IEMAllCImplSvmInstr.cpp.h@ 67945

Last change on this file since 67945 was 67945, checked in by vboxsync, 7 years ago
VMM/IEM: Nested Hw.virt: Fixes
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 59.5 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 67945 2017-07-13 09:49:32Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Helper for handling a SVM world-switch (VMRUN, \#VMEXIT).
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param uOldEfer EFER MSR prior to the world-switch.
59	* @param uOldCr0 CR0 prior to the world-switch.
60	*/
61	DECLINLINE(VBOXSTRICTRC) iemSvmHandleWorldSwitch(PVMCPU pVCpu, uint64_t uOldEfer, uint64_t uOldCr0)
62	{
63	RT_NOREF(uOldEfer); RT_NOREF(uOldCr0);
64
65	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
66
67	/*
68	* Inform PGM.
69	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
70	* see comment in iemMemPageTranslateAndCheckAccess().
71	*/
72	PGMFlushTLB(pVCpu, pCtx->cr3, true);
73	int rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
74	AssertRCReturn(rc, rc);
75
76	/* Inform CPUM (recompiler). */
77	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
78
79	/* Re-initialize IEM cache/state after the drastic mode switch. */
80	iemReInitExec(pVCpu);
81	return rc;
82	}
83
84
85	/**
86	* SVM \#VMEXIT handler.
87	*
88	* @returns Strict VBox status code.
89	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
90	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
91	* "host state" and a shutdown is required.
92	*
93	* @param pVCpu The cross context virtual CPU structure.
94	* @param pCtx The guest-CPU context.
95	* @param uExitCode The exit code.
96	* @param uExitInfo1 The exit info. 1 field.
97	* @param uExitInfo2 The exit info. 2 field.
98	*/
99	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
100	{
101	#ifndef IN_RING3
102	RT_NOREF(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
103	AssertMsgFailed(("iemSvmVmexit: Bad context\n"));
104	return VERR_INTERNAL_ERROR_5;
105	#else
106	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
107	\|\| uExitCode == SVM_EXIT_INVALID)
108	{
109	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
110	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
111
112	/*
113	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
114	*/
115	pCtx->hwvirt.svm.fGif = 0;
116
117	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
118	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
119	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
120	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
121
122	/*
123	* Save the nested-guest state into the VMCB state-save area.
124	*/
125	SVMVMCBSTATESAVE VmcbNstGst;
126	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, ES, es);
127	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, CS, cs);
128	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, SS, ss);
129	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, DS, ds);
130	VmcbNstGst.GDTR.u32Limit = pCtx->gdtr.cbGdt;
131	VmcbNstGst.GDTR.u64Base = pCtx->gdtr.pGdt;
132	VmcbNstGst.IDTR.u32Limit = pCtx->idtr.cbIdt;
133	VmcbNstGst.IDTR.u64Base = pCtx->idtr.pIdt;
134	VmcbNstGst.u64EFER = pCtx->msrEFER;
135	VmcbNstGst.u64CR4 = pCtx->cr4;
136	VmcbNstGst.u64CR3 = pCtx->cr3;
137	VmcbNstGst.u64CR2 = pCtx->cr2;
138	VmcbNstGst.u64CR0 = pCtx->cr0;
139	/** @todo Nested paging. */
140	VmcbNstGst.u64RFlags = pCtx->rflags.u64;
141	VmcbNstGst.u64RIP = pCtx->rip;
142	VmcbNstGst.u64RSP = pCtx->rsp;
143	VmcbNstGst.u64RAX = pCtx->rax;
144	VmcbNstGst.u64DR7 = pCtx->dr[6];
145	VmcbNstGst.u64DR6 = pCtx->dr[7];
146	VmcbNstGst.u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
147	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
148
149	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
150	/* Save interrupt shadow of the nested-guest instruction if any. */
151	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
152	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
153	{
154	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
155	pVmcbCtrl->u64IntShadow \|= SVM_INTERRUPT_SHADOW_ACTIVE;
156	}
157
158	/*
159	* Save additional state and intercept information.
160	*/
161	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
162	{
163	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
164	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
165	}
166	else
167	pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
168
169	/** @todo Save V_TPR, V_IRQ. */
170	/** @todo NRIP. */
171
172	/* Save exit information. */
173	pVmcbCtrl->u64ExitCode = uExitCode;
174	pVmcbCtrl->u64ExitInfo1 = uExitInfo1;
175	pVmcbCtrl->u64ExitInfo2 = uExitInfo2;
176
177	/*
178	* Update the exit interrupt information field if this #VMEXIT happened as a result
179	* of delivering an event.
180	*/
181	{
182	uint8_t uExitIntVector;
183	uint32_t uExitIntErr;
184	uint32_t fExitIntFlags;
185	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
186	NULL /* uExitIntCr2 */);
187	pVmcbCtrl->ExitIntInfo.n.u1Valid = fRaisingEvent;
188	if (fRaisingEvent)
189	{
190	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
191	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
192	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
193	{
194	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
195	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
196	}
197	}
198	}
199
200	/*
201	* Clear event injection in the VMCB.
202	*/
203	pVmcbCtrl->EventInject.n.u1Valid = 0;
204
205	/*
206	* Write back the VMCB controls to the guest VMCB in guest physical memory.
207	*/
208	VBOXSTRICTRC rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, pVmcbCtrl,
209	sizeof(*pVmcbCtrl));
210	/*
211	* Prepare for guest's "host mode" by clearing internal processor state bits.
212	*
213	* Some of these like TSC offset can then be used unconditionally in our TM code
214	* but the offset in the guest's VMCB will remain as it should as we've written
215	* back the VMCB controls above.
216	*/
217	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
218	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
219
220	if (RT_SUCCESS(rcStrict))
221	{
222	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
223	&VmcbNstGst, sizeof(VmcbNstGst));
224	if (RT_SUCCESS(rcStrict))
225	{
226	/** @todo Nested paging. */
227	/** @todo ASID. */
228
229	uint64_t const uOldCr0 = pCtx->cr0;
230	uint64_t const uOldEfer = pCtx->msrEFER;
231
232	/*
233	* Reload the guest's "host state".
234	*/
235	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
236	pCtx->es = pHostState->es;
237	pCtx->cs = pHostState->cs;
238	pCtx->ss = pHostState->ss;
239	pCtx->ds = pHostState->ds;
240	pCtx->gdtr = pHostState->gdtr;
241	pCtx->idtr = pHostState->idtr;
242	pCtx->msrEFER = pHostState->uEferMsr;
243	pCtx->cr0 = pHostState->uCr0 \| X86_CR0_PE;
244	pCtx->cr3 = pHostState->uCr3;
245	pCtx->cr4 = pHostState->uCr4;
246	pCtx->rflags = pHostState->rflags;
247	pCtx->rflags.Bits.u1VM = 0;
248	pCtx->rip = pHostState->uRip;
249	pCtx->rsp = pHostState->uRsp;
250	pCtx->rax = pHostState->uRax;
251	pCtx->dr[7] &= ~(X86_DR7_ENABLED_MASK \| X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
252	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
253
254	/** @todo if RIP is not canonical or outside the CS segment limit, we need to
255	* raise \#GP(0) in the guest. */
256
257	/** @todo check the loaded host-state for consistency. Figure out what
258	* exactly this involves? */
259
260	/* Restore guest's force-flags. */
261	if (pCtx->hwvirt.fLocalForcedActions)
262	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
263
264	/*
265	* Inform PGM and others of the world-switch.
266	*/
267	rcStrict = iemSvmHandleWorldSwitch(pVCpu, uOldEfer, uOldCr0);
268	if (rcStrict == VINF_SUCCESS)
269	return VINF_SVM_VMEXIT;
270
271	if (RT_SUCCESS(rcStrict))
272	{
273	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmHandleWorldSwitch %Rrc\n", rcStrict));
274	iemSetPassUpStatus(pVCpu, rcStrict);
275	return VINF_SVM_VMEXIT;
276	}
277
278	LogFlow(("iemSvmVmexit: iemSvmHandleWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
279	}
280	else
281	LogFlow(("iemSvmVmexit: Writing VMCB guest-state at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
282	VBOXSTRICTRC_VAL(rcStrict)));
283	}
284	else
285	LogFlow(("iemSvmVmexit: Writing VMCB guest-controls at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
286	VBOXSTRICTRC_VAL(rcStrict)));
287
288	return VERR_SVM_VMEXIT_FAILED;
289	}
290
291	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
292	uExitInfo1, uExitInfo2));
293	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
294	return VERR_SVM_IPE_5;
295	#endif
296	}
297
298
299	/**
300	* Performs the operations necessary that are part of the vmrun instruction
301	* execution in the guest.
302	*
303	* @returns Strict VBox status code (i.e. informational status codes too).
304	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
305	* code execution.
306	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
307	* (SVM_EXIT_INVALID most likely).
308	*
309	* @param pVCpu The cross context virtual CPU structure.
310	* @param pCtx Pointer to the guest-CPU context.
311	* @param cbInstr The length of the VMRUN instruction.
312	* @param GCPhysVmcb Guest physical address of the VMCB to run.
313	*/
314	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
315	{
316	#ifndef IN_RING3
317	RT_NOREF(pVCpu, pCtx, cbInstr, GCPhysVmcb);
318	return VINF_EM_RESCHEDULE_REM;
319	#else
320	PVM pVM = pVCpu->CTX_SUFF(pVM);
321	LogFlow(("iemSvmVmrun\n"));
322
323	/*
324	* Cache the physical address of the VMCB for #VMEXIT exceptions.
325	*/
326	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
327
328	/*
329	* Read the guest VMCB state.
330	*/
331	int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
332	if (RT_SUCCESS(rc))
333	{
334	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
335	PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
336
337	/*
338	* Save the host state.
339	*/
340	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
341	pHostState->es = pCtx->es;
342	pHostState->cs = pCtx->cs;
343	pHostState->ss = pCtx->ss;
344	pHostState->ds = pCtx->ds;
345	pHostState->gdtr = pCtx->gdtr;
346	pHostState->idtr = pCtx->idtr;
347	pHostState->uEferMsr = pCtx->msrEFER;
348	pHostState->uCr0 = pCtx->cr0;
349	pHostState->uCr3 = pCtx->cr3;
350	pHostState->uCr4 = pCtx->cr4;
351	pHostState->rflags = pCtx->rflags;
352	pHostState->uRip = pCtx->rip + cbInstr;
353	pHostState->uRsp = pCtx->rsp;
354	pHostState->uRax = pCtx->rax;
355
356	/*
357	* Validate guest-state and controls.
358	*/
359	/* VMRUN must always be iHMSntercepted. */
360	if (!CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_VMRUN))
361	{
362	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
363	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
364	}
365
366	/* Nested paging. */
367	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
368	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
369	{
370	Log(("iemSvmVmrun: Nested paging not supported -> #VMEXIT\n"));
371	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
372	}
373
374	/* AVIC. */
375	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
376	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
377	{
378	Log(("iemSvmVmrun: AVIC not supported -> #VMEXIT\n"));
379	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
380	}
381
382	/* Last branch record (LBR) virtualization. */
383	if ( (pVmcbCtrl->u64LBRVirt & SVM_LBR_VIRT_ENABLE)
384	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
385	{
386	Log(("iemSvmVmrun: LBR virtualization not supported -> #VMEXIT\n"));
387	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
388	}
389
390	/* Guest ASID. */
391	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
392	{
393	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
394	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
395	}
396
397	/* IO permission bitmap. */
398	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
399	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
400	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
401	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
402	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
403	{
404	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
405	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
406	}
407
408	/* MSR permission bitmap. */
409	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
410	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
411	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
412	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
413	{
414	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
415	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
416	}
417
418	/* CR0. */
419	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
420	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
421	{
422	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
423	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
424	}
425	if (pVmcbNstGst->u64CR0 >> 32)
426	{
427	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
428	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
429	}
430	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
431
432	/* DR6 and DR7. */
433	if ( pVmcbNstGst->u64DR6 >> 32
434	\|\| pVmcbNstGst->u64DR7 >> 32)
435	{
436	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
437	pVmcbNstGst->u64DR6));
438	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
439	}
440
441	/** @todo gPAT MSR validation? */
442
443	/*
444	* Copy the IO permission bitmap into the cache.
445	*/
446	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
447	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
448	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
449	if (RT_FAILURE(rc))
450	{
451	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
452	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
453	}
454
455	/*
456	* Copy the MSR permission bitmap into the cache.
457	*/
458	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
459	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
460	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
461	if (RT_FAILURE(rc))
462	{
463	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
464	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
465	}
466
467	/*
468	* Copy segments from nested-guest VMCB state to the guest-CPU state.
469	*
470	* We do this here as we need to use the CS attributes and it's easier this way
471	* then using the VMCB format selectors. It doesn't really matter where we copy
472	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
473	*/
474	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
475	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
476	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
477	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
478
479	/** @todo Segment attribute overrides by VMRUN. */
480
481	/*
482	* CPL adjustments and overrides.
483	*
484	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
485	* We shall thus adjust both CS.DPL and SS.DPL here.
486	*/
487	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
488	if (CPUMIsGuestInV86ModeEx(pCtx))
489	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
490	if (CPUMIsGuestInRealModeEx(pCtx))
491	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
492
493	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
494
495	/*
496	* Continue validating guest-state and controls.
497	*/
498	/* EFER, CR0 and CR4. */
499	uint64_t uValidEfer;
500	rc = CPUMQueryValidatedGuestEfer(pVM, pVmcbNstGst->u64CR0, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
501	if (RT_FAILURE(rc))
502	{
503	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
504	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
505	}
506	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
507	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
508	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
509	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
510	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
511	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
512	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
513	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
514	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
515	if (fLongModeWithPaging)
516	uValidEfer \|= MSR_K6_EFER_LMA;
517	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
518	if ( !fSvm
519	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
520	\|\| (fLongModeWithPaging && !fPae)
521	\|\| (fLongModeWithPaging && !fProtMode)
522	\|\| ( fLongModeEnabled
523	&& fPaging
524	&& fPae
525	&& fLongModeConformCS))
526	{
527	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
528	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
529	}
530
531	/*
532	* Preserve the required force-flags.
533	*
534	* We only preserve the force-flags that would affect the execution of the
535	* nested-guest (or the guest).
536	*
537	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
538	* instruction which is this VMRUN instruction itself.
539	*
540	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
541	* execution of a subsequent IRET instruction in the guest.
542	*
543	* - The remaining FFs (e.g. timers) can stay in place so that we will be
544	* able to generate interrupts that should cause #VMEXITs for the
545	* nested-guest.
546	*/
547	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
548
549	/*
550	* Interrupt shadow.
551	*/
552	if (pVmcbCtrl->u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
553	{
554	LogFlow(("iemSvmVmrun: setting inerrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
555	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
556	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
557	}
558
559	/*
560	* TLB flush control.
561	* Currently disabled since it's redundant as we unconditionally flush the TLB
562	* in iemSvmHandleWorldSwitch() below.
563	*/
564	#if 0
565	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
566	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
567	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
568	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
569	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
570	#endif
571
572	/** @todo @bugref{7243}: SVM TSC offset, see tmCpuTickGetInternal. */
573
574	uint64_t const uOldEfer = pCtx->msrEFER;
575	uint64_t const uOldCr0 = pCtx->cr0;
576
577	/*
578	* Copy the remaining guest state from the VMCB to the guest-CPU context.
579	*/
580	pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
581	pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
582	pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
583	pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
584	pCtx->cr0 = pVmcbNstGst->u64CR0; /** @todo What about informing PGM about CR0.WP? */
585	pCtx->cr4 = pVmcbNstGst->u64CR4;
586	pCtx->cr3 = pVmcbNstGst->u64CR3;
587	pCtx->cr2 = pVmcbNstGst->u64CR2;
588	pCtx->dr[6] = pVmcbNstGst->u64DR6;
589	pCtx->dr[7] = pVmcbNstGst->u64DR7;
590	pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
591	pCtx->rax = pVmcbNstGst->u64RAX;
592	pCtx->rsp = pVmcbNstGst->u64RSP;
593	pCtx->rip = pVmcbNstGst->u64RIP;
594	pCtx->msrEFER = uValidEfer;
595
596	/* Mask DR6, DR7 bits mandatory set/clear bits. */
597	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
598	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
599	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
600	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
601
602	/*
603	* Check for pending virtual interrupts.
604	*/
605	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
606	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
607	else
608	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
609
610	/*
611	* Clear global interrupt flags to allow interrupts in the guest.
612	*/
613	pCtx->hwvirt.svm.fGif = 1;
614
615	/*
616	* Inform PGM and others of the world-switch.
617	*/
618	VBOXSTRICTRC rcStrict = iemSvmHandleWorldSwitch(pVCpu, uOldEfer, uOldCr0);
619	if (rcStrict == VINF_SUCCESS)
620	{ /* likely */ }
621	else if (RT_SUCCESS(rcStrict))
622	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
623	else
624	{
625	LogFlow(("iemSvmVmrun: iemSvmHandleWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
626	return rcStrict;
627	}
628
629	/*
630	* Event injection.
631	*/
632	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
633	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
634	if (pEventInject->n.u1Valid)
635	{
636	uint8_t const uVector = pEventInject->n.u8Vector;
637	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
638	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
639
640	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
641	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
642	{
643	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
644	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
645	}
646	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
647	{
648	if ( uVector == X86_XCPT_NMI
649	\|\| uVector > X86_XCPT_LAST)
650	{
651	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
652	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
653	}
654	if ( uVector == X86_XCPT_BR
655	&& CPUMIsGuestInLongModeEx(pCtx))
656	{
657	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
658	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
659	}
660	/** @todo any others? */
661	}
662
663	/*
664	* Update the exit interruption info field so that if an exception occurs
665	* while delivering the event causing a #VMEXIT, we only need to update
666	* the valid bit while the rest is already in place.
667	*/
668	pVmcbCtrl->ExitIntInfo.u = pVmcbCtrl->EventInject.u;
669	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
670
671	/** @todo NRIP: Software interrupts can only be pushed properly if we support
672	* NRIP for the nested-guest to calculate the instruction length
673	* below. */
674	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 uVector=%#x enmType=%d uErrorCode=%u cr2=%#RX64\n",
675	pCtx->cs.Sel, pCtx->rip, uVector, enmType,uErrorCode, pCtx->cr2));
676	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
677	}
678	else
679	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
680	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
681
682	return rcStrict;
683	}
684
685	/* Shouldn't really happen as the caller should've validated the physical address already. */
686	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
687	return rc;
688	#endif
689	}
690
691
692	#if 0
693	/**
694	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
695	* intercept is active.
696	*
697	* @returns Strict VBox status code.
698	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
699	* we're not executing a nested-guest.
700	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
701	* successfully.
702	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
703	* failed and a shutdown needs to be initiated for the geust.
704	*
705	* @param pVCpu The cross context virtual CPU structure.
706	* @param pCtx The guest-CPU context.
707	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
708	* @param uExitInfo1 The exit info. 1 field.
709	* @param uExitInfo2 The exit info. 2 field.
710	*/
711	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
712	uint64_t uExitInfo2)
713	{
714	#define HMSVM_CTRL_INTERCEPT_VMEXIT(a_Intercept) \
715	do { \
716	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
717	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
718	break; \
719	} while (0)
720
721	if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
722	return VINF_HM_INTERCEPT_NOT_ACTIVE;
723
724	switch (uExitCode)
725	{
726	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
727	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
728	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
729	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
730	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
731	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
732	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
733	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
734	{
735	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
736	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
737	break;
738	}
739
740	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
741	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
742	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
743	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
744	{
745	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
746	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
747	break;
748	}
749
750	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
751	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
752	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
753	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
754	{
755	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
756	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
757	break;
758	}
759
760	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
761	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
762	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
763	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
764	{
765	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
766	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
767	break;
768	}
769
770	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
771	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
772	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
773	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
774	{
775	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
776	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
777	break;
778	}
779
780	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTR);
781	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_NMI);
782	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SMI);
783	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INIT);
784	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VINTR);
785	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
786	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_READS);
787	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_READS);
788	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_READS);
789	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_READS);
790	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_WRITES);
791	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_WRITES);
792	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_WRITES);
793	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_WRITES);
794	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSC);
795	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDPMC);
796	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PUSHF);
797	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_POPF);
798	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CPUID);
799	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RSM);
800	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IRET);
801	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTN);
802	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVD);
803	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PAUSE);
804	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_HLT);
805	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPG);
806	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPGA);
807	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TASK_SWITCH);
808	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_FERR_FREEZE);
809	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SHUTDOWN);
810	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMRUN);
811	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMMCALL);
812	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMLOAD);
813	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMSAVE);
814	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_STGI);
815	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CLGI);
816	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SKINIT);
817	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSCP);
818	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_ICEBP);
819	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_WBINVD);
820	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MONITOR);
821	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT);
822	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
823	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_XSETBV);
824
825	case SVM_EXIT_IOIO:
826	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
827	return VERR_SVM_IPE_1;
828
829	case SVM_EXIT_MSR:
830	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
831	return VERR_SVM_IPE_1;
832
833	case SVM_EXIT_NPF:
834	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
835	case SVM_EXIT_AVIC_NOACCEL:
836	AssertMsgFailed(("Todo Implement.\n"));
837	return VERR_SVM_IPE_1;
838
839	default:
840	AssertMsgFailed(("Unsupported SVM exit code %#RX64\n", uExitCode));
841	return VERR_SVM_IPE_1;
842	}
843
844	return VINF_HM_INTERCEPT_NOT_ACTIVE;
845
846	#undef HMSVM_CTRL_INTERCEPT_VMEXIT
847	}
848	#endif
849
850
851	/**
852	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
853	* intercept is active.
854	*
855	* @returns Strict VBox status code.
856	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
857	* we're not executing a nested-guest.
858	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
859	* successfully.
860	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
861	* failed and a shutdown needs to be initiated for the geust.
862	*
863	* @returns VBox strict status code.
864	* @param pVCpu The cross context virtual CPU structure of the calling thread.
865	* @param u16Port The IO port being accessed.
866	* @param enmIoType The type of IO access.
867	* @param cbReg The IO operand size in bytes.
868	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
869	* @param iEffSeg The effective segment number.
870	* @param fRep Whether this is a repeating IO instruction (REP prefix).
871	* @param fStrIo Whether this is a string IO instruction.
872	* @param cbInstr The length of the IO instruction in bytes.
873	*/
874	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
875	uint64_t uCr2)
876	{
877	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
878
879	/*
880	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
881	*
882	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_EXCEPTION_2 #VMEXITs.
883	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
884	* even when they use a vector in the range 0 to 31.
885	* - ICEBP should not trigger #DB intercept, but its own intercept.
886	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
887	*/
888	/* Check NMI intercept */
889	if ( u8Vector == X86_XCPT_NMI
890	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
891	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
892	{
893	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
894	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
895	}
896
897	/* Check ICEBP intercept. */
898	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
899	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
900	{
901	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
902	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
903	}
904
905	/* Check CPU exception intercepts. */
906	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
907	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
908	{
909	Assert(u8Vector <= X86_XCPT_LAST);
910	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
911	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
912	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist
913	&& u8Vector == X86_XCPT_PF
914	&& !(uErr & X86_TRAP_PF_ID))
915	{
916	/** @todo Nested-guest SVM - figure out fetching op-code bytes from IEM. */
917	#ifdef IEM_WITH_CODE_TLB
918	AssertReleaseFailedReturn(VERR_IEM_IPE_5);
919	#else
920	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
921	uint8_t const offOpCode = pVCpu->iem.s.offOpcode;
922	uint8_t const cbCurrent = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode;
923	if ( cbCurrent > 0
924	&& cbCurrent < sizeof(pVmcbCtrl->abInstr))
925	{
926	Assert(cbCurrent <= sizeof(pVCpu->iem.s.abOpcode));
927	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[offOpCode], cbCurrent);
928	}
929	#endif
930	}
931	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
932	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
933	u8Vector, uExitInfo1, uExitInfo2));
934	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_EXCEPTION_0 + u8Vector, uExitInfo1, uExitInfo2);
935	}
936
937	/* Check software interrupt (INTn) intercepts. */
938	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
939	\| IEM_XCPT_FLAGS_BP_INSTR
940	\| IEM_XCPT_FLAGS_ICEBP_INSTR
941	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
942	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
943	{
944	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist ? u8Vector : 0;
945	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
946	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
947	}
948
949	return VINF_HM_INTERCEPT_NOT_ACTIVE;
950	}
951
952
953	/**
954	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
955	* corresponding intercept is active.
956	*
957	* @returns Strict VBox status code.
958	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
959	* we're not executing a nested-guest.
960	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
961	* successfully.
962	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
963	* failed and a shutdown needs to be initiated for the geust.
964	*
965	* @returns VBox strict status code.
966	* @param pVCpu The cross context virtual CPU structure of the calling thread.
967	* @param u16Port The IO port being accessed.
968	* @param enmIoType The type of IO access.
969	* @param cbReg The IO operand size in bytes.
970	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
971	* @param iEffSeg The effective segment number.
972	* @param fRep Whether this is a repeating IO instruction (REP prefix).
973	* @param fStrIo Whether this is a string IO instruction.
974	* @param cbInstr The length of the IO instruction in bytes.
975	*/
976	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
977	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
978	{
979	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
980	Assert(cAddrSizeBits == 0 \|\| cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
981	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
982
983	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
984
985	/*
986	* The IOPM layout:
987	* Each bit represents one 8-bit port. That makes a total of 0..65535 bits or
988	* two 4K pages.
989	*
990	* For IO instructions that access more than a single byte, the permission bits
991	* for all bytes are checked; if any bit is set to 1, the IO access is intercepted.
992	*
993	* Since it's possible to do a 32-bit IO access at port 65534 (accessing 4 bytes),
994	* we need 3 extra bits beyond the second 4K page.
995	*/
996	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
997	static const uint16_t s_auSizeMasks[] = { 0, 1, 3, 0, 0xf, 0, 0, 0 };
998
999	uint16_t const offIopm = u16Port >> 3;
1000	uint16_t const fSizeMask = s_auSizeMasks[(cAddrSizeBits >> SVM_IOIO_OP_SIZE_SHIFT) & 7];
1001	uint8_t const cShift = u16Port - (offIopm << 3);
1002	uint16_t const fIopmMask = (1 << cShift) \| (fSizeMask << cShift);
1003
1004	uint8_t const pbIopm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
1005	Assert(pbIopm);
1006	pbIopm += offIopm;
1007	uint16_t const u16Iopm = (uint16_t )pbIopm;
1008	if (u16Iopm & fIopmMask)
1009	{
1010	static const uint32_t s_auIoOpSize[] =
1011	{ SVM_IOIO_32_BIT_OP, SVM_IOIO_8_BIT_OP, SVM_IOIO_16_BIT_OP, 0, SVM_IOIO_32_BIT_OP, 0, 0, 0 };
1012
1013	static const uint32_t s_auIoAddrSize[] =
1014	{ 0, SVM_IOIO_16_BIT_ADDR, SVM_IOIO_32_BIT_ADDR, 0, SVM_IOIO_64_BIT_ADDR, 0, 0, 0 };
1015
1016	SVMIOIOEXITINFO IoExitInfo;
1017	IoExitInfo.u = s_auIoOpSize[cbReg & 7];
1018	IoExitInfo.u \|= s_auIoAddrSize[(cAddrSizeBits >> 4) & 7];
1019	IoExitInfo.n.u1STR = fStrIo;
1020	IoExitInfo.n.u1REP = fRep;
1021	IoExitInfo.n.u3SEG = iEffSeg & 7;
1022	IoExitInfo.n.u1Type = enmIoType;
1023	IoExitInfo.n.u16Port = u16Port;
1024
1025	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) offIoPm=%u fSizeMask=%#x cShift=%u fIopmMask=%#x -> #VMEXIT\n",
1026	u16Port, u16Port, offIopm, fSizeMask, cShift, fIopmMask));
1027	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
1028	}
1029
1030	/** @todo remove later (for debugging as VirtualBox always traps all IO
1031	* intercepts). */
1032	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1033	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1034	}
1035
1036
1037	/**
1038	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1039	* corresponding intercept is active.
1040	*
1041	* @returns Strict VBox status code.
1042	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1043	* specify interception of the accessed MSR @a idMsr.
1044	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1045	* successfully.
1046	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1047	* failed and a shutdown needs to be initiated for the geust.
1048	*
1049	* @param pVCpu The cross context virtual CPU structure.
1050	* @param pCtx The guest-CPU context.
1051	* @param idMsr The MSR being accessed in the nested-guest.
1052	* @param fWrite Whether this is an MSR write access, @c false implies an
1053	* MSR read.
1054	*/
1055	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1056	{
1057	/*
1058	* Check if any MSRs are being intercepted.
1059	*/
1060	Assert(CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1061	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1062
1063	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1064
1065	/*
1066	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1067	*/
1068	uint16_t offMsrpm;
1069	uint32_t uMsrpmBit;
1070	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1071	if (RT_SUCCESS(rc))
1072	{
1073	Assert(uMsrpmBit < 0x3fff);
1074	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1075	if (fWrite)
1076	++uMsrpmBit;
1077
1078	/*
1079	* Check if the bit is set, if so, trigger a #VMEXIT.
1080	*/
1081	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1082	pbMsrpm += offMsrpm;
1083	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1084	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1085	}
1086	else
1087	{
1088	/*
1089	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1090	*/
1091	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1092	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1093	}
1094	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1095	}
1096
1097
1098
1099	/**
1100	* Implements 'VMRUN'.
1101	*/
1102	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1103	{
1104	#ifndef IN_RING3
1105	RT_NOREF2(pVCpu, cbInstr);
1106	return VINF_EM_RESCHEDULE_REM;
1107	#else
1108	LogFlow(("iemCImpl_vmrun\n"));
1109	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1110	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1111
1112	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1113	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1114	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1115	{
1116	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1117	return iemRaiseGeneralProtectionFault0(pVCpu);
1118	}
1119
1120	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1121	{
1122	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1123	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1124	}
1125
1126	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1127	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1128	{
1129	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1130	rcStrict = iemInitiateCpuShutdown(pVCpu);
1131	}
1132	return rcStrict;
1133	#endif
1134	}
1135
1136
1137	/**
1138	* Implements 'VMMCALL'.
1139	*/
1140	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1141	{
1142	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1143	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1144	{
1145	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1146	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1147	}
1148
1149	bool fUpdatedRipAndRF;
1150	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1151	if (RT_SUCCESS(rcStrict))
1152	{
1153	if (!fUpdatedRipAndRF)
1154	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1155	return rcStrict;
1156	}
1157
1158	return iemRaiseUndefinedOpcode(pVCpu);
1159	}
1160
1161
1162	/**
1163	* Implements 'VMLOAD'.
1164	*/
1165	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1166	{
1167	#ifndef IN_RING3
1168	RT_NOREF2(pVCpu, cbInstr);
1169	return VINF_EM_RAW_EMULATE_INSTR;
1170	#else
1171	LogFlow(("iemCImpl_vmload\n"));
1172	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1173	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1174
1175	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1176	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1177	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1178	{
1179	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1180	return iemRaiseGeneralProtectionFault0(pVCpu);
1181	}
1182
1183	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1184	{
1185	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1186	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1187	}
1188
1189	SVMVMCBSTATESAVE VmcbNstGst;
1190	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1191	sizeof(SVMVMCBSTATESAVE));
1192	if (rcStrict == VINF_SUCCESS)
1193	{
1194	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1195	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1196	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1197	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1198	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1199
1200	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1201	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1202	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1203	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1204	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1205
1206	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1207	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1208	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1209
1210	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1211	}
1212	return rcStrict;
1213	#endif
1214	}
1215
1216
1217	/**
1218	* Implements 'VMSAVE'.
1219	*/
1220	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1221	{
1222	#ifndef IN_RING3
1223	RT_NOREF2(pVCpu, cbInstr);
1224	return VINF_EM_RAW_EMULATE_INSTR;
1225	#else
1226	LogFlow(("iemCImpl_vmsave\n"));
1227	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1228	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1229
1230	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1231	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1232	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1233	{
1234	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1235	return iemRaiseGeneralProtectionFault0(pVCpu);
1236	}
1237
1238	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1239	{
1240	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1241	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1242	}
1243
1244	SVMVMCBSTATESAVE VmcbNstGst;
1245	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1246	sizeof(SVMVMCBSTATESAVE));
1247	if (rcStrict == VINF_SUCCESS)
1248	{
1249	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1250	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1251	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1252	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1253	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1254
1255	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1256	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1257	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1258	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1259	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1260
1261	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1262	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1263	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1264
1265	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1266	sizeof(SVMVMCBSTATESAVE));
1267	if (rcStrict == VINF_SUCCESS)
1268	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1269	}
1270	return rcStrict;
1271	#endif
1272	}
1273
1274
1275	/**
1276	* Implements 'CLGI'.
1277	*/
1278	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1279	{
1280	#ifndef IN_RING3
1281	RT_NOREF2(pVCpu, cbInstr);
1282	return VINF_EM_RESCHEDULE_REM;
1283	#else
1284	LogFlow(("iemCImpl_clgi\n"));
1285	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1286	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1287	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1288	{
1289	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1290	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1291	}
1292
1293	pCtx->hwvirt.svm.fGif = 0;
1294	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1295	# if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1296	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1297	# else
1298	return VINF_SUCCESS;
1299	# endif
1300	#endif
1301	}
1302
1303
1304	/**
1305	* Implements 'STGI'.
1306	*/
1307	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1308	{
1309	#ifndef IN_RING3
1310	RT_NOREF2(pVCpu, cbInstr);
1311	return VINF_EM_RESCHEDULE_REM;
1312	#else
1313	LogFlow(("iemCImpl_stgi\n"));
1314	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1315	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1316	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1317	{
1318	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1319	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1320	}
1321
1322	pCtx->hwvirt.svm.fGif = 1;
1323	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1324	# if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1325	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1326	# else
1327	return VINF_SUCCESS;
1328	# endif
1329	#endif
1330	}
1331
1332
1333	/**
1334	* Implements 'INVLPGA'.
1335	*/
1336	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1337	{
1338	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1339	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1340	/** @todo PGM needs virtual ASID support. */
1341	#if 0
1342	uint32_t const uAsid = pCtx->ecx;
1343	#endif
1344
1345	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1346	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1347	{
1348	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1349	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1350	}
1351
1352	PGMInvalidatePage(pVCpu, GCPtrPage);
1353	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1354	return VINF_SUCCESS;
1355	}
1356
1357
1358	/**
1359	* Implements 'SKINIT'.
1360	*/
1361	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1362	{
1363	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1364
1365	uint32_t uIgnore;
1366	uint32_t fFeaturesECX;
1367	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1368	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1369	return iemRaiseUndefinedOpcode(pVCpu);
1370
1371	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1372	{
1373	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1374	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1375	}
1376
1377	RT_NOREF(cbInstr);
1378	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1379	}
1380

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 67945

Download in other formats: