IEMAllCImplSvmInstr.cpp.h@ 68226

Last change on this file since 68226 was 68150, checked in by vboxsync, 7 years ago
VMM/IEM: Nested Hw.virt: Fixes.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 59.2 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 68150 2017-07-28 08:32:26Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param pCtx The guest-CPU context.
59	*/
60	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu, PCPUMCTX pCtx)
61	{
62	/* Flush the TLB with new CR3. */
63	PGMFlushTLB(pVCpu, pCtx->cr3, true);
64
65	/*
66	* Inform PGM about paging mode changes.
67	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
68	* see comment in iemMemPageTranslateAndCheckAccess().
69	*/
70	int rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
71	AssertRCReturn(rc, rc);
72
73	/* Inform CPUM (recompiler), can later be removed. */
74	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
75
76	/* Re-initialize IEM cache/state after the drastic mode switch. */
77	iemReInitExec(pVCpu);
78	return rc;
79	}
80
81
82	/**
83	* SVM \#VMEXIT handler.
84	*
85	* @returns Strict VBox status code.
86	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
87	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
88	* "host state" and a shutdown is required.
89	*
90	* @param pVCpu The cross context virtual CPU structure.
91	* @param pCtx The guest-CPU context.
92	* @param uExitCode The exit code.
93	* @param uExitInfo1 The exit info. 1 field.
94	* @param uExitInfo2 The exit info. 2 field.
95	*/
96	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
97	{
98	#ifndef IN_RING3
99	RT_NOREF(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
100	AssertMsgFailed(("iemSvmVmexit: Bad context\n"));
101	return VERR_INTERNAL_ERROR_5;
102	#else
103	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
104	\|\| uExitCode == SVM_EXIT_INVALID)
105	{
106	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
107	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
108
109	/*
110	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
111	*/
112	pCtx->hwvirt.svm.fGif = 0;
113
114	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
115	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
116	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
117	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
118
119	/*
120	* Save the nested-guest state into the VMCB state-save area.
121	*/
122	SVMVMCBSTATESAVE VmcbNstGst;
123	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, ES, es);
124	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, CS, cs);
125	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, SS, ss);
126	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, DS, ds);
127	VmcbNstGst.GDTR.u32Limit = pCtx->gdtr.cbGdt;
128	VmcbNstGst.GDTR.u64Base = pCtx->gdtr.pGdt;
129	VmcbNstGst.IDTR.u32Limit = pCtx->idtr.cbIdt;
130	VmcbNstGst.IDTR.u64Base = pCtx->idtr.pIdt;
131	VmcbNstGst.u64EFER = pCtx->msrEFER;
132	VmcbNstGst.u64CR4 = pCtx->cr4;
133	VmcbNstGst.u64CR3 = pCtx->cr3;
134	VmcbNstGst.u64CR2 = pCtx->cr2;
135	VmcbNstGst.u64CR0 = pCtx->cr0;
136	/** @todo Nested paging. */
137	VmcbNstGst.u64RFlags = pCtx->rflags.u64;
138	VmcbNstGst.u64RIP = pCtx->rip;
139	VmcbNstGst.u64RSP = pCtx->rsp;
140	VmcbNstGst.u64RAX = pCtx->rax;
141	VmcbNstGst.u64DR7 = pCtx->dr[6];
142	VmcbNstGst.u64DR6 = pCtx->dr[7];
143	VmcbNstGst.u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
144	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
145
146	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
147	/* Save interrupt shadow of the nested-guest instruction if any. */
148	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
149	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
150	{
151	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
152	pVmcbCtrl->u64IntShadow \|= SVM_INTERRUPT_SHADOW_ACTIVE;
153	}
154
155	/*
156	* Save additional state and intercept information.
157	*/
158	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
159	{
160	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
161	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
162	}
163	else
164	pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
165
166	/** @todo Save V_TPR, V_IRQ. */
167	/** @todo NRIP. */
168
169	/* Save exit information. */
170	pVmcbCtrl->u64ExitCode = uExitCode;
171	pVmcbCtrl->u64ExitInfo1 = uExitInfo1;
172	pVmcbCtrl->u64ExitInfo2 = uExitInfo2;
173
174	/*
175	* Update the exit interrupt information field if this #VMEXIT happened as a result
176	* of delivering an event.
177	*/
178	{
179	uint8_t uExitIntVector;
180	uint32_t uExitIntErr;
181	uint32_t fExitIntFlags;
182	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
183	NULL /* uExitIntCr2 */);
184	pVmcbCtrl->ExitIntInfo.n.u1Valid = fRaisingEvent;
185	if (fRaisingEvent)
186	{
187	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
188	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
189	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
190	{
191	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
192	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
193	}
194	}
195	}
196
197	/*
198	* Clear event injection in the VMCB.
199	*/
200	pVmcbCtrl->EventInject.n.u1Valid = 0;
201
202	/*
203	* Write back the VMCB controls to the guest VMCB in guest physical memory.
204	*/
205	VBOXSTRICTRC rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, pVmcbCtrl,
206	sizeof(*pVmcbCtrl));
207	/*
208	* Prepare for guest's "host mode" by clearing internal processor state bits.
209	*
210	* Some of these like TSC offset can then be used unconditionally in our TM code
211	* but the offset in the guest's VMCB will remain as it should as we've written
212	* back the VMCB controls above.
213	*/
214	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
215	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
216
217	if (RT_SUCCESS(rcStrict))
218	{
219	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
220	&VmcbNstGst, sizeof(VmcbNstGst));
221	if (RT_SUCCESS(rcStrict))
222	{
223	/** @todo Nested paging. */
224	/** @todo ASID. */
225
226	/*
227	* Reload the guest's "host state".
228	*/
229	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
230	pCtx->es = pHostState->es;
231	pCtx->cs = pHostState->cs;
232	pCtx->ss = pHostState->ss;
233	pCtx->ds = pHostState->ds;
234	pCtx->gdtr = pHostState->gdtr;
235	pCtx->idtr = pHostState->idtr;
236	pCtx->msrEFER = pHostState->uEferMsr;
237	pCtx->cr0 = pHostState->uCr0 \| X86_CR0_PE;
238	pCtx->cr3 = pHostState->uCr3;
239	pCtx->cr4 = pHostState->uCr4;
240	pCtx->rflags = pHostState->rflags;
241	pCtx->rflags.Bits.u1VM = 0;
242	pCtx->rip = pHostState->uRip;
243	pCtx->rsp = pHostState->uRsp;
244	pCtx->rax = pHostState->uRax;
245	pCtx->dr[7] &= ~(X86_DR7_ENABLED_MASK \| X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
246	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
247
248	/** @todo if RIP is not canonical or outside the CS segment limit, we need to
249	* raise \#GP(0) in the guest. */
250
251	/** @todo check the loaded host-state for consistency. Figure out what
252	* exactly this involves? */
253
254	/* Restore guest's force-flags. */
255	if (pCtx->hwvirt.fLocalForcedActions)
256	{
257	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
258	pCtx->hwvirt.fLocalForcedActions = 0;
259	}
260
261	/*
262	* Update PGM, IEM and others of a world-switch.
263	*/
264	rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
265	if (rcStrict == VINF_SUCCESS)
266	return VINF_SVM_VMEXIT;
267
268	if (RT_SUCCESS(rcStrict))
269	{
270	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", rcStrict));
271	iemSetPassUpStatus(pVCpu, rcStrict);
272	return VINF_SVM_VMEXIT;
273	}
274
275	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
276	}
277	else
278	LogFlow(("iemSvmVmexit: Writing VMCB guest-state at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
279	VBOXSTRICTRC_VAL(rcStrict)));
280	}
281	else
282	LogFlow(("iemSvmVmexit: Writing VMCB guest-controls at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
283	VBOXSTRICTRC_VAL(rcStrict)));
284
285	return VERR_SVM_VMEXIT_FAILED;
286	}
287
288	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
289	uExitInfo1, uExitInfo2));
290	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
291	return VERR_SVM_IPE_5;
292	#endif
293	}
294
295
296	/**
297	* Performs the operations necessary that are part of the vmrun instruction
298	* execution in the guest.
299	*
300	* @returns Strict VBox status code (i.e. informational status codes too).
301	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
302	* code execution.
303	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
304	* (SVM_EXIT_INVALID most likely).
305	*
306	* @param pVCpu The cross context virtual CPU structure.
307	* @param pCtx Pointer to the guest-CPU context.
308	* @param cbInstr The length of the VMRUN instruction.
309	* @param GCPhysVmcb Guest physical address of the VMCB to run.
310	*/
311	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
312	{
313	#ifndef IN_RING3
314	RT_NOREF(pVCpu, pCtx, cbInstr, GCPhysVmcb);
315	return VINF_EM_RESCHEDULE_REM;
316	#else
317	PVM pVM = pVCpu->CTX_SUFF(pVM);
318	LogFlow(("iemSvmVmrun\n"));
319
320	/*
321	* Cache the physical address of the VMCB for #VMEXIT exceptions.
322	*/
323	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
324
325	/*
326	* Save the host state.
327	*/
328	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
329	pHostState->es = pCtx->es;
330	pHostState->cs = pCtx->cs;
331	pHostState->ss = pCtx->ss;
332	pHostState->ds = pCtx->ds;
333	pHostState->gdtr = pCtx->gdtr;
334	pHostState->idtr = pCtx->idtr;
335	pHostState->uEferMsr = pCtx->msrEFER;
336	pHostState->uCr0 = pCtx->cr0;
337	pHostState->uCr3 = pCtx->cr3;
338	pHostState->uCr4 = pCtx->cr4;
339	pHostState->rflags = pCtx->rflags;
340	pHostState->uRip = pCtx->rip + cbInstr;
341	pHostState->uRsp = pCtx->rsp;
342	pHostState->uRax = pCtx->rax;
343
344	/*
345	* Read the guest VMCB state.
346	*/
347	int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
348	if (RT_SUCCESS(rc))
349	{
350	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
351	PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
352
353	/*
354	* Validate guest-state and controls.
355	*/
356	/* VMRUN must always be intercepted. */
357	if (!CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_VMRUN))
358	{
359	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
360	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
361	}
362
363	/* Nested paging. */
364	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
365	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
366	{
367	Log(("iemSvmVmrun: Nested paging not supported -> #VMEXIT\n"));
368	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
369	}
370
371	/* AVIC. */
372	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
373	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
374	{
375	Log(("iemSvmVmrun: AVIC not supported -> #VMEXIT\n"));
376	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
377	}
378
379	/* Last branch record (LBR) virtualization. */
380	if ( (pVmcbCtrl->u64LBRVirt & SVM_LBR_VIRT_ENABLE)
381	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
382	{
383	Log(("iemSvmVmrun: LBR virtualization not supported -> #VMEXIT\n"));
384	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
385	}
386
387	/* Guest ASID. */
388	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
389	{
390	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
391	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
392	}
393
394	/* IO permission bitmap. */
395	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
396	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
397	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
398	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
399	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
400	{
401	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
402	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
403	}
404
405	/* MSR permission bitmap. */
406	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
407	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
408	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
409	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
410	{
411	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
412	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
413	}
414
415	/* CR0. */
416	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
417	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
418	{
419	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
420	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
421	}
422	if (pVmcbNstGst->u64CR0 >> 32)
423	{
424	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
425	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
426	}
427	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
428
429	/* DR6 and DR7. */
430	if ( pVmcbNstGst->u64DR6 >> 32
431	\|\| pVmcbNstGst->u64DR7 >> 32)
432	{
433	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
434	pVmcbNstGst->u64DR6));
435	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
436	}
437
438	/** @todo gPAT MSR validation? */
439
440	/*
441	* Copy the IO permission bitmap into the cache.
442	*/
443	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
444	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
445	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
446	if (RT_FAILURE(rc))
447	{
448	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
449	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
450	}
451
452	/*
453	* Copy the MSR permission bitmap into the cache.
454	*/
455	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
456	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
457	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
458	if (RT_FAILURE(rc))
459	{
460	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
461	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
462	}
463
464	/*
465	* Copy segments from nested-guest VMCB state to the guest-CPU state.
466	*
467	* We do this here as we need to use the CS attributes and it's easier this way
468	* then using the VMCB format selectors. It doesn't really matter where we copy
469	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
470	*/
471	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
472	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
473	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
474	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
475
476	/** @todo Segment attribute overrides by VMRUN. */
477
478	/*
479	* CPL adjustments and overrides.
480	*
481	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
482	* We shall thus adjust both CS.DPL and SS.DPL here.
483	*/
484	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
485	if (CPUMIsGuestInV86ModeEx(pCtx))
486	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
487	if (CPUMIsGuestInRealModeEx(pCtx))
488	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
489
490	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
491
492	/*
493	* Continue validating guest-state and controls.
494	*/
495	/* EFER, CR0 and CR4. */
496	uint64_t uValidEfer;
497	rc = CPUMQueryValidatedGuestEfer(pVM, pVmcbNstGst->u64CR0, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
498	if (RT_FAILURE(rc))
499	{
500	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
501	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
502	}
503	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
504	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
505	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
506	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
507	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
508	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
509	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
510	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
511	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
512	if (fLongModeWithPaging)
513	uValidEfer \|= MSR_K6_EFER_LMA;
514	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
515	if ( !fSvm
516	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
517	\|\| (fLongModeWithPaging && !fPae)
518	\|\| (fLongModeWithPaging && !fProtMode)
519	\|\| ( fLongModeEnabled
520	&& fPaging
521	&& fPae
522	&& fLongModeConformCS))
523	{
524	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
525	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
526	}
527
528	/*
529	* Preserve the required force-flags.
530	*
531	* We only preserve the force-flags that would affect the execution of the
532	* nested-guest (or the guest).
533	*
534	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
535	* instruction which is this VMRUN instruction itself.
536	*
537	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
538	* execution of a subsequent IRET instruction in the guest.
539	*
540	* - The remaining FFs (e.g. timers) can stay in place so that we will be
541	* able to generate interrupts that should cause #VMEXITs for the
542	* nested-guest.
543	*/
544	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
545
546	/*
547	* Interrupt shadow.
548	*/
549	if (pVmcbCtrl->u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
550	{
551	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
552	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
553	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
554	}
555
556	/*
557	* TLB flush control.
558	* Currently disabled since it's redundant as we unconditionally flush the TLB
559	* in iemSvmWorldSwitch() below.
560	*/
561	#if 0
562	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
563	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
564	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
565	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
566	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
567	#endif
568
569	/** @todo @bugref{7243}: SVM TSC offset, see tmCpuTickGetInternal. */
570
571	/*
572	* Copy the remaining guest state from the VMCB to the guest-CPU context.
573	*/
574	pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
575	pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
576	pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
577	pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
578	pCtx->cr0 = pVmcbNstGst->u64CR0; /** @todo What about informing PGM about CR0.WP? */
579	pCtx->cr4 = pVmcbNstGst->u64CR4;
580	pCtx->cr3 = pVmcbNstGst->u64CR3;
581	pCtx->cr2 = pVmcbNstGst->u64CR2;
582	pCtx->dr[6] = pVmcbNstGst->u64DR6;
583	pCtx->dr[7] = pVmcbNstGst->u64DR7;
584	pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
585	pCtx->rax = pVmcbNstGst->u64RAX;
586	pCtx->rsp = pVmcbNstGst->u64RSP;
587	pCtx->rip = pVmcbNstGst->u64RIP;
588	pCtx->msrEFER = uValidEfer;
589
590	/* Mask DR6, DR7 bits mandatory set/clear bits. */
591	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
592	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
593	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
594	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
595
596	/*
597	* Check for pending virtual interrupts.
598	*/
599	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
600	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
601	else
602	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
603
604	/*
605	* Update PGM, IEM and others of a world-switch.
606	*/
607	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
608	if (rcStrict == VINF_SUCCESS)
609	{ /* likely */ }
610	else if (RT_SUCCESS(rcStrict))
611	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
612	else
613	{
614	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
615	return rcStrict;
616	}
617
618	/*
619	* Clear global interrupt flags to allow interrupts in the guest.
620	*/
621	pCtx->hwvirt.svm.fGif = 1;
622
623	/*
624	* Event injection.
625	*/
626	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
627	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
628	if (pEventInject->n.u1Valid)
629	{
630	uint8_t const uVector = pEventInject->n.u8Vector;
631	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
632	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
633
634	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
635	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
636	{
637	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
638	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
639	}
640	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
641	{
642	if ( uVector == X86_XCPT_NMI
643	\|\| uVector > X86_XCPT_LAST)
644	{
645	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
646	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
647	}
648	if ( uVector == X86_XCPT_BR
649	&& CPUMIsGuestInLongModeEx(pCtx))
650	{
651	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
652	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
653	}
654	/** @todo any others? */
655	}
656
657	/*
658	* Update the exit interruption info field so that if an exception occurs
659	* while delivering the event causing a #VMEXIT, we only need to update
660	* the valid bit while the rest is already in place.
661	*/
662	pVmcbCtrl->ExitIntInfo.u = pVmcbCtrl->EventInject.u;
663	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
664
665	/** @todo NRIP: Software interrupts can only be pushed properly if we support
666	* NRIP for the nested-guest to calculate the instruction length
667	* below. */
668	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 uVector=%#x enmType=%d uErrorCode=%u cr2=%#RX64\n",
669	pCtx->cs.Sel, pCtx->rip, uVector, enmType,uErrorCode, pCtx->cr2));
670	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
671	}
672	else
673	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
674	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
675
676	return rcStrict;
677	}
678
679	/* Shouldn't really happen as the caller should've validated the physical address already. */
680	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
681	return rc;
682	#endif
683	}
684
685
686	#if 0
687	/**
688	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
689	* intercept is active.
690	*
691	* @returns Strict VBox status code.
692	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
693	* we're not executing a nested-guest.
694	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
695	* successfully.
696	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
697	* failed and a shutdown needs to be initiated for the geust.
698	*
699	* @param pVCpu The cross context virtual CPU structure.
700	* @param pCtx The guest-CPU context.
701	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
702	* @param uExitInfo1 The exit info. 1 field.
703	* @param uExitInfo2 The exit info. 2 field.
704	*/
705	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
706	uint64_t uExitInfo2)
707	{
708	#define HMSVM_CTRL_INTERCEPT_VMEXIT(a_Intercept) \
709	do { \
710	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
711	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
712	break; \
713	} while (0)
714
715	if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
716	return VINF_HM_INTERCEPT_NOT_ACTIVE;
717
718	switch (uExitCode)
719	{
720	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
721	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
722	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
723	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
724	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
725	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
726	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
727	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
728	{
729	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
730	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
731	break;
732	}
733
734	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
735	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
736	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
737	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
738	{
739	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
740	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
741	break;
742	}
743
744	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
745	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
746	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
747	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
748	{
749	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
750	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
751	break;
752	}
753
754	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
755	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
756	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
757	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
758	{
759	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
760	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
761	break;
762	}
763
764	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
765	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
766	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
767	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
768	{
769	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
770	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
771	break;
772	}
773
774	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTR);
775	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_NMI);
776	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SMI);
777	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INIT);
778	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VINTR);
779	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
780	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_READS);
781	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_READS);
782	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_READS);
783	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_READS);
784	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_WRITES);
785	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_WRITES);
786	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_WRITES);
787	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_WRITES);
788	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSC);
789	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDPMC);
790	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PUSHF);
791	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_POPF);
792	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CPUID);
793	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RSM);
794	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IRET);
795	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTN);
796	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVD);
797	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PAUSE);
798	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_HLT);
799	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPG);
800	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPGA);
801	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TASK_SWITCH);
802	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_FERR_FREEZE);
803	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SHUTDOWN);
804	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMRUN);
805	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMMCALL);
806	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMLOAD);
807	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMSAVE);
808	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_STGI);
809	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CLGI);
810	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SKINIT);
811	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSCP);
812	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_ICEBP);
813	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_WBINVD);
814	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MONITOR);
815	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT);
816	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
817	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_XSETBV);
818
819	case SVM_EXIT_IOIO:
820	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
821	return VERR_SVM_IPE_1;
822
823	case SVM_EXIT_MSR:
824	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
825	return VERR_SVM_IPE_1;
826
827	case SVM_EXIT_NPF:
828	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
829	case SVM_EXIT_AVIC_NOACCEL:
830	AssertMsgFailed(("Todo Implement.\n"));
831	return VERR_SVM_IPE_1;
832
833	default:
834	AssertMsgFailed(("Unsupported SVM exit code %#RX64\n", uExitCode));
835	return VERR_SVM_IPE_1;
836	}
837
838	return VINF_HM_INTERCEPT_NOT_ACTIVE;
839
840	#undef HMSVM_CTRL_INTERCEPT_VMEXIT
841	}
842	#endif
843
844
845	/**
846	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
847	* intercept is active.
848	*
849	* @returns Strict VBox status code.
850	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
851	* we're not executing a nested-guest.
852	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
853	* successfully.
854	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
855	* failed and a shutdown needs to be initiated for the geust.
856	*
857	* @returns VBox strict status code.
858	* @param pVCpu The cross context virtual CPU structure of the calling thread.
859	* @param u16Port The IO port being accessed.
860	* @param enmIoType The type of IO access.
861	* @param cbReg The IO operand size in bytes.
862	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
863	* @param iEffSeg The effective segment number.
864	* @param fRep Whether this is a repeating IO instruction (REP prefix).
865	* @param fStrIo Whether this is a string IO instruction.
866	* @param cbInstr The length of the IO instruction in bytes.
867	*/
868	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
869	uint64_t uCr2)
870	{
871	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
872
873	/*
874	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
875	*
876	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_EXCEPTION_2 #VMEXITs.
877	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
878	* even when they use a vector in the range 0 to 31.
879	* - ICEBP should not trigger #DB intercept, but its own intercept.
880	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
881	*/
882	/* Check NMI intercept */
883	if ( u8Vector == X86_XCPT_NMI
884	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
885	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
886	{
887	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
888	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
889	}
890
891	/* Check ICEBP intercept. */
892	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
893	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
894	{
895	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
896	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
897	}
898
899	/* Check CPU exception intercepts. */
900	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
901	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
902	{
903	Assert(u8Vector <= X86_XCPT_LAST);
904	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
905	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
906	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist
907	&& u8Vector == X86_XCPT_PF
908	&& !(uErr & X86_TRAP_PF_ID))
909	{
910	/** @todo Nested-guest SVM - figure out fetching op-code bytes from IEM. */
911	#ifdef IEM_WITH_CODE_TLB
912	AssertReleaseFailedReturn(VERR_IEM_IPE_5);
913	#else
914	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
915	uint8_t const offOpCode = pVCpu->iem.s.offOpcode;
916	uint8_t const cbCurrent = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode;
917	if ( cbCurrent > 0
918	&& cbCurrent < sizeof(pVmcbCtrl->abInstr))
919	{
920	Assert(cbCurrent <= sizeof(pVCpu->iem.s.abOpcode));
921	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[offOpCode], cbCurrent);
922	}
923	#endif
924	}
925	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
926	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
927	u8Vector, uExitInfo1, uExitInfo2));
928	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_EXCEPTION_0 + u8Vector, uExitInfo1, uExitInfo2);
929	}
930
931	/* Check software interrupt (INTn) intercepts. */
932	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
933	\| IEM_XCPT_FLAGS_BP_INSTR
934	\| IEM_XCPT_FLAGS_ICEBP_INSTR
935	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
936	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
937	{
938	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssist ? u8Vector : 0;
939	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
940	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
941	}
942
943	return VINF_HM_INTERCEPT_NOT_ACTIVE;
944	}
945
946
947	/**
948	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
949	* corresponding intercept is active.
950	*
951	* @returns Strict VBox status code.
952	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
953	* we're not executing a nested-guest.
954	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
955	* successfully.
956	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
957	* failed and a shutdown needs to be initiated for the geust.
958	*
959	* @returns VBox strict status code.
960	* @param pVCpu The cross context virtual CPU structure of the calling thread.
961	* @param u16Port The IO port being accessed.
962	* @param enmIoType The type of IO access.
963	* @param cbReg The IO operand size in bytes.
964	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
965	* @param iEffSeg The effective segment number.
966	* @param fRep Whether this is a repeating IO instruction (REP prefix).
967	* @param fStrIo Whether this is a string IO instruction.
968	* @param cbInstr The length of the IO instruction in bytes.
969	*/
970	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
971	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
972	{
973	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
974	Assert(cAddrSizeBits == 0 \|\| cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
975	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
976
977	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
978
979	/*
980	* The IOPM layout:
981	* Each bit represents one 8-bit port. That makes a total of 0..65535 bits or
982	* two 4K pages.
983	*
984	* For IO instructions that access more than a single byte, the permission bits
985	* for all bytes are checked; if any bit is set to 1, the IO access is intercepted.
986	*
987	* Since it's possible to do a 32-bit IO access at port 65534 (accessing 4 bytes),
988	* we need 3 extra bits beyond the second 4K page.
989	*/
990	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
991	static const uint16_t s_auSizeMasks[] = { 0, 1, 3, 0, 0xf, 0, 0, 0 };
992
993	uint16_t const offIopm = u16Port >> 3;
994	uint16_t const fSizeMask = s_auSizeMasks[(cAddrSizeBits >> SVM_IOIO_OP_SIZE_SHIFT) & 7];
995	uint8_t const cShift = u16Port - (offIopm << 3);
996	uint16_t const fIopmMask = (1 << cShift) \| (fSizeMask << cShift);
997
998	uint8_t const pbIopm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
999	Assert(pbIopm);
1000	pbIopm += offIopm;
1001	uint16_t const u16Iopm = (uint16_t )pbIopm;
1002	if (u16Iopm & fIopmMask)
1003	{
1004	static const uint32_t s_auIoOpSize[] =
1005	{ SVM_IOIO_32_BIT_OP, SVM_IOIO_8_BIT_OP, SVM_IOIO_16_BIT_OP, 0, SVM_IOIO_32_BIT_OP, 0, 0, 0 };
1006
1007	static const uint32_t s_auIoAddrSize[] =
1008	{ 0, SVM_IOIO_16_BIT_ADDR, SVM_IOIO_32_BIT_ADDR, 0, SVM_IOIO_64_BIT_ADDR, 0, 0, 0 };
1009
1010	SVMIOIOEXITINFO IoExitInfo;
1011	IoExitInfo.u = s_auIoOpSize[cbReg & 7];
1012	IoExitInfo.u \|= s_auIoAddrSize[(cAddrSizeBits >> 4) & 7];
1013	IoExitInfo.n.u1STR = fStrIo;
1014	IoExitInfo.n.u1REP = fRep;
1015	IoExitInfo.n.u3SEG = iEffSeg & 7;
1016	IoExitInfo.n.u1Type = enmIoType;
1017	IoExitInfo.n.u16Port = u16Port;
1018
1019	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) offIoPm=%u fSizeMask=%#x cShift=%u fIopmMask=%#x -> #VMEXIT\n",
1020	u16Port, u16Port, offIopm, fSizeMask, cShift, fIopmMask));
1021	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
1022	}
1023
1024	/** @todo remove later (for debugging as VirtualBox always traps all IO
1025	* intercepts). */
1026	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1027	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1028	}
1029
1030
1031	/**
1032	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1033	* corresponding intercept is active.
1034	*
1035	* @returns Strict VBox status code.
1036	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1037	* specify interception of the accessed MSR @a idMsr.
1038	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1039	* successfully.
1040	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1041	* failed and a shutdown needs to be initiated for the geust.
1042	*
1043	* @param pVCpu The cross context virtual CPU structure.
1044	* @param pCtx The guest-CPU context.
1045	* @param idMsr The MSR being accessed in the nested-guest.
1046	* @param fWrite Whether this is an MSR write access, @c false implies an
1047	* MSR read.
1048	*/
1049	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1050	{
1051	/*
1052	* Check if any MSRs are being intercepted.
1053	*/
1054	Assert(CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1055	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1056
1057	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1058
1059	/*
1060	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1061	*/
1062	uint16_t offMsrpm;
1063	uint32_t uMsrpmBit;
1064	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1065	if (RT_SUCCESS(rc))
1066	{
1067	Assert(uMsrpmBit < 0x3fff);
1068	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1069	if (fWrite)
1070	++uMsrpmBit;
1071
1072	/*
1073	* Check if the bit is set, if so, trigger a #VMEXIT.
1074	*/
1075	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1076	pbMsrpm += offMsrpm;
1077	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1078	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1079	}
1080	else
1081	{
1082	/*
1083	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1084	*/
1085	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1086	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1087	}
1088	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1089	}
1090
1091
1092
1093	/**
1094	* Implements 'VMRUN'.
1095	*/
1096	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1097	{
1098	#ifndef IN_RING3
1099	RT_NOREF2(pVCpu, cbInstr);
1100	return VINF_EM_RESCHEDULE_REM;
1101	#else
1102	LogFlow(("iemCImpl_vmrun\n"));
1103	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1104	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1105
1106	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1107	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1108	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1109	{
1110	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1111	return iemRaiseGeneralProtectionFault0(pVCpu);
1112	}
1113
1114	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1115	{
1116	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1117	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1118	}
1119
1120	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1121	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1122	{
1123	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1124	rcStrict = VINF_EM_TRIPLE_FAULT;
1125	}
1126	return rcStrict;
1127	#endif
1128	}
1129
1130
1131	/**
1132	* Implements 'VMMCALL'.
1133	*/
1134	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1135	{
1136	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1137	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1138	{
1139	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1140	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1141	}
1142
1143	bool fUpdatedRipAndRF;
1144	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1145	if (RT_SUCCESS(rcStrict))
1146	{
1147	if (!fUpdatedRipAndRF)
1148	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1149	return rcStrict;
1150	}
1151
1152	return iemRaiseUndefinedOpcode(pVCpu);
1153	}
1154
1155
1156	/**
1157	* Implements 'VMLOAD'.
1158	*/
1159	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1160	{
1161	#ifndef IN_RING3
1162	RT_NOREF2(pVCpu, cbInstr);
1163	return VINF_EM_RAW_EMULATE_INSTR;
1164	#else
1165	LogFlow(("iemCImpl_vmload\n"));
1166	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1167	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1168
1169	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1170	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1171	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1172	{
1173	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1174	return iemRaiseGeneralProtectionFault0(pVCpu);
1175	}
1176
1177	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1178	{
1179	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1180	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1181	}
1182
1183	SVMVMCBSTATESAVE VmcbNstGst;
1184	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1185	sizeof(SVMVMCBSTATESAVE));
1186	if (rcStrict == VINF_SUCCESS)
1187	{
1188	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1189	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1190	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1191	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1192	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1193
1194	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1195	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1196	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1197	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1198	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1199
1200	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1201	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1202	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1203
1204	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1205	}
1206	return rcStrict;
1207	#endif
1208	}
1209
1210
1211	/**
1212	* Implements 'VMSAVE'.
1213	*/
1214	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1215	{
1216	#ifndef IN_RING3
1217	RT_NOREF2(pVCpu, cbInstr);
1218	return VINF_EM_RAW_EMULATE_INSTR;
1219	#else
1220	LogFlow(("iemCImpl_vmsave\n"));
1221	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1222	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1223
1224	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1225	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1226	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1227	{
1228	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1229	return iemRaiseGeneralProtectionFault0(pVCpu);
1230	}
1231
1232	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1233	{
1234	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1235	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1236	}
1237
1238	SVMVMCBSTATESAVE VmcbNstGst;
1239	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1240	sizeof(SVMVMCBSTATESAVE));
1241	if (rcStrict == VINF_SUCCESS)
1242	{
1243	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1244	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1245	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1246	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1247	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1248
1249	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1250	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1251	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1252	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1253	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1254
1255	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1256	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1257	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1258
1259	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1260	sizeof(SVMVMCBSTATESAVE));
1261	if (rcStrict == VINF_SUCCESS)
1262	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1263	}
1264	return rcStrict;
1265	#endif
1266	}
1267
1268
1269	/**
1270	* Implements 'CLGI'.
1271	*/
1272	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1273	{
1274	#ifndef IN_RING3
1275	RT_NOREF2(pVCpu, cbInstr);
1276	return VINF_EM_RESCHEDULE_REM;
1277	#else
1278	LogFlow(("iemCImpl_clgi\n"));
1279	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1280	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1281	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1282	{
1283	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1284	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1285	}
1286
1287	pCtx->hwvirt.svm.fGif = 0;
1288	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1289	# if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1290	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1291	# else
1292	return VINF_SUCCESS;
1293	# endif
1294	#endif
1295	}
1296
1297
1298	/**
1299	* Implements 'STGI'.
1300	*/
1301	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1302	{
1303	#ifndef IN_RING3
1304	RT_NOREF2(pVCpu, cbInstr);
1305	return VINF_EM_RESCHEDULE_REM;
1306	#else
1307	LogFlow(("iemCImpl_stgi\n"));
1308	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1309	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1310	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1311	{
1312	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1313	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1314	}
1315
1316	pCtx->hwvirt.svm.fGif = 1;
1317	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1318	# if defined(VBOX_WITH_NESTED_HWVIRT) && defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1319	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1320	# else
1321	return VINF_SUCCESS;
1322	# endif
1323	#endif
1324	}
1325
1326
1327	/**
1328	* Implements 'INVLPGA'.
1329	*/
1330	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1331	{
1332	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1333	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1334	/** @todo PGM needs virtual ASID support. */
1335	#if 0
1336	uint32_t const uAsid = pCtx->ecx;
1337	#endif
1338
1339	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1340	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1341	{
1342	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1343	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1344	}
1345
1346	PGMInvalidatePage(pVCpu, GCPtrPage);
1347	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1348	return VINF_SUCCESS;
1349	}
1350
1351
1352	/**
1353	* Implements 'SKINIT'.
1354	*/
1355	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1356	{
1357	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1358
1359	uint32_t uIgnore;
1360	uint32_t fFeaturesECX;
1361	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1362	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1363	return iemRaiseUndefinedOpcode(pVCpu);
1364
1365	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1366	{
1367	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1368	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1369	}
1370
1371	RT_NOREF(cbInstr);
1372	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1373	}
1374

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 68226

Download in other formats: