VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 74157

Last change on this file since 74157 was 74102, checked in by vboxsync, 6 years ago

VMM/CPUM: Naming nit.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 61.0 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp.h 74102 2018-09-06 04:51:44Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
20/** Check and handles SVM nested-guest instruction intercept and updates
21 * NRIP if needed.
22 */
23# define IEMCIMPL_HLP_SVM_INSTR_INTERCEPT_AND_NRIP(a_pVCpu, a_Intercept, a_uExitCode, a_uExitInfo1, a_uExitInfo2) \
24 do \
25 { \
26 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(a_pVCpu, a_Intercept)) \
27 { \
28 IEM_SVM_UPDATE_NRIP(a_pVCpu); \
29 IEM_RETURN_SVM_VMEXIT(a_pVCpu, a_uExitCode, a_uExitInfo1, a_uExitInfo2); \
30 } \
31 } while (0)
32
33/** Checks and handles SVM nested-guest CR0 read intercept. */
34# define IEMCIMPL_HLP_SVM_READ_CR_INTERCEPT(a_pVCpu, a_uCr, a_uExitInfo1, a_uExitInfo2) \
35 do \
36 { \
37 if (!IEM_IS_SVM_READ_CR_INTERCEPT_SET(a_pVCpu, a_uCr)) \
38 { /* probably likely */ } \
39 else \
40 { \
41 IEM_SVM_UPDATE_NRIP(a_pVCpu); \
42 IEM_RETURN_SVM_VMEXIT(a_pVCpu, SVM_EXIT_READ_CR0 + (a_uCr), a_uExitInfo1, a_uExitInfo2); \
43 } \
44 } while (0)
45
46#else /* !VBOX_WITH_NESTED_HWVIRT_SVM */
47# define IEMCIMPL_HLP_SVM_INSTR_INTERCEPT_AND_NRIP(a_pVCpu, a_Intercept, a_uExitCode, a_uExitInfo1, a_uExitInfo2) do { } while (0)
48# define IEMCIMPL_HLP_SVM_READ_CR_INTERCEPT(a_pVCpu, a_uCr, a_uExitInfo1, a_uExitInfo2) do { } while (0)
49#endif /* !VBOX_WITH_NESTED_HWVIRT_SVM */
50
51
52#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
53
54/**
55 * Converts an IEM exception event type to an SVM event type.
56 *
57 * @returns The SVM event type.
58 * @retval UINT8_MAX if the specified type of event isn't among the set
59 * of recognized IEM event types.
60 *
61 * @param uVector The vector of the event.
62 * @param fIemXcptFlags The IEM exception / interrupt flags.
63 */
64IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
65{
66 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
67 {
68 if (uVector != X86_XCPT_NMI)
69 return SVM_EVENT_EXCEPTION;
70 return SVM_EVENT_NMI;
71 }
72
73 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
74 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
75 return SVM_EVENT_EXCEPTION;
76
77 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
78 return SVM_EVENT_EXTERNAL_IRQ;
79
80 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
81 return SVM_EVENT_SOFTWARE_INT;
82
83 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
84 return UINT8_MAX;
85}
86
87
88/**
89 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
90 *
91 * @returns Strict VBox status code.
92 * @param pVCpu The cross context virtual CPU structure.
93 */
94DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu)
95{
96 /*
97 * Inform PGM about paging mode changes.
98 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
99 * see comment in iemMemPageTranslateAndCheckAccess().
100 */
101 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
102# ifdef IN_RING3
103 Assert(rc != VINF_PGM_CHANGE_MODE);
104# endif
105 AssertRCReturn(rc, rc);
106
107 /* Inform CPUM (recompiler), can later be removed. */
108 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
109
110 /*
111 * Flush the TLB with new CR3. This is required in case the PGM mode change
112 * above doesn't actually change anything.
113 */
114 if (rc == VINF_SUCCESS)
115 {
116 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
117 AssertRCReturn(rc, rc);
118 }
119
120 /* Re-initialize IEM cache/state after the drastic mode switch. */
121 iemReInitExec(pVCpu);
122 return rc;
123}
124
125
126/**
127 * SVM \#VMEXIT handler.
128 *
129 * @returns Strict VBox status code.
130 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
131 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
132 * "host state" and a shutdown is required.
133 *
134 * @param pVCpu The cross context virtual CPU structure.
135 * @param uExitCode The exit code.
136 * @param uExitInfo1 The exit info. 1 field.
137 * @param uExitInfo2 The exit info. 2 field.
138 */
139IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
140{
141 VBOXSTRICTRC rcStrict;
142 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
143 || uExitCode == SVM_EXIT_INVALID)
144 {
145 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
146 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
147
148 /*
149 * Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
150 */
151 pVCpu->cpum.GstCtx.hwvirt.fGif = false;
152
153 /*
154 * Map the nested-guest VMCB from its location in guest memory.
155 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
156 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
157 */
158 PSVMVMCB pVmcbMem;
159 PGMPAGEMAPLOCK PgLockMem;
160 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
161 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem, &PgLockMem);
162 if (rcStrict == VINF_SUCCESS)
163 {
164 /*
165 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
166 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
167 * writing the VMCB back to guest memory.
168 */
169 HMSvmNstGstVmExitNotify(pVCpu, IEM_GET_CTX(pVCpu));
170
171 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
172 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
173 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
174 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
175
176 /*
177 * Save the nested-guest state into the VMCB state-save area.
178 */
179 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
180 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
181 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
182 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
183 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
184 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
185 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
186 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
187 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
188 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
189 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
190 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
191 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
192 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
193 /** @todo Nested paging. */
194 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
195 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
196 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
197 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
198 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
199 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
200 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
201 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
202 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
203 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
204
205 /*
206 * Save additional state and intercept information.
207 *
208 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
209 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
210 * SVM execution.
211 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
212 */
213 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
214 if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
215 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
216 else
217 {
218 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
219 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
220 }
221
222 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
223
224 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
225 && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
226 {
227 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
228 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
229 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
230 }
231 else
232 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
233
234 /*
235 * Save nRIP, instruction length and byte fields.
236 */
237 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
238 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
239 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
240
241 /*
242 * Save exit information.
243 */
244 pVmcbMemCtrl->u64ExitCode = uExitCode;
245 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
246 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
247
248 /*
249 * Update the exit interrupt-information field if this #VMEXIT happened as a result
250 * of delivering an event through IEM.
251 *
252 * Don't update the exit interrupt-information field if the event wasn't being injected
253 * through IEM, as it would have been updated by real hardware if the nested-guest was
254 * executed using hardware-assisted SVM.
255 */
256 {
257 uint8_t uExitIntVector;
258 uint32_t uExitIntErr;
259 uint32_t fExitIntFlags;
260 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
261 NULL /* uExitIntCr2 */);
262 if (fRaisingEvent)
263 {
264 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
265 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
266 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
267 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
268 {
269 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
270 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
271 }
272 }
273 }
274
275 /*
276 * Save the exit interrupt-information field.
277 *
278 * We write the whole field including overwriting reserved bits as it was observed on an
279 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
280 */
281 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
282
283 /*
284 * Clear event injection.
285 */
286 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
287
288 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
289 }
290
291 /*
292 * Prepare for guest's "host mode" by clearing internal processor state bits.
293 *
294 * We don't need to zero out the state-save area, just the controls should be
295 * sufficient because it has the critical bit of indicating whether we're inside
296 * the nested-guest or not.
297 */
298 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
299 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
300
301 /*
302 * Restore the subset of force-flags that were preserved.
303 */
304 if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
305 {
306 VMCPU_FF_SET(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
307 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
308 }
309
310 if (rcStrict == VINF_SUCCESS)
311 {
312 /** @todo Nested paging. */
313 /** @todo ASID. */
314
315 /*
316 * Reload the guest's "host state".
317 */
318 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
319
320 /*
321 * Update PGM, IEM and others of a world-switch.
322 */
323 rcStrict = iemSvmWorldSwitch(pVCpu);
324 if (rcStrict == VINF_SUCCESS)
325 rcStrict = VINF_SVM_VMEXIT;
326 else if (RT_SUCCESS(rcStrict))
327 {
328 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
329 iemSetPassUpStatus(pVCpu, rcStrict);
330 rcStrict = VINF_SVM_VMEXIT;
331 }
332 else
333 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
334 }
335 else
336 {
337 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
338 rcStrict = VERR_SVM_VMEXIT_FAILED;
339 }
340 }
341 else
342 {
343 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
344 rcStrict = VERR_SVM_IPE_3;
345 }
346
347# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
348 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
349 if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
350 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
351# endif
352 return rcStrict;
353}
354
355
356/**
357 * Performs the operations necessary that are part of the vmrun instruction
358 * execution in the guest.
359 *
360 * @returns Strict VBox status code (i.e. informational status codes too).
361 * @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
362 * code execution.
363 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
364 * (SVM_EXIT_INVALID most likely).
365 *
366 * @param pVCpu The cross context virtual CPU structure.
367 * @param cbInstr The length of the VMRUN instruction.
368 * @param GCPhysVmcb Guest physical address of the VMCB to run.
369 */
370IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
371{
372 LogFlow(("iemSvmVmrun\n"));
373
374 /*
375 * Cache the physical address of the VMCB for #VMEXIT exceptions.
376 */
377 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
378
379 /*
380 * Save the host state.
381 */
382 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
383
384 /*
385 * Read the guest VMCB.
386 */
387 PVM pVM = pVCpu->CTX_SUFF(pVM);
388 int rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
389 if (RT_SUCCESS(rc))
390 {
391 /*
392 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
393 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
394 * but in our implementation we try to preserve as much as we possibly can.
395 *
396 * We could read the entire page here and only write back the relevant fields on
397 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
398 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
399 * currently reserved but may be recognized as features bits in future CPUs causing
400 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
401 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
402 */
403 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
404 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->guest;
405
406 RT_ZERO(pVmcbCtrl->u8Reserved0);
407 RT_ZERO(pVmcbCtrl->u8Reserved1);
408 RT_ZERO(pVmcbCtrl->u8Reserved2);
409 RT_ZERO(pVmcbNstGst->u8Reserved0);
410 RT_ZERO(pVmcbNstGst->u8Reserved1);
411 RT_ZERO(pVmcbNstGst->u8Reserved2);
412 RT_ZERO(pVmcbNstGst->u8Reserved3);
413 RT_ZERO(pVmcbNstGst->u8Reserved4);
414 RT_ZERO(pVmcbNstGst->u8Reserved5);
415 pVmcbCtrl->u32Reserved0 = 0;
416 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
417 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
418 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
419 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
420 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
421 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
422 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
423 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
424 pVmcbCtrl->EventInject.n.u19Reserved = 0;
425 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
426
427 /*
428 * Validate guest-state and controls.
429 */
430 /* VMRUN must always be intercepted. */
431 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
432 {
433 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
434 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
435 }
436
437 /* Nested paging. */
438 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
439 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
440 {
441 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
442 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
443 }
444
445 /* AVIC. */
446 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
447 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
448 {
449 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
450 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
451 }
452
453 /* Last branch record (LBR) virtualization. */
454 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
455 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
456 {
457 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
458 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
459 }
460
461 /* Virtualized VMSAVE/VMLOAD. */
462 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
463 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
464 {
465 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
466 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
467 }
468
469 /* Virtual GIF. */
470 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
471 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
472 {
473 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
474 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
475 }
476
477 /* Guest ASID. */
478 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
479 {
480 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
481 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
482 }
483
484 /* Guest AVIC. */
485 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
486 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
487 {
488 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
489 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
490 }
491
492 /* Guest Secure Encrypted Virtualization. */
493 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
494 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
495 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
496 {
497 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
498 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
499 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
500 }
501
502 /* Flush by ASID. */
503 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
504 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
505 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
506 {
507 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
508 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
509 }
510
511 /* IO permission bitmap. */
512 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
513 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
514 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
515 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
516 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
517 {
518 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
519 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
520 }
521
522 /* MSR permission bitmap. */
523 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
524 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
525 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
526 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
527 {
528 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
529 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
530 }
531
532 /* CR0. */
533 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
534 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
535 {
536 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
537 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
538 }
539 if (pVmcbNstGst->u64CR0 >> 32)
540 {
541 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
542 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
543 }
544 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
545
546 /* DR6 and DR7. */
547 if ( pVmcbNstGst->u64DR6 >> 32
548 || pVmcbNstGst->u64DR7 >> 32)
549 {
550 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
551 pVmcbNstGst->u64DR6));
552 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
553 }
554
555 /*
556 * PAT (Page Attribute Table) MSR.
557 *
558 * The CPU only validates and loads it when nested-paging is enabled.
559 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
560 */
561 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
562 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
563 {
564 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
565 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
566 }
567
568 /*
569 * Copy the IO permission bitmap into the cache.
570 */
571 Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap));
572 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
573 SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
574 if (RT_FAILURE(rc))
575 {
576 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
577 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
578 }
579
580 /*
581 * Copy the MSR permission bitmap into the cache.
582 */
583 Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap));
584 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
585 SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
586 if (RT_FAILURE(rc))
587 {
588 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
589 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
590 }
591
592 /*
593 * Copy segments from nested-guest VMCB state to the guest-CPU state.
594 *
595 * We do this here as we need to use the CS attributes and it's easier this way
596 * then using the VMCB format selectors. It doesn't really matter where we copy
597 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
598 */
599 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
600 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
601 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
602 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
603
604 /** @todo Segment attribute overrides by VMRUN. */
605
606 /*
607 * CPL adjustments and overrides.
608 *
609 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
610 * We shall thus adjust both CS.DPL and SS.DPL here.
611 */
612 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
613 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
614 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
615 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
616 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
617 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
618
619 /*
620 * Continue validating guest-state and controls.
621 *
622 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
623 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
624 * old and new EFER value to not have any guest EFER bits influence the new
625 * nested-guest EFER.
626 */
627 uint64_t uValidEfer;
628 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
629 if (RT_FAILURE(rc))
630 {
631 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
632 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
633 }
634
635 /* Validate paging and CPU mode bits. */
636 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
637 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
638 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
639 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
640 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
641 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
642 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
643 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
644 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
645 if (fLongModeWithPaging)
646 uValidEfer |= MSR_K6_EFER_LMA;
647 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
648 if ( !fSvm
649 || (!fLongModeSupported && fLongModeActiveOrEnabled)
650 || (fLongModeWithPaging && !fPae)
651 || (fLongModeWithPaging && !fProtMode)
652 || ( fLongModeEnabled
653 && fPaging
654 && fPae
655 && fLongModeConformCS))
656 {
657 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
658 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
659 }
660
661 /*
662 * Preserve the required force-flags.
663 *
664 * We only preserve the force-flags that would affect the execution of the
665 * nested-guest (or the guest).
666 *
667 * - VMCPU_FF_INHIBIT_INTERRUPTS need -not- be preserved as it's for a single
668 * instruction which is this VMRUN instruction itself.
669 *
670 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
671 * execution of a subsequent IRET instruction in the guest.
672 *
673 * - The remaining FFs (e.g. timers) can stay in place so that we will be
674 * able to generate interrupts that should cause #VMEXITs for the
675 * nested-guest.
676 */
677 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
678 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
679
680 /*
681 * Pause filter.
682 */
683 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
684 {
685 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
686 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
687 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
688 }
689
690 /*
691 * Interrupt shadow.
692 */
693 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
694 {
695 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
696 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
697 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
698 }
699
700 /*
701 * TLB flush control.
702 * Currently disabled since it's redundant as we unconditionally flush the TLB
703 * in iemSvmWorldSwitch() below.
704 */
705# if 0
706 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
707 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
708 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
709 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
710 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
711# endif
712
713 /*
714 * Copy the remaining guest state from the VMCB to the guest-CPU context.
715 */
716 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
717 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
718 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
719 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
720 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
721 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
722 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
723 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
724 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
725 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
726 pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
727 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
728 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
729 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
730 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
731 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
732 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
733
734 /* Mask DR6, DR7 bits mandatory set/clear bits. */
735 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
736 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
737 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
738 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
739
740 /*
741 * Check for pending virtual interrupts.
742 */
743 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
744 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
745 else
746 Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
747
748 /*
749 * Update PGM, IEM and others of a world-switch.
750 */
751 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
752 if (rcStrict == VINF_SUCCESS)
753 { /* likely */ }
754 else if (RT_SUCCESS(rcStrict))
755 {
756 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
757 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
758 }
759 else
760 {
761 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
762 return rcStrict;
763 }
764
765 /*
766 * Clear global interrupt flags to allow interrupts in the guest.
767 */
768 pVCpu->cpum.GstCtx.hwvirt.fGif = true;
769
770 /*
771 * Event injection.
772 */
773 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
774 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
775 if (pEventInject->n.u1Valid)
776 {
777 uint8_t const uVector = pEventInject->n.u8Vector;
778 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
779 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
780
781 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
782 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
783 {
784 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
785 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
786 }
787 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
788 {
789 if ( uVector == X86_XCPT_NMI
790 || uVector > X86_XCPT_LAST)
791 {
792 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
793 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
794 }
795 if ( uVector == X86_XCPT_BR
796 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
797 {
798 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
799 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
800 }
801 /** @todo any others? */
802 }
803
804 /*
805 * Invalidate the exit interrupt-information field here. This field is fully updated
806 * on #VMEXIT as events other than the one below can also cause intercepts during
807 * their injection (e.g. exceptions).
808 */
809 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
810
811 /*
812 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
813 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
814 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
815 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
816 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
817 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
818 * injecting the event through IEM here.
819 */
820 pVmcbCtrl->EventInject.n.u1Valid = 0;
821
822 /** @todo NRIP: Software interrupts can only be pushed properly if we support
823 * NRIP for the nested-guest to calculate the instruction length
824 * below. */
825 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
826 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
827 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
828
829 /*
830 * We shall not inject the event here right away. There may be paging mode related updates
831 * as a result of the world-switch above that are yet to be honored. Instead flag the event
832 * as pending for injection.
833 */
834 TRPMAssertTrap(pVCpu, uVector, enmType);
835 if (pEventInject->n.u1ErrorCodeValid)
836 TRPMSetErrorCode(pVCpu, uErrorCode);
837 if ( enmType == TRPM_TRAP
838 && uVector == X86_XCPT_PF)
839 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
840 }
841 else
842 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
843 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
844 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
845
846 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
847
848# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
849 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
850 if (HMSvmIsVGifActive(pVM))
851 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
852# endif
853
854 return rcStrict;
855 }
856
857 /* Shouldn't really happen as the caller should've validated the physical address already. */
858 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
859 return rc;
860}
861
862
863/**
864 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
865 * intercept is active.
866 *
867 * @returns Strict VBox status code.
868 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
869 * we're not executing a nested-guest.
870 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
871 * successfully.
872 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
873 * failed and a shutdown needs to be initiated for the geust.
874 *
875 * @returns VBox strict status code.
876 * @param pVCpu The cross context virtual CPU structure of the calling thread.
877 * @param u8Vector The interrupt or exception vector.
878 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
879 * @param uErr The error-code associated with the exception.
880 * @param uCr2 The CR2 value in case of a \#PF exception.
881 */
882IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
883{
884 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
885
886 /*
887 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
888 *
889 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
890 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
891 * even when they use a vector in the range 0 to 31.
892 * - ICEBP should not trigger #DB intercept, but its own intercept.
893 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
894 */
895 /* Check NMI intercept */
896 if ( u8Vector == X86_XCPT_NMI
897 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
898 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
899 {
900 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
901 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
902 }
903
904 /* Check ICEBP intercept. */
905 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
906 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
907 {
908 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
909 IEM_SVM_UPDATE_NRIP(pVCpu);
910 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
911 }
912
913 /* Check CPU exception intercepts. */
914 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
915 && IEM_IS_SVM_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
916 {
917 Assert(u8Vector <= X86_XCPT_LAST);
918 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
919 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
920 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
921 && u8Vector == X86_XCPT_PF
922 && !(uErr & X86_TRAP_PF_ID))
923 {
924 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
925# ifdef IEM_WITH_CODE_TLB
926 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
927 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
928 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
929 if ( pbInstrBuf
930 && cbInstrBuf > 0)
931 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
932# else
933 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
934 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
935 if (cbOpcode > 0)
936 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
937# endif
938 }
939 if (u8Vector == X86_XCPT_BR)
940 IEM_SVM_UPDATE_NRIP(pVCpu);
941 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
942 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
943 u8Vector, uExitInfo1, uExitInfo2));
944 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
945 }
946
947 /* Check software interrupt (INTn) intercepts. */
948 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
949 | IEM_XCPT_FLAGS_BP_INSTR
950 | IEM_XCPT_FLAGS_ICEBP_INSTR
951 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
952 && IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
953 {
954 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
955 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
956 IEM_SVM_UPDATE_NRIP(pVCpu);
957 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
958 }
959
960 return VINF_HM_INTERCEPT_NOT_ACTIVE;
961}
962
963
964/**
965 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
966 * corresponding intercept is active.
967 *
968 * @returns Strict VBox status code.
969 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
970 * we're not executing a nested-guest.
971 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
972 * successfully.
973 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
974 * failed and a shutdown needs to be initiated for the geust.
975 *
976 * @returns VBox strict status code.
977 * @param pVCpu The cross context virtual CPU structure of the calling thread.
978 * @param u16Port The IO port being accessed.
979 * @param enmIoType The type of IO access.
980 * @param cbReg The IO operand size in bytes.
981 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
982 * @param iEffSeg The effective segment number.
983 * @param fRep Whether this is a repeating IO instruction (REP prefix).
984 * @param fStrIo Whether this is a string IO instruction.
985 * @param cbInstr The length of the IO instruction in bytes.
986 */
987IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
988 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
989{
990 Assert(IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
991 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
992 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
993
994 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
995
996 SVMIOIOEXITINFO IoExitInfo;
997 void *pvIoBitmap = pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap);
998 bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
999 &IoExitInfo);
1000 if (fIntercept)
1001 {
1002 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1003 IEM_SVM_UPDATE_NRIP(pVCpu);
1004 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1005 }
1006
1007 /** @todo remove later (for debugging as VirtualBox always traps all IO
1008 * intercepts). */
1009 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1010 return VINF_HM_INTERCEPT_NOT_ACTIVE;
1011}
1012
1013
1014/**
1015 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1016 * corresponding intercept is active.
1017 *
1018 * @returns Strict VBox status code.
1019 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1020 * specify interception of the accessed MSR @a idMsr.
1021 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1022 * successfully.
1023 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1024 * failed and a shutdown needs to be initiated for the geust.
1025 *
1026 * @param pVCpu The cross context virtual CPU structure.
1027 * @param idMsr The MSR being accessed in the nested-guest.
1028 * @param fWrite Whether this is an MSR write access, @c false implies an
1029 * MSR read.
1030 * @param cbInstr The length of the MSR read/write instruction in bytes.
1031 */
1032IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, uint32_t idMsr, bool fWrite)
1033{
1034 /*
1035 * Check if any MSRs are being intercepted.
1036 */
1037 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1038 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1039
1040 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1041
1042 /*
1043 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1044 */
1045 uint16_t offMsrpm;
1046 uint8_t uMsrpmBit;
1047 int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1048 if (RT_SUCCESS(rc))
1049 {
1050 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1051 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1052 if (fWrite)
1053 ++uMsrpmBit;
1054
1055 /*
1056 * Check if the bit is set, if so, trigger a #VMEXIT.
1057 */
1058 uint8_t *pbMsrpm = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1059 pbMsrpm += offMsrpm;
1060 if (*pbMsrpm & RT_BIT(uMsrpmBit))
1061 {
1062 IEM_SVM_UPDATE_NRIP(pVCpu);
1063 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1064 }
1065 }
1066 else
1067 {
1068 /*
1069 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1070 */
1071 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1072 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1073 }
1074 return VINF_HM_INTERCEPT_NOT_ACTIVE;
1075}
1076
1077
1078
1079/**
1080 * Implements 'VMRUN'.
1081 */
1082IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1083{
1084# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1085 RT_NOREF2(pVCpu, cbInstr);
1086 return VINF_EM_RAW_EMULATE_INSTR;
1087# else
1088 LogFlow(("iemCImpl_vmrun\n"));
1089 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1090
1091 /** @todo Check effective address size using address size prefix. */
1092 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1093 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1094 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1095 {
1096 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1097 return iemRaiseGeneralProtectionFault0(pVCpu);
1098 }
1099
1100 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1101 {
1102 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1103 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1104 }
1105
1106 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1107 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1108 {
1109 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1110 rcStrict = VINF_EM_TRIPLE_FAULT;
1111 }
1112 return rcStrict;
1113# endif
1114}
1115
1116#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1117
1118/**
1119 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1120 */
1121IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1122{
1123 if (EMAreHypercallInstructionsEnabled(pVCpu))
1124 {
1125 NOREF(uDisOpcode);
1126 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1127 if (RT_SUCCESS(rcStrict))
1128 {
1129 if (rcStrict == VINF_SUCCESS)
1130 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1131 if ( rcStrict == VINF_SUCCESS
1132 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1133 return VINF_SUCCESS;
1134 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1135 return rcStrict;
1136 }
1137 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1138 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1139 || rcStrict == VERR_GIM_NOT_ENABLED
1140 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1141 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1142 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1143
1144 /* Raise #UD on all failures. */
1145 }
1146 return iemRaiseUndefinedOpcode(pVCpu);
1147}
1148
1149/**
1150 * Implements 'VMMCALL'.
1151 */
1152IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1153{
1154 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1155 {
1156 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1157 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1158 }
1159
1160#ifndef IN_RC
1161 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1162 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1163 if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
1164 {
1165 int rc = HMHCSvmMaybeMovTprHypercall(pVCpu);
1166 if (RT_SUCCESS(rc))
1167 {
1168 Log(("vmmcall: MovTrp\n"));
1169 return VINF_SUCCESS;
1170 }
1171 }
1172#endif
1173
1174 /* Join forces with vmcall. */
1175 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1176}
1177
1178#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1179
1180/**
1181 * Implements 'VMLOAD'.
1182 */
1183IEM_CIMPL_DEF_0(iemCImpl_vmload)
1184{
1185# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1186 RT_NOREF2(pVCpu, cbInstr);
1187 return VINF_EM_RAW_EMULATE_INSTR;
1188# else
1189 LogFlow(("iemCImpl_vmload\n"));
1190 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1191
1192 /** @todo Check effective address size using address size prefix. */
1193 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1194 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1195 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1196 {
1197 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1198 return iemRaiseGeneralProtectionFault0(pVCpu);
1199 }
1200
1201 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1202 {
1203 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1204 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1205 }
1206
1207 SVMVMCBSTATESAVE VmcbNstGst;
1208 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1209 sizeof(SVMVMCBSTATESAVE));
1210 if (rcStrict == VINF_SUCCESS)
1211 {
1212 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1213 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1214 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1215 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1216 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1217
1218 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1219 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1220 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1221 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1222 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1223
1224 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1225 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1226 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1227
1228 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1229 }
1230 return rcStrict;
1231# endif
1232}
1233
1234
1235/**
1236 * Implements 'VMSAVE'.
1237 */
1238IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1239{
1240# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1241 RT_NOREF2(pVCpu, cbInstr);
1242 return VINF_EM_RAW_EMULATE_INSTR;
1243# else
1244 LogFlow(("iemCImpl_vmsave\n"));
1245 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1246
1247 /** @todo Check effective address size using address size prefix. */
1248 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1249 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1250 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1251 {
1252 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1253 return iemRaiseGeneralProtectionFault0(pVCpu);
1254 }
1255
1256 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1257 {
1258 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1259 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1260 }
1261
1262 SVMVMCBSTATESAVE VmcbNstGst;
1263 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1264 sizeof(SVMVMCBSTATESAVE));
1265 if (rcStrict == VINF_SUCCESS)
1266 {
1267 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1268 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1269 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1270
1271 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1272 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1273 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1274 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1275
1276 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1277 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1278 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1279 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1280 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1281
1282 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1283 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1284 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1285
1286 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1287 sizeof(SVMVMCBSTATESAVE));
1288 if (rcStrict == VINF_SUCCESS)
1289 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1290 }
1291 return rcStrict;
1292# endif
1293}
1294
1295
1296/**
1297 * Implements 'CLGI'.
1298 */
1299IEM_CIMPL_DEF_0(iemCImpl_clgi)
1300{
1301# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1302 RT_NOREF2(pVCpu, cbInstr);
1303 return VINF_EM_RAW_EMULATE_INSTR;
1304# else
1305 LogFlow(("iemCImpl_clgi\n"));
1306 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1307 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1308 {
1309 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1310 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1311 }
1312
1313 pVCpu->cpum.GstCtx.hwvirt.fGif = false;
1314 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1315
1316# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1317 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1318# else
1319 return VINF_SUCCESS;
1320# endif
1321# endif
1322}
1323
1324
1325/**
1326 * Implements 'STGI'.
1327 */
1328IEM_CIMPL_DEF_0(iemCImpl_stgi)
1329{
1330# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1331 RT_NOREF2(pVCpu, cbInstr);
1332 return VINF_EM_RAW_EMULATE_INSTR;
1333# else
1334 LogFlow(("iemCImpl_stgi\n"));
1335 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1336 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1337 {
1338 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1339 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1340 }
1341
1342 pVCpu->cpum.GstCtx.hwvirt.fGif = true;
1343 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1344
1345# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1346 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1347# else
1348 return VINF_SUCCESS;
1349# endif
1350# endif
1351}
1352
1353
1354/**
1355 * Implements 'INVLPGA'.
1356 */
1357IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1358{
1359 /** @todo Check effective address size using address size prefix. */
1360 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1361 /** @todo PGM needs virtual ASID support. */
1362# if 0
1363 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1364# endif
1365
1366 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1367 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1368 {
1369 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1370 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1371 }
1372
1373 PGMInvalidatePage(pVCpu, GCPtrPage);
1374 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1375 return VINF_SUCCESS;
1376}
1377
1378
1379/**
1380 * Implements 'SKINIT'.
1381 */
1382IEM_CIMPL_DEF_0(iemCImpl_skinit)
1383{
1384 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1385
1386 uint32_t uIgnore;
1387 uint32_t fFeaturesECX;
1388 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1389 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1390 return iemRaiseUndefinedOpcode(pVCpu);
1391
1392 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1393 {
1394 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1395 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1396 }
1397
1398 RT_NOREF(cbInstr);
1399 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1400}
1401
1402
1403/**
1404 * Implements SVM's implementation of PAUSE.
1405 */
1406IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1407{
1408 bool fCheckIntercept = true;
1409 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1410 {
1411 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1412
1413 /* TSC based pause-filter thresholding. */
1414 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1415 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1416 {
1417 uint64_t const uTick = TMCpuTickGet(pVCpu);
1418 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1419 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = IEM_GET_SVM_PAUSE_FILTER_COUNT(pVCpu);
1420 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1421 }
1422
1423 /* Simple pause-filter counter. */
1424 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1425 {
1426 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1427 fCheckIntercept = false;
1428 }
1429 }
1430
1431 if (fCheckIntercept)
1432 IEMCIMPL_HLP_SVM_INSTR_INTERCEPT_AND_NRIP(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1433
1434 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1435 return VINF_SUCCESS;
1436}
1437
1438#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1439
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette