VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 91291

Last change on this file since 91291 was 91291, checked in by vboxsync, 3 years ago

VMM/CPUM,++: Moved the nested SVM I/O permission bitmap allocation into CPUMCTX. bugref:10093
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 60.7 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp.h 91291 2021-09-16 22:04:16Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2020 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Defined Constants And Macros *
21*********************************************************************************************************************************/
22#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23/**
24 * Check the common SVM instruction preconditions.
25 */
26# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27 do { \
28 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29 { \
30 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31 return iemRaiseUndefinedOpcode(a_pVCpu); \
32 } \
33 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34 { \
35 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36 return iemRaiseUndefinedOpcode(a_pVCpu); \
37 } \
38 if ((a_pVCpu)->iem.s.uCpl != 0) \
39 { \
40 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42 } \
43 } while (0)
44
45
46/**
47 * Converts an IEM exception event type to an SVM event type.
48 *
49 * @returns The SVM event type.
50 * @retval UINT8_MAX if the specified type of event isn't among the set
51 * of recognized IEM event types.
52 *
53 * @param uVector The vector of the event.
54 * @param fIemXcptFlags The IEM exception / interrupt flags.
55 */
56IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57{
58 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59 {
60 if (uVector != X86_XCPT_NMI)
61 return SVM_EVENT_EXCEPTION;
62 return SVM_EVENT_NMI;
63 }
64
65 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
67 return SVM_EVENT_EXCEPTION;
68
69 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70 return SVM_EVENT_EXTERNAL_IRQ;
71
72 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73 return SVM_EVENT_SOFTWARE_INT;
74
75 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76 return UINT8_MAX;
77}
78
79
80/**
81 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82 *
83 * @returns Strict VBox status code.
84 * @param pVCpu The cross context virtual CPU structure.
85 */
86DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu)
87{
88 /*
89 * Inform PGM about paging mode changes.
90 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
91 * see comment in iemMemPageTranslateAndCheckAccess().
92 */
93 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
94# ifdef IN_RING3
95 Assert(rc != VINF_PGM_CHANGE_MODE);
96# endif
97 AssertRCReturn(rc, rc);
98
99 /* Inform CPUM (recompiler), can later be removed. */
100 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
101
102 /*
103 * Flush the TLB with new CR3. This is required in case the PGM mode change
104 * above doesn't actually change anything.
105 */
106 if (rc == VINF_SUCCESS)
107 {
108 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
109 AssertRCReturn(rc, rc);
110 }
111
112 /* Re-initialize IEM cache/state after the drastic mode switch. */
113 iemReInitExec(pVCpu);
114 return rc;
115}
116
117
118/**
119 * SVM \#VMEXIT handler.
120 *
121 * @returns Strict VBox status code.
122 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
123 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
124 * "host state" and a shutdown is required.
125 *
126 * @param pVCpu The cross context virtual CPU structure.
127 * @param uExitCode The exit code.
128 * @param uExitInfo1 The exit info. 1 field.
129 * @param uExitInfo2 The exit info. 2 field.
130 */
131IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
132{
133 VBOXSTRICTRC rcStrict;
134 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
135 || uExitCode == SVM_EXIT_INVALID)
136 {
137 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
138 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
139
140 /*
141 * Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
142 */
143 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
144
145 /*
146 * Map the nested-guest VMCB from its location in guest memory.
147 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
148 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
149 */
150 PSVMVMCB pVmcbMem;
151 PGMPAGEMAPLOCK PgLockMem;
152 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
153 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
154 &PgLockMem);
155 if (rcStrict == VINF_SUCCESS)
156 {
157 /*
158 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
159 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
160 * writing the VMCB back to guest memory.
161 */
162 HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
163
164 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
165 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
166 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
167 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
168
169 /*
170 * Save the nested-guest state into the VMCB state-save area.
171 */
172 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
173 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
174 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
175 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
176 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
177 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
178 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
179 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
180 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
181 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
182 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
183 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
184 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
185 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
186 /** @todo Nested paging. */
187 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
188 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
189 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
190 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
191 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
192 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
193 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
194 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
195 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
196 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
197
198 /*
199 * Save additional state and intercept information.
200 *
201 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
202 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
203 * SVM execution.
204 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
205 */
206 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
207 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
208 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
209 else
210 {
211 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
212 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
213 }
214
215 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
216
217 if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
218 && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
219 {
220 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
221 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
222 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
223 }
224 else
225 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
226
227 /*
228 * Save nRIP, instruction length and byte fields.
229 */
230 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
231 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
232 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
233
234 /*
235 * Save exit information.
236 */
237 pVmcbMemCtrl->u64ExitCode = uExitCode;
238 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
239 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
240
241 /*
242 * Update the exit interrupt-information field if this #VMEXIT happened as a result
243 * of delivering an event through IEM.
244 *
245 * Don't update the exit interrupt-information field if the event wasn't being injected
246 * through IEM, as it would have been updated by real hardware if the nested-guest was
247 * executed using hardware-assisted SVM.
248 */
249 {
250 uint8_t uExitIntVector;
251 uint32_t uExitIntErr;
252 uint32_t fExitIntFlags;
253 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
254 NULL /* uExitIntCr2 */);
255 if (fRaisingEvent)
256 {
257 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
258 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
259 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
260 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
261 {
262 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
263 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
264 }
265 }
266 }
267
268 /*
269 * Save the exit interrupt-information field.
270 *
271 * We write the whole field including overwriting reserved bits as it was observed on an
272 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
273 */
274 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
275
276 /*
277 * Clear event injection.
278 */
279 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
280
281 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
282 }
283
284 /*
285 * Prepare for guest's "host mode" by clearing internal processor state bits.
286 *
287 * We don't need to zero out the state-save area, just the controls should be
288 * sufficient because it has the critical bit of indicating whether we're inside
289 * the nested-guest or not.
290 */
291 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
292 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
293
294 /*
295 * Restore the subset of force-flags that were preserved.
296 */
297 if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
298 {
299 VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
300 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
301 }
302
303 if (rcStrict == VINF_SUCCESS)
304 {
305 /** @todo Nested paging. */
306 /** @todo ASID. */
307
308 /*
309 * Reload the guest's "host state".
310 */
311 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
312
313 /*
314 * Update PGM, IEM and others of a world-switch.
315 */
316 rcStrict = iemSvmWorldSwitch(pVCpu);
317 if (rcStrict == VINF_SUCCESS)
318 rcStrict = VINF_SVM_VMEXIT;
319 else if (RT_SUCCESS(rcStrict))
320 {
321 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
322 iemSetPassUpStatus(pVCpu, rcStrict);
323 rcStrict = VINF_SVM_VMEXIT;
324 }
325 else
326 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
327 }
328 else
329 {
330 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
331 rcStrict = VERR_SVM_VMEXIT_FAILED;
332 }
333 }
334 else
335 {
336 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
337 rcStrict = VERR_SVM_IPE_3;
338 }
339
340# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
341 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
342 if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
343 && HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
344 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
345# endif
346 return rcStrict;
347}
348
349
350/**
351 * Performs the operations necessary that are part of the vmrun instruction
352 * execution in the guest.
353 *
354 * @returns Strict VBox status code (i.e. informational status codes too).
355 * @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
356 * code execution.
357 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
358 * (SVM_EXIT_INVALID most likely).
359 *
360 * @param pVCpu The cross context virtual CPU structure.
361 * @param cbInstr The length of the VMRUN instruction.
362 * @param GCPhysVmcb Guest physical address of the VMCB to run.
363 */
364IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
365{
366 LogFlow(("iemSvmVmrun\n"));
367
368 /*
369 * Cache the physical address of the VMCB for #VMEXIT exceptions.
370 */
371 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
372
373 /*
374 * Save the host state.
375 */
376 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
377
378 /*
379 * Read the guest VMCB.
380 */
381 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
382 int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
383 if (RT_SUCCESS(rc))
384 {
385 /*
386 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
387 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
388 * but in our implementation we try to preserve as much as we possibly can.
389 *
390 * We could read the entire page here and only write back the relevant fields on
391 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
392 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
393 * currently reserved but may be recognized as features bits in future CPUs causing
394 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
395 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
396 */
397 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
398 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
399
400 RT_ZERO(pVmcbCtrl->u8Reserved0);
401 RT_ZERO(pVmcbCtrl->u8Reserved1);
402 RT_ZERO(pVmcbCtrl->u8Reserved2);
403 RT_ZERO(pVmcbNstGst->u8Reserved0);
404 RT_ZERO(pVmcbNstGst->u8Reserved1);
405 RT_ZERO(pVmcbNstGst->u8Reserved2);
406 RT_ZERO(pVmcbNstGst->u8Reserved3);
407 RT_ZERO(pVmcbNstGst->u8Reserved4);
408 RT_ZERO(pVmcbNstGst->u8Reserved5);
409 pVmcbCtrl->u32Reserved0 = 0;
410 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
411 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
412 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
413 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
414 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
415 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
416 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
417 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
418 pVmcbCtrl->EventInject.n.u19Reserved = 0;
419 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
420
421 /*
422 * Validate guest-state and controls.
423 */
424 /* VMRUN must always be intercepted. */
425 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
426 {
427 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
428 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
429 }
430
431 /* Nested paging. */
432 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
433 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
434 {
435 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
436 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
437 }
438
439 /* AVIC. */
440 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
441 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
442 {
443 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
444 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
445 }
446
447 /* Last branch record (LBR) virtualization. */
448 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
449 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
450 {
451 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
452 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
453 }
454
455 /* Virtualized VMSAVE/VMLOAD. */
456 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
457 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
458 {
459 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
460 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
461 }
462
463 /* Virtual GIF. */
464 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
465 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
466 {
467 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
468 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
469 }
470
471 /* Guest ASID. */
472 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
473 {
474 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
475 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
476 }
477
478 /* Guest AVIC. */
479 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
480 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
481 {
482 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
483 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
484 }
485
486 /* Guest Secure Encrypted Virtualization. */
487 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
488 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
489 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
490 {
491 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
492 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
493 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
494 }
495
496 /* Flush by ASID. */
497 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
498 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
499 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
500 {
501 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
502 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
503 }
504
505 /* IO permission bitmap. */
506 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
507 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
508 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
509 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
510 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
511 {
512 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
513 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
514 }
515
516 /* MSR permission bitmap. */
517 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
518 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
519 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
520 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
521 {
522 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
523 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
524 }
525
526 /* CR0. */
527 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
528 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
529 {
530 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
531 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
532 }
533 if (pVmcbNstGst->u64CR0 >> 32)
534 {
535 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
536 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
537 }
538 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
539
540 /* DR6 and DR7. */
541 if ( pVmcbNstGst->u64DR6 >> 32
542 || pVmcbNstGst->u64DR7 >> 32)
543 {
544 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
545 pVmcbNstGst->u64DR6));
546 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
547 }
548
549 /*
550 * PAT (Page Attribute Table) MSR.
551 *
552 * The CPU only validates and loads it when nested-paging is enabled.
553 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
554 */
555 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
556 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
557 {
558 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
559 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
560 }
561
562 /*
563 * Copy the IO permission bitmap into the cache.
564 */
565 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
566 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
567 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
568 if (RT_FAILURE(rc))
569 {
570 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
571 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
572 }
573
574 /*
575 * Copy the MSR permission bitmap into the cache.
576 */
577 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
578 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
579 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
580 if (RT_FAILURE(rc))
581 {
582 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
583 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
584 }
585
586 /*
587 * Copy segments from nested-guest VMCB state to the guest-CPU state.
588 *
589 * We do this here as we need to use the CS attributes and it's easier this way
590 * then using the VMCB format selectors. It doesn't really matter where we copy
591 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
592 */
593 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
594 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
595 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
596 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
597
598 /** @todo Segment attribute overrides by VMRUN. */
599
600 /*
601 * CPL adjustments and overrides.
602 *
603 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
604 * We shall thus adjust both CS.DPL and SS.DPL here.
605 */
606 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
607 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
608 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
609 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
610 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
611 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
612
613 /*
614 * Continue validating guest-state and controls.
615 *
616 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
617 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
618 * old and new EFER value to not have any guest EFER bits influence the new
619 * nested-guest EFER.
620 */
621 uint64_t uValidEfer;
622 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
623 if (RT_FAILURE(rc))
624 {
625 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
626 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
627 }
628
629 /* Validate paging and CPU mode bits. */
630 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
631 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
632 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
633 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
634 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
635 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
636 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
637 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
638 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
639 if (fLongModeWithPaging)
640 uValidEfer |= MSR_K6_EFER_LMA;
641 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
642 if ( !fSvm
643 || (!fLongModeSupported && fLongModeActiveOrEnabled)
644 || (fLongModeWithPaging && !fPae)
645 || (fLongModeWithPaging && !fProtMode)
646 || ( fLongModeEnabled
647 && fPaging
648 && fPae
649 && fLongModeConformCS))
650 {
651 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
652 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
653 }
654
655 /*
656 * Preserve the required force-flags.
657 *
658 * We only preserve the force-flags that would affect the execution of the
659 * nested-guest (or the guest).
660 *
661 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
662 * execution of a subsequent IRET instruction in the guest.
663 *
664 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
665 * generate interrupts that should cause #VMEXITs for the nested-guest.
666 *
667 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
668 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
669 */
670 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
671 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
672
673 /*
674 * Pause filter.
675 */
676 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
677 {
678 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
679 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
680 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
681 }
682
683 /*
684 * Interrupt shadow.
685 */
686 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
687 {
688 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
689 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
690 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
691 }
692
693 /*
694 * TLB flush control.
695 * Currently disabled since it's redundant as we unconditionally flush the TLB
696 * in iemSvmWorldSwitch() below.
697 */
698# if 0
699 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
700 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
701 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
702 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
703 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
704# endif
705
706 /*
707 * Copy the remaining guest state from the VMCB to the guest-CPU context.
708 */
709 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
710 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
711 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
712 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
713 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
714 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
715 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
716 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
717 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
718 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
719 pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
720 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
721 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
722 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
723 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
724 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
725 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
726
727 /* Mask DR6, DR7 bits mandatory set/clear bits. */
728 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
729 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
730 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
731 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
732
733 /*
734 * Check for pending virtual interrupts.
735 */
736 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
737 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
738 else
739 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
740
741 /*
742 * Update PGM, IEM and others of a world-switch.
743 */
744 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
745 if (rcStrict == VINF_SUCCESS)
746 { /* likely */ }
747 else if (RT_SUCCESS(rcStrict))
748 {
749 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
750 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
751 }
752 else
753 {
754 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
755 return rcStrict;
756 }
757
758 /*
759 * Set the global-interrupt flag to allow interrupts in the guest.
760 */
761 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
762
763 /*
764 * Event injection.
765 */
766 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
767 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
768 if (pEventInject->n.u1Valid)
769 {
770 uint8_t const uVector = pEventInject->n.u8Vector;
771 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
772 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
773
774 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
775 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
776 {
777 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
778 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
779 }
780 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
781 {
782 if ( uVector == X86_XCPT_NMI
783 || uVector > X86_XCPT_LAST)
784 {
785 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
786 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
787 }
788 if ( uVector == X86_XCPT_BR
789 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
790 {
791 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
792 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
793 }
794 /** @todo any others? */
795 }
796
797 /*
798 * Invalidate the exit interrupt-information field here. This field is fully updated
799 * on #VMEXIT as events other than the one below can also cause intercepts during
800 * their injection (e.g. exceptions).
801 */
802 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
803
804 /*
805 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
806 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
807 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
808 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
809 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
810 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
811 * injecting the event through IEM here.
812 */
813 pVmcbCtrl->EventInject.n.u1Valid = 0;
814
815 /** @todo NRIP: Software interrupts can only be pushed properly if we support
816 * NRIP for the nested-guest to calculate the instruction length
817 * below. */
818 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
819 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
820 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
821
822 /*
823 * We shall not inject the event here right away. There may be paging mode related updates
824 * as a result of the world-switch above that are yet to be honored. Instead flag the event
825 * as pending for injection.
826 */
827 TRPMAssertTrap(pVCpu, uVector, enmType);
828 if (pEventInject->n.u1ErrorCodeValid)
829 TRPMSetErrorCode(pVCpu, uErrorCode);
830 if ( enmType == TRPM_TRAP
831 && uVector == X86_XCPT_PF)
832 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
833 }
834 else
835 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
836 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
837 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
838
839 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
840
841# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
842 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
843 if ( HMIsEnabled(pVM)
844 && HMIsSvmVGifActive(pVM))
845 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
846# endif
847
848 return rcStrict;
849 }
850
851 /* Shouldn't really happen as the caller should've validated the physical address already. */
852 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
853 return rc;
854}
855
856
857/**
858 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
859 * intercept is active.
860 *
861 * @returns Strict VBox status code.
862 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
863 * we're not executing a nested-guest.
864 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
865 * successfully.
866 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
867 * failed and a shutdown needs to be initiated for the guest.
868 *
869 * @returns VBox strict status code.
870 * @param pVCpu The cross context virtual CPU structure of the calling thread.
871 * @param u8Vector The interrupt or exception vector.
872 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
873 * @param uErr The error-code associated with the exception.
874 * @param uCr2 The CR2 value in case of a \#PF exception.
875 */
876IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
877{
878 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
879
880 /*
881 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
882 *
883 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
884 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
885 * even when they use a vector in the range 0 to 31.
886 * - ICEBP should not trigger #DB intercept, but its own intercept.
887 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
888 */
889 /* Check NMI intercept */
890 if ( u8Vector == X86_XCPT_NMI
891 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
892 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
893 {
894 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
895 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
896 }
897
898 /* Check ICEBP intercept. */
899 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
900 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
901 {
902 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
903 IEM_SVM_UPDATE_NRIP(pVCpu);
904 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
905 }
906
907 /* Check CPU exception intercepts. */
908 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
909 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
910 {
911 Assert(u8Vector <= X86_XCPT_LAST);
912 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
913 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
914 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
915 && u8Vector == X86_XCPT_PF
916 && !(uErr & X86_TRAP_PF_ID))
917 {
918 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
919# ifdef IEM_WITH_CODE_TLB
920 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
921 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
922 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
923 if ( pbInstrBuf
924 && cbInstrBuf > 0)
925 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
926# else
927 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
928 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
929 if (cbOpcode > 0)
930 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
931# endif
932 }
933 if (u8Vector == X86_XCPT_BR)
934 IEM_SVM_UPDATE_NRIP(pVCpu);
935 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
936 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
937 u8Vector, uExitInfo1, uExitInfo2));
938 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
939 }
940
941 /* Check software interrupt (INTn) intercepts. */
942 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
943 | IEM_XCPT_FLAGS_BP_INSTR
944 | IEM_XCPT_FLAGS_ICEBP_INSTR
945 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
946 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
947 {
948 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
949 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
950 IEM_SVM_UPDATE_NRIP(pVCpu);
951 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
952 }
953
954 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
955}
956
957
958/**
959 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
960 * corresponding intercept is active.
961 *
962 * @returns Strict VBox status code.
963 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
964 * we're not executing a nested-guest.
965 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
966 * successfully.
967 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
968 * failed and a shutdown needs to be initiated for the guest.
969 *
970 * @returns VBox strict status code.
971 * @param pVCpu The cross context virtual CPU structure of the calling thread.
972 * @param u16Port The IO port being accessed.
973 * @param enmIoType The type of IO access.
974 * @param cbReg The IO operand size in bytes.
975 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
976 * @param iEffSeg The effective segment number.
977 * @param fRep Whether this is a repeating IO instruction (REP prefix).
978 * @param fStrIo Whether this is a string IO instruction.
979 * @param cbInstr The length of the IO instruction in bytes.
980 */
981IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
982 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
983{
984 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
985 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
986 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
987
988 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
989
990 SVMIOIOEXITINFO IoExitInfo;
991 bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
992 cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
993 if (fIntercept)
994 {
995 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
996 IEM_SVM_UPDATE_NRIP(pVCpu);
997 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
998 }
999
1000 /** @todo remove later (for debugging as VirtualBox always traps all IO
1001 * intercepts). */
1002 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1003 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1004}
1005
1006
1007/**
1008 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1009 * corresponding intercept is active.
1010 *
1011 * @returns Strict VBox status code.
1012 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1013 * specify interception of the accessed MSR @a idMsr.
1014 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1015 * successfully.
1016 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1017 * failed and a shutdown needs to be initiated for the guest.
1018 *
1019 * @param pVCpu The cross context virtual CPU structure.
1020 * @param idMsr The MSR being accessed in the nested-guest.
1021 * @param fWrite Whether this is an MSR write access, @c false implies an
1022 * MSR read.
1023 * @param cbInstr The length of the MSR read/write instruction in bytes.
1024 */
1025IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite)
1026{
1027 /*
1028 * Check if any MSRs are being intercepted.
1029 */
1030 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1031 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1032
1033 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1034
1035 /*
1036 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1037 */
1038 uint16_t offMsrpm;
1039 uint8_t uMsrpmBit;
1040 int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1041 if (RT_SUCCESS(rc))
1042 {
1043 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1044 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1045 if (fWrite)
1046 ++uMsrpmBit;
1047
1048 /*
1049 * Check if the bit is set, if so, trigger a #VMEXIT.
1050 */
1051 if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1052 {
1053 IEM_SVM_UPDATE_NRIP(pVCpu);
1054 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1055 }
1056 }
1057 else
1058 {
1059 /*
1060 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1061 */
1062 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1063 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1064 }
1065 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1066}
1067
1068
1069
1070/**
1071 * Implements 'VMRUN'.
1072 */
1073IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1074{
1075# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1076 RT_NOREF2(pVCpu, cbInstr);
1077 return VINF_EM_RAW_EMULATE_INSTR;
1078# else
1079 LogFlow(("iemCImpl_vmrun\n"));
1080 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1081
1082 /** @todo Check effective address size using address size prefix. */
1083 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1084 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1085 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1086 {
1087 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1088 return iemRaiseGeneralProtectionFault0(pVCpu);
1089 }
1090
1091 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1092 {
1093 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1094 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1095 }
1096
1097 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1098 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1099 {
1100 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1101 rcStrict = VINF_EM_TRIPLE_FAULT;
1102 }
1103 return rcStrict;
1104# endif
1105}
1106
1107
1108/**
1109 * Implements 'VMLOAD'.
1110 */
1111IEM_CIMPL_DEF_0(iemCImpl_vmload)
1112{
1113# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1114 RT_NOREF2(pVCpu, cbInstr);
1115 return VINF_EM_RAW_EMULATE_INSTR;
1116# else
1117 LogFlow(("iemCImpl_vmload\n"));
1118 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1119
1120 /** @todo Check effective address size using address size prefix. */
1121 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1122 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1123 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1124 {
1125 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1126 return iemRaiseGeneralProtectionFault0(pVCpu);
1127 }
1128
1129 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1130 {
1131 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1132 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1133 }
1134
1135 SVMVMCBSTATESAVE VmcbNstGst;
1136 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1137 sizeof(SVMVMCBSTATESAVE));
1138 if (rcStrict == VINF_SUCCESS)
1139 {
1140 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1141 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1142 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1143 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1144 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1145
1146 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1147 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1148 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1149 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1150 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1151
1152 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1153 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1154 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1155
1156 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1157 }
1158 return rcStrict;
1159# endif
1160}
1161
1162
1163/**
1164 * Implements 'VMSAVE'.
1165 */
1166IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1167{
1168# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1169 RT_NOREF2(pVCpu, cbInstr);
1170 return VINF_EM_RAW_EMULATE_INSTR;
1171# else
1172 LogFlow(("iemCImpl_vmsave\n"));
1173 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1174
1175 /** @todo Check effective address size using address size prefix. */
1176 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1177 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1178 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1179 {
1180 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1181 return iemRaiseGeneralProtectionFault0(pVCpu);
1182 }
1183
1184 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1185 {
1186 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1187 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1188 }
1189
1190 SVMVMCBSTATESAVE VmcbNstGst;
1191 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1192 sizeof(SVMVMCBSTATESAVE));
1193 if (rcStrict == VINF_SUCCESS)
1194 {
1195 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1196 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1197 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1198
1199 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1200 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1201 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1202 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1203
1204 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1205 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1206 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1207 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1208 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1209
1210 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1211 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1212 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1213
1214 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1215 sizeof(SVMVMCBSTATESAVE));
1216 if (rcStrict == VINF_SUCCESS)
1217 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1218 }
1219 return rcStrict;
1220# endif
1221}
1222
1223
1224/**
1225 * Implements 'CLGI'.
1226 */
1227IEM_CIMPL_DEF_0(iemCImpl_clgi)
1228{
1229# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1230 RT_NOREF2(pVCpu, cbInstr);
1231 return VINF_EM_RAW_EMULATE_INSTR;
1232# else
1233 LogFlow(("iemCImpl_clgi\n"));
1234 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1235 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1236 {
1237 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1238 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1239 }
1240
1241 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1242 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1243
1244# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1245 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1246# else
1247 return VINF_SUCCESS;
1248# endif
1249# endif
1250}
1251
1252
1253/**
1254 * Implements 'STGI'.
1255 */
1256IEM_CIMPL_DEF_0(iemCImpl_stgi)
1257{
1258# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1259 RT_NOREF2(pVCpu, cbInstr);
1260 return VINF_EM_RAW_EMULATE_INSTR;
1261# else
1262 LogFlow(("iemCImpl_stgi\n"));
1263 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1264 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1265 {
1266 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1267 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1268 }
1269
1270 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1271 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1272
1273# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1274 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1275# else
1276 return VINF_SUCCESS;
1277# endif
1278# endif
1279}
1280
1281
1282/**
1283 * Implements 'INVLPGA'.
1284 */
1285IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1286{
1287 /** @todo Check effective address size using address size prefix. */
1288 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1289 /** @todo PGM needs virtual ASID support. */
1290# if 0
1291 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1292# endif
1293
1294 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1295 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1296 {
1297 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1298 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1299 }
1300
1301 PGMInvalidatePage(pVCpu, GCPtrPage);
1302 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1303 return VINF_SUCCESS;
1304}
1305
1306
1307/**
1308 * Implements 'SKINIT'.
1309 */
1310IEM_CIMPL_DEF_0(iemCImpl_skinit)
1311{
1312 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1313
1314 uint32_t uIgnore;
1315 uint32_t fFeaturesECX;
1316 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1317 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1318 return iemRaiseUndefinedOpcode(pVCpu);
1319
1320 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1321 {
1322 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1323 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1324 }
1325
1326 RT_NOREF(cbInstr);
1327 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1328}
1329
1330
1331/**
1332 * Implements SVM's implementation of PAUSE.
1333 */
1334IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1335{
1336 bool fCheckIntercept = true;
1337 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1338 {
1339 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1340
1341 /* TSC based pause-filter thresholding. */
1342 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1343 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1344 {
1345 uint64_t const uTick = TMCpuTickGet(pVCpu);
1346 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1347 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1348 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1349 }
1350
1351 /* Simple pause-filter counter. */
1352 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1353 {
1354 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1355 fCheckIntercept = false;
1356 }
1357 }
1358
1359 if (fCheckIntercept)
1360 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1361
1362 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1363 return VINF_SUCCESS;
1364}
1365
1366#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1367
1368/**
1369 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1370 */
1371IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1372{
1373 if (EMAreHypercallInstructionsEnabled(pVCpu))
1374 {
1375 NOREF(uDisOpcode);
1376 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1377 if (RT_SUCCESS(rcStrict))
1378 {
1379 if (rcStrict == VINF_SUCCESS)
1380 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1381 if ( rcStrict == VINF_SUCCESS
1382 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1383 return VINF_SUCCESS;
1384 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1385 return rcStrict;
1386 }
1387 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1388 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1389 || rcStrict == VERR_GIM_NOT_ENABLED
1390 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1391 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1392 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1393
1394 /* Raise #UD on all failures. */
1395 }
1396 return iemRaiseUndefinedOpcode(pVCpu);
1397}
1398
1399
1400/**
1401 * Implements 'VMMCALL'.
1402 */
1403IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1404{
1405 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1406 {
1407 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1408 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1409 }
1410
1411 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1412 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1413 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1414 if (VM_IS_HM_ENABLED(pVM))
1415 {
1416 int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1417 if (RT_SUCCESS(rc))
1418 {
1419 Log(("vmmcall: MovTpr\n"));
1420 return VINF_SUCCESS;
1421 }
1422 }
1423
1424 /* Join forces with vmcall. */
1425 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1426}
1427
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette