IEMAllCImplSvmInstr.cpp.h@ 67925

Last change on this file since 67925 was 67925, checked in by vboxsync, 8 years ago
VMM/IEM: Nested Hw.virt: Fixes for dynamically allocated nested-guest VMCB.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 60.8 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 67925 2017-07-12 11:13:08Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Helper for handling a SVM world-switch (VMRUN, \#VMEXIT).
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param uOldEfer EFER MSR prior to the world-switch.
59	* @param uOldCr0 CR0 prior to the world-switch.
60	*/
61	DECLINLINE(VBOXSTRICTRC) iemSvmHandleWorldSwitch(PVMCPU pVCpu, uint64_t uOldEfer, uint64_t uOldCr0)
62	{
63	RT_NOREF(uOldEfer); RT_NOREF(uOldCr0);
64
65	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
66
67	/*
68	* Inform PGM.
69	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
70	* see comment in iemMemPageTranslateAndCheckAccess().
71	*/
72	PGMFlushTLB(pVCpu, pCtx->cr3, true);
73	int rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
74	AssertRCReturn(rc, rc);
75
76	/* Inform CPUM (recompiler). */
77	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
78
79	/* Re-initialize IEM cache/state after the drastic mode switch. */
80	iemReInitExec(pVCpu);
81	return rc;
82	}
83
84
85	/**
86	* SVM \#VMEXIT handler.
87	*
88	* @returns Strict VBox status code.
89	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
90	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
91	* "host state" and a shutdown is required.
92	*
93	* @param pVCpu The cross context virtual CPU structure.
94	* @param pCtx The guest-CPU context.
95	* @param uExitCode The exit code.
96	* @param uExitInfo1 The exit info. 1 field.
97	* @param uExitInfo2 The exit info. 2 field.
98	*/
99	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
100	{
101	#ifndef IN_RING3
102	AssertMsgFailed(("iemSvmVmexit: Bad context\n"));
103	return VERR_INTERNAL_ERROR_5;
104	#endif
105
106	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
107	\|\| uExitCode == SVM_EXIT_INVALID)
108	{
109	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
110	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
111
112	/*
113	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
114	*/
115	pCtx->hwvirt.svm.fGif = 0;
116
117	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
118	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
119	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
120	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
121
122	/*
123	* Save the nested-guest state into the VMCB state-save area.
124	*/
125	SVMVMCBSTATESAVE VmcbNstGst;
126	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, ES, es);
127	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, CS, cs);
128	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, SS, ss);
129	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, DS, ds);
130	VmcbNstGst.GDTR.u32Limit = pCtx->gdtr.cbGdt;
131	VmcbNstGst.GDTR.u64Base = pCtx->gdtr.pGdt;
132	VmcbNstGst.IDTR.u32Limit = pCtx->idtr.cbIdt;
133	VmcbNstGst.IDTR.u64Base = pCtx->idtr.pIdt;
134	VmcbNstGst.u64EFER = pCtx->msrEFER;
135	VmcbNstGst.u64CR4 = pCtx->cr4;
136	VmcbNstGst.u64CR3 = pCtx->cr3;
137	VmcbNstGst.u64CR2 = pCtx->cr2;
138	VmcbNstGst.u64CR0 = pCtx->cr0;
139	/** @todo Nested paging. */
140	VmcbNstGst.u64RFlags = pCtx->rflags.u64;
141	VmcbNstGst.u64RIP = pCtx->rip;
142	VmcbNstGst.u64RSP = pCtx->rsp;
143	VmcbNstGst.u64RAX = pCtx->rax;
144	VmcbNstGst.u64DR7 = pCtx->dr[6];
145	VmcbNstGst.u64DR6 = pCtx->dr[7];
146	VmcbNstGst.u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
147	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
148
149	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
150	/* Save interrupt shadow of the nested-guest instruction if any. */
151	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
152	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
153	{
154	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
155	pVmcbCtrl->u64IntShadow \|= SVM_INTERRUPT_SHADOW_ACTIVE;
156	}
157
158	/*
159	* Save additional state and intercept information.
160	*/
161	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
162	{
163	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
164	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
165	}
166	else
167	pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
168
169	/** @todo Save V_TPR, V_IRQ. */
170	/** @todo NRIP. */
171
172	/* Save exit information. */
173	pVmcbCtrl->u64ExitCode = uExitCode;
174	pVmcbCtrl->u64ExitInfo1 = uExitInfo1;
175	pVmcbCtrl->u64ExitInfo2 = uExitInfo2;
176
177	/*
178	* Update the exit interrupt information field if this #VMEXIT happened as a result
179	* of delivering an event.
180	*/
181	{
182	uint8_t uExitIntVector;
183	uint32_t uExitIntErr;
184	uint32_t fExitIntFlags;
185	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
186	NULL /* uExitIntCr2 */);
187	pVmcbCtrl->ExitIntInfo.n.u1Valid = fRaisingEvent;
188	if (fRaisingEvent)
189	{
190	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
191	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
192	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
193	{
194	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
195	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
196	}
197	}
198	}
199
200	/*
201	* Clear event injection in the VMCB.
202	*/
203	pVmcbCtrl->EventInject.n.u1Valid = 0;
204
205	/*
206	* Write back the VMCB controls to the guest VMCB in guest physical memory.
207	*/
208	VBOXSTRICTRC rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, pVmcbCtrl,
209	sizeof(*pVmcbCtrl));
210	/*
211	* Prepare for guest's "host mode" by clearing internal processor state bits.
212	*
213	* Some of these like TSC offset can then be used unconditionally in our TM code
214	* but the offset in the guest's VMCB will remain as it should as we've written
215	* back the VMCB controls above.
216	*/
217	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
218
219	if (RT_SUCCESS(rcStrict))
220	{
221	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
222	&VmcbNstGst, sizeof(VmcbNstGst));
223	if (RT_SUCCESS(rcStrict))
224	{
225	/** @todo Nested paging. */
226	/** @todo ASID. */
227
228	uint64_t const uOldCr0 = pCtx->cr0;
229	uint64_t const uOldEfer = pCtx->msrEFER;
230
231	/*
232	* Reload the guest's "host state".
233	*/
234	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
235	pCtx->es = pHostState->es;
236	pCtx->cs = pHostState->cs;
237	pCtx->ss = pHostState->ss;
238	pCtx->ds = pHostState->ds;
239	pCtx->gdtr = pHostState->gdtr;
240	pCtx->idtr = pHostState->idtr;
241	pCtx->msrEFER = pHostState->uEferMsr;
242	pCtx->cr0 = pHostState->uCr0 \| X86_CR0_PE;
243	pCtx->cr3 = pHostState->uCr3;
244	pCtx->cr4 = pHostState->uCr4;
245	pCtx->rflags = pHostState->rflags;
246	pCtx->rflags.Bits.u1VM = 0;
247	pCtx->rip = pHostState->uRip;
248	pCtx->rsp = pHostState->uRsp;
249	pCtx->rax = pHostState->uRax;
250	pCtx->dr[7] &= ~(X86_DR7_ENABLED_MASK \| X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
251	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
252
253	/** @todo if RIP is not canonical or outside the CS segment limit, we need to
254	* raise \#GP(0) in the guest. */
255
256	/** @todo check the loaded host-state for consistency. Figure out what
257	* exactly this involves? */
258
259	/* Restore guest's force-flags. */
260	if (pCtx->hwvirt.fLocalForcedActions)
261	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
262
263	/*
264	* Inform PGM and others of the world-switch.
265	*/
266	rcStrict = iemSvmHandleWorldSwitch(pVCpu, uOldEfer, uOldCr0);
267	if (rcStrict == VINF_SUCCESS)
268	return VINF_SVM_VMEXIT;
269
270	if (RT_SUCCESS(rcStrict))
271	{
272	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmHandleWorldSwitch %Rrc\n", rcStrict));
273	iemSetPassUpStatus(pVCpu, rcStrict);
274	return VINF_SVM_VMEXIT;
275	}
276
277	LogFlow(("iemSvmVmexit: iemSvmHandleWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
278	}
279	else
280	LogFlow(("iemSvmVmexit: Writing VMCB guest-state at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
281	VBOXSTRICTRC_VAL(rcStrict)));
282	}
283	else
284	LogFlow(("iemSvmVmexit: Writing VMCB guest-controls at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
285	VBOXSTRICTRC_VAL(rcStrict)));
286
287	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
288	return VERR_SVM_VMEXIT_FAILED;
289	}
290
291	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
292	uExitInfo1, uExitInfo2));
293	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
294	return VERR_SVM_IPE_5;
295	}
296
297
298	/**
299	* Performs the operations necessary that are part of the vmrun instruction
300	* execution in the guest.
301	*
302	* @returns Strict VBox status code (i.e. informational status codes too).
303	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
304	* code execution.
305	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
306	* (SVM_EXIT_INVALID most likely).
307	*
308	* @param pVCpu The cross context virtual CPU structure.
309	* @param pCtx Pointer to the guest-CPU context.
310	* @param cbInstr The length of the VMRUN instruction.
311	* @param GCPhysVmcb Guest physical address of the VMCB to run.
312	*/
313	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
314	{
315	#ifndef IN_RING3
316	return VINF_EM_RESCHEDULE_REM;
317	#endif
318
319	Assert(pVCpu);
320	Assert(pCtx);
321
322	PVM pVM = pVCpu->CTX_SUFF(pVM);
323	LogFlow(("iemSvmVmrun\n"));
324
325	/*
326	* Cache the physical address of the VMCB for #VMEXIT exceptions.
327	*/
328	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
329
330	/*
331	* Read the guest VMCB state.
332	*/
333	SVMVMCBSTATESAVE VmcbNstGst;
334	int rc = PGMPhysSimpleReadGCPhys(pVM, &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), sizeof(SVMVMCBSTATESAVE));
335	if (RT_SUCCESS(rc))
336	{
337	/*
338	* Save the host state.
339	*/
340	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
341	pHostState->es = pCtx->es;
342	pHostState->cs = pCtx->cs;
343	pHostState->ss = pCtx->ss;
344	pHostState->ds = pCtx->ds;
345	pHostState->gdtr = pCtx->gdtr;
346	pHostState->idtr = pCtx->idtr;
347	pHostState->uEferMsr = pCtx->msrEFER;
348	pHostState->uCr0 = pCtx->cr0;
349	pHostState->uCr3 = pCtx->cr3;
350	pHostState->uCr4 = pCtx->cr4;
351	pHostState->rflags = pCtx->rflags;
352	pHostState->uRip = pCtx->rip + cbInstr;
353	pHostState->uRsp = pCtx->rsp;
354	pHostState->uRax = pCtx->rax;
355
356	/*
357	* Read the guest VMCB controls.
358	*/
359	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
360	rc = PGMPhysSimpleReadGCPhys(pVM, pVmcbCtrl, GCPhysVmcb, sizeof(*pVmcbCtrl));
361	if (RT_SUCCESS(rc))
362	{
363	/*
364	* Validate guest-state and controls.
365	*/
366	/* VMRUN must always be iHMSntercepted. */
367	if (!CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_VMRUN))
368	{
369	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
370	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
371	}
372
373	/* Nested paging. */
374	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
375	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
376	{
377	Log(("iemSvmVmrun: Nested paging not supported -> #VMEXIT\n"));
378	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
379	}
380
381	/* AVIC. */
382	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
383	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
384	{
385	Log(("iemSvmVmrun: AVIC not supported -> #VMEXIT\n"));
386	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
387	}
388
389	/* Last branch record (LBR) virtualization. */
390	if ( (pVmcbCtrl->u64LBRVirt & SVM_LBR_VIRT_ENABLE)
391	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
392	{
393	Log(("iemSvmVmrun: LBR virtualization not supported -> #VMEXIT\n"));
394	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
395	}
396
397	/* Guest ASID. */
398	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
399	{
400	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
401	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
402	}
403
404	/* IO permission bitmap. */
405	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
406	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
407	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
408	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
409	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
410	{
411	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
412	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
413	}
414
415	/* MSR permission bitmap. */
416	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
417	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
418	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
419	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
420	{
421	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
422	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
423	}
424
425	/* CR0. */
426	if ( !(VmcbNstGst.u64CR0 & X86_CR0_CD)
427	&& (VmcbNstGst.u64CR0 & X86_CR0_NW))
428	{
429	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64CR0));
430	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
431	}
432	if (VmcbNstGst.u64CR0 >> 32)
433	{
434	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64CR0));
435	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
436	}
437	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
438
439	/* DR6 and DR7. */
440	if ( VmcbNstGst.u64DR6 >> 32
441	\|\| VmcbNstGst.u64DR7 >> 32)
442	{
443	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64DR6,
444	VmcbNstGst.u64DR6));
445	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
446	}
447
448	/** @todo gPAT MSR validation? */
449
450	/*
451	* Copy the IO permission bitmap into the cache.
452	*/
453	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
454	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
455	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
456	if (RT_FAILURE(rc))
457	{
458	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
459	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
460	}
461
462	/*
463	* Copy the MSR permission bitmap into the cache.
464	*/
465	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
466	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
467	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
468	if (RT_FAILURE(rc))
469	{
470	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
471	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
472	}
473
474	/*
475	* Copy segments from nested-guest VMCB state to the guest-CPU state.
476	*
477	* We do this here as we need to use the CS attributes and it's easier this way
478	* then using the VMCB format selectors. It doesn't really matter where we copy
479	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
480	*/
481	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, ES, es);
482	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, CS, cs);
483	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, SS, ss);
484	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, DS, ds);
485
486	/** @todo Segment attribute overrides by VMRUN. */
487
488	/*
489	* CPL adjustments and overrides.
490	*
491	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
492	* We shall thus adjust both CS.DPL and SS.DPL here.
493	*/
494	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = VmcbNstGst.u8CPL;
495	if (CPUMIsGuestInV86ModeEx(pCtx))
496	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
497	if (CPUMIsGuestInRealModeEx(pCtx))
498	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
499
500	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
501
502	/*
503	* Continue validating guest-state and controls.
504	*/
505	/* EFER, CR0 and CR4. */
506	uint64_t uValidEfer;
507	rc = CPUMQueryValidatedGuestEfer(pVM, VmcbNstGst.u64CR0, VmcbNstGst.u64EFER, VmcbNstGst.u64EFER, &uValidEfer);
508	if (RT_FAILURE(rc))
509	{
510	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64EFER));
511	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
512	}
513	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
514	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
515	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
516	bool const fPaging = RT_BOOL(VmcbNstGst.u64CR0 & X86_CR0_PG);
517	bool const fPae = RT_BOOL(VmcbNstGst.u64CR4 & X86_CR4_PAE);
518	bool const fProtMode = RT_BOOL(VmcbNstGst.u64CR0 & X86_CR0_PE);
519	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
520	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
521	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
522	if (fLongModeWithPaging)
523	uValidEfer \|= MSR_K6_EFER_LMA;
524	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
525	if ( !fSvm
526	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
527	\|\| (fLongModeWithPaging && !fPae)
528	\|\| (fLongModeWithPaging && !fProtMode)
529	\|\| ( fLongModeEnabled
530	&& fPaging
531	&& fPae
532	&& fLongModeConformCS))
533	{
534	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
535	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
536	}
537
538	/*
539	* Preserve the required force-flags.
540	*
541	* We only preserve the force-flags that would affect the execution of the
542	* nested-guest (or the guest).
543	*
544	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
545	* instruction which is this VMRUN instruction itself.
546	*
547	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
548	* execution of a subsequent IRET instruction in the guest.
549	*
550	* - The remaining FFs (e.g. timers) can stay in place so that we will be
551	* able to generate interrupts that should cause #VMEXITs for the
552	* nested-guest.
553	*/
554	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
555
556	/*
557	* Interrupt shadow.
558	*/
559	if (pVmcbCtrl->u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
560	{
561	LogFlow(("iemSvmVmrun: setting inerrupt shadow. inhibit PC=%#RX64\n", VmcbNstGst.u64RIP));
562	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
563	EMSetInhibitInterruptsPC(pVCpu, VmcbNstGst.u64RIP);
564	}
565
566	/*
567	* TLB flush control.
568	* Currently disabled since it's redundant as we unconditionally flush the TLB
569	* in iemSvmHandleWorldSwitch() below.
570	*/
571	#if 0
572	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
573	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
574	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
575	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
576	PGMFlushTLB(pVCpu, VmcbNstGst.u64CR3, true /* fGlobal */);
577	#endif
578
579	/** @todo @bugref{7243}: SVM TSC offset, see tmCpuTickGetInternal. */
580
581	uint64_t const uOldEfer = pCtx->msrEFER;
582	uint64_t const uOldCr0 = pCtx->cr0;
583
584	/*
585	* Copy the remaining guest state from the VMCB to the guest-CPU context.
586	*/
587	pCtx->gdtr.cbGdt = VmcbNstGst.GDTR.u32Limit;
588	pCtx->gdtr.pGdt = VmcbNstGst.GDTR.u64Base;
589	pCtx->idtr.cbIdt = VmcbNstGst.IDTR.u32Limit;
590	pCtx->idtr.pIdt = VmcbNstGst.IDTR.u64Base;
591	pCtx->cr0 = VmcbNstGst.u64CR0; /** @todo What about informing PGM about CR0.WP? */
592	pCtx->cr4 = VmcbNstGst.u64CR4;
593	pCtx->cr3 = VmcbNstGst.u64CR3;
594	pCtx->cr2 = VmcbNstGst.u64CR2;
595	pCtx->dr[6] = VmcbNstGst.u64DR6;
596	pCtx->dr[7] = VmcbNstGst.u64DR7;
597	pCtx->rflags.u64 = VmcbNstGst.u64RFlags;
598	pCtx->rax = VmcbNstGst.u64RAX;
599	pCtx->rsp = VmcbNstGst.u64RSP;
600	pCtx->rip = VmcbNstGst.u64RIP;
601	pCtx->msrEFER = uValidEfer;
602
603	/* Mask DR6, DR7 bits mandatory set/clear bits. */
604	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
605	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
606	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
607	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
608
609	/*
610	* Check for pending virtual interrupts.
611	*/
612	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
613	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
614	else
615	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
616
617	/*
618	* Clear global interrupt flags to allow interrupts in the guest.
619	*/
620	pCtx->hwvirt.svm.fGif = 1;
621
622	/*
623	* Inform PGM and others of the world-switch.
624	*/
625	VBOXSTRICTRC rcStrict = iemSvmHandleWorldSwitch(pVCpu, uOldEfer, uOldCr0);
626	if (rcStrict == VINF_SUCCESS)
627	{ /* likely */ }
628	else if (RT_SUCCESS(rcStrict))
629	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
630	else
631	{
632	LogFlow(("iemSvmVmrun: iemSvmHandleWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
633	return rcStrict;
634	}
635
636	/*
637	* Event injection.
638	*/
639	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
640	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
641	if (pEventInject->n.u1Valid)
642	{
643	uint8_t const uVector = pEventInject->n.u8Vector;
644	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
645	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
646
647	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
648	if (enmType == TRPM_32BIT_HACK)
649	{
650	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
651	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
652	}
653	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
654	{
655	if ( uVector == X86_XCPT_NMI
656	\|\| uVector > X86_XCPT_LAST)
657	{
658	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
659	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
660	}
661	if ( uVector == X86_XCPT_BR
662	&& CPUMIsGuestInLongModeEx(pCtx))
663	{
664	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
665	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
666	}
667	/** @todo any others? */
668	}
669
670	/*
671	* Update the exit interruption info field so that if an exception occurs
672	* while delivering the event causing a #VMEXIT, we only need to update
673	* the valid bit while the rest is already in place.
674	*/
675	pVmcbCtrl->ExitIntInfo.u = pVmcbCtrl->EventInject.u;
676	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
677
678	/** @todo NRIP: Software interrupts can only be pushed properly if we support
679	* NRIP for the nested-guest to calculate the instruction length
680	* below. */
681	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 uVector=%#x enmType=%d uErrorCode=%u cr2=%#RX64\n",
682	pCtx->cs.Sel, pCtx->rip, uVector, enmType,uErrorCode, pCtx->cr2));
683	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
684	}
685	else
686	LogFlow(("iemSvmVmrun: Entered nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
687	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
688
689	return rcStrict;
690	}
691
692	/* Shouldn't really happen as the caller should've validated the physical address already. */
693	Log(("iemSvmVmrun: Failed to read nested-guest VMCB control area at %#RGp -> #VMEXIT\n",
694	GCPhysVmcb));
695	return VERR_SVM_IPE_4;
696	}
697
698	/* Shouldn't really happen as the caller should've validated the physical address already. */
699	Log(("iemSvmVmrun: Failed to read nested-guest VMCB save-state area at %#RGp -> #VMEXIT\n",
700	GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest)));
701	return VERR_IEM_IPE_1;
702	}
703
704
705	#if 0
706	/**
707	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
708	* intercept is active.
709	*
710	* @returns Strict VBox status code.
711	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
712	* we're not executing a nested-guest.
713	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
714	* successfully.
715	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
716	* failed and a shutdown needs to be initiated for the geust.
717	*
718	* @param pVCpu The cross context virtual CPU structure.
719	* @param pCtx The guest-CPU context.
720	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
721	* @param uExitInfo1 The exit info. 1 field.
722	* @param uExitInfo2 The exit info. 2 field.
723	*/
724	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
725	uint64_t uExitInfo2)
726	{
727	#define HMSVM_CTRL_INTERCEPT_VMEXIT(a_Intercept) \
728	do { \
729	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
730	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
731	break; \
732	} while (0)
733
734	if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
735	return VINF_HM_INTERCEPT_NOT_ACTIVE;
736
737	switch (uExitCode)
738	{
739	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
740	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
741	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
742	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
743	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
744	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
745	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
746	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
747	{
748	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
749	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
750	break;
751	}
752
753	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
754	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
755	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
756	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
757	{
758	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
759	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
760	break;
761	}
762
763	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
764	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
765	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
766	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
767	{
768	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
769	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
770	break;
771	}
772
773	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
774	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
775	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
776	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
777	{
778	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
779	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
780	break;
781	}
782
783	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
784	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
785	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
786	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
787	{
788	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
789	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
790	break;
791	}
792
793	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTR);
794	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_NMI);
795	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SMI);
796	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INIT);
797	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VINTR);
798	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
799	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_READS);
800	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_READS);
801	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_READS);
802	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_READS);
803	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_WRITES);
804	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_WRITES);
805	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_WRITES);
806	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_WRITES);
807	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSC);
808	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDPMC);
809	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PUSHF);
810	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_POPF);
811	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CPUID);
812	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RSM);
813	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IRET);
814	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTN);
815	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVD);
816	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PAUSE);
817	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_HLT);
818	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPG);
819	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPGA);
820	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TASK_SWITCH);
821	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_FERR_FREEZE);
822	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SHUTDOWN);
823	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMRUN);
824	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMMCALL);
825	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMLOAD);
826	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMSAVE);
827	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_STGI);
828	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CLGI);
829	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SKINIT);
830	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSCP);
831	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_ICEBP);
832	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_WBINVD);
833	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MONITOR);
834	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT);
835	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
836	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_XSETBV);
837
838	case SVM_EXIT_IOIO:
839	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
840	return VERR_SVM_IPE_1;
841
842	case SVM_EXIT_MSR:
843	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
844	return VERR_SVM_IPE_1;
845
846	case SVM_EXIT_NPF:
847	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
848	case SVM_EXIT_AVIC_NOACCEL:
849	AssertMsgFailed(("Todo Implement.\n"));
850	return VERR_SVM_IPE_1;
851
852	default:
853	AssertMsgFailed(("Unsupported SVM exit code %#RX64\n", uExitCode));
854	return VERR_SVM_IPE_1;
855	}
856
857	return VINF_HM_INTERCEPT_NOT_ACTIVE;
858
859	#undef HMSVM_CTRL_INTERCEPT_VMEXIT
860	}
861	#endif
862
863
864	/**
865	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
866	* intercept is active.
867	*
868	* @returns Strict VBox status code.
869	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
870	* we're not executing a nested-guest.
871	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
872	* successfully.
873	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
874	* failed and a shutdown needs to be initiated for the geust.
875	*
876	* @returns VBox strict status code.
877	* @param pVCpu The cross context virtual CPU structure of the calling thread.
878	* @param u16Port The IO port being accessed.
879	* @param enmIoType The type of IO access.
880	* @param cbReg The IO operand size in bytes.
881	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
882	* @param iEffSeg The effective segment number.
883	* @param fRep Whether this is a repeating IO instruction (REP prefix).
884	* @param fStrIo Whether this is a string IO instruction.
885	* @param cbInstr The length of the IO instruction in bytes.
886	*/
887	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
888	uint64_t uCr2)
889	{
890	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
891
892	/*
893	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
894	*
895	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_EXCEPTION_2 #VMEXITs.
896	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
897	* even when they use a vector in the range 0 to 31.
898	* - ICEBP should not trigger #DB intercept, but its own intercept.
899	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
900	*/
901	/* Check NMI intercept */
902	if ( u8Vector == X86_XCPT_NMI
903	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
904	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
905	{
906	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
907	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
908	}
909
910	/* Check ICEBP intercept. */
911	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
912	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
913	{
914	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
915	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
916	}
917
918	/* Check CPU exception intercepts. */
919	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
920	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
921	{
922	Assert(u8Vector <= X86_XCPT_LAST);
923	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
924	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
925	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist
926	&& u8Vector == X86_XCPT_PF
927	&& !(uErr & X86_TRAP_PF_ID))
928	{
929	/** @todo Nested-guest SVM - figure out fetching op-code bytes from IEM. */
930	#ifdef IEM_WITH_CODE_TLB
931	AssertReleaseFailedReturn(VERR_IEM_IPE_5);
932	#else
933	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
934	uint8_t const offOpCode = pVCpu->iem.s.offOpcode;
935	uint8_t const cbCurrent = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode;
936	if ( cbCurrent > 0
937	&& cbCurrent < sizeof(pVmcbCtrl->abInstr))
938	{
939	Assert(cbCurrent <= sizeof(pVCpu->iem.s.abOpcode));
940	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[offOpCode], cbCurrent);
941	}
942	#endif
943	}
944	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
945	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
946	u8Vector, uExitInfo1, uExitInfo2));
947	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_EXCEPTION_0 + u8Vector, uExitInfo1, uExitInfo2);
948	}
949
950	/* Check software interrupt (INTn) intercepts. */
951	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
952	\| IEM_XCPT_FLAGS_BP_INSTR
953	\| IEM_XCPT_FLAGS_ICEBP_INSTR
954	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
955	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
956	{
957	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist ? u8Vector : 0;
958	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
959	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
960	}
961
962	return VINF_HM_INTERCEPT_NOT_ACTIVE;
963	}
964
965
966	/**
967	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
968	* corresponding intercept is active.
969	*
970	* @returns Strict VBox status code.
971	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
972	* we're not executing a nested-guest.
973	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
974	* successfully.
975	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
976	* failed and a shutdown needs to be initiated for the geust.
977	*
978	* @returns VBox strict status code.
979	* @param pVCpu The cross context virtual CPU structure of the calling thread.
980	* @param u16Port The IO port being accessed.
981	* @param enmIoType The type of IO access.
982	* @param cbReg The IO operand size in bytes.
983	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
984	* @param iEffSeg The effective segment number.
985	* @param fRep Whether this is a repeating IO instruction (REP prefix).
986	* @param fStrIo Whether this is a string IO instruction.
987	* @param cbInstr The length of the IO instruction in bytes.
988	*/
989	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
990	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
991	{
992	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
993	Assert(cAddrSizeBits == 0 \|\| cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
994	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
995
996	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
997
998	/*
999	* The IOPM layout:
1000	* Each bit represents one 8-bit port. That makes a total of 0..65535 bits or
1001	* two 4K pages.
1002	*
1003	* For IO instructions that access more than a single byte, the permission bits
1004	* for all bytes are checked; if any bit is set to 1, the IO access is intercepted.
1005	*
1006	* Since it's possible to do a 32-bit IO access at port 65534 (accessing 4 bytes),
1007	* we need 3 extra bits beyond the second 4K page.
1008	*/
1009	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1010	static const uint16_t s_auSizeMasks[] = { 0, 1, 3, 0, 0xf, 0, 0, 0 };
1011
1012	uint16_t const offIopm = u16Port >> 3;
1013	uint16_t const fSizeMask = s_auSizeMasks[(cAddrSizeBits >> SVM_IOIO_OP_SIZE_SHIFT) & 7];
1014	uint8_t const cShift = u16Port - (offIopm << 3);
1015	uint16_t const fIopmMask = (1 << cShift) \| (fSizeMask << cShift);
1016
1017	uint8_t const pbIopm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
1018	Assert(pbIopm);
1019	pbIopm += offIopm;
1020	uint16_t const u16Iopm = (uint16_t )pbIopm;
1021	if (u16Iopm & fIopmMask)
1022	{
1023	static const uint32_t s_auIoOpSize[] =
1024	{ SVM_IOIO_32_BIT_OP, SVM_IOIO_8_BIT_OP, SVM_IOIO_16_BIT_OP, 0, SVM_IOIO_32_BIT_OP, 0, 0, 0 };
1025
1026	static const uint32_t s_auIoAddrSize[] =
1027	{ 0, SVM_IOIO_16_BIT_ADDR, SVM_IOIO_32_BIT_ADDR, 0, SVM_IOIO_64_BIT_ADDR, 0, 0, 0 };
1028
1029	SVMIOIOEXITINFO IoExitInfo;
1030	IoExitInfo.u = s_auIoOpSize[cbReg & 7];
1031	IoExitInfo.u \|= s_auIoAddrSize[(cAddrSizeBits >> 4) & 7];
1032	IoExitInfo.n.u1STR = fStrIo;
1033	IoExitInfo.n.u1REP = fRep;
1034	IoExitInfo.n.u3SEG = iEffSeg & 7;
1035	IoExitInfo.n.u1Type = enmIoType;
1036	IoExitInfo.n.u16Port = u16Port;
1037
1038	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) offIoPm=%u fSizeMask=%#x cShift=%u fIopmMask=%#x -> #VMEXIT\n",
1039	u16Port, u16Port, offIopm, fSizeMask, cShift, fIopmMask));
1040	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
1041	}
1042
1043	/** @todo remove later (for debugging as VirtualBox always traps all IO
1044	* intercepts). */
1045	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1046	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1047	}
1048
1049
1050	/**
1051	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1052	* corresponding intercept is active.
1053	*
1054	* @returns Strict VBox status code.
1055	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1056	* specify interception of the accessed MSR @a idMsr.
1057	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1058	* successfully.
1059	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1060	* failed and a shutdown needs to be initiated for the geust.
1061	*
1062	* @param pVCpu The cross context virtual CPU structure.
1063	* @param pCtx The guest-CPU context.
1064	* @param idMsr The MSR being accessed in the nested-guest.
1065	* @param fWrite Whether this is an MSR write access, @c false implies an
1066	* MSR read.
1067	*/
1068	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1069	{
1070	/*
1071	* Check if any MSRs are being intercepted.
1072	*/
1073	Assert(CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1074	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1075
1076	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1077
1078	/*
1079	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1080	*/
1081	uint16_t offMsrpm;
1082	uint32_t uMsrpmBit;
1083	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1084	if (RT_SUCCESS(rc))
1085	{
1086	Assert(uMsrpmBit < 0x3fff);
1087	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1088	if (fWrite)
1089	++uMsrpmBit;
1090
1091	/*
1092	* Check if the bit is set, if so, trigger a #VMEXIT.
1093	*/
1094	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1095	pbMsrpm += offMsrpm;
1096	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1097	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1098	}
1099	else
1100	{
1101	/*
1102	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1103	*/
1104	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1105	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1106	}
1107	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1108	}
1109
1110
1111
1112	/**
1113	* Implements 'VMRUN'.
1114	*/
1115	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1116	{
1117	#ifndef IN_RING3
1118	return VINF_EM_RESCHEDULE_REM;
1119	#endif
1120
1121	LogFlow(("iemCImpl_vmrun\n"));
1122	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1123	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1124
1125	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1126	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1127	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1128	{
1129	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1130	return iemRaiseGeneralProtectionFault0(pVCpu);
1131	}
1132
1133	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1134	{
1135	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1136	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1137	}
1138
1139	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1140	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1141	{
1142	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1143	rcStrict = iemInitiateCpuShutdown(pVCpu);
1144	}
1145	return rcStrict;
1146	}
1147
1148
1149	/**
1150	* Implements 'VMMCALL'.
1151	*/
1152	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1153	{
1154	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1155	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1156	{
1157	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1158	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1159	}
1160
1161	bool fUpdatedRipAndRF;
1162	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1163	if (RT_SUCCESS(rcStrict))
1164	{
1165	if (!fUpdatedRipAndRF)
1166	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1167	return rcStrict;
1168	}
1169
1170	return iemRaiseUndefinedOpcode(pVCpu);
1171	}
1172
1173
1174	/**
1175	* Implements 'VMLOAD'.
1176	*/
1177	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1178	{
1179	#ifndef IN_RING3
1180	return VINF_EM_RAW_EMULATE_INSTR;
1181	#endif
1182
1183	LogFlow(("iemCImpl_vmload\n"));
1184	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1185	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1186
1187	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1188	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1189	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1190	{
1191	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1192	return iemRaiseGeneralProtectionFault0(pVCpu);
1193	}
1194
1195	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1196	{
1197	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1198	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1199	}
1200
1201	SVMVMCBSTATESAVE VmcbNstGst;
1202	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1203	sizeof(SVMVMCBSTATESAVE));
1204	if (rcStrict == VINF_SUCCESS)
1205	{
1206	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1207	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1208	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1209	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1210	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1211
1212	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1213	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1214	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1215	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1216	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1217
1218	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1219	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1220	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1221
1222	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1223	}
1224	return rcStrict;
1225	}
1226
1227
1228	/**
1229	* Implements 'VMSAVE'.
1230	*/
1231	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1232	{
1233	#ifndef IN_RING3
1234	return VINF_EM_RAW_EMULATE_INSTR;
1235	#endif
1236
1237	LogFlow(("iemCImpl_vmsave\n"));
1238	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1239	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1240
1241	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1242	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1243	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1244	{
1245	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1246	return iemRaiseGeneralProtectionFault0(pVCpu);
1247	}
1248
1249	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1250	{
1251	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1252	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1253	}
1254
1255	SVMVMCBSTATESAVE VmcbNstGst;
1256	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1257	sizeof(SVMVMCBSTATESAVE));
1258	if (rcStrict == VINF_SUCCESS)
1259	{
1260	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1261	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1262	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1263	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1264	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1265
1266	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1267	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1268	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1269	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1270	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1271
1272	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1273	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1274	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1275
1276	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1277	sizeof(SVMVMCBSTATESAVE));
1278	if (rcStrict == VINF_SUCCESS)
1279	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1280	}
1281	return rcStrict;
1282	}
1283
1284
1285	/**
1286	* Implements 'CLGI'.
1287	*/
1288	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1289	{
1290	#ifndef IN_RING3
1291	return VINF_EM_RESCHEDULE_REM;
1292	#endif
1293
1294	LogFlow(("iemCImpl_clgi\n"));
1295	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1296	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1297	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1298	{
1299	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1300	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1301	}
1302
1303	pCtx->hwvirt.svm.fGif = 0;
1304	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1305	#if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1306	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1307	#endif
1308	return VINF_SUCCESS;
1309	}
1310
1311
1312	/**
1313	* Implements 'STGI'.
1314	*/
1315	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1316	{
1317	#ifndef IN_RING3
1318	return VINF_EM_RESCHEDULE_REM;
1319	#endif
1320
1321	LogFlow(("iemCImpl_stgi\n"));
1322	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1323	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1324	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1325	{
1326	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1327	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1328	}
1329
1330	pCtx->hwvirt.svm.fGif = 1;
1331	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1332	#if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1333	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1334	#else
1335	return VINF_SUCCESS;
1336	#endif
1337	}
1338
1339
1340	/**
1341	* Implements 'INVLPGA'.
1342	*/
1343	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1344	{
1345	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1346	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1347	/** @todo PGM needs virtual ASID support. */
1348	#if 0
1349	uint32_t const uAsid = pCtx->ecx;
1350	#endif
1351
1352	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1353	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1354	{
1355	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1356	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1357	}
1358
1359	PGMInvalidatePage(pVCpu, GCPtrPage);
1360	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1361	return VINF_SUCCESS;
1362	}
1363
1364
1365	/**
1366	* Implements 'SKINIT'.
1367	*/
1368	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1369	{
1370	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1371
1372	uint32_t uIgnore;
1373	uint32_t fFeaturesECX;
1374	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1375	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1376	return iemRaiseUndefinedOpcode(pVCpu);
1377
1378	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1379	{
1380	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1381	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1382	}
1383
1384	RT_NOREF(cbInstr);
1385	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1386	}
1387

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 67925

Download in other formats: