HM.cpp@ 57334

Last change on this file since 57334 was 57127, checked in by vboxsync, 9 years ago
VMM/HM: Avoid duplicate line when a VT-x feature must be set.
Property svn:eol-style set to `native` Property svn:keywords set to `Id Revision`
File size: 141.5 KB

Line
1	/* $Id: HM.cpp 57127 2015-07-30 11:54:06Z vboxsync $ */
2	/** @file
3	* HM - Intel/AMD VM Hardware Support Manager.
4	*/
5
6	/*
7	* Copyright (C) 2006-2015 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*******************************************************************************
20	* Header Files *
21	*******************************************************************************/
22	#define LOG_GROUP LOG_GROUP_HM
23	#include <VBox/vmm/cpum.h>
24	#include <VBox/vmm/stam.h>
25	#include <VBox/vmm/mm.h>
26	#include <VBox/vmm/pdmapi.h>
27	#include <VBox/vmm/pgm.h>
28	#include <VBox/vmm/ssm.h>
29	#include <VBox/vmm/trpm.h>
30	#include <VBox/vmm/dbgf.h>
31	#include <VBox/vmm/iom.h>
32	#include <VBox/vmm/patm.h>
33	#include <VBox/vmm/csam.h>
34	#include <VBox/vmm/selm.h>
35	#ifdef VBOX_WITH_REM
36	# include <VBox/vmm/rem.h>
37	#endif
38	#include <VBox/vmm/hm_vmx.h>
39	#include <VBox/vmm/hm_svm.h>
40	#include "HMInternal.h"
41	#include <VBox/vmm/vm.h>
42	#include <VBox/vmm/uvm.h>
43	#include <VBox/err.h>
44	#include <VBox/param.h>
45
46	#include <iprt/assert.h>
47	#include <VBox/log.h>
48	#include <iprt/asm.h>
49	#include <iprt/asm-amd64-x86.h>
50	#include <iprt/env.h>
51	#include <iprt/thread.h>
52
53
54	/*******************************************************************************
55	* Global Variables *
56	*******************************************************************************/
57	#ifdef VBOX_WITH_STATISTICS
58	# define EXIT_REASON(def, val, str) #def " - " #val " - " str
59	# define EXIT_REASON_NIL() NULL
60	/** Exit reason descriptions for VT-x, used to describe statistics. */
61	static const char * const g_apszVTxExitReasons[MAX_EXITREASON_STAT] =
62	{
63	EXIT_REASON(VMX_EXIT_XCPT_OR_NMI , 0, "Exception or non-maskable interrupt (NMI)."),
64	EXIT_REASON(VMX_EXIT_EXT_INT , 1, "External interrupt."),
65	EXIT_REASON(VMX_EXIT_TRIPLE_FAULT , 2, "Triple fault."),
66	EXIT_REASON(VMX_EXIT_INIT_SIGNAL , 3, "INIT signal."),
67	EXIT_REASON(VMX_EXIT_SIPI , 4, "Start-up IPI (SIPI)."),
68	EXIT_REASON(VMX_EXIT_IO_SMI_IRQ , 5, "I/O system-management interrupt (SMI)."),
69	EXIT_REASON(VMX_EXIT_SMI_IRQ , 6, "Other SMI."),
70	EXIT_REASON(VMX_EXIT_INT_WINDOW , 7, "Interrupt window."),
71	EXIT_REASON(VMX_EXIT_NMI_WINDOW , 8, "NMI window."),
72	EXIT_REASON(VMX_EXIT_TASK_SWITCH , 9, "Task switch."),
73	EXIT_REASON(VMX_EXIT_CPUID , 10, "CPUID instruction."),
74	EXIT_REASON_NIL(),
75	EXIT_REASON(VMX_EXIT_HLT , 12, "HLT instruction."),
76	EXIT_REASON(VMX_EXIT_INVD , 13, "INVD instruction."),
77	EXIT_REASON(VMX_EXIT_INVLPG , 14, "INVLPG instruction."),
78	EXIT_REASON(VMX_EXIT_RDPMC , 15, "RDPMCinstruction."),
79	EXIT_REASON(VMX_EXIT_RDTSC , 16, "RDTSC instruction."),
80	EXIT_REASON(VMX_EXIT_RSM , 17, "RSM instruction in SMM."),
81	EXIT_REASON(VMX_EXIT_VMCALL , 18, "VMCALL instruction."),
82	EXIT_REASON(VMX_EXIT_VMCLEAR , 19, "VMCLEAR instruction."),
83	EXIT_REASON(VMX_EXIT_VMLAUNCH , 20, "VMLAUNCH instruction."),
84	EXIT_REASON(VMX_EXIT_VMPTRLD , 21, "VMPTRLD instruction."),
85	EXIT_REASON(VMX_EXIT_VMPTRST , 22, "VMPTRST instruction."),
86	EXIT_REASON(VMX_EXIT_VMREAD , 23, "VMREAD instruction."),
87	EXIT_REASON(VMX_EXIT_VMRESUME , 24, "VMRESUME instruction."),
88	EXIT_REASON(VMX_EXIT_VMWRITE , 25, "VMWRITE instruction."),
89	EXIT_REASON(VMX_EXIT_VMXOFF , 26, "VMXOFF instruction."),
90	EXIT_REASON(VMX_EXIT_VMXON , 27, "VMXON instruction."),
91	EXIT_REASON(VMX_EXIT_MOV_CRX , 28, "Control-register accesses."),
92	EXIT_REASON(VMX_EXIT_MOV_DRX , 29, "Debug-register accesses."),
93	EXIT_REASON(VMX_EXIT_PORT_IO , 30, "I/O instruction."),
94	EXIT_REASON(VMX_EXIT_RDMSR , 31, "RDMSR instruction."),
95	EXIT_REASON(VMX_EXIT_WRMSR , 32, "WRMSR instruction."),
96	EXIT_REASON(VMX_EXIT_ERR_INVALID_GUEST_STATE, 33, "VM-entry failure due to invalid guest state."),
97	EXIT_REASON(VMX_EXIT_ERR_MSR_LOAD , 34, "VM-entry failure due to MSR loading."),
98	EXIT_REASON_NIL(),
99	EXIT_REASON(VMX_EXIT_MWAIT , 36, "MWAIT instruction."),
100	EXIT_REASON(VMX_EXIT_MTF , 37, "Monitor Trap Flag."),
101	EXIT_REASON_NIL(),
102	EXIT_REASON(VMX_EXIT_MONITOR , 39, "MONITOR instruction."),
103	EXIT_REASON(VMX_EXIT_PAUSE , 40, "PAUSE instruction."),
104	EXIT_REASON(VMX_EXIT_ERR_MACHINE_CHECK , 41, "VM-entry failure due to machine-check."),
105	EXIT_REASON_NIL(),
106	EXIT_REASON(VMX_EXIT_TPR_BELOW_THRESHOLD, 43, "TPR below threshold (MOV to CR8)."),
107	EXIT_REASON(VMX_EXIT_APIC_ACCESS , 44, "APIC access."),
108	EXIT_REASON_NIL(),
109	EXIT_REASON(VMX_EXIT_XDTR_ACCESS , 46, "Access to GDTR or IDTR using LGDT, LIDT, SGDT, or SIDT."),
110	EXIT_REASON(VMX_EXIT_TR_ACCESS , 47, "Access to LDTR or TR using LLDT, LTR, SLDT, or STR."),
111	EXIT_REASON(VMX_EXIT_EPT_VIOLATION , 48, "EPT violation."),
112	EXIT_REASON(VMX_EXIT_EPT_MISCONFIG , 49, "EPT misconfiguration."),
113	EXIT_REASON(VMX_EXIT_INVEPT , 50, "INVEPT instruction."),
114	EXIT_REASON(VMX_EXIT_RDTSCP , 51, "RDTSCP instruction."),
115	EXIT_REASON(VMX_EXIT_PREEMPT_TIMER , 52, "VMX-preemption timer expired."),
116	EXIT_REASON(VMX_EXIT_INVVPID , 53, "INVVPID instruction."),
117	EXIT_REASON(VMX_EXIT_WBINVD , 54, "WBINVD instruction."),
118	EXIT_REASON(VMX_EXIT_XSETBV , 55, "XSETBV instruction."),
119	EXIT_REASON_NIL(),
120	EXIT_REASON(VMX_EXIT_RDRAND , 57, "RDRAND instruction."),
121	EXIT_REASON(VMX_EXIT_INVPCID , 58, "INVPCID instruction."),
122	EXIT_REASON(VMX_EXIT_VMFUNC , 59, "VMFUNC instruction."),
123	EXIT_REASON_NIL(),
124	EXIT_REASON(VMX_EXIT_RDSEED , 61, "RDSEED instruction."),
125	EXIT_REASON_NIL(),
126	EXIT_REASON(VMX_EXIT_XSAVES , 61, "XSAVES instruction."),
127	EXIT_REASON(VMX_EXIT_XRSTORS , 62, "XRSTORS instruction.")
128	};
129	/** Exit reason descriptions for AMD-V, used to describe statistics. */
130	static const char * const g_apszAmdVExitReasons[MAX_EXITREASON_STAT] =
131	{
132	EXIT_REASON(SVM_EXIT_READ_CR0 , 0, "Read CR0."),
133	EXIT_REASON(SVM_EXIT_READ_CR1 , 1, "Read CR1."),
134	EXIT_REASON(SVM_EXIT_READ_CR2 , 2, "Read CR2."),
135	EXIT_REASON(SVM_EXIT_READ_CR3 , 3, "Read CR3."),
136	EXIT_REASON(SVM_EXIT_READ_CR4 , 4, "Read CR4."),
137	EXIT_REASON(SVM_EXIT_READ_CR5 , 5, "Read CR5."),
138	EXIT_REASON(SVM_EXIT_READ_CR6 , 6, "Read CR6."),
139	EXIT_REASON(SVM_EXIT_READ_CR7 , 7, "Read CR7."),
140	EXIT_REASON(SVM_EXIT_READ_CR8 , 8, "Read CR8."),
141	EXIT_REASON(SVM_EXIT_READ_CR9 , 9, "Read CR9."),
142	EXIT_REASON(SVM_EXIT_READ_CR10 , 10, "Read CR10."),
143	EXIT_REASON(SVM_EXIT_READ_CR11 , 11, "Read CR11."),
144	EXIT_REASON(SVM_EXIT_READ_CR12 , 12, "Read CR12."),
145	EXIT_REASON(SVM_EXIT_READ_CR13 , 13, "Read CR13."),
146	EXIT_REASON(SVM_EXIT_READ_CR14 , 14, "Read CR14."),
147	EXIT_REASON(SVM_EXIT_READ_CR15 , 15, "Read CR15."),
148	EXIT_REASON(SVM_EXIT_WRITE_CR0 , 16, "Write CR0."),
149	EXIT_REASON(SVM_EXIT_WRITE_CR1 , 17, "Write CR1."),
150	EXIT_REASON(SVM_EXIT_WRITE_CR2 , 18, "Write CR2."),
151	EXIT_REASON(SVM_EXIT_WRITE_CR3 , 19, "Write CR3."),
152	EXIT_REASON(SVM_EXIT_WRITE_CR4 , 20, "Write CR4."),
153	EXIT_REASON(SVM_EXIT_WRITE_CR5 , 21, "Write CR5."),
154	EXIT_REASON(SVM_EXIT_WRITE_CR6 , 22, "Write CR6."),
155	EXIT_REASON(SVM_EXIT_WRITE_CR7 , 23, "Write CR7."),
156	EXIT_REASON(SVM_EXIT_WRITE_CR8 , 24, "Write CR8."),
157	EXIT_REASON(SVM_EXIT_WRITE_CR9 , 25, "Write CR9."),
158	EXIT_REASON(SVM_EXIT_WRITE_CR10 , 26, "Write CR10."),
159	EXIT_REASON(SVM_EXIT_WRITE_CR11 , 27, "Write CR11."),
160	EXIT_REASON(SVM_EXIT_WRITE_CR12 , 28, "Write CR12."),
161	EXIT_REASON(SVM_EXIT_WRITE_CR13 , 29, "Write CR13."),
162	EXIT_REASON(SVM_EXIT_WRITE_CR14 , 30, "Write CR14."),
163	EXIT_REASON(SVM_EXIT_WRITE_CR15 , 31, "Write CR15."),
164	EXIT_REASON(SVM_EXIT_READ_DR0 , 32, "Read DR0."),
165	EXIT_REASON(SVM_EXIT_READ_DR1 , 33, "Read DR1."),
166	EXIT_REASON(SVM_EXIT_READ_DR2 , 34, "Read DR2."),
167	EXIT_REASON(SVM_EXIT_READ_DR3 , 35, "Read DR3."),
168	EXIT_REASON(SVM_EXIT_READ_DR4 , 36, "Read DR4."),
169	EXIT_REASON(SVM_EXIT_READ_DR5 , 37, "Read DR5."),
170	EXIT_REASON(SVM_EXIT_READ_DR6 , 38, "Read DR6."),
171	EXIT_REASON(SVM_EXIT_READ_DR7 , 39, "Read DR7."),
172	EXIT_REASON(SVM_EXIT_READ_DR8 , 40, "Read DR8."),
173	EXIT_REASON(SVM_EXIT_READ_DR9 , 41, "Read DR9."),
174	EXIT_REASON(SVM_EXIT_READ_DR10 , 42, "Read DR10."),
175	EXIT_REASON(SVM_EXIT_READ_DR11 , 43, "Read DR11"),
176	EXIT_REASON(SVM_EXIT_READ_DR12 , 44, "Read DR12."),
177	EXIT_REASON(SVM_EXIT_READ_DR13 , 45, "Read DR13."),
178	EXIT_REASON(SVM_EXIT_READ_DR14 , 46, "Read DR14."),
179	EXIT_REASON(SVM_EXIT_READ_DR15 , 47, "Read DR15."),
180	EXIT_REASON(SVM_EXIT_WRITE_DR0 , 48, "Write DR0."),
181	EXIT_REASON(SVM_EXIT_WRITE_DR1 , 49, "Write DR1."),
182	EXIT_REASON(SVM_EXIT_WRITE_DR2 , 50, "Write DR2."),
183	EXIT_REASON(SVM_EXIT_WRITE_DR3 , 51, "Write DR3."),
184	EXIT_REASON(SVM_EXIT_WRITE_DR4 , 52, "Write DR4."),
185	EXIT_REASON(SVM_EXIT_WRITE_DR5 , 53, "Write DR5."),
186	EXIT_REASON(SVM_EXIT_WRITE_DR6 , 54, "Write DR6."),
187	EXIT_REASON(SVM_EXIT_WRITE_DR7 , 55, "Write DR7."),
188	EXIT_REASON(SVM_EXIT_WRITE_DR8 , 56, "Write DR8."),
189	EXIT_REASON(SVM_EXIT_WRITE_DR9 , 57, "Write DR9."),
190	EXIT_REASON(SVM_EXIT_WRITE_DR10 , 58, "Write DR10."),
191	EXIT_REASON(SVM_EXIT_WRITE_DR11 , 59, "Write DR11."),
192	EXIT_REASON(SVM_EXIT_WRITE_DR12 , 60, "Write DR12."),
193	EXIT_REASON(SVM_EXIT_WRITE_DR13 , 61, "Write DR13."),
194	EXIT_REASON(SVM_EXIT_WRITE_DR14 , 62, "Write DR14."),
195	EXIT_REASON(SVM_EXIT_WRITE_DR15 , 63, "Write DR15."),
196	EXIT_REASON(SVM_EXIT_EXCEPTION_0 , 64, "Exception Vector 0 (#DE)."),
197	EXIT_REASON(SVM_EXIT_EXCEPTION_1 , 65, "Exception Vector 1 (#DB)."),
198	EXIT_REASON(SVM_EXIT_EXCEPTION_2 , 66, "Exception Vector 2 (#NMI)."),
199	EXIT_REASON(SVM_EXIT_EXCEPTION_3 , 67, "Exception Vector 3 (#BP)."),
200	EXIT_REASON(SVM_EXIT_EXCEPTION_4 , 68, "Exception Vector 4 (#OF)."),
201	EXIT_REASON(SVM_EXIT_EXCEPTION_5 , 69, "Exception Vector 5 (#BR)."),
202	EXIT_REASON(SVM_EXIT_EXCEPTION_6 , 70, "Exception Vector 6 (#UD)."),
203	EXIT_REASON(SVM_EXIT_EXCEPTION_7 , 71, "Exception Vector 7 (#NM)."),
204	EXIT_REASON(SVM_EXIT_EXCEPTION_8 , 72, "Exception Vector 8 (#DF)."),
205	EXIT_REASON(SVM_EXIT_EXCEPTION_9 , 73, "Exception Vector 9 (#CO_SEG_OVERRUN)."),
206	EXIT_REASON(SVM_EXIT_EXCEPTION_A , 74, "Exception Vector 10 (#TS)."),
207	EXIT_REASON(SVM_EXIT_EXCEPTION_B , 75, "Exception Vector 11 (#NP)."),
208	EXIT_REASON(SVM_EXIT_EXCEPTION_C , 76, "Exception Vector 12 (#SS)."),
209	EXIT_REASON(SVM_EXIT_EXCEPTION_D , 77, "Exception Vector 13 (#GP)."),
210	EXIT_REASON(SVM_EXIT_EXCEPTION_E , 78, "Exception Vector 14 (#PF)."),
211	EXIT_REASON(SVM_EXIT_EXCEPTION_F , 79, "Exception Vector 15 (0x0f)."),
212	EXIT_REASON(SVM_EXIT_EXCEPTION_10 , 80, "Exception Vector 16 (#MF)."),
213	EXIT_REASON(SVM_EXIT_EXCEPTION_11 , 81, "Exception Vector 17 (#AC)."),
214	EXIT_REASON(SVM_EXIT_EXCEPTION_12 , 82, "Exception Vector 18 (#MC)."),
215	EXIT_REASON(SVM_EXIT_EXCEPTION_13 , 83, "Exception Vector 19 (#XF)."),
216	EXIT_REASON(SVM_EXIT_EXCEPTION_14 , 84, "Exception Vector 20 (0x14)."),
217	EXIT_REASON(SVM_EXIT_EXCEPTION_15 , 85, "Exception Vector 22 (0x15)."),
218	EXIT_REASON(SVM_EXIT_EXCEPTION_16 , 86, "Exception Vector 22 (0x16)."),
219	EXIT_REASON(SVM_EXIT_EXCEPTION_17 , 87, "Exception Vector 23 (0x17)."),
220	EXIT_REASON(SVM_EXIT_EXCEPTION_18 , 88, "Exception Vector 24 (0x18)."),
221	EXIT_REASON(SVM_EXIT_EXCEPTION_19 , 89, "Exception Vector 25 (0x19)."),
222	EXIT_REASON(SVM_EXIT_EXCEPTION_1A , 90, "Exception Vector 26 (0x1A)."),
223	EXIT_REASON(SVM_EXIT_EXCEPTION_1B , 91, "Exception Vector 27 (0x1B)."),
224	EXIT_REASON(SVM_EXIT_EXCEPTION_1C , 92, "Exception Vector 28 (0x1C)."),
225	EXIT_REASON(SVM_EXIT_EXCEPTION_1D , 93, "Exception Vector 29 (0x1D)."),
226	EXIT_REASON(SVM_EXIT_EXCEPTION_1E , 94, "Exception Vector 30 (0x1E)."),
227	EXIT_REASON(SVM_EXIT_EXCEPTION_1F , 95, "Exception Vector 31 (0x1F)."),
228	EXIT_REASON(SVM_EXIT_INTR , 96, "Physical maskable interrupt (host)."),
229	EXIT_REASON(SVM_EXIT_NMI , 97, "Physical non-maskable interrupt (host)."),
230	EXIT_REASON(SVM_EXIT_SMI , 98, "System management interrupt (host)."),
231	EXIT_REASON(SVM_EXIT_INIT , 99, "Physical INIT signal (host)."),
232	EXIT_REASON(SVM_EXIT_VINTR ,100, "Virtual interrupt-window exit."),
233	EXIT_REASON(SVM_EXIT_CR0_SEL_WRITE ,101, "Write to CR0 that changed any bits other than CR0.TS or CR0.MP."),
234	EXIT_REASON(SVM_EXIT_IDTR_READ ,102, "Read IDTR"),
235	EXIT_REASON(SVM_EXIT_GDTR_READ ,103, "Read GDTR"),
236	EXIT_REASON(SVM_EXIT_LDTR_READ ,104, "Read LDTR."),
237	EXIT_REASON(SVM_EXIT_TR_READ ,105, "Read TR."),
238	EXIT_REASON(SVM_EXIT_TR_READ ,106, "Write IDTR."),
239	EXIT_REASON(SVM_EXIT_TR_READ ,107, "Write GDTR."),
240	EXIT_REASON(SVM_EXIT_TR_READ ,108, "Write LDTR."),
241	EXIT_REASON(SVM_EXIT_TR_READ ,109, "Write TR."),
242	EXIT_REASON(SVM_EXIT_RDTSC ,110, "RDTSC instruction."),
243	EXIT_REASON(SVM_EXIT_RDPMC ,111, "RDPMC instruction."),
244	EXIT_REASON(SVM_EXIT_PUSHF ,112, "PUSHF instruction."),
245	EXIT_REASON(SVM_EXIT_POPF ,113, "POPF instruction."),
246	EXIT_REASON(SVM_EXIT_CPUID ,114, "CPUID instruction."),
247	EXIT_REASON(SVM_EXIT_RSM ,115, "RSM instruction."),
248	EXIT_REASON(SVM_EXIT_IRET ,116, "IRET instruction."),
249	EXIT_REASON(SVM_EXIT_SWINT ,117, "Software interrupt (INTn instructions)."),
250	EXIT_REASON(SVM_EXIT_INVD ,118, "INVD instruction."),
251	EXIT_REASON(SVM_EXIT_PAUSE ,119, "PAUSE instruction."),
252	EXIT_REASON(SVM_EXIT_HLT ,120, "HLT instruction."),
253	EXIT_REASON(SVM_EXIT_INVLPG ,121, "INVLPG instruction."),
254	EXIT_REASON(SVM_EXIT_INVLPGA ,122, "INVLPGA instruction."),
255	EXIT_REASON(SVM_EXIT_IOIO ,123, "IN/OUT accessing protected port."),
256	EXIT_REASON(SVM_EXIT_MSR ,124, "RDMSR or WRMSR access to protected MSR."),
257	EXIT_REASON(SVM_EXIT_TASK_SWITCH ,125, "Task switch."),
258	EXIT_REASON(SVM_EXIT_FERR_FREEZE ,126, "Legacy FPU handling enabled; processor is frozen in an x87/mmx instruction waiting for an interrupt"),
259	EXIT_REASON(SVM_EXIT_SHUTDOWN ,127, "Shutdown."),
260	EXIT_REASON(SVM_EXIT_VMRUN ,128, "VMRUN instruction."),
261	EXIT_REASON(SVM_EXIT_VMMCALL ,129, "VMCALL instruction."),
262	EXIT_REASON(SVM_EXIT_VMLOAD ,130, "VMLOAD instruction."),
263	EXIT_REASON(SVM_EXIT_VMSAVE ,131, "VMSAVE instruction."),
264	EXIT_REASON(SVM_EXIT_STGI ,132, "STGI instruction."),
265	EXIT_REASON(SVM_EXIT_CLGI ,133, "CLGI instruction."),
266	EXIT_REASON(SVM_EXIT_SKINIT ,134, "SKINIT instruction."),
267	EXIT_REASON(SVM_EXIT_RDTSCP ,135, "RDTSCP instruction."),
268	EXIT_REASON(SVM_EXIT_ICEBP ,136, "ICEBP instruction."),
269	EXIT_REASON(SVM_EXIT_WBINVD ,137, "WBINVD instruction."),
270	EXIT_REASON(SVM_EXIT_MONITOR ,138, "MONITOR instruction."),
271	EXIT_REASON(SVM_EXIT_MWAIT ,139, "MWAIT instruction."),
272	EXIT_REASON(SVM_EXIT_MWAIT_ARMED ,140, "MWAIT instruction when armed."),
273	EXIT_REASON(SVM_EXIT_NPF ,1024, "Nested paging fault."),
274	EXIT_REASON_NIL()
275	};
276	# undef EXIT_REASON
277	# undef EXIT_REASON_NIL
278	#endif /* VBOX_WITH_STATISTICS */
279
280	#define HMVMX_REPORT_FEATURE(allowed1, disallowed0, featflag) \
281	do { \
282	if ((allowed1) & (featflag)) \
283	{ \
284	if ((disallowed0) & (featflag)) \
285	LogRel(("HM: " #featflag " (must be set)\n")); \
286	else \
287	LogRel(("HM: " #featflag "\n")); \
288	} \
289	else \
290	LogRel(("HM: " #featflag " (must be cleared)\n")); \
291	} while (0)
292
293	#define HMVMX_REPORT_ALLOWED_FEATURE(allowed1, featflag) \
294	do { \
295	if ((allowed1) & (featflag)) \
296	LogRel(("HM: " #featflag "\n")); \
297	else \
298	LogRel(("HM: " #featflag " not supported\n")); \
299	} while (0)
300
301	#define HMVMX_REPORT_CAPABILITY(msrcaps, cap) \
302	do { \
303	if ((msrcaps) & (cap)) \
304	LogRel(("HM: " #cap "\n")); \
305	} while (0)
306
307
308	/*******************************************************************************
309	* Internal Functions *
310	*******************************************************************************/
311	static DECLCALLBACK(int) hmR3Save(PVM pVM, PSSMHANDLE pSSM);
312	static DECLCALLBACK(int) hmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass);
313	static int hmR3InitCPU(PVM pVM);
314	static int hmR3InitFinalizeR0(PVM pVM);
315	static int hmR3InitFinalizeR0Intel(PVM pVM);
316	static int hmR3InitFinalizeR0Amd(PVM pVM);
317	static int hmR3TermCPU(PVM pVM);
318
319
320
321	/**
322	* Initializes the HM.
323	*
324	* This reads the config and check whether VT-x or AMD-V hardware is available
325	* if configured to use it. This is one of the very first components to be
326	* initialized after CFGM, so that we can fall back to raw-mode early in the
327	* initialization process.
328	*
329	* Note that a lot of the set up work is done in ring-0 and thus postponed till
330	* the ring-3 and ring-0 callback to HMR3InitCompleted.
331	*
332	* @returns VBox status code.
333	* @param pVM Pointer to the VM.
334	*
335	* @remarks Be careful with what we call here, since most of the VMM components
336	* are uninitialized.
337	*/
338	VMMR3_INT_DECL(int) HMR3Init(PVM pVM)
339	{
340	LogFlow(("HMR3Init\n"));
341
342	/*
343	* Assert alignment and sizes.
344	*/
345	AssertCompileMemberAlignment(VM, hm.s, 32);
346	AssertCompile(sizeof(pVM->hm.s) <= sizeof(pVM->hm.padding));
347
348	/*
349	* Register the saved state data unit.
350	*/
351	int rc = SSMR3RegisterInternal(pVM, "HWACCM", 0, HM_SAVED_STATE_VERSION, sizeof(HM),
352	NULL, NULL, NULL,
353	NULL, hmR3Save, NULL,
354	NULL, hmR3Load, NULL);
355	if (RT_FAILURE(rc))
356	return rc;
357
358	/*
359	* Read configuration.
360	*/
361	PCFGMNODE pCfgHM = CFGMR3GetChild(CFGMR3GetRoot(pVM), "HM/");
362
363	/** @cfgm{/HM/HMForced, bool, false}
364	* Forces hardware virtualization, no falling back on raw-mode. HM must be
365	* enabled, i.e. /HMEnabled must be true. */
366	bool fHMForced;
367	#ifdef VBOX_WITH_RAW_MODE
368	rc = CFGMR3QueryBoolDef(pCfgHM, "HMForced", &fHMForced, false);
369	AssertRCReturn(rc, rc);
370	AssertLogRelMsgReturn(!fHMForced \|\| pVM->fHMEnabled, ("Configuration error: HM forced but not enabled!\n"),
371	VERR_INVALID_PARAMETER);
372	# if defined(RT_OS_DARWIN)
373	if (pVM->fHMEnabled)
374	fHMForced = true;
375	# endif
376	AssertLogRelMsgReturn(pVM->cCpus == 1 \|\| pVM->fHMEnabled, ("Configuration error: SMP requires HM to be enabled!\n"),
377	VERR_INVALID_PARAMETER);
378	if (pVM->cCpus > 1)
379	fHMForced = true;
380	#else /* !VBOX_WITH_RAW_MODE */
381	AssertRelease(pVM->fHMEnabled);
382	fHMForced = true;
383	#endif /* !VBOX_WITH_RAW_MODE */
384
385	/** @cfgm{/HM/EnableNestedPaging, bool, false}
386	* Enables nested paging (aka extended page tables). */
387	rc = CFGMR3QueryBoolDef(pCfgHM, "EnableNestedPaging", &pVM->hm.s.fAllowNestedPaging, false);
388	AssertRCReturn(rc, rc);
389
390	/** @cfgm{/HM/EnableUX, bool, true}
391	* Enables the VT-x unrestricted execution feature. */
392	rc = CFGMR3QueryBoolDef(pCfgHM, "EnableUX", &pVM->hm.s.vmx.fAllowUnrestricted, true);
393	AssertRCReturn(rc, rc);
394
395	/** @cfgm{/HM/EnableLargePages, bool, false}
396	* Enables using large pages (2 MB) for guest memory, thus saving on (nested)
397	* page table walking and maybe better TLB hit rate in some cases. */
398	rc = CFGMR3QueryBoolDef(pCfgHM, "EnableLargePages", &pVM->hm.s.fLargePages, false);
399	AssertRCReturn(rc, rc);
400
401	/** @cfgm{/HM/EnableVPID, bool, false}
402	* Enables the VT-x VPID feature. */
403	rc = CFGMR3QueryBoolDef(pCfgHM, "EnableVPID", &pVM->hm.s.vmx.fAllowVpid, false);
404	AssertRCReturn(rc, rc);
405
406	/** @cfgm{/HM/TPRPatchingEnabled, bool, false}
407	* Enables TPR patching for 32-bit windows guests with IO-APIC. */
408	rc = CFGMR3QueryBoolDef(pCfgHM, "TPRPatchingEnabled", &pVM->hm.s.fTprPatchingAllowed, false);
409	AssertRCReturn(rc, rc);
410
411	/** @cfgm{/HM/64bitEnabled, bool, 32-bit:false, 64-bit:true}
412	* Enables AMD64 cpu features.
413	* On 32-bit hosts this isn't default and require host CPU support. 64-bit hosts
414	* already have the support. */
415	#ifdef VBOX_ENABLE_64_BITS_GUESTS
416	rc = CFGMR3QueryBoolDef(pCfgHM, "64bitEnabled", &pVM->hm.s.fAllow64BitGuests, HC_ARCH_BITS == 64);
417	AssertLogRelRCReturn(rc, rc);
418	#else
419	pVM->hm.s.fAllow64BitGuests = false;
420	#endif
421
422	/** @cfgm{/HM/Exclusive, bool}
423	* Determines the init method for AMD-V and VT-x. If set to true, HM will do a
424	* global init for each host CPU. If false, we do local init each time we wish
425	* to execute guest code.
426	*
427	* On Windows, default is false due to the higher risk of conflicts with other
428	* hypervisors.
429	*
430	* On Mac OS X, this setting is ignored since the code does not handle local
431	* init when it utilizes the OS provided VT-x function, SUPR0EnableVTx().
432	*/
433	#if defined(RT_OS_DARWIN)
434	pVM->hm.s.fGlobalInit = true;
435	#else
436	rc = CFGMR3QueryBoolDef(pCfgHM, "Exclusive", &pVM->hm.s.fGlobalInit,
437	# if defined(RT_OS_WINDOWS)
438	false
439	# else
440	true
441	# endif
442	);
443	AssertLogRelRCReturn(rc, rc);
444	#endif
445
446	/** @cfgm{/HM/MaxResumeLoops, uint32_t}
447	* The number of times to resume guest execution before we forcibly return to
448	* ring-3. The return value of RTThreadPreemptIsPendingTrusty in ring-0
449	* determines the default value. */
450	rc = CFGMR3QueryU32Def(pCfgHM, "MaxResumeLoops", &pVM->hm.s.cMaxResumeLoops, 0 /* set by R0 later */);
451	AssertLogRelRCReturn(rc, rc);
452
453	/** @cfgm{/HM/UseVmxPreemptTimer, bool}
454	* Whether to make use of the VMX-preemption timer feature of the CPU if it's
455	* available. */
456	rc = CFGMR3QueryBoolDef(pCfgHM, "UseVmxPreemptTimer", &pVM->hm.s.vmx.fUsePreemptTimer, true);
457	AssertLogRelRCReturn(rc, rc);
458
459	/*
460	* Check if VT-x or AMD-v support according to the users wishes.
461	*/
462	/** @todo SUPR3QueryVTCaps won't catch VERR_VMX_IN_VMX_ROOT_MODE or
463	* VERR_SVM_IN_USE. */
464	if (pVM->fHMEnabled)
465	{
466	uint32_t fCaps;
467	rc = SUPR3QueryVTCaps(&fCaps);
468	if (RT_SUCCESS(rc))
469	{
470	if (fCaps & SUPVTCAPS_AMD_V)
471	{
472	LogRel(("HM: HMR3Init: AMD-V%s\n", fCaps & SUPVTCAPS_NESTED_PAGING ? " w/ nested paging" : ""));
473	pVM->hm.s.svm.fSupported = true;
474	}
475	else if (fCaps & SUPVTCAPS_VT_X)
476	{
477	rc = SUPR3QueryVTxSupported();
478	if (RT_SUCCESS(rc))
479	{
480	LogRel(("HM: HMR3Init: VT-x%s%s%s\n",
481	fCaps & SUPVTCAPS_NESTED_PAGING ? " w/ nested paging" : "",
482	fCaps & SUPVTCAPS_VTX_UNRESTRICTED_GUEST ? " and unrestricted guest execution" : "",
483	(fCaps & (SUPVTCAPS_NESTED_PAGING \| SUPVTCAPS_VTX_UNRESTRICTED_GUEST)) ? " hw support" : ""));
484	pVM->hm.s.vmx.fSupported = true;
485	}
486	else
487	{
488	#ifdef RT_OS_LINUX
489	const char *pszMinReq = " Linux 2.6.13 or newer required!";
490	#else
491	const char *pszMinReq = "";
492	#endif
493	if (fHMForced)
494	return VMSetError(pVM, rc, RT_SRC_POS, "The host kernel does not support VT-x.%s\n", pszMinReq);
495
496	/* Fall back to raw-mode. */
497	LogRel(("HM: HMR3Init: Falling back to raw-mode: The host kernel does not support VT-x.%s\n", pszMinReq));
498	pVM->fHMEnabled = false;
499	}
500	}
501	else
502	AssertLogRelMsgFailedReturn(("SUPR3QueryVTCaps didn't return either AMD-V or VT-x flag set (%#x)!\n", fCaps),
503	VERR_INTERNAL_ERROR_5);
504
505	/*
506	* Do we require a little bit or raw-mode for 64-bit guest execution?
507	*/
508	pVM->fHMNeedRawModeCtx = HC_ARCH_BITS == 32
509	&& pVM->fHMEnabled
510	&& pVM->hm.s.fAllow64BitGuests;
511
512	/*
513	* Disable nested paging and unrestricted guest execution now if they're
514	* configured so that CPUM can make decisions based on our configuration.
515	*/
516	Assert(!pVM->hm.s.fNestedPaging);
517	if (pVM->hm.s.fAllowNestedPaging)
518	{
519	if (fCaps & SUPVTCAPS_NESTED_PAGING)
520	pVM->hm.s.fNestedPaging = true;
521	else
522	pVM->hm.s.fAllowNestedPaging = false;
523	}
524
525	if (fCaps & SUPVTCAPS_VT_X)
526	{
527	Assert(!pVM->hm.s.vmx.fUnrestrictedGuest);
528	if (pVM->hm.s.vmx.fAllowUnrestricted)
529	{
530	if ( (fCaps & SUPVTCAPS_VTX_UNRESTRICTED_GUEST)
531	&& pVM->hm.s.fNestedPaging)
532	pVM->hm.s.vmx.fUnrestrictedGuest = true;
533	else
534	pVM->hm.s.vmx.fAllowUnrestricted = false;
535	}
536	}
537	}
538	else
539	{
540	const char *pszMsg;
541	switch (rc)
542	{
543	case VERR_UNSUPPORTED_CPU:
544	pszMsg = "Unknown CPU, VT-x or AMD-v features cannot be ascertained";
545	break;
546
547	case VERR_VMX_NO_VMX:
548	pszMsg = "VT-x is not available";
549	break;
550
551	case VERR_VMX_MSR_VMX_DISABLED:
552	pszMsg = "VT-x is disabled in the BIOS";
553	break;
554
555	case VERR_VMX_MSR_ALL_VMX_DISABLED:
556	pszMsg = "VT-x is disabled in the BIOS for both all CPU modes";
557	break;
558
559	case VERR_VMX_MSR_LOCKING_FAILED:
560	pszMsg = "Failed to enable and lock VT-x features";
561	break;
562
563	case VERR_SVM_NO_SVM:
564	pszMsg = "AMD-V is not available";
565	break;
566
567	case VERR_SVM_DISABLED:
568	pszMsg = "AMD-V is disabled in the BIOS (or by the host OS)";
569	break;
570
571	default:
572	pszMsg = NULL;
573	break;
574	}
575	if (fHMForced && pszMsg)
576	return VM_SET_ERROR(pVM, rc, pszMsg);
577	if (!pszMsg)
578	return VMSetError(pVM, rc, RT_SRC_POS, "SUPR3QueryVTCaps failed with %Rrc", rc);
579
580	/* Fall back to raw-mode. */
581	LogRel(("HM: HMR3Init: Falling back to raw-mode: %s\n", pszMsg));
582	pVM->fHMEnabled = false;
583	}
584	}
585
586	/* It's now OK to use the predicate function. */
587	pVM->fHMEnabledFixed = true;
588	return VINF_SUCCESS;
589	}
590
591
592	/**
593	* Initializes the per-VCPU HM.
594	*
595	* @returns VBox status code.
596	* @param pVM Pointer to the VM.
597	*/
598	static int hmR3InitCPU(PVM pVM)
599	{
600	LogFlow(("HMR3InitCPU\n"));
601
602	if (!HMIsEnabled(pVM))
603	return VINF_SUCCESS;
604
605	for (VMCPUID i = 0; i < pVM->cCpus; i++)
606	{
607	PVMCPU pVCpu = &pVM->aCpus[i];
608	pVCpu->hm.s.fActive = false;
609	}
610
611	#ifdef VBOX_WITH_STATISTICS
612	STAM_REG(pVM, &pVM->hm.s.StatTprPatchSuccess, STAMTYPE_COUNTER, "/HM/TPR/Patch/Success", STAMUNIT_OCCURENCES, "Number of times an instruction was successfully patched.");
613	STAM_REG(pVM, &pVM->hm.s.StatTprPatchFailure, STAMTYPE_COUNTER, "/HM/TPR/Patch/Failed", STAMUNIT_OCCURENCES, "Number of unsuccessful patch attempts.");
614	STAM_REG(pVM, &pVM->hm.s.StatTprReplaceSuccess, STAMTYPE_COUNTER, "/HM/TPR/Replace/Success",STAMUNIT_OCCURENCES, "Number of times an instruction was successfully patched.");
615	STAM_REG(pVM, &pVM->hm.s.StatTprReplaceFailure, STAMTYPE_COUNTER, "/HM/TPR/Replace/Failed", STAMUNIT_OCCURENCES, "Number of unsuccessful patch attempts.");
616	#endif
617
618	/*
619	* Statistics.
620	*/
621	for (VMCPUID i = 0; i < pVM->cCpus; i++)
622	{
623	PVMCPU pVCpu = &pVM->aCpus[i];
624	int rc;
625
626	#ifdef VBOX_WITH_STATISTICS
627	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatPoke, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
628	"Profiling of RTMpPokeCpu",
629	"/PROF/CPU%d/HM/Poke", i);
630	AssertRC(rc);
631	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatSpinPoke, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
632	"Profiling of poke wait",
633	"/PROF/CPU%d/HM/PokeWait", i);
634	AssertRC(rc);
635	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatSpinPokeFailed, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
636	"Profiling of poke wait when RTMpPokeCpu fails",
637	"/PROF/CPU%d/HM/PokeWaitFailed", i);
638	AssertRC(rc);
639	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatEntry, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
640	"Profiling of VMXR0RunGuestCode entry",
641	"/PROF/CPU%d/HM/StatEntry", i);
642	AssertRC(rc);
643	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExit1, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
644	"Profiling of VMXR0RunGuestCode exit part 1",
645	"/PROF/CPU%d/HM/SwitchFromGC_1", i);
646	AssertRC(rc);
647	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExit2, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
648	"Profiling of VMXR0RunGuestCode exit part 2",
649	"/PROF/CPU%d/HM/SwitchFromGC_2", i);
650	AssertRC(rc);
651
652	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitIO, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
653	"I/O",
654	"/PROF/CPU%d/HM/SwitchFromGC_2/IO", i);
655	AssertRC(rc);
656	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitMovCRx, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
657	"MOV CRx",
658	"/PROF/CPU%d/HM/SwitchFromGC_2/MovCRx", i);
659	AssertRC(rc);
660	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitXcptNmi, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
661	"Exceptions, NMIs",
662	"/PROF/CPU%d/HM/SwitchFromGC_2/XcptNmi", i);
663	AssertRC(rc);
664
665	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatLoadGuestState, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
666	"Profiling of VMXR0LoadGuestState",
667	"/PROF/CPU%d/HM/StatLoadGuestState", i);
668	AssertRC(rc);
669	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatInGC, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
670	"Profiling of VMLAUNCH/VMRESUME.",
671	"/PROF/CPU%d/HM/InGC", i);
672	AssertRC(rc);
673
674	# if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
675	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatWorldSwitch3264, STAMTYPE_PROFILE, STAMVISIBILITY_USED,
676	STAMUNIT_TICKS_PER_CALL, "Profiling of the 32/64 switcher.",
677	"/PROF/CPU%d/HM/Switcher3264", i);
678	AssertRC(rc);
679	# endif
680
681	# ifdef HM_PROFILE_EXIT_DISPATCH
682	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitDispatch, STAMTYPE_PROFILE_ADV, STAMVISIBILITY_USED,
683	STAMUNIT_TICKS_PER_CALL, "Profiling the dispatching of exit handlers.",
684	"/PROF/CPU%d/HM/ExitDispatch", i);
685	AssertRC(rc);
686	# endif
687
688	#endif
689	# define HM_REG_COUNTER(a, b, desc) \
690	rc = STAMR3RegisterF(pVM, a, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, desc, b, i); \
691	AssertRC(rc);
692
693	#ifdef VBOX_WITH_STATISTICS
694	HM_REG_COUNTER(&pVCpu->hm.s.StatExitAll, "/HM/CPU%d/Exit/All", "Exits (total).");
695	HM_REG_COUNTER(&pVCpu->hm.s.StatExitShadowNM, "/HM/CPU%d/Exit/Trap/Shw/#NM", "Shadow #NM (device not available, no math co-processor) exception.");
696	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestNM, "/HM/CPU%d/Exit/Trap/Gst/#NM", "Guest #NM (device not available, no math co-processor) exception.");
697	HM_REG_COUNTER(&pVCpu->hm.s.StatExitShadowPF, "/HM/CPU%d/Exit/Trap/Shw/#PF", "Shadow #PF (page fault) exception.");
698	HM_REG_COUNTER(&pVCpu->hm.s.StatExitShadowPFEM, "/HM/CPU%d/Exit/Trap/Shw/#PF-EM", "#PF (page fault) exception going back to ring-3 for emulating the instruction.");
699	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestPF, "/HM/CPU%d/Exit/Trap/Gst/#PF", "Guest #PF (page fault) exception.");
700	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestUD, "/HM/CPU%d/Exit/Trap/Gst/#UD", "Guest #UD (undefined opcode) exception.");
701	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestSS, "/HM/CPU%d/Exit/Trap/Gst/#SS", "Guest #SS (stack-segment fault) exception.");
702	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestNP, "/HM/CPU%d/Exit/Trap/Gst/#NP", "Guest #NP (segment not present) exception.");
703	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestGP, "/HM/CPU%d/Exit/Trap/Gst/#GP", "Guest #GP (general protection) exception.");
704	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestMF, "/HM/CPU%d/Exit/Trap/Gst/#MF", "Guest #MF (x87 FPU error, math fault) exception.");
705	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestDE, "/HM/CPU%d/Exit/Trap/Gst/#DE", "Guest #DE (divide error) exception.");
706	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestDB, "/HM/CPU%d/Exit/Trap/Gst/#DB", "Guest #DB (debug) exception.");
707	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestBP, "/HM/CPU%d/Exit/Trap/Gst/#BP", "Guest #BP (breakpoint) exception.");
708	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestXF, "/HM/CPU%d/Exit/Trap/Gst/#XF", "Guest #XF (extended math fault, SIMD FPU) exception.");
709	HM_REG_COUNTER(&pVCpu->hm.s.StatExitGuestXcpUnk, "/HM/CPU%d/Exit/Trap/Gst/Other", "Other guest exceptions.");
710	HM_REG_COUNTER(&pVCpu->hm.s.StatExitInvlpg, "/HM/CPU%d/Exit/Instr/Invlpg", "Guest attempted to execute INVLPG.");
711	HM_REG_COUNTER(&pVCpu->hm.s.StatExitInvd, "/HM/CPU%d/Exit/Instr/Invd", "Guest attempted to execute INVD.");
712	HM_REG_COUNTER(&pVCpu->hm.s.StatExitWbinvd, "/HM/CPU%d/Exit/Instr/Wbinvd", "Guest attempted to execute WBINVD.");
713	HM_REG_COUNTER(&pVCpu->hm.s.StatExitPause, "/HM/CPU%d/Exit/Instr/Pause", "Guest attempted to execute PAUSE.");
714	HM_REG_COUNTER(&pVCpu->hm.s.StatExitCpuid, "/HM/CPU%d/Exit/Instr/Cpuid", "Guest attempted to execute CPUID.");
715	HM_REG_COUNTER(&pVCpu->hm.s.StatExitRdtsc, "/HM/CPU%d/Exit/Instr/Rdtsc", "Guest attempted to execute RDTSC.");
716	HM_REG_COUNTER(&pVCpu->hm.s.StatExitRdtscp, "/HM/CPU%d/Exit/Instr/Rdtscp", "Guest attempted to execute RDTSCP.");
717	HM_REG_COUNTER(&pVCpu->hm.s.StatExitRdpmc, "/HM/CPU%d/Exit/Instr/Rdpmc", "Guest attempted to execute RDPMC.");
718	HM_REG_COUNTER(&pVCpu->hm.s.StatExitRdrand, "/HM/CPU%d/Exit/Instr/Rdrand", "Guest attempted to execute RDRAND.");
719	HM_REG_COUNTER(&pVCpu->hm.s.StatExitRdmsr, "/HM/CPU%d/Exit/Instr/Rdmsr", "Guest attempted to execute RDMSR.");
720	HM_REG_COUNTER(&pVCpu->hm.s.StatExitWrmsr, "/HM/CPU%d/Exit/Instr/Wrmsr", "Guest attempted to execute WRMSR.");
721	HM_REG_COUNTER(&pVCpu->hm.s.StatExitMwait, "/HM/CPU%d/Exit/Instr/Mwait", "Guest attempted to execute MWAIT.");
722	HM_REG_COUNTER(&pVCpu->hm.s.StatExitMonitor, "/HM/CPU%d/Exit/Instr/Monitor", "Guest attempted to execute MONITOR.");
723	HM_REG_COUNTER(&pVCpu->hm.s.StatExitDRxWrite, "/HM/CPU%d/Exit/Instr/DR/Write", "Guest attempted to write a debug register.");
724	HM_REG_COUNTER(&pVCpu->hm.s.StatExitDRxRead, "/HM/CPU%d/Exit/Instr/DR/Read", "Guest attempted to read a debug register.");
725	HM_REG_COUNTER(&pVCpu->hm.s.StatExitClts, "/HM/CPU%d/Exit/Instr/CLTS", "Guest attempted to execute CLTS.");
726	HM_REG_COUNTER(&pVCpu->hm.s.StatExitLmsw, "/HM/CPU%d/Exit/Instr/LMSW", "Guest attempted to execute LMSW.");
727	HM_REG_COUNTER(&pVCpu->hm.s.StatExitCli, "/HM/CPU%d/Exit/Instr/Cli", "Guest attempted to execute CLI.");
728	HM_REG_COUNTER(&pVCpu->hm.s.StatExitSti, "/HM/CPU%d/Exit/Instr/Sti", "Guest attempted to execute STI.");
729	HM_REG_COUNTER(&pVCpu->hm.s.StatExitPushf, "/HM/CPU%d/Exit/Instr/Pushf", "Guest attempted to execute PUSHF.");
730	HM_REG_COUNTER(&pVCpu->hm.s.StatExitPopf, "/HM/CPU%d/Exit/Instr/Popf", "Guest attempted to execute POPF.");
731	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIret, "/HM/CPU%d/Exit/Instr/Iret", "Guest attempted to execute IRET.");
732	HM_REG_COUNTER(&pVCpu->hm.s.StatExitInt, "/HM/CPU%d/Exit/Instr/Int", "Guest attempted to execute INT.");
733	HM_REG_COUNTER(&pVCpu->hm.s.StatExitHlt, "/HM/CPU%d/Exit/Instr/Hlt", "Guest attempted to execute HLT.");
734	HM_REG_COUNTER(&pVCpu->hm.s.StatExitXdtrAccess, "/HM/CPU%d/Exit/Instr/XdtrAccess", "Guest attempted to access descriptor table register (GDTR, IDTR, LDTR).");
735	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIOWrite, "/HM/CPU%d/Exit/IO/Write", "I/O write.");
736	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIORead, "/HM/CPU%d/Exit/IO/Read", "I/O read.");
737	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIOStringWrite, "/HM/CPU%d/Exit/IO/WriteString", "String I/O write.");
738	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIOStringRead, "/HM/CPU%d/Exit/IO/ReadString", "String I/O read.");
739	HM_REG_COUNTER(&pVCpu->hm.s.StatExitIntWindow, "/HM/CPU%d/Exit/IntWindow", "Interrupt-window exit. Guest is ready to receive interrupts again.");
740	HM_REG_COUNTER(&pVCpu->hm.s.StatExitExtInt, "/HM/CPU%d/Exit/ExtInt", "Host interrupt received.");
741	#endif
742	HM_REG_COUNTER(&pVCpu->hm.s.StatExitHostNmiInGC, "/HM/CPU%d/Exit/HostNmiInGC", "Host NMI received while in guest context.");
743	#ifdef VBOX_WITH_STATISTICS
744	HM_REG_COUNTER(&pVCpu->hm.s.StatExitPreemptTimer, "/HM/CPU%d/Exit/PreemptTimer", "VMX-preemption timer expired.");
745	HM_REG_COUNTER(&pVCpu->hm.s.StatExitTprBelowThreshold, "/HM/CPU%d/Exit/TprBelowThreshold", "TPR lowered below threshold by the guest.");
746	HM_REG_COUNTER(&pVCpu->hm.s.StatExitTaskSwitch, "/HM/CPU%d/Exit/TaskSwitch", "Guest attempted a task switch.");
747	HM_REG_COUNTER(&pVCpu->hm.s.StatExitMtf, "/HM/CPU%d/Exit/MonitorTrapFlag", "Monitor Trap Flag.");
748	HM_REG_COUNTER(&pVCpu->hm.s.StatExitApicAccess, "/HM/CPU%d/Exit/ApicAccess", "APIC access. Guest attempted to access memory at a physical address on the APIC-access page.");
749
750	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchGuestIrq, "/HM/CPU%d/Switch/IrqPending", "PDMGetInterrupt() cleared behind our back!?!.");
751	HM_REG_COUNTER(&pVCpu->hm.s.StatPendingHostIrq, "/HM/CPU%d/Switch/PendingHostIrq", "Exit to ring-3 due to pending host interrupt before executing guest code.");
752	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchHmToR3FF, "/HM/CPU%d/Switch/HmToR3FF", "Exit to ring-3 due to pending timers, EMT rendezvous, critical section etc.");
753	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchExitToR3, "/HM/CPU%d/Switch/ExitToR3", "Exit to ring-3 (total).");
754	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchLongJmpToR3, "/HM/CPU%d/Switch/LongJmpToR3", "Longjump to ring-3.");
755	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchMaxResumeLoops, "/HM/CPU%d/Switch/MaxResumeToR3", "Maximum VMRESUME inner-loop counter reached.");
756	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchHltToR3, "/HM/CPU%d/Switch/HltToR3", "HLT causing us to go to ring-3.");
757	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchApicAccessToR3, "/HM/CPU%d/Switch/ApicAccessToR3", "APIC access causing us to go to ring-3.");
758	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchPreempt, "/HM/CPU%d/Switch/Preempting", "EMT has been preempted while in HM context.");
759	HM_REG_COUNTER(&pVCpu->hm.s.StatSwitchPreemptSaveHostState, "/HM/CPU%d/Switch/SaveHostState", "Preemption caused us to resave host state.");
760
761	HM_REG_COUNTER(&pVCpu->hm.s.StatInjectInterrupt, "/HM/CPU%d/EventInject/Interrupt", "Injected an external interrupt into the guest.");
762	HM_REG_COUNTER(&pVCpu->hm.s.StatInjectXcpt, "/HM/CPU%d/EventInject/Trap", "Injected an exception into the guest.");
763	HM_REG_COUNTER(&pVCpu->hm.s.StatInjectPendingReflect, "/HM/CPU%d/EventInject/PendingReflect", "Reflecting an exception back to the guest.");
764
765	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushPage, "/HM/CPU%d/Flush/Page", "Invalidating a guest page on all guest CPUs.");
766	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushPageManual, "/HM/CPU%d/Flush/Page/Virt", "Invalidating a guest page using guest-virtual address.");
767	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushPhysPageManual, "/HM/CPU%d/Flush/Page/Phys", "Invalidating a guest page using guest-physical address.");
768	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushTlb, "/HM/CPU%d/Flush/TLB", "Forcing a full guest-TLB flush (ring-0).");
769	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushTlbManual, "/HM/CPU%d/Flush/TLB/Manual", "Request a full guest-TLB flush.");
770	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushTlbWorldSwitch, "/HM/CPU%d/Flush/TLB/CpuSwitch", "Forcing a full guest-TLB flush due to host-CPU reschedule or ASID-limit hit by another guest-VCPU.");
771	HM_REG_COUNTER(&pVCpu->hm.s.StatNoFlushTlbWorldSwitch, "/HM/CPU%d/Flush/TLB/Skipped", "No TLB flushing required.");
772	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushEntire, "/HM/CPU%d/Flush/TLB/Entire", "Flush the entire TLB (host + guest).");
773	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushAsid, "/HM/CPU%d/Flush/TLB/ASID", "Flushed guest-TLB entries for the current VPID.");
774	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushNestedPaging, "/HM/CPU%d/Flush/TLB/NestedPaging", "Flushed guest-TLB entries for the current EPT.");
775	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushTlbInvlpgVirt, "/HM/CPU%d/Flush/TLB/InvlpgVirt", "Invalidated a guest-TLB entry for a guest-virtual address.");
776	HM_REG_COUNTER(&pVCpu->hm.s.StatFlushTlbInvlpgPhys, "/HM/CPU%d/Flush/TLB/InvlpgPhys", "Currently not possible, flushes entire guest-TLB.");
777	HM_REG_COUNTER(&pVCpu->hm.s.StatTlbShootdown, "/HM/CPU%d/Flush/Shootdown/Page", "Inter-VCPU request to flush queued guest page.");
778	HM_REG_COUNTER(&pVCpu->hm.s.StatTlbShootdownFlush, "/HM/CPU%d/Flush/Shootdown/TLB", "Inter-VCPU request to flush entire guest-TLB.");
779
780	HM_REG_COUNTER(&pVCpu->hm.s.StatTscParavirt, "/HM/CPU%d/TSC/Paravirt", "Paravirtualized TSC in effect.");
781	HM_REG_COUNTER(&pVCpu->hm.s.StatTscOffset, "/HM/CPU%d/TSC/Offset", "TSC offsetting is in effect.");
782	HM_REG_COUNTER(&pVCpu->hm.s.StatTscIntercept, "/HM/CPU%d/TSC/Intercept", "Intercept TSC accesses.");
783
784	HM_REG_COUNTER(&pVCpu->hm.s.StatDRxArmed, "/HM/CPU%d/Debug/Armed", "Loaded guest-debug state while loading guest-state.");
785	HM_REG_COUNTER(&pVCpu->hm.s.StatDRxContextSwitch, "/HM/CPU%d/Debug/ContextSwitch", "Loaded guest-debug state on MOV DRx.");
786	HM_REG_COUNTER(&pVCpu->hm.s.StatDRxIoCheck, "/HM/CPU%d/Debug/IOCheck", "Checking for I/O breakpoint.");
787
788	HM_REG_COUNTER(&pVCpu->hm.s.StatLoadMinimal, "/HM/CPU%d/Load/Minimal", "VM-entry loading minimal guest-state.");
789	HM_REG_COUNTER(&pVCpu->hm.s.StatLoadFull, "/HM/CPU%d/Load/Full", "VM-entry loading the full guest-state.");
790
791	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadRmSelBase, "/HM/CPU%d/VMXCheck/RMSelBase", "Could not use VMX due to unsuitable real-mode selector base.");
792	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadRmSelLimit, "/HM/CPU%d/VMXCheck/RMSelLimit", "Could not use VMX due to unsuitable real-mode selector limit.");
793	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckRmOk, "/HM/CPU%d/VMXCheck/VMX_RM", "VMX execution in real (V86) mode OK.");
794	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadSel, "/HM/CPU%d/VMXCheck/Selector", "Could not use VMX due to unsuitable selector.");
795	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadRpl, "/HM/CPU%d/VMXCheck/RPL", "Could not use VMX due to unsuitable RPL.");
796	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadLdt, "/HM/CPU%d/VMXCheck/LDT", "Could not use VMX due to unsuitable LDT.");
797	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckBadTr, "/HM/CPU%d/VMXCheck/TR", "Could not use VMX due to unsuitable TR.");
798	HM_REG_COUNTER(&pVCpu->hm.s.StatVmxCheckPmOk, "/HM/CPU%d/VMXCheck/VMX_PM", "VMX execution in protected mode OK.");
799
800	#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
801	HM_REG_COUNTER(&pVCpu->hm.s.StatFpu64SwitchBack, "/HM/CPU%d/Switch64/Fpu", "Saving guest FPU/XMM state.");
802	HM_REG_COUNTER(&pVCpu->hm.s.StatDebug64SwitchBack, "/HM/CPU%d/Switch64/Debug", "Saving guest debug state.");
803	#endif
804
805	for (unsigned j = 0; j < RT_ELEMENTS(pVCpu->hm.s.StatExitCRxWrite); j++)
806	{
807	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitCRxWrite[j], STAMTYPE_COUNTER, STAMVISIBILITY_USED,
808	STAMUNIT_OCCURENCES, "Profiling of CRx writes",
809	"/HM/CPU%d/Exit/Instr/CR/Write/%x", i, j);
810	AssertRC(rc);
811	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitCRxRead[j], STAMTYPE_COUNTER, STAMVISIBILITY_USED,
812	STAMUNIT_OCCURENCES, "Profiling of CRx reads",
813	"/HM/CPU%d/Exit/Instr/CR/Read/%x", i, j);
814	AssertRC(rc);
815	}
816
817	#undef HM_REG_COUNTER
818
819	pVCpu->hm.s.paStatExitReason = NULL;
820
821	rc = MMHyperAlloc(pVM, MAX_EXITREASON_STAT * sizeof(pVCpu->hm.s.paStatExitReason), 0 / uAlignment */, MM_TAG_HM,
822	(void **)&pVCpu->hm.s.paStatExitReason);
823	AssertRC(rc);
824	if (RT_SUCCESS(rc))
825	{
826	const char * const *papszDesc = ASMIsIntelCpu() ? &g_apszVTxExitReasons[0] : &g_apszAmdVExitReasons[0];
827	for (int j = 0; j < MAX_EXITREASON_STAT; j++)
828	{
829	if (papszDesc[j])
830	{
831	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.paStatExitReason[j], STAMTYPE_COUNTER, STAMVISIBILITY_USED,
832	STAMUNIT_OCCURENCES, papszDesc[j], "/HM/CPU%d/Exit/Reason/%02x", i, j);
833	AssertRC(rc);
834	}
835	}
836	rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitReasonNpf, STAMTYPE_COUNTER, STAMVISIBILITY_USED, STAMUNIT_OCCURENCES,
837	"Nested page fault", "/HM/CPU%d/Exit/Reason/#NPF", i);
838	AssertRC(rc);
839	}
840	pVCpu->hm.s.paStatExitReasonR0 = MMHyperR3ToR0(pVM, pVCpu->hm.s.paStatExitReason);
841	# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
842	Assert(pVCpu->hm.s.paStatExitReasonR0 != NIL_RTR0PTR \|\| !HMIsEnabled(pVM));
843	# else
844	Assert(pVCpu->hm.s.paStatExitReasonR0 != NIL_RTR0PTR);
845	# endif
846
847	rc = MMHyperAlloc(pVM, sizeof(STAMCOUNTER) * 256, 8, MM_TAG_HM, (void **)&pVCpu->hm.s.paStatInjectedIrqs);
848	AssertRCReturn(rc, rc);
849	pVCpu->hm.s.paStatInjectedIrqsR0 = MMHyperR3ToR0(pVM, pVCpu->hm.s.paStatInjectedIrqs);
850	# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
851	Assert(pVCpu->hm.s.paStatInjectedIrqsR0 != NIL_RTR0PTR \|\| !HMIsEnabled(pVM));
852	# else
853	Assert(pVCpu->hm.s.paStatInjectedIrqsR0 != NIL_RTR0PTR);
854	# endif
855	for (unsigned j = 0; j < 255; j++)
856	{
857	STAMR3RegisterF(pVM, &pVCpu->hm.s.paStatInjectedIrqs[j], STAMTYPE_COUNTER, STAMVISIBILITY_USED, STAMUNIT_OCCURENCES,
858	"Injected event.",
859	(j < 0x20) ? "/HM/CPU%d/EventInject/InjectTrap/%02X" : "/HM/CPU%d/EventInject/InjectIRQ/%02X", i, j);
860	}
861
862	#endif /* VBOX_WITH_STATISTICS */
863	}
864
865	#ifdef VBOX_WITH_CRASHDUMP_MAGIC
866	/*
867	* Magic marker for searching in crash dumps.
868	*/
869	for (VMCPUID i = 0; i < pVM->cCpus; i++)
870	{
871	PVMCPU pVCpu = &pVM->aCpus[i];
872
873	PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
874	strcpy((char *)pCache->aMagic, "VMCSCACHE Magic");
875	pCache->uMagic = UINT64_C(0xDEADBEEFDEADBEEF);
876	}
877	#endif
878
879	return VINF_SUCCESS;
880	}
881
882
883	/**
884	* Called when a init phase has completed.
885	*
886	* @returns VBox status code.
887	* @param pVM The VM.
888	* @param enmWhat The phase that completed.
889	*/
890	VMMR3_INT_DECL(int) HMR3InitCompleted(PVM pVM, VMINITCOMPLETED enmWhat)
891	{
892	switch (enmWhat)
893	{
894	case VMINITCOMPLETED_RING3:
895	return hmR3InitCPU(pVM);
896	case VMINITCOMPLETED_RING0:
897	return hmR3InitFinalizeR0(pVM);
898	default:
899	return VINF_SUCCESS;
900	}
901	}
902
903
904	/**
905	* Turns off normal raw mode features.
906	*
907	* @param pVM Pointer to the VM.
908	*/
909	static void hmR3DisableRawMode(PVM pVM)
910	{
911	/* Reinit the paging mode to force the new shadow mode. */
912	for (VMCPUID i = 0; i < pVM->cCpus; i++)
913	{
914	PVMCPU pVCpu = &pVM->aCpus[i];
915
916	PGMR3ChangeMode(pVM, pVCpu, PGMMODE_REAL);
917	}
918	}
919
920
921	/**
922	* Initialize VT-x or AMD-V.
923	*
924	* @returns VBox status code.
925	* @param pVM Pointer to the VM.
926	*/
927	static int hmR3InitFinalizeR0(PVM pVM)
928	{
929	int rc;
930
931	if (!HMIsEnabled(pVM))
932	return VINF_SUCCESS;
933
934	/*
935	* Hack to allow users to work around broken BIOSes that incorrectly set
936	* EFER.SVME, which makes us believe somebody else is already using AMD-V.
937	*/
938	if ( !pVM->hm.s.vmx.fSupported
939	&& !pVM->hm.s.svm.fSupported
940	&& pVM->hm.s.lLastError == VERR_SVM_IN_USE /* implies functional AMD-V */
941	&& RTEnvExist("VBOX_HWVIRTEX_IGNORE_SVM_IN_USE"))
942	{
943	LogRel(("HM: VBOX_HWVIRTEX_IGNORE_SVM_IN_USE active!\n"));
944	pVM->hm.s.svm.fSupported = true;
945	pVM->hm.s.svm.fIgnoreInUseError = true;
946	pVM->hm.s.lLastError = VINF_SUCCESS;
947	}
948
949	/*
950	* Report ring-0 init errors.
951	*/
952	if ( !pVM->hm.s.vmx.fSupported
953	&& !pVM->hm.s.svm.fSupported)
954	{
955	LogRel(("HM: Failed to initialize VT-x / AMD-V: %Rrc\n", pVM->hm.s.lLastError));
956	LogRel(("HM: VMX MSR_IA32_FEATURE_CONTROL=%RX64\n", pVM->hm.s.vmx.Msrs.u64FeatureCtrl));
957	switch (pVM->hm.s.lLastError)
958	{
959	case VERR_VMX_IN_VMX_ROOT_MODE:
960	return VM_SET_ERROR(pVM, VERR_VMX_IN_VMX_ROOT_MODE, "VT-x is being used by another hypervisor");
961	case VERR_VMX_NO_VMX:
962	return VM_SET_ERROR(pVM, VERR_VMX_NO_VMX, "VT-x is not available");
963	case VERR_VMX_MSR_VMX_DISABLED:
964	return VM_SET_ERROR(pVM, VERR_VMX_MSR_VMX_DISABLED, "VT-x is disabled in the BIOS");
965	case VERR_VMX_MSR_ALL_VMX_DISABLED:
966	return VM_SET_ERROR(pVM, VERR_VMX_MSR_ALL_VMX_DISABLED, "VT-x is disabled in the BIOS for all CPU modes");
967	case VERR_VMX_MSR_LOCKING_FAILED:
968	return VM_SET_ERROR(pVM, VERR_VMX_MSR_LOCKING_FAILED, "Failed to lock VT-x features while trying to enable VT-x");
969	case VERR_VMX_MSR_VMX_ENABLE_FAILED:
970	return VM_SET_ERROR(pVM, VERR_VMX_MSR_VMX_ENABLE_FAILED, "Failed to enable VT-x features");
971	case VERR_VMX_MSR_SMX_VMX_ENABLE_FAILED:
972	return VM_SET_ERROR(pVM, VERR_VMX_MSR_SMX_VMX_ENABLE_FAILED, "Failed to enable VT-x features in SMX mode");
973
974	case VERR_SVM_IN_USE:
975	return VM_SET_ERROR(pVM, VERR_SVM_IN_USE, "AMD-V is being used by another hypervisor");
976	case VERR_SVM_NO_SVM:
977	return VM_SET_ERROR(pVM, VERR_SVM_NO_SVM, "AMD-V is not available");
978	case VERR_SVM_DISABLED:
979	return VM_SET_ERROR(pVM, VERR_SVM_DISABLED, "AMD-V is disabled in the BIOS");
980	}
981	return VMSetError(pVM, pVM->hm.s.lLastError, RT_SRC_POS, "HM ring-0 init failed: %Rrc", pVM->hm.s.lLastError);
982	}
983
984	/*
985	* Enable VT-x or AMD-V on all host CPUs.
986	*/
987	rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /idCpu/, VMMR0_DO_HM_ENABLE, 0, NULL);
988	if (RT_FAILURE(rc))
989	{
990	LogRel(("HM: Failed to enable, error %Rrc\n", rc));
991	HMR3CheckError(pVM, rc);
992	return rc;
993	}
994
995	/*
996	* No TPR patching is required when the IO-APIC is not enabled for this VM.
997	* (Main should have taken care of this already)
998	*/
999	pVM->hm.s.fHasIoApic = PDMHasIoApic(pVM);
1000	if (!pVM->hm.s.fHasIoApic)
1001	{
1002	Assert(!pVM->hm.s.fTprPatchingAllowed); /* paranoia */
1003	pVM->hm.s.fTprPatchingAllowed = false;
1004	}
1005
1006	/*
1007	* Do the vendor specific initalization .
1008	* .
1009	* Note! We disable release log buffering here since we're doing relatively .
1010	* lot of logging and doesn't want to hit the disk with each LogRel .
1011	* statement.
1012	*/
1013	AssertLogRelReturn(!pVM->hm.s.fInitialized, VERR_HM_IPE_5);
1014	bool fOldBuffered = RTLogRelSetBuffering(true /fBuffered/);
1015	if (pVM->hm.s.vmx.fSupported)
1016	rc = hmR3InitFinalizeR0Intel(pVM);
1017	else
1018	rc = hmR3InitFinalizeR0Amd(pVM);
1019	LogRel(("HM: VT-x/AMD-V init method: %s\n", (pVM->hm.s.fGlobalInit) ? "GLOBAL" : "LOCAL"));
1020	RTLogRelSetBuffering(fOldBuffered);
1021	pVM->hm.s.fInitialized = true;
1022
1023	return rc;
1024	}
1025
1026
1027	/**
1028	* Finish VT-x initialization (after ring-0 init).
1029	*
1030	* @returns VBox status code.
1031	* @param pVM The cross context VM structure.
1032	*/
1033	static int hmR3InitFinalizeR0Intel(PVM pVM)
1034	{
1035	int rc;
1036
1037	Log(("pVM->hm.s.vmx.fSupported = %d\n", pVM->hm.s.vmx.fSupported));
1038	AssertLogRelReturn(pVM->hm.s.vmx.Msrs.u64FeatureCtrl != 0, VERR_HM_IPE_4);
1039
1040	uint64_t val;
1041	uint64_t zap;
1042	RTGCPHYS GCPhys = 0;
1043
1044	LogRel(("HM: Using VT-x implementation 2.0!\n"));
1045	LogRel(("HM: Host CR4 = %#RX64\n", pVM->hm.s.vmx.u64HostCr4));
1046	LogRel(("HM: Host EFER = %#RX64\n", pVM->hm.s.vmx.u64HostEfer));
1047	LogRel(("HM: MSR_IA32_FEATURE_CONTROL = %#RX64\n", pVM->hm.s.vmx.Msrs.u64FeatureCtrl));
1048	if (!(pVM->hm.s.vmx.Msrs.u64FeatureCtrl & MSR_IA32_FEATURE_CONTROL_LOCK))
1049	LogRel(("HM: IA32_FEATURE_CONTROL lock bit not set, possibly bad hardware!\n"));
1050	LogRel(("HM: MSR_IA32_VMX_BASIC_INFO = %#RX64\n", pVM->hm.s.vmx.Msrs.u64BasicInfo));
1051	LogRel(("HM: VMCS id = %#x\n", MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hm.s.vmx.Msrs.u64BasicInfo)));
1052	LogRel(("HM: VMCS size = %u bytes\n", MSR_IA32_VMX_BASIC_INFO_VMCS_SIZE(pVM->hm.s.vmx.Msrs.u64BasicInfo)));
1053	LogRel(("HM: VMCS physical address limit = %s\n", MSR_IA32_VMX_BASIC_INFO_VMCS_PHYS_WIDTH(pVM->hm.s.vmx.Msrs.u64BasicInfo) ? "< 4 GB" : "None"));
1054	LogRel(("HM: VMCS memory type = %#x\n", MSR_IA32_VMX_BASIC_INFO_VMCS_MEM_TYPE(pVM->hm.s.vmx.Msrs.u64BasicInfo)));
1055	LogRel(("HM: Dual-monitor treatment support = %RTbool\n", RT_BOOL(MSR_IA32_VMX_BASIC_INFO_VMCS_DUAL_MON(pVM->hm.s.vmx.Msrs.u64BasicInfo))));
1056	LogRel(("HM: OUTS & INS instruction-info = %RTbool\n", RT_BOOL(MSR_IA32_VMX_BASIC_INFO_VMCS_INS_OUTS(pVM->hm.s.vmx.Msrs.u64BasicInfo))));
1057	LogRel(("HM: Max resume loops = %u\n", pVM->hm.s.cMaxResumeLoops));
1058
1059	LogRel(("HM: MSR_IA32_VMX_PINBASED_CTLS = %#RX64\n", pVM->hm.s.vmx.Msrs.VmxPinCtls.u));
1060	val = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1;
1061	zap = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.disallowed0;
1062	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PIN_EXEC_EXT_INT_EXIT);
1063	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PIN_EXEC_NMI_EXIT);
1064	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI);
1065	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PIN_EXEC_PREEMPT_TIMER);
1066
1067	LogRel(("HM: MSR_IA32_VMX_PROCBASED_CTLS = %#RX64\n", pVM->hm.s.vmx.Msrs.VmxProcCtls.u));
1068	val = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1;
1069	zap = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.disallowed0;
1070	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_INT_WINDOW_EXIT);
1071	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING);
1072	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_HLT_EXIT);
1073	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_INVLPG_EXIT);
1074	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_MWAIT_EXIT);
1075	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_RDPMC_EXIT);
1076	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT);
1077	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT);
1078	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT);
1079	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT);
1080	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT);
1081	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW);
1082	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_NMI_WINDOW_EXIT);
1083	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT);
1084	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_UNCOND_IO_EXIT);
1085	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_USE_IO_BITMAPS);
1086	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG);
1087	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS);
1088	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_MONITOR_EXIT);
1089	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_PAUSE_EXIT);
1090	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL);
1091	if (pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
1092	{
1093	LogRel(("HM: MSR_IA32_VMX_PROCBASED_CTLS2 = %#RX64\n", pVM->hm.s.vmx.Msrs.VmxProcCtls2.u));
1094	val = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1;
1095	zap = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.disallowed0;
1096	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC);
1097	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_EPT);
1098	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_DESCRIPTOR_TABLE_EXIT);
1099	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP);
1100	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_VIRT_X2APIC);
1101	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_VPID);
1102	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT);
1103	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST);
1104	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_PAUSE_LOOP_EXIT);
1105	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_RDRAND_EXIT);
1106	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_INVPCID);
1107	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_VMFUNC);
1108	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_VMCS_SHADOWING);
1109	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_RDSEED_EXIT);
1110	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_EPT_VE);
1111	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_PROC_EXEC2_XSAVES);
1112	}
1113
1114	LogRel(("HM: MSR_IA32_VMX_ENTRY_CTLS = %#RX64\n", pVM->hm.s.vmx.Msrs.VmxEntry.u));
1115	val = pVM->hm.s.vmx.Msrs.VmxEntry.n.allowed1;
1116	zap = pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0;
1117	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_LOAD_DEBUG);
1118	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST);
1119	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_ENTRY_SMM);
1120	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_DEACTIVATE_DUALMON);
1121	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_PERF_MSR);
1122	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_PAT_MSR);
1123	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_EFER_MSR);
1124
1125	LogRel(("HM: MSR_IA32_VMX_EXIT_CTLS = %#RX64\n", pVM->hm.s.vmx.Msrs.VmxExit.u));
1126	val = pVM->hm.s.vmx.Msrs.VmxExit.n.allowed1;
1127	zap = pVM->hm.s.vmx.Msrs.VmxExit.n.disallowed0;
1128	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_SAVE_DEBUG);
1129	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE);
1130	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_LOAD_PERF_MSR);
1131	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_ACK_EXT_INT);
1132	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_SAVE_GUEST_PAT_MSR);
1133	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_LOAD_HOST_PAT_MSR);
1134	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_SAVE_GUEST_EFER_MSR);
1135	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_LOAD_HOST_EFER_MSR);
1136	HMVMX_REPORT_FEATURE(val, zap, VMX_VMCS_CTRL_EXIT_SAVE_VMX_PREEMPT_TIMER);
1137
1138	if (pVM->hm.s.vmx.Msrs.u64EptVpidCaps)
1139	{
1140	val = pVM->hm.s.vmx.Msrs.u64EptVpidCaps;
1141	LogRel(("HM: MSR_IA32_VMX_EPT_VPID_CAP = %#RX64\n", val));
1142	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_RWX_X_ONLY);
1143	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_RWX_W_ONLY);
1144	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_RWX_WX_ONLY);
1145	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_GAW_21_BITS);
1146	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_GAW_30_BITS);
1147	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_GAW_39_BITS);
1148	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_GAW_48_BITS);
1149	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_GAW_57_BITS);
1150	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_EMT_UC);
1151	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_EMT_WC);
1152	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_EMT_WT);
1153	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_EMT_WP);
1154	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_EMT_WB);
1155	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_SP_21_BITS);
1156	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_SP_30_BITS);
1157	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_SP_39_BITS);
1158	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_SP_48_BITS);
1159	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVEPT);
1160	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_SINGLE_CONTEXT);
1161	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVEPT_ALL_CONTEXTS);
1162	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVVPID);
1163	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_INDIV_ADDR);
1164	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT);
1165	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_ALL_CONTEXTS);
1166	HMVMX_REPORT_CAPABILITY(val, MSR_IA32_VMX_EPT_VPID_CAP_INVVPID_SINGLE_CONTEXT_RETAIN_GLOBALS);
1167	}
1168
1169	val = pVM->hm.s.vmx.Msrs.u64Misc;
1170	LogRel(("HM: MSR_IA32_VMX_MISC = %#RX64\n", val));
1171	if (MSR_IA32_VMX_MISC_PREEMPT_TSC_BIT(val) == pVM->hm.s.vmx.cPreemptTimerShift)
1172	LogRel(("HM: MSR_IA32_VMX_MISC_PREEMPT_TSC_BIT = %#x\n", MSR_IA32_VMX_MISC_PREEMPT_TSC_BIT(val)));
1173	else
1174	{
1175	LogRel(("HM: MSR_IA32_VMX_MISC_PREEMPT_TSC_BIT = %#x - erratum detected, using %#x instead\n",
1176	MSR_IA32_VMX_MISC_PREEMPT_TSC_BIT(val), pVM->hm.s.vmx.cPreemptTimerShift));
1177	}
1178
1179	LogRel(("HM: MSR_IA32_VMX_MISC_STORE_EFERLMA_VMEXIT = %RTbool\n", RT_BOOL(MSR_IA32_VMX_MISC_STORE_EFERLMA_VMEXIT(val))));
1180	LogRel(("HM: MSR_IA32_VMX_MISC_ACTIVITY_STATES = %#x\n", MSR_IA32_VMX_MISC_ACTIVITY_STATES(val)));
1181	LogRel(("HM: MSR_IA32_VMX_MISC_CR3_TARGET = %#x\n", MSR_IA32_VMX_MISC_CR3_TARGET(val)));
1182	LogRel(("HM: MSR_IA32_VMX_MISC_MAX_MSR = %u\n", MSR_IA32_VMX_MISC_MAX_MSR(val)));
1183	LogRel(("HM: MSR_IA32_VMX_MISC_RDMSR_SMBASE_MSR_SMM = %RTbool\n", RT_BOOL(MSR_IA32_VMX_MISC_RDMSR_SMBASE_MSR_SMM(val))));
1184	LogRel(("HM: MSR_IA32_VMX_MISC_SMM_MONITOR_CTL_B2 = %RTbool\n", RT_BOOL(MSR_IA32_VMX_MISC_SMM_MONITOR_CTL_B2(val))));
1185	LogRel(("HM: MSR_IA32_VMX_MISC_VMWRITE_VMEXIT_INFO = %RTbool\n", RT_BOOL(MSR_IA32_VMX_MISC_VMWRITE_VMEXIT_INFO(val))));
1186	LogRel(("HM: MSR_IA32_VMX_MISC_MSEG_ID = %#x\n", MSR_IA32_VMX_MISC_MSEG_ID(val)));
1187
1188	/* Paranoia */
1189	AssertRelease(MSR_IA32_VMX_MISC_MAX_MSR(pVM->hm.s.vmx.Msrs.u64Misc) >= 512);
1190
1191	LogRel(("HM: MSR_IA32_VMX_CR0_FIXED0 = %#RX64\n", pVM->hm.s.vmx.Msrs.u64Cr0Fixed0));
1192	LogRel(("HM: MSR_IA32_VMX_CR0_FIXED1 = %#RX64\n", pVM->hm.s.vmx.Msrs.u64Cr0Fixed1));
1193	LogRel(("HM: MSR_IA32_VMX_CR4_FIXED0 = %#RX64\n", pVM->hm.s.vmx.Msrs.u64Cr4Fixed0));
1194	LogRel(("HM: MSR_IA32_VMX_CR4_FIXED1 = %#RX64\n", pVM->hm.s.vmx.Msrs.u64Cr4Fixed1));
1195
1196	val = pVM->hm.s.vmx.Msrs.u64VmcsEnum;
1197	LogRel(("HM: MSR_IA32_VMX_VMCS_ENUM = %#RX64\n", val));
1198	LogRel(("HM: MSR_IA32_VMX_VMCS_ENUM_HIGHEST_INDEX = %#x\n", MSR_IA32_VMX_VMCS_ENUM_HIGHEST_INDEX(val)));
1199
1200	val = pVM->hm.s.vmx.Msrs.u64Vmfunc;
1201	if (val)
1202	{
1203	LogRel(("HM: MSR_A32_VMX_VMFUNC = %#RX64\n", val));
1204	HMVMX_REPORT_ALLOWED_FEATURE(val, VMX_VMCS_CTRL_VMFUNC_EPTP_SWITCHING);
1205	}
1206
1207	LogRel(("HM: APIC-access page physaddr = %#RHp\n", pVM->hm.s.vmx.HCPhysApicAccess));
1208
1209	for (VMCPUID i = 0; i < pVM->cCpus; i++)
1210	{
1211	LogRel(("HM: VCPU%3d: MSR bitmap physaddr = %#RHp\n", i, pVM->aCpus[i].hm.s.vmx.HCPhysMsrBitmap));
1212	LogRel(("HM: VCPU%3d: VMCS physaddr = %#RHp\n", i, pVM->aCpus[i].hm.s.vmx.HCPhysVmcs));
1213	}
1214
1215	/*
1216	* EPT and unhampered guest execution are determined in HMR3Init, verify the sanity of that.
1217	*/
1218	AssertLogRelReturn( !pVM->hm.s.fNestedPaging
1219	\|\| (pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_EPT),
1220	VERR_HM_IPE_1);
1221	AssertLogRelReturn( !pVM->hm.s.vmx.fUnrestrictedGuest
1222	\|\| ( (pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST)
1223	&& pVM->hm.s.fNestedPaging),
1224	VERR_HM_IPE_1);
1225
1226	/*
1227	* Enable VPID if configured and supported.
1228	*/
1229	if (pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VPID)
1230	pVM->hm.s.vmx.fVpid = pVM->hm.s.vmx.fAllowVpid;
1231
1232	/*
1233	* Disallow RDTSCP in the guest if there is no secondary process-based VM execution controls as otherwise
1234	* RDTSCP would cause a #UD. There might be no CPUs out there where this happens, as RDTSCP was introduced
1235	* in Nehalems and secondary VM exec. controls should be supported in all of them, but nonetheless it's Intel...
1236	*/
1237	if ( !(pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
1238	&& CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP))
1239	{
1240	CPUMClearGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_RDTSCP);
1241	LogRel(("HM: RDTSCP disabled\n"));
1242	}
1243
1244	if (!pVM->hm.s.vmx.fUnrestrictedGuest)
1245	{
1246	/* Allocate three pages for the TSS we need for real mode emulation. (2 pages for the IO bitmap) */
1247	rc = PDMR3VmmDevHeapAlloc(pVM, HM_VTX_TOTAL_DEVHEAP_MEM, (RTR3PTR *)&pVM->hm.s.vmx.pRealModeTSS);
1248	if (RT_SUCCESS(rc))
1249	{
1250	/* The IO bitmap starts right after the virtual interrupt redirection bitmap.
1251	Refer Intel spec. 20.3.3 "Software Interrupt Handling in Virtual-8086 mode"
1252	esp. Figure 20-5.*/
1253	ASMMemZero32(pVM->hm.s.vmx.pRealModeTSS, sizeof(*pVM->hm.s.vmx.pRealModeTSS));
1254	pVM->hm.s.vmx.pRealModeTSS->offIoBitmap = sizeof(*pVM->hm.s.vmx.pRealModeTSS);
1255
1256	/* Bit set to 0 means software interrupts are redirected to the
1257	8086 program interrupt handler rather than switching to
1258	protected-mode handler. */
1259	memset(pVM->hm.s.vmx.pRealModeTSS->IntRedirBitmap, 0, sizeof(pVM->hm.s.vmx.pRealModeTSS->IntRedirBitmap));
1260
1261	/* Allow all port IO, so that port IO instructions do not cause
1262	exceptions and would instead cause a VM-exit (based on VT-x's
1263	IO bitmap which we currently configure to always cause an exit). */
1264	memset(pVM->hm.s.vmx.pRealModeTSS + 1, 0, PAGE_SIZE * 2);
1265	((unsigned char )pVM->hm.s.vmx.pRealModeTSS + HM_VTX_TSS_SIZE - 2) = 0xff;
1266
1267	/*
1268	* Construct a 1024 element page directory with 4 MB pages for
1269	* the identity mapped page table used in real and protected mode
1270	* without paging with EPT.
1271	*/
1272	pVM->hm.s.vmx.pNonPagingModeEPTPageTable = (PX86PD)((char )pVM->hm.s.vmx.pRealModeTSS + PAGE_SIZE 3);
1273	for (uint32_t i = 0; i < X86_PG_ENTRIES; i++)
1274	{
1275	pVM->hm.s.vmx.pNonPagingModeEPTPageTable->a[i].u = _4M * i;
1276	pVM->hm.s.vmx.pNonPagingModeEPTPageTable->a[i].u \|= X86_PDE4M_P \| X86_PDE4M_RW \| X86_PDE4M_US
1277	\| X86_PDE4M_A \| X86_PDE4M_D \| X86_PDE4M_PS
1278	\| X86_PDE4M_G;
1279	}
1280
1281	/* We convert it here every time as pci regions could be reconfigured. */
1282	rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pRealModeTSS, &GCPhys);
1283	AssertRCReturn(rc, rc);
1284	LogRel(("HM: Real Mode TSS guest physaddr = %#RGp\n", GCPhys));
1285
1286	rc = PDMVmmDevHeapR3ToGCPhys(pVM, pVM->hm.s.vmx.pNonPagingModeEPTPageTable, &GCPhys);
1287	AssertRCReturn(rc, rc);
1288	LogRel(("HM: Non-Paging Mode EPT CR3 = %#RGp\n", GCPhys));
1289	}
1290	else
1291	{
1292	LogRel(("HM: No real mode VT-x support (PDMR3VMMDevHeapAlloc returned %Rrc)\n", rc));
1293	pVM->hm.s.vmx.pRealModeTSS = NULL;
1294	pVM->hm.s.vmx.pNonPagingModeEPTPageTable = NULL;
1295	return VMSetError(pVM, rc, RT_SRC_POS,
1296	"HM failure: No real mode VT-x support (PDMR3VMMDevHeapAlloc returned %Rrc)", rc);
1297	}
1298	}
1299
1300	LogRel((pVM->hm.s.fAllow64BitGuests
1301	? "HM: Guest support: 32-bit and 64-bit\n"
1302	: "HM: Guest support: 32-bit only\n"));
1303
1304	/*
1305	* Call ring-0 to set up the VM.
1306	*/
1307	rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /* idCpu /, VMMR0_DO_HM_SETUP_VM, 0 / u64Arg /, NULL / pReqHdr */);
1308	if (rc != VINF_SUCCESS)
1309	{
1310	AssertMsgFailed(("%Rrc\n", rc));
1311	LogRel(("HM: VMX setup failed with rc=%Rrc!\n", rc));
1312	for (VMCPUID i = 0; i < pVM->cCpus; i++)
1313	{
1314	PVMCPU pVCpu = &pVM->aCpus[i];
1315	LogRel(("HM: CPU[%u] Last instruction error %#x\n", i, pVCpu->hm.s.vmx.LastError.u32InstrError));
1316	LogRel(("HM: CPU[%u] HM error %#x (%u)\n", i, pVCpu->hm.s.u32HMError, pVCpu->hm.s.u32HMError));
1317	}
1318	HMR3CheckError(pVM, rc);
1319	return VMSetError(pVM, rc, RT_SRC_POS, "VT-x setup failed: %Rrc", rc);
1320	}
1321
1322	LogRel(("HM: Supports VMCS EFER fields = %RTbool\n", pVM->hm.s.vmx.fSupportsVmcsEfer));
1323	LogRel(("HM: VMX enabled!\n"));
1324	pVM->hm.s.vmx.fEnabled = true;
1325
1326	hmR3DisableRawMode(pVM); /** @todo make this go away! */
1327
1328	/*
1329	* Change the CPU features.
1330	*/
1331	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_SEP);
1332	if (pVM->hm.s.fAllow64BitGuests)
1333	{
1334	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_PAE);
1335	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_LONG_MODE);
1336	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_SYSCALL); /* 64 bits only on Intel CPUs */
1337	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_LAHF);
1338	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_NX);
1339	}
1340	/* Turn on NXE if PAE has been enabled and the host has turned on NXE
1341	(we reuse the host EFER in the switcher). */
1342	/** @todo this needs to be fixed properly!! */
1343	else if (CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_PAE))
1344	{
1345	if (pVM->hm.s.vmx.u64HostEfer & MSR_K6_EFER_NXE)
1346	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_NX);
1347	else
1348	LogRel(("HM: NX not enabled on the host, unavailable to PAE guest\n"));
1349	}
1350
1351	/*
1352	* Log configuration details.
1353	*/
1354	if (pVM->hm.s.fNestedPaging)
1355	{
1356	LogRel(("HM: Nested paging enabled!\n"));
1357	if (pVM->hm.s.vmx.enmFlushEpt == VMXFLUSHEPT_SINGLE_CONTEXT)
1358	LogRel(("HM: EPT flush type = VMXFLUSHEPT_SINGLE_CONTEXT\n"));
1359	else if (pVM->hm.s.vmx.enmFlushEpt == VMXFLUSHEPT_ALL_CONTEXTS)
1360	LogRel(("HM: EPT flush type = VMXFLUSHEPT_ALL_CONTEXTS\n"));
1361	else if (pVM->hm.s.vmx.enmFlushEpt == VMXFLUSHEPT_NOT_SUPPORTED)
1362	LogRel(("HM: EPT flush type = VMXFLUSHEPT_NOT_SUPPORTED\n"));
1363	else
1364	LogRel(("HM: EPT flush type = %d\n", pVM->hm.s.vmx.enmFlushEpt));
1365
1366	if (pVM->hm.s.vmx.fUnrestrictedGuest)
1367	LogRel(("HM: Unrestricted guest execution enabled!\n"));
1368
1369	#if HC_ARCH_BITS == 64
1370	if (pVM->hm.s.fLargePages)
1371	{
1372	/* Use large (2 MB) pages for our EPT PDEs where possible. */
1373	PGMSetLargePageUsage(pVM, true);
1374	LogRel(("HM: Large page support enabled\n"));
1375	}
1376	#endif
1377	}
1378	else
1379	Assert(!pVM->hm.s.vmx.fUnrestrictedGuest);
1380
1381	if (pVM->hm.s.vmx.fVpid)
1382	{
1383	LogRel(("HM: VPID enabled!\n"));
1384	if (pVM->hm.s.vmx.enmFlushVpid == VMXFLUSHVPID_INDIV_ADDR)
1385	LogRel(("HM: VPID flush type = VMXFLUSHVPID_INDIV_ADDR\n"));
1386	else if (pVM->hm.s.vmx.enmFlushVpid == VMXFLUSHVPID_SINGLE_CONTEXT)
1387	LogRel(("HM: VPID flush type = VMXFLUSHVPID_SINGLE_CONTEXT\n"));
1388	else if (pVM->hm.s.vmx.enmFlushVpid == VMXFLUSHVPID_ALL_CONTEXTS)
1389	LogRel(("HM: VPID flush type = VMXFLUSHVPID_ALL_CONTEXTS\n"));
1390	else if (pVM->hm.s.vmx.enmFlushVpid == VMXFLUSHVPID_SINGLE_CONTEXT_RETAIN_GLOBALS)
1391	LogRel(("HM: VPID flush type = VMXFLUSHVPID_SINGLE_CONTEXT_RETAIN_GLOBALS\n"));
1392	else
1393	LogRel(("HM: VPID flush type = %d\n", pVM->hm.s.vmx.enmFlushVpid));
1394	}
1395	else if (pVM->hm.s.vmx.enmFlushVpid == VMXFLUSHVPID_NOT_SUPPORTED)
1396	LogRel(("HM: Ignoring VPID capabilities of CPU\n"));
1397
1398	if (pVM->hm.s.vmx.fUsePreemptTimer)
1399	LogRel(("HM: VMX-preemption timer enabled (cPreemptTimerShift=%u)\n", pVM->hm.s.vmx.cPreemptTimerShift));
1400	else
1401	LogRel(("HM: VMX-preemption timer disabled\n"));
1402
1403	return VINF_SUCCESS;
1404	}
1405
1406
1407	/**
1408	* Finish AMD-V initialization (after ring-0 init).
1409	*
1410	* @returns VBox status code.
1411	* @param pVM The cross context VM structure.
1412	*/
1413	static int hmR3InitFinalizeR0Amd(PVM pVM)
1414	{
1415	Log(("pVM->hm.s.svm.fSupported = %d\n", pVM->hm.s.svm.fSupported));
1416
1417	LogRel(("HM: Using AMD-V implementation 2.0!\n"));
1418
1419	uint32_t u32Family;
1420	uint32_t u32Model;
1421	uint32_t u32Stepping;
1422	if (HMAmdIsSubjectToErratum170(&u32Family, &u32Model, &u32Stepping))
1423	LogRel(("HM: AMD Cpu with erratum 170 family %#x model %#x stepping %#x\n", u32Family, u32Model, u32Stepping));
1424	LogRel(("HM: Max resume loops = %u\n", pVM->hm.s.cMaxResumeLoops));
1425	LogRel(("HM: CPUID 0x80000001.u32AMDFeatureECX = %#RX32\n", pVM->hm.s.cpuid.u32AMDFeatureECX));
1426	LogRel(("HM: CPUID 0x80000001.u32AMDFeatureEDX = %#RX32\n", pVM->hm.s.cpuid.u32AMDFeatureEDX));
1427	LogRel(("HM: AMD HWCR MSR = %#RX64\n", pVM->hm.s.svm.u64MsrHwcr));
1428	LogRel(("HM: AMD-V revision = %#x\n", pVM->hm.s.svm.u32Rev));
1429	LogRel(("HM: AMD-V max ASID = %RU32\n", pVM->hm.s.uMaxAsid));
1430	LogRel(("HM: AMD-V features = %#x\n", pVM->hm.s.svm.u32Features));
1431
1432	/*
1433	* Enumerate AMD-V features.
1434	*/
1435	static const struct { uint32_t fFlag; const char *pszName; } s_aSvmFeatures[] =
1436	{
1437	#define HMSVM_REPORT_FEATURE(a_Define) { a_Define, #a_Define }
1438	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING),
1439	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_LBR_VIRT),
1440	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_SVM_LOCK),
1441	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_NRIP_SAVE),
1442	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_TSC_RATE_MSR),
1443	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_VMCB_CLEAN),
1444	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_FLUSH_BY_ASID),
1445	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_DECODE_ASSIST),
1446	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_PAUSE_FILTER),
1447	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_PAUSE_FILTER_THRESHOLD),
1448	HMSVM_REPORT_FEATURE(AMD_CPUID_SVM_FEATURE_EDX_AVIC),
1449	#undef HMSVM_REPORT_FEATURE
1450	};
1451
1452	uint32_t fSvmFeatures = pVM->hm.s.svm.u32Features;
1453	for (unsigned i = 0; i < RT_ELEMENTS(s_aSvmFeatures); i++)
1454	if (fSvmFeatures & s_aSvmFeatures[i].fFlag)
1455	{
1456	LogRel(("HM: %s\n", s_aSvmFeatures[i].pszName));
1457	fSvmFeatures &= ~s_aSvmFeatures[i].fFlag;
1458	}
1459	if (fSvmFeatures)
1460	for (unsigned iBit = 0; iBit < 32; iBit++)
1461	if (RT_BIT_32(iBit) & fSvmFeatures)
1462	LogRel(("HM: Reserved bit %u\n", iBit));
1463
1464	/*
1465	* Nested paging is determined in HMR3Init, verify the sanity of that.
1466	*/
1467	AssertLogRelReturn( !pVM->hm.s.fNestedPaging
1468	\|\| (pVM->hm.s.svm.u32Features & AMD_CPUID_SVM_FEATURE_EDX_NESTED_PAGING),
1469	VERR_HM_IPE_1);
1470
1471	/*
1472	* Call ring-0 to set up the VM.
1473	*/
1474	int rc = SUPR3CallVMMR0Ex(pVM->pVMR0, 0 /idCpu/, VMMR0_DO_HM_SETUP_VM, 0, NULL);
1475	if (rc != VINF_SUCCESS)
1476	{
1477	AssertMsgFailed(("%Rrc\n", rc));
1478	LogRel(("HM: AMD-V setup failed with rc=%Rrc!\n", rc));
1479	return VMSetError(pVM, rc, RT_SRC_POS, "AMD-V setup failed: %Rrc", rc);
1480	}
1481
1482	LogRel(("HM: AMD-V enabled!\n"));
1483	pVM->hm.s.svm.fEnabled = true;
1484
1485	if (pVM->hm.s.fNestedPaging)
1486	{
1487	LogRel(("HM: Nested paging enabled!\n"));
1488
1489	/*
1490	* Enable large pages (2 MB) if applicable.
1491	*/
1492	#if HC_ARCH_BITS == 64
1493	if (pVM->hm.s.fLargePages)
1494	{
1495	PGMSetLargePageUsage(pVM, true);
1496	LogRel(("HM: Large page support enabled!\n"));
1497	}
1498	#endif
1499	}
1500
1501	hmR3DisableRawMode(pVM);
1502
1503	/*
1504	* Change the CPU features.
1505	*/
1506	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_SEP);
1507	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_SYSCALL);
1508	if (pVM->hm.s.fAllow64BitGuests)
1509	{
1510	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_PAE);
1511	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_LONG_MODE);
1512	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_NX);
1513	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_LAHF);
1514	}
1515	/* Turn on NXE if PAE has been enabled. */
1516	else if (CPUMGetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_PAE))
1517	CPUMSetGuestCpuIdFeature(pVM, CPUMCPUIDFEATURE_NX);
1518
1519	LogRel(("HM: TPR patching %s\n", (pVM->hm.s.fTprPatchingAllowed) ? "enabled" : "disabled"));
1520
1521	LogRel((pVM->hm.s.fAllow64BitGuests
1522	? "HM: Guest support: 32-bit and 64-bit\n"
1523	: "HM: Guest support: 32-bit only\n"));
1524
1525	return VINF_SUCCESS;
1526	}
1527
1528
1529	/**
1530	* Applies relocations to data and code managed by this
1531	* component. This function will be called at init and
1532	* whenever the VMM need to relocate it self inside the GC.
1533	*
1534	* @param pVM The VM.
1535	*/
1536	VMMR3_INT_DECL(void) HMR3Relocate(PVM pVM)
1537	{
1538	Log(("HMR3Relocate to %RGv\n", MMHyperGetArea(pVM, 0)));
1539
1540	/* Fetch the current paging mode during the relocate callback during state loading. */
1541	if (VMR3GetState(pVM) == VMSTATE_LOADING)
1542	{
1543	for (VMCPUID i = 0; i < pVM->cCpus; i++)
1544	{
1545	PVMCPU pVCpu = &pVM->aCpus[i];
1546	pVCpu->hm.s.enmShadowMode = PGMGetShadowMode(pVCpu);
1547	}
1548	}
1549	#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
1550	if (HMIsEnabled(pVM))
1551	{
1552	switch (PGMGetHostMode(pVM))
1553	{
1554	case PGMMODE_32_BIT:
1555	pVM->hm.s.pfnHost32ToGuest64R0 = VMMR3GetHostToGuestSwitcher(pVM, VMMSWITCHER_32_TO_AMD64);
1556	break;
1557
1558	case PGMMODE_PAE:
1559	case PGMMODE_PAE_NX:
1560	pVM->hm.s.pfnHost32ToGuest64R0 = VMMR3GetHostToGuestSwitcher(pVM, VMMSWITCHER_PAE_TO_AMD64);
1561	break;
1562
1563	default:
1564	AssertFailed();
1565	break;
1566	}
1567	}
1568	#endif
1569	return;
1570	}
1571
1572
1573	/**
1574	* Notification callback which is called whenever there is a chance that a CR3
1575	* value might have changed.
1576	*
1577	* This is called by PGM.
1578	*
1579	* @param pVM Pointer to the VM.
1580	* @param pVCpu Pointer to the VMCPU.
1581	* @param enmShadowMode New shadow paging mode.
1582	* @param enmGuestMode New guest paging mode.
1583	*/
1584	VMMR3_INT_DECL(void) HMR3PagingModeChanged(PVM pVM, PVMCPU pVCpu, PGMMODE enmShadowMode, PGMMODE enmGuestMode)
1585	{
1586	/* Ignore page mode changes during state loading. */
1587	if (VMR3GetState(pVCpu->pVMR3) == VMSTATE_LOADING)
1588	return;
1589
1590	pVCpu->hm.s.enmShadowMode = enmShadowMode;
1591
1592	/*
1593	* If the guest left protected mode VMX execution, we'll have to be
1594	* extra careful if/when the guest switches back to protected mode.
1595	*/
1596	if (enmGuestMode == PGMMODE_REAL)
1597	{
1598	Log(("HMR3PagingModeChanged indicates real mode execution\n"));
1599	pVCpu->hm.s.vmx.fWasInRealMode = true;
1600	}
1601
1602	/** @todo r=ramshankar: Disabling for now. If nothing breaks remove it
1603	* eventually. (Test platforms that use the cache ofc). */
1604	#if 0
1605	#ifdef VMX_USE_CACHED_VMCS_ACCESSES
1606	/* Reset the contents of the read cache. */
1607	PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
1608	for (unsigned j = 0; j < pCache->Read.cValidEntries; j++)
1609	pCache->Read.aFieldVal[j] = 0;
1610	#endif
1611	#endif
1612	}
1613
1614
1615	/**
1616	* Terminates the HM.
1617	*
1618	* Termination means cleaning up and freeing all resources,
1619	* the VM itself is, at this point, powered off or suspended.
1620	*
1621	* @returns VBox status code.
1622	* @param pVM Pointer to the VM.
1623	*/
1624	VMMR3_INT_DECL(int) HMR3Term(PVM pVM)
1625	{
1626	if (pVM->hm.s.vmx.pRealModeTSS)
1627	{
1628	PDMR3VmmDevHeapFree(pVM, pVM->hm.s.vmx.pRealModeTSS);
1629	pVM->hm.s.vmx.pRealModeTSS = 0;
1630	}
1631	hmR3TermCPU(pVM);
1632	return 0;
1633	}
1634
1635
1636	/**
1637	* Terminates the per-VCPU HM.
1638	*
1639	* @returns VBox status code.
1640	* @param pVM Pointer to the VM.
1641	*/
1642	static int hmR3TermCPU(PVM pVM)
1643	{
1644	for (VMCPUID i = 0; i < pVM->cCpus; i++)
1645	{
1646	PVMCPU pVCpu = &pVM->aCpus[i]; NOREF(pVCpu);
1647
1648	#ifdef VBOX_WITH_STATISTICS
1649	if (pVCpu->hm.s.paStatExitReason)
1650	{
1651	MMHyperFree(pVM, pVCpu->hm.s.paStatExitReason);
1652	pVCpu->hm.s.paStatExitReason = NULL;
1653	pVCpu->hm.s.paStatExitReasonR0 = NIL_RTR0PTR;
1654	}
1655	if (pVCpu->hm.s.paStatInjectedIrqs)
1656	{
1657	MMHyperFree(pVM, pVCpu->hm.s.paStatInjectedIrqs);
1658	pVCpu->hm.s.paStatInjectedIrqs = NULL;
1659	pVCpu->hm.s.paStatInjectedIrqsR0 = NIL_RTR0PTR;
1660	}
1661	#endif
1662
1663	#ifdef VBOX_WITH_CRASHDUMP_MAGIC
1664	memset(pVCpu->hm.s.vmx.VMCSCache.aMagic, 0, sizeof(pVCpu->hm.s.vmx.VMCSCache.aMagic));
1665	pVCpu->hm.s.vmx.VMCSCache.uMagic = 0;
1666	pVCpu->hm.s.vmx.VMCSCache.uPos = 0xffffffff;
1667	#endif
1668	}
1669	return 0;
1670	}
1671
1672
1673	/**
1674	* Resets a virtual CPU.
1675	*
1676	* Used by HMR3Reset and CPU hot plugging.
1677	*
1678	* @param pVCpu The CPU to reset.
1679	*/
1680	VMMR3_INT_DECL(void) HMR3ResetCpu(PVMCPU pVCpu)
1681	{
1682	/* Sync. entire state on VM reset R0-reentry. It's safe to reset
1683	the HM flags here, all other EMTs are in ring-3. See VMR3Reset(). */
1684	HMCPU_CF_RESET_TO(pVCpu, HM_CHANGED_HOST_CONTEXT \| HM_CHANGED_ALL_GUEST);
1685
1686	pVCpu->hm.s.vmx.u32CR0Mask = 0;
1687	pVCpu->hm.s.vmx.u32CR4Mask = 0;
1688	pVCpu->hm.s.fActive = false;
1689	pVCpu->hm.s.Event.fPending = false;
1690	pVCpu->hm.s.vmx.fWasInRealMode = true;
1691	pVCpu->hm.s.vmx.u64MsrApicBase = 0;
1692
1693	/* Reset the contents of the read cache. */
1694	PVMCSCACHE pCache = &pVCpu->hm.s.vmx.VMCSCache;
1695	for (unsigned j = 0; j < pCache->Read.cValidEntries; j++)
1696	pCache->Read.aFieldVal[j] = 0;
1697
1698	#ifdef VBOX_WITH_CRASHDUMP_MAGIC
1699	/* Magic marker for searching in crash dumps. */
1700	strcpy((char *)pCache->aMagic, "VMCSCACHE Magic");
1701	pCache->uMagic = UINT64_C(0xDEADBEEFDEADBEEF);
1702	#endif
1703	}
1704
1705
1706	/**
1707	* The VM is being reset.
1708	*
1709	* For the HM component this means that any GDT/LDT/TSS monitors
1710	* needs to be removed.
1711	*
1712	* @param pVM Pointer to the VM.
1713	*/
1714	VMMR3_INT_DECL(void) HMR3Reset(PVM pVM)
1715	{
1716	LogFlow(("HMR3Reset:\n"));
1717
1718	if (HMIsEnabled(pVM))
1719	hmR3DisableRawMode(pVM);
1720
1721	for (VMCPUID i = 0; i < pVM->cCpus; i++)
1722	{
1723	PVMCPU pVCpu = &pVM->aCpus[i];
1724
1725	HMR3ResetCpu(pVCpu);
1726	}
1727
1728	/* Clear all patch information. */
1729	pVM->hm.s.pGuestPatchMem = 0;
1730	pVM->hm.s.pFreeGuestPatchMem = 0;
1731	pVM->hm.s.cbGuestPatchMem = 0;
1732	pVM->hm.s.cPatches = 0;
1733	pVM->hm.s.PatchTree = 0;
1734	pVM->hm.s.fTPRPatchingActive = false;
1735	ASMMemZero32(pVM->hm.s.aPatches, sizeof(pVM->hm.s.aPatches));
1736	}
1737
1738
1739	/**
1740	* Callback to patch a TPR instruction (vmmcall or mov cr8).
1741	*
1742	* @returns VBox strict status code.
1743	* @param pVM Pointer to the VM.
1744	* @param pVCpu The VMCPU for the EMT we're being called on.
1745	* @param pvUser Unused.
1746	*/
1747	DECLCALLBACK(VBOXSTRICTRC) hmR3RemovePatches(PVM pVM, PVMCPU pVCpu, void *pvUser)
1748	{
1749	VMCPUID idCpu = (VMCPUID)(uintptr_t)pvUser;
1750
1751	/* Only execute the handler on the VCPU the original patch request was issued. */
1752	if (pVCpu->idCpu != idCpu)
1753	return VINF_SUCCESS;
1754
1755	Log(("hmR3RemovePatches\n"));
1756	for (unsigned i = 0; i < pVM->hm.s.cPatches; i++)
1757	{
1758	uint8_t abInstr[15];
1759	PHMTPRPATCH pPatch = &pVM->hm.s.aPatches[i];
1760	RTGCPTR pInstrGC = (RTGCPTR)pPatch->Core.Key;
1761	int rc;
1762
1763	#ifdef LOG_ENABLED
1764	char szOutput[256];
1765
1766	rc = DBGFR3DisasInstrEx(pVM->pUVM, pVCpu->idCpu, CPUMGetGuestCS(pVCpu), pInstrGC, DBGF_DISAS_FLAGS_DEFAULT_MODE,
1767	szOutput, sizeof(szOutput), NULL);
1768	if (RT_SUCCESS(rc))
1769	Log(("Patched instr: %s\n", szOutput));
1770	#endif
1771
1772	/* Check if the instruction is still the same. */
1773	rc = PGMPhysSimpleReadGCPtr(pVCpu, abInstr, pInstrGC, pPatch->cbNewOp);
1774	if (rc != VINF_SUCCESS)
1775	{
1776	Log(("Patched code removed? (rc=%Rrc0\n", rc));
1777	continue; /* swapped out or otherwise removed; skip it. */
1778	}
1779
1780	if (memcmp(abInstr, pPatch->aNewOpcode, pPatch->cbNewOp))
1781	{
1782	Log(("Patched instruction was changed! (rc=%Rrc0\n", rc));
1783	continue; /* skip it. */
1784	}
1785
1786	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pInstrGC, pPatch->aOpcode, pPatch->cbOp);
1787	AssertRC(rc);
1788
1789	#ifdef LOG_ENABLED
1790	rc = DBGFR3DisasInstrEx(pVM->pUVM, pVCpu->idCpu, CPUMGetGuestCS(pVCpu), pInstrGC, DBGF_DISAS_FLAGS_DEFAULT_MODE,
1791	szOutput, sizeof(szOutput), NULL);
1792	if (RT_SUCCESS(rc))
1793	Log(("Original instr: %s\n", szOutput));
1794	#endif
1795	}
1796	pVM->hm.s.cPatches = 0;
1797	pVM->hm.s.PatchTree = 0;
1798	pVM->hm.s.pFreeGuestPatchMem = pVM->hm.s.pGuestPatchMem;
1799	pVM->hm.s.fTPRPatchingActive = false;
1800	return VINF_SUCCESS;
1801	}
1802
1803
1804	/**
1805	* Worker for enabling patching in a VT-x/AMD-V guest.
1806	*
1807	* @returns VBox status code.
1808	* @param pVM Pointer to the VM.
1809	* @param idCpu VCPU to execute hmR3RemovePatches on.
1810	* @param pPatchMem Patch memory range.
1811	* @param cbPatchMem Size of the memory range.
1812	*/
1813	static int hmR3EnablePatching(PVM pVM, VMCPUID idCpu, RTRCPTR pPatchMem, unsigned cbPatchMem)
1814	{
1815	int rc = VMMR3EmtRendezvous(pVM, VMMEMTRENDEZVOUS_FLAGS_TYPE_ONE_BY_ONE, hmR3RemovePatches, (void *)(uintptr_t)idCpu);
1816	AssertRC(rc);
1817
1818	pVM->hm.s.pGuestPatchMem = pPatchMem;
1819	pVM->hm.s.pFreeGuestPatchMem = pPatchMem;
1820	pVM->hm.s.cbGuestPatchMem = cbPatchMem;
1821	return VINF_SUCCESS;
1822	}
1823
1824
1825	/**
1826	* Enable patching in a VT-x/AMD-V guest
1827	*
1828	* @returns VBox status code.
1829	* @param pVM Pointer to the VM.
1830	* @param pPatchMem Patch memory range.
1831	* @param cbPatchMem Size of the memory range.
1832	*/
1833	VMMR3_INT_DECL(int) HMR3EnablePatching(PVM pVM, RTGCPTR pPatchMem, unsigned cbPatchMem)
1834	{
1835	VM_ASSERT_EMT(pVM);
1836	Log(("HMR3EnablePatching %RGv size %x\n", pPatchMem, cbPatchMem));
1837	if (pVM->cCpus > 1)
1838	{
1839	/* We own the IOM lock here and could cause a deadlock by waiting for a VCPU that is blocking on the IOM lock. */
1840	int rc = VMR3ReqCallNoWait(pVM, VMCPUID_ANY_QUEUE,
1841	(PFNRT)hmR3EnablePatching, 4, pVM, VMMGetCpuId(pVM), (RTRCPTR)pPatchMem, cbPatchMem);
1842	AssertRC(rc);
1843	return rc;
1844	}
1845	return hmR3EnablePatching(pVM, VMMGetCpuId(pVM), (RTRCPTR)pPatchMem, cbPatchMem);
1846	}
1847
1848
1849	/**
1850	* Disable patching in a VT-x/AMD-V guest.
1851	*
1852	* @returns VBox status code.
1853	* @param pVM Pointer to the VM.
1854	* @param pPatchMem Patch memory range.
1855	* @param cbPatchMem Size of the memory range.
1856	*/
1857	VMMR3_INT_DECL(int) HMR3DisablePatching(PVM pVM, RTGCPTR pPatchMem, unsigned cbPatchMem)
1858	{
1859	Log(("HMR3DisablePatching %RGv size %x\n", pPatchMem, cbPatchMem));
1860
1861	Assert(pVM->hm.s.pGuestPatchMem == pPatchMem);
1862	Assert(pVM->hm.s.cbGuestPatchMem == cbPatchMem);
1863
1864	/* @todo Potential deadlock when other VCPUs are waiting on the IOM lock (we own it)!! */
1865	int rc = VMMR3EmtRendezvous(pVM, VMMEMTRENDEZVOUS_FLAGS_TYPE_ONE_BY_ONE, hmR3RemovePatches,
1866	(void *)(uintptr_t)VMMGetCpuId(pVM));
1867	AssertRC(rc);
1868
1869	pVM->hm.s.pGuestPatchMem = 0;
1870	pVM->hm.s.pFreeGuestPatchMem = 0;
1871	pVM->hm.s.cbGuestPatchMem = 0;
1872	pVM->hm.s.fTPRPatchingActive = false;
1873	return VINF_SUCCESS;
1874	}
1875
1876
1877	/**
1878	* Callback to patch a TPR instruction (vmmcall or mov cr8).
1879	*
1880	* @returns VBox strict status code.
1881	* @param pVM Pointer to the VM.
1882	* @param pVCpu The VMCPU for the EMT we're being called on.
1883	* @param pvUser User specified CPU context.
1884	*
1885	*/
1886	DECLCALLBACK(VBOXSTRICTRC) hmR3ReplaceTprInstr(PVM pVM, PVMCPU pVCpu, void *pvUser)
1887	{
1888	/*
1889	* Only execute the handler on the VCPU the original patch request was
1890	* issued. (The other CPU(s) might not yet have switched to protected
1891	* mode, nor have the correct memory context.)
1892	*/
1893	VMCPUID idCpu = (VMCPUID)(uintptr_t)pvUser;
1894	if (pVCpu->idCpu != idCpu)
1895	return VINF_SUCCESS;
1896
1897	/*
1898	* We're racing other VCPUs here, so don't try patch the instruction twice
1899	* and make sure there is still room for our patch record.
1900	*/
1901	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
1902	PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
1903	if (pPatch)
1904	{
1905	Log(("hmR3ReplaceTprInstr: already patched %RGv\n", pCtx->rip));
1906	return VINF_SUCCESS;
1907	}
1908	uint32_t const idx = pVM->hm.s.cPatches;
1909	if (idx >= RT_ELEMENTS(pVM->hm.s.aPatches))
1910	{
1911	Log(("hmR3ReplaceTprInstr: no available patch slots (%RGv)\n", pCtx->rip));
1912	return VINF_SUCCESS;
1913	}
1914	pPatch = &pVM->hm.s.aPatches[idx];
1915
1916	Log(("hmR3ReplaceTprInstr: rip=%RGv idxPatch=%u\n", pCtx->rip, idx));
1917
1918	/*
1919	* Disassembler the instruction and get cracking.
1920	*/
1921	DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "hmR3ReplaceTprInstr");
1922	PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
1923	uint32_t cbOp;
1924	int rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
1925	AssertRC(rc);
1926	if ( rc == VINF_SUCCESS
1927	&& pDis->pCurInstr->uOpcode == OP_MOV
1928	&& cbOp >= 3)
1929	{
1930	static uint8_t const s_abVMMCall[3] = { 0x0f, 0x01, 0xd9 };
1931
1932	rc = PGMPhysSimpleReadGCPtr(pVCpu, pPatch->aOpcode, pCtx->rip, cbOp);
1933	AssertRC(rc);
1934
1935	pPatch->cbOp = cbOp;
1936
1937	if (pDis->Param1.fUse == DISUSE_DISPLACEMENT32)
1938	{
1939	/* write. */
1940	if (pDis->Param2.fUse == DISUSE_REG_GEN32)
1941	{
1942	pPatch->enmType = HMTPRINSTR_WRITE_REG;
1943	pPatch->uSrcOperand = pDis->Param2.Base.idxGenReg;
1944	Log(("hmR3ReplaceTprInstr: HMTPRINSTR_WRITE_REG %u\n", pDis->Param2.Base.idxGenReg));
1945	}
1946	else
1947	{
1948	Assert(pDis->Param2.fUse == DISUSE_IMMEDIATE32);
1949	pPatch->enmType = HMTPRINSTR_WRITE_IMM;
1950	pPatch->uSrcOperand = pDis->Param2.uValue;
1951	Log(("hmR3ReplaceTprInstr: HMTPRINSTR_WRITE_IMM %#llx\n", pDis->Param2.uValue));
1952	}
1953	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, s_abVMMCall, sizeof(s_abVMMCall));
1954	AssertRC(rc);
1955
1956	memcpy(pPatch->aNewOpcode, s_abVMMCall, sizeof(s_abVMMCall));
1957	pPatch->cbNewOp = sizeof(s_abVMMCall);
1958	}
1959	else
1960	{
1961	/*
1962	* TPR Read.
1963	*
1964	* Found:
1965	* mov eax, dword [fffe0080] (5 bytes)
1966	* Check if next instruction is:
1967	* shr eax, 4
1968	*/
1969	Assert(pDis->Param1.fUse == DISUSE_REG_GEN32);
1970
1971	uint8_t const idxMmioReg = pDis->Param1.Base.idxGenReg;
1972	uint8_t const cbOpMmio = cbOp;
1973	uint64_t const uSavedRip = pCtx->rip;
1974
1975	pCtx->rip += cbOp;
1976	rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
1977	DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Following read");
1978	pCtx->rip = uSavedRip;
1979
1980	if ( rc == VINF_SUCCESS
1981	&& pDis->pCurInstr->uOpcode == OP_SHR
1982	&& pDis->Param1.fUse == DISUSE_REG_GEN32
1983	&& pDis->Param1.Base.idxGenReg == idxMmioReg
1984	&& pDis->Param2.fUse == DISUSE_IMMEDIATE8
1985	&& pDis->Param2.uValue == 4
1986	&& cbOpMmio + cbOp < sizeof(pVM->hm.s.aPatches[idx].aOpcode))
1987	{
1988	uint8_t abInstr[15];
1989
1990	/* Replacing the two instructions above with an AMD-V specific lock-prefixed 32-bit MOV CR8 instruction so as to
1991	access CR8 in 32-bit mode and not cause a #VMEXIT. */
1992	rc = PGMPhysSimpleReadGCPtr(pVCpu, &pPatch->aOpcode, pCtx->rip, cbOpMmio + cbOp);
1993	AssertRC(rc);
1994
1995	pPatch->cbOp = cbOpMmio + cbOp;
1996
1997	/* 0xF0, 0x0F, 0x20, 0xC0 = mov eax, cr8 */
1998	abInstr[0] = 0xF0;
1999	abInstr[1] = 0x0F;
2000	abInstr[2] = 0x20;
2001	abInstr[3] = 0xC0 \| pDis->Param1.Base.idxGenReg;
2002	for (unsigned i = 4; i < pPatch->cbOp; i++)
2003	abInstr[i] = 0x90; /* nop */
2004
2005	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, abInstr, pPatch->cbOp);
2006	AssertRC(rc);
2007
2008	memcpy(pPatch->aNewOpcode, abInstr, pPatch->cbOp);
2009	pPatch->cbNewOp = pPatch->cbOp;
2010
2011	Log(("Acceptable read/shr candidate!\n"));
2012	pPatch->enmType = HMTPRINSTR_READ_SHR4;
2013	}
2014	else
2015	{
2016	pPatch->enmType = HMTPRINSTR_READ;
2017	pPatch->uDstOperand = idxMmioReg;
2018
2019	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, s_abVMMCall, sizeof(s_abVMMCall));
2020	AssertRC(rc);
2021
2022	memcpy(pPatch->aNewOpcode, s_abVMMCall, sizeof(s_abVMMCall));
2023	pPatch->cbNewOp = sizeof(s_abVMMCall);
2024	Log(("hmR3ReplaceTprInstr: HMTPRINSTR_READ %u\n", pPatch->uDstOperand));
2025	}
2026	}
2027
2028	pPatch->Core.Key = pCtx->eip;
2029	rc = RTAvloU32Insert(&pVM->hm.s.PatchTree, &pPatch->Core);
2030	AssertRC(rc);
2031
2032	pVM->hm.s.cPatches++;
2033	STAM_COUNTER_INC(&pVM->hm.s.StatTprReplaceSuccess);
2034	return VINF_SUCCESS;
2035	}
2036
2037	/*
2038	* Save invalid patch, so we will not try again.
2039	*/
2040	Log(("hmR3ReplaceTprInstr: Failed to patch instr!\n"));
2041	pPatch->Core.Key = pCtx->eip;
2042	pPatch->enmType = HMTPRINSTR_INVALID;
2043	rc = RTAvloU32Insert(&pVM->hm.s.PatchTree, &pPatch->Core);
2044	AssertRC(rc);
2045	pVM->hm.s.cPatches++;
2046	STAM_COUNTER_INC(&pVM->hm.s.StatTprReplaceFailure);
2047	return VINF_SUCCESS;
2048	}
2049
2050
2051	/**
2052	* Callback to patch a TPR instruction (jump to generated code).
2053	*
2054	* @returns VBox strict status code.
2055	* @param pVM Pointer to the VM.
2056	* @param pVCpu The VMCPU for the EMT we're being called on.
2057	* @param pvUser User specified CPU context.
2058	*
2059	*/
2060	DECLCALLBACK(VBOXSTRICTRC) hmR3PatchTprInstr(PVM pVM, PVMCPU pVCpu, void *pvUser)
2061	{
2062	/*
2063	* Only execute the handler on the VCPU the original patch request was
2064	* issued. (The other CPU(s) might not yet have switched to protected
2065	* mode, nor have the correct memory context.)
2066	*/
2067	VMCPUID idCpu = (VMCPUID)(uintptr_t)pvUser;
2068	if (pVCpu->idCpu != idCpu)
2069	return VINF_SUCCESS;
2070
2071	/*
2072	* We're racing other VCPUs here, so don't try patch the instruction twice
2073	* and make sure there is still room for our patch record.
2074	*/
2075	PCPUMCTX pCtx = CPUMQueryGuestCtxPtr(pVCpu);
2076	PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
2077	if (pPatch)
2078	{
2079	Log(("hmR3PatchTprInstr: already patched %RGv\n", pCtx->rip));
2080	return VINF_SUCCESS;
2081	}
2082	uint32_t const idx = pVM->hm.s.cPatches;
2083	if (idx >= RT_ELEMENTS(pVM->hm.s.aPatches))
2084	{
2085	Log(("hmR3PatchTprInstr: no available patch slots (%RGv)\n", pCtx->rip));
2086	return VINF_SUCCESS;
2087	}
2088	pPatch = &pVM->hm.s.aPatches[idx];
2089
2090	Log(("hmR3PatchTprInstr: rip=%RGv idxPatch=%u\n", pCtx->rip, idx));
2091	DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "hmR3PatchTprInstr");
2092
2093	/*
2094	* Disassemble the instruction and get cracking.
2095	*/
2096	PDISCPUSTATE pDis = &pVCpu->hm.s.DisState;
2097	uint32_t cbOp;
2098	int rc = EMInterpretDisasCurrent(pVM, pVCpu, pDis, &cbOp);
2099	AssertRC(rc);
2100	if ( rc == VINF_SUCCESS
2101	&& pDis->pCurInstr->uOpcode == OP_MOV
2102	&& cbOp >= 5)
2103	{
2104	uint8_t aPatch[64];
2105	uint32_t off = 0;
2106
2107	rc = PGMPhysSimpleReadGCPtr(pVCpu, pPatch->aOpcode, pCtx->rip, cbOp);
2108	AssertRC(rc);
2109
2110	pPatch->cbOp = cbOp;
2111	pPatch->enmType = HMTPRINSTR_JUMP_REPLACEMENT;
2112
2113	if (pDis->Param1.fUse == DISUSE_DISPLACEMENT32)
2114	{
2115	/*
2116	* TPR write:
2117	*
2118	* push ECX [51]
2119	* push EDX [52]
2120	* push EAX [50]
2121	* xor EDX,EDX [31 D2]
2122	* mov EAX,EAX [89 C0]
2123	* or
2124	* mov EAX,0000000CCh [B8 CC 00 00 00]
2125	* mov ECX,0C0000082h [B9 82 00 00 C0]
2126	* wrmsr [0F 30]
2127	* pop EAX [58]
2128	* pop EDX [5A]
2129	* pop ECX [59]
2130	* jmp return_address [E9 return_address]
2131	*
2132	*/
2133	bool fUsesEax = (pDis->Param2.fUse == DISUSE_REG_GEN32 && pDis->Param2.Base.idxGenReg == DISGREG_EAX);
2134
2135	aPatch[off++] = 0x51; /* push ecx */
2136	aPatch[off++] = 0x52; /* push edx */
2137	if (!fUsesEax)
2138	aPatch[off++] = 0x50; /* push eax */
2139	aPatch[off++] = 0x31; /* xor edx, edx */
2140	aPatch[off++] = 0xD2;
2141	if (pDis->Param2.fUse == DISUSE_REG_GEN32)
2142	{
2143	if (!fUsesEax)
2144	{
2145	aPatch[off++] = 0x89; /* mov eax, src_reg */
2146	aPatch[off++] = MAKE_MODRM(3, pDis->Param2.Base.idxGenReg, DISGREG_EAX);
2147	}
2148	}
2149	else
2150	{
2151	Assert(pDis->Param2.fUse == DISUSE_IMMEDIATE32);
2152	aPatch[off++] = 0xB8; /* mov eax, immediate */
2153	(uint32_t )&aPatch[off] = pDis->Param2.uValue;
2154	off += sizeof(uint32_t);
2155	}
2156	aPatch[off++] = 0xB9; /* mov ecx, 0xc0000082 */
2157	(uint32_t )&aPatch[off] = MSR_K8_LSTAR;
2158	off += sizeof(uint32_t);
2159
2160	aPatch[off++] = 0x0F; /* wrmsr */
2161	aPatch[off++] = 0x30;
2162	if (!fUsesEax)
2163	aPatch[off++] = 0x58; /* pop eax */
2164	aPatch[off++] = 0x5A; /* pop edx */
2165	aPatch[off++] = 0x59; /* pop ecx */
2166	}
2167	else
2168	{
2169	/*
2170	* TPR read:
2171	*
2172	* push ECX [51]
2173	* push EDX [52]
2174	* push EAX [50]
2175	* mov ECX,0C0000082h [B9 82 00 00 C0]
2176	* rdmsr [0F 32]
2177	* mov EAX,EAX [89 C0]
2178	* pop EAX [58]
2179	* pop EDX [5A]
2180	* pop ECX [59]
2181	* jmp return_address [E9 return_address]
2182	*
2183	*/
2184	Assert(pDis->Param1.fUse == DISUSE_REG_GEN32);
2185
2186	if (pDis->Param1.Base.idxGenReg != DISGREG_ECX)
2187	aPatch[off++] = 0x51; /* push ecx */
2188	if (pDis->Param1.Base.idxGenReg != DISGREG_EDX )
2189	aPatch[off++] = 0x52; /* push edx */
2190	if (pDis->Param1.Base.idxGenReg != DISGREG_EAX)
2191	aPatch[off++] = 0x50; /* push eax */
2192
2193	aPatch[off++] = 0x31; /* xor edx, edx */
2194	aPatch[off++] = 0xD2;
2195
2196	aPatch[off++] = 0xB9; /* mov ecx, 0xc0000082 */
2197	(uint32_t )&aPatch[off] = MSR_K8_LSTAR;
2198	off += sizeof(uint32_t);
2199
2200	aPatch[off++] = 0x0F; /* rdmsr */
2201	aPatch[off++] = 0x32;
2202
2203	if (pDis->Param1.Base.idxGenReg != DISGREG_EAX)
2204	{
2205	aPatch[off++] = 0x89; /* mov dst_reg, eax */
2206	aPatch[off++] = MAKE_MODRM(3, DISGREG_EAX, pDis->Param1.Base.idxGenReg);
2207	}
2208
2209	if (pDis->Param1.Base.idxGenReg != DISGREG_EAX)
2210	aPatch[off++] = 0x58; /* pop eax */
2211	if (pDis->Param1.Base.idxGenReg != DISGREG_EDX )
2212	aPatch[off++] = 0x5A; /* pop edx */
2213	if (pDis->Param1.Base.idxGenReg != DISGREG_ECX)
2214	aPatch[off++] = 0x59; /* pop ecx */
2215	}
2216	aPatch[off++] = 0xE9; /* jmp return_address */
2217	(RTRCUINTPTR )&aPatch[off] = ((RTRCUINTPTR)pCtx->eip + cbOp) - ((RTRCUINTPTR)pVM->hm.s.pFreeGuestPatchMem + off + 4);
2218	off += sizeof(RTRCUINTPTR);
2219
2220	if (pVM->hm.s.pFreeGuestPatchMem + off <= pVM->hm.s.pGuestPatchMem + pVM->hm.s.cbGuestPatchMem)
2221	{
2222	/* Write new code to the patch buffer. */
2223	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pVM->hm.s.pFreeGuestPatchMem, aPatch, off);
2224	AssertRC(rc);
2225
2226	#ifdef LOG_ENABLED
2227	uint32_t cbCurInstr;
2228	for (RTGCPTR GCPtrInstr = pVM->hm.s.pFreeGuestPatchMem;
2229	GCPtrInstr < pVM->hm.s.pFreeGuestPatchMem + off;
2230	GCPtrInstr += RT_MAX(cbCurInstr, 1))
2231	{
2232	char szOutput[256];
2233	rc = DBGFR3DisasInstrEx(pVM->pUVM, pVCpu->idCpu, pCtx->cs.Sel, GCPtrInstr, DBGF_DISAS_FLAGS_DEFAULT_MODE,
2234	szOutput, sizeof(szOutput), &cbCurInstr);
2235	if (RT_SUCCESS(rc))
2236	Log(("Patch instr %s\n", szOutput));
2237	else
2238	Log(("%RGv: rc=%Rrc\n", GCPtrInstr, rc));
2239	}
2240	#endif
2241
2242	pPatch->aNewOpcode[0] = 0xE9;
2243	(RTRCUINTPTR )&pPatch->aNewOpcode[1] = ((RTRCUINTPTR)pVM->hm.s.pFreeGuestPatchMem) - ((RTRCUINTPTR)pCtx->eip + 5);
2244
2245	/* Overwrite the TPR instruction with a jump. */
2246	rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->eip, pPatch->aNewOpcode, 5);
2247	AssertRC(rc);
2248
2249	DBGFR3_DISAS_INSTR_CUR_LOG(pVCpu, "Jump");
2250
2251	pVM->hm.s.pFreeGuestPatchMem += off;
2252	pPatch->cbNewOp = 5;
2253
2254	pPatch->Core.Key = pCtx->eip;
2255	rc = RTAvloU32Insert(&pVM->hm.s.PatchTree, &pPatch->Core);
2256	AssertRC(rc);
2257
2258	pVM->hm.s.cPatches++;
2259	pVM->hm.s.fTPRPatchingActive = true;
2260	STAM_COUNTER_INC(&pVM->hm.s.StatTprPatchSuccess);
2261	return VINF_SUCCESS;
2262	}
2263
2264	Log(("Ran out of space in our patch buffer!\n"));
2265	}
2266	else
2267	Log(("hmR3PatchTprInstr: Failed to patch instr!\n"));
2268
2269
2270	/*
2271	* Save invalid patch, so we will not try again.
2272	*/
2273	pPatch = &pVM->hm.s.aPatches[idx];
2274	pPatch->Core.Key = pCtx->eip;
2275	pPatch->enmType = HMTPRINSTR_INVALID;
2276	rc = RTAvloU32Insert(&pVM->hm.s.PatchTree, &pPatch->Core);
2277	AssertRC(rc);
2278	pVM->hm.s.cPatches++;
2279	STAM_COUNTER_INC(&pVM->hm.s.StatTprPatchFailure);
2280	return VINF_SUCCESS;
2281	}
2282
2283
2284	/**
2285	* Attempt to patch TPR mmio instructions.
2286	*
2287	* @returns VBox status code.
2288	* @param pVM Pointer to the VM.
2289	* @param pVCpu Pointer to the VMCPU.
2290	* @param pCtx Pointer to the guest CPU context.
2291	*/
2292	VMMR3_INT_DECL(int) HMR3PatchTprInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2293	{
2294	NOREF(pCtx);
2295	int rc = VMMR3EmtRendezvous(pVM, VMMEMTRENDEZVOUS_FLAGS_TYPE_ONE_BY_ONE,
2296	pVM->hm.s.pGuestPatchMem ? hmR3PatchTprInstr : hmR3ReplaceTprInstr,
2297	(void *)(uintptr_t)pVCpu->idCpu);
2298	AssertRC(rc);
2299	return rc;
2300	}
2301
2302
2303	/**
2304	* Checks if a code selector (CS) is suitable for execution
2305	* within VMX when unrestricted execution isn't available.
2306	*
2307	* @returns true if selector is suitable for VMX, otherwise
2308	* false.
2309	* @param pSel Pointer to the selector to check (CS).
2310	* uStackDpl The CPL, aka the DPL of the stack segment.
2311	*/
2312	static bool hmR3IsCodeSelectorOkForVmx(PCPUMSELREG pSel, unsigned uStackDpl)
2313	{
2314	/*
2315	* Segment must be an accessed code segment, it must be present and it must
2316	* be usable.
2317	* Note! These are all standard requirements and if CS holds anything else
2318	* we've got buggy code somewhere!
2319	*/
2320	AssertCompile(X86DESCATTR_TYPE == 0xf);
2321	AssertMsgReturn( (pSel->Attr.u & (X86_SEL_TYPE_ACCESSED \| X86_SEL_TYPE_CODE \| X86DESCATTR_DT \| X86DESCATTR_P \| X86DESCATTR_UNUSABLE))
2322	== (X86_SEL_TYPE_ACCESSED \| X86_SEL_TYPE_CODE \| X86DESCATTR_DT \| X86DESCATTR_P),
2323	("%#x\n", pSel->Attr.u),
2324	false);
2325
2326	/* For conforming segments, CS.DPL must be <= SS.DPL, while CS.DPL
2327	must equal SS.DPL for non-confroming segments.
2328	Note! This is also a hard requirement like above. */
2329	AssertMsgReturn( pSel->Attr.n.u4Type & X86_SEL_TYPE_CONF
2330	? pSel->Attr.n.u2Dpl <= uStackDpl
2331	: pSel->Attr.n.u2Dpl == uStackDpl,
2332	("u4Type=%#x u2Dpl=%u uStackDpl=%u\n", pSel->Attr.n.u4Type, pSel->Attr.n.u2Dpl, uStackDpl),
2333	false);
2334
2335	/*
2336	* The following two requirements are VT-x specific:
2337	* - G bit must be set if any high limit bits are set.
2338	* - G bit must be clear if any low limit bits are clear.
2339	*/
2340	if ( ((pSel->u32Limit & 0xfff00000) == 0x00000000 \|\| pSel->Attr.n.u1Granularity)
2341	&& ((pSel->u32Limit & 0x00000fff) == 0x00000fff \|\| !pSel->Attr.n.u1Granularity) )
2342	return true;
2343	return false;
2344	}
2345
2346
2347	/**
2348	* Checks if a data selector (DS/ES/FS/GS) is suitable for
2349	* execution within VMX when unrestricted execution isn't
2350	* available.
2351	*
2352	* @returns true if selector is suitable for VMX, otherwise
2353	* false.
2354	* @param pSel Pointer to the selector to check
2355	* (DS/ES/FS/GS).
2356	*/
2357	static bool hmR3IsDataSelectorOkForVmx(PCPUMSELREG pSel)
2358	{
2359	/*
2360	* Unusable segments are OK. These days they should be marked as such, as
2361	* but as an alternative we for old saved states and AMD<->VT-x migration
2362	* we also treat segments with all the attributes cleared as unusable.
2363	*/
2364	if (pSel->Attr.n.u1Unusable \|\| !pSel->Attr.u)
2365	return true;
2366
2367	/** @todo tighten these checks. Will require CPUM load adjusting. */
2368
2369	/* Segment must be accessed. */
2370	if (pSel->Attr.u & X86_SEL_TYPE_ACCESSED)
2371	{
2372	/* Code segments must also be readable. */
2373	if ( !(pSel->Attr.u & X86_SEL_TYPE_CODE)
2374	\|\| (pSel->Attr.u & X86_SEL_TYPE_READ))
2375	{
2376	/* The S bit must be set. */
2377	if (pSel->Attr.n.u1DescType)
2378	{
2379	/* Except for conforming segments, DPL >= RPL. */
2380	if ( pSel->Attr.n.u2Dpl >= (pSel->Sel & X86_SEL_RPL)
2381	\|\| pSel->Attr.n.u4Type >= X86_SEL_TYPE_ER_ACC)
2382	{
2383	/* Segment must be present. */
2384	if (pSel->Attr.n.u1Present)
2385	{
2386	/*
2387	* The following two requirements are VT-x specific:
2388	* - G bit must be set if any high limit bits are set.
2389	* - G bit must be clear if any low limit bits are clear.
2390	*/
2391	if ( ((pSel->u32Limit & 0xfff00000) == 0x00000000 \|\| pSel->Attr.n.u1Granularity)
2392	&& ((pSel->u32Limit & 0x00000fff) == 0x00000fff \|\| !pSel->Attr.n.u1Granularity) )
2393	return true;
2394	}
2395	}
2396	}
2397	}
2398	}
2399
2400	return false;
2401	}
2402
2403
2404	/**
2405	* Checks if the stack selector (SS) is suitable for execution
2406	* within VMX when unrestricted execution isn't available.
2407	*
2408	* @returns true if selector is suitable for VMX, otherwise
2409	* false.
2410	* @param pSel Pointer to the selector to check (SS).
2411	*/
2412	static bool hmR3IsStackSelectorOkForVmx(PCPUMSELREG pSel)
2413	{
2414	/*
2415	* Unusable segments are OK. These days they should be marked as such, as
2416	* but as an alternative we for old saved states and AMD<->VT-x migration
2417	* we also treat segments with all the attributes cleared as unusable.
2418	*/
2419	/** @todo r=bird: actually all zeros isn't gonna cut it... SS.DPL == CPL. */
2420	if (pSel->Attr.n.u1Unusable \|\| !pSel->Attr.u)
2421	return true;
2422
2423	/*
2424	* Segment must be an accessed writable segment, it must be present.
2425	* Note! These are all standard requirements and if SS holds anything else
2426	* we've got buggy code somewhere!
2427	*/
2428	AssertCompile(X86DESCATTR_TYPE == 0xf);
2429	AssertMsgReturn( (pSel->Attr.u & (X86_SEL_TYPE_ACCESSED \| X86_SEL_TYPE_WRITE \| X86DESCATTR_DT \| X86DESCATTR_P \| X86_SEL_TYPE_CODE))
2430	== (X86_SEL_TYPE_ACCESSED \| X86_SEL_TYPE_WRITE \| X86DESCATTR_DT \| X86DESCATTR_P),
2431	("%#x\n", pSel->Attr.u),
2432	false);
2433
2434	/* DPL must equal RPL.
2435	Note! This is also a hard requirement like above. */
2436	AssertMsgReturn(pSel->Attr.n.u2Dpl == (pSel->Sel & X86_SEL_RPL),
2437	("u2Dpl=%u Sel=%#x\n", pSel->Attr.n.u2Dpl, pSel->Sel),
2438	false);
2439
2440	/*
2441	* The following two requirements are VT-x specific:
2442	* - G bit must be set if any high limit bits are set.
2443	* - G bit must be clear if any low limit bits are clear.
2444	*/
2445	if ( ((pSel->u32Limit & 0xfff00000) == 0x00000000 \|\| pSel->Attr.n.u1Granularity)
2446	&& ((pSel->u32Limit & 0x00000fff) == 0x00000fff \|\| !pSel->Attr.n.u1Granularity) )
2447	return true;
2448	return false;
2449	}
2450
2451
2452	/**
2453	* Force execution of the current IO code in the recompiler.
2454	*
2455	* @returns VBox status code.
2456	* @param pVM Pointer to the VM.
2457	* @param pCtx Partial VM execution context.
2458	*/
2459	VMMR3_INT_DECL(int) HMR3EmulateIoBlock(PVM pVM, PCPUMCTX pCtx)
2460	{
2461	PVMCPU pVCpu = VMMGetCpu(pVM);
2462
2463	Assert(HMIsEnabled(pVM));
2464	Log(("HMR3EmulateIoBlock\n"));
2465
2466	/* This is primarily intended to speed up Grub, so we don't care about paged protected mode. */
2467	if (HMCanEmulateIoBlockEx(pCtx))
2468	{
2469	Log(("HMR3EmulateIoBlock -> enabled\n"));
2470	pVCpu->hm.s.EmulateIoBlock.fEnabled = true;
2471	pVCpu->hm.s.EmulateIoBlock.GCPtrFunctionEip = pCtx->rip;
2472	pVCpu->hm.s.EmulateIoBlock.cr0 = pCtx->cr0;
2473	return VINF_EM_RESCHEDULE_REM;
2474	}
2475	return VINF_SUCCESS;
2476	}
2477
2478
2479	/**
2480	* Checks if we can currently use hardware accelerated raw mode.
2481	*
2482	* @returns true if we can currently use hardware acceleration, otherwise false.
2483	* @param pVM Pointer to the VM.
2484	* @param pCtx Partial VM execution context.
2485	*/
2486	VMMR3DECL(bool) HMR3CanExecuteGuest(PVM pVM, PCPUMCTX pCtx)
2487	{
2488	PVMCPU pVCpu = VMMGetCpu(pVM);
2489
2490	Assert(HMIsEnabled(pVM));
2491
2492	/* If we're still executing the IO code, then return false. */
2493	if ( RT_UNLIKELY(pVCpu->hm.s.EmulateIoBlock.fEnabled)
2494	&& pCtx->rip < pVCpu->hm.s.EmulateIoBlock.GCPtrFunctionEip + 0x200
2495	&& pCtx->rip > pVCpu->hm.s.EmulateIoBlock.GCPtrFunctionEip - 0x200
2496	&& pCtx->cr0 == pVCpu->hm.s.EmulateIoBlock.cr0)
2497	return false;
2498
2499	pVCpu->hm.s.EmulateIoBlock.fEnabled = false;
2500
2501	/* AMD-V supports real & protected mode with or without paging. */
2502	if (pVM->hm.s.svm.fEnabled)
2503	{
2504	pVCpu->hm.s.fActive = true;
2505	return true;
2506	}
2507
2508	pVCpu->hm.s.fActive = false;
2509
2510	/* Note! The context supplied by REM is partial. If we add more checks here, be sure to verify that REM provides this info! */
2511	Assert( (pVM->hm.s.vmx.fUnrestrictedGuest && !pVM->hm.s.vmx.pRealModeTSS)
2512	\|\| (!pVM->hm.s.vmx.fUnrestrictedGuest && pVM->hm.s.vmx.pRealModeTSS));
2513
2514	bool fSupportsRealMode = pVM->hm.s.vmx.fUnrestrictedGuest \|\| PDMVmmDevHeapIsEnabled(pVM);
2515	if (!pVM->hm.s.vmx.fUnrestrictedGuest)
2516	{
2517	/*
2518	* The VMM device heap is a requirement for emulating real mode or protected mode without paging with the unrestricted
2519	* guest execution feature is missing (VT-x only).
2520	*/
2521	if (fSupportsRealMode)
2522	{
2523	if (CPUMIsGuestInRealModeEx(pCtx))
2524	{
2525	/* In V86 mode (VT-x or not), the CPU enforces real-mode compatible selector
2526	* bases and limits, i.e. limit must be 64K and base must be selector * 16.
2527	* If this is not true, we cannot execute real mode as V86 and have to fall
2528	* back to emulation.
2529	*/
2530	if ( pCtx->cs.Sel != (pCtx->cs.u64Base >> 4)
2531	\|\| pCtx->ds.Sel != (pCtx->ds.u64Base >> 4)
2532	\|\| pCtx->es.Sel != (pCtx->es.u64Base >> 4)
2533	\|\| pCtx->ss.Sel != (pCtx->ss.u64Base >> 4)
2534	\|\| pCtx->fs.Sel != (pCtx->fs.u64Base >> 4)
2535	\|\| pCtx->gs.Sel != (pCtx->gs.u64Base >> 4))
2536	{
2537	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadRmSelBase);
2538	return false;
2539	}
2540	if ( (pCtx->cs.u32Limit != 0xffff)
2541	\|\| (pCtx->ds.u32Limit != 0xffff)
2542	\|\| (pCtx->es.u32Limit != 0xffff)
2543	\|\| (pCtx->ss.u32Limit != 0xffff)
2544	\|\| (pCtx->fs.u32Limit != 0xffff)
2545	\|\| (pCtx->gs.u32Limit != 0xffff))
2546	{
2547	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadRmSelLimit);
2548	return false;
2549	}
2550	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckRmOk);
2551	}
2552	else
2553	{
2554	/* Verify the requirements for executing code in protected
2555	mode. VT-x can't handle the CPU state right after a switch
2556	from real to protected mode. (all sorts of RPL & DPL assumptions). */
2557	if (pVCpu->hm.s.vmx.fWasInRealMode)
2558	{
2559	/** @todo If guest is in V86 mode, these checks should be different! */
2560	if ((pCtx->cs.Sel & X86_SEL_RPL) != (pCtx->ss.Sel & X86_SEL_RPL))
2561	{
2562	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadRpl);
2563	return false;
2564	}
2565	if ( !hmR3IsCodeSelectorOkForVmx(&pCtx->cs, pCtx->ss.Attr.n.u2Dpl)
2566	\|\| !hmR3IsDataSelectorOkForVmx(&pCtx->ds)
2567	\|\| !hmR3IsDataSelectorOkForVmx(&pCtx->es)
2568	\|\| !hmR3IsDataSelectorOkForVmx(&pCtx->fs)
2569	\|\| !hmR3IsDataSelectorOkForVmx(&pCtx->gs)
2570	\|\| !hmR3IsStackSelectorOkForVmx(&pCtx->ss))
2571	{
2572	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadSel);
2573	return false;
2574	}
2575	}
2576	/* VT-x also chokes on invalid TR or LDTR selectors (minix). */
2577	if (pCtx->gdtr.cbGdt)
2578	{
2579	if ((pCtx->tr.Sel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
2580	{
2581	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadTr);
2582	return false;
2583	}
2584	else if ((pCtx->ldtr.Sel \| X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
2585	{
2586	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckBadLdt);
2587	return false;
2588	}
2589	}
2590	STAM_COUNTER_INC(&pVCpu->hm.s.StatVmxCheckPmOk);
2591	}
2592	}
2593	else
2594	{
2595	if ( !CPUMIsGuestInLongModeEx(pCtx)
2596	&& !pVM->hm.s.vmx.fUnrestrictedGuest)
2597	{
2598	if ( !pVM->hm.s.fNestedPaging /* Requires a fake PD for real and protected mode without paging - stored in the VMM device heap */
2599	\|\| CPUMIsGuestInRealModeEx(pCtx)) /* Requires a fake TSS for real mode - stored in the VMM device heap */
2600	return false;
2601
2602	/* Too early for VT-x; Solaris guests will fail with a guru meditation otherwise; same for XP. */
2603	if (pCtx->idtr.pIdt == 0 \|\| pCtx->idtr.cbIdt == 0 \|\| pCtx->tr.Sel == 0)
2604	return false;
2605
2606	/* The guest is about to complete the switch to protected mode. Wait a bit longer. */
2607	/* Windows XP; switch to protected mode; all selectors are marked not present in the
2608	* hidden registers (possible recompiler bug; see load_seg_vm) */
2609	if (pCtx->cs.Attr.n.u1Present == 0)
2610	return false;
2611	if (pCtx->ss.Attr.n.u1Present == 0)
2612	return false;
2613
2614	/* Windows XP: possible same as above, but new recompiler requires new heuristics?
2615	VT-x doesn't seem to like something about the guest state and this stuff avoids it. */
2616	/** @todo This check is actually wrong, it doesn't take the direction of the
2617	* stack segment into account. But, it does the job for now. */
2618	if (pCtx->rsp >= pCtx->ss.u32Limit)
2619	return false;
2620	}
2621	}
2622	}
2623
2624	if (pVM->hm.s.vmx.fEnabled)
2625	{
2626	uint32_t mask;
2627
2628	/* if bit N is set in cr0_fixed0, then it must be set in the guest's cr0. */
2629	mask = (uint32_t)pVM->hm.s.vmx.Msrs.u64Cr0Fixed0;
2630	/* Note: We ignore the NE bit here on purpose; see vmmr0\hmr0.cpp for details. */
2631	mask &= ~X86_CR0_NE;
2632
2633	if (fSupportsRealMode)
2634	{
2635	/* Note: We ignore the PE & PG bits here on purpose; we emulate real and protected mode without paging. */
2636	mask &= ~(X86_CR0_PG\|X86_CR0_PE);
2637	}
2638	else
2639	{
2640	/* We support protected mode without paging using identity mapping. */
2641	mask &= ~X86_CR0_PG;
2642	}
2643	if ((pCtx->cr0 & mask) != mask)
2644	return false;
2645
2646	/* if bit N is cleared in cr0_fixed1, then it must be zero in the guest's cr0. */
2647	mask = (uint32_t)~pVM->hm.s.vmx.Msrs.u64Cr0Fixed1;
2648	if ((pCtx->cr0 & mask) != 0)
2649	return false;
2650
2651	/* if bit N is set in cr4_fixed0, then it must be set in the guest's cr4. */
2652	mask = (uint32_t)pVM->hm.s.vmx.Msrs.u64Cr4Fixed0;
2653	mask &= ~X86_CR4_VMXE;
2654	if ((pCtx->cr4 & mask) != mask)
2655	return false;
2656
2657	/* if bit N is cleared in cr4_fixed1, then it must be zero in the guest's cr4. */
2658	mask = (uint32_t)~pVM->hm.s.vmx.Msrs.u64Cr4Fixed1;
2659	if ((pCtx->cr4 & mask) != 0)
2660	return false;
2661
2662	pVCpu->hm.s.fActive = true;
2663	return true;
2664	}
2665
2666	return false;
2667	}
2668
2669
2670	/**
2671	* Checks if we need to reschedule due to VMM device heap changes.
2672	*
2673	* @returns true if a reschedule is required, otherwise false.
2674	* @param pVM Pointer to the VM.
2675	* @param pCtx VM execution context.
2676	*/
2677	VMMR3_INT_DECL(bool) HMR3IsRescheduleRequired(PVM pVM, PCPUMCTX pCtx)
2678	{
2679	/*
2680	* The VMM device heap is a requirement for emulating real-mode or protected-mode without paging
2681	* when the unrestricted guest execution feature is missing (VT-x only).
2682	*/
2683	if ( pVM->hm.s.vmx.fEnabled
2684	&& !pVM->hm.s.vmx.fUnrestrictedGuest
2685	&& CPUMIsGuestInRealModeEx(pCtx)
2686	&& !PDMVmmDevHeapIsEnabled(pVM))
2687	{
2688	return true;
2689	}
2690
2691	return false;
2692	}
2693
2694
2695	/**
2696	* Notification from EM about a rescheduling into hardware assisted execution
2697	* mode.
2698	*
2699	* @param pVCpu Pointer to the current VMCPU.
2700	*/
2701	VMMR3_INT_DECL(void) HMR3NotifyScheduled(PVMCPU pVCpu)
2702	{
2703	HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
2704	}
2705
2706
2707	/**
2708	* Notification from EM about returning from instruction emulation (REM / EM).
2709	*
2710	* @param pVCpu Pointer to the VMCPU.
2711	*/
2712	VMMR3_INT_DECL(void) HMR3NotifyEmulated(PVMCPU pVCpu)
2713	{
2714	HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
2715	}
2716
2717
2718	/**
2719	* Checks if we are currently using hardware acceleration.
2720	*
2721	* @returns true if hardware acceleration is being used, otherwise false.
2722	* @param pVCpu Pointer to the VMCPU.
2723	*/
2724	VMMR3_INT_DECL(bool) HMR3IsActive(PVMCPU pVCpu)
2725	{
2726	return pVCpu->hm.s.fActive;
2727	}
2728
2729
2730	/**
2731	* External interface for querying whether hardware acceleration is enabled.
2732	*
2733	* @returns true if VT-x or AMD-V is being used, otherwise false.
2734	* @param pUVM The user mode VM handle.
2735	* @sa HMIsEnabled, HMIsEnabledNotMacro.
2736	*/
2737	VMMR3DECL(bool) HMR3IsEnabled(PUVM pUVM)
2738	{
2739	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2740	PVM pVM = pUVM->pVM;
2741	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2742	return pVM->fHMEnabled; /* Don't use the macro as the GUI may query us very very early. */
2743	}
2744
2745
2746	/**
2747	* External interface for querying whether VT-x is being used.
2748	*
2749	* @returns true if VT-x is being used, otherwise false.
2750	* @param pUVM The user mode VM handle.
2751	* @sa HMR3IsSvmEnabled, HMIsEnabled
2752	*/
2753	VMMR3DECL(bool) HMR3IsVmxEnabled(PUVM pUVM)
2754	{
2755	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2756	PVM pVM = pUVM->pVM;
2757	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2758	return pVM->hm.s.vmx.fEnabled
2759	&& pVM->hm.s.vmx.fSupported
2760	&& pVM->fHMEnabled;
2761	}
2762
2763
2764	/**
2765	* External interface for querying whether AMD-V is being used.
2766	*
2767	* @returns true if VT-x is being used, otherwise false.
2768	* @param pUVM The user mode VM handle.
2769	* @sa HMR3IsVmxEnabled, HMIsEnabled
2770	*/
2771	VMMR3DECL(bool) HMR3IsSvmEnabled(PUVM pUVM)
2772	{
2773	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2774	PVM pVM = pUVM->pVM;
2775	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2776	return pVM->hm.s.svm.fEnabled
2777	&& pVM->hm.s.svm.fSupported
2778	&& pVM->fHMEnabled;
2779	}
2780
2781
2782	/**
2783	* Checks if we are currently using nested paging.
2784	*
2785	* @returns true if nested paging is being used, otherwise false.
2786	* @param pUVM The user mode VM handle.
2787	*/
2788	VMMR3DECL(bool) HMR3IsNestedPagingActive(PUVM pUVM)
2789	{
2790	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2791	PVM pVM = pUVM->pVM;
2792	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2793	return pVM->hm.s.fNestedPaging;
2794	}
2795
2796
2797	/**
2798	* Checks if we are currently using VPID in VT-x mode.
2799	*
2800	* @returns true if VPID is being used, otherwise false.
2801	* @param pUVM The user mode VM handle.
2802	*/
2803	VMMR3DECL(bool) HMR3IsVpidActive(PUVM pUVM)
2804	{
2805	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2806	PVM pVM = pUVM->pVM;
2807	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2808	return pVM->hm.s.vmx.fVpid;
2809	}
2810
2811
2812	/**
2813	* Checks if we are currently using VT-x unrestricted execution,
2814	* aka UX.
2815	*
2816	* @returns true if UX is being used, otherwise false.
2817	* @param pUVM The user mode VM handle.
2818	*/
2819	VMMR3DECL(bool) HMR3IsUXActive(PUVM pUVM)
2820	{
2821	UVM_ASSERT_VALID_EXT_RETURN(pUVM, false);
2822	PVM pVM = pUVM->pVM;
2823	VM_ASSERT_VALID_EXT_RETURN(pVM, false);
2824	return pVM->hm.s.vmx.fUnrestrictedGuest;
2825	}
2826
2827
2828	/**
2829	* Checks if internal events are pending. In that case we are not allowed to dispatch interrupts.
2830	*
2831	* @returns true if an internal event is pending, otherwise false.
2832	* @param pVM Pointer to the VM.
2833	*/
2834	VMMR3_INT_DECL(bool) HMR3IsEventPending(PVMCPU pVCpu)
2835	{
2836	return HMIsEnabled(pVCpu->pVMR3) && pVCpu->hm.s.Event.fPending;
2837	}
2838
2839
2840	/**
2841	* Checks if the VMX-preemption timer is being used.
2842	*
2843	* @returns true if the VMX-preemption timer is being used, otherwise false.
2844	* @param pVM Pointer to the VM.
2845	*/
2846	VMMR3_INT_DECL(bool) HMR3IsVmxPreemptionTimerUsed(PVM pVM)
2847	{
2848	return HMIsEnabled(pVM)
2849	&& pVM->hm.s.vmx.fEnabled
2850	&& pVM->hm.s.vmx.fUsePreemptTimer;
2851	}
2852
2853
2854	/**
2855	* Restart an I/O instruction that was refused in ring-0
2856	*
2857	* @returns Strict VBox status code. Informational status codes other than the one documented
2858	* here are to be treated as internal failure. Use IOM_SUCCESS() to check for success.
2859	* @retval VINF_SUCCESS Success.
2860	* @retval VINF_EM_FIRST-VINF_EM_LAST Success with some exceptions (see IOM_SUCCESS()), the
2861	* status code must be passed on to EM.
2862	* @retval VERR_NOT_FOUND if no pending I/O instruction.
2863	*
2864	* @param pVM Pointer to the VM.
2865	* @param pVCpu Pointer to the VMCPU.
2866	* @param pCtx Pointer to the guest CPU context.
2867	*/
2868	VMMR3_INT_DECL(VBOXSTRICTRC) HMR3RestartPendingIOInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2869	{
2870	HMPENDINGIO enmType = pVCpu->hm.s.PendingIO.enmType;
2871
2872	pVCpu->hm.s.PendingIO.enmType = HMPENDINGIO_INVALID;
2873
2874	if ( pVCpu->hm.s.PendingIO.GCPtrRip != pCtx->rip
2875	\|\| enmType == HMPENDINGIO_INVALID)
2876	return VERR_NOT_FOUND;
2877
2878	VBOXSTRICTRC rcStrict;
2879	switch (enmType)
2880	{
2881	case HMPENDINGIO_PORT_READ:
2882	{
2883	uint32_t uAndVal = pVCpu->hm.s.PendingIO.s.Port.uAndVal;
2884	uint32_t u32Val = 0;
2885
2886	rcStrict = IOMIOPortRead(pVM, pVCpu, pVCpu->hm.s.PendingIO.s.Port.uPort,
2887	&u32Val,
2888	pVCpu->hm.s.PendingIO.s.Port.cbSize);
2889	if (IOM_SUCCESS(rcStrict))
2890	{
2891	/* Write back to the EAX register. */
2892	pCtx->eax = (pCtx->eax & ~uAndVal) \| (u32Val & uAndVal);
2893	pCtx->rip = pVCpu->hm.s.PendingIO.GCPtrRipNext;
2894	}
2895	break;
2896	}
2897
2898	case HMPENDINGIO_PORT_WRITE:
2899	rcStrict = IOMIOPortWrite(pVM, pVCpu, pVCpu->hm.s.PendingIO.s.Port.uPort,
2900	pCtx->eax & pVCpu->hm.s.PendingIO.s.Port.uAndVal,
2901	pVCpu->hm.s.PendingIO.s.Port.cbSize);
2902	if (IOM_SUCCESS(rcStrict))
2903	pCtx->rip = pVCpu->hm.s.PendingIO.GCPtrRipNext;
2904	break;
2905
2906	default:
2907	AssertLogRelFailedReturn(VERR_HM_UNKNOWN_IO_INSTRUCTION);
2908	}
2909
2910	if (IOM_SUCCESS(rcStrict))
2911	{
2912	/*
2913	* Check for I/O breakpoints.
2914	*/
2915	uint32_t const uDr7 = pCtx->dr[7];
2916	if ( ( (uDr7 & X86_DR7_ENABLED_MASK)
2917	&& X86_DR7_ANY_RW_IO(uDr7)
2918	&& (pCtx->cr4 & X86_CR4_DE))
2919	\|\| DBGFBpIsHwIoArmed(pVM))
2920	{
2921	VBOXSTRICTRC rcStrict2 = DBGFBpCheckIo(pVM, pVCpu, pCtx, pVCpu->hm.s.PendingIO.s.Port.uPort,
2922	pVCpu->hm.s.PendingIO.s.Port.cbSize);
2923	if (rcStrict2 == VINF_EM_RAW_GUEST_TRAP)
2924	rcStrict2 = TRPMAssertTrap(pVCpu, X86_XCPT_DB, TRPM_TRAP);
2925	/* rcStrict is VINF_SUCCESS or in [VINF_EM_FIRST..VINF_EM_LAST]. */
2926	else if (rcStrict2 != VINF_SUCCESS && (rcStrict == VINF_SUCCESS \|\| rcStrict2 < rcStrict))
2927	rcStrict = rcStrict2;
2928	}
2929	}
2930	return rcStrict;
2931	}
2932
2933
2934	/**
2935	* Check fatal VT-x/AMD-V error and produce some meaningful
2936	* log release message.
2937	*
2938	* @param pVM Pointer to the VM.
2939	* @param iStatusCode VBox status code.
2940	*/
2941	VMMR3_INT_DECL(void) HMR3CheckError(PVM pVM, int iStatusCode)
2942	{
2943	for (VMCPUID i = 0; i < pVM->cCpus; i++)
2944	{
2945	PVMCPU pVCpu = &pVM->aCpus[i];
2946	switch (iStatusCode)
2947	{
2948	/** @todo r=ramshankar: Are all EMTs out of ring-0 at this point!? If not, we
2949	* might be getting inaccurate values for non-guru'ing EMTs. */
2950	case VERR_VMX_INVALID_VMCS_FIELD:
2951	break;
2952
2953	case VERR_VMX_INVALID_VMCS_PTR:
2954	LogRel(("HM: VERR_VMX_INVALID_VMCS_PTR:\n"));
2955	LogRel(("HM: CPU[%u] Current pointer %#RGp vs %#RGp\n", i, pVCpu->hm.s.vmx.LastError.u64VMCSPhys,
2956	pVCpu->hm.s.vmx.HCPhysVmcs));
2957	LogRel(("HM: CPU[%u] Current VMCS version %#x\n", i, pVCpu->hm.s.vmx.LastError.u32VMCSRevision));
2958	LogRel(("HM: CPU[%u] Entered Host Cpu %u\n", i, pVCpu->hm.s.vmx.LastError.idEnteredCpu));
2959	LogRel(("HM: CPU[%u] Current Host Cpu %u\n", i, pVCpu->hm.s.vmx.LastError.idCurrentCpu));
2960	break;
2961
2962	case VERR_VMX_UNABLE_TO_START_VM:
2963	LogRel(("HM: VERR_VMX_UNABLE_TO_START_VM:\n"));
2964	LogRel(("HM: CPU[%u] Instruction error %#x\n", i, pVCpu->hm.s.vmx.LastError.u32InstrError));
2965	LogRel(("HM: CPU[%u] Exit reason %#x\n", i, pVCpu->hm.s.vmx.LastError.u32ExitReason));
2966
2967	if ( pVM->aCpus[i].hm.s.vmx.LastError.u32InstrError == VMX_ERROR_VMLAUCH_NON_CLEAR_VMCS
2968	\|\| pVM->aCpus[i].hm.s.vmx.LastError.u32InstrError == VMX_ERROR_VMRESUME_NON_LAUNCHED_VMCS)
2969	{
2970	LogRel(("HM: CPU[%u] Entered Host Cpu %u\n", i, pVCpu->hm.s.vmx.LastError.idEnteredCpu));
2971	LogRel(("HM: CPU[%u] Current Host Cpu %u\n", i, pVCpu->hm.s.vmx.LastError.idCurrentCpu));
2972	}
2973	else if (pVM->aCpus[i].hm.s.vmx.LastError.u32InstrError == VMX_ERROR_VMENTRY_INVALID_CONTROL_FIELDS)
2974	{
2975	LogRel(("HM: CPU[%u] PinCtls %#RX32\n", i, pVCpu->hm.s.vmx.u32PinCtls));
2976	LogRel(("HM: CPU[%u] ProcCtls %#RX32\n", i, pVCpu->hm.s.vmx.u32ProcCtls));
2977	LogRel(("HM: CPU[%u] ProcCtls2 %#RX32\n", i, pVCpu->hm.s.vmx.u32ProcCtls2));
2978	LogRel(("HM: CPU[%u] EntryCtls %#RX32\n", i, pVCpu->hm.s.vmx.u32EntryCtls));
2979	LogRel(("HM: CPU[%u] ExitCtls %#RX32\n", i, pVCpu->hm.s.vmx.u32ExitCtls));
2980	LogRel(("HM: CPU[%u] HCPhysMsrBitmap %#RHp\n", i, pVCpu->hm.s.vmx.HCPhysMsrBitmap));
2981	LogRel(("HM: CPU[%u] HCPhysGuestMsr %#RHp\n", i, pVCpu->hm.s.vmx.HCPhysGuestMsr));
2982	LogRel(("HM: CPU[%u] HCPhysHostMsr %#RHp\n", i, pVCpu->hm.s.vmx.HCPhysHostMsr));
2983	LogRel(("HM: CPU[%u] cMsrs %u\n", i, pVCpu->hm.s.vmx.cMsrs));
2984	}
2985	/** @todo Log VM-entry event injection control fields
2986	* VMX_VMCS_CTRL_ENTRY_IRQ_INFO, VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE
2987	* and VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH from the VMCS. */
2988	break;
2989
2990	case VERR_VMX_INVALID_VMXON_PTR:
2991	break;
2992
2993	case VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO:
2994	case VERR_VMX_INVALID_GUEST_STATE:
2995	case VERR_VMX_UNEXPECTED_EXIT:
2996	case VERR_SVM_UNKNOWN_EXIT:
2997	case VERR_SVM_UNEXPECTED_EXIT:
2998	case VERR_SVM_UNEXPECTED_PATCH_TYPE:
2999	case VERR_SVM_UNEXPECTED_XCPT_EXIT:
3000	case VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_TYPE:
3001	{
3002	LogRel(("HM: CPU[%u] HM error %#x (%u)\n", i, pVCpu->hm.s.u32HMError, pVCpu->hm.s.u32HMError));
3003	LogRel(("HM: CPU[%u] idxExitHistoryFree %u\n", i, pVCpu->hm.s.idxExitHistoryFree));
3004	unsigned const idxLast = pVCpu->hm.s.idxExitHistoryFree > 0 ?
3005	pVCpu->hm.s.idxExitHistoryFree - 1 :
3006	RT_ELEMENTS(pVCpu->hm.s.auExitHistory) - 1;
3007	for (unsigned k = 0; k < RT_ELEMENTS(pVCpu->hm.s.auExitHistory); k++)
3008	{
3009	LogRel(("HM: CPU[%u] auExitHistory[%2u] = %#x (%u) %s\n", i, k, pVCpu->hm.s.auExitHistory[k],
3010	pVCpu->hm.s.auExitHistory[k], idxLast == k ? "<-- Last" : ""));
3011	}
3012	break;
3013	}
3014	}
3015	}
3016
3017	if (iStatusCode == VERR_VMX_UNABLE_TO_START_VM)
3018	{
3019	LogRel(("HM: VERR_VMX_UNABLE_TO_START_VM: VM-entry allowed %#RX32\n", pVM->hm.s.vmx.Msrs.VmxEntry.n.allowed1));
3020	LogRel(("HM: VERR_VMX_UNABLE_TO_START_VM: VM-entry disallowed %#RX32\n", pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0));
3021	}
3022	else if (iStatusCode == VERR_VMX_INVALID_VMXON_PTR)
3023	LogRel(("HM: HCPhysVmxEnableError = %#RHp\n", pVM->hm.s.vmx.HCPhysVmxEnableError));
3024	}
3025
3026
3027	/**
3028	* Execute state save operation.
3029	*
3030	* @returns VBox status code.
3031	* @param pVM Pointer to the VM.
3032	* @param pSSM SSM operation handle.
3033	*/
3034	static DECLCALLBACK(int) hmR3Save(PVM pVM, PSSMHANDLE pSSM)
3035	{
3036	int rc;
3037
3038	Log(("hmR3Save:\n"));
3039
3040	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3041	{
3042	/*
3043	* Save the basic bits - fortunately all the other things can be resynced on load.
3044	*/
3045	rc = SSMR3PutU32(pSSM, pVM->aCpus[i].hm.s.Event.fPending);
3046	AssertRCReturn(rc, rc);
3047	rc = SSMR3PutU32(pSSM, pVM->aCpus[i].hm.s.Event.u32ErrCode);
3048	AssertRCReturn(rc, rc);
3049	rc = SSMR3PutU64(pSSM, pVM->aCpus[i].hm.s.Event.u64IntInfo);
3050	AssertRCReturn(rc, rc);
3051	/** @todo Shouldn't we be saving GCPtrFaultAddress too? */
3052
3053	/** @todo We only need to save pVM->aCpus[i].hm.s.vmx.fWasInRealMode and
3054	* perhaps not even that (the initial value of @c true is safe. */
3055	uint32_t u32Dummy = PGMMODE_REAL;
3056	rc = SSMR3PutU32(pSSM, u32Dummy);
3057	AssertRCReturn(rc, rc);
3058	rc = SSMR3PutU32(pSSM, u32Dummy);
3059	AssertRCReturn(rc, rc);
3060	rc = SSMR3PutU32(pSSM, u32Dummy);
3061	AssertRCReturn(rc, rc);
3062	}
3063
3064	#ifdef VBOX_HM_WITH_GUEST_PATCHING
3065	rc = SSMR3PutGCPtr(pSSM, pVM->hm.s.pGuestPatchMem);
3066	AssertRCReturn(rc, rc);
3067	rc = SSMR3PutGCPtr(pSSM, pVM->hm.s.pFreeGuestPatchMem);
3068	AssertRCReturn(rc, rc);
3069	rc = SSMR3PutU32(pSSM, pVM->hm.s.cbGuestPatchMem);
3070	AssertRCReturn(rc, rc);
3071
3072	/* Store all the guest patch records too. */
3073	rc = SSMR3PutU32(pSSM, pVM->hm.s.cPatches);
3074	AssertRCReturn(rc, rc);
3075
3076	for (unsigned i = 0; i < pVM->hm.s.cPatches; i++)
3077	{
3078	PHMTPRPATCH pPatch = &pVM->hm.s.aPatches[i];
3079
3080	rc = SSMR3PutU32(pSSM, pPatch->Core.Key);
3081	AssertRCReturn(rc, rc);
3082
3083	rc = SSMR3PutMem(pSSM, pPatch->aOpcode, sizeof(pPatch->aOpcode));
3084	AssertRCReturn(rc, rc);
3085
3086	rc = SSMR3PutU32(pSSM, pPatch->cbOp);
3087	AssertRCReturn(rc, rc);
3088
3089	rc = SSMR3PutMem(pSSM, pPatch->aNewOpcode, sizeof(pPatch->aNewOpcode));
3090	AssertRCReturn(rc, rc);
3091
3092	rc = SSMR3PutU32(pSSM, pPatch->cbNewOp);
3093	AssertRCReturn(rc, rc);
3094
3095	AssertCompileSize(HMTPRINSTR, 4);
3096	rc = SSMR3PutU32(pSSM, (uint32_t)pPatch->enmType);
3097	AssertRCReturn(rc, rc);
3098
3099	rc = SSMR3PutU32(pSSM, pPatch->uSrcOperand);
3100	AssertRCReturn(rc, rc);
3101
3102	rc = SSMR3PutU32(pSSM, pPatch->uDstOperand);
3103	AssertRCReturn(rc, rc);
3104
3105	rc = SSMR3PutU32(pSSM, pPatch->pJumpTarget);
3106	AssertRCReturn(rc, rc);
3107
3108	rc = SSMR3PutU32(pSSM, pPatch->cFaults);
3109	AssertRCReturn(rc, rc);
3110	}
3111	#endif
3112	return VINF_SUCCESS;
3113	}
3114
3115
3116	/**
3117	* Execute state load operation.
3118	*
3119	* @returns VBox status code.
3120	* @param pVM Pointer to the VM.
3121	* @param pSSM SSM operation handle.
3122	* @param uVersion Data layout version.
3123	* @param uPass The data pass.
3124	*/
3125	static DECLCALLBACK(int) hmR3Load(PVM pVM, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
3126	{
3127	int rc;
3128
3129	Log(("hmR3Load:\n"));
3130	Assert(uPass == SSM_PASS_FINAL); NOREF(uPass);
3131
3132	/*
3133	* Validate version.
3134	*/
3135	if ( uVersion != HM_SAVED_STATE_VERSION
3136	&& uVersion != HM_SAVED_STATE_VERSION_NO_PATCHING
3137	&& uVersion != HM_SAVED_STATE_VERSION_2_0_X)
3138	{
3139	AssertMsgFailed(("hmR3Load: Invalid version uVersion=%d!\n", uVersion));
3140	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3141	}
3142	for (VMCPUID i = 0; i < pVM->cCpus; i++)
3143	{
3144	rc = SSMR3GetU32(pSSM, &pVM->aCpus[i].hm.s.Event.fPending);
3145	AssertRCReturn(rc, rc);
3146	rc = SSMR3GetU32(pSSM, &pVM->aCpus[i].hm.s.Event.u32ErrCode);
3147	AssertRCReturn(rc, rc);
3148	rc = SSMR3GetU64(pSSM, &pVM->aCpus[i].hm.s.Event.u64IntInfo);
3149	AssertRCReturn(rc, rc);
3150
3151	if (uVersion >= HM_SAVED_STATE_VERSION_NO_PATCHING)
3152	{
3153	uint32_t val;
3154	/** @todo See note in hmR3Save(). */
3155	rc = SSMR3GetU32(pSSM, &val);
3156	AssertRCReturn(rc, rc);
3157	rc = SSMR3GetU32(pSSM, &val);
3158	AssertRCReturn(rc, rc);
3159	rc = SSMR3GetU32(pSSM, &val);
3160	AssertRCReturn(rc, rc);
3161	}
3162	}
3163	#ifdef VBOX_HM_WITH_GUEST_PATCHING
3164	if (uVersion > HM_SAVED_STATE_VERSION_NO_PATCHING)
3165	{
3166	rc = SSMR3GetGCPtr(pSSM, &pVM->hm.s.pGuestPatchMem);
3167	AssertRCReturn(rc, rc);
3168	rc = SSMR3GetGCPtr(pSSM, &pVM->hm.s.pFreeGuestPatchMem);
3169	AssertRCReturn(rc, rc);
3170	rc = SSMR3GetU32(pSSM, &pVM->hm.s.cbGuestPatchMem);
3171	AssertRCReturn(rc, rc);
3172
3173	/* Fetch all TPR patch records. */
3174	rc = SSMR3GetU32(pSSM, &pVM->hm.s.cPatches);
3175	AssertRCReturn(rc, rc);
3176
3177	for (unsigned i = 0; i < pVM->hm.s.cPatches; i++)
3178	{
3179	PHMTPRPATCH pPatch = &pVM->hm.s.aPatches[i];
3180
3181	rc = SSMR3GetU32(pSSM, &pPatch->Core.Key);
3182	AssertRCReturn(rc, rc);
3183
3184	rc = SSMR3GetMem(pSSM, pPatch->aOpcode, sizeof(pPatch->aOpcode));
3185	AssertRCReturn(rc, rc);
3186
3187	rc = SSMR3GetU32(pSSM, &pPatch->cbOp);
3188	AssertRCReturn(rc, rc);
3189
3190	rc = SSMR3GetMem(pSSM, pPatch->aNewOpcode, sizeof(pPatch->aNewOpcode));
3191	AssertRCReturn(rc, rc);
3192
3193	rc = SSMR3GetU32(pSSM, &pPatch->cbNewOp);
3194	AssertRCReturn(rc, rc);
3195
3196	rc = SSMR3GetU32(pSSM, (uint32_t *)&pPatch->enmType);
3197	AssertRCReturn(rc, rc);
3198
3199	if (pPatch->enmType == HMTPRINSTR_JUMP_REPLACEMENT)
3200	pVM->hm.s.fTPRPatchingActive = true;
3201
3202	Assert(pPatch->enmType == HMTPRINSTR_JUMP_REPLACEMENT \|\| pVM->hm.s.fTPRPatchingActive == false);
3203
3204	rc = SSMR3GetU32(pSSM, &pPatch->uSrcOperand);
3205	AssertRCReturn(rc, rc);
3206
3207	rc = SSMR3GetU32(pSSM, &pPatch->uDstOperand);
3208	AssertRCReturn(rc, rc);
3209
3210	rc = SSMR3GetU32(pSSM, &pPatch->cFaults);
3211	AssertRCReturn(rc, rc);
3212
3213	rc = SSMR3GetU32(pSSM, &pPatch->pJumpTarget);
3214	AssertRCReturn(rc, rc);
3215
3216	Log(("hmR3Load: patch %d\n", i));
3217	Log(("Key = %x\n", pPatch->Core.Key));
3218	Log(("cbOp = %d\n", pPatch->cbOp));
3219	Log(("cbNewOp = %d\n", pPatch->cbNewOp));
3220	Log(("type = %d\n", pPatch->enmType));
3221	Log(("srcop = %d\n", pPatch->uSrcOperand));
3222	Log(("dstop = %d\n", pPatch->uDstOperand));
3223	Log(("cFaults = %d\n", pPatch->cFaults));
3224	Log(("target = %x\n", pPatch->pJumpTarget));
3225	rc = RTAvloU32Insert(&pVM->hm.s.PatchTree, &pPatch->Core);
3226	AssertRC(rc);
3227	}
3228	}
3229	#endif
3230
3231	return VINF_SUCCESS;
3232	}
3233

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/HM.cpp@ 57334

Download in other formats: