /* Check if external interrupts are pending; if so, don't switch back. */
4868 if ( rc == VINF_SUCCESS
4869 || ( rc == VINF_EM_HALT
4870 && EMShouldContinueAfterHalt(pVCpu, pCtx))
4871 )
4872 goto ResumeExecution;
4873 }
4874 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4875 break;
4876
4877 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
4878 AssertFailed(); /* can't happen. */
4879 rc = VERR_EM_INTERPRETER;
4880 break;
4881
4882 case VMX_EXIT_MTF: /* 37 Exit due to Monitor Trap Flag. */
4883 LogFlow(("VMX_EXIT_MTF at %RGv\n", (RTGCPTR)pCtx->rip));
4884 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
4885 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4886 AssertRC(rc2);
4887 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMtf);
4888#if 0
4889 DBGFDoneStepping(pVCpu);
4890#endif
4891 rc = VINF_EM_DBG_STOP;
4892 break;
4893
4894 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
4895 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
4896 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
4897 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
4898 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
4899 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
4900 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
4901 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
4902 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
4903 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
4904 /** @todo inject #UD immediately */
4905 rc = VERR_EM_INTERPRETER;
4906 break;
4907
4908 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4909 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4910 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4911 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4912 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4913 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4914 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4915 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4916 /* already handled above */
4917 AssertMsg( rc == VINF_PGM_CHANGE_MODE
4918 || rc == VINF_EM_RAW_INTERRUPT
4919 || rc == VERR_EM_INTERPRETER
4920 || rc == VINF_EM_RAW_EMULATE_INSTR
4921 || rc == VINF_PGM_SYNC_CR3
4922 || rc == VINF_IOM_R3_IOPORT_READ
4923 || rc == VINF_IOM_R3_IOPORT_WRITE
4924 || rc == VINF_EM_RAW_GUEST_TRAP
4925 || rc == VINF_TRPM_XCPT_DISPATCHED
4926 || rc == VINF_EM_RESCHEDULE_REM,
4927 ("rc = %d\n", VBOXSTRICTRC_VAL(rc)));
4928 break;
4929
4930 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4931 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4932 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4933 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
4934 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4935 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4936 on the APIC-access page. */
4937 {
4938 /*
4939 * If we decided to emulate them here, then we must sync the MSRs that could have been changed (sysenter, FS/GS base)
4940 */
4941 rc = VERR_EM_INTERPRETER;
4942 break;
4943 }
4944
4945 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window. */
4946 Assert(rc == VINF_EM_RAW_INTERRUPT);
4947 break;
4948
4949 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
4950 {
4951#ifdef VBOX_STRICT
4952 RTCCUINTREG val2 = 0;
4953
4954 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
4955
4956 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val2);
4957 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val2));
4958
4959 VMXReadVmcs(VMX_VMCS_GUEST_CR0, &val2);
4960 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", (uint64_t)val2));
4961
4962 VMXReadVmcs(VMX_VMCS_GUEST_CR3, &val2);
4963 Log(("VMX_VMCS_GUEST_CR3 %RX64\n", (uint64_t)val2));
4964
4965 VMXReadVmcs(VMX_VMCS_GUEST_CR4, &val2);
4966 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", (uint64_t)val2));
4967
4968 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val2);
4969 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val2));
4970
4971 VMX_LOG_SELREG(CS, "CS", val2);
4972 VMX_LOG_SELREG(DS, "DS", val2);
4973 VMX_LOG_SELREG(ES, "ES", val2);
4974 VMX_LOG_SELREG(FS, "FS", val2);
4975 VMX_LOG_SELREG(GS, "GS", val2);
4976 VMX_LOG_SELREG(SS, "SS", val2);
4977 VMX_LOG_SELREG(TR, "TR", val2);
4978 VMX_LOG_SELREG(LDTR, "LDTR", val2);
4979
4980 VMXReadVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val2);
4981 Log(("VMX_VMCS_GUEST_GDTR_BASE %RX64\n", (uint64_t)val2));
4982 VMXReadVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val2);
4983 Log(("VMX_VMCS_GUEST_IDTR_BASE %RX64\n", (uint64_t)val2));
4984#endif /* VBOX_STRICT */
4985 rc = VERR_VMX_INVALID_GUEST_STATE;
4986 break;
4987 }
4988
4989 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
4990 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
4991 default:
4992 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
4993 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
4994 break;
4995
4996 }
4997
4998end:
4999 /* We now going back to ring-3, so clear the action flag. */
5000 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
5001
5002 /*
5003 * Signal changes for the recompiler.
5004 */
5005 CPUMSetChangedFlags(pVCpu,
5006 CPUM_CHANGED_SYSENTER_MSR
5007 | CPUM_CHANGED_LDTR
5008 | CPUM_CHANGED_GDTR
5009 | CPUM_CHANGED_IDTR
5010 | CPUM_CHANGED_TR
5011 | CPUM_CHANGED_HIDDEN_SEL_REGS);
5012
5013 /*
5014 * If we executed vmlaunch/vmresume and an external IRQ was pending, then we don't have to do a full sync the next time.
5015 */
5016 if ( exitReason == VMX_EXIT_EXT_INT
5017 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
5018 {
5019 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
5020 /* On the next entry we'll only sync the host context. */
5021 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT;
5022 }
5023 else
5024 {
5025 /* On the next entry we'll sync everything. */
5026 /** @todo we can do better than this */
5027 /* Not in the VINF_PGM_CHANGE_MODE though! */
5028 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
5029 }
5030
5031 /* Translate into a less severe return code */
5032 if (rc == VERR_EM_INTERPRETER)
5033 rc = VINF_EM_RAW_EMULATE_INSTR;
5034 else if (rc == VERR_VMX_INVALID_VMCS_PTR)
5035 {
5036 /* Try to extract more information about what might have gone wrong here. */
5037 VMXGetActivateVMCS(&pVCpu->hm.s.vmx.lasterror.u64VMCSPhys);
5038 pVCpu->hm.s.vmx.lasterror.u32VMCSRevision = *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs;
5039 pVCpu->hm.s.vmx.lasterror.idEnteredCpu = pVCpu->hm.s.idEnteredCpu;
5040 pVCpu->hm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
5041 }
5042
5043 /* Just set the correct state here instead of trying to catch every goto above. */
5044 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
5045
5046#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
5047 /* Restore interrupts if we exited after disabling them. */
5048 if (uOldEFlags != ~(RTCCUINTREG)0)
5049 ASMSetFlags(uOldEFlags);
5050#endif
5051
5052 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5053 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
5054 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5055 Log2(("X"));
5056 return VBOXSTRICTRC_TODO(rc);
5057}
5058
5059
5060/**
5061 * Enters the VT-x session.
5062 *
5063 * @returns VBox status code.
5064 * @param pVM Pointer to the VM.
5065 * @param pVCpu Pointer to the VMCPU.
5066 * @param pCpu Pointer to the CPU info struct.
5067 */
5068VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBLCPUINFO pCpu)
5069{
5070 Assert(pVM->hm.s.vmx.fSupported);
5071 NOREF(pCpu);
5072
5073 unsigned cr4 = ASMGetCR4();
5074 if (!(cr4 & X86_CR4_VMXE))
5075 {
5076 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
5077 return VERR_VMX_X86_CR4_VMXE_CLEARED;
5078 }
5079
5080 /* Activate the VMCS. */
5081 int rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5082 if (RT_FAILURE(rc))
5083 return rc;
5084
5085 pVCpu->hm.s.fResumeVM = false;
5086 return VINF_SUCCESS;
5087}
5088
5089
5090/**
5091 * Leaves the VT-x session.
5092 *
5093 * @returns VBox status code.
5094 * @param pVM Pointer to the VM.
5095 * @param pVCpu Pointer to the VMCPU.
5096 * @param pCtx Pointer to the guests CPU context.
5097 */
5098VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5099{
5100 Assert(pVM->hm.s.vmx.fSupported);
5101
5102#ifdef DEBUG
5103 if (CPUMIsHyperDebugStateActive(pVCpu))
5104 {
5105 CPUMR0LoadHostDebugState(pVM, pVCpu);
5106 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5107 }
5108 else
5109#endif
5110
5111 /*
5112 * Save the guest debug state if necessary.
5113 */
5114 if (CPUMIsGuestDebugStateActive(pVCpu))
5115 {
5116 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
5117
5118 /* Enable DRx move intercepts again. */
5119 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
5120 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
5121 AssertRC(rc);
5122
5123 /* Resync the debug registers the next time. */
5124 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
5125 }
5126 else
5127 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5128
5129 /*
5130 * Clear VMCS, marking it inactive, clearing implementation-specific data and writing
5131 * VMCS data back to memory.
5132 */
5133 int rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5134 AssertRC(rc);
5135
5136 return VINF_SUCCESS;
5137}
5138
5139
5140/**
5141 * Flush the TLB using EPT.
5142 *
5143 * @returns VBox status code.
5144 * @param pVM Pointer to the VM.
5145 * @param pVCpu Pointer to the VMCPU.
5146 * @param enmFlush Type of flush.
5147 */
5148static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush)
5149{
5150 uint64_t descriptor[2];
5151
5152 LogFlow(("hmR0VmxFlushEPT %d\n", enmFlush));
5153 Assert(pVM->hm.s.fNestedPaging);
5154 descriptor[0] = pVCpu->hm.s.vmx.GCPhysEPTP;
5155 descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
5156 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
5157 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.GCPhysEPTP, rc));
5158#ifdef VBOX_WITH_STATISTICS
5159 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
5160#endif
5161}
5162
5163
5164/**
5165 * Flush the TLB using VPID.
5166 *
5167 * @returns VBox status code.
5168 * @param pVM Pointer to the VM.
5169 * @param pVCpu Pointer to the VMCPU (can be NULL depending on @a
5170 * enmFlush).
5171 * @param enmFlush Type of flush.
5172 * @param GCPtr Virtual address of the page to flush (can be 0 depending
5173 * on @a enmFlush).
5174 */
5175static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr)
5176{
5177 uint64_t descriptor[2];
5178
5179 Assert(pVM->hm.s.vmx.fVpid);
5180 if (enmFlush == VMX_FLUSH_VPID_ALL_CONTEXTS)
5181 {
5182 descriptor[0] = 0;
5183 descriptor[1] = 0;
5184 }
5185 else
5186 {
5187 AssertPtr(pVCpu);
5188 AssertMsg(pVCpu->hm.s.uCurrentAsid != 0, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5189 AssertMsg(pVCpu->hm.s.uCurrentAsid <= UINT16_MAX, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5190 descriptor[0] = pVCpu->hm.s.uCurrentAsid;
5191 descriptor[1] = GCPtr;
5192 }
5193 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]); NOREF(rc);
5194 AssertMsg(rc == VINF_SUCCESS,
5195 ("VMXR0InvVPID %x %x %RGv failed with %d\n", enmFlush, pVCpu ? pVCpu->hm.s.uCurrentAsid : 0, GCPtr, rc));
5196#ifdef VBOX_WITH_STATISTICS
5197 if (pVCpu)
5198 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushAsid);
5199#endif
5200}
5201
5202
5203/**
5204 * Invalidates a guest page by guest virtual address. Only relevant for
5205 * EPT/VPID, otherwise there is nothing really to invalidate.
5206 *
5207 * @returns VBox status code.
5208 * @param pVM Pointer to the VM.
5209 * @param pVCpu Pointer to the VMCPU.
5210 * @param GCVirt Guest virtual address of the page to invalidate.
5211 */
5212VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
5213{
5214 bool fFlushPending = VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
5215
5216 Log2(("VMXR0InvalidatePage %RGv\n", GCVirt));
5217
5218 if (!fFlushPending)
5219 {
5220 /*
5221 * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
5222 * See @bugref{6043} and @bugref{6177}
5223 *
5224 * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VMENTRY in hmR0VmxSetupTLB*() as this
5225 * function maybe called in a loop with individual addresses.
5226 */
5227 if (pVM->hm.s.vmx.fVpid)
5228 {
5229 /* If we can flush just this page do it, otherwise flush as little as possible. */
5230 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
5231 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, GCVirt);
5232 else
5233 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5234 }
5235 else if (pVM->hm.s.fNestedPaging)
5236 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5237 }
5238
5239 return VINF_SUCCESS;
5240}
5241
5242
5243/**
5244 * Invalidates a guest page by physical address. Only relevant for EPT/VPID,
5245 * otherwise there is nothing really to invalidate.
5246 *
5247 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
5248 *
5249 * @returns VBox status code.
5250 * @param pVM Pointer to the VM.
5251 * @param pVCpu Pointer to the VMCPU.
5252 * @param GCPhys Guest physical address of the page to invalidate.
5253 */
5254VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
5255{
5256 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
5257
5258 /*
5259 * We cannot flush a page by guest-physical address. invvpid takes only a linear address
5260 * while invept only flushes by EPT not individual addresses. We update the force flag here
5261 * and flush before VMENTRY in hmR0VmxSetupTLB*(). This function might be called in a loop.
5262 */
5263 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5264 return VINF_SUCCESS;
5265}
5266
5267
5268/**
5269 * Report world switch error and dump some useful debug info.
5270 *
5271 * @param pVM Pointer to the VM.
5272 * @param pVCpu Pointer to the VMCPU.
5273 * @param rc Return code.
5274 * @param pCtx Pointer to the current guest CPU context (not updated).
5275 */
5276static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx)
5277{
5278 NOREF(pVM);
5279
5280 switch (VBOXSTRICTRC_VAL(rc))
5281 {
5282 case VERR_VMX_INVALID_VMXON_PTR:
5283 AssertFailed();
5284 break;
5285
5286 case VERR_VMX_UNABLE_TO_START_VM:
5287 case VERR_VMX_UNABLE_TO_RESUME_VM:
5288 {
5289 int rc2;
5290 RTCCUINTREG exitReason, instrError;
5291
5292 rc2 = VMXReadVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
5293 rc2 |= VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
5294 AssertRC(rc2);
5295 if (rc2 == VINF_SUCCESS)
5296 {
5297 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason,
5298 (uint32_t)instrError));
5299 Log(("Current stack %08x\n", &rc2));
5300
5301 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
5302 pVCpu->hm.s.vmx.lasterror.u32ExitReason = exitReason;
5303
5304#ifdef VBOX_STRICT
5305 RTGDTR gdtr;
5306 PCX86DESCHC pDesc;
5307 RTCCUINTREG val;
5308
5309 ASMGetGDTR(&gdtr);
5310
5311 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val);
5312 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
5313 VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val);
5314 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
5315 VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val);
5316 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
5317 VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val);
5318 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
5319 VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val);
5320 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
5321
5322 VMXReadVmcs(VMX_VMCS_HOST_CR0, &val);
5323 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
5324 VMXReadVmcs(VMX_VMCS_HOST_CR3, &val);
5325 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
5326 VMXReadVmcs(VMX_VMCS_HOST_CR4, &val);
5327 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
5328
5329 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_CS, &val);
5330 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
5331 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
5332 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
5333
5334 if (val < gdtr.cbGdt)
5335 {
5336 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5337 HMR0DumpDescriptor(pDesc, val, "CS: ");
5338 }
5339
5340 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_DS, &val);
5341 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
5342 if (val < gdtr.cbGdt)
5343 {
5344 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5345 HMR0DumpDescriptor(pDesc, val, "DS: ");
5346 }
5347
5348 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_ES, &val);
5349 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
5350 if (val < gdtr.cbGdt)
5351 {
5352 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5353 HMR0DumpDescriptor(pDesc, val, "ES: ");
5354 }
5355
5356 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_FS, &val);
5357 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
5358 if (val < gdtr.cbGdt)
5359 {
5360 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5361 HMR0DumpDescriptor(pDesc, val, "FS: ");
5362 }
5363
5364 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_GS, &val);
5365 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
5366 if (val < gdtr.cbGdt)
5367 {
5368 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5369 HMR0DumpDescriptor(pDesc, val, "GS: ");
5370 }
5371
5372 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_SS, &val);
5373 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
5374 if (val < gdtr.cbGdt)
5375 {
5376 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5377 HMR0DumpDescriptor(pDesc, val, "SS: ");
5378 }
5379
5380 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_TR, &val);
5381 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
5382 if (val < gdtr.cbGdt)
5383 {
5384 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5385 HMR0DumpDescriptor(pDesc, val, "TR: ");
5386 }
5387
5388 VMXReadVmcs(VMX_VMCS_HOST_TR_BASE, &val);
5389 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
5390 VMXReadVmcs(VMX_VMCS_HOST_GDTR_BASE, &val);
5391 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
5392 VMXReadVmcs(VMX_VMCS_HOST_IDTR_BASE, &val);
5393 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
5394 VMXReadVmcs(VMX_VMCS32_HOST_SYSENTER_CS, &val);
5395 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
5396 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_EIP, &val);
5397 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
5398 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_ESP, &val);
5399 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
5400 VMXReadVmcs(VMX_VMCS_HOST_RSP, &val);
5401 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
5402 VMXReadVmcs(VMX_VMCS_HOST_RIP, &val);
5403 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
5404# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5405 if (VMX_IS_64BIT_HOST_MODE())
5406 {
5407 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
5408 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
5409 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
5410 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
5411 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
5412 Log(("MSR_K8_KERNEL_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_KERNEL_GS_BASE)));
5413 }
5414# endif
5415#endif /* VBOX_STRICT */
5416 }
5417 break;
5418 }
5419
5420 default:
5421 /* impossible */
5422 AssertMsgFailed(("%Rrc (%#x)\n", VBOXSTRICTRC_VAL(rc), VBOXSTRICTRC_VAL(rc)));
5423 break;
5424 }
5425}
5426
5427
5428#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5429/**
5430 * Prepares for and executes VMLAUNCH (64 bits guest mode).
5431 *
5432 * @returns VBox status code.
5433 * @param fResume Whether to vmlauch/vmresume.
5434 * @param pCtx Pointer to the guest CPU context.
5435 * @param pCache Pointer to the VMCS cache.
5436 * @param pVM Pointer to the VM.
5437 * @param pVCpu Pointer to the VMCPU.
5438 */
5439DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu)
5440{
5441 uint32_t aParam[6];
5442 PHMGLOBLCPUINFO pCpu;
5443 RTHCPHYS HCPhysCpuPage;
5444 int rc;
5445
5446 pCpu = HMR0GetCurrentCpu();
5447 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5448
5449#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5450 pCache->uPos = 1;
5451 pCache->interPD = PGMGetInterPaeCR3(pVM);
5452 pCache->pSwitcher = (uint64_t)pVM->hm.s.pfnHost32ToGuest64R0;
5453#endif
5454
5455#ifdef DEBUG
5456 pCache->TestIn.HCPhysCpuPage= 0;
5457 pCache->TestIn.HCPhysVmcs = 0;
5458 pCache->TestIn.pCache = 0;
5459 pCache->TestOut.HCPhysVmcs = 0;
5460 pCache->TestOut.pCache = 0;
5461 pCache->TestOut.pCtx = 0;
5462 pCache->TestOut.eflags = 0;
5463#endif
5464
5465 aParam[0] = (uint32_t)(HCPhysCpuPage); /* Param 1: VMXON physical address - Lo. */
5466 aParam[1] = (uint32_t)(HCPhysCpuPage >> 32); /* Param 1: VMXON physical address - Hi. */
5467 aParam[2] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs); /* Param 2: VMCS physical address - Lo. */
5468 aParam[3] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs >> 32); /* Param 2: VMCS physical address - Hi. */
5469 aParam[4] = VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache);
5470 aParam[5] = 0;
5471
5472#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5473 pCtx->dr[4] = pVM->hm.s.vmx.pScratchPhys + 16 + 8;
5474 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 1;
5475#endif
5476 rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hm.s.pfnVMXGCStartVM64, 6, &aParam[0]);
5477
5478#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5479 Assert(*(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) == 5);
5480 Assert(pCtx->dr[4] == 10);
5481 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 0xff;
5482#endif
5483
5484#ifdef DEBUG
5485 AssertMsg(pCache->TestIn.HCPhysCpuPage== HCPhysCpuPage, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysCpuPage, HCPhysCpuPage));
5486 AssertMsg(pCache->TestIn.HCPhysVmcs == pVCpu->hm.s.vmx.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5487 pVCpu->hm.s.vmx.HCPhysVmcs));
5488 AssertMsg(pCache->TestIn.HCPhysVmcs == pCache->TestOut.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5489 pCache->TestOut.HCPhysVmcs));
5490 AssertMsg(pCache->TestIn.pCache == pCache->TestOut.pCache, ("%RGv vs %RGv\n", pCache->TestIn.pCache,
5491 pCache->TestOut.pCache));
5492 AssertMsg(pCache->TestIn.pCache == VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache),
5493 ("%RGv vs %RGv\n", pCache->TestIn.pCache, VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache)));
5494 AssertMsg(pCache->TestIn.pCtx == pCache->TestOut.pCtx, ("%RGv vs %RGv\n", pCache->TestIn.pCtx,
5495 pCache->TestOut.pCtx));
5496 Assert(!(pCache->TestOut.eflags & X86_EFL_IF));
5497#endif
5498 return rc;
5499}
5500
5501
5502# ifdef VBOX_STRICT
5503static bool hmR0VmxIsValidReadField(uint32_t idxField)
5504{
5505 switch (idxField)
5506 {
5507 case VMX_VMCS_GUEST_RIP:
5508 case VMX_VMCS_GUEST_RSP:
5509 case VMX_VMCS_GUEST_RFLAGS:
5510 case VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE:
5511 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
5512 case VMX_VMCS_GUEST_CR0:
5513 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
5514 case VMX_VMCS_GUEST_CR4:
5515 case VMX_VMCS_GUEST_DR7:
5516 case VMX_VMCS32_GUEST_SYSENTER_CS:
5517 case VMX_VMCS_GUEST_SYSENTER_EIP:
5518 case VMX_VMCS_GUEST_SYSENTER_ESP:
5519 case VMX_VMCS32_GUEST_GDTR_LIMIT:
5520 case VMX_VMCS_GUEST_GDTR_BASE:
5521 case VMX_VMCS32_GUEST_IDTR_LIMIT:
5522 case VMX_VMCS_GUEST_IDTR_BASE:
5523 case VMX_VMCS16_GUEST_FIELD_CS:
5524 case VMX_VMCS32_GUEST_CS_LIMIT:
5525 case VMX_VMCS_GUEST_CS_BASE:
5526 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
5527 case VMX_VMCS16_GUEST_FIELD_DS:
5528 case VMX_VMCS32_GUEST_DS_LIMIT:
5529 case VMX_VMCS_GUEST_DS_BASE:
5530 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
5531 case VMX_VMCS16_GUEST_FIELD_ES:
5532 case VMX_VMCS32_GUEST_ES_LIMIT:
5533 case VMX_VMCS_GUEST_ES_BASE:
5534 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
5535 case VMX_VMCS16_GUEST_FIELD_FS:
5536 case VMX_VMCS32_GUEST_FS_LIMIT:
5537 case VMX_VMCS_GUEST_FS_BASE:
5538 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
5539 case VMX_VMCS16_GUEST_FIELD_GS:
5540 case VMX_VMCS32_GUEST_GS_LIMIT:
5541 case VMX_VMCS_GUEST_GS_BASE:
5542 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
5543 case VMX_VMCS16_GUEST_FIELD_SS:
5544 case VMX_VMCS32_GUEST_SS_LIMIT:
5545 case VMX_VMCS_GUEST_SS_BASE:
5546 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
5547 case VMX_VMCS16_GUEST_FIELD_LDTR:
5548 case VMX_VMCS32_GUEST_LDTR_LIMIT:
5549 case VMX_VMCS_GUEST_LDTR_BASE:
5550 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
5551 case VMX_VMCS16_GUEST_FIELD_TR:
5552 case VMX_VMCS32_GUEST_TR_LIMIT:
5553 case VMX_VMCS_GUEST_TR_BASE:
5554 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
5555 case VMX_VMCS32_RO_EXIT_REASON:
5556 case VMX_VMCS32_RO_VM_INSTR_ERROR:
5557 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
5558 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
5559 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
5560 case VMX_VMCS32_RO_EXIT_INSTR_INFO:
5561 case VMX_VMCS_RO_EXIT_QUALIFICATION:
5562 case VMX_VMCS32_RO_IDT_INFO:
5563 case VMX_VMCS32_RO_IDT_ERROR_CODE:
5564 case VMX_VMCS_GUEST_CR3:
5565 case VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL:
5566 return true;
5567 }
5568 return false;
5569}
5570
5571
5572static bool hmR0VmxIsValidWriteField(uint32_t idxField)
5573{
5574 switch (idxField)
5575 {
5576 case VMX_VMCS_GUEST_LDTR_BASE:
5577 case VMX_VMCS_GUEST_TR_BASE:
5578 case VMX_VMCS_GUEST_GDTR_BASE:
5579 case VMX_VMCS_GUEST_IDTR_BASE:
5580 case VMX_VMCS_GUEST_SYSENTER_EIP:
5581 case VMX_VMCS_GUEST_SYSENTER_ESP:
5582 case VMX_VMCS_GUEST_CR0:
5583 case VMX_VMCS_GUEST_CR4:
5584 case VMX_VMCS_GUEST_CR3:
5585 case VMX_VMCS_GUEST_DR7:
5586 case VMX_VMCS_GUEST_RIP:
5587 case VMX_VMCS_GUEST_RSP:
5588 case VMX_VMCS_GUEST_CS_BASE:
5589 case VMX_VMCS_GUEST_DS_BASE:
5590 case VMX_VMCS_GUEST_ES_BASE:
5591 case VMX_VMCS_GUEST_FS_BASE:
5592 case VMX_VMCS_GUEST_GS_BASE:
5593 case VMX_VMCS_GUEST_SS_BASE:
5594 return true;
5595 }
5596 return false;
5597}
5598# endif /* VBOX_STRICT */
5599
5600
5601/**
5602 * Executes the specified handler in 64-bit mode.
5603 *
5604 * @returns VBox status code.
5605 * @param pVM Pointer to the VM.
5606 * @param pVCpu Pointer to the VMCPU.
5607 * @param pCtx Pointer to the guest CPU context.
5608 * @param pfnHandler Pointer to the RC handler function.
5609 * @param cbParam Number of parameters.
5610 * @param paParam Array of 32-bit parameters.
5611 */
5612VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam,
5613 uint32_t *paParam)
5614{
5615 int rc, rc2;
5616 PHMGLOBLCPUINFO pCpu;
5617 RTHCPHYS HCPhysCpuPage;
5618 RTHCUINTREG uOldEFlags;
5619
5620 AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
5621 Assert(pfnHandler);
5622 Assert(pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Write.aField));
5623 Assert(pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Read.aField));
5624
5625#ifdef VBOX_STRICT
5626 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries;i++)
5627 Assert(hmR0VmxIsValidWriteField(pVCpu->hm.s.vmx.VMCSCache.Write.aField[i]));
5628
5629 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries;i++)
5630 Assert(hmR0VmxIsValidReadField(pVCpu->hm.s.vmx.VMCSCache.Read.aField[i]));
5631#endif
5632
5633 /* Disable interrupts. */
5634 uOldEFlags = ASMIntDisableFlags();
5635
5636#ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
5637 RTCPUID idHostCpu = RTMpCpuId();
5638 CPUMR0SetLApic(pVM, idHostCpu);
5639#endif
5640
5641 pCpu = HMR0GetCurrentCpu();
5642 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5643
5644 /* Clear VMCS. Marking it inactive, clearing implementation-specific data and writing VMCS data back to memory. */
5645 VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5646
5647 /* Leave VMX Root Mode. */
5648 VMXDisable();
5649
5650 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5651
5652 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
5653 CPUMSetHyperEIP(pVCpu, pfnHandler);
5654 for (int i=(int)cbParam-1;i>=0;i--)
5655 CPUMPushHyper(pVCpu, paParam[i]);
5656
5657 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
5658
5659 /* Call switcher. */
5660 rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
5661 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
5662
5663 /* Make sure the VMX instructions don't cause #UD faults. */
5664 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
5665
5666 /* Enter VMX Root Mode */
5667 rc2 = VMXEnable(HCPhysCpuPage);
5668 if (RT_FAILURE(rc2))
5669 {
5670 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5671 ASMSetFlags(uOldEFlags);
5672 return VERR_VMX_VMXON_FAILED;
5673 }
5674
5675 rc2 = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5676 AssertRC(rc2);
5677 Assert(!(ASMGetFlags() & X86_EFL_IF));
5678 ASMSetFlags(uOldEFlags);
5679 return rc;
5680}
5681#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL) */
5682
5683
5684#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5685/**
5686 * Executes VMWRITE.
5687 *
5688 * @returns VBox status code
5689 * @param pVCpu Pointer to the VMCPU.
5690 * @param idxField VMCS field index.
5691 * @param u64Val 16, 32 or 64 bits value.
5692 */
5693VMMR0DECL(int) VMXWriteVmcs64Ex(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5694{
5695 int rc;
5696 switch (idxField)
5697 {
5698 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
5699 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
5700 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
5701 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
5702 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
5703 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
5704 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
5705 case VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL:
5706 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
5707 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
5708 case VMX_VMCS64_GUEST_PDPTE0_FULL:
5709 case VMX_VMCS64_GUEST_PDPTE1_FULL:
5710 case VMX_VMCS64_GUEST_PDPTE2_FULL:
5711 case VMX_VMCS64_GUEST_PDPTE3_FULL:
5712 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
5713 case VMX_VMCS64_GUEST_EFER_FULL:
5714 case VMX_VMCS64_CTRL_EPTP_FULL:
5715 /* These fields consist of two parts, which are both writable in 32 bits mode. */
5716 rc = VMXWriteVmcs32(idxField, u64Val);
5717 rc |= VMXWriteVmcs32(idxField + 1, (uint32_t)(u64Val >> 32ULL));
5718 AssertRC(rc);
5719 return rc;
5720
5721 case VMX_VMCS_GUEST_LDTR_BASE:
5722 case VMX_VMCS_GUEST_TR_BASE:
5723 case VMX_VMCS_GUEST_GDTR_BASE:
5724 case VMX_VMCS_GUEST_IDTR_BASE:
5725 case VMX_VMCS_GUEST_SYSENTER_EIP:
5726 case VMX_VMCS_GUEST_SYSENTER_ESP:
5727 case VMX_VMCS_GUEST_CR0:
5728 case VMX_VMCS_GUEST_CR4:
5729 case VMX_VMCS_GUEST_CR3:
5730 case VMX_VMCS_GUEST_DR7:
5731 case VMX_VMCS_GUEST_RIP:
5732 case VMX_VMCS_GUEST_RSP:
5733 case VMX_VMCS_GUEST_CS_BASE:
5734 case VMX_VMCS_GUEST_DS_BASE:
5735 case VMX_VMCS_GUEST_ES_BASE:
5736 case VMX_VMCS_GUEST_FS_BASE:
5737 case VMX_VMCS_GUEST_GS_BASE:
5738 case VMX_VMCS_GUEST_SS_BASE:
5739 /* Queue a 64 bits value as we can't set it in 32 bits host mode. */
5740 if (u64Val >> 32ULL)
5741 rc = VMXWriteCachedVmcsEx(pVCpu, idxField, u64Val);
5742 else
5743 rc = VMXWriteVmcs32(idxField, (uint32_t)u64Val);
5744
5745 return rc;
5746
5747 default:
5748 AssertMsgFailed(("Unexpected field %x\n", idxField));
5749 return VERR_INVALID_PARAMETER;
5750 }
5751}
5752
5753
5754/**
5755 * Cache VMCS writes for running 64 bits guests on 32 bits hosts.
5756 *
5757 * @param pVCpu Pointer to the VMCPU.
5758 * @param idxField VMCS field index.
5759 * @param u64Val 16, 32 or 64 bits value.
5760 */
5761VMMR0DECL(int) VMXWriteCachedVmcsEx(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5762{
5763 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
5764
5765 AssertMsgReturn(pCache->Write.cValidEntries < VMCSCACHE_MAX_ENTRY - 1,
5766 ("entries=%x\n", pCache->Write.cValidEntries), VERR_ACCESS_DENIED);
5767
5768 /* Make sure there are no duplicates. */
5769 for (unsigned i = 0; i < pCache->Write.cValidEntries; i++)
5770 {
5771 if (pCache->Write.aField[i] == idxField)
5772 {
5773 pCache->Write.aFieldVal[i] = u64Val;
5774 return VINF_SUCCESS;
5775 }
5776 }
5777
5778 pCache->Write.aField[pCache->Write.cValidEntries] = idxField;
5779 pCache->Write.aFieldVal[pCache->Write.cValidEntries] = u64Val;
5780 pCache->Write.cValidEntries++;
5781 return VINF_SUCCESS;
5782}
5783
5784#endif /* HC_ARCH_BITS == 32 && !VBOX_WITH_HYBRID_32BIT_KERNEL */
5785
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette