IEMAllCImplSvmInstr.cpp.h@ 70736

Last change on this file since 70736 was 70736, checked in by vboxsync, 7 years ago
VMM/IEM: comment typo.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 60.0 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 70736 2018-01-25 10:06:30Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param pCtx The guest-CPU context.
59	*/
60	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu, PCPUMCTX pCtx)
61	{
62	/*
63	* Flush the TLB with new CR3. This is required in case the PGM mode change
64	* below doesn't actually change anything.
65	*/
66	PGMFlushTLB(pVCpu, pCtx->cr3, true);
67
68	/*
69	* Inform PGM about paging mode changes.
70	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
71	* see comment in iemMemPageTranslateAndCheckAccess().
72	*/
73	int rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
74	#ifdef IN_RING3
75	Assert(rc != VINF_PGM_CHANGE_MODE);
76	#endif
77	AssertRCReturn(rc, rc);
78
79	/* Inform CPUM (recompiler), can later be removed. */
80	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
81
82	/* Re-initialize IEM cache/state after the drastic mode switch. */
83	iemReInitExec(pVCpu);
84	return rc;
85	}
86
87
88	/**
89	* SVM \#VMEXIT handler.
90	*
91	* @returns Strict VBox status code.
92	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
93	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
94	* "host state" and a shutdown is required.
95	*
96	* @param pVCpu The cross context virtual CPU structure.
97	* @param pCtx The guest-CPU context.
98	* @param uExitCode The exit code.
99	* @param uExitInfo1 The exit info. 1 field.
100	* @param uExitInfo2 The exit info. 2 field.
101	*/
102	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
103	{
104	VBOXSTRICTRC rcStrict;
105	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
106	\|\| uExitCode == SVM_EXIT_INVALID)
107	{
108	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
109	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
110
111	/*
112	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
113	*/
114	pCtx->hwvirt.fGif = false;
115
116	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
117	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
118	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
119	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
120
121	/*
122	* Save the nested-guest state into the VMCB state-save area.
123	*/
124	PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
125	PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
126	PSVMVMCBSTATESAVE pVmcbNstGstState = &pVmcbNstGst->guest;
127
128	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, ES, es);
129	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, CS, cs);
130	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, SS, ss);
131	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, DS, ds);
132	pVmcbNstGstState->GDTR.u32Limit = pCtx->gdtr.cbGdt;
133	pVmcbNstGstState->GDTR.u64Base = pCtx->gdtr.pGdt;
134	pVmcbNstGstState->IDTR.u32Limit = pCtx->idtr.cbIdt;
135	pVmcbNstGstState->IDTR.u64Base = pCtx->idtr.pIdt;
136	pVmcbNstGstState->u64EFER = pCtx->msrEFER;
137	pVmcbNstGstState->u64CR4 = pCtx->cr4;
138	pVmcbNstGstState->u64CR3 = pCtx->cr3;
139	pVmcbNstGstState->u64CR2 = pCtx->cr2;
140	pVmcbNstGstState->u64CR0 = pCtx->cr0;
141	/** @todo Nested paging. */
142	pVmcbNstGstState->u64RFlags = pCtx->rflags.u64;
143	pVmcbNstGstState->u64RIP = pCtx->rip;
144	pVmcbNstGstState->u64RSP = pCtx->rsp;
145	pVmcbNstGstState->u64RAX = pCtx->rax;
146	pVmcbNstGstState->u64DR7 = pCtx->dr[7];
147	pVmcbNstGstState->u64DR6 = pCtx->dr[6];
148	pVmcbNstGstState->u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
149	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
150
151	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
152	/* Record any interrupt shadow of the nested-guest instruction into the nested-guest VMCB. */
153	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
154	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
155	{
156	pVmcbCtrl->IntShadow.n.u1IntShadow = 1;
157
158	/* Clear the inhibit-interrupt force-flag so as to not affect the outer guest. */
159	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
160	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
161	}
162
163	/*
164	* Save additional state and intercept information.
165	*/
166	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
167	{
168	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
169	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
170	}
171	else
172	pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
173
174	/** @todo Save V_TPR, V_IRQ. */
175	/** @todo NRIP. */
176
177	/* Save exit information. */
178	pVmcbCtrl->u64ExitCode = uExitCode;
179	pVmcbCtrl->u64ExitInfo1 = uExitInfo1;
180	pVmcbCtrl->u64ExitInfo2 = uExitInfo2;
181
182	/*
183	* Update the exit interrupt-information field if this #VMEXIT happened as a result
184	* of delivering an event through IEM.
185	*
186	* Don't update the exit interrupt-information field if the event wasn't being injected
187	* through IEM, as it may have been updated by real hardware if the nested-guest was
188	* executed using hardware-assisted SVM.
189	*/
190	{
191	uint8_t uExitIntVector;
192	uint32_t uExitIntErr;
193	uint32_t fExitIntFlags;
194	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
195	NULL /* uExitIntCr2 */);
196	if (fRaisingEvent)
197	{
198	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
199	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
200	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
201	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
202	{
203	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
204	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
205	}
206	}
207	}
208
209	/*
210	* Clear event injection in the VMCB.
211	*/
212	pVmcbCtrl->EventInject.n.u1Valid = 0;
213
214	/*
215	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
216	* would have modified some VMCB state) that need to be restored on #VMEXIT before
217	* writing the VMCB back to guest memory.
218	*/
219	HMSvmNstGstVmExitNotify(pVCpu, pCtx);
220
221	/*
222	* Write back the nested-guest's VMCB to its guest physical memory location.
223	*/
224	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, pVmcbNstGst, sizeof(*pVmcbNstGst));
225
226	/*
227	* Prepare for guest's "host mode" by clearing internal processor state bits.
228	*
229	* We don't need to zero out the state-save area, just the controls should be
230	* sufficient because it has the critical bit of indicating whether we're inside
231	* the nested-guest or not.
232	*/
233	memset(pVmcbNstGstCtrl, 0, sizeof(*pVmcbNstGstCtrl));
234	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
235
236	/*
237	* Restore the subset of force-flags that were preserved.
238	*/
239	if (pCtx->hwvirt.fLocalForcedActions)
240	{
241	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
242	pCtx->hwvirt.fLocalForcedActions = 0;
243	}
244
245	if (RT_SUCCESS(rcStrict))
246	{
247	/** @todo Nested paging. */
248	/** @todo ASID. */
249
250	/*
251	* Reload the guest's "host state".
252	*/
253	CPUMSvmVmExitRestoreHostState(pVCpu, pCtx);
254
255	/*
256	* Update PGM, IEM and others of a world-switch.
257	*/
258	rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
259	if (rcStrict == VINF_SUCCESS)
260	rcStrict = VINF_SVM_VMEXIT;
261	else if (RT_SUCCESS(rcStrict))
262	{
263	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", rcStrict));
264	iemSetPassUpStatus(pVCpu, rcStrict);
265	rcStrict = VINF_SVM_VMEXIT;
266	}
267	else
268	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
269	}
270	else
271	{
272	LogFlow(("iemSvmVmexit: Writing VMCB at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
273	VBOXSTRICTRC_VAL(rcStrict)));
274	rcStrict = VERR_SVM_VMEXIT_FAILED;
275	}
276	}
277	else
278	{
279	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
280	uExitInfo1, uExitInfo2));
281	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
282	rcStrict = VERR_SVM_IPE_5;
283	}
284
285	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
286	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
287	if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
288	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
289	# endif
290	return rcStrict;
291	}
292
293
294	/**
295	* Performs the operations necessary that are part of the vmrun instruction
296	* execution in the guest.
297	*
298	* @returns Strict VBox status code (i.e. informational status codes too).
299	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
300	* code execution.
301	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
302	* (SVM_EXIT_INVALID most likely).
303	*
304	* @param pVCpu The cross context virtual CPU structure.
305	* @param pCtx Pointer to the guest-CPU context.
306	* @param cbInstr The length of the VMRUN instruction.
307	* @param GCPhysVmcb Guest physical address of the VMCB to run.
308	*/
309	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
310	{
311	LogFlow(("iemSvmVmrun\n"));
312
313	#ifdef IN_RING0
314	/*
315	* Until PGM can handle switching the guest paging mode in ring-0,
316	* there's no point in trying to emulate VMRUN in ring-0 as we have
317	* to go back to ring-3 anyway, see @bugref{7243#c48}.
318	*/
319	RT_NOREF(pVCpu, pCtx, cbInstr, GCPhysVmcb);
320	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
321	#else
322
323	/*
324	* Cache the physical address of the VMCB for #VMEXIT exceptions.
325	*/
326	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
327
328	/*
329	* Save the host state.
330	*/
331	CPUMSvmVmRunSaveHostState(pCtx, cbInstr);
332
333	/*
334	* Read the guest VMCB state.
335	*/
336	PVM pVM = pVCpu->CTX_SUFF(pVM);
337	int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
338	if (RT_SUCCESS(rc))
339	{
340	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
341	PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
342
343	/*
344	* Validate guest-state and controls.
345	*/
346	/* VMRUN must always be intercepted. */
347	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_VMRUN))
348	{
349	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
350	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
351	}
352
353	/* Nested paging. */
354	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
355	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
356	{
357	Log(("iemSvmVmrun: Nested paging not supported -> #VMEXIT\n"));
358	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
359	}
360
361	/* AVIC. */
362	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
363	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
364	{
365	Log(("iemSvmVmrun: AVIC not supported -> #VMEXIT\n"));
366	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
367	}
368
369	/* Last branch record (LBR) virtualization. */
370	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
371	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
372	{
373	Log(("iemSvmVmrun: LBR virtualization not supported -> #VMEXIT\n"));
374	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
375	}
376
377	/* Virtualized VMSAVE/VMLOAD. */
378	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
379	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
380	{
381	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> #VMEXIT\n"));
382	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
383	}
384
385	/* Virtual GIF. */
386	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
387	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
388	{
389	Log(("iemSvmVmrun: Virtual GIF not supported -> #VMEXIT\n"));
390	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
391	}
392
393	/* Guest ASID. */
394	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
395	{
396	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
397	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
398	}
399
400	/* IO permission bitmap. */
401	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
402	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
403	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
404	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
405	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
406	{
407	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
408	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
409	}
410
411	/* MSR permission bitmap. */
412	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
413	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
414	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
415	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
416	{
417	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
418	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
419	}
420
421	/* CR0. */
422	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
423	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
424	{
425	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
426	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
427	}
428	if (pVmcbNstGst->u64CR0 >> 32)
429	{
430	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
431	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
432	}
433	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
434
435	/* DR6 and DR7. */
436	if ( pVmcbNstGst->u64DR6 >> 32
437	\|\| pVmcbNstGst->u64DR7 >> 32)
438	{
439	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
440	pVmcbNstGst->u64DR6));
441	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
442	}
443
444	/** @todo gPAT MSR validation? */
445
446	/*
447	* Copy the IO permission bitmap into the cache.
448	*/
449	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
450	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
451	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
452	if (RT_FAILURE(rc))
453	{
454	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
455	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
456	}
457
458	/*
459	* Copy the MSR permission bitmap into the cache.
460	*/
461	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
462	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
463	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
464	if (RT_FAILURE(rc))
465	{
466	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
467	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
468	}
469
470	/*
471	* Copy segments from nested-guest VMCB state to the guest-CPU state.
472	*
473	* We do this here as we need to use the CS attributes and it's easier this way
474	* then using the VMCB format selectors. It doesn't really matter where we copy
475	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
476	*/
477	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
478	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
479	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
480	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
481
482	/** @todo Segment attribute overrides by VMRUN. */
483
484	/*
485	* CPL adjustments and overrides.
486	*
487	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
488	* We shall thus adjust both CS.DPL and SS.DPL here.
489	*/
490	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
491	if (CPUMIsGuestInV86ModeEx(pCtx))
492	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
493	if (CPUMIsGuestInRealModeEx(pCtx))
494	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
495	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
496
497	/*
498	* Continue validating guest-state and controls.
499	*
500	* We pass CR0 as 0 to CPUMQueryValidatedGuestEfer below to skip the illegal
501	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
502	* old and new EFER value to not have any guest EFER bits influence the new
503	* nested-guest EFER.
504	*/
505	uint64_t uValidEfer;
506	rc = CPUMQueryValidatedGuestEfer(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
507	if (RT_FAILURE(rc))
508	{
509	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
510	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
511	}
512
513	/* Validate paging and CPU mode bits. */
514	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
515	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
516	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
517	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
518	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
519	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
520	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
521	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
522	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
523	if (fLongModeWithPaging)
524	uValidEfer \|= MSR_K6_EFER_LMA;
525	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
526	if ( !fSvm
527	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
528	\|\| (fLongModeWithPaging && !fPae)
529	\|\| (fLongModeWithPaging && !fProtMode)
530	\|\| ( fLongModeEnabled
531	&& fPaging
532	&& fPae
533	&& fLongModeConformCS))
534	{
535	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
536	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
537	}
538
539	/*
540	* Preserve the required force-flags.
541	*
542	* We only preserve the force-flags that would affect the execution of the
543	* nested-guest (or the guest).
544	*
545	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
546	* instruction which is this VMRUN instruction itself.
547	*
548	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
549	* execution of a subsequent IRET instruction in the guest.
550	*
551	* - The remaining FFs (e.g. timers) can stay in place so that we will be
552	* able to generate interrupts that should cause #VMEXITs for the
553	* nested-guest.
554	*/
555	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
556	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
557
558	/*
559	* Interrupt shadow.
560	*/
561	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
562	{
563	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
564	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
565	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
566	}
567
568	/*
569	* TLB flush control.
570	* Currently disabled since it's redundant as we unconditionally flush the TLB
571	* in iemSvmWorldSwitch() below.
572	*/
573	#if 0
574	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
575	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
576	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
577	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
578	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
579	#endif
580
581	/*
582	* Copy the remaining guest state from the VMCB to the guest-CPU context.
583	*/
584	pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
585	pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
586	pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
587	pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
588	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
589	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
590	pCtx->cr3 = pVmcbNstGst->u64CR3;
591	pCtx->cr2 = pVmcbNstGst->u64CR2;
592	pCtx->dr[6] = pVmcbNstGst->u64DR6;
593	pCtx->dr[7] = pVmcbNstGst->u64DR7;
594	pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
595	pCtx->rax = pVmcbNstGst->u64RAX;
596	pCtx->rsp = pVmcbNstGst->u64RSP;
597	pCtx->rip = pVmcbNstGst->u64RIP;
598	CPUMSetGuestMsrEferNoCheck(pVCpu, pCtx->msrEFER, uValidEfer);
599
600	/* Mask DR6, DR7 bits mandatory set/clear bits. */
601	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
602	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
603	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
604	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
605
606	/*
607	* Check for pending virtual interrupts.
608	*/
609	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
610	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
611	else
612	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
613
614	/*
615	* Update PGM, IEM and others of a world-switch.
616	*/
617	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
618	if (rcStrict == VINF_SUCCESS)
619	{ /* likely */ }
620	else if (RT_SUCCESS(rcStrict))
621	{
622	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
623	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
624	}
625	else
626	{
627	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
628	return rcStrict;
629	}
630
631	/*
632	* Clear global interrupt flags to allow interrupts in the guest.
633	*/
634	pCtx->hwvirt.fGif = true;
635
636	/*
637	* Event injection.
638	*/
639	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
640	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
641	if (pEventInject->n.u1Valid)
642	{
643	uint8_t const uVector = pEventInject->n.u8Vector;
644	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
645	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
646
647	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
648	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
649	{
650	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
651	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
652	}
653	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
654	{
655	if ( uVector == X86_XCPT_NMI
656	\|\| uVector > X86_XCPT_LAST)
657	{
658	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
659	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
660	}
661	if ( uVector == X86_XCPT_BR
662	&& CPUMIsGuestInLongModeEx(pCtx))
663	{
664	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
665	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
666	}
667	/** @todo any others? */
668	}
669
670	/*
671	* Invalidate the exit interrupt-information field here. This field is fully updated
672	* on #VMEXIT as events other than the one below can also cause intercepts during
673	* their injection (e.g. exceptions).
674	*/
675	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
676
677	/*
678	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
679	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
680	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
681	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
682	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
683	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
684	* injecting the event through IEM here.
685	*/
686	pVmcbCtrl->EventInject.n.u1Valid = 0;
687
688	/** @todo NRIP: Software interrupts can only be pushed properly if we support
689	* NRIP for the nested-guest to calculate the instruction length
690	* below. */
691	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
692	pCtx->cs.Sel, pCtx->rip, uVector, enmType, uErrorCode, pCtx->cr2, pCtx->cr3, pCtx->msrEFER));
693	#if 0
694	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
695	#else
696	TRPMAssertTrap(pVCpu, uVector, enmType);
697	if (pEventInject->n.u1ErrorCodeValid)
698	TRPMSetErrorCode(pVCpu, uErrorCode);
699	if ( enmType == TRPM_TRAP
700	&& uVector == X86_XCPT_PF)
701	TRPMSetFaultAddress(pVCpu, pCtx->cr2);
702	#endif
703	}
704	else
705	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
706	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
707
708	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
709
710	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
711	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
712	if (HMSvmIsVGifActive(pVM))
713	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
714	# endif
715
716	return rcStrict;
717	}
718
719	/* Shouldn't really happen as the caller should've validated the physical address already. */
720	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
721	return rc;
722	#endif
723	}
724
725
726	#if 0
727	/**
728	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
729	* intercept is active.
730	*
731	* @returns Strict VBox status code.
732	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
733	* we're not executing a nested-guest.
734	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
735	* successfully.
736	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
737	* failed and a shutdown needs to be initiated for the geust.
738	*
739	* @param pVCpu The cross context virtual CPU structure.
740	* @param pCtx The guest-CPU context.
741	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
742	* @param uExitInfo1 The exit info. 1 field.
743	* @param uExitInfo2 The exit info. 2 field.
744	*/
745	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
746	uint64_t uExitInfo2)
747	{
748	#define HMSVM_CTRL_INTERCEPT_VMEXIT(a_Intercept) \
749	do { \
750	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
751	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
752	break; \
753	} while (0)
754
755	if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
756	return VINF_HM_INTERCEPT_NOT_ACTIVE;
757
758	switch (uExitCode)
759	{
760	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
761	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
762	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
763	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
764	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
765	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
766	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
767	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
768	{
769	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
770	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
771	break;
772	}
773
774	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
775	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
776	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
777	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
778	{
779	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
780	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
781	break;
782	}
783
784	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
785	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
786	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
787	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
788	{
789	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
790	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
791	break;
792	}
793
794	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
795	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
796	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
797	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
798	{
799	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
800	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
801	break;
802	}
803
804	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
805	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
806	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
807	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
808	{
809	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
810	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
811	break;
812	}
813
814	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTR);
815	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_NMI);
816	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SMI);
817	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INIT);
818	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VINTR);
819	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
820	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_READS);
821	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_READS);
822	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_READS);
823	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_READS);
824	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_WRITES);
825	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_WRITES);
826	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_WRITES);
827	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_WRITES);
828	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSC);
829	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDPMC);
830	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PUSHF);
831	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_POPF);
832	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CPUID);
833	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RSM);
834	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IRET);
835	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTN);
836	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVD);
837	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PAUSE);
838	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_HLT);
839	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPG);
840	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPGA);
841	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TASK_SWITCH);
842	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_FERR_FREEZE);
843	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SHUTDOWN);
844	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMRUN);
845	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMMCALL);
846	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMLOAD);
847	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMSAVE);
848	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_STGI);
849	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CLGI);
850	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SKINIT);
851	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSCP);
852	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_ICEBP);
853	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_WBINVD);
854	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MONITOR);
855	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT);
856	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
857	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_XSETBV);
858
859	case SVM_EXIT_IOIO:
860	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
861	return VERR_SVM_IPE_1;
862
863	case SVM_EXIT_MSR:
864	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
865	return VERR_SVM_IPE_1;
866
867	case SVM_EXIT_NPF:
868	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
869	case SVM_EXIT_AVIC_NOACCEL:
870	AssertMsgFailed(("Todo Implement.\n"));
871	return VERR_SVM_IPE_1;
872
873	default:
874	AssertMsgFailed(("Unsupported SVM exit code %#RX64\n", uExitCode));
875	return VERR_SVM_IPE_1;
876	}
877
878	return VINF_HM_INTERCEPT_NOT_ACTIVE;
879
880	#undef HMSVM_CTRL_INTERCEPT_VMEXIT
881	}
882	#endif
883
884
885	/**
886	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
887	* intercept is active.
888	*
889	* @returns Strict VBox status code.
890	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
891	* we're not executing a nested-guest.
892	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
893	* successfully.
894	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
895	* failed and a shutdown needs to be initiated for the geust.
896	*
897	* @returns VBox strict status code.
898	* @param pVCpu The cross context virtual CPU structure of the calling thread.
899	* @param u16Port The IO port being accessed.
900	* @param enmIoType The type of IO access.
901	* @param cbReg The IO operand size in bytes.
902	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
903	* @param iEffSeg The effective segment number.
904	* @param fRep Whether this is a repeating IO instruction (REP prefix).
905	* @param fStrIo Whether this is a string IO instruction.
906	* @param cbInstr The length of the IO instruction in bytes.
907	*/
908	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
909	uint64_t uCr2)
910	{
911	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
912
913	/*
914	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
915	*
916	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_EXCEPTION_2 #VMEXITs.
917	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
918	* even when they use a vector in the range 0 to 31.
919	* - ICEBP should not trigger #DB intercept, but its own intercept.
920	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
921	*/
922	/* Check NMI intercept */
923	if ( u8Vector == X86_XCPT_NMI
924	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
925	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
926	{
927	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
928	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
929	}
930
931	/* Check ICEBP intercept. */
932	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
933	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
934	{
935	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
936	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
937	}
938
939	/* Check CPU exception intercepts. */
940	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
941	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
942	{
943	Assert(u8Vector <= X86_XCPT_LAST);
944	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
945	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
946	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
947	&& u8Vector == X86_XCPT_PF
948	&& !(uErr & X86_TRAP_PF_ID))
949	{
950	/** @todo Nested-guest SVM - figure out fetching op-code bytes from IEM. */
951	#ifdef IEM_WITH_CODE_TLB
952	AssertReleaseFailedReturn(VERR_IEM_IPE_5);
953	#else
954	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
955	uint8_t const offOpCode = pVCpu->iem.s.offOpcode;
956	uint8_t const cbCurrent = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode;
957	if ( cbCurrent > 0
958	&& cbCurrent < sizeof(pVmcbCtrl->abInstr))
959	{
960	Assert(cbCurrent <= sizeof(pVCpu->iem.s.abOpcode));
961	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[offOpCode], cbCurrent);
962	}
963	#endif
964	}
965	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
966	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
967	u8Vector, uExitInfo1, uExitInfo2));
968	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_EXCEPTION_0 + u8Vector, uExitInfo1, uExitInfo2);
969	}
970
971	/* Check software interrupt (INTn) intercepts. */
972	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
973	\| IEM_XCPT_FLAGS_BP_INSTR
974	\| IEM_XCPT_FLAGS_ICEBP_INSTR
975	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
976	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
977	{
978	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
979	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
980	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
981	}
982
983	return VINF_HM_INTERCEPT_NOT_ACTIVE;
984	}
985
986
987	/**
988	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
989	* corresponding intercept is active.
990	*
991	* @returns Strict VBox status code.
992	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
993	* we're not executing a nested-guest.
994	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
995	* successfully.
996	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
997	* failed and a shutdown needs to be initiated for the geust.
998	*
999	* @returns VBox strict status code.
1000	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1001	* @param u16Port The IO port being accessed.
1002	* @param enmIoType The type of IO access.
1003	* @param cbReg The IO operand size in bytes.
1004	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1005	* @param iEffSeg The effective segment number.
1006	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1007	* @param fStrIo Whether this is a string IO instruction.
1008	* @param cbInstr The length of the IO instruction in bytes.
1009	*/
1010	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1011	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1012	{
1013	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1014	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1015	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1016
1017	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1018
1019	SVMIOIOEXITINFO IoExitInfo;
1020	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1021	void *pvIoBitmap = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
1022	bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
1023	&IoExitInfo);
1024	if (fIntercept)
1025	{
1026	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1027	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
1028	}
1029
1030	/** @todo remove later (for debugging as VirtualBox always traps all IO
1031	* intercepts). */
1032	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1033	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1034	}
1035
1036
1037	/**
1038	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1039	* corresponding intercept is active.
1040	*
1041	* @returns Strict VBox status code.
1042	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1043	* specify interception of the accessed MSR @a idMsr.
1044	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1045	* successfully.
1046	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1047	* failed and a shutdown needs to be initiated for the geust.
1048	*
1049	* @param pVCpu The cross context virtual CPU structure.
1050	* @param pCtx The guest-CPU context.
1051	* @param idMsr The MSR being accessed in the nested-guest.
1052	* @param fWrite Whether this is an MSR write access, @c false implies an
1053	* MSR read.
1054	*/
1055	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1056	{
1057	/*
1058	* Check if any MSRs are being intercepted.
1059	*/
1060	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1061	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1062
1063	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1064
1065	/*
1066	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1067	*/
1068	uint16_t offMsrpm;
1069	uint32_t uMsrpmBit;
1070	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1071	if (RT_SUCCESS(rc))
1072	{
1073	Assert(uMsrpmBit < 0x3fff);
1074	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1075	if (fWrite)
1076	++uMsrpmBit;
1077
1078	/*
1079	* Check if the bit is set, if so, trigger a #VMEXIT.
1080	*/
1081	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1082	pbMsrpm += offMsrpm;
1083	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1084	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1085	}
1086	else
1087	{
1088	/*
1089	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1090	*/
1091	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1092	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1093	}
1094	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1095	}
1096
1097
1098
1099	/**
1100	* Implements 'VMRUN'.
1101	*/
1102	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1103	{
1104	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1105	RT_NOREF2(pVCpu, cbInstr);
1106	return VINF_EM_RAW_EMULATE_INSTR;
1107	#else
1108	LogFlow(("iemCImpl_vmrun\n"));
1109	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1110	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1111
1112	/** @todo Check effective address size using address size prefix. */
1113	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1114	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1115	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1116	{
1117	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1118	return iemRaiseGeneralProtectionFault0(pVCpu);
1119	}
1120
1121	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1122	{
1123	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1124	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1125	}
1126
1127	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1128	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1129	{
1130	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1131	rcStrict = VINF_EM_TRIPLE_FAULT;
1132	}
1133	return rcStrict;
1134	#endif
1135	}
1136
1137
1138	/**
1139	* Implements 'VMMCALL'.
1140	*/
1141	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1142	{
1143	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1144	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1145	{
1146	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1147	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1148	}
1149
1150	bool fUpdatedRipAndRF;
1151	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1152	if (RT_SUCCESS(rcStrict))
1153	{
1154	if (!fUpdatedRipAndRF)
1155	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1156	return rcStrict;
1157	}
1158
1159	return iemRaiseUndefinedOpcode(pVCpu);
1160	}
1161
1162
1163	/**
1164	* Implements 'VMLOAD'.
1165	*/
1166	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1167	{
1168	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1169	RT_NOREF2(pVCpu, cbInstr);
1170	return VINF_EM_RAW_EMULATE_INSTR;
1171	#else
1172	LogFlow(("iemCImpl_vmload\n"));
1173	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1174	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1175
1176	/** @todo Check effective address size using address size prefix. */
1177	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1178	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1179	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1180	{
1181	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1182	return iemRaiseGeneralProtectionFault0(pVCpu);
1183	}
1184
1185	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1186	{
1187	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1188	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1189	}
1190
1191	SVMVMCBSTATESAVE VmcbNstGst;
1192	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1193	sizeof(SVMVMCBSTATESAVE));
1194	if (rcStrict == VINF_SUCCESS)
1195	{
1196	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1197	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1198	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1199	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1200	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1201
1202	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1203	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1204	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1205	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1206	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1207
1208	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1209	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1210	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1211
1212	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1213	}
1214	return rcStrict;
1215	#endif
1216	}
1217
1218
1219	/**
1220	* Implements 'VMSAVE'.
1221	*/
1222	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1223	{
1224	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1225	RT_NOREF2(pVCpu, cbInstr);
1226	return VINF_EM_RAW_EMULATE_INSTR;
1227	#else
1228	LogFlow(("iemCImpl_vmsave\n"));
1229	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1230	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1231
1232	/** @todo Check effective address size using address size prefix. */
1233	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1234	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1235	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1236	{
1237	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1238	return iemRaiseGeneralProtectionFault0(pVCpu);
1239	}
1240
1241	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1242	{
1243	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1244	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1245	}
1246
1247	SVMVMCBSTATESAVE VmcbNstGst;
1248	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1249	sizeof(SVMVMCBSTATESAVE));
1250	if (rcStrict == VINF_SUCCESS)
1251	{
1252	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1253	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1254	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1255	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1256	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1257
1258	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1259	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1260	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1261	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1262	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1263
1264	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1265	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1266	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1267
1268	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1269	sizeof(SVMVMCBSTATESAVE));
1270	if (rcStrict == VINF_SUCCESS)
1271	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1272	}
1273	return rcStrict;
1274	#endif
1275	}
1276
1277
1278	/**
1279	* Implements 'CLGI'.
1280	*/
1281	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1282	{
1283	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1284	RT_NOREF2(pVCpu, cbInstr);
1285	return VINF_EM_RAW_EMULATE_INSTR;
1286	#else
1287	LogFlow(("iemCImpl_clgi\n"));
1288	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1289	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1290	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1291	{
1292	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1293	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1294	}
1295
1296	pCtx->hwvirt.fGif = false;
1297	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1298
1299	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1300	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1301	# else
1302	return VINF_SUCCESS;
1303	# endif
1304	#endif
1305	}
1306
1307
1308	/**
1309	* Implements 'STGI'.
1310	*/
1311	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1312	{
1313	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1314	RT_NOREF2(pVCpu, cbInstr);
1315	return VINF_EM_RAW_EMULATE_INSTR;
1316	#else
1317	LogFlow(("iemCImpl_stgi\n"));
1318	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1319	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1320	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1321	{
1322	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1323	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1324	}
1325
1326	pCtx->hwvirt.fGif = true;
1327	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1328
1329	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1330	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1331	# else
1332	return VINF_SUCCESS;
1333	# endif
1334	#endif
1335	}
1336
1337
1338	/**
1339	* Implements 'INVLPGA'.
1340	*/
1341	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1342	{
1343	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1344	/** @todo Check effective address size using address size prefix. */
1345	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1346	/** @todo PGM needs virtual ASID support. */
1347	#if 0
1348	uint32_t const uAsid = pCtx->ecx;
1349	#endif
1350
1351	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1352	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1353	{
1354	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1355	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1356	}
1357
1358	PGMInvalidatePage(pVCpu, GCPtrPage);
1359	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1360	return VINF_SUCCESS;
1361	}
1362
1363
1364	/**
1365	* Implements 'SKINIT'.
1366	*/
1367	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1368	{
1369	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1370
1371	uint32_t uIgnore;
1372	uint32_t fFeaturesECX;
1373	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1374	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1375	return iemRaiseUndefinedOpcode(pVCpu);
1376
1377	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1378	{
1379	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1380	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1381	}
1382
1383	RT_NOREF(cbInstr);
1384	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1385	}
1386

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 70736

Download in other formats: