Changeset 45556 in vbox for trunk/src

Timestamp:

Apr 15, 2013 4:45:27 PM (12 years ago)

Author:

vboxsync

Message:

VMM/VMMR0: HM bits.

File:

• trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp (modified) (54 diffs)

trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp

@@ -2561 +2561 @@
         rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_RIP, pMixedCtx->rip);
         AssertRCReturn(rc, rc);
-        Log(("VMX_VMCS_GUEST_RIP=%#RX64\n", pMixedCtx->rip));
+        Log(("Load: VMX_VMCS_GUEST_RIP=%#RX64\n", pMixedCtx->rip));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_RIP;
     }
@@ -2629 +2629 @@
         AssertRCReturn(rc, rc);
 
-        Log(("VMX_VMCS_GUEST_RFLAGS=%#RX64\n", uRFlags.u64));
+        Log(("Load: VMX_VMCS_GUEST_RFLAGS=%#RX64\n", uRFlags.u64));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_RFLAGS;
     }
@@ -2684 +2684 @@
         rc  = VMXWriteVmcsGstN(VMX_VMCS_CTRL_CR0_READ_SHADOW, u64GuestCR0);
         AssertRCReturn(rc, rc);
-        Log2(("VMX_VMCS_CTRL_CR0_READ_SHADOW=%#RX64\n", u64GuestCR0));
+        Log(("Load: VMX_VMCS_CTRL_CR0_READ_SHADOW=%#RX64\n", u64GuestCR0));
 
         /* Setup VT-x's view of the guest CR0. */
@@ -2712 +2712 @@
          * Guest FPU bits.
          * Intel spec. 23.8 "Restrictions on VMX operation" mentions that CR0.NE bit must always be set on the first
-         * CPUs to support VT-x (prob. means all the way up to Nehalem) and no mention of with regards to UX in VM-entry checks.
+         * CPUs to support VT-x and no mention of with regards to UX in VM-entry checks.
          */
         u64GuestCR0 |= X86_CR0_NE;
@@ -2789 +2789 @@
         rc  = VMXWriteVmcsGstN(VMX_VMCS_GUEST_CR0, u64GuestCR0);
         rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, pVCpu->hm.s.vmx.u32XcptBitmap);
-        Log2(("VMX_VMCS_GUEST_CR0=%#RX32\n", (uint32_t)u64GuestCR0));
+        Log(("Load: VMX_VMCS_GUEST_CR0=%RGv (uSetCR0=%#RGv uZapCR0=%#RGv)\n", u64GuestCR0, uSetCR0, uZapCR0));
 
         /*
@@ -2798 +2798 @@
         uint64_t u64CR0Mask = 0;
         u64CR0Mask =  X86_CR0_PE
+                    | X86_CR0_NE
                     | X86_CR0_WP
                     | X86_CR0_PG
@@ -2853 +2854 @@
             rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
             AssertRCReturn(rc, rc);
-            Log(("VMX_VMCS64_CTRL_EPTP_FULL=%#RX64\n", pVCpu->hm.s.vmx.HCPhysEPTP));
+            Log(("Load: VMX_VMCS64_CTRL_EPTP_FULL=%#RX64\n", pVCpu->hm.s.vmx.HCPhysEPTP));
 
             if (   pVM->hm.s.vmx.fUnrestrictedGuest
@@ -2897 +2898 @@
         }
 
-        Log2(("VMX_VMCS_GUEST_CR3=%#RX64\n", u64GuestCR3));
+        Log(("Load: VMX_VMCS_GUEST_CR3=%#RX64\n", u64GuestCR3));
         rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_CR3, u64GuestCR3);
         AssertRCReturn(rc, rc);
@@ -2914 +2915 @@
         rc  = VMXWriteVmcsGstN(VMX_VMCS_CTRL_CR4_READ_SHADOW, u64GuestCR4);
         AssertRCReturn(rc, rc);
-        Log2(("VMX_VMCS_CTRL_CR4_READ_SHADOW=%#RGv\n", u64GuestCR4));
+        Log(("Load: VMX_VMCS_CTRL_CR4_READ_SHADOW=%#RGv\n", u64GuestCR4));
 
         /* Setup VT-x's view of the guest CR4. */
@@ -2982 +2983 @@
 
         /* Write VT-x's view of the guest CR4 into the VMCS. */
-        Log2(("VMX_VMCS_GUEST_CR4=%#RGv (Set=%#RX32 Zap=%#RX32)\n", u64GuestCR4, uSetCR4, uZapCR4));
+        Log(("Load: VMX_VMCS_GUEST_CR4=%#RGv (Set=%#RX32 Zap=%#RX32)\n", u64GuestCR4, uSetCR4, uZapCR4));
         rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_CR4, u64GuestCR4);
 
@@ -3371 +3372 @@
                        in real-mode (e.g. OpenBSD 4.0) */
                     REMFlushTBs(pVM);
-                    Log2(("Switch to protected mode detected!\n"));
+                    Log(("Load: Switch to protected mode detected!\n"));
                 }
                 pVCpu->hm.s.vmx.enmLastSeenGuestMode = enmGuestMode;
@@ -3460 +3461 @@
         AssertRCReturn(rc, rc);
 
-        Log2(("VMX_VMCS_GUEST_TR_BASE=%#RX64\n", u64Base));
+        Log(("Load: VMX_VMCS_GUEST_TR_BASE=%#RX64\n", u64Base));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_TR;
     }
@@ -3474 +3475 @@
 
         Assert(!(pCtx->gdtr.cbGdt & 0xffff0000ULL));      /* Bits 31:16 MBZ. */
-        Log2(("VMX_VMCS_GUEST_GDTR_BASE=%#RX64\n", pCtx->gdtr.pGdt));
+        Log(("Load: VMX_VMCS_GUEST_GDTR_BASE=%#RX64\n", pCtx->gdtr.pGdt));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_GDTR;
     }
@@ -3511 +3512 @@
         }
 
-        Log2(("VMX_VMCS_GUEST_LDTR_BASE=%#RX64\n",  pCtx->ldtr.u64Base));
+        Log(("Load: VMX_VMCS_GUEST_LDTR_BASE=%#RX64\n",  pCtx->ldtr.u64Base));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_LDTR;
     }
@@ -3525 +3526 @@
 
         Assert(!(pCtx->idtr.cbIdt & 0xffff0000ULL));      /* Bits 31:16 MBZ. */
-        Log2(("VMX_VMCS_GUEST_IDTR_BASE=%#RX64\n", pCtx->idtr.pIdt));
+        Log(("Load: VMX_VMCS_GUEST_IDTR_BASE=%#RX64\n", pCtx->idtr.pIdt));
         pVCpu->hm.s.fContextUseFlags &= ~HM_CHANGED_GUEST_IDTR;
     }
@@ -4731 +4732 @@
 
         /* See Intel spec. 30.7.1.1 "Reflecting Exceptions to Guest Software". */
-        VMXREFLECTXCPT enmReflect = VMXREFLECTXCPT_NONE;
+        VMXREFLECTXCPT enmReflect     = VMXREFLECTXCPT_NONE;
+        RTGCUINTPTR GCPtrFaultAddress = 0;
         if (uIntType == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT)
         {
             if (   hmR0VmxIsBenignXcpt(uIdtVector)
-                || hmR0VmxIsBenignXcpt(uExitVector))
+                || hmR0VmxIsBenignXcpt(uExitVector)
+                || (   hmR0VmxIsContributoryXcpt(uIdtVector)
+                    && uExitVector == X86_XCPT_PF))
             {
                 enmReflect = VMXREFLECTXCPT_XCPT;
@@ -4744 +4748 @@
                 pVmxTransient->fVectoringPF = true;
                 enmReflect = VMXREFLECTXCPT_XCPT;
+                GCPtrFaultAddress = pMixedCtx->cr2;
+                Log(("Vectoring #PF uCR2=%#RGv\n", pMixedCtx->cr2));
             }
             else if (   (pVCpu->hm.s.vmx.u32XcptBitmap & VMX_CONTRIBUTORY_XCPT_BITMAP)
@@ -4778 +4784 @@
                 }
                 hmR0VmxSetPendingEvent(pVCpu, VMX_ENTRY_INTR_INFO_FROM_EXIT_IDT_INFO(pVmxTransient->uIdtVectoringInfo),
-                                       0 /* cbInstr */,  u32ErrCode, 0 /* GCPtrFaultAddress */);
+                                       0 /* cbInstr */,  u32ErrCode, GCPtrFaultAddress);
                 rc = VINF_SUCCESS;
-                Log(("Pending event %#RX64 Err=%#RX32\n", pVCpu->hm.s.Event.u64IntrInfo, pVCpu->hm.s.Event.u32ErrCode));
+                Log(("Pending vectoring event %#RX64 Err=%#RX32\n", pVCpu->hm.s.Event.u64IntrInfo, pVCpu->hm.s.Event.u32ErrCode));
                 break;
             }
@@ -4788 +4794 @@
                 hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
                 rc = VINF_VMX_DOUBLE_FAULT;
-                Log(("Pending #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->hm.s.Event.u64IntrInfo, uIdtVector,
+                Log(("Pending vectoring #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->hm.s.Event.u64IntrInfo, uIdtVector,
                      uExitVector));
                 break;
@@ -4795 +4801 @@
             case VMXREFLECTXCPT_TF:
             {
-                Log(("Pending triple-fault uIdt=%#x uExit=%#x\n", uIdtVector, uExitVector));
+                Log(("Pending vectoring triple-fault uIdt=%#x uExit=%#x\n", uIdtVector, uExitVector));
                 rc = VINF_EM_RESET;
                 break;
@@ -5210 +5216 @@
             AssertRCReturn(rc, rc);
         }
+
         pVCpu->hm.s.vmx.fUpdatedGuestState |= VMX_UPDATED_GUEST_CR3;
     }
@@ -5519 +5526 @@
             {
                 AssertRC(rc);
-                Log2(("hmR0VmxCheckForceFlags: PGMSyncCR3 forcing us back to ring-3. rc=%d\n", rc));
+                Log(("hmR0VmxCheckForceFlags: PGMSyncCR3 forcing us back to ring-3. rc=%d\n", rc));
                 return rc;
             }
@@ -5531 +5538 @@
             STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
             rc = RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
-            Log2(("hmR0VmxCheckForceFlags: HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc));
+            Log(("hmR0VmxCheckForceFlags: HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc));
             return rc;
         }
@@ -5539 +5546 @@
             || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
         {
-            Log2(("hmR0VmxCheckForceFlags: Pending VM request forcing us back to ring-3\n"));
+            Log(("hmR0VmxCheckForceFlags: Pending VM request forcing us back to ring-3\n"));
             return VINF_EM_PENDING_REQUEST;
         }
@@ -5546 +5553 @@
         if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
         {
-            Log2(("hmR0VmxCheckForceFlags: PGM pool flush pending forcing us back to ring-3\n"));
+            Log(("hmR0VmxCheckForceFlags: PGM pool flush pending forcing us back to ring-3\n"));
             return rc = VINF_PGM_POOL_FLUSH_PENDING;
         }
@@ -5553 +5560 @@
         if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
         {
-            Log2(("hmR0VmxCheckForceFlags: Pending DMA request forcing us back to ring-3\n"));
+            Log(("hmR0VmxCheckForceFlags: Pending DMA request forcing us back to ring-3\n"));
             return VINF_EM_RAW_TO_R3;
         }
@@ -5638 +5645 @@
     AssertRC(rc);
     Log(("Converting TRPM trap: u32IntrInfo=%#RX32 enmTrpmEvent=%d cbInstr=%u u32ErrCode=%#RX32 GCPtrFaultAddress=%#RGv\n",
-         u32IntrInfo, enmTrpmEvent, u32ErrCode, GCPtrFaultAddress));
+         u32IntrInfo, enmTrpmEvent, cbInstr, u32ErrCode, GCPtrFaultAddress));
     hmR0VmxSetPendingEvent(pVCpu, u32IntrInfo, cbInstr, u32ErrCode, GCPtrFaultAddress);
 }
@@ -5674 +5681 @@
             case VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT:      /* #BP and #OF */
             case VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT:
-                enmTrapType = TRPM_TRAP;            /** @tod does #BP and #OF come under TRAP or SOFTWARE_INT?? */
+                enmTrapType = TRPM_TRAP;
                 break;
             default:
@@ -5954 +5961 @@
             && !fBlockMovSS)
         {
-            uint8_t u8Interrupt = 0;
+            uint8_t u8Interrupt;
             rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
             if (RT_SUCCESS(rc))
@@ -6520 +6527 @@
 
         /* Map the HC APIC-access page into the GC space, this also updates the shadow page tables if necessary. */
-        Log2(("Mapped HC APIC-access page into GC: GCPhysApicBase=%#RGv\n", GCPhysApicBase));
+        Log(("Mapped HC APIC-access page into GC: GCPhysApicBase=%#RGv\n", GCPhysApicBase));
         rc = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess, X86_PTE_RW | X86_PTE_P);
         AssertRCReturn(rc, rc);
@@ -6886 +6893 @@
    } while (0)
 
-# define VMX_VALIDATE_EXIT_HANDLER_PARAMS() \
-            do {                                                      \
-                AssertPtr(pVCpu);                                     \
-                AssertPtr(pMixedCtx);                                 \
-                AssertPtr(pVmxTransient);                             \
-                Assert(pVmxTransient->fVMEntryFailed == false);       \
-                Assert(ASMIntAreEnabled());                           \
-                Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));      \
-                VMX_ASSERT_PREEMPT_CPUID_VAR();                       \
-                LogFunc(("\n"));                                      \
-                Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));      \
-                if (VMMR0IsLogFlushDisabled(pVCpu))                   \
-                    VMX_ASSERT_PREEMPT_CPUID();                       \
+# define VMX_VALIDATE_EXIT_HANDLER_PARAMS()                                  \
+            do {                                                             \
+                AssertPtr(pVCpu);                                            \
+                AssertPtr(pMixedCtx);                                        \
+                AssertPtr(pVmxTransient);                                    \
+                Assert(pVmxTransient->fVMEntryFailed == false);              \
+                Assert(ASMIntAreEnabled());                                  \
+                Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));             \
+                VMX_ASSERT_PREEMPT_CPUID_VAR();                              \
+                LogFunc(("vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv\n")); \
+                Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));             \
+                if (VMMR0IsLogFlushDisabled(pVCpu))                          \
+                    VMX_ASSERT_PREEMPT_CPUID();                              \
             } while (0)
 # define VMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS() \
-            do { \
-                LogFunc(("\n"));                                      \
+            do {                                 \
+                LogFunc(("\n"));                 \
             } while(0)
 #else   /* Release builds */
@@ -7248 +7255 @@
     else
     {
-        AssertMsg(rc == VERR_EM_INTERPRETER, ("hmR0VmxExitInvlpg: EMInterpretInvlpg %RGv failed with %Rrc\n",
+        AssertMsg(rc == VERR_EM_INTERPRETER, ("hmR0VmxExitInvlpg: EMInterpretInvlpg %#RGv failed with %Rrc\n",
                                               pVmxTransient->uExitQualification, rc));
         rc = VERR_EM_INTERPRETER;
@@ -7780 +7787 @@
             {
                 case 0: /* CR0 */
-                    Log(("CR0 write rc=%d\n", rc));
+                    Log(("CR0 write rc=%d CR0=%#RGv\n", rc, pMixedCtx->cr0));
                     pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
                     break;
@@ -7788 +7795 @@
                 case 3: /* CR3 */
                     Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestPagingEnabledEx(pMixedCtx));
-                    Log(("CR3 write rc=%d\n", rc));
+                    Log(("CR3 write rc=%d CR3=%#RGv\n", rc, pMixedCtx->cr3));
                     pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR3;
                     break;
                 case 4: /* CR4 */
-                    Log(("CR4 write rc=%d\n", rc));
+                    Log(("CR4 write rc=%d CR4=%#RGv\n", rc, pMixedCtx->cr4));
                     pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR4;
                     break;
@@ -7812 +7819 @@
         {
             /* EMInterpretCRxRead() requires EFER MSR, CS. */
-            rc = hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+            rc  = hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
             AssertRCReturn(rc, rc);
             Assert(   !pVM->hm.s.fNestedPaging
@@ -8388 +8395 @@
 {
     VMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS();
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
 
     int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
     AssertRCReturn(rc, rc);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
 
     if (!(pMixedCtx->cr0 & X86_CR0_NE))
@@ -8411 +8418 @@
 {
     VMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS();
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
 
     /** @todo Try optimize this by not saving the entire guest state unless
@@ -8416 +8424 @@
     int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
     AssertRCReturn(rc, rc);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
 
     PVM pVM = pVCpu->CTX_SUFF(pVM);
@@ -8442 +8449 @@
 {
     VMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS();
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
 
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
@@ -8454 +8462 @@
     PVM pVM = pVCpu->CTX_SUFF(pVM);
     rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx), uDR6);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
     if (rc == VINF_EM_RAW_GUEST_TRAP)
     {
@@ -8502 +8509 @@
     int rc = hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
     AssertRCReturn(rc, rc);
+
+    rc = hmR0VmxSaveGuestGprs(pVCpu, pMixedCtx);
+    rc |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    Log(("Rip %04x:%#RX64\n", pMixedCtx->cs.Sel, pMixedCtx->rip));
 
     /* Lazy FPU loading; Load the guest-FPU state transparently and continue execution of the guest. */
@@ -8533 +8544 @@
 {
     VMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS();
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestGP);
 
     int rc = VERR_INTERNAL_ERROR_5;
@@ -8543 +8555 @@
         rc |= hmR0VmxReadExitIntrErrorCodeVmcs(pVCpu, pVmxTransient);
         rc |= hmR0VmxReadExitInstrLenVmcs(pVCpu, pVmxTransient);
-        rc |= hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
+        rc |= hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
         AssertRCReturn(rc, rc);
-        Log(("#GP Gst: RIP %#RX64\n", pMixedCtx->rip));
+        Log(("#GP Gst: RIP %#RX64 ErrorCode=%#x CR0=%#RGv CPL=%u\n", pMixedCtx->rip, pVmxTransient->uExitIntrErrorCode,
+             pMixedCtx->cr0, CPUMGetGuestCPL(pVCpu)));
         hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntrInfo),
                                pVmxTransient->cbInstr, pVmxTransient->uExitIntrErrorCode, 0 /* GCPtrFaultAddress */);
@@ -8571 +8584 @@
         rc = VINF_SUCCESS;
         Assert(cbOp == pDis->cbInstr);
-        Log2(("#GP Disas OpCode=%u CS:EIP %04x:%#RX64\n", pDis->pCurInstr->uOpcode, pMixedCtx->cs.Sel, pMixedCtx->rip));
+        Log(("#GP Disas OpCode=%u CS:EIP %04x:%#RX64\n", pDis->pCurInstr->uOpcode, pMixedCtx->cs.Sel, pMixedCtx->rip));
         switch (pDis->pCurInstr->uOpcode)
         {
@@ -8629 +8642 @@
                     break;
                 }
-                Log(("POPF %x -> %RGv mask=%x RIP=%#RX64\n", uEflags.u, pMixedCtx->rsp, uMask, pMixedCtx->rip));
+                Log(("POPF %x -> %#RGv mask=%x RIP=%#RX64\n", uEflags.u, pMixedCtx->rsp, uMask, pMixedCtx->rip));
                 pMixedCtx->eflags.u32 =   (pMixedCtx->eflags.u32 & ~(X86_EFL_POPF_BITS & uMask))
                                         | (uEflags.u32 & X86_EFL_POPF_BITS & uMask);
@@ -8678 +8691 @@
                     break;
                 }
-                Log(("PUSHF %x -> %RGv\n", uEflags.u, GCPtrStack));
+                Log(("PUSHF %x -> %#RGv\n", uEflags.u, GCPtrStack));
                 pMixedCtx->esp               -= cbParm;
                 pMixedCtx->esp               &= uMask;
@@ -8747 +8760 @@
                 rc = VBOXSTRICTRC_VAL(rc2);
                 pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_ALL_GUEST;
-                Log2(("#GP rc=%Rrc\n", rc));
+                Log(("#GP rc=%Rrc\n", rc));
                 break;
             }
@@ -8774 +8787 @@
     /* Re-inject the exception into the guest. This cannot be a double-fault condition which would have been handled in
        hmR0VmxCheckExitDueToEventDelivery(). */
+    int rc =  hmR0VmxReadExitIntrErrorCodeVmcs(pVCpu, pVmxTransient);
+    rc    |= hmR0VmxReadExitInstrLenVmcs(pVCpu, pVmxTransient);
+    AssertRCReturn(rc, rc);
+    Assert(pVmxTransient->fVmcsFieldsRead & VMX_TRANSIENT_EXIT_INTERRUPTION_INFO);
     hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntrInfo),
                            pVmxTransient->cbInstr, pVmxTransient->uExitIntrErrorCode, 0 /* GCPtrFaultAddress */);
@@ -8789 +8806 @@
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     rc    |= hmR0VmxReadExitIntrInfoVmcs(pVCpu, pVmxTransient);
-    rc    |= hmR0VmxReadExitInstrLenVmcs(pVCpu, pVmxTransient);
     rc    |= hmR0VmxReadExitIntrErrorCodeVmcs(pVCpu, pVmxTransient);
     AssertRCReturn(rc, rc);
@@ -8799 +8815 @@
         {
             pMixedCtx->cr2 = pVmxTransient->uExitQualification;
+            pVCpu->hm.s.Event.fPending = false;     /* In case it's a contributory #PF. */
             hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntrInfo),
-                                   pVmxTransient->cbInstr, pVmxTransient->uExitIntrErrorCode, pMixedCtx->cr2);
+                                   0 /* cbInstr */, pVmxTransient->uExitIntrErrorCode, pMixedCtx->cr2);
+            STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
         }
         else
         {
             /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
-            Log(("Pending #DF due to vectoring #PF.\n"));
-            pVCpu->hm.s.Event.fPending = false;
-            rc = hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
+            pVCpu->hm.s.Event.fPending = false;     /* A vectoring #PF. */
+            hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
+            Log(("Pending #DF due to vectoring #PF. NP\n"));
         }
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
@@ -8847 +8865 @@
 #endif
 
-    Assert(!pVmxTransient->fVectoringPF || pVCpu->hm.s.Event.fPending);
-
     rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
     AssertRCReturn(rc, rc);
 
+    Log(("#PF: cr2=%#RGv cs:rip=%#04x:%#RGv uErrCode %#RX32\n", pVmxTransient->uExitQualification, pMixedCtx->cs.Sel,
+         pMixedCtx->rip, pVmxTransient->uExitIntrErrorCode));
+
     TRPMAssertXcptPF(pVCpu, pVmxTransient->uExitQualification, (RTGCUINT)pVmxTransient->uExitIntrErrorCode);
-
-    /* Forward it to the trap handler first. */
     rc = PGMTrap0eHandler(pVCpu, pVmxTransient->uExitIntrErrorCode, CPUMCTX2CORE(pMixedCtx),
                           (RTGCPTR)pVmxTransient->uExitQualification);
 
-    Log(("#PF: cr2=%RGv cs:rip=%04x:%RGv errorcode %#RX32 rc=%d\n", pVmxTransient->uExitQualification, pMixedCtx->cs.Sel,
-         pMixedCtx->rip, pVmxTransient->uExitIntrErrorCode, rc));
-
+    Log(("#PF: rc=%Rrc\n", rc));
     if (rc == VINF_SUCCESS)
     {
@@ -8874 +8889 @@
     else if (rc == VINF_EM_RAW_GUEST_TRAP)
     {
-        if (RT_LIKELY(!pVmxTransient->fVectoringPF))
+        if (!pVmxTransient->fVectoringPF)
         {
             /* It's a guest page fault and needs to be reflected to the guest. */
@@ -8880 +8895 @@
             TRPMResetTrap(pVCpu);
             pMixedCtx->cr2 = pVmxTransient->uExitQualification;
+            pVCpu->hm.s.Event.fPending = false;     /* In case it's a contributory #PF. */
             hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntrInfo),
                                    0 /* cbInstr */, uGstErrorCode, pMixedCtx->cr2);
@@ -8887 +8903 @@
             /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
             TRPMResetTrap(pVCpu);
-            pVCpu->hm.s.Event.fPending = false;
+            pVCpu->hm.s.Event.fPending = false;     /* Clear pending #PF for replace it with #DF. */
             hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
             Log(("#PF: Pending #DF due to vectoring #PF\n"));