VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 47065

Last change on this file since 47065 was 47065, checked in by vboxsync, 12 years ago

VMM/HWVMXR0: Trip over assert.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 228.3 KB
Line 
1/* $Id: HWVMXR0.cpp 47065 2013-07-10 09:19:19Z vboxsync $ */
2/** @file
3 * HM VMX (VT-x) - Host Context Ring-0.
4 */
5
6/*
7 * Copyright (C) 2006-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*******************************************************************************
20* Header Files *
21*******************************************************************************/
22#define LOG_GROUP LOG_GROUP_HM
23#include <iprt/asm-amd64-x86.h>
24#include <VBox/vmm/hm.h>
25#include <VBox/vmm/pgm.h>
26#include <VBox/vmm/dbgf.h>
27#include <VBox/vmm/dbgftrace.h>
28#include <VBox/vmm/selm.h>
29#include <VBox/vmm/iom.h>
30#ifdef VBOX_WITH_REM
31# include <VBox/vmm/rem.h>
32#endif
33#include <VBox/vmm/tm.h>
34#include "HMInternal.h"
35#include <VBox/vmm/vm.h>
36#include <VBox/vmm/pdmapi.h>
37#include <VBox/err.h>
38#include <VBox/log.h>
39#include <iprt/assert.h>
40#include <iprt/param.h>
41#include <iprt/string.h>
42#include <iprt/time.h>
43#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
44# include <iprt/thread.h>
45#endif
46#include <iprt/x86.h>
47#include "HWVMXR0.h"
48
49#include "dtrace/VBoxVMM.h"
50
51
52/*******************************************************************************
53* Defined Constants And Macros *
54*******************************************************************************/
55#if defined(RT_ARCH_AMD64)
56# define VMX_IS_64BIT_HOST_MODE() (true)
57#elif defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
58# define VMX_IS_64BIT_HOST_MODE() (g_fVMXIs64bitHost != 0)
59#else
60# define VMX_IS_64BIT_HOST_MODE() (false)
61#endif
62
63# define VMX_WRITE_SELREG(REG, reg) \
64 do \
65 { \
66 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_##REG, pCtx->reg.Sel); \
67 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, pCtx->reg.u32Limit); \
68 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_##REG##_BASE, pCtx->reg.u64Base); \
69 if ((pCtx->eflags.u32 & X86_EFL_VM)) \
70 { \
71 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
72 /* DPL=3, present, code/data, r/w/accessed. */ \
73 /** @todo we shouldn't have to do this, if it is not 0xf3 it means we screwed up elsewhere (recompiler). */ \
74 /** @todo VT-x docs explicitly mentions 0xF3. Why not just val = 0xf3 ??. */ \
75 val = (pCtx->reg.Attr.u & ~0xFF) | 0xF3; \
76 } \
77 else \
78 if ( CPUMIsGuestInRealModeEx(pCtx) \
79 && !pVM->hm.s.vmx.fUnrestrictedGuest) \
80 { \
81 /** @todo shouldn't the 'if' condition above check for 'pRealModeTSS' ? */ \
82 /* Must override this or else VT-x will fail with invalid guest state errors. */ \
83 /* DPL=3, present, code/data, r/w/accessed. */ \
84 val = 0xf3; \
85 } \
86 else \
87 if ( ( pCtx->reg.Sel \
88 || !CPUMIsGuestInPagedProtectedModeEx(pCtx) \
89 || (!pCtx->cs.Attr.n.u1DefBig && !CPUMIsGuestIn64BitCodeEx(pCtx)) \
90 ) \
91 && pCtx->reg.Attr.n.u1Present == 1) \
92 { \
93 val = pCtx->reg.Attr.u | X86_SEL_TYPE_ACCESSED; \
94 } \
95 else \
96 val = 0x10000; /* Invalid guest state error otherwise. (BIT(16) = Unusable) */ \
97 \
98 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, val); \
99 } while (0)
100
101# define VMX_READ_SELREG(REG, reg) \
102 do \
103 { \
104 VMXReadCachedVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &val); \
105 pCtx->reg.Sel = val; \
106 pCtx->reg.ValidSel = val; \
107 pCtx->reg.fFlags = CPUMSELREG_FLAGS_VALID; \
108 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &val); \
109 pCtx->reg.u32Limit = val; \
110 VMXReadCachedVmcs(VMX_VMCS_GUEST_##REG##_BASE, &val); \
111 pCtx->reg.u64Base = val; \
112 VMXReadCachedVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &val); \
113 pCtx->reg.Attr.u = val; \
114 } while (0)
115
116/* Don't read from the cache in this macro; used only in case of failure where the cache is out of sync. */
117# define VMX_LOG_SELREG(REG, szSelReg, val) \
118 do \
119 { \
120 VMXReadVmcs(VMX_VMCS16_GUEST_FIELD_##REG, &(val)); \
121 Log(("%s Selector %x\n", szSelReg, (val))); \
122 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_LIMIT, &(val)); \
123 Log(("%s Limit %x\n", szSelReg, (val))); \
124 VMXReadVmcs(VMX_VMCS_GUEST_##REG##_BASE, &(val)); \
125 Log(("%s Base %RX64\n", szSelReg, (uint64_t)(val))); \
126 VMXReadVmcs(VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS, &(val)); \
127 Log(("%s Attributes %x\n", szSelReg, (val))); \
128 } while (0)
129
130#define VMXSetupCachedReadVmcs(pCache, idxField) \
131{ \
132 Assert(pCache->Read.aField[idxField##_CACHE_IDX] == 0); \
133 pCache->Read.aField[idxField##_CACHE_IDX] = idxField; \
134 pCache->Read.aFieldVal[idxField##_CACHE_IDX] = 0; \
135}
136#define VMX_SETUP_SELREG(REG, pCache) \
137{ \
138 VMXSetupCachedReadVmcs(pCache, VMX_VMCS16_GUEST_FIELD_##REG); \
139 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_LIMIT); \
140 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_##REG##_BASE); \
141 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_##REG##_ACCESS_RIGHTS); \
142}
143
144
145/*******************************************************************************
146* Global Variables *
147*******************************************************************************/
148/* IO operation lookup arrays. */
149static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
150static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
151
152#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
153/** See HMR0A.asm. */
154extern "C" uint32_t g_fVMXIs64bitHost;
155#endif
156
157
158/*******************************************************************************
159* Local Functions *
160*******************************************************************************/
161static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu);
162static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu);
163static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu);
164static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu);
165static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush);
166static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr);
167static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
168static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
169static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx);
170
171
172/**
173 * Updates error from VMCS to HMCPU's lasterror record.
174 *
175 * @param pVM Pointer to the VM.
176 * @param pVCpu Pointer to the VMCPU.
177 * @param rc The error code.
178 */
179static void hmR0VmxCheckError(PVM pVM, PVMCPU pVCpu, int rc)
180{
181 if ( rc == VERR_VMX_UNABLE_TO_START_VM
182 || rc == VERR_VMX_INVALID_VMCS_FIELD)
183 {
184 RTCCUINTREG instrError;
185
186 VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
187 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
188 }
189 pVM->hm.s.lLastError = rc;
190}
191
192
193/**
194 * Sets up and activates VT-x on the current CPU.
195 *
196 * @returns VBox status code.
197 * @param pCpu Pointer to the CPU info struct.
198 * @param pVM Pointer to the VM. (can be NULL after a resume!!)
199 * @param pvCpuPage Pointer to the global CPU page.
200 * @param HCPhysCpuPage Physical address of the global CPU page.
201 * @param fEnabledByHost Set if SUPR0EnableVTx or similar was used to enable
202 * VT-x/AMD-V on the host.
203 */
204VMMR0DECL(int) VMXR0EnableCpu(PHMGLOBLCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage, bool fEnabledByHost)
205{
206 if (!fEnabledByHost)
207 {
208 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
209 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
210
211 if (pVM)
212 {
213 /* Set revision dword at the beginning of the VMXON structure. */
214 *(uint32_t *)pvCpuPage = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
215 }
216
217 /** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
218 * (which can have very bad consequences!!!)
219 */
220
221 /** @todo r=bird: Why is this code different than the probing code earlier
222 * on? It just sets VMXE if needed and doesn't check that it isn't
223 * set. Mac OS X host_vmxoff may leave this set and we'll fail here
224 * and debug-assert in the calling code. This is what caused the
225 * "regression" after backing out the SUPR0EnableVTx code hours before
226 * 4.2.0GA (reboot fixed the issue). I've changed here to do the same
227 * as the init code. */
228 uint64_t uCr4 = ASMGetCR4();
229 if (!(uCr4 & X86_CR4_VMXE))
230 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE); /* Make sure the VMX instructions don't cause #UD faults. */
231
232 /*
233 * Enter VM root mode.
234 */
235 int rc = VMXEnable(HCPhysCpuPage);
236 if (RT_FAILURE(rc))
237 {
238 ASMSetCR4(uCr4);
239 return VERR_VMX_VMXON_FAILED;
240 }
241 }
242
243 /*
244 * Flush all VPIDs (in case we or any other hypervisor have been using VPIDs) so that
245 * we can avoid an explicit flush while using new VPIDs. We would still need to flush
246 * each time while reusing a VPID after hitting the MaxASID limit once.
247 */
248 if ( pVM
249 && pVM->hm.s.vmx.fVpid
250 && (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS))
251 {
252 hmR0VmxFlushVPID(pVM, NULL /* pvCpu */, VMX_FLUSH_VPID_ALL_CONTEXTS, 0 /* GCPtr */);
253 pCpu->fFlushAsidBeforeUse = false;
254 }
255 else
256 pCpu->fFlushAsidBeforeUse = true;
257
258 /*
259 * Ensure each VCPU scheduled on this CPU gets a new VPID on resume. See @bugref{6255}.
260 */
261 ++pCpu->cTlbFlushes;
262
263 return VINF_SUCCESS;
264}
265
266
267/**
268 * Deactivates VT-x on the current CPU.
269 *
270 * @returns VBox status code.
271 * @param pCpu Pointer to the CPU info struct.
272 * @param pvCpuPage Pointer to the global CPU page.
273 * @param HCPhysCpuPage Physical address of the global CPU page.
274 */
275VMMR0DECL(int) VMXR0DisableCpu(PHMGLOBLCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
276{
277 AssertReturn(HCPhysCpuPage != 0 && HCPhysCpuPage != NIL_RTHCPHYS, VERR_INVALID_PARAMETER);
278 AssertReturn(pvCpuPage, VERR_INVALID_PARAMETER);
279 NOREF(pCpu);
280
281 /* If we're somehow not in VMX root mode, then we shouldn't dare leaving it. */
282 if (!(ASMGetCR4() & X86_CR4_VMXE))
283 return VERR_VMX_NOT_IN_VMX_ROOT_MODE;
284
285 /* Leave VMX Root Mode. */
286 VMXDisable();
287
288 /* And clear the X86_CR4_VMXE bit. */
289 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
290 return VINF_SUCCESS;
291}
292
293VMMR0DECL(int) VMXR0GlobalInit(void)
294{
295 /* Nothing to do. */
296 return VINF_SUCCESS;
297}
298
299VMMR0DECL(void) VMXR0GlobalTerm(void)
300{
301 /* Nothing to do. */
302}
303
304/**
305 * Does Ring-0 per VM VT-x initialization.
306 *
307 * @returns VBox status code.
308 * @param pVM Pointer to the VM.
309 */
310VMMR0DECL(int) VMXR0InitVM(PVM pVM)
311{
312 int rc;
313
314#ifdef LOG_ENABLED
315 SUPR0Printf("VMXR0InitVM %p\n", pVM);
316#endif
317
318 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
319
320 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW)
321 {
322 /* Allocate one page for the APIC physical page (serves for filtering accesses). */
323 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjApicAccess, PAGE_SIZE, false /* fExecutable */);
324 AssertRC(rc);
325 if (RT_FAILURE(rc))
326 return rc;
327
328 pVM->hm.s.vmx.pbApicAccess = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjApicAccess);
329 pVM->hm.s.vmx.HCPhysApicAccess = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjApicAccess, 0);
330 ASMMemZero32(pVM->hm.s.vmx.pbApicAccess, PAGE_SIZE);
331 }
332 else
333 {
334 pVM->hm.s.vmx.hMemObjApicAccess = 0;
335 pVM->hm.s.vmx.pbApicAccess = 0;
336 pVM->hm.s.vmx.HCPhysApicAccess = 0;
337 }
338
339#ifdef VBOX_WITH_CRASHDUMP_MAGIC
340 {
341 rc = RTR0MemObjAllocCont(&pVM->hm.s.vmx.hMemObjScratch, PAGE_SIZE, false /* fExecutable */);
342 AssertRC(rc);
343 if (RT_FAILURE(rc))
344 return rc;
345
346 pVM->hm.s.vmx.pScratch = (uint8_t *)RTR0MemObjAddress(pVM->hm.s.vmx.hMemObjScratch);
347 pVM->hm.s.vmx.pScratchPhys = RTR0MemObjGetPagePhysAddr(pVM->hm.s.vmx.hMemObjScratch, 0);
348
349 ASMMemZero32(pVM->hm.s.vmx.pbScratch, PAGE_SIZE);
350 strcpy((char *)pVM->hm.s.vmx.pbScratch, "SCRATCH Magic");
351 *(uint64_t *)(pVM->hm.s.vmx.pbScratch + 16) = UINT64_C(0xDEADBEEFDEADBEEF);
352 }
353#endif
354
355 /* Allocate VMCSs for all guest CPUs. */
356 for (VMCPUID i = 0; i < pVM->cCpus; i++)
357 {
358 PVMCPU pVCpu = &pVM->aCpus[i];
359
360 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
361
362 /* Allocate one page for the VM control structure (VMCS). */
363 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVmcs, PAGE_SIZE, false /* fExecutable */);
364 AssertRC(rc);
365 if (RT_FAILURE(rc))
366 return rc;
367
368 pVCpu->hm.s.vmx.pvVmcs = RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVmcs);
369 pVCpu->hm.s.vmx.HCPhysVmcs = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVmcs, 0);
370 ASMMemZeroPage(pVCpu->hm.s.vmx.pvVmcs);
371
372 pVCpu->hm.s.vmx.u32CR0Mask = 0;
373 pVCpu->hm.s.vmx.u32CR4Mask = 0;
374
375 /* Allocate one page for the virtual APIC page for TPR caching. */
376 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjVirtApic, PAGE_SIZE, false /* fExecutable */);
377 AssertRC(rc);
378 if (RT_FAILURE(rc))
379 return rc;
380
381 pVCpu->hm.s.vmx.pbVirtApic = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjVirtApic);
382 pVCpu->hm.s.vmx.HCPhysVirtApic = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjVirtApic, 0);
383 ASMMemZeroPage(pVCpu->hm.s.vmx.pbVirtApic);
384
385 /* Allocate the MSR bitmap if this feature is supported. */
386 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS)
387 {
388 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjMsrBitmap, PAGE_SIZE, false /* fExecutable */);
389 AssertRC(rc);
390 if (RT_FAILURE(rc))
391 return rc;
392
393 pVCpu->hm.s.vmx.pvMsrBitmap = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjMsrBitmap);
394 pVCpu->hm.s.vmx.HCPhysMsrBitmap = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjMsrBitmap, 0);
395 memset(pVCpu->hm.s.vmx.pvMsrBitmap, 0xff, PAGE_SIZE);
396 }
397
398#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
399 /* Allocate one page for the guest MSR load area (for preloading guest MSRs during the world switch). */
400 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjGuestMsr, PAGE_SIZE, false /* fExecutable */);
401 AssertRC(rc);
402 if (RT_FAILURE(rc))
403 return rc;
404
405 pVCpu->hm.s.vmx.pvGuestMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjGuestMsr);
406 pVCpu->hm.s.vmx.HCPhysGuestMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjGuestMsr, 0);
407 Assert(!(pVCpu->hm.s.vmx.HCPhysGuestMsr & 0xf));
408 memset(pVCpu->hm.s.vmx.pvGuestMsr, 0, PAGE_SIZE);
409
410 /* Allocate one page for the host MSR load area (for restoring host MSRs after the world switch back). */
411 rc = RTR0MemObjAllocCont(&pVCpu->hm.s.vmx.hMemObjHostMsr, PAGE_SIZE, false /* fExecutable */);
412 AssertRC(rc);
413 if (RT_FAILURE(rc))
414 return rc;
415
416 pVCpu->hm.s.vmx.pvHostMsr = (uint8_t *)RTR0MemObjAddress(pVCpu->hm.s.vmx.hMemObjHostMsr);
417 pVCpu->hm.s.vmx.HCPhysHostMsr = RTR0MemObjGetPagePhysAddr(pVCpu->hm.s.vmx.hMemObjHostMsr, 0);
418 Assert(!(pVCpu->hm.s.vmx.HCPhysHostMsr & 0xf));
419 memset(pVCpu->hm.s.vmx.pvHostMsr, 0, PAGE_SIZE);
420#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
421
422 /* Current guest paging mode. */
423 pVCpu->hm.s.vmx.enmLastSeenGuestMode = PGMMODE_REAL;
424
425#ifdef LOG_ENABLED
426 SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVCpu->hm.s.vmx.pvVmcs, (uint32_t)pVCpu->hm.s.vmx.HCPhysVmcs);
427#endif
428 }
429
430 return VINF_SUCCESS;
431}
432
433
434/**
435 * Does Ring-0 per VM VT-x termination.
436 *
437 * @returns VBox status code.
438 * @param pVM Pointer to the VM.
439 */
440VMMR0DECL(int) VMXR0TermVM(PVM pVM)
441{
442 for (VMCPUID i = 0; i < pVM->cCpus; i++)
443 {
444 PVMCPU pVCpu = &pVM->aCpus[i];
445
446 if (pVCpu->hm.s.vmx.hMemObjVmcs != NIL_RTR0MEMOBJ)
447 {
448 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVmcs, false);
449 pVCpu->hm.s.vmx.hMemObjVmcs = NIL_RTR0MEMOBJ;
450 pVCpu->hm.s.vmx.pvVmcs = 0;
451 pVCpu->hm.s.vmx.HCPhysVmcs = 0;
452 }
453 if (pVCpu->hm.s.vmx.hMemObjVirtApic != NIL_RTR0MEMOBJ)
454 {
455 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjVirtApic, false);
456 pVCpu->hm.s.vmx.hMemObjVirtApic = NIL_RTR0MEMOBJ;
457 pVCpu->hm.s.vmx.pbVirtApic = 0;
458 pVCpu->hm.s.vmx.HCPhysVirtApic = 0;
459 }
460 if (pVCpu->hm.s.vmx.hMemObjMsrBitmap != NIL_RTR0MEMOBJ)
461 {
462 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjMsrBitmap, false);
463 pVCpu->hm.s.vmx.hMemObjMsrBitmap = NIL_RTR0MEMOBJ;
464 pVCpu->hm.s.vmx.pvMsrBitmap = 0;
465 pVCpu->hm.s.vmx.HCPhysMsrBitmap = 0;
466 }
467#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
468 if (pVCpu->hm.s.vmx.hMemObjHostMsr != NIL_RTR0MEMOBJ)
469 {
470 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjHostMsr, false);
471 pVCpu->hm.s.vmx.hMemObjHostMsr = NIL_RTR0MEMOBJ;
472 pVCpu->hm.s.vmx.pvHostMsr = 0;
473 pVCpu->hm.s.vmx.HCPhysHostMsr = 0;
474 }
475 if (pVCpu->hm.s.vmx.hMemObjGuestMsr != NIL_RTR0MEMOBJ)
476 {
477 RTR0MemObjFree(pVCpu->hm.s.vmx.hMemObjGuestMsr, false);
478 pVCpu->hm.s.vmx.hMemObjGuestMsr = NIL_RTR0MEMOBJ;
479 pVCpu->hm.s.vmx.pvGuestMsr = 0;
480 pVCpu->hm.s.vmx.HCPhysGuestMsr = 0;
481 }
482#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
483 }
484 if (pVM->hm.s.vmx.hMemObjApicAccess != NIL_RTR0MEMOBJ)
485 {
486 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjApicAccess, false);
487 pVM->hm.s.vmx.hMemObjApicAccess = NIL_RTR0MEMOBJ;
488 pVM->hm.s.vmx.pbApicAccess = 0;
489 pVM->hm.s.vmx.HCPhysApicAccess = 0;
490 }
491#ifdef VBOX_WITH_CRASHDUMP_MAGIC
492 if (pVM->hm.s.vmx.hMemObjScratch != NIL_RTR0MEMOBJ)
493 {
494 ASMMemZero32(pVM->hm.s.vmx.pScratch, PAGE_SIZE);
495 RTR0MemObjFree(pVM->hm.s.vmx.hMemObjScratch, false);
496 pVM->hm.s.vmx.hMemObjScratch = NIL_RTR0MEMOBJ;
497 pVM->hm.s.vmx.pScratch = 0;
498 pVM->hm.s.vmx.pScratchPhys = 0;
499 }
500#endif
501 return VINF_SUCCESS;
502}
503
504
505/**
506 * Sets up VT-x for the specified VM.
507 *
508 * @returns VBox status code.
509 * @param pVM Pointer to the VM.
510 */
511VMMR0DECL(int) VMXR0SetupVM(PVM pVM)
512{
513 int rc = VINF_SUCCESS;
514 uint32_t val;
515
516 AssertReturn(pVM, VERR_INVALID_PARAMETER);
517
518 /* Initialize these always, see hmR3InitFinalizeR0().*/
519 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NONE;
520 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NONE;
521
522 /* Determine optimal flush type for EPT. */
523 if (pVM->hm.s.fNestedPaging)
524 {
525 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT)
526 {
527 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_SINGLE_CONTEXT)
528 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_SINGLE_CONTEXT;
529 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_ALL_CONTEXTS)
530 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_ALL_CONTEXTS;
531 else
532 {
533 /*
534 * Should never really happen. EPT is supported but no suitable flush types supported.
535 * We cannot ignore EPT at this point as we've already setup Unrestricted Guest execution.
536 */
537 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
538 return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
539 }
540 }
541 else
542 {
543 /*
544 * Should never really happen. EPT is supported but INVEPT instruction is not supported.
545 */
546 pVM->hm.s.vmx.enmFlushEpt = VMX_FLUSH_EPT_NOT_SUPPORTED;
547 return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
548 }
549 }
550
551 /* Determine optimal flush type for VPID. */
552 if (pVM->hm.s.vmx.fVpid)
553 {
554 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID)
555 {
556 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
557 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_SINGLE_CONTEXT;
558 else if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS)
559 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_ALL_CONTEXTS;
560 else
561 {
562 /*
563 * Neither SINGLE nor ALL context flush types for VPID supported by the CPU.
564 * We do not handle other flush type combinations, ignore VPID capabilities.
565 */
566 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
567 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_INDIV_ADDR supported. Ignoring VPID.\n"));
568 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT_RETAIN_GLOBALS)
569 Log(("VMXR0SetupVM: Only VMX_FLUSH_VPID_SINGLE_CONTEXT_RETAIN_GLOBALS supported. Ignoring VPID.\n"));
570 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
571 pVM->hm.s.vmx.fVpid = false;
572 }
573 }
574 else
575 {
576 /*
577 * Should not really happen. EPT is supported but INVEPT is not supported.
578 * Ignore VPID capabilities as our code relies on using INVEPT for selective flushing.
579 */
580 Log(("VMXR0SetupVM: VPID supported without INVEPT support. Ignoring VPID.\n"));
581 pVM->hm.s.vmx.enmFlushVpid = VMX_FLUSH_VPID_NOT_SUPPORTED;
582 pVM->hm.s.vmx.fVpid = false;
583 }
584 }
585
586 for (VMCPUID i = 0; i < pVM->cCpus; i++)
587 {
588 PVMCPU pVCpu = &pVM->aCpus[i];
589
590 AssertPtr(pVCpu->hm.s.vmx.pvVmcs);
591
592 /* Set revision dword at the beginning of the VMCS structure. */
593 *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.msr.vmx_basic_info);
594
595 /*
596 * Clear and activate the VMCS.
597 */
598 Log(("HCPhysVmcs = %RHp\n", pVCpu->hm.s.vmx.HCPhysVmcs));
599 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
600 if (RT_FAILURE(rc))
601 goto vmx_end;
602
603 rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
604 if (RT_FAILURE(rc))
605 goto vmx_end;
606
607 /*
608 * VMX_VMCS_CTRL_PIN_EXEC
609 * Set required bits to one and zero according to the MSR capabilities.
610 */
611 val = pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
612 val |= VMX_VMCS_CTRL_PIN_EXEC_EXT_INT_EXIT /* External interrupts */
613 | VMX_VMCS_CTRL_PIN_EXEC_NMI_EXIT; /* Non-maskable interrupts */
614
615 /*
616 * Enable the VMX preemption timer.
617 */
618 if (pVM->hm.s.vmx.fUsePreemptTimer)
619 val |= VMX_VMCS_CTRL_PIN_EXEC_PREEMPT_TIMER;
620 val &= pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
621
622 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PIN_EXEC, val);
623 AssertRC(rc);
624 pVCpu->hm.s.vmx.u32PinCtls = val;
625
626 /*
627 * VMX_VMCS_CTRL_PROC_EXEC
628 * Set required bits to one and zero according to the MSR capabilities.
629 */
630 val = pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
631 /* Program which event cause VM-exits and which features we want to use. */
632 val |= VMX_VMCS_CTRL_PROC_EXEC_HLT_EXIT
633 | VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING
634 | VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT
635 | VMX_VMCS_CTRL_PROC_EXEC_UNCOND_IO_EXIT
636 | VMX_VMCS_CTRL_PROC_EXEC_RDPMC_EXIT
637 | VMX_VMCS_CTRL_PROC_EXEC_MONITOR_EXIT
638 | VMX_VMCS_CTRL_PROC_EXEC_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside
639 the guest (host thinks the cpu load is high) */
640
641 /* Without nested paging we should intercept invlpg and cr3 mov instructions. */
642 if (!pVM->hm.s.fNestedPaging)
643 {
644 val |= VMX_VMCS_CTRL_PROC_EXEC_INVLPG_EXIT
645 | VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
646 | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
647 }
648
649 /*
650 * VMX_VMCS_CTRL_PROC_EXEC_MWAIT_EXIT might cause a vmlaunch
651 * failure with an invalid control fields error. (combined with some other exit reasons)
652 */
653 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW)
654 {
655 /* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
656 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW;
657 Assert(pVM->hm.s.vmx.pbApicAccess);
658 }
659 else
660 /* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
661 val |= VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT | VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT;
662
663 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS)
664 {
665 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
666 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS;
667 }
668
669 /* We will use the secondary control if it's present. */
670 val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
671
672 /* Mask away the bits that the CPU doesn't support */
673 /** @todo make sure they don't conflict with the above requirements. */
674 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
675 pVCpu->hm.s.vmx.u32ProcCtls = val;
676
677 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, val);
678 AssertRC(rc);
679
680 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
681 {
682 /*
683 * VMX_VMCS_CTRL_PROC_EXEC2
684 * Set required bits to one and zero according to the MSR capabilities.
685 */
686 val = pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
687 val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
688
689 if (pVM->hm.s.fNestedPaging)
690 val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;
691
692 if (pVM->hm.s.vmx.fVpid)
693 val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;
694
695 if (pVM->hm.s.fHasIoApic)
696 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
697
698 if (pVM->hm.s.vmx.fUnrestrictedGuest)
699 val |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;
700
701 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
702 val |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;
703
704 /* Mask away the bits that the CPU doesn't support */
705 /** @todo make sure they don't conflict with the above requirements. */
706 val &= pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
707 pVCpu->hm.s.vmx.u32ProcCtls2 = val;
708 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC2, val);
709 AssertRC(rc);
710 }
711
712 /*
713 * VMX_VMCS_CTRL_CR3_TARGET_COUNT
714 * Set required bits to one and zero according to the MSR capabilities.
715 */
716 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_CR3_TARGET_COUNT, 0);
717 AssertRC(rc);
718
719 /*
720 * Forward all exception except #NM & #PF to the guest.
721 * We always need to check pagefaults since our shadow page table can be out of sync.
722 * And we always lazily sync the FPU & XMM state. .
723 */
724
725 /** @todo Possible optimization:
726 * Keep the FPU and XMM state current in the EM thread. That way there's no need to
727 * lazily sync anything, but the downside is that we can't use the FPU stack or XMM
728 * registers ourselves of course.
729 *
730 * Note: only possible if the current state is actually ours (X86_CR0_TS flag)
731 */
732
733 /*
734 * Don't filter page faults, all of them should cause a world switch.
735 */
736 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK, 0);
737 AssertRC(rc);
738 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH, 0);
739 AssertRC(rc);
740
741 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0);
742 AssertRC(rc);
743 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_A_FULL, 0);
744 AssertRC(rc);
745 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_B_FULL, 0);
746 AssertRC(rc);
747
748 /*
749 * Set the MSR bitmap address.
750 */
751 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS)
752 {
753 Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
754
755 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_MSR_BITMAP_FULL, pVCpu->hm.s.vmx.HCPhysMsrBitmap);
756 AssertRC(rc);
757
758 /*
759 * Allow the guest to directly modify these MSRs; they are loaded/stored automatically
760 * using MSR-load/store areas in the VMCS.
761 */
762 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
763 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
764 hmR0VmxSetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
765 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
766 hmR0VmxSetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
767 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
768 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
769 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
770 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
771 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
772 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_TSC_AUX, true, true);
773 }
774
775#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
776 /*
777 * Set the guest & host MSR load/store physical addresses.
778 */
779 Assert(pVCpu->hm.s.vmx.HCPhysGuestMsr);
780 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
781 AssertRC(rc);
782 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL, pVCpu->hm.s.vmx.HCPhysGuestMsr);
783 AssertRC(rc);
784 Assert(pVCpu->hm.s.vmx.HCPhysHostMsr);
785 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL, pVCpu->hm.s.vmx.HCPhysHostMsr);
786 AssertRC(rc);
787#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
788
789 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, 0);
790 AssertRC(rc);
791 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, 0);
792 AssertRC(rc);
793 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, 0);
794 AssertRC(rc);
795
796 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW)
797 {
798 Assert(pVM->hm.s.vmx.hMemObjApicAccess);
799 /* Optional */
800 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, 0);
801 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hm.s.vmx.HCPhysVirtApic);
802
803 if (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
804 rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL, pVM->hm.s.vmx.HCPhysApicAccess);
805
806 AssertRC(rc);
807 }
808
809 /* Set link pointer to -1. Not currently used. */
810 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFFULL);
811 AssertRC(rc);
812
813 /*
814 * Clear VMCS, marking it inactive. Clear implementation specific data and writing back
815 * VMCS data back to memory.
816 */
817 rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
818 AssertRC(rc);
819
820 /*
821 * Configure the VMCS read cache.
822 */
823 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
824
825 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RIP);
826 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RSP);
827 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_RFLAGS);
828 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE);
829 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR0_READ_SHADOW);
830 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR0);
831 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_CTRL_CR4_READ_SHADOW);
832 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR4);
833 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_DR7);
834 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_SYSENTER_CS);
835 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_EIP);
836 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_SYSENTER_ESP);
837 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_GDTR_LIMIT);
838 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_GDTR_BASE);
839 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_GUEST_IDTR_LIMIT);
840 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_IDTR_BASE);
841
842 VMX_SETUP_SELREG(ES, pCache);
843 VMX_SETUP_SELREG(SS, pCache);
844 VMX_SETUP_SELREG(CS, pCache);
845 VMX_SETUP_SELREG(DS, pCache);
846 VMX_SETUP_SELREG(FS, pCache);
847 VMX_SETUP_SELREG(GS, pCache);
848 VMX_SETUP_SELREG(LDTR, pCache);
849 VMX_SETUP_SELREG(TR, pCache);
850
851 /*
852 * Status code VMCS reads.
853 */
854 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_REASON);
855 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_VM_INSTR_ERROR);
856 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_LENGTH);
857 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE);
858 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO);
859 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_EXIT_INSTR_INFO);
860 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_RO_EXIT_QUALIFICATION);
861 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_INFO);
862 VMXSetupCachedReadVmcs(pCache, VMX_VMCS32_RO_IDT_ERROR_CODE);
863
864 if (pVM->hm.s.fNestedPaging)
865 {
866 VMXSetupCachedReadVmcs(pCache, VMX_VMCS_GUEST_CR3);
867 VMXSetupCachedReadVmcs(pCache, VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL);
868 pCache->Read.cValidEntries = VMX_VMCS_MAX_NESTED_PAGING_CACHE_IDX;
869 }
870 else
871 pCache->Read.cValidEntries = VMX_VMCS_MAX_CACHE_IDX;
872 } /* for each VMCPU */
873
874 /*
875 * Setup the right TLB function based on CPU capabilities.
876 */
877 if (pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid)
878 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBBoth;
879 else if (pVM->hm.s.fNestedPaging)
880 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBEPT;
881 else if (pVM->hm.s.vmx.fVpid)
882 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBVPID;
883 else
884 pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxSetupTLBDummy;
885
886vmx_end:
887 hmR0VmxCheckError(pVM, &pVM->aCpus[0], rc);
888 return rc;
889}
890
891
892/**
893 * Sets the permission bits for the specified MSR.
894 *
895 * @param pVCpu Pointer to the VMCPU.
896 * @param ulMSR The MSR value.
897 * @param fRead Whether reading is allowed.
898 * @param fWrite Whether writing is allowed.
899 */
900static void hmR0VmxSetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
901{
902 unsigned ulBit;
903 uint8_t *pvMsrBitmap = (uint8_t *)pVCpu->hm.s.vmx.pvMsrBitmap;
904
905 /*
906 * Layout:
907 * 0x000 - 0x3ff - Low MSR read bits
908 * 0x400 - 0x7ff - High MSR read bits
909 * 0x800 - 0xbff - Low MSR write bits
910 * 0xc00 - 0xfff - High MSR write bits
911 */
912 if (ulMSR <= 0x00001FFF)
913 {
914 /* Pentium-compatible MSRs */
915 ulBit = ulMSR;
916 }
917 else if ( ulMSR >= 0xC0000000
918 && ulMSR <= 0xC0001FFF)
919 {
920 /* AMD Sixth Generation x86 Processor MSRs */
921 ulBit = (ulMSR - 0xC0000000);
922 pvMsrBitmap += 0x400;
923 }
924 else
925 {
926 AssertFailed();
927 return;
928 }
929
930 Assert(ulBit <= 0x1fff);
931 if (fRead)
932 ASMBitClear(pvMsrBitmap, ulBit);
933 else
934 ASMBitSet(pvMsrBitmap, ulBit);
935
936 if (fWrite)
937 ASMBitClear(pvMsrBitmap + 0x800, ulBit);
938 else
939 ASMBitSet(pvMsrBitmap + 0x800, ulBit);
940}
941
942
943/**
944 * Injects an event (trap or external interrupt).
945 *
946 * @returns VBox status code. Note that it may return VINF_EM_RESET to
947 * indicate a triple fault when injecting X86_XCPT_DF.
948 *
949 * @param pVM Pointer to the VM.
950 * @param pVCpu Pointer to the VMCPU.
951 * @param pCtx Pointer to the guest CPU Context.
952 * @param intInfo VMX interrupt info.
953 * @param cbInstr Opcode length of faulting instruction.
954 * @param errCode Error code (optional).
955 */
956static int hmR0VmxInjectEvent(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
957{
958 int rc;
959 uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
960
961#ifdef VBOX_WITH_STATISTICS
962 STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[iGate & MASK_INJECT_IRQ_STAT]);
963#endif
964
965#ifdef VBOX_STRICT
966 if (iGate == 0xE)
967 {
968 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x CR2=%RGv intInfo=%08x\n", iGate,
969 (RTGCPTR)pCtx->rip, errCode, pCtx->cr2, intInfo));
970 }
971 else if (iGate < 0x20)
972 {
973 LogFlow(("hmR0VmxInjectEvent: Injecting interrupt %d at %RGv error code=%08x\n", iGate, (RTGCPTR)pCtx->rip,
974 errCode));
975 }
976 else
977 {
978 LogFlow(("INJ-EI: %x at %RGv\n", iGate, (RTGCPTR)pCtx->rip));
979 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
980 || !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
981 Assert( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
982 || pCtx->eflags.u32 & X86_EFL_IF);
983 }
984#endif
985
986 if ( CPUMIsGuestInRealModeEx(pCtx)
987 && pVM->hm.s.vmx.pRealModeTSS)
988 {
989 RTGCPHYS GCPhysHandler;
990 uint16_t offset, ip;
991 RTSEL sel;
992
993 /*
994 * Injecting events doesn't work right with real mode emulation.
995 * (#GP if we try to inject external hardware interrupts)
996 * Inject the interrupt or trap directly instead.
997 *
998 * ASSUMES no access handlers for the bits we read or write below (should be safe).
999 */
1000 Log(("Manual interrupt/trap '%x' inject (real mode)\n", iGate));
1001
1002 /*
1003 * Check if the interrupt handler is present.
1004 */
1005 if (iGate * 4 + 3 > pCtx->idtr.cbIdt)
1006 {
1007 Log(("IDT cbIdt violation\n"));
1008 if (iGate != X86_XCPT_DF)
1009 {
1010 uint32_t intInfo2;
1011
1012 intInfo2 = (iGate == X86_XCPT_GP) ? (uint32_t)X86_XCPT_DF : (uint32_t)X86_XCPT_GP;
1013 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1014 intInfo2 |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1015 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1016
1017 return hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, 0, 0 /* no error code according to the Intel docs */);
1018 }
1019 Log(("Triple fault -> reset the VM!\n"));
1020 return VINF_EM_RESET;
1021 }
1022 if ( VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
1023 || iGate == 3 /* Both #BP and #OF point to the instruction after. */
1024 || iGate == 4)
1025 {
1026 ip = pCtx->ip + cbInstr;
1027 }
1028 else
1029 ip = pCtx->ip;
1030
1031 /*
1032 * Read the selector:offset pair of the interrupt handler.
1033 */
1034 GCPhysHandler = (RTGCPHYS)pCtx->idtr.pIdt + iGate * 4;
1035 rc = PGMPhysSimpleReadGCPhys(pVM, &offset, GCPhysHandler, sizeof(offset)); AssertRC(rc);
1036 rc = PGMPhysSimpleReadGCPhys(pVM, &sel, GCPhysHandler + 2, sizeof(sel)); AssertRC(rc);
1037
1038 LogFlow(("IDT handler %04X:%04X\n", sel, offset));
1039
1040 /*
1041 * Construct the stack frame.
1042 */
1043 /** @todo Check stack limit. */
1044 pCtx->sp -= 2;
1045 LogFlow(("ss:sp %04X:%04X eflags=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->eflags.u));
1046 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->eflags, sizeof(uint16_t)); AssertRC(rc);
1047 pCtx->sp -= 2;
1048 LogFlow(("ss:sp %04X:%04X cs=%x\n", pCtx->ss.Sel, pCtx->sp, pCtx->cs.Sel));
1049 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &pCtx->cs, sizeof(uint16_t)); AssertRC(rc);
1050 pCtx->sp -= 2;
1051 LogFlow(("ss:sp %04X:%04X ip=%x\n", pCtx->ss.Sel, pCtx->sp, ip));
1052 rc = PGMPhysSimpleWriteGCPhys(pVM, pCtx->ss.u64Base + pCtx->sp, &ip, sizeof(ip)); AssertRC(rc);
1053
1054 /*
1055 * Update the CPU state for executing the handler.
1056 */
1057 pCtx->rip = offset;
1058 pCtx->cs.Sel = sel;
1059 pCtx->cs.u64Base = sel << 4;
1060 pCtx->eflags.u &= ~(X86_EFL_IF | X86_EFL_TF | X86_EFL_RF | X86_EFL_AC);
1061
1062 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_SEGMENT_REGS;
1063 return VINF_SUCCESS;
1064 }
1065
1066 /*
1067 * Set event injection state.
1068 */
1069 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, intInfo | (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
1070 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
1071 rc |= VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
1072
1073 AssertRC(rc);
1074 return rc;
1075}
1076
1077
1078/**
1079 * Checks for pending guest interrupts and injects them.
1080 *
1081 * @returns VBox status code.
1082 * @param pVM Pointer to the VM.
1083 * @param pVCpu Pointer to the VMCPU.
1084 * @param pCtx Pointer to the guest CPU context.
1085 */
1086static int hmR0VmxCheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, CPUMCTX *pCtx)
1087{
1088 int rc;
1089
1090 /*
1091 * Dispatch any pending interrupts (injected before, but a VM exit occurred prematurely).
1092 */
1093 if (pVCpu->hm.s.Event.fPending)
1094 {
1095 Log(("CPU%d: Reinjecting event %RX64 %08x at %RGv cr2=%RX64\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntrInfo,
1096 pVCpu->hm.s.Event.u32ErrCode, (RTGCPTR)pCtx->rip, pCtx->cr2));
1097 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
1098 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, pVCpu->hm.s.Event.u64IntrInfo, 0, pVCpu->hm.s.Event.u32ErrCode);
1099 AssertRC(rc);
1100
1101 pVCpu->hm.s.Event.fPending = false;
1102 return VINF_SUCCESS;
1103 }
1104
1105 /*
1106 * If an active trap is already pending, we must forward it first!
1107 */
1108 if (!TRPMHasTrap(pVCpu))
1109 {
1110 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NMI))
1111 {
1112 RTGCUINTPTR intInfo;
1113
1114 Log(("CPU%d: injecting #NMI\n", pVCpu->idCpu));
1115
1116 intInfo = X86_XCPT_NMI;
1117 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1118 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1119
1120 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, 0);
1121 AssertRC(rc);
1122
1123 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectXcpt);
1124 return VINF_SUCCESS;
1125 }
1126
1127 /** @todo SMI interrupts. */
1128
1129 /*
1130 * When external interrupts are pending, we should exit the VM when IF is set.
1131 */
1132 if (VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
1133 {
1134 if (!(pCtx->eflags.u32 & X86_EFL_IF))
1135 {
1136 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_INT_WINDOW_EXIT))
1137 {
1138 LogFlow(("Enable irq window exit!\n"));
1139 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_INT_WINDOW_EXIT;
1140 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
1141 AssertRC(rc);
1142 }
1143 /* else nothing to do but wait */
1144 }
1145 else if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1146 {
1147 uint8_t u8Interrupt;
1148
1149 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
1150 Log(("CPU%d: Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc cs:rip=%04X:%RGv\n", pVCpu->idCpu,
1151 u8Interrupt, u8Interrupt, rc, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
1152 if (RT_SUCCESS(rc))
1153 {
1154 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
1155 AssertRC(rc);
1156 }
1157 else
1158 {
1159 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
1160 Assert(!VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
1161 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchGuestIrq);
1162 /* Just continue */
1163 }
1164 }
1165 else
1166 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS!!\n", (RTGCPTR)pCtx->rip));
1167 }
1168 }
1169
1170#ifdef VBOX_STRICT
1171 if (TRPMHasTrap(pVCpu))
1172 {
1173 uint8_t u8Vector;
1174 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, NULL, NULL, NULL);
1175 AssertRC(rc);
1176 }
1177#endif
1178
1179 if ( (pCtx->eflags.u32 & X86_EFL_IF)
1180 && (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
1181 && TRPMHasTrap(pVCpu)
1182 )
1183 {
1184 uint8_t u8Vector;
1185 TRPMEVENT enmType;
1186 RTGCUINTPTR intInfo;
1187 RTGCUINT errCode;
1188
1189 /*
1190 * If a new event is pending, dispatch it now.
1191 */
1192 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &errCode, NULL, NULL);
1193 AssertRC(rc);
1194 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
1195 Assert(enmType != TRPM_SOFTWARE_INT);
1196
1197 /*
1198 * Clear the pending trap.
1199 */
1200 rc = TRPMResetTrap(pVCpu);
1201 AssertRC(rc);
1202
1203 intInfo = u8Vector;
1204 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
1205
1206 if (enmType == TRPM_TRAP)
1207 {
1208 switch (u8Vector)
1209 {
1210 case X86_XCPT_DF:
1211 case X86_XCPT_TS:
1212 case X86_XCPT_NP:
1213 case X86_XCPT_SS:
1214 case X86_XCPT_GP:
1215 case X86_XCPT_PF:
1216 case X86_XCPT_AC:
1217 {
1218 /** @todo r=ramshankar: setting this bit would blow up for real-mode guests with
1219 * unrestricted guest execution. */
1220 /* Valid error codes. */
1221 intInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
1222 break;
1223 }
1224
1225 default:
1226 break;
1227 }
1228
1229 if ( u8Vector == X86_XCPT_BP
1230 || u8Vector == X86_XCPT_OF)
1231 {
1232 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1233 }
1234 else
1235 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1236
1237 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectXcpt);
1238 }
1239 else
1240 {
1241 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
1242 STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectInterrupt);
1243 }
1244
1245 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo, 0, errCode);
1246 AssertRC(rc);
1247 } /* if (interrupts can be dispatched) */
1248
1249 return VINF_SUCCESS;
1250}
1251
1252/**
1253 * Checks for pending VMX events and converts them to TRPM. Before we execute any instruction
1254 * outside of VMX, any pending VMX event must be converted so that it can be delivered properly.
1255 *
1256 * @returns VBox status code.
1257 * @param pVCpu Pointer to the VMCPU.
1258 */
1259static int hmR0VmxCheckPendingEvent(PVMCPU pVCpu)
1260{
1261 if (pVCpu->hm.s.Event.fPending)
1262 {
1263 TRPMEVENT enmTrapType;
1264
1265 /* If a trap was already pending, we did something wrong! */
1266 Assert((TRPMQueryTrap(pVCpu, NULL, NULL) == VERR_TRPM_NO_ACTIVE_TRAP));
1267
1268 /*
1269 * Clear the pending event and move it over to TRPM for the rest
1270 * of the world to see.
1271 */
1272 pVCpu->hm.s.Event.fPending = false;
1273 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo))
1274 {
1275 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT:
1276 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI:
1277 enmTrapType = TRPM_HARDWARE_INT;
1278 break;
1279 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT:
1280 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /** @todo Is classifying #BP, #OF as TRPM_SOFTWARE_INT correct? */
1281 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT:
1282 enmTrapType = TRPM_SOFTWARE_INT;
1283 break;
1284 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT:
1285 enmTrapType = TRPM_TRAP;
1286 break;
1287 default:
1288 enmTrapType = TRPM_32BIT_HACK; /* Can't get here. */
1289 AssertFailed();
1290 }
1291 TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), enmTrapType);
1292 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
1293 TRPMSetErrorCode(pVCpu, pVCpu->hm.s.Event.u32ErrCode);
1294 //@todo: Is there any situation where we need to call TRPMSetFaultAddress()?
1295 }
1296 return VINF_SUCCESS;
1297}
1298
1299/**
1300 * Save the host state into the VMCS.
1301 *
1302 * @returns VBox status code.
1303 * @param pVM Pointer to the VM.
1304 * @param pVCpu Pointer to the VMCPU.
1305 */
1306VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
1307{
1308 int rc = VINF_SUCCESS;
1309 NOREF(pVM);
1310
1311 /*
1312 * Host CPU Context.
1313 */
1314 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
1315 {
1316 RTIDTR idtr;
1317 RTGDTR gdtr;
1318 RTSEL SelTR;
1319 PCX86DESCHC pDesc;
1320 uintptr_t trBase;
1321 RTSEL cs;
1322 RTSEL ss;
1323 uint64_t cr3;
1324
1325 /*
1326 * Control registers.
1327 */
1328 rc = VMXWriteVmcs(VMX_VMCS_HOST_CR0, ASMGetCR0());
1329 Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
1330#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1331 if (VMX_IS_64BIT_HOST_MODE())
1332 {
1333 cr3 = HMR0Get64bitCR3();
1334 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_CR3, cr3);
1335 }
1336 else
1337#endif
1338 {
1339 cr3 = ASMGetCR3();
1340 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR3, cr3);
1341 }
1342 Log2(("VMX_VMCS_HOST_CR3 %08RX64\n", cr3));
1343 rc |= VMXWriteVmcs(VMX_VMCS_HOST_CR4, ASMGetCR4());
1344 Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
1345 AssertRC(rc);
1346
1347 /*
1348 * Selector registers.
1349 */
1350#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1351 if (VMX_IS_64BIT_HOST_MODE())
1352 {
1353 cs = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelCS;
1354 ss = (RTSEL)(uintptr_t)&SUPR0Abs64bitKernelSS;
1355 }
1356 else
1357 {
1358 /* sysenter loads LDT cs & ss, VMX doesn't like this. Load the GDT ones (safe). */
1359 cs = (RTSEL)(uintptr_t)&SUPR0AbsKernelCS;
1360 ss = (RTSEL)(uintptr_t)&SUPR0AbsKernelSS;
1361 }
1362#else
1363 cs = ASMGetCS();
1364 ss = ASMGetSS();
1365#endif
1366 Assert(!(cs & X86_SEL_LDT)); Assert((cs & X86_SEL_RPL) == 0);
1367 Assert(!(ss & X86_SEL_LDT)); Assert((ss & X86_SEL_RPL) == 0);
1368 rc = VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_CS, cs);
1369 /* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
1370 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_DS, 0);
1371 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_ES, 0);
1372#if HC_ARCH_BITS == 32
1373 if (!VMX_IS_64BIT_HOST_MODE())
1374 {
1375 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_FS, 0);
1376 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_GS, 0);
1377 }
1378#endif
1379 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_SS, ss);
1380 SelTR = ASMGetTR();
1381 rc |= VMXWriteVmcs(VMX_VMCS16_HOST_FIELD_TR, SelTR);
1382 AssertRC(rc);
1383 Log2(("VMX_VMCS_HOST_FIELD_CS %08x (%08x)\n", cs, ASMGetSS()));
1384 Log2(("VMX_VMCS_HOST_FIELD_DS 00000000 (%08x)\n", ASMGetDS()));
1385 Log2(("VMX_VMCS_HOST_FIELD_ES 00000000 (%08x)\n", ASMGetES()));
1386 Log2(("VMX_VMCS_HOST_FIELD_FS 00000000 (%08x)\n", ASMGetFS()));
1387 Log2(("VMX_VMCS_HOST_FIELD_GS 00000000 (%08x)\n", ASMGetGS()));
1388 Log2(("VMX_VMCS_HOST_FIELD_SS %08x (%08x)\n", ss, ASMGetSS()));
1389 Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
1390
1391 /*
1392 * GDTR & IDTR.
1393 */
1394#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1395 if (VMX_IS_64BIT_HOST_MODE())
1396 {
1397 X86XDTR64 gdtr64, idtr64;
1398 HMR0Get64bitGdtrAndIdtr(&gdtr64, &idtr64);
1399 rc = VMXWriteVmcs64(VMX_VMCS_HOST_GDTR_BASE, gdtr64.uAddr);
1400 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_IDTR_BASE, idtr64.uAddr);
1401 AssertRC(rc);
1402 Log2(("VMX_VMCS_HOST_GDTR_BASE %RX64\n", gdtr64.uAddr));
1403 Log2(("VMX_VMCS_HOST_IDTR_BASE %RX64\n", idtr64.uAddr));
1404 gdtr.cbGdt = gdtr64.cb;
1405 gdtr.pGdt = (uintptr_t)gdtr64.uAddr;
1406 }
1407 else
1408#endif
1409 {
1410 ASMGetGDTR(&gdtr);
1411 rc = VMXWriteVmcs(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
1412 ASMGetIDTR(&idtr);
1413 rc |= VMXWriteVmcs(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
1414 AssertRC(rc);
1415 Log2(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", gdtr.pGdt));
1416 Log2(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", idtr.pIdt));
1417 }
1418
1419 /*
1420 * Save the base address of the TR selector.
1421 */
1422 if (SelTR > gdtr.cbGdt)
1423 {
1424 AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
1425 return VERR_VMX_INVALID_HOST_STATE;
1426 }
1427
1428 pDesc = (PCX86DESCHC)(gdtr.pGdt + (SelTR & X86_SEL_MASK));
1429#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1430 if (VMX_IS_64BIT_HOST_MODE())
1431 {
1432 uint64_t trBase64 = X86DESC64_BASE((PX86DESC64)pDesc);
1433 rc = VMXWriteVmcs64(VMX_VMCS_HOST_TR_BASE, trBase64);
1434 Log2(("VMX_VMCS_HOST_TR_BASE %RX64\n", trBase64));
1435 AssertRC(rc);
1436 }
1437 else
1438#endif
1439 {
1440#if HC_ARCH_BITS == 64
1441 trBase = X86DESC64_BASE(pDesc);
1442#else
1443 trBase = X86DESC_BASE(pDesc);
1444#endif
1445 rc = VMXWriteVmcs(VMX_VMCS_HOST_TR_BASE, trBase);
1446 AssertRC(rc);
1447 Log2(("VMX_VMCS_HOST_TR_BASE %RHv\n", trBase));
1448 }
1449
1450 /*
1451 * FS base and GS base.
1452 */
1453#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1454 if (VMX_IS_64BIT_HOST_MODE())
1455 {
1456 Log2(("MSR_K8_FS_BASE = %RX64\n", ASMRdMsr(MSR_K8_FS_BASE)));
1457 Log2(("MSR_K8_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_GS_BASE)));
1458 rc = VMXWriteVmcs64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
1459 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
1460 }
1461#endif
1462 AssertRC(rc);
1463
1464 /*
1465 * Sysenter MSRs.
1466 */
1467 /** @todo expensive!! */
1468 rc = VMXWriteVmcs(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
1469 Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
1470#ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
1471 if (VMX_IS_64BIT_HOST_MODE())
1472 {
1473 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1474 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1475 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1476 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1477 }
1478 else
1479 {
1480 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1481 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1482 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1483 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1484 }
1485#elif HC_ARCH_BITS == 32
1486 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
1487 rc |= VMXWriteVmcs(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
1488 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
1489 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX32\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
1490#else
1491 Log2(("VMX_VMCS_HOST_SYSENTER_EIP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
1492 Log2(("VMX_VMCS_HOST_SYSENTER_ESP %RX64\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
1493 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
1494 rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
1495#endif
1496 AssertRC(rc);
1497
1498
1499#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
1500 /*
1501 * Store all host MSRs in the VM-Exit load area, so they will be reloaded after
1502 * the world switch back to the host.
1503 */
1504 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvHostMsr;
1505 unsigned idxMsr = 0;
1506
1507 uint32_t u32HostExtFeatures = ASMCpuId_EDX(0x80000001);
1508 if (u32HostExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
1509 {
1510 pMsr->u32IndexMSR = MSR_K6_EFER;
1511 pMsr->u32Reserved = 0;
1512# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1513 if (CPUMIsGuestInLongMode(pVCpu))
1514 {
1515 /* Must match the EFER value in our 64 bits switcher. */
1516 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER) | MSR_K6_EFER_LME | MSR_K6_EFER_SCE | MSR_K6_EFER_NXE;
1517 }
1518 else
1519# endif
1520 pMsr->u64Value = ASMRdMsr(MSR_K6_EFER);
1521 pMsr++; idxMsr++;
1522 }
1523
1524# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1525 if (VMX_IS_64BIT_HOST_MODE())
1526 {
1527 pMsr->u32IndexMSR = MSR_K6_STAR;
1528 pMsr->u32Reserved = 0;
1529 pMsr->u64Value = ASMRdMsr(MSR_K6_STAR); /* legacy syscall eip, cs & ss */
1530 pMsr++; idxMsr++;
1531 pMsr->u32IndexMSR = MSR_K8_LSTAR;
1532 pMsr->u32Reserved = 0;
1533 pMsr->u64Value = ASMRdMsr(MSR_K8_LSTAR); /* 64 bits mode syscall rip */
1534 pMsr++; idxMsr++;
1535 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
1536 pMsr->u32Reserved = 0;
1537 pMsr->u64Value = ASMRdMsr(MSR_K8_SF_MASK); /* syscall flag mask */
1538 pMsr++; idxMsr++;
1539# if 0
1540 /* The KERNEL_GS_BASE MSR does not work reliably with auto load/store. See @bugref{6208} */
1541 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
1542 pMsr->u32Reserved = 0;
1543 pMsr->u64Value = ASMRdMsr(MSR_K8_KERNEL_GS_BASE); /* swapgs exchange value */
1544 pMsr++; idxMsr++;
1545# endif
1546 }
1547# endif
1548
1549 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
1550 {
1551 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
1552 pMsr->u32Reserved = 0;
1553 pMsr->u64Value = ASMRdMsr(MSR_K8_TSC_AUX);
1554 pMsr++; idxMsr++;
1555 }
1556
1557 /** @todo r=ramshankar: check IA32_VMX_MISC bits 27:25 for valid idxMsr
1558 * range. */
1559 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT, idxMsr);
1560 AssertRC(rc);
1561#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
1562
1563 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_HOST_CONTEXT;
1564 }
1565 return rc;
1566}
1567
1568
1569/**
1570 * Loads the 4 PDPEs into the guest state when nested paging is used and the
1571 * guest operates in PAE mode.
1572 *
1573 * @returns VBox status code.
1574 * @param pVCpu Pointer to the VMCPU.
1575 * @param pCtx Pointer to the guest CPU context.
1576 */
1577static int hmR0VmxLoadPaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1578{
1579 if (CPUMIsGuestInPAEModeEx(pCtx))
1580 {
1581 X86PDPE aPdpes[4];
1582 int rc = PGMGstGetPaePdpes(pVCpu, &aPdpes[0]);
1583 AssertRCReturn(rc, rc);
1584
1585 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, aPdpes[0].u); AssertRCReturn(rc, rc);
1586 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, aPdpes[1].u); AssertRCReturn(rc, rc);
1587 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, aPdpes[2].u); AssertRCReturn(rc, rc);
1588 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, aPdpes[3].u); AssertRCReturn(rc, rc);
1589 }
1590 return VINF_SUCCESS;
1591}
1592
1593
1594/**
1595 * Saves the 4 PDPEs into the guest state when nested paging is used and the
1596 * guest operates in PAE mode.
1597 *
1598 * @returns VBox status code.
1599 * @param pVCpu Pointer to the VM CPU.
1600 * @param pCtx Pointer to the guest CPU context.
1601 *
1602 * @remarks Tell PGM about CR3 changes before calling this helper.
1603 */
1604static int hmR0VmxSavePaePdpes(PVMCPU pVCpu, PCPUMCTX pCtx)
1605{
1606 if (CPUMIsGuestInPAEModeEx(pCtx))
1607 {
1608 int rc;
1609 X86PDPE aPdpes[4];
1610 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &aPdpes[0].u); AssertRCReturn(rc, rc);
1611 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &aPdpes[1].u); AssertRCReturn(rc, rc);
1612 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &aPdpes[2].u); AssertRCReturn(rc, rc);
1613 rc = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &aPdpes[3].u); AssertRCReturn(rc, rc);
1614
1615 rc = PGMGstUpdatePaePdpes(pVCpu, &aPdpes[0]);
1616 AssertRCReturn(rc, rc);
1617 }
1618 return VINF_SUCCESS;
1619}
1620
1621
1622/**
1623 * Update the exception bitmap according to the current CPU state.
1624 *
1625 * @param pVM Pointer to the VM.
1626 * @param pVCpu Pointer to the VMCPU.
1627 * @param pCtx Pointer to the guest CPU context.
1628 */
1629static void hmR0VmxUpdateExceptionBitmap(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1630{
1631 uint32_t u32TrapMask;
1632 Assert(pCtx);
1633
1634 /*
1635 * Set up a mask for intercepting traps.
1636 */
1637 /** @todo Do we really need to always intercept #DB? */
1638 u32TrapMask = RT_BIT(X86_XCPT_DB)
1639 | RT_BIT(X86_XCPT_NM)
1640#ifdef VBOX_ALWAYS_TRAP_PF
1641 | RT_BIT(X86_XCPT_PF)
1642#endif
1643#ifdef VBOX_STRICT
1644 | RT_BIT(X86_XCPT_BP)
1645 | RT_BIT(X86_XCPT_DB)
1646 | RT_BIT(X86_XCPT_DE)
1647 | RT_BIT(X86_XCPT_NM)
1648 | RT_BIT(X86_XCPT_UD)
1649 | RT_BIT(X86_XCPT_NP)
1650 | RT_BIT(X86_XCPT_SS)
1651 | RT_BIT(X86_XCPT_GP)
1652 | RT_BIT(X86_XCPT_MF)
1653#endif
1654 ;
1655
1656 /*
1657 * Without nested paging, #PF must be intercepted to implement shadow paging.
1658 */
1659 /** @todo NP state won't change so maybe we should build the initial trap mask up front? */
1660 if (!pVM->hm.s.fNestedPaging)
1661 u32TrapMask |= RT_BIT(X86_XCPT_PF);
1662
1663 /* Catch floating point exceptions if we need to report them to the guest in a different way. */
1664 if (!(pCtx->cr0 & X86_CR0_NE))
1665 u32TrapMask |= RT_BIT(X86_XCPT_MF);
1666
1667 /*
1668 * Intercept all exceptions in real mode as none of them can be injected directly (#GP otherwise).
1669 */
1670 /** @todo Despite the claim to intercept everything, with NP we do not intercept #PF. Should we? */
1671 if ( CPUMIsGuestInRealModeEx(pCtx)
1672 && pVM->hm.s.vmx.pRealModeTSS)
1673 {
1674 u32TrapMask |= RT_BIT(X86_XCPT_DE)
1675 | RT_BIT(X86_XCPT_DB)
1676 | RT_BIT(X86_XCPT_NMI)
1677 | RT_BIT(X86_XCPT_BP)
1678 | RT_BIT(X86_XCPT_OF)
1679 | RT_BIT(X86_XCPT_BR)
1680 | RT_BIT(X86_XCPT_UD)
1681 | RT_BIT(X86_XCPT_DF)
1682 | RT_BIT(X86_XCPT_CO_SEG_OVERRUN)
1683 | RT_BIT(X86_XCPT_TS)
1684 | RT_BIT(X86_XCPT_NP)
1685 | RT_BIT(X86_XCPT_SS)
1686 | RT_BIT(X86_XCPT_GP)
1687 | RT_BIT(X86_XCPT_MF)
1688 | RT_BIT(X86_XCPT_AC)
1689 | RT_BIT(X86_XCPT_MC)
1690 | RT_BIT(X86_XCPT_XF)
1691 ;
1692 }
1693
1694 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, u32TrapMask);
1695 AssertRC(rc);
1696}
1697
1698
1699/**
1700 * Loads a minimal guest state.
1701 *
1702 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1703 *
1704 * @param pVM Pointer to the VM.
1705 * @param pVCpu Pointer to the VMCPU.
1706 * @param pCtx Pointer to the guest CPU context.
1707 */
1708VMMR0DECL(void) VMXR0LoadMinimalGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1709{
1710 int rc;
1711 X86EFLAGS eflags;
1712
1713 Assert(!(pVCpu->hm.s.fContextUseFlags & HM_CHANGED_ALL_GUEST));
1714
1715 /*
1716 * Load EIP, ESP and EFLAGS.
1717 */
1718 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_RIP, pCtx->rip);
1719 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1720 AssertRC(rc);
1721
1722 /*
1723 * Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1.
1724 */
1725 eflags = pCtx->eflags;
1726 eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1727 eflags.u32 |= VMX_EFLAGS_RESERVED_1;
1728
1729 /*
1730 * Check if real mode emulation using v86 mode.
1731 */
1732 if ( CPUMIsGuestInRealModeEx(pCtx)
1733 && pVM->hm.s.vmx.pRealModeTSS)
1734 {
1735 pVCpu->hm.s.vmx.RealMode.eflags = eflags;
1736
1737 eflags.Bits.u1VM = 1;
1738 eflags.Bits.u2IOPL = 0; /* must always be 0 or else certain instructions won't cause faults. */
1739 }
1740 rc = VMXWriteVmcs(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1741 AssertRC(rc);
1742}
1743
1744
1745/**
1746 * Sets up TSC offsetting and VMX preemption, if supported/configured/available.
1747 *
1748 * NOTE: This function reads the host TSC value. Therefore it must be executed very
1749 * shortly before a VM entry and execution MUST NOT be rescheduled between a call to
1750 * this function and a VM entry without calling this function again.
1751 *
1752 * @returns VBox status code.
1753 * @param pVM Pointer to the VM.
1754 * @param pVCpu Pointer to the VMCPU.
1755 */
1756VMMR0DECL(int) VMXR0SetupTscOffsetAndPreemption(PVM pVM, PVMCPU pVCpu)
1757{
1758 int rc = VINF_SUCCESS;
1759 bool fOffsettedTsc;
1760
1761 if (pVM->hm.s.vmx.fUsePreemptTimer)
1762 {
1763 uint64_t cTicksToDeadline = TMCpuTickGetDeadlineAndTscOffset(pVCpu, &fOffsettedTsc, &pVCpu->hm.s.vmx.u64TSCOffset);
1764
1765 /* Make sure the returned values have sane upper and lower boundaries. */
1766 uint64_t u64CpuHz = SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage);
1767
1768 cTicksToDeadline = RT_MIN(cTicksToDeadline, u64CpuHz / 64); /* 1/64 of a second */
1769 cTicksToDeadline = RT_MAX(cTicksToDeadline, u64CpuHz / 2048); /* 1/2048th of a second */
1770
1771 cTicksToDeadline >>= pVM->hm.s.vmx.cPreemptTimerShift;
1772 uint32_t cPreemptionTickCount = (uint32_t)RT_MIN(cTicksToDeadline, UINT32_MAX - 16);
1773 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_PREEMPT_TIMER_VALUE, cPreemptionTickCount);
1774 AssertRC(rc);
1775 }
1776 else
1777 fOffsettedTsc = TMCpuTickCanUseRealTSC(pVCpu, &pVCpu->hm.s.vmx.u64TSCOffset);
1778
1779 if (fOffsettedTsc)
1780 {
1781 uint64_t u64CurTSC = ASMReadTSC();
1782 if (u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset > TMCpuTickGetLastSeen(pVCpu))
1783 {
1784 /* Note: VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT takes precedence over TSC_OFFSET, applies to RDTSCP too. */
1785 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, pVCpu->hm.s.vmx.u64TSCOffset);
1786 AssertRC(rc);
1787
1788 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT;
1789 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
1790 AssertRC(rc);
1791 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscOffset);
1792 }
1793 else
1794 {
1795 /* Fall back to rdtsc, rdtscp emulation as we would otherwise pass decreasing tsc values to the guest. */
1796 LogFlow(("TSC %RX64 offset %RX64 time=%RX64 last=%RX64 (diff=%RX64, virt_tsc=%RX64)\n", u64CurTSC,
1797 pVCpu->hm.s.vmx.u64TSCOffset, u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset,
1798 TMCpuTickGetLastSeen(pVCpu), TMCpuTickGetLastSeen(pVCpu) - u64CurTSC - pVCpu->hm.s.vmx.u64TSCOffset,
1799 TMCpuTickGet(pVCpu)));
1800 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT;
1801 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
1802 AssertRC(rc);
1803 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscInterceptOverFlow);
1804 }
1805 }
1806 else
1807 {
1808 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT;
1809 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
1810 AssertRC(rc);
1811 STAM_COUNTER_INC(&pVCpu->hm.s.StatTscIntercept);
1812 }
1813 return rc;
1814}
1815
1816/**
1817 * Loads the guest state.
1818 *
1819 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
1820 *
1821 * @returns VBox status code.
1822 * @param pVM Pointer to the VM.
1823 * @param pVCpu Pointer to the VMCPU.
1824 * @param pCtx Pointer to the guest CPU context.
1825 */
1826VMMR0DECL(int) VMXR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
1827{
1828 int rc = VINF_SUCCESS;
1829 RTGCUINTPTR val;
1830
1831 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
1832
1833 /*
1834 * VMX_VMCS_CTRL_ENTRY
1835 * Set required bits to one and zero according to the MSR capabilities.
1836 */
1837 val = pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0;
1838
1839 /*
1840 * Load guest debug controls (DR7 & IA32_DEBUGCTL_MSR).
1841 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1842 */
1843 val |= VMX_VMCS_CTRL_ENTRY_LOAD_DEBUG;
1844
1845 if (CPUMIsGuestInLongModeEx(pCtx))
1846 val |= VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST;
1847 /* else Must be zero when AMD64 is not available. */
1848
1849 /*
1850 * Mask away the bits that the CPU doesn't support.
1851 */
1852 val &= pVM->hm.s.vmx.msr.vmx_entry.n.allowed1;
1853 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY, val);
1854 AssertRC(rc);
1855
1856 /*
1857 * VMX_VMCS_CTRL_EXIT
1858 * Set required bits to one and zero according to the MSR capabilities.
1859 */
1860 val = pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0;
1861
1862 /*
1863 * Save debug controls (DR7 & IA32_DEBUGCTL_MSR)
1864 * Forced to 1 on the 'first' VT-x capable CPUs; this actually includes the newest Nehalem CPUs
1865 */
1866 val |= VMX_VMCS_CTRL_EXIT_SAVE_DEBUG;
1867
1868#if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1869 if (VMX_IS_64BIT_HOST_MODE())
1870 val |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE;
1871 /* else Must be zero when AMD64 is not available. */
1872#elif HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
1873 if (CPUMIsGuestInLongModeEx(pCtx))
1874 val |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE; /* our switcher goes to long mode */
1875 else
1876 Assert(!(val & VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE));
1877#endif
1878 val &= pVM->hm.s.vmx.msr.vmx_exit.n.allowed1;
1879
1880 /*
1881 * Don't acknowledge external interrupts on VM-exit.
1882 */
1883 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT, val);
1884 AssertRC(rc);
1885
1886 /*
1887 * Guest CPU context: ES, CS, SS, DS, FS, GS.
1888 */
1889 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_SEGMENT_REGS)
1890 {
1891 if (pVM->hm.s.vmx.pRealModeTSS)
1892 {
1893 PGMMODE enmGuestMode = PGMGetGuestMode(pVCpu);
1894 if (pVCpu->hm.s.vmx.enmLastSeenGuestMode != enmGuestMode)
1895 {
1896 /*
1897 * Correct weird requirements for switching to protected mode.
1898 */
1899 if ( pVCpu->hm.s.vmx.enmLastSeenGuestMode == PGMMODE_REAL
1900 && enmGuestMode >= PGMMODE_PROTECTED)
1901 {
1902#ifdef VBOX_WITH_REM
1903 /*
1904 * Flush the recompiler code cache as it's not unlikely the guest will rewrite code
1905 * it will later execute in real mode (OpenBSD 4.0 is one such example)
1906 */
1907 REMFlushTBs(pVM);
1908#endif
1909
1910 /*
1911 * DPL of all hidden selector registers must match the current CPL (0).
1912 */
1913 pCtx->cs.Attr.n.u2Dpl = 0;
1914 pCtx->cs.Attr.n.u4Type = X86_SEL_TYPE_CODE | X86_SEL_TYPE_RW_ACC;
1915
1916 pCtx->ds.Attr.n.u2Dpl = 0;
1917 pCtx->es.Attr.n.u2Dpl = 0;
1918 pCtx->fs.Attr.n.u2Dpl = 0;
1919 pCtx->gs.Attr.n.u2Dpl = 0;
1920 pCtx->ss.Attr.n.u2Dpl = 0;
1921 }
1922 pVCpu->hm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
1923 }
1924 }
1925
1926 VMX_WRITE_SELREG(ES, es);
1927 AssertRC(rc);
1928
1929 VMX_WRITE_SELREG(CS, cs);
1930 AssertRC(rc);
1931
1932 VMX_WRITE_SELREG(SS, ss);
1933 AssertRC(rc);
1934
1935 VMX_WRITE_SELREG(DS, ds);
1936 AssertRC(rc);
1937
1938 VMX_WRITE_SELREG(FS, fs);
1939 AssertRC(rc);
1940
1941 VMX_WRITE_SELREG(GS, gs);
1942 AssertRC(rc);
1943 }
1944
1945 /*
1946 * Guest CPU context: LDTR.
1947 */
1948 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_LDTR)
1949 {
1950 if (pCtx->ldtr.Sel == 0)
1951 {
1952 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, 0);
1953 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, 0);
1954 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, 0); /* @todo removing "64" in the function should be the same. */
1955 /* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
1956 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
1957 }
1958 else
1959 {
1960 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_LDTR, pCtx->ldtr.Sel);
1961 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_LIMIT, pCtx->ldtr.u32Limit);
1962 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtr.u64Base); /* @todo removing "64" and it should be the same */
1963 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtr.Attr.u);
1964 }
1965 AssertRC(rc);
1966 }
1967
1968 /*
1969 * Guest CPU context: TR.
1970 */
1971 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_TR)
1972 {
1973 /*
1974 * Real mode emulation using v86 mode with CR4.VME (interrupt redirection
1975 * using the int bitmap in the TSS).
1976 */
1977 if ( CPUMIsGuestInRealModeEx(pCtx)
1978 && pVM->hm.s.vmx.pRealModeTSS)
1979 {
1980 RTGCPHYS GCPhys;
1981
1982 /* We convert it here every time as PCI regions could be reconfigured. */
1983 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pRealModeTSS, &GCPhys);
1984 AssertRC(rc);
1985
1986 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, 0);
1987 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, HM_VTX_TSS_SIZE);
1988 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
1989
1990 X86DESCATTR attr;
1991
1992 attr.u = 0;
1993 attr.n.u1Present = 1;
1994 attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1995 val = attr.u;
1996 }
1997 else
1998 {
1999 rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_TR, pCtx->tr.Sel);
2000 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_LIMIT, pCtx->tr.u32Limit);
2001 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_TR_BASE, pCtx->tr.u64Base);
2002
2003 val = pCtx->tr.Attr.u;
2004
2005 /* The TSS selector must be busy (REM bugs? see defect #XXXX). */
2006 if (!(val & X86_SEL_TYPE_SYS_TSS_BUSY_MASK))
2007 {
2008 if (val & 0xf)
2009 val |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2010 else
2011 /* Default if no TR selector has been set (otherwise vmlaunch will fail!) */
2012 val = (val & ~0xF) | X86_SEL_TYPE_SYS_386_TSS_BUSY;
2013 }
2014 AssertMsg((val & 0xf) == X86_SEL_TYPE_SYS_386_TSS_BUSY || (val & 0xf) == X86_SEL_TYPE_SYS_286_TSS_BUSY,
2015 ("%#x\n", val));
2016 }
2017 rc |= VMXWriteVmcs(VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS, val);
2018 AssertRC(rc);
2019 }
2020
2021 /*
2022 * Guest CPU context: GDTR.
2023 */
2024 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_GDTR)
2025 {
2026 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
2027 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
2028 AssertRC(rc);
2029 }
2030
2031 /*
2032 * Guest CPU context: IDTR.
2033 */
2034 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_IDTR)
2035 {
2036 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
2037 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
2038 AssertRC(rc);
2039 }
2040
2041 /*
2042 * Sysenter MSRs.
2043 */
2044 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2045 {
2046 rc = VMXWriteVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
2047 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
2048 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
2049 AssertRC(rc);
2050 }
2051
2052 /*
2053 * Guest CPU context: Control registers.
2054 */
2055 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR0)
2056 {
2057 val = pCtx->cr0;
2058 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
2059 Log2(("Guest CR0-shadow %08x\n", val));
2060 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2061 {
2062 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
2063 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
2064 }
2065 else
2066 {
2067 /** @todo check if we support the old style mess correctly. */
2068 if (!(val & X86_CR0_NE))
2069 Log(("Forcing X86_CR0_NE!!!\n"));
2070
2071 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
2072 }
2073 /* Protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
2074 if (!pVM->hm.s.vmx.fUnrestrictedGuest)
2075 val |= X86_CR0_PE | X86_CR0_PG;
2076
2077 if (pVM->hm.s.fNestedPaging)
2078 {
2079 if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
2080 {
2081 /* Disable CR3 read/write monitoring as we don't need it for EPT. */
2082 pVCpu->hm.s.vmx.u32ProcCtls &= ~( VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
2083 | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT);
2084 }
2085 else
2086 {
2087 /* Reenable CR3 read/write monitoring as our identity mapped page table is active. */
2088 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
2089 | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
2090 }
2091 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
2092 AssertRC(rc);
2093 }
2094 else
2095 {
2096 /* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
2097 val |= X86_CR0_WP;
2098 }
2099
2100 /* Always enable caching. */
2101 val &= ~(X86_CR0_CD|X86_CR0_NW);
2102
2103 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR0, val);
2104 Log2(("Guest CR0 %08x\n", val));
2105
2106 /*
2107 * CR0 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2108 */
2109 val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
2110 | X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
2111 | X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
2112 | X86_CR0_CD /* Bit not restored during VM-exit! */
2113 | X86_CR0_NW /* Bit not restored during VM-exit! */
2114 | X86_CR0_NE;
2115
2116 /*
2117 * When the guest's FPU state is active, then we no longer care about the FPU related bits.
2118 */
2119 if (CPUMIsGuestFPUStateActive(pVCpu) == false)
2120 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_MP;
2121
2122 pVCpu->hm.s.vmx.u32CR0Mask = val;
2123
2124 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR0_MASK, val);
2125 Log2(("Guest CR0-mask %08x\n", val));
2126 AssertRC(rc);
2127 }
2128
2129 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR4)
2130 {
2131 rc = VMXWriteVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
2132 Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
2133 /* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
2134 val = pCtx->cr4 | (uint32_t)pVM->hm.s.vmx.msr.vmx_cr4_fixed0;
2135
2136 if (!pVM->hm.s.fNestedPaging)
2137 {
2138 switch (pVCpu->hm.s.enmShadowMode)
2139 {
2140 case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
2141 case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
2142 case PGMMODE_32_BIT: /* 32-bit paging. */
2143 val &= ~X86_CR4_PAE;
2144 break;
2145
2146 case PGMMODE_PAE: /* PAE paging. */
2147 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
2148 /** Must use PAE paging as we could use physical memory > 4 GB */
2149 val |= X86_CR4_PAE;
2150 break;
2151
2152 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
2153 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
2154#ifdef VBOX_ENABLE_64_BITS_GUESTS
2155 break;
2156#else
2157 AssertFailed();
2158 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2159#endif
2160 default: /* shut up gcc */
2161 AssertFailed();
2162 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2163 }
2164 }
2165 else if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2166 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2167 {
2168 /* We use 4 MB pages in our identity mapping page table for real and protected mode without paging. */
2169 val |= X86_CR4_PSE;
2170 /* Our identity mapping is a 32 bits page directory. */
2171 val &= ~X86_CR4_PAE;
2172 }
2173
2174 /*
2175 * Turn off VME if we're in emulated real mode.
2176 */
2177 if ( CPUMIsGuestInRealModeEx(pCtx)
2178 && pVM->hm.s.vmx.pRealModeTSS)
2179 {
2180 val &= ~X86_CR4_VME;
2181 }
2182
2183 rc |= VMXWriteVmcs64(VMX_VMCS_GUEST_CR4, val);
2184 Log2(("Guest CR4 %08x\n", val));
2185
2186 /*
2187 * CR4 flags owned by the host; if the guests attempts to change them, then the VM will exit.
2188 */
2189 val = 0
2190 | X86_CR4_VME
2191 | X86_CR4_PAE
2192 | X86_CR4_PGE
2193 | X86_CR4_PSE
2194 | X86_CR4_VMXE;
2195 pVCpu->hm.s.vmx.u32CR4Mask = val;
2196
2197 rc |= VMXWriteVmcs(VMX_VMCS_CTRL_CR4_MASK, val);
2198 Log2(("Guest CR4-mask %08x\n", val));
2199 AssertRC(rc);
2200 }
2201
2202#if 0
2203 /* Enable single stepping if requested and CPU supports it. */
2204 if (pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG)
2205 if (DBGFIsStepping(pVCpu))
2206 {
2207 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG;
2208 rc = VMXWriteVmcs(VMX_VMCS_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
2209 AssertRC(rc);
2210 }
2211#endif
2212
2213 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_CR3)
2214 {
2215 if (pVM->hm.s.fNestedPaging)
2216 {
2217 Assert(PGMGetHyperCR3(pVCpu));
2218 pVCpu->hm.s.vmx.HCPhysEPTP = PGMGetHyperCR3(pVCpu);
2219
2220 Assert(!(pVCpu->hm.s.vmx.HCPhysEPTP & 0xfff));
2221 /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
2222 pVCpu->hm.s.vmx.HCPhysEPTP |= VMX_EPT_MEMTYPE_WB
2223 | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
2224
2225 rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
2226 AssertRC(rc);
2227
2228 if ( !CPUMIsGuestInPagedProtectedModeEx(pCtx)
2229 && !pVM->hm.s.vmx.fUnrestrictedGuest)
2230 {
2231 RTGCPHYS GCPhys;
2232
2233 /* We convert it here every time as PCI regions could be reconfigured. */
2234 rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
2235 AssertMsgRC(rc, ("pNonPagingModeEPTPageTable = %RGv\n", pVM->hm.s.vmx.pNonPagingModeEPTPageTable));
2236
2237 /*
2238 * We use our identity mapping page table here as we need to map guest virtual to
2239 * guest physical addresses; EPT will take care of the translation to host physical addresses.
2240 */
2241 val = GCPhys;
2242 }
2243 else
2244 {
2245 /* Save the real guest CR3 in VMX_VMCS_GUEST_CR3 */
2246 val = pCtx->cr3;
2247 rc = hmR0VmxLoadPaePdpes(pVCpu, pCtx);
2248 AssertRCReturn(rc, rc);
2249 }
2250 }
2251 else
2252 {
2253 val = PGMGetHyperCR3(pVCpu);
2254 Assert(val || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
2255 }
2256
2257 /* Save our shadow CR3 register. */
2258 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_CR3, val);
2259 AssertRC(rc);
2260 }
2261
2262 /*
2263 * Guest CPU context: Debug registers.
2264 */
2265 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_DEBUG)
2266 {
2267 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
2268 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
2269
2270 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2271 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2272 pCtx->dr[7] |= 0x400; /* must be one */
2273
2274 /* Resync DR7 */
2275 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2276 AssertRC(rc);
2277
2278#ifdef DEBUG
2279 /* Sync the hypervisor debug state now if any breakpoint is armed. */
2280 if ( CPUMGetHyperDR7(pVCpu) & (X86_DR7_ENABLED_MASK|X86_DR7_GD)
2281 && !CPUMIsHyperDebugStateActive(pVCpu)
2282 && !DBGFIsStepping(pVCpu))
2283 {
2284 /* Save the host and load the hypervisor debug state. */
2285 rc = CPUMR0LoadHyperDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2286 AssertRC(rc);
2287
2288 /* DRx intercepts remain enabled. */
2289
2290 /* Override dr7 with the hypervisor value. */
2291 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, CPUMGetHyperDR7(pVCpu));
2292 AssertRC(rc);
2293 }
2294 else
2295#endif
2296 /* Sync the debug state now if any breakpoint is armed. */
2297 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
2298 && !CPUMIsGuestDebugStateActive(pVCpu)
2299 && !DBGFIsStepping(pVCpu))
2300 {
2301 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxArmed);
2302
2303 /* Disable DRx move intercepts. */
2304 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
2305 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
2306 AssertRC(rc);
2307
2308 /* Save the host and load the guest debug state. */
2309 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
2310 AssertRC(rc);
2311 }
2312
2313 /* IA32_DEBUGCTL MSR. */
2314 rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);
2315 AssertRC(rc);
2316
2317 /** @todo do we really ever need this? */
2318 rc |= VMXWriteVmcs(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, 0);
2319 AssertRC(rc);
2320 }
2321
2322 /*
2323 * 64-bit guest mode.
2324 */
2325 if (CPUMIsGuestInLongModeEx(pCtx))
2326 {
2327#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
2328 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2329#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2330 pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
2331#else
2332# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
2333 if (!pVM->hm.s.fAllow64BitGuests)
2334 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
2335# endif
2336 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM64;
2337#endif
2338 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_GUEST_MSR)
2339 {
2340 /* Update these as wrmsr might have changed them. */
2341 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_FS_BASE, pCtx->fs.u64Base);
2342 AssertRC(rc);
2343 rc = VMXWriteVmcs64(VMX_VMCS_GUEST_GS_BASE, pCtx->gs.u64Base);
2344 AssertRC(rc);
2345 }
2346 }
2347 else
2348 {
2349 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
2350 }
2351
2352 hmR0VmxUpdateExceptionBitmap(pVM, pVCpu, pCtx);
2353
2354#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2355 /*
2356 * Store all guest MSRs in the VM-entry load area, so they will be loaded
2357 * during VM-entry and restored into the VM-exit store area during VM-exit.
2358 */
2359 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2360 unsigned idxMsr = 0;
2361
2362 uint32_t u32GstExtFeatures;
2363 uint32_t u32Temp;
2364 CPUMGetGuestCpuId(pVCpu, 0x80000001, &u32Temp, &u32Temp, &u32Temp, &u32GstExtFeatures);
2365
2366 if (u32GstExtFeatures & (X86_CPUID_EXT_FEATURE_EDX_NX | X86_CPUID_EXT_FEATURE_EDX_LONG_MODE))
2367 {
2368 pMsr->u32IndexMSR = MSR_K6_EFER;
2369 pMsr->u32Reserved = 0;
2370 pMsr->u64Value = pCtx->msrEFER;
2371 /* VT-x will complain if only MSR_K6_EFER_LME is set. */
2372 if (!CPUMIsGuestInLongModeEx(pCtx))
2373 pMsr->u64Value &= ~(MSR_K6_EFER_LMA | MSR_K6_EFER_LME);
2374 pMsr++; idxMsr++;
2375
2376 if (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_LONG_MODE)
2377 {
2378 pMsr->u32IndexMSR = MSR_K8_LSTAR;
2379 pMsr->u32Reserved = 0;
2380 pMsr->u64Value = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
2381 pMsr++; idxMsr++;
2382 pMsr->u32IndexMSR = MSR_K6_STAR;
2383 pMsr->u32Reserved = 0;
2384 pMsr->u64Value = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
2385 pMsr++; idxMsr++;
2386 pMsr->u32IndexMSR = MSR_K8_SF_MASK;
2387 pMsr->u32Reserved = 0;
2388 pMsr->u64Value = pCtx->msrSFMASK; /* syscall flag mask */
2389 pMsr++; idxMsr++;
2390#if 0
2391 /* The KERNEL_GS_BASE MSR does not work reliably with auto load/store. See @bugref{6208} */
2392 pMsr->u32IndexMSR = MSR_K8_KERNEL_GS_BASE;
2393 pMsr->u32Reserved = 0;
2394 pMsr->u64Value = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
2395 pMsr++; idxMsr++;
2396#endif
2397 }
2398 }
2399
2400 if ( pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP
2401 && (u32GstExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP))
2402 {
2403 pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
2404 pMsr->u32Reserved = 0;
2405 rc = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pMsr->u64Value);
2406 AssertRC(rc);
2407 pMsr++; idxMsr++;
2408 }
2409
2410 pVCpu->hm.s.vmx.cGuestMsrs = idxMsr;
2411
2412 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT, idxMsr);
2413 AssertRC(rc);
2414
2415 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT, idxMsr);
2416 AssertRC(rc);
2417#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2418
2419 /* Done with the major changes */
2420 pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_ALL_GUEST;
2421
2422 /* Minimal guest state update (ESP, EIP, EFLAGS mostly) */
2423 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
2424
2425 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
2426 return rc;
2427}
2428
2429
2430/**
2431 * Syncs back the guest state from VMCS.
2432 *
2433 * @returns VBox status code.
2434 * @param pVM Pointer to the VM.
2435 * @param pVCpu Pointer to the VMCPU.
2436 * @param pCtx Pointer to the guest CPU context.
2437 */
2438DECLINLINE(int) VMXR0SaveGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2439{
2440 RTGCUINTREG val, valShadow;
2441 RTGCUINTPTR uInterruptState;
2442 int rc;
2443
2444 /* First sync back EIP, ESP, and EFLAGS. */
2445 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RIP, &val);
2446 AssertRC(rc);
2447 pCtx->rip = val;
2448 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RSP, &val);
2449 AssertRC(rc);
2450 pCtx->rsp = val;
2451 rc = VMXReadCachedVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
2452 AssertRC(rc);
2453 pCtx->eflags.u32 = val;
2454
2455 /* Take care of instruction fusing (sti, mov ss) */
2456 rc |= VMXReadCachedVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &val);
2457 uInterruptState = val;
2458 if (uInterruptState != 0)
2459 {
2460 Assert(uInterruptState <= 2); /* only sti & mov ss */
2461 Log(("uInterruptState %x eip=%RGv\n", (uint32_t)uInterruptState, pCtx->rip));
2462 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
2463 }
2464 else
2465 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
2466
2467 /* Control registers. */
2468 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
2469 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR0, &val);
2470 val = (valShadow & pVCpu->hm.s.vmx.u32CR0Mask) | (val & ~pVCpu->hm.s.vmx.u32CR0Mask);
2471 CPUMSetGuestCR0(pVCpu, val);
2472
2473 VMXReadCachedVmcs(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
2474 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR4, &val);
2475 val = (valShadow & pVCpu->hm.s.vmx.u32CR4Mask) | (val & ~pVCpu->hm.s.vmx.u32CR4Mask);
2476 CPUMSetGuestCR4(pVCpu, val);
2477
2478 /*
2479 * No reason to sync back the CRx registers. They can't be changed by the guest unless in
2480 * the nested paging case where CR3 & CR4 can be changed by the guest.
2481 */
2482 if ( pVM->hm.s.fNestedPaging
2483 && CPUMIsGuestInPagedProtectedModeEx(pCtx)) /** @todo check if we will always catch mode switches and such... */
2484 {
2485 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
2486
2487 /* Can be updated behind our back in the nested paging case. */
2488 CPUMSetGuestCR2(pVCpu, pCache->cr2);
2489
2490 VMXReadCachedVmcs(VMX_VMCS_GUEST_CR3, &val);
2491
2492 if (val != pCtx->cr3)
2493 {
2494 CPUMSetGuestCR3(pVCpu, val);
2495 PGMUpdateCR3(pVCpu, val);
2496 }
2497 rc = hmR0VmxSavePaePdpes(pVCpu, pCtx);
2498 AssertRCReturn(rc, rc);
2499 }
2500
2501 /* Sync back DR7. */
2502 VMXReadCachedVmcs(VMX_VMCS_GUEST_DR7, &val);
2503 pCtx->dr[7] = val;
2504
2505 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
2506 VMX_READ_SELREG(ES, es);
2507 VMX_READ_SELREG(SS, ss);
2508 VMX_READ_SELREG(CS, cs);
2509 VMX_READ_SELREG(DS, ds);
2510 VMX_READ_SELREG(FS, fs);
2511 VMX_READ_SELREG(GS, gs);
2512
2513 /* System MSRs */
2514 VMXReadCachedVmcs(VMX_VMCS32_GUEST_SYSENTER_CS, &val);
2515 pCtx->SysEnter.cs = val;
2516 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
2517 pCtx->SysEnter.eip = val;
2518 VMXReadCachedVmcs(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
2519 pCtx->SysEnter.esp = val;
2520
2521 /* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
2522 VMX_READ_SELREG(LDTR, ldtr);
2523
2524 VMXReadCachedVmcs(VMX_VMCS32_GUEST_GDTR_LIMIT, &val);
2525 pCtx->gdtr.cbGdt = val;
2526 VMXReadCachedVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val);
2527 pCtx->gdtr.pGdt = val;
2528
2529 VMXReadCachedVmcs(VMX_VMCS32_GUEST_IDTR_LIMIT, &val);
2530 pCtx->idtr.cbIdt = val;
2531 VMXReadCachedVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val);
2532 pCtx->idtr.pIdt = val;
2533
2534 /* Real mode emulation using v86 mode. */
2535 if ( CPUMIsGuestInRealModeEx(pCtx)
2536 && pVM->hm.s.vmx.pRealModeTSS)
2537 {
2538 /* Hide our emulation flags */
2539 pCtx->eflags.Bits.u1VM = 0;
2540
2541 /* Restore original IOPL setting as we always use 0. */
2542 pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.eflags.Bits.u2IOPL;
2543
2544 /* Force a TR resync every time in case we switch modes. */
2545 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_TR;
2546 }
2547 else
2548 {
2549 /* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
2550 VMX_READ_SELREG(TR, tr);
2551 }
2552
2553#ifdef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
2554 /*
2555 * Save the possibly changed MSRs that we automatically restore and save during a world switch.
2556 */
2557 for (unsigned i = 0; i < pVCpu->hm.s.vmx.cGuestMsrs; i++)
2558 {
2559 PVMXMSR pMsr = (PVMXMSR)pVCpu->hm.s.vmx.pvGuestMsr;
2560 pMsr += i;
2561
2562 switch (pMsr->u32IndexMSR)
2563 {
2564 case MSR_K8_LSTAR:
2565 pCtx->msrLSTAR = pMsr->u64Value;
2566 break;
2567 case MSR_K6_STAR:
2568 pCtx->msrSTAR = pMsr->u64Value;
2569 break;
2570 case MSR_K8_SF_MASK:
2571 pCtx->msrSFMASK = pMsr->u64Value;
2572 break;
2573#if 0
2574 /* The KERNEL_GS_BASE MSR does not work reliably with auto load/store. See @bugref{6208} */
2575 case MSR_K8_KERNEL_GS_BASE:
2576 pCtx->msrKERNELGSBASE = pMsr->u64Value;
2577 break;
2578#endif
2579 case MSR_K8_TSC_AUX:
2580 CPUMSetGuestMsr(pVCpu, MSR_K8_TSC_AUX, pMsr->u64Value);
2581 break;
2582
2583 case MSR_K6_EFER:
2584 /* EFER can't be changed without causing a VM-exit. */
2585 /* Assert(pCtx->msrEFER == pMsr->u64Value); */
2586 break;
2587
2588 default:
2589 AssertFailed();
2590 return VERR_HM_UNEXPECTED_LD_ST_MSR;
2591 }
2592 }
2593#endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
2594 return VINF_SUCCESS;
2595}
2596
2597
2598/**
2599 * Dummy placeholder for TLB flush handling before VM-entry. Used in the case
2600 * where neither EPT nor VPID is supported by the CPU.
2601 *
2602 * @param pVM Pointer to the VM.
2603 * @param pVCpu Pointer to the VMCPU.
2604 */
2605static DECLCALLBACK(void) hmR0VmxSetupTLBDummy(PVM pVM, PVMCPU pVCpu)
2606{
2607 NOREF(pVM);
2608 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH);
2609 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2610 pVCpu->hm.s.TlbShootdown.cPages = 0;
2611}
2612
2613
2614/**
2615 * Setup the tagged TLB for EPT+VPID.
2616 *
2617 * @param pVM Pointer to the VM.
2618 * @param pVCpu Pointer to the VMCPU.
2619 */
2620static DECLCALLBACK(void) hmR0VmxSetupTLBBoth(PVM pVM, PVMCPU pVCpu)
2621{
2622 PHMGLOBLCPUINFO pCpu;
2623
2624 Assert(pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid);
2625
2626 pCpu = HMR0GetCurrentCpu();
2627
2628 /*
2629 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2630 * This can happen both for start & resume due to long jumps back to ring-3.
2631 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2632 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2633 */
2634 bool fNewAsid = false;
2635 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2636 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2637 {
2638 pVCpu->hm.s.fForceTLBFlush = true;
2639 fNewAsid = true;
2640 }
2641
2642 /*
2643 * Check for explicit TLB shootdowns.
2644 */
2645 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2646 pVCpu->hm.s.fForceTLBFlush = true;
2647
2648 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2649
2650 if (pVCpu->hm.s.fForceTLBFlush)
2651 {
2652 if (fNewAsid)
2653 {
2654 ++pCpu->uCurrentAsid;
2655 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2656 {
2657 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2658 pCpu->cTlbFlushes++;
2659 pCpu->fFlushAsidBeforeUse = true;
2660 }
2661
2662 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2663 if (pCpu->fFlushAsidBeforeUse)
2664 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2665 }
2666 else
2667 {
2668 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT)
2669 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_SINGLE_CONTEXT, 0 /* GCPtr */);
2670 else
2671 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2672 }
2673
2674 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2675 pVCpu->hm.s.fForceTLBFlush = false;
2676 }
2677 else
2678 {
2679 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2680 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2681 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2682 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2683
2684 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2685 * not be executed. See hmQueueInvlPage() where it is commented
2686 * out. Support individual entry flushing someday. */
2687 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2688 {
2689 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2690
2691 /*
2692 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2693 * as supported by the CPU.
2694 */
2695 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2696 {
2697 for (uint32_t i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2698 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2699 }
2700 else
2701 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2702 }
2703 else
2704 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2705 }
2706
2707 pVCpu->hm.s.TlbShootdown.cPages = 0;
2708 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2709
2710 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2711 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2712 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2713 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2714 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2715 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2716
2717 /* Update VMCS with the VPID. */
2718 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2719 AssertRC(rc);
2720}
2721
2722
2723/**
2724 * Setup the tagged TLB for EPT only.
2725 *
2726 * @returns VBox status code.
2727 * @param pVM Pointer to the VM.
2728 * @param pVCpu Pointer to the VMCPU.
2729 */
2730static DECLCALLBACK(void) hmR0VmxSetupTLBEPT(PVM pVM, PVMCPU pVCpu)
2731{
2732 PHMGLOBLCPUINFO pCpu;
2733
2734 Assert(pVM->hm.s.fNestedPaging);
2735 Assert(!pVM->hm.s.vmx.fVpid);
2736
2737 pCpu = HMR0GetCurrentCpu();
2738
2739 /*
2740 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2741 * This can happen both for start & resume due to long jumps back to ring-3.
2742 * A change in the TLB flush count implies the host Cpu is online after a suspend/resume.
2743 */
2744 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2745 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2746 {
2747 pVCpu->hm.s.fForceTLBFlush = true;
2748 }
2749
2750 /*
2751 * Check for explicit TLB shootdown flushes.
2752 */
2753 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2754 pVCpu->hm.s.fForceTLBFlush = true;
2755
2756 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2757 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2758
2759 if (pVCpu->hm.s.fForceTLBFlush)
2760 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2761 else
2762 {
2763 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2764 * not be executed. See hmQueueInvlPage() where it is commented
2765 * out. Support individual entry flushing someday. */
2766 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2767 {
2768 /*
2769 * We cannot flush individual entries without VPID support. Flush using EPT.
2770 */
2771 STAM_COUNTER_INC(&pVCpu->hm.s.StatTlbShootdown);
2772 hmR0VmxFlushEPT(pVM, pVCpu, pVM->hm.s.vmx.enmFlushEpt);
2773 }
2774 }
2775 pVCpu->hm.s.TlbShootdown.cPages = 0;
2776 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2777
2778#ifdef VBOX_WITH_STATISTICS
2779 /** @todo r=ramshankar: this is not accurate anymore with the VPID+EPT
2780 * handling. Should be fixed later. */
2781 if (pVCpu->hm.s.fForceTLBFlush)
2782 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2783 else
2784 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2785#endif
2786}
2787
2788
2789/**
2790 * Setup the tagged TLB for VPID.
2791 *
2792 * @returns VBox status code.
2793 * @param pVM Pointer to the VM.
2794 * @param pVCpu Pointer to the VMCPU.
2795 */
2796static DECLCALLBACK(void) hmR0VmxSetupTLBVPID(PVM pVM, PVMCPU pVCpu)
2797{
2798 PHMGLOBLCPUINFO pCpu;
2799
2800 Assert(pVM->hm.s.vmx.fVpid);
2801 Assert(!pVM->hm.s.fNestedPaging);
2802
2803 pCpu = HMR0GetCurrentCpu();
2804
2805 /*
2806 * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last
2807 * This can happen both for start & resume due to long jumps back to ring-3.
2808 * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
2809 * or the host Cpu is online after a suspend/resume, so we cannot reuse the current ASID anymore.
2810 */
2811 if ( pVCpu->hm.s.idLastCpu != pCpu->idCpu
2812 || pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
2813 {
2814 /* Force a TLB flush on VM entry. */
2815 pVCpu->hm.s.fForceTLBFlush = true;
2816 }
2817
2818 /*
2819 * Check for explicit TLB shootdown flushes.
2820 */
2821 if (VMCPU_FF_TEST_AND_CLEAR(pVCpu, VMCPU_FF_TLB_FLUSH))
2822 pVCpu->hm.s.fForceTLBFlush = true;
2823
2824 pVCpu->hm.s.idLastCpu = pCpu->idCpu;
2825
2826 if (pVCpu->hm.s.fForceTLBFlush)
2827 {
2828 ++pCpu->uCurrentAsid;
2829 if (pCpu->uCurrentAsid >= pVM->hm.s.uMaxAsid)
2830 {
2831 pCpu->uCurrentAsid = 1; /* start at 1; host uses 0 */
2832 pCpu->cTlbFlushes++;
2833 pCpu->fFlushAsidBeforeUse = true;
2834 }
2835
2836 pVCpu->hm.s.fForceTLBFlush = false;
2837 pVCpu->hm.s.cTlbFlushes = pCpu->cTlbFlushes;
2838 pVCpu->hm.s.uCurrentAsid = pCpu->uCurrentAsid;
2839 if (pCpu->fFlushAsidBeforeUse)
2840 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2841 }
2842 else
2843 {
2844 AssertMsg(pVCpu->hm.s.uCurrentAsid && pCpu->uCurrentAsid,
2845 ("hm->uCurrentAsid=%lu hm->cTlbFlushes=%lu cpu->uCurrentAsid=%lu cpu->cTlbFlushes=%lu\n",
2846 pVCpu->hm.s.uCurrentAsid, pVCpu->hm.s.cTlbFlushes,
2847 pCpu->uCurrentAsid, pCpu->cTlbFlushes));
2848
2849 /** @todo We never set VMCPU_FF_TLB_SHOOTDOWN anywhere so this path should
2850 * not be executed. See hmQueueInvlPage() where it is commented
2851 * out. Support individual entry flushing someday. */
2852 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
2853 {
2854 /*
2855 * Flush individual guest entries using VPID from the TLB or as little as possible with EPT
2856 * as supported by the CPU.
2857 */
2858 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
2859 {
2860 for (uint32_t i = 0; i < pVCpu->hm.s.TlbShootdown.cPages; i++)
2861 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, pVCpu->hm.s.TlbShootdown.aPages[i]);
2862 }
2863 else
2864 hmR0VmxFlushVPID(pVM, pVCpu, pVM->hm.s.vmx.enmFlushVpid, 0 /* GCPtr */);
2865 }
2866 }
2867 pVCpu->hm.s.TlbShootdown.cPages = 0;
2868 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
2869
2870 AssertMsg(pVCpu->hm.s.cTlbFlushes == pCpu->cTlbFlushes,
2871 ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hm.s.cTlbFlushes, pCpu->cTlbFlushes));
2872 AssertMsg(pCpu->uCurrentAsid >= 1 && pCpu->uCurrentAsid < pVM->hm.s.uMaxAsid,
2873 ("cpu%d uCurrentAsid = %x\n", pCpu->idCpu, pCpu->uCurrentAsid));
2874 AssertMsg(pVCpu->hm.s.uCurrentAsid >= 1 && pVCpu->hm.s.uCurrentAsid < pVM->hm.s.uMaxAsid,
2875 ("cpu%d VM uCurrentAsid = %x\n", pCpu->idCpu, pVCpu->hm.s.uCurrentAsid));
2876
2877 int rc = VMXWriteVmcs(VMX_VMCS16_GUEST_FIELD_VPID, pVCpu->hm.s.uCurrentAsid);
2878 AssertRC(rc);
2879
2880# ifdef VBOX_WITH_STATISTICS
2881 /** @todo r=ramshankar: this is not accurate anymore with EPT+VPID handling.
2882 * Should be fixed later. */
2883 if (pVCpu->hm.s.fForceTLBFlush)
2884 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushTlbWorldSwitch);
2885 else
2886 STAM_COUNTER_INC(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch);
2887# endif
2888}
2889
2890
2891/**
2892 * Runs guest code in a VT-x VM.
2893 *
2894 * @returns VBox status code.
2895 * @param pVM Pointer to the VM.
2896 * @param pVCpu Pointer to the VMCPU.
2897 * @param pCtx Pointer to the guest CPU context.
2898 */
2899VMMR0DECL(int) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2900{
2901 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
2902 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
2903 STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
2904
2905 VBOXSTRICTRC rc = VINF_SUCCESS;
2906 int rc2;
2907 RTGCUINTREG val;
2908 RTGCUINTREG exitReason = (RTGCUINTREG)VMX_EXIT_INVALID;
2909 RTGCUINTREG instrError, cbInstr;
2910 RTGCUINTPTR exitQualification = 0;
2911 RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
2912 RTGCUINTPTR errCode, instrInfo;
2913 bool fSetupTPRCaching = false;
2914 bool fNeedTscSetup = true;
2915 uint64_t u64OldLSTAR = 0;
2916 uint8_t u8LastTPR = 0;
2917 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
2918 unsigned cResume = 0;
2919#ifdef VBOX_STRICT
2920 RTCPUID idCpuCheck;
2921 bool fWasInLongMode = false;
2922#endif
2923#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
2924 uint64_t u64LastTime = RTTimeMilliTS();
2925#endif
2926
2927 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2928 || (pVCpu->hm.s.vmx.pbVirtApic && pVM->hm.s.vmx.pbApicAccess));
2929
2930 /*
2931 * Check if we need to use TPR shadowing.
2932 */
2933 if ( CPUMIsGuestInLongModeEx(pCtx)
2934 || ( (( pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
2935 || pVM->hm.s.fTRPPatchingAllowed)
2936 && pVM->hm.s.fHasIoApic)
2937 )
2938 {
2939 fSetupTPRCaching = true;
2940 }
2941
2942 Log2(("\n"));
2943
2944 /* This is not ideal, but if we don't clear the event injection in the VMCS right here,
2945 * we may end up injecting some stale event into a VM, including injecting an event that
2946 * originated before a VM reset *after* the VM has been reset. See @bugref{6220}.
2947 */
2948 VMXWriteVmcs(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, 0);
2949
2950#ifdef VBOX_STRICT
2951 {
2952 RTCCUINTREG val2;
2953
2954 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC, &val2);
2955 AssertRC(rc2);
2956 Log2(("VMX_VMCS_CTRL_PIN_EXEC = %08x\n", val2));
2957
2958 /* allowed zero */
2959 if ((val2 & pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
2960 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC: zero\n"));
2961
2962 /* allowed one */
2963 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
2964 Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC: one\n"));
2965
2966 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC, &val2);
2967 AssertRC(rc2);
2968 Log2(("VMX_VMCS_CTRL_PROC_EXEC = %08x\n", val2));
2969
2970 /*
2971 * Must be set according to the MSR, but can be cleared if nested paging is used.
2972 */
2973 if (pVM->hm.s.fNestedPaging)
2974 {
2975 val2 |= VMX_VMCS_CTRL_PROC_EXEC_INVLPG_EXIT
2976 | VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
2977 | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
2978 }
2979
2980 /* allowed zero */
2981 if ((val2 & pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
2982 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC: zero\n"));
2983
2984 /* allowed one */
2985 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
2986 Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC: one\n"));
2987
2988 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY, &val2);
2989 AssertRC(rc2);
2990 Log2(("VMX_VMCS_CTRL_ENTRY = %08x\n", val2));
2991
2992 /* allowed zero */
2993 if ((val2 & pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_entry.n.disallowed0)
2994 Log(("Invalid VMX_VMCS_CTRL_ENTRY: zero\n"));
2995
2996 /* allowed one */
2997 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
2998 Log(("Invalid VMX_VMCS_CTRL_ENTRY: one\n"));
2999
3000 rc2 = VMXReadVmcs(VMX_VMCS32_CTRL_EXIT, &val2);
3001 AssertRC(rc2);
3002 Log2(("VMX_VMCS_CTRL_EXIT = %08x\n", val2));
3003
3004 /* allowed zero */
3005 if ((val2 & pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hm.s.vmx.msr.vmx_exit.n.disallowed0)
3006 Log(("Invalid VMX_VMCS_CTRL_EXIT: zero\n"));
3007
3008 /* allowed one */
3009 if ((val2 & ~pVM->hm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
3010 Log(("Invalid VMX_VMCS_CTRL_EXIT: one\n"));
3011 }
3012 fWasInLongMode = CPUMIsGuestInLongModeEx(pCtx);
3013#endif /* VBOX_STRICT */
3014
3015#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3016 pVCpu->hm.s.vmx.VMCSCache.u64TimeEntry = RTTimeNanoTS();
3017#endif
3018
3019 /*
3020 * We can jump to this point to resume execution after determining that a VM-exit is innocent.
3021 */
3022ResumeExecution:
3023 if (!STAM_REL_PROFILE_ADV_IS_RUNNING(&pVCpu->hm.s.StatEntry))
3024 STAM_REL_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit2, &pVCpu->hm.s.StatEntry, x);
3025 AssertMsg(pVCpu->hm.s.idEnteredCpu == RTMpCpuId(),
3026 ("Expected %d, I'm %d; cResume=%d exitReason=%RGv exitQualification=%RGv\n",
3027 (int)pVCpu->hm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
3028 Assert(!HMR0SuspendPending());
3029 /* Not allowed to switch modes without reloading the host state (32->64 switcher)!! */
3030 Assert(fWasInLongMode == CPUMIsGuestInLongModeEx(pCtx));
3031
3032 /*
3033 * Safety precaution; looping for too long here can have a very bad effect on the host.
3034 */
3035 if (RT_UNLIKELY(++cResume > pVM->hm.s.cMaxResumeLoops))
3036 {
3037 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMaxResume);
3038 rc = VINF_EM_RAW_INTERRUPT;
3039 goto end;
3040 }
3041
3042 /*
3043 * Check for IRQ inhibition due to instruction fusing (sti, mov ss).
3044 */
3045 if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
3046 {
3047 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
3048 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
3049 {
3050 /*
3051 * Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
3052 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
3053 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
3054 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
3055 */
3056 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
3057 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3058 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3059 AssertRC(rc2);
3060 }
3061 }
3062 else
3063 {
3064 /* Irq inhibition is no longer active; clear the corresponding VMX state. */
3065 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, 0);
3066 AssertRC(rc2);
3067 }
3068
3069#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
3070 if (RT_UNLIKELY((cResume & 0xf) == 0))
3071 {
3072 uint64_t u64CurTime = RTTimeMilliTS();
3073
3074 if (RT_UNLIKELY(u64CurTime > u64LastTime))
3075 {
3076 u64LastTime = u64CurTime;
3077 TMTimerPollVoid(pVM, pVCpu);
3078 }
3079 }
3080#endif
3081
3082 /*
3083 * Check for pending actions that force us to go back to ring-3.
3084 */
3085 if ( VM_FF_IS_PENDING(pVM, VM_FF_HM_TO_R3_MASK | VM_FF_REQUEST | VM_FF_PGM_POOL_FLUSH_PENDING | VM_FF_PDM_DMA)
3086 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK | VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL | VMCPU_FF_REQUEST))
3087 {
3088 /* Check if a sync operation is pending. */
3089 if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
3090 {
3091 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
3092 if (rc != VINF_SUCCESS)
3093 {
3094 AssertRC(VBOXSTRICTRC_VAL(rc));
3095 Log(("Pending pool sync is forcing us back to ring 3; rc=%d\n", VBOXSTRICTRC_VAL(rc)));
3096 goto end;
3097 }
3098 }
3099
3100#ifdef DEBUG
3101 /* Intercept X86_XCPT_DB if stepping is enabled */
3102 if (!DBGFIsStepping(pVCpu))
3103#endif
3104 {
3105 if ( VM_FF_IS_PENDING(pVM, VM_FF_HM_TO_R3_MASK)
3106 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_TO_R3_MASK))
3107 {
3108 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
3109 rc = RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
3110 goto end;
3111 }
3112 }
3113
3114 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
3115 if ( VM_FF_IS_PENDING(pVM, VM_FF_REQUEST)
3116 || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
3117 {
3118 rc = VINF_EM_PENDING_REQUEST;
3119 goto end;
3120 }
3121
3122 /* Check if a pgm pool flush is in progress. */
3123 if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
3124 {
3125 rc = VINF_PGM_POOL_FLUSH_PENDING;
3126 goto end;
3127 }
3128
3129 /* Check if DMA work is pending (2nd+ run). */
3130 if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA) && cResume > 1)
3131 {
3132 rc = VINF_EM_RAW_TO_R3;
3133 goto end;
3134 }
3135 }
3136
3137#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3138 /*
3139 * Exit to ring-3 preemption/work is pending.
3140 *
3141 * Interrupts are disabled before the call to make sure we don't miss any interrupt
3142 * that would flag preemption (IPI, timer tick, ++). (Would've been nice to do this
3143 * further down, but hmR0VmxCheckPendingInterrupt makes that impossible.)
3144 *
3145 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
3146 * shootdowns rely on this.
3147 */
3148 uOldEFlags = ASMIntDisableFlags();
3149 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
3150 {
3151 STAM_COUNTER_INC(&pVCpu->hm.s.StatPendingHostIrq);
3152 rc = VINF_EM_RAW_INTERRUPT;
3153 goto end;
3154 }
3155 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3156#endif
3157
3158 /*
3159 * When external interrupts are pending, we should exit the VM when IF is set.
3160 * Note: *After* VM_FF_INHIBIT_INTERRUPTS check!
3161 */
3162 rc = hmR0VmxCheckPendingInterrupt(pVM, pVCpu, pCtx);
3163 if (RT_FAILURE(rc))
3164 goto end;
3165
3166 /** @todo check timers?? */
3167
3168 /*
3169 * TPR caching using CR8 is only available in 64-bit mode.
3170 * Note: The 32-bit exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but this appears missing in Intel CPUs.
3171 * Note: We can't do this in LoadGuestState() as PDMApicGetTPR can jump back to ring-3 (lock)!! (no longer true) .
3172 */
3173 /** @todo query and update the TPR only when it could have been changed (mmio
3174 * access & wrsmr (x2apic) */
3175 if (fSetupTPRCaching)
3176 {
3177 /* TPR caching in CR8 */
3178 bool fPending;
3179
3180 rc2 = PDMApicGetTPR(pVCpu, &u8LastTPR, &fPending, NULL /* pu8PendingIrq */);
3181 AssertRC(rc2);
3182 /* The TPR can be found at offset 0x80 in the APIC mmio page. */
3183 pVCpu->hm.s.vmx.pbVirtApic[0x80] = u8LastTPR;
3184
3185 /*
3186 * Two options here:
3187 * - external interrupt pending, but masked by the TPR value.
3188 * -> a CR8 update that lower the current TPR value should cause an exit
3189 * - no pending interrupts
3190 * -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
3191 */
3192
3193 /* cr8 bits 3-0 correspond to bits 7-4 of the task priority mmio register. */
3194 rc = VMXWriteVmcs(VMX_VMCS32_CTRL_TPR_THRESHOLD, (fPending) ? (u8LastTPR >> 4) : 0);
3195 AssertRC(VBOXSTRICTRC_VAL(rc));
3196
3197 if (pVM->hm.s.fTPRPatchingActive)
3198 {
3199 Assert(!CPUMIsGuestInLongModeEx(pCtx));
3200 /* Our patch code uses LSTAR for TPR caching. */
3201 pCtx->msrLSTAR = u8LastTPR;
3202
3203 /** @todo r=ramshankar: we should check for MSR-bitmap support here. */
3204 if (fPending)
3205 {
3206 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
3207 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
3208 }
3209 else
3210 {
3211 /*
3212 * No interrupts are pending, so we don't need to be explicitely notified.
3213 * There are enough world switches for detecting pending interrupts.
3214 */
3215 hmR0VmxSetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
3216 }
3217 }
3218 }
3219
3220#ifdef LOG_ENABLED
3221 if ( pVM->hm.s.fNestedPaging
3222 || pVM->hm.s.vmx.fVpid)
3223 {
3224 PHMGLOBLCPUINFO pCpu = HMR0GetCurrentCpu();
3225 if (pVCpu->hm.s.idLastCpu != pCpu->idCpu)
3226 {
3227 LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hm.s.idLastCpu,
3228 pCpu->idCpu));
3229 }
3230 else if (pVCpu->hm.s.cTlbFlushes != pCpu->cTlbFlushes)
3231 {
3232 LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hm.s.cTlbFlushes,
3233 pCpu->cTlbFlushes));
3234 }
3235 else if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_TLB_FLUSH))
3236 LogFlow(("Manual TLB flush\n"));
3237 }
3238#endif
3239#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
3240 PGMRZDynMapFlushAutoSet(pVCpu);
3241#endif
3242
3243 /*
3244 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING-3!
3245 * (until the actual world switch)
3246 */
3247#ifdef VBOX_STRICT
3248 idCpuCheck = RTMpCpuId();
3249#endif
3250#ifdef LOG_ENABLED
3251 VMMR0LogFlushDisable(pVCpu);
3252#endif
3253
3254 /*
3255 * Save the host state first.
3256 */
3257 if (pVCpu->hm.s.fContextUseFlags & HM_CHANGED_HOST_CONTEXT)
3258 {
3259 rc = VMXR0SaveHostState(pVM, pVCpu);
3260 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3261 {
3262 VMMR0LogFlushEnable(pVCpu);
3263 goto end;
3264 }
3265 }
3266
3267 /*
3268 * Load the guest state.
3269 */
3270 if (!pVCpu->hm.s.fContextUseFlags)
3271 {
3272 VMXR0LoadMinimalGuestState(pVM, pVCpu, pCtx);
3273 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadMinimal);
3274 if (fNeedTscSetup)
3275 {
3276 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3277 fNeedTscSetup = false;
3278 }
3279 }
3280 else
3281 {
3282 rc = VMXR0LoadGuestState(pVM, pVCpu, pCtx);
3283 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3284 {
3285 VMMR0LogFlushEnable(pVCpu);
3286 goto end;
3287 }
3288 STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
3289 VMXR0SetupTscOffsetAndPreemption(pVM, pVCpu);
3290 }
3291
3292#ifndef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3293 /*
3294 * Disable interrupts to make sure a poke will interrupt execution.
3295 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
3296 */
3297 uOldEFlags = ASMIntDisableFlags();
3298 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
3299#endif
3300
3301 /* Non-register state Guest Context */
3302 /** @todo change me according to cpu state */
3303 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_VMCS_GUEST_ACTIVITY_ACTIVE);
3304 AssertRC(rc2);
3305
3306 /* Set TLB flush state as checked until we return from the world switch. */
3307 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);
3308 /* Deal with tagged TLB setup and invalidation. */
3309 pVM->hm.s.vmx.pfnFlushTaggedTlb(pVM, pVCpu);
3310
3311 /*
3312 * Manual save and restore:
3313 * - General purpose registers except RIP, RSP
3314 *
3315 * Trashed:
3316 * - CR2 (we don't care)
3317 * - LDTR (reset to 0)
3318 * - DRx (presumably not changed at all)
3319 * - DR7 (reset to 0x400)
3320 * - EFLAGS (reset to RT_BIT(1); not relevant)
3321 */
3322
3323 /* All done! Let's start VM execution. */
3324 Assert(idCpuCheck == RTMpCpuId());
3325
3326#ifdef VBOX_WITH_CRASHDUMP_MAGIC
3327 pVCpu->hm.s.vmx.VMCSCache.cResume = cResume;
3328 pVCpu->hm.s.vmx.VMCSCache.u64TimeSwitch = RTTimeNanoTS();
3329#endif
3330
3331 /*
3332 * Save the current TPR value in the LSTAR MSR so our patches can access it.
3333 */
3334 if (pVM->hm.s.fTPRPatchingActive)
3335 {
3336 Assert(pVM->hm.s.fTPRPatchingActive);
3337 u64OldLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3338 ASMWrMsr(MSR_K8_LSTAR, u8LastTPR);
3339 }
3340
3341 TMNotifyStartOfExecution(pVCpu);
3342
3343#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3344 /*
3345 * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
3346 * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
3347 */
3348 if ( (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3349 && !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT))
3350 {
3351 pVCpu->hm.s.u64HostTscAux = ASMRdMsr(MSR_K8_TSC_AUX);
3352 uint64_t u64HostTscAux = 0;
3353 rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64HostTscAux);
3354 AssertRC(rc2);
3355 ASMWrMsr(MSR_K8_TSC_AUX, u64HostTscAux);
3356 }
3357#endif
3358
3359 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatEntry, &pVCpu->hm.s.StatInGC, x);
3360#ifdef VBOX_WITH_KERNEL_USING_XMM
3361 rc = HMR0VMXStartVMWrapXMM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu, pVCpu->hm.s.vmx.pfnStartVM);
3362#else
3363 rc = pVCpu->hm.s.vmx.pfnStartVM(pVCpu->hm.s.fResumeVM, pCtx, &pVCpu->hm.s.vmx.VMCSCache, pVM, pVCpu);
3364#endif
3365 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
3366 ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false);
3367 ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits);
3368
3369 /* Possibly the last TSC value seen by the guest (too high) (only when we're in TSC offset mode). */
3370 if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT))
3371 {
3372#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
3373 /* Restore host's TSC_AUX. */
3374 if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
3375 ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hm.s.u64HostTscAux);
3376#endif
3377
3378 TMCpuTickSetLastSeen(pVCpu,
3379 ASMReadTSC() + pVCpu->hm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
3380 }
3381
3382 TMNotifyEndOfExecution(pVCpu);
3383 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_HM);
3384 Assert(!(ASMGetFlags() & X86_EFL_IF));
3385
3386 /*
3387 * Restore the host LSTAR MSR if the guest could have changed it.
3388 */
3389 if (pVM->hm.s.fTPRPatchingActive)
3390 {
3391 Assert(pVM->hm.s.fTPRPatchingActive);
3392 pVCpu->hm.s.vmx.pbVirtApic[0x80] = pCtx->msrLSTAR = ASMRdMsr(MSR_K8_LSTAR);
3393 ASMWrMsr(MSR_K8_LSTAR, u64OldLSTAR);
3394 }
3395
3396 ASMSetFlags(uOldEFlags);
3397#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
3398 uOldEFlags = ~(RTCCUINTREG)0;
3399#endif
3400
3401 AssertMsg(!pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries, ("pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries=%d\n",
3402 pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries));
3403
3404 /* In case we execute a goto ResumeExecution later on. */
3405 pVCpu->hm.s.fResumeVM = true;
3406 pVCpu->hm.s.fForceTLBFlush = false;
3407
3408 /*
3409 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3410 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
3411 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
3412 */
3413
3414 if (RT_UNLIKELY(rc != VINF_SUCCESS))
3415 {
3416 hmR0VmxReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
3417 VMMR0LogFlushEnable(pVCpu);
3418 goto end;
3419 }
3420
3421 /* Success. Query the guest state and figure out what has happened. */
3422
3423 /* Investigate why there was a VM-exit. */
3424 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
3425 STAM_COUNTER_INC(&pVCpu->hm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
3426
3427 exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
3428 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
3429 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &cbInstr);
3430 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &intInfo);
3431 /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
3432 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE, &errCode);
3433 rc2 |= VMXReadCachedVmcs(VMX_VMCS32_RO_EXIT_INSTR_INFO, &instrInfo);
3434 rc2 |= VMXReadCachedVmcs(VMX_VMCS_RO_EXIT_QUALIFICATION, &exitQualification);
3435 AssertRC(rc2);
3436
3437 /*
3438 * Sync back the guest state.
3439 */
3440 rc2 = VMXR0SaveGuestState(pVM, pVCpu, pCtx);
3441 AssertRC(rc2);
3442
3443 /* Note! NOW IT'S SAFE FOR LOGGING! */
3444 VMMR0LogFlushEnable(pVCpu);
3445 Log2(("Raw exit reason %08x\n", exitReason));
3446#if ARCH_BITS == 64 /* for the time being */
3447 VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pCtx, exitReason);
3448#endif
3449
3450 /*
3451 * Check if an injected event was interrupted prematurely.
3452 */
3453 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_INFO, &val);
3454 AssertRC(rc2);
3455 pVCpu->hm.s.Event.u64IntrInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
3456 if ( VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3457 /* Ignore 'int xx' as they'll be restarted anyway. */
3458 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT
3459 /* Ignore software exceptions (such as int3) as they'll reoccur when we restart the instruction anyway. */
3460 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3461 {
3462 Assert(!pVCpu->hm.s.Event.fPending);
3463 pVCpu->hm.s.Event.fPending = true;
3464 /* Error code present? */
3465 if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo))
3466 {
3467 rc2 = VMXReadCachedVmcs(VMX_VMCS32_RO_IDT_ERROR_CODE, &val);
3468 AssertRC(rc2);
3469 pVCpu->hm.s.Event.u32ErrCode = val;
3470 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv pending error=%RX64\n",
3471 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification, val));
3472 }
3473 else
3474 {
3475 Log(("Pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n", pVCpu->hm.s.Event.u64IntrInfo,
3476 (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3477 pVCpu->hm.s.Event.u32ErrCode = 0;
3478 }
3479 }
3480#ifdef VBOX_STRICT
3481 else if ( VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo)
3482 /* Ignore software exceptions (such as int3) as they're reoccur when we restart the instruction anyway. */
3483 && VMX_EXIT_INTERRUPTION_INFO_TYPE(pVCpu->hm.s.Event.u64IntrInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT)
3484 {
3485 Log(("Ignore pending inject %RX64 at %RGv exit=%08x intInfo=%08x exitQualification=%RGv\n",
3486 pVCpu->hm.s.Event.u64IntrInfo, (RTGCPTR)pCtx->rip, exitReason, intInfo, exitQualification));
3487 }
3488
3489 if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
3490 HMDumpRegs(pVM, pVCpu, pCtx);
3491#endif
3492
3493 Log2(("E%d: New EIP=%x:%RGv\n", (uint32_t)exitReason, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3494 Log2(("Exit reason %d, exitQualification %RGv\n", (uint32_t)exitReason, exitQualification));
3495 Log2(("instrInfo=%d instrError=%d instr length=%d\n", (uint32_t)instrInfo, (uint32_t)instrError, (uint32_t)cbInstr));
3496 Log2(("Interruption error code %d\n", (uint32_t)errCode));
3497 Log2(("IntInfo = %08x\n", (uint32_t)intInfo));
3498
3499 /*
3500 * Sync back the TPR if it was changed.
3501 */
3502 if ( fSetupTPRCaching
3503 && u8LastTPR != pVCpu->hm.s.vmx.pbVirtApic[0x80])
3504 {
3505 rc2 = PDMApicSetTPR(pVCpu, pVCpu->hm.s.vmx.pbVirtApic[0x80]);
3506 AssertRC(rc2);
3507 }
3508
3509#ifdef DBGFTRACE_ENABLED /** @todo DTrace later. */
3510 RTTraceBufAddMsgF(pVM->CTX_SUFF(hTraceBuf), "vmexit %08x %016RX64 at %04:%08RX64 %RX64",
3511 exitReason, (uint64_t)exitQualification, pCtx->cs.Sel, pCtx->rip, (uint64_t)intInfo);
3512#endif
3513 STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatExit1, &pVCpu->hm.s.StatExit2, x);
3514
3515 /* Some cases don't need a complete resync of the guest CPU state; handle them here. */
3516 Assert(rc == VINF_SUCCESS); /* might consider VERR_IPE_UNINITIALIZED_STATUS here later... */
3517 switch (exitReason)
3518 {
3519 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
3520 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
3521 {
3522 uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
3523
3524 if (!VMX_EXIT_INTERRUPTION_INFO_IS_VALID(intInfo))
3525 {
3526 Assert(exitReason == VMX_EXIT_EXT_INT);
3527 /* External interrupt; leave to allow it to be dispatched again. */
3528 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitExtInt);
3529 rc = VINF_EM_RAW_INTERRUPT;
3530 break;
3531 }
3532 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitXcptNmi, y3);
3533 switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
3534 {
3535 case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
3536 /* External interrupt; leave to allow it to be dispatched again. */
3537 rc = VINF_EM_RAW_INTERRUPT;
3538 break;
3539
3540 case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT: /* External hardware interrupt. */
3541 AssertFailed(); /* can't come here; fails the first check. */
3542 break;
3543
3544 case VMX_EXIT_INTERRUPTION_INFO_TYPE_DB_XCPT: /* Unknown why we get this type for #DB */
3545 case VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_XCPT: /* Software exception. (#BP or #OF) */
3546 Assert(vector == 1 || vector == 3 || vector == 4);
3547 /* no break */
3548 case VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT: /* Hardware exception. */
3549 Log2(("Hardware/software interrupt %d\n", vector));
3550 switch (vector)
3551 {
3552 case X86_XCPT_NM:
3553 {
3554 Log(("#NM fault at %RGv error code %x\n", (RTGCPTR)pCtx->rip, errCode));
3555
3556 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
3557 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
3558 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
3559 if (rc == VINF_SUCCESS)
3560 {
3561 Assert(CPUMIsGuestFPUStateActive(pVCpu));
3562
3563 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowNM);
3564
3565 /* Continue execution. */
3566 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
3567
3568 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3569 goto ResumeExecution;
3570 }
3571
3572 Log(("Forward #NM fault to the guest\n"));
3573 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNM);
3574 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3575 cbInstr, 0);
3576 AssertRC(rc2);
3577 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3578 goto ResumeExecution;
3579 }
3580
3581 case X86_XCPT_PF: /* Page fault */
3582 {
3583#ifdef VBOX_ALWAYS_TRAP_PF
3584 if (pVM->hm.s.fNestedPaging)
3585 {
3586 /*
3587 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3588 */
3589 Log(("Guest page fault at %RGv cr2=%RGv error code %RGv rsp=%RGv\n", (RTGCPTR)pCtx->rip, exitQualification,
3590 errCode, (RTGCPTR)pCtx->rsp));
3591
3592 Assert(CPUMIsGuestInPagedProtectedModeEx(pCtx));
3593
3594 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3595
3596 /* Now we must update CR2. */
3597 pCtx->cr2 = exitQualification;
3598 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3599 cbInstr, errCode);
3600 AssertRC(rc2);
3601
3602 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3603 goto ResumeExecution;
3604 }
3605#else
3606 Assert(!pVM->hm.s.fNestedPaging);
3607#endif
3608
3609#ifdef VBOX_HM_WITH_GUEST_PATCHING
3610 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
3611 if ( pVM->hm.s.fTRPPatchingAllowed
3612 && pVM->hm.s.pGuestPatchMem
3613 && (exitQualification & 0xfff) == 0x080
3614 && !(errCode & X86_TRAP_PF_P) /* not present */
3615 && CPUMGetGuestCPL(pVCpu) == 0
3616 && !CPUMIsGuestInLongModeEx(pCtx)
3617 && pVM->hm.s.cPatches < RT_ELEMENTS(pVM->hm.s.aPatches))
3618 {
3619 RTGCPHYS GCPhysApicBase, GCPhys;
3620 GCPhysApicBase = pCtx->msrApicBase;
3621 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3622
3623 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3624 if ( rc == VINF_SUCCESS
3625 && GCPhys == GCPhysApicBase)
3626 {
3627 /* Only attempt to patch the instruction once. */
3628 PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
3629 if (!pPatch)
3630 {
3631 rc = VINF_EM_HM_PATCH_TPR_INSTR;
3632 break;
3633 }
3634 }
3635 }
3636#endif
3637
3638 Log2(("Page fault at %RGv error code %x\n", exitQualification, errCode));
3639 /* Exit qualification contains the linear address of the page fault. */
3640 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
3641 TRPMSetErrorCode(pVCpu, errCode);
3642 TRPMSetFaultAddress(pVCpu, exitQualification);
3643
3644 /* Shortcut for APIC TPR reads and writes. */
3645 if ( (exitQualification & 0xfff) == 0x080
3646 && !(errCode & X86_TRAP_PF_P) /* not present */
3647 && fSetupTPRCaching
3648 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
3649 {
3650 RTGCPHYS GCPhysApicBase, GCPhys;
3651 GCPhysApicBase = pCtx->msrApicBase;
3652 GCPhysApicBase &= PAGE_BASE_GC_MASK;
3653
3654 rc = PGMGstGetPage(pVCpu, (RTGCPTR)exitQualification, NULL, &GCPhys);
3655 if ( rc == VINF_SUCCESS
3656 && GCPhys == GCPhysApicBase)
3657 {
3658 Log(("Enable VT-x virtual APIC access filtering\n"));
3659 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
3660 X86_PTE_RW | X86_PTE_P);
3661 AssertRC(rc2);
3662 }
3663 }
3664
3665 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
3666 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
3667 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3668
3669 if (rc == VINF_SUCCESS)
3670 { /* We've successfully synced our shadow pages, so let's just continue execution. */
3671 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, exitQualification ,errCode));
3672 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
3673
3674 TRPMResetTrap(pVCpu);
3675 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3676 goto ResumeExecution;
3677 }
3678 else if (rc == VINF_EM_RAW_GUEST_TRAP)
3679 {
3680 /*
3681 * A genuine pagefault. Forward the trap to the guest by injecting the exception and resuming execution.
3682 */
3683 Log2(("Forward page fault to the guest\n"));
3684
3685 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
3686 /* The error code might have been changed. */
3687 errCode = TRPMGetErrorCode(pVCpu);
3688
3689 TRPMResetTrap(pVCpu);
3690
3691 /* Now we must update CR2. */
3692 pCtx->cr2 = exitQualification;
3693 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3694 cbInstr, errCode);
3695 AssertRC(rc2);
3696
3697 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3698 goto ResumeExecution;
3699 }
3700#ifdef VBOX_STRICT
3701 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
3702 Log2(("PGMTrap0eHandler failed with %d\n", VBOXSTRICTRC_VAL(rc)));
3703#endif
3704 /* Need to go back to the recompiler to emulate the instruction. */
3705 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPFEM);
3706 TRPMResetTrap(pVCpu);
3707
3708 /* If event delivery caused the #PF (shadow or not), tell TRPM. */
3709 hmR0VmxCheckPendingEvent(pVCpu);
3710 break;
3711 }
3712
3713 case X86_XCPT_MF: /* Floating point exception. */
3714 {
3715 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
3716 if (!(pCtx->cr0 & X86_CR0_NE))
3717 {
3718 /* old style FPU error reporting needs some extra work. */
3719 /** @todo don't fall back to the recompiler, but do it manually. */
3720 rc = VINF_EM_RAW_EMULATE_INSTR;
3721 break;
3722 }
3723 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3724 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3725 cbInstr, errCode);
3726 AssertRC(rc2);
3727
3728 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3729 goto ResumeExecution;
3730 }
3731
3732 case X86_XCPT_DB: /* Debug exception. */
3733 {
3734 uint64_t uDR6;
3735
3736 /*
3737 * DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
3738 *
3739 * Exit qualification bits:
3740 * 3:0 B0-B3 which breakpoint condition was met
3741 * 12:4 Reserved (0)
3742 * 13 BD - debug register access detected
3743 * 14 BS - single step execution or branch taken
3744 * 63:15 Reserved (0)
3745 */
3746 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
3747
3748 /* Note that we don't support guest and host-initiated debugging at the same time. */
3749
3750 uDR6 = X86_DR6_INIT_VAL;
3751 uDR6 |= (exitQualification & (X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3|X86_DR6_BD|X86_DR6_BS));
3752 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), uDR6);
3753 if (rc == VINF_EM_RAW_GUEST_TRAP)
3754 {
3755 /* Update DR6 here. */
3756 pCtx->dr[6] = uDR6;
3757
3758 /* Resync DR6 if the debug state is active. */
3759 if (CPUMIsGuestDebugStateActive(pVCpu))
3760 ASMSetDR6(pCtx->dr[6]);
3761
3762 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
3763 pCtx->dr[7] &= ~X86_DR7_GD;
3764
3765 /* Paranoia. */
3766 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
3767 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
3768 pCtx->dr[7] |= 0x400; /* must be one */
3769
3770 /* Resync DR7 */
3771 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
3772 AssertRC(rc2);
3773
3774 Log(("Trap %x (debug) at %RGv exit qualification %RX64 dr6=%x dr7=%x\n", vector, (RTGCPTR)pCtx->rip,
3775 exitQualification, (uint32_t)pCtx->dr[6], (uint32_t)pCtx->dr[7]));
3776 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3777 cbInstr, errCode);
3778 AssertRC(rc2);
3779
3780 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3781 goto ResumeExecution;
3782 }
3783 /* Return to ring 3 to deal with the debug exit code. */
3784 Log(("Debugger hardware BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3785 break;
3786 }
3787
3788 case X86_XCPT_BP: /* Breakpoint. */
3789 {
3790 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
3791 rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx));
3792 if (rc == VINF_EM_RAW_GUEST_TRAP)
3793 {
3794 Log(("Guest #BP at %04x:%RGv\n", pCtx->cs.Sel, pCtx->rip));
3795 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3796 cbInstr, errCode);
3797 AssertRC(rc2);
3798 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3799 goto ResumeExecution;
3800 }
3801 if (rc == VINF_SUCCESS)
3802 {
3803 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3804 goto ResumeExecution;
3805 }
3806 Log(("Debugger BP at %04x:%RGv (rc=%Rrc)\n", pCtx->cs.Sel, pCtx->rip, VBOXSTRICTRC_VAL(rc)));
3807 break;
3808 }
3809
3810 case X86_XCPT_GP: /* General protection failure exception. */
3811 {
3812 uint32_t cbOp;
3813 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
3814
3815 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestGP);
3816#ifdef VBOX_STRICT
3817 if ( !CPUMIsGuestInRealModeEx(pCtx)
3818 || !pVM->hm.s.vmx.pRealModeTSS)
3819 {
3820 Log(("Trap %x at %04X:%RGv errorCode=%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip, errCode));
3821 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
3822 cbInstr, errCode);
3823 AssertRC(rc2);
3824 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
3825 goto ResumeExecution;
3826 }
3827#endif
3828 Assert(CPUMIsGuestInRealModeEx(pCtx));
3829
3830 LogFlow(("Real mode X86_XCPT_GP instruction emulation at %x:%RGv\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
3831
3832 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
3833 if (RT_SUCCESS(rc2))
3834 {
3835 bool fUpdateRIP = true;
3836
3837 rc = VINF_SUCCESS;
3838 Assert(cbOp == pDis->cbInstr);
3839 switch (pDis->pCurInstr->uOpcode)
3840 {
3841 case OP_CLI:
3842 pCtx->eflags.Bits.u1IF = 0;
3843 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCli);
3844 break;
3845
3846 case OP_STI:
3847 pCtx->eflags.Bits.u1IF = 1;
3848 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip + pDis->cbInstr);
3849 Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
3850 rc2 = VMXWriteVmcs(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE,
3851 VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
3852 AssertRC(rc2);
3853 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitSti);
3854 break;
3855
3856 case OP_HLT:
3857 fUpdateRIP = false;
3858 rc = VINF_EM_HALT;
3859 pCtx->rip += pDis->cbInstr;
3860 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
3861 break;
3862
3863 case OP_POPF:
3864 {
3865 RTGCPTR GCPtrStack;
3866 uint32_t cbParm;
3867 uint32_t uMask;
3868 X86EFLAGS eflags;
3869
3870 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3871 {
3872 cbParm = 4;
3873 uMask = 0xffffffff;
3874 }
3875 else
3876 {
3877 cbParm = 2;
3878 uMask = 0xffff;
3879 }
3880
3881 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3882 if (RT_FAILURE(rc2))
3883 {
3884 rc = VERR_EM_INTERPRETER;
3885 break;
3886 }
3887 eflags.u = 0;
3888 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3889 if (RT_FAILURE(rc2))
3890 {
3891 rc = VERR_EM_INTERPRETER;
3892 break;
3893 }
3894 LogFlow(("POPF %x -> %RGv mask=%x\n", eflags.u, pCtx->rsp, uMask));
3895 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3896 | (eflags.u & X86_EFL_POPF_BITS & uMask);
3897 /* RF cleared when popped in real mode; see pushf description in AMD manual. */
3898 pCtx->eflags.Bits.u1RF = 0;
3899 pCtx->esp += cbParm;
3900 pCtx->esp &= uMask;
3901
3902 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPopf);
3903 break;
3904 }
3905
3906 case OP_PUSHF:
3907 {
3908 RTGCPTR GCPtrStack;
3909 uint32_t cbParm;
3910 uint32_t uMask;
3911 X86EFLAGS eflags;
3912
3913 if (pDis->fPrefix & DISPREFIX_OPSIZE)
3914 {
3915 cbParm = 4;
3916 uMask = 0xffffffff;
3917 }
3918 else
3919 {
3920 cbParm = 2;
3921 uMask = 0xffff;
3922 }
3923
3924 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), (pCtx->esp - cbParm) & uMask, 0,
3925 &GCPtrStack);
3926 if (RT_FAILURE(rc2))
3927 {
3928 rc = VERR_EM_INTERPRETER;
3929 break;
3930 }
3931 eflags = pCtx->eflags;
3932 /* RF & VM cleared when pushed in real mode; see pushf description in AMD manual. */
3933 eflags.Bits.u1RF = 0;
3934 eflags.Bits.u1VM = 0;
3935
3936 rc2 = PGMPhysWrite(pVM, (RTGCPHYS)GCPtrStack, &eflags.u, cbParm);
3937 if (RT_FAILURE(rc2))
3938 {
3939 rc = VERR_EM_INTERPRETER;
3940 break;
3941 }
3942 LogFlow(("PUSHF %x -> %RGv\n", eflags.u, GCPtrStack));
3943 pCtx->esp -= cbParm;
3944 pCtx->esp &= uMask;
3945 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPushf);
3946 break;
3947 }
3948
3949 case OP_IRET:
3950 {
3951 RTGCPTR GCPtrStack;
3952 uint32_t uMask = 0xffff;
3953 uint16_t aIretFrame[3];
3954
3955 if (pDis->fPrefix & (DISPREFIX_OPSIZE | DISPREFIX_ADDRSIZE))
3956 {
3957 rc = VERR_EM_INTERPRETER;
3958 break;
3959 }
3960
3961 rc2 = SELMToFlatEx(pVCpu, DISSELREG_SS, CPUMCTX2CORE(pCtx), pCtx->esp & uMask, 0, &GCPtrStack);
3962 if (RT_FAILURE(rc2))
3963 {
3964 rc = VERR_EM_INTERPRETER;
3965 break;
3966 }
3967 rc2 = PGMPhysRead(pVM, (RTGCPHYS)GCPtrStack, &aIretFrame[0], sizeof(aIretFrame));
3968 if (RT_FAILURE(rc2))
3969 {
3970 rc = VERR_EM_INTERPRETER;
3971 break;
3972 }
3973 pCtx->ip = aIretFrame[0];
3974 pCtx->cs.Sel = aIretFrame[1];
3975 pCtx->cs.ValidSel = aIretFrame[1];
3976 pCtx->cs.u64Base = (uint32_t)pCtx->cs.Sel << 4;
3977 pCtx->eflags.u = (pCtx->eflags.u & ~(X86_EFL_POPF_BITS & uMask))
3978 | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
3979 pCtx->sp += sizeof(aIretFrame);
3980
3981 LogFlow(("iret to %04x:%x\n", pCtx->cs.Sel, pCtx->ip));
3982 fUpdateRIP = false;
3983 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIret);
3984 break;
3985 }
3986
3987 case OP_INT:
3988 {
3989 uint32_t intInfo2;
3990
3991 LogFlow(("Realmode: INT %x\n", pDis->Param1.uValue & 0xff));
3992 intInfo2 = pDis->Param1.uValue & 0xff;
3993 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
3994 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
3995
3996 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
3997 AssertRC(VBOXSTRICTRC_VAL(rc));
3998 fUpdateRIP = false;
3999 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4000 break;
4001 }
4002
4003 case OP_INTO:
4004 {
4005 if (pCtx->eflags.Bits.u1OF)
4006 {
4007 uint32_t intInfo2;
4008
4009 LogFlow(("Realmode: INTO\n"));
4010 intInfo2 = X86_XCPT_OF;
4011 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4012 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4013
4014 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4015 AssertRC(VBOXSTRICTRC_VAL(rc));
4016 fUpdateRIP = false;
4017 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4018 }
4019 break;
4020 }
4021
4022 case OP_INT3:
4023 {
4024 uint32_t intInfo2;
4025
4026 LogFlow(("Realmode: INT 3\n"));
4027 intInfo2 = 3;
4028 intInfo2 |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4029 intInfo2 |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4030
4031 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, intInfo2, cbOp, 0);
4032 AssertRC(VBOXSTRICTRC_VAL(rc));
4033 fUpdateRIP = false;
4034 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInt);
4035 break;
4036 }
4037
4038 default:
4039 rc = EMInterpretInstructionDisasState(pVCpu, pDis, CPUMCTX2CORE(pCtx), 0, EMCODETYPE_SUPERVISOR);
4040 fUpdateRIP = false;
4041 break;
4042 }
4043
4044 if (rc == VINF_SUCCESS)
4045 {
4046 if (fUpdateRIP)
4047 pCtx->rip += cbOp; /* Move on to the next instruction. */
4048
4049 /*
4050 * LIDT, LGDT can end up here. In the future CRx changes as well. Just reload the
4051 * whole context to be done with it.
4052 */
4053 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT | HM_CHANGED_ALL_GUEST;
4054
4055 /* Only resume if successful. */
4056 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4057 goto ResumeExecution;
4058 }
4059 }
4060 else
4061 rc = VERR_EM_INTERPRETER;
4062
4063 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_EM_HALT,
4064 ("Unexpected rc=%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4065 break;
4066 }
4067
4068#ifdef VBOX_STRICT
4069 case X86_XCPT_XF: /* SIMD exception. */
4070 case X86_XCPT_DE: /* Divide error. */
4071 case X86_XCPT_UD: /* Unknown opcode exception. */
4072 case X86_XCPT_SS: /* Stack segment exception. */
4073 case X86_XCPT_NP: /* Segment not present exception. */
4074 {
4075 switch (vector)
4076 {
4077 case X86_XCPT_DE: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDE); break;
4078 case X86_XCPT_UD: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestUD); break;
4079 case X86_XCPT_SS: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestSS); break;
4080 case X86_XCPT_NP: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestNP); break;
4081 case X86_XCPT_XF: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXF); break;
4082 }
4083
4084 Log(("Trap %x at %04X:%RGv\n", vector, pCtx->cs.Sel, (RTGCPTR)pCtx->rip));
4085 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4086 cbInstr, errCode);
4087 AssertRC(rc2);
4088
4089 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4090 goto ResumeExecution;
4091 }
4092#endif
4093 default:
4094 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXcpUnk);
4095 if ( CPUMIsGuestInRealModeEx(pCtx)
4096 && pVM->hm.s.vmx.pRealModeTSS)
4097 {
4098 Log(("Real Mode Trap %x at %04x:%04X error code %x\n", vector, pCtx->cs.Sel, pCtx->eip, errCode));
4099 rc = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4100 cbInstr, errCode);
4101 AssertRC(VBOXSTRICTRC_VAL(rc)); /* Strict RC check below. */
4102
4103 /* Go back to ring-3 in case of a triple fault. */
4104 if ( vector == X86_XCPT_DF
4105 && rc == VINF_EM_RESET)
4106 {
4107 break;
4108 }
4109
4110 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4111 goto ResumeExecution;
4112 }
4113 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
4114 rc = VERR_VMX_UNEXPECTED_EXCEPTION;
4115 break;
4116 } /* switch (vector) */
4117
4118 break;
4119
4120 default:
4121 rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
4122 AssertMsgFailed(("Unexpected interruption code %x\n", intInfo));
4123 break;
4124 }
4125
4126 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
4127 break;
4128 }
4129
4130 /*
4131 * 48 EPT violation. An attempt to access memory with a guest-physical address was disallowed
4132 * by the configuration of the EPT paging structures.
4133 */
4134 case VMX_EXIT_EPT_VIOLATION:
4135 {
4136 RTGCPHYS GCPhys;
4137
4138 Assert(pVM->hm.s.fNestedPaging);
4139
4140 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4141 AssertRC(rc2);
4142 Assert(((exitQualification >> 7) & 3) != 2);
4143
4144 /* Determine the kind of violation. */
4145 errCode = 0;
4146 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
4147 errCode |= X86_TRAP_PF_ID;
4148
4149 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
4150 errCode |= X86_TRAP_PF_RW;
4151
4152 /* If the page is present, then it's a page level protection fault. */
4153 if (exitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
4154 errCode |= X86_TRAP_PF_P;
4155 else
4156 {
4157 /* Shortcut for APIC TPR reads and writes. */
4158 if ( (GCPhys & 0xfff) == 0x080
4159 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4160 && fSetupTPRCaching
4161 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4162 {
4163 RTGCPHYS GCPhysApicBase;
4164 GCPhysApicBase = pCtx->msrApicBase;
4165 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4166 if (GCPhys == GCPhysApicBase + 0x80)
4167 {
4168 Log(("Enable VT-x virtual APIC access filtering\n"));
4169 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4170 X86_PTE_RW | X86_PTE_P);
4171 AssertRC(rc2);
4172 }
4173 }
4174 }
4175 Log(("EPT Page fault %x at %RGp error code %x\n", (uint32_t)exitQualification, GCPhys, errCode));
4176
4177 /* GCPhys contains the guest physical address of the page fault. */
4178 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
4179 TRPMSetErrorCode(pVCpu, errCode);
4180 TRPMSetFaultAddress(pVCpu, GCPhys);
4181
4182 /* Handle the pagefault trap for the nested shadow table. */
4183 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, PGMMODE_EPT, errCode, CPUMCTX2CORE(pCtx), GCPhys);
4184
4185 /*
4186 * Same case as PGMR0Trap0eHandlerNPMisconfig(). See comment below, @bugref{6043}.
4187 */
4188 if ( rc == VINF_SUCCESS
4189 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4190 || rc == VERR_PAGE_NOT_PRESENT)
4191 {
4192 /* We've successfully synced our shadow pages, so let's just continue execution. */
4193 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, exitQualification , errCode));
4194 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf);
4195
4196 TRPMResetTrap(pVCpu);
4197 goto ResumeExecution;
4198 }
4199
4200#ifdef VBOX_STRICT
4201 if (rc != VINF_EM_RAW_EMULATE_INSTR)
4202 LogFlow(("PGMTrap0eHandlerNestedPaging at %RGv failed with %Rrc\n", (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4203#endif
4204 /* Need to go back to the recompiler to emulate the instruction. */
4205 TRPMResetTrap(pVCpu);
4206 break;
4207 }
4208
4209 case VMX_EXIT_EPT_MISCONFIG:
4210 {
4211 RTGCPHYS GCPhys;
4212
4213 Assert(pVM->hm.s.fNestedPaging);
4214
4215 rc2 = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
4216 AssertRC(rc2);
4217 Log(("VMX_EXIT_EPT_MISCONFIG for %RGp\n", GCPhys));
4218
4219 /* Shortcut for APIC TPR reads and writes. */
4220 if ( (GCPhys & 0xfff) == 0x080
4221 && GCPhys > 0x1000000 /* to skip VGA frame buffer accesses */
4222 && fSetupTPRCaching
4223 && (pVM->hm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC))
4224 {
4225 RTGCPHYS GCPhysApicBase = pCtx->msrApicBase;
4226 GCPhysApicBase &= PAGE_BASE_GC_MASK;
4227 if (GCPhys == GCPhysApicBase + 0x80)
4228 {
4229 Log(("Enable VT-x virtual APIC access filtering\n"));
4230 rc2 = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess,
4231 X86_PTE_RW | X86_PTE_P);
4232 AssertRC(rc2);
4233 }
4234 }
4235
4236 rc = PGMR0Trap0eHandlerNPMisconfig(pVM, pVCpu, PGMMODE_EPT, CPUMCTX2CORE(pCtx), GCPhys, UINT32_MAX);
4237
4238 /*
4239 * If we succeed, resume execution.
4240 * Or, if fail in interpreting the instruction because we couldn't get the guest physical address
4241 * of the page containing the instruction via the guest's page tables (we would invalidate the guest page
4242 * in the host TLB), resume execution which would cause a guest page fault to let the guest handle this
4243 * weird case. See @bugref{6043}.
4244 */
4245 if ( rc == VINF_SUCCESS
4246 || rc == VERR_PAGE_TABLE_NOT_PRESENT
4247 || rc == VERR_PAGE_NOT_PRESENT)
4248 {
4249 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> resume\n", GCPhys, (RTGCPTR)pCtx->rip));
4250 goto ResumeExecution;
4251 }
4252
4253 Log2(("PGMR0Trap0eHandlerNPMisconfig(,,,%RGp) at %RGv -> %Rrc\n", GCPhys, (RTGCPTR)pCtx->rip, VBOXSTRICTRC_VAL(rc)));
4254 break;
4255 }
4256
4257 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window exiting. */
4258 /* Clear VM-exit on IF=1 change. */
4259 LogFlow(("VMX_EXIT_INT_WINDOW %RGv pending=%d IF=%d\n", (RTGCPTR)pCtx->rip,
4260 VMCPU_FF_IS_PENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
4261 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_INT_WINDOW_EXIT;
4262 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
4263 AssertRC(rc2);
4264 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIntWindow);
4265 goto ResumeExecution; /* we check for pending guest interrupts there */
4266
4267 case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
4268 case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
4269 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
4270 /* Skip instruction and continue directly. */
4271 pCtx->rip += cbInstr;
4272 /* Continue execution.*/
4273 goto ResumeExecution;
4274
4275 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4276 {
4277 Log2(("VMX: Cpuid %x\n", pCtx->eax));
4278 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
4279 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4280 if (rc == VINF_SUCCESS)
4281 {
4282 /* Update EIP and continue execution. */
4283 Assert(cbInstr == 2);
4284 pCtx->rip += cbInstr;
4285 goto ResumeExecution;
4286 }
4287 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4288 rc = VINF_EM_RAW_EMULATE_INSTR;
4289 break;
4290 }
4291
4292 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4293 {
4294 Log2(("VMX: Rdpmc %x\n", pCtx->ecx));
4295 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
4296 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4297 if (rc == VINF_SUCCESS)
4298 {
4299 /* Update EIP and continue execution. */
4300 Assert(cbInstr == 2);
4301 pCtx->rip += cbInstr;
4302 goto ResumeExecution;
4303 }
4304 rc = VINF_EM_RAW_EMULATE_INSTR;
4305 break;
4306 }
4307
4308 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4309 {
4310 Log2(("VMX: Rdtsc\n"));
4311 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
4312 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4313 if (rc == VINF_SUCCESS)
4314 {
4315 /* Update EIP and continue execution. */
4316 Assert(cbInstr == 2);
4317 pCtx->rip += cbInstr;
4318 fNeedTscSetup = true; /* See @bugref{6634}. */
4319 goto ResumeExecution;
4320 }
4321 rc = VINF_EM_RAW_EMULATE_INSTR;
4322 break;
4323 }
4324
4325 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4326 {
4327 Log2(("VMX: Rdtscp\n"));
4328 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
4329 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
4330 if (rc == VINF_SUCCESS)
4331 {
4332 /* Update EIP and continue execution. */
4333 Assert(cbInstr == 3);
4334 pCtx->rip += cbInstr;
4335 fNeedTscSetup = true; /* See @bugref{6634}. */
4336 goto ResumeExecution;
4337 }
4338 rc = VINF_EM_RAW_EMULATE_INSTR;
4339 break;
4340 }
4341
4342 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4343 {
4344 Log2(("VMX: invlpg\n"));
4345 Assert(!pVM->hm.s.fNestedPaging);
4346
4347 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
4348 rc = EMInterpretInvlpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), exitQualification);
4349 if (rc == VINF_SUCCESS)
4350 {
4351 /* Update EIP and continue execution. */
4352 pCtx->rip += cbInstr;
4353 goto ResumeExecution;
4354 }
4355 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %RGv failed with %Rrc\n", exitQualification, VBOXSTRICTRC_VAL(rc)));
4356 break;
4357 }
4358
4359 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4360 {
4361 Log2(("VMX: monitor\n"));
4362
4363 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMonitor);
4364 rc = EMInterpretMonitor(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4365 if (rc == VINF_SUCCESS)
4366 {
4367 /* Update EIP and continue execution. */
4368 pCtx->rip += cbInstr;
4369 goto ResumeExecution;
4370 }
4371 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: monitor failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4372 break;
4373 }
4374
4375 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4376 /* When an interrupt is pending, we'll let MSR_K8_LSTAR writes fault in our TPR patch code. */
4377 if ( pVM->hm.s.fTPRPatchingActive
4378 && pCtx->ecx == MSR_K8_LSTAR)
4379 {
4380 Assert(!CPUMIsGuestInLongModeEx(pCtx));
4381 if ((pCtx->eax & 0xff) != u8LastTPR)
4382 {
4383 Log(("VMX: Faulting MSR_K8_LSTAR write with new TPR value %x\n", pCtx->eax & 0xff));
4384
4385 /* Our patch code uses LSTAR for TPR caching. */
4386 rc2 = PDMApicSetTPR(pVCpu, pCtx->eax & 0xff);
4387 AssertRC(rc2);
4388 }
4389
4390 /* Skip the instruction and continue. */
4391 pCtx->rip += cbInstr; /* wrmsr = [0F 30] */
4392
4393 /* Only resume if successful. */
4394 goto ResumeExecution;
4395 }
4396 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_MSR;
4397 /* no break */
4398 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4399 {
4400 STAM_COUNTER_INC((exitReason == VMX_EXIT_RDMSR) ? &pVCpu->hm.s.StatExitRdmsr : &pVCpu->hm.s.StatExitWrmsr);
4401
4402 Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
4403 rc = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0);
4404 if (rc == VINF_SUCCESS)
4405 {
4406 /* EIP has been updated already. */
4407 /* Only resume if successful. */
4408 goto ResumeExecution;
4409 }
4410 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n",
4411 (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", VBOXSTRICTRC_VAL(rc)));
4412 break;
4413 }
4414
4415 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4416 {
4417 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitMovCRx, y2);
4418
4419 switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
4420 {
4421 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
4422 {
4423 Log2(("VMX: %RGv mov cr%d, x\n", (RTGCPTR)pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
4424 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4425 rc = EMInterpretCRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4426 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
4427 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
4428 switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
4429 {
4430 case 0:
4431 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0 | HM_CHANGED_GUEST_CR3;
4432 break;
4433 case 2:
4434 break;
4435 case 3:
4436 Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
4437 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR3;
4438 break;
4439 case 4:
4440 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR4;
4441 break;
4442 case 8:
4443 /* CR8 contains the APIC TPR */
4444 Assert(!(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1
4445 & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW));
4446 break;
4447
4448 default:
4449 AssertFailed();
4450 break;
4451 }
4452 break;
4453 }
4454
4455 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
4456 {
4457 Log2(("VMX: mov x, crx\n"));
4458 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)]);
4459
4460 Assert( !pVM->hm.s.fNestedPaging
4461 || !CPUMIsGuestInPagedProtectedModeEx(pCtx)
4462 || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != DISCREG_CR3);
4463
4464 /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
4465 Assert( VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8
4466 || !(pVM->hm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW));
4467
4468 rc = EMInterpretCRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4469 VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
4470 VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
4471 break;
4472 }
4473
4474 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
4475 {
4476 Log2(("VMX: clts\n"));
4477 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClts);
4478 rc = EMInterpretCLTS(pVM, pVCpu);
4479 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4480 break;
4481 }
4482
4483 case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
4484 {
4485 Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
4486 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitLmsw);
4487 rc = EMInterpretLMSW(pVM, pVCpu, CPUMCTX2CORE(pCtx), VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
4488 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
4489 break;
4490 }
4491 }
4492
4493 /* Update EIP if no error occurred. */
4494 if (RT_SUCCESS(rc))
4495 pCtx->rip += cbInstr;
4496
4497 if (rc == VINF_SUCCESS)
4498 {
4499 /* Only resume if successful. */
4500 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
4501 goto ResumeExecution;
4502 }
4503 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
4504 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
4505 break;
4506 }
4507
4508 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4509 {
4510 if ( !DBGFIsStepping(pVCpu)
4511 && !CPUMIsHyperDebugStateActive(pVCpu))
4512 {
4513 /* Disable DRx move intercepts. */
4514 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
4515 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
4516 AssertRC(rc2);
4517
4518 /* Save the host and load the guest debug state. */
4519 rc2 = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, true /* include DR6 */);
4520 AssertRC(rc2);
4521
4522#ifdef LOG_ENABLED
4523 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4524 {
4525 Log(("VMX_EXIT_MOV_DRX: write DR%d genreg %d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4526 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4527 }
4528 else
4529 Log(("VMX_EXIT_MOV_DRX: read DR%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification)));
4530#endif
4531
4532#ifdef VBOX_WITH_STATISTICS
4533 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxContextSwitch);
4534 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4535 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4536 else
4537 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4538#endif
4539
4540 goto ResumeExecution;
4541 }
4542
4543 /** @todo clear VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT after the first
4544 * time and restore DRx registers afterwards */
4545 if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
4546 {
4547 Log2(("VMX: mov DRx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4548 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
4549 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
4550 rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4551 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
4552 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
4553 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
4554 Log2(("DR7=%08x\n", pCtx->dr[7]));
4555 }
4556 else
4557 {
4558 Log2(("VMX: mov x, DRx\n"));
4559 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
4560 rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pCtx),
4561 VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
4562 VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
4563 }
4564 /* Update EIP if no error occurred. */
4565 if (RT_SUCCESS(rc))
4566 pCtx->rip += cbInstr;
4567
4568 if (rc == VINF_SUCCESS)
4569 {
4570 /* Only resume if successful. */
4571 goto ResumeExecution;
4572 }
4573 Assert(rc == VERR_EM_INTERPRETER);
4574 break;
4575 }
4576
4577 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
4578 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4579 {
4580 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitIO, y1);
4581 uint32_t uPort;
4582 uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
4583 bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
4584
4585 /** @todo necessary to make the distinction? */
4586 if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
4587 uPort = pCtx->edx & 0xffff;
4588 else
4589 uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
4590
4591 if (RT_UNLIKELY(uIOWidth == 2 || uIOWidth >= 4)) /* paranoia */
4592 {
4593 rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
4594 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4595 break;
4596 }
4597
4598 uint32_t cbSize = g_aIOSize[uIOWidth];
4599 if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
4600 {
4601 /* ins/outs */
4602 PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
4603
4604 /* Disassemble manually to deal with segment prefixes. */
4605 /** @todo VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR contains the flat pointer
4606 * operand of the instruction. */
4607 /** @todo VMX_VMCS32_RO_EXIT_INSTR_INFO also contains segment prefix info. */
4608 rc2 = EMInterpretDisasCurrent(pVM, pVCpu, pDis, NULL);
4609 if (RT_SUCCESS(rc))
4610 {
4611 if (fIOWrite)
4612 {
4613 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4614 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringWrite);
4615 rc = IOMInterpretOUTSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4616 (DISCPUMODE)pDis->uAddrMode, cbSize);
4617 }
4618 else
4619 {
4620 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, uPort, cbSize));
4621 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOStringRead);
4622 rc = IOMInterpretINSEx(pVM, pVCpu, CPUMCTX2CORE(pCtx), uPort, pDis->fPrefix,
4623 (DISCPUMODE)pDis->uAddrMode, cbSize);
4624 }
4625 }
4626 else
4627 rc = VINF_EM_RAW_EMULATE_INSTR;
4628 }
4629 else
4630 {
4631 /* Normal in/out */
4632 uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
4633
4634 Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
4635
4636 if (fIOWrite)
4637 {
4638 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIOWrite);
4639 rc = IOMIOPortWrite(pVM, pVCpu, uPort, pCtx->eax & uAndVal, cbSize);
4640 if (rc == VINF_IOM_R3_IOPORT_WRITE)
4641 HMR0SavePendingIOPortWrite(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4642 }
4643 else
4644 {
4645 uint32_t u32Val = 0;
4646
4647 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIORead);
4648 rc = IOMIOPortRead(pVM, pVCpu, uPort, &u32Val, cbSize);
4649 if (IOM_SUCCESS(rc))
4650 {
4651 /* Write back to the EAX register. */
4652 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
4653 }
4654 else
4655 if (rc == VINF_IOM_R3_IOPORT_READ)
4656 HMR0SavePendingIOPortRead(pVCpu, pCtx->rip, pCtx->rip + cbInstr, uPort, uAndVal, cbSize);
4657 }
4658 }
4659
4660 /*
4661 * Handled the I/O return codes.
4662 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
4663 */
4664 if (IOM_SUCCESS(rc))
4665 {
4666 /* Update EIP and continue execution. */
4667 pCtx->rip += cbInstr;
4668 if (RT_LIKELY(rc == VINF_SUCCESS))
4669 {
4670 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
4671 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
4672 {
4673 STAM_COUNTER_INC(&pVCpu->hm.s.StatDRxIoCheck);
4674 for (unsigned i = 0; i < 4; i++)
4675 {
4676 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
4677
4678 if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
4679 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
4680 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
4681 {
4682 uint64_t uDR6;
4683
4684 Assert(CPUMIsGuestDebugStateActive(pVCpu));
4685
4686 uDR6 = ASMGetDR6();
4687
4688 /* Clear all breakpoint status flags and set the one we just hit. */
4689 uDR6 &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
4690 uDR6 |= (uint64_t)RT_BIT(i);
4691
4692 /*
4693 * Note: AMD64 Architecture Programmer's Manual 13.1:
4694 * Bits 15:13 of the DR6 register is never cleared by the processor and must
4695 * be cleared by software after the contents have been read.
4696 */
4697 ASMSetDR6(uDR6);
4698
4699 /* X86_DR7_GD will be cleared if DRx accesses should be trapped inside the guest. */
4700 pCtx->dr[7] &= ~X86_DR7_GD;
4701
4702 /* Paranoia. */
4703 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
4704 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
4705 pCtx->dr[7] |= 0x400; /* must be one */
4706
4707 /* Resync DR7 */
4708 rc2 = VMXWriteVmcs64(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
4709 AssertRC(rc2);
4710
4711 /* Construct inject info. */
4712 intInfo = X86_XCPT_DB;
4713 intInfo |= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
4714 intInfo |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
4715
4716 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
4717 rc2 = hmR0VmxInjectEvent(pVM, pVCpu, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo),
4718 0 /* cbInstr */, 0 /* errCode */);
4719 AssertRC(rc2);
4720
4721 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4722 goto ResumeExecution;
4723 }
4724 }
4725 }
4726 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4727 goto ResumeExecution;
4728 }
4729 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4730 break;
4731 }
4732
4733#ifdef VBOX_STRICT
4734 if (rc == VINF_IOM_R3_IOPORT_READ)
4735 Assert(!fIOWrite);
4736 else if (rc == VINF_IOM_R3_IOPORT_WRITE)
4737 Assert(fIOWrite);
4738 else
4739 {
4740 AssertMsg( RT_FAILURE(rc)
4741 || rc == VINF_EM_RAW_EMULATE_INSTR
4742 || rc == VINF_EM_RAW_GUEST_TRAP
4743 || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", VBOXSTRICTRC_VAL(rc)));
4744 }
4745#endif
4746 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
4747 break;
4748 }
4749
4750 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4751 LogFlow(("VMX_EXIT_TPR_BELOW_THRESHOLD\n"));
4752 /* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
4753 goto ResumeExecution;
4754
4755 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4756 on the APIC-access page. */
4757 {
4758 LogFlow(("VMX_EXIT_APIC_ACCESS\n"));
4759 unsigned uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(exitQualification);
4760
4761 switch (uAccessType)
4762 {
4763 case VMX_APIC_ACCESS_TYPE_LINEAR_READ:
4764 case VMX_APIC_ACCESS_TYPE_LINEAR_WRITE:
4765 {
4766 RTGCPHYS GCPhys = pCtx->msrApicBase;
4767 GCPhys &= PAGE_BASE_GC_MASK;
4768 GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(exitQualification);
4769
4770 LogFlow(("Apic access at %RGp\n", GCPhys));
4771 rc = IOMMMIOPhysHandler(pVM, pVCpu, (uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ) ? 0 : X86_TRAP_PF_RW,
4772 CPUMCTX2CORE(pCtx), GCPhys);
4773 if (rc == VINF_SUCCESS)
4774 goto ResumeExecution; /* rip already updated */
4775 break;
4776 }
4777
4778 default:
4779 rc = VINF_EM_RAW_EMULATE_INSTR;
4780 break;
4781 }
4782 break;
4783 }
4784
4785 case VMX_EXIT_PREEMPT_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4786 if (!TMTimerPollBool(pVM, pVCpu))
4787 goto ResumeExecution;
4788 rc = VINF_EM_RAW_TIMER_PENDING;
4789 break;
4790
4791 default:
4792 /* The rest is handled after syncing the entire CPU state. */
4793 break;
4794 }
4795
4796
4797 /*
4798 * Note: The guest state is not entirely synced back at this stage!
4799 */
4800
4801 /* Investigate why there was a VM-exit. (part 2) */
4802 switch (exitReason)
4803 {
4804 case VMX_EXIT_XCPT_NMI: /* 0 Exception or non-maskable interrupt (NMI). */
4805 case VMX_EXIT_EXT_INT: /* 1 External interrupt. */
4806 case VMX_EXIT_EPT_VIOLATION:
4807 case VMX_EXIT_EPT_MISCONFIG: /* 49 EPT misconfig is used by the PGM/MMIO optimizations. */
4808 case VMX_EXIT_PREEMPT_TIMER: /* 52 VMX-preemption timer expired. The preemption timer counted down to zero. */
4809 /* Already handled above. */
4810 break;
4811
4812 case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
4813 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
4814 break;
4815
4816 case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
4817 case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
4818 rc = VINF_EM_RAW_INTERRUPT;
4819 AssertFailed(); /* Can't happen. Yet. */
4820 break;
4821
4822 case VMX_EXIT_IO_SMI: /* 5 I/O system-management interrupt (SMI). */
4823 case VMX_EXIT_SMI: /* 6 Other SMI. */
4824 rc = VINF_EM_RAW_INTERRUPT;
4825 AssertFailed(); /* Can't happen afaik. */
4826 break;
4827
4828 case VMX_EXIT_TASK_SWITCH: /* 9 Task switch: too complicated to emulate, so fall back to the recompiler */
4829 Log(("VMX_EXIT_TASK_SWITCH: exit=%RX64\n", exitQualification));
4830 if ( (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(exitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
4831 && pVCpu->hm.s.Event.fPending)
4832 {
4833 /* Caused by an injected interrupt. */
4834 pVCpu->hm.s.Event.fPending = false;
4835
4836 Log(("VMX_EXIT_TASK_SWITCH: reassert trap %d\n", VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo)));
4837 Assert(!VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVCpu->hm.s.Event.u64IntrInfo));
4838 //@todo: Why do we assume this had to be a hardware interrupt? What about software interrupts or exceptions?
4839 rc2 = TRPMAssertTrap(pVCpu, VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVCpu->hm.s.Event.u64IntrInfo), TRPM_HARDWARE_INT);
4840 AssertRC(rc2);
4841 }
4842 /* else Exceptions and software interrupts can just be restarted. */
4843 rc = VERR_EM_INTERPRETER;
4844 break;
4845
4846 case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
4847 /* Check if external interrupts are pending; if so, don't switch back. */
4848 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
4849 pCtx->rip++; /* skip hlt */
4850 if (EMShouldContinueAfterHalt(pVCpu, pCtx))
4851 goto ResumeExecution;
4852
4853 rc = VINF_EM_HALT;
4854 break;
4855
4856 case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
4857 Log2(("VMX: mwait\n"));
4858 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMwait);
4859 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
4860 if ( rc == VINF_EM_HALT
4861 || rc == VINF_SUCCESS)
4862 {
4863 /* Update EIP and continue execution. */
4864 pCtx->rip += cbInstr;
4865
4866 /* Check if external interrupts are pending; if so, don't switch back. */
4867 if ( rc == VINF_SUCCESS
4868 || ( rc == VINF_EM_HALT
4869 && EMShouldContinueAfterHalt(pVCpu, pCtx))
4870 )
4871 goto ResumeExecution;
4872 }
4873 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", VBOXSTRICTRC_VAL(rc)));
4874 break;
4875
4876 case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
4877 AssertFailed(); /* can't happen. */
4878 rc = VERR_EM_INTERPRETER;
4879 break;
4880
4881 case VMX_EXIT_MTF: /* 37 Exit due to Monitor Trap Flag. */
4882 LogFlow(("VMX_EXIT_MTF at %RGv\n", (RTGCPTR)pCtx->rip));
4883 pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG;
4884 rc2 = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
4885 AssertRC(rc2);
4886 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitMtf);
4887#if 0
4888 DBGFDoneStepping(pVCpu);
4889#endif
4890 rc = VINF_EM_DBG_STOP;
4891 break;
4892
4893 case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
4894 case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
4895 case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
4896 case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
4897 case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
4898 case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
4899 case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
4900 case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
4901 case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
4902 case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
4903 /** @todo inject #UD immediately */
4904 rc = VERR_EM_INTERPRETER;
4905 break;
4906
4907 case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
4908 case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
4909 case VMX_EXIT_INVLPG: /* 14 Guest software attempted to execute INVLPG. */
4910 case VMX_EXIT_MOV_CRX: /* 28 Control-register accesses. */
4911 case VMX_EXIT_MOV_DRX: /* 29 Debug-register accesses. */
4912 case VMX_EXIT_IO_INSTR: /* 30 I/O instruction. */
4913 case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
4914 case VMX_EXIT_RDTSCP: /* 51 Guest software attempted to execute RDTSCP. */
4915 /* already handled above */
4916 AssertMsg( rc == VINF_PGM_CHANGE_MODE
4917 || rc == VINF_EM_RAW_INTERRUPT
4918 || rc == VERR_EM_INTERPRETER
4919 || rc == VINF_EM_RAW_EMULATE_INSTR
4920 || rc == VINF_PGM_SYNC_CR3
4921 || rc == VINF_IOM_R3_IOPORT_READ
4922 || rc == VINF_IOM_R3_IOPORT_WRITE
4923 || rc == VINF_EM_RAW_GUEST_TRAP
4924 || rc == VINF_TRPM_XCPT_DISPATCHED
4925 || rc == VINF_EM_RESCHEDULE_REM,
4926 ("rc = %d\n", VBOXSTRICTRC_VAL(rc)));
4927 break;
4928
4929 case VMX_EXIT_TPR_BELOW_THRESHOLD: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
4930 case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
4931 case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
4932 case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
4933 case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
4934 case VMX_EXIT_APIC_ACCESS: /* 44 APIC access. Guest software attempted to access memory at a physical address
4935 on the APIC-access page. */
4936 {
4937 /*
4938 * If we decided to emulate them here, then we must sync the MSRs that could have been changed (sysenter, FS/GS base)
4939 */
4940 rc = VERR_EM_INTERPRETER;
4941 break;
4942 }
4943
4944 case VMX_EXIT_INT_WINDOW: /* 7 Interrupt window. */
4945 Assert(rc == VINF_EM_RAW_INTERRUPT);
4946 break;
4947
4948 case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
4949 {
4950#ifdef VBOX_STRICT
4951 RTCCUINTREG val2 = 0;
4952
4953 Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
4954
4955 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val2);
4956 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val2));
4957
4958 VMXReadVmcs(VMX_VMCS_GUEST_CR0, &val2);
4959 Log(("VMX_VMCS_GUEST_CR0 %RX64\n", (uint64_t)val2));
4960
4961 VMXReadVmcs(VMX_VMCS_GUEST_CR3, &val2);
4962 Log(("VMX_VMCS_GUEST_CR3 %RX64\n", (uint64_t)val2));
4963
4964 VMXReadVmcs(VMX_VMCS_GUEST_CR4, &val2);
4965 Log(("VMX_VMCS_GUEST_CR4 %RX64\n", (uint64_t)val2));
4966
4967 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val2);
4968 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val2));
4969
4970 VMX_LOG_SELREG(CS, "CS", val2);
4971 VMX_LOG_SELREG(DS, "DS", val2);
4972 VMX_LOG_SELREG(ES, "ES", val2);
4973 VMX_LOG_SELREG(FS, "FS", val2);
4974 VMX_LOG_SELREG(GS, "GS", val2);
4975 VMX_LOG_SELREG(SS, "SS", val2);
4976 VMX_LOG_SELREG(TR, "TR", val2);
4977 VMX_LOG_SELREG(LDTR, "LDTR", val2);
4978
4979 VMXReadVmcs(VMX_VMCS_GUEST_GDTR_BASE, &val2);
4980 Log(("VMX_VMCS_GUEST_GDTR_BASE %RX64\n", (uint64_t)val2));
4981 VMXReadVmcs(VMX_VMCS_GUEST_IDTR_BASE, &val2);
4982 Log(("VMX_VMCS_GUEST_IDTR_BASE %RX64\n", (uint64_t)val2));
4983#endif /* VBOX_STRICT */
4984 rc = VERR_VMX_INVALID_GUEST_STATE;
4985 break;
4986 }
4987
4988 case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
4989 case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
4990 default:
4991 rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
4992 AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
4993 break;
4994
4995 }
4996
4997end:
4998 /* We now going back to ring-3, so clear the action flag. */
4999 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
5000
5001 /*
5002 * Signal changes for the recompiler.
5003 */
5004 CPUMSetChangedFlags(pVCpu,
5005 CPUM_CHANGED_SYSENTER_MSR
5006 | CPUM_CHANGED_LDTR
5007 | CPUM_CHANGED_GDTR
5008 | CPUM_CHANGED_IDTR
5009 | CPUM_CHANGED_TR
5010 | CPUM_CHANGED_HIDDEN_SEL_REGS);
5011
5012 /*
5013 * If we executed vmlaunch/vmresume and an external IRQ was pending, then we don't have to do a full sync the next time.
5014 */
5015 if ( exitReason == VMX_EXIT_EXT_INT
5016 && !VMX_EXIT_INTERRUPTION_INFO_IS_VALID(intInfo))
5017 {
5018 /* On the next entry we'll only sync the host context. */
5019 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT;
5020 }
5021 else
5022 {
5023 /* On the next entry we'll sync everything. */
5024 /** @todo we can do better than this */
5025 /* Not in the VINF_PGM_CHANGE_MODE though! */
5026 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_HOST_CONTEXT | HM_CHANGED_ALL_GUEST;
5027 }
5028
5029 /* Translate into a less severe return code */
5030 if (rc == VERR_EM_INTERPRETER)
5031 rc = VINF_EM_RAW_EMULATE_INSTR;
5032 else if (rc == VERR_VMX_INVALID_VMCS_PTR)
5033 {
5034 /* Try to extract more information about what might have gone wrong here. */
5035 VMXGetActivateVMCS(&pVCpu->hm.s.vmx.lasterror.u64VMCSPhys);
5036 pVCpu->hm.s.vmx.lasterror.u32VMCSRevision = *(uint32_t *)pVCpu->hm.s.vmx.pvVmcs;
5037 pVCpu->hm.s.vmx.lasterror.idEnteredCpu = pVCpu->hm.s.idEnteredCpu;
5038 pVCpu->hm.s.vmx.lasterror.idCurrentCpu = RTMpCpuId();
5039 }
5040
5041 /* Just set the correct state here instead of trying to catch every goto above. */
5042 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED_HM, VMCPUSTATE_STARTED_EXEC);
5043
5044#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
5045 /* Restore interrupts if we exited after disabling them. */
5046 if (uOldEFlags != ~(RTCCUINTREG)0)
5047 ASMSetFlags(uOldEFlags);
5048#endif
5049
5050 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5051 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
5052 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatEntry, x);
5053 STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchExitToR3);
5054 Log2(("X"));
5055 return VBOXSTRICTRC_TODO(rc);
5056}
5057
5058
5059/**
5060 * Enters the VT-x session.
5061 *
5062 * @returns VBox status code.
5063 * @param pVM Pointer to the VM.
5064 * @param pVCpu Pointer to the VMCPU.
5065 * @param pCpu Pointer to the CPU info struct.
5066 */
5067VMMR0DECL(int) VMXR0Enter(PVM pVM, PVMCPU pVCpu, PHMGLOBLCPUINFO pCpu)
5068{
5069 Assert(pVM->hm.s.vmx.fSupported);
5070 NOREF(pCpu);
5071
5072 unsigned cr4 = ASMGetCR4();
5073 if (!(cr4 & X86_CR4_VMXE))
5074 {
5075 AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
5076 return VERR_VMX_X86_CR4_VMXE_CLEARED;
5077 }
5078
5079 /* Activate the VMCS. */
5080 int rc = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5081 if (RT_FAILURE(rc))
5082 return rc;
5083
5084 pVCpu->hm.s.fResumeVM = false;
5085 return VINF_SUCCESS;
5086}
5087
5088
5089/**
5090 * Leaves the VT-x session.
5091 *
5092 * @returns VBox status code.
5093 * @param pVM Pointer to the VM.
5094 * @param pVCpu Pointer to the VMCPU.
5095 * @param pCtx Pointer to the guests CPU context.
5096 */
5097VMMR0DECL(int) VMXR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
5098{
5099 Assert(pVM->hm.s.vmx.fSupported);
5100
5101#ifdef DEBUG
5102 if (CPUMIsHyperDebugStateActive(pVCpu))
5103 {
5104 CPUMR0LoadHostDebugState(pVM, pVCpu);
5105 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT);
5106 }
5107 else
5108#endif
5109
5110 /*
5111 * Save the guest debug state if necessary.
5112 */
5113 if (CPUMIsGuestDebugStateActive(pVCpu))
5114 {
5115 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, true /* save DR6 */);
5116
5117 /* Enable DRx move intercepts again. */
5118 pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
5119 int rc = VMXWriteVmcs(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
5120 AssertRC(rc);
5121
5122 /* Resync the debug registers the next time. */
5123 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
5124 }
5125 else
5126 Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT);
5127
5128 /*
5129 * Clear VMCS, marking it inactive, clearing implementation-specific data and writing
5130 * VMCS data back to memory.
5131 */
5132 int rc = VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5133 AssertRC(rc);
5134
5135 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2, x);
5136 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
5137 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
5138 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
5139 return VINF_SUCCESS;
5140}
5141
5142
5143/**
5144 * Flush the TLB using EPT.
5145 *
5146 * @returns VBox status code.
5147 * @param pVM Pointer to the VM.
5148 * @param pVCpu Pointer to the VMCPU.
5149 * @param enmFlush Type of flush.
5150 */
5151static void hmR0VmxFlushEPT(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_EPT enmFlush)
5152{
5153 uint64_t descriptor[2];
5154
5155 LogFlow(("hmR0VmxFlushEPT %d\n", enmFlush));
5156 Assert(pVM->hm.s.fNestedPaging);
5157 descriptor[0] = pVCpu->hm.s.vmx.HCPhysEPTP;
5158 descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
5159 int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
5160 AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.HCPhysEPTP, rc));
5161#ifdef VBOX_WITH_STATISTICS
5162 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
5163#endif
5164}
5165
5166
5167/**
5168 * Flush the TLB using VPID.
5169 *
5170 * @returns VBox status code.
5171 * @param pVM Pointer to the VM.
5172 * @param pVCpu Pointer to the VMCPU (can be NULL depending on @a
5173 * enmFlush).
5174 * @param enmFlush Type of flush.
5175 * @param GCPtr Virtual address of the page to flush (can be 0 depending
5176 * on @a enmFlush).
5177 */
5178static void hmR0VmxFlushVPID(PVM pVM, PVMCPU pVCpu, VMX_FLUSH_VPID enmFlush, RTGCPTR GCPtr)
5179{
5180 uint64_t descriptor[2];
5181
5182 Assert(pVM->hm.s.vmx.fVpid);
5183 if (enmFlush == VMX_FLUSH_VPID_ALL_CONTEXTS)
5184 {
5185 descriptor[0] = 0;
5186 descriptor[1] = 0;
5187 }
5188 else
5189 {
5190 AssertPtr(pVCpu);
5191 AssertMsg(pVCpu->hm.s.uCurrentAsid != 0, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5192 AssertMsg(pVCpu->hm.s.uCurrentAsid <= UINT16_MAX, ("VMXR0InvVPID invalid ASID %lu\n", pVCpu->hm.s.uCurrentAsid));
5193 descriptor[0] = pVCpu->hm.s.uCurrentAsid;
5194 descriptor[1] = GCPtr;
5195 }
5196 int rc = VMXR0InvVPID(enmFlush, &descriptor[0]); NOREF(rc);
5197 AssertMsg(rc == VINF_SUCCESS,
5198 ("VMXR0InvVPID %x %x %RGv failed with %d\n", enmFlush, pVCpu ? pVCpu->hm.s.uCurrentAsid : 0, GCPtr, rc));
5199#ifdef VBOX_WITH_STATISTICS
5200 if (pVCpu)
5201 STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushAsid);
5202#endif
5203}
5204
5205
5206/**
5207 * Invalidates a guest page by guest virtual address. Only relevant for
5208 * EPT/VPID, otherwise there is nothing really to invalidate.
5209 *
5210 * @returns VBox status code.
5211 * @param pVM Pointer to the VM.
5212 * @param pVCpu Pointer to the VMCPU.
5213 * @param GCVirt Guest virtual address of the page to invalidate.
5214 */
5215VMMR0DECL(int) VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
5216{
5217 bool fFlushPending = VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5218
5219 Log2(("VMXR0InvalidatePage %RGv\n", GCVirt));
5220
5221 if (!fFlushPending)
5222 {
5223 /*
5224 * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
5225 * See @bugref{6043} and @bugref{6177}
5226 *
5227 * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VMENTRY in hmR0VmxSetupTLB*() as this
5228 * function maybe called in a loop with individual addresses.
5229 */
5230 if (pVM->hm.s.vmx.fVpid)
5231 {
5232 /* If we can flush just this page do it, otherwise flush as little as possible. */
5233 if (pVM->hm.s.vmx.msr.vmx_ept_vpid_caps & MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR)
5234 hmR0VmxFlushVPID(pVM, pVCpu, VMX_FLUSH_VPID_INDIV_ADDR, GCVirt);
5235 else
5236 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5237 }
5238 else if (pVM->hm.s.fNestedPaging)
5239 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5240 }
5241
5242 return VINF_SUCCESS;
5243}
5244
5245
5246/**
5247 * Invalidates a guest page by physical address. Only relevant for EPT/VPID,
5248 * otherwise there is nothing really to invalidate.
5249 *
5250 * NOTE: Assumes the current instruction references this physical page though a virtual address!!
5251 *
5252 * @returns VBox status code.
5253 * @param pVM Pointer to the VM.
5254 * @param pVCpu Pointer to the VMCPU.
5255 * @param GCPhys Guest physical address of the page to invalidate.
5256 */
5257VMMR0DECL(int) VMXR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
5258{
5259 LogFlow(("VMXR0InvalidatePhysPage %RGp\n", GCPhys));
5260
5261 /*
5262 * We cannot flush a page by guest-physical address. invvpid takes only a linear address
5263 * while invept only flushes by EPT not individual addresses. We update the force flag here
5264 * and flush before VMENTRY in hmR0VmxSetupTLB*(). This function might be called in a loop.
5265 */
5266 VMCPU_FF_SET(pVCpu, VMCPU_FF_TLB_FLUSH);
5267 return VINF_SUCCESS;
5268}
5269
5270
5271/**
5272 * Report world switch error and dump some useful debug info.
5273 *
5274 * @param pVM Pointer to the VM.
5275 * @param pVCpu Pointer to the VMCPU.
5276 * @param rc Return code.
5277 * @param pCtx Pointer to the current guest CPU context (not updated).
5278 */
5279static void hmR0VmxReportWorldSwitchError(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rc, PCPUMCTX pCtx)
5280{
5281 NOREF(pVM);
5282
5283 switch (VBOXSTRICTRC_VAL(rc))
5284 {
5285 case VERR_VMX_INVALID_VMXON_PTR:
5286 AssertFailed();
5287 break;
5288
5289 case VERR_VMX_UNABLE_TO_START_VM:
5290 {
5291 int rc2;
5292 RTCCUINTREG exitReason, instrError;
5293
5294 rc2 = VMXReadVmcs(VMX_VMCS32_RO_EXIT_REASON, &exitReason);
5295 rc2 |= VMXReadVmcs(VMX_VMCS32_RO_VM_INSTR_ERROR, &instrError);
5296 AssertRC(rc2);
5297 if (rc2 == VINF_SUCCESS)
5298 {
5299 Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason,
5300 (uint32_t)instrError));
5301 Log(("Current stack %08x\n", &rc2));
5302
5303 pVCpu->hm.s.vmx.lasterror.u32InstrError = instrError;
5304 pVCpu->hm.s.vmx.lasterror.u32ExitReason = exitReason;
5305
5306#ifdef VBOX_STRICT
5307 RTGDTR gdtr;
5308 PCX86DESCHC pDesc;
5309 RTCCUINTREG val;
5310
5311 ASMGetGDTR(&gdtr);
5312
5313 VMXReadVmcs(VMX_VMCS_GUEST_RIP, &val);
5314 Log(("Old eip %RGv new %RGv\n", (RTGCPTR)pCtx->rip, (RTGCPTR)val));
5315 VMXReadVmcs(VMX_VMCS32_CTRL_PIN_EXEC, &val);
5316 Log(("VMX_VMCS_CTRL_PIN_EXEC %08x\n", val));
5317 VMXReadVmcs(VMX_VMCS32_CTRL_PROC_EXEC, &val);
5318 Log(("VMX_VMCS_CTRL_PROC_EXEC %08x\n", val));
5319 VMXReadVmcs(VMX_VMCS32_CTRL_ENTRY, &val);
5320 Log(("VMX_VMCS_CTRL_ENTRY %08x\n", val));
5321 VMXReadVmcs(VMX_VMCS32_CTRL_EXIT, &val);
5322 Log(("VMX_VMCS_CTRL_EXIT %08x\n", val));
5323
5324 VMXReadVmcs(VMX_VMCS_HOST_CR0, &val);
5325 Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
5326 VMXReadVmcs(VMX_VMCS_HOST_CR3, &val);
5327 Log(("VMX_VMCS_HOST_CR3 %08x\n", val));
5328 VMXReadVmcs(VMX_VMCS_HOST_CR4, &val);
5329 Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
5330
5331 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_CS, &val);
5332 Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
5333 VMXReadVmcs(VMX_VMCS_GUEST_RFLAGS, &val);
5334 Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
5335
5336 if (val < gdtr.cbGdt)
5337 {
5338 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5339 HMR0DumpDescriptor(pDesc, val, "CS: ");
5340 }
5341
5342 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_DS, &val);
5343 Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
5344 if (val < gdtr.cbGdt)
5345 {
5346 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5347 HMR0DumpDescriptor(pDesc, val, "DS: ");
5348 }
5349
5350 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_ES, &val);
5351 Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
5352 if (val < gdtr.cbGdt)
5353 {
5354 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5355 HMR0DumpDescriptor(pDesc, val, "ES: ");
5356 }
5357
5358 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_FS, &val);
5359 Log(("VMX_VMCS16_HOST_FIELD_FS %08x\n", val));
5360 if (val < gdtr.cbGdt)
5361 {
5362 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5363 HMR0DumpDescriptor(pDesc, val, "FS: ");
5364 }
5365
5366 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_GS, &val);
5367 Log(("VMX_VMCS16_HOST_FIELD_GS %08x\n", val));
5368 if (val < gdtr.cbGdt)
5369 {
5370 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5371 HMR0DumpDescriptor(pDesc, val, "GS: ");
5372 }
5373
5374 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_SS, &val);
5375 Log(("VMX_VMCS16_HOST_FIELD_SS %08x\n", val));
5376 if (val < gdtr.cbGdt)
5377 {
5378 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5379 HMR0DumpDescriptor(pDesc, val, "SS: ");
5380 }
5381
5382 VMXReadVmcs(VMX_VMCS16_HOST_FIELD_TR, &val);
5383 Log(("VMX_VMCS16_HOST_FIELD_TR %08x\n", val));
5384 if (val < gdtr.cbGdt)
5385 {
5386 pDesc = (PCX86DESCHC)(gdtr.pGdt + (val & X86_SEL_MASK));
5387 HMR0DumpDescriptor(pDesc, val, "TR: ");
5388 }
5389
5390 VMXReadVmcs(VMX_VMCS_HOST_TR_BASE, &val);
5391 Log(("VMX_VMCS_HOST_TR_BASE %RHv\n", val));
5392 VMXReadVmcs(VMX_VMCS_HOST_GDTR_BASE, &val);
5393 Log(("VMX_VMCS_HOST_GDTR_BASE %RHv\n", val));
5394 VMXReadVmcs(VMX_VMCS_HOST_IDTR_BASE, &val);
5395 Log(("VMX_VMCS_HOST_IDTR_BASE %RHv\n", val));
5396 VMXReadVmcs(VMX_VMCS32_HOST_SYSENTER_CS, &val);
5397 Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
5398 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_EIP, &val);
5399 Log(("VMX_VMCS_HOST_SYSENTER_EIP %RHv\n", val));
5400 VMXReadVmcs(VMX_VMCS_HOST_SYSENTER_ESP, &val);
5401 Log(("VMX_VMCS_HOST_SYSENTER_ESP %RHv\n", val));
5402 VMXReadVmcs(VMX_VMCS_HOST_RSP, &val);
5403 Log(("VMX_VMCS_HOST_RSP %RHv\n", val));
5404 VMXReadVmcs(VMX_VMCS_HOST_RIP, &val);
5405 Log(("VMX_VMCS_HOST_RIP %RHv\n", val));
5406# if HC_ARCH_BITS == 64 || defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5407 if (VMX_IS_64BIT_HOST_MODE())
5408 {
5409 Log(("MSR_K6_EFER = %RX64\n", ASMRdMsr(MSR_K6_EFER)));
5410 Log(("MSR_K6_STAR = %RX64\n", ASMRdMsr(MSR_K6_STAR)));
5411 Log(("MSR_K8_LSTAR = %RX64\n", ASMRdMsr(MSR_K8_LSTAR)));
5412 Log(("MSR_K8_CSTAR = %RX64\n", ASMRdMsr(MSR_K8_CSTAR)));
5413 Log(("MSR_K8_SF_MASK = %RX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
5414 Log(("MSR_K8_KERNEL_GS_BASE = %RX64\n", ASMRdMsr(MSR_K8_KERNEL_GS_BASE)));
5415 }
5416# endif
5417#endif /* VBOX_STRICT */
5418 }
5419 break;
5420 }
5421
5422 default:
5423 /* impossible */
5424 AssertMsgFailed(("%Rrc (%#x)\n", VBOXSTRICTRC_VAL(rc), VBOXSTRICTRC_VAL(rc)));
5425 break;
5426 }
5427}
5428
5429
5430#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5431/**
5432 * Prepares for and executes VMLAUNCH (64 bits guest mode).
5433 *
5434 * @returns VBox status code.
5435 * @param fResume Whether to vmlauch/vmresume.
5436 * @param pCtx Pointer to the guest CPU context.
5437 * @param pCache Pointer to the VMCS cache.
5438 * @param pVM Pointer to the VM.
5439 * @param pVCpu Pointer to the VMCPU.
5440 */
5441DECLASM(int) VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu)
5442{
5443 uint32_t aParam[6];
5444 PHMGLOBLCPUINFO pCpu;
5445 RTHCPHYS HCPhysCpuPage;
5446 int rc;
5447
5448 pCpu = HMR0GetCurrentCpu();
5449 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5450
5451#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5452 pCache->uPos = 1;
5453 pCache->interPD = PGMGetInterPaeCR3(pVM);
5454 pCache->pSwitcher = (uint64_t)pVM->hm.s.pfnHost32ToGuest64R0;
5455#endif
5456
5457#ifdef DEBUG
5458 pCache->TestIn.HCPhysCpuPage= 0;
5459 pCache->TestIn.HCPhysVmcs = 0;
5460 pCache->TestIn.pCache = 0;
5461 pCache->TestOut.HCPhysVmcs = 0;
5462 pCache->TestOut.pCache = 0;
5463 pCache->TestOut.pCtx = 0;
5464 pCache->TestOut.eflags = 0;
5465#endif
5466
5467 aParam[0] = (uint32_t)(HCPhysCpuPage); /* Param 1: VMXON physical address - Lo. */
5468 aParam[1] = (uint32_t)(HCPhysCpuPage >> 32); /* Param 1: VMXON physical address - Hi. */
5469 aParam[2] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs); /* Param 2: VMCS physical address - Lo. */
5470 aParam[3] = (uint32_t)(pVCpu->hm.s.vmx.HCPhysVmcs >> 32); /* Param 2: VMCS physical address - Hi. */
5471 aParam[4] = VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache);
5472 aParam[5] = 0;
5473
5474#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5475 pCtx->dr[4] = pVM->hm.s.vmx.pScratchPhys + 16 + 8;
5476 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 1;
5477#endif
5478 rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_VMXRCStartVM64, 6, &aParam[0]);
5479
5480#ifdef VBOX_WITH_CRASHDUMP_MAGIC
5481 Assert(*(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) == 5);
5482 Assert(pCtx->dr[4] == 10);
5483 *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 0xff;
5484#endif
5485
5486#ifdef DEBUG
5487 AssertMsg(pCache->TestIn.HCPhysCpuPage== HCPhysCpuPage, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysCpuPage, HCPhysCpuPage));
5488 AssertMsg(pCache->TestIn.HCPhysVmcs == pVCpu->hm.s.vmx.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5489 pVCpu->hm.s.vmx.HCPhysVmcs));
5490 AssertMsg(pCache->TestIn.HCPhysVmcs == pCache->TestOut.HCPhysVmcs, ("%RHp vs %RHp\n", pCache->TestIn.HCPhysVmcs,
5491 pCache->TestOut.HCPhysVmcs));
5492 AssertMsg(pCache->TestIn.pCache == pCache->TestOut.pCache, ("%RGv vs %RGv\n", pCache->TestIn.pCache,
5493 pCache->TestOut.pCache));
5494 AssertMsg(pCache->TestIn.pCache == VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache),
5495 ("%RGv vs %RGv\n", pCache->TestIn.pCache, VM_RC_ADDR(pVM, &pVM->aCpus[pVCpu->idCpu].hm.s.vmx.VMCSCache)));
5496 AssertMsg(pCache->TestIn.pCtx == pCache->TestOut.pCtx, ("%RGv vs %RGv\n", pCache->TestIn.pCtx,
5497 pCache->TestOut.pCtx));
5498 Assert(!(pCache->TestOut.eflags & X86_EFL_IF));
5499#endif
5500 return rc;
5501}
5502
5503
5504#ifdef VBOX_STRICT
5505static bool hmR0VmxIsValidReadField(uint32_t idxField)
5506{
5507 switch (idxField)
5508 {
5509 case VMX_VMCS_GUEST_RIP:
5510 case VMX_VMCS_GUEST_RSP:
5511 case VMX_VMCS_GUEST_RFLAGS:
5512 case VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE:
5513 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
5514 case VMX_VMCS_GUEST_CR0:
5515 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
5516 case VMX_VMCS_GUEST_CR4:
5517 case VMX_VMCS_GUEST_DR7:
5518 case VMX_VMCS32_GUEST_SYSENTER_CS:
5519 case VMX_VMCS_GUEST_SYSENTER_EIP:
5520 case VMX_VMCS_GUEST_SYSENTER_ESP:
5521 case VMX_VMCS32_GUEST_GDTR_LIMIT:
5522 case VMX_VMCS_GUEST_GDTR_BASE:
5523 case VMX_VMCS32_GUEST_IDTR_LIMIT:
5524 case VMX_VMCS_GUEST_IDTR_BASE:
5525 case VMX_VMCS16_GUEST_FIELD_CS:
5526 case VMX_VMCS32_GUEST_CS_LIMIT:
5527 case VMX_VMCS_GUEST_CS_BASE:
5528 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
5529 case VMX_VMCS16_GUEST_FIELD_DS:
5530 case VMX_VMCS32_GUEST_DS_LIMIT:
5531 case VMX_VMCS_GUEST_DS_BASE:
5532 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
5533 case VMX_VMCS16_GUEST_FIELD_ES:
5534 case VMX_VMCS32_GUEST_ES_LIMIT:
5535 case VMX_VMCS_GUEST_ES_BASE:
5536 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
5537 case VMX_VMCS16_GUEST_FIELD_FS:
5538 case VMX_VMCS32_GUEST_FS_LIMIT:
5539 case VMX_VMCS_GUEST_FS_BASE:
5540 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
5541 case VMX_VMCS16_GUEST_FIELD_GS:
5542 case VMX_VMCS32_GUEST_GS_LIMIT:
5543 case VMX_VMCS_GUEST_GS_BASE:
5544 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
5545 case VMX_VMCS16_GUEST_FIELD_SS:
5546 case VMX_VMCS32_GUEST_SS_LIMIT:
5547 case VMX_VMCS_GUEST_SS_BASE:
5548 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
5549 case VMX_VMCS16_GUEST_FIELD_LDTR:
5550 case VMX_VMCS32_GUEST_LDTR_LIMIT:
5551 case VMX_VMCS_GUEST_LDTR_BASE:
5552 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
5553 case VMX_VMCS16_GUEST_FIELD_TR:
5554 case VMX_VMCS32_GUEST_TR_LIMIT:
5555 case VMX_VMCS_GUEST_TR_BASE:
5556 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
5557 case VMX_VMCS32_RO_EXIT_REASON:
5558 case VMX_VMCS32_RO_VM_INSTR_ERROR:
5559 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
5560 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
5561 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
5562 case VMX_VMCS32_RO_EXIT_INSTR_INFO:
5563 case VMX_VMCS_RO_EXIT_QUALIFICATION:
5564 case VMX_VMCS32_RO_IDT_INFO:
5565 case VMX_VMCS32_RO_IDT_ERROR_CODE:
5566 case VMX_VMCS_GUEST_CR3:
5567 case VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL:
5568 return true;
5569 }
5570 return false;
5571}
5572
5573
5574static bool hmR0VmxIsValidWriteField(uint32_t idxField)
5575{
5576 switch (idxField)
5577 {
5578 case VMX_VMCS_GUEST_LDTR_BASE:
5579 case VMX_VMCS_GUEST_TR_BASE:
5580 case VMX_VMCS_GUEST_GDTR_BASE:
5581 case VMX_VMCS_GUEST_IDTR_BASE:
5582 case VMX_VMCS_GUEST_SYSENTER_EIP:
5583 case VMX_VMCS_GUEST_SYSENTER_ESP:
5584 case VMX_VMCS_GUEST_CR0:
5585 case VMX_VMCS_GUEST_CR4:
5586 case VMX_VMCS_GUEST_CR3:
5587 case VMX_VMCS_GUEST_DR7:
5588 case VMX_VMCS_GUEST_RIP:
5589 case VMX_VMCS_GUEST_RSP:
5590 case VMX_VMCS_GUEST_CS_BASE:
5591 case VMX_VMCS_GUEST_DS_BASE:
5592 case VMX_VMCS_GUEST_ES_BASE:
5593 case VMX_VMCS_GUEST_FS_BASE:
5594 case VMX_VMCS_GUEST_GS_BASE:
5595 case VMX_VMCS_GUEST_SS_BASE:
5596 return true;
5597 }
5598 return false;
5599}
5600#endif /* VBOX_STRICT */
5601
5602
5603/**
5604 * Executes the specified handler in 64-bit mode.
5605 *
5606 * @returns VBox status code.
5607 * @param pVM Pointer to the VM.
5608 * @param pVCpu Pointer to the VMCPU.
5609 * @param pCtx Pointer to the guest CPU context.
5610 * @param enmOp The operation to perform.
5611 * @param cbParam Number of parameters.
5612 * @param paParam Array of 32-bit parameters.
5613 */
5614VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, HM64ON32OP enmOp, uint32_t cbParam,
5615 uint32_t *paParam)
5616{
5617 int rc, rc2;
5618 PHMGLOBLCPUINFO pCpu;
5619 RTHCPHYS HCPhysCpuPage;
5620 RTHCUINTREG uOldEFlags;
5621
5622 AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
5623 Assert(enmOp > HM64ON32OP_INVALID && enmOp < HM64ON32OP_END);
5624 Assert(pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Write.aField));
5625 Assert(pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries <= RT_ELEMENTS(pVCpu->hm.s.vmx.VMCSCache.Read.aField));
5626
5627#ifdef VBOX_STRICT
5628 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Write.cValidEntries;i++)
5629 Assert(hmR0VmxIsValidWriteField(pVCpu->hm.s.vmx.VMCSCache.Write.aField[i]));
5630
5631 for (unsigned i=0;i<pVCpu->hm.s.vmx.VMCSCache.Read.cValidEntries;i++)
5632 Assert(hmR0VmxIsValidReadField(pVCpu->hm.s.vmx.VMCSCache.Read.aField[i]));
5633#endif
5634
5635 /* Disable interrupts. */
5636 uOldEFlags = ASMIntDisableFlags();
5637
5638#ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
5639 RTCPUID idHostCpu = RTMpCpuId();
5640 CPUMR0SetLApic(pVM, idHostCpu);
5641#endif
5642
5643 pCpu = HMR0GetCurrentCpu();
5644 HCPhysCpuPage = RTR0MemObjGetPagePhysAddr(pCpu->hMemObj, 0);
5645
5646 /* Clear VMCS. Marking it inactive, clearing implementation-specific data and writing VMCS data back to memory. */
5647 VMXClearVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5648
5649 /* Leave VMX Root Mode. */
5650 VMXDisable();
5651
5652 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5653
5654 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVCpu));
5655 CPUMSetHyperEIP(pVCpu, enmOp);
5656 for (int i=(int)cbParam-1;i>=0;i--)
5657 CPUMPushHyper(pVCpu, paParam[i]);
5658
5659 STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
5660
5661 /* Call switcher. */
5662 rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
5663 STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
5664
5665 /* Make sure the VMX instructions don't cause #UD faults. */
5666 ASMSetCR4(ASMGetCR4() | X86_CR4_VMXE);
5667
5668 /* Enter VMX Root Mode */
5669 rc2 = VMXEnable(HCPhysCpuPage);
5670 if (RT_FAILURE(rc2))
5671 {
5672 ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
5673 ASMSetFlags(uOldEFlags);
5674 return VERR_VMX_VMXON_FAILED;
5675 }
5676
5677 rc2 = VMXActivateVMCS(pVCpu->hm.s.vmx.HCPhysVmcs);
5678 AssertRC(rc2);
5679 Assert(!(ASMGetFlags() & X86_EFL_IF));
5680 ASMSetFlags(uOldEFlags);
5681 return rc;
5682}
5683#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL) */
5684
5685
5686#if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
5687/**
5688 * Executes VMWRITE.
5689 *
5690 * @returns VBox status code
5691 * @param pVCpu Pointer to the VMCPU.
5692 * @param idxField VMCS field index.
5693 * @param u64Val 16, 32 or 64 bits value.
5694 */
5695VMMR0DECL(int) VMXWriteVmcs64Ex(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5696{
5697 int rc;
5698 switch (idxField)
5699 {
5700 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
5701 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
5702 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
5703 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
5704 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
5705 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
5706 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
5707 case VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL:
5708 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
5709 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
5710 case VMX_VMCS64_GUEST_PDPTE0_FULL:
5711 case VMX_VMCS64_GUEST_PDPTE1_FULL:
5712 case VMX_VMCS64_GUEST_PDPTE2_FULL:
5713 case VMX_VMCS64_GUEST_PDPTE3_FULL:
5714 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
5715 case VMX_VMCS64_GUEST_EFER_FULL:
5716 case VMX_VMCS64_CTRL_EPTP_FULL:
5717 /* These fields consist of two parts, which are both writable in 32 bits mode. */
5718 rc = VMXWriteVmcs32(idxField, u64Val);
5719 rc |= VMXWriteVmcs32(idxField + 1, (uint32_t)(u64Val >> 32ULL));
5720 AssertRC(rc);
5721 return rc;
5722
5723 case VMX_VMCS_GUEST_LDTR_BASE:
5724 case VMX_VMCS_GUEST_TR_BASE:
5725 case VMX_VMCS_GUEST_GDTR_BASE:
5726 case VMX_VMCS_GUEST_IDTR_BASE:
5727 case VMX_VMCS_GUEST_SYSENTER_EIP:
5728 case VMX_VMCS_GUEST_SYSENTER_ESP:
5729 case VMX_VMCS_GUEST_CR0:
5730 case VMX_VMCS_GUEST_CR4:
5731 case VMX_VMCS_GUEST_CR3:
5732 case VMX_VMCS_GUEST_DR7:
5733 case VMX_VMCS_GUEST_RIP:
5734 case VMX_VMCS_GUEST_RSP:
5735 case VMX_VMCS_GUEST_CS_BASE:
5736 case VMX_VMCS_GUEST_DS_BASE:
5737 case VMX_VMCS_GUEST_ES_BASE:
5738 case VMX_VMCS_GUEST_FS_BASE:
5739 case VMX_VMCS_GUEST_GS_BASE:
5740 case VMX_VMCS_GUEST_SS_BASE:
5741 /* Queue a 64 bits value as we can't set it in 32 bits host mode. */
5742 if (u64Val >> 32ULL)
5743 rc = VMXWriteCachedVmcsEx(pVCpu, idxField, u64Val);
5744 else
5745 rc = VMXWriteVmcs32(idxField, (uint32_t)u64Val);
5746
5747 return rc;
5748
5749 default:
5750 AssertMsgFailed(("Unexpected field %x\n", idxField));
5751 return VERR_INVALID_PARAMETER;
5752 }
5753}
5754
5755
5756/**
5757 * Cache VMCS writes for running 64 bits guests on 32 bits hosts.
5758 *
5759 * @param pVCpu Pointer to the VMCPU.
5760 * @param idxField VMCS field index.
5761 * @param u64Val 16, 32 or 64 bits value.
5762 */
5763VMMR0DECL(int) VMXWriteCachedVmcsEx(PVMCPU pVCpu, uint32_t idxField, uint64_t u64Val)
5764{
5765 PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
5766
5767 AssertMsgReturn(pCache->Write.cValidEntries < VMCSCACHE_MAX_ENTRY - 1,
5768 ("entries=%x\n", pCache->Write.cValidEntries), VERR_ACCESS_DENIED);
5769
5770 /* Make sure there are no duplicates. */
5771 for (unsigned i = 0; i < pCache->Write.cValidEntries; i++)
5772 {
5773 if (pCache->Write.aField[i] == idxField)
5774 {
5775 pCache->Write.aFieldVal[i] = u64Val;
5776 return VINF_SUCCESS;
5777 }
5778 }
5779
5780 pCache->Write.aField[pCache->Write.cValidEntries] = idxField;
5781 pCache->Write.aFieldVal[pCache->Write.cValidEntries] = u64Val;
5782 pCache->Write.cValidEntries++;
5783 return VINF_SUCCESS;
5784}
5785
5786#endif /* HC_ARCH_BITS == 32 && !VBOX_WITH_HYBRID_32BIT_KERNEL */
5787
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette