VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp@ 20588

最後變更 在這個檔案從20588是 20530,由 vboxsync 提交於 16 年 前

VMM: remove DISCPUSTATE from the stack.
  • 屬性 svn:eol-style 設為 native
  • 屬性 svn:keywords 設為 Id
檔案大小: 111.3 KB
行 
1/* $Id: HWSVMR0.cpp 20530 2009-06-13 20:53:44Z vboxsync $ */
2/** @file
3 * HWACCM SVM - Host Context Ring 0.
4 */
5
6/*
7 * Copyright (C) 2006-2007 Sun Microsystems, Inc.
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.alldomusa.eu.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18 * Clara, CA 95054 USA or visit http://www.sun.com if you need
19 * additional information or have any questions.
20 */
21
22
23/*******************************************************************************
24* Header Files *
25*******************************************************************************/
26#define LOG_GROUP LOG_GROUP_HWACCM
27#include <VBox/hwaccm.h>
28#include "HWACCMInternal.h"
29#include <VBox/vm.h>
30#include <VBox/x86.h>
31#include <VBox/hwacc_svm.h>
32#include <VBox/pgm.h>
33#include <VBox/pdm.h>
34#include <VBox/err.h>
35#include <VBox/log.h>
36#include <VBox/selm.h>
37#include <VBox/iom.h>
38#include <VBox/dis.h>
39#include <VBox/dbgf.h>
40#include <VBox/disopcode.h>
41#include <iprt/param.h>
42#include <iprt/assert.h>
43#include <iprt/asm.h>
44#include <iprt/cpuset.h>
45#include <iprt/mp.h>
46#include <iprt/time.h>
47#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
48# include <iprt/thread.h>
49#endif
50#include "HWSVMR0.h"
51
52/*******************************************************************************
53* Internal Functions *
54*******************************************************************************/
55static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID);
56static int svmR0ReplaceTprInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
57
58/*******************************************************************************
59* Global Variables *
60*******************************************************************************/
61/* IO operation lookup arrays. */
62static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
63
64/**
65 * Sets up and activates AMD-V on the current CPU
66 *
67 * @returns VBox status code.
68 * @param pCpu CPU info struct
69 * @param pVM The VM to operate on. (can be NULL after a resume!!)
70 * @param pvPageCpu Pointer to the global cpu page
71 * @param pPageCpuPhys Physical address of the global cpu page
72 */
73VMMR0DECL(int) SVMR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
74{
75 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
76 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
77
78 /* We must turn on AMD-V and setup the host state physical address, as those MSRs are per-cpu/core. */
79
80#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
81 SUPR0Printf("SVMR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
82#endif
83
84 /* Turn on AMD-V in the EFER MSR. */
85 uint64_t val = ASMRdMsr(MSR_K6_EFER);
86 if (!(val & MSR_K6_EFER_SVME))
87 ASMWrMsr(MSR_K6_EFER, val | MSR_K6_EFER_SVME);
88
89 /* Write the physical page address where the CPU will store the host state while executing the VM. */
90 ASMWrMsr(MSR_K8_VM_HSAVE_PA, pPageCpuPhys);
91
92 return VINF_SUCCESS;
93}
94
95/**
96 * Deactivates AMD-V on the current CPU
97 *
98 * @returns VBox status code.
99 * @param pCpu CPU info struct
100 * @param pvPageCpu Pointer to the global cpu page
101 * @param pPageCpuPhys Physical address of the global cpu page
102 */
103VMMR0DECL(int) SVMR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
104{
105 AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
106 AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
107
108#if defined(LOG_ENABLED) && !defined(DEBUG_bird)
109 SUPR0Printf("SVMR0DisableCpu cpu %d\n", pCpu->idCpu);
110#endif
111
112 /* Turn off AMD-V in the EFER MSR. */
113 uint64_t val = ASMRdMsr(MSR_K6_EFER);
114 ASMWrMsr(MSR_K6_EFER, val & ~MSR_K6_EFER_SVME);
115
116 /* Invalidate host state physical address. */
117 ASMWrMsr(MSR_K8_VM_HSAVE_PA, 0);
118
119 return VINF_SUCCESS;
120}
121
122/**
123 * Does Ring-0 per VM AMD-V init.
124 *
125 * @returns VBox status code.
126 * @param pVM The VM to operate on.
127 */
128VMMR0DECL(int) SVMR0InitVM(PVM pVM)
129{
130 int rc;
131
132 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
133 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
134
135 /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
136 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjIOBitmap, 3 << PAGE_SHIFT, true /* executable R0 mapping */);
137 if (RT_FAILURE(rc))
138 return rc;
139
140 pVM->hwaccm.s.svm.pIOBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjIOBitmap);
141 pVM->hwaccm.s.svm.pIOBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjIOBitmap, 0);
142 /* Set all bits to intercept all IO accesses. */
143 ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
144
145 /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
146 rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
147 if (RT_FAILURE(rc))
148 return rc;
149
150 pVM->hwaccm.s.svm.pMSRBitmap = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
151 pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
152 /* Set all bits to intercept all MSR accesses. */
153 ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
154
155 /* Erratum 170 which requires a forced TLB flush for each world switch:
156 * See http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/33610.pdf
157 *
158 * All BH-G1/2 and DH-G1/2 models include a fix:
159 * Athlon X2: 0x6b 1/2
160 * 0x68 1/2
161 * Athlon 64: 0x7f 1
162 * 0x6f 2
163 * Sempron: 0x7f 1/2
164 * 0x6f 2
165 * 0x6c 2
166 * 0x7c 2
167 * Turion 64: 0x68 2
168 *
169 */
170 uint32_t u32Dummy;
171 uint32_t u32Version, u32Family, u32Model, u32Stepping, u32BaseFamily;
172 ASMCpuId(1, &u32Version, &u32Dummy, &u32Dummy, &u32Dummy);
173 u32BaseFamily= (u32Version >> 8) & 0xf;
174 u32Family = u32BaseFamily + (u32BaseFamily == 0xf ? ((u32Version >> 20) & 0x7f) : 0);
175 u32Model = ((u32Version >> 4) & 0xf);
176 u32Model = u32Model | ((u32BaseFamily == 0xf ? (u32Version >> 16) & 0x0f : 0) << 4);
177 u32Stepping = u32Version & 0xf;
178 if ( u32Family == 0xf
179 && !((u32Model == 0x68 || u32Model == 0x6b || u32Model == 0x7f) && u32Stepping >= 1)
180 && !((u32Model == 0x6f || u32Model == 0x6c || u32Model == 0x7c) && u32Stepping >= 2))
181 {
182 Log(("SVMR0InitVM: AMD cpu with erratum 170 family %x model %x stepping %x\n", u32Family, u32Model, u32Stepping));
183 pVM->hwaccm.s.svm.fAlwaysFlushTLB = true;
184 }
185
186 /* Allocate VMCBs for all guest CPUs. */
187 for (unsigned i=0;i<pVM->cCPUs;i++)
188 {
189 PVMCPU pVCpu = &pVM->aCpus[i];
190
191 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
192 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
193
194 /* Allocate one page for the host context */
195 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
196 if (RT_FAILURE(rc))
197 return rc;
198
199 pVCpu->hwaccm.s.svm.pVMCBHost = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCBHost);
200 pVCpu->hwaccm.s.svm.pVMCBHostPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, 0);
201 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCBHost);
202
203 /* Allocate one page for the VM control block (VMCB). */
204 rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjVMCB, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
205 if (RT_FAILURE(rc))
206 return rc;
207
208 pVCpu->hwaccm.s.svm.pVMCB = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjVMCB);
209 pVCpu->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCB, 0);
210 ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCB);
211 }
212
213 return VINF_SUCCESS;
214}
215
216/**
217 * Does Ring-0 per VM AMD-V termination.
218 *
219 * @returns VBox status code.
220 * @param pVM The VM to operate on.
221 */
222VMMR0DECL(int) SVMR0TermVM(PVM pVM)
223{
224 for (unsigned i=0;i<pVM->cCPUs;i++)
225 {
226 PVMCPU pVCpu = &pVM->aCpus[i];
227
228 if (pVCpu->hwaccm.s.svm.pMemObjVMCBHost != NIL_RTR0MEMOBJ)
229 {
230 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCBHost, false);
231 pVCpu->hwaccm.s.svm.pVMCBHost = 0;
232 pVCpu->hwaccm.s.svm.pVMCBHostPhys = 0;
233 pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
234 }
235
236 if (pVCpu->hwaccm.s.svm.pMemObjVMCB != NIL_RTR0MEMOBJ)
237 {
238 RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjVMCB, false);
239 pVCpu->hwaccm.s.svm.pVMCB = 0;
240 pVCpu->hwaccm.s.svm.pVMCBPhys = 0;
241 pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
242 }
243 }
244 if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
245 {
246 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjIOBitmap, false);
247 pVM->hwaccm.s.svm.pIOBitmap = 0;
248 pVM->hwaccm.s.svm.pIOBitmapPhys = 0;
249 pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
250 }
251 if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
252 {
253 RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
254 pVM->hwaccm.s.svm.pMSRBitmap = 0;
255 pVM->hwaccm.s.svm.pMSRBitmapPhys = 0;
256 pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
257 }
258 return VINF_SUCCESS;
259}
260
261/**
262 * Sets up AMD-V for the specified VM
263 *
264 * @returns VBox status code.
265 * @param pVM The VM to operate on.
266 */
267VMMR0DECL(int) SVMR0SetupVM(PVM pVM)
268{
269 int rc = VINF_SUCCESS;
270 SVM_VMCB *pVMCB;
271
272 AssertReturn(pVM, VERR_INVALID_PARAMETER);
273
274 Assert(pVM->hwaccm.s.svm.fSupported);
275
276 for (unsigned i=0;i<pVM->cCPUs;i++)
277 {
278 pVMCB = (SVM_VMCB *)pVM->aCpus[i].hwaccm.s.svm.pVMCB;
279 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
280
281 /* Program the control fields. Most of them never have to be changed again. */
282 /* CR0/3/4 reads must be intercepted, our shadow values are not necessarily the same as the guest's. */
283 /* Note: CR0 & CR4 can be safely read when guest and shadow copies are identical. */
284 if (!pVM->hwaccm.s.fNestedPaging)
285 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
286 else
287 pVMCB->ctrl.u16InterceptRdCRx = RT_BIT(0) | RT_BIT(4);
288
289 /*
290 * CR0/3/4 writes must be intercepted for obvious reasons.
291 */
292 if (!pVM->hwaccm.s.fNestedPaging)
293 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(3) | RT_BIT(4);
294 else
295 pVMCB->ctrl.u16InterceptWrCRx = RT_BIT(0) | RT_BIT(4) | RT_BIT(8);
296
297 /* Intercept all DRx reads and writes by default. Changed later on. */
298 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
299 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
300
301 /* Currently we don't care about DRx reads or writes. DRx registers are trashed.
302 * All breakpoints are automatically cleared when the VM exits.
303 */
304
305 pVMCB->ctrl.u32InterceptException = HWACCM_SVM_TRAP_MASK;
306#ifndef DEBUG
307 if (pVM->hwaccm.s.fNestedPaging)
308 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_PF); /* no longer need to intercept #PF. */
309#endif
310
311 pVMCB->ctrl.u32InterceptCtrl1 = SVM_CTRL1_INTERCEPT_INTR
312 | SVM_CTRL1_INTERCEPT_VINTR
313 | SVM_CTRL1_INTERCEPT_NMI
314 | SVM_CTRL1_INTERCEPT_SMI
315 | SVM_CTRL1_INTERCEPT_INIT
316 | SVM_CTRL1_INTERCEPT_RDPMC
317 | SVM_CTRL1_INTERCEPT_CPUID
318 | SVM_CTRL1_INTERCEPT_RSM
319 | SVM_CTRL1_INTERCEPT_HLT
320 | SVM_CTRL1_INTERCEPT_INOUT_BITMAP
321 | SVM_CTRL1_INTERCEPT_MSR_SHADOW
322 | SVM_CTRL1_INTERCEPT_INVLPG
323 | SVM_CTRL1_INTERCEPT_INVLPGA /* AMD only */
324 | SVM_CTRL1_INTERCEPT_TASK_SWITCH
325 | SVM_CTRL1_INTERCEPT_SHUTDOWN /* fatal */
326 | SVM_CTRL1_INTERCEPT_FERR_FREEZE; /* Legacy FPU FERR handling. */
327 ;
328 /* With nested paging we don't care about invlpg anymore. */
329 if (pVM->hwaccm.s.fNestedPaging)
330 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_INVLPG;
331
332 pVMCB->ctrl.u32InterceptCtrl2 = SVM_CTRL2_INTERCEPT_VMRUN /* required */
333 | SVM_CTRL2_INTERCEPT_VMMCALL
334 | SVM_CTRL2_INTERCEPT_VMLOAD
335 | SVM_CTRL2_INTERCEPT_VMSAVE
336 | SVM_CTRL2_INTERCEPT_STGI
337 | SVM_CTRL2_INTERCEPT_CLGI
338 | SVM_CTRL2_INTERCEPT_SKINIT
339 | SVM_CTRL2_INTERCEPT_WBINVD
340 | SVM_CTRL2_INTERCEPT_MWAIT_UNCOND; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
341 ;
342 Log(("pVMCB->ctrl.u32InterceptException = %x\n", pVMCB->ctrl.u32InterceptException));
343 Log(("pVMCB->ctrl.u32InterceptCtrl1 = %x\n", pVMCB->ctrl.u32InterceptCtrl1));
344 Log(("pVMCB->ctrl.u32InterceptCtrl2 = %x\n", pVMCB->ctrl.u32InterceptCtrl2));
345
346 /* Virtualize masking of INTR interrupts. (reads/writes from/to CR8 go to the V_TPR register) */
347 pVMCB->ctrl.IntCtrl.n.u1VIrqMasking = 1;
348 /* Ignore the priority in the TPR; just deliver it when we tell it to. */
349 pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR = 1;
350
351 /* Set IO and MSR bitmap addresses. */
352 pVMCB->ctrl.u64IOPMPhysAddr = pVM->hwaccm.s.svm.pIOBitmapPhys;
353 pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
354
355 /* No LBR virtualization. */
356 pVMCB->ctrl.u64LBRVirt = 0;
357
358 /** The ASID must start at 1; the host uses 0. */
359 pVMCB->ctrl.TLBCtrl.n.u32ASID = 1;
360
361 /** Setup the PAT msr (nested paging only) */
362 pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
363 }
364 return rc;
365}
366
367
368/**
369 * Injects an event (trap or external interrupt)
370 *
371 * @param pVCpu The VMCPU to operate on.
372 * @param pVMCB SVM control block
373 * @param pCtx CPU Context
374 * @param pIntInfo SVM interrupt info
375 */
376inline void SVMR0InjectEvent(PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx, SVM_EVENT* pEvent)
377{
378#ifdef VBOX_WITH_STATISTICS
379 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatInjectedIrqsR0[pEvent->n.u8Vector & MASK_INJECT_IRQ_STAT]);
380#endif
381
382#ifdef VBOX_STRICT
383 if (pEvent->n.u8Vector == 0xE)
384 Log(("SVM: Inject int %d at %RGv error code=%02x CR2=%RGv intInfo=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode, (RTGCPTR)pCtx->cr2, pEvent->au64[0]));
385 else
386 if (pEvent->n.u8Vector < 0x20)
387 Log(("SVM: Inject int %d at %RGv error code=%08x\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip, pEvent->n.u32ErrorCode));
388 else
389 {
390 Log(("INJ-EI: %x at %RGv\n", pEvent->n.u8Vector, (RTGCPTR)pCtx->rip));
391 Assert(!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
392 Assert(pCtx->eflags.u32 & X86_EFL_IF);
393 }
394#endif
395
396 /* Set event injection state. */
397 pVMCB->ctrl.EventInject.au64[0] = pEvent->au64[0];
398}
399
400
401/**
402 * Checks for pending guest interrupts and injects them
403 *
404 * @returns VBox status code.
405 * @param pVM The VM to operate on.
406 * @param pVCpu The VM CPU to operate on.
407 * @param pVMCB SVM control block
408 * @param pCtx CPU Context
409 */
410static int SVMR0CheckPendingInterrupt(PVM pVM, PVMCPU pVCpu, SVM_VMCB *pVMCB, CPUMCTX *pCtx)
411{
412 int rc;
413
414 /* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
415 if (pVCpu->hwaccm.s.Event.fPending)
416 {
417 SVM_EVENT Event;
418
419 Log(("Reinjecting event %08x %08x at %RGv\n", pVCpu->hwaccm.s.Event.intInfo, pVCpu->hwaccm.s.Event.errCode, (RTGCPTR)pCtx->rip));
420 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntReinject);
421 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
422 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
423
424 pVCpu->hwaccm.s.Event.fPending = false;
425 return VINF_SUCCESS;
426 }
427
428 if (pVM->hwaccm.s.fInjectNMI)
429 {
430 SVM_EVENT Event;
431
432 Event.n.u8Vector = X86_XCPT_NMI;
433 Event.n.u1Valid = 1;
434 Event.n.u32ErrorCode = 0;
435 Event.n.u3Type = SVM_EVENT_NMI;
436
437 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
438 pVM->hwaccm.s.fInjectNMI = false;
439 return VINF_SUCCESS;
440 }
441
442 /* When external interrupts are pending, we should exit the VM when IF is set. */
443 if ( !TRPMHasTrap(pVCpu)
444 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
445 {
446 if ( !(pCtx->eflags.u32 & X86_EFL_IF)
447 || VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
448 {
449 if (!pVMCB->ctrl.IntCtrl.n.u1VIrqValid)
450 {
451 if (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
452 LogFlow(("Enable irq window exit!\n"));
453 else
454 Log(("Pending interrupt blocked at %RGv by VM_FF_INHIBIT_INTERRUPTS -> irq window exit\n", (RTGCPTR)pCtx->rip));
455
456 /** @todo use virtual interrupt method to inject a pending irq; dispatched as soon as guest.IF is set. */
457 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_VINTR;
458 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 1;
459 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0; /* don't care */
460 }
461 }
462 else
463 {
464 uint8_t u8Interrupt;
465
466 rc = PDMGetInterrupt(pVCpu, &u8Interrupt);
467 Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Rrc\n", u8Interrupt, u8Interrupt, rc));
468 if (RT_SUCCESS(rc))
469 {
470 rc = TRPMAssertTrap(pVCpu, u8Interrupt, TRPM_HARDWARE_INT);
471 AssertRC(rc);
472 }
473 else
474 {
475 /* Can only happen in rare cases where a pending interrupt is cleared behind our back */
476 Assert(!VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)));
477 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchGuestIrq);
478 /* Just continue */
479 }
480 }
481 }
482
483#ifdef VBOX_STRICT
484 if (TRPMHasTrap(pVCpu))
485 {
486 uint8_t u8Vector;
487 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, 0, 0, 0);
488 AssertRC(rc);
489 }
490#endif
491
492 if ( (pCtx->eflags.u32 & X86_EFL_IF)
493 && (!VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
494 && TRPMHasTrap(pVCpu)
495 )
496 {
497 uint8_t u8Vector;
498 int rc;
499 TRPMEVENT enmType;
500 SVM_EVENT Event;
501 RTGCUINT u32ErrorCode;
502
503 Event.au64[0] = 0;
504
505 /* If a new event is pending, then dispatch it now. */
506 rc = TRPMQueryTrapAll(pVCpu, &u8Vector, &enmType, &u32ErrorCode, 0);
507 AssertRC(rc);
508 Assert(pCtx->eflags.Bits.u1IF == 1 || enmType == TRPM_TRAP);
509 Assert(enmType != TRPM_SOFTWARE_INT);
510
511 /* Clear the pending trap. */
512 rc = TRPMResetTrap(pVCpu);
513 AssertRC(rc);
514
515 Event.n.u8Vector = u8Vector;
516 Event.n.u1Valid = 1;
517 Event.n.u32ErrorCode = u32ErrorCode;
518
519 if (enmType == TRPM_TRAP)
520 {
521 switch (u8Vector) {
522 case 8:
523 case 10:
524 case 11:
525 case 12:
526 case 13:
527 case 14:
528 case 17:
529 /* Valid error codes. */
530 Event.n.u1ErrorCodeValid = 1;
531 break;
532 default:
533 break;
534 }
535 if (u8Vector == X86_XCPT_NMI)
536 Event.n.u3Type = SVM_EVENT_NMI;
537 else
538 Event.n.u3Type = SVM_EVENT_EXCEPTION;
539 }
540 else
541 Event.n.u3Type = SVM_EVENT_EXTERNAL_IRQ;
542
543 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatIntInject);
544 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
545 } /* if (interrupts can be dispatched) */
546
547 return VINF_SUCCESS;
548}
549
550/**
551 * Save the host state
552 *
553 * @returns VBox status code.
554 * @param pVM The VM to operate on.
555 * @param pVCpu The VM CPU to operate on.
556 */
557VMMR0DECL(int) SVMR0SaveHostState(PVM pVM, PVMCPU pVCpu)
558{
559 NOREF(pVM);
560 NOREF(pVCpu);
561 /* Nothing to do here. */
562 return VINF_SUCCESS;
563}
564
565/**
566 * Loads the guest state
567 *
568 * NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
569 *
570 * @returns VBox status code.
571 * @param pVM The VM to operate on.
572 * @param pVCpu The VM CPU to operate on.
573 * @param pCtx Guest context
574 */
575VMMR0DECL(int) SVMR0LoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
576{
577 RTGCUINTPTR val;
578 SVM_VMCB *pVMCB;
579
580 if (pVM == NULL)
581 return VERR_INVALID_PARAMETER;
582
583 /* Setup AMD SVM. */
584 Assert(pVM->hwaccm.s.svm.fSupported);
585
586 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
587 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
588
589 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
590 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
591 {
592 SVM_WRITE_SELREG(CS, cs);
593 SVM_WRITE_SELREG(SS, ss);
594 SVM_WRITE_SELREG(DS, ds);
595 SVM_WRITE_SELREG(ES, es);
596 SVM_WRITE_SELREG(FS, fs);
597 SVM_WRITE_SELREG(GS, gs);
598 }
599
600 /* Guest CPU context: LDTR. */
601 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
602 {
603 SVM_WRITE_SELREG(LDTR, ldtr);
604 }
605
606 /* Guest CPU context: TR. */
607 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
608 {
609 SVM_WRITE_SELREG(TR, tr);
610 }
611
612 /* Guest CPU context: GDTR. */
613 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
614 {
615 pVMCB->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
616 pVMCB->guest.GDTR.u64Base = pCtx->gdtr.pGdt;
617 }
618
619 /* Guest CPU context: IDTR. */
620 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
621 {
622 pVMCB->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
623 pVMCB->guest.IDTR.u64Base = pCtx->idtr.pIdt;
624 }
625
626 /*
627 * Sysenter MSRs (unconditional)
628 */
629 pVMCB->guest.u64SysEnterCS = pCtx->SysEnter.cs;
630 pVMCB->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
631 pVMCB->guest.u64SysEnterESP = pCtx->SysEnter.esp;
632
633 /* Control registers */
634 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
635 {
636 val = pCtx->cr0;
637 if (!CPUMIsGuestFPUStateActive(pVCpu))
638 {
639 /* Always use #NM exceptions to load the FPU/XMM state on demand. */
640 val |= X86_CR0_TS | X86_CR0_ET | X86_CR0_NE | X86_CR0_MP;
641 }
642 else
643 {
644 /** @todo check if we support the old style mess correctly. */
645 if (!(val & X86_CR0_NE))
646 {
647 Log(("Forcing X86_CR0_NE!!!\n"));
648
649 /* Also catch floating point exceptions as we need to report them to the guest in a different way. */
650 if (!pVCpu->hwaccm.s.fFPUOldStyleOverride)
651 {
652 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_MF);
653 pVCpu->hwaccm.s.fFPUOldStyleOverride = true;
654 }
655 }
656 val |= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
657 }
658 /* Always enable caching. */
659 val &= ~(X86_CR0_CD|X86_CR0_NW);
660
661 /* Note: WP is not relevant in nested paging mode as we catch accesses on the (guest) physical level. */
662 /* Note: In nested paging mode the guest is allowed to run with paging disabled; the guest physical to host physical translation will remain active. */
663 if (!pVM->hwaccm.s.fNestedPaging)
664 {
665 val |= X86_CR0_PG; /* Paging is always enabled; even when the guest is running in real mode or PE without paging. */
666 val |= X86_CR0_WP; /* Must set this as we rely on protect various pages and supervisor writes must be caught. */
667 }
668 pVMCB->guest.u64CR0 = val;
669 }
670 /* CR2 as well */
671 pVMCB->guest.u64CR2 = pCtx->cr2;
672
673 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
674 {
675 /* Save our shadow CR3 register. */
676 if (pVM->hwaccm.s.fNestedPaging)
677 {
678 PGMMODE enmShwPagingMode;
679
680#if HC_ARCH_BITS == 32
681 if (CPUMIsGuestInLongModeEx(pCtx))
682 enmShwPagingMode = PGMMODE_AMD64_NX;
683 else
684#endif
685 enmShwPagingMode = PGMGetHostMode(pVM);
686
687 pVMCB->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
688 Assert(pVMCB->ctrl.u64NestedPagingCR3);
689 pVMCB->guest.u64CR3 = pCtx->cr3;
690 }
691 else
692 {
693 pVMCB->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
694 Assert(pVMCB->guest.u64CR3 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL));
695 }
696 }
697
698 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
699 {
700 val = pCtx->cr4;
701 if (!pVM->hwaccm.s.fNestedPaging)
702 {
703 switch(pVCpu->hwaccm.s.enmShadowMode)
704 {
705 case PGMMODE_REAL:
706 case PGMMODE_PROTECTED: /* Protected mode, no paging. */
707 AssertFailed();
708 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
709
710 case PGMMODE_32_BIT: /* 32-bit paging. */
711 val &= ~X86_CR4_PAE;
712 break;
713
714 case PGMMODE_PAE: /* PAE paging. */
715 case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
716 /** @todo use normal 32 bits paging */
717 val |= X86_CR4_PAE;
718 break;
719
720 case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
721 case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
722#ifdef VBOX_ENABLE_64_BITS_GUESTS
723 break;
724#else
725 AssertFailed();
726 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
727#endif
728
729 default: /* shut up gcc */
730 AssertFailed();
731 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
732 }
733 }
734 pVMCB->guest.u64CR4 = val;
735 }
736
737 /* Debug registers. */
738 if (pVCpu->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
739 {
740 pCtx->dr[6] |= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
741 pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
742
743 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
744 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
745 pCtx->dr[7] |= 0x400; /* must be one */
746
747 pVMCB->guest.u64DR7 = pCtx->dr[7];
748 pVMCB->guest.u64DR6 = pCtx->dr[6];
749
750 /* Sync the debug state now if any breakpoint is armed. */
751 if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK|X86_DR7_GD))
752 && !CPUMIsGuestDebugStateActive(pVCpu)
753 && !DBGFIsStepping(pVCpu))
754 {
755 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxArmed);
756
757 /* Disable drx move intercepts. */
758 pVMCB->ctrl.u16InterceptRdDRx = 0;
759 pVMCB->ctrl.u16InterceptWrDRx = 0;
760
761 /* Save the host and load the guest debug state. */
762 int rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
763 AssertRC(rc);
764 }
765 }
766
767 /* EIP, ESP and EFLAGS */
768 pVMCB->guest.u64RIP = pCtx->rip;
769 pVMCB->guest.u64RSP = pCtx->rsp;
770 pVMCB->guest.u64RFlags = pCtx->eflags.u32;
771
772 /* Set CPL */
773 pVMCB->guest.u8CPL = pCtx->csHid.Attr.n.u2Dpl;
774
775 /* RAX/EAX too, as VMRUN uses RAX as an implicit parameter. */
776 pVMCB->guest.u64RAX = pCtx->rax;
777
778 /* vmrun will fail without MSR_K6_EFER_SVME. */
779 pVMCB->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
780
781 /* 64 bits guest mode? */
782 if (CPUMIsGuestInLongModeEx(pCtx))
783 {
784#if !defined(VBOX_ENABLE_64_BITS_GUESTS)
785 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
786#elif HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
787 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMSwitcherRun64;
788#else
789# ifdef VBOX_WITH_HYBRID_32BIT_KERNEL
790 if (!pVM->hwaccm.s.fAllow64BitGuests)
791 return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
792# endif
793 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun64;
794#endif
795 /* Unconditionally update these as wrmsr might have changed them. (HWACCM_CHANGED_GUEST_SEGMENT_REGS will not be set) */
796 pVMCB->guest.FS.u64Base = pCtx->fsHid.u64Base;
797 pVMCB->guest.GS.u64Base = pCtx->gsHid.u64Base;
798 }
799 else
800 {
801 /* Filter out the MSR_K6_LME bit or else AMD-V expects amd64 shadow paging. */
802 pVMCB->guest.u64EFER &= ~MSR_K6_EFER_LME;
803
804 pVCpu->hwaccm.s.svm.pfnVMRun = SVMR0VMRun;
805 }
806
807 /* TSC offset. */
808 if (TMCpuTickCanUseRealTSC(pVCpu, &pVMCB->ctrl.u64TSCOffset))
809 {
810 pVMCB->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
811 pVMCB->ctrl.u32InterceptCtrl2 &= ~SVM_CTRL2_INTERCEPT_RDTSCP;
812 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCOffset);
813 }
814 else
815 {
816 pVMCB->ctrl.u32InterceptCtrl1 |= SVM_CTRL1_INTERCEPT_RDTSC;
817 pVMCB->ctrl.u32InterceptCtrl2 |= SVM_CTRL2_INTERCEPT_RDTSCP;
818 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTSCIntercept);
819 }
820
821 /* Sync the various msrs for 64 bits mode. */
822 pVMCB->guest.u64STAR = pCtx->msrSTAR; /* legacy syscall eip, cs & ss */
823 pVMCB->guest.u64LSTAR = pCtx->msrLSTAR; /* 64 bits mode syscall rip */
824 pVMCB->guest.u64CSTAR = pCtx->msrCSTAR; /* compatibility mode syscall rip */
825 pVMCB->guest.u64SFMASK = pCtx->msrSFMASK; /* syscall flag mask */
826 pVMCB->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE; /* swapgs exchange value */
827
828#ifdef DEBUG
829 /* Intercept X86_XCPT_DB if stepping is enabled */
830 if (DBGFIsStepping(pVCpu))
831 pVMCB->ctrl.u32InterceptException |= RT_BIT(X86_XCPT_DB);
832 else
833 pVMCB->ctrl.u32InterceptException &= ~RT_BIT(X86_XCPT_DB);
834#endif
835
836 /* Done. */
837 pVCpu->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
838
839 return VINF_SUCCESS;
840}
841
842
843/**
844 * Runs guest code in an AMD-V VM.
845 *
846 * @returns VBox status code.
847 * @param pVM The VM to operate on.
848 * @param pVCpu The VM CPU to operate on.
849 * @param pCtx Guest context
850 */
851VMMR0DECL(int) SVMR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
852{
853 int rc = VINF_SUCCESS;
854 uint64_t exitCode = (uint64_t)SVM_EXIT_INVALID;
855 SVM_VMCB *pVMCB;
856 bool fSyncTPR = false;
857 unsigned cResume = 0;
858 uint8_t u8LastVTPR;
859 PHWACCM_CPUINFO pCpu = 0;
860 RTCCUINTREG uOldEFlags = ~(RTCCUINTREG)0;
861#ifdef VBOX_STRICT
862 RTCPUID idCpuCheck;
863#endif
864#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
865 uint64_t u64LastTime = RTTimeMilliTS();
866#endif
867
868 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatEntry, x);
869
870 pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
871 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
872
873 /* We can jump to this point to resume execution after determining that a VM-exit is innocent.
874 */
875ResumeExecution:
876 Assert(!HWACCMR0SuspendPending());
877
878 /* Safety precaution; looping for too long here can have a very bad effect on the host */
879 if (RT_UNLIKELY(++cResume > pVM->hwaccm.s.cMaxResumeLoops))
880 {
881 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMaxResume);
882 rc = VINF_EM_RAW_INTERRUPT;
883 goto end;
884 }
885
886 /* Check for irq inhibition due to instruction fusing (sti, mov ss). */
887 if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
888 {
889 Log(("VM_FF_INHIBIT_INTERRUPTS at %RGv successor %RGv\n", (RTGCPTR)pCtx->rip, EMGetInhibitInterruptsPC(pVCpu)));
890 if (pCtx->rip != EMGetInhibitInterruptsPC(pVCpu))
891 {
892 /* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
893 * Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
894 * force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
895 * break the guest. Sounds very unlikely, but such timing sensitive problems are not as rare as you might think.
896 */
897 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
898 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
899 pVMCB->ctrl.u64IntShadow = 0;
900 }
901 }
902 else
903 {
904 /* Irq inhibition is no longer active; clear the corresponding SVM state. */
905 pVMCB->ctrl.u64IntShadow = 0;
906 }
907
908#ifdef VBOX_HIGH_RES_TIMERS_HACK_IN_RING0
909 if (RT_UNLIKELY(cResume & 0xf) == 0)
910 {
911 uint64_t u64CurTime = RTTimeMilliTS();
912
913 if (RT_UNLIKELY(u64CurTime > u64LastTime))
914 {
915 u64LastTime = u64CurTime;
916 TMTimerPollVoid(pVM, pVCpu);
917 }
918 }
919#endif
920
921 /* Check for pending actions that force us to go back to ring 3. */
922#ifdef DEBUG
923 /* Intercept X86_XCPT_DB if stepping is enabled */
924 if (!DBGFIsStepping(pVCpu))
925#endif
926 {
927 if ( VM_FF_ISPENDING(pVM, VM_FF_HWACCM_TO_R3_MASK)
928 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_HWACCM_TO_R3_MASK))
929 {
930 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
931 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatSwitchToR3);
932 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
933 rc = RT_UNLIKELY(VM_FF_ISPENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
934 goto end;
935 }
936 }
937
938 /* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
939 if ( VM_FF_ISPENDING(pVM, VM_FF_REQUEST)
940 || VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_REQUEST))
941 {
942 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
943 rc = VINF_EM_PENDING_REQUEST;
944 goto end;
945 }
946
947 /* When external interrupts are pending, we should exit the VM when IF is set. */
948 /* Note! *After* VM_FF_INHIBIT_INTERRUPTS check!!! */
949 rc = SVMR0CheckPendingInterrupt(pVM, pVCpu, pVMCB, pCtx);
950 if (RT_FAILURE(rc))
951 {
952 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
953 goto end;
954 }
955
956 /* TPR caching using CR8 is only available in 64 bits mode or with 32 bits guests when X86_CPUID_AMD_FEATURE_ECX_CR8L is supported. */
957 /* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!!!!! */
958 if (pVM->hwaccm.s.fHasIoApic)
959 {
960 bool fPending;
961
962 /* TPR caching in CR8 */
963 int rc = PDMApicGetTPR(pVCpu, &u8LastVTPR, &fPending);
964 AssertRC(rc);
965 pVMCB->ctrl.IntCtrl.n.u8VTPR = u8LastVTPR;
966
967 if (fPending)
968 {
969 /* A TPR change could activate a pending interrupt, so catch cr8 writes. */
970 pVMCB->ctrl.u16InterceptWrCRx |= RT_BIT(8);
971 }
972 else
973 /* No interrupts are pending, so we don't need to be explicitely notified.
974 * There are enough world switches for detecting pending interrupts.
975 */
976 pVMCB->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
977
978 fSyncTPR = !fPending;
979 }
980
981 /* All done! Let's start VM execution. */
982 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatInGC, x);
983
984 /* Enable nested paging if necessary (disabled each time after #VMEXIT). */
985 pVMCB->ctrl.NestedPaging.n.u1NestedPaging = pVM->hwaccm.s.fNestedPaging;
986
987#ifdef LOG_ENABLED
988 pCpu = HWACCMR0GetCurrentCpu();
989 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
990 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
991 {
992 if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
993 Log(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
994 else
995 Log(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
996 }
997 if (pCpu->fFlushTLB)
998 Log(("Force TLB flush: first time cpu %d is used -> flush\n", pCpu->idCpu));
999#endif
1000
1001 /*
1002 * NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1003 * (until the actual world switch)
1004 */
1005#ifdef VBOX_STRICT
1006 idCpuCheck = RTMpCpuId();
1007#endif
1008#ifdef LOG_ENABLED
1009 VMMR0LogFlushDisable(pVCpu);
1010#endif
1011
1012 /* Load the guest state; *must* be here as it sets up the shadow cr0 for lazy fpu syncing! */
1013 rc = SVMR0LoadGuestState(pVM, pVCpu, pCtx);
1014 if (rc != VINF_SUCCESS)
1015 {
1016 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatEntry, x);
1017 goto end;
1018 }
1019
1020#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1021 /*
1022 * Exit to ring-3 preemption/work is pending.
1023 *
1024 * Interrupts are disabled before the call to make sure we don't miss any interrupt
1025 * that would flag preemption (IPI, timer tick, ++).
1026 *
1027 * Note! Interrupts must be disabled done *before* we check for TLB flushes; TLB
1028 * shootdowns rely on this.
1029 */
1030 uOldEFlags = ASMIntDisableFlags();
1031 if (RTThreadPreemptIsPending(NIL_RTTHREAD))
1032 {
1033 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitPreemptPending);
1034 rc = VINF_EM_RAW_INTERRUPT;
1035 goto end;
1036 }
1037 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
1038#else
1039 /* Disable interrupts to make sure a poke will interrupt execution.
1040 * This must be done *before* we check for TLB flushes; TLB shootdowns rely on this.
1041 */
1042 uOldEFlags = ASMIntDisableFlags();
1043 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_EXEC);
1044#endif
1045
1046 pCpu = HWACCMR0GetCurrentCpu();
1047 /* Force a TLB flush for the first world switch if the current cpu differs from the one we ran on last. */
1048 /* Note that this can happen both for start and resume due to long jumps back to ring 3. */
1049 if ( pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu
1050 /* if the tlb flush count has changed, another VM has flushed the TLB of this cpu, so we can't use our current ASID anymore. */
1051 || pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
1052 {
1053 /* Force a TLB flush on VM entry. */
1054 pVCpu->hwaccm.s.fForceTLBFlush = true;
1055 }
1056 else
1057 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1058
1059 pVCpu->hwaccm.s.idLastCpu = pCpu->idCpu;
1060
1061 /* Check for tlb shootdown flushes. */
1062 if (VMCPU_FF_TESTANDCLEAR(pVCpu, VMCPU_FF_TLB_FLUSH_BIT))
1063 pVCpu->hwaccm.s.fForceTLBFlush = true;
1064
1065 /* Make sure we flush the TLB when required. Switch ASID to achieve the same thing, but without actually flushing the whole TLB (which is expensive). */
1066 if ( pVCpu->hwaccm.s.fForceTLBFlush
1067 && !pVM->hwaccm.s.svm.fAlwaysFlushTLB)
1068 {
1069 if ( ++pCpu->uCurrentASID >= pVM->hwaccm.s.uMaxASID
1070 || pCpu->fFlushTLB)
1071 {
1072 pCpu->fFlushTLB = false;
1073 pCpu->uCurrentASID = 1; /* start at 1; host uses 0 */
1074 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = 1; /* wrap around; flush TLB */
1075 pCpu->cTLBFlushes++;
1076 }
1077 else
1078 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushASID);
1079
1080 pVCpu->hwaccm.s.cTLBFlushes = pCpu->cTLBFlushes;
1081 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID;
1082 }
1083 else
1084 {
1085 Assert(!pCpu->fFlushTLB || pVM->hwaccm.s.svm.fAlwaysFlushTLB);
1086
1087 /* We never increase uCurrentASID in the fAlwaysFlushTLB (erratum 170) case. */
1088 if (!pCpu->uCurrentASID || !pVCpu->hwaccm.s.uCurrentASID)
1089 pVCpu->hwaccm.s.uCurrentASID = pCpu->uCurrentASID = 1;
1090
1091 Assert(!pVM->hwaccm.s.svm.fAlwaysFlushTLB || pVCpu->hwaccm.s.fForceTLBFlush);
1092 pVMCB->ctrl.TLBCtrl.n.u1TLBFlush = pVCpu->hwaccm.s.fForceTLBFlush;
1093
1094 if ( !pVM->hwaccm.s.svm.fAlwaysFlushTLB
1095 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_TLB_SHOOTDOWN))
1096 {
1097 /* Deal with pending TLB shootdown actions which were queued when we were not executing code. */
1098 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatTlbShootdown);
1099 for (unsigned i=0;i<pVCpu->hwaccm.s.TlbShootdown.cPages;i++)
1100 SVMR0InvlpgA(pVCpu->hwaccm.s.TlbShootdown.aPages[i], pVMCB->ctrl.TLBCtrl.n.u32ASID);
1101 }
1102 }
1103 pVCpu->hwaccm.s.TlbShootdown.cPages = 0;
1104 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TLB_SHOOTDOWN);
1105
1106 AssertMsg(pVCpu->hwaccm.s.cTLBFlushes == pCpu->cTLBFlushes, ("Flush count mismatch for cpu %d (%x vs %x)\n", pCpu->idCpu, pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
1107 AssertMsg(pCpu->uCurrentASID >= 1 && pCpu->uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d uCurrentASID = %x\n", pCpu->idCpu, pCpu->uCurrentASID));
1108 AssertMsg(pVCpu->hwaccm.s.uCurrentASID >= 1 && pVCpu->hwaccm.s.uCurrentASID < pVM->hwaccm.s.uMaxASID, ("cpu%d VM uCurrentASID = %x\n", pCpu->idCpu, pVCpu->hwaccm.s.uCurrentASID));
1109 pVMCB->ctrl.TLBCtrl.n.u32ASID = pVCpu->hwaccm.s.uCurrentASID;
1110
1111#ifdef VBOX_WITH_STATISTICS
1112 if (pVMCB->ctrl.TLBCtrl.n.u1TLBFlush)
1113 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBWorldSwitch);
1114 else
1115 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatNoFlushTLBWorldSwitch);
1116#endif
1117
1118 /* In case we execute a goto ResumeExecution later on. */
1119 pVCpu->hwaccm.s.fResumeVM = true;
1120 pVCpu->hwaccm.s.fForceTLBFlush = pVM->hwaccm.s.svm.fAlwaysFlushTLB;
1121
1122 Assert(sizeof(pVCpu->hwaccm.s.svm.pVMCBPhys) == 8);
1123 Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
1124 Assert(pVMCB->ctrl.u64IOPMPhysAddr == pVM->hwaccm.s.svm.pIOBitmapPhys);
1125 Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
1126 Assert(pVMCB->ctrl.u64LBRVirt == 0);
1127
1128#ifdef VBOX_STRICT
1129 Assert(idCpuCheck == RTMpCpuId());
1130#endif
1131 TMNotifyStartOfExecution(pVCpu);
1132 pVCpu->hwaccm.s.svm.pfnVMRun(pVCpu->hwaccm.s.svm.pVMCBHostPhys, pVCpu->hwaccm.s.svm.pVMCBPhys, pCtx, pVM, pVCpu);
1133 TMNotifyEndOfExecution(pVCpu);
1134 VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED);
1135 ASMSetFlags(uOldEFlags);
1136#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
1137 uOldEFlags = ~(RTCCUINTREG)0;
1138#endif
1139 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatInGC, x);
1140
1141 /*
1142 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1143 * IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 *BEFORE* WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1144 * !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1145 */
1146
1147 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatExit1, x);
1148
1149 /* Reason for the VM exit */
1150 exitCode = pVMCB->ctrl.u64ExitCode;
1151
1152 if (exitCode == (uint64_t)SVM_EXIT_INVALID) /* Invalid guest state. */
1153 {
1154 HWACCMDumpRegs(pVM, pVCpu, pCtx);
1155#ifdef DEBUG
1156 Log(("ctrl.u16InterceptRdCRx %x\n", pVMCB->ctrl.u16InterceptRdCRx));
1157 Log(("ctrl.u16InterceptWrCRx %x\n", pVMCB->ctrl.u16InterceptWrCRx));
1158 Log(("ctrl.u16InterceptRdDRx %x\n", pVMCB->ctrl.u16InterceptRdDRx));
1159 Log(("ctrl.u16InterceptWrDRx %x\n", pVMCB->ctrl.u16InterceptWrDRx));
1160 Log(("ctrl.u32InterceptException %x\n", pVMCB->ctrl.u32InterceptException));
1161 Log(("ctrl.u32InterceptCtrl1 %x\n", pVMCB->ctrl.u32InterceptCtrl1));
1162 Log(("ctrl.u32InterceptCtrl2 %x\n", pVMCB->ctrl.u32InterceptCtrl2));
1163 Log(("ctrl.u64IOPMPhysAddr %RX64\n", pVMCB->ctrl.u64IOPMPhysAddr));
1164 Log(("ctrl.u64MSRPMPhysAddr %RX64\n", pVMCB->ctrl.u64MSRPMPhysAddr));
1165 Log(("ctrl.u64TSCOffset %RX64\n", pVMCB->ctrl.u64TSCOffset));
1166
1167 Log(("ctrl.TLBCtrl.u32ASID %x\n", pVMCB->ctrl.TLBCtrl.n.u32ASID));
1168 Log(("ctrl.TLBCtrl.u1TLBFlush %x\n", pVMCB->ctrl.TLBCtrl.n.u1TLBFlush));
1169 Log(("ctrl.TLBCtrl.u7Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u7Reserved));
1170 Log(("ctrl.TLBCtrl.u24Reserved %x\n", pVMCB->ctrl.TLBCtrl.n.u24Reserved));
1171
1172 Log(("ctrl.IntCtrl.u8VTPR %x\n", pVMCB->ctrl.IntCtrl.n.u8VTPR));
1173 Log(("ctrl.IntCtrl.u1VIrqValid %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqValid));
1174 Log(("ctrl.IntCtrl.u7Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved));
1175 Log(("ctrl.IntCtrl.u4VIrqPriority %x\n", pVMCB->ctrl.IntCtrl.n.u4VIrqPriority));
1176 Log(("ctrl.IntCtrl.u1IgnoreTPR %x\n", pVMCB->ctrl.IntCtrl.n.u1IgnoreTPR));
1177 Log(("ctrl.IntCtrl.u3Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u3Reserved));
1178 Log(("ctrl.IntCtrl.u1VIrqMasking %x\n", pVMCB->ctrl.IntCtrl.n.u1VIrqMasking));
1179 Log(("ctrl.IntCtrl.u7Reserved2 %x\n", pVMCB->ctrl.IntCtrl.n.u7Reserved2));
1180 Log(("ctrl.IntCtrl.u8VIrqVector %x\n", pVMCB->ctrl.IntCtrl.n.u8VIrqVector));
1181 Log(("ctrl.IntCtrl.u24Reserved %x\n", pVMCB->ctrl.IntCtrl.n.u24Reserved));
1182
1183 Log(("ctrl.u64IntShadow %RX64\n", pVMCB->ctrl.u64IntShadow));
1184 Log(("ctrl.u64ExitCode %RX64\n", pVMCB->ctrl.u64ExitCode));
1185 Log(("ctrl.u64ExitInfo1 %RX64\n", pVMCB->ctrl.u64ExitInfo1));
1186 Log(("ctrl.u64ExitInfo2 %RX64\n", pVMCB->ctrl.u64ExitInfo2));
1187 Log(("ctrl.ExitIntInfo.u8Vector %x\n", pVMCB->ctrl.ExitIntInfo.n.u8Vector));
1188 Log(("ctrl.ExitIntInfo.u3Type %x\n", pVMCB->ctrl.ExitIntInfo.n.u3Type));
1189 Log(("ctrl.ExitIntInfo.u1ErrorCodeValid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid));
1190 Log(("ctrl.ExitIntInfo.u19Reserved %x\n", pVMCB->ctrl.ExitIntInfo.n.u19Reserved));
1191 Log(("ctrl.ExitIntInfo.u1Valid %x\n", pVMCB->ctrl.ExitIntInfo.n.u1Valid));
1192 Log(("ctrl.ExitIntInfo.u32ErrorCode %x\n", pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode));
1193 Log(("ctrl.NestedPaging %RX64\n", pVMCB->ctrl.NestedPaging.au64));
1194 Log(("ctrl.EventInject.u8Vector %x\n", pVMCB->ctrl.EventInject.n.u8Vector));
1195 Log(("ctrl.EventInject.u3Type %x\n", pVMCB->ctrl.EventInject.n.u3Type));
1196 Log(("ctrl.EventInject.u1ErrorCodeValid %x\n", pVMCB->ctrl.EventInject.n.u1ErrorCodeValid));
1197 Log(("ctrl.EventInject.u19Reserved %x\n", pVMCB->ctrl.EventInject.n.u19Reserved));
1198 Log(("ctrl.EventInject.u1Valid %x\n", pVMCB->ctrl.EventInject.n.u1Valid));
1199 Log(("ctrl.EventInject.u32ErrorCode %x\n", pVMCB->ctrl.EventInject.n.u32ErrorCode));
1200
1201 Log(("ctrl.u64NestedPagingCR3 %RX64\n", pVMCB->ctrl.u64NestedPagingCR3));
1202 Log(("ctrl.u64LBRVirt %RX64\n", pVMCB->ctrl.u64LBRVirt));
1203
1204 Log(("guest.CS.u16Sel %04X\n", pVMCB->guest.CS.u16Sel));
1205 Log(("guest.CS.u16Attr %04X\n", pVMCB->guest.CS.u16Attr));
1206 Log(("guest.CS.u32Limit %X\n", pVMCB->guest.CS.u32Limit));
1207 Log(("guest.CS.u64Base %RX64\n", pVMCB->guest.CS.u64Base));
1208 Log(("guest.DS.u16Sel %04X\n", pVMCB->guest.DS.u16Sel));
1209 Log(("guest.DS.u16Attr %04X\n", pVMCB->guest.DS.u16Attr));
1210 Log(("guest.DS.u32Limit %X\n", pVMCB->guest.DS.u32Limit));
1211 Log(("guest.DS.u64Base %RX64\n", pVMCB->guest.DS.u64Base));
1212 Log(("guest.ES.u16Sel %04X\n", pVMCB->guest.ES.u16Sel));
1213 Log(("guest.ES.u16Attr %04X\n", pVMCB->guest.ES.u16Attr));
1214 Log(("guest.ES.u32Limit %X\n", pVMCB->guest.ES.u32Limit));
1215 Log(("guest.ES.u64Base %RX64\n", pVMCB->guest.ES.u64Base));
1216 Log(("guest.FS.u16Sel %04X\n", pVMCB->guest.FS.u16Sel));
1217 Log(("guest.FS.u16Attr %04X\n", pVMCB->guest.FS.u16Attr));
1218 Log(("guest.FS.u32Limit %X\n", pVMCB->guest.FS.u32Limit));
1219 Log(("guest.FS.u64Base %RX64\n", pVMCB->guest.FS.u64Base));
1220 Log(("guest.GS.u16Sel %04X\n", pVMCB->guest.GS.u16Sel));
1221 Log(("guest.GS.u16Attr %04X\n", pVMCB->guest.GS.u16Attr));
1222 Log(("guest.GS.u32Limit %X\n", pVMCB->guest.GS.u32Limit));
1223 Log(("guest.GS.u64Base %RX64\n", pVMCB->guest.GS.u64Base));
1224
1225 Log(("guest.GDTR.u32Limit %X\n", pVMCB->guest.GDTR.u32Limit));
1226 Log(("guest.GDTR.u64Base %RX64\n", pVMCB->guest.GDTR.u64Base));
1227
1228 Log(("guest.LDTR.u16Sel %04X\n", pVMCB->guest.LDTR.u16Sel));
1229 Log(("guest.LDTR.u16Attr %04X\n", pVMCB->guest.LDTR.u16Attr));
1230 Log(("guest.LDTR.u32Limit %X\n", pVMCB->guest.LDTR.u32Limit));
1231 Log(("guest.LDTR.u64Base %RX64\n", pVMCB->guest.LDTR.u64Base));
1232
1233 Log(("guest.IDTR.u32Limit %X\n", pVMCB->guest.IDTR.u32Limit));
1234 Log(("guest.IDTR.u64Base %RX64\n", pVMCB->guest.IDTR.u64Base));
1235
1236 Log(("guest.TR.u16Sel %04X\n", pVMCB->guest.TR.u16Sel));
1237 Log(("guest.TR.u16Attr %04X\n", pVMCB->guest.TR.u16Attr));
1238 Log(("guest.TR.u32Limit %X\n", pVMCB->guest.TR.u32Limit));
1239 Log(("guest.TR.u64Base %RX64\n", pVMCB->guest.TR.u64Base));
1240
1241 Log(("guest.u8CPL %X\n", pVMCB->guest.u8CPL));
1242 Log(("guest.u64CR0 %RX64\n", pVMCB->guest.u64CR0));
1243 Log(("guest.u64CR2 %RX64\n", pVMCB->guest.u64CR2));
1244 Log(("guest.u64CR3 %RX64\n", pVMCB->guest.u64CR3));
1245 Log(("guest.u64CR4 %RX64\n", pVMCB->guest.u64CR4));
1246 Log(("guest.u64DR6 %RX64\n", pVMCB->guest.u64DR6));
1247 Log(("guest.u64DR7 %RX64\n", pVMCB->guest.u64DR7));
1248
1249 Log(("guest.u64RIP %RX64\n", pVMCB->guest.u64RIP));
1250 Log(("guest.u64RSP %RX64\n", pVMCB->guest.u64RSP));
1251 Log(("guest.u64RAX %RX64\n", pVMCB->guest.u64RAX));
1252 Log(("guest.u64RFlags %RX64\n", pVMCB->guest.u64RFlags));
1253
1254 Log(("guest.u64SysEnterCS %RX64\n", pVMCB->guest.u64SysEnterCS));
1255 Log(("guest.u64SysEnterEIP %RX64\n", pVMCB->guest.u64SysEnterEIP));
1256 Log(("guest.u64SysEnterESP %RX64\n", pVMCB->guest.u64SysEnterESP));
1257
1258 Log(("guest.u64EFER %RX64\n", pVMCB->guest.u64EFER));
1259 Log(("guest.u64STAR %RX64\n", pVMCB->guest.u64STAR));
1260 Log(("guest.u64LSTAR %RX64\n", pVMCB->guest.u64LSTAR));
1261 Log(("guest.u64CSTAR %RX64\n", pVMCB->guest.u64CSTAR));
1262 Log(("guest.u64SFMASK %RX64\n", pVMCB->guest.u64SFMASK));
1263 Log(("guest.u64KernelGSBase %RX64\n", pVMCB->guest.u64KernelGSBase));
1264 Log(("guest.u64GPAT %RX64\n", pVMCB->guest.u64GPAT));
1265 Log(("guest.u64DBGCTL %RX64\n", pVMCB->guest.u64DBGCTL));
1266 Log(("guest.u64BR_FROM %RX64\n", pVMCB->guest.u64BR_FROM));
1267 Log(("guest.u64BR_TO %RX64\n", pVMCB->guest.u64BR_TO));
1268 Log(("guest.u64LASTEXCPFROM %RX64\n", pVMCB->guest.u64LASTEXCPFROM));
1269 Log(("guest.u64LASTEXCPTO %RX64\n", pVMCB->guest.u64LASTEXCPTO));
1270
1271#endif
1272 rc = VERR_SVM_UNABLE_TO_START_VM;
1273 goto end;
1274 }
1275
1276 /* Let's first sync back eip, esp, and eflags. */
1277 pCtx->rip = pVMCB->guest.u64RIP;
1278 pCtx->rsp = pVMCB->guest.u64RSP;
1279 pCtx->eflags.u32 = pVMCB->guest.u64RFlags;
1280 /* eax is saved/restore across the vmrun instruction */
1281 pCtx->rax = pVMCB->guest.u64RAX;
1282
1283 pCtx->msrKERNELGSBASE = pVMCB->guest.u64KernelGSBase; /* swapgs exchange value */
1284
1285 /* Can be updated behind our back in the nested paging case. */
1286 pCtx->cr2 = pVMCB->guest.u64CR2;
1287
1288 /* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1289 SVM_READ_SELREG(SS, ss);
1290 SVM_READ_SELREG(CS, cs);
1291 SVM_READ_SELREG(DS, ds);
1292 SVM_READ_SELREG(ES, es);
1293 SVM_READ_SELREG(FS, fs);
1294 SVM_READ_SELREG(GS, gs);
1295
1296 /*
1297 * System MSRs
1298 */
1299 pCtx->SysEnter.cs = pVMCB->guest.u64SysEnterCS;
1300 pCtx->SysEnter.eip = pVMCB->guest.u64SysEnterEIP;
1301 pCtx->SysEnter.esp = pVMCB->guest.u64SysEnterESP;
1302
1303 /* Remaining guest CPU context: TR, IDTR, GDTR, LDTR; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1304 SVM_READ_SELREG(LDTR, ldtr);
1305 SVM_READ_SELREG(TR, tr);
1306
1307 pCtx->gdtr.cbGdt = pVMCB->guest.GDTR.u32Limit;
1308 pCtx->gdtr.pGdt = pVMCB->guest.GDTR.u64Base;
1309
1310 pCtx->idtr.cbIdt = pVMCB->guest.IDTR.u32Limit;
1311 pCtx->idtr.pIdt = pVMCB->guest.IDTR.u64Base;
1312
1313 /* Note: no reason to sync back the CRx and DRx registers. They can't be changed by the guest. */
1314 /* Note: only in the nested paging case can CR3 & CR4 be changed by the guest. */
1315 if ( pVM->hwaccm.s.fNestedPaging
1316 && pCtx->cr3 != pVMCB->guest.u64CR3)
1317 {
1318 CPUMSetGuestCR3(pVCpu, pVMCB->guest.u64CR3);
1319 PGMUpdateCR3(pVCpu, pVMCB->guest.u64CR3);
1320 }
1321
1322 /* Note! NOW IT'S SAFE FOR LOGGING! */
1323#ifdef LOG_ENABLED
1324 VMMR0LogFlushEnable(pVCpu);
1325#endif
1326
1327 /* Take care of instruction fusing (sti, mov ss) (see 15.20.5 Interrupt Shadows) */
1328 if (pVMCB->ctrl.u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
1329 {
1330 Log(("uInterruptState %x rip=%RGv\n", pVMCB->ctrl.u64IntShadow, (RTGCPTR)pCtx->rip));
1331 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
1332 }
1333 else
1334 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
1335
1336 Log2(("exitCode = %x\n", exitCode));
1337
1338 /* Sync back DR6 as it could have been changed by hitting breakpoints. */
1339 pCtx->dr[6] = pVMCB->guest.u64DR6;
1340 /* DR7.GD can be cleared by debug exceptions, so sync it back as well. */
1341 pCtx->dr[7] = pVMCB->guest.u64DR7;
1342
1343 /* Check if an injected event was interrupted prematurely. */
1344 pVCpu->hwaccm.s.Event.intInfo = pVMCB->ctrl.ExitIntInfo.au64[0];
1345 if ( pVMCB->ctrl.ExitIntInfo.n.u1Valid
1346 && pVMCB->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT /* we don't care about 'int xx' as the instruction will be restarted. */)
1347 {
1348 Log(("Pending inject %RX64 at %RGv exit=%08x\n", pVCpu->hwaccm.s.Event.intInfo, (RTGCPTR)pCtx->rip, exitCode));
1349
1350#ifdef LOG_ENABLED
1351 SVM_EVENT Event;
1352 Event.au64[0] = pVCpu->hwaccm.s.Event.intInfo;
1353
1354 if ( exitCode == SVM_EXIT_EXCEPTION_E
1355 && Event.n.u8Vector == 0xE)
1356 {
1357 Log(("Double fault!\n"));
1358 }
1359#endif
1360
1361 pVCpu->hwaccm.s.Event.fPending = true;
1362 /* Error code present? (redundant) */
1363 if (pVMCB->ctrl.ExitIntInfo.n.u1ErrorCodeValid)
1364 pVCpu->hwaccm.s.Event.errCode = pVMCB->ctrl.ExitIntInfo.n.u32ErrorCode;
1365 else
1366 pVCpu->hwaccm.s.Event.errCode = 0;
1367 }
1368#ifdef VBOX_WITH_STATISTICS
1369 if (exitCode == SVM_EXIT_NPF)
1370 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitReasonNPF);
1371 else
1372 STAM_COUNTER_INC(&pVCpu->hwaccm.s.paStatExitReasonR0[exitCode & MASK_EXITREASON_STAT]);
1373#endif
1374
1375 if (fSyncTPR)
1376 {
1377 rc = PDMApicSetTPR(pVCpu, pVMCB->ctrl.IntCtrl.n.u8VTPR);
1378 AssertRC(rc);
1379 }
1380
1381 /* Deal with the reason of the VM-exit. */
1382 switch (exitCode)
1383 {
1384 case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
1385 case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
1386 case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_A: case SVM_EXIT_EXCEPTION_B:
1387 case SVM_EXIT_EXCEPTION_C: case SVM_EXIT_EXCEPTION_D: case SVM_EXIT_EXCEPTION_E: case SVM_EXIT_EXCEPTION_F:
1388 case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11: case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13:
1389 case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15: case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17:
1390 case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19: case SVM_EXIT_EXCEPTION_1A: case SVM_EXIT_EXCEPTION_1B:
1391 case SVM_EXIT_EXCEPTION_1C: case SVM_EXIT_EXCEPTION_1D: case SVM_EXIT_EXCEPTION_1E: case SVM_EXIT_EXCEPTION_1F:
1392 {
1393 /* Pending trap. */
1394 SVM_EVENT Event;
1395 uint32_t vector = exitCode - SVM_EXIT_EXCEPTION_0;
1396
1397 Log2(("Hardware/software interrupt %d\n", vector));
1398 switch (vector)
1399 {
1400 case X86_XCPT_DB:
1401 {
1402 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDB);
1403
1404 /* Note that we don't support guest and host-initiated debugging at the same time. */
1405 Assert(DBGFIsStepping(pVCpu));
1406
1407 rc = DBGFRZTrap01Handler(pVM, pVCpu, CPUMCTX2CORE(pCtx), pCtx->dr[6]);
1408 if (rc == VINF_EM_RAW_GUEST_TRAP)
1409 {
1410 Log(("Trap %x (debug) at %016RX64\n", vector, pCtx->rip));
1411
1412 /* Reinject the exception. */
1413 Event.au64[0] = 0;
1414 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
1415 Event.n.u1Valid = 1;
1416 Event.n.u8Vector = X86_XCPT_DB;
1417
1418 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1419
1420 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1421 goto ResumeExecution;
1422 }
1423 /* Return to ring 3 to deal with the debug exit code. */
1424 break;
1425 }
1426
1427 case X86_XCPT_NM:
1428 {
1429 Log(("#NM fault at %RGv\n", (RTGCPTR)pCtx->rip));
1430
1431 /** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1432 /* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1433 rc = CPUMR0LoadGuestFPU(pVM, pVCpu, pCtx);
1434 if (rc == VINF_SUCCESS)
1435 {
1436 Assert(CPUMIsGuestFPUStateActive(pVCpu));
1437 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowNM);
1438
1439 /* Continue execution. */
1440 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1441 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1442
1443 goto ResumeExecution;
1444 }
1445
1446 Log(("Forward #NM fault to the guest\n"));
1447 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNM);
1448
1449 Event.au64[0] = 0;
1450 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1451 Event.n.u1Valid = 1;
1452 Event.n.u8Vector = X86_XCPT_NM;
1453
1454 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1455 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1456 goto ResumeExecution;
1457 }
1458
1459 case X86_XCPT_PF: /* Page fault */
1460 {
1461 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1462 RTGCUINTPTR uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1463
1464#ifdef DEBUG
1465 if (pVM->hwaccm.s.fNestedPaging)
1466 { /* A genuine pagefault.
1467 * Forward the trap to the guest by injecting the exception and resuming execution.
1468 */
1469 Log(("Guest page fault at %04X:%RGv cr2=%RGv error code %x rsp=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
1470 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1471
1472 /* Now we must update CR2. */
1473 pCtx->cr2 = uFaultAddress;
1474
1475 Event.au64[0] = 0;
1476 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1477 Event.n.u1Valid = 1;
1478 Event.n.u8Vector = X86_XCPT_PF;
1479 Event.n.u1ErrorCodeValid = 1;
1480 Event.n.u32ErrorCode = errCode;
1481
1482 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1483
1484 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1485 goto ResumeExecution;
1486 }
1487#endif
1488 Assert(!pVM->hwaccm.s.fNestedPaging);
1489
1490#if 0
1491 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1492 if ( (uFaultAddress & 0xfff) == 0x080
1493 && pVM->hwaccm.s.fHasIoApic
1494 && !(errCode & X86_TRAP_PF_P) /* not present */
1495 && !CPUMIsGuestInLongModeEx(pCtx))
1496 {
1497 RTGCPHYS GCPhysApicBase, GCPhys;
1498 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1499 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1500
1501 rc = PGMGstGetPage(pVCpu, (RTGCPTR)uFaultAddress, NULL, &GCPhys);
1502 if ( rc == VINF_SUCCESS
1503 && GCPhys == GCPhysApicBase)
1504 {
1505 Log(("Replace TPR access at %RGv\n", pCtx->rip));
1506
1507 DISCPUSTATE Cpu;
1508 unsigned cbOp;
1509 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu, &cbOp);
1510 AssertRC(rc);
1511 if ( rc == VINF_SUCCESS
1512 && Cpu.pCurInstr->opcode == OP_MOV
1513 && (cbOp == 5 || cbOp == 6))
1514 {
1515 uint8_t szInstr[15];
1516 if ( (errCode & X86_TRAP_PF_RW)
1517 && Cpu.param1.disp32 == (uint32_t)uFaultAddress
1518 && Cpu.param2.flags == USE_REG_GEN32)
1519 {
1520 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
1521 szInstr[0] = 0xF0;
1522 szInstr[1] = 0x0F;
1523 szInstr[2] = 0x22;
1524 szInstr[3] = 0xC0 | Cpu.param2.base.reg_gen;
1525 for (unsigned i = 4; i < cbOp; i++)
1526 szInstr[i] = 0x90; /* nop */
1527
1528 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, cbOp);
1529 AssertRC(rc);
1530
1531 Log(("Acceptable write candidate!\n"));
1532 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1533 goto ResumeExecution;
1534 }
1535 else
1536 if ( Cpu.param2.disp32 == (uint32_t)uFaultAddress
1537 && Cpu.param1.flags == USE_REG_GEN32)
1538 {
1539 /* 0xF0, 0x0F, 0x20, 0xC0 = mov eax, cr8 */
1540 szInstr[0] = 0xF0;
1541 szInstr[1] = 0x0F;
1542 szInstr[2] = 0x20;
1543 szInstr[3] = 0xC0 | Cpu.param1.base.reg_gen;
1544 for (unsigned i = 4; i < cbOp; i++)
1545 szInstr[i] = 0x90; /* nop */
1546
1547 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, cbOp);
1548 AssertRC(rc);
1549
1550 Log(("Acceptable read candidate!\n"));
1551 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1552 goto ResumeExecution;
1553 }
1554 }
1555 }
1556 }
1557#endif
1558
1559 Log2(("Page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1560 /* Exit qualification contains the linear address of the page fault. */
1561 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1562 TRPMSetErrorCode(pVCpu, errCode);
1563 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1564
1565 /* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1566 rc = PGMTrap0eHandler(pVCpu, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
1567 Log2(("PGMTrap0eHandler %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1568 if (rc == VINF_SUCCESS)
1569 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1570 Log2(("Shadow page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1571 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1572
1573 TRPMResetTrap(pVCpu);
1574
1575 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1576 goto ResumeExecution;
1577 }
1578 else
1579 if (rc == VINF_EM_RAW_GUEST_TRAP)
1580 { /* A genuine pagefault.
1581 * Forward the trap to the guest by injecting the exception and resuming execution.
1582 */
1583 Log2(("Forward page fault to the guest\n"));
1584 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
1585 /* The error code might have been changed. */
1586 errCode = TRPMGetErrorCode(pVCpu);
1587
1588 TRPMResetTrap(pVCpu);
1589
1590 /* Now we must update CR2. */
1591 pCtx->cr2 = uFaultAddress;
1592
1593 Event.au64[0] = 0;
1594 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1595 Event.n.u1Valid = 1;
1596 Event.n.u8Vector = X86_XCPT_PF;
1597 Event.n.u1ErrorCodeValid = 1;
1598 Event.n.u32ErrorCode = errCode;
1599
1600 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1601
1602 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1603 goto ResumeExecution;
1604 }
1605#ifdef VBOX_STRICT
1606 if (rc != VINF_EM_RAW_EMULATE_INSTR && rc != VINF_EM_RAW_EMULATE_IO_BLOCK)
1607 LogFlow(("PGMTrap0eHandler failed with %d\n", rc));
1608#endif
1609 /* Need to go back to the recompiler to emulate the instruction. */
1610 TRPMResetTrap(pVCpu);
1611 break;
1612 }
1613
1614 case X86_XCPT_MF: /* Floating point exception. */
1615 {
1616 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestMF);
1617 if (!(pCtx->cr0 & X86_CR0_NE))
1618 {
1619 /* old style FPU error reporting needs some extra work. */
1620 /** @todo don't fall back to the recompiler, but do it manually. */
1621 rc = VINF_EM_RAW_EMULATE_INSTR;
1622 break;
1623 }
1624 Log(("Trap %x at %RGv\n", vector, (RTGCPTR)pCtx->rip));
1625
1626 Event.au64[0] = 0;
1627 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1628 Event.n.u1Valid = 1;
1629 Event.n.u8Vector = X86_XCPT_MF;
1630
1631 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1632
1633 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1634 goto ResumeExecution;
1635 }
1636
1637#ifdef VBOX_STRICT
1638 case X86_XCPT_GP: /* General protection failure exception.*/
1639 case X86_XCPT_UD: /* Unknown opcode exception. */
1640 case X86_XCPT_DE: /* Divide error. */
1641 case X86_XCPT_SS: /* Stack segment exception. */
1642 case X86_XCPT_NP: /* Segment not present exception. */
1643 {
1644 Event.au64[0] = 0;
1645 Event.n.u3Type = SVM_EVENT_EXCEPTION;
1646 Event.n.u1Valid = 1;
1647 Event.n.u8Vector = vector;
1648
1649 switch(vector)
1650 {
1651 case X86_XCPT_GP:
1652 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestGP);
1653 Event.n.u1ErrorCodeValid = 1;
1654 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1655 break;
1656 case X86_XCPT_DE:
1657 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestDE);
1658 break;
1659 case X86_XCPT_UD:
1660 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestUD);
1661 break;
1662 case X86_XCPT_SS:
1663 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestSS);
1664 Event.n.u1ErrorCodeValid = 1;
1665 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1666 break;
1667 case X86_XCPT_NP:
1668 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestNP);
1669 Event.n.u1ErrorCodeValid = 1;
1670 Event.n.u32ErrorCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1671 break;
1672 }
1673 Log(("Trap %x at %04x:%RGv esi=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, pCtx->esi));
1674 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
1675
1676 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1677 goto ResumeExecution;
1678 }
1679#endif
1680 default:
1681 AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
1682 rc = VERR_EM_INTERNAL_ERROR;
1683 break;
1684
1685 } /* switch (vector) */
1686 break;
1687 }
1688
1689 case SVM_EXIT_NPF:
1690 {
1691 /* EXITINFO1 contains fault errorcode; EXITINFO2 contains the guest physical address causing the fault. */
1692 uint32_t errCode = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
1693 RTGCPHYS uFaultAddress = pVMCB->ctrl.u64ExitInfo2; /* EXITINFO2 = fault address */
1694 PGMMODE enmShwPagingMode;
1695
1696 Assert(pVM->hwaccm.s.fNestedPaging);
1697 LogFlow(("Nested page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1698
1699#if 0
1700 /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
1701 if ( (uFaultAddress & 0xfff) == 0x080
1702 && pVM->hwaccm.s.fHasIoApic
1703 && !(errCode & X86_TRAP_PF_P) /* not present */
1704 && CPUMGetGuestCPL(pVCpu, CPUMCTX2CORE(pCtx)) == 0
1705 && !CPUMIsGuestInLongModeEx(pCtx))
1706 {
1707 RTGCPHYS GCPhysApicBase;
1708 PDMApicGetBase(pVM, &GCPhysApicBase); /* @todo cache this */
1709 GCPhysApicBase &= PAGE_BASE_GC_MASK;
1710
1711 if (uFaultAddress == GCPhysApicBase + 0x80)
1712 {
1713 rc = svmR0ReplaceTprInstr(pVM, pVCpu, pCtx);
1714 if (rc == VINF_SUCCESS)
1715 {
1716 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1717 goto ResumeExecution;
1718 }
1719
1720 rc = IOMMMIOPhysHandler(pVM, errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1721 if (rc == VINF_SUCCESS)
1722 {
1723 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1724 goto ResumeExecution; /* rip already updated */
1725 }
1726 }
1727 }
1728#endif
1729
1730 /* Exit qualification contains the linear address of the page fault. */
1731 TRPMAssertTrap(pVCpu, X86_XCPT_PF, TRPM_TRAP);
1732 TRPMSetErrorCode(pVCpu, errCode);
1733 TRPMSetFaultAddress(pVCpu, uFaultAddress);
1734
1735 /* Handle the pagefault trap for the nested shadow table. */
1736#if HC_ARCH_BITS == 32
1737 if (CPUMIsGuestInLongModeEx(pCtx))
1738 enmShwPagingMode = PGMMODE_AMD64_NX;
1739 else
1740#endif
1741 enmShwPagingMode = PGMGetHostMode(pVM);
1742
1743 rc = PGMR0Trap0eHandlerNestedPaging(pVM, pVCpu, enmShwPagingMode, errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
1744 Log2(("PGMR0Trap0eHandlerNestedPaging %RGv returned %Rrc\n", (RTGCPTR)pCtx->rip, rc));
1745 if (rc == VINF_SUCCESS)
1746 { /* We've successfully synced our shadow pages, so let's just continue execution. */
1747 Log2(("Shadow page fault at %RGv cr2=%RGp error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
1748 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitShadowPF);
1749
1750 TRPMResetTrap(pVCpu);
1751
1752 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1753 goto ResumeExecution;
1754 }
1755
1756#ifdef VBOX_STRICT
1757 if (rc != VINF_EM_RAW_EMULATE_INSTR)
1758 LogFlow(("PGMTrap0eHandlerNestedPaging failed with %d\n", rc));
1759#endif
1760 /* Need to go back to the recompiler to emulate the instruction. */
1761 TRPMResetTrap(pVCpu);
1762 break;
1763 }
1764
1765 case SVM_EXIT_VINTR:
1766 /* A virtual interrupt is about to be delivered, which means IF=1. */
1767 Log(("SVM_EXIT_VINTR IF=%d\n", pCtx->eflags.Bits.u1IF));
1768 pVMCB->ctrl.IntCtrl.n.u1VIrqValid = 0;
1769 pVMCB->ctrl.IntCtrl.n.u8VIrqVector = 0;
1770 goto ResumeExecution;
1771
1772 case SVM_EXIT_FERR_FREEZE:
1773 case SVM_EXIT_INTR:
1774 case SVM_EXIT_NMI:
1775 case SVM_EXIT_SMI:
1776 case SVM_EXIT_INIT:
1777 /* External interrupt; leave to allow it to be dispatched again. */
1778 rc = VINF_EM_RAW_INTERRUPT;
1779 break;
1780
1781 case SVM_EXIT_WBINVD:
1782 case SVM_EXIT_INVD: /* Guest software attempted to execute INVD. */
1783 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvd);
1784 /* Skip instruction and continue directly. */
1785 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1786 /* Continue execution.*/
1787 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1788 goto ResumeExecution;
1789
1790 case SVM_EXIT_CPUID: /* Guest software attempted to execute CPUID. */
1791 {
1792 Log2(("SVM: Cpuid at %RGv for %x\n", (RTGCPTR)pCtx->rip, pCtx->eax));
1793 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCpuid);
1794 rc = EMInterpretCpuId(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1795 if (rc == VINF_SUCCESS)
1796 {
1797 /* Update EIP and continue execution. */
1798 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1799 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1800 goto ResumeExecution;
1801 }
1802 AssertMsgFailed(("EMU: cpuid failed with %Rrc\n", rc));
1803 rc = VINF_EM_RAW_EMULATE_INSTR;
1804 break;
1805 }
1806
1807 case SVM_EXIT_RDTSC: /* Guest software attempted to execute RDTSC. */
1808 {
1809 Log2(("SVM: Rdtsc\n"));
1810 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1811 rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1812 if (rc == VINF_SUCCESS)
1813 {
1814 /* Update EIP and continue execution. */
1815 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1816 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1817 goto ResumeExecution;
1818 }
1819 rc = VINF_EM_RAW_EMULATE_INSTR;
1820 break;
1821 }
1822
1823 case SVM_EXIT_RDPMC: /* Guest software attempted to execute RDPMC. */
1824 {
1825 Log2(("SVM: Rdpmc %x\n", pCtx->ecx));
1826 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdpmc);
1827 rc = EMInterpretRdpmc(pVM, pVCpu, CPUMCTX2CORE(pCtx));
1828 if (rc == VINF_SUCCESS)
1829 {
1830 /* Update EIP and continue execution. */
1831 pCtx->rip += 2; /* Note! hardcoded opcode size! */
1832 goto ResumeExecution;
1833 }
1834 rc = VINF_EM_RAW_EMULATE_INSTR;
1835 break;
1836 }
1837
1838 case SVM_EXIT_RDTSCP: /* Guest software attempted to execute RDTSCP. */
1839 {
1840 Log2(("SVM: Rdtscp\n"));
1841 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitRdtsc);
1842 rc = EMInterpretRdtscp(pVM, pVCpu, pCtx);
1843 if (rc == VINF_SUCCESS)
1844 {
1845 /* Update EIP and continue execution. */
1846 pCtx->rip += 3; /* Note! hardcoded opcode size! */
1847 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1848 goto ResumeExecution;
1849 }
1850 AssertMsgFailed(("EMU: rdtscp failed with %Rrc\n", rc));
1851 rc = VINF_EM_RAW_EMULATE_INSTR;
1852 break;
1853 }
1854
1855 case SVM_EXIT_INVLPG: /* Guest software attempted to execute INVPG. */
1856 {
1857 Log2(("SVM: invlpg\n"));
1858 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitInvpg);
1859
1860 Assert(!pVM->hwaccm.s.fNestedPaging);
1861
1862 /* Truly a pita. Why can't SVM give the same information as VT-x? */
1863 rc = svmR0InterpretInvpg(pVM, pVCpu, CPUMCTX2CORE(pCtx), pVMCB->ctrl.TLBCtrl.n.u32ASID);
1864 if (rc == VINF_SUCCESS)
1865 {
1866 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushPageInvlpg);
1867 goto ResumeExecution; /* eip already updated */
1868 }
1869 break;
1870 }
1871
1872 case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
1873 case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
1874 case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
1875 case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
1876 {
1877 uint32_t cbSize;
1878
1879 Log2(("SVM: %RGv mov cr%d, \n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_CR0));
1880 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxWrite[exitCode - SVM_EXIT_WRITE_CR0]);
1881 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1882
1883 switch (exitCode - SVM_EXIT_WRITE_CR0)
1884 {
1885 case 0:
1886 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR0;
1887 break;
1888 case 2:
1889 break;
1890 case 3:
1891 Assert(!pVM->hwaccm.s.fNestedPaging);
1892 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
1893 break;
1894 case 4:
1895 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR4;
1896 break;
1897 case 8:
1898 break;
1899 default:
1900 AssertFailed();
1901 }
1902 /* Check if a sync operation is pending. */
1903 if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
1904 && VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
1905 {
1906 rc = PGMSyncCR3(pVCpu, pCtx->cr0, pCtx->cr3, pCtx->cr4, VMCPU_FF_ISSET(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
1907 AssertRC(rc);
1908
1909 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBCRxChange);
1910
1911 /* Must be set by PGMSyncCR3 */
1912 AssertMsg(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3 || PGMGetGuestMode(pVCpu) <= PGMMODE_PROTECTED || pVCpu->hwaccm.s.fForceTLBFlush,
1913 ("rc=%Rrc mode=%d fForceTLBFlush=%RTbool\n", rc, PGMGetGuestMode(pVCpu), pVCpu->hwaccm.s.fForceTLBFlush));
1914 }
1915 if (rc == VINF_SUCCESS)
1916 {
1917 /* EIP has been updated already. */
1918
1919 /* Only resume if successful. */
1920 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1921 goto ResumeExecution;
1922 }
1923 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1924 break;
1925 }
1926
1927 case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
1928 case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
1929 case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
1930 case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
1931 {
1932 uint32_t cbSize;
1933
1934 Log2(("SVM: %RGv mov x, cr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_CR0));
1935 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitCRxRead[exitCode - SVM_EXIT_READ_CR0]);
1936 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1937 if (rc == VINF_SUCCESS)
1938 {
1939 /* EIP has been updated already. */
1940
1941 /* Only resume if successful. */
1942 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1943 goto ResumeExecution;
1944 }
1945 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1946 break;
1947 }
1948
1949 case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
1950 case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
1951 case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
1952 case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
1953 {
1954 uint32_t cbSize;
1955
1956 Log2(("SVM: %RGv mov dr%d, x\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_WRITE_DR0));
1957 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxWrite);
1958
1959 if (!DBGFIsStepping(pVCpu))
1960 {
1961 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
1962
1963 /* Disable drx move intercepts. */
1964 pVMCB->ctrl.u16InterceptRdDRx = 0;
1965 pVMCB->ctrl.u16InterceptWrDRx = 0;
1966
1967 /* Save the host and load the guest debug state. */
1968 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
1969 AssertRC(rc);
1970
1971 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1972 goto ResumeExecution;
1973 }
1974
1975 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
1976 if (rc == VINF_SUCCESS)
1977 {
1978 /* EIP has been updated already. */
1979 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
1980
1981 /* Only resume if successful. */
1982 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
1983 goto ResumeExecution;
1984 }
1985 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
1986 break;
1987 }
1988
1989 case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
1990 case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
1991 case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
1992 case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
1993 {
1994 uint32_t cbSize;
1995
1996 Log2(("SVM: %RGv mov x, dr%d\n", (RTGCPTR)pCtx->rip, exitCode - SVM_EXIT_READ_DR0));
1997 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitDRxRead);
1998
1999 if (!DBGFIsStepping(pVCpu))
2000 {
2001 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxContextSwitch);
2002
2003 /* Disable drx move intercepts. */
2004 pVMCB->ctrl.u16InterceptRdDRx = 0;
2005 pVMCB->ctrl.u16InterceptWrDRx = 0;
2006
2007 /* Save the host and load the guest debug state. */
2008 rc = CPUMR0LoadGuestDebugState(pVM, pVCpu, pCtx, false /* exclude DR6 */);
2009 AssertRC(rc);
2010
2011 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2012 goto ResumeExecution;
2013 }
2014
2015 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2016 if (rc == VINF_SUCCESS)
2017 {
2018 /* EIP has been updated already. */
2019
2020 /* Only resume if successful. */
2021 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2022 goto ResumeExecution;
2023 }
2024 Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
2025 break;
2026 }
2027
2028 /* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2029 case SVM_EXIT_IOIO: /* I/O instruction. */
2030 {
2031 SVM_IOIO_EXIT IoExitInfo;
2032 uint32_t uIOSize, uAndVal;
2033
2034 IoExitInfo.au32[0] = pVMCB->ctrl.u64ExitInfo1;
2035
2036 /** @todo could use a lookup table here */
2037 if (IoExitInfo.n.u1OP8)
2038 {
2039 uIOSize = 1;
2040 uAndVal = 0xff;
2041 }
2042 else
2043 if (IoExitInfo.n.u1OP16)
2044 {
2045 uIOSize = 2;
2046 uAndVal = 0xffff;
2047 }
2048 else
2049 if (IoExitInfo.n.u1OP32)
2050 {
2051 uIOSize = 4;
2052 uAndVal = 0xffffffff;
2053 }
2054 else
2055 {
2056 AssertFailed(); /* should be fatal. */
2057 rc = VINF_EM_RAW_EMULATE_INSTR;
2058 break;
2059 }
2060
2061 if (IoExitInfo.n.u1STR)
2062 {
2063 /* ins/outs */
2064 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2065
2066 /* Disassemble manually to deal with segment prefixes. */
2067 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, NULL);
2068 if (rc == VINF_SUCCESS)
2069 {
2070 if (IoExitInfo.n.u1Type == 0)
2071 {
2072 Log2(("IOMInterpretOUTSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2073 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringWrite);
2074 rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2075 }
2076 else
2077 {
2078 Log2(("IOMInterpretINSEx %RGv %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2079 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOStringRead);
2080 rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), IoExitInfo.n.u16Port, pDis->prefix, uIOSize);
2081 }
2082 }
2083 else
2084 rc = VINF_EM_RAW_EMULATE_INSTR;
2085 }
2086 else
2087 {
2088 /* normal in/out */
2089 Assert(!IoExitInfo.n.u1REP);
2090
2091 if (IoExitInfo.n.u1Type == 0)
2092 {
2093 Log2(("IOMIOPortWrite %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize));
2094 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIOWrite);
2095 rc = IOMIOPortWrite(pVM, IoExitInfo.n.u16Port, pCtx->eax & uAndVal, uIOSize);
2096 }
2097 else
2098 {
2099 uint32_t u32Val = 0;
2100
2101 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitIORead);
2102 rc = IOMIOPortRead(pVM, IoExitInfo.n.u16Port, &u32Val, uIOSize);
2103 if (IOM_SUCCESS(rc))
2104 {
2105 /* Write back to the EAX register. */
2106 pCtx->eax = (pCtx->eax & ~uAndVal) | (u32Val & uAndVal);
2107 Log2(("IOMIOPortRead %RGv %x %x size=%d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, u32Val & uAndVal, uIOSize));
2108 }
2109 }
2110 }
2111 /*
2112 * Handled the I/O return codes.
2113 * (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2114 */
2115 if (IOM_SUCCESS(rc))
2116 {
2117 /* Update EIP and continue execution. */
2118 pCtx->rip = pVMCB->ctrl.u64ExitInfo2; /* RIP/EIP of the next instruction is saved in EXITINFO2. */
2119 if (RT_LIKELY(rc == VINF_SUCCESS))
2120 {
2121 /* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2122 if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2123 {
2124 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatDRxIOCheck);
2125 for (unsigned i=0;i<4;i++)
2126 {
2127 unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2128
2129 if ( (IoExitInfo.n.u16Port >= pCtx->dr[i] && IoExitInfo.n.u16Port < pCtx->dr[i] + uBPLen)
2130 && (pCtx->dr[7] & (X86_DR7_L(i) | X86_DR7_G(i)))
2131 && (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2132 {
2133 SVM_EVENT Event;
2134
2135 Assert(CPUMIsGuestDebugStateActive(pVCpu));
2136
2137 /* Clear all breakpoint status flags and set the one we just hit. */
2138 pCtx->dr[6] &= ~(X86_DR6_B0|X86_DR6_B1|X86_DR6_B2|X86_DR6_B3);
2139 pCtx->dr[6] |= (uint64_t)RT_BIT(i);
2140
2141 /* Note: AMD64 Architecture Programmer's Manual 13.1:
2142 * Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2143 * the contents have been read.
2144 */
2145 pVMCB->guest.u64DR6 = pCtx->dr[6];
2146
2147 /* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2148 pCtx->dr[7] &= ~X86_DR7_GD;
2149
2150 /* Paranoia. */
2151 pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2152 pCtx->dr[7] &= ~(RT_BIT(11) | RT_BIT(12) | RT_BIT(14) | RT_BIT(15)); /* must be zero */
2153 pCtx->dr[7] |= 0x400; /* must be one */
2154
2155 pVMCB->guest.u64DR7 = pCtx->dr[7];
2156
2157 /* Inject the exception. */
2158 Log(("Inject IO debug trap at %RGv\n", (RTGCPTR)pCtx->rip));
2159
2160 Event.au64[0] = 0;
2161 Event.n.u3Type = SVM_EVENT_EXCEPTION; /* trap or fault */
2162 Event.n.u1Valid = 1;
2163 Event.n.u8Vector = X86_XCPT_DB;
2164
2165 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2166
2167 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2168 goto ResumeExecution;
2169 }
2170 }
2171 }
2172
2173 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2174 goto ResumeExecution;
2175 }
2176 Log2(("EM status from IO at %RGv %x size %d: %Rrc\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize, rc));
2177 break;
2178 }
2179
2180#ifdef VBOX_STRICT
2181 if (rc == VINF_IOM_HC_IOPORT_READ)
2182 Assert(IoExitInfo.n.u1Type != 0);
2183 else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2184 Assert(IoExitInfo.n.u1Type == 0);
2185 else
2186 AssertMsg(RT_FAILURE(rc) || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_EM_RAW_GUEST_TRAP || rc == VINF_TRPM_XCPT_DISPATCHED, ("%Rrc\n", rc));
2187#endif
2188 Log2(("Failed IO at %RGv %x size %d\n", (RTGCPTR)pCtx->rip, IoExitInfo.n.u16Port, uIOSize));
2189 break;
2190 }
2191
2192 case SVM_EXIT_HLT:
2193 /** Check if external interrupts are pending; if so, don't switch back. */
2194 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitHlt);
2195 pCtx->rip++; /* skip hlt */
2196 if ( pCtx->eflags.Bits.u1IF
2197 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2198 goto ResumeExecution;
2199
2200 rc = VINF_EM_HALT;
2201 break;
2202
2203 case SVM_EXIT_MWAIT_UNCOND:
2204 Log2(("SVM: mwait\n"));
2205 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitMwait);
2206 rc = EMInterpretMWait(pVM, pVCpu, CPUMCTX2CORE(pCtx));
2207 if ( rc == VINF_EM_HALT
2208 || rc == VINF_SUCCESS)
2209 {
2210 /* Update EIP and continue execution. */
2211 pCtx->rip += 3; /* Note: hardcoded opcode size assumption! */
2212
2213 /** Check if external interrupts are pending; if so, don't switch back. */
2214 if ( rc == VINF_SUCCESS
2215 || ( rc == VINF_EM_HALT
2216 && pCtx->eflags.Bits.u1IF
2217 && VMCPU_FF_ISPENDING(pVCpu, (VMCPU_FF_INTERRUPT_APIC|VMCPU_FF_INTERRUPT_PIC)))
2218 )
2219 goto ResumeExecution;
2220 }
2221 AssertMsg(rc == VERR_EM_INTERPRETER || rc == VINF_EM_HALT, ("EMU: mwait failed with %Rrc\n", rc));
2222 break;
2223
2224 case SVM_EXIT_RSM:
2225 case SVM_EXIT_INVLPGA:
2226 case SVM_EXIT_VMRUN:
2227 case SVM_EXIT_VMMCALL:
2228 case SVM_EXIT_VMLOAD:
2229 case SVM_EXIT_VMSAVE:
2230 case SVM_EXIT_STGI:
2231 case SVM_EXIT_CLGI:
2232 case SVM_EXIT_SKINIT:
2233 {
2234 /* Unsupported instructions. */
2235 SVM_EVENT Event;
2236
2237 Event.au64[0] = 0;
2238 Event.n.u3Type = SVM_EVENT_EXCEPTION;
2239 Event.n.u1Valid = 1;
2240 Event.n.u8Vector = X86_XCPT_UD;
2241
2242 Log(("Forced #UD trap at %RGv\n", (RTGCPTR)pCtx->rip));
2243 SVMR0InjectEvent(pVCpu, pVMCB, pCtx, &Event);
2244
2245 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2246 goto ResumeExecution;
2247 }
2248
2249 /* Emulate in ring 3. */
2250 case SVM_EXIT_MSR:
2251 {
2252 uint32_t cbSize;
2253
2254 /* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2255 STAM_COUNTER_INC((pVMCB->ctrl.u64ExitInfo1 == 0) ? &pVCpu->hwaccm.s.StatExitRdmsr : &pVCpu->hwaccm.s.StatExitWrmsr);
2256 Log(("SVM: %s\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr"));
2257 rc = EMInterpretInstruction(pVM, pVCpu, CPUMCTX2CORE(pCtx), 0, &cbSize);
2258 if (rc == VINF_SUCCESS)
2259 {
2260 /* EIP has been updated already. */
2261
2262 /* Only resume if successful. */
2263 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2264 goto ResumeExecution;
2265 }
2266 AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Rrc\n", (pVMCB->ctrl.u64ExitInfo1 == 0) ? "rdmsr" : "wrmsr", rc));
2267 break;
2268 }
2269
2270 case SVM_EXIT_MONITOR:
2271 case SVM_EXIT_PAUSE:
2272 case SVM_EXIT_MWAIT_ARMED:
2273 case SVM_EXIT_TASK_SWITCH: /* can change CR3; emulate */
2274 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2275 break;
2276
2277 case SVM_EXIT_SHUTDOWN:
2278 rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2279 break;
2280
2281 case SVM_EXIT_IDTR_READ:
2282 case SVM_EXIT_GDTR_READ:
2283 case SVM_EXIT_LDTR_READ:
2284 case SVM_EXIT_TR_READ:
2285 case SVM_EXIT_IDTR_WRITE:
2286 case SVM_EXIT_GDTR_WRITE:
2287 case SVM_EXIT_LDTR_WRITE:
2288 case SVM_EXIT_TR_WRITE:
2289 case SVM_EXIT_CR0_SEL_WRITE:
2290 default:
2291 /* Unexpected exit codes. */
2292 rc = VERR_EM_INTERNAL_ERROR;
2293 AssertMsgFailed(("Unexpected exit code %x\n", exitCode)); /* Can't happen. */
2294 break;
2295 }
2296
2297end:
2298
2299 /* Signal changes for the recompiler. */
2300 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_SYSENTER_MSR | CPUM_CHANGED_LDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_IDTR | CPUM_CHANGED_TR | CPUM_CHANGED_HIDDEN_SEL_REGS);
2301
2302 /* If we executed vmrun and an external irq was pending, then we don't have to do a full sync the next time. */
2303 if (exitCode == SVM_EXIT_INTR)
2304 {
2305 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatPendingHostIrq);
2306 /* On the next entry we'll only sync the host context. */
2307 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_HOST_CONTEXT;
2308 }
2309 else
2310 {
2311 /* On the next entry we'll sync everything. */
2312 /** @todo we can do better than this */
2313 /* Not in the VINF_PGM_CHANGE_MODE though! */
2314 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_ALL;
2315 }
2316
2317 /* translate into a less severe return code */
2318 if (rc == VERR_EM_INTERPRETER)
2319 rc = VINF_EM_RAW_EMULATE_INSTR;
2320
2321 /* Just set the correct state here instead of trying to catch every goto above. */
2322 VMCPU_CMPXCHG_STATE(pVCpu, VMCPUSTATE_STARTED, VMCPUSTATE_STARTED_EXEC);
2323
2324#ifdef VBOX_WITH_VMMR0_DISABLE_PREEMPTION
2325 /* Restore interrupts if we exitted after disabling them. */
2326 if (uOldEFlags != ~(RTCCUINTREG)0)
2327 ASMSetFlags(uOldEFlags);
2328#endif
2329
2330 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatExit1, x);
2331 return rc;
2332}
2333
2334/**
2335 * Emulate simple mov tpr instruction
2336 *
2337 * @returns VBox status code.
2338 * @param pVCpu The VM CPU to operate on.
2339 * @param pDis Disassembly state
2340 * @param pCtx CPU context
2341 * @param cbOp Opcode size
2342 */
2343static int svmR0EmulateTprMov(PVMCPU pVCpu, PDISCPUSTATE pDis, PCPUMCTX pCtx, unsigned cbOp)
2344{
2345 int rc;
2346
2347 if (pDis->param1.flags == USE_DISPLACEMENT32)
2348 {
2349 /* write */
2350 uint8_t u8Tpr;
2351
2352 /* Fetch the new TPR value */
2353 if (pDis->param2.flags == USE_REG_GEN32)
2354 {
2355 uint32_t val;
2356
2357 rc = DISFetchReg32(CPUMCTX2CORE(pCtx), pDis->param2.base.reg_gen, &val);
2358 AssertRC(rc);
2359 u8Tpr = val >> 4;
2360 }
2361 else
2362 if (pDis->param2.flags == USE_IMMEDIATE32)
2363 {
2364 u8Tpr = (uint8_t)pDis->param2.parval >> 4;
2365 }
2366 else
2367 return VERR_EM_INTERPRETER;
2368
2369 rc = PDMApicSetTPR(pVCpu, u8Tpr);
2370 AssertRC(rc);
2371
2372 Log(("Emulated write successfully\n"));
2373 pCtx->rip += cbOp;
2374 return VINF_SUCCESS;
2375 }
2376 else
2377 if (pDis->param2.flags == USE_DISPLACEMENT32)
2378 {
2379 /* read */
2380 bool fPending;
2381 uint8_t u8Tpr;
2382
2383 /* TPR caching in CR8 */
2384 rc = PDMApicGetTPR(pVCpu, &u8Tpr, &fPending);
2385 AssertRC(rc);
2386
2387 rc = DISWriteReg32(CPUMCTX2CORE(pCtx), pDis->param1.base.reg_gen, u8Tpr << 4);
2388 AssertRC(rc);
2389
2390 Log(("Emulated read successfully\n"));
2391 pCtx->rip += cbOp;
2392 return VINF_SUCCESS;
2393 }
2394 return VERR_EM_INTERPRETER;
2395}
2396
2397/**
2398 * Attempt to patch TPR mmio instructions
2399 *
2400 * @returns VBox status code.
2401 * @param pVM The VM to operate on.
2402 * @param pVCpu The VM CPU to operate on.
2403 * @param pCtx CPU context
2404 */
2405static int svmR0ReplaceTprInstr(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2406{
2407 RTGCPTR oldrip = pCtx->rip;
2408 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2409 unsigned cbOp;
2410
2411 Log(("Replace TPR access at %RGv\n", pCtx->rip));
2412
2413 int rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2414 AssertRC(rc);
2415 if ( rc == VINF_SUCCESS
2416 && pDis->pCurInstr->opcode == OP_MOV)
2417 {
2418#if 0
2419 uint8_t szInstr[15];
2420 if ( cbOp == 10
2421 && pDis->param1.flags == USE_DISPLACEMENT32
2422 && pDis->param2.flags == USE_IMMEDIATE32)
2423 {
2424 /* Found:
2425 * mov [fffe0080], immediate_dword (10 bytes)
2426 *
2427 * Replace with:
2428 * mov free_register, immediate_dword >> 4 (5 bytes)
2429 * mov cr8, free_register (4 bytes)
2430 * nop (1 byte)
2431 *
2432 */
2433 uint32_t u32tpr = (uint32_t)pDis->param2.parval;
2434
2435 u32tpr = (u32tpr >> 4) & 0xf;
2436
2437 /* Check if the next instruction overwrites a general purpose register. If
2438 * it does, then we can safely use it ourselves.
2439 */
2440 pCtx->rip += cbOp;
2441 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2442 pCtx->rip = oldrip;
2443 if ( rc == VINF_SUCCESS
2444 && pDis->pCurInstr->opcode == OP_MOV
2445 && pDis->param1.flags == USE_REG_GEN32)
2446 {
2447 /* 0xB8, dword immediate = mov eax, dword immediate */
2448 szInstr[0] = 0xB8 + pDis->param1.base.reg_gen;
2449 szInstr[1] = (uint8_t)u32tpr;
2450 szInstr[2] = 0;
2451 szInstr[3] = 0;
2452 szInstr[4] = 0;
2453
2454 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
2455 szInstr[5] = 0xF0;
2456 szInstr[6] = 0x0F;
2457 szInstr[7] = 0x22;
2458 szInstr[8] = 0xC0 | pDis->param1.base.reg_gen;
2459 szInstr[9] = 0x90; /* nop */
2460
2461 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 10);
2462 AssertRC(rc);
2463
2464 Log(("Acceptable write candidate!\n"));
2465 return VINF_SUCCESS;
2466 }
2467 }
2468 else
2469 {
2470 if ( pDis->param2.flags == USE_REG_GEN32
2471 && cbOp == 6)
2472 {
2473 RTGCPTR GCPtrTpr = (uint32_t)pDis->param1.disp32;
2474 uint32_t uMmioReg = pDis->param2.base.reg_gen;
2475
2476 /* Found:
2477 * mov dword [fffe0080], eax (6 bytes)
2478 * Check if next instruction is a TPR read:
2479 * mov ecx, dword [fffe0080] (5 bytes)
2480 */
2481 pCtx->rip += cbOp;
2482 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2483 pCtx->rip = oldrip;
2484 if ( rc == VINF_SUCCESS
2485 && pDis->pCurInstr->opcode == OP_MOV
2486 && pDis->param1.flags == USE_REG_GEN32
2487 && pDis->param2.flags == USE_DISPLACEMENT32
2488 && pDis->param2.disp32 == (uint32_t)GCPtrTpr
2489 && cbOp == 5)
2490 {
2491 /* mov new_reg, uMmioReg */
2492 szInstr[0] = 0x89;
2493 szInstr[1] = MAKE_MODRM(3, uMmioReg, pDis->param1.base.reg_gen);
2494
2495 /* Let's hope the guest won't mind us trashing the source register...
2496 * shr uMmioReg, 4
2497 */
2498 szInstr[2] = 0xC1;
2499 szInstr[3] = 0xE8 | uMmioReg;
2500 szInstr[4] = 4;
2501
2502 /* 0xF0, 0x0F, 0x22, 0xC0 = mov cr8, eax */
2503 szInstr[5] = 0xF0;
2504 szInstr[6] = 0x0F;
2505 szInstr[7] = 0x22;
2506 szInstr[8] = 0xC0 | uMmioReg;
2507
2508 /* Two nop instructions */
2509 szInstr[9] = 0x90;
2510 szInstr[10] = 0x90;
2511
2512 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 6+cbOp);
2513 AssertRC(rc);
2514
2515 Log(("Acceptable read/write candidate!\n"));
2516 return VINF_SUCCESS;
2517 }
2518 }
2519 else
2520 if ( pDis->param1.flags == USE_REG_GEN32
2521 && cbOp == 5)
2522 {
2523 uint32_t uMmioReg = pDis->param1.base.reg_gen;
2524
2525 /* Found:
2526 * mov eax, dword [fffe0080] (5 bytes)
2527 * Check if next instruction is:
2528 * shr eax, 4
2529 */
2530 pCtx->rip += cbOp;
2531 rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), pDis, &cbOp);
2532 pCtx->rip = oldrip;
2533 if ( rc == VINF_SUCCESS
2534 && pDis->pCurInstr->opcode == OP_SHR
2535 && pDis->param1.flags == USE_REG_GEN32
2536 && pDis->param1.base.reg_gen == uMmioReg
2537 && pDis->param2.flags == USE_IMMEDIATE8
2538 && pDis->param2.parval == 4)
2539 {
2540 /* 0xF0, 0x0F, 0x20, 0xC0 = mov eax, cr8 */
2541 szInstr[0] = 0xF0;
2542 szInstr[1] = 0x0F;
2543 szInstr[2] = 0x20;
2544 szInstr[3] = 0xC0 | pDis->param1.base.reg_gen;
2545 for (unsigned i = 4; i < 5+cbOp; i++)
2546 szInstr[i] = 0x90; /* nop */
2547
2548 rc = PGMPhysSimpleWriteGCPtr(pVCpu, pCtx->rip, szInstr, 5+cbOp);
2549 AssertRC(rc);
2550
2551 Log(("Acceptable read candidate!\n"));
2552 return VINF_SUCCESS;
2553 }
2554 }
2555 }
2556#endif
2557 rc = svmR0EmulateTprMov(pVCpu, pDis, pCtx, cbOp);
2558 if (rc != VINF_SUCCESS)
2559 return rc;
2560
2561 /* Emulated successfully, so continue. */
2562 return VINF_SUCCESS;
2563 }
2564 return VERR_ACCESS_DENIED;
2565}
2566
2567/**
2568 * Enters the AMD-V session
2569 *
2570 * @returns VBox status code.
2571 * @param pVM The VM to operate on.
2572 * @param pVCpu The VM CPU to operate on.
2573 * @param pCpu CPU info struct
2574 */
2575VMMR0DECL(int) SVMR0Enter(PVM pVM, PVMCPU pVCpu, PHWACCM_CPUINFO pCpu)
2576{
2577 Assert(pVM->hwaccm.s.svm.fSupported);
2578
2579 LogFlow(("SVMR0Enter cpu%d last=%d asid=%d\n", pCpu->idCpu, pVCpu->hwaccm.s.idLastCpu, pVCpu->hwaccm.s.uCurrentASID));
2580 pVCpu->hwaccm.s.fResumeVM = false;
2581
2582 /* Force to reload LDTR, so we'll execute VMLoad to load additional guest state. */
2583 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_LDTR;
2584
2585 return VINF_SUCCESS;
2586}
2587
2588
2589/**
2590 * Leaves the AMD-V session
2591 *
2592 * @returns VBox status code.
2593 * @param pVM The VM to operate on.
2594 * @param pVCpu The VM CPU to operate on.
2595 * @param pCtx CPU context
2596 */
2597VMMR0DECL(int) SVMR0Leave(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
2598{
2599 SVM_VMCB *pVMCB = (SVM_VMCB *)pVCpu->hwaccm.s.svm.pVMCB;
2600
2601 Assert(pVM->hwaccm.s.svm.fSupported);
2602
2603 /* Save the guest debug state if necessary. */
2604 if (CPUMIsGuestDebugStateActive(pVCpu))
2605 {
2606 CPUMR0SaveGuestDebugState(pVM, pVCpu, pCtx, false /* skip DR6 */);
2607
2608 /* Intercept all DRx reads and writes again. Changed later on. */
2609 pVMCB->ctrl.u16InterceptRdDRx = 0xFFFF;
2610 pVMCB->ctrl.u16InterceptWrDRx = 0xFFFF;
2611
2612 /* Resync the debug registers the next time. */
2613 pVCpu->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_DEBUG;
2614 }
2615 else
2616 Assert(pVMCB->ctrl.u16InterceptRdDRx == 0xFFFF && pVMCB->ctrl.u16InterceptWrDRx == 0xFFFF);
2617
2618 return VINF_SUCCESS;
2619}
2620
2621
2622static int svmR0InterpretInvlPg(PVMCPU pVCpu, PDISCPUSTATE pCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2623{
2624 OP_PARAMVAL param1;
2625 RTGCPTR addr;
2626
2627 int rc = DISQueryParamVal(pRegFrame, pCpu, &pCpu->param1, &param1, PARAM_SOURCE);
2628 if(RT_FAILURE(rc))
2629 return VERR_EM_INTERPRETER;
2630
2631 switch(param1.type)
2632 {
2633 case PARMTYPE_IMMEDIATE:
2634 case PARMTYPE_ADDRESS:
2635 if(!(param1.flags & (PARAM_VAL32|PARAM_VAL64)))
2636 return VERR_EM_INTERPRETER;
2637 addr = param1.val.val64;
2638 break;
2639
2640 default:
2641 return VERR_EM_INTERPRETER;
2642 }
2643
2644 /** @todo is addr always a flat linear address or ds based
2645 * (in absence of segment override prefixes)????
2646 */
2647 rc = PGMInvalidatePage(pVCpu, addr);
2648 if (RT_SUCCESS(rc))
2649 {
2650 /* Manually invalidate the page for the VM's TLB. */
2651 Log(("SVMR0InvlpgA %RGv ASID=%d\n", addr, uASID));
2652 SVMR0InvlpgA(addr, uASID);
2653 return VINF_SUCCESS;
2654 }
2655 AssertRC(rc);
2656 return rc;
2657}
2658
2659/**
2660 * Interprets INVLPG
2661 *
2662 * @returns VBox status code.
2663 * @retval VINF_* Scheduling instructions.
2664 * @retval VERR_EM_INTERPRETER Something we can't cope with.
2665 * @retval VERR_* Fatal errors.
2666 *
2667 * @param pVM The VM handle.
2668 * @param pRegFrame The register frame.
2669 * @param ASID Tagged TLB id for the guest
2670 *
2671 * Updates the EIP if an instruction was executed successfully.
2672 */
2673static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID)
2674{
2675 /*
2676 * Only allow 32 & 64 bits code.
2677 */
2678 DISCPUMODE enmMode = SELMGetCpuModeFromSelector(pVM, pRegFrame->eflags, pRegFrame->cs, &pRegFrame->csHid);
2679 if (enmMode != CPUMODE_16BIT)
2680 {
2681 RTGCPTR pbCode;
2682 int rc = SELMValidateAndConvertCSAddr(pVM, pRegFrame->eflags, pRegFrame->ss, pRegFrame->cs, &pRegFrame->csHid, (RTGCPTR)pRegFrame->rip, &pbCode);
2683 if (RT_SUCCESS(rc))
2684 {
2685 uint32_t cbOp;
2686 PDISCPUSTATE pDis = &pVCpu->hwaccm.s.DisState;
2687
2688 pDis->mode = enmMode;
2689 rc = EMInterpretDisasOneEx(pVM, pVCpu, pbCode, pRegFrame, pDis, &cbOp);
2690 Assert(RT_FAILURE(rc) || pDis->pCurInstr->opcode == OP_INVLPG);
2691 if (RT_SUCCESS(rc) && pDis->pCurInstr->opcode == OP_INVLPG)
2692 {
2693 Assert(cbOp == pDis->opsize);
2694 rc = svmR0InterpretInvlPg(pVCpu, pDis, pRegFrame, uASID);
2695 if (RT_SUCCESS(rc))
2696 {
2697 pRegFrame->rip += cbOp; /* Move on to the next instruction. */
2698 }
2699 return rc;
2700 }
2701 }
2702 }
2703 return VERR_EM_INTERPRETER;
2704}
2705
2706
2707/**
2708 * Invalidates a guest page
2709 *
2710 * @returns VBox status code.
2711 * @param pVM The VM to operate on.
2712 * @param pVCpu The VM CPU to operate on.
2713 * @param GCVirt Page to invalidate
2714 */
2715VMMR0DECL(int) SVMR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt)
2716{
2717 bool fFlushPending = pVM->hwaccm.s.svm.fAlwaysFlushTLB | pVCpu->hwaccm.s.fForceTLBFlush;
2718
2719 /* Skip it if a TLB flush is already pending. */
2720 if (!fFlushPending)
2721 {
2722 SVM_VMCB *pVMCB;
2723
2724 Log2(("SVMR0InvalidatePage %RGv\n", GCVirt));
2725 AssertReturn(pVM, VERR_INVALID_PARAMETER);
2726 Assert(pVM->hwaccm.s.svm.fSupported);
2727
2728 /* @todo SMP */
2729 pVMCB = (SVM_VMCB *)pVM->aCpus[0].hwaccm.s.svm.pVMCB;
2730 AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
2731
2732#if HC_ARCH_BITS == 32
2733 /* If we get a flush in 64 bits guest mode, then force a full TLB flush. Invlpga takes only 32 bits addresses. */
2734 if (CPUMIsGuestInLongMode(pVCpu))
2735 pVCpu->hwaccm.s.fForceTLBFlush = true;
2736 else
2737#endif
2738 SVMR0InvlpgA(GCVirt, pVMCB->ctrl.TLBCtrl.n.u32ASID);
2739 }
2740 return VINF_SUCCESS;
2741}
2742
2743
2744#if 0 /* obsolete, but left here for clarification. */
2745/**
2746 * Invalidates a guest page by physical address
2747 *
2748 * @returns VBox status code.
2749 * @param pVM The VM to operate on.
2750 * @param pVCpu The VM CPU to operate on.
2751 * @param GCPhys Page to invalidate
2752 */
2753VMMR0DECL(int) SVMR0InvalidatePhysPage(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys)
2754{
2755 Assert(pVM->hwaccm.s.fNestedPaging);
2756 /* invlpga only invalidates TLB entries for guest virtual addresses; we have no choice but to force a TLB flush here. */
2757 pVCpu->hwaccm.s.fForceTLBFlush = true;
2758 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatFlushTLBInvlpga);
2759 return VINF_SUCCESS;
2760}
2761#endif
2762
2763#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
2764/**
2765 * Prepares for and executes VMRUN (64 bits guests from a 32 bits hosts).
2766 *
2767 * @returns VBox status code.
2768 * @param pVMCBHostPhys Physical address of host VMCB.
2769 * @param pVMCBPhys Physical address of the VMCB.
2770 * @param pCtx Guest context.
2771 * @param pVM The VM to operate on.
2772 * @param pVCpu The VMCPU to operate on.
2773 */
2774DECLASM(int) SVMR0VMSwitcherRun64(RTHCPHYS pVMCBHostPhys, RTHCPHYS pVMCBPhys, PCPUMCTX pCtx, PVM pVM, PVMCPU pVCpu)
2775{
2776 uint32_t aParam[4];
2777
2778 aParam[0] = (uint32_t)(pVMCBHostPhys); /* Param 1: pVMCBHostPhys - Lo. */
2779 aParam[1] = (uint32_t)(pVMCBHostPhys >> 32); /* Param 1: pVMCBHostPhys - Hi. */
2780 aParam[2] = (uint32_t)(pVMCBPhys); /* Param 2: pVMCBPhys - Lo. */
2781 aParam[3] = (uint32_t)(pVMCBPhys >> 32); /* Param 2: pVMCBPhys - Hi. */
2782
2783 return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, pVM->hwaccm.s.pfnSVMGCVMRun64, 4, &aParam[0]);
2784}
2785
2786/**
2787 * Executes the specified handler in 64 mode
2788 *
2789 * @returns VBox status code.
2790 * @param pVM The VM to operate on.
2791 * @param pVCpu The VMCPU to operate on.
2792 * @param pCtx Guest context
2793 * @param pfnHandler RC handler
2794 * @param cbParam Number of parameters
2795 * @param paParam Array of 32 bits parameters
2796 */
2797VMMR0DECL(int) SVMR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, RTRCPTR pfnHandler, uint32_t cbParam, uint32_t *paParam)
2798{
2799 int rc;
2800 RTHCUINTREG uOldEFlags;
2801
2802 /* @todo This code is not guest SMP safe (hyper stack and switchers) */
2803 AssertReturn(pVM->cCPUs == 1, VERR_TOO_MANY_CPUS);
2804 Assert(pfnHandler);
2805
2806 uOldEFlags = ASMIntDisableFlags();
2807
2808 CPUMSetHyperESP(pVCpu, VMMGetStackRC(pVM));
2809 CPUMSetHyperEIP(pVCpu, pfnHandler);
2810 for (int i=(int)cbParam-1;i>=0;i--)
2811 CPUMPushHyper(pVCpu, paParam[i]);
2812
2813 STAM_PROFILE_ADV_START(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2814 /* Call switcher. */
2815 rc = pVM->hwaccm.s.pfnHost32ToGuest64R0(pVM);
2816 STAM_PROFILE_ADV_STOP(&pVCpu->hwaccm.s.StatWorldSwitch3264, z);
2817
2818 ASMSetFlags(uOldEFlags);
2819 return rc;
2820}
2821
2822#endif /* HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS) */
注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette