HWVMXR0.cpp@ 12983

Last change on this file since 12983 was 12824, checked in by vboxsync, 16 years ago
FreeBSD boot assertion fix (VT-x real-mode emulation).
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 105.4 KB

Line
1	/* $Id: HWVMXR0.cpp 12824 2008-09-30 09:04:49Z vboxsync $ */
2	/** @file
3	* HWACCM VMX - Host Context Ring 0.
4	*/
5
6	/*
7	* Copyright (C) 2006-2007 Sun Microsystems, Inc.
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa
18	* Clara, CA 95054 USA or visit http://www.sun.com if you need
19	* additional information or have any questions.
20	*/
21
22
23	/*******************************************************************************
24	* Header Files *
25	*******************************************************************************/
26	#define LOG_GROUP LOG_GROUP_HWACCM
27	#include <VBox/hwaccm.h>
28	#include "HWACCMInternal.h"
29	#include <VBox/vm.h>
30	#include <VBox/x86.h>
31	#include <VBox/pgm.h>
32	#include <VBox/pdm.h>
33	#include <VBox/err.h>
34	#include <VBox/log.h>
35	#include <VBox/selm.h>
36	#include <VBox/iom.h>
37	#include <iprt/param.h>
38	#include <iprt/assert.h>
39	#include <iprt/asm.h>
40	#include <iprt/string.h>
41	#include "HWVMXR0.h"
42
43
44	/*******************************************************************************
45	* Global Variables *
46	*******************************************************************************/
47	/* IO operation lookup arrays. */
48	static uint32_t const g_aIOSize[4] = {1, 2, 0, 4};
49	static uint32_t const g_aIOOpAnd[4] = {0xff, 0xffff, 0, 0xffffffff};
50
51
52	static void VMXR0CheckError(PVM pVM, int rc)
53	{
54	if (rc == VERR_VMX_GENERIC)
55	{
56	RTCCUINTREG instrError;
57
58	VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
59	pVM->hwaccm.s.vmx.ulLastInstrError = instrError;
60	}
61	pVM->hwaccm.s.lLastError = rc;
62	}
63
64	/**
65	* Sets up and activates VT-x on the current CPU
66	*
67	* @returns VBox status code.
68	* @param pCpu CPU info struct
69	* @param pVM The VM to operate on.
70	* @param pvPageCpu Pointer to the global cpu page
71	* @param pPageCpuPhys Physical address of the global cpu page
72	*/
73	HWACCMR0DECL(int) VMXR0EnableCpu(PHWACCM_CPUINFO pCpu, PVM pVM, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
74	{
75	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
76	AssertReturn(pVM, VERR_INVALID_PARAMETER);
77	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
78
79	/* Setup Intel VMX. */
80	Assert(pVM->hwaccm.s.vmx.fSupported);
81
82	#ifdef LOG_ENABLED
83	SUPR0Printf("VMXR0EnableCpu cpu %d page (%x) %x\n", pCpu->idCpu, pvPageCpu, (uint32_t)pPageCpuPhys);
84	#endif
85	/* Set revision dword at the beginning of the VMXON structure. */
86	(uint32_t )pvPageCpu = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
87
88	/** @todo we should unmap the two pages from the virtual address space in order to prevent accidental corruption.
89	* (which can have very bad consequences!!!)
90	*/
91
92	/* Make sure the VMX instructions don't cause #UD faults. */
93	ASMSetCR4(ASMGetCR4() \| X86_CR4_VMXE);
94
95	/* Enter VMX Root Mode */
96	int rc = VMXEnable(pPageCpuPhys);
97	if (VBOX_FAILURE(rc))
98	{
99	VMXR0CheckError(pVM, rc);
100	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
101	return VERR_VMX_VMXON_FAILED;
102	}
103	return VINF_SUCCESS;
104	}
105
106	/**
107	* Deactivates VT-x on the current CPU
108	*
109	* @returns VBox status code.
110	* @param pCpu CPU info struct
111	* @param pvPageCpu Pointer to the global cpu page
112	* @param pPageCpuPhys Physical address of the global cpu page
113	*/
114	HWACCMR0DECL(int) VMXR0DisableCpu(PHWACCM_CPUINFO pCpu, void *pvPageCpu, RTHCPHYS pPageCpuPhys)
115	{
116	AssertReturn(pPageCpuPhys, VERR_INVALID_PARAMETER);
117	AssertReturn(pvPageCpu, VERR_INVALID_PARAMETER);
118
119	/* Leave VMX Root Mode. */
120	VMXDisable();
121
122	/* And clear the X86_CR4_VMXE bit */
123	ASMSetCR4(ASMGetCR4() & ~X86_CR4_VMXE);
124
125	#ifdef LOG_ENABLED
126	SUPR0Printf("VMXR0DisableCpu cpu %d\n", pCpu->idCpu);
127	#endif
128	return VINF_SUCCESS;
129	}
130
131	/**
132	* Does Ring-0 per VM VT-x init.
133	*
134	* @returns VBox status code.
135	* @param pVM The VM to operate on.
136	*/
137	HWACCMR0DECL(int) VMXR0InitVM(PVM pVM)
138	{
139	int rc;
140
141	#ifdef LOG_ENABLED
142	SUPR0Printf("VMXR0InitVM %x\n", pVM);
143	#endif
144	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
145	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
146
147
148	/* Allocate one page for the VM control structure (VMCS). */
149	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjVMCS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
150	AssertRC(rc);
151	if (RT_FAILURE(rc))
152	return rc;
153
154	pVM->hwaccm.s.vmx.pVMCS = RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjVMCS);
155	pVM->hwaccm.s.vmx.pVMCSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjVMCS, 0);
156	ASMMemZero32(pVM->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
157
158	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
159	{
160	/* Allocate one page for the virtual APIC mmio cache. */
161	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjAPIC, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
162	AssertRC(rc);
163	if (RT_FAILURE(rc))
164	return rc;
165
166	pVM->hwaccm.s.vmx.pAPIC = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjAPIC);
167	pVM->hwaccm.s.vmx.pAPICPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjAPIC, 0);
168	ASMMemZero32(pVM->hwaccm.s.vmx.pAPIC, PAGE_SIZE);
169	}
170	else
171	{
172	pVM->hwaccm.s.vmx.pMemObjAPIC = 0;
173	pVM->hwaccm.s.vmx.pAPIC = 0;
174	pVM->hwaccm.s.vmx.pAPICPhys = 0;
175	}
176
177	/* Allocate the MSR bitmap if this feature is supported. */
178	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
179	{
180	rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
181	AssertRC(rc);
182	if (RT_FAILURE(rc))
183	return rc;
184
185	pVM->hwaccm.s.vmx.pMSRBitmap = (uint8_t *)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjMSRBitmap);
186	pVM->hwaccm.s.vmx.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, 0);
187	memset(pVM->hwaccm.s.vmx.pMSRBitmap, 0xff, PAGE_SIZE);
188	}
189
190	/* Current guest paging mode. */
191	pVM->hwaccm.s.vmx.enmCurrGuestMode = PGMMODE_REAL;
192
193	#ifdef LOG_ENABLED
194	SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVM->hwaccm.s.vmx.pVMCS, (uint32_t)pVM->hwaccm.s.vmx.pVMCSPhys);
195	#endif
196	return VINF_SUCCESS;
197	}
198
199	/**
200	* Does Ring-0 per VM VT-x termination.
201	*
202	* @returns VBox status code.
203	* @param pVM The VM to operate on.
204	*/
205	HWACCMR0DECL(int) VMXR0TermVM(PVM pVM)
206	{
207	if (pVM->hwaccm.s.vmx.pMemObjVMCS != NIL_RTR0MEMOBJ)
208	{
209	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjVMCS, false);
210	pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
211	pVM->hwaccm.s.vmx.pVMCS = 0;
212	pVM->hwaccm.s.vmx.pVMCSPhys = 0;
213	}
214	if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
215	{
216	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjAPIC, false);
217	pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
218	pVM->hwaccm.s.vmx.pAPIC = 0;
219	pVM->hwaccm.s.vmx.pAPICPhys = 0;
220	}
221	if (pVM->hwaccm.s.vmx.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
222	{
223	RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjMSRBitmap, false);
224	pVM->hwaccm.s.vmx.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
225	pVM->hwaccm.s.vmx.pMSRBitmap = 0;
226	pVM->hwaccm.s.vmx.pMSRBitmapPhys = 0;
227	}
228	return VINF_SUCCESS;
229	}
230
231	/**
232	* Sets up VT-x for the specified VM
233	*
234	* @returns VBox status code.
235	* @param pVM The VM to operate on.
236	*/
237	HWACCMR0DECL(int) VMXR0SetupVM(PVM pVM)
238	{
239	int rc = VINF_SUCCESS;
240	uint32_t val;
241
242	AssertReturn(pVM, VERR_INVALID_PARAMETER);
243	Assert(pVM->hwaccm.s.vmx.pVMCS);
244
245	/* Set revision dword at the beginning of the VMCS structure. */
246	(uint32_t )pVM->hwaccm.s.vmx.pVMCS = MSR_IA32_VMX_BASIC_INFO_VMCS_ID(pVM->hwaccm.s.vmx.msr.vmx_basic_info);
247
248	/* Clear VM Control Structure. */
249	Log(("pVMCSPhys = %VHp\n", pVM->hwaccm.s.vmx.pVMCSPhys));
250	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
251	if (VBOX_FAILURE(rc))
252	goto vmx_end;
253
254	/* Activate the VM Control Structure. */
255	rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
256	if (VBOX_FAILURE(rc))
257	goto vmx_end;
258
259	/* VMX_VMCS_CTRL_PIN_EXEC_CONTROLS
260	* Set required bits to one and zero according to the MSR capabilities.
261	*/
262	val = pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0;
263	/* External and non-maskable interrupts cause VM-exits. */
264	val = val \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_EXT_INT_EXIT \| VMX_VMCS_CTRL_PIN_EXEC_CONTROLS_NMI_EXIT;
265	val &= pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1;
266
267	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, val);
268	AssertRC(rc);
269
270	/* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS
271	* Set required bits to one and zero according to the MSR capabilities.
272	*/
273	val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0;
274	/* Program which event cause VM-exits and which features we want to use. */
275	val = val \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_HLT_EXIT
276	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_TSC_OFFSET
277	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_INVLPG_EXIT
278	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT
279	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_UNCOND_IO_EXIT
280	\| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT; /* don't execute mwait or else we'll idle inside the guest (host thinks the cpu load is high) */
281
282	/* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MWAIT_EXIT might cause a vmlaunch failure with an invalid control fields error. (combined with some other exit reasons) */
283
284	#if HC_ARCH_BITS == 64
285	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
286	{
287	/* CR8 reads from the APIC shadow page; writes cause an exit is they lower the TPR below the threshold */
288	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW;
289	Assert(pVM->hwaccm.s.vmx.pAPIC);
290	}
291	else
292	/* Exit on CR8 reads & writes in case the TPR shadow feature isn't present. */
293	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_STORE_EXIT \| VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR8_LOAD_EXIT;
294	#endif
295
296	#ifdef VBOX_WITH_VTX_MSR_BITMAPS
297	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
298	{
299	Assert(pVM->hwaccm.s.vmx.pMSRBitmapPhys);
300	val \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS;
301	}
302	#endif
303
304	/* We will use the secondary control if it's present. */
305	val \|= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
306
307	/* Mask away the bits that the CPU doesn't support */
308	/** @todo make sure they don't conflict with the above requirements. */
309	val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1;
310	pVM->hwaccm.s.vmx.proc_ctls = val;
311
312	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, val);
313	AssertRC(rc);
314
315	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
316	{
317	/* VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2
318	* Set required bits to one and zero according to the MSR capabilities.
319	*/
320	val = pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.disallowed0;
321	val \|= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;
322
323	/* Mask away the bits that the CPU doesn't support */
324	/** @todo make sure they don't conflict with the above requirements. */
325	val &= pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1;
326
327	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS2, val);
328	AssertRC(rc);
329	}
330
331	/* VMX_VMCS_CTRL_CR3_TARGET_COUNT
332	* Set required bits to one and zero according to the MSR capabilities.
333	*/
334	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR3_TARGET_COUNT, 0);
335	AssertRC(rc);
336
337	/* VMX_VMCS_CTRL_EXIT_CONTROLS
338	* Set required bits to one and zero according to the MSR capabilities.
339	*/
340	val = pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0;
341	#if HC_ARCH_BITS == 64
342	val \|= VMX_VMCS_CTRL_EXIT_CONTROLS_HOST_AMD64;
343	#else
344	/* else Must be zero when AMD64 is not available. */
345	#endif
346	val &= pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1;
347	/* Don't acknowledge external interrupts on VM-exit. */
348	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, val);
349	AssertRC(rc);
350
351	/* Forward all exception except #NM & #PF to the guest.
352	* We always need to check pagefaults since our shadow page table can be out of sync.
353	* And we always lazily sync the FPU & XMM state.
354	*/
355
356	/** @todo Possible optimization:
357	* Keep the FPU and XMM state current in the EM thread. That way there's no need to
358	* lazily sync anything, but the downside is that we can't use the FPU stack or XMM
359	* registers ourselves of course.
360	*
361	* Note: only possible if the current state is actually ours (X86_CR0_TS flag)
362	*/
363	pVM->hwaccm.s.vmx.u32TrapMask = HWACCM_VMX_TRAP_MASK;
364	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, pVM->hwaccm.s.vmx.u32TrapMask);
365	AssertRC(rc);
366
367	/* Don't filter page faults; all of them should cause a switch. */
368	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MASK, 0);
369	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_PAGEFAULT_ERROR_MATCH, 0);
370	AssertRC(rc);
371
372	/* Init TSC offset to zero. */
373	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, 0);
374	#if HC_ARCH_BITS == 32
375	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, 0);
376	#endif
377	AssertRC(rc);
378
379	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_FULL, 0);
380	#if HC_ARCH_BITS == 32
381	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_A_HIGH, 0);
382	#endif
383	AssertRC(rc);
384
385	rc = VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_FULL, 0);
386	#if HC_ARCH_BITS == 32
387	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_IO_BITMAP_B_HIGH, 0);
388	#endif
389	AssertRC(rc);
390
391	/* Set the MSR bitmap address. */
392	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_MSR_BITMAPS)
393	{
394	/* Optional */
395	rc = VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_FULL, pVM->hwaccm.s.vmx.pMSRBitmapPhys);
396	#if HC_ARCH_BITS == 32
397	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_MSR_BITMAP_HIGH, pVM->hwaccm.s.vmx.pMSRBitmapPhys >> 32);
398	#endif
399	AssertRC(rc);
400	}
401
402	/* Clear MSR controls. */
403	rc = VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_FULL, 0);
404	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_FULL, 0);
405	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMENTRY_MSR_LOAD_FULL, 0);
406	#if HC_ARCH_BITS == 32
407	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_STORE_HIGH, 0);
408	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
409	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VMEXIT_MSR_LOAD_HIGH, 0);
410	#endif
411	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_STORE_COUNT, 0);
412	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_EXIT_MSR_LOAD_COUNT, 0);
413	AssertRC(rc);
414
415	if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
416	{
417	Assert(pVM->hwaccm.s.vmx.pMemObjAPIC);
418	/* Optional */
419	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, 0);
420	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_FULL, pVM->hwaccm.s.vmx.pAPICPhys);
421	#if HC_ARCH_BITS == 32
422	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_VAPIC_PAGEADDR_HIGH, pVM->hwaccm.s.vmx.pAPICPhys >> 32);
423	#endif
424	AssertRC(rc);
425	}
426
427	/* Set link pointer to -1. Not currently used. */
428	#if HC_ARCH_BITS == 32
429	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFF);
430	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_HIGH, 0xFFFFFFFF);
431	#else
432	rc = VMXWriteVMCS(VMX_VMCS_GUEST_LINK_PTR_FULL, 0xFFFFFFFFFFFFFFFF);
433	#endif
434	AssertRC(rc);
435
436	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
437	rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
438	AssertRC(rc);
439
440	vmx_end:
441	VMXR0CheckError(pVM, rc);
442	return rc;
443	}
444
445
446	/**
447	* Injects an event (trap or external interrupt)
448	*
449	* @returns VBox status code.
450	* @param pVM The VM to operate on.
451	* @param pCtx CPU Context
452	* @param intInfo VMX interrupt info
453	* @param cbInstr Opcode length of faulting instruction
454	* @param errCode Error code (optional)
455	*/
456	static int VMXR0InjectEvent(PVM pVM, CPUMCTX *pCtx, uint32_t intInfo, uint32_t cbInstr, uint32_t errCode)
457	{
458	int rc;
459
460	#ifdef VBOX_STRICT
461	uint32_t iGate = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
462	if (iGate == 0xE)
463	LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x CR2=%08x intInfo=%08x\n", iGate, pCtx->rip, errCode, pCtx->cr2, intInfo));
464	else
465	if (iGate < 0x20)
466	LogFlow(("VMXR0InjectEvent: Injecting interrupt %d at %VGv error code=%08x\n", iGate, pCtx->rip, errCode));
467	else
468	{
469	LogFlow(("INJ-EI: %x at %VGv\n", iGate, pCtx->rip));
470	Assert(!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS));
471	Assert(pCtx->eflags.u32 & X86_EFL_IF);
472	}
473	#endif
474
475	#ifdef HWACCM_VMX_EMULATE_REALMODE
476	if (CPUMIsGuestInRealModeEx(pCtx))
477	{
478	/* Injecting events doesn't work right with real mode emulation.
479	* (#GP if we try to inject external hardware interrupts)
480	* Fake an 'int x' instruction. Note that we need to take special precautions when
481	* the inject is interrupted as the normal pending event method seems to be broken in this case.
482	*/
483	LogFlow(("Fake 'int %x' inject (real mode)\n", iGate));
484	/* Make sure the return address is set to the current IP. (ugly hack alert) */
485	pCtx->rip--;
486	cbInstr = 1;
487	intInfo = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo) \| (VMX_EXIT_INTERRUPTION_INFO_TYPE_SW << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
488
489	pVM->hwaccm.s.vmx.RealMode.Event.intInfo = intInfo;
490	pVM->hwaccm.s.vmx.RealMode.Event.fPending = true;
491	pVM->hwaccm.s.vmx.RealMode.eip = pCtx->eip;
492	}
493	#endif /* HWACCM_VMX_EMULATE_REALMODE */
494
495	/* Set event injection state. */
496	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_IRQ_INFO, intInfo \| (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT));
497
498	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
499	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_EXCEPTION_ERRCODE, errCode);
500
501	AssertRC(rc);
502	return rc;
503	}
504
505
506	/**
507	* Checks for pending guest interrupts and injects them
508	*
509	* @returns VBox status code.
510	* @param pVM The VM to operate on.
511	* @param pCtx CPU Context
512	*/
513	static int VMXR0CheckPendingInterrupt(PVM pVM, CPUMCTX *pCtx)
514	{
515	int rc;
516
517	/* Dispatch any pending interrupts. (injected before, but a VM exit occurred prematurely) */
518	if (pVM->hwaccm.s.Event.fPending)
519	{
520	Log(("Reinjecting event %VX64 %08x at %VGv cr2=%RX64\n", pVM->hwaccm.s.Event.intInfo, pVM->hwaccm.s.Event.errCode, pCtx->rip, pCtx->cr2));
521	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntReinject);
522	rc = VMXR0InjectEvent(pVM, pCtx, pVM->hwaccm.s.Event.intInfo, 0, pVM->hwaccm.s.Event.errCode);
523	AssertRC(rc);
524
525	pVM->hwaccm.s.Event.fPending = false;
526	return VINF_SUCCESS;
527	}
528
529	/* When external interrupts are pending, we should exit the VM when IF is set. */
530	if ( !TRPMHasTrap(pVM)
531	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
532	{
533	if (!(pCtx->eflags.u32 & X86_EFL_IF))
534	{
535	if (!(pVM->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT))
536	{
537	LogFlow(("Enable irq window exit!\n"));
538	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
539	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
540	AssertRC(rc);
541	}
542	/* else nothing to do but wait */
543	}
544	else
545	if (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
546	{
547	uint8_t u8Interrupt;
548
549	rc = PDMGetInterrupt(pVM, &u8Interrupt);
550	Log(("Dispatch interrupt: u8Interrupt=%x (%d) rc=%Vrc cs:eip=%04X:%VGv\n", u8Interrupt, u8Interrupt, rc, pCtx->cs, pCtx->rip));
551	if (VBOX_SUCCESS(rc))
552	{
553	rc = TRPMAssertTrap(pVM, u8Interrupt, TRPM_HARDWARE_INT);
554	AssertRC(rc);
555	}
556	else
557	{
558	/* Can only happen in rare cases where a pending interrupt is cleared behind our back */
559	Assert(!VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)));
560	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchGuestIrq);
561	/* Just continue */
562	}
563	}
564	else
565	Log(("Pending interrupt blocked at %VGv by VM_FF_INHIBIT_INTERRUPTS!!\n", pCtx->rip));
566	}
567
568	#ifdef VBOX_STRICT
569	if (TRPMHasTrap(pVM))
570	{
571	uint8_t u8Vector;
572	rc = TRPMQueryTrapAll(pVM, &u8Vector, 0, 0, 0);
573	AssertRC(rc);
574	}
575	#endif
576
577	if ( pCtx->eflags.u32 & X86_EFL_IF
578	&& (!VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
579	&& TRPMHasTrap(pVM)
580	)
581	{
582	uint8_t u8Vector;
583	int rc;
584	TRPMEVENT enmType;
585	RTGCUINTPTR intInfo;
586	RTGCUINT errCode;
587
588	/* If a new event is pending, then dispatch it now. */
589	rc = TRPMQueryTrapAll(pVM, &u8Vector, &enmType, &errCode, 0);
590	AssertRC(rc);
591	Assert(pCtx->eflags.Bits.u1IF == 1 \|\| enmType == TRPM_TRAP);
592	Assert(enmType != TRPM_SOFTWARE_INT);
593
594	/* Clear the pending trap. */
595	rc = TRPMResetTrap(pVM);
596	AssertRC(rc);
597
598	intInfo = u8Vector;
599	intInfo \|= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
600
601	if (enmType == TRPM_TRAP)
602	{
603	switch (u8Vector) {
604	case 8:
605	case 10:
606	case 11:
607	case 12:
608	case 13:
609	case 14:
610	case 17:
611	/* Valid error codes. */
612	intInfo \|= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
613	break;
614	default:
615	break;
616	}
617	if (u8Vector == X86_XCPT_BP \|\| u8Vector == X86_XCPT_OF)
618	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
619	else
620	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
621	}
622	else
623	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
624
625	STAM_COUNTER_INC(&pVM->hwaccm.s.StatIntInject);
626	rc = VMXR0InjectEvent(pVM, pCtx, intInfo, 0, errCode);
627	AssertRC(rc);
628	} /* if (interrupts can be dispatched) */
629
630	return VINF_SUCCESS;
631	}
632
633	/**
634	* Save the host state
635	*
636	* @returns VBox status code.
637	* @param pVM The VM to operate on.
638	*/
639	HWACCMR0DECL(int) VMXR0SaveHostState(PVM pVM)
640	{
641	int rc = VINF_SUCCESS;
642
643	/*
644	* Host CPU Context
645	*/
646	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_HOST_CONTEXT)
647	{
648	RTIDTR idtr;
649	RTGDTR gdtr;
650	RTSEL SelTR;
651	PX86DESCHC pDesc;
652	uintptr_t trBase;
653
654	/* Control registers */
655	rc = VMXWriteVMCS(VMX_VMCS_HOST_CR0, ASMGetCR0());
656	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR3, ASMGetCR3());
657	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_CR4, ASMGetCR4());
658	AssertRC(rc);
659	Log2(("VMX_VMCS_HOST_CR0 %08x\n", ASMGetCR0()));
660	Log2(("VMX_VMCS_HOST_CR3 %VHp\n", ASMGetCR3()));
661	Log2(("VMX_VMCS_HOST_CR4 %08x\n", ASMGetCR4()));
662
663	/* Selector registers. */
664	rc = VMXWriteVMCS(VMX_VMCS_HOST_FIELD_CS, ASMGetCS());
665	/* Note: VMX is (again) very picky about the RPL of the selectors here; we'll restore them manually. */
666	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_DS, 0);
667	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_ES, 0);
668	#if HC_ARCH_BITS == 32
669	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_FS, 0);
670	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_GS, 0);
671	#endif
672	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_SS, ASMGetSS());
673	SelTR = ASMGetTR();
674	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_FIELD_TR, SelTR);
675	AssertRC(rc);
676	Log2(("VMX_VMCS_HOST_FIELD_CS %08x\n", ASMGetCS()));
677	Log2(("VMX_VMCS_HOST_FIELD_DS %08x\n", ASMGetDS()));
678	Log2(("VMX_VMCS_HOST_FIELD_ES %08x\n", ASMGetES()));
679	Log2(("VMX_VMCS_HOST_FIELD_FS %08x\n", ASMGetFS()));
680	Log2(("VMX_VMCS_HOST_FIELD_GS %08x\n", ASMGetGS()));
681	Log2(("VMX_VMCS_HOST_FIELD_SS %08x\n", ASMGetSS()));
682	Log2(("VMX_VMCS_HOST_FIELD_TR %08x\n", ASMGetTR()));
683
684	/* GDTR & IDTR */
685	ASMGetGDTR(&gdtr);
686	rc = VMXWriteVMCS(VMX_VMCS_HOST_GDTR_BASE, gdtr.pGdt);
687	ASMGetIDTR(&idtr);
688	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_IDTR_BASE, idtr.pIdt);
689	AssertRC(rc);
690	Log2(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", gdtr.pGdt));
691	Log2(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", idtr.pIdt));
692
693	/* Save the base address of the TR selector. */
694	if (SelTR > gdtr.cbGdt)
695	{
696	AssertMsgFailed(("Invalid TR selector %x. GDTR.cbGdt=%x\n", SelTR, gdtr.cbGdt));
697	return VERR_VMX_INVALID_HOST_STATE;
698	}
699
700	pDesc = &((PX86DESCHC)gdtr.pGdt)[SelTR >> X86_SEL_SHIFT_HC];
701	#if HC_ARCH_BITS == 64
702	trBase = X86DESC64_BASE(*pDesc);
703	#else
704	trBase = X86DESC_BASE(*pDesc);
705	#endif
706	rc = VMXWriteVMCS(VMX_VMCS_HOST_TR_BASE, trBase);
707	AssertRC(rc);
708	Log2(("VMX_VMCS_HOST_TR_BASE %VHv\n", trBase));
709
710	/* FS and GS base. */
711	#if HC_ARCH_BITS == 64
712	Log2(("MSR_K8_FS_BASE = %VHv\n", ASMRdMsr(MSR_K8_FS_BASE)));
713	Log2(("MSR_K8_GS_BASE = %VHv\n", ASMRdMsr(MSR_K8_GS_BASE)));
714	rc = VMXWriteVMCS64(VMX_VMCS_HOST_FS_BASE, ASMRdMsr(MSR_K8_FS_BASE));
715	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_GS_BASE, ASMRdMsr(MSR_K8_GS_BASE));
716	#endif
717	AssertRC(rc);
718
719	/* Sysenter MSRs. */
720	/** @todo expensive!! */
721	rc = VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
722	Log2(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_CS)));
723	#if HC_ARCH_BITS == 32
724	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
725	rc \|= VMXWriteVMCS(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
726	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP)));
727	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP)));
728	#else
729	Log2(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_EIP)));
730	Log2(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", ASMRdMsr(MSR_IA32_SYSENTER_ESP)));
731	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
732	rc \|= VMXWriteVMCS64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
733	#endif
734	AssertRC(rc);
735
736	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_HOST_CONTEXT;
737	}
738	return rc;
739	}
740
741
742	/**
743	* Loads the guest state
744	*
745	* NOTE: Don't do anything here that can cause a jump back to ring 3!!!!!
746	*
747	* @returns VBox status code.
748	* @param pVM The VM to operate on.
749	* @param pCtx Guest context
750	*/
751	HWACCMR0DECL(int) VMXR0LoadGuestState(PVM pVM, CPUMCTX *pCtx)
752	{
753	int rc = VINF_SUCCESS;
754	RTGCUINTPTR val;
755	X86EFLAGS eflags;
756
757	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
758	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_SEGMENT_REGS)
759	{
760	#ifdef HWACCM_VMX_EMULATE_REALMODE
761	PGMMODE enmGuestMode = PGMGetGuestMode(pVM);
762	if (pVM->hwaccm.s.vmx.enmCurrGuestMode != enmGuestMode)
763	{
764	# define VTX_CORRECT_PROT_SEL(reg) \
765	{ \
766	if ( pCtx->reg##Hid.u64Base == (pVM->hwaccm.s.vmx.RealMode.reg##Hid.u64Base & 0xfffff) \
767	&& pCtx->reg == ((pVM->hwaccm.s.vmx.RealMode.reg##Hid.u64Base >> 4) & ~X86_SEL_RPL)) \
768	{ \
769	pCtx->reg##Hid = pVM->hwaccm.s.vmx.RealMode.reg##Hid; \
770	pCtx->reg = pVM->hwaccm.s.vmx.RealMode.reg; \
771	} \
772	}
773
774	/* Correct weird requirements for switching to protected mode. */
775	if ( pVM->hwaccm.s.vmx.enmCurrGuestMode == PGMMODE_REAL
776	&& enmGuestMode >= PGMMODE_PROTECTED)
777	{
778	/* DPL of all hidden selector registers must match the current CPL (0). */
779	pCtx->csHid.Attr.n.u2Dpl = 0;
780	pCtx->csHid.Attr.n.u4Type = X86_SEL_TYPE_CODE \| X86_SEL_TYPE_RW_ACC;
781
782	pCtx->dsHid.Attr.n.u2Dpl = 0;
783	pCtx->esHid.Attr.n.u2Dpl = 0;
784	pCtx->fsHid.Attr.n.u2Dpl = 0;
785	pCtx->gsHid.Attr.n.u2Dpl = 0;
786	pCtx->ssHid.Attr.n.u2Dpl = 0;
787
788	/* RPL of all selectors must match the current CPL (0). */
789	pCtx->cs &= ~X86_SEL_RPL;
790	pCtx->ds &= ~X86_SEL_RPL;
791	pCtx->es &= ~X86_SEL_RPL;
792	pCtx->fs &= ~X86_SEL_RPL;
793	pCtx->gs &= ~X86_SEL_RPL;
794	pCtx->ss &= ~X86_SEL_RPL;
795
796	if (pVM->hwaccm.s.vmx.RealMode.fValid)
797	{
798	VTX_CORRECT_PROT_SEL(ds);
799	VTX_CORRECT_PROT_SEL(es);
800	VTX_CORRECT_PROT_SEL(fs);
801	VTX_CORRECT_PROT_SEL(gs);
802	VTX_CORRECT_PROT_SEL(ss);
803	pVM->hwaccm.s.vmx.RealMode.fValid = false;
804	}
805	}
806	else
807	/* Switching from protected mode to real mode. */
808	if ( pVM->hwaccm.s.vmx.enmCurrGuestMode >= PGMMODE_PROTECTED
809	&& enmGuestMode == PGMMODE_REAL)
810	{
811	/* Save the original hidden selectors in case we need to restore them later on. */
812	pVM->hwaccm.s.vmx.RealMode.ds = pCtx->ds;
813	pVM->hwaccm.s.vmx.RealMode.dsHid = pCtx->dsHid;
814	pVM->hwaccm.s.vmx.RealMode.es = pCtx->es;
815	pVM->hwaccm.s.vmx.RealMode.esHid = pCtx->esHid;
816	pVM->hwaccm.s.vmx.RealMode.fs = pCtx->fs;
817	pVM->hwaccm.s.vmx.RealMode.fsHid = pCtx->fsHid;
818	pVM->hwaccm.s.vmx.RealMode.gs = pCtx->gs;
819	pVM->hwaccm.s.vmx.RealMode.gsHid = pCtx->gsHid;
820	pVM->hwaccm.s.vmx.RealMode.ss = pCtx->ss;
821	pVM->hwaccm.s.vmx.RealMode.ssHid = pCtx->ssHid;
822	pVM->hwaccm.s.vmx.RealMode.fValid = true;
823
824	/* The selector value & base must be adjusted or else... */
825	pCtx->cs = pCtx->csHid.u64Base >> 4;
826	pCtx->ds = pCtx->dsHid.u64Base >> 4;
827	pCtx->es = pCtx->esHid.u64Base >> 4;
828	pCtx->fs = pCtx->fsHid.u64Base >> 4;
829	pCtx->gs = pCtx->gsHid.u64Base >> 4;
830	pCtx->ss = pCtx->ssHid.u64Base >> 4;
831
832	/* The limit must also be adjusted. */
833	pCtx->csHid.u32Limit &= 0xffff;
834	pCtx->dsHid.u32Limit &= 0xffff;
835	pCtx->esHid.u32Limit &= 0xffff;
836	pCtx->fsHid.u32Limit &= 0xffff;
837	pCtx->gsHid.u32Limit &= 0xffff;
838	pCtx->ssHid.u32Limit &= 0xffff;
839
840	Assert(pCtx->dsHid.u64Base <= 0xfffff);
841	Assert(pCtx->esHid.u64Base <= 0xfffff);
842	Assert(pCtx->fsHid.u64Base <= 0xfffff);
843	Assert(pCtx->gsHid.u64Base <= 0xfffff);
844	}
845	pVM->hwaccm.s.vmx.enmCurrGuestMode = enmGuestMode;
846	}
847	else
848	/* VT-x will fail with a guest invalid state otherwise... (CPU state after a reset) */
849	if ( CPUMIsGuestInRealModeEx(pCtx)
850	&& pCtx->csHid.u64Base == 0xffff0000)
851	{
852	pCtx->csHid.u64Base = 0xf0000;
853	pCtx->cs = 0xf000;
854	}
855	#endif /* HWACCM_VMX_EMULATE_REALMODE */
856
857	VMX_WRITE_SELREG(ES, es);
858	AssertRC(rc);
859
860	VMX_WRITE_SELREG(CS, cs);
861	AssertRC(rc);
862
863	VMX_WRITE_SELREG(SS, ss);
864	AssertRC(rc);
865
866	VMX_WRITE_SELREG(DS, ds);
867	AssertRC(rc);
868
869	/* The base values in the hidden fs & gs registers are not in sync with the msrs; they are cut to 32 bits. */
870	VMX_WRITE_SELREG(FS, fs);
871	AssertRC(rc);
872
873	VMX_WRITE_SELREG(GS, gs);
874	AssertRC(rc);
875	}
876
877	/* Guest CPU context: LDTR. */
878	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_LDTR)
879	{
880	if (pCtx->ldtr == 0)
881	{
882	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, 0);
883	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, 0);
884	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, 0);
885	/* Note: vmlaunch will fail with 0 or just 0x02. No idea why. */
886	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, 0x82 /* present, LDT */);
887	}
888	else
889	{
890	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_LDTR, pCtx->ldtr);
891	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_LIMIT, pCtx->ldtrHid.u32Limit);
892	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_BASE, pCtx->ldtrHid.u64Base);
893	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_LDTR_ACCESS_RIGHTS, pCtx->ldtrHid.Attr.u);
894	}
895	AssertRC(rc);
896	}
897	/* Guest CPU context: TR. */
898	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_TR)
899	{
900	#ifdef HWACCM_VMX_EMULATE_REALMODE
901	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
902	if (CPUMIsGuestInRealModeEx(pCtx))
903	{
904	RTGCPHYS GCPhys;
905
906	/* We convert it here every time as pci regions could be reconfigured. */
907	rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
908	AssertRC(rc);
909
910	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, 0);
911	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, HWACCM_VTX_TSS_SIZE);
912	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, GCPhys /* phys = virt in this mode */);
913
914	X86DESCATTR attr;
915
916	attr.u = 0;
917	attr.n.u1Present = 1;
918	attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
919	val = attr.u;
920	}
921	else
922	#endif /* HWACCM_VMX_EMULATE_REALMODE */
923	{
924	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FIELD_TR, pCtx->tr);
925	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT, pCtx->trHid.u32Limit);
926	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE, pCtx->trHid.u64Base);
927
928	val = pCtx->trHid.Attr.u;
929
930	/* The TSS selector must be busy. */
931	if ((val & 0xF) == X86_SEL_TYPE_SYS_286_TSS_AVAIL)
932	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_286_TSS_BUSY;
933	else
934	/* Default even if no TR selector has been set (otherwise vmlaunch will fail!) */
935	val = (val & ~0xF) \| X86_SEL_TYPE_SYS_386_TSS_BUSY;
936
937	}
938	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_TR_ACCESS_RIGHTS, val);
939	AssertRC(rc);
940	}
941	/* Guest CPU context: GDTR. */
942	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_GDTR)
943	{
944	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, pCtx->gdtr.cbGdt);
945	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_GDTR_BASE, pCtx->gdtr.pGdt);
946	AssertRC(rc);
947	}
948	/* Guest CPU context: IDTR. */
949	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_IDTR)
950	{
951	rc = VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, pCtx->idtr.cbIdt);
952	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_IDTR_BASE, pCtx->idtr.pIdt);
953	AssertRC(rc);
954	}
955
956	/*
957	* Sysenter MSRs (unconditional)
958	*/
959	rc = VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_CS, pCtx->SysEnter.cs);
960	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, pCtx->SysEnter.eip);
961	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, pCtx->SysEnter.esp);
962	AssertRC(rc);
963
964	/* Control registers */
965	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR0)
966	{
967	val = pCtx->cr0;
968	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, val);
969	Log2(("Guest CR0-shadow %08x\n", val));
970	if (CPUMIsGuestFPUStateActive(pVM) == false)
971	{
972	/* Always use #NM exceptions to load the FPU/XMM state on demand. */
973	val \|= X86_CR0_TS \| X86_CR0_ET \| X86_CR0_NE \| X86_CR0_MP;
974	}
975	else
976	{
977	/** @todo check if we support the old style mess correctly. */
978	if (!(val & X86_CR0_NE))
979	{
980	Log(("Forcing X86_CR0_NE!!!\n"));
981
982	/* Also catch floating point exceptions as we need to report them to the guest in a different way. */
983	if (!pVM->hwaccm.s.fFPUOldStyleOverride)
984	{
985	pVM->hwaccm.s.vmx.u32TrapMask \|= RT_BIT(X86_XCPT_MF);
986	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, pVM->hwaccm.s.vmx.u32TrapMask);
987	AssertRC(rc);
988	pVM->hwaccm.s.fFPUOldStyleOverride = true;
989	}
990	}
991
992	val \|= X86_CR0_NE; /* always turn on the native mechanism to report FPU errors (old style uses interrupts) */
993	}
994	/* Note: protected mode & paging are always enabled; we use them for emulating real and protected mode without paging too. */
995	val \|= X86_CR0_PE \| X86_CR0_PG;
996	/* Note: We must also set this as we rely on protecting various pages for which supervisor writes must be caught. */
997	val \|= X86_CR0_WP;
998
999	/* Always enable caching. */
1000	val &= ~(X86_CR0_CD\|X86_CR0_NW);
1001
1002	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR0, val);
1003	Log2(("Guest CR0 %08x\n", val));
1004	/* CR0 flags owned by the host; if the guests attempts to change them, then
1005	* the VM will exit.
1006	*/
1007	val = X86_CR0_PE /* Must monitor this bit (assumptions are made for real mode emulation) */
1008	\| X86_CR0_WP /* Must monitor this bit (it must always be enabled). */
1009	\| X86_CR0_PG /* Must monitor this bit (assumptions are made for real mode & protected mode without paging emulation) */
1010	\| X86_CR0_TS
1011	\| X86_CR0_ET /* Bit not restored during VM-exit! */
1012	\| X86_CR0_CD /* Bit not restored during VM-exit! */
1013	\| X86_CR0_NW /* Bit not restored during VM-exit! */
1014	\| X86_CR0_NE
1015	\| X86_CR0_MP;
1016	pVM->hwaccm.s.vmx.cr0_mask = val;
1017
1018	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR0_MASK, val);
1019	Log2(("Guest CR0-mask %08x\n", val));
1020	AssertRC(rc);
1021	}
1022	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR4)
1023	{
1024	/* CR4 */
1025	rc = VMXWriteVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, pCtx->cr4);
1026	Log2(("Guest CR4-shadow %08x\n", pCtx->cr4));
1027	/* Set the required bits in cr4 too (currently X86_CR4_VMXE). */
1028	val = pCtx->cr4 \| (uint32_t)pVM->hwaccm.s.vmx.msr.vmx_cr4_fixed0;
1029	switch(pVM->hwaccm.s.enmShadowMode)
1030	{
1031	case PGMMODE_REAL: /* Real mode -> emulated using v86 mode */
1032	case PGMMODE_PROTECTED: /* Protected mode, no paging -> emulated using identity mapping. */
1033	case PGMMODE_32_BIT: /* 32-bit paging. */
1034	break;
1035
1036	case PGMMODE_PAE: /* PAE paging. */
1037	case PGMMODE_PAE_NX: /* PAE paging with NX enabled. */
1038	/** @todo use normal 32 bits paging */
1039	val \|= X86_CR4_PAE;
1040	break;
1041
1042	case PGMMODE_AMD64: /* 64-bit AMD paging (long mode). */
1043	case PGMMODE_AMD64_NX: /* 64-bit AMD paging (long mode) with NX enabled. */
1044	#ifdef VBOX_ENABLE_64_BITS_GUESTS
1045	break;
1046	#else
1047	AssertFailed();
1048	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1049	#endif
1050	default: /* shut up gcc */
1051	AssertFailed();
1052	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1053	}
1054	#ifdef HWACCM_VMX_EMULATE_REALMODE
1055	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1056	if (CPUMIsGuestInRealModeEx(pCtx))
1057	val \|= X86_CR4_VME;
1058	#endif /* HWACCM_VMX_EMULATE_REALMODE */
1059
1060	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_CR4, val);
1061	Log2(("Guest CR4 %08x\n", val));
1062	/* CR4 flags owned by the host; if the guests attempts to change them, then
1063	* the VM will exit.
1064	*/
1065	val = 0
1066	#ifdef HWACCM_VMX_EMULATE_REALMODE
1067	\| X86_CR4_VME
1068	#endif
1069	\| X86_CR4_PAE
1070	\| X86_CR4_PGE
1071	\| X86_CR4_PSE
1072	\| X86_CR4_VMXE;
1073	pVM->hwaccm.s.vmx.cr4_mask = val;
1074
1075	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_CR4_MASK, val);
1076	Log2(("Guest CR4-mask %08x\n", val));
1077	AssertRC(rc);
1078	}
1079
1080	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_CR3)
1081	{
1082	/* Save our shadow CR3 register. */
1083	val = PGMGetHyperCR3(pVM);
1084	Assert(val);
1085	rc = VMXWriteVMCS(VMX_VMCS_GUEST_CR3, val);
1086	AssertRC(rc);
1087	}
1088
1089	/* Debug registers. */
1090	if (pVM->hwaccm.s.fContextUseFlags & HWACCM_CHANGED_GUEST_DEBUG)
1091	{
1092	pCtx->dr[6] \|= X86_DR6_INIT_VAL; /* set all reserved bits to 1. */
1093	pCtx->dr[6] &= ~RT_BIT(12); /* must be zero. */
1094
1095	pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1096	pCtx->dr[7] &= ~(RT_BIT(11) \| RT_BIT(12) \| RT_BIT(14) \| RT_BIT(15)); /* must be zero */
1097	pCtx->dr[7] \|= 0x400; /* must be one */
1098
1099	/* Resync DR7 */
1100	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1101	AssertRC(rc);
1102
1103	/* Sync the debug state now if any breakpoint is armed. */
1104	if ( (pCtx->dr[7] & (X86_DR7_ENABLED_MASK\|X86_DR7_GD))
1105	&& !CPUMIsGuestDebugStateActive(pVM)
1106	&& !DBGFIsStepping(pVM))
1107	{
1108	STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxArmed);
1109
1110	/* Disable drx move intercepts. */
1111	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
1112	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1113	AssertRC(rc);
1114
1115	/* Save the host and load the guest debug state. */
1116	rc = CPUMR0LoadGuestDebugState(pVM, pCtx, true /* include DR6 */);
1117	AssertRC(rc);
1118	}
1119
1120	/* IA32_DEBUGCTL MSR. */
1121	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_FULL, 0);
1122	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUGCTL_HIGH, 0);
1123	AssertRC(rc);
1124
1125	/** @todo do we really ever need this? */
1126	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_DEBUG_EXCEPTIONS, 0);
1127	AssertRC(rc);
1128	}
1129
1130	/* EIP, ESP and EFLAGS */
1131	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RIP, pCtx->rip);
1132	rc \|= VMXWriteVMCS(VMX_VMCS_GUEST_RSP, pCtx->rsp);
1133	AssertRC(rc);
1134
1135	/* Bits 22-31, 15, 5 & 3 must be zero. Bit 1 must be 1. */
1136	eflags = pCtx->eflags;
1137	eflags.u32 &= VMX_EFLAGS_RESERVED_0;
1138	eflags.u32 \|= VMX_EFLAGS_RESERVED_1;
1139
1140	#ifdef HWACCM_VMX_EMULATE_REALMODE
1141	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1142	if (CPUMIsGuestInRealModeEx(pCtx))
1143	{
1144	eflags.Bits.u1VM = 1;
1145	eflags.Bits.u2IOPL = 3;
1146	}
1147	#endif /* HWACCM_VMX_EMULATE_REALMODE */
1148	rc = VMXWriteVMCS(VMX_VMCS_GUEST_RFLAGS, eflags.u32);
1149	AssertRC(rc);
1150
1151	/* TSC offset. */
1152	uint64_t u64TSCOffset;
1153
1154	if (TMCpuTickCanUseRealTSC(pVM, &u64TSCOffset))
1155	{
1156	/* Note: VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT takes precedence over TSC_OFFSET */
1157	#if HC_ARCH_BITS == 64
1158	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, u64TSCOffset);
1159	#else
1160	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_FULL, (uint32_t)u64TSCOffset);
1161	rc \|= VMXWriteVMCS(VMX_VMCS_CTRL_TSC_OFFSET_HIGH, (uint32_t)(u64TSCOffset >> 32ULL));
1162	#endif
1163	AssertRC(rc);
1164
1165	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1166	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1167	AssertRC(rc);
1168	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCOffset);
1169	}
1170	else
1171	{
1172	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT;
1173	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
1174	AssertRC(rc);
1175	STAM_COUNTER_INC(&pVM->hwaccm.s.StatTSCIntercept);
1176	}
1177
1178	/* VMX_VMCS_CTRL_ENTRY_CONTROLS
1179	* Set required bits to one and zero according to the MSR capabilities.
1180	*/
1181	val = pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0;
1182	/* 64 bits guest mode? */
1183	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1184	val \|= VMX_VMCS_CTRL_ENTRY_CONTROLS_IA64_MODE;
1185	/* else Must be zero when AMD64 is not available. */
1186
1187	/* Mask away the bits that the CPU doesn't support */
1188	val &= pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1;
1189	rc = VMXWriteVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, val);
1190	AssertRC(rc);
1191
1192	/* 64 bits guest mode? */
1193	if (pCtx->msrEFER & MSR_K6_EFER_LMA)
1194	{
1195	#if !defined(VBOX_WITH_64_BITS_GUESTS) \|\| HC_ARCH_BITS != 64
1196	return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
1197	#else
1198	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM64;
1199	#endif
1200	/* Unconditionally update these as wrmsr might have changed them. */
1201	rc = VMXWriteVMCS(VMX_VMCS_GUEST_FS_BASE, pCtx->fsHid.u64Base);
1202	AssertRC(rc);
1203	rc = VMXWriteVMCS(VMX_VMCS_GUEST_GS_BASE, pCtx->gsHid.u64Base);
1204	AssertRC(rc);
1205	}
1206	else
1207	{
1208	pVM->hwaccm.s.vmx.pfnStartVM = VMXR0StartVM32;
1209	}
1210
1211	#ifdef DEBUG
1212	/* Intercept X86_XCPT_DB if stepping is enabled */
1213	if (DBGFIsStepping(pVM))
1214	pVM->hwaccm.s.vmx.u32TrapMask \|= RT_BIT(X86_XCPT_DB);
1215	else
1216	pVM->hwaccm.s.vmx.u32TrapMask &= ~RT_BIT(X86_XCPT_DB);
1217
1218	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, pVM->hwaccm.s.vmx.u32TrapMask);
1219	#endif
1220
1221	#ifdef VBOX_STRICT
1222	Assert(pVM->hwaccm.s.vmx.u32TrapMask & RT_BIT(X86_XCPT_GP));
1223	#else
1224	# ifdef HWACCM_VMX_EMULATE_REALMODE
1225	/* Intercept #GP faults in real mode to handle privileged instructions. */
1226	if (CPUMIsGuestInRealModeEx(pCtx))
1227	pVM->hwaccm.s.vmx.u32TrapMask \|= RT_BIT(X86_XCPT_GP);
1228	else
1229	pVM->hwaccm.s.vmx.u32TrapMask &= ~RT_BIT(X86_XCPT_GP);
1230	# endif /* HWACCM_VMX_EMULATE_REALMODE */
1231	rc = VMXWriteVMCS(VMX_VMCS_CTRL_EXCEPTION_BITMAP, pVM->hwaccm.s.vmx.u32TrapMask);
1232	AssertRC(rc);
1233	#endif
1234
1235	/* Done. */
1236	pVM->hwaccm.s.fContextUseFlags &= ~HWACCM_CHANGED_ALL_GUEST;
1237
1238	return rc;
1239	}
1240
1241	/**
1242	* Runs guest code in a VT-x VM.
1243	*
1244	* @returns VBox status code.
1245	* @param pVM The VM to operate on.
1246	* @param pCtx Guest context
1247	*/
1248	HWACCMR0DECL(int) VMXR0RunGuestCode(PVM pVM, CPUMCTX *pCtx)
1249	{
1250	int rc = VINF_SUCCESS;
1251	RTCCUINTREG val, valShadow;
1252	RTCCUINTREG exitReason, instrError, cbInstr;
1253	RTGCUINTPTR exitQualification;
1254	RTGCUINTPTR intInfo = 0; /* shut up buggy gcc 4 */
1255	RTGCUINTPTR errCode, instrInfo, uInterruptState;
1256	bool fSyncTPR = false;
1257	unsigned cResume = 0;
1258	#ifdef VBOX_STRICT
1259	RTCPUID idCpuCheck;
1260	#endif
1261
1262	Log2(("\nE"));
1263
1264	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatEntry, x);
1265
1266	#ifdef VBOX_STRICT
1267	rc = VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1268	AssertRC(rc);
1269	Log2(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS = %08x\n", val));
1270
1271	/* allowed zero */
1272	if ((val & pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.disallowed0)
1273	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: zero\n"));
1274
1275	/* allowed one */
1276	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_pin_ctls.n.allowed1) != 0)
1277	Log(("Invalid VMX_VMCS_CTRL_PIN_EXEC_CONTROLS: one\n"));
1278
1279	rc = VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1280	AssertRC(rc);
1281	Log2(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS = %08x\n", val));
1282
1283	/* allowed zero */
1284	if ((val & pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.disallowed0)
1285	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: zero\n"));
1286
1287	/* allowed one */
1288	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1) != 0)
1289	Log(("Invalid VMX_VMCS_CTRL_PROC_EXEC_CONTROLS: one\n"));
1290
1291	rc = VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1292	AssertRC(rc);
1293	Log2(("VMX_VMCS_CTRL_ENTRY_CONTROLS = %08x\n", val));
1294
1295	/* allowed zero */
1296	if ((val & pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_entry.n.disallowed0)
1297	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: zero\n"));
1298
1299	/* allowed one */
1300	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_entry.n.allowed1) != 0)
1301	Log(("Invalid VMX_VMCS_CTRL_ENTRY_CONTROLS: one\n"));
1302
1303	rc = VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1304	AssertRC(rc);
1305	Log2(("VMX_VMCS_CTRL_EXIT_CONTROLS = %08x\n", val));
1306
1307	/* allowed zero */
1308	if ((val & pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0) != pVM->hwaccm.s.vmx.msr.vmx_exit.n.disallowed0)
1309	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: zero\n"));
1310
1311	/* allowed one */
1312	if ((val & ~pVM->hwaccm.s.vmx.msr.vmx_exit.n.allowed1) != 0)
1313	Log(("Invalid VMX_VMCS_CTRL_EXIT_CONTROLS: one\n"));
1314	#endif
1315
1316	/* We can jump to this point to resume execution after determining that a VM-exit is innocent.
1317	*/
1318	ResumeExecution:
1319	AssertMsg(pVM->hwaccm.s.idEnteredCpu == RTMpCpuId(),
1320	("Expected %d, I'm %d; cResume=%d exitReason=%RTreg exitQualification=%RTreg\n",
1321	(int)pVM->hwaccm.s.idEnteredCpu, (int)RTMpCpuId(), cResume, exitReason, exitQualification));
1322
1323	/* Safety precaution; looping for too long here can have a very bad effect on the host */
1324	if (++cResume > HWACCM_MAX_RESUME_LOOPS)
1325	{
1326	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitMaxResume);
1327	rc = VINF_EM_RAW_INTERRUPT;
1328	goto end;
1329	}
1330
1331	/* Check for irq inhibition due to instruction fusing (sti, mov ss). */
1332	if (VM_FF_ISSET(pVM, VM_FF_INHIBIT_INTERRUPTS))
1333	{
1334	Log(("VM_FF_INHIBIT_INTERRUPTS at %VGv successor %VGv\n", pCtx->rip, EMGetInhibitInterruptsPC(pVM)));
1335	if (pCtx->rip != EMGetInhibitInterruptsPC(pVM))
1336	{
1337	/* Note: we intentionally don't clear VM_FF_INHIBIT_INTERRUPTS here.
1338	* Before we are able to execute this instruction in raw mode (iret to guest code) an external interrupt might
1339	* force a world switch again. Possibly allowing a guest interrupt to be dispatched in the process. This could
1340	* break the guest. Sounds very unlikely, but such timing sensitive problem are not as rare as you might think.
1341	*/
1342	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1343	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1344	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1345	AssertRC(rc);
1346	}
1347	}
1348	else
1349	{
1350	/* Irq inhibition is no longer active; clear the corresponding VMX state. */
1351	rc = VMXWriteVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, 0);
1352	AssertRC(rc);
1353	}
1354
1355	/* Check for pending actions that force us to go back to ring 3. */
1356	if (VM_FF_ISPENDING(pVM, VM_FF_TO_R3 \| VM_FF_TIMER))
1357	{
1358	VM_FF_CLEAR(pVM, VM_FF_TO_R3);
1359	STAM_COUNTER_INC(&pVM->hwaccm.s.StatSwitchToR3);
1360	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1361	rc = VINF_EM_RAW_TO_R3;
1362	goto end;
1363	}
1364	/* Pending request packets might contain actions that need immediate attention, such as pending hardware interrupts. */
1365	if (VM_FF_ISPENDING(pVM, VM_FF_REQUEST))
1366	{
1367	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1368	rc = VINF_EM_PENDING_REQUEST;
1369	goto end;
1370	}
1371
1372	/* When external interrupts are pending, we should exit the VM when IF is set. */
1373	/* Note! After VM_FF_INHIBIT_INTERRUPTS check!!! */
1374	rc = VMXR0CheckPendingInterrupt(pVM, pCtx);
1375	if (VBOX_FAILURE(rc))
1376	{
1377	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1378	goto end;
1379	}
1380
1381	/** @todo check timers?? */
1382
1383	/* TPR caching using CR8 is only available in 64 bits mode */
1384	/* Note the 32 bits exception for AMD (X86_CPUID_AMD_FEATURE_ECX_CR8L), but that appears missing in Intel CPUs */
1385	/* Note: we can't do this in LoadGuestState as PDMApicGetTPR can jump back to ring 3 (lock)!!!!! */
1386	/**
1387	* @todo reduce overhead
1388	*/
1389	if ( (pCtx->msrEFER & MSR_K6_EFER_LMA)
1390	&& pVM->hwaccm.s.vmx.pAPIC)
1391	{
1392	/* TPR caching in CR8 */
1393	uint8_t u8TPR;
1394	bool fPending;
1395
1396	int rc = PDMApicGetTPR(pVM, &u8TPR, &fPending);
1397	AssertRC(rc);
1398	/* The TPR can be found at offset 0x80 in the APIC mmio page. */
1399	pVM->hwaccm.s.vmx.pAPIC[0x80] = u8TPR << 4; /* bits 7-4 contain the task priority */
1400
1401	/* Two options here:
1402	* - external interrupt pending, but masked by the TPR value.
1403	* -> a CR8 update that lower the current TPR value should cause an exit
1404	* - no pending interrupts
1405	* -> We don't need to be explicitely notified. There are enough world switches for detecting pending interrupts.
1406	*/
1407	rc = VMXWriteVMCS(VMX_VMCS_CTRL_TPR_THRESHOLD, (fPending) ? u8TPR : 0);
1408	AssertRC(rc);
1409
1410	/* Always sync back the TPR; we should optimize this though / /* @todo optimize TPR sync. */
1411	fSyncTPR = true;
1412	}
1413
1414	/*
1415	* NOTE: DO NOT DO ANYTHING AFTER THIS POINT THAT MIGHT JUMP BACK TO RING 3!
1416	* (until the actual world switch)
1417	*/
1418	#ifdef VBOX_STRICT
1419	idCpuCheck = RTMpCpuId();
1420	#endif
1421	/* Save the host state first. */
1422	rc = VMXR0SaveHostState(pVM);
1423	if (rc != VINF_SUCCESS)
1424	{
1425	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1426	goto end;
1427	}
1428	/* Load the guest state */
1429	rc = VMXR0LoadGuestState(pVM, pCtx);
1430	if (rc != VINF_SUCCESS)
1431	{
1432	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1433	goto end;
1434	}
1435
1436	/* Non-register state Guest Context */
1437	/** @todo change me according to cpu state */
1438	rc = VMXWriteVMCS(VMX_VMCS_GUEST_ACTIVITY_STATE, VMX_CMS_GUEST_ACTIVITY_ACTIVE);
1439	AssertRC(rc);
1440
1441	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatEntry, x);
1442
1443	/* Manual save and restore:
1444	* - General purpose registers except RIP, RSP
1445	*
1446	* Trashed:
1447	* - CR2 (we don't care)
1448	* - LDTR (reset to 0)
1449	* - DRx (presumably not changed at all)
1450	* - DR7 (reset to 0x400)
1451	* - EFLAGS (reset to RT_BIT(1); not relevant)
1452	*
1453	*/
1454
1455	/* All done! Let's start VM execution. */
1456	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatInGC, x);
1457	#ifdef VBOX_STRICT
1458	Assert(idCpuCheck == RTMpCpuId());
1459	#endif
1460	TMNotifyStartOfExecution(pVM);
1461	rc = pVM->hwaccm.s.vmx.pfnStartVM(pVM->hwaccm.s.vmx.fResumeVM, pCtx);
1462	TMNotifyEndOfExecution(pVM);
1463
1464	/* In case we execute a goto ResumeExecution later on. */
1465	pVM->hwaccm.s.vmx.fResumeVM = true;
1466
1467	/*
1468	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1469	* IMPORTANT: WE CAN'T DO ANY LOGGING OR OPERATIONS THAT CAN DO A LONGJMP BACK TO RING 3 BEFORE WE'VE SYNCED BACK (MOST OF) THE GUEST STATE
1470	* !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
1471	*/
1472
1473	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatInGC, x);
1474	STAM_PROFILE_ADV_START(&pVM->hwaccm.s.StatExit, x);
1475
1476	switch (rc)
1477	{
1478	case VINF_SUCCESS:
1479	break;
1480
1481	case VERR_VMX_INVALID_VMXON_PTR:
1482	AssertFailed();
1483	goto end;
1484
1485	case VERR_VMX_UNABLE_TO_START_VM:
1486	case VERR_VMX_UNABLE_TO_RESUME_VM:
1487	{
1488	#ifdef VBOX_STRICT
1489	int rc1;
1490
1491	rc1 = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1492	rc1 \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1493	AssertRC(rc1);
1494	if (rc1 == VINF_SUCCESS)
1495	{
1496	RTGDTR gdtr;
1497	PX86DESCHC pDesc;
1498
1499	ASMGetGDTR(&gdtr);
1500
1501	Log(("Unable to start/resume VM for reason: %x. Instruction error %x\n", (uint32_t)exitReason, (uint32_t)instrError));
1502	Log(("Current stack %08x\n", &rc1));
1503
1504
1505	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1506	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
1507	VMXReadVMCS(VMX_VMCS_CTRL_PIN_EXEC_CONTROLS, &val);
1508	Log(("VMX_VMCS_CTRL_PIN_EXEC_CONTROLS %08x\n", val));
1509	VMXReadVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, &val);
1510	Log(("VMX_VMCS_CTRL_PROC_EXEC_CONTROLS %08x\n", val));
1511	VMXReadVMCS(VMX_VMCS_CTRL_ENTRY_CONTROLS, &val);
1512	Log(("VMX_VMCS_CTRL_ENTRY_CONTROLS %08x\n", val));
1513	VMXReadVMCS(VMX_VMCS_CTRL_EXIT_CONTROLS, &val);
1514	Log(("VMX_VMCS_CTRL_EXIT_CONTROLS %08x\n", val));
1515
1516	VMXReadVMCS(VMX_VMCS_HOST_CR0, &val);
1517	Log(("VMX_VMCS_HOST_CR0 %08x\n", val));
1518
1519	VMXReadVMCS(VMX_VMCS_HOST_CR3, &val);
1520	Log(("VMX_VMCS_HOST_CR3 %VHp\n", val));
1521
1522	VMXReadVMCS(VMX_VMCS_HOST_CR4, &val);
1523	Log(("VMX_VMCS_HOST_CR4 %08x\n", val));
1524
1525	VMXReadVMCS(VMX_VMCS_HOST_FIELD_CS, &val);
1526	Log(("VMX_VMCS_HOST_FIELD_CS %08x\n", val));
1527
1528	VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1529	Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
1530
1531	if (val < gdtr.cbGdt)
1532	{
1533	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1534	HWACCMR0DumpDescriptor(pDesc, val, "CS: ");
1535	}
1536
1537	VMXReadVMCS(VMX_VMCS_HOST_FIELD_DS, &val);
1538	Log(("VMX_VMCS_HOST_FIELD_DS %08x\n", val));
1539	if (val < gdtr.cbGdt)
1540	{
1541	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1542	HWACCMR0DumpDescriptor(pDesc, val, "DS: ");
1543	}
1544
1545	VMXReadVMCS(VMX_VMCS_HOST_FIELD_ES, &val);
1546	Log(("VMX_VMCS_HOST_FIELD_ES %08x\n", val));
1547	if (val < gdtr.cbGdt)
1548	{
1549	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1550	HWACCMR0DumpDescriptor(pDesc, val, "ES: ");
1551	}
1552
1553	VMXReadVMCS(VMX_VMCS_HOST_FIELD_FS, &val);
1554	Log(("VMX_VMCS_HOST_FIELD_FS %08x\n", val));
1555	if (val < gdtr.cbGdt)
1556	{
1557	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1558	HWACCMR0DumpDescriptor(pDesc, val, "FS: ");
1559	}
1560
1561	VMXReadVMCS(VMX_VMCS_HOST_FIELD_GS, &val);
1562	Log(("VMX_VMCS_HOST_FIELD_GS %08x\n", val));
1563	if (val < gdtr.cbGdt)
1564	{
1565	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1566	HWACCMR0DumpDescriptor(pDesc, val, "GS: ");
1567	}
1568
1569	VMXReadVMCS(VMX_VMCS_HOST_FIELD_SS, &val);
1570	Log(("VMX_VMCS_HOST_FIELD_SS %08x\n", val));
1571	if (val < gdtr.cbGdt)
1572	{
1573	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1574	HWACCMR0DumpDescriptor(pDesc, val, "SS: ");
1575	}
1576
1577	VMXReadVMCS(VMX_VMCS_HOST_FIELD_TR, &val);
1578	Log(("VMX_VMCS_HOST_FIELD_TR %08x\n", val));
1579	if (val < gdtr.cbGdt)
1580	{
1581	pDesc = &((PX86DESCHC)gdtr.pGdt)[val >> X86_SEL_SHIFT_HC];
1582	HWACCMR0DumpDescriptor(pDesc, val, "TR: ");
1583	}
1584
1585	VMXReadVMCS(VMX_VMCS_HOST_TR_BASE, &val);
1586	Log(("VMX_VMCS_HOST_TR_BASE %VHv\n", val));
1587
1588	VMXReadVMCS(VMX_VMCS_HOST_GDTR_BASE, &val);
1589	Log(("VMX_VMCS_HOST_GDTR_BASE %VHv\n", val));
1590	VMXReadVMCS(VMX_VMCS_HOST_IDTR_BASE, &val);
1591	Log(("VMX_VMCS_HOST_IDTR_BASE %VHv\n", val));
1592
1593	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_CS, &val);
1594	Log(("VMX_VMCS_HOST_SYSENTER_CS %08x\n", val));
1595
1596	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_EIP, &val);
1597	Log(("VMX_VMCS_HOST_SYSENTER_EIP %VHv\n", val));
1598
1599	VMXReadVMCS(VMX_VMCS_HOST_SYSENTER_ESP, &val);
1600	Log(("VMX_VMCS_HOST_SYSENTER_ESP %VHv\n", val));
1601
1602	VMXReadVMCS(VMX_VMCS_HOST_RSP, &val);
1603	Log(("VMX_VMCS_HOST_RSP %VHv\n", val));
1604	VMXReadVMCS(VMX_VMCS_HOST_RIP, &val);
1605	Log(("VMX_VMCS_HOST_RIP %VHv\n", val));
1606
1607	#if HC_ARCH_BITS == 64
1608	Log(("MSR_K6_EFER = %VX64\n", ASMRdMsr(MSR_K6_EFER)));
1609	Log(("MSR_K6_STAR = %VX64\n", ASMRdMsr(MSR_K6_STAR)));
1610	Log(("MSR_K8_LSTAR = %VX64\n", ASMRdMsr(MSR_K8_LSTAR)));
1611	Log(("MSR_K8_CSTAR = %VX64\n", ASMRdMsr(MSR_K8_CSTAR)));
1612	Log(("MSR_K8_SF_MASK = %VX64\n", ASMRdMsr(MSR_K8_SF_MASK)));
1613	#endif
1614	}
1615	#endif /* VBOX_STRICT */
1616	goto end;
1617	}
1618
1619	default:
1620	/* impossible */
1621	AssertFailed();
1622	goto end;
1623	}
1624	/* Success. Query the guest state and figure out what has happened. */
1625
1626	/* Investigate why there was a VM-exit. */
1627	rc = VMXReadVMCS(VMX_VMCS_RO_EXIT_REASON, &exitReason);
1628	STAM_COUNTER_INC(&pVM->hwaccm.s.paStatExitReasonR0[exitReason & MASK_EXITREASON_STAT]);
1629
1630	exitReason &= 0xffff; /* bit 0-15 contain the exit code. */
1631	rc \|= VMXReadVMCS(VMX_VMCS_RO_VM_INSTR_ERROR, &instrError);
1632	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_LENGTH, &cbInstr);
1633	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_INFO, &val);
1634	intInfo = val;
1635	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INTERRUPTION_ERRCODE, &val);
1636	errCode = val; /* might not be valid; depends on VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID. */
1637	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_INSTR_INFO, &val);
1638	instrInfo = val;
1639	rc \|= VMXReadVMCS(VMX_VMCS_RO_EXIT_QUALIFICATION, &val);
1640	exitQualification = val;
1641	AssertRC(rc);
1642
1643	/* Let's first sync back eip, esp, and eflags. */
1644	rc = VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
1645	AssertRC(rc);
1646	pCtx->rip = val;
1647	rc = VMXReadVMCS(VMX_VMCS_GUEST_RSP, &val);
1648	AssertRC(rc);
1649	pCtx->rsp = val;
1650	rc = VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
1651	AssertRC(rc);
1652	pCtx->eflags.u32 = val;
1653
1654	/* Take care of instruction fusing (sti, mov ss) */
1655	rc \|= VMXReadVMCS(VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE, &val);
1656	uInterruptState = val;
1657	if (uInterruptState != 0)
1658	{
1659	Assert(uInterruptState <= 2); /* only sti & mov ss */
1660	Log(("uInterruptState %x eip=%VGv\n", uInterruptState, pCtx->rip));
1661	EMSetInhibitInterruptsPC(pVM, pCtx->rip);
1662	}
1663	else
1664	VM_FF_CLEAR(pVM, VM_FF_INHIBIT_INTERRUPTS);
1665
1666	/* Control registers. */
1667	VMXReadVMCS(VMX_VMCS_CTRL_CR0_READ_SHADOW, &valShadow);
1668	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
1669	val = (valShadow & pVM->hwaccm.s.vmx.cr0_mask) \| (val & ~pVM->hwaccm.s.vmx.cr0_mask);
1670	CPUMSetGuestCR0(pVM, val);
1671
1672	VMXReadVMCS(VMX_VMCS_CTRL_CR4_READ_SHADOW, &valShadow);
1673	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
1674	val = (valShadow & pVM->hwaccm.s.vmx.cr4_mask) \| (val & ~pVM->hwaccm.s.vmx.cr4_mask);
1675	CPUMSetGuestCR4(pVM, val);
1676
1677	CPUMSetGuestCR2(pVM, ASMGetCR2());
1678
1679	/* Sync back DR7 here. */
1680	VMXReadVMCS(VMX_VMCS_GUEST_DR7, &val);
1681	pCtx->dr[7] = val;
1682
1683	/* Guest CPU context: ES, CS, SS, DS, FS, GS. */
1684	VMX_READ_SELREG(ES, es);
1685	VMX_READ_SELREG(SS, ss);
1686	VMX_READ_SELREG(CS, cs);
1687	VMX_READ_SELREG(DS, ds);
1688	VMX_READ_SELREG(FS, fs);
1689	VMX_READ_SELREG(GS, gs);
1690
1691	/*
1692	* System MSRs
1693	*/
1694	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_CS, &val);
1695	pCtx->SysEnter.cs = val;
1696	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_EIP, &val);
1697	pCtx->SysEnter.eip = val;
1698	VMXReadVMCS(VMX_VMCS_GUEST_SYSENTER_ESP, &val);
1699	pCtx->SysEnter.esp = val;
1700
1701	/* Misc. registers; must sync everything otherwise we can get out of sync when jumping to ring 3. */
1702	VMX_READ_SELREG(LDTR, ldtr);
1703
1704	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_LIMIT, &val);
1705	pCtx->gdtr.cbGdt = val;
1706	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
1707	pCtx->gdtr.pGdt = val;
1708
1709	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_LIMIT, &val);
1710	pCtx->idtr.cbIdt = val;
1711	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
1712	pCtx->idtr.pIdt = val;
1713
1714	#ifdef HWACCM_VMX_EMULATE_REALMODE
1715	/* Real mode emulation using v86 mode with CR4.VME (interrupt redirection using the int bitmap in the TSS) */
1716	if (CPUMIsGuestInRealModeEx(pCtx))
1717	{
1718	/* Hide our emulation flags */
1719	pCtx->eflags.Bits.u1VM = 0;
1720	pCtx->eflags.Bits.u2IOPL = 0;
1721
1722	/* Force a TR resync every time in case we switch modes. */
1723	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_TR;
1724	}
1725	else
1726	#endif /* HWACCM_VMX_EMULATE_REALMODE */
1727	{
1728	/* In real mode we have a fake TSS, so only sync it back when it's supposed to be valid. */
1729	VMX_READ_SELREG(TR, tr);
1730	}
1731
1732	/* Note! NOW IT'S SAFE FOR LOGGING! */
1733	Log2(("Raw exit reason %08x\n", exitReason));
1734
1735	/* Check if an injected event was interrupted prematurely. */
1736	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_INFO, &val);
1737	AssertRC(rc);
1738	#ifdef HWACCM_VMX_EMULATE_REALMODE
1739	/* For some reason injected software interrupts are ignored (not signalled as pending) when e.g. a shadow page fault occurs. */
1740	if ( CPUMIsGuestInRealModeEx(pCtx)
1741	&& pVM->hwaccm.s.vmx.RealMode.eip == pCtx->eip
1742	&& pVM->hwaccm.s.vmx.RealMode.Event.fPending)
1743	{
1744	Assert(!VMX_EXIT_INTERRUPTION_INFO_VALID(pVM->hwaccm.s.Event.intInfo));
1745
1746	Log(("Pending real-mode inject %VX64 at %VGv\n", pVM->hwaccm.s.vmx.RealMode.Event.intInfo, pCtx->rip));
1747
1748	/* We faked an 'int x' instruction and messed with IP, so correct it here. */
1749	pCtx->rip++;
1750	pVM->hwaccm.s.Event.intInfo = pVM->hwaccm.s.vmx.RealMode.Event.intInfo;
1751	pVM->hwaccm.s.Event.fPending = true;
1752	}
1753	else
1754	#endif /* HWACCM_VMX_EMULATE_REALMODE */
1755	{
1756	pVM->hwaccm.s.Event.intInfo = VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(val);
1757	if ( VMX_EXIT_INTERRUPTION_INFO_VALID(pVM->hwaccm.s.Event.intInfo)
1758	&& VMX_EXIT_INTERRUPTION_INFO_TYPE(pVM->hwaccm.s.Event.intInfo) != VMX_EXIT_INTERRUPTION_INFO_TYPE_SW)
1759	{
1760	pVM->hwaccm.s.Event.fPending = true;
1761	/* Error code present? */
1762	if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(pVM->hwaccm.s.Event.intInfo))
1763	{
1764	rc = VMXReadVMCS(VMX_VMCS_RO_IDT_ERRCODE, &val);
1765	AssertRC(rc);
1766	pVM->hwaccm.s.Event.errCode = val;
1767	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x pending error=%RX64\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification, val));
1768	}
1769	else
1770	{
1771	Log(("Pending inject %VX64 at %VGv exit=%08x intInfo=%08x exitQualification=%08x\n", pVM->hwaccm.s.Event.intInfo, pCtx->rip, exitReason, intInfo, exitQualification));
1772	pVM->hwaccm.s.Event.errCode = 0;
1773	}
1774	}
1775	}
1776	pVM->hwaccm.s.vmx.RealMode.Event.fPending = false;
1777
1778	#ifdef VBOX_STRICT
1779	if (exitReason == VMX_EXIT_ERR_INVALID_GUEST_STATE)
1780	HWACCMDumpRegs(pVM, pCtx);
1781	#endif
1782
1783	Log2(("E%d", exitReason));
1784	Log2(("Exit reason %d, exitQualification %08x\n", exitReason, exitQualification));
1785	Log2(("instrInfo=%d instrError=%d instr length=%d\n", instrInfo, instrError, cbInstr));
1786	Log2(("Interruption error code %d\n", errCode));
1787	Log2(("IntInfo = %08x\n", intInfo));
1788	Log2(("New EIP=%VGv\n", pCtx->rip));
1789
1790	if (fSyncTPR)
1791	{
1792	rc = PDMApicSetTPR(pVM, pVM->hwaccm.s.vmx.pAPIC[0x80] >> 4);
1793	AssertRC(rc);
1794	}
1795
1796	/* Some cases don't need a complete resync of the guest CPU state; handle them here. */
1797	switch (exitReason)
1798	{
1799	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
1800	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
1801	{
1802	uint32_t vector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(intInfo);
1803
1804	if (!VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
1805	{
1806	Assert(exitReason == VMX_EXIT_EXTERNAL_IRQ);
1807	/* External interrupt; leave to allow it to be dispatched again. */
1808	rc = VINF_EM_RAW_INTERRUPT;
1809	break;
1810	}
1811	switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
1812	{
1813	case VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI: /* Non-maskable interrupt. */
1814	/* External interrupt; leave to allow it to be dispatched again. */
1815	rc = VINF_EM_RAW_INTERRUPT;
1816	break;
1817
1818	case VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT: /* External hardware interrupt. */
1819	AssertFailed(); /* can't come here; fails the first check. */
1820	break;
1821
1822	case VMX_EXIT_INTERRUPTION_INFO_TYPE_SWEXCPT: /* Software exception. (#BP or #OF) */
1823	Assert(vector == 3 \|\| vector == 4);
1824	/* no break */
1825	case VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT: /* Hardware exception. */
1826	Log2(("Hardware/software interrupt %d\n", vector));
1827	switch (vector)
1828	{
1829	case X86_XCPT_NM:
1830	{
1831	Log(("#NM fault at %VGv error code %x\n", pCtx->rip, errCode));
1832
1833	/** @todo don't intercept #NM exceptions anymore when we've activated the guest FPU state. */
1834	/* If we sync the FPU/XMM state on-demand, then we can continue execution as if nothing has happened. */
1835	rc = CPUMR0LoadGuestFPU(pVM, pCtx);
1836	if (rc == VINF_SUCCESS)
1837	{
1838	Assert(CPUMIsGuestFPUStateActive(pVM));
1839
1840	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowNM);
1841
1842	/* Continue execution. */
1843	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1844	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
1845
1846	goto ResumeExecution;
1847	}
1848
1849	Log(("Forward #NM fault to the guest\n"));
1850	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNM);
1851	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, 0);
1852	AssertRC(rc);
1853	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1854	goto ResumeExecution;
1855	}
1856
1857	case X86_XCPT_PF: /* Page fault */
1858	{
1859	Log2(("Page fault at %VGv error code %x\n", exitQualification ,errCode));
1860	/* Exit qualification contains the linear address of the page fault. */
1861	TRPMAssertTrap(pVM, X86_XCPT_PF, TRPM_TRAP);
1862	TRPMSetErrorCode(pVM, errCode);
1863	TRPMSetFaultAddress(pVM, exitQualification);
1864
1865	/* Forward it to our trap handler first, in case our shadow pages are out of sync. */
1866	rc = PGMTrap0eHandler(pVM, errCode, CPUMCTX2CORE(pCtx), (RTGCPTR)exitQualification);
1867	Log2(("PGMTrap0eHandler %VGv returned %Vrc\n", pCtx->rip, rc));
1868	if (rc == VINF_SUCCESS)
1869	{ /* We've successfully synced our shadow pages, so let's just continue execution. */
1870	Log2(("Shadow page fault at %VGv cr2=%VGv error code %x\n", pCtx->rip, exitQualification ,errCode));
1871	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitShadowPF);
1872
1873	TRPMResetTrap(pVM);
1874
1875	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1876	goto ResumeExecution;
1877	}
1878	else
1879	if (rc == VINF_EM_RAW_GUEST_TRAP)
1880	{ /* A genuine pagefault.
1881	* Forward the trap to the guest by injecting the exception and resuming execution.
1882	*/
1883	Log2(("Forward page fault to the guest\n"));
1884
1885	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestPF);
1886	/* The error code might have been changed. */
1887	errCode = TRPMGetErrorCode(pVM);
1888
1889	TRPMResetTrap(pVM);
1890
1891	/* Now we must update CR2. */
1892	pCtx->cr2 = exitQualification;
1893	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1894	AssertRC(rc);
1895
1896	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1897	goto ResumeExecution;
1898	}
1899	#ifdef VBOX_STRICT
1900	if (rc != VINF_EM_RAW_EMULATE_INSTR)
1901	Log2(("PGMTrap0eHandler failed with %d\n", rc));
1902	#endif
1903	/* Need to go back to the recompiler to emulate the instruction. */
1904	TRPMResetTrap(pVM);
1905	break;
1906	}
1907
1908	case X86_XCPT_MF: /* Floating point exception. */
1909	{
1910	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestMF);
1911	if (!(pCtx->cr0 & X86_CR0_NE))
1912	{
1913	/* old style FPU error reporting needs some extra work. */
1914	/** @todo don't fall back to the recompiler, but do it manually. */
1915	rc = VINF_EM_RAW_EMULATE_INSTR;
1916	break;
1917	}
1918	Log(("Trap %x at %VGv\n", vector, pCtx->rip));
1919	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1920	AssertRC(rc);
1921
1922	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1923	goto ResumeExecution;
1924	}
1925
1926	case X86_XCPT_DB: /* Debug exception. */
1927	{
1928	uint64_t uDR6;
1929
1930	/* DR6, DR7.GD and IA32_DEBUGCTL.LBR are not updated yet.
1931	*
1932	* Exit qualification bits:
1933	* 3:0 B0-B3 which breakpoint condition was met
1934	* 12:4 Reserved (0)
1935	* 13 BD - debug register access detected
1936	* 14 BS - single step execution or branch taken
1937	* 63:15 Reserved (0)
1938	*/
1939	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDB);
1940
1941	/* Note that we don't support guest and host-initiated debugging at the same time. */
1942	Assert(DBGFIsStepping(pVM));
1943
1944	uDR6 = X86_DR6_INIT_VAL;
1945	uDR6 \|= (exitQualification & (X86_DR6_B0\|X86_DR6_B1\|X86_DR6_B2\|X86_DR6_B3\|X86_DR6_BD\|X86_DR6_BS));
1946	rc = DBGFR0Trap01Handler(pVM, CPUMCTX2CORE(pCtx), uDR6);
1947	if (rc == VINF_EM_RAW_GUEST_TRAP)
1948	{
1949	/** @todo this isn't working, but we'll never get here normally. */
1950
1951	/* Update DR6 here. */
1952	pCtx->dr[6] = uDR6;
1953
1954	/* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
1955	pCtx->dr[7] &= ~X86_DR7_GD;
1956
1957	/* Paranoia. */
1958	pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
1959	pCtx->dr[7] &= ~(RT_BIT(11) \| RT_BIT(12) \| RT_BIT(14) \| RT_BIT(15)); /* must be zero */
1960	pCtx->dr[7] \|= 0x400; /* must be one */
1961
1962	/* Resync DR7 */
1963	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
1964	AssertRC(rc);
1965
1966	Log(("Trap %x (debug) at %VGv exit qualification %VX64\n", vector, pCtx->rip, exitQualification));
1967	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1968	AssertRC(rc);
1969
1970	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1971	goto ResumeExecution;
1972	}
1973	/* Return to ring 3 to deal with the debug exit code. */
1974	break;
1975	}
1976
1977	case X86_XCPT_GP: /* General protection failure exception.*/
1978	{
1979	uint32_t cbSize;
1980
1981	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestGP);
1982	#ifdef VBOX_STRICT
1983	if (!CPUMIsGuestInRealModeEx(pCtx))
1984	{
1985	Log(("Trap %x at %VGv error code %x\n", vector, pCtx->rip, errCode));
1986	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
1987	AssertRC(rc);
1988	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
1989	goto ResumeExecution;
1990	}
1991	#endif
1992	Assert(CPUMIsGuestInRealModeEx(pCtx));
1993
1994	LogFlow(("Real mode X86_XCPT_GP instruction emulation at %VGv\n", pCtx->rip));
1995	rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
1996	if (rc == VINF_SUCCESS)
1997	{
1998	/* EIP has been updated already. */
1999
2000	/* lidt, lgdt can end up here. In the future crx changes as well. Just reload the whole context to be done with it. */
2001	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_ALL;
2002
2003	/* Only resume if successful. */
2004	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2005	goto ResumeExecution;
2006	}
2007	AssertMsg(rc == VERR_EM_INTERPRETER \|\| rc == VINF_PGM_CHANGE_MODE \|\| rc == VINF_EM_HALT, ("Unexpected rc=%Vrc\n", rc));
2008	break;
2009	}
2010
2011	#ifdef VBOX_STRICT
2012	case X86_XCPT_DE: /* Divide error. */
2013	case X86_XCPT_UD: /* Unknown opcode exception. */
2014	case X86_XCPT_SS: /* Stack segment exception. */
2015	case X86_XCPT_NP: /* Segment not present exception. */
2016	{
2017	switch(vector)
2018	{
2019	case X86_XCPT_DE:
2020	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestDE);
2021	break;
2022	case X86_XCPT_UD:
2023	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestUD);
2024	break;
2025	case X86_XCPT_SS:
2026	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestSS);
2027	break;
2028	case X86_XCPT_NP:
2029	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitGuestNP);
2030	break;
2031	}
2032
2033	Log(("Trap %x at %VGv error code %x\n", vector, pCtx->rip, errCode));
2034	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), cbInstr, errCode);
2035	AssertRC(rc);
2036
2037	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2038	goto ResumeExecution;
2039	}
2040	#endif
2041	default:
2042	AssertMsgFailed(("Unexpected vm-exit caused by exception %x\n", vector));
2043	rc = VERR_VMX_UNEXPECTED_EXCEPTION;
2044	break;
2045	} /* switch (vector) */
2046
2047	break;
2048
2049	default:
2050	rc = VERR_VMX_UNEXPECTED_INTERRUPTION_EXIT_CODE;
2051	AssertFailed();
2052	break;
2053	}
2054
2055	break;
2056	}
2057
2058	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2059	/* Clear VM-exit on IF=1 change. */
2060	LogFlow(("VMX_EXIT_IRQ_WINDOW %VGv pending=%d IF=%d\n", pCtx->rip, VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)), pCtx->eflags.Bits.u1IF));
2061	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_IRQ_WINDOW_EXIT;
2062	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
2063	AssertRC(rc);
2064	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIrqWindow);
2065	goto ResumeExecution; /* we check for pending guest interrupts there */
2066
2067	case VMX_EXIT_WBINVD: /* 54 Guest software attempted to execute WBINVD. (conditional) */
2068	case VMX_EXIT_INVD: /* 13 Guest software attempted to execute INVD. (unconditional) */
2069	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvd);
2070	/* Skip instruction and continue directly. */
2071	pCtx->rip += cbInstr;
2072	/* Continue execution.*/
2073	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2074	goto ResumeExecution;
2075
2076	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2077	{
2078	Log2(("VMX: Cpuid %x\n", pCtx->eax));
2079	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCpuid);
2080	rc = EMInterpretCpuId(pVM, CPUMCTX2CORE(pCtx));
2081	if (rc == VINF_SUCCESS)
2082	{
2083	/* Update EIP and continue execution. */
2084	Assert(cbInstr == 2);
2085	pCtx->rip += cbInstr;
2086	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2087	goto ResumeExecution;
2088	}
2089	AssertMsgFailed(("EMU: cpuid failed with %Vrc\n", rc));
2090	rc = VINF_EM_RAW_EMULATE_INSTR;
2091	break;
2092	}
2093
2094	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2095	{
2096	Log2(("VMX: Rdtsc\n"));
2097	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitRdtsc);
2098	rc = EMInterpretRdtsc(pVM, CPUMCTX2CORE(pCtx));
2099	if (rc == VINF_SUCCESS)
2100	{
2101	/* Update EIP and continue execution. */
2102	Assert(cbInstr == 2);
2103	pCtx->rip += cbInstr;
2104	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2105	goto ResumeExecution;
2106	}
2107	AssertMsgFailed(("EMU: rdtsc failed with %Vrc\n", rc));
2108	rc = VINF_EM_RAW_EMULATE_INSTR;
2109	break;
2110	}
2111
2112	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2113	{
2114	Log2(("VMX: invlpg\n"));
2115	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitInvpg);
2116	rc = EMInterpretInvlpg(pVM, CPUMCTX2CORE(pCtx), exitQualification);
2117	if (rc == VINF_SUCCESS)
2118	{
2119	/* Update EIP and continue execution. */
2120	pCtx->rip += cbInstr;
2121	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2122	goto ResumeExecution;
2123	}
2124	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: invlpg %VGv failed with %Vrc\n", exitQualification, rc));
2125	break;
2126	}
2127
2128	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2129	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2130	{
2131	uint32_t cbSize;
2132
2133	/* Note: the intel manual claims there's a REX version of RDMSR that's slightly different, so we play safe by completely disassembling the instruction. */
2134	Log2(("VMX: %s\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr"));
2135	rc = EMInterpretInstruction(pVM, CPUMCTX2CORE(pCtx), 0, &cbSize);
2136	if (rc == VINF_SUCCESS)
2137	{
2138	/* EIP has been updated already. */
2139
2140	/* Only resume if successful. */
2141	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2142	goto ResumeExecution;
2143	}
2144	AssertMsg(rc == VERR_EM_INTERPRETER, ("EMU: %s failed with %Vrc\n", (exitReason == VMX_EXIT_RDMSR) ? "rdmsr" : "wrmsr", rc));
2145	break;
2146	}
2147
2148	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2149	{
2150	switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
2151	{
2152	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:
2153	Log2(("VMX: %VGv mov cr%d, x\n", pCtx->rip, VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification)));
2154	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxWrite);
2155	rc = EMInterpretCRxWrite(pVM, CPUMCTX2CORE(pCtx),
2156	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification),
2157	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification));
2158
2159	switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification))
2160	{
2161	case 0:
2162	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
2163	break;
2164	case 2:
2165	break;
2166	case 3:
2167	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR3;
2168	break;
2169	case 4:
2170	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR4;
2171	break;
2172	case 8:
2173	/* CR8 contains the APIC TPR */
2174	Assert(!(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2175	break;
2176
2177	default:
2178	AssertFailed();
2179	break;
2180	}
2181	/* Check if a sync operation is pending. */
2182	if ( rc == VINF_SUCCESS /* don't bother if we are going to ring 3 anyway */
2183	&& VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 \| VM_FF_PGM_SYNC_CR3_NON_GLOBAL))
2184	{
2185	rc = PGMSyncCR3(pVM, CPUMGetGuestCR0(pVM), CPUMGetGuestCR3(pVM), CPUMGetGuestCR4(pVM), VM_FF_ISSET(pVM, VM_FF_PGM_SYNC_CR3));
2186	AssertRC(rc);
2187	}
2188	break;
2189
2190	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:
2191	Log2(("VMX: mov x, crx\n"));
2192	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
2193
2194	/* CR8 reads only cause an exit when the TPR shadow feature isn't present. */
2195	Assert(VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != 8 \|\| !(pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW));
2196
2197	rc = EMInterpretCRxRead(pVM, CPUMCTX2CORE(pCtx),
2198	VMX_EXIT_QUALIFICATION_CRX_GENREG(exitQualification),
2199	VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification));
2200	break;
2201
2202	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:
2203	Log2(("VMX: clts\n"));
2204	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCLTS);
2205	rc = EMInterpretCLTS(pVM);
2206	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
2207	break;
2208
2209	case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:
2210	Log2(("VMX: lmsw %x\n", VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification)));
2211	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitLMSW);
2212	rc = EMInterpretLMSW(pVM, VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(exitQualification));
2213	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_CR0;
2214	break;
2215	}
2216
2217	/* Update EIP if no error occurred. */
2218	if (VBOX_SUCCESS(rc))
2219	pCtx->rip += cbInstr;
2220
2221	if (rc == VINF_SUCCESS)
2222	{
2223	/* Only resume if successful. */
2224	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2225	goto ResumeExecution;
2226	}
2227	Assert(rc == VERR_EM_INTERPRETER \|\| rc == VINF_PGM_CHANGE_MODE \|\| rc == VINF_PGM_SYNC_CR3);
2228	break;
2229	}
2230
2231	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2232	{
2233	if (!DBGFIsStepping(pVM))
2234	{
2235	/* Disable drx move intercepts. */
2236	pVM->hwaccm.s.vmx.proc_ctls &= ~VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2237	rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
2238	AssertRC(rc);
2239
2240	/* Save the host and load the guest debug state. */
2241	rc = CPUMR0LoadGuestDebugState(pVM, pCtx, true /* include DR6 */);
2242	AssertRC(rc);
2243
2244	#ifdef VBOX_WITH_STATISTICS
2245	STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxContextSwitch);
2246	if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2247	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxWrite);
2248	else
2249	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
2250	#endif
2251
2252	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2253	goto ResumeExecution;
2254	}
2255
2256	/** @todo clear VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT after the first time and restore drx registers afterwards */
2257	if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
2258	{
2259	Log2(("VMX: mov drx%d, genreg%d\n", VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification), VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification)));
2260	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxWrite);
2261	rc = EMInterpretDRxWrite(pVM, CPUMCTX2CORE(pCtx),
2262	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification),
2263	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification));
2264	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_DEBUG;
2265	Log2(("DR7=%08x\n", pCtx->dr[7]));
2266	}
2267	else
2268	{
2269	Log2(("VMX: mov x, drx\n"));
2270	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitDRxRead);
2271	rc = EMInterpretDRxRead(pVM, CPUMCTX2CORE(pCtx),
2272	VMX_EXIT_QUALIFICATION_DRX_GENREG(exitQualification),
2273	VMX_EXIT_QUALIFICATION_DRX_REGISTER(exitQualification));
2274	}
2275	/* Update EIP if no error occurred. */
2276	if (VBOX_SUCCESS(rc))
2277	pCtx->rip += cbInstr;
2278
2279	if (rc == VINF_SUCCESS)
2280	{
2281	/* Only resume if successful. */
2282	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2283	goto ResumeExecution;
2284	}
2285	Assert(rc == VERR_EM_INTERPRETER);
2286	break;
2287	}
2288
2289	/* Note: We'll get a #GP if the IO instruction isn't allowed (IOPL or TSS bitmap); no need to double check. */
2290	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2291	{
2292	uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
2293	uint32_t uPort;
2294	bool fIOWrite = (VMX_EXIT_QUALIFICATION_IO_DIRECTION(exitQualification) == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
2295
2296	/** @todo necessary to make the distinction? */
2297	if (VMX_EXIT_QUALIFICATION_IO_ENCODING(exitQualification) == VMX_EXIT_QUALIFICATION_IO_ENCODING_DX)
2298	{
2299	uPort = pCtx->edx & 0xffff;
2300	}
2301	else
2302	uPort = VMX_EXIT_QUALIFICATION_IO_PORT(exitQualification); /* Immediate encoding. */
2303
2304	/* paranoia */
2305	if (RT_UNLIKELY(uIOWidth == 2 \|\| uIOWidth >= 4))
2306	{
2307	rc = fIOWrite ? VINF_IOM_HC_IOPORT_WRITE : VINF_IOM_HC_IOPORT_READ;
2308	break;
2309	}
2310
2311	uint32_t cbSize = g_aIOSize[uIOWidth];
2312
2313	if (VMX_EXIT_QUALIFICATION_IO_STRING(exitQualification))
2314	{
2315	/* ins/outs */
2316	uint32_t prefix = 0;
2317	if (VMX_EXIT_QUALIFICATION_IO_REP(exitQualification))
2318	prefix \|= PREFIX_REP;
2319
2320	if (fIOWrite)
2321	{
2322	Log2(("IOMInterpretOUTSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
2323	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringWrite);
2324	rc = IOMInterpretOUTSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2325	}
2326	else
2327	{
2328	Log2(("IOMInterpretINSEx %VGv %x size=%d\n", pCtx->rip, uPort, cbSize));
2329	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOStringRead);
2330	rc = IOMInterpretINSEx(pVM, CPUMCTX2CORE(pCtx), uPort, prefix, cbSize);
2331	}
2332	}
2333	else
2334	{
2335	/* normal in/out */
2336	uint32_t uAndVal = g_aIOOpAnd[uIOWidth];
2337
2338	Assert(!VMX_EXIT_QUALIFICATION_IO_REP(exitQualification));
2339
2340	if (fIOWrite)
2341	{
2342	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIOWrite);
2343	rc = IOMIOPortWrite(pVM, uPort, pCtx->eax & uAndVal, cbSize);
2344	}
2345	else
2346	{
2347	uint32_t u32Val = 0;
2348
2349	STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitIORead);
2350	rc = IOMIOPortRead(pVM, uPort, &u32Val, cbSize);
2351	if (IOM_SUCCESS(rc))
2352	{
2353	/* Write back to the EAX register. */
2354	pCtx->eax = (pCtx->eax & ~uAndVal) \| (u32Val & uAndVal);
2355	}
2356	}
2357	}
2358	/*
2359	* Handled the I/O return codes.
2360	* (The unhandled cases end up with rc == VINF_EM_RAW_EMULATE_INSTR.)
2361	*/
2362	if (IOM_SUCCESS(rc))
2363	{
2364	/* Update EIP and continue execution. */
2365	pCtx->rip += cbInstr;
2366	if (RT_LIKELY(rc == VINF_SUCCESS))
2367	{
2368	/* If any IO breakpoints are armed, then we should check if a debug trap needs to be generated. */
2369	if (pCtx->dr[7] & X86_DR7_ENABLED_MASK)
2370	{
2371	STAM_COUNTER_INC(&pVM->hwaccm.s.StatDRxIOCheck);
2372	for (unsigned i=0;i<4;i++)
2373	{
2374	unsigned uBPLen = g_aIOSize[X86_DR7_GET_LEN(pCtx->dr[7], i)];
2375
2376	if ( (uPort >= pCtx->dr[i] && uPort < pCtx->dr[i] + uBPLen)
2377	&& (pCtx->dr[7] & (X86_DR7_L(i) \| X86_DR7_G(i)))
2378	&& (pCtx->dr[7] & X86_DR7_RW(i, X86_DR7_RW_IO)) == X86_DR7_RW(i, X86_DR7_RW_IO))
2379	{
2380	uint64_t uDR6;
2381
2382	Assert(CPUMIsGuestDebugStateActive(pVM));
2383
2384	uDR6 = ASMGetDR6();
2385
2386	/* Clear all breakpoint status flags and set the one we just hit. */
2387	uDR6 &= ~(X86_DR6_B0\|X86_DR6_B1\|X86_DR6_B2\|X86_DR6_B3);
2388	uDR6 \|= RT_BIT(i);
2389
2390	/* Note: AMD64 Architecture Programmer's Manual 13.1:
2391	* Bits 15:13 of the DR6 register is never cleared by the processor and must be cleared by software after
2392	* the contents have been read.
2393	*/
2394	ASMSetDR6(uDR6);
2395
2396	/* X86_DR7_GD will be cleared if drx accesses should be trapped inside the guest. */
2397	pCtx->dr[7] &= ~X86_DR7_GD;
2398
2399	/* Paranoia. */
2400	pCtx->dr[7] &= 0xffffffff; /* upper 32 bits reserved */
2401	pCtx->dr[7] &= ~(RT_BIT(11) \| RT_BIT(12) \| RT_BIT(14) \| RT_BIT(15)); /* must be zero */
2402	pCtx->dr[7] \|= 0x400; /* must be one */
2403
2404	/* Resync DR7 */
2405	rc = VMXWriteVMCS(VMX_VMCS_GUEST_DR7, pCtx->dr[7]);
2406	AssertRC(rc);
2407
2408	/* Construct inject info. */
2409	intInfo = X86_XCPT_DB;
2410	intInfo \|= (1 << VMX_EXIT_INTERRUPTION_INFO_VALID_SHIFT);
2411	intInfo \|= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HWEXCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
2412
2413	Log(("Inject IO debug trap at %VGv\n", pCtx->rip));
2414	rc = VMXR0InjectEvent(pVM, pCtx, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(intInfo), 0, 0);
2415	AssertRC(rc);
2416
2417	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2418	goto ResumeExecution;
2419	}
2420	}
2421	}
2422
2423	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2424	goto ResumeExecution;
2425	}
2426	break;
2427	}
2428
2429	#ifdef VBOX_STRICT
2430	if (rc == VINF_IOM_HC_IOPORT_READ)
2431	Assert(!fIOWrite);
2432	else if (rc == VINF_IOM_HC_IOPORT_WRITE)
2433	Assert(fIOWrite);
2434	else
2435	AssertMsg(VBOX_FAILURE(rc) \|\| rc == VINF_EM_RAW_EMULATE_INSTR \|\| rc == VINF_EM_RAW_GUEST_TRAP \|\| rc == VINF_TRPM_XCPT_DISPATCHED, ("%Vrc\n", rc));
2436	#endif
2437	break;
2438	}
2439
2440	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2441	LogFlow(("VMX_EXIT_TPR\n"));
2442	/* RIP is already set to the next instruction and the TPR has been synced back. Just resume. */
2443	goto ResumeExecution;
2444
2445	default:
2446	/* The rest is handled after syncing the entire CPU state. */
2447	break;
2448	}
2449
2450	/* Note: the guest state isn't entirely synced back at this stage. */
2451
2452	/* Investigate why there was a VM-exit. (part 2) */
2453	switch (exitReason)
2454	{
2455	case VMX_EXIT_EXCEPTION: /* 0 Exception or non-maskable interrupt (NMI). */
2456	case VMX_EXIT_EXTERNAL_IRQ: /* 1 External interrupt. */
2457	/* Already handled above. */
2458	break;
2459
2460	case VMX_EXIT_TRIPLE_FAULT: /* 2 Triple fault. */
2461	rc = VINF_EM_RESET; /* Triple fault equals a reset. */
2462	break;
2463
2464	case VMX_EXIT_INIT_SIGNAL: /* 3 INIT signal. */
2465	case VMX_EXIT_SIPI: /* 4 Start-up IPI (SIPI). */
2466	rc = VINF_EM_RAW_INTERRUPT;
2467	AssertFailed(); /* Can't happen. Yet. */
2468	break;
2469
2470	case VMX_EXIT_IO_SMI_IRQ: /* 5 I/O system-management interrupt (SMI). */
2471	case VMX_EXIT_SMI_IRQ: /* 6 Other SMI. */
2472	rc = VINF_EM_RAW_INTERRUPT;
2473	AssertFailed(); /* Can't happen afaik. */
2474	break;
2475
2476	case VMX_EXIT_TASK_SWITCH: /* 9 Task switch. */
2477	rc = VERR_EM_INTERPRETER;
2478	break;
2479
2480	case VMX_EXIT_HLT: /* 12 Guest software attempted to execute HLT. */
2481	/** Check if external interrupts are pending; if so, don't switch back. */
2482	pCtx->rip++; /* skip hlt */
2483	if ( pCtx->eflags.Bits.u1IF
2484	&& VM_FF_ISPENDING(pVM, (VM_FF_INTERRUPT_APIC\|VM_FF_INTERRUPT_PIC)))
2485	goto ResumeExecution;
2486
2487	rc = VINF_EM_HALT;
2488	break;
2489
2490	case VMX_EXIT_RSM: /* 17 Guest software attempted to execute RSM in SMM. */
2491	AssertFailed(); /* can't happen. */
2492	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2493	break;
2494
2495	case VMX_EXIT_VMCALL: /* 18 Guest software executed VMCALL. */
2496	case VMX_EXIT_VMCLEAR: /* 19 Guest software executed VMCLEAR. */
2497	case VMX_EXIT_VMLAUNCH: /* 20 Guest software executed VMLAUNCH. */
2498	case VMX_EXIT_VMPTRLD: /* 21 Guest software executed VMPTRLD. */
2499	case VMX_EXIT_VMPTRST: /* 22 Guest software executed VMPTRST. */
2500	case VMX_EXIT_VMREAD: /* 23 Guest software executed VMREAD. */
2501	case VMX_EXIT_VMRESUME: /* 24 Guest software executed VMRESUME. */
2502	case VMX_EXIT_VMWRITE: /* 25 Guest software executed VMWRITE. */
2503	case VMX_EXIT_VMXOFF: /* 26 Guest software executed VMXOFF. */
2504	case VMX_EXIT_VMXON: /* 27 Guest software executed VMXON. */
2505	/** @todo inject #UD immediately */
2506	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2507	break;
2508
2509	case VMX_EXIT_CPUID: /* 10 Guest software attempted to execute CPUID. */
2510	case VMX_EXIT_RDTSC: /* 16 Guest software attempted to execute RDTSC. */
2511	case VMX_EXIT_INVPG: /* 14 Guest software attempted to execute INVPG. */
2512	case VMX_EXIT_CRX_MOVE: /* 28 Control-register accesses. */
2513	case VMX_EXIT_DRX_MOVE: /* 29 Debug-register accesses. */
2514	case VMX_EXIT_PORT_IO: /* 30 I/O instruction. */
2515	/* already handled above */
2516	AssertMsg( rc == VINF_PGM_CHANGE_MODE
2517	\|\| rc == VINF_EM_RAW_INTERRUPT
2518	\|\| rc == VERR_EM_INTERPRETER
2519	\|\| rc == VINF_EM_RAW_EMULATE_INSTR
2520	\|\| rc == VINF_PGM_SYNC_CR3
2521	\|\| rc == VINF_IOM_HC_IOPORT_READ
2522	\|\| rc == VINF_IOM_HC_IOPORT_WRITE
2523	\|\| rc == VINF_EM_RAW_GUEST_TRAP
2524	\|\| rc == VINF_TRPM_XCPT_DISPATCHED
2525	\|\| rc == VINF_EM_RESCHEDULE_REM,
2526	("rc = %d\n", rc));
2527	break;
2528
2529	case VMX_EXIT_TPR: /* 43 TPR below threshold. Guest software executed MOV to CR8. */
2530	case VMX_EXIT_RDMSR: /* 31 RDMSR. Guest software attempted to execute RDMSR. */
2531	case VMX_EXIT_WRMSR: /* 32 WRMSR. Guest software attempted to execute WRMSR. */
2532	/* Note: If we decide to emulate them here, then we must sync the MSRs that could have been changed (sysenter, fs/gs base)!!! */
2533	rc = VERR_EM_INTERPRETER;
2534	break;
2535
2536	case VMX_EXIT_RDPMC: /* 15 Guest software attempted to execute RDPMC. */
2537	case VMX_EXIT_MWAIT: /* 36 Guest software executed MWAIT. */
2538	case VMX_EXIT_MONITOR: /* 39 Guest software attempted to execute MONITOR. */
2539	case VMX_EXIT_PAUSE: /* 40 Guest software attempted to execute PAUSE. */
2540	rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
2541	break;
2542
2543	case VMX_EXIT_IRQ_WINDOW: /* 7 Interrupt window. */
2544	Assert(rc == VINF_EM_RAW_INTERRUPT);
2545	break;
2546
2547	case VMX_EXIT_ERR_INVALID_GUEST_STATE: /* 33 VM-entry failure due to invalid guest state. */
2548	{
2549	#ifdef VBOX_STRICT
2550	Log(("VMX_EXIT_ERR_INVALID_GUEST_STATE\n"));
2551
2552	VMXReadVMCS(VMX_VMCS_GUEST_RIP, &val);
2553	Log(("Old eip %VGv new %VGv\n", pCtx->rip, (RTGCPTR)val));
2554
2555	VMXReadVMCS(VMX_VMCS_GUEST_CR0, &val);
2556	Log(("VMX_VMCS_GUEST_CR0 %RX64\n", val));
2557
2558	VMXReadVMCS(VMX_VMCS_GUEST_CR3, &val);
2559	Log(("VMX_VMCS_HOST_CR3 %VGp\n", val));
2560
2561	VMXReadVMCS(VMX_VMCS_GUEST_CR4, &val);
2562	Log(("VMX_VMCS_GUEST_CR4 %RX64\n", val));
2563
2564	VMXReadVMCS(VMX_VMCS_GUEST_RFLAGS, &val);
2565	Log(("VMX_VMCS_GUEST_RFLAGS %08x\n", val));
2566
2567	VMX_LOG_SELREG(CS, "CS");
2568	VMX_LOG_SELREG(DS, "DS");
2569	VMX_LOG_SELREG(ES, "ES");
2570	VMX_LOG_SELREG(FS, "FS");
2571	VMX_LOG_SELREG(GS, "GS");
2572	VMX_LOG_SELREG(SS, "SS");
2573	VMX_LOG_SELREG(TR, "TR");
2574	VMX_LOG_SELREG(LDTR, "LDTR");
2575
2576	VMXReadVMCS(VMX_VMCS_GUEST_GDTR_BASE, &val);
2577	Log(("VMX_VMCS_GUEST_GDTR_BASE %VGv\n", val));
2578	VMXReadVMCS(VMX_VMCS_GUEST_IDTR_BASE, &val);
2579	Log(("VMX_VMCS_GUEST_IDTR_BASE %VGv\n", val));
2580	#endif /* VBOX_STRICT */
2581	rc = VERR_VMX_INVALID_GUEST_STATE;
2582	break;
2583	}
2584
2585	case VMX_EXIT_ERR_MSR_LOAD: /* 34 VM-entry failure due to MSR loading. */
2586	case VMX_EXIT_ERR_MACHINE_CHECK: /* 41 VM-entry failure due to machine-check. */
2587	default:
2588	rc = VERR_VMX_UNEXPECTED_EXIT_CODE;
2589	AssertMsgFailed(("Unexpected exit code %d\n", exitReason)); /* Can't happen. */
2590	break;
2591
2592	}
2593	end:
2594
2595	/* Signal changes for the recompiler. */
2596	CPUMSetChangedFlags(pVM, CPUM_CHANGED_SYSENTER_MSR \| CPUM_CHANGED_LDTR \| CPUM_CHANGED_GDTR \| CPUM_CHANGED_IDTR \| CPUM_CHANGED_TR \| CPUM_CHANGED_HIDDEN_SEL_REGS);
2597
2598	/* If we executed vmlaunch/vmresume and an external irq was pending, then we don't have to do a full sync the next time. */
2599	if ( exitReason == VMX_EXIT_EXTERNAL_IRQ
2600	&& !VMX_EXIT_INTERRUPTION_INFO_VALID(intInfo))
2601	{
2602	STAM_COUNTER_INC(&pVM->hwaccm.s.StatPendingHostIrq);
2603	/* On the next entry we'll only sync the host context. */
2604	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_HOST_CONTEXT;
2605	}
2606	else
2607	{
2608	/* On the next entry we'll sync everything. */
2609	/** @todo we can do better than this */
2610	/* Not in the VINF_PGM_CHANGE_MODE though! */
2611	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_ALL;
2612	}
2613
2614	/* translate into a less severe return code */
2615	if (rc == VERR_EM_INTERPRETER)
2616	rc = VINF_EM_RAW_EMULATE_INSTR;
2617	else
2618	/* Try to extract more information about what might have gone wrong here. */
2619	if (rc == VERR_VMX_INVALID_VMCS_PTR)
2620	{
2621	VMXGetActivateVMCS(&pVM->hwaccm.s.vmx.lasterror.u64VMCSPhys);
2622	pVM->hwaccm.s.vmx.lasterror.ulVMCSRevision = (uint32_t )pVM->hwaccm.s.vmx.pVMCS;
2623	}
2624
2625	STAM_PROFILE_ADV_STOP(&pVM->hwaccm.s.StatExit, x);
2626
2627	Log2(("X"));
2628	return rc;
2629	}
2630
2631
2632	/**
2633	* Enters the VT-x session
2634	*
2635	* @returns VBox status code.
2636	* @param pVM The VM to operate on.
2637	* @param pCpu CPU info struct
2638	*/
2639	HWACCMR0DECL(int) VMXR0Enter(PVM pVM, PHWACCM_CPUINFO pCpu)
2640	{
2641	Assert(pVM->hwaccm.s.vmx.fSupported);
2642
2643	unsigned cr4 = ASMGetCR4();
2644	if (!(cr4 & X86_CR4_VMXE))
2645	{
2646	AssertMsgFailed(("X86_CR4_VMXE should be set!\n"));
2647	return VERR_VMX_X86_CR4_VMXE_CLEARED;
2648	}
2649
2650	/* Activate the VM Control Structure. */
2651	int rc = VMXActivateVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2652	if (VBOX_FAILURE(rc))
2653	return rc;
2654
2655	pVM->hwaccm.s.vmx.fResumeVM = false;
2656	return VINF_SUCCESS;
2657	}
2658
2659
2660	/**
2661	* Leaves the VT-x session
2662	*
2663	* @returns VBox status code.
2664	* @param pVM The VM to operate on.
2665	* @param pCtx CPU context
2666	*/
2667	HWACCMR0DECL(int) VMXR0Leave(PVM pVM, PCPUMCTX pCtx)
2668	{
2669	Assert(pVM->hwaccm.s.vmx.fSupported);
2670
2671	/* Save the guest debug state if necessary. */
2672	if (CPUMIsGuestDebugStateActive(pVM))
2673	{
2674	CPUMR0SaveGuestDebugState(pVM, pCtx, true /* save DR6 */);
2675
2676	/* Enable drx move intercepts again. */
2677	pVM->hwaccm.s.vmx.proc_ctls \|= VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT;
2678	int rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
2679	AssertRC(rc);
2680
2681	/* Resync the debug registers the next time. */
2682	pVM->hwaccm.s.fContextUseFlags \|= HWACCM_CHANGED_GUEST_DEBUG;
2683	}
2684	else
2685	Assert(pVM->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_MOV_DR_EXIT);
2686
2687	/* Clear VM Control Structure. Marking it inactive, clearing implementation specific data and writing back VMCS data to memory. */
2688	int rc = VMXClearVMCS(pVM->hwaccm.s.vmx.pVMCSPhys);
2689	AssertRC(rc);
2690
2691	return VINF_SUCCESS;
2692	}
2693

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp@ 12983

Download in other formats: