VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 75638

Last change on this file since 75638 was 75638, checked in by vboxsync, 6 years ago

VMM/IEM: Nested VMX: bugref:9180 Documented a hack that's no longer necessary and added a couple of flower boxes.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 60.7 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp.h 75638 2018-11-21 10:49:32Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Defined Constants And Macros *
21*********************************************************************************************************************************/
22#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23/**
24 * Check the common SVM instruction preconditions.
25 */
26# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27 do { \
28 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29 { \
30 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31 return iemRaiseUndefinedOpcode(a_pVCpu); \
32 } \
33 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34 { \
35 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36 return iemRaiseUndefinedOpcode(a_pVCpu); \
37 } \
38 if ((a_pVCpu)->iem.s.uCpl != 0) \
39 { \
40 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42 } \
43 } while (0)
44
45
46/**
47 * Converts an IEM exception event type to an SVM event type.
48 *
49 * @returns The SVM event type.
50 * @retval UINT8_MAX if the specified type of event isn't among the set
51 * of recognized IEM event types.
52 *
53 * @param uVector The vector of the event.
54 * @param fIemXcptFlags The IEM exception / interrupt flags.
55 */
56IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57{
58 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59 {
60 if (uVector != X86_XCPT_NMI)
61 return SVM_EVENT_EXCEPTION;
62 return SVM_EVENT_NMI;
63 }
64
65 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
67 return SVM_EVENT_EXCEPTION;
68
69 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70 return SVM_EVENT_EXTERNAL_IRQ;
71
72 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73 return SVM_EVENT_SOFTWARE_INT;
74
75 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76 return UINT8_MAX;
77}
78
79
80/**
81 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82 *
83 * @returns Strict VBox status code.
84 * @param pVCpu The cross context virtual CPU structure.
85 */
86DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPU pVCpu)
87{
88 /*
89 * Inform PGM about paging mode changes.
90 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
91 * see comment in iemMemPageTranslateAndCheckAccess().
92 */
93 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
94# ifdef IN_RING3
95 Assert(rc != VINF_PGM_CHANGE_MODE);
96# endif
97 AssertRCReturn(rc, rc);
98
99 /* Inform CPUM (recompiler), can later be removed. */
100 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
101
102 /*
103 * Flush the TLB with new CR3. This is required in case the PGM mode change
104 * above doesn't actually change anything.
105 */
106 if (rc == VINF_SUCCESS)
107 {
108 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
109 AssertRCReturn(rc, rc);
110 }
111
112 /* Re-initialize IEM cache/state after the drastic mode switch. */
113 iemReInitExec(pVCpu);
114 return rc;
115}
116
117
118/**
119 * SVM \#VMEXIT handler.
120 *
121 * @returns Strict VBox status code.
122 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
123 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
124 * "host state" and a shutdown is required.
125 *
126 * @param pVCpu The cross context virtual CPU structure.
127 * @param uExitCode The exit code.
128 * @param uExitInfo1 The exit info. 1 field.
129 * @param uExitInfo2 The exit info. 2 field.
130 */
131IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPU pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
132{
133 VBOXSTRICTRC rcStrict;
134 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
135 || uExitCode == SVM_EXIT_INVALID)
136 {
137 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
138 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
139
140 /*
141 * Disable the global interrupt flag to prevent interrupts during the 'atomic' world switch.
142 */
143 pVCpu->cpum.GstCtx.hwvirt.fGif = false;
144
145 /*
146 * Map the nested-guest VMCB from its location in guest memory.
147 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
148 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
149 */
150 PSVMVMCB pVmcbMem;
151 PGMPAGEMAPLOCK PgLockMem;
152 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
153 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
154 &PgLockMem);
155 if (rcStrict == VINF_SUCCESS)
156 {
157 /*
158 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
159 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
160 * writing the VMCB back to guest memory.
161 */
162 HMSvmNstGstVmExitNotify(pVCpu, IEM_GET_CTX(pVCpu));
163
164 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
165 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
166 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
167 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
168
169 /*
170 * Save the nested-guest state into the VMCB state-save area.
171 */
172 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
173 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
174 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
175 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
176 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
177 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
178 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
179 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
180 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
181 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
182 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
183 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
184 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
185 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
186 /** @todo Nested paging. */
187 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
188 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
189 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
190 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
191 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
192 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
193 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
194 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
195 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
196 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
197
198 /*
199 * Save additional state and intercept information.
200 *
201 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
202 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
203 * SVM execution.
204 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
205 */
206 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
207 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
208 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
209 else
210 {
211 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
212 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
213 }
214
215 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
216
217 if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
218 && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
219 {
220 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
221 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
222 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
223 }
224 else
225 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
226
227 /*
228 * Save nRIP, instruction length and byte fields.
229 */
230 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
231 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
232 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
233
234 /*
235 * Save exit information.
236 */
237 pVmcbMemCtrl->u64ExitCode = uExitCode;
238 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
239 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
240
241 /*
242 * Update the exit interrupt-information field if this #VMEXIT happened as a result
243 * of delivering an event through IEM.
244 *
245 * Don't update the exit interrupt-information field if the event wasn't being injected
246 * through IEM, as it would have been updated by real hardware if the nested-guest was
247 * executed using hardware-assisted SVM.
248 */
249 {
250 uint8_t uExitIntVector;
251 uint32_t uExitIntErr;
252 uint32_t fExitIntFlags;
253 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
254 NULL /* uExitIntCr2 */);
255 if (fRaisingEvent)
256 {
257 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
258 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
259 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
260 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
261 {
262 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
263 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
264 }
265 }
266 }
267
268 /*
269 * Save the exit interrupt-information field.
270 *
271 * We write the whole field including overwriting reserved bits as it was observed on an
272 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
273 */
274 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
275
276 /*
277 * Clear event injection.
278 */
279 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
280
281 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
282 }
283
284 /*
285 * Prepare for guest's "host mode" by clearing internal processor state bits.
286 *
287 * We don't need to zero out the state-save area, just the controls should be
288 * sufficient because it has the critical bit of indicating whether we're inside
289 * the nested-guest or not.
290 */
291 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
292 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
293
294 /*
295 * Restore the subset of force-flags that were preserved.
296 */
297 if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
298 {
299 VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
300 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
301 }
302
303 if (rcStrict == VINF_SUCCESS)
304 {
305 /** @todo Nested paging. */
306 /** @todo ASID. */
307
308 /*
309 * Reload the guest's "host state".
310 */
311 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
312
313 /*
314 * Update PGM, IEM and others of a world-switch.
315 */
316 rcStrict = iemSvmWorldSwitch(pVCpu);
317 if (rcStrict == VINF_SUCCESS)
318 rcStrict = VINF_SVM_VMEXIT;
319 else if (RT_SUCCESS(rcStrict))
320 {
321 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
322 iemSetPassUpStatus(pVCpu, rcStrict);
323 rcStrict = VINF_SVM_VMEXIT;
324 }
325 else
326 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
327 }
328 else
329 {
330 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
331 rcStrict = VERR_SVM_VMEXIT_FAILED;
332 }
333 }
334 else
335 {
336 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
337 rcStrict = VERR_SVM_IPE_3;
338 }
339
340# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
341 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
342 if (HMSvmIsVGifActive(pVCpu->CTX_SUFF(pVM)))
343 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
344# endif
345 return rcStrict;
346}
347
348
349/**
350 * Performs the operations necessary that are part of the vmrun instruction
351 * execution in the guest.
352 *
353 * @returns Strict VBox status code (i.e. informational status codes too).
354 * @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
355 * code execution.
356 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
357 * (SVM_EXIT_INVALID most likely).
358 *
359 * @param pVCpu The cross context virtual CPU structure.
360 * @param cbInstr The length of the VMRUN instruction.
361 * @param GCPhysVmcb Guest physical address of the VMCB to run.
362 */
363IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPU pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
364{
365 LogFlow(("iemSvmVmrun\n"));
366
367 /*
368 * Cache the physical address of the VMCB for #VMEXIT exceptions.
369 */
370 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
371
372 /*
373 * Save the host state.
374 */
375 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
376
377 /*
378 * Read the guest VMCB.
379 */
380 PVM pVM = pVCpu->CTX_SUFF(pVM);
381 int rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb), GCPhysVmcb, sizeof(SVMVMCB));
382 if (RT_SUCCESS(rc))
383 {
384 /*
385 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
386 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
387 * but in our implementation we try to preserve as much as we possibly can.
388 *
389 * We could read the entire page here and only write back the relevant fields on
390 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
391 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
392 * currently reserved but may be recognized as features bits in future CPUs causing
393 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
394 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
395 */
396 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
397 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->guest;
398
399 RT_ZERO(pVmcbCtrl->u8Reserved0);
400 RT_ZERO(pVmcbCtrl->u8Reserved1);
401 RT_ZERO(pVmcbCtrl->u8Reserved2);
402 RT_ZERO(pVmcbNstGst->u8Reserved0);
403 RT_ZERO(pVmcbNstGst->u8Reserved1);
404 RT_ZERO(pVmcbNstGst->u8Reserved2);
405 RT_ZERO(pVmcbNstGst->u8Reserved3);
406 RT_ZERO(pVmcbNstGst->u8Reserved4);
407 RT_ZERO(pVmcbNstGst->u8Reserved5);
408 pVmcbCtrl->u32Reserved0 = 0;
409 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
410 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
411 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
412 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
413 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
414 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
415 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
416 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
417 pVmcbCtrl->EventInject.n.u19Reserved = 0;
418 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
419
420 /*
421 * Validate guest-state and controls.
422 */
423 /* VMRUN must always be intercepted. */
424 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
425 {
426 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
427 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
428 }
429
430 /* Nested paging. */
431 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
432 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
433 {
434 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
435 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
436 }
437
438 /* AVIC. */
439 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
440 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
441 {
442 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
443 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
444 }
445
446 /* Last branch record (LBR) virtualization. */
447 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
448 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
449 {
450 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
451 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
452 }
453
454 /* Virtualized VMSAVE/VMLOAD. */
455 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
456 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
457 {
458 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
459 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
460 }
461
462 /* Virtual GIF. */
463 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
464 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
465 {
466 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
467 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
468 }
469
470 /* Guest ASID. */
471 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
472 {
473 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
474 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
475 }
476
477 /* Guest AVIC. */
478 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
479 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
480 {
481 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
482 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
483 }
484
485 /* Guest Secure Encrypted Virtualization. */
486 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
487 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
488 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
489 {
490 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
491 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
492 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
493 }
494
495 /* Flush by ASID. */
496 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
497 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
498 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
499 {
500 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
501 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
502 }
503
504 /* IO permission bitmap. */
505 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
506 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
507 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
508 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
509 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
510 {
511 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
512 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
513 }
514
515 /* MSR permission bitmap. */
516 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
517 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
518 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
519 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
520 {
521 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
522 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
523 }
524
525 /* CR0. */
526 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
527 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
528 {
529 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
530 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
531 }
532 if (pVmcbNstGst->u64CR0 >> 32)
533 {
534 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
535 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
536 }
537 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
538
539 /* DR6 and DR7. */
540 if ( pVmcbNstGst->u64DR6 >> 32
541 || pVmcbNstGst->u64DR7 >> 32)
542 {
543 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
544 pVmcbNstGst->u64DR6));
545 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
546 }
547
548 /*
549 * PAT (Page Attribute Table) MSR.
550 *
551 * The CPU only validates and loads it when nested-paging is enabled.
552 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
553 */
554 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
555 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
556 {
557 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
558 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
559 }
560
561 /*
562 * Copy the IO permission bitmap into the cache.
563 */
564 Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap));
565 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
566 SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
567 if (RT_FAILURE(rc))
568 {
569 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
570 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
571 }
572
573 /*
574 * Copy the MSR permission bitmap into the cache.
575 */
576 Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap));
577 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
578 SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
579 if (RT_FAILURE(rc))
580 {
581 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
582 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
583 }
584
585 /*
586 * Copy segments from nested-guest VMCB state to the guest-CPU state.
587 *
588 * We do this here as we need to use the CS attributes and it's easier this way
589 * then using the VMCB format selectors. It doesn't really matter where we copy
590 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
591 */
592 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
593 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
594 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
595 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
596
597 /** @todo Segment attribute overrides by VMRUN. */
598
599 /*
600 * CPL adjustments and overrides.
601 *
602 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
603 * We shall thus adjust both CS.DPL and SS.DPL here.
604 */
605 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
606 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
607 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
608 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
609 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
610 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
611
612 /*
613 * Continue validating guest-state and controls.
614 *
615 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
616 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
617 * old and new EFER value to not have any guest EFER bits influence the new
618 * nested-guest EFER.
619 */
620 uint64_t uValidEfer;
621 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
622 if (RT_FAILURE(rc))
623 {
624 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
625 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
626 }
627
628 /* Validate paging and CPU mode bits. */
629 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
630 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
631 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
632 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
633 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
634 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
635 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
636 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
637 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
638 if (fLongModeWithPaging)
639 uValidEfer |= MSR_K6_EFER_LMA;
640 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
641 if ( !fSvm
642 || (!fLongModeSupported && fLongModeActiveOrEnabled)
643 || (fLongModeWithPaging && !fPae)
644 || (fLongModeWithPaging && !fProtMode)
645 || ( fLongModeEnabled
646 && fPaging
647 && fPae
648 && fLongModeConformCS))
649 {
650 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
651 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
652 }
653
654 /*
655 * Preserve the required force-flags.
656 *
657 * We only preserve the force-flags that would affect the execution of the
658 * nested-guest (or the guest).
659 *
660 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
661 * execution of a subsequent IRET instruction in the guest.
662 *
663 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
664 * generate interrupts that should cause #VMEXITs for the nested-guest.
665 *
666 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
667 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
668 */
669 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
670 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
671
672 /*
673 * Pause filter.
674 */
675 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
676 {
677 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
678 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
679 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
680 }
681
682 /*
683 * Interrupt shadow.
684 */
685 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
686 {
687 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
688 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
689 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
690 }
691
692 /*
693 * TLB flush control.
694 * Currently disabled since it's redundant as we unconditionally flush the TLB
695 * in iemSvmWorldSwitch() below.
696 */
697# if 0
698 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
699 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
700 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
701 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
702 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
703# endif
704
705 /*
706 * Copy the remaining guest state from the VMCB to the guest-CPU context.
707 */
708 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
709 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
710 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
711 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
712 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
713 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
714 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
715 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
716 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
717 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
718 pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
719 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
720 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
721 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
722 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
723 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
724 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
725
726 /* Mask DR6, DR7 bits mandatory set/clear bits. */
727 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
728 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
729 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
730 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
731
732 /*
733 * Check for pending virtual interrupts.
734 */
735 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
736 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
737 else
738 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
739
740 /*
741 * Update PGM, IEM and others of a world-switch.
742 */
743 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
744 if (rcStrict == VINF_SUCCESS)
745 { /* likely */ }
746 else if (RT_SUCCESS(rcStrict))
747 {
748 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
749 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
750 }
751 else
752 {
753 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
754 return rcStrict;
755 }
756
757 /*
758 * Clear global interrupt flags to allow interrupts in the guest.
759 */
760 pVCpu->cpum.GstCtx.hwvirt.fGif = true;
761
762 /*
763 * Event injection.
764 */
765 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
766 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
767 if (pEventInject->n.u1Valid)
768 {
769 uint8_t const uVector = pEventInject->n.u8Vector;
770 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject);
771 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
772
773 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
774 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
775 {
776 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
777 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
778 }
779 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
780 {
781 if ( uVector == X86_XCPT_NMI
782 || uVector > X86_XCPT_LAST)
783 {
784 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
785 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
786 }
787 if ( uVector == X86_XCPT_BR
788 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
789 {
790 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
791 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
792 }
793 /** @todo any others? */
794 }
795
796 /*
797 * Invalidate the exit interrupt-information field here. This field is fully updated
798 * on #VMEXIT as events other than the one below can also cause intercepts during
799 * their injection (e.g. exceptions).
800 */
801 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
802
803 /*
804 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
805 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
806 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
807 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
808 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
809 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
810 * injecting the event through IEM here.
811 */
812 pVmcbCtrl->EventInject.n.u1Valid = 0;
813
814 /** @todo NRIP: Software interrupts can only be pushed properly if we support
815 * NRIP for the nested-guest to calculate the instruction length
816 * below. */
817 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
818 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
819 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
820
821 /*
822 * We shall not inject the event here right away. There may be paging mode related updates
823 * as a result of the world-switch above that are yet to be honored. Instead flag the event
824 * as pending for injection.
825 */
826 TRPMAssertTrap(pVCpu, uVector, enmType);
827 if (pEventInject->n.u1ErrorCodeValid)
828 TRPMSetErrorCode(pVCpu, uErrorCode);
829 if ( enmType == TRPM_TRAP
830 && uVector == X86_XCPT_PF)
831 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
832 }
833 else
834 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
835 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
836 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
837
838 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
839
840# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
841 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
842 if (HMSvmIsVGifActive(pVM))
843 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
844# endif
845
846 return rcStrict;
847 }
848
849 /* Shouldn't really happen as the caller should've validated the physical address already. */
850 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
851 return rc;
852}
853
854
855/**
856 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
857 * intercept is active.
858 *
859 * @returns Strict VBox status code.
860 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
861 * we're not executing a nested-guest.
862 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
863 * successfully.
864 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
865 * failed and a shutdown needs to be initiated for the geust.
866 *
867 * @returns VBox strict status code.
868 * @param pVCpu The cross context virtual CPU structure of the calling thread.
869 * @param u8Vector The interrupt or exception vector.
870 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
871 * @param uErr The error-code associated with the exception.
872 * @param uCr2 The CR2 value in case of a \#PF exception.
873 */
874IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPU pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
875{
876 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
877
878 /*
879 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
880 *
881 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
882 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
883 * even when they use a vector in the range 0 to 31.
884 * - ICEBP should not trigger #DB intercept, but its own intercept.
885 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
886 */
887 /* Check NMI intercept */
888 if ( u8Vector == X86_XCPT_NMI
889 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
890 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
891 {
892 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
893 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
894 }
895
896 /* Check ICEBP intercept. */
897 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
898 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
899 {
900 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
901 IEM_SVM_UPDATE_NRIP(pVCpu);
902 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
903 }
904
905 /* Check CPU exception intercepts. */
906 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
907 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
908 {
909 Assert(u8Vector <= X86_XCPT_LAST);
910 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
911 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
912 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
913 && u8Vector == X86_XCPT_PF
914 && !(uErr & X86_TRAP_PF_ID))
915 {
916 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
917# ifdef IEM_WITH_CODE_TLB
918 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
919 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
920 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
921 if ( pbInstrBuf
922 && cbInstrBuf > 0)
923 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
924# else
925 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
926 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
927 if (cbOpcode > 0)
928 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
929# endif
930 }
931 if (u8Vector == X86_XCPT_BR)
932 IEM_SVM_UPDATE_NRIP(pVCpu);
933 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
934 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl.u32InterceptXcpt,
935 u8Vector, uExitInfo1, uExitInfo2));
936 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
937 }
938
939 /* Check software interrupt (INTn) intercepts. */
940 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
941 | IEM_XCPT_FLAGS_BP_INSTR
942 | IEM_XCPT_FLAGS_ICEBP_INSTR
943 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
944 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
945 {
946 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
947 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
948 IEM_SVM_UPDATE_NRIP(pVCpu);
949 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
950 }
951
952 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
953}
954
955
956/**
957 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
958 * corresponding intercept is active.
959 *
960 * @returns Strict VBox status code.
961 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
962 * we're not executing a nested-guest.
963 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
964 * successfully.
965 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
966 * failed and a shutdown needs to be initiated for the geust.
967 *
968 * @returns VBox strict status code.
969 * @param pVCpu The cross context virtual CPU structure of the calling thread.
970 * @param u16Port The IO port being accessed.
971 * @param enmIoType The type of IO access.
972 * @param cbReg The IO operand size in bytes.
973 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
974 * @param iEffSeg The effective segment number.
975 * @param fRep Whether this is a repeating IO instruction (REP prefix).
976 * @param fStrIo Whether this is a string IO instruction.
977 * @param cbInstr The length of the IO instruction in bytes.
978 */
979IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPU pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
980 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
981{
982 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
983 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
984 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
985
986 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
987
988 SVMIOIOEXITINFO IoExitInfo;
989 void *pvIoBitmap = pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap);
990 bool const fIntercept = HMSvmIsIOInterceptActive(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep,
991 fStrIo, &IoExitInfo);
992 if (fIntercept)
993 {
994 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
995 IEM_SVM_UPDATE_NRIP(pVCpu);
996 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
997 }
998
999 /** @todo remove later (for debugging as VirtualBox always traps all IO
1000 * intercepts). */
1001 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1002 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1003}
1004
1005
1006/**
1007 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1008 * corresponding intercept is active.
1009 *
1010 * @returns Strict VBox status code.
1011 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1012 * specify interception of the accessed MSR @a idMsr.
1013 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1014 * successfully.
1015 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1016 * failed and a shutdown needs to be initiated for the geust.
1017 *
1018 * @param pVCpu The cross context virtual CPU structure.
1019 * @param idMsr The MSR being accessed in the nested-guest.
1020 * @param fWrite Whether this is an MSR write access, @c false implies an
1021 * MSR read.
1022 * @param cbInstr The length of the MSR read/write instruction in bytes.
1023 */
1024IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPU pVCpu, uint32_t idMsr, bool fWrite)
1025{
1026 /*
1027 * Check if any MSRs are being intercepted.
1028 */
1029 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1030 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1031
1032 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1033
1034 /*
1035 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1036 */
1037 uint16_t offMsrpm;
1038 uint8_t uMsrpmBit;
1039 int rc = HMSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1040 if (RT_SUCCESS(rc))
1041 {
1042 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1043 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1044 if (fWrite)
1045 ++uMsrpmBit;
1046
1047 /*
1048 * Check if the bit is set, if so, trigger a #VMEXIT.
1049 */
1050 uint8_t *pbMsrpm = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1051 pbMsrpm += offMsrpm;
1052 if (*pbMsrpm & RT_BIT(uMsrpmBit))
1053 {
1054 IEM_SVM_UPDATE_NRIP(pVCpu);
1055 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1056 }
1057 }
1058 else
1059 {
1060 /*
1061 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1062 */
1063 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1064 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1065 }
1066 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1067}
1068
1069
1070
1071/**
1072 * Implements 'VMRUN'.
1073 */
1074IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1075{
1076# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1077 RT_NOREF2(pVCpu, cbInstr);
1078 return VINF_EM_RAW_EMULATE_INSTR;
1079# else
1080 LogFlow(("iemCImpl_vmrun\n"));
1081 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1082
1083 /** @todo Check effective address size using address size prefix. */
1084 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1085 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1086 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1087 {
1088 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1089 return iemRaiseGeneralProtectionFault0(pVCpu);
1090 }
1091
1092 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1093 {
1094 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1095 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1096 }
1097
1098 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1099 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1100 {
1101 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1102 rcStrict = VINF_EM_TRIPLE_FAULT;
1103 }
1104 return rcStrict;
1105# endif
1106}
1107
1108
1109/**
1110 * Implements 'VMLOAD'.
1111 */
1112IEM_CIMPL_DEF_0(iemCImpl_vmload)
1113{
1114# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1115 RT_NOREF2(pVCpu, cbInstr);
1116 return VINF_EM_RAW_EMULATE_INSTR;
1117# else
1118 LogFlow(("iemCImpl_vmload\n"));
1119 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1120
1121 /** @todo Check effective address size using address size prefix. */
1122 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1123 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1124 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1125 {
1126 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1127 return iemRaiseGeneralProtectionFault0(pVCpu);
1128 }
1129
1130 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1131 {
1132 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1133 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1134 }
1135
1136 SVMVMCBSTATESAVE VmcbNstGst;
1137 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1138 sizeof(SVMVMCBSTATESAVE));
1139 if (rcStrict == VINF_SUCCESS)
1140 {
1141 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1142 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1143 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1144 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1145 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1146
1147 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1148 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1149 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1150 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1151 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1152
1153 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1154 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1155 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1156
1157 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1158 }
1159 return rcStrict;
1160# endif
1161}
1162
1163
1164/**
1165 * Implements 'VMSAVE'.
1166 */
1167IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1168{
1169# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1170 RT_NOREF2(pVCpu, cbInstr);
1171 return VINF_EM_RAW_EMULATE_INSTR;
1172# else
1173 LogFlow(("iemCImpl_vmsave\n"));
1174 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1175
1176 /** @todo Check effective address size using address size prefix. */
1177 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1178 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1179 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1180 {
1181 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1182 return iemRaiseGeneralProtectionFault0(pVCpu);
1183 }
1184
1185 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1186 {
1187 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1188 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1189 }
1190
1191 SVMVMCBSTATESAVE VmcbNstGst;
1192 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1193 sizeof(SVMVMCBSTATESAVE));
1194 if (rcStrict == VINF_SUCCESS)
1195 {
1196 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1197 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1198 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1199
1200 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1201 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1202 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1203 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1204
1205 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1206 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1207 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1208 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1209 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1210
1211 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1212 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1213 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1214
1215 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1216 sizeof(SVMVMCBSTATESAVE));
1217 if (rcStrict == VINF_SUCCESS)
1218 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1219 }
1220 return rcStrict;
1221# endif
1222}
1223
1224
1225/**
1226 * Implements 'CLGI'.
1227 */
1228IEM_CIMPL_DEF_0(iemCImpl_clgi)
1229{
1230# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1231 RT_NOREF2(pVCpu, cbInstr);
1232 return VINF_EM_RAW_EMULATE_INSTR;
1233# else
1234 LogFlow(("iemCImpl_clgi\n"));
1235 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1236 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1237 {
1238 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1239 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1240 }
1241
1242 pVCpu->cpum.GstCtx.hwvirt.fGif = false;
1243 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1244
1245# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1246 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1247# else
1248 return VINF_SUCCESS;
1249# endif
1250# endif
1251}
1252
1253
1254/**
1255 * Implements 'STGI'.
1256 */
1257IEM_CIMPL_DEF_0(iemCImpl_stgi)
1258{
1259# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1260 RT_NOREF2(pVCpu, cbInstr);
1261 return VINF_EM_RAW_EMULATE_INSTR;
1262# else
1263 LogFlow(("iemCImpl_stgi\n"));
1264 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1265 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1266 {
1267 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1268 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1269 }
1270
1271 pVCpu->cpum.GstCtx.hwvirt.fGif = true;
1272 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1273
1274# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1275 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1276# else
1277 return VINF_SUCCESS;
1278# endif
1279# endif
1280}
1281
1282
1283/**
1284 * Implements 'INVLPGA'.
1285 */
1286IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1287{
1288 /** @todo Check effective address size using address size prefix. */
1289 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1290 /** @todo PGM needs virtual ASID support. */
1291# if 0
1292 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1293# endif
1294
1295 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1296 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1297 {
1298 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1299 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1300 }
1301
1302 PGMInvalidatePage(pVCpu, GCPtrPage);
1303 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1304 return VINF_SUCCESS;
1305}
1306
1307
1308/**
1309 * Implements 'SKINIT'.
1310 */
1311IEM_CIMPL_DEF_0(iemCImpl_skinit)
1312{
1313 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1314
1315 uint32_t uIgnore;
1316 uint32_t fFeaturesECX;
1317 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1318 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1319 return iemRaiseUndefinedOpcode(pVCpu);
1320
1321 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1322 {
1323 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1324 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1325 }
1326
1327 RT_NOREF(cbInstr);
1328 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1329}
1330
1331
1332/**
1333 * Implements SVM's implementation of PAUSE.
1334 */
1335IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1336{
1337 bool fCheckIntercept = true;
1338 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1339 {
1340 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1341
1342 /* TSC based pause-filter thresholding. */
1343 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1344 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1345 {
1346 uint64_t const uTick = TMCpuTickGet(pVCpu);
1347 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1348 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1349 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1350 }
1351
1352 /* Simple pause-filter counter. */
1353 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1354 {
1355 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1356 fCheckIntercept = false;
1357 }
1358 }
1359
1360 if (fCheckIntercept)
1361 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1362
1363 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1364 return VINF_SUCCESS;
1365}
1366
1367#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1368
1369/**
1370 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1371 */
1372IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1373{
1374 if (EMAreHypercallInstructionsEnabled(pVCpu))
1375 {
1376 NOREF(uDisOpcode);
1377 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1378 if (RT_SUCCESS(rcStrict))
1379 {
1380 if (rcStrict == VINF_SUCCESS)
1381 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1382 if ( rcStrict == VINF_SUCCESS
1383 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1384 return VINF_SUCCESS;
1385 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1386 return rcStrict;
1387 }
1388 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1389 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1390 || rcStrict == VERR_GIM_NOT_ENABLED
1391 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1392 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1393 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1394
1395 /* Raise #UD on all failures. */
1396 }
1397 return iemRaiseUndefinedOpcode(pVCpu);
1398}
1399
1400
1401/**
1402 * Implements 'VMMCALL'.
1403 */
1404IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1405{
1406 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1407 {
1408 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1409 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1410 }
1411
1412#ifndef IN_RC
1413 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1414 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1415 if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
1416 {
1417 int rc = HMHCSvmMaybeMovTprHypercall(pVCpu);
1418 if (RT_SUCCESS(rc))
1419 {
1420 Log(("vmmcall: MovTrp\n"));
1421 return VINF_SUCCESS;
1422 }
1423 }
1424#endif
1425
1426 /* Join forces with vmcall. */
1427 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1428}
1429
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette