IEMAllCImplSvmInstr.cpp.h@ 72064

Last change on this file since 72064 was 71970, checked in by vboxsync, 7 years ago
VMM: Nested hw.virt: Try run whatever VMRUN emulations in ring-0 although we'd be travelling back to ring-3 in many situations due to PGM mode changes.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 55.5 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 71970 2018-04-23 09:04:53Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/**
20	* Converts an IEM exception event type to an SVM event type.
21	*
22	* @returns The SVM event type.
23	* @retval UINT8_MAX if the specified type of event isn't among the set
24	* of recognized IEM event types.
25	*
26	* @param uVector The vector of the event.
27	* @param fIemXcptFlags The IEM exception / interrupt flags.
28	*/
29	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30	{
31	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32	{
33	if (uVector != X86_XCPT_NMI)
34	return SVM_EVENT_EXCEPTION;
35	return SVM_EVENT_NMI;
36	}
37
38	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
40	return SVM_EVENT_EXCEPTION;
41
42	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43	return SVM_EVENT_EXTERNAL_IRQ;
44
45	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46	return SVM_EVENT_SOFTWARE_INT;
47
48	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49	return UINT8_MAX;
50	}
51
52
53	/**
54	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
55	*
56	* @returns Strict VBox status code.
57	* @param pVCpu The cross context virtual CPU structure.
58	* @param pCtx The guest-CPU context.
59	*/
60	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu, PCPUMCTX pCtx)
61	{
62	/*
63	* Inform PGM about paging mode changes.
64	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
65	* see comment in iemMemPageTranslateAndCheckAccess().
66	*/
67	int rc = PGMChangeMode(pVCpu, pCtx->cr0 \| X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
68	#ifdef IN_RING3
69	Assert(rc != VINF_PGM_CHANGE_MODE);
70	#endif
71	AssertRCReturn(rc, rc);
72
73	/* Inform CPUM (recompiler), can later be removed. */
74	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
75
76	/*
77	* Flush the TLB with new CR3. This is required in case the PGM mode change
78	* above doesn't actually change anything.
79	*/
80	if (rc == VINF_SUCCESS)
81	{
82	rc = PGMFlushTLB(pVCpu, pCtx->cr3, true);
83	AssertRCReturn(rc, rc);
84	}
85
86	/* Re-initialize IEM cache/state after the drastic mode switch. */
87	iemReInitExec(pVCpu);
88	return rc;
89	}
90
91
92	/**
93	* SVM \#VMEXIT handler.
94	*
95	* @returns Strict VBox status code.
96	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
97	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
98	* "host state" and a shutdown is required.
99	*
100	* @param pVCpu The cross context virtual CPU structure.
101	* @param pCtx The guest-CPU context.
102	* @param uExitCode The exit code.
103	* @param uExitInfo1 The exit info. 1 field.
104	* @param uExitInfo2 The exit info. 2 field.
105	*/
106	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
107	{
108	VBOXSTRICTRC rcStrict;
109	if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
110	\|\| uExitCode == SVM_EXIT_INVALID)
111	{
112	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
113	pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
114
115	/*
116	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
117	*/
118	pCtx->hwvirt.fGif = false;
119
120	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
121	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
122	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
123	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
124
125	/*
126	* Map the nested-guest VMCB from its location in guest memory.
127	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
128	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
129	*/
130	PSVMVMCB pVmcbMem;
131	PGMPAGEMAPLOCK PgLockMem;
132	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
133	rcStrict = iemMemPageMap(pVCpu, pCtx->hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem, &PgLockMem);
134	if (rcStrict == VINF_SUCCESS)
135	{
136	/*
137	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
138	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
139	* writing the VMCB back to guest memory.
140	*/
141	HMSvmNstGstVmExitNotify(pVCpu, pCtx);
142
143	/*
144	* Save the nested-guest state into the VMCB state-save area.
145	*/
146	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
147	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, ES, es);
148	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, CS, cs);
149	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, SS, ss);
150	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, DS, ds);
151	pVmcbMemState->GDTR.u32Limit = pCtx->gdtr.cbGdt;
152	pVmcbMemState->GDTR.u64Base = pCtx->gdtr.pGdt;
153	pVmcbMemState->IDTR.u32Limit = pCtx->idtr.cbIdt;
154	pVmcbMemState->IDTR.u64Base = pCtx->idtr.pIdt;
155	pVmcbMemState->u64EFER = pCtx->msrEFER;
156	pVmcbMemState->u64CR4 = pCtx->cr4;
157	pVmcbMemState->u64CR3 = pCtx->cr3;
158	pVmcbMemState->u64CR2 = pCtx->cr2;
159	pVmcbMemState->u64CR0 = pCtx->cr0;
160	/** @todo Nested paging. */
161	pVmcbMemState->u64RFlags = pCtx->rflags.u64;
162	pVmcbMemState->u64RIP = pCtx->rip;
163	pVmcbMemState->u64RSP = pCtx->rsp;
164	pVmcbMemState->u64RAX = pCtx->rax;
165	pVmcbMemState->u64DR7 = pCtx->dr[7];
166	pVmcbMemState->u64DR6 = pCtx->dr[6];
167	pVmcbMemState->u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
168	Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
169	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, pCtx))
170	pVmcbMemState->u64PAT = pCtx->msrPAT;
171
172	/*
173	* Save additional state and intercept information.
174	*
175	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
176	* - V_TPR: Already updated by iemCImpl_load_CrX or by the physical CPU for
177	* hardware-assisted SVM execution.
178	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
179	*/
180	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
181	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
182	{
183	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
184	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 1;
185	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
186	}
187	else
188	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
189
190	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
191
192	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
193	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
194	{
195	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
196	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
197	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
198	}
199	else
200	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
201
202	/*
203	* Save nRIP, instruction length and byte fields.
204	*/
205	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
206	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
207	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
208
209	/*
210	* Save exit information.
211	*/
212	pVmcbMemCtrl->u64ExitCode = uExitCode;
213	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
214	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
215
216	/*
217	* Update the exit interrupt-information field if this #VMEXIT happened as a result
218	* of delivering an event through IEM.
219	*
220	* Don't update the exit interrupt-information field if the event wasn't being injected
221	* through IEM, as it would have been updated by real hardware if the nested-guest was
222	* executed using hardware-assisted SVM.
223	*/
224	{
225	uint8_t uExitIntVector;
226	uint32_t uExitIntErr;
227	uint32_t fExitIntFlags;
228	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
229	NULL /* uExitIntCr2 */);
230	if (fRaisingEvent)
231	{
232	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
233	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
234	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
235	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
236	{
237	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
238	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
239	}
240	}
241	}
242
243	/*
244	* Save the exit interrupt-information field.
245	*
246	* We write the whole field including overwriting reserved bits as it was observed on an
247	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
248	*/
249	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
250
251	/*
252	* Clear event injection.
253	*/
254	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
255
256	iemMemPageUnmap(pVCpu, pCtx->hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
257	}
258
259	/*
260	* Prepare for guest's "host mode" by clearing internal processor state bits.
261	*
262	* We don't need to zero out the state-save area, just the controls should be
263	* sufficient because it has the critical bit of indicating whether we're inside
264	* the nested-guest or not.
265	*/
266	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
267	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
268
269	/*
270	* Restore the subset of force-flags that were preserved.
271	*/
272	if (pCtx->hwvirt.fLocalForcedActions)
273	{
274	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
275	pCtx->hwvirt.fLocalForcedActions = 0;
276	}
277
278	if (rcStrict == VINF_SUCCESS)
279	{
280	/** @todo Nested paging. */
281	/** @todo ASID. */
282
283	/*
284	* Reload the guest's "host state".
285	*/
286	CPUMSvmVmExitRestoreHostState(pVCpu, pCtx);
287
288	/*
289	* Update PGM, IEM and others of a world-switch.
290	*/
291	rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
292	if (rcStrict == VINF_SUCCESS)
293	rcStrict = VINF_SVM_VMEXIT;
294	else if (RT_SUCCESS(rcStrict))
295	{
296	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
297	iemSetPassUpStatus(pVCpu, rcStrict);
298	rcStrict = VINF_SVM_VMEXIT;
299	}
300	else
301	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
302	}
303	else
304	{
305	LogFlow(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
306	rcStrict = VERR_SVM_VMEXIT_FAILED;
307	}
308	}
309	else
310	{
311	Log(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
312	uExitInfo1, uExitInfo2));
313	AssertMsgFailed(("iemSvmVmexit: Unexpected SVM-exit failure uExitCode=%#RX64\n", uExitCode));
314	rcStrict = VERR_SVM_IPE_3;
315	}
316
317	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
318	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
319	if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
320	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
321	# endif
322	return rcStrict;
323	}
324
325
326	/**
327	* Performs the operations necessary that are part of the vmrun instruction
328	* execution in the guest.
329	*
330	* @returns Strict VBox status code (i.e. informational status codes too).
331	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
332	* code execution.
333	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
334	* (SVM_EXIT_INVALID most likely).
335	*
336	* @param pVCpu The cross context virtual CPU structure.
337	* @param pCtx Pointer to the guest-CPU context.
338	* @param cbInstr The length of the VMRUN instruction.
339	* @param GCPhysVmcb Guest physical address of the VMCB to run.
340	*/
341	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
342	{
343	LogFlow(("iemSvmVmrun\n"));
344
345	/*
346	* Cache the physical address of the VMCB for #VMEXIT exceptions.
347	*/
348	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
349
350	/*
351	* Save the host state.
352	*/
353	CPUMSvmVmRunSaveHostState(pCtx, cbInstr);
354
355	/*
356	* Read the guest VMCB.
357	*/
358	PVM pVM = pVCpu->CTX_SUFF(pVM);
359	int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
360	if (RT_SUCCESS(rc))
361	{
362	/*
363	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
364	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
365	* but in our implementation we try to preserve as much as we possibly can.
366	*
367	* We could read the entire page here and only write back the relevant fields on
368	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
369	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
370	* currently reserved but may be recognized as features bits in future CPUs causing
371	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
372	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
373	*/
374	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
375	PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
376
377	RT_ZERO(pVmcbCtrl->u8Reserved0);
378	RT_ZERO(pVmcbCtrl->u8Reserved1);
379	RT_ZERO(pVmcbCtrl->u8Reserved2);
380	RT_ZERO(pVmcbNstGst->u8Reserved0);
381	RT_ZERO(pVmcbNstGst->u8Reserved1);
382	RT_ZERO(pVmcbNstGst->u8Reserved2);
383	RT_ZERO(pVmcbNstGst->u8Reserved3);
384	RT_ZERO(pVmcbNstGst->u8Reserved4);
385	RT_ZERO(pVmcbNstGst->u8Reserved5);
386	pVmcbCtrl->u32Reserved0 = 0;
387	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
388	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
389	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
390	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
391	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
392	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
393	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
394	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
395	pVmcbCtrl->EventInject.n.u19Reserved = 0;
396	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
397
398	/*
399	* Validate guest-state and controls.
400	*/
401	/* VMRUN must always be intercepted. */
402	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_VMRUN))
403	{
404	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
405	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
406	}
407
408	/* Nested paging. */
409	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
410	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
411	{
412	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
413	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
414	}
415
416	/* AVIC. */
417	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
418	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
419	{
420	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
421	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
422	}
423
424	/* Last branch record (LBR) virtualization. */
425	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
426	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
427	{
428	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
429	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
430	}
431
432	/* Virtualized VMSAVE/VMLOAD. */
433	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
434	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
435	{
436	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
437	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
438	}
439
440	/* Virtual GIF. */
441	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
442	&& pVM->cpum.ro.GuestFeatures.fSvmVGif)
443	{
444	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
445	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
446	}
447
448	/* Guest ASID. */
449	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
450	{
451	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
452	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
453	}
454
455	/* Guest AVIC. */
456	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
457	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
458	{
459	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
460	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
461	}
462
463	/* Guest Secure Encrypted Virtualization. */
464	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
465	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
466	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
467	{
468	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
469	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
470	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
471	}
472
473	/* Flush by ASID. */
474	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
475	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
476	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
477	{
478	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
479	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
480	}
481
482	/* IO permission bitmap. */
483	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
484	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
485	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
486	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
487	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
488	{
489	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
490	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
491	}
492
493	/* MSR permission bitmap. */
494	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
495	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
496	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
497	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
498	{
499	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
500	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
501	}
502
503	/* CR0. */
504	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
505	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
506	{
507	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
508	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
509	}
510	if (pVmcbNstGst->u64CR0 >> 32)
511	{
512	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
513	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
514	}
515	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
516
517	/* DR6 and DR7. */
518	if ( pVmcbNstGst->u64DR6 >> 32
519	\|\| pVmcbNstGst->u64DR7 >> 32)
520	{
521	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
522	pVmcbNstGst->u64DR6));
523	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
524	}
525
526	/*
527	* PAT (Page Attribute Table) MSR.
528	*
529	* The CPU only validates and loads it when nested-paging is enabled.
530	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
531	*/
532	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
533	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
534	{
535	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
536	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
537	}
538
539	/*
540	* Copy the IO permission bitmap into the cache.
541	*/
542	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
543	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
544	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
545	if (RT_FAILURE(rc))
546	{
547	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
548	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
549	}
550
551	/*
552	* Copy the MSR permission bitmap into the cache.
553	*/
554	Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
555	rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
556	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
557	if (RT_FAILURE(rc))
558	{
559	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
560	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
561	}
562
563	/*
564	* Copy segments from nested-guest VMCB state to the guest-CPU state.
565	*
566	* We do this here as we need to use the CS attributes and it's easier this way
567	* then using the VMCB format selectors. It doesn't really matter where we copy
568	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
569	*/
570	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
571	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
572	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
573	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
574
575	/** @todo Segment attribute overrides by VMRUN. */
576
577	/*
578	* CPL adjustments and overrides.
579	*
580	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
581	* We shall thus adjust both CS.DPL and SS.DPL here.
582	*/
583	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
584	if (CPUMIsGuestInV86ModeEx(pCtx))
585	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
586	if (CPUMIsGuestInRealModeEx(pCtx))
587	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
588	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
589
590	/*
591	* Continue validating guest-state and controls.
592	*
593	* We pass CR0 as 0 to CPUMQueryValidatedGuestEfer below to skip the illegal
594	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
595	* old and new EFER value to not have any guest EFER bits influence the new
596	* nested-guest EFER.
597	*/
598	uint64_t uValidEfer;
599	rc = CPUMQueryValidatedGuestEfer(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
600	if (RT_FAILURE(rc))
601	{
602	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
603	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
604	}
605
606	/* Validate paging and CPU mode bits. */
607	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
608	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
609	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
610	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
611	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
612	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
613	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
614	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
615	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
616	if (fLongModeWithPaging)
617	uValidEfer \|= MSR_K6_EFER_LMA;
618	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
619	if ( !fSvm
620	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
621	\|\| (fLongModeWithPaging && !fPae)
622	\|\| (fLongModeWithPaging && !fProtMode)
623	\|\| ( fLongModeEnabled
624	&& fPaging
625	&& fPae
626	&& fLongModeConformCS))
627	{
628	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
629	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
630	}
631
632	/*
633	* Preserve the required force-flags.
634	*
635	* We only preserve the force-flags that would affect the execution of the
636	* nested-guest (or the guest).
637	*
638	* - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
639	* instruction which is this VMRUN instruction itself.
640	*
641	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
642	* execution of a subsequent IRET instruction in the guest.
643	*
644	* - The remaining FFs (e.g. timers) can stay in place so that we will be
645	* able to generate interrupts that should cause #VMEXITs for the
646	* nested-guest.
647	*/
648	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
649	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
650
651	/*
652	* Pause filter.
653	*/
654	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
655	{
656	pCtx->hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
657	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
658	pCtx->hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
659	}
660
661	/*
662	* Interrupt shadow.
663	*/
664	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
665	{
666	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
667	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
668	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
669	}
670
671	/*
672	* TLB flush control.
673	* Currently disabled since it's redundant as we unconditionally flush the TLB
674	* in iemSvmWorldSwitch() below.
675	*/
676	#if 0
677	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
678	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
679	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
680	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
681	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
682	#endif
683
684	/*
685	* Copy the remaining guest state from the VMCB to the guest-CPU context.
686	*/
687	pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
688	pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
689	pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
690	pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
691	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
692	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
693	pCtx->cr3 = pVmcbNstGst->u64CR3;
694	pCtx->cr2 = pVmcbNstGst->u64CR2;
695	pCtx->dr[6] = pVmcbNstGst->u64DR6;
696	pCtx->dr[7] = pVmcbNstGst->u64DR7;
697	pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
698	pCtx->rax = pVmcbNstGst->u64RAX;
699	pCtx->rsp = pVmcbNstGst->u64RSP;
700	pCtx->rip = pVmcbNstGst->u64RIP;
701	CPUMSetGuestMsrEferNoCheck(pVCpu, pCtx->msrEFER, uValidEfer);
702	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
703	pCtx->msrPAT = pVmcbNstGst->u64PAT;
704
705	/* Mask DR6, DR7 bits mandatory set/clear bits. */
706	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
707	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
708	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
709	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
710
711	/*
712	* Check for pending virtual interrupts.
713	*/
714	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
715	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
716	else
717	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
718
719	/*
720	* Update PGM, IEM and others of a world-switch.
721	*/
722	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
723	if (rcStrict == VINF_SUCCESS)
724	{ /* likely */ }
725	else if (RT_SUCCESS(rcStrict))
726	{
727	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
728	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
729	}
730	else
731	{
732	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
733	return rcStrict;
734	}
735
736	/*
737	* Clear global interrupt flags to allow interrupts in the guest.
738	*/
739	pCtx->hwvirt.fGif = true;
740
741	/*
742	* Event injection.
743	*/
744	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
745	pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
746	if (pEventInject->n.u1Valid)
747	{
748	uint8_t const uVector = pEventInject->n.u8Vector;
749	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
750	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
751
752	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
753	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
754	{
755	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
756	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
757	}
758	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
759	{
760	if ( uVector == X86_XCPT_NMI
761	\|\| uVector > X86_XCPT_LAST)
762	{
763	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
764	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
765	}
766	if ( uVector == X86_XCPT_BR
767	&& CPUMIsGuestInLongModeEx(pCtx))
768	{
769	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
770	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
771	}
772	/** @todo any others? */
773	}
774
775	/*
776	* Invalidate the exit interrupt-information field here. This field is fully updated
777	* on #VMEXIT as events other than the one below can also cause intercepts during
778	* their injection (e.g. exceptions).
779	*/
780	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
781
782	/*
783	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
784	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
785	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
786	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
787	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
788	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
789	* injecting the event through IEM here.
790	*/
791	pVmcbCtrl->EventInject.n.u1Valid = 0;
792
793	/** @todo NRIP: Software interrupts can only be pushed properly if we support
794	* NRIP for the nested-guest to calculate the instruction length
795	* below. */
796	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
797	pCtx->cs.Sel, pCtx->rip, uVector, enmType, uErrorCode, pCtx->cr2, pCtx->cr3, pCtx->msrEFER));
798	#if 0
799	rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
800	#else
801	TRPMAssertTrap(pVCpu, uVector, enmType);
802	if (pEventInject->n.u1ErrorCodeValid)
803	TRPMSetErrorCode(pVCpu, uErrorCode);
804	if ( enmType == TRPM_TRAP
805	&& uVector == X86_XCPT_PF)
806	TRPMSetFaultAddress(pVCpu, pCtx->cr2);
807	#endif
808	}
809	else
810	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
811	pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
812
813	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
814
815	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
816	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
817	if (HMSvmIsVGifActive(pVM))
818	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
819	# endif
820
821	return rcStrict;
822	}
823
824	/* Shouldn't really happen as the caller should've validated the physical address already. */
825	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
826	return rc;
827	}
828
829
830	/**
831	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
832	* intercept is active.
833	*
834	* @returns Strict VBox status code.
835	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
836	* we're not executing a nested-guest.
837	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
838	* successfully.
839	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
840	* failed and a shutdown needs to be initiated for the geust.
841	*
842	* @returns VBox strict status code.
843	* @param pVCpu The cross context virtual CPU structure of the calling thread.
844	* @param u16Port The IO port being accessed.
845	* @param enmIoType The type of IO access.
846	* @param cbReg The IO operand size in bytes.
847	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
848	* @param iEffSeg The effective segment number.
849	* @param fRep Whether this is a repeating IO instruction (REP prefix).
850	* @param fStrIo Whether this is a string IO instruction.
851	*/
852	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
853	uint64_t uCr2)
854	{
855	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
856
857	/*
858	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
859	*
860	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
861	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
862	* even when they use a vector in the range 0 to 31.
863	* - ICEBP should not trigger #DB intercept, but its own intercept.
864	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
865	*/
866	/* Check NMI intercept */
867	if ( u8Vector == X86_XCPT_NMI
868	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
869	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
870	{
871	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
872	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
873	}
874
875	/* Check ICEBP intercept. */
876	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
877	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
878	{
879	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
880	IEM_SVM_UPDATE_NRIP(pVCpu);
881	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
882	}
883
884	/* Check CPU exception intercepts. */
885	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
886	&& IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
887	{
888	Assert(u8Vector <= X86_XCPT_LAST);
889	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
890	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
891	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
892	&& u8Vector == X86_XCPT_PF
893	&& !(uErr & X86_TRAP_PF_ID))
894	{
895	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
896	#ifdef IEM_WITH_CODE_TLB
897	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
898	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
899	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
900	if ( pbInstrBuf
901	&& cbInstrBuf > 0)
902	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
903	#else
904	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
905	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
906	if (cbOpcode > 0)
907	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
908	#endif
909	}
910	if (u8Vector == X86_XCPT_BR)
911	IEM_SVM_UPDATE_NRIP(pVCpu);
912	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
913	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
914	u8Vector, uExitInfo1, uExitInfo2));
915	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
916	}
917
918	/* Check software interrupt (INTn) intercepts. */
919	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
920	\| IEM_XCPT_FLAGS_BP_INSTR
921	\| IEM_XCPT_FLAGS_ICEBP_INSTR
922	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
923	&& IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
924	{
925	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
926	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
927	IEM_SVM_UPDATE_NRIP(pVCpu);
928	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
929	}
930
931	return VINF_HM_INTERCEPT_NOT_ACTIVE;
932	}
933
934
935	/**
936	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
937	* corresponding intercept is active.
938	*
939	* @returns Strict VBox status code.
940	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
941	* we're not executing a nested-guest.
942	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
943	* successfully.
944	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
945	* failed and a shutdown needs to be initiated for the geust.
946	*
947	* @returns VBox strict status code.
948	* @param pVCpu The cross context virtual CPU structure of the calling thread.
949	* @param u16Port The IO port being accessed.
950	* @param enmIoType The type of IO access.
951	* @param cbReg The IO operand size in bytes.
952	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
953	* @param iEffSeg The effective segment number.
954	* @param fRep Whether this is a repeating IO instruction (REP prefix).
955	* @param fStrIo Whether this is a string IO instruction.
956	* @param cbInstr The length of the IO instruction in bytes.
957	*/
958	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
959	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
960	{
961	Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
962	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
963	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
964
965	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
966
967	SVMIOIOEXITINFO IoExitInfo;
968	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
969	void *pvIoBitmap = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
970	bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
971	&IoExitInfo);
972	if (fIntercept)
973	{
974	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
975	IEM_SVM_UPDATE_NRIP(pVCpu);
976	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
977	}
978
979	/** @todo remove later (for debugging as VirtualBox always traps all IO
980	* intercepts). */
981	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
982	return VINF_HM_INTERCEPT_NOT_ACTIVE;
983	}
984
985
986	/**
987	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
988	* corresponding intercept is active.
989	*
990	* @returns Strict VBox status code.
991	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
992	* specify interception of the accessed MSR @a idMsr.
993	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
994	* successfully.
995	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
996	* failed and a shutdown needs to be initiated for the geust.
997	*
998	* @param pVCpu The cross context virtual CPU structure.
999	* @param pCtx The guest-CPU context.
1000	* @param idMsr The MSR being accessed in the nested-guest.
1001	* @param fWrite Whether this is an MSR write access, @c false implies an
1002	* MSR read.
1003	* @param cbInstr The length of the MSR read/write instruction in bytes.
1004	*/
1005	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1006	{
1007	/*
1008	* Check if any MSRs are being intercepted.
1009	*/
1010	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1011	Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1012
1013	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1014
1015	/*
1016	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1017	*/
1018	uint16_t offMsrpm;
1019	uint8_t uMsrpmBit;
1020	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1021	if (RT_SUCCESS(rc))
1022	{
1023	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1024	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1025	if (fWrite)
1026	++uMsrpmBit;
1027
1028	/*
1029	* Check if the bit is set, if so, trigger a #VMEXIT.
1030	*/
1031	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1032	pbMsrpm += offMsrpm;
1033	if (*pbMsrpm & RT_BIT(uMsrpmBit))
1034	{
1035	IEM_SVM_UPDATE_NRIP(pVCpu);
1036	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1037	}
1038	}
1039	else
1040	{
1041	/*
1042	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1043	*/
1044	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1045	return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1046	}
1047	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1048	}
1049
1050
1051
1052	/**
1053	* Implements 'VMRUN'.
1054	*/
1055	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1056	{
1057	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1058	RT_NOREF2(pVCpu, cbInstr);
1059	return VINF_EM_RAW_EMULATE_INSTR;
1060	#else
1061	LogFlow(("iemCImpl_vmrun\n"));
1062	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1063	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1064
1065	/** @todo Check effective address size using address size prefix. */
1066	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1067	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1068	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1069	{
1070	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1071	return iemRaiseGeneralProtectionFault0(pVCpu);
1072	}
1073
1074	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1075	{
1076	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1077	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1078	}
1079
1080	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1081	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1082	{
1083	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1084	rcStrict = VINF_EM_TRIPLE_FAULT;
1085	}
1086	return rcStrict;
1087	#endif
1088	}
1089
1090
1091	/**
1092	* Implements 'VMMCALL'.
1093	*/
1094	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1095	{
1096	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1097	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1098	{
1099	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1100	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1101	}
1102
1103	bool fUpdatedRipAndRF;
1104	VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1105	if (RT_SUCCESS(rcStrict))
1106	{
1107	if (!fUpdatedRipAndRF)
1108	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1109	return rcStrict;
1110	}
1111
1112	return iemRaiseUndefinedOpcode(pVCpu);
1113	}
1114
1115
1116	/**
1117	* Implements 'VMLOAD'.
1118	*/
1119	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1120	{
1121	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1122	RT_NOREF2(pVCpu, cbInstr);
1123	return VINF_EM_RAW_EMULATE_INSTR;
1124	#else
1125	LogFlow(("iemCImpl_vmload\n"));
1126	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1127	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1128
1129	/** @todo Check effective address size using address size prefix. */
1130	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1131	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1132	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1133	{
1134	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1135	return iemRaiseGeneralProtectionFault0(pVCpu);
1136	}
1137
1138	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1139	{
1140	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1141	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1142	}
1143
1144	SVMVMCBSTATESAVE VmcbNstGst;
1145	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1146	sizeof(SVMVMCBSTATESAVE));
1147	if (rcStrict == VINF_SUCCESS)
1148	{
1149	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1150	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1151	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1152	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1153	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1154
1155	pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1156	pCtx->msrSTAR = VmcbNstGst.u64STAR;
1157	pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1158	pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1159	pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1160
1161	pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1162	pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1163	pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1164
1165	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1166	}
1167	return rcStrict;
1168	#endif
1169	}
1170
1171
1172	/**
1173	* Implements 'VMSAVE'.
1174	*/
1175	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1176	{
1177	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1178	RT_NOREF2(pVCpu, cbInstr);
1179	return VINF_EM_RAW_EMULATE_INSTR;
1180	#else
1181	LogFlow(("iemCImpl_vmsave\n"));
1182	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1183	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1184
1185	/** @todo Check effective address size using address size prefix. */
1186	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1187	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1188	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1189	{
1190	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1191	return iemRaiseGeneralProtectionFault0(pVCpu);
1192	}
1193
1194	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1195	{
1196	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1197	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1198	}
1199
1200	SVMVMCBSTATESAVE VmcbNstGst;
1201	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1202	sizeof(SVMVMCBSTATESAVE));
1203	if (rcStrict == VINF_SUCCESS)
1204	{
1205	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1206	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1207	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1208	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1209	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1210
1211	VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1212	VmcbNstGst.u64STAR = pCtx->msrSTAR;
1213	VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1214	VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1215	VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1216
1217	VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1218	VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1219	VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1220
1221	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1222	sizeof(SVMVMCBSTATESAVE));
1223	if (rcStrict == VINF_SUCCESS)
1224	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1225	}
1226	return rcStrict;
1227	#endif
1228	}
1229
1230
1231	/**
1232	* Implements 'CLGI'.
1233	*/
1234	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1235	{
1236	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1237	RT_NOREF2(pVCpu, cbInstr);
1238	return VINF_EM_RAW_EMULATE_INSTR;
1239	#else
1240	LogFlow(("iemCImpl_clgi\n"));
1241	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1242	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1243	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1244	{
1245	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1246	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1247	}
1248
1249	pCtx->hwvirt.fGif = false;
1250	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1251
1252	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1253	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1254	# else
1255	return VINF_SUCCESS;
1256	# endif
1257	#endif
1258	}
1259
1260
1261	/**
1262	* Implements 'STGI'.
1263	*/
1264	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1265	{
1266	#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1267	RT_NOREF2(pVCpu, cbInstr);
1268	return VINF_EM_RAW_EMULATE_INSTR;
1269	#else
1270	LogFlow(("iemCImpl_stgi\n"));
1271	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1272	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1273	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1274	{
1275	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1276	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1277	}
1278
1279	pCtx->hwvirt.fGif = true;
1280	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1281
1282	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1283	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1284	# else
1285	return VINF_SUCCESS;
1286	# endif
1287	#endif
1288	}
1289
1290
1291	/**
1292	* Implements 'INVLPGA'.
1293	*/
1294	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1295	{
1296	PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1297	/** @todo Check effective address size using address size prefix. */
1298	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1299	/** @todo PGM needs virtual ASID support. */
1300	#if 0
1301	uint32_t const uAsid = pCtx->ecx;
1302	#endif
1303
1304	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1305	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1306	{
1307	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1308	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1309	}
1310
1311	PGMInvalidatePage(pVCpu, GCPtrPage);
1312	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1313	return VINF_SUCCESS;
1314	}
1315
1316
1317	/**
1318	* Implements 'SKINIT'.
1319	*/
1320	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1321	{
1322	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1323
1324	uint32_t uIgnore;
1325	uint32_t fFeaturesECX;
1326	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1327	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1328	return iemRaiseUndefinedOpcode(pVCpu);
1329
1330	if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1331	{
1332	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1333	IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1334	}
1335
1336	RT_NOREF(cbInstr);
1337	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1338	}
1339

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 72064

Download in other formats: