IEMAllCImplSvmInstr.cpp.h@ 92489

Last change on this file since 92489 was 91580, checked in by vboxsync, 3 years ago
VMM: Nested VMX: bugref:10092 Made changes to PGM++ to handle invalid PAE PDPEs being loaded.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 62.4 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 91580 2021-10-06 07:22:04Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Defined Constants And Macros *
21	*********************************************************************************************************************************/
22	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23	/**
24	* Check the common SVM instruction preconditions.
25	*/
26	# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27	do { \
28	if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29	{ \
30	Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31	return iemRaiseUndefinedOpcode(a_pVCpu); \
32	} \
33	if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34	{ \
35	Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36	return iemRaiseUndefinedOpcode(a_pVCpu); \
37	} \
38	if ((a_pVCpu)->iem.s.uCpl != 0) \
39	{ \
40	Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41	return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42	} \
43	} while (0)
44
45
46	/**
47	* Converts an IEM exception event type to an SVM event type.
48	*
49	* @returns The SVM event type.
50	* @retval UINT8_MAX if the specified type of event isn't among the set
51	* of recognized IEM event types.
52	*
53	* @param uVector The vector of the event.
54	* @param fIemXcptFlags The IEM exception / interrupt flags.
55	*/
56	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57	{
58	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59	{
60	if (uVector != X86_XCPT_NMI)
61	return SVM_EVENT_EXCEPTION;
62	return SVM_EVENT_NMI;
63	}
64
65	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
67	return SVM_EVENT_EXCEPTION;
68
69	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70	return SVM_EVENT_EXTERNAL_IRQ;
71
72	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73	return SVM_EVENT_SOFTWARE_INT;
74
75	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76	return UINT8_MAX;
77	}
78
79
80	/**
81	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82	*
83	* @returns Strict VBox status code.
84	* @param pVCpu The cross context virtual CPU structure.
85	* @param fPdpesMapped Whether the PAE PDPEs (and PDPT) have been mapped.
86	*/
87	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, bool fPdpesMapped)
88	{
89	/*
90	* Inform PGM about paging mode changes.
91	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
92	* see comment in iemMemPageTranslateAndCheckAccess().
93	*/
94	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
95	# ifdef IN_RING3
96	Assert(rc != VINF_PGM_CHANGE_MODE);
97	# endif
98	AssertRCReturn(rc, rc);
99
100	/* Inform CPUM (recompiler), can later be removed. */
101	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
102
103	/*
104	* Flush the TLB with new CR3. This is required in case the PGM mode change
105	* above doesn't actually change anything.
106	*/
107	if (rc == VINF_SUCCESS)
108	{
109	rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* fGlobal */, fPdpesMapped);
110	AssertRCReturn(rc, rc);
111	}
112
113	/* Re-initialize IEM cache/state after the drastic mode switch. */
114	iemReInitExec(pVCpu);
115	return rc;
116	}
117
118
119	/**
120	* SVM \#VMEXIT handler.
121	*
122	* @returns Strict VBox status code.
123	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
124	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
125	* "host state" and a shutdown is required.
126	*
127	* @param pVCpu The cross context virtual CPU structure.
128	* @param uExitCode The exit code.
129	* @param uExitInfo1 The exit info. 1 field.
130	* @param uExitInfo2 The exit info. 2 field.
131	*/
132	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
133	{
134	VBOXSTRICTRC rcStrict;
135	if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
136	\|\| uExitCode == SVM_EXIT_INVALID)
137	{
138	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
139	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
140
141	/*
142	* Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
143	*/
144	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
145
146	/*
147	* Map the nested-guest VMCB from its location in guest memory.
148	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
149	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
150	*/
151	PSVMVMCB pVmcbMem;
152	PGMPAGEMAPLOCK PgLockMem;
153	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
154	rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
155	&PgLockMem);
156	if (rcStrict == VINF_SUCCESS)
157	{
158	/*
159	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
160	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
161	* writing the VMCB back to guest memory.
162	*/
163	HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
164
165	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
166	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
167	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
168	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
169
170	/*
171	* Save the nested-guest state into the VMCB state-save area.
172	*/
173	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
174	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
175	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
176	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
177	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
178	pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
179	pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
180	pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
181	pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
182	pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
183	pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
184	pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
185	pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
186	pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
187	/** @todo Nested paging. */
188	pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
189	pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
190	pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
191	pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
192	pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
193	pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
194	pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
195	Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
196	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
197	pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
198
199	/*
200	* Save additional state and intercept information.
201	*
202	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
203	* - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
204	* SVM execution.
205	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
206	*/
207	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
208	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
209	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
210	else
211	{
212	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
213	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
214	}
215
216	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
217
218	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
219	&& EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
220	{
221	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
222	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
223	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
224	}
225	else
226	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
227
228	/*
229	* Save nRIP, instruction length and byte fields.
230	*/
231	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
232	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
233	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
234
235	/*
236	* Save exit information.
237	*/
238	pVmcbMemCtrl->u64ExitCode = uExitCode;
239	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
240	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
241
242	/*
243	* Update the exit interrupt-information field if this #VMEXIT happened as a result
244	* of delivering an event through IEM.
245	*
246	* Don't update the exit interrupt-information field if the event wasn't being injected
247	* through IEM, as it would have been updated by real hardware if the nested-guest was
248	* executed using hardware-assisted SVM.
249	*/
250	{
251	uint8_t uExitIntVector;
252	uint32_t uExitIntErr;
253	uint32_t fExitIntFlags;
254	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
255	NULL /* uExitIntCr2 */);
256	if (fRaisingEvent)
257	{
258	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
259	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
260	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
261	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
262	{
263	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
264	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
265	}
266	}
267	}
268
269	/*
270	* Save the exit interrupt-information field.
271	*
272	* We write the whole field including overwriting reserved bits as it was observed on an
273	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
274	*/
275	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
276
277	/*
278	* Clear event injection.
279	*/
280	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
281
282	iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
283	}
284
285	/*
286	* Prepare for guest's "host mode" by clearing internal processor state bits.
287	*
288	* We don't need to zero out the state-save area, just the controls should be
289	* sufficient because it has the critical bit of indicating whether we're inside
290	* the nested-guest or not.
291	*/
292	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
293	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
294
295	/*
296	* Restore the subset of force-flags that were preserved.
297	*/
298	if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
299	{
300	VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
301	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
302	}
303
304	if (rcStrict == VINF_SUCCESS)
305	{
306	/** @todo Nested paging. */
307	/** @todo ASID. */
308
309	/*
310	* If we are switching to PAE mode host, validate the PDPEs first.
311	* Any invalid PDPEs here causes a VCPU shutdown.
312	*/
313	PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
314	bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
315	if (fHostInPaeMode)
316	rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
317	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
318	{
319	/*
320	* Reload the host state.
321	*/
322	CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
323
324	/*
325	* Update PGM, IEM and others of a world-switch.
326	*/
327	rcStrict = iemSvmWorldSwitch(pVCpu, fHostInPaeMode);
328	if (rcStrict == VINF_SUCCESS)
329	rcStrict = VINF_SVM_VMEXIT;
330	else if (RT_SUCCESS(rcStrict))
331	{
332	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
333	iemSetPassUpStatus(pVCpu, rcStrict);
334	rcStrict = VINF_SVM_VMEXIT;
335	}
336	else
337	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
338	}
339	else
340	{
341	Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
342	rcStrict = VINF_EM_TRIPLE_FAULT;
343	}
344	}
345	else
346	{
347	AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
348	rcStrict = VINF_EM_TRIPLE_FAULT;
349	}
350	}
351	else
352	{
353	AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
354	rcStrict = VERR_SVM_IPE_3;
355	}
356
357	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
358	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
359	if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
360	&& HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
361	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
362	# endif
363	return rcStrict;
364	}
365
366
367	/**
368	* Performs the operations necessary that are part of the vmrun instruction
369	* execution in the guest.
370	*
371	* @returns Strict VBox status code (i.e. informational status codes too).
372	* @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
373	* code execution.
374	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
375	* (SVM_EXIT_INVALID most likely).
376	*
377	* @param pVCpu The cross context virtual CPU structure.
378	* @param cbInstr The length of the VMRUN instruction.
379	* @param GCPhysVmcb Guest physical address of the VMCB to run.
380	*/
381	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
382	{
383	LogFlow(("iemSvmVmrun\n"));
384
385	/*
386	* Cache the physical address of the VMCB for #VMEXIT exceptions.
387	*/
388	pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
389
390	/*
391	* Save the host state.
392	*/
393	CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
394
395	/*
396	* Read the guest VMCB.
397	*/
398	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
399	int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
400	if (RT_SUCCESS(rc))
401	{
402	/*
403	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
404	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
405	* but in our implementation we try to preserve as much as we possibly can.
406	*
407	* We could read the entire page here and only write back the relevant fields on
408	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
409	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
410	* currently reserved but may be recognized as features bits in future CPUs causing
411	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
412	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
413	*/
414	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
415	PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
416
417	RT_ZERO(pVmcbCtrl->u8Reserved0);
418	RT_ZERO(pVmcbCtrl->u8Reserved1);
419	RT_ZERO(pVmcbCtrl->u8Reserved2);
420	RT_ZERO(pVmcbNstGst->u8Reserved0);
421	RT_ZERO(pVmcbNstGst->u8Reserved1);
422	RT_ZERO(pVmcbNstGst->u8Reserved2);
423	RT_ZERO(pVmcbNstGst->u8Reserved3);
424	RT_ZERO(pVmcbNstGst->u8Reserved4);
425	RT_ZERO(pVmcbNstGst->u8Reserved5);
426	pVmcbCtrl->u32Reserved0 = 0;
427	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
428	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
429	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
430	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
431	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
432	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
433	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
434	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
435	pVmcbCtrl->EventInject.n.u19Reserved = 0;
436	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
437
438	/*
439	* Validate guest-state and controls.
440	*/
441	/* VMRUN must always be intercepted. */
442	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
443	{
444	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
445	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
446	}
447
448	/* Nested paging. */
449	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
450	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
451	{
452	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
453	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
454	}
455
456	/* AVIC. */
457	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
458	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
459	{
460	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
461	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
462	}
463
464	/* Last branch record (LBR) virtualization. */
465	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
466	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
467	{
468	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
469	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
470	}
471
472	/* Virtualized VMSAVE/VMLOAD. */
473	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
474	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
475	{
476	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
477	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
478	}
479
480	/* Virtual GIF. */
481	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
482	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
483	{
484	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
485	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
486	}
487
488	/* Guest ASID. */
489	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
490	{
491	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
492	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
493	}
494
495	/* Guest AVIC. */
496	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
497	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
498	{
499	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
500	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
501	}
502
503	/* Guest Secure Encrypted Virtualization. */
504	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
505	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
506	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
507	{
508	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
509	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
510	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
511	}
512
513	/* Flush by ASID. */
514	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
515	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
516	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
517	{
518	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
519	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
520	}
521
522	/* IO permission bitmap. */
523	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
524	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
525	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
526	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
527	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
528	{
529	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
530	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
531	}
532
533	/* MSR permission bitmap. */
534	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
535	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
536	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
537	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
538	{
539	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
540	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
541	}
542
543	/* CR0. */
544	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
545	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
546	{
547	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
548	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
549	}
550	if (pVmcbNstGst->u64CR0 >> 32)
551	{
552	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
553	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
554	}
555	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
556
557	/* DR6 and DR7. */
558	if ( pVmcbNstGst->u64DR6 >> 32
559	\|\| pVmcbNstGst->u64DR7 >> 32)
560	{
561	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
562	pVmcbNstGst->u64DR6));
563	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
564	}
565
566	/*
567	* PAT (Page Attribute Table) MSR.
568	*
569	* The CPU only validates and loads it when nested-paging is enabled.
570	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
571	*/
572	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
573	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
574	{
575	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
576	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
577	}
578
579	/*
580	* Copy the IO permission bitmap into the cache.
581	*/
582	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
583	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
584	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
585	if (RT_FAILURE(rc))
586	{
587	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
588	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
589	}
590
591	/*
592	* Copy the MSR permission bitmap into the cache.
593	*/
594	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
595	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
596	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
597	if (RT_FAILURE(rc))
598	{
599	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
600	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
601	}
602
603	/*
604	* Copy segments from nested-guest VMCB state to the guest-CPU state.
605	*
606	* We do this here as we need to use the CS attributes and it's easier this way
607	* then using the VMCB format selectors. It doesn't really matter where we copy
608	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
609	*/
610	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
611	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
612	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
613	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
614
615	/** @todo Segment attribute overrides by VMRUN. */
616
617	/*
618	* CPL adjustments and overrides.
619	*
620	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
621	* We shall thus adjust both CS.DPL and SS.DPL here.
622	*/
623	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
624	if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
625	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
626	if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
627	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
628	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
629
630	/*
631	* Continue validating guest-state and controls.
632	*
633	* We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
634	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
635	* old and new EFER value to not have any guest EFER bits influence the new
636	* nested-guest EFER.
637	*/
638	uint64_t uValidEfer;
639	rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
640	if (RT_FAILURE(rc))
641	{
642	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
643	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
644	}
645
646	/* Validate paging and CPU mode bits. */
647	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
648	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
649	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
650	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
651	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
652	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
653	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
654	bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
655	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
656	if (fLongModeWithPaging)
657	uValidEfer \|= MSR_K6_EFER_LMA;
658	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
659	if ( !fSvm
660	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
661	\|\| (fLongModeWithPaging && !fPae)
662	\|\| (fLongModeWithPaging && !fProtMode)
663	\|\| ( fLongModeEnabled
664	&& fPaging
665	&& fPae
666	&& fLongModeConformCS))
667	{
668	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
669	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
670	}
671
672	/*
673	* Preserve the required force-flags.
674	*
675	* We only preserve the force-flags that would affect the execution of the
676	* nested-guest (or the guest).
677	*
678	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
679	* execution of a subsequent IRET instruction in the guest.
680	*
681	* The remaining FFs (e.g. timers) can stay in place so that we will be able to
682	* generate interrupts that should cause #VMEXITs for the nested-guest.
683	*
684	* VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
685	* preserve VMCPU_FF_INHIBIT_INTERRUPTS.
686	*/
687	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
688	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
689
690	/*
691	* Pause filter.
692	*/
693	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
694	{
695	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
696	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
697	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
698	}
699
700	/*
701	* Interrupt shadow.
702	*/
703	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
704	{
705	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
706	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
707	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
708	}
709
710	/*
711	* TLB flush control.
712	* Currently disabled since it's redundant as we unconditionally flush the TLB
713	* in iemSvmWorldSwitch() below.
714	*/
715	# if 0
716	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
717	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
718	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
719	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
720	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
721	# endif
722
723	/*
724	* Validate and map PAE PDPEs if the guest will be using PAE paging.
725	* Invalid PAE PDPEs here causes a #VMEXIT.
726	*/
727	bool fPdpesMapped;
728	if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
729	&& CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
730	{
731	rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
732	if (RT_SUCCESS(rc))
733	fPdpesMapped = true;
734	else
735	{
736	Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
737	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
738	}
739	}
740	else
741	fPdpesMapped = false;
742
743	/*
744	* Copy the remaining guest state from the VMCB to the guest-CPU context.
745	*/
746	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
747	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
748	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
749	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
750	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
751	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
752	pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
753	pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
754	pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
755	pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
756	pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
757	pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
758	pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
759	pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
760	CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
761	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
762	pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
763
764	/* Mask DR6, DR7 bits mandatory set/clear bits. */
765	pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
766	pVCpu->cpum.GstCtx.dr[6] \|= X86_DR6_RA1_MASK;
767	pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
768	pVCpu->cpum.GstCtx.dr[7] \|= X86_DR7_RA1_MASK;
769
770	/*
771	* Check for pending virtual interrupts.
772	*/
773	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
774	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
775	else
776	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
777
778	/*
779	* Update PGM, IEM and others of a world-switch.
780	*/
781	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, fPdpesMapped);
782	if (rcStrict == VINF_SUCCESS)
783	{ /* likely */ }
784	else if (RT_SUCCESS(rcStrict))
785	{
786	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
787	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
788	}
789	else
790	{
791	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
792	return rcStrict;
793	}
794
795	/*
796	* Set the global-interrupt flag to allow interrupts in the guest.
797	*/
798	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
799
800	/*
801	* Event injection.
802	*/
803	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
804	pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
805	if (pEventInject->n.u1Valid)
806	{
807	uint8_t const uVector = pEventInject->n.u8Vector;
808	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
809	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
810
811	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
812	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
813	{
814	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
815	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
816	}
817	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
818	{
819	if ( uVector == X86_XCPT_NMI
820	\|\| uVector > X86_XCPT_LAST)
821	{
822	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
823	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
824	}
825	if ( uVector == X86_XCPT_BR
826	&& CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
827	{
828	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
829	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
830	}
831	/** @todo any others? */
832	}
833
834	/*
835	* Invalidate the exit interrupt-information field here. This field is fully updated
836	* on #VMEXIT as events other than the one below can also cause intercepts during
837	* their injection (e.g. exceptions).
838	*/
839	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
840
841	/*
842	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
843	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
844	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
845	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
846	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
847	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
848	* injecting the event through IEM here.
849	*/
850	pVmcbCtrl->EventInject.n.u1Valid = 0;
851
852	/** @todo NRIP: Software interrupts can only be pushed properly if we support
853	* NRIP for the nested-guest to calculate the instruction length
854	* below. */
855	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
856	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
857	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
858
859	/*
860	* We shall not inject the event here right away. There may be paging mode related updates
861	* as a result of the world-switch above that are yet to be honored. Instead flag the event
862	* as pending for injection.
863	*/
864	TRPMAssertTrap(pVCpu, uVector, enmType);
865	if (pEventInject->n.u1ErrorCodeValid)
866	TRPMSetErrorCode(pVCpu, uErrorCode);
867	if ( enmType == TRPM_TRAP
868	&& uVector == X86_XCPT_PF)
869	TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
870	}
871	else
872	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
873	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
874	pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
875
876	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
877
878	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
879	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
880	if ( HMIsEnabled(pVM)
881	&& HMIsSvmVGifActive(pVM))
882	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
883	# endif
884
885	return rcStrict;
886	}
887
888	/* Shouldn't really happen as the caller should've validated the physical address already. */
889	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
890	return rc;
891	}
892
893
894	/**
895	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
896	* intercept is active.
897	*
898	* @returns Strict VBox status code.
899	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
900	* we're not executing a nested-guest.
901	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
902	* successfully.
903	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
904	* failed and a shutdown needs to be initiated for the guest.
905	*
906	* @returns VBox strict status code.
907	* @param pVCpu The cross context virtual CPU structure of the calling thread.
908	* @param u8Vector The interrupt or exception vector.
909	* @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
910	* @param uErr The error-code associated with the exception.
911	* @param uCr2 The CR2 value in case of a \#PF exception.
912	*/
913	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
914	{
915	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
916
917	/*
918	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
919	*
920	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
921	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
922	* even when they use a vector in the range 0 to 31.
923	* - ICEBP should not trigger #DB intercept, but its own intercept.
924	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
925	*/
926	/* Check NMI intercept */
927	if ( u8Vector == X86_XCPT_NMI
928	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
929	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
930	{
931	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
932	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
933	}
934
935	/* Check ICEBP intercept. */
936	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
937	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
938	{
939	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
940	IEM_SVM_UPDATE_NRIP(pVCpu);
941	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
942	}
943
944	/* Check CPU exception intercepts. */
945	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
946	&& IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
947	{
948	Assert(u8Vector <= X86_XCPT_LAST);
949	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
950	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
951	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
952	&& u8Vector == X86_XCPT_PF
953	&& !(uErr & X86_TRAP_PF_ID))
954	{
955	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
956	# ifdef IEM_WITH_CODE_TLB
957	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
958	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
959	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
960	if ( pbInstrBuf
961	&& cbInstrBuf > 0)
962	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
963	# else
964	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
965	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
966	if (cbOpcode > 0)
967	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
968	# endif
969	}
970	if (u8Vector == X86_XCPT_BR)
971	IEM_SVM_UPDATE_NRIP(pVCpu);
972	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
973	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
974	u8Vector, uExitInfo1, uExitInfo2));
975	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
976	}
977
978	/* Check software interrupt (INTn) intercepts. */
979	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
980	\| IEM_XCPT_FLAGS_BP_INSTR
981	\| IEM_XCPT_FLAGS_ICEBP_INSTR
982	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
983	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
984	{
985	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
986	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
987	IEM_SVM_UPDATE_NRIP(pVCpu);
988	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
989	}
990
991	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
992	}
993
994
995	/**
996	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
997	* corresponding intercept is active.
998	*
999	* @returns Strict VBox status code.
1000	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1001	* we're not executing a nested-guest.
1002	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1003	* successfully.
1004	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1005	* failed and a shutdown needs to be initiated for the guest.
1006	*
1007	* @returns VBox strict status code.
1008	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1009	* @param u16Port The IO port being accessed.
1010	* @param enmIoType The type of IO access.
1011	* @param cbReg The IO operand size in bytes.
1012	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1013	* @param iEffSeg The effective segment number.
1014	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1015	* @param fStrIo Whether this is a string IO instruction.
1016	* @param cbInstr The length of the IO instruction in bytes.
1017	*/
1018	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1019	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1020	{
1021	Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1022	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1023	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1024
1025	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1026
1027	SVMIOIOEXITINFO IoExitInfo;
1028	bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1029	cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1030	if (fIntercept)
1031	{
1032	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1033	IEM_SVM_UPDATE_NRIP(pVCpu);
1034	return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1035	}
1036
1037	/** @todo remove later (for debugging as VirtualBox always traps all IO
1038	* intercepts). */
1039	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1040	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1041	}
1042
1043
1044	/**
1045	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1046	* corresponding intercept is active.
1047	*
1048	* @returns Strict VBox status code.
1049	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1050	* specify interception of the accessed MSR @a idMsr.
1051	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1052	* successfully.
1053	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1054	* failed and a shutdown needs to be initiated for the guest.
1055	*
1056	* @param pVCpu The cross context virtual CPU structure.
1057	* @param idMsr The MSR being accessed in the nested-guest.
1058	* @param fWrite Whether this is an MSR write access, @c false implies an
1059	* MSR read.
1060	* @param cbInstr The length of the MSR read/write instruction in bytes.
1061	*/
1062	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite)
1063	{
1064	/*
1065	* Check if any MSRs are being intercepted.
1066	*/
1067	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1068	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1069
1070	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1071
1072	/*
1073	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1074	*/
1075	uint16_t offMsrpm;
1076	uint8_t uMsrpmBit;
1077	int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1078	if (RT_SUCCESS(rc))
1079	{
1080	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1081	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1082	if (fWrite)
1083	++uMsrpmBit;
1084
1085	/*
1086	* Check if the bit is set, if so, trigger a #VMEXIT.
1087	*/
1088	if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1089	{
1090	IEM_SVM_UPDATE_NRIP(pVCpu);
1091	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1092	}
1093	}
1094	else
1095	{
1096	/*
1097	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1098	*/
1099	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1100	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1101	}
1102	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1103	}
1104
1105
1106
1107	/**
1108	* Implements 'VMRUN'.
1109	*/
1110	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1111	{
1112	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1113	RT_NOREF2(pVCpu, cbInstr);
1114	return VINF_EM_RAW_EMULATE_INSTR;
1115	# else
1116	LogFlow(("iemCImpl_vmrun\n"));
1117	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1118
1119	/** @todo Check effective address size using address size prefix. */
1120	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1121	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1122	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1123	{
1124	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1125	return iemRaiseGeneralProtectionFault0(pVCpu);
1126	}
1127
1128	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1129	{
1130	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1131	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1132	}
1133
1134	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1135	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1136	{
1137	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1138	rcStrict = VINF_EM_TRIPLE_FAULT;
1139	}
1140	return rcStrict;
1141	# endif
1142	}
1143
1144
1145	/**
1146	* Implements 'VMLOAD'.
1147	*/
1148	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1149	{
1150	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1151	RT_NOREF2(pVCpu, cbInstr);
1152	return VINF_EM_RAW_EMULATE_INSTR;
1153	# else
1154	LogFlow(("iemCImpl_vmload\n"));
1155	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1156
1157	/** @todo Check effective address size using address size prefix. */
1158	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1159	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1160	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1161	{
1162	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1163	return iemRaiseGeneralProtectionFault0(pVCpu);
1164	}
1165
1166	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1167	{
1168	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1169	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1170	}
1171
1172	SVMVMCBSTATESAVE VmcbNstGst;
1173	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1174	sizeof(SVMVMCBSTATESAVE));
1175	if (rcStrict == VINF_SUCCESS)
1176	{
1177	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1178	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1179	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1180	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1181	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1182
1183	pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1184	pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1185	pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1186	pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1187	pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1188
1189	pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1190	pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1191	pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1192
1193	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1194	}
1195	return rcStrict;
1196	# endif
1197	}
1198
1199
1200	/**
1201	* Implements 'VMSAVE'.
1202	*/
1203	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1204	{
1205	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1206	RT_NOREF2(pVCpu, cbInstr);
1207	return VINF_EM_RAW_EMULATE_INSTR;
1208	# else
1209	LogFlow(("iemCImpl_vmsave\n"));
1210	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1211
1212	/** @todo Check effective address size using address size prefix. */
1213	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1214	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1215	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1216	{
1217	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1218	return iemRaiseGeneralProtectionFault0(pVCpu);
1219	}
1220
1221	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1222	{
1223	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1224	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1225	}
1226
1227	SVMVMCBSTATESAVE VmcbNstGst;
1228	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1229	sizeof(SVMVMCBSTATESAVE));
1230	if (rcStrict == VINF_SUCCESS)
1231	{
1232	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1233	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS \| CPUMCTX_EXTRN_GS \| CPUMCTX_EXTRN_TR \| CPUMCTX_EXTRN_LDTR
1234	\| CPUMCTX_EXTRN_KERNEL_GS_BASE \| CPUMCTX_EXTRN_SYSCALL_MSRS \| CPUMCTX_EXTRN_SYSENTER_MSRS);
1235
1236	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1237	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1238	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1239	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1240
1241	VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1242	VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1243	VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1244	VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1245	VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1246
1247	VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1248	VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1249	VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1250
1251	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1252	sizeof(SVMVMCBSTATESAVE));
1253	if (rcStrict == VINF_SUCCESS)
1254	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1255	}
1256	return rcStrict;
1257	# endif
1258	}
1259
1260
1261	/**
1262	* Implements 'CLGI'.
1263	*/
1264	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1265	{
1266	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1267	RT_NOREF2(pVCpu, cbInstr);
1268	return VINF_EM_RAW_EMULATE_INSTR;
1269	# else
1270	LogFlow(("iemCImpl_clgi\n"));
1271	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1272	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1273	{
1274	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1275	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1276	}
1277
1278	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1279	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1280
1281	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1282	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1283	# else
1284	return VINF_SUCCESS;
1285	# endif
1286	# endif
1287	}
1288
1289
1290	/**
1291	* Implements 'STGI'.
1292	*/
1293	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1294	{
1295	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1296	RT_NOREF2(pVCpu, cbInstr);
1297	return VINF_EM_RAW_EMULATE_INSTR;
1298	# else
1299	LogFlow(("iemCImpl_stgi\n"));
1300	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1301	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1302	{
1303	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1304	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1305	}
1306
1307	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1308	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1309
1310	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1311	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1312	# else
1313	return VINF_SUCCESS;
1314	# endif
1315	# endif
1316	}
1317
1318
1319	/**
1320	* Implements 'INVLPGA'.
1321	*/
1322	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1323	{
1324	/** @todo Check effective address size using address size prefix. */
1325	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1326	/** @todo PGM needs virtual ASID support. */
1327	# if 0
1328	uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1329	# endif
1330
1331	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1332	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1333	{
1334	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1335	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1336	}
1337
1338	PGMInvalidatePage(pVCpu, GCPtrPage);
1339	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1340	return VINF_SUCCESS;
1341	}
1342
1343
1344	/**
1345	* Implements 'SKINIT'.
1346	*/
1347	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1348	{
1349	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1350
1351	uint32_t uIgnore;
1352	uint32_t fFeaturesECX;
1353	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1354	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1355	return iemRaiseUndefinedOpcode(pVCpu);
1356
1357	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1358	{
1359	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1360	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1361	}
1362
1363	RT_NOREF(cbInstr);
1364	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1365	}
1366
1367
1368	/**
1369	* Implements SVM's implementation of PAUSE.
1370	*/
1371	IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1372	{
1373	bool fCheckIntercept = true;
1374	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1375	{
1376	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1377
1378	/* TSC based pause-filter thresholding. */
1379	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1380	&& pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1381	{
1382	uint64_t const uTick = TMCpuTickGet(pVCpu);
1383	if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1384	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1385	pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1386	}
1387
1388	/* Simple pause-filter counter. */
1389	if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1390	{
1391	--pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1392	fCheckIntercept = false;
1393	}
1394	}
1395
1396	if (fCheckIntercept)
1397	IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1398
1399	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1400	return VINF_SUCCESS;
1401	}
1402
1403	#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1404
1405	/**
1406	* Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1407	*/
1408	IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1409	{
1410	if (EMAreHypercallInstructionsEnabled(pVCpu))
1411	{
1412	NOREF(uDisOpcode);
1413	VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1414	if (RT_SUCCESS(rcStrict))
1415	{
1416	if (rcStrict == VINF_SUCCESS)
1417	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1418	if ( rcStrict == VINF_SUCCESS
1419	\|\| rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1420	return VINF_SUCCESS;
1421	AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1422	return rcStrict;
1423	}
1424	AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1425	\|\| rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1426	\|\| rcStrict == VERR_GIM_NOT_ENABLED
1427	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1428	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1429	("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1430
1431	/* Raise #UD on all failures. */
1432	}
1433	return iemRaiseUndefinedOpcode(pVCpu);
1434	}
1435
1436
1437	/**
1438	* Implements 'VMMCALL'.
1439	*/
1440	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1441	{
1442	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1443	{
1444	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1445	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1446	}
1447
1448	/* This is a little bit more complicated than the VT-x version because HM/SVM may
1449	patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1450	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1451	if (VM_IS_HM_ENABLED(pVM))
1452	{
1453	int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1454	if (RT_SUCCESS(rc))
1455	{
1456	Log(("vmmcall: MovTpr\n"));
1457	return VINF_SUCCESS;
1458	}
1459	}
1460
1461	/* Join forces with vmcall. */
1462	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1463	}
1464

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 92489

Download in other formats: