VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 72262

Last change on this file since 72262 was 72084, checked in by vboxsync, 7 years ago

VMM/IEM: Nested hw.virt: Assertion on VM-exit path that's not supposed to really fail rather than logging.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 55.3 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp.h 72084 2018-05-03 07:27:29Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/**
20 * Converts an IEM exception event type to an SVM event type.
21 *
22 * @returns The SVM event type.
23 * @retval UINT8_MAX if the specified type of event isn't among the set
24 * of recognized IEM event types.
25 *
26 * @param uVector The vector of the event.
27 * @param fIemXcptFlags The IEM exception / interrupt flags.
28 */
29IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
30{
31 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
32 {
33 if (uVector != X86_XCPT_NMI)
34 return SVM_EVENT_EXCEPTION;
35 return SVM_EVENT_NMI;
36 }
37
38 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
39 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
40 return SVM_EVENT_EXCEPTION;
41
42 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
43 return SVM_EVENT_EXTERNAL_IRQ;
44
45 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
46 return SVM_EVENT_SOFTWARE_INT;
47
48 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
49 return UINT8_MAX;
50}
51
52
53/**
54 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
55 *
56 * @returns Strict VBox status code.
57 * @param pVCpu The cross context virtual CPU structure.
58 * @param pCtx The guest-CPU context.
59 */
60DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu, PCPUMCTX pCtx)
61{
62 /*
63 * Inform PGM about paging mode changes.
64 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
65 * see comment in iemMemPageTranslateAndCheckAccess().
66 */
67 int rc = PGMChangeMode(pVCpu, pCtx->cr0 | X86_CR0_PE, pCtx->cr4, pCtx->msrEFER);
68#ifdef IN_RING3
69 Assert(rc != VINF_PGM_CHANGE_MODE);
70#endif
71 AssertRCReturn(rc, rc);
72
73 /* Inform CPUM (recompiler), can later be removed. */
74 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
75
76 /*
77 * Flush the TLB with new CR3. This is required in case the PGM mode change
78 * above doesn't actually change anything.
79 */
80 if (rc == VINF_SUCCESS)
81 {
82 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true);
83 AssertRCReturn(rc, rc);
84 }
85
86 /* Re-initialize IEM cache/state after the drastic mode switch. */
87 iemReInitExec(pVCpu);
88 return rc;
89}
90
91
92/**
93 * SVM \#VMEXIT handler.
94 *
95 * @returns Strict VBox status code.
96 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
97 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
98 * "host state" and a shutdown is required.
99 *
100 * @param pVCpu The cross context virtual CPU structure.
101 * @param pCtx The guest-CPU context.
102 * @param uExitCode The exit code.
103 * @param uExitInfo1 The exit info. 1 field.
104 * @param uExitInfo2 The exit info. 2 field.
105 */
106IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
107{
108 VBOXSTRICTRC rcStrict;
109 if ( CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
110 || uExitCode == SVM_EXIT_INVALID)
111 {
112 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pCtx->cs.Sel,
113 pCtx->rip, uExitCode, uExitInfo1, uExitInfo2));
114
115 /*
116 * Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
117 */
118 pCtx->hwvirt.fGif = false;
119
120 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
121 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
122 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
123 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
124
125 /*
126 * Map the nested-guest VMCB from its location in guest memory.
127 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
128 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
129 */
130 PSVMVMCB pVmcbMem;
131 PGMPAGEMAPLOCK PgLockMem;
132 PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
133 rcStrict = iemMemPageMap(pVCpu, pCtx->hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem, &PgLockMem);
134 if (rcStrict == VINF_SUCCESS)
135 {
136 /*
137 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
138 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
139 * writing the VMCB back to guest memory.
140 */
141 HMSvmNstGstVmExitNotify(pVCpu, pCtx);
142
143 /*
144 * Save the nested-guest state into the VMCB state-save area.
145 */
146 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
147 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, ES, es);
148 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, CS, cs);
149 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, SS, ss);
150 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, pVmcbMemState, DS, ds);
151 pVmcbMemState->GDTR.u32Limit = pCtx->gdtr.cbGdt;
152 pVmcbMemState->GDTR.u64Base = pCtx->gdtr.pGdt;
153 pVmcbMemState->IDTR.u32Limit = pCtx->idtr.cbIdt;
154 pVmcbMemState->IDTR.u64Base = pCtx->idtr.pIdt;
155 pVmcbMemState->u64EFER = pCtx->msrEFER;
156 pVmcbMemState->u64CR4 = pCtx->cr4;
157 pVmcbMemState->u64CR3 = pCtx->cr3;
158 pVmcbMemState->u64CR2 = pCtx->cr2;
159 pVmcbMemState->u64CR0 = pCtx->cr0;
160 /** @todo Nested paging. */
161 pVmcbMemState->u64RFlags = pCtx->rflags.u64;
162 pVmcbMemState->u64RIP = pCtx->rip;
163 pVmcbMemState->u64RSP = pCtx->rsp;
164 pVmcbMemState->u64RAX = pCtx->rax;
165 pVmcbMemState->u64DR7 = pCtx->dr[7];
166 pVmcbMemState->u64DR6 = pCtx->dr[6];
167 pVmcbMemState->u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
168 Assert(CPUMGetGuestCPL(pVCpu) == pCtx->ss.Attr.n.u2Dpl);
169 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, pCtx))
170 pVmcbMemState->u64PAT = pCtx->msrPAT;
171
172 /*
173 * Save additional state and intercept information.
174 *
175 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
176 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
177 * SVM execution.
178 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
179 */
180 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
181 if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
182 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
183 else
184 {
185 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
186 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
187 }
188
189 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
190
191 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
192 && EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
193 {
194 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
195 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
196 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pCtx->rip));
197 }
198 else
199 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
200
201 /*
202 * Save nRIP, instruction length and byte fields.
203 */
204 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
205 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
206 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
207
208 /*
209 * Save exit information.
210 */
211 pVmcbMemCtrl->u64ExitCode = uExitCode;
212 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
213 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
214
215 /*
216 * Update the exit interrupt-information field if this #VMEXIT happened as a result
217 * of delivering an event through IEM.
218 *
219 * Don't update the exit interrupt-information field if the event wasn't being injected
220 * through IEM, as it would have been updated by real hardware if the nested-guest was
221 * executed using hardware-assisted SVM.
222 */
223 {
224 uint8_t uExitIntVector;
225 uint32_t uExitIntErr;
226 uint32_t fExitIntFlags;
227 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
228 NULL /* uExitIntCr2 */);
229 if (fRaisingEvent)
230 {
231 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
232 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
233 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
234 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
235 {
236 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
237 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
238 }
239 }
240 }
241
242 /*
243 * Save the exit interrupt-information field.
244 *
245 * We write the whole field including overwriting reserved bits as it was observed on an
246 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
247 */
248 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
249
250 /*
251 * Clear event injection.
252 */
253 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
254
255 iemMemPageUnmap(pVCpu, pCtx->hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
256 }
257
258 /*
259 * Prepare for guest's "host mode" by clearing internal processor state bits.
260 *
261 * We don't need to zero out the state-save area, just the controls should be
262 * sufficient because it has the critical bit of indicating whether we're inside
263 * the nested-guest or not.
264 */
265 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
266 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
267
268 /*
269 * Restore the subset of force-flags that were preserved.
270 */
271 if (pCtx->hwvirt.fLocalForcedActions)
272 {
273 VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
274 pCtx->hwvirt.fLocalForcedActions = 0;
275 }
276
277 if (rcStrict == VINF_SUCCESS)
278 {
279 /** @todo Nested paging. */
280 /** @todo ASID. */
281
282 /*
283 * Reload the guest's "host state".
284 */
285 CPUMSvmVmExitRestoreHostState(pVCpu, pCtx);
286
287 /*
288 * Update PGM, IEM and others of a world-switch.
289 */
290 rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
291 if (rcStrict == VINF_SUCCESS)
292 rcStrict = VINF_SVM_VMEXIT;
293 else if (RT_SUCCESS(rcStrict))
294 {
295 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
296 iemSetPassUpStatus(pVCpu, rcStrict);
297 rcStrict = VINF_SVM_VMEXIT;
298 }
299 else
300 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
301 }
302 else
303 {
304 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pCtx->hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
305 rcStrict = VERR_SVM_VMEXIT_FAILED;
306 }
307 }
308 else
309 {
310 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
311 rcStrict = VERR_SVM_IPE_3;
312 }
313
314# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
315 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
316 if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
317 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
318# endif
319 return rcStrict;
320}
321
322
323/**
324 * Performs the operations necessary that are part of the vmrun instruction
325 * execution in the guest.
326 *
327 * @returns Strict VBox status code (i.e. informational status codes too).
328 * @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
329 * code execution.
330 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
331 * (SVM_EXIT_INVALID most likely).
332 *
333 * @param pVCpu The cross context virtual CPU structure.
334 * @param pCtx Pointer to the guest-CPU context.
335 * @param cbInstr The length of the VMRUN instruction.
336 * @param GCPhysVmcb Guest physical address of the VMCB to run.
337 */
338IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
339{
340 LogFlow(("iemSvmVmrun\n"));
341
342 /*
343 * Cache the physical address of the VMCB for #VMEXIT exceptions.
344 */
345 pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
346
347 /*
348 * Save the host state.
349 */
350 CPUMSvmVmRunSaveHostState(pCtx, cbInstr);
351
352 /*
353 * Read the guest VMCB.
354 */
355 PVM pVM = pVCpu->CTX_SUFF(pVM);
356 int rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
357 if (RT_SUCCESS(rc))
358 {
359 /*
360 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
361 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
362 * but in our implementation we try to preserve as much as we possibly can.
363 *
364 * We could read the entire page here and only write back the relevant fields on
365 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
366 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
367 * currently reserved but may be recognized as features bits in future CPUs causing
368 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
369 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
370 */
371 PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
372 PSVMVMCBSTATESAVE pVmcbNstGst = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->guest;
373
374 RT_ZERO(pVmcbCtrl->u8Reserved0);
375 RT_ZERO(pVmcbCtrl->u8Reserved1);
376 RT_ZERO(pVmcbCtrl->u8Reserved2);
377 RT_ZERO(pVmcbNstGst->u8Reserved0);
378 RT_ZERO(pVmcbNstGst->u8Reserved1);
379 RT_ZERO(pVmcbNstGst->u8Reserved2);
380 RT_ZERO(pVmcbNstGst->u8Reserved3);
381 RT_ZERO(pVmcbNstGst->u8Reserved4);
382 RT_ZERO(pVmcbNstGst->u8Reserved5);
383 pVmcbCtrl->u32Reserved0 = 0;
384 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
385 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
386 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
387 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
388 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
389 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
390 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
391 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
392 pVmcbCtrl->EventInject.n.u19Reserved = 0;
393 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
394
395 /*
396 * Validate guest-state and controls.
397 */
398 /* VMRUN must always be intercepted. */
399 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_VMRUN))
400 {
401 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
402 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
403 }
404
405 /* Nested paging. */
406 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
407 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
408 {
409 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
410 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
411 }
412
413 /* AVIC. */
414 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
415 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
416 {
417 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
418 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
419 }
420
421 /* Last branch record (LBR) virtualization. */
422 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
423 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
424 {
425 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
426 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
427 }
428
429 /* Virtualized VMSAVE/VMLOAD. */
430 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
431 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
432 {
433 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
434 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
435 }
436
437 /* Virtual GIF. */
438 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
439 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
440 {
441 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
442 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
443 }
444
445 /* Guest ASID. */
446 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
447 {
448 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
449 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
450 }
451
452 /* Guest AVIC. */
453 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
454 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
455 {
456 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
457 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
458 }
459
460 /* Guest Secure Encrypted Virtualization. */
461 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
462 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
463 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
464 {
465 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
466 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
467 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
468 }
469
470 /* Flush by ASID. */
471 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
472 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
473 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
474 {
475 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
476 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
477 }
478
479 /* IO permission bitmap. */
480 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
481 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
482 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
483 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
484 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
485 {
486 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
487 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
488 }
489
490 /* MSR permission bitmap. */
491 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
492 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
493 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
494 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
495 {
496 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
497 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
498 }
499
500 /* CR0. */
501 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
502 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
503 {
504 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
505 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
506 }
507 if (pVmcbNstGst->u64CR0 >> 32)
508 {
509 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
510 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
511 }
512 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
513
514 /* DR6 and DR7. */
515 if ( pVmcbNstGst->u64DR6 >> 32
516 || pVmcbNstGst->u64DR7 >> 32)
517 {
518 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
519 pVmcbNstGst->u64DR6));
520 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
521 }
522
523 /*
524 * PAT (Page Attribute Table) MSR.
525 *
526 * The CPU only validates and loads it when nested-paging is enabled.
527 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
528 */
529 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
530 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
531 {
532 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
533 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
534 }
535
536 /*
537 * Copy the IO permission bitmap into the cache.
538 */
539 Assert(pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap));
540 rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
541 SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
542 if (RT_FAILURE(rc))
543 {
544 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
545 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
546 }
547
548 /*
549 * Copy the MSR permission bitmap into the cache.
550 */
551 Assert(pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap));
552 rc = PGMPhysSimpleReadGCPhys(pVM, pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
553 SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
554 if (RT_FAILURE(rc))
555 {
556 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
557 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
558 }
559
560 /*
561 * Copy segments from nested-guest VMCB state to the guest-CPU state.
562 *
563 * We do this here as we need to use the CS attributes and it's easier this way
564 * then using the VMCB format selectors. It doesn't really matter where we copy
565 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
566 */
567 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, ES, es);
568 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, CS, cs);
569 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, SS, ss);
570 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbNstGst, DS, ds);
571
572 /** @todo Segment attribute overrides by VMRUN. */
573
574 /*
575 * CPL adjustments and overrides.
576 *
577 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
578 * We shall thus adjust both CS.DPL and SS.DPL here.
579 */
580 pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
581 if (CPUMIsGuestInV86ModeEx(pCtx))
582 pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
583 if (CPUMIsGuestInRealModeEx(pCtx))
584 pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
585 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
586
587 /*
588 * Continue validating guest-state and controls.
589 *
590 * We pass CR0 as 0 to CPUMQueryValidatedGuestEfer below to skip the illegal
591 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
592 * old and new EFER value to not have any guest EFER bits influence the new
593 * nested-guest EFER.
594 */
595 uint64_t uValidEfer;
596 rc = CPUMQueryValidatedGuestEfer(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
597 if (RT_FAILURE(rc))
598 {
599 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
600 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
601 }
602
603 /* Validate paging and CPU mode bits. */
604 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
605 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
606 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
607 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
608 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
609 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
610 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
611 bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
612 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
613 if (fLongModeWithPaging)
614 uValidEfer |= MSR_K6_EFER_LMA;
615 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
616 if ( !fSvm
617 || (!fLongModeSupported && fLongModeActiveOrEnabled)
618 || (fLongModeWithPaging && !fPae)
619 || (fLongModeWithPaging && !fProtMode)
620 || ( fLongModeEnabled
621 && fPaging
622 && fPae
623 && fLongModeConformCS))
624 {
625 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
626 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
627 }
628
629 /*
630 * Preserve the required force-flags.
631 *
632 * We only preserve the force-flags that would affect the execution of the
633 * nested-guest (or the guest).
634 *
635 * - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
636 * instruction which is this VMRUN instruction itself.
637 *
638 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
639 * execution of a subsequent IRET instruction in the guest.
640 *
641 * - The remaining FFs (e.g. timers) can stay in place so that we will be
642 * able to generate interrupts that should cause #VMEXITs for the
643 * nested-guest.
644 */
645 pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
646 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
647
648 /*
649 * Pause filter.
650 */
651 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
652 {
653 pCtx->hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
654 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
655 pCtx->hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
656 }
657
658 /*
659 * Interrupt shadow.
660 */
661 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
662 {
663 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
664 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
665 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
666 }
667
668 /*
669 * TLB flush control.
670 * Currently disabled since it's redundant as we unconditionally flush the TLB
671 * in iemSvmWorldSwitch() below.
672 */
673#if 0
674 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
675 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
676 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
677 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
678 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
679#endif
680
681 /*
682 * Copy the remaining guest state from the VMCB to the guest-CPU context.
683 */
684 pCtx->gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
685 pCtx->gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
686 pCtx->idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
687 pCtx->idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
688 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
689 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
690 pCtx->cr3 = pVmcbNstGst->u64CR3;
691 pCtx->cr2 = pVmcbNstGst->u64CR2;
692 pCtx->dr[6] = pVmcbNstGst->u64DR6;
693 pCtx->dr[7] = pVmcbNstGst->u64DR7;
694 pCtx->rflags.u64 = pVmcbNstGst->u64RFlags;
695 pCtx->rax = pVmcbNstGst->u64RAX;
696 pCtx->rsp = pVmcbNstGst->u64RSP;
697 pCtx->rip = pVmcbNstGst->u64RIP;
698 CPUMSetGuestMsrEferNoCheck(pVCpu, pCtx->msrEFER, uValidEfer);
699 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
700 pCtx->msrPAT = pVmcbNstGst->u64PAT;
701
702 /* Mask DR6, DR7 bits mandatory set/clear bits. */
703 pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
704 pCtx->dr[6] |= X86_DR6_RA1_MASK;
705 pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
706 pCtx->dr[7] |= X86_DR7_RA1_MASK;
707
708 /*
709 * Check for pending virtual interrupts.
710 */
711 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
712 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
713 else
714 Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
715
716 /*
717 * Update PGM, IEM and others of a world-switch.
718 */
719 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, pCtx);
720 if (rcStrict == VINF_SUCCESS)
721 { /* likely */ }
722 else if (RT_SUCCESS(rcStrict))
723 {
724 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
725 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
726 }
727 else
728 {
729 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
730 return rcStrict;
731 }
732
733 /*
734 * Clear global interrupt flags to allow interrupts in the guest.
735 */
736 pCtx->hwvirt.fGif = true;
737
738 /*
739 * Event injection.
740 */
741 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
742 pCtx->hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
743 if (pEventInject->n.u1Valid)
744 {
745 uint8_t const uVector = pEventInject->n.u8Vector;
746 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
747 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
748
749 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
750 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
751 {
752 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
753 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
754 }
755 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
756 {
757 if ( uVector == X86_XCPT_NMI
758 || uVector > X86_XCPT_LAST)
759 {
760 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
761 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
762 }
763 if ( uVector == X86_XCPT_BR
764 && CPUMIsGuestInLongModeEx(pCtx))
765 {
766 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
767 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
768 }
769 /** @todo any others? */
770 }
771
772 /*
773 * Invalidate the exit interrupt-information field here. This field is fully updated
774 * on #VMEXIT as events other than the one below can also cause intercepts during
775 * their injection (e.g. exceptions).
776 */
777 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
778
779 /*
780 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
781 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
782 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
783 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
784 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
785 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
786 * injecting the event through IEM here.
787 */
788 pVmcbCtrl->EventInject.n.u1Valid = 0;
789
790 /** @todo NRIP: Software interrupts can only be pushed properly if we support
791 * NRIP for the nested-guest to calculate the instruction length
792 * below. */
793 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
794 pCtx->cs.Sel, pCtx->rip, uVector, enmType, uErrorCode, pCtx->cr2, pCtx->cr3, pCtx->msrEFER));
795#if 0
796 rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
797#else
798 TRPMAssertTrap(pVCpu, uVector, enmType);
799 if (pEventInject->n.u1ErrorCodeValid)
800 TRPMSetErrorCode(pVCpu, uErrorCode);
801 if ( enmType == TRPM_TRAP
802 && uVector == X86_XCPT_PF)
803 TRPMSetFaultAddress(pVCpu, pCtx->cr2);
804#endif
805 }
806 else
807 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
808 pCtx->cs.Sel, pCtx->rip, pCtx->cr0, pCtx->cr3, pCtx->cr4, pCtx->msrEFER, pCtx->rflags.u64));
809
810 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
811
812# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
813 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
814 if (HMSvmIsVGifActive(pVM))
815 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
816# endif
817
818 return rcStrict;
819 }
820
821 /* Shouldn't really happen as the caller should've validated the physical address already. */
822 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
823 return rc;
824}
825
826
827/**
828 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
829 * intercept is active.
830 *
831 * @returns Strict VBox status code.
832 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
833 * we're not executing a nested-guest.
834 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
835 * successfully.
836 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
837 * failed and a shutdown needs to be initiated for the geust.
838 *
839 * @returns VBox strict status code.
840 * @param pVCpu The cross context virtual CPU structure of the calling thread.
841 * @param u16Port The IO port being accessed.
842 * @param enmIoType The type of IO access.
843 * @param cbReg The IO operand size in bytes.
844 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
845 * @param iEffSeg The effective segment number.
846 * @param fRep Whether this is a repeating IO instruction (REP prefix).
847 * @param fStrIo Whether this is a string IO instruction.
848 */
849IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr,
850 uint64_t uCr2)
851{
852 Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
853
854 /*
855 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
856 *
857 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
858 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
859 * even when they use a vector in the range 0 to 31.
860 * - ICEBP should not trigger #DB intercept, but its own intercept.
861 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
862 */
863 /* Check NMI intercept */
864 if ( u8Vector == X86_XCPT_NMI
865 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
866 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
867 {
868 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
869 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
870 }
871
872 /* Check ICEBP intercept. */
873 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
874 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
875 {
876 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
877 IEM_SVM_UPDATE_NRIP(pVCpu);
878 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
879 }
880
881 /* Check CPU exception intercepts. */
882 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
883 && IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
884 {
885 Assert(u8Vector <= X86_XCPT_LAST);
886 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
887 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
888 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
889 && u8Vector == X86_XCPT_PF
890 && !(uErr & X86_TRAP_PF_ID))
891 {
892 PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
893#ifdef IEM_WITH_CODE_TLB
894 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
895 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
896 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
897 if ( pbInstrBuf
898 && cbInstrBuf > 0)
899 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
900#else
901 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
902 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
903 if (cbOpcode > 0)
904 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
905#endif
906 }
907 if (u8Vector == X86_XCPT_BR)
908 IEM_SVM_UPDATE_NRIP(pVCpu);
909 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
910 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
911 u8Vector, uExitInfo1, uExitInfo2));
912 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
913 }
914
915 /* Check software interrupt (INTn) intercepts. */
916 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
917 | IEM_XCPT_FLAGS_BP_INSTR
918 | IEM_XCPT_FLAGS_ICEBP_INSTR
919 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
920 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
921 {
922 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
923 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
924 IEM_SVM_UPDATE_NRIP(pVCpu);
925 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
926 }
927
928 return VINF_HM_INTERCEPT_NOT_ACTIVE;
929}
930
931
932/**
933 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
934 * corresponding intercept is active.
935 *
936 * @returns Strict VBox status code.
937 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
938 * we're not executing a nested-guest.
939 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
940 * successfully.
941 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
942 * failed and a shutdown needs to be initiated for the geust.
943 *
944 * @returns VBox strict status code.
945 * @param pVCpu The cross context virtual CPU structure of the calling thread.
946 * @param u16Port The IO port being accessed.
947 * @param enmIoType The type of IO access.
948 * @param cbReg The IO operand size in bytes.
949 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
950 * @param iEffSeg The effective segment number.
951 * @param fRep Whether this is a repeating IO instruction (REP prefix).
952 * @param fStrIo Whether this is a string IO instruction.
953 * @param cbInstr The length of the IO instruction in bytes.
954 */
955IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
956 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
957{
958 Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
959 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
960 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
961
962 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
963
964 SVMIOIOEXITINFO IoExitInfo;
965 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
966 void *pvIoBitmap = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
967 bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
968 &IoExitInfo);
969 if (fIntercept)
970 {
971 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
972 IEM_SVM_UPDATE_NRIP(pVCpu);
973 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_IOIO, IoExitInfo.u, pCtx->rip + cbInstr);
974 }
975
976 /** @todo remove later (for debugging as VirtualBox always traps all IO
977 * intercepts). */
978 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
979 return VINF_HM_INTERCEPT_NOT_ACTIVE;
980}
981
982
983/**
984 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
985 * corresponding intercept is active.
986 *
987 * @returns Strict VBox status code.
988 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
989 * specify interception of the accessed MSR @a idMsr.
990 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
991 * successfully.
992 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
993 * failed and a shutdown needs to be initiated for the geust.
994 *
995 * @param pVCpu The cross context virtual CPU structure.
996 * @param pCtx The guest-CPU context.
997 * @param idMsr The MSR being accessed in the nested-guest.
998 * @param fWrite Whether this is an MSR write access, @c false implies an
999 * MSR read.
1000 * @param cbInstr The length of the MSR read/write instruction in bytes.
1001 */
1002IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
1003{
1004 /*
1005 * Check if any MSRs are being intercepted.
1006 */
1007 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_MSR_PROT));
1008 Assert(CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1009
1010 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1011
1012 /*
1013 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1014 */
1015 uint16_t offMsrpm;
1016 uint8_t uMsrpmBit;
1017 int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1018 if (RT_SUCCESS(rc))
1019 {
1020 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1021 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1022 if (fWrite)
1023 ++uMsrpmBit;
1024
1025 /*
1026 * Check if the bit is set, if so, trigger a #VMEXIT.
1027 */
1028 uint8_t *pbMsrpm = (uint8_t *)pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1029 pbMsrpm += offMsrpm;
1030 if (*pbMsrpm & RT_BIT(uMsrpmBit))
1031 {
1032 IEM_SVM_UPDATE_NRIP(pVCpu);
1033 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1034 }
1035 }
1036 else
1037 {
1038 /*
1039 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1040 */
1041 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1042 return iemSvmVmexit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1043 }
1044 return VINF_HM_INTERCEPT_NOT_ACTIVE;
1045}
1046
1047
1048
1049/**
1050 * Implements 'VMRUN'.
1051 */
1052IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1053{
1054#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1055 RT_NOREF2(pVCpu, cbInstr);
1056 return VINF_EM_RAW_EMULATE_INSTR;
1057#else
1058 LogFlow(("iemCImpl_vmrun\n"));
1059 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1060 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1061
1062 /** @todo Check effective address size using address size prefix. */
1063 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1064 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1065 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1066 {
1067 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1068 return iemRaiseGeneralProtectionFault0(pVCpu);
1069 }
1070
1071 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1072 {
1073 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1074 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1075 }
1076
1077 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, pCtx, cbInstr, GCPhysVmcb);
1078 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1079 {
1080 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(pCtx));
1081 rcStrict = VINF_EM_TRIPLE_FAULT;
1082 }
1083 return rcStrict;
1084#endif
1085}
1086
1087
1088/**
1089 * Implements 'VMMCALL'.
1090 */
1091IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1092{
1093 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1094 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1095 {
1096 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1097 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1098 }
1099
1100 bool fUpdatedRipAndRF;
1101 VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
1102 if (RT_SUCCESS(rcStrict))
1103 {
1104 if (!fUpdatedRipAndRF)
1105 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1106 return rcStrict;
1107 }
1108
1109 return iemRaiseUndefinedOpcode(pVCpu);
1110}
1111
1112
1113/**
1114 * Implements 'VMLOAD'.
1115 */
1116IEM_CIMPL_DEF_0(iemCImpl_vmload)
1117{
1118#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1119 RT_NOREF2(pVCpu, cbInstr);
1120 return VINF_EM_RAW_EMULATE_INSTR;
1121#else
1122 LogFlow(("iemCImpl_vmload\n"));
1123 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1124 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1125
1126 /** @todo Check effective address size using address size prefix. */
1127 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1128 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1129 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1130 {
1131 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1132 return iemRaiseGeneralProtectionFault0(pVCpu);
1133 }
1134
1135 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1136 {
1137 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1138 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1139 }
1140
1141 SVMVMCBSTATESAVE VmcbNstGst;
1142 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1143 sizeof(SVMVMCBSTATESAVE));
1144 if (rcStrict == VINF_SUCCESS)
1145 {
1146 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1147 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, FS, fs);
1148 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, GS, gs);
1149 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, TR, tr);
1150 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1151
1152 pCtx->msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1153 pCtx->msrSTAR = VmcbNstGst.u64STAR;
1154 pCtx->msrLSTAR = VmcbNstGst.u64LSTAR;
1155 pCtx->msrCSTAR = VmcbNstGst.u64CSTAR;
1156 pCtx->msrSFMASK = VmcbNstGst.u64SFMASK;
1157
1158 pCtx->SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1159 pCtx->SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1160 pCtx->SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1161
1162 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1163 }
1164 return rcStrict;
1165#endif
1166}
1167
1168
1169/**
1170 * Implements 'VMSAVE'.
1171 */
1172IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1173{
1174#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1175 RT_NOREF2(pVCpu, cbInstr);
1176 return VINF_EM_RAW_EMULATE_INSTR;
1177#else
1178 LogFlow(("iemCImpl_vmsave\n"));
1179 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1180 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1181
1182 /** @todo Check effective address size using address size prefix. */
1183 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1184 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1185 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1186 {
1187 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1188 return iemRaiseGeneralProtectionFault0(pVCpu);
1189 }
1190
1191 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1192 {
1193 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1194 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1195 }
1196
1197 SVMVMCBSTATESAVE VmcbNstGst;
1198 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest),
1199 sizeof(SVMVMCBSTATESAVE));
1200 if (rcStrict == VINF_SUCCESS)
1201 {
1202 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1203 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, FS, fs);
1204 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, GS, gs);
1205 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, TR, tr);
1206 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, LDTR, ldtr);
1207
1208 VmcbNstGst.u64KernelGSBase = pCtx->msrKERNELGSBASE;
1209 VmcbNstGst.u64STAR = pCtx->msrSTAR;
1210 VmcbNstGst.u64LSTAR = pCtx->msrLSTAR;
1211 VmcbNstGst.u64CSTAR = pCtx->msrCSTAR;
1212 VmcbNstGst.u64SFMASK = pCtx->msrSFMASK;
1213
1214 VmcbNstGst.u64SysEnterCS = pCtx->SysEnter.cs;
1215 VmcbNstGst.u64SysEnterESP = pCtx->SysEnter.esp;
1216 VmcbNstGst.u64SysEnterEIP = pCtx->SysEnter.eip;
1217
1218 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1219 sizeof(SVMVMCBSTATESAVE));
1220 if (rcStrict == VINF_SUCCESS)
1221 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1222 }
1223 return rcStrict;
1224#endif
1225}
1226
1227
1228/**
1229 * Implements 'CLGI'.
1230 */
1231IEM_CIMPL_DEF_0(iemCImpl_clgi)
1232{
1233#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1234 RT_NOREF2(pVCpu, cbInstr);
1235 return VINF_EM_RAW_EMULATE_INSTR;
1236#else
1237 LogFlow(("iemCImpl_clgi\n"));
1238 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1239 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1240 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1241 {
1242 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1243 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1244 }
1245
1246 pCtx->hwvirt.fGif = false;
1247 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1248
1249# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1250 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1251# else
1252 return VINF_SUCCESS;
1253# endif
1254#endif
1255}
1256
1257
1258/**
1259 * Implements 'STGI'.
1260 */
1261IEM_CIMPL_DEF_0(iemCImpl_stgi)
1262{
1263#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1264 RT_NOREF2(pVCpu, cbInstr);
1265 return VINF_EM_RAW_EMULATE_INSTR;
1266#else
1267 LogFlow(("iemCImpl_stgi\n"));
1268 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1269 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1270 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1271 {
1272 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1273 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1274 }
1275
1276 pCtx->hwvirt.fGif = true;
1277 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1278
1279# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1280 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1281# else
1282 return VINF_SUCCESS;
1283# endif
1284#endif
1285}
1286
1287
1288/**
1289 * Implements 'INVLPGA'.
1290 */
1291IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1292{
1293 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1294 /** @todo Check effective address size using address size prefix. */
1295 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
1296 /** @todo PGM needs virtual ASID support. */
1297#if 0
1298 uint32_t const uAsid = pCtx->ecx;
1299#endif
1300
1301 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1302 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1303 {
1304 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1305 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1306 }
1307
1308 PGMInvalidatePage(pVCpu, GCPtrPage);
1309 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1310 return VINF_SUCCESS;
1311}
1312
1313
1314/**
1315 * Implements 'SKINIT'.
1316 */
1317IEM_CIMPL_DEF_0(iemCImpl_skinit)
1318{
1319 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1320
1321 uint32_t uIgnore;
1322 uint32_t fFeaturesECX;
1323 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1324 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1325 return iemRaiseUndefinedOpcode(pVCpu);
1326
1327 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1328 {
1329 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1330 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1331 }
1332
1333 RT_NOREF(cbInstr);
1334 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1335}
1336
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette