IEMAllCImplSvmInstr.cpp.h@ 70948

Last change on this file since 70948 was 70900, checked in by vboxsync, 7 years ago
VMM/IEM: Nested Hw.virt: Don't ignore result of PGMFlushTLB.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 60.1 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 70900 2018-02-08 09:40:29Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param pCtx The guest-CPU context.
59	*/
60	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu, PCPUMCTX pCtx)
61	{
62	/*
63	* Flush the TLB with new CR3. This is required in case the PGM mode change
64	* below doesn't actually change anything.
65	*/
66	int rc = PGMFlushTLB(pVCpu, pCtx->cr3, true);
67	if (RT_SUCCESS(rc))
68	{
69	/*
70	* Inform PGM about paging mode changes.
71	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
72	* see comment in iemMemPageTranslateAndCheckAccess().
73	*/
74	rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
75	#ifdef IN_RING3
76	Assert(rc != VINF_PGM_CHANGE_MODE);
77	#endif
78	AssertRCReturn(rc, rc);
79
80	/* Inform CPUM (recompiler), can later be removed. */
81	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
82
83	/* Re-initialize IEM cache/state after the drastic mode switch. */
84	iemReInitExec(pVCpu);
85	}
86	return rc;
87	}
88
89
90	/**
91	* SVM \#VMEXIT handler.
92	*
93	* @returns Strict VBox status code.
94	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
95	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
96	* "host state" and a shutdown is required.
97	*
98	* @param pVCpu The cross context virtual CPU structure.
99	* @param pCtx The guest-CPU context.
100	* @param uExitCode The exit code.
101	* @param uExitInfo1 The exit info. 1 field.
102	* @param uExitInfo2 The exit info. 2 field.
103	*/
104	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
105	{
106	VBOXSTRICTRC rcStrict;
107	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
108	\|\| uExitCode == SVM_EXIT_INVALID)
109	{
110	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
111	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
112
113	/*
114	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
115	*/
116	pCtx->hwvirt.fGif = false;
117
118	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
119	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
120	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
121	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
122
123	/*
124	* Save the nested-guest state into the VMCB state-save area.
125	*/
126	PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
127	PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
128	PSVMVMCBSTATESAVE pVmcbNstGstState = &pVmcbNstGst->guest;
129
130	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, ES, es);
131	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, CS, cs);
132	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, SS, ss);
133	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbNstGstState, DS, ds);
134	pVmcbNstGstState->GDTR.u32Limit = pCtx->gdtr.cbGdt;
135	pVmcbNstGstState->GDTR.u64Base = pCtx->gdtr.pGdt;
136	pVmcbNstGstState->IDTR.u32Limit = pCtx->idtr.cbIdt;
137	pVmcbNstGstState->IDTR.u64Base = pCtx->idtr.pIdt;
138	pVmcbNstGstState->u64EFER = pCtx->msrEFER;
139	pVmcbNstGstState->u64CR4 = pCtx->cr4;
140	pVmcbNstGstState->u64CR3 = pCtx->cr3;
141	pVmcbNstGstState->u64CR2 = pCtx->cr2;
142	pVmcbNstGstState->u64CR0 = pCtx->cr0;
143	/** @todo Nested paging. */
144	pVmcbNstGstState->u64RFlags = pCtx->rflags.u64;
145	pVmcbNstGstState->u64RIP = pCtx->rip;
146	pVmcbNstGstState->u64RSP = pCtx->rsp;
147	pVmcbNstGstState->u64RAX = pCtx->rax;
148	pVmcbNstGstState->u64DR7 = pCtx->dr[7];
149	pVmcbNstGstState->u64DR6 = pCtx->dr[6];
150	pVmcbNstGstState->u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
151	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
152
153	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
154	/* Record any interrupt shadow of the nested-guest instruction into the nested-guest VMCB. */
155	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
156	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
157	{
158	pVmcbCtrl->IntShadow.n.u1IntShadow = 1;
159
160	/* Clear the inhibit-interrupt force-flag so as to not affect the outer guest. */
161	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
162	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
163	}
164
165	/*
166	* Save additional state and intercept information.
167	*/
168	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
169	{
170	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
171	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
172	}
173	else
174	pVmcbCtrl->IntCtrl.n.u1VIrqPending = 0;
175
176	/** @todo Save V_TPR, V_IRQ. */
177	/** @todo NRIP. */
178
179	/* Save exit information. */
180	pVmcbCtrl->u64ExitCode = uExitCode;
181	pVmcbCtrl->u64ExitInfo1 = uExitInfo1;
182	pVmcbCtrl->u64ExitInfo2 = uExitInfo2;
183
184	/*
185	* Update the exit interrupt-information field if this #VMEXIT happened as a result
186	* of delivering an event through IEM.
187	*
188	* Don't update the exit interrupt-information field if the event wasn't being injected
189	* through IEM, as it may have been updated by real hardware if the nested-guest was
190	* executed using hardware-assisted SVM.
191	*/
192	{
193	uint8_t uExitIntVector;
194	uint32_t uExitIntErr;
195	uint32_t fExitIntFlags;
196	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
197	NULL /* uExitIntCr2 */);
198	if (fRaisingEvent)
199	{
200	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
201	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
202	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
203	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
204	{
205	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
206	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
207	}
208	}
209	}
210
211	/*
212	* Clear event injection in the VMCB.
213	*/
214	pVmcbCtrl->EventInject.n.u1Valid = 0;
215
216	/*
217	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
218	* would have modified some VMCB state) that need to be restored on #VMEXIT before
219	* writing the VMCB back to guest memory.
220	*/
221	HMSvmNstGstVmExitNotify(pVCpu, pCtx);
222
223	/*
224	* Write back the nested-guest's VMCB to its guest physical memory location.
225	*/
226	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, pVmcbNstGst, sizeof(*pVmcbNstGst));
227
228	/*
229	* Prepare for guest's "host mode" by clearing internal processor state bits.
230	*
231	* We don't need to zero out the state-save area, just the controls should be
232	* sufficient because it has the critical bit of indicating whether we're inside
233	* the nested-guest or not.
234	*/
235	memset(pVmcbNstGstCtrl, 0, sizeof(*pVmcbNstGstCtrl));
236	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
237
238	/*
239	* Restore the subset of force-flags that were preserved.
240	*/
241	if (pCtx->hwvirt.fLocalForcedActions)
242	{
243	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
244	pCtx->hwvirt.fLocalForcedActions = 0;
245	}
246
247	if (RT_SUCCESS(rcStrict))
248	{
249	/** @todo Nested paging. */
250	/** @todo ASID. */
251
252	/*
253	* Reload the guest's "host state".
254	*/
255	CPUMSvmVmExitRestoreHostState(pVCpu, pCtx);
256
257	/*
258	* Update PGM, IEM and others of a world-switch.
259	*/
260	rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
261	if (rcStrict == VINF_SUCCESS)
262	rcStrict = VINF_SVM_VMEXIT;
263	else if (RT_SUCCESS(rcStrict))
264	{
265	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
266	iemSetPassUpStatus(pVCpu, rcStrict);
267	rcStrict = VINF_SVM_VMEXIT;
268	}
269	else
270	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
271	}
272	else
273	{
274	LogFlow(("iemSvmVmexit: Writing VMCB at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb,
275	VBOXSTRICTRC_VAL(rcStrict)));
276	rcStrict = VERR_SVM_VMEXIT_FAILED;
277	}
278	}
279	else
280	{
281	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
282	uExitInfo1, uExitInfo2));
283	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
284	rcStrict = VERR_SVM_IPE_5;
285	}
286
287	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
288	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
289	if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
290	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
291	# endif
292	return rcStrict;
293	}
294
295
296	/**
297	* Performs the operations necessary that are part of the vmrun instruction
298	* execution in the guest.
299	*
300	* @returns Strict VBox status code (i.e. informational status codes too).
301	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
302	* code execution.
303	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
304	* (SVM_EXIT_INVALID most likely).
305	*
306	* @param pVCpu The cross context virtual CPU structure.
307	* @param pCtx Pointer to the guest-CPU context.
308	* @param cbInstr The length of the VMRUN instruction.
309	* @param GCPhysVmcb Guest physical address of the VMCB to run.
310	*/
311	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
312	{
313	LogFlow(("iemSvmVmrun\n"));
314
315	#ifdef IN_RING0
316	/*
317	* Until PGM can handle switching the guest paging mode in ring-0,
318	* there's no point in trying to emulate VMRUN in ring-0 as we have
319	* to go back to ring-3 anyway, see @bugref{7243#c48}.
320	*/
321	RT_NOREF(pVCpu, pCtx, cbInstr, GCPhysVmcb);
322	return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
323	#else
324
325	/*
326	* Cache the physical address of the VMCB for #VMEXIT exceptions.
327	*/
328	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
329
330	/*
331	* Save the host state.
332	*/
333	CPUMSvmVmRunSaveHostState(pCtx, cbInstr);
334
335	/*
336	* Read the guest VMCB state.
337	*/
338	PVM pVM = pVCpu->CTX_SUFF(pVM);
339	int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
340	if (RT_SUCCESS(rc))
341	{
342	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
343	PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
344
345	/*
346	* Validate guest-state and controls.
347	*/
348	/* VMRUN must always be intercepted. */
349	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_VMRUN))
350	{
351	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
352	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
353	}
354
355	/* Nested paging. */
356	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
357	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
358	{
359	Log(("iemSvmVmrun: Nested paging not supported -> #VMEXIT\n"));
360	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
361	}
362
363	/* AVIC. */
364	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
365	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
366	{
367	Log(("iemSvmVmrun: AVIC not supported -> #VMEXIT\n"));
368	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
369	}
370
371	/* Last branch record (LBR) virtualization. */
372	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
373	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
374	{
375	Log(("iemSvmVmrun: LBR virtualization not supported -> #VMEXIT\n"));
376	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
377	}
378
379	/* Virtualized VMSAVE/VMLOAD. */
380	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
381	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
382	{
383	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> #VMEXIT\n"));
384	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
385	}
386
387	/* Virtual GIF. */
388	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
389	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
390	{
391	Log(("iemSvmVmrun: Virtual GIF not supported -> #VMEXIT\n"));
392	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
393	}
394
395	/* Guest ASID. */
396	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
397	{
398	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
399	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
400	}
401
402	/* IO permission bitmap. */
403	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
404	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
405	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
406	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
407	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
408	{
409	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
410	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
411	}
412
413	/* MSR permission bitmap. */
414	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
415	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
416	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
417	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
418	{
419	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
420	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
421	}
422
423	/* CR0. */
424	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
425	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
426	{
427	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
428	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
429	}
430	if (pVmcbNstGst->u64CR0 >> 32)
431	{
432	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
433	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
434	}
435	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
436
437	/* DR6 and DR7. */
438	if ( pVmcbNstGst->u64DR6 >> 32
439	\|\| pVmcbNstGst->u64DR7 >> 32)
440	{
441	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
442	pVmcbNstGst->u64DR6));
443	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
444	}
445
446	/** @todo gPAT MSR validation? */
447
448	/*
449	* Copy the IO permission bitmap into the cache.
450	*/
451	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
452	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
453	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
454	if (RT_FAILURE(rc))
455	{
456	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
457	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
458	}
459
460	/*
461	* Copy the MSR permission bitmap into the cache.
462	*/
463	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
464	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
465	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
466	if (RT_FAILURE(rc))
467	{
468	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
469	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
470	}
471
472	/*
473	* Copy segments from nested-guest VMCB state to the guest-CPU state.
474	*
475	* We do this here as we need to use the CS attributes and it's easier this way
476	* then using the VMCB format selectors. It doesn't really matter where we copy
477	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
478	*/
479	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
480	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
481	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
482	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
483
484	/** @todo Segment attribute overrides by VMRUN. */
485
486	/*
487	* CPL adjustments and overrides.
488	*
489	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
490	* We shall thus adjust both CS.DPL and SS.DPL here.
491	*/
492	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
493	if (CPUMIsGuestInV86ModeEx(pCtx))
494	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
495	if (CPUMIsGuestInRealModeEx(pCtx))
496	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
497	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
498
499	/*
500	* Continue validating guest-state and controls.
501	*
502	* We pass CR0 as 0 to CPUMQueryValidatedGuestEfer below to skip the illegal
503	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
504	* old and new EFER value to not have any guest EFER bits influence the new
505	* nested-guest EFER.
506	*/
507	uint64_t uValidEfer;
508	rc = CPUMQueryValidatedGuestEfer(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
509	if (RT_FAILURE(rc))
510	{
511	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
512	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
513	}
514
515	/* Validate paging and CPU mode bits. */
516	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
517	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
518	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
519	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
520	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
521	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
522	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
523	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
524	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
525	if (fLongModeWithPaging)
526	uValidEfer \|= MSR_K6_EFER_LMA;
527	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
528	if ( !fSvm
529	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
530	\|\| (fLongModeWithPaging && !fPae)
531	\|\| (fLongModeWithPaging && !fProtMode)
532	\|\| ( fLongModeEnabled
533	&& fPaging
534	&& fPae
535	&& fLongModeConformCS))
536	{
537	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
538	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
539	}
540
541	/*
542	* Preserve the required force-flags.
543	*
544	* We only preserve the force-flags that would affect the execution of the
545	* nested-guest (or the guest).
546	*
547	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
548	* instruction which is this VMRUN instruction itself.
549	*
550	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
551	* execution of a subsequent IRET instruction in the guest.
552	*
553	* - The remaining FFs (e.g. timers) can stay in place so that we will be
554	* able to generate interrupts that should cause #VMEXITs for the
555	* nested-guest.
556	*/
557	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
558	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
559
560	/*
561	* Interrupt shadow.
562	*/
563	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
564	{
565	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
566	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
567	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
568	}
569
570	/*
571	* TLB flush control.
572	* Currently disabled since it's redundant as we unconditionally flush the TLB
573	* in iemSvmWorldSwitch() below.
574	*/
575	#if 0
576	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
577	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
578	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
579	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
580	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
581	#endif
582
583	/*
584	* Copy the remaining guest state from the VMCB to the guest-CPU context.
585	*/
586	pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
587	pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
588	pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
589	pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
590	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
591	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
592	pCtx->cr3 = pVmcbNstGst->u64CR3;
593	pCtx->cr2 = pVmcbNstGst->u64CR2;
594	pCtx->dr[6] = pVmcbNstGst->u64DR6;
595	pCtx->dr[7] = pVmcbNstGst->u64DR7;
596	pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
597	pCtx->rax = pVmcbNstGst->u64RAX;
598	pCtx->rsp = pVmcbNstGst->u64RSP;
599	pCtx->rip = pVmcbNstGst->u64RIP;
600	CPUMSetGuestMsrEferNoCheck(pVCpu, pCtx->msrEFER, uValidEfer);
601
602	/* Mask DR6, DR7 bits mandatory set/clear bits. */
603	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
604	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
605	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
606	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
607
608	/*
609	* Check for pending virtual interrupts.
610	*/
611	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
612	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
613	else
614	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
615
616	/*
617	* Update PGM, IEM and others of a world-switch.
618	*/
619	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
620	if (rcStrict == VINF_SUCCESS)
621	{ /* likely */ }
622	else if (RT_SUCCESS(rcStrict))
623	{
624	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
625	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
626	}
627	else
628	{
629	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
630	return rcStrict;
631	}
632
633	/*
634	* Clear global interrupt flags to allow interrupts in the guest.
635	*/
636	pCtx->hwvirt.fGif = true;
637
638	/*
639	* Event injection.
640	*/
641	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
642	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
643	if (pEventInject->n.u1Valid)
644	{
645	uint8_t const uVector = pEventInject->n.u8Vector;
646	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
647	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
648
649	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
650	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
651	{
652	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
653	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
654	}
655	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
656	{
657	if ( uVector == X86_XCPT_NMI
658	\|\| uVector > X86_XCPT_LAST)
659	{
660	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
661	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
662	}
663	if ( uVector == X86_XCPT_BR
664	&& CPUMIsGuestInLongModeEx(pCtx))
665	{
666	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
667	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
668	}
669	/** @todo any others? */
670	}
671
672	/*
673	* Invalidate the exit interrupt-information field here. This field is fully updated
674	* on #VMEXIT as events other than the one below can also cause intercepts during
675	* their injection (e.g. exceptions).
676	*/
677	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
678
679	/*
680	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
681	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
682	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
683	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
684	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
685	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
686	* injecting the event through IEM here.
687	*/
688	pVmcbCtrl->EventInject.n.u1Valid = 0;
689
690	/** @todo NRIP: Software interrupts can only be pushed properly if we support
691	* NRIP for the nested-guest to calculate the instruction length
692	* below. */
693	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
694	pCtx->cs.Sel, pCtx->rip, uVector, enmType, uErrorCode, pCtx->cr2, pCtx->cr3, pCtx->msrEFER));
695	#if 0
696	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
697	#else
698	TRPMAssertTrap(pVCpu, uVector, enmType);
699	if (pEventInject->n.u1ErrorCodeValid)
700	TRPMSetErrorCode(pVCpu, uErrorCode);
701	if ( enmType == TRPM_TRAP
702	&& uVector == X86_XCPT_PF)
703	TRPMSetFaultAddress(pVCpu, pCtx->cr2);
704	#endif
705	}
706	else
707	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
708	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
709
710	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
711
712	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
713	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
714	if (HMSvmIsVGifActive(pVM))
715	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
716	# endif
717
718	return rcStrict;
719	}
720
721	/* Shouldn't really happen as the caller should've validated the physical address already. */
722	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
723	return rc;
724	#endif
725	}
726
727
728	#if 0
729	/**
730	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
731	* intercept is active.
732	*
733	* @returns Strict VBox status code.
734	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
735	* we're not executing a nested-guest.
736	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
737	* successfully.
738	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
739	* failed and a shutdown needs to be initiated for the geust.
740	*
741	* @param pVCpu The cross context virtual CPU structure.
742	* @param pCtx The guest-CPU context.
743	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
744	* @param uExitInfo1 The exit info. 1 field.
745	* @param uExitInfo2 The exit info. 2 field.
746	*/
747	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
748	uint64_t uExitInfo2)
749	{
750	#define HMSVM_CTRL_INTERCEPT_VMEXIT(a_Intercept) \
751	do { \
752	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
753	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
754	break; \
755	} while (0)
756
757	if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
758	return VINF_HM_INTERCEPT_NOT_ACTIVE;
759
760	switch (uExitCode)
761	{
762	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
763	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
764	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
765	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
766	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
767	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
768	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
769	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
770	{
771	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
772	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
773	break;
774	}
775
776	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
777	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
778	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
779	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
780	{
781	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
782	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
783	break;
784	}
785
786	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
787	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
788	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
789	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
790	{
791	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
792	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
793	break;
794	}
795
796	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
797	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
798	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
799	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
800	{
801	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
802	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
803	break;
804	}
805
806	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
807	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
808	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
809	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
810	{
811	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
812	return iemSvmVmexit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2);
813	break;
814	}
815
816	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTR);
817	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_NMI);
818	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SMI);
819	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INIT);
820	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VINTR);
821	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
822	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_READS);
823	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_READS);
824	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_READS);
825	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_READS);
826	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IDTR_WRITES);
827	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_GDTR_WRITES);
828	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_LDTR_WRITES);
829	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TR_WRITES);
830	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSC);
831	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDPMC);
832	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PUSHF);
833	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_POPF);
834	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CPUID);
835	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RSM);
836	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_IRET);
837	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INTN);
838	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVD);
839	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_PAUSE);
840	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_HLT);
841	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPG);
842	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_INVLPGA);
843	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_TASK_SWITCH);
844	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_FERR_FREEZE);
845	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SHUTDOWN);
846	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMRUN);
847	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMMCALL);
848	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMLOAD);
849	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_VMSAVE);
850	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_STGI);
851	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_CLGI);
852	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_SKINIT);
853	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_RDTSCP);
854	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_ICEBP);
855	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_WBINVD);
856	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MONITOR);
857	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT);
858	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
859	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT(SVM_CTRL_INTERCEPT_XSETBV);
860
861	case SVM_EXIT_IOIO:
862	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
863	return VERR_SVM_IPE_1;
864
865	case SVM_EXIT_MSR:
866	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
867	return VERR_SVM_IPE_1;
868
869	case SVM_EXIT_NPF:
870	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
871	case SVM_EXIT_AVIC_NOACCEL:
872	AssertMsgFailed(("Todo Implement.\n"));
873	return VERR_SVM_IPE_1;
874
875	default:
876	AssertMsgFailed(("Unsupported SVM exit code %#RX64\n", uExitCode));
877	return VERR_SVM_IPE_1;
878	}
879
880	return VINF_HM_INTERCEPT_NOT_ACTIVE;
881
882	#undef HMSVM_CTRL_INTERCEPT_VMEXIT
883	}
884	#endif
885
886
887	/**
888	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
889	* intercept is active.
890	*
891	* @returns Strict VBox status code.
892	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
893	* we're not executing a nested-guest.
894	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
895	* successfully.
896	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
897	* failed and a shutdown needs to be initiated for the geust.
898	*
899	* @returns VBox strict status code.
900	* @param pVCpu The cross context virtual CPU structure of the calling thread.
901	* @param u16Port The IO port being accessed.
902	* @param enmIoType The type of IO access.
903	* @param cbReg The IO operand size in bytes.
904	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
905	* @param iEffSeg The effective segment number.
906	* @param fRep Whether this is a repeating IO instruction (REP prefix).
907	* @param fStrIo Whether this is a string IO instruction.
908	* @param cbInstr The length of the IO instruction in bytes.
909	*/
910	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
911	uint64_t uCr2)
912	{
913	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
914
915	/*
916	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
917	*
918	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_EXCEPTION_2 #VMEXITs.
919	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
920	* even when they use a vector in the range 0 to 31.
921	* - ICEBP should not trigger #DB intercept, but its own intercept.
922	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
923	*/
924	/* Check NMI intercept */
925	if ( u8Vector == X86_XCPT_NMI
926	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
927	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
928	{
929	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
930	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
931	}
932
933	/* Check ICEBP intercept. */
934	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
935	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
936	{
937	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
938	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
939	}
940
941	/* Check CPU exception intercepts. */
942	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
943	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
944	{
945	Assert(u8Vector <= X86_XCPT_LAST);
946	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
947	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
948	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
949	&& u8Vector == X86_XCPT_PF
950	&& !(uErr & X86_TRAP_PF_ID))
951	{
952	/** @todo Nested-guest SVM - figure out fetching op-code bytes from IEM. */
953	#ifdef IEM_WITH_CODE_TLB
954	AssertReleaseFailedReturn(VERR_IEM_IPE_5);
955	#else
956	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
957	uint8_t const offOpCode = pVCpu->iem.s.offOpcode;
958	uint8_t const cbCurrent = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode;
959	if ( cbCurrent > 0
960	&& cbCurrent < sizeof(pVmcbCtrl->abInstr))
961	{
962	Assert(cbCurrent <= sizeof(pVCpu->iem.s.abOpcode));
963	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[offOpCode], cbCurrent);
964	}
965	#endif
966	}
967	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
968	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
969	u8Vector, uExitInfo1, uExitInfo2));
970	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_EXCEPTION_0 + u8Vector, uExitInfo1, uExitInfo2);
971	}
972
973	/* Check software interrupt (INTn) intercepts. */
974	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
975	\| IEM_XCPT_FLAGS_BP_INSTR
976	\| IEM_XCPT_FLAGS_ICEBP_INSTR
977	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
978	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
979	{
980	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
981	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
982	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
983	}
984
985	return VINF_HM_INTERCEPT_NOT_ACTIVE;
986	}
987
988
989	/**
990	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
991	* corresponding intercept is active.
992	*
993	* @returns Strict VBox status code.
994	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
995	* we're not executing a nested-guest.
996	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
997	* successfully.
998	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
999	* failed and a shutdown needs to be initiated for the geust.
1000	*
1001	* @returns VBox strict status code.
1002	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1003	* @param u16Port The IO port being accessed.
1004	* @param enmIoType The type of IO access.
1005	* @param cbReg The IO operand size in bytes.
1006	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1007	* @param iEffSeg The effective segment number.
1008	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1009	* @param fStrIo Whether this is a string IO instruction.
1010	* @param cbInstr The length of the IO instruction in bytes.
1011	*/
1012	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1013	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1014	{
1015	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1016	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1017	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1018
1019	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1020
1021	SVMIOIOEXITINFO IoExitInfo;
1022	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1023	void *pvIoBitmap = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
1024	bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
1025	&IoExitInfo);
1026	if (fIntercept)
1027	{
1028	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1029	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
1030	}
1031
1032	/** @todo remove later (for debugging as VirtualBox always traps all IO
1033	* intercepts). */
1034	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1035	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1036	}
1037
1038
1039	/**
1040	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1041	* corresponding intercept is active.
1042	*
1043	* @returns Strict VBox status code.
1044	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1045	* specify interception of the accessed MSR @a idMsr.
1046	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1047	* successfully.
1048	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1049	* failed and a shutdown needs to be initiated for the geust.
1050	*
1051	* @param pVCpu The cross context virtual CPU structure.
1052	* @param pCtx The guest-CPU context.
1053	* @param idMsr The MSR being accessed in the nested-guest.
1054	* @param fWrite Whether this is an MSR write access, @c false implies an
1055	* MSR read.
1056	*/
1057	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1058	{
1059	/*
1060	* Check if any MSRs are being intercepted.
1061	*/
1062	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1063	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1064
1065	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1066
1067	/*
1068	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1069	*/
1070	uint16_t offMsrpm;
1071	uint32_t uMsrpmBit;
1072	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1073	if (RT_SUCCESS(rc))
1074	{
1075	Assert(uMsrpmBit < 0x3fff);
1076	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1077	if (fWrite)
1078	++uMsrpmBit;
1079
1080	/*
1081	* Check if the bit is set, if so, trigger a #VMEXIT.
1082	*/
1083	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1084	pbMsrpm += offMsrpm;
1085	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1086	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1087	}
1088	else
1089	{
1090	/*
1091	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1092	*/
1093	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1094	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1095	}
1096	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1097	}
1098
1099
1100
1101	/**
1102	* Implements 'VMRUN'.
1103	*/
1104	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1105	{
1106	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1107	RT_NOREF2(pVCpu, cbInstr);
1108	return VINF_EM_RAW_EMULATE_INSTR;
1109	#else
1110	LogFlow(("iemCImpl_vmrun\n"));
1111	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1112	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1113
1114	/** @todo Check effective address size using address size prefix. */
1115	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1116	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1117	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1118	{
1119	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1120	return iemRaiseGeneralProtectionFault0(pVCpu);
1121	}
1122
1123	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1124	{
1125	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1126	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1127	}
1128
1129	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1130	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1131	{
1132	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1133	rcStrict = VINF_EM_TRIPLE_FAULT;
1134	}
1135	return rcStrict;
1136	#endif
1137	}
1138
1139
1140	/**
1141	* Implements 'VMMCALL'.
1142	*/
1143	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1144	{
1145	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1146	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1147	{
1148	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1149	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1150	}
1151
1152	bool fUpdatedRipAndRF;
1153	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1154	if (RT_SUCCESS(rcStrict))
1155	{
1156	if (!fUpdatedRipAndRF)
1157	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1158	return rcStrict;
1159	}
1160
1161	return iemRaiseUndefinedOpcode(pVCpu);
1162	}
1163
1164
1165	/**
1166	* Implements 'VMLOAD'.
1167	*/
1168	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1169	{
1170	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1171	RT_NOREF2(pVCpu, cbInstr);
1172	return VINF_EM_RAW_EMULATE_INSTR;
1173	#else
1174	LogFlow(("iemCImpl_vmload\n"));
1175	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1176	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1177
1178	/** @todo Check effective address size using address size prefix. */
1179	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1180	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1181	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1182	{
1183	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1184	return iemRaiseGeneralProtectionFault0(pVCpu);
1185	}
1186
1187	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1188	{
1189	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1190	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1191	}
1192
1193	SVMVMCBSTATESAVE VmcbNstGst;
1194	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1195	sizeof(SVMVMCBSTATESAVE));
1196	if (rcStrict == VINF_SUCCESS)
1197	{
1198	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1199	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1200	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1201	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1202	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1203
1204	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1205	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1206	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1207	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1208	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1209
1210	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1211	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1212	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1213
1214	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1215	}
1216	return rcStrict;
1217	#endif
1218	}
1219
1220
1221	/**
1222	* Implements 'VMSAVE'.
1223	*/
1224	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1225	{
1226	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1227	RT_NOREF2(pVCpu, cbInstr);
1228	return VINF_EM_RAW_EMULATE_INSTR;
1229	#else
1230	LogFlow(("iemCImpl_vmsave\n"));
1231	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1232	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1233
1234	/** @todo Check effective address size using address size prefix. */
1235	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1236	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1237	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1238	{
1239	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1240	return iemRaiseGeneralProtectionFault0(pVCpu);
1241	}
1242
1243	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1244	{
1245	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1246	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1247	}
1248
1249	SVMVMCBSTATESAVE VmcbNstGst;
1250	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1251	sizeof(SVMVMCBSTATESAVE));
1252	if (rcStrict == VINF_SUCCESS)
1253	{
1254	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1255	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1256	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1257	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1258	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1259
1260	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1261	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1262	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1263	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1264	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1265
1266	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1267	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1268	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1269
1270	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1271	sizeof(SVMVMCBSTATESAVE));
1272	if (rcStrict == VINF_SUCCESS)
1273	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1274	}
1275	return rcStrict;
1276	#endif
1277	}
1278
1279
1280	/**
1281	* Implements 'CLGI'.
1282	*/
1283	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1284	{
1285	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1286	RT_NOREF2(pVCpu, cbInstr);
1287	return VINF_EM_RAW_EMULATE_INSTR;
1288	#else
1289	LogFlow(("iemCImpl_clgi\n"));
1290	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1291	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1292	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1293	{
1294	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1295	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1296	}
1297
1298	pCtx->hwvirt.fGif = false;
1299	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1300
1301	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1302	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1303	# else
1304	return VINF_SUCCESS;
1305	# endif
1306	#endif
1307	}
1308
1309
1310	/**
1311	* Implements 'STGI'.
1312	*/
1313	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1314	{
1315	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1316	RT_NOREF2(pVCpu, cbInstr);
1317	return VINF_EM_RAW_EMULATE_INSTR;
1318	#else
1319	LogFlow(("iemCImpl_stgi\n"));
1320	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1321	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1322	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1323	{
1324	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1325	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1326	}
1327
1328	pCtx->hwvirt.fGif = true;
1329	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1330
1331	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1332	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1333	# else
1334	return VINF_SUCCESS;
1335	# endif
1336	#endif
1337	}
1338
1339
1340	/**
1341	* Implements 'INVLPGA'.
1342	*/
1343	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1344	{
1345	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1346	/** @todo Check effective address size using address size prefix. */
1347	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1348	/** @todo PGM needs virtual ASID support. */
1349	#if 0
1350	uint32_t const uAsid = pCtx->ecx;
1351	#endif
1352
1353	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1354	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1355	{
1356	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1357	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1358	}
1359
1360	PGMInvalidatePage(pVCpu, GCPtrPage);
1361	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1362	return VINF_SUCCESS;
1363	}
1364
1365
1366	/**
1367	* Implements 'SKINIT'.
1368	*/
1369	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1370	{
1371	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1372
1373	uint32_t uIgnore;
1374	uint32_t fFeaturesECX;
1375	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1376	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1377	return iemRaiseUndefinedOpcode(pVCpu);
1378
1379	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1380	{
1381	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1382	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1383	}
1384
1385	RT_NOREF(cbInstr);
1386	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1387	}
1388

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 70948

Download in other formats: