IEMAllCImplSvmInstr.cpp.h@ 74603

Last change on this file since 74603 was 74603, checked in by vboxsync, 6 years ago
VMM/IEM, HM: Nested VMX: bugref:9180 VM-exit bits; LMSW intercept. Separated VINF_HM_INTERCEPT_NOT_ACTIVE into VMX and SVM specific codes. Adjusted IEMExecDecodedLmsw to supply the additional memory operand parameter from the VMCS guest-linear address field.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 60.3 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 74603 2018-10-04 06:07:20Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
20	/**
21	* Check the common SVM instruction preconditions.
22	*/
23	# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
24	do { \
25	if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
26	{ \
27	Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
28	return iemRaiseUndefinedOpcode(a_pVCpu); \
29	} \
30	if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
31	{ \
32	Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
33	return iemRaiseUndefinedOpcode(a_pVCpu); \
34	} \
35	if ((a_pVCpu)->iem.s.uCpl != 0) \
36	{ \
37	Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
38	return iemRaiseGeneralProtectionFault0(a_pVCpu); \
39	} \
40	} while (0)
41
42
43	/**
44	* Converts an IEM exception event type to an SVM event type.
45	*
46	* @returns The SVM event type.
47	* @retval UINT8_MAX if the specified type of event isn't among the set
48	* of recognized IEM event types.
49	*
50	* @param uVector The vector of the event.
51	* @param fIemXcptFlags The IEM exception / interrupt flags.
52	*/
53	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
54	{
55	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
56	{
57	if (uVector != X86_XCPT_NMI)
58	return SVM_EVENT_EXCEPTION;
59	return SVM_EVENT_NMI;
60	}
61
62	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
63	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
64	return SVM_EVENT_EXCEPTION;
65
66	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
67	return SVM_EVENT_EXTERNAL_IRQ;
68
69	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
70	return SVM_EVENT_SOFTWARE_INT;
71
72	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
73	return UINT8_MAX;
74	}
75
76
77	/**
78	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
79	*
80	* @returns Strict VBox status code.
81	* @param pVCpu The cross context virtual CPU structure.
82	*/
83	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu)
84	{
85	/*
86	* Inform PGM about paging mode changes.
87	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
88	* see comment in iemMemPageTranslateAndCheckAccess().
89	*/
90	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
91	# ifdef IN_RING3
92	Assert(rc != VINF_PGM_CHANGE_MODE);
93	# endif
94	AssertRCReturn(rc, rc);
95
96	/* Inform CPUM (recompiler), can later be removed. */
97	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
98
99	/*
100	* Flush the TLB with new CR3. This is required in case the PGM mode change
101	* above doesn't actually change anything.
102	*/
103	if (rc == VINF_SUCCESS)
104	{
105	rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
106	AssertRCReturn(rc, rc);
107	}
108
109	/* Re-initialize IEM cache/state after the drastic mode switch. */
110	iemReInitExec(pVCpu);
111	return rc;
112	}
113
114
115	/**
116	* SVM \#VMEXIT handler.
117	*
118	* @returns Strict VBox status code.
119	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
120	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
121	* "host state" and a shutdown is required.
122	*
123	* @param pVCpu The cross context virtual CPU structure.
124	* @param uExitCode The exit code.
125	* @param uExitInfo1 The exit info. 1 field.
126	* @param uExitInfo2 The exit info. 2 field.
127	*/
128	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
129	{
130	VBOXSTRICTRC rcStrict;
131	if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
132	\|\| uExitCode == SVM_EXIT_INVALID)
133	{
134	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
135	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
136
137	/*
138	* Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
139	*/
140	pVCpu->cpum.GstCtx.hwvirt.fGif = false;
141
142	/*
143	* Map the nested-guest VMCB from its location in guest memory.
144	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
145	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
146	*/
147	PSVMVMCB pVmcbMem;
148	PGMPAGEMAPLOCK PgLockMem;
149	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
150	rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
151	&PgLockMem);
152	if (rcStrict == VINF_SUCCESS)
153	{
154	/*
155	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
156	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
157	* writing the VMCB back to guest memory.
158	*/
159	HMSvmNstGstVmExitNotify(pVCpu, IEM_GET_CTX(pVCpu));
160
161	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
162	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
163	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
164	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
165
166	/*
167	* Save the nested-guest state into the VMCB state-save area.
168	*/
169	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
170	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
171	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
172	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
173	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
174	pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
175	pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
176	pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
177	pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
178	pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
179	pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
180	pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
181	pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
182	pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
183	/** @todo Nested paging. */
184	pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
185	pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
186	pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
187	pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
188	pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
189	pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
190	pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
191	Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
192	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
193	pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
194
195	/*
196	* Save additional state and intercept information.
197	*
198	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
199	* - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
200	* SVM execution.
201	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
202	*/
203	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
204	if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
205	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
206	else
207	{
208	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
209	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
210	}
211
212	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
213
214	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
215	&& EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
216	{
217	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
218	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
219	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
220	}
221	else
222	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
223
224	/*
225	* Save nRIP, instruction length and byte fields.
226	*/
227	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
228	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
229	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
230
231	/*
232	* Save exit information.
233	*/
234	pVmcbMemCtrl->u64ExitCode = uExitCode;
235	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
236	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
237
238	/*
239	* Update the exit interrupt-information field if this #VMEXIT happened as a result
240	* of delivering an event through IEM.
241	*
242	* Don't update the exit interrupt-information field if the event wasn't being injected
243	* through IEM, as it would have been updated by real hardware if the nested-guest was
244	* executed using hardware-assisted SVM.
245	*/
246	{
247	uint8_t uExitIntVector;
248	uint32_t uExitIntErr;
249	uint32_t fExitIntFlags;
250	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
251	NULL /* uExitIntCr2 */);
252	if (fRaisingEvent)
253	{
254	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
255	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
256	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
257	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
258	{
259	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
260	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
261	}
262	}
263	}
264
265	/*
266	* Save the exit interrupt-information field.
267	*
268	* We write the whole field including overwriting reserved bits as it was observed on an
269	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
270	*/
271	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
272
273	/*
274	* Clear event injection.
275	*/
276	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
277
278	iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
279	}
280
281	/*
282	* Prepare for guest's "host mode" by clearing internal processor state bits.
283	*
284	* We don't need to zero out the state-save area, just the controls should be
285	* sufficient because it has the critical bit of indicating whether we're inside
286	* the nested-guest or not.
287	*/
288	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
289	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
290
291	/*
292	* Restore the subset of force-flags that were preserved.
293	*/
294	if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
295	{
296	VMCPU_FF_SET(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
297	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
298	}
299
300	if (rcStrict == VINF_SUCCESS)
301	{
302	/** @todo Nested paging. */
303	/** @todo ASID. */
304
305	/*
306	* Reload the guest's "host state".
307	*/
308	CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
309
310	/*
311	* Update PGM, IEM and others of a world-switch.
312	*/
313	rcStrict = iemSvmWorldSwitch(pVCpu);
314	if (rcStrict == VINF_SUCCESS)
315	rcStrict = VINF_SVM_VMEXIT;
316	else if (RT_SUCCESS(rcStrict))
317	{
318	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
319	iemSetPassUpStatus(pVCpu, rcStrict);
320	rcStrict = VINF_SVM_VMEXIT;
321	}
322	else
323	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
324	}
325	else
326	{
327	AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
328	rcStrict = VERR_SVM_VMEXIT_FAILED;
329	}
330	}
331	else
332	{
333	AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
334	rcStrict = VERR_SVM_IPE_3;
335	}
336
337	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
338	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
339	if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
340	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
341	# endif
342	return rcStrict;
343	}
344
345
346	/**
347	* Performs the operations necessary that are part of the vmrun instruction
348	* execution in the guest.
349	*
350	* @returns Strict VBox status code (i.e. informational status codes too).
351	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
352	* code execution.
353	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
354	* (SVM_EXIT_INVALID most likely).
355	*
356	* @param pVCpu The cross context virtual CPU structure.
357	* @param cbInstr The length of the VMRUN instruction.
358	* @param GCPhysVmcb Guest physical address of the VMCB to run.
359	*/
360	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
361	{
362	LogFlow(("iemSvmVmrun\n"));
363
364	/*
365	* Cache the physical address of the VMCB for #VMEXIT exceptions.
366	*/
367	pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
368
369	/*
370	* Save the host state.
371	*/
372	CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
373
374	/*
375	* Read the guest VMCB.
376	*/
377	PVM pVM = pVCpu->CTX_SUFF(pVM);
378	int rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
379	if (RT_SUCCESS(rc))
380	{
381	/*
382	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
383	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
384	* but in our implementation we try to preserve as much as we possibly can.
385	*
386	* We could read the entire page here and only write back the relevant fields on
387	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
388	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
389	* currently reserved but may be recognized as features bits in future CPUs causing
390	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
391	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
392	*/
393	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
394	PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->guest;
395
396	RT_ZERO(pVmcbCtrl->u8Reserved0);
397	RT_ZERO(pVmcbCtrl->u8Reserved1);
398	RT_ZERO(pVmcbCtrl->u8Reserved2);
399	RT_ZERO(pVmcbNstGst->u8Reserved0);
400	RT_ZERO(pVmcbNstGst->u8Reserved1);
401	RT_ZERO(pVmcbNstGst->u8Reserved2);
402	RT_ZERO(pVmcbNstGst->u8Reserved3);
403	RT_ZERO(pVmcbNstGst->u8Reserved4);
404	RT_ZERO(pVmcbNstGst->u8Reserved5);
405	pVmcbCtrl->u32Reserved0 = 0;
406	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
407	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
408	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
409	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
410	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
411	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
412	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
413	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
414	pVmcbCtrl->EventInject.n.u19Reserved = 0;
415	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
416
417	/*
418	* Validate guest-state and controls.
419	*/
420	/* VMRUN must always be intercepted. */
421	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
422	{
423	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
424	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
425	}
426
427	/* Nested paging. */
428	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
429	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
430	{
431	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
432	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
433	}
434
435	/* AVIC. */
436	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
437	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
438	{
439	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
440	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
441	}
442
443	/* Last branch record (LBR) virtualization. */
444	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
445	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
446	{
447	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
448	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
449	}
450
451	/* Virtualized VMSAVE/VMLOAD. */
452	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
453	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
454	{
455	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
456	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
457	}
458
459	/* Virtual GIF. */
460	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
461	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
462	{
463	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
464	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
465	}
466
467	/* Guest ASID. */
468	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
469	{
470	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
471	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
472	}
473
474	/* Guest AVIC. */
475	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
476	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
477	{
478	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
479	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
480	}
481
482	/* Guest Secure Encrypted Virtualization. */
483	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
484	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
485	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
486	{
487	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
488	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
489	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
490	}
491
492	/* Flush by ASID. */
493	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
494	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
495	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
496	{
497	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
498	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
499	}
500
501	/* IO permission bitmap. */
502	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
503	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
504	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
505	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
506	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
507	{
508	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
509	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
510	}
511
512	/* MSR permission bitmap. */
513	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
514	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
515	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
516	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
517	{
518	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
519	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
520	}
521
522	/* CR0. */
523	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
524	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
525	{
526	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
527	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
528	}
529	if (pVmcbNstGst->u64CR0 >> 32)
530	{
531	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
532	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
533	}
534	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
535
536	/* DR6 and DR7. */
537	if ( pVmcbNstGst->u64DR6 >> 32
538	\|\| pVmcbNstGst->u64DR7 >> 32)
539	{
540	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
541	pVmcbNstGst->u64DR6));
542	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
543	}
544
545	/*
546	* PAT (Page Attribute Table) MSR.
547	*
548	* The CPU only validates and loads it when nested-paging is enabled.
549	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
550	*/
551	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
552	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
553	{
554	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
555	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
556	}
557
558	/*
559	* Copy the IO permission bitmap into the cache.
560	*/
561	Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap));
562	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
563	SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
564	if (RT_FAILURE(rc))
565	{
566	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
567	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
568	}
569
570	/*
571	* Copy the MSR permission bitmap into the cache.
572	*/
573	Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap));
574	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
575	SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
576	if (RT_FAILURE(rc))
577	{
578	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
579	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
580	}
581
582	/*
583	* Copy segments from nested-guest VMCB state to the guest-CPU state.
584	*
585	* We do this here as we need to use the CS attributes and it's easier this way
586	* then using the VMCB format selectors. It doesn't really matter where we copy
587	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
588	*/
589	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
590	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
591	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
592	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
593
594	/** @todo Segment attribute overrides by VMRUN. */
595
596	/*
597	* CPL adjustments and overrides.
598	*
599	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
600	* We shall thus adjust both CS.DPL and SS.DPL here.
601	*/
602	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
603	if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
604	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
605	if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
606	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
607	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
608
609	/*
610	* Continue validating guest-state and controls.
611	*
612	* We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
613	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
614	* old and new EFER value to not have any guest EFER bits influence the new
615	* nested-guest EFER.
616	*/
617	uint64_t uValidEfer;
618	rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
619	if (RT_FAILURE(rc))
620	{
621	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
622	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
623	}
624
625	/* Validate paging and CPU mode bits. */
626	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
627	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
628	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
629	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
630	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
631	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
632	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
633	bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
634	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
635	if (fLongModeWithPaging)
636	uValidEfer \|= MSR_K6_EFER_LMA;
637	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
638	if ( !fSvm
639	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
640	\|\| (fLongModeWithPaging && !fPae)
641	\|\| (fLongModeWithPaging && !fProtMode)
642	\|\| ( fLongModeEnabled
643	&& fPaging
644	&& fPae
645	&& fLongModeConformCS))
646	{
647	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
648	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
649	}
650
651	/*
652	* Preserve the required force-flags.
653	*
654	* We only preserve the force-flags that would affect the execution of the
655	* nested-guest (or the guest).
656	*
657	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
658	* execution of a subsequent IRET instruction in the guest.
659	*
660	* The remaining FFs (e.g. timers) can stay in place so that we will be able to
661	* generate interrupts that should cause #VMEXITs for the nested-guest.
662	*
663	* VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
664	* preserve VMCPU_FF_INHIBIT_INTERRUPTS.
665	*/
666	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
667	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
668
669	/*
670	* Pause filter.
671	*/
672	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
673	{
674	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
675	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
676	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
677	}
678
679	/*
680	* Interrupt shadow.
681	*/
682	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
683	{
684	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
685	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
686	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
687	}
688
689	/*
690	* TLB flush control.
691	* Currently disabled since it's redundant as we unconditionally flush the TLB
692	* in iemSvmWorldSwitch() below.
693	*/
694	# if 0
695	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
696	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
697	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
698	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
699	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
700	# endif
701
702	/*
703	* Copy the remaining guest state from the VMCB to the guest-CPU context.
704	*/
705	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
706	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
707	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
708	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
709	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
710	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
711	pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
712	pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
713	pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
714	pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
715	pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
716	pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
717	pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
718	pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
719	CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
720	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
721	pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
722
723	/* Mask DR6, DR7 bits mandatory set/clear bits. */
724	pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
725	pVCpu->cpum.GstCtx.dr[6] \|= X86_DR6_RA1_MASK;
726	pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
727	pVCpu->cpum.GstCtx.dr[7] \|= X86_DR7_RA1_MASK;
728
729	/*
730	* Check for pending virtual interrupts.
731	*/
732	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
733	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
734	else
735	Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
736
737	/*
738	* Update PGM, IEM and others of a world-switch.
739	*/
740	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
741	if (rcStrict == VINF_SUCCESS)
742	{ /* likely */ }
743	else if (RT_SUCCESS(rcStrict))
744	{
745	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
746	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
747	}
748	else
749	{
750	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
751	return rcStrict;
752	}
753
754	/*
755	* Clear global interrupt flags to allow interrupts in the guest.
756	*/
757	pVCpu->cpum.GstCtx.hwvirt.fGif = true;
758
759	/*
760	* Event injection.
761	*/
762	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
763	pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
764	if (pEventInject->n.u1Valid)
765	{
766	uint8_t const uVector = pEventInject->n.u8Vector;
767	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
768	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
769
770	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
771	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
772	{
773	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
774	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
775	}
776	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
777	{
778	if ( uVector == X86_XCPT_NMI
779	\|\| uVector > X86_XCPT_LAST)
780	{
781	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
782	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
783	}
784	if ( uVector == X86_XCPT_BR
785	&& CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
786	{
787	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
788	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
789	}
790	/** @todo any others? */
791	}
792
793	/*
794	* Invalidate the exit interrupt-information field here. This field is fully updated
795	* on #VMEXIT as events other than the one below can also cause intercepts during
796	* their injection (e.g. exceptions).
797	*/
798	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
799
800	/*
801	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
802	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
803	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
804	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
805	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
806	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
807	* injecting the event through IEM here.
808	*/
809	pVmcbCtrl->EventInject.n.u1Valid = 0;
810
811	/** @todo NRIP: Software interrupts can only be pushed properly if we support
812	* NRIP for the nested-guest to calculate the instruction length
813	* below. */
814	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
815	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
816	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
817
818	/*
819	* We shall not inject the event here right away. There may be paging mode related updates
820	* as a result of the world-switch above that are yet to be honored. Instead flag the event
821	* as pending for injection.
822	*/
823	TRPMAssertTrap(pVCpu, uVector, enmType);
824	if (pEventInject->n.u1ErrorCodeValid)
825	TRPMSetErrorCode(pVCpu, uErrorCode);
826	if ( enmType == TRPM_TRAP
827	&& uVector == X86_XCPT_PF)
828	TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
829	}
830	else
831	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
832	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
833	pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
834
835	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
836
837	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
838	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
839	if (HMSvmIsVGifActive(pVM))
840	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
841	# endif
842
843	return rcStrict;
844	}
845
846	/* Shouldn't really happen as the caller should've validated the physical address already. */
847	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
848	return rc;
849	}
850
851
852	/**
853	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
854	* intercept is active.
855	*
856	* @returns Strict VBox status code.
857	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
858	* we're not executing a nested-guest.
859	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
860	* successfully.
861	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
862	* failed and a shutdown needs to be initiated for the geust.
863	*
864	* @returns VBox strict status code.
865	* @param pVCpu The cross context virtual CPU structure of the calling thread.
866	* @param u8Vector The interrupt or exception vector.
867	* @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
868	* @param uErr The error-code associated with the exception.
869	* @param uCr2 The CR2 value in case of a \#PF exception.
870	*/
871	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
872	{
873	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
874
875	/*
876	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
877	*
878	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
879	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
880	* even when they use a vector in the range 0 to 31.
881	* - ICEBP should not trigger #DB intercept, but its own intercept.
882	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
883	*/
884	/* Check NMI intercept */
885	if ( u8Vector == X86_XCPT_NMI
886	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
887	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
888	{
889	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
890	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
891	}
892
893	/* Check ICEBP intercept. */
894	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
895	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
896	{
897	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
898	IEM_SVM_UPDATE_NRIP(pVCpu);
899	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
900	}
901
902	/* Check CPU exception intercepts. */
903	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
904	&& IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
905	{
906	Assert(u8Vector <= X86_XCPT_LAST);
907	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
908	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
909	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
910	&& u8Vector == X86_XCPT_PF
911	&& !(uErr & X86_TRAP_PF_ID))
912	{
913	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
914	# ifdef IEM_WITH_CODE_TLB
915	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
916	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
917	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
918	if ( pbInstrBuf
919	&& cbInstrBuf > 0)
920	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
921	# else
922	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
923	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
924	if (cbOpcode > 0)
925	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
926	# endif
927	}
928	if (u8Vector == X86_XCPT_BR)
929	IEM_SVM_UPDATE_NRIP(pVCpu);
930	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
931	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
932	u8Vector, uExitInfo1, uExitInfo2));
933	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
934	}
935
936	/* Check software interrupt (INTn) intercepts. */
937	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
938	\| IEM_XCPT_FLAGS_BP_INSTR
939	\| IEM_XCPT_FLAGS_ICEBP_INSTR
940	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
941	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
942	{
943	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
944	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
945	IEM_SVM_UPDATE_NRIP(pVCpu);
946	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
947	}
948
949	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
950	}
951
952
953	/**
954	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
955	* corresponding intercept is active.
956	*
957	* @returns Strict VBox status code.
958	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
959	* we're not executing a nested-guest.
960	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
961	* successfully.
962	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
963	* failed and a shutdown needs to be initiated for the geust.
964	*
965	* @returns VBox strict status code.
966	* @param pVCpu The cross context virtual CPU structure of the calling thread.
967	* @param u16Port The IO port being accessed.
968	* @param enmIoType The type of IO access.
969	* @param cbReg The IO operand size in bytes.
970	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
971	* @param iEffSeg The effective segment number.
972	* @param fRep Whether this is a repeating IO instruction (REP prefix).
973	* @param fStrIo Whether this is a string IO instruction.
974	* @param cbInstr The length of the IO instruction in bytes.
975	*/
976	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
977	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
978	{
979	Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
980	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
981	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
982
983	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
984
985	SVMIOIOEXITINFO IoExitInfo;
986	void *pvIoBitmap = pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap);
987	bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep, fStrIo,
988	&IoExitInfo);
989	if (fIntercept)
990	{
991	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
992	IEM_SVM_UPDATE_NRIP(pVCpu);
993	return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
994	}
995
996	/** @todo remove later (for debugging as VirtualBox always traps all IO
997	* intercepts). */
998	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
999	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1000	}
1001
1002
1003	/**
1004	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1005	* corresponding intercept is active.
1006	*
1007	* @returns Strict VBox status code.
1008	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1009	* specify interception of the accessed MSR @a idMsr.
1010	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1011	* successfully.
1012	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1013	* failed and a shutdown needs to be initiated for the geust.
1014	*
1015	* @param pVCpu The cross context virtual CPU structure.
1016	* @param idMsr The MSR being accessed in the nested-guest.
1017	* @param fWrite Whether this is an MSR write access, @c false implies an
1018	* MSR read.
1019	* @param cbInstr The length of the MSR read/write instruction in bytes.
1020	*/
1021	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, uint32_t idMsr, bool fWrite)
1022	{
1023	/*
1024	* Check if any MSRs are being intercepted.
1025	*/
1026	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1027	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1028
1029	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1030
1031	/*
1032	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1033	*/
1034	uint16_t offMsrpm;
1035	uint8_t uMsrpmBit;
1036	int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1037	if (RT_SUCCESS(rc))
1038	{
1039	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1040	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1041	if (fWrite)
1042	++uMsrpmBit;
1043
1044	/*
1045	* Check if the bit is set, if so, trigger a #VMEXIT.
1046	*/
1047	uint8_t pbMsrpm = (uint8_t )pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1048	pbMsrpm += offMsrpm;
1049	if (*pbMsrpm & RT_BIT(uMsrpmBit))
1050	{
1051	IEM_SVM_UPDATE_NRIP(pVCpu);
1052	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1053	}
1054	}
1055	else
1056	{
1057	/*
1058	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1059	*/
1060	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1061	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1062	}
1063	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1064	}
1065
1066
1067
1068	/**
1069	* Implements 'VMRUN'.
1070	*/
1071	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1072	{
1073	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1074	RT_NOREF2(pVCpu, cbInstr);
1075	return VINF_EM_RAW_EMULATE_INSTR;
1076	# else
1077	LogFlow(("iemCImpl_vmrun\n"));
1078	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1079
1080	/** @todo Check effective address size using address size prefix. */
1081	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1082	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1083	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1084	{
1085	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1086	return iemRaiseGeneralProtectionFault0(pVCpu);
1087	}
1088
1089	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1090	{
1091	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1092	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1093	}
1094
1095	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1096	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1097	{
1098	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1099	rcStrict = VINF_EM_TRIPLE_FAULT;
1100	}
1101	return rcStrict;
1102	# endif
1103	}
1104
1105
1106	/**
1107	* Implements 'VMLOAD'.
1108	*/
1109	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1110	{
1111	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1112	RT_NOREF2(pVCpu, cbInstr);
1113	return VINF_EM_RAW_EMULATE_INSTR;
1114	# else
1115	LogFlow(("iemCImpl_vmload\n"));
1116	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1117
1118	/** @todo Check effective address size using address size prefix. */
1119	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1120	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1121	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1122	{
1123	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1124	return iemRaiseGeneralProtectionFault0(pVCpu);
1125	}
1126
1127	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1128	{
1129	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1130	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1131	}
1132
1133	SVMVMCBSTATESAVE VmcbNstGst;
1134	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1135	sizeof(SVMVMCBSTATESAVE));
1136	if (rcStrict == VINF_SUCCESS)
1137	{
1138	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1139	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1140	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1141	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1142	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1143
1144	pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1145	pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1146	pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1147	pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1148	pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1149
1150	pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1151	pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1152	pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1153
1154	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1155	}
1156	return rcStrict;
1157	# endif
1158	}
1159
1160
1161	/**
1162	* Implements 'VMSAVE'.
1163	*/
1164	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1165	{
1166	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1167	RT_NOREF2(pVCpu, cbInstr);
1168	return VINF_EM_RAW_EMULATE_INSTR;
1169	# else
1170	LogFlow(("iemCImpl_vmsave\n"));
1171	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1172
1173	/** @todo Check effective address size using address size prefix. */
1174	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1175	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1176	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1177	{
1178	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1179	return iemRaiseGeneralProtectionFault0(pVCpu);
1180	}
1181
1182	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1183	{
1184	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1185	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1186	}
1187
1188	SVMVMCBSTATESAVE VmcbNstGst;
1189	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1190	sizeof(SVMVMCBSTATESAVE));
1191	if (rcStrict == VINF_SUCCESS)
1192	{
1193	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1194	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS \| CPUMCTX_EXTRN_GS \| CPUMCTX_EXTRN_TR \| CPUMCTX_EXTRN_LDTR
1195	\| CPUMCTX_EXTRN_KERNEL_GS_BASE \| CPUMCTX_EXTRN_SYSCALL_MSRS \| CPUMCTX_EXTRN_SYSENTER_MSRS);
1196
1197	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1198	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1199	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1200	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1201
1202	VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1203	VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1204	VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1205	VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1206	VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1207
1208	VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1209	VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1210	VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1211
1212	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1213	sizeof(SVMVMCBSTATESAVE));
1214	if (rcStrict == VINF_SUCCESS)
1215	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1216	}
1217	return rcStrict;
1218	# endif
1219	}
1220
1221
1222	/**
1223	* Implements 'CLGI'.
1224	*/
1225	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1226	{
1227	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1228	RT_NOREF2(pVCpu, cbInstr);
1229	return VINF_EM_RAW_EMULATE_INSTR;
1230	# else
1231	LogFlow(("iemCImpl_clgi\n"));
1232	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1233	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1234	{
1235	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1236	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1237	}
1238
1239	pVCpu->cpum.GstCtx.hwvirt.fGif = false;
1240	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1241
1242	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1243	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1244	# else
1245	return VINF_SUCCESS;
1246	# endif
1247	# endif
1248	}
1249
1250
1251	/**
1252	* Implements 'STGI'.
1253	*/
1254	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1255	{
1256	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1257	RT_NOREF2(pVCpu, cbInstr);
1258	return VINF_EM_RAW_EMULATE_INSTR;
1259	# else
1260	LogFlow(("iemCImpl_stgi\n"));
1261	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1262	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1263	{
1264	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1265	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1266	}
1267
1268	pVCpu->cpum.GstCtx.hwvirt.fGif = true;
1269	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1270
1271	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1272	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1273	# else
1274	return VINF_SUCCESS;
1275	# endif
1276	# endif
1277	}
1278
1279
1280	/**
1281	* Implements 'INVLPGA'.
1282	*/
1283	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1284	{
1285	/** @todo Check effective address size using address size prefix. */
1286	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1287	/** @todo PGM needs virtual ASID support. */
1288	# if 0
1289	uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1290	# endif
1291
1292	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1293	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1294	{
1295	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1296	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1297	}
1298
1299	PGMInvalidatePage(pVCpu, GCPtrPage);
1300	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1301	return VINF_SUCCESS;
1302	}
1303
1304
1305	/**
1306	* Implements 'SKINIT'.
1307	*/
1308	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1309	{
1310	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1311
1312	uint32_t uIgnore;
1313	uint32_t fFeaturesECX;
1314	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1315	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1316	return iemRaiseUndefinedOpcode(pVCpu);
1317
1318	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1319	{
1320	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1321	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1322	}
1323
1324	RT_NOREF(cbInstr);
1325	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1326	}
1327
1328
1329	/**
1330	* Implements SVM's implementation of PAUSE.
1331	*/
1332	IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1333	{
1334	bool fCheckIntercept = true;
1335	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1336	{
1337	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1338
1339	/* TSC based pause-filter thresholding. */
1340	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1341	&& pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1342	{
1343	uint64_t const uTick = TMCpuTickGet(pVCpu);
1344	if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1345	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1346	pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1347	}
1348
1349	/* Simple pause-filter counter. */
1350	if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1351	{
1352	--pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1353	fCheckIntercept = false;
1354	}
1355	}
1356
1357	if (fCheckIntercept)
1358	IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1359
1360	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1361	return VINF_SUCCESS;
1362	}
1363
1364	#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1365
1366	/**
1367	* Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1368	*/
1369	IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1370	{
1371	if (EMAreHypercallInstructionsEnabled(pVCpu))
1372	{
1373	NOREF(uDisOpcode);
1374	VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1375	if (RT_SUCCESS(rcStrict))
1376	{
1377	if (rcStrict == VINF_SUCCESS)
1378	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1379	if ( rcStrict == VINF_SUCCESS
1380	\|\| rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1381	return VINF_SUCCESS;
1382	AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1383	return rcStrict;
1384	}
1385	AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1386	\|\| rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1387	\|\| rcStrict == VERR_GIM_NOT_ENABLED
1388	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1389	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1390	("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1391
1392	/* Raise #UD on all failures. */
1393	}
1394	return iemRaiseUndefinedOpcode(pVCpu);
1395	}
1396
1397
1398	/**
1399	* Implements 'VMMCALL'.
1400	*/
1401	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1402	{
1403	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1404	{
1405	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1406	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1407	}
1408
1409	#ifndef IN_RC
1410	/* This is a little bit more complicated than the VT-x version because HM/SVM may
1411	patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1412	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
1413	{
1414	int rc = HMHCSvmMaybeMovTprHypercall(pVCpu);
1415	if (RT_SUCCESS(rc))
1416	{
1417	Log(("vmmcall: MovTrp\n"));
1418	return VINF_SUCCESS;
1419	}
1420	}
1421	#endif
1422
1423	/* Join forces with vmcall. */
1424	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1425	}
1426

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 74603

Download in other formats: