VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 45623

Last change on this file since 45623 was 45531, checked in by vboxsync, 12 years ago

VMMR0/HMVMXR0: Redo of VT-x event injection. Some STAM cleanup.
VMM: TRPM enhancements to include instruction-length information for software interrupts and exceptions (#BP, #OF).

  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 228.7 KB
Line 
1/* $Id: HWVMXR0.cpp 45531 2013-04-13 09:01:30Z vboxsync $ */
2/** @file
3 * HM VMX (VT-x) - Host Context Ring-0.
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_HM
23#include <iprt/asm-amd64-x86.h>
24#include <VBox/vmm/hm.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/dbgf.h>
27#include <VBox/vmm/dbgftrace.h>
28#include <VBox/vmm/selm.h>
29#include <VBox/vmm/iom.h>
30#ifdef VBOX_WITH_REM
31# include <VBox/vmm/rem.h>
32#endif
33#include <VBox/vmm/tm.h>
34#include "HMInternal.h"
35#include <VBox/vmm/vm.h>
36#include <VBox/vmm/pdmapi.h>
37#include <VBox/err.h>
38#include <VBox/log.h>
39#include <iprt/assert.h>
40#include <iprt/param.h>
41#include <iprt/string.h>
42#include <iprt/time.h>
43#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
44# include <iprt/thread.h>
45#endif
46#include <iprt/x86.h>
47#include "HWVMXR0.h"
48
49#include "dtrace/VBoxVMM.h"
50
51
52/*******************************************************************************
53* Defined Constants And Macros *
54*******************************************************************************/
55#if defined(RT_ARCH_AMD64)
56# define VMX_IS_64BIT_HOST_MODE() (true)
57#elif defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
58# define VMX_IS_64BIT_HOST_MODE() (g_fVMXIs64bitHost != 0)
59#else
60# define VMX_IS_64BIT_HOST_MODE() (false)
61#endif
62
63# define VMX_WRITE_SELREG(REG, reg) \
64 do \
65 { \
66 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_##REG, pCtx->reg.Sel); \
67 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, pCtx->reg.u32Limit); \
68 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_##REG##_BASE, pCtx->reg.u64Base); \
69 if ((pCtx->eflags.u32 & X86_EFL_VM)) \
70 { \
71 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
72 /* DPL=3, present, code/data, r/w/accessed. */ \
73 /** @todo we shouldn't have to do this, if it is not 0xf3 it means we screwed up elsewhere (recompiler). */ \
74 /** @todo VT-x docs explicitly mentions 0xF3. Why not just val = 0xf3 ??. */ \
75 val = (pCtx->reg.Attr.u & ~0xFF) | 0xF3; \
76 } \
77 else \
78 if ( CPUMIsGuestInRealModeEx(pCtx) \
79 && !pVM->hm.s.vmx.fUnrestrictedGuest) \
80 { \
81 /** @todo shouldn't the 'if' condition above check for 'pRealModeTSS' ? */ \
82 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
83 /* DPL=3, present, code/data, r/w/accessed. */ \
84 val = 0xf3; \
85 } \
86 else \
87 if ( ( pCtx->reg.Sel \
88 || !CPUMIsGuestInPagedProtectedModeEx(pCtx) \
89 || (!pCtx->cs.Attr.n.u1DefBig && !CPUMIsGuestIn64BitCodeEx(pCtx)) \
90 ) \
91 && pCtx->reg.Attr.n.u1Present == 1) \
92 { \
93 val = pCtx->reg.Attr.u | X86_SEL_TYPE_ACCESSED; \
94 } \
95 else \
96 val = 0x10000; /* Invalid guest state error otherwise. (BIT(16) = Unusable) */ \
97 \
98 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, val); \
99 } while (0)
100
101# define VMX_READ_SELREG(REG, reg) \
102 do \
103 { \
104 VMXReadCachedVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &val); \
105 pCtx->reg.Sel = val; \
106 pCtx->reg.ValidSel = val; \
107 pCtx->reg.fFlags = CPUMSELREG_FLAGS_VALID; \
108 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &val); \
109 pCtx->reg.u32Limit = val; \
110 VMXReadCachedVmcs(VMX_VMCS_GUEST_##REG##_BASE, &val); \
111 pCtx->reg.u64Base = val; \
112 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &val); \
113 pCtx->reg.Attr.u = val; \
114 } while (0)
115
116/* Don't read from the cache in this macro; used only in case of failure where the cache is out of sync. */
117# define VMX_LOG_SELREG(REG, szSelReg, val) \
118 do \
119 { \
120 VMXReadVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &(val)); \
121 Log(("%s Selector %x\n", szSelReg, (val))); \
122 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &(val)); \
123 Log(("%s Limit %x\n", szSelReg, (val))); \
124 VMXReadVmcs(VMX_VMCS_GUEST_##REG##_BASE, &(val)); \
125 Log(("%s Base %RX64\n", szSelReg, (uint64_t)(val))); \
126 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &(val)); \
127 Log(("%s Attributes %x\n", szSelReg, (val))); \
128 } while (0)
129
130#define VMXSetupCachedReadVmcs(pCache, idxField) \
131{ \
132 Assert(pCache->Read.aField[idxField##_CACHE_IDX] == 0); \
133 pCache->Read.aField[idxField##_CACHE_IDX] = idxField; \
134 pCache->Read.aFieldVal[idxField##_CACHE_IDX] = 0; \
135}
136#define VMX_SETUP_SELREG(REG, pCache) \
137{ \
138 VMXSetupCachedReadVmcs(pCache, VMX_VMCS16_GUEST_FIELD_##REG); \
139 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_LIMIT); \
140 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_##REG##_BASE); \
141 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS); \
142}
143
144
145/*******************************************************************************
146* Global Variables *
147*******************************************************************************/
148/* IO operation lookup arrays. */
149static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
150static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
151
152#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
153/** See HMR0A.asm. */
154extern "C" uint32_t g_fVMXIs64bitHost;
155#endif
156
157
158/*******************************************************************************
159* Local Functions *
160*******************************************************************************/
161static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu);
162static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu);
163static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu);
164static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu);
165static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush);
166static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr);
167static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
168static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
169static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx);
170
171
172/**
173 * Updates error from VMCS to HMCPU's lasterror record.
174 *
175 * @param pVM Pointer to the VM.
176 * @param pVCpu Pointer to the VMCPU.
177 * @param rc The error code.
178 */
179static void hmR0VmxCheckError(PVM pVM, PVMCPU pVCpu, int rc)
180{
181 if ( rc == VERR_VMX_UNABLE_TO_START_VM
182 || rc == VERR_VMX_INVALID_VMCS_FIELD)
183 {
184 RTCCUINTREG instrError;
185
186 VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
187 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
188 }
189 pVM->hm.s.lLastError = rc;
190}
191
192
193/**
194 * Sets up and activates VT-x on the current CPU.
195 *
196 * @returns VBox status code.
197 * @param pCpu Pointer to the CPU info struct.
198 * @param pVM Pointer to the VM. (can be NULL after a resume!!)
199 * @param pvCpuPage Pointer to the global CPU page.
200 * @param HCPhysCpuPage Physical address of the global CPU page.
201 * @param fEnabledByHost Set if SUPR0EnableVTx or similar was used to enable
202 * VT-x/AMD-V on the host.
203 */
204VMMR0DECL(int) VMXR0EnableCpu(PHMGLOBLCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage, bool fEnabledByHost)
205{
206 if (!fEnabledByHost)
207 {
208 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
209 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
210
211 if (pVM)
212 {
213 /* Set revision dword at the beginning of the VMXON structure. */
214 *(uint32_t *)pvCpuPage = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
215 }
216
217 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
218 * (which can have very bad consequences!!!)
219 */
220
221 /** @todo r=bird: Why is this code different than the probing code earlier
222 * on? It just sets VMXE if needed and doesn't check that it isn't
223 * set. Mac OS X host_vmxoff may leave this set and we'll fail here
224 * and debug-assert in the calling code. This is what caused the
225 * "regression" after backing out the SUPR0EnableVTx code hours before
226 * 4.2.0GA (reboot fixed the issue). I've changed here to do the same
227 * as the init code. */
228 uint64_t uCr4 = ASMGetCR4();
229 if (!(uCr4 & X86_CR4_VMXE))
230 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE); /* Make sure the VMX instructions don't cause #UD faults. */
231
232 /*
233 * Enter VM root mode.
234 */
235 int rc = VMXEnable(HCPhysCpuPage);
236 if (RT_FAILURE(rc))
237 {
238 ASMSetCR4(uCr4);
239 return VERR_VMX_VMXON_FAILED;
240 }
241 }
242
243 /*
244 * Flush all VPIDs (in case we or any other hypervisor have been using VPIDs) so that
245 * we can avoid an explicit flush while using new VPIDs. We would still need to flush
246 * each time while reusing a VPID after hitting the MaxASID limit once.
247 */
248 if ( pVM
249 && pVM->hm.s.vmx.fVpid
250 && (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS))
251 {
252 hmR0VmxFlushVPID(pVM, NULL /* pvCpu */, VMX_FLUSH_VPID_ALL_CONTEXTS, 0 /* GCPtr */);
253 pCpu->fFlushAsidBeforeUse = false;
254 }
255 else
256 pCpu->fFlushAsidBeforeUse = true;
257
258 /*
259 * Ensure each VCPU scheduled on this CPU gets a new VPID on resume. See @bugref{6255}.
260 */
261 ++pCpu->cTlbFlushes;
262
263 return VINF_SUCCESS;
264}
265
266
267/**
268 * Deactivates VT-x on the current CPU.
269 *
270 * @returns VBox status code.
271 * @param pCpu Pointer to the CPU info struct.
272 * @param pvCpuPage Pointer to the global CPU page.
273 * @param HCPhysCpuPage Physical address of the global CPU page.
274 */
275VMMR0DECL(int) VMXR0DisableCpu(PHMGLOBLCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
276{
277 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
278 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
279 NOREF(pCpu);
280
281 /* If we're somehow not in VMX root mode, then we shouldn't dare leaving it. */
282 if (!(ASMGetCR4() & X86_CR4_VMXE))
283 return VERR_VMX_NOT_IN_VMX_ROOT_MODE;
284
285 /* Leave VMX Root Mode. */
286 VMXDisable();
287
288 /* And clear the X86_CR4_VMXE bit. */
289 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
290 return VINF_SUCCESS;
291}
292
293VMMR0DECL(int) VMXR0GlobalInit(void)
294{
295 /* Nothing to do. */
296 return VINF_SUCCESS;
297}
298
299VMMR0DECL(void) VMXR0GlobalTerm(void)
300{
301 /* Nothing to do. */
302}
303
304/**
305 * Does Ring-0 per VM VT-x initialization.
306 *
307 * @returns VBox status code.
308 * @param pVM Pointer to the VM.
309 */
310VMMR0DECL(int) VMXR0InitVM(PVM pVM)
311{
312 int rc;
313
314#ifdef LOG_ENABLED
315 SUPR0Printf("VMXR0InitVM %p\n", pVM);
316#endif
317
318 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
319
320 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
321 {
322 /* Allocate one page for the APIC physical page (serves for filtering accesses). */
323 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjApicAccess, PAGE_SIZE, false /* fExecutable */);
324 AssertRC(rc);
325 if (RT_FAILURE(rc))
326 return rc;
327
328 pVM->hm.s.vmx.pbApicAccess = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjApicAccess);
329 pVM->hm.s.vmx.HCPhysApicAccess = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjApicAccess, 0);
330 ASMMemZero32(pVM->hm.s.vmx.pbApicAccess, PAGE_SIZE);
331 }
332 else
333 {
334 pVM->hm.s.vmx.hMemObjApicAccess = 0;
335 pVM->hm.s.vmx.pbApicAccess = 0;
336 pVM->hm.s.vmx.HCPhysApicAccess = 0;
337 }
338
339#ifdef VBOX_WITH_CRASHDUMP_MAGIC
340 {
341 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjScratch, PAGE_SIZE, false /* fExecutable */);
342 AssertRC(rc);
343 if (RT_FAILURE(rc))
344 return rc;
345
346 pVM->hm.s.vmx.pScratch = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjScratch);
347 pVM->hm.s.vmx.pScratchPhys = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjScratch, 0);
348
349 ASMMemZero32(pVM->hm.s.vmx.pbScratch, PAGE_SIZE);
350 strcpy((char *)pVM->hm.s.vmx.pbScratch, "SCRATCH Magic");
351 *(uint64_t *)(pVM->hm.s.vmx.pbScratch + 16) = UINT64_C(0xDEADBEEFDEADBEEF);
352 }
353#endif
354
355 /* Allocate VMCSs for all guest CPUs. */
356 for (VMCPUID i = 0; i < pVM->cCpus; i++)
357 {
358 PVMCPU pVCpu = &pVM->aCpus[i];
359
360 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
361
362 /* Allocate one page for the VM control structure (VMCS). */
363 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVmcs, PAGE_SIZE, false /* fExecutable */);
364 AssertRC(rc);
365 if (RT_FAILURE(rc))
366 return rc;
367
368 pVCpu->hm.s.vmx.pvVmcs = RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVmcs);
369 pVCpu->hm.s.vmx.HCPhysVmcs = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVmcs, 0);
370 ASMMemZeroPage(pVCpu->hm.s.vmx.pvVmcs);
371
372 pVCpu->hm.s.vmx.cr0_mask = 0;
373 pVCpu->hm.s.vmx.cr4_mask = 0;
374
375 /* Allocate one page for the virtual APIC page for TPR caching. */
376 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVirtApic, PAGE_SIZE, false /* fExecutable */);
377 AssertRC(rc);
378 if (RT_FAILURE(rc))
379 return rc;
380
381 pVCpu->hm.s.vmx.pbVirtApic = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVirtApic);
382 pVCpu->hm.s.vmx.HCPhysVirtApic = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVirtApic, 0);
383 ASMMemZeroPage(pVCpu->hm.s.vmx.pbVirtApic);
384
385 /* Allocate the MSR bitmap if this feature is supported. */
386 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
387 {
388 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjMsrBitmap, PAGE_SIZE, false /* fExecutable */);
389 AssertRC(rc);
390 if (RT_FAILURE(rc))
391 return rc;
392
393 pVCpu->hm.s.vmx.pvMsrBitmap = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjMsrBitmap);
394 pVCpu->hm.s.vmx.HCPhysMsrBitmap = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjMsrBitmap, 0);
395 memset(pVCpu->hm.s.vmx.pvMsrBitmap, 0xff, PAGE_SIZE);
396 }
397
398#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
399 /* Allocate one page for the guest MSR load area (for preloading guest MSRs during the world switch). */
400 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjGuestMsr, PAGE_SIZE, false /* fExecutable */);
401 AssertRC(rc);
402 if (RT_FAILURE(rc))
403 return rc;
404
405 pVCpu->hm.s.vmx.pvGuestMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjGuestMsr);
406 pVCpu->hm.s.vmx.HCPhysGuestMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjGuestMsr, 0);
407 Assert(!(pVCpu->hm.s.vmx.HCPhysGuestMsr & 0xf));
408 memset(pVCpu->hm.s.vmx.pvGuestMsr, 0, PAGE_SIZE);
409
410 /* Allocate one page for the host MSR load area (for restoring host MSRs after the world switch back). */
411 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjHostMsr, PAGE_SIZE, false /* fExecutable */);
412 AssertRC(rc);
413 if (RT_FAILURE(rc))
414 return rc;
415
416 pVCpu->hm.s.vmx.pvHostMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjHostMsr);
417 pVCpu->hm.s.vmx.HCPhysHostMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjHostMsr, 0);
418 Assert(!(pVCpu->hm.s.vmx.HCPhysHostMsr & 0xf));
419 memset(pVCpu->hm.s.vmx.pvHostMsr, 0, PAGE_SIZE);
420#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
421
422 /* Current guest paging mode. */
423 pVCpu->hm.s.vmx.enmLastSeenGuestMode = PGMMODE_REAL;
424
425#ifdef LOG_ENABLED
426 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hm.s.vmx.pvVmcs, (uint32_t)pVCpu->hm.s.vmx.HCPhysVmcs);
427#endif
428 }
429
430 return VINF_SUCCESS;
431}
432
433
434/**
435 * Does Ring-0 per VM VT-x termination.
436 *
437 * @returns VBox status code.
438 * @param pVM Pointer to the VM.
439 */
440VMMR0DECL(int) VMXR0TermVM(PVM pVM)
441{
442 for (VMCPUID i = 0; i < pVM->cCpus; i++)
443 {
444 PVMCPU pVCpu = &pVM->aCpus[i];
445
446 if (pVCpu->hm.s.vmx.hMemObjVmcs != NIL_RTR0MEMOBJ)
447 {
448 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVmcs, false);
449 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
450 pVCpu->hm.s.vmx.pvVmcs = 0;
451 pVCpu->hm.s.vmx.HCPhysVmcs = 0;
452 }
453 if (pVCpu->hm.s.vmx.hMemObjVirtApic != NIL_RTR0MEMOBJ)
454 {
455 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVirtApic, false);
456 pVCpu->hm.s.vmx.hMemObjVirtApic = NIL_RTR0MEMOBJ;
457 pVCpu->hm.s.vmx.pbVirtApic = 0;
458 pVCpu->hm.s.vmx.HCPhysVirtApic = 0;
459 }
460 if (pVCpu->hm.s.vmx.hMemObjMsrBitmap != NIL_RTR0MEMOBJ)
461 {
462 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjMsrBitmap, false);
463 pVCpu->hm.s.vmx.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
464 pVCpu->hm.s.vmx.pvMsrBitmap = 0;
465 pVCpu->hm.s.vmx.HCPhysMsrBitmap = 0;
466 }
467#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
468 if (pVCpu->hm.s.vmx.hMemObjHostMsr != NIL_RTR0MEMOBJ)
469 {
470 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjHostMsr, false);
471 pVCpu->hm.s.vmx.hMemObjHostMsr = NIL_RTR0MEMOBJ;
472 pVCpu->hm.s.vmx.pvHostMsr = 0;
473 pVCpu->hm.s.vmx.HCPhysHostMsr = 0;
474 }
475 if (pVCpu->hm.s.vmx.hMemObjGuestMsr != NIL_RTR0MEMOBJ)
476 {
477 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjGuestMsr, false);
478 pVCpu->hm.s.vmx.hMemObjGuestMsr = NIL_RTR0MEMOBJ;
479 pVCpu->hm.s.vmx.pvGuestMsr = 0;
480 pVCpu->hm.s.vmx.HCPhysGuestMsr = 0;
481 }
482#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
483 }
484 if (pVM->hm.s.vmx.hMemObjApicAccess != NIL_RTR0MEMOBJ)
485 {
486 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjApicAccess, false);
487 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
488 pVM->hm.s.vmx.pbApicAccess = 0;
489 pVM->hm.s.vmx.HCPhysApicAccess = 0;
490 }
491#ifdef VBOX_WITH_CRASHDUMP_MAGIC
492 if (pVM->hm.s.vmx.hMemObjScratch != NIL_RTR0MEMOBJ)
493 {
494 ASMMemZero32(pVM->hm.s.vmx.pScratch, PAGE_SIZE);
495 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjScratch, false);
496 pVM->hm.s.vmx.hMemObjScratch = NIL_RTR0MEMOBJ;
497 pVM->hm.s.vmx.pScratch = 0;
498 pVM->hm.s.vmx.pScratchPhys = 0;
499 }
500#endif
501 return VINF_SUCCESS;
502}
503
504
505/**
506 * Sets up VT-x for the specified VM.
507 *
508 * @returns VBox status code.
509 * @param pVM Pointer to the VM.
510 */
511VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
512{
513 int rc = VINF_SUCCESS;
514 uint32_t val;
515
516 AssertReturn(pVM, VERR_INVALID_PARAMETER);
517
518 /* Initialize these always, see hmR3InitFinalizeR0().*/
519 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NONE;
520 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NONE;
521
522 /* Determine optimal flush type for EPT. */
523 if (pVM->hm.s.fNestedPaging)
524 {
525 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT)
526 {
527 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_SINGLE_CONTEXT)
528 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_SINGLE_CONTEXT;
529 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_ALL_CONTEXTS)
530 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_ALL_CONTEXTS;
531 else
532 {
533 /*
534 * Should never really happen. EPT is supported but no suitable flush types supported.
535 * We cannot ignore EPT at this point as we've already setup Unrestricted Guest execution.
536 */
537 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
538 return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
539 }
540 }
541 else
542 {
543 /*
544 * Should never really happen. EPT is supported but INVEPT instruction is not supported.
545 */
546 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
547 return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
548 }
549 }
550
551 /* Determine optimal flush type for VPID. */
552 if (pVM->hm.s.vmx.fVpid)
553 {
554 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID)
555 {
556 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
557 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_SINGLE_CONTEXT;
558 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS)
559 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_ALL_CONTEXTS;
560 else
561 {
562 /*
563 * Neither SINGLE nor ALL context flush types for VPID supported by the CPU.
564 * We do not handle other flush type combinations, ignore VPID capabilities.
565 */
566 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
567 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_INDIV_ADDR supported. Ignoring VPID.\n"));
568 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT_RETAIN_GLOBALS)
569 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_SINGLE_CONTEXT_RETAIN_GLOBALS supported. Ignoring VPID.\n"));
570 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
571 pVM->hm.s.vmx.fVpid = false;
572 }
573 }
574 else
575 {
576 /*
577 * Should not really happen. EPT is supported but INVEPT is not supported.
578 * Ignore VPID capabilities as our code relies on using INVEPT for selective flushing.
579 */
580 Log(("VMXR0SetupVM: VPID supported without INVEPT support. Ignoring VPID.\n"));
581 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
582 pVM->hm.s.vmx.fVpid = false;
583 }
584 }
585
586 for (VMCPUID i = 0; i < pVM->cCpus; i++)
587 {
588 PVMCPU pVCpu = &pVM->aCpus[i];
589
590 AssertPtr(pVCpu->hm.s.vmx.pvVmcs);
591
592 /* Set revision dword at the beginning of the VMCS structure. */
593 *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
594
595 /*
596 * Clear and activate the VMCS.
597 */
598 Log(("HCPhysVmcs = %RHp\n", pVCpu->hm.s.vmx.HCPhysVmcs));
599 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
600 if (RT_FAILURE(rc))
601 goto vmx_end;
602
603 rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
604 if (RT_FAILURE(rc))
605 goto vmx_end;
606
607 /*
608 * VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
609 * Set required bits to one and zero according to the MSR capabilities.
610 */
611 val = pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
612 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT /* External interrupts */
613 | VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT; /* Non-maskable interrupts */
614
615 /*
616 * Enable the VMX preemption timer.
617 */
618 if (pVM->hm.s.vmx.fUsePreemptTimer)
619 val |= VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_PREEMPT_TIMER;
620 val &= pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
621
622 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, val);
623 AssertRC(rc);
624 pVCpu->hm.s.vmx.u32PinCtls = val;
625
626 /*
627 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
628 * Set required bits to one and zero according to the MSR capabilities.
629 */
630 val = pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
631 /* Program which event cause VM-exits and which features we want to use. */
632 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
633 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TSC_OFFSETTING
634 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
635 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
636 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDPMC_EXIT
637 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_EXIT
638 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside
639 the guest (host thinks the cpu load is high) */
640
641 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
642 if (!pVM->hm.s.fNestedPaging)
643 {
644 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
645 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
646 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
647 }
648
649 /*
650 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch
651 * failure with an invalid control fields error. (combined with some other exit reasons)
652 */
653 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
654 {
655 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
656 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
657 Assert(pVM->hm.s.vmx.pbApicAccess);
658 }
659 else
660 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
661 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
662
663 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
664 {
665 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
666 val |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
667 }
668
669 /* We will use the secondary control if it's present. */
670 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
671
672 /* Mask away the bits that the CPU doesn't support */
673 /** @todo make sure they don't conflict with the above requirements. */
674 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
675 pVCpu->hm.s.vmx.u32ProcCtls = val;
676
677 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, val);
678 AssertRC(rc);
679
680 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
681 {
682 /*
683 * VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
684 * Set required bits to one and zero according to the MSR capabilities.
685 */
686 val = pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
687 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
688
689 if (pVM->hm.s.fNestedPaging)
690 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
691
692 if (pVM->hm.s.vmx.fVpid)
693 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
694
695 if (pVM->hm.s.fHasIoApic)
696 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
697
698 if (pVM->hm.s.vmx.fUnrestrictedGuest)
699 val |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;
700
701 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
702 val |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;
703
704 /* Mask away the bits that the CPU doesn't support */
705 /** @todo make sure they don't conflict with the above requirements. */
706 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
707 pVCpu->hm.s.vmx.u32ProcCtls2 = val;
708 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS2, val);
709 AssertRC(rc);
710 }
711
712 /*
713 * VMX_VMCS_CTRL_CR3_TARGET_COUNT
714 * Set required bits to one and zero according to the MSR capabilities.
715 */
716 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_CR3_TARGET_COUNT, 0);
717 AssertRC(rc);
718
719 /*
720 * Forward all exception except #NM & #PF to the guest.
721 * We always need to check pagefaults since our shadow page table can be out of sync.
722 * And we always lazily sync the FPU & XMM state. .
723 */
724
725 /** @todo Possible optimization:
726 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
727 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
728 * registers ourselves of course.
729 *
730 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
731 */
732
733 /*
734 * Don't filter page faults, all of them should cause a world switch.
735 */
736 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK, 0);
737 AssertRC(rc);
738 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH, 0);
739 AssertRC(rc);
740
741 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0);
742 AssertRC(rc);
743 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_A_FULL, 0);
744 AssertRC(rc);
745 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_B_FULL, 0);
746 AssertRC(rc);
747
748 /*
749 * Set the MSR bitmap address.
750 */
751 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
752 {
753 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
754
755 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_MSR_BITMAP_FULL, pVCpu->hm.s.vmx.HCPhysMsrBitmap);
756 AssertRC(rc);
757
758 /*
759 * Allow the guest to directly modify these MSRs; they are loaded/stored automatically
760 * using MSR-load/store areas in the VMCS.
761 */
762 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
763 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
764 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
765 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
766 hmR0VmxSetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
767 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
768 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
769 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
770 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
771 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
772 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_TSC_AUX, true, true);
773 }
774
775#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
776 /*
777 * Set the guest & host MSR load/store physical addresses.
778 */
779 Assert(pVCpu->hm.s.vmx.HCPhysGuestMsr);
780 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
781 AssertRC(rc);
782 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
783 AssertRC(rc);
784 Assert(pVCpu->hm.s.vmx.HCPhysHostMsr);
785 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysHostMsr);
786 AssertRC(rc);
787#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
788
789 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, 0);
790 AssertRC(rc);
791 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, 0);
792 AssertRC(rc);
793 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, 0);
794 AssertRC(rc);
795
796 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
797 {
798 Assert(pVM->hm.s.vmx.hMemObjApicAccess);
799 /* Optional */
800 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, 0);
801 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hm.s.vmx.HCPhysVirtApic);
802
803 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
804 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL, pVM->hm.s.vmx.HCPhysApicAccess);
805
806 AssertRC(rc);
807 }
808
809 /* Set link pointer to -1. Not currently used. */
810 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
811 AssertRC(rc);
812
813 /*
814 * Clear VMCS, marking it inactive. Clear implementation specific data and writing back
815 * VMCS data back to memory.
816 */
817 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
818 AssertRC(rc);
819
820 /*
821 * Configure the VMCS read cache.
822 */
823 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
824
825 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RIP);
826 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RSP);
827 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RFLAGS);
828 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE);
829 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR0_READ_SHADOW);
830 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR0);
831 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR4_READ_SHADOW);
832 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR4);
833 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_DR7);
834 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_SYSENTER_CS);
835 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_EIP);
836 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_ESP);
837 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_GDTR_LIMIT);
838 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_GDTR_BASE);
839 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_IDTR_LIMIT);
840 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_IDTR_BASE);
841
842 VMX_SETUP_SELREG(ES, pCache);
843 VMX_SETUP_SELREG(SS, pCache);
844 VMX_SETUP_SELREG(CS, pCache);
845 VMX_SETUP_SELREG(DS, pCache);
846 VMX_SETUP_SELREG(FS, pCache);
847 VMX_SETUP_SELREG(GS, pCache);
848 VMX_SETUP_SELREG(LDTR, pCache);
849 VMX_SETUP_SELREG(TR, pCache);
850
851 /*
852 * Status code VMCS reads.
853 */
854 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_REASON);
855 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_VM_INSTR_ERROR);
856 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_LENGTH);
857 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE);
858 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO);
859 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_INFO);
860 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_RO_EXIT_QUALIFICATION);
861 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_INFO);
862 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_ERROR_CODE);
863
864 if (pVM->hm.s.fNestedPaging)
865 {
866 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR3);
867 VMXSetupCachedReadVmcs(pCache, VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL);
868 pCache->Read.cValidEntries = VMX_VMCS_MAX_NESTED_PAGING_CACHE_IDX;
869 }
870 else
871 pCache->Read.cValidEntries = VMX_VMCS_MAX_CACHE_IDX;
872 } /* for each VMCPU */
873
874 /*
875 * Setup the right TLB function based on CPU capabilities.
876 */
877 if (pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid)
878 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBBoth;
879 else if (pVM->hm.s.fNestedPaging)
880 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBEPT;
881 else if (pVM->hm.s.vmx.fVpid)
882 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBVPID;
883 else
884 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBDummy;
885
886vmx_end:
887 hmR0VmxCheckError(pVM, &pVM->aCpus[0], rc);
888 return rc;
889}
890
891
892/**
893 * Sets the permission bits for the specified MSR.
894 *
895 * @param pVCpu Pointer to the VMCPU.
896 * @param ulMSR The MSR value.
897 * @param fRead Whether reading is allowed.
898 * @param fWrite Whether writing is allowed.
899 */
900static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
901{
902 unsigned ulBit;
903 uint8_t *pvMsrBitmap = (uint8_t *)pVCpu->hm.s.vmx.pvMsrBitmap;
904
905 /*
906 * Layout:
907 * 0x000 - 0x3ff - Low MSR read bits
908 * 0x400 - 0x7ff - High MSR read bits
909 * 0x800 - 0xbff - Low MSR write bits
910 * 0xc00 - 0xfff - High MSR write bits
911 */
912 if (ulMSR <= 0x00001FFF)
913 {
914 /* Pentium-compatible MSRs */
915 ulBit = ulMSR;
916 }
917 else if ( ulMSR >= 0xC0000000
918 && ulMSR <= 0xC0001FFF)
919 {
920 /* AMD Sixth Generation x86 Processor MSRs */
921 ulBit = (ulMSR - 0xC0000000);
922 pvMsrBitmap += 0x400;
923 }
924 else
925 {
926 AssertFailed();
927 return;
928 }
929
930 Assert(ulBit <= 0x1fff);
931 if (fRead)
932 ASMBitClear(pvMsrBitmap, ulBit);
933 else
934 ASMBitSet(pvMsrBitmap, ulBit);
935
936 if (fWrite)
937 ASMBitClear(pvMsrBitmap + 0x800, ulBit);
938 else
939 ASMBitSet(pvMsrBitmap + 0x800, ulBit);
940}
941
942
943/**
944 * Injects an event (trap or external interrupt).
945 *
946 * @returns VBox status code. Note that it may return VINF_EM_RESET to
947 * indicate a triple fault when injecting X86_XCPT_DF.
948 *
949 * @param pVM Pointer to the VM.
950 * @param pVCpu Pointer to the VMCPU.
951 * @param pCtx Pointer to the guest CPU Context.
952 * @param intInfo VMX interrupt info.
953 * @param cbInstr Opcode length of faulting instruction.
954 * @param errCode Error code (optional).
955 */
956static int hmR0VmxInjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
957{
958 int rc;
959 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
960
961#ifdef VBOX_WITH_STATISTICS
962 STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[iGate & MASK_INJECT_IRQ_STAT]);
963#endif
964
965#ifdef VBOX_STRICT
966 if (iGate == 0xE)
967 {
968 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%RGv intInfo=%08x\n", iGate,
969 (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
970 }
971 else if (iGate < 0x20)
972 {
973 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip,
974 errCode));
975 }
976 else
977 {
978 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
979 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
980 || !VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
981 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
982 || pCtx->eflags.u32 & X86_EFL_IF);
983 }
984#endif
985
986 if ( CPUMIsGuestInRealModeEx(pCtx)
987 && pVM->hm.s.vmx.pRealModeTSS)
988 {
989 RTGCPHYS GCPhysHandler;
990 uint16_t offset, ip;
991 RTSEL sel;
992
993 /*
994 * Injecting events doesn't work right with real mode emulation.
995 * (#GP if we try to inject external hardware interrupts)
996 * Inject the interrupt or trap directly instead.
997 *
998 * ASSUMES no access handlers for the bits we read or write below (should be safe).
999 */
1000 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
1001
1002 /*
1003 * Check if the interrupt handler is present.
1004 */
1005 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
1006 {
1007 Log(("IDT cbIdt violation\n"));
1008 if (iGate != X86_XCPT_DF)
1009 {
1010 uint32_t intInfo2;
1011
1012 intInfo2 = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : (uint32_t)X86_XCPT_GP;
1013 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1014 intInfo2 |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1015 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1016
1017 return hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, 0, 0 /* no error code according to the Intel docs */);
1018 }
1019 Log(("Triple fault -> reset the VM!\n"));
1020 return VINF_EM_RESET;
1021 }
1022 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
1023 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
1024 || iGate == 4)
1025 {
1026 ip = pCtx->ip + cbInstr;
1027 }
1028 else
1029 ip = pCtx->ip;
1030
1031 /*
1032 * Read the selector:offset pair of the interrupt handler.
1033 */
1034 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
1035 rc = PGMPhysSimpleReadGCPhys(pVM, &offset, GCPhysHandler, sizeof(offset)); AssertRC(rc);
1036 rc = PGMPhysSimpleReadGCPhys(pVM, &sel, GCPhysHandler + 2, sizeof(sel)); AssertRC(rc);
1037
1038 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
1039
1040 /*
1041 * Construct the stack frame.
1042 */
1043 /** @todo Check stack limit. */
1044 pCtx->sp -= 2;
1045 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->eflags.u));
1046 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t)); AssertRC(rc);
1047 pCtx->sp -= 2;
1048 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->cs.Sel));
1049 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t)); AssertRC(rc);
1050 pCtx->sp -= 2;
1051 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss.Sel, pCtx->sp, ip));
1052 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &ip, sizeof(ip)); AssertRC(rc);
1053
1054 /*
1055 * Update the CPU state for executing the handler.
1056 */
1057 pCtx->rip = offset;
1058 pCtx->cs.Sel = sel;
1059 pCtx->cs.u64Base = sel << 4;
1060 pCtx->eflags.u &= ~(X86_EFL_IF | X86_EFL_TF | X86_EFL_RF | X86_EFL_AC);
1061
1062 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_SEGMENT_REGS;
1063 return VINF_SUCCESS;
1064 }
1065
1066 /*
1067 * Set event injection state.
1068 */
1069 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
1070 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
1071 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
1072
1073 AssertRC(rc);
1074 return rc;
1075}
1076
1077
1078/**
1079 * Checks for pending guest interrupts and injects them.
1080 *
1081 * @returns VBox status code.
1082 * @param pVM Pointer to the VM.
1083 * @param pVCpu Pointer to the VMCPU.
1084 * @param pCtx Pointer to the guest CPU context.
1085 */
1086static int hmR0VmxCheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
1087{
1088 int rc;
1089
1090 /*
1091 * Dispatch any pending interrupts (injected before, but a VM exit occurred prematurely).
1092 */
1093 if (pVCpu->hm.s.Event.fPending)
1094 {
1095 Log(("CPU%d: Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntrInfo,
1096 pVCpu->hm.s.Event.u32ErrCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
1097 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntReinject);
1098 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, pVCpu->hm.s.Event.u64IntrInfo, 0, pVCpu->hm.s.Event.u32ErrCode);
1099 AssertRC(rc);
1100
1101 pVCpu->hm.s.Event.fPending = false;
1102 return VINF_SUCCESS;
1103 }
1104
1105 /*
1106 * If an active trap is already pending, we must forward it first!
1107 */
1108 if (!TRPMHasTrap(pVCpu))
1109 {
1110 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
1111 {
1112 RTGCUINTPTR intInfo;
1113
1114 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
1115
1116 intInfo = X86_XCPT_NMI;
1117 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1118 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1119
1120 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
1121 AssertRC(rc);
1122
1123 return VINF_SUCCESS;
1124 }
1125
1126 /** @todo SMI interrupts. */
1127
1128 /*
1129 * When external interrupts are pending, we should exit the VM when IF is set.
1130 */
1131 if (VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
1132 {
1133 if (!(pCtx->eflags.u32 & X86_EFL_IF))
1134 {
1135 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT))
1136 {
1137 LogFlow(("Enable irq window exit!\n"));
1138 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
1139 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1140 AssertRC(rc);
1141 }
1142 /* else nothing to do but wait */
1143 }
1144 else if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1145 {
1146 uint8_t u8Interrupt;
1147
1148 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
1149 Log(("CPU%d: Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", pVCpu->idCpu,
1150 u8Interrupt, u8Interrupt, rc, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
1151 if (RT_SUCCESS(rc))
1152 {
1153 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
1154 AssertRC(rc);
1155 }
1156 else
1157 {
1158 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
1159 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
1160 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
1161 /* Just continue */
1162 }
1163 }
1164 else
1165 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
1166 }
1167 }
1168
1169#ifdef VBOX_STRICT
1170 if (TRPMHasTrap(pVCpu))
1171 {
1172 uint8_t u8Vector;
1173 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, NULL, NULL, NULL);
1174 AssertRC(rc);
1175 }
1176#endif
1177
1178 if ( (pCtx->eflags.u32 & X86_EFL_IF)
1179 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1180 && TRPMHasTrap(pVCpu)
1181 )
1182 {
1183 uint8_t u8Vector;
1184 TRPMEVENT enmType;
1185 RTGCUINTPTR intInfo;
1186 RTGCUINT errCode;
1187
1188 /*
1189 * If a new event is pending, dispatch it now.
1190 */
1191 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &errCode, NULL, NULL);
1192 AssertRC(rc);
1193 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
1194 Assert(enmType != TRPM_SOFTWARE_INT);
1195
1196 /*
1197 * Clear the pending trap.
1198 */
1199 rc = TRPMResetTrap(pVCpu);
1200 AssertRC(rc);
1201
1202 intInfo = u8Vector;
1203 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1204
1205 if (enmType == TRPM_TRAP)
1206 {
1207 switch (u8Vector)
1208 {
1209 case X86_XCPT_DF:
1210 case X86_XCPT_TS:
1211 case X86_XCPT_NP:
1212 case X86_XCPT_SS:
1213 case X86_XCPT_GP:
1214 case X86_XCPT_PF:
1215 case X86_XCPT_AC:
1216 {
1217 /** @todo r=ramshankar: setting this bit would blow up for real-mode guests with
1218 * unrestricted guest execution. */
1219 /* Valid error codes. */
1220 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1221 break;
1222 }
1223
1224 default:
1225 break;
1226 }
1227
1228 if ( u8Vector == X86_XCPT_BP
1229 || u8Vector == X86_XCPT_OF)
1230 {
1231 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1232 }
1233 else
1234 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1235 }
1236 else
1237 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1238
1239 STAM_COUNTER_INC(&pVCpu->hm.s.StatIntInject);
1240 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
1241 AssertRC(rc);
1242 } /* if (interrupts can be dispatched) */
1243
1244 return VINF_SUCCESS;
1245}
1246
1247/**
1248 * Checks for pending VMX events and converts them to TRPM. Before we execute any instruction
1249 * outside of VMX, any pending VMX event must be converted so that it can be delivered properly.
1250 *
1251 * @returns VBox status code.
1252 * @param pVCpu Pointer to the VMCPU.
1253 */
1254static int hmR0VmxCheckPendingEvent(PVMCPU pVCpu)
1255{
1256 if (pVCpu->hm.s.Event.fPending)
1257 {
1258 TRPMEVENT enmTrapType;
1259
1260 /* If a trap was already pending, we did something wrong! */
1261 Assert((TRPMQueryTrap(pVCpu, NULL, NULL) == VERR_TRPM_NO_ACTIVE_TRAP));
1262
1263 /*
1264 * Clear the pending event and move it over to TRPM for the rest
1265 * of the world to see.
1266 */
1267 pVCpu->hm.s.Event.fPending = false;
1268 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo))
1269 {
1270 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT:
1271 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI:
1272 enmTrapType = TRPM_HARDWARE_INT;
1273 break;
1274 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT:
1275 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /** @todo Is classifying #BP, #OF as TRPM_SOFTWARE_INT correct? */
1276 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT:
1277 enmTrapType = TRPM_SOFTWARE_INT;
1278 break;
1279 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT:
1280 enmTrapType = TRPM_TRAP;
1281 break;
1282 default:
1283 enmTrapType = TRPM_32BIT_HACK; /* Can't get here. */
1284 AssertFailed();
1285 }
1286 TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), enmTrapType);
1287 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
1288 TRPMSetErrorCode(pVCpu, pVCpu->hm.s.Event.u32ErrCode);
1289 //@todo: Is there any situation where we need to call TRPMSetFaultAddress()?
1290 }
1291 return VINF_SUCCESS;
1292}
1293
1294/**
1295 * Save the host state into the VMCS.
1296 *
1297 * @returns VBox status code.
1298 * @param pVM Pointer to the VM.
1299 * @param pVCpu Pointer to the VMCPU.
1300 */
1301VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
1302{
1303 int rc = VINF_SUCCESS;
1304 NOREF(pVM);
1305
1306 /*
1307 * Host CPU Context.
1308 */
1309 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
1310 {
1311 RTIDTR idtr;
1312 RTGDTR gdtr;
1313 RTSEL SelTR;
1314 PCX86DESCHC pDesc;
1315 uintptr_t trBase;
1316 RTSEL cs;
1317 RTSEL ss;
1318 uint64_t cr3;
1319
1320 /*
1321 * Control registers.
1322 */
1323 rc = VMXWriteVmcs(VMX_VMCS_HOST_CR0, ASMGetCR0());
1324 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
1325#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1326 if (VMX_IS_64BIT_HOST_MODE())
1327 {
1328 cr3 = hmR0Get64bitCR3();
1329 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_CR3, cr3);
1330 }
1331 else
1332#endif
1333 {
1334 cr3 = ASMGetCR3();
1335 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR3, cr3);
1336 }
1337 Log2(("VMX_VMCS_HOST_CR3 %08RX64\n", cr3));
1338 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR4, ASMGetCR4());
1339 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
1340 AssertRC(rc);
1341
1342 /*
1343 * Selector registers.
1344 */
1345#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1346 if (VMX_IS_64BIT_HOST_MODE())
1347 {
1348 cs = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelCS;
1349 ss = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelSS;
1350 }
1351 else
1352 {
1353 /* sysenter loads LDT cs & ss, VMX doesn't like this. Load the GDT ones (safe). */
1354 cs = (RTSEL)(uintptr_t)&SUPR0AbsKernelCS;
1355 ss = (RTSEL)(uintptr_t)&SUPR0AbsKernelSS;
1356 }
1357#else
1358 cs = ASMGetCS();
1359 ss = ASMGetSS();
1360#endif
1361 Assert(!(cs & X86_SEL_LDT)); Assert((cs & X86_SEL_RPL) == 0);
1362 Assert(!(ss & X86_SEL_LDT)); Assert((ss & X86_SEL_RPL) == 0);
1363 rc = VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_CS, cs);
1364 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
1365 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_DS, 0);
1366 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_ES, 0);
1367#if HC_ARCH_BITS == 32
1368 if (!VMX_IS_64BIT_HOST_MODE())
1369 {
1370 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_FS, 0);
1371 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_GS, 0);
1372 }
1373#endif
1374 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_SS, ss);
1375 SelTR = ASMGetTR();
1376 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_TR, SelTR);
1377 AssertRC(rc);
1378 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
1379 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
1380 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
1381 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
1382 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
1383 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", ss, ASMGetSS()));
1384 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
1385
1386 /*
1387 * GDTR & IDTR.
1388 */
1389#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1390 if (VMX_IS_64BIT_HOST_MODE())
1391 {
1392 X86XDTR64 gdtr64, idtr64;
1393 hmR0Get64bitGdtrAndIdtr(&gdtr64, &idtr64);
1394 rc = VMXWriteVmcs64(VMX_VMCS_HOST_GDTR_BASE, gdtr64.uAddr);
1395 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_IDTR_BASE, idtr64.uAddr);
1396 AssertRC(rc);
1397 Log2(("VMX_VMCS_HOST_GDTR_BASE %RX64\n", gdtr64.uAddr));
1398 Log2(("VMX_VMCS_HOST_IDTR_BASE %RX64\n", idtr64.uAddr));
1399 gdtr.cbGdt = gdtr64.cb;
1400 gdtr.pGdt = (uintptr_t)gdtr64.uAddr;
1401 }
1402 else
1403#endif
1404 {
1405 ASMGetGDTR(&gdtr);
1406 rc = VMXWriteVmcs(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
1407 ASMGetIDTR(&idtr);
1408 rc |= VMXWriteVmcs(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
1409 AssertRC(rc);
1410 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
1411 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
1412 }
1413
1414 /*
1415 * Save the base address of the TR selector.
1416 */
1417 if (SelTR > gdtr.cbGdt)
1418 {
1419 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
1420 return VERR_VMX_INVALID_HOST_STATE;
1421 }
1422
1423 pDesc = (PCX86DESCHC)(gdtr.pGdt + (SelTR & X86_SEL_MASK));
1424#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1425 if (VMX_IS_64BIT_HOST_MODE())
1426 {
1427 uint64_t trBase64 = X86DESC64_BASE((PX86DESC64)pDesc);
1428 rc = VMXWriteVmcs64(VMX_VMCS_HOST_TR_BASE, trBase64);
1429 Log2(("VMX_VMCS_HOST_TR_BASE %RX64\n", trBase64));
1430 AssertRC(rc);
1431 }
1432 else
1433#endif
1434 {
1435#if HC_ARCH_BITS == 64
1436 trBase = X86DESC64_BASE(pDesc);
1437#else
1438 trBase = X86DESC_BASE(pDesc);
1439#endif
1440 rc = VMXWriteVmcs(VMX_VMCS_HOST_TR_BASE, trBase);
1441 AssertRC(rc);
1442 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
1443 }
1444
1445 /*
1446 * FS base and GS base.
1447 */
1448#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1449 if (VMX_IS_64BIT_HOST_MODE())
1450 {
1451 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
1452 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
1453 rc = VMXWriteVmcs64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
1454 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
1455 }
1456#endif
1457 AssertRC(rc);
1458
1459 /*
1460 * Sysenter MSRs.
1461 */
1462 /** @todo expensive!! */
1463 rc = VMXWriteVmcs(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
1464 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
1465#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1466 if (VMX_IS_64BIT_HOST_MODE())
1467 {
1468 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1469 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1470 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1471 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1472 }
1473 else
1474 {
1475 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1476 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1477 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1478 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1479 }
1480#elif HC_ARCH_BITS == 32
1481 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1482 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1483 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1484 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1485#else
1486 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1487 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1488 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1489 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1490#endif
1491 AssertRC(rc);
1492
1493
1494#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1495 /*
1496 * Store all host MSRs in the VM-Exit load area, so they will be reloaded after
1497 * the world switch back to the host.
1498 */
1499 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvHostMsr;
1500 unsigned idxMsr = 0;
1501
1502 uint32_t u32HostExtFeatures = ASMCpuId_EDX(0x80000001);
1503 if (u32HostExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
1504 {
1505 pMsr->u32IndexMSR = MSR_K6_EFER;
1506 pMsr->u32Reserved = 0;
1507# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1508 if (CPUMIsGuestInLongMode(pVCpu))
1509 {
1510 /* Must match the EFER value in our 64 bits switcher. */
1511 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER) | MSR_K6_EFER_LME | MSR_K6_EFER_SCE | MSR_K6_EFER_NXE;
1512 }
1513 else
1514# endif
1515 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER);
1516 pMsr++; idxMsr++;
1517 }
1518
1519# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1520 if (VMX_IS_64BIT_HOST_MODE())
1521 {
1522 pMsr->u32IndexMSR = MSR_K6_STAR;
1523 pMsr->u32Reserved = 0;
1524 pMsr->u64Value = ASMRdMsr(MSR_K6_STAR); /* legacy syscall eip, cs & ss */
1525 pMsr++; idxMsr++;
1526 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1527 pMsr->u32Reserved = 0;
1528 pMsr->u64Value = ASMRdMsr(MSR_K8_LSTAR); /* 64 bits mode syscall rip */
1529 pMsr++; idxMsr++;
1530 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1531 pMsr->u32Reserved = 0;
1532 pMsr->u64Value = ASMRdMsr(MSR_K8_SF_MASK); /* syscall flag mask */
1533 pMsr++; idxMsr++;
1534
1535 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
1536#if 0
1537 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1538 pMsr->u32Reserved = 0;
1539 pMsr->u64Value = ASMRdMsr(MSR_K8_KERNEL_GS_BASE); /* swapgs exchange value */
1540 pMsr++; idxMsr++;
1541#endif
1542 }
1543# endif
1544
1545 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
1546 {
1547 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
1548 pMsr->u32Reserved = 0;
1549 pMsr->u64Value = ASMRdMsr(MSR_K8_TSC_AUX);
1550 pMsr++; idxMsr++;
1551 }
1552
1553 /** @todo r=ramshankar: check IA32_VMX_MISC bits 27:25 for valid idxMsr
1554 * range. */
1555 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, idxMsr);
1556 AssertRC(rc);
1557#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1558
1559 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_HOST_CONTEXT;
1560 }
1561 return rc;
1562}
1563
1564
1565/**
1566 * Loads the 4 PDPEs into the guest state when nested paging is used and the
1567 * guest operates in PAE mode.
1568 *
1569 * @returns VBox status code.
1570 * @param pVCpu Pointer to the VMCPU.
1571 * @param pCtx Pointer to the guest CPU context.
1572 */
1573static int hmR0VmxLoadPaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1574{
1575 if (CPUMIsGuestInPAEModeEx(pCtx))
1576 {
1577 X86PDPE aPdpes[4];
1578 int rc = PGMGstGetPaePdpes(pVCpu, &aPdpes[0]);
1579 AssertRCReturn(rc, rc);
1580
1581 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, aPdpes[0].u); AssertRCReturn(rc, rc);
1582 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, aPdpes[1].u); AssertRCReturn(rc, rc);
1583 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, aPdpes[2].u); AssertRCReturn(rc, rc);
1584 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, aPdpes[3].u); AssertRCReturn(rc, rc);
1585 }
1586 return VINF_SUCCESS;
1587}
1588
1589
1590/**
1591 * Saves the 4 PDPEs into the guest state when nested paging is used and the
1592 * guest operates in PAE mode.
1593 *
1594 * @returns VBox status code.
1595 * @param pVCpu Pointer to the VM CPU.
1596 * @param pCtx Pointer to the guest CPU context.
1597 *
1598 * @remarks Tell PGM about CR3 changes before calling this helper.
1599 */
1600static int hmR0VmxSavePaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1601{
1602 if (CPUMIsGuestInPAEModeEx(pCtx))
1603 {
1604 int rc;
1605 X86PDPE aPdpes[4];
1606 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &aPdpes[0].u); AssertRCReturn(rc, rc);
1607 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &aPdpes[1].u); AssertRCReturn(rc, rc);
1608 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &aPdpes[2].u); AssertRCReturn(rc, rc);
1609 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &aPdpes[3].u); AssertRCReturn(rc, rc);
1610
1611 rc = PGMGstUpdatePaePdpes(pVCpu, &aPdpes[0]);
1612 AssertRCReturn(rc, rc);
1613 }
1614 return VINF_SUCCESS;
1615}
1616
1617
1618/**
1619 * Update the exception bitmap according to the current CPU state.
1620 *
1621 * @param pVM Pointer to the VM.
1622 * @param pVCpu Pointer to the VMCPU.
1623 * @param pCtx Pointer to the guest CPU context.
1624 */
1625static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1626{
1627 uint32_t u32TrapMask;
1628 Assert(pCtx);
1629
1630 /*
1631 * Set up a mask for intercepting traps.
1632 */
1633 /** @todo Do we really need to always intercept #DB? */
1634 u32TrapMask = RT_BIT(X86_XCPT_DB)
1635 | RT_BIT(X86_XCPT_NM)
1636#ifdef VBOX_ALWAYS_TRAP_PF
1637 | RT_BIT(X86_XCPT_PF)
1638#endif
1639#ifdef VBOX_STRICT
1640 | RT_BIT(X86_XCPT_BP)
1641 | RT_BIT(X86_XCPT_DB)
1642 | RT_BIT(X86_XCPT_DE)
1643 | RT_BIT(X86_XCPT_NM)
1644 | RT_BIT(X86_XCPT_UD)
1645 | RT_BIT(X86_XCPT_NP)
1646 | RT_BIT(X86_XCPT_SS)
1647 | RT_BIT(X86_XCPT_GP)
1648 | RT_BIT(X86_XCPT_MF)
1649#endif
1650 ;
1651
1652 /*
1653 * Without nested paging, #PF must be intercepted to implement shadow paging.
1654 */
1655 /** @todo NP state won't change so maybe we should build the initial trap mask up front? */
1656 if (!pVM->hm.s.fNestedPaging)
1657 u32TrapMask |= RT_BIT(X86_XCPT_PF);
1658
1659 /* Catch floating point exceptions if we need to report them to the guest in a different way. */
1660 if (!(pCtx->cr0 & X86_CR0_NE))
1661 u32TrapMask |= RT_BIT(X86_XCPT_MF);
1662
1663#ifdef VBOX_STRICT
1664 Assert(u32TrapMask & RT_BIT(X86_XCPT_GP));
1665#endif
1666
1667 /*
1668 * Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise).
1669 */
1670 /** @todo Despite the claim to intercept everything, with NP we do not intercept #PF. Should we? */
1671 if ( CPUMIsGuestInRealModeEx(pCtx)
1672 && pVM->hm.s.vmx.pRealModeTSS)
1673 {
1674 u32TrapMask |= RT_BIT(X86_XCPT_DE)
1675 | RT_BIT(X86_XCPT_DB)
1676 | RT_BIT(X86_XCPT_NMI)
1677 | RT_BIT(X86_XCPT_BP)
1678 | RT_BIT(X86_XCPT_OF)
1679 | RT_BIT(X86_XCPT_BR)
1680 | RT_BIT(X86_XCPT_UD)
1681 | RT_BIT(X86_XCPT_DF)
1682 | RT_BIT(X86_XCPT_CO_SEG_OVERRUN)
1683 | RT_BIT(X86_XCPT_TS)
1684 | RT_BIT(X86_XCPT_NP)
1685 | RT_BIT(X86_XCPT_SS)
1686 | RT_BIT(X86_XCPT_GP)
1687 | RT_BIT(X86_XCPT_MF)
1688 | RT_BIT(X86_XCPT_AC)
1689 | RT_BIT(X86_XCPT_MC)
1690 | RT_BIT(X86_XCPT_XF)
1691 ;
1692 }
1693
1694 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, u32TrapMask);
1695 AssertRC(rc);
1696}
1697
1698
1699/**
1700 * Loads a minimal guest state.
1701 *
1702 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1703 *
1704 * @param pVM Pointer to the VM.
1705 * @param pVCpu Pointer to the VMCPU.
1706 * @param pCtx Pointer to the guest CPU context.
1707 */
1708VMMR0DECL(void) VMXR0LoadMinimalGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1709{
1710 int rc;
1711 X86EFLAGS eflags;
1712
1713 Assert(!(pVCpu->hm.s.fContextUseFlags & HM_CHANGED_ALL_GUEST));
1714
1715 /*
1716 * Load EIP, ESP and EFLAGS.
1717 */
1718 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_RIP, pCtx->rip);
1719 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1720 AssertRC(rc);
1721
1722 /*
1723 * Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1.
1724 */
1725 eflags = pCtx->eflags;
1726 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1727 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1728
1729 /*
1730 * Check if real mode emulation using v86 mode.
1731 */
1732 if ( CPUMIsGuestInRealModeEx(pCtx)
1733 && pVM->hm.s.vmx.pRealModeTSS)
1734 {
1735 pVCpu->hm.s.vmx.RealMode.eflags = eflags;
1736
1737 eflags.Bits.u1VM = 1;
1738 eflags.Bits.u2IOPL = 0; /* must always be 0 or else certain instructions won't cause faults. */
1739 }
1740 rc = VMXWriteVmcs(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1741 AssertRC(rc);
1742}
1743
1744
1745/**
1746 * Sets up TSC offsetting and VMX preemption, if supported/configured/available.
1747 *
1748 * NOTE: This function reads the host TSC value. Therefore it must be executed very
1749 * shortly before a VM entry and execution MUST NOT be rescheduled between a call to
1750 * this function and a VM entry without calling this function again.
1751 *
1752 * @returns VBox status code.
1753 * @param pVM Pointer to the VM.
1754 * @param pVCpu Pointer to the VMCPU.
1755 */
1756VMMR0DECL(int) VMXR0SetupTscOffsetAndPreemption(PVM pVM, PVMCPU pVCpu)
1757{
1758 int rc = VINF_SUCCESS;
1759 bool fOffsettedTsc;
1760
1761 if (pVM->hm.s.vmx.fUsePreemptTimer)
1762 {
1763 uint64_t cTicksToDeadline = TMCpuTickGetDeadlineAndTscOffset(pVCpu, &fOffsettedTsc, &pVCpu->hm.s.vmx.u64TSCOffset);
1764
1765 /* Make sure the returned values have sane upper and lower boundaries. */
1766 uint64_t u64CpuHz = SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage);
1767
1768 cTicksToDeadline = RT_MIN(cTicksToDeadline, u64CpuHz / 64); /* 1/64 of a second */
1769 cTicksToDeadline = RT_MAX(cTicksToDeadline, u64CpuHz / 2048); /* 1/2048th of a second */
1770
1771 cTicksToDeadline >>= pVM->hm.s.vmx.cPreemptTimerShift;
1772 uint32_t cPreemptionTickCount = (uint32_t)RT_MIN(cTicksToDeadline, UINT32_MAX - 16);
1773 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_PREEMPT_TIMER_VALUE, cPreemptionTickCount);
1774 AssertRC(rc);
1775 }
1776 else
1777 fOffsettedTsc = TMCpuTickCanUseRealTSC(pVCpu, &pVCpu->hm.s.vmx.u64TSCOffset);
1778
1779 if (fOffsettedTsc)
1780 {
1781 uint64_t u64CurTSC = ASMReadTSC();
1782 if (u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset > TMCpuTickGetLastSeen(pVCpu))
1783 {
1784 /* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET, applies to RDTSCP too. */
1785 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, pVCpu->hm.s.vmx.u64TSCOffset);
1786 AssertRC(rc);
1787
1788 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1789 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1790 AssertRC(rc);
1791 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscOffset);
1792 }
1793 else
1794 {
1795 /* Fall back to rdtsc, rdtscp emulation as we would otherwise pass decreasing tsc values to the guest. */
1796 LogFlow(("TSC %RX64 offset %RX64 time=%RX64 last=%RX64 (diff=%RX64, virt_tsc=%RX64)\n", u64CurTSC,
1797 pVCpu->hm.s.vmx.u64TSCOffset, u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset,
1798 TMCpuTickGetLastSeen(pVCpu), TMCpuTickGetLastSeen(pVCpu) - u64CurTSC - pVCpu->hm.s.vmx.u64TSCOffset,
1799 TMCpuTickGet(pVCpu)));
1800 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1801 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1802 AssertRC(rc);
1803 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscInterceptOverFlow);
1804 }
1805 }
1806 else
1807 {
1808 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1809 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
1810 AssertRC(rc);
1811 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscIntercept);
1812 }
1813 return rc;
1814}
1815
1816/**
1817 * Loads the guest state.
1818 *
1819 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1820 *
1821 * @returns VBox status code.
1822 * @param pVM Pointer to the VM.
1823 * @param pVCpu Pointer to the VMCPU.
1824 * @param pCtx Pointer to the guest CPU context.
1825 */
1826VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1827{
1828 int rc = VINF_SUCCESS;
1829 RTGCUINTPTR val;
1830
1831 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
1832
1833 /*
1834 * VMX_VMCS_CTRL_ENTRY_CONTROLS
1835 * Set required bits to one and zero according to the MSR capabilities.
1836 */
1837 val = pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0;
1838
1839 /*
1840 * Load guest debug controls (DR7 & IA32_DEBUGCTL_MSR).
1841 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1842 */
1843 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_LOAD_DEBUG;
1844
1845 if (CPUMIsGuestInLongModeEx(pCtx))
1846 val |= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA32E_MODE_GUEST;
1847 /* else Must be zero when AMD64 is not available. */
1848
1849 /*
1850 * Mask away the bits that the CPU doesn't support.
1851 */
1852 val &= pVM->hm.s.vmx.msr.vmx_entry.n.allowed1;
1853 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, val);
1854 AssertRC(rc);
1855
1856 /*
1857 * VMX_VMCS_CTRL_EXIT_CONTROLS
1858 * Set required bits to one and zero according to the MSR capabilities.
1859 */
1860 val = pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0;
1861
1862 /*
1863 * Save debug controls (DR7 & IA32_DEBUGCTL_MSR)
1864 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1865 */
1866 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_SAVE_DEBUG;
1867
1868#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1869 if (VMX_IS_64BIT_HOST_MODE())
1870 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE;
1871 /* else Must be zero when AMD64 is not available. */
1872#elif HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1873 if (CPUMIsGuestInLongModeEx(pCtx))
1874 val |= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE; /* our switcher goes to long mode */
1875 else
1876 Assert(!(val & VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_ADDR_SPACE_SIZE));
1877#endif
1878 val &= pVM->hm.s.vmx.msr.vmx_exit.n.allowed1;
1879
1880 /*
1881 * Don't acknowledge external interrupts on VM-exit.
1882 */
1883 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, val);
1884 AssertRC(rc);
1885
1886 /*
1887 * Guest CPU context: ES, CS, SS, DS, FS, GS.
1888 */
1889 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_SEGMENT_REGS)
1890 {
1891 if (pVM->hm.s.vmx.pRealModeTSS)
1892 {
1893 PGMMODE enmGuestMode = PGMGetGuestMode(pVCpu);
1894 if (pVCpu->hm.s.vmx.enmLastSeenGuestMode != enmGuestMode)
1895 {
1896 /*
1897 * Correct weird requirements for switching to protected mode.
1898 */
1899 if ( pVCpu->hm.s.vmx.enmLastSeenGuestMode == PGMMODE_REAL
1900 && enmGuestMode >= PGMMODE_PROTECTED)
1901 {
1902#ifdef VBOX_WITH_REM
1903 /*
1904 * Flush the recompiler code cache as it's not unlikely the guest will rewrite code
1905 * it will later execute in real mode (OpenBSD 4.0 is one such example)
1906 */
1907 REMFlushTBs(pVM);
1908#endif
1909
1910 /*
1911 * DPL of all hidden selector registers must match the current CPL (0).
1912 */
1913 pCtx->cs.Attr.n.u2Dpl = 0;
1914 pCtx->cs.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
1915
1916 pCtx->ds.Attr.n.u2Dpl = 0;
1917 pCtx->es.Attr.n.u2Dpl = 0;
1918 pCtx->fs.Attr.n.u2Dpl = 0;
1919 pCtx->gs.Attr.n.u2Dpl = 0;
1920 pCtx->ss.Attr.n.u2Dpl = 0;
1921 }
1922 pVCpu->hm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
1923 }
1924 }
1925
1926 VMX_WRITE_SELREG(ES, es);
1927 AssertRC(rc);
1928
1929 VMX_WRITE_SELREG(CS, cs);
1930 AssertRC(rc);
1931
1932 VMX_WRITE_SELREG(SS, ss);
1933 AssertRC(rc);
1934
1935 VMX_WRITE_SELREG(DS, ds);
1936 AssertRC(rc);
1937
1938 VMX_WRITE_SELREG(FS, fs);
1939 AssertRC(rc);
1940
1941 VMX_WRITE_SELREG(GS, gs);
1942 AssertRC(rc);
1943 }
1944
1945 /*
1946 * Guest CPU context: LDTR.
1947 */
1948 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_LDTR)
1949 {
1950 if (pCtx->ldtr.Sel == 0)
1951 {
1952 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1953 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1954 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, 0); /* @todo removing "64" in the function should be the same. */
1955 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1956 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1957 }
1958 else
1959 {
1960 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr.Sel);
1961 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtr.u32Limit);
1962 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtr.u64Base); /* @todo removing "64" and it should be the same */
1963 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtr.Attr.u);
1964 }
1965 AssertRC(rc);
1966 }
1967
1968 /*
1969 * Guest CPU context: TR.
1970 */
1971 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_TR)
1972 {
1973 /*
1974 * Real mode emulation using v86 mode with CR4.VME (interrupt redirection
1975 * using the int bitmap in the TSS).
1976 */
1977 if ( CPUMIsGuestInRealModeEx(pCtx)
1978 && pVM->hm.s.vmx.pRealModeTSS)
1979 {
1980 RTGCPHYS GCPhys;
1981
1982 /* We convert it here every time as PCI regions could be reconfigured. */
1983 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pRealModeTSS, &GCPhys);
1984 AssertRC(rc);
1985
1986 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, 0);
1987 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, HM_VTX_TSS_SIZE);
1988 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1989
1990 X86DESCATTR attr;
1991
1992 attr.u = 0;
1993 attr.n.u1Present = 1;
1994 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1995 val = attr.u;
1996 }
1997 else
1998 {
1999 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr.Sel);
2000 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->tr.u32Limit);
2001 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, pCtx->tr.u64Base);
2002
2003 val = pCtx->tr.Attr.u;
2004
2005 /* The TSS selector must be busy (REM bugs? see defect #XXXX). */
2006 if (!(val & X86_SEL_TYPE_SYS_TSS_BUSY_MASK))
2007 {
2008 if (val & 0xf)
2009 val |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2010 else
2011 /* Default if no TR selector has been set (otherwise vmlaunch will fail!) */
2012 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
2013 }
2014 AssertMsg((val & 0xf) == X86_SEL_TYPE_SYS_386_TSS_BUSY || (val & 0xf) == X86_SEL_TYPE_SYS_286_TSS_BUSY,
2015 ("%#x\n", val));
2016 }
2017 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
2018 AssertRC(rc);
2019 }
2020
2021 /*
2022 * Guest CPU context: GDTR.
2023 */
2024 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_GDTR)
2025 {
2026 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
2027 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
2028 AssertRC(rc);
2029 }
2030
2031 /*
2032 * Guest CPU context: IDTR.
2033 */
2034 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_IDTR)
2035 {
2036 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
2037 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
2038 AssertRC(rc);
2039 }
2040
2041 /*
2042 * Sysenter MSRs.
2043 */
2044 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2045 {
2046 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
2047 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
2048 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
2049 AssertRC(rc);
2050 }
2051
2052 /*
2053 * Guest CPU context: Control registers.
2054 */
2055 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR0)
2056 {
2057 val = pCtx->cr0;
2058 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
2059 Log2(("Guest CR0-shadow %08x\n", val));
2060 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2061 {
2062 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
2063 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
2064 }
2065 else
2066 {
2067 /** @todo check if we support the old style mess correctly. */
2068 if (!(val & X86_CR0_NE))
2069 Log(("Forcing X86_CR0_NE!!!\n"));
2070
2071 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
2072 }
2073 /* Protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
2074 if (!pVM->hm.s.vmx.fUnrestrictedGuest)
2075 val |= X86_CR0_PE | X86_CR0_PG;
2076
2077 if (pVM->hm.s.fNestedPaging)
2078 {
2079 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
2080 {
2081 /* Disable CR3 read/write monitoring as we don't need it for EPT. */
2082 pVCpu->hm.s.vmx.u32ProcCtls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2083 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
2084 }
2085 else
2086 {
2087 /* Reenable CR3 read/write monitoring as our identity mapped page table is active. */
2088 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2089 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2090 }
2091 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2092 AssertRC(rc);
2093 }
2094 else
2095 {
2096 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
2097 val |= X86_CR0_WP;
2098 }
2099
2100 /* Always enable caching. */
2101 val &= ~(X86_CR0_CD|X86_CR0_NW);
2102
2103 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR0, val);
2104 Log2(("Guest CR0 %08x\n", val));
2105
2106 /*
2107 * CR0 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2108 */
2109 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
2110 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
2111 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
2112 | X86_CR0_CD /* Bit not restored during VM-exit! */
2113 | X86_CR0_NW /* Bit not restored during VM-exit! */
2114 | X86_CR0_NE;
2115
2116 /*
2117 * When the guest's FPU state is active, then we no longer care about the FPU related bits.
2118 */
2119 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2120 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_MP;
2121
2122 pVCpu->hm.s.vmx.cr0_mask = val;
2123
2124 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR0_MASK, val);
2125 Log2(("Guest CR0-mask %08x\n", val));
2126 AssertRC(rc);
2127 }
2128
2129 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR4)
2130 {
2131 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
2132 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
2133 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
2134 val = pCtx->cr4 | (uint32_t)pVM->hm.s.vmx.msr.vmx_cr4_fixed0;
2135
2136 if (!pVM->hm.s.fNestedPaging)
2137 {
2138 switch (pVCpu->hm.s.enmShadowMode)
2139 {
2140 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
2141 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
2142 case PGMMODE_32_BIT: /* 32-bit paging. */
2143 val &= ~X86_CR4_PAE;
2144 break;
2145
2146 case PGMMODE_PAE: /* PAE paging. */
2147 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
2148 /** Must use PAE paging as we could use physical memory > 4 GB */
2149 val |= X86_CR4_PAE;
2150 break;
2151
2152 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
2153 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
2154#ifdef VBOX_ENABLE_64_BITS_GUESTS
2155 break;
2156#else
2157 AssertFailed();
2158 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2159#endif
2160 default: /* shut up gcc */
2161 AssertFailed();
2162 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2163 }
2164 }
2165 else if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2166 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2167 {
2168 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
2169 val |= X86_CR4_PSE;
2170 /* Our identity mapping is a 32 bits page directory. */
2171 val &= ~X86_CR4_PAE;
2172 }
2173
2174 /*
2175 * Turn off VME if we're in emulated real mode.
2176 */
2177 if ( CPUMIsGuestInRealModeEx(pCtx)
2178 && pVM->hm.s.vmx.pRealModeTSS)
2179 {
2180 val &= ~X86_CR4_VME;
2181 }
2182
2183 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR4, val);
2184 Log2(("Guest CR4 %08x\n", val));
2185
2186 /*
2187 * CR4 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2188 */
2189 val = 0
2190 | X86_CR4_VME
2191 | X86_CR4_PAE
2192 | X86_CR4_PGE
2193 | X86_CR4_PSE
2194 | X86_CR4_VMXE;
2195 pVCpu->hm.s.vmx.cr4_mask = val;
2196
2197 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR4_MASK, val);
2198 Log2(("Guest CR4-mask %08x\n", val));
2199 AssertRC(rc);
2200 }
2201
2202#if 0
2203 /* Enable single stepping if requested and CPU supports it. */
2204 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG)
2205 if (DBGFIsStepping(pVCpu))
2206 {
2207 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
2208 rc = VMXWriteVmcs(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2209 AssertRC(rc);
2210 }
2211#endif
2212
2213 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR3)
2214 {
2215 if (pVM->hm.s.fNestedPaging)
2216 {
2217 Assert(PGMGetHyperCR3(pVCpu));
2218 pVCpu->hm.s.vmx.HCPhysEPTP = PGMGetHyperCR3(pVCpu);
2219
2220 Assert(!(pVCpu->hm.s.vmx.HCPhysEPTP & 0xfff));
2221 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
2222 pVCpu->hm.s.vmx.HCPhysEPTP |= VMX_EPT_MEMTYPE_WB
2223 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
2224
2225 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
2226 AssertRC(rc);
2227
2228 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2229 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2230 {
2231 RTGCPHYS GCPhys;
2232
2233 /* We convert it here every time as PCI regions could be reconfigured. */
2234 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
2235 AssertMsgRC(rc, ("pNonPagingModeEPTPageTable = %RGv\n", pVM->hm.s.vmx.pNonPagingModeEPTPageTable));
2236
2237 /*
2238 * We use our identity mapping page table here as we need to map guest virtual to
2239 * guest physical addresses; EPT will take care of the translation to host physical addresses.
2240 */
2241 val = GCPhys;
2242 }
2243 else
2244 {
2245 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
2246 val = pCtx->cr3;
2247 rc = hmR0VmxLoadPaePdpes(pVCpu, pCtx);
2248 AssertRCReturn(rc, rc);
2249 }
2250 }
2251 else
2252 {
2253 val = PGMGetHyperCR3(pVCpu);
2254 Assert(val || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
2255 }
2256
2257 /* Save our shadow CR3 register. */
2258 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_CR3, val);
2259 AssertRC(rc);
2260 }
2261
2262 /*
2263 * Guest CPU context: Debug registers.
2264 */
2265 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_DEBUG)
2266 {
2267 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
2268 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
2269
2270 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2271 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2272 pCtx->dr[7] |= 0x400; /* must be one */
2273
2274 /* Resync DR7 */
2275 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2276 AssertRC(rc);
2277
2278#ifdef DEBUG
2279 /* Sync the hypervisor debug state now if any breakpoint is armed. */
2280 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
2281 && !CPUMIsHyperDebugStateActive(pVCpu)
2282 && !DBGFIsStepping(pVCpu))
2283 {
2284 /* Save the host and load the hypervisor debug state. */
2285 rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2286 AssertRC(rc);
2287
2288 /* DRx intercepts remain enabled. */
2289
2290 /* Override dr7 with the hypervisor value. */
2291 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, CPUMGetHyperDR7(pVCpu));
2292 AssertRC(rc);
2293 }
2294 else
2295#endif
2296 /* Sync the debug state now if any breakpoint is armed. */
2297 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
2298 && !CPUMIsGuestDebugStateActive(pVCpu)
2299 && !DBGFIsStepping(pVCpu))
2300 {
2301 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2302
2303 /* Disable DRx move intercepts. */
2304 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2305 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
2306 AssertRC(rc);
2307
2308 /* Save the host and load the guest debug state. */
2309 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2310 AssertRC(rc);
2311 }
2312
2313 /* IA32_DEBUGCTL MSR. */
2314 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);
2315 AssertRC(rc);
2316
2317 /** @todo do we really ever need this? */
2318 rc |= VMXWriteVmcs(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, 0);
2319 AssertRC(rc);
2320 }
2321
2322 /*
2323 * 64-bit guest mode.
2324 */
2325 if (CPUMIsGuestInLongModeEx(pCtx))
2326 {
2327#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
2328 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2329#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2330 pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
2331#else
2332# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
2333 if (!pVM->hm.s.fAllow64BitGuests)
2334 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2335# endif
2336 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM64;
2337#endif
2338 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2339 {
2340 /* Update these as wrmsr might have changed them. */
2341 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_FS_BASE, pCtx->fs.u64Base);
2342 AssertRC(rc);
2343 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_GS_BASE, pCtx->gs.u64Base);
2344 AssertRC(rc);
2345 }
2346 }
2347 else
2348 {
2349 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
2350 }
2351
2352 hmR0VmxUpdateExceptionBitmap(pVM, pVCpu, pCtx);
2353
2354#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2355 /*
2356 * Store all guest MSRs in the VM-entry load area, so they will be loaded
2357 * during VM-entry and restored into the VM-exit store area during VM-exit.
2358 */
2359 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2360 unsigned idxMsr = 0;
2361
2362 uint32_t u32GstExtFeatures;
2363 uint32_t u32Temp;
2364 CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Temp, &u32Temp, &u32Temp, &u32GstExtFeatures);
2365
2366 if (u32GstExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
2367 {
2368 pMsr->u32IndexMSR = MSR_K6_EFER;
2369 pMsr->u32Reserved = 0;
2370 pMsr->u64Value = pCtx->msrEFER;
2371 /* VT-x will complain if only MSR_K6_EFER_LME is set. */
2372 if (!CPUMIsGuestInLongModeEx(pCtx))
2373 pMsr->u64Value &= ~(MSR_K6_EFER_LMA | MSR_K6_EFER_LME);
2374 pMsr++; idxMsr++;
2375
2376 if (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE)
2377 {
2378 pMsr->u32IndexMSR = MSR_K8_LSTAR;
2379 pMsr->u32Reserved = 0;
2380 pMsr->u64Value = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
2381 pMsr++; idxMsr++;
2382 pMsr->u32IndexMSR = MSR_K6_STAR;
2383 pMsr->u32Reserved = 0;
2384 pMsr->u64Value = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
2385 pMsr++; idxMsr++;
2386 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
2387 pMsr->u32Reserved = 0;
2388 pMsr->u64Value = pCtx->msrSFMASK; /* syscall flag mask */
2389 pMsr++; idxMsr++;
2390
2391 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2392#if 0
2393 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
2394 pMsr->u32Reserved = 0;
2395 pMsr->u64Value = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
2396 pMsr++; idxMsr++;
2397#endif
2398 }
2399 }
2400
2401 if ( pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP
2402 && (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP))
2403 {
2404 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
2405 pMsr->u32Reserved = 0;
2406 rc = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pMsr->u64Value);
2407 AssertRC(rc);
2408 pMsr++; idxMsr++;
2409 }
2410
2411 pVCpu->hm.s.vmx.cGuestMsrs = idxMsr;
2412
2413 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, idxMsr);
2414 AssertRC(rc);
2415
2416 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, idxMsr);
2417 AssertRC(rc);
2418#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2419
2420 /* Done with the major changes */
2421 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_ALL_GUEST;
2422
2423 /* Minimal guest state update (ESP, EIP, EFLAGS mostly) */
2424 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
2425
2426 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
2427 return rc;
2428}
2429
2430
2431/**
2432 * Syncs back the guest state from VMCS.
2433 *
2434 * @returns VBox status code.
2435 * @param pVM Pointer to the VM.
2436 * @param pVCpu Pointer to the VMCPU.
2437 * @param pCtx Pointer to the guest CPU context.
2438 */
2439DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2440{
2441 RTGCUINTREG val, valShadow;
2442 RTGCUINTPTR uInterruptState;
2443 int rc;
2444
2445 /* First sync back EIP, ESP, and EFLAGS. */
2446 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RIP, &val);
2447 AssertRC(rc);
2448 pCtx->rip = val;
2449 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RSP, &val);
2450 AssertRC(rc);
2451 pCtx->rsp = val;
2452 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
2453 AssertRC(rc);
2454 pCtx->eflags.u32 = val;
2455
2456 /* Take care of instruction fusing (sti, mov ss) */
2457 rc |= VMXReadCachedVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
2458 uInterruptState = val;
2459 if (uInterruptState != 0)
2460 {
2461 Assert(uInterruptState <= 2); /* only sti & mov ss */
2462 Log(("uInterruptState %x eip=%RGv\n", (uint32_t)uInterruptState, pCtx->rip));
2463 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
2464 }
2465 else
2466 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2467
2468 /* Control registers. */
2469 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
2470 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR0, &val);
2471 val = (valShadow & pVCpu->hm.s.vmx.cr0_mask) | (val & ~pVCpu->hm.s.vmx.cr0_mask);
2472 CPUMSetGuestCR0(pVCpu, val);
2473
2474 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
2475 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR4, &val);
2476 val = (valShadow & pVCpu->hm.s.vmx.cr4_mask) | (val & ~pVCpu->hm.s.vmx.cr4_mask);
2477 CPUMSetGuestCR4(pVCpu, val);
2478
2479 /*
2480 * No reason to sync back the CRx registers. They can't be changed by the guest unless in
2481 * the nested paging case where CR3 & CR4 can be changed by the guest.
2482 */
2483 if ( pVM->hm.s.fNestedPaging
2484 && CPUMIsGuestInPagedProtectedModeEx(pCtx)) /** @todo check if we will always catch mode switches and such... */
2485 {
2486 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
2487
2488 /* Can be updated behind our back in the nested paging case. */
2489 CPUMSetGuestCR2(pVCpu, pCache->cr2);
2490
2491 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR3, &val);
2492
2493 if (val != pCtx->cr3)
2494 {
2495 CPUMSetGuestCR3(pVCpu, val);
2496 PGMUpdateCR3(pVCpu, val);
2497 }
2498 rc = hmR0VmxSavePaePdpes(pVCpu, pCtx);
2499 AssertRCReturn(rc, rc);
2500 }
2501
2502 /* Sync back DR7. */
2503 VMXReadCachedVmcs(VMX_VMCS_GUEST_DR7, &val);
2504 pCtx->dr[7] = val;
2505
2506 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
2507 VMX_READ_SELREG(ES, es);
2508 VMX_READ_SELREG(SS, ss);
2509 VMX_READ_SELREG(CS, cs);
2510 VMX_READ_SELREG(DS, ds);
2511 VMX_READ_SELREG(FS, fs);
2512 VMX_READ_SELREG(GS, gs);
2513
2514 /* System MSRs */
2515 VMXReadCachedVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
2516 pCtx->SysEnter.cs = val;
2517 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
2518 pCtx->SysEnter.eip = val;
2519 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
2520 pCtx->SysEnter.esp = val;
2521
2522 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
2523 VMX_READ_SELREG(LDTR, ldtr);
2524
2525 VMXReadCachedVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
2526 pCtx->gdtr.cbGdt = val;
2527 VMXReadCachedVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val);
2528 pCtx->gdtr.pGdt = val;
2529
2530 VMXReadCachedVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
2531 pCtx->idtr.cbIdt = val;
2532 VMXReadCachedVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val);
2533 pCtx->idtr.pIdt = val;
2534
2535 /* Real mode emulation using v86 mode. */
2536 if ( CPUMIsGuestInRealModeEx(pCtx)
2537 && pVM->hm.s.vmx.pRealModeTSS)
2538 {
2539 /* Hide our emulation flags */
2540 pCtx->eflags.Bits.u1VM = 0;
2541
2542 /* Restore original IOPL setting as we always use 0. */
2543 pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.eflags.Bits.u2IOPL;
2544
2545 /* Force a TR resync every time in case we switch modes. */
2546 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_TR;
2547 }
2548 else
2549 {
2550 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
2551 VMX_READ_SELREG(TR, tr);
2552 }
2553
2554#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2555 /*
2556 * Save the possibly changed MSRs that we automatically restore and save during a world switch.
2557 */
2558 for (unsigned i = 0; i < pVCpu->hm.s.vmx.cGuestMsrs; i++)
2559 {
2560 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2561 pMsr += i;
2562
2563 switch (pMsr->u32IndexMSR)
2564 {
2565 case MSR_K8_LSTAR:
2566 pCtx->msrLSTAR = pMsr->u64Value;
2567 break;
2568 case MSR_K6_STAR:
2569 pCtx->msrSTAR = pMsr->u64Value;
2570 break;
2571 case MSR_K8_SF_MASK:
2572 pCtx->msrSFMASK = pMsr->u64Value;
2573 break;
2574 /* The KERNEL_GS_BASE MSR doesn't work reliably with auto load/store. See @bugref{6208} */
2575#if 0
2576 case MSR_K8_KERNEL_GS_BASE:
2577 pCtx->msrKERNELGSBASE = pMsr->u64Value;
2578 break;
2579#endif
2580 case MSR_K8_TSC_AUX:
2581 CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, pMsr->u64Value);
2582 break;
2583
2584 case MSR_K6_EFER:
2585 /* EFER can't be changed without causing a VM-exit. */
2586 /* Assert(pCtx->msrEFER == pMsr->u64Value); */
2587 break;
2588
2589 default:
2590 AssertFailed();
2591 return VERR_HM_UNEXPECTED_LD_ST_MSR;
2592 }
2593 }
2594#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2595 return VINF_SUCCESS;
2596}
2597
2598
2599/**
2600 * Dummy placeholder for TLB flush handling before VM-entry. Used in the case
2601 * where neither EPT nor VPID is supported by the CPU.
2602 *
2603 * @param pVM Pointer to the VM.
2604 * @param pVCpu Pointer to the VMCPU.
2605 */
2606static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu)
2607{
2608 NOREF(pVM);
2609 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH);
2610 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2611 pVCpu->hm.s.TlbShootdown.cPages = 0;
2612}
2613
2614
2615/**
2616 * Setup the tagged TLB for EPT+VPID.
2617 *
2618 * @param pVM Pointer to the VM.
2619 * @param pVCpu Pointer to the VMCPU.
2620 */
2621static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu)
2622{
2623 PHMGLOBLCPUINFO pCpu;
2624
2625 Assert(pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid);
2626
2627 pCpu = HMR0GetCurrentCpu();
2628
2629 /*
2630 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2631 * This can happen both for start & resume due to long jumps back to ring-3.
2632 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2633 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2634 */
2635 bool fNewAsid = false;
2636 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2637 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2638 {
2639 pVCpu->hm.s.fForceTLBFlush = true;
2640 fNewAsid = true;
2641 }
2642
2643 /*
2644 * Check for explicit TLB shootdowns.
2645 */
2646 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2647 pVCpu->hm.s.fForceTLBFlush = true;
2648
2649 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2650
2651 if (pVCpu->hm.s.fForceTLBFlush)
2652 {
2653 if (fNewAsid)
2654 {
2655 ++pCpu->uCurrentAsid;
2656 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2657 {
2658 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2659 pCpu->cTlbFlushes++;
2660 pCpu->fFlushAsidBeforeUse = true;
2661 }
2662
2663 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2664 if (pCpu->fFlushAsidBeforeUse)
2665 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2666 }
2667 else
2668 {
2669 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
2670 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_SINGLE_CONTEXT, 0 /* GCPtr */);
2671 else
2672 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2673 }
2674
2675 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2676 pVCpu->hm.s.fForceTLBFlush = false;
2677 }
2678 else
2679 {
2680 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2681 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2682 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2683 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2684
2685 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2686 * not be executed. See hmQueueInvlPage() where it is commented
2687 * out. Support individual entry flushing someday. */
2688 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2689 {
2690 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2691
2692 /*
2693 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2694 * as supported by the CPU.
2695 */
2696 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2697 {
2698 for (uint32_t i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2699 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2700 }
2701 else
2702 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2703 }
2704 else
2705 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2706 }
2707
2708 pVCpu->hm.s.TlbShootdown.cPages = 0;
2709 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2710
2711 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2712 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2713 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2714 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2715 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2716 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2717
2718 /* Update VMCS with the VPID. */
2719 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2720 AssertRC(rc);
2721}
2722
2723
2724/**
2725 * Setup the tagged TLB for EPT only.
2726 *
2727 * @returns VBox status code.
2728 * @param pVM Pointer to the VM.
2729 * @param pVCpu Pointer to the VMCPU.
2730 */
2731static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu)
2732{
2733 PHMGLOBLCPUINFO pCpu;
2734
2735 Assert(pVM->hm.s.fNestedPaging);
2736 Assert(!pVM->hm.s.vmx.fVpid);
2737
2738 pCpu = HMR0GetCurrentCpu();
2739
2740 /*
2741 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2742 * This can happen both for start & resume due to long jumps back to ring-3.
2743 * A change in the TLB flush count implies the host Cpu is online after a suspend/resume.
2744 */
2745 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2746 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2747 {
2748 pVCpu->hm.s.fForceTLBFlush = true;
2749 }
2750
2751 /*
2752 * Check for explicit TLB shootdown flushes.
2753 */
2754 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2755 pVCpu->hm.s.fForceTLBFlush = true;
2756
2757 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2758 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2759
2760 if (pVCpu->hm.s.fForceTLBFlush)
2761 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2762 else
2763 {
2764 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2765 * not be executed. See hmQueueInvlPage() where it is commented
2766 * out. Support individual entry flushing someday. */
2767 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2768 {
2769 /*
2770 * We cannot flush individual entries without VPID support. Flush using EPT.
2771 */
2772 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2773 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2774 }
2775 }
2776 pVCpu->hm.s.TlbShootdown.cPages = 0;
2777 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2778
2779#ifdef VBOX_WITH_STATISTICS
2780 /** @todo r=ramshankar: this is not accurate anymore with the VPID+EPT
2781 * handling. Should be fixed later. */
2782 if (pVCpu->hm.s.fForceTLBFlush)
2783 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2784 else
2785 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2786#endif
2787}
2788
2789
2790/**
2791 * Setup the tagged TLB for VPID.
2792 *
2793 * @returns VBox status code.
2794 * @param pVM Pointer to the VM.
2795 * @param pVCpu Pointer to the VMCPU.
2796 */
2797static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu)
2798{
2799 PHMGLOBLCPUINFO pCpu;
2800
2801 Assert(pVM->hm.s.vmx.fVpid);
2802 Assert(!pVM->hm.s.fNestedPaging);
2803
2804 pCpu = HMR0GetCurrentCpu();
2805
2806 /*
2807 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2808 * This can happen both for start & resume due to long jumps back to ring-3.
2809 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2810 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2811 */
2812 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2813 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2814 {
2815 /* Force a TLB flush on VM entry. */
2816 pVCpu->hm.s.fForceTLBFlush = true;
2817 }
2818
2819 /*
2820 * Check for explicit TLB shootdown flushes.
2821 */
2822 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2823 pVCpu->hm.s.fForceTLBFlush = true;
2824
2825 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2826
2827 if (pVCpu->hm.s.fForceTLBFlush)
2828 {
2829 ++pCpu->uCurrentAsid;
2830 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2831 {
2832 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2833 pCpu->cTlbFlushes++;
2834 pCpu->fFlushAsidBeforeUse = true;
2835 }
2836
2837 pVCpu->hm.s.fForceTLBFlush = false;
2838 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2839 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2840 if (pCpu->fFlushAsidBeforeUse)
2841 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2842 }
2843 else
2844 {
2845 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2846 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2847 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2848 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2849
2850 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2851 * not be executed. See hmQueueInvlPage() where it is commented
2852 * out. Support individual entry flushing someday. */
2853 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2854 {
2855 /*
2856 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2857 * as supported by the CPU.
2858 */
2859 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2860 {
2861 for (uint32_t i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2862 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2863 }
2864 else
2865 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2866 }
2867 }
2868 pVCpu->hm.s.TlbShootdown.cPages = 0;
2869 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2870
2871 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2872 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2873 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2874 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2875 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2876 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2877
2878 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2879 AssertRC(rc);
2880
2881# ifdef VBOX_WITH_STATISTICS
2882 /** @todo r=ramshankar: this is not accurate anymore with EPT+VPID handling.
2883 * Should be fixed later. */
2884 if (pVCpu->hm.s.fForceTLBFlush)
2885 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2886 else
2887 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2888# endif
2889}
2890
2891
2892/**
2893 * Runs guest code in a VT-x VM.
2894 *
2895 * @returns VBox status code.
2896 * @param pVM Pointer to the VM.
2897 * @param pVCpu Pointer to the VMCPU.
2898 * @param pCtx Pointer to the guest CPU context.
2899 */
2900VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2901{
2902 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
2903 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
2904 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
2905
2906 VBOXSTRICTRC rc = VINF_SUCCESS;
2907 int rc2;
2908 RTGCUINTREG val;
2909 RTGCUINTREG exitReason = (RTGCUINTREG)VMX_EXIT_INVALID;
2910 RTGCUINTREG instrError, cbInstr;
2911 RTGCUINTPTR exitQualification = 0;
2912 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
2913 RTGCUINTPTR errCode, instrInfo;
2914 bool fSetupTPRCaching = false;
2915 bool fNeedTscSetup = true;
2916 uint64_t u64OldLSTAR = 0;
2917 uint8_t u8LastTPR = 0;
2918 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
2919 unsigned cResume = 0;
2920#ifdef VBOX_STRICT
2921 RTCPUID idCpuCheck;
2922 bool fWasInLongMode = false;
2923#endif
2924#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2925 uint64_t u64LastTime = RTTimeMilliTS();
2926#endif
2927
2928 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2929 || (pVCpu->hm.s.vmx.pbVirtApic && pVM->hm.s.vmx.pbApicAccess));
2930
2931 /*
2932 * Check if we need to use TPR shadowing.
2933 */
2934 if ( CPUMIsGuestInLongModeEx(pCtx)
2935 || ( (( pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2936 || pVM->hm.s.fTRPPatchingAllowed)
2937 && pVM->hm.s.fHasIoApic)
2938 )
2939 {
2940 fSetupTPRCaching = true;
2941 }
2942
2943 Log2(("\nE"));
2944
2945 /* This is not ideal, but if we don't clear the event injection in the VMCS right here,
2946 * we may end up injecting some stale event into a VM, including injecting an event that
2947 * originated before a VM reset *after* the VM has been reset. See @bugref{6220}.
2948 */
2949 VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, 0);
2950
2951#ifdef VBOX_STRICT
2952 {
2953 RTCCUINTREG val2;
2954
2955 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val2);
2956 AssertRC(rc2);
2957 Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val2));
2958
2959 /* allowed zero */
2960 if ((val2 & pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
2961 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
2962
2963 /* allowed one */
2964 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
2965 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
2966
2967 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val2);
2968 AssertRC(rc2);
2969 Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val2));
2970
2971 /*
2972 * Must be set according to the MSR, but can be cleared if nested paging is used.
2973 */
2974 if (pVM->hm.s.fNestedPaging)
2975 {
2976 val2 |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
2977 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT
2978 | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
2979 }
2980
2981 /* allowed zero */
2982 if ((val2 & pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
2983 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
2984
2985 /* allowed one */
2986 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
2987 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
2988
2989 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val2);
2990 AssertRC(rc2);
2991 Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val2));
2992
2993 /* allowed zero */
2994 if ((val2 & pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0)
2995 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
2996
2997 /* allowed one */
2998 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
2999 Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
3000
3001 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val2);
3002 AssertRC(rc2);
3003 Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val2));
3004
3005 /* allowed zero */
3006 if ((val2 & pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0)
3007 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
3008
3009 /* allowed one */
3010 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
3011 Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
3012 }
3013 fWasInLongMode = CPUMIsGuestInLongModeEx(pCtx);
3014#endif /* VBOX_STRICT */
3015
3016#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3017 pVCpu->hm.s.vmx.VMCSCache.u64TimeEntry = RTTimeNanoTS();
3018#endif
3019
3020 /*
3021 * We can jump to this point to resume execution after determining that a VM-exit is innocent.
3022 */
3023ResumeExecution:
3024 if (!STAM_REL_PROFILE_ADV_IS_RUNNING(&pVCpu->hm.s.StatEntry))
3025 STAM_REL_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit2, &pVCpu->hm.s.StatEntry, x);
3026 AssertMsg(pVCpu->hm.s.idEnteredCpu == RTMpCpuId(),
3027 ("Expected %d, I'm %d; cResume=%d exitReason=%RGv exitQualification=%RGv\n",
3028 (int)pVCpu->hm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
3029 Assert(!HMR0SuspendPending());
3030 /* Not allowed to switch modes without reloading the host state (32->64 switcher)!! */
3031 Assert(fWasInLongMode == CPUMIsGuestInLongModeEx(pCtx));
3032
3033 /*
3034 * Safety precaution; looping for too long here can have a very bad effect on the host.
3035 */
3036 if (RT_UNLIKELY(++cResume > pVM->hm.s.cMaxResumeLoops))
3037 {
3038 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMaxResume);
3039 rc = VINF_EM_RAW_INTERRUPT;
3040 goto end;
3041 }
3042
3043 /*
3044 * Check for IRQ inhibition due to instruction fusing (sti, mov ss).
3045 */
3046 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
3047 {
3048 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
3049 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
3050 {
3051 /*
3052 * Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
3053 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
3054 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
3055 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
3056 */
3057 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3058 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3059 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3060 AssertRC(rc2);
3061 }
3062 }
3063 else
3064 {
3065 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3066 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3067 AssertRC(rc2);
3068 }
3069
3070#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
3071 if (RT_UNLIKELY((cResume & 0xf) == 0))
3072 {
3073 uint64_t u64CurTime = RTTimeMilliTS();
3074
3075 if (RT_UNLIKELY(u64CurTime > u64LastTime))
3076 {
3077 u64LastTime = u64CurTime;
3078 TMTimerPollVoid(pVM, pVCpu);
3079 }
3080 }
3081#endif
3082
3083 /*
3084 * Check for pending actions that force us to go back to ring-3.
3085 */
3086 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK | VM_FF_REQUEST | VM_FF_PGM_POOL_FLUSH_PENDING | VM_FF_PDM_DMA)
3087 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL | VMCPU_FF_REQUEST))
3088 {
3089 /* Check if a sync operation is pending. */
3090 if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
3091 {
3092 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
3093 if (rc != VINF_SUCCESS)
3094 {
3095 AssertRC(VBOXSTRICTRC_VAL(rc));
3096 Log(("Pending pool sync is forcing us back to ring 3; rc=%d\n", VBOXSTRICTRC_VAL(rc)));
3097 goto end;
3098 }
3099 }
3100
3101#ifdef DEBUG
3102 /* Intercept X86_XCPT_DB if stepping is enabled */
3103 if (!DBGFIsStepping(pVCpu))
3104#endif
3105 {
3106 if ( VM_FF_ISPENDING(pVM, VM_FF_HM_TO_R3_MASK)
3107 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
3108 {
3109 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
3110 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
3111 goto end;
3112 }
3113 }
3114
3115 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
3116 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
3117 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
3118 {
3119 rc = VINF_EM_PENDING_REQUEST;
3120 goto end;
3121 }
3122
3123 /* Check if a pgm pool flush is in progress. */
3124 if (VM_FF_ISPENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
3125 {
3126 rc = VINF_PGM_POOL_FLUSH_PENDING;
3127 goto end;
3128 }
3129
3130 /* Check if DMA work is pending (2nd+ run). */
3131 if (VM_FF_ISPENDING(pVM, VM_FF_PDM_DMA) && cResume > 1)
3132 {
3133 rc = VINF_EM_RAW_TO_R3;
3134 goto end;
3135 }
3136 }
3137
3138#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3139 /*
3140 * Exit to ring-3 preemption/work is pending.
3141 *
3142 * Interrupts are disabled before the call to make sure we don't miss any interrupt
3143 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
3144 * further down, but hmR0VmxCheckPendingInterrupt makes that impossible.)
3145 *
3146 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
3147 * shootdowns rely on this.
3148 */
3149 uOldEFlags = ASMIntDisableFlags();
3150 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
3151 {
3152 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
3153 rc = VINF_EM_RAW_INTERRUPT;
3154 goto end;
3155 }
3156 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3157#endif
3158
3159 /*
3160 * When external interrupts are pending, we should exit the VM when IF is set.
3161 * Note: *After* VM_FF_INHIBIT_INTERRUPTS check!
3162 */
3163 rc = hmR0VmxCheckPendingInterrupt(pVM, pVCpu, pCtx);
3164 if (RT_FAILURE(rc))
3165 goto end;
3166
3167 /** @todo check timers?? */
3168
3169 /*
3170 * TPR caching using CR8 is only available in 64-bit mode.
3171 * Note: The 32-bit exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but this appears missing in Intel CPUs.
3172 * Note: We can't do this in LoadGuestState() as PDMApicGetTPR can jump back to ring-3 (lock)!! (no longer true) .
3173 */
3174 /** @todo query and update the TPR only when it could have been changed (mmio
3175 * access & wrsmr (x2apic) */
3176 if (fSetupTPRCaching)
3177 {
3178 /* TPR caching in CR8 */
3179 bool fPending;
3180
3181 rc2 = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending);
3182 AssertRC(rc2);
3183 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
3184 pVCpu->hm.s.vmx.pbVirtApic[0x80] = u8LastTPR;
3185
3186 /*
3187 * Two options here:
3188 * - external interrupt pending, but masked by the TPR value.
3189 * -> a CR8 update that lower the current TPR value should cause an exit
3190 * - no pending interrupts
3191 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
3192 */
3193
3194 /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
3195 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, (fPending) ? (u8LastTPR >> 4) : 0);
3196 AssertRC(VBOXSTRICTRC_VAL(rc));
3197
3198 if (pVM->hm.s.fTPRPatchingActive)
3199 {
3200 Assert(!CPUMIsGuestInLongModeEx(pCtx));
3201 /* Our patch code uses LSTAR for TPR caching. */
3202 pCtx->msrLSTAR = u8LastTPR;
3203
3204 /** @todo r=ramshankar: we should check for MSR-bitmap support here. */
3205 if (fPending)
3206 {
3207 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
3208 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
3209 }
3210 else
3211 {
3212 /*
3213 * No interrupts are pending, so we don't need to be explicitely notified.
3214 * There are enough world switches for detecting pending interrupts.
3215 */
3216 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
3217 }
3218 }
3219 }
3220
3221#ifdef LOG_ENABLED
3222 if ( pVM->hm.s.fNestedPaging
3223 || pVM->hm.s.vmx.fVpid)
3224 {
3225 PHMGLOBLCPUINFO pCpu = HMR0GetCurrentCpu();
3226 if (pVCpu->hm.s.idLastCpu != pCpu->idCpu)
3227 {
3228 LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hm.s.idLastCpu,
3229 pCpu->idCpu));
3230 }
3231 else if (pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
3232 {
3233 LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hm.s.cTlbFlushes,
3234 pCpu->cTlbFlushes));
3235 }
3236 else if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH))
3237 LogFlow(("Manual TLB flush\n"));
3238 }
3239#endif
3240#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
3241 PGMRZDynMapFlushAutoSet(pVCpu);
3242#endif
3243
3244 /*
3245 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING-3!
3246 * (until the actual world switch)
3247 */
3248#ifdef VBOX_STRICT
3249 idCpuCheck = RTMpCpuId();
3250#endif
3251#ifdef LOG_ENABLED
3252 VMMR0LogFlushDisable(pVCpu);
3253#endif
3254
3255 /*
3256 * Save the host state first.
3257 */
3258 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
3259 {
3260 rc = VMXR0SaveHostState(pVM, pVCpu);
3261 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3262 {
3263 VMMR0LogFlushEnable(pVCpu);
3264 goto end;
3265 }
3266 }
3267
3268 /*
3269 * Load the guest state.
3270 */
3271 if (!pVCpu->hm.s.fContextUseFlags)
3272 {
3273 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
3274 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadMinimal);
3275 if (fNeedTscSetup)
3276 {
3277 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3278 fNeedTscSetup = false;
3279 }
3280 }
3281 else
3282 {
3283 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
3284 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3285 {
3286 VMMR0LogFlushEnable(pVCpu);
3287 goto end;
3288 }
3289 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
3290 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3291 }
3292
3293#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3294 /*
3295 * Disable interrupts to make sure a poke will interrupt execution.
3296 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
3297 */
3298 uOldEFlags = ASMIntDisableFlags();
3299 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3300#endif
3301
3302 /* Non-register state Guest Context */
3303 /** @todo change me according to cpu state */
3304 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_VMCS_GUEST_ACTIVITY_ACTIVE);
3305 AssertRC(rc2);
3306
3307 /* Set TLB flush state as checked until we return from the world switch. */
3308 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);
3309 /* Deal with tagged TLB setup and invalidation. */
3310 pVM->hm.s.vmx.pfnFlushTaggedTlb(pVM, pVCpu);
3311
3312 /*
3313 * Manual save and restore:
3314 * - General purpose registers except RIP, RSP
3315 *
3316 * Trashed:
3317 * - CR2 (we don't care)
3318 * - LDTR (reset to 0)
3319 * - DRx (presumably not changed at all)
3320 * - DR7 (reset to 0x400)
3321 * - EFLAGS (reset to RT_BIT(1); not relevant)
3322 */
3323
3324 /* All done! Let's start VM execution. */
3325 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatEntry, &pVCpu->hm.s.StatInGC, x);
3326 Assert(idCpuCheck == RTMpCpuId());
3327
3328#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3329 pVCpu->hm.s.vmx.VMCSCache.cResume = cResume;
3330 pVCpu->hm.s.vmx.VMCSCache.u64TimeSwitch = RTTimeNanoTS();
3331#endif
3332
3333 /*
3334 * Save the current TPR value in the LSTAR MSR so our patches can access it.
3335 */
3336 if (pVM->hm.s.fTPRPatchingActive)
3337 {
3338 Assert(pVM->hm.s.fTPRPatchingActive);
3339 u64OldLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3340 ASMWrMsr(MSR_K8_LSTAR, u8LastTPR);
3341 }
3342
3343 TMNotifyStartOfExecution(pVCpu);
3344
3345#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3346 /*
3347 * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
3348 * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
3349 */
3350 if ( (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3351 && !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3352 {
3353 pVCpu->hm.s.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
3354 uint64_t u64GuestTSCAux = 0;
3355 rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64GuestTSCAux);
3356 AssertRC(rc2);
3357 ASMWrMsr(MSR_K8_TSC_AUX, u64GuestTSCAux);
3358 }
3359#endif
3360
3361#ifdef VBOX_WITH_KERNEL_USING_XMM
3362 rc = hmR0VMXStartVMWrapXMM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu, pVCpu->hm.s.vmx.pfnStartVM);
3363#else
3364 rc = pVCpu->hm.s.vmx.pfnStartVM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu);
3365#endif
3366 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false);
3367 ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits);
3368
3369 /* Possibly the last TSC value seen by the guest (too high) (only when we're in TSC offset mode). */
3370 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
3371 {
3372#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3373 /* Restore host's TSC_AUX. */
3374 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3375 ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hm.s.u64HostTSCAux);
3376#endif
3377
3378 TMCpuTickSetLastSeen(pVCpu,
3379 ASMReadTSC() + pVCpu->hm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
3380 }
3381
3382 TMNotifyEndOfExecution(pVCpu);
3383 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
3384 Assert(!(ASMGetFlags() & X86_EFL_IF));
3385
3386 /*
3387 * Restore the host LSTAR MSR if the guest could have changed it.
3388 */
3389 if (pVM->hm.s.fTPRPatchingActive)
3390 {
3391 Assert(pVM->hm.s.fTPRPatchingActive);
3392 pVCpu->hm.s.vmx.pbVirtApic[0x80] = pCtx->msrLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3393 ASMWrMsr(MSR_K8_LSTAR, u64OldLSTAR);
3394 }
3395
3396 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
3397 ASMSetFlags(uOldEFlags);
3398#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3399 uOldEFlags = ~(RTCCUINTREG)0;
3400#endif
3401
3402 AssertMsg(!pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries, ("pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries=%d\n",
3403 pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries));
3404
3405 /* In case we execute a goto ResumeExecution later on. */
3406 pVCpu->hm.s.fResumeVM = true;
3407 pVCpu->hm.s.fForceTLBFlush = false;
3408
3409 /*
3410 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3411 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
3412 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3413 */
3414
3415 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3416 {
3417 hmR0VmxReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
3418 VMMR0LogFlushEnable(pVCpu);
3419 goto end;
3420 }
3421
3422 /* Success. Query the guest state and figure out what has happened. */
3423
3424 /* Investigate why there was a VM-exit. */
3425 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3426 STAM_COUNTER_INC(&pVCpu->hm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
3427
3428 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
3429 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3430 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
3431 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &intInfo);
3432 /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
3433 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE, &errCode);
3434 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_INFO, &instrInfo);
3435 rc2 |= VMXReadCachedVmcs(VMX_VMCS_RO_EXIT_QUALIFICATION, &exitQualification);
3436 AssertRC(rc2);
3437
3438 /*
3439 * Sync back the guest state.
3440 */
3441 rc2 = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
3442 AssertRC(rc2);
3443
3444 /* Note! NOW IT'S SAFE FOR LOGGING! */
3445 VMMR0LogFlushEnable(pVCpu);
3446 Log2(("Raw exit reason %08x\n", exitReason));
3447#if ARCH_BITS == 64 /* for the time being */
3448 VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pCtx, exitReason);
3449#endif
3450
3451 /*
3452 * Check if an injected event was interrupted prematurely.
3453 */
3454 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_INFO, &val);
3455 AssertRC(rc2);
3456 pVCpu->hm.s.Event.u64IntrInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
3457 if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3458 /* Ignore 'int xx' as they'll be restarted anyway. */
3459 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
3460 /* Ignore software exceptions (such as int3) as they'll reoccur when we restart the instruction anyway. */
3461 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3462 {
3463 Assert(!pVCpu->hm.s.Event.fPending);
3464 pVCpu->hm.s.Event.fPending = true;
3465 /* Error code present? */
3466 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
3467 {
3468 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_ERROR_CODE, &val);
3469 AssertRC(rc2);
3470 pVCpu->hm.s.Event.u32ErrCode = val;
3471 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv pending error=%RX64\n",
3472 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
3473 }
3474 else
3475 {
3476 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hm.s.Event.u64IntrInfo,
3477 (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3478 pVCpu->hm.s.Event.u32ErrCode = 0;
3479 }
3480 }
3481#ifdef VBOX_STRICT
3482 else if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3483 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
3484 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3485 {
3486 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n",
3487 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3488 }
3489
3490 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
3491 HMDumpRegs(pVM, pVCpu, pCtx);
3492#endif
3493
3494 Log2(("E%d: New EIP=%x:%RGv\n", (uint32_t)exitReason, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3495 Log2(("Exit reason %d, exitQualification %RGv\n", (uint32_t)exitReason, exitQualification));
3496 Log2(("instrInfo=%d instrError=%d instr length=%d\n", (uint32_t)instrInfo, (uint32_t)instrError, (uint32_t)cbInstr));
3497 Log2(("Interruption error code %d\n", (uint32_t)errCode));
3498 Log2(("IntInfo = %08x\n", (uint32_t)intInfo));
3499
3500 /*
3501 * Sync back the TPR if it was changed.
3502 */
3503 if ( fSetupTPRCaching
3504 && u8LastTPR != pVCpu->hm.s.vmx.pbVirtApic[0x80])
3505 {
3506 rc2 = PDMApicSetTPR(pVCpu, pVCpu->hm.s.vmx.pbVirtApic[0x80]);
3507 AssertRC(rc2);
3508 }
3509
3510#ifdef DBGFTRACE_ENABLED /** @todo DTrace later. */
3511 RTTraceBufAddMsgF(pVM->CTX_SUFF(hTraceBuf), "vmexit %08x %016RX64 at %04:%08RX64 %RX64",
3512 exitReason, (uint64_t)exitQualification, pCtx->cs.Sel, pCtx->rip, (uint64_t)intInfo);
3513#endif
3514 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
3515
3516 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
3517 Assert(rc == VINF_SUCCESS); /* might consider VERR_IPE_UNINITIALIZED_STATUS here later... */
3518 switch (exitReason)
3519 {
3520 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
3521 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
3522 {
3523 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
3524
3525 if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
3526 {
3527 Assert(exitReason == VMX_EXIT_EXT_INT);
3528 /* External interrupt; leave to allow it to be dispatched again. */
3529 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitExtInt);
3530 rc = VINF_EM_RAW_INTERRUPT;
3531 break;
3532 }
3533 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitXcptNmi, y3);
3534 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
3535 {
3536 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
3537 /* External interrupt; leave to allow it to be dispatched again. */
3538 rc = VINF_EM_RAW_INTERRUPT;
3539 break;
3540
3541 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT: /* External hardware interrupt. */
3542 AssertFailed(); /* can't come here; fails the first check. */
3543 break;
3544
3545 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT: /* Unknown why we get this type for #DB */
3546 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /* Software exception. (#BP or #OF) */
3547 Assert(vector == 1 || vector == 3 || vector == 4);
3548 /* no break */
3549 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT: /* Hardware exception. */
3550 Log2(("Hardware/software interrupt %d\n", vector));
3551 switch (vector)
3552 {
3553 case X86_XCPT_NM:
3554 {
3555 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
3556
3557 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
3558 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
3559 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
3560 if (rc == VINF_SUCCESS)
3561 {
3562 Assert(CPUMIsGuestFPUStateActive(pVCpu));
3563
3564 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowNM);
3565
3566 /* Continue execution. */
3567 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
3568
3569 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3570 goto ResumeExecution;
3571 }
3572
3573 Log(("Forward #NM fault to the guest\n"));
3574 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNM);
3575 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3576 cbInstr, 0);
3577 AssertRC(rc2);
3578 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3579 goto ResumeExecution;
3580 }
3581
3582 case X86_XCPT_PF: /* Page fault */
3583 {
3584#ifdef VBOX_ALWAYS_TRAP_PF
3585 if (pVM->hm.s.fNestedPaging)
3586 {
3587 /*
3588 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3589 */
3590 Log(("Guest page fault at %RGv cr2=%RGv error code %RGv rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification,
3591 errCode, (RTGCPTR)pCtx->rsp));
3592
3593 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
3594
3595 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3596
3597 /* Now we must update CR2. */
3598 pCtx->cr2 = exitQualification;
3599 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3600 cbInstr, errCode);
3601 AssertRC(rc2);
3602
3603 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3604 goto ResumeExecution;
3605 }
3606#else
3607 Assert(!pVM->hm.s.fNestedPaging);
3608#endif
3609
3610#ifdef VBOX_HM_WITH_GUEST_PATCHING
3611 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
3612 if ( pVM->hm.s.fTRPPatchingAllowed
3613 && pVM->hm.s.pGuestPatchMem
3614 && (exitQualification & 0xfff) == 0x080
3615 && !(errCode & X86_TRAP_PF_P) /* not present */
3616 && CPUMGetGuestCPL(pVCpu) == 0
3617 && !CPUMIsGuestInLongModeEx(pCtx)
3618 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
3619 {
3620 RTGCPHYS GCPhysApicBase, GCPhys;
3621 GCPhysApicBase = pCtx->msrApicBase;
3622 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3623
3624 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3625 if ( rc == VINF_SUCCESS
3626 && GCPhys == GCPhysApicBase)
3627 {
3628 /* Only attempt to patch the instruction once. */
3629 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
3630 if (!pPatch)
3631 {
3632 rc = VINF_EM_HM_PATCH_TPR_INSTR;
3633 break;
3634 }
3635 }
3636 }
3637#endif
3638
3639 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
3640 /* Exit qualification contains the linear address of the page fault. */
3641 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3642 TRPMSetErrorCode(pVCpu, errCode);
3643 TRPMSetFaultAddress(pVCpu, exitQualification);
3644
3645 /* Shortcut for APIC TPR reads and writes. */
3646 if ( (exitQualification & 0xfff) == 0x080
3647 && !(errCode & X86_TRAP_PF_P) /* not present */
3648 && fSetupTPRCaching
3649 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3650 {
3651 RTGCPHYS GCPhysApicBase, GCPhys;
3652 GCPhysApicBase = pCtx->msrApicBase;
3653 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3654
3655 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3656 if ( rc == VINF_SUCCESS
3657 && GCPhys == GCPhysApicBase)
3658 {
3659 Log(("Enable VT-x virtual APIC access filtering\n"));
3660 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
3661 X86_PTE_RW | X86_PTE_P);
3662 AssertRC(rc2);
3663 }
3664 }
3665
3666 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
3667 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
3668 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3669
3670 if (rc == VINF_SUCCESS)
3671 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3672 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
3673 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
3674
3675 TRPMResetTrap(pVCpu);
3676 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3677 goto ResumeExecution;
3678 }
3679 else if (rc == VINF_EM_RAW_GUEST_TRAP)
3680 {
3681 /*
3682 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3683 */
3684 Log2(("Forward page fault to the guest\n"));
3685
3686 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3687 /* The error code might have been changed. */
3688 errCode = TRPMGetErrorCode(pVCpu);
3689
3690 TRPMResetTrap(pVCpu);
3691
3692 /* Now we must update CR2. */
3693 pCtx->cr2 = exitQualification;
3694 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3695 cbInstr, errCode);
3696 AssertRC(rc2);
3697
3698 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3699 goto ResumeExecution;
3700 }
3701#ifdef VBOX_STRICT
3702 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
3703 Log2(("PGMTrap0eHandler failed with %d\n", VBOXSTRICTRC_VAL(rc)));
3704#endif
3705 /* Need to go back to the recompiler to emulate the instruction. */
3706 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPFEM);
3707 TRPMResetTrap(pVCpu);
3708
3709 /* If event delivery caused the #PF (shadow or not), tell TRPM. */
3710 hmR0VmxCheckPendingEvent(pVCpu);
3711 break;
3712 }
3713
3714 case X86_XCPT_MF: /* Floating point exception. */
3715 {
3716 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
3717 if (!(pCtx->cr0 & X86_CR0_NE))
3718 {
3719 /* old style FPU error reporting needs some extra work. */
3720 /** @todo don't fall back to the recompiler, but do it manually. */
3721 rc = VINF_EM_RAW_EMULATE_INSTR;
3722 break;
3723 }
3724 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3725 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3726 cbInstr, errCode);
3727 AssertRC(rc2);
3728
3729 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3730 goto ResumeExecution;
3731 }
3732
3733 case X86_XCPT_DB: /* Debug exception. */
3734 {
3735 uint64_t uDR6;
3736
3737 /*
3738 * DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
3739 *
3740 * Exit qualification bits:
3741 * 3:0 B0-B3 which breakpoint condition was met
3742 * 12:4 Reserved (0)
3743 * 13 BD - debug register access detected
3744 * 14 BS - single step execution or branch taken
3745 * 63:15 Reserved (0)
3746 */
3747 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
3748
3749 /* Note that we don't support guest and host-initiated debugging at the same time. */
3750
3751 uDR6 = X86_DR6_INIT_VAL;
3752 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
3753 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), uDR6);
3754 if (rc == VINF_EM_RAW_GUEST_TRAP)
3755 {
3756 /* Update DR6 here. */
3757 pCtx->dr[6] = uDR6;
3758
3759 /* Resync DR6 if the debug state is active. */
3760 if (CPUMIsGuestDebugStateActive(pVCpu))
3761 ASMSetDR6(pCtx->dr[6]);
3762
3763 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
3764 pCtx->dr[7] &= ~X86_DR7_GD;
3765
3766 /* Paranoia. */
3767 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
3768 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
3769 pCtx->dr[7] |= 0x400; /* must be one */
3770
3771 /* Resync DR7 */
3772 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
3773 AssertRC(rc2);
3774
3775 Log(("Trap %x (debug) at %RGv exit qualification %RX64 dr6=%x dr7=%x\n", vector, (RTGCPTR)pCtx->rip,
3776 exitQualification, (uint32_t)pCtx->dr[6], (uint32_t)pCtx->dr[7]));
3777 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3778 cbInstr, errCode);
3779 AssertRC(rc2);
3780
3781 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3782 goto ResumeExecution;
3783 }
3784 /* Return to ring 3 to deal with the debug exit code. */
3785 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3786 break;
3787 }
3788
3789 case X86_XCPT_BP: /* Breakpoint. */
3790 {
3791 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
3792 rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3793 if (rc == VINF_EM_RAW_GUEST_TRAP)
3794 {
3795 Log(("Guest #BP at %04x:%RGv\n", pCtx->cs.Sel, pCtx->rip));
3796 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3797 cbInstr, errCode);
3798 AssertRC(rc2);
3799 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3800 goto ResumeExecution;
3801 }
3802 if (rc == VINF_SUCCESS)
3803 {
3804 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3805 goto ResumeExecution;
3806 }
3807 Log(("Debugger BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3808 break;
3809 }
3810
3811 case X86_XCPT_GP: /* General protection failure exception. */
3812 {
3813 uint32_t cbOp;
3814 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
3815
3816 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestGP);
3817#ifdef VBOX_STRICT
3818 if ( !CPUMIsGuestInRealModeEx(pCtx)
3819 || !pVM->hm.s.vmx.pRealModeTSS)
3820 {
3821 Log(("Trap %x at %04X:%RGv errorCode=%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip, errCode));
3822 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3823 cbInstr, errCode);
3824 AssertRC(rc2);
3825 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3826 goto ResumeExecution;
3827 }
3828#endif
3829 Assert(CPUMIsGuestInRealModeEx(pCtx));
3830
3831 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %x:%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3832
3833 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
3834 if (RT_SUCCESS(rc2))
3835 {
3836 bool fUpdateRIP = true;
3837
3838 rc = VINF_SUCCESS;
3839 Assert(cbOp == pDis->cbInstr);
3840 switch (pDis->pCurInstr->uOpcode)
3841 {
3842 case OP_CLI:
3843 pCtx->eflags.Bits.u1IF = 0;
3844 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCli);
3845 break;
3846
3847 case OP_STI:
3848 pCtx->eflags.Bits.u1IF = 1;
3849 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + pDis->cbInstr);
3850 Assert(VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
3851 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE,
3852 VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
3853 AssertRC(rc2);
3854 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitSti);
3855 break;
3856
3857 case OP_HLT:
3858 fUpdateRIP = false;
3859 rc = VINF_EM_HALT;
3860 pCtx->rip += pDis->cbInstr;
3861 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
3862 break;
3863
3864 case OP_POPF:
3865 {
3866 RTGCPTR GCPtrStack;
3867 uint32_t cbParm;
3868 uint32_t uMask;
3869 X86EFLAGS eflags;
3870
3871 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3872 {
3873 cbParm = 4;
3874 uMask = 0xffffffff;
3875 }
3876 else
3877 {
3878 cbParm = 2;
3879 uMask = 0xffff;
3880 }
3881
3882 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3883 if (RT_FAILURE(rc2))
3884 {
3885 rc = VERR_EM_INTERPRETER;
3886 break;
3887 }
3888 eflags.u = 0;
3889 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3890 if (RT_FAILURE(rc2))
3891 {
3892 rc = VERR_EM_INTERPRETER;
3893 break;
3894 }
3895 LogFlow(("POPF %x -> %RGv mask=%x\n", eflags.u, pCtx->rsp, uMask));
3896 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3897 | (eflags.u & X86_EFL_POPF_BITS & uMask);
3898 /* RF cleared when popped in real mode; see pushf description in AMD manual. */
3899 pCtx->eflags.Bits.u1RF = 0;
3900 pCtx->esp += cbParm;
3901 pCtx->esp &= uMask;
3902
3903 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPopf);
3904 break;
3905 }
3906
3907 case OP_PUSHF:
3908 {
3909 RTGCPTR GCPtrStack;
3910 uint32_t cbParm;
3911 uint32_t uMask;
3912 X86EFLAGS eflags;
3913
3914 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3915 {
3916 cbParm = 4;
3917 uMask = 0xffffffff;
3918 }
3919 else
3920 {
3921 cbParm = 2;
3922 uMask = 0xffff;
3923 }
3924
3925 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), (pCtx->esp - cbParm) & uMask, 0,
3926 &GCPtrStack);
3927 if (RT_FAILURE(rc2))
3928 {
3929 rc = VERR_EM_INTERPRETER;
3930 break;
3931 }
3932 eflags = pCtx->eflags;
3933 /* RF & VM cleared when pushed in real mode; see pushf description in AMD manual. */
3934 eflags.Bits.u1RF = 0;
3935 eflags.Bits.u1VM = 0;
3936
3937 rc2 = PGMPhysWrite(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3938 if (RT_FAILURE(rc2))
3939 {
3940 rc = VERR_EM_INTERPRETER;
3941 break;
3942 }
3943 LogFlow(("PUSHF %x -> %RGv\n", eflags.u, GCPtrStack));
3944 pCtx->esp -= cbParm;
3945 pCtx->esp &= uMask;
3946 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPushf);
3947 break;
3948 }
3949
3950 case OP_IRET:
3951 {
3952 RTGCPTR GCPtrStack;
3953 uint32_t uMask = 0xffff;
3954 uint16_t aIretFrame[3];
3955
3956 if (pDis->fPrefix & (DISPREFIX_OPSIZE | DISPREFIX_ADDRSIZE))
3957 {
3958 rc = VERR_EM_INTERPRETER;
3959 break;
3960 }
3961
3962 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3963 if (RT_FAILURE(rc2))
3964 {
3965 rc = VERR_EM_INTERPRETER;
3966 break;
3967 }
3968 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &aIretFrame[0], sizeof(aIretFrame));
3969 if (RT_FAILURE(rc2))
3970 {
3971 rc = VERR_EM_INTERPRETER;
3972 break;
3973 }
3974 pCtx->ip = aIretFrame[0];
3975 pCtx->cs.Sel = aIretFrame[1];
3976 pCtx->cs.ValidSel = aIretFrame[1];
3977 pCtx->cs.u64Base = (uint32_t)pCtx->cs.Sel << 4;
3978 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3979 | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
3980 pCtx->sp += sizeof(aIretFrame);
3981
3982 LogFlow(("iret to %04x:%x\n", pCtx->cs.Sel, pCtx->ip));
3983 fUpdateRIP = false;
3984 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIret);
3985 break;
3986 }
3987
3988 case OP_INT:
3989 {
3990 uint32_t intInfo2;
3991
3992 LogFlow(("Realmode: INT %x\n", pDis->Param1.uValue & 0xff));
3993 intInfo2 = pDis->Param1.uValue & 0xff;
3994 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3995 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3996
3997 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3998 AssertRC(VBOXSTRICTRC_VAL(rc));
3999 fUpdateRIP = false;
4000 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4001 break;
4002 }
4003
4004 case OP_INTO:
4005 {
4006 if (pCtx->eflags.Bits.u1OF)
4007 {
4008 uint32_t intInfo2;
4009
4010 LogFlow(("Realmode: INTO\n"));
4011 intInfo2 = X86_XCPT_OF;
4012 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4013 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4014
4015 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4016 AssertRC(VBOXSTRICTRC_VAL(rc));
4017 fUpdateRIP = false;
4018 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4019 }
4020 break;
4021 }
4022
4023 case OP_INT3:
4024 {
4025 uint32_t intInfo2;
4026
4027 LogFlow(("Realmode: INT 3\n"));
4028 intInfo2 = 3;
4029 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4030 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4031
4032 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4033 AssertRC(VBOXSTRICTRC_VAL(rc));
4034 fUpdateRIP = false;
4035 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4036 break;
4037 }
4038
4039 default:
4040 rc = EMInterpretInstructionDisasState(pVCpu, pDis, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR);
4041 fUpdateRIP = false;
4042 break;
4043 }
4044
4045 if (rc == VINF_SUCCESS)
4046 {
4047 if (fUpdateRIP)
4048 pCtx->rip += cbOp; /* Move on to the next instruction. */
4049
4050 /*
4051 * LIDT, LGDT can end up here. In the future CRx changes as well. Just reload the
4052 * whole context to be done with it.
4053 */
4054 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
4055
4056 /* Only resume if successful. */
4057 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4058 goto ResumeExecution;
4059 }
4060 }
4061 else
4062 rc = VERR_EM_INTERPRETER;
4063
4064 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT,
4065 ("Unexpected rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4066 break;
4067 }
4068
4069#ifdef VBOX_STRICT
4070 case X86_XCPT_XF: /* SIMD exception. */
4071 case X86_XCPT_DE: /* Divide error. */
4072 case X86_XCPT_UD: /* Unknown opcode exception. */
4073 case X86_XCPT_SS: /* Stack segment exception. */
4074 case X86_XCPT_NP: /* Segment not present exception. */
4075 {
4076 switch (vector)
4077 {
4078 case X86_XCPT_DE: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDE); break;
4079 case X86_XCPT_UD: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestUD); break;
4080 case X86_XCPT_SS: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestSS); break;
4081 case X86_XCPT_NP: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNP); break;
4082 case X86_XCPT_XF: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXF); break;
4083 }
4084
4085 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
4086 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4087 cbInstr, errCode);
4088 AssertRC(rc2);
4089
4090 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4091 goto ResumeExecution;
4092 }
4093#endif
4094 default:
4095 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXcpUnk);
4096 if ( CPUMIsGuestInRealModeEx(pCtx)
4097 && pVM->hm.s.vmx.pRealModeTSS)
4098 {
4099 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs.Sel, pCtx->eip, errCode));
4100 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4101 cbInstr, errCode);
4102 AssertRC(VBOXSTRICTRC_VAL(rc)); /* Strict RC check below. */
4103
4104 /* Go back to ring-3 in case of a triple fault. */
4105 if ( vector == X86_XCPT_DF
4106 && rc == VINF_EM_RESET)
4107 {
4108 break;
4109 }
4110
4111 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4112 goto ResumeExecution;
4113 }
4114 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
4115 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
4116 break;
4117 } /* switch (vector) */
4118
4119 break;
4120
4121 default:
4122 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
4123 AssertMsgFailed(("Unexpected interruption code %x\n", intInfo));
4124 break;
4125 }
4126
4127 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4128 break;
4129 }
4130
4131 /*
4132 * 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed
4133 * by the configuration of the EPT paging structures.
4134 */
4135 case VMX_EXIT_EPT_VIOLATION:
4136 {
4137 RTGCPHYS GCPhys;
4138
4139 Assert(pVM->hm.s.fNestedPaging);
4140
4141 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4142 AssertRC(rc2);
4143 Assert(((exitQualification >> 7) & 3) != 2);
4144
4145 /* Determine the kind of violation. */
4146 errCode = 0;
4147 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
4148 errCode |= X86_TRAP_PF_ID;
4149
4150 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
4151 errCode |= X86_TRAP_PF_RW;
4152
4153 /* If the page is present, then it's a page level protection fault. */
4154 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
4155 errCode |= X86_TRAP_PF_P;
4156 else
4157 {
4158 /* Shortcut for APIC TPR reads and writes. */
4159 if ( (GCPhys & 0xfff) == 0x080
4160 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4161 && fSetupTPRCaching
4162 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4163 {
4164 RTGCPHYS GCPhysApicBase;
4165 GCPhysApicBase = pCtx->msrApicBase;
4166 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4167 if (GCPhys == GCPhysApicBase + 0x80)
4168 {
4169 Log(("Enable VT-x virtual APIC access filtering\n"));
4170 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4171 X86_PTE_RW | X86_PTE_P);
4172 AssertRC(rc2);
4173 }
4174 }
4175 }
4176 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
4177
4178 /* GCPhys contains the guest physical address of the page fault. */
4179 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
4180 TRPMSetErrorCode(pVCpu, errCode);
4181 TRPMSetFaultAddress(pVCpu, GCPhys);
4182
4183 /* Handle the pagefault trap for the nested shadow table. */
4184 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
4185
4186 /*
4187 * Same case as PGMR0Trap0eHandlerNPMisconfig(). See comment below, @bugref{6043}.
4188 */
4189 if ( rc == VINF_SUCCESS
4190 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4191 || rc == VERR_PAGE_NOT_PRESENT)
4192 {
4193 /* We've successfully synced our shadow pages, so let's just continue execution. */
4194 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
4195 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf);
4196
4197 TRPMResetTrap(pVCpu);
4198 goto ResumeExecution;
4199 }
4200
4201#ifdef VBOX_STRICT
4202 if (rc != VINF_EM_RAW_EMULATE_INSTR)
4203 LogFlow(("PGMTrap0eHandlerNestedPaging at %RGv failed with %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4204#endif
4205 /* Need to go back to the recompiler to emulate the instruction. */
4206 TRPMResetTrap(pVCpu);
4207 break;
4208 }
4209
4210 case VMX_EXIT_EPT_MISCONFIG:
4211 {
4212 RTGCPHYS GCPhys;
4213
4214 Assert(pVM->hm.s.fNestedPaging);
4215
4216 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4217 AssertRC(rc2);
4218 Log(("VMX_EXIT_EPT_MISCONFIG for %RGp\n", GCPhys));
4219
4220 /* Shortcut for APIC TPR reads and writes. */
4221 if ( (GCPhys & 0xfff) == 0x080
4222 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4223 && fSetupTPRCaching
4224 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4225 {
4226 RTGCPHYS GCPhysApicBase = pCtx->msrApicBase;
4227 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4228 if (GCPhys == GCPhysApicBase + 0x80)
4229 {
4230 Log(("Enable VT-x virtual APIC access filtering\n"));
4231 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4232 X86_PTE_RW | X86_PTE_P);
4233 AssertRC(rc2);
4234 }
4235 }
4236
4237 rc = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, PGMMODE_EPT, CPUMCTX2CORE(pCtx), GCPhys, UINT32_MAX);
4238
4239 /*
4240 * If we succeed, resume execution.
4241 * Or, if fail in interpreting the instruction because we couldn't get the guest physical address
4242 * of the page containing the instruction via the guest's page tables (we would invalidate the guest page
4243 * in the host TLB), resume execution which would cause a guest page fault to let the guest handle this
4244 * weird case. See @bugref{6043}.
4245 */
4246 if ( rc == VINF_SUCCESS
4247 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4248 || rc == VERR_PAGE_NOT_PRESENT)
4249 {
4250 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> resume\n", GCPhys, (RTGCPTR)pCtx->rip));
4251 goto ResumeExecution;
4252 }
4253
4254 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> %Rrc\n", GCPhys, (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4255 break;
4256 }
4257
4258 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window exiting. */
4259 /* Clear VM-exit on IF=1 change. */
4260 LogFlow(("VMX_EXIT_INT_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip,
4261 VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
4262 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INT_WINDOW_EXIT;
4263 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4264 AssertRC(rc2);
4265 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIntWindow);
4266 goto ResumeExecution; /* we check for pending guest interrupts there */
4267
4268 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
4269 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
4270 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
4271 /* Skip instruction and continue directly. */
4272 pCtx->rip += cbInstr;
4273 /* Continue execution.*/
4274 goto ResumeExecution;
4275
4276 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4277 {
4278 Log2(("VMX: Cpuid %x\n", pCtx->eax));
4279 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
4280 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4281 if (rc == VINF_SUCCESS)
4282 {
4283 /* Update EIP and continue execution. */
4284 Assert(cbInstr == 2);
4285 pCtx->rip += cbInstr;
4286 goto ResumeExecution;
4287 }
4288 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4289 rc = VINF_EM_RAW_EMULATE_INSTR;
4290 break;
4291 }
4292
4293 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4294 {
4295 Log2(("VMX: Rdpmc %x\n", pCtx->ecx));
4296 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
4297 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4298 if (rc == VINF_SUCCESS)
4299 {
4300 /* Update EIP and continue execution. */
4301 Assert(cbInstr == 2);
4302 pCtx->rip += cbInstr;
4303 goto ResumeExecution;
4304 }
4305 rc = VINF_EM_RAW_EMULATE_INSTR;
4306 break;
4307 }
4308
4309 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4310 {
4311 Log2(("VMX: Rdtsc\n"));
4312 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
4313 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4314 if (rc == VINF_SUCCESS)
4315 {
4316 /* Update EIP and continue execution. */
4317 Assert(cbInstr == 2);
4318 pCtx->rip += cbInstr;
4319 fNeedTscSetup = true; /* See @bugref{6634}. */
4320 goto ResumeExecution;
4321 }
4322 rc = VINF_EM_RAW_EMULATE_INSTR;
4323 break;
4324 }
4325
4326 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4327 {
4328 Log2(("VMX: Rdtscp\n"));
4329 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
4330 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
4331 if (rc == VINF_SUCCESS)
4332 {
4333 /* Update EIP and continue execution. */
4334 Assert(cbInstr == 3);
4335 pCtx->rip += cbInstr;
4336 fNeedTscSetup = true; /* See @bugref{6634}. */
4337 goto ResumeExecution;
4338 }
4339 rc = VINF_EM_RAW_EMULATE_INSTR;
4340 break;
4341 }
4342
4343 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4344 {
4345 Log2(("VMX: invlpg\n"));
4346 Assert(!pVM->hm.s.fNestedPaging);
4347
4348 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
4349 rc = EMInterpretInvlpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), exitQualification);
4350 if (rc == VINF_SUCCESS)
4351 {
4352 /* Update EIP and continue execution. */
4353 pCtx->rip += cbInstr;
4354 goto ResumeExecution;
4355 }
4356 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, VBOXSTRICTRC_VAL(rc)));
4357 break;
4358 }
4359
4360 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4361 {
4362 Log2(("VMX: monitor\n"));
4363
4364 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMonitor);
4365 rc = EMInterpretMonitor(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4366 if (rc == VINF_SUCCESS)
4367 {
4368 /* Update EIP and continue execution. */
4369 pCtx->rip += cbInstr;
4370 goto ResumeExecution;
4371 }
4372 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: monitor failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4373 break;
4374 }
4375
4376 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4377 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
4378 if ( pVM->hm.s.fTPRPatchingActive
4379 && pCtx->ecx == MSR_K8_LSTAR)
4380 {
4381 Assert(!CPUMIsGuestInLongModeEx(pCtx));
4382 if ((pCtx->eax & 0xff) != u8LastTPR)
4383 {
4384 Log(("VMX: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
4385
4386 /* Our patch code uses LSTAR for TPR caching. */
4387 rc2 = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
4388 AssertRC(rc2);
4389 }
4390
4391 /* Skip the instruction and continue. */
4392 pCtx->rip += cbInstr; /* wrmsr = [0F 30] */
4393
4394 /* Only resume if successful. */
4395 goto ResumeExecution;
4396 }
4397 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_MSR;
4398 /* no break */
4399 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4400 {
4401 STAM_COUNTER_INC((exitReason == VMX_EXIT_RDMSR) ? &pVCpu->hm.s.StatExitRdmsr : &pVCpu->hm.s.StatExitWrmsr);
4402
4403 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
4404 rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0);
4405 if (rc == VINF_SUCCESS)
4406 {
4407 /* EIP has been updated already. */
4408 /* Only resume if successful. */
4409 goto ResumeExecution;
4410 }
4411 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n",
4412 (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", VBOXSTRICTRC_VAL(rc)));
4413 break;
4414 }
4415
4416 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4417 {
4418 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitMovCRx, y2);
4419
4420 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
4421 {
4422 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
4423 {
4424 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
4425 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4426 rc = EMInterpretCRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4427 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
4428 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
4429 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
4430 {
4431 case 0:
4432 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0 | HM_CHANGED_GUEST_CR3;
4433 break;
4434 case 2:
4435 break;
4436 case 3:
4437 Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
4438 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR3;
4439 break;
4440 case 4:
4441 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR4;
4442 break;
4443 case 8:
4444 /* CR8 contains the APIC TPR */
4445 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1
4446 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4447 break;
4448
4449 default:
4450 AssertFailed();
4451 break;
4452 }
4453 break;
4454 }
4455
4456 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
4457 {
4458 Log2(("VMX: mov x, crx\n"));
4459 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4460
4461 Assert( !pVM->hm.s.fNestedPaging
4462 || !CPUMIsGuestInPagedProtectedModeEx(pCtx)
4463 || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != DISCREG_CR3);
4464
4465 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
4466 Assert( VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8
4467 || !(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
4468
4469 rc = EMInterpretCRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4470 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
4471 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
4472 break;
4473 }
4474
4475 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
4476 {
4477 Log2(("VMX: clts\n"));
4478 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClts);
4479 rc = EMInterpretCLTS(pVM, pVCpu);
4480 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4481 break;
4482 }
4483
4484 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
4485 {
4486 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
4487 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitLmsw);
4488 rc = EMInterpretLMSW(pVM, pVCpu, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
4489 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4490 break;
4491 }
4492 }
4493
4494 /* Update EIP if no error occurred. */
4495 if (RT_SUCCESS(rc))
4496 pCtx->rip += cbInstr;
4497
4498 if (rc == VINF_SUCCESS)
4499 {
4500 /* Only resume if successful. */
4501 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
4502 goto ResumeExecution;
4503 }
4504 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
4505 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
4506 break;
4507 }
4508
4509 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4510 {
4511 if ( !DBGFIsStepping(pVCpu)
4512 && !CPUMIsHyperDebugStateActive(pVCpu))
4513 {
4514 /* Disable DRx move intercepts. */
4515 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
4516 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4517 AssertRC(rc2);
4518
4519 /* Save the host and load the guest debug state. */
4520 rc2 = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
4521 AssertRC(rc2);
4522
4523#ifdef LOG_ENABLED
4524 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4525 {
4526 Log(("VMX_EXIT_MOV_DRX: write DR%d genreg %d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4527 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4528 }
4529 else
4530 Log(("VMX_EXIT_MOV_DRX: read DR%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification)));
4531#endif
4532
4533#ifdef VBOX_WITH_STATISTICS
4534 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxContextSwitch);
4535 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4536 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4537 else
4538 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4539#endif
4540
4541 goto ResumeExecution;
4542 }
4543
4544 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first
4545 * time and restore DRx registers afterwards */
4546 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4547 {
4548 Log2(("VMX: mov DRx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4549 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4550 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4551 rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4552 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4553 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
4554 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
4555 Log2(("DR7=%08x\n", pCtx->dr[7]));
4556 }
4557 else
4558 {
4559 Log2(("VMX: mov x, DRx\n"));
4560 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4561 rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4562 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
4563 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
4564 }
4565 /* Update EIP if no error occurred. */
4566 if (RT_SUCCESS(rc))
4567 pCtx->rip += cbInstr;
4568
4569 if (rc == VINF_SUCCESS)
4570 {
4571 /* Only resume if successful. */
4572 goto ResumeExecution;
4573 }
4574 Assert(rc == VERR_EM_INTERPRETER);
4575 break;
4576 }
4577
4578 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
4579 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4580 {
4581 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitIO, y1);
4582 uint32_t uPort;
4583 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
4584 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
4585
4586 /** @todo necessary to make the distinction? */
4587 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
4588 uPort = pCtx->edx & 0xffff;
4589 else
4590 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
4591
4592 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4)) /* paranoia */
4593 {
4594 rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
4595 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4596 break;
4597 }
4598
4599 uint32_t cbSize = g_aIOSize[uIOWidth];
4600 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
4601 {
4602 /* ins/outs */
4603 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
4604
4605 /* Disassemble manually to deal with segment prefixes. */
4606 /** @todo VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR contains the flat pointer
4607 * operand of the instruction. */
4608 /** @todo VMX_VMCS32_RO_EXIT_INSTR_INFO also contains segment prefix info. */
4609 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL);
4610 if (RT_SUCCESS(rc))
4611 {
4612 if (fIOWrite)
4613 {
4614 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4615 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringWrite);
4616 rc = IOMInterpretOUTSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4617 (DISCPUMODE)pDis->uAddrMode, cbSize);
4618 }
4619 else
4620 {
4621 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4622 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringRead);
4623 rc = IOMInterpretINSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4624 (DISCPUMODE)pDis->uAddrMode, cbSize);
4625 }
4626 }
4627 else
4628 rc = VINF_EM_RAW_EMULATE_INSTR;
4629 }
4630 else
4631 {
4632 /* Normal in/out */
4633 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
4634
4635 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
4636
4637 if (fIOWrite)
4638 {
4639 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOWrite);
4640 rc = IOMIOPortWrite(pVM, pVCpu, uPort, pCtx->eax & uAndVal, cbSize);
4641 if (rc == VINF_IOM_R3_IOPORT_WRITE)
4642 HMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4643 }
4644 else
4645 {
4646 uint32_t u32Val = 0;
4647
4648 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);
4649 rc = IOMIOPortRead(pVM, pVCpu, uPort, &u32Val, cbSize);
4650 if (IOM_SUCCESS(rc))
4651 {
4652 /* Write back to the EAX register. */
4653 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
4654 }
4655 else
4656 if (rc == VINF_IOM_R3_IOPORT_READ)
4657 HMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4658 }
4659 }
4660
4661 /*
4662 * Handled the I/O return codes.
4663 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
4664 */
4665 if (IOM_SUCCESS(rc))
4666 {
4667 /* Update EIP and continue execution. */
4668 pCtx->rip += cbInstr;
4669 if (RT_LIKELY(rc == VINF_SUCCESS))
4670 {
4671 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
4672 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
4673 {
4674 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxIoCheck);
4675 for (unsigned i = 0; i < 4; i++)
4676 {
4677 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
4678
4679 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
4680 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
4681 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
4682 {
4683 uint64_t uDR6;
4684
4685 Assert(CPUMIsGuestDebugStateActive(pVCpu));
4686
4687 uDR6 = ASMGetDR6();
4688
4689 /* Clear all breakpoint status flags and set the one we just hit. */
4690 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
4691 uDR6 |= (uint64_t)RT_BIT(i);
4692
4693 /*
4694 * Note: AMD64 Architecture Programmer's Manual 13.1:
4695 * Bits 15:13 of the DR6 register is never cleared by the processor and must
4696 * be cleared by software after the contents have been read.
4697 */
4698 ASMSetDR6(uDR6);
4699
4700 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
4701 pCtx->dr[7] &= ~X86_DR7_GD;
4702
4703 /* Paranoia. */
4704 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
4705 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
4706 pCtx->dr[7] |= 0x400; /* must be one */
4707
4708 /* Resync DR7 */
4709 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
4710 AssertRC(rc2);
4711
4712 /* Construct inject info. */
4713 intInfo = X86_XCPT_DB;
4714 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4715 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4716
4717 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
4718 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4719 0 /* cbInstr */, 0 /* errCode */);
4720 AssertRC(rc2);
4721
4722 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4723 goto ResumeExecution;
4724 }
4725 }
4726 }
4727 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4728 goto ResumeExecution;
4729 }
4730 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4731 break;
4732 }
4733
4734#ifdef VBOX_STRICT
4735 if (rc == VINF_IOM_R3_IOPORT_READ)
4736 Assert(!fIOWrite);
4737 else if (rc == VINF_IOM_R3_IOPORT_WRITE)
4738 Assert(fIOWrite);
4739 else
4740 {
4741 AssertMsg( RT_FAILURE(rc)
4742 || rc == VINF_EM_RAW_EMULATE_INSTR
4743 || rc == VINF_EM_RAW_GUEST_TRAP
4744 || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4745 }
4746#endif
4747 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4748 break;
4749 }
4750
4751 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4752 LogFlow(("VMX_EXIT_TPR_BELOW_THRESHOLD\n"));
4753 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
4754 goto ResumeExecution;
4755
4756 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4757 on the APIC-access page. */
4758 {
4759 LogFlow(("VMX_EXIT_APIC_ACCESS\n"));
4760 unsigned uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(exitQualification);
4761
4762 switch (uAccessType)
4763 {
4764 case VMX_APIC_ACCESS_TYPE_LINEAR_READ:
4765 case VMX_APIC_ACCESS_TYPE_LINEAR_WRITE:
4766 {
4767 RTGCPHYS GCPhys = pCtx->msrApicBase;
4768 GCPhys &= PAGE_BASE_GC_MASK;
4769 GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(exitQualification);
4770
4771 LogFlow(("Apic access at %RGp\n", GCPhys));
4772 rc = IOMMMIOPhysHandler(pVM, pVCpu, (uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ) ? 0 : X86_TRAP_PF_RW,
4773 CPUMCTX2CORE(pCtx), GCPhys);
4774 if (rc == VINF_SUCCESS)
4775 goto ResumeExecution; /* rip already updated */
4776 break;
4777 }
4778
4779 default:
4780 rc = VINF_EM_RAW_EMULATE_INSTR;
4781 break;
4782 }
4783 break;
4784 }
4785
4786 case VMX_EXIT_PREEMPT_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4787 if (!TMTimerPollBool(pVM, pVCpu))
4788 goto ResumeExecution;
4789 rc = VINF_EM_RAW_TIMER_PENDING;
4790 break;
4791
4792 default:
4793 /* The rest is handled after syncing the entire CPU state. */
4794 break;
4795 }
4796
4797
4798 /*
4799 * Note: The guest state is not entirely synced back at this stage!
4800 */
4801
4802 /* Investigate why there was a VM-exit. (part 2) */
4803 switch (exitReason)
4804 {
4805 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
4806 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
4807 case VMX_EXIT_EPT_VIOLATION:
4808 case VMX_EXIT_EPT_MISCONFIG: /* 49 EPT misconfig is used by the PGM/MMIO optimizations. */
4809 case VMX_EXIT_PREEMPT_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4810 /* Already handled above. */
4811 break;
4812
4813 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
4814 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
4815 break;
4816
4817 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
4818 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
4819 rc = VINF_EM_RAW_INTERRUPT;
4820 AssertFailed(); /* Can't happen. Yet. */
4821 break;
4822
4823 case VMX_EXIT_IO_SMI: /* 5 I/O system-management interrupt (SMI). */
4824 case VMX_EXIT_SMI: /* 6 Other SMI. */
4825 rc = VINF_EM_RAW_INTERRUPT;
4826 AssertFailed(); /* Can't happen afaik. */
4827 break;
4828
4829 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch: too complicated to emulate, so fall back to the recompiler */
4830 Log(("VMX_EXIT_TASK_SWITCH: exit=%RX64\n", exitQualification));
4831 if ( (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(exitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
4832 && pVCpu->hm.s.Event.fPending)
4833 {
4834 /* Caused by an injected interrupt. */
4835 pVCpu->hm.s.Event.fPending = false;
4836
4837 Log(("VMX_EXIT_TASK_SWITCH: reassert trap %d\n", VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo)));
4838 Assert(!VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo));
4839 //@todo: Why do we assume this had to be a hardware interrupt? What about software interrupts or exceptions?
4840 rc2 = TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), TRPM_HARDWARE_INT);
4841 AssertRC(rc2);
4842 }
4843 /* else Exceptions and software interrupts can just be restarted. */
4844 rc = VERR_EM_INTERPRETER;
4845 break;
4846
4847 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
4848 /* Check if external interrupts are pending; if so, don't switch back. */
4849 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
4850 pCtx->rip++; /* skip hlt */
4851 if (EMShouldContinueAfterHalt(pVCpu, pCtx))
4852 goto ResumeExecution;
4853
4854 rc = VINF_EM_HALT;
4855 break;
4856
4857 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
4858 Log2(("VMX: mwait\n"));
4859 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMwait);
4860 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4861 if ( rc == VINF_EM_HALT
4862 || rc == VINF_SUCCESS)
4863 {
4864 /* Update EIP and continue execution. */
4865 pCtx->rip += cbInstr;
4866
4867 /* Check if external interrupts are pending; if so, don't switch back. */
4868 if ( rc == VINF_SUCCESS
4869 || ( rc == VINF_EM_HALT
4870 && EMShouldContinueAfterHalt(pVCpu, pCtx))
4871 )
4872 goto ResumeExecution;
4873 }
4874 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4875 break;
4876
4877 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
4878 AssertFailed(); /* can't happen. */
4879 rc = VERR_EM_INTERPRETER;
4880 break;
4881
4882 case VMX_EXIT_MTF: /* 37 Exit due to Monitor Trap Flag. */
4883 LogFlow(("VMX_EXIT_MTF at %RGv\n", (RTGCPTR)pCtx->rip));
4884 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MONITOR_TRAP_FLAG;
4885 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
4886 AssertRC(rc2);
4887 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMtf);
4888#if 0
4889 DBGFDoneStepping(pVCpu);
4890#endif
4891 rc = VINF_EM_DBG_STOP;
4892 break;
4893
4894 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
4895 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
4896 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
4897 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
4898 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
4899 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
4900 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
4901 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
4902 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
4903 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
4904 /** @todo inject #UD immediately */
4905 rc = VERR_EM_INTERPRETER;
4906 break;
4907
4908 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4909 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4910 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4911 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4912 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4913 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4914 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4915 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4916 /* already handled above */
4917 AssertMsg( rc == VINF_PGM_CHANGE_MODE
4918 || rc == VINF_EM_RAW_INTERRUPT
4919 || rc == VERR_EM_INTERPRETER
4920 || rc == VINF_EM_RAW_EMULATE_INSTR
4921 || rc == VINF_PGM_SYNC_CR3
4922 || rc == VINF_IOM_R3_IOPORT_READ
4923 || rc == VINF_IOM_R3_IOPORT_WRITE
4924 || rc == VINF_EM_RAW_GUEST_TRAP
4925 || rc == VINF_TRPM_XCPT_DISPATCHED
4926 || rc == VINF_EM_RESCHEDULE_REM,
4927 ("rc = %d\n", VBOXSTRICTRC_VAL(rc)));
4928 break;
4929
4930 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4931 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4932 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4933 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
4934 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4935 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4936 on the APIC-access page. */
4937 {
4938 /*
4939 * If we decided to emulate them here, then we must sync the MSRs that could have been changed (sysenter, FS/GS base)
4940 */
4941 rc = VERR_EM_INTERPRETER;
4942 break;
4943 }
4944
4945 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window. */
4946 Assert(rc == VINF_EM_RAW_INTERRUPT);
4947 break;
4948
4949 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
4950 {
4951#ifdef VBOX_STRICT
4952 RTCCUINTREG val2 = 0;
4953
4954 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
4955
4956 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val2);
4957 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val2));
4958
4959 VMXReadVmcs(VMX_VMCS_GUEST_CR0, &val2);
4960 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", (uint64_t)val2));
4961
4962 VMXReadVmcs(VMX_VMCS_GUEST_CR3, &val2);
4963 Log(("VMX_VMCS_GUEST_CR3 %RX64\n", (uint64_t)val2));
4964
4965 VMXReadVmcs(VMX_VMCS_GUEST_CR4, &val2);
4966 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", (uint64_t)val2));
4967
4968 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val2);
4969 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val2));
4970
4971 VMX_LOG_SELREG(CS, "CS", val2);
4972 VMX_LOG_SELREG(DS, "DS", val2);
4973 VMX_LOG_SELREG(ES, "ES", val2);
4974 VMX_LOG_SELREG(FS, "FS", val2);
4975 VMX_LOG_SELREG(GS, "GS", val2);
4976 VMX_LOG_SELREG(SS, "SS", val2);
4977 VMX_LOG_SELREG(TR, "TR", val2);
4978 VMX_LOG_SELREG(LDTR, "LDTR", val2);
4979
4980 VMXReadVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val2);
4981 Log(("VMX_VMCS_GUEST_GDTR_BASE %RX64\n", (uint64_t)val2));
4982 VMXReadVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val2);
4983 Log(("VMX_VMCS_GUEST_IDTR_BASE %RX64\n", (uint64_t)val2));
4984#endif /* VBOX_STRICT */
4985 rc = VERR_VMX_INVALID_GUEST_STATE;
4986 break;
4987 }
4988
4989 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
4990 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
4991 default:
4992 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
4993 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
4994 break;
4995
4996 }
4997
4998end:
4999 /* We now going back to ring-3, so clear the action flag. */
5000 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
5001
5002 /*
5003 * Signal changes for the recompiler.
5004 */
5005 CPUMSetChangedFlags(pVCpu,
5006 CPUM_CHANGED_SYSENTER_MSR
5007 | CPUM_CHANGED_LDTR
5008 | CPUM_CHANGED_GDTR
5009 | CPUM_CHANGED_IDTR
5010 | CPUM_CHANGED_TR
5011 | CPUM_CHANGED_HIDDEN_SEL_REGS);
5012
5013 /*
5014 * If we executed vmlaunch/vmresume and an external IRQ was pending, then we don't have to do a full sync the next time.
5015 */
5016 if ( exitReason == VMX_EXIT_EXT_INT
5017 && !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
5018 {
5019 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
5020 /* On the next entry we'll only sync the host context. */
5021 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT;
5022 }
5023 else
5024 {
5025 /* On the next entry we'll sync everything. */
5026 /** @todo we can do better than this */
5027 /* Not in the VINF_PGM_CHANGE_MODE though! */
5028 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL;
5029 }
5030
5031 /* Translate into a less severe return code */
5032 if (rc == VERR_EM_INTERPRETER)
5033 rc = VINF_EM_RAW_EMULATE_INSTR;
5034 else if (rc == VERR_VMX_INVALID_VMCS_PTR)
5035 {
5036 /* Try to extract more information about what might have gone wrong here. */
5037 VMXGetActivateVMCS(&pVCpu->hm.s.vmx.lasterror.u64VMCSPhys);
5038 pVCpu->hm.s.vmx.lasterror.u32VMCSRevision = *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs;
5039 pVCpu->hm.s.vmx.lasterror.idEnteredCpu = pVCpu->hm.s.idEnteredCpu;
5040 pVCpu->hm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
5041 }
5042
5043 /* Just set the correct state here instead of trying to catch every goto above. */
5044 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
5045
5046#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
5047 /* Restore interrupts if we exited after disabling them. */
5048 if (uOldEFlags != ~(RTCCUINTREG)0)
5049 ASMSetFlags(uOldEFlags);
5050#endif
5051
5052 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5053 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
5054 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5055 Log2(("X"));
5056 return VBOXSTRICTRC_TODO(rc);
5057}
5058
5059
5060/**
5061 * Enters the VT-x session.
5062 *
5063 * @returns VBox status code.
5064 * @param pVM Pointer to the VM.
5065 * @param pVCpu Pointer to the VMCPU.
5066 * @param pCpu Pointer to the CPU info struct.
5067 */
5068VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBLCPUINFO pCpu)
5069{
5070 Assert(pVM->hm.s.vmx.fSupported);
5071 NOREF(pCpu);
5072
5073 unsigned cr4 = ASMGetCR4();
5074 if (!(cr4 & X86_CR4_VMXE))
5075 {
5076 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
5077 return VERR_VMX_X86_CR4_VMXE_CLEARED;
5078 }
5079
5080 /* Activate the VMCS. */
5081 int rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5082 if (RT_FAILURE(rc))
5083 return rc;
5084
5085 pVCpu->hm.s.fResumeVM = false;
5086 return VINF_SUCCESS;
5087}
5088
5089
5090/**
5091 * Leaves the VT-x session.
5092 *
5093 * @returns VBox status code.
5094 * @param pVM Pointer to the VM.
5095 * @param pVCpu Pointer to the VMCPU.
5096 * @param pCtx Pointer to the guests CPU context.
5097 */
5098VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5099{
5100 Assert(pVM->hm.s.vmx.fSupported);
5101
5102#ifdef DEBUG
5103 if (CPUMIsHyperDebugStateActive(pVCpu))
5104 {
5105 CPUMR0LoadHostDebugState(pVM, pVCpu);
5106 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5107 }
5108 else
5109#endif
5110
5111 /*
5112 * Save the guest debug state if necessary.
5113 */
5114 if (CPUMIsGuestDebugStateActive(pVCpu))
5115 {
5116 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
5117
5118 /* Enable DRx move intercepts again. */
5119 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
5120 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, pVCpu->hm.s.vmx.u32ProcCtls);
5121 AssertRC(rc);
5122
5123 /* Resync the debug registers the next time. */
5124 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
5125 }
5126 else
5127 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
5128
5129 /*
5130 * Clear VMCS, marking it inactive, clearing implementation-specific data and writing
5131 * VMCS data back to memory.
5132 */
5133 int rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5134 AssertRC(rc);
5135
5136 return VINF_SUCCESS;
5137}
5138
5139
5140/**
5141 * Flush the TLB using EPT.
5142 *
5143 * @returns VBox status code.
5144 * @param pVM Pointer to the VM.
5145 * @param pVCpu Pointer to the VMCPU.
5146 * @param enmFlush Type of flush.
5147 */
5148static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush)
5149{
5150 uint64_t descriptor[2];
5151
5152 LogFlow(("hmR0VmxFlushEPT %d\n", enmFlush));
5153 Assert(pVM->hm.s.fNestedPaging);
5154 descriptor[0] = pVCpu->hm.s.vmx.HCPhysEPTP;
5155 descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
5156 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
5157 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.HCPhysEPTP, rc));
5158#ifdef VBOX_WITH_STATISTICS
5159 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
5160#endif
5161}
5162
5163
5164/**
5165 * Flush the TLB using VPID.
5166 *
5167 * @returns VBox status code.
5168 * @param pVM Pointer to the VM.
5169 * @param pVCpu Pointer to the VMCPU (can be NULL depending on @a
5170 * enmFlush).
5171 * @param enmFlush Type of flush.
5172 * @param GCPtr Virtual address of the page to flush (can be 0 depending
5173 * on @a enmFlush).
5174 */
5175static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr)
5176{
5177 uint64_t descriptor[2];
5178
5179 Assert(pVM->hm.s.vmx.fVpid);
5180 if (enmFlush == VMX_FLUSH_VPID_ALL_CONTEXTS)
5181 {
5182 descriptor[0] = 0;
5183 descriptor[1] = 0;
5184 }
5185 else
5186 {
5187 AssertPtr(pVCpu);
5188 AssertMsg(pVCpu->hm.s.uCurrentAsid != 0, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5189 AssertMsg(pVCpu->hm.s.uCurrentAsid <= UINT16_MAX, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5190 descriptor[0] = pVCpu->hm.s.uCurrentAsid;
5191 descriptor[1] = GCPtr;
5192 }
5193 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]); NOREF(rc);
5194 AssertMsg(rc == VINF_SUCCESS,
5195 ("VMXR0InvVPID %x %x %RGv failed with %d\n", enmFlush, pVCpu ? pVCpu->hm.s.uCurrentAsid : 0, GCPtr, rc));
5196#ifdef VBOX_WITH_STATISTICS
5197 if (pVCpu)
5198 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushAsid);
5199#endif
5200}
5201
5202
5203/**
5204 * Invalidates a guest page by guest virtual address. Only relevant for
5205 * EPT/VPID, otherwise there is nothing really to invalidate.
5206 *
5207 * @returns VBox status code.
5208 * @param pVM Pointer to the VM.
5209 * @param pVCpu Pointer to the VMCPU.
5210 * @param GCVirt Guest virtual address of the page to invalidate.
5211 */
5212VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
5213{
5214 bool fFlushPending = VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH);
5215
5216 Log2(("VMXR0InvalidatePage %RGv\n", GCVirt));
5217
5218 if (!fFlushPending)
5219 {
5220 /*
5221 * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
5222 * See @bugref{6043} and @bugref{6177}
5223 *
5224 * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VMENTRY in hmR0VmxSetupTLB*() as this
5225 * function maybe called in a loop with individual addresses.
5226 */
5227 if (pVM->hm.s.vmx.fVpid)
5228 {
5229 /* If we can flush just this page do it, otherwise flush as little as possible. */
5230 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
5231 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, GCVirt);
5232 else
5233 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5234 }
5235 else if (pVM->hm.s.fNestedPaging)
5236 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5237 }
5238
5239 return VINF_SUCCESS;
5240}
5241
5242
5243/**
5244 * Invalidates a guest page by physical address. Only relevant for EPT/VPID,
5245 * otherwise there is nothing really to invalidate.
5246 *
5247 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
5248 *
5249 * @returns VBox status code.
5250 * @param pVM Pointer to the VM.
5251 * @param pVCpu Pointer to the VMCPU.
5252 * @param GCPhys Guest physical address of the page to invalidate.
5253 */
5254VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
5255{
5256 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
5257
5258 /*
5259 * We cannot flush a page by guest-physical address. invvpid takes only a linear address
5260 * while invept only flushes by EPT not individual addresses. We update the force flag here
5261 * and flush before VMENTRY in hmR0VmxSetupTLB*(). This function might be called in a loop.
5262 */
5263 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5264 return VINF_SUCCESS;
5265}
5266
5267
5268/**
5269 * Report world switch error and dump some useful debug info.
5270 *
5271 * @param pVM Pointer to the VM.
5272 * @param pVCpu Pointer to the VMCPU.
5273 * @param rc Return code.
5274 * @param pCtx Pointer to the current guest CPU context (not updated).
5275 */
5276static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx)
5277{
5278 NOREF(pVM);
5279
5280 switch (VBOXSTRICTRC_VAL(rc))
5281 {
5282 case VERR_VMX_INVALID_VMXON_PTR:
5283 AssertFailed();
5284 break;
5285
5286 case VERR_VMX_UNABLE_TO_START_VM:
5287 {
5288 int rc2;
5289 RTCCUINTREG exitReason, instrError;
5290
5291 rc2 = VMXReadVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
5292 rc2 |= VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
5293 AssertRC(rc2);
5294 if (rc2 == VINF_SUCCESS)
5295 {
5296 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason,
5297 (uint32_t)instrError));
5298 Log(("Current stack %08x\n", &rc2));
5299
5300 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
5301 pVCpu->hm.s.vmx.lasterror.u32ExitReason = exitReason;
5302
5303#ifdef VBOX_STRICT
5304 RTGDTR gdtr;
5305 PCX86DESCHC pDesc;
5306 RTCCUINTREG val;
5307
5308 ASMGetGDTR(&gdtr);
5309
5310 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val);
5311 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
5312 VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC_CONTROLS, &val);
5313 Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
5314 VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC_CONTROLS, &val);
5315 Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
5316 VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY_CONTROLS, &val);
5317 Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
5318 VMXReadVmcs(VMX_VMCS32_CTRL_EXIT_CONTROLS, &val);
5319 Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
5320
5321 VMXReadVmcs(VMX_VMCS_HOST_CR0, &val);
5322 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
5323 VMXReadVmcs(VMX_VMCS_HOST_CR3, &val);
5324 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
5325 VMXReadVmcs(VMX_VMCS_HOST_CR4, &val);
5326 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
5327
5328 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_CS, &val);
5329 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
5330 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
5331 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
5332
5333 if (val < gdtr.cbGdt)
5334 {
5335 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5336 HMR0DumpDescriptor(pDesc, val, "CS: ");
5337 }
5338
5339 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_DS, &val);
5340 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
5341 if (val < gdtr.cbGdt)
5342 {
5343 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5344 HMR0DumpDescriptor(pDesc, val, "DS: ");
5345 }
5346
5347 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_ES, &val);
5348 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
5349 if (val < gdtr.cbGdt)
5350 {
5351 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5352 HMR0DumpDescriptor(pDesc, val, "ES: ");
5353 }
5354
5355 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_FS, &val);
5356 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
5357 if (val < gdtr.cbGdt)
5358 {
5359 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5360 HMR0DumpDescriptor(pDesc, val, "FS: ");
5361 }
5362
5363 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_GS, &val);
5364 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
5365 if (val < gdtr.cbGdt)
5366 {
5367 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5368 HMR0DumpDescriptor(pDesc, val, "GS: ");
5369 }
5370
5371 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_SS, &val);
5372 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
5373 if (val < gdtr.cbGdt)
5374 {
5375 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5376 HMR0DumpDescriptor(pDesc, val, "SS: ");
5377 }
5378
5379 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_TR, &val);
5380 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
5381 if (val < gdtr.cbGdt)
5382 {
5383 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5384 HMR0DumpDescriptor(pDesc, val, "TR: ");
5385 }
5386
5387 VMXReadVmcs(VMX_VMCS_HOST_TR_BASE, &val);
5388 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
5389 VMXReadVmcs(VMX_VMCS_HOST_GDTR_BASE, &val);
5390 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
5391 VMXReadVmcs(VMX_VMCS_HOST_IDTR_BASE, &val);
5392 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
5393 VMXReadVmcs(VMX_VMCS32_HOST_SYSENTER_CS, &val);
5394 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
5395 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_EIP, &val);
5396 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
5397 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_ESP, &val);
5398 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
5399 VMXReadVmcs(VMX_VMCS_HOST_RSP, &val);
5400 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
5401 VMXReadVmcs(VMX_VMCS_HOST_RIP, &val);
5402 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
5403# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5404 if (VMX_IS_64BIT_HOST_MODE())
5405 {
5406 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
5407 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
5408 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
5409 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
5410 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
5411 Log(("MSR_K8_KERNEL_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_KERNEL_GS_BASE)));
5412 }
5413# endif
5414#endif /* VBOX_STRICT */
5415 }
5416 break;
5417 }
5418
5419 default:
5420 /* impossible */
5421 AssertMsgFailed(("%Rrc (%#x)\n", VBOXSTRICTRC_VAL(rc), VBOXSTRICTRC_VAL(rc)));
5422 break;
5423 }
5424}
5425
5426
5427#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5428/**
5429 * Prepares for and executes VMLAUNCH (64 bits guest mode).
5430 *
5431 * @returns VBox status code.
5432 * @param fResume Whether to vmlauch/vmresume.
5433 * @param pCtx Pointer to the guest CPU context.
5434 * @param pCache Pointer to the VMCS cache.
5435 * @param pVM Pointer to the VM.
5436 * @param pVCpu Pointer to the VMCPU.
5437 */
5438DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu)
5439{
5440 uint32_t aParam[6];
5441 PHMGLOBLCPUINFO pCpu;
5442 RTHCPHYS HCPhysCpuPage;
5443 int rc;
5444
5445 pCpu = HMR0GetCurrentCpu();
5446 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5447
5448#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5449 pCache->uPos = 1;
5450 pCache->interPD = PGMGetInterPaeCR3(pVM);
5451 pCache->pSwitcher = (uint64_t)pVM->hm.s.pfnHost32ToGuest64R0;
5452#endif
5453
5454#ifdef DEBUG
5455 pCache->TestIn.HCPhysCpuPage= 0;
5456 pCache->TestIn.HCPhysVmcs = 0;
5457 pCache->TestIn.pCache = 0;
5458 pCache->TestOut.HCPhysVmcs = 0;
5459 pCache->TestOut.pCache = 0;
5460 pCache->TestOut.pCtx = 0;
5461 pCache->TestOut.eflags = 0;
5462#endif
5463
5464 aParam[0] = (uint32_t)(HCPhysCpuPage); /* Param 1: VMXON physical address - Lo. */
5465 aParam[1] = (uint32_t)(HCPhysCpuPage >> 32); /* Param 1: VMXON physical address - Hi. */
5466 aParam[2] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs); /* Param 2: VMCS physical address - Lo. */
5467 aParam[3] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs >> 32); /* Param 2: VMCS physical address - Hi. */
5468 aParam[4] = VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache);
5469 aParam[5] = 0;
5470
5471#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5472 pCtx->dr[4] = pVM->hm.s.vmx.pScratchPhys + 16 + 8;
5473 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 1;
5474#endif
5475 rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hm.s.pfnVMXGCStartVM64, 6, &aParam[0]);
5476
5477#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5478 Assert(*(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) == 5);
5479 Assert(pCtx->dr[4] == 10);
5480 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 0xff;
5481#endif
5482
5483#ifdef DEBUG
5484 AssertMsg(pCache->TestIn.HCPhysCpuPage== HCPhysCpuPage, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysCpuPage, HCPhysCpuPage));
5485 AssertMsg(pCache->TestIn.HCPhysVmcs == pVCpu->hm.s.vmx.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5486 pVCpu->hm.s.vmx.HCPhysVmcs));
5487 AssertMsg(pCache->TestIn.HCPhysVmcs == pCache->TestOut.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5488 pCache->TestOut.HCPhysVmcs));
5489 AssertMsg(pCache->TestIn.pCache == pCache->TestOut.pCache, ("%RGv vs %RGv\n", pCache->TestIn.pCache,
5490 pCache->TestOut.pCache));
5491 AssertMsg(pCache->TestIn.pCache == VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache),
5492 ("%RGv vs %RGv\n", pCache->TestIn.pCache, VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache)));
5493 AssertMsg(pCache->TestIn.pCtx == pCache->TestOut.pCtx, ("%RGv vs %RGv\n", pCache->TestIn.pCtx,
5494 pCache->TestOut.pCtx));
5495 Assert(!(pCache->TestOut.eflags & X86_EFL_IF));
5496#endif
5497 return rc;
5498}
5499
5500
5501#ifdef VBOX_STRICT
5502static bool hmR0VmxIsValidReadField(uint32_t idxField)
5503{
5504 switch (idxField)
5505 {
5506 case VMX_VMCS_GUEST_RIP:
5507 case VMX_VMCS_GUEST_RSP:
5508 case VMX_VMCS_GUEST_RFLAGS:
5509 case VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE:
5510 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
5511 case VMX_VMCS_GUEST_CR0:
5512 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
5513 case VMX_VMCS_GUEST_CR4:
5514 case VMX_VMCS_GUEST_DR7:
5515 case VMX_VMCS32_GUEST_SYSENTER_CS:
5516 case VMX_VMCS_GUEST_SYSENTER_EIP:
5517 case VMX_VMCS_GUEST_SYSENTER_ESP:
5518 case VMX_VMCS32_GUEST_GDTR_LIMIT:
5519 case VMX_VMCS_GUEST_GDTR_BASE:
5520 case VMX_VMCS32_GUEST_IDTR_LIMIT:
5521 case VMX_VMCS_GUEST_IDTR_BASE:
5522 case VMX_VMCS16_GUEST_FIELD_CS:
5523 case VMX_VMCS32_GUEST_CS_LIMIT:
5524 case VMX_VMCS_GUEST_CS_BASE:
5525 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
5526 case VMX_VMCS16_GUEST_FIELD_DS:
5527 case VMX_VMCS32_GUEST_DS_LIMIT:
5528 case VMX_VMCS_GUEST_DS_BASE:
5529 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
5530 case VMX_VMCS16_GUEST_FIELD_ES:
5531 case VMX_VMCS32_GUEST_ES_LIMIT:
5532 case VMX_VMCS_GUEST_ES_BASE:
5533 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
5534 case VMX_VMCS16_GUEST_FIELD_FS:
5535 case VMX_VMCS32_GUEST_FS_LIMIT:
5536 case VMX_VMCS_GUEST_FS_BASE:
5537 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
5538 case VMX_VMCS16_GUEST_FIELD_GS:
5539 case VMX_VMCS32_GUEST_GS_LIMIT:
5540 case VMX_VMCS_GUEST_GS_BASE:
5541 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
5542 case VMX_VMCS16_GUEST_FIELD_SS:
5543 case VMX_VMCS32_GUEST_SS_LIMIT:
5544 case VMX_VMCS_GUEST_SS_BASE:
5545 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
5546 case VMX_VMCS16_GUEST_FIELD_LDTR:
5547 case VMX_VMCS32_GUEST_LDTR_LIMIT:
5548 case VMX_VMCS_GUEST_LDTR_BASE:
5549 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
5550 case VMX_VMCS16_GUEST_FIELD_TR:
5551 case VMX_VMCS32_GUEST_TR_LIMIT:
5552 case VMX_VMCS_GUEST_TR_BASE:
5553 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
5554 case VMX_VMCS32_RO_EXIT_REASON:
5555 case VMX_VMCS32_RO_VM_INSTR_ERROR:
5556 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
5557 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
5558 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
5559 case VMX_VMCS32_RO_EXIT_INSTR_INFO:
5560 case VMX_VMCS_RO_EXIT_QUALIFICATION:
5561 case VMX_VMCS32_RO_IDT_INFO:
5562 case VMX_VMCS32_RO_IDT_ERROR_CODE:
5563 case VMX_VMCS_GUEST_CR3:
5564 case VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL:
5565 return true;
5566 }
5567 return false;
5568}
5569
5570
5571static bool hmR0VmxIsValidWriteField(uint32_t idxField)
5572{
5573 switch (idxField)
5574 {
5575 case VMX_VMCS_GUEST_LDTR_BASE:
5576 case VMX_VMCS_GUEST_TR_BASE:
5577 case VMX_VMCS_GUEST_GDTR_BASE:
5578 case VMX_VMCS_GUEST_IDTR_BASE:
5579 case VMX_VMCS_GUEST_SYSENTER_EIP:
5580 case VMX_VMCS_GUEST_SYSENTER_ESP:
5581 case VMX_VMCS_GUEST_CR0:
5582 case VMX_VMCS_GUEST_CR4:
5583 case VMX_VMCS_GUEST_CR3:
5584 case VMX_VMCS_GUEST_DR7:
5585 case VMX_VMCS_GUEST_RIP:
5586 case VMX_VMCS_GUEST_RSP:
5587 case VMX_VMCS_GUEST_CS_BASE:
5588 case VMX_VMCS_GUEST_DS_BASE:
5589 case VMX_VMCS_GUEST_ES_BASE:
5590 case VMX_VMCS_GUEST_FS_BASE:
5591 case VMX_VMCS_GUEST_GS_BASE:
5592 case VMX_VMCS_GUEST_SS_BASE:
5593 return true;
5594 }
5595 return false;
5596}
5597#endif /* VBOX_STRICT */
5598
5599
5600/**
5601 * Executes the specified handler in 64-bit mode.
5602 *
5603 * @returns VBox status code.
5604 * @param pVM Pointer to the VM.
5605 * @param pVCpu Pointer to the VMCPU.
5606 * @param pCtx Pointer to the guest CPU context.
5607 * @param pfnHandler Pointer to the RC handler function.
5608 * @param cbParam Number of parameters.
5609 * @param paParam Array of 32-bit parameters.
5610 */
5611VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam,
5612 uint32_t *paParam)
5613{
5614 int rc, rc2;
5615 PHMGLOBLCPUINFO pCpu;
5616 RTHCPHYS HCPhysCpuPage;
5617 RTHCUINTREG uOldEFlags;
5618
5619 AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
5620 Assert(pfnHandler);
5621 Assert(pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Write.aField));
5622 Assert(pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Read.aField));
5623
5624#ifdef VBOX_STRICT
5625 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries;i++)
5626 Assert(hmR0VmxIsValidWriteField(pVCpu->hm.s.vmx.VMCSCache.Write.aField[i]));
5627
5628 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries;i++)
5629 Assert(hmR0VmxIsValidReadField(pVCpu->hm.s.vmx.VMCSCache.Read.aField[i]));
5630#endif
5631
5632 /* Disable interrupts. */
5633 uOldEFlags = ASMIntDisableFlags();
5634
5635#ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
5636 RTCPUID idHostCpu = RTMpCpuId();
5637 CPUMR0SetLApic(pVM, idHostCpu);
5638#endif
5639
5640 pCpu = HMR0GetCurrentCpu();
5641 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5642
5643 /* Clear VMCS. Marking it inactive, clearing implementation-specific data and writing VMCS data back to memory. */
5644 VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5645
5646 /* Leave VMX Root Mode. */
5647 VMXDisable();
5648
5649 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5650
5651 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
5652 CPUMSetHyperEIP(pVCpu, pfnHandler);
5653 for (int i=(int)cbParam-1;i>=0;i--)
5654 CPUMPushHyper(pVCpu, paParam[i]);
5655
5656 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
5657
5658 /* Call switcher. */
5659 rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
5660 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
5661
5662 /* Make sure the VMX instructions don't cause #UD faults. */
5663 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
5664
5665 /* Enter VMX Root Mode */
5666 rc2 = VMXEnable(HCPhysCpuPage);
5667 if (RT_FAILURE(rc2))
5668 {
5669 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5670 ASMSetFlags(uOldEFlags);
5671 return VERR_VMX_VMXON_FAILED;
5672 }
5673
5674 rc2 = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5675 AssertRC(rc2);
5676 Assert(!(ASMGetFlags() & X86_EFL_IF));
5677 ASMSetFlags(uOldEFlags);
5678 return rc;
5679}
5680#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL) */
5681
5682
5683#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5684/**
5685 * Executes VMWRITE.
5686 *
5687 * @returns VBox status code
5688 * @param pVCpu Pointer to the VMCPU.
5689 * @param idxField VMCS field index.
5690 * @param u64Val 16, 32 or 64 bits value.
5691 */
5692VMMR0DECL(int) VMXWriteVmcs64Ex(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5693{
5694 int rc;
5695 switch (idxField)
5696 {
5697 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
5698 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
5699 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
5700 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
5701 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
5702 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
5703 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
5704 case VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL:
5705 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
5706 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
5707 case VMX_VMCS64_GUEST_PDPTE0_FULL:
5708 case VMX_VMCS64_GUEST_PDPTE1_FULL:
5709 case VMX_VMCS64_GUEST_PDPTE2_FULL:
5710 case VMX_VMCS64_GUEST_PDPTE3_FULL:
5711 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
5712 case VMX_VMCS64_GUEST_EFER_FULL:
5713 case VMX_VMCS64_CTRL_EPTP_FULL:
5714 /* These fields consist of two parts, which are both writable in 32 bits mode. */
5715 rc = VMXWriteVmcs32(idxField, u64Val);
5716 rc |= VMXWriteVmcs32(idxField + 1, (uint32_t)(u64Val >> 32ULL));
5717 AssertRC(rc);
5718 return rc;
5719
5720 case VMX_VMCS_GUEST_LDTR_BASE:
5721 case VMX_VMCS_GUEST_TR_BASE:
5722 case VMX_VMCS_GUEST_GDTR_BASE:
5723 case VMX_VMCS_GUEST_IDTR_BASE:
5724 case VMX_VMCS_GUEST_SYSENTER_EIP:
5725 case VMX_VMCS_GUEST_SYSENTER_ESP:
5726 case VMX_VMCS_GUEST_CR0:
5727 case VMX_VMCS_GUEST_CR4:
5728 case VMX_VMCS_GUEST_CR3:
5729 case VMX_VMCS_GUEST_DR7:
5730 case VMX_VMCS_GUEST_RIP:
5731 case VMX_VMCS_GUEST_RSP:
5732 case VMX_VMCS_GUEST_CS_BASE:
5733 case VMX_VMCS_GUEST_DS_BASE:
5734 case VMX_VMCS_GUEST_ES_BASE:
5735 case VMX_VMCS_GUEST_FS_BASE:
5736 case VMX_VMCS_GUEST_GS_BASE:
5737 case VMX_VMCS_GUEST_SS_BASE:
5738 /* Queue a 64 bits value as we can't set it in 32 bits host mode. */
5739 if (u64Val >> 32ULL)
5740 rc = VMXWriteCachedVmcsEx(pVCpu, idxField, u64Val);
5741 else
5742 rc = VMXWriteVmcs32(idxField, (uint32_t)u64Val);
5743
5744 return rc;
5745
5746 default:
5747 AssertMsgFailed(("Unexpected field %x\n", idxField));
5748 return VERR_INVALID_PARAMETER;
5749 }
5750}
5751
5752
5753/**
5754 * Cache VMCS writes for running 64 bits guests on 32 bits hosts.
5755 *
5756 * @param pVCpu Pointer to the VMCPU.
5757 * @param idxField VMCS field index.
5758 * @param u64Val 16, 32 or 64 bits value.
5759 */
5760VMMR0DECL(int) VMXWriteCachedVmcsEx(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5761{
5762 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
5763
5764 AssertMsgReturn(pCache->Write.cValidEntries < VMCSCACHE_MAX_ENTRY - 1,
5765 ("entries=%x\n", pCache->Write.cValidEntries), VERR_ACCESS_DENIED);
5766
5767 /* Make sure there are no duplicates. */
5768 for (unsigned i = 0; i < pCache->Write.cValidEntries; i++)
5769 {
5770 if (pCache->Write.aField[i] == idxField)
5771 {
5772 pCache->Write.aFieldVal[i] = u64Val;
5773 return VINF_SUCCESS;
5774 }
5775 }
5776
5777 pCache->Write.aField[pCache->Write.cValidEntries] = idxField;
5778 pCache->Write.aFieldVal[pCache->Write.cValidEntries] = u64Val;
5779 pCache->Write.cValidEntries++;
5780 return VINF_SUCCESS;
5781}
5782
5783#endif /* HC_ARCH_BITS == 32 && !VBOX_WITH_HYBRID_32BIT_KERNEL */
5784
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette