IEMAllCImplSvmInstr.cpp.h@ 92561

Last change on this file since 92561 was 92546, checked in by vboxsync, 3 years ago
VMM/IEM: Nested VMX: bugref:10092 Just check for RT_SUCCESS for PGMGstMapPaePdpesAtCr3.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 62.4 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 92546 2021-11-22 12:13:32Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Defined Constants And Macros *
21	*********************************************************************************************************************************/
22	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23	/**
24	* Check the common SVM instruction preconditions.
25	*/
26	# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27	do { \
28	if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29	{ \
30	Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31	return iemRaiseUndefinedOpcode(a_pVCpu); \
32	} \
33	if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34	{ \
35	Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36	return iemRaiseUndefinedOpcode(a_pVCpu); \
37	} \
38	if ((a_pVCpu)->iem.s.uCpl != 0) \
39	{ \
40	Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41	return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42	} \
43	} while (0)
44
45
46	/**
47	* Converts an IEM exception event type to an SVM event type.
48	*
49	* @returns The SVM event type.
50	* @retval UINT8_MAX if the specified type of event isn't among the set
51	* of recognized IEM event types.
52	*
53	* @param uVector The vector of the event.
54	* @param fIemXcptFlags The IEM exception / interrupt flags.
55	*/
56	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57	{
58	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59	{
60	if (uVector != X86_XCPT_NMI)
61	return SVM_EVENT_EXCEPTION;
62	return SVM_EVENT_NMI;
63	}
64
65	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
67	return SVM_EVENT_EXCEPTION;
68
69	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70	return SVM_EVENT_EXTERNAL_IRQ;
71
72	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73	return SVM_EVENT_SOFTWARE_INT;
74
75	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76	return UINT8_MAX;
77	}
78
79
80	/**
81	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82	*
83	* @returns Strict VBox status code.
84	* @param pVCpu The cross context virtual CPU structure.
85	* @param fPdpesMapped Whether the PAE PDPEs (and PDPT) have been mapped.
86	*/
87	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, bool fPdpesMapped)
88	{
89	/*
90	* Inform PGM about paging mode changes.
91	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
92	* see comment in iemMemPageTranslateAndCheckAccess().
93	*/
94	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
95	true /* fForce */);
96	AssertRCReturn(rc, rc);
97
98	/* Inform CPUM (recompiler), can later be removed. */
99	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
100
101	/*
102	* Flush the TLB with new CR3. This is required in case the PGM mode change
103	* above doesn't actually change anything.
104	*/
105	if (rc == VINF_SUCCESS)
106	{
107	rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* fGlobal */, fPdpesMapped);
108	AssertRCReturn(rc, rc);
109	}
110
111	/* Re-initialize IEM cache/state after the drastic mode switch. */
112	iemReInitExec(pVCpu);
113	return rc;
114	}
115
116
117	/**
118	* SVM \#VMEXIT handler.
119	*
120	* @returns Strict VBox status code.
121	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
122	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
123	* "host state" and a shutdown is required.
124	*
125	* @param pVCpu The cross context virtual CPU structure.
126	* @param uExitCode The exit code.
127	* @param uExitInfo1 The exit info. 1 field.
128	* @param uExitInfo2 The exit info. 2 field.
129	*/
130	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
131	{
132	VBOXSTRICTRC rcStrict;
133	if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
134	\|\| uExitCode == SVM_EXIT_INVALID)
135	{
136	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
137	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
138
139	/*
140	* Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
141	*/
142	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
143
144	/*
145	* Map the nested-guest VMCB from its location in guest memory.
146	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
147	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
148	*/
149	PSVMVMCB pVmcbMem;
150	PGMPAGEMAPLOCK PgLockMem;
151	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
152	rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
153	&PgLockMem);
154	if (rcStrict == VINF_SUCCESS)
155	{
156	/*
157	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
158	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
159	* writing the VMCB back to guest memory.
160	*/
161	HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
162
163	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
164	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
165	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
166	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
167
168	/*
169	* Save the nested-guest state into the VMCB state-save area.
170	*/
171	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
172	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
173	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
174	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
175	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
176	pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
177	pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
178	pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
179	pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
180	pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
181	pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
182	pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
183	pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
184	pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
185	/** @todo Nested paging. */
186	pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
187	pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
188	pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
189	pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
190	pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
191	pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
192	pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
193	Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
194	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
195	pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
196
197	/*
198	* Save additional state and intercept information.
199	*
200	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
201	* - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
202	* SVM execution.
203	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
204	*/
205	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
206	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
207	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
208	else
209	{
210	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
211	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
212	}
213
214	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
215
216	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
217	&& EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
218	{
219	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
220	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
221	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
222	}
223	else
224	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
225
226	/*
227	* Save nRIP, instruction length and byte fields.
228	*/
229	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
230	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
231	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
232
233	/*
234	* Save exit information.
235	*/
236	pVmcbMemCtrl->u64ExitCode = uExitCode;
237	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
238	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
239
240	/*
241	* Update the exit interrupt-information field if this #VMEXIT happened as a result
242	* of delivering an event through IEM.
243	*
244	* Don't update the exit interrupt-information field if the event wasn't being injected
245	* through IEM, as it would have been updated by real hardware if the nested-guest was
246	* executed using hardware-assisted SVM.
247	*/
248	{
249	uint8_t uExitIntVector;
250	uint32_t uExitIntErr;
251	uint32_t fExitIntFlags;
252	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
253	NULL /* uExitIntCr2 */);
254	if (fRaisingEvent)
255	{
256	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
257	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
258	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
259	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
260	{
261	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
262	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
263	}
264	}
265	}
266
267	/*
268	* Save the exit interrupt-information field.
269	*
270	* We write the whole field including overwriting reserved bits as it was observed on an
271	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
272	*/
273	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
274
275	/*
276	* Clear event injection.
277	*/
278	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
279
280	iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
281	}
282
283	/*
284	* Prepare for guest's "host mode" by clearing internal processor state bits.
285	*
286	* We don't need to zero out the state-save area, just the controls should be
287	* sufficient because it has the critical bit of indicating whether we're inside
288	* the nested-guest or not.
289	*/
290	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
291	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
292
293	/*
294	* Restore the subset of force-flags that were preserved.
295	*/
296	if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
297	{
298	VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
299	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
300	}
301
302	if (rcStrict == VINF_SUCCESS)
303	{
304	/** @todo Nested paging. */
305	/** @todo ASID. */
306
307	/*
308	* If we are switching to PAE mode host, validate the PDPEs first.
309	* Any invalid PDPEs here causes a VCPU shutdown.
310	*/
311	PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
312	bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
313	if (fHostInPaeMode)
314	rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
315	if (RT_SUCCESS(rcStrict))
316	{
317	/*
318	* Reload the host state.
319	*/
320	CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
321
322	/*
323	* Update PGM, IEM and others of a world-switch.
324	*/
325	rcStrict = iemSvmWorldSwitch(pVCpu, fHostInPaeMode);
326	if (rcStrict == VINF_SUCCESS)
327	rcStrict = VINF_SVM_VMEXIT;
328	else if (RT_SUCCESS(rcStrict))
329	{
330	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
331	iemSetPassUpStatus(pVCpu, rcStrict);
332	rcStrict = VINF_SVM_VMEXIT;
333	}
334	else
335	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
336	}
337	else
338	{
339	Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
340	rcStrict = VINF_EM_TRIPLE_FAULT;
341	}
342	}
343	else
344	{
345	AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
346	rcStrict = VINF_EM_TRIPLE_FAULT;
347	}
348	}
349	else
350	{
351	AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
352	rcStrict = VERR_SVM_IPE_3;
353	}
354
355	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
356	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
357	if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
358	&& HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
359	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
360	# endif
361	return rcStrict;
362	}
363
364
365	/**
366	* Performs the operations necessary that are part of the vmrun instruction
367	* execution in the guest.
368	*
369	* @returns Strict VBox status code (i.e. informational status codes too).
370	* @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
371	* code execution.
372	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
373	* (SVM_EXIT_INVALID most likely).
374	*
375	* @param pVCpu The cross context virtual CPU structure.
376	* @param cbInstr The length of the VMRUN instruction.
377	* @param GCPhysVmcb Guest physical address of the VMCB to run.
378	*/
379	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
380	{
381	LogFlow(("iemSvmVmrun\n"));
382
383	/*
384	* Cache the physical address of the VMCB for #VMEXIT exceptions.
385	*/
386	pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
387
388	/*
389	* Save the host state.
390	*/
391	CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
392
393	/*
394	* Read the guest VMCB.
395	*/
396	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
397	int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
398	if (RT_SUCCESS(rc))
399	{
400	/*
401	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
402	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
403	* but in our implementation we try to preserve as much as we possibly can.
404	*
405	* We could read the entire page here and only write back the relevant fields on
406	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
407	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
408	* currently reserved but may be recognized as features bits in future CPUs causing
409	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
410	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
411	*/
412	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
413	PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
414
415	RT_ZERO(pVmcbCtrl->u8Reserved0);
416	RT_ZERO(pVmcbCtrl->u8Reserved1);
417	RT_ZERO(pVmcbCtrl->u8Reserved2);
418	RT_ZERO(pVmcbNstGst->u8Reserved0);
419	RT_ZERO(pVmcbNstGst->u8Reserved1);
420	RT_ZERO(pVmcbNstGst->u8Reserved2);
421	RT_ZERO(pVmcbNstGst->u8Reserved3);
422	RT_ZERO(pVmcbNstGst->u8Reserved4);
423	RT_ZERO(pVmcbNstGst->u8Reserved5);
424	pVmcbCtrl->u32Reserved0 = 0;
425	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
426	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
427	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
428	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
429	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
430	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
431	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
432	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
433	pVmcbCtrl->EventInject.n.u19Reserved = 0;
434	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
435
436	/*
437	* Validate guest-state and controls.
438	*/
439	/* VMRUN must always be intercepted. */
440	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
441	{
442	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
443	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
444	}
445
446	/* Nested paging. */
447	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
448	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
449	{
450	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
451	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
452	}
453
454	/* AVIC. */
455	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
456	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
457	{
458	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
459	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
460	}
461
462	/* Last branch record (LBR) virtualization. */
463	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
464	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
465	{
466	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
467	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
468	}
469
470	/* Virtualized VMSAVE/VMLOAD. */
471	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
472	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
473	{
474	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
475	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
476	}
477
478	/* Virtual GIF. */
479	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
480	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
481	{
482	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
483	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
484	}
485
486	/* Guest ASID. */
487	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
488	{
489	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
490	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
491	}
492
493	/* Guest AVIC. */
494	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
495	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
496	{
497	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
498	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
499	}
500
501	/* Guest Secure Encrypted Virtualization. */
502	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
503	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
504	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
505	{
506	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
507	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
508	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
509	}
510
511	/* Flush by ASID. */
512	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
513	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
514	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
515	{
516	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
517	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
518	}
519
520	/* IO permission bitmap. */
521	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
522	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
523	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
524	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
525	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
526	{
527	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
528	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
529	}
530
531	/* MSR permission bitmap. */
532	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
533	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
534	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
535	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
536	{
537	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
538	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
539	}
540
541	/* CR0. */
542	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
543	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
544	{
545	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
546	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
547	}
548	if (pVmcbNstGst->u64CR0 >> 32)
549	{
550	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
551	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
552	}
553	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
554
555	/* DR6 and DR7. */
556	if ( pVmcbNstGst->u64DR6 >> 32
557	\|\| pVmcbNstGst->u64DR7 >> 32)
558	{
559	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
560	pVmcbNstGst->u64DR6));
561	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
562	}
563
564	/*
565	* PAT (Page Attribute Table) MSR.
566	*
567	* The CPU only validates and loads it when nested-paging is enabled.
568	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
569	*/
570	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
571	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
572	{
573	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
574	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
575	}
576
577	/*
578	* Copy the IO permission bitmap into the cache.
579	*/
580	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
581	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
582	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
583	if (RT_FAILURE(rc))
584	{
585	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
586	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
587	}
588
589	/*
590	* Copy the MSR permission bitmap into the cache.
591	*/
592	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
593	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
594	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
595	if (RT_FAILURE(rc))
596	{
597	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
598	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
599	}
600
601	/*
602	* Copy segments from nested-guest VMCB state to the guest-CPU state.
603	*
604	* We do this here as we need to use the CS attributes and it's easier this way
605	* then using the VMCB format selectors. It doesn't really matter where we copy
606	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
607	*/
608	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
609	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
610	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
611	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
612
613	/** @todo Segment attribute overrides by VMRUN. */
614
615	/*
616	* CPL adjustments and overrides.
617	*
618	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
619	* We shall thus adjust both CS.DPL and SS.DPL here.
620	*/
621	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
622	if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
623	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
624	if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
625	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
626	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
627
628	/*
629	* Continue validating guest-state and controls.
630	*
631	* We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
632	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
633	* old and new EFER value to not have any guest EFER bits influence the new
634	* nested-guest EFER.
635	*/
636	uint64_t uValidEfer;
637	rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
638	if (RT_FAILURE(rc))
639	{
640	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
641	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
642	}
643
644	/* Validate paging and CPU mode bits. */
645	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
646	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
647	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
648	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
649	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
650	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
651	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
652	bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
653	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
654	if (fLongModeWithPaging)
655	uValidEfer \|= MSR_K6_EFER_LMA;
656	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
657	if ( !fSvm
658	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
659	\|\| (fLongModeWithPaging && !fPae)
660	\|\| (fLongModeWithPaging && !fProtMode)
661	\|\| ( fLongModeEnabled
662	&& fPaging
663	&& fPae
664	&& fLongModeConformCS))
665	{
666	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
667	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
668	}
669
670	/*
671	* Preserve the required force-flags.
672	*
673	* We only preserve the force-flags that would affect the execution of the
674	* nested-guest (or the guest).
675	*
676	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
677	* execution of a subsequent IRET instruction in the guest.
678	*
679	* The remaining FFs (e.g. timers) can stay in place so that we will be able to
680	* generate interrupts that should cause #VMEXITs for the nested-guest.
681	*
682	* VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
683	* preserve VMCPU_FF_INHIBIT_INTERRUPTS.
684	*/
685	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
686	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
687
688	/*
689	* Pause filter.
690	*/
691	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
692	{
693	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
694	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
695	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
696	}
697
698	/*
699	* Interrupt shadow.
700	*/
701	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
702	{
703	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
704	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
705	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
706	}
707
708	/*
709	* TLB flush control.
710	* Currently disabled since it's redundant as we unconditionally flush the TLB
711	* in iemSvmWorldSwitch() below.
712	*/
713	# if 0
714	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
715	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
716	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
717	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
718	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
719	# endif
720
721	/*
722	* Validate and map PAE PDPEs if the guest will be using PAE paging.
723	* Invalid PAE PDPEs here causes a #VMEXIT.
724	*/
725	bool fPdpesMapped;
726	if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
727	&& CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
728	{
729	rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
730	if (RT_SUCCESS(rc))
731	fPdpesMapped = true;
732	else
733	{
734	Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
735	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
736	}
737	}
738	else
739	fPdpesMapped = false;
740
741	/*
742	* Copy the remaining guest state from the VMCB to the guest-CPU context.
743	*/
744	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
745	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
746	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
747	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
748	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
749	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
750	pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
751	pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
752	pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
753	pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
754	pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
755	pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
756	pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
757	pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
758	CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
759	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
760	pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
761
762	/* Mask DR6, DR7 bits mandatory set/clear bits. */
763	pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
764	pVCpu->cpum.GstCtx.dr[6] \|= X86_DR6_RA1_MASK;
765	pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
766	pVCpu->cpum.GstCtx.dr[7] \|= X86_DR7_RA1_MASK;
767
768	/*
769	* Check for pending virtual interrupts.
770	*/
771	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
772	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
773	else
774	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
775
776	/*
777	* Update PGM, IEM and others of a world-switch.
778	*/
779	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, fPdpesMapped);
780	if (rcStrict == VINF_SUCCESS)
781	{ /* likely */ }
782	else if (RT_SUCCESS(rcStrict))
783	{
784	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
785	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
786	}
787	else
788	{
789	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
790	return rcStrict;
791	}
792
793	/*
794	* Set the global-interrupt flag to allow interrupts in the guest.
795	*/
796	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
797
798	/*
799	* Event injection.
800	*/
801	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
802	pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
803	if (pEventInject->n.u1Valid)
804	{
805	uint8_t const uVector = pEventInject->n.u8Vector;
806	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
807	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
808
809	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
810	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
811	{
812	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
813	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
814	}
815	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
816	{
817	if ( uVector == X86_XCPT_NMI
818	\|\| uVector > X86_XCPT_LAST)
819	{
820	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
821	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
822	}
823	if ( uVector == X86_XCPT_BR
824	&& CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
825	{
826	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
827	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
828	}
829	/** @todo any others? */
830	}
831
832	/*
833	* Invalidate the exit interrupt-information field here. This field is fully updated
834	* on #VMEXIT as events other than the one below can also cause intercepts during
835	* their injection (e.g. exceptions).
836	*/
837	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
838
839	/*
840	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
841	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
842	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
843	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
844	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
845	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
846	* injecting the event through IEM here.
847	*/
848	pVmcbCtrl->EventInject.n.u1Valid = 0;
849
850	/** @todo NRIP: Software interrupts can only be pushed properly if we support
851	* NRIP for the nested-guest to calculate the instruction length
852	* below. */
853	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
854	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
855	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
856
857	/*
858	* We shall not inject the event here right away. There may be paging mode related updates
859	* as a result of the world-switch above that are yet to be honored. Instead flag the event
860	* as pending for injection.
861	*/
862	TRPMAssertTrap(pVCpu, uVector, enmType);
863	if (pEventInject->n.u1ErrorCodeValid)
864	TRPMSetErrorCode(pVCpu, uErrorCode);
865	if ( enmType == TRPM_TRAP
866	&& uVector == X86_XCPT_PF)
867	TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
868	}
869	else
870	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
871	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
872	pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
873
874	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
875
876	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
877	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
878	if ( HMIsEnabled(pVM)
879	&& HMIsSvmVGifActive(pVM))
880	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
881	# endif
882
883	return rcStrict;
884	}
885
886	/* Shouldn't really happen as the caller should've validated the physical address already. */
887	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
888	return rc;
889	}
890
891
892	/**
893	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
894	* intercept is active.
895	*
896	* @returns Strict VBox status code.
897	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
898	* we're not executing a nested-guest.
899	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
900	* successfully.
901	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
902	* failed and a shutdown needs to be initiated for the guest.
903	*
904	* @returns VBox strict status code.
905	* @param pVCpu The cross context virtual CPU structure of the calling thread.
906	* @param u8Vector The interrupt or exception vector.
907	* @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
908	* @param uErr The error-code associated with the exception.
909	* @param uCr2 The CR2 value in case of a \#PF exception.
910	*/
911	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
912	{
913	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
914
915	/*
916	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
917	*
918	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
919	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
920	* even when they use a vector in the range 0 to 31.
921	* - ICEBP should not trigger #DB intercept, but its own intercept.
922	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
923	*/
924	/* Check NMI intercept */
925	if ( u8Vector == X86_XCPT_NMI
926	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
927	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
928	{
929	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
930	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
931	}
932
933	/* Check ICEBP intercept. */
934	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
935	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
936	{
937	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
938	IEM_SVM_UPDATE_NRIP(pVCpu);
939	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
940	}
941
942	/* Check CPU exception intercepts. */
943	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
944	&& IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
945	{
946	Assert(u8Vector <= X86_XCPT_LAST);
947	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
948	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
949	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
950	&& u8Vector == X86_XCPT_PF
951	&& !(uErr & X86_TRAP_PF_ID))
952	{
953	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
954	# ifdef IEM_WITH_CODE_TLB
955	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
956	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
957	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
958	if ( pbInstrBuf
959	&& cbInstrBuf > 0)
960	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
961	# else
962	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
963	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
964	if (cbOpcode > 0)
965	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
966	# endif
967	}
968	if (u8Vector == X86_XCPT_BR)
969	IEM_SVM_UPDATE_NRIP(pVCpu);
970	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
971	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
972	u8Vector, uExitInfo1, uExitInfo2));
973	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
974	}
975
976	/* Check software interrupt (INTn) intercepts. */
977	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
978	\| IEM_XCPT_FLAGS_BP_INSTR
979	\| IEM_XCPT_FLAGS_ICEBP_INSTR
980	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
981	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
982	{
983	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
984	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
985	IEM_SVM_UPDATE_NRIP(pVCpu);
986	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
987	}
988
989	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
990	}
991
992
993	/**
994	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
995	* corresponding intercept is active.
996	*
997	* @returns Strict VBox status code.
998	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
999	* we're not executing a nested-guest.
1000	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1001	* successfully.
1002	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1003	* failed and a shutdown needs to be initiated for the guest.
1004	*
1005	* @returns VBox strict status code.
1006	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1007	* @param u16Port The IO port being accessed.
1008	* @param enmIoType The type of IO access.
1009	* @param cbReg The IO operand size in bytes.
1010	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1011	* @param iEffSeg The effective segment number.
1012	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1013	* @param fStrIo Whether this is a string IO instruction.
1014	* @param cbInstr The length of the IO instruction in bytes.
1015	*/
1016	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1017	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1018	{
1019	Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1020	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1021	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1022
1023	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1024
1025	SVMIOIOEXITINFO IoExitInfo;
1026	bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1027	cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1028	if (fIntercept)
1029	{
1030	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1031	IEM_SVM_UPDATE_NRIP(pVCpu);
1032	return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1033	}
1034
1035	/** @todo remove later (for debugging as VirtualBox always traps all IO
1036	* intercepts). */
1037	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1038	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1039	}
1040
1041
1042	/**
1043	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1044	* corresponding intercept is active.
1045	*
1046	* @returns Strict VBox status code.
1047	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1048	* specify interception of the accessed MSR @a idMsr.
1049	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1050	* successfully.
1051	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1052	* failed and a shutdown needs to be initiated for the guest.
1053	*
1054	* @param pVCpu The cross context virtual CPU structure.
1055	* @param idMsr The MSR being accessed in the nested-guest.
1056	* @param fWrite Whether this is an MSR write access, @c false implies an
1057	* MSR read.
1058	* @param cbInstr The length of the MSR read/write instruction in bytes.
1059	*/
1060	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite)
1061	{
1062	/*
1063	* Check if any MSRs are being intercepted.
1064	*/
1065	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1066	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1067
1068	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1069
1070	/*
1071	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1072	*/
1073	uint16_t offMsrpm;
1074	uint8_t uMsrpmBit;
1075	int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1076	if (RT_SUCCESS(rc))
1077	{
1078	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1079	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1080	if (fWrite)
1081	++uMsrpmBit;
1082
1083	/*
1084	* Check if the bit is set, if so, trigger a #VMEXIT.
1085	*/
1086	if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1087	{
1088	IEM_SVM_UPDATE_NRIP(pVCpu);
1089	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1090	}
1091	}
1092	else
1093	{
1094	/*
1095	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1096	*/
1097	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1098	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1099	}
1100	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1101	}
1102
1103
1104
1105	/**
1106	* Implements 'VMRUN'.
1107	*/
1108	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1109	{
1110	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1111	RT_NOREF2(pVCpu, cbInstr);
1112	return VINF_EM_RAW_EMULATE_INSTR;
1113	# else
1114	LogFlow(("iemCImpl_vmrun\n"));
1115	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1116
1117	/** @todo Check effective address size using address size prefix. */
1118	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1119	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1120	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1121	{
1122	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1123	return iemRaiseGeneralProtectionFault0(pVCpu);
1124	}
1125
1126	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1127	{
1128	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1129	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1130	}
1131
1132	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1133	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1134	{
1135	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1136	rcStrict = VINF_EM_TRIPLE_FAULT;
1137	}
1138	return rcStrict;
1139	# endif
1140	}
1141
1142
1143	/**
1144	* Implements 'VMLOAD'.
1145	*/
1146	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1147	{
1148	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1149	RT_NOREF2(pVCpu, cbInstr);
1150	return VINF_EM_RAW_EMULATE_INSTR;
1151	# else
1152	LogFlow(("iemCImpl_vmload\n"));
1153	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1154
1155	/** @todo Check effective address size using address size prefix. */
1156	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1157	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1158	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1159	{
1160	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1161	return iemRaiseGeneralProtectionFault0(pVCpu);
1162	}
1163
1164	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1165	{
1166	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1167	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1168	}
1169
1170	SVMVMCBSTATESAVE VmcbNstGst;
1171	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1172	sizeof(SVMVMCBSTATESAVE));
1173	if (rcStrict == VINF_SUCCESS)
1174	{
1175	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1176	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1177	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1178	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1179	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1180
1181	pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1182	pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1183	pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1184	pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1185	pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1186
1187	pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1188	pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1189	pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1190
1191	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1192	}
1193	return rcStrict;
1194	# endif
1195	}
1196
1197
1198	/**
1199	* Implements 'VMSAVE'.
1200	*/
1201	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1202	{
1203	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1204	RT_NOREF2(pVCpu, cbInstr);
1205	return VINF_EM_RAW_EMULATE_INSTR;
1206	# else
1207	LogFlow(("iemCImpl_vmsave\n"));
1208	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1209
1210	/** @todo Check effective address size using address size prefix. */
1211	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1212	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1213	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1214	{
1215	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1216	return iemRaiseGeneralProtectionFault0(pVCpu);
1217	}
1218
1219	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1220	{
1221	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1222	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1223	}
1224
1225	SVMVMCBSTATESAVE VmcbNstGst;
1226	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1227	sizeof(SVMVMCBSTATESAVE));
1228	if (rcStrict == VINF_SUCCESS)
1229	{
1230	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1231	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS \| CPUMCTX_EXTRN_GS \| CPUMCTX_EXTRN_TR \| CPUMCTX_EXTRN_LDTR
1232	\| CPUMCTX_EXTRN_KERNEL_GS_BASE \| CPUMCTX_EXTRN_SYSCALL_MSRS \| CPUMCTX_EXTRN_SYSENTER_MSRS);
1233
1234	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1235	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1236	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1237	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1238
1239	VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1240	VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1241	VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1242	VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1243	VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1244
1245	VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1246	VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1247	VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1248
1249	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1250	sizeof(SVMVMCBSTATESAVE));
1251	if (rcStrict == VINF_SUCCESS)
1252	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1253	}
1254	return rcStrict;
1255	# endif
1256	}
1257
1258
1259	/**
1260	* Implements 'CLGI'.
1261	*/
1262	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1263	{
1264	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1265	RT_NOREF2(pVCpu, cbInstr);
1266	return VINF_EM_RAW_EMULATE_INSTR;
1267	# else
1268	LogFlow(("iemCImpl_clgi\n"));
1269	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1270	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1271	{
1272	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1273	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1274	}
1275
1276	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1277	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1278
1279	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1280	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1281	# else
1282	return VINF_SUCCESS;
1283	# endif
1284	# endif
1285	}
1286
1287
1288	/**
1289	* Implements 'STGI'.
1290	*/
1291	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1292	{
1293	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1294	RT_NOREF2(pVCpu, cbInstr);
1295	return VINF_EM_RAW_EMULATE_INSTR;
1296	# else
1297	LogFlow(("iemCImpl_stgi\n"));
1298	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1299	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1300	{
1301	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1302	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1303	}
1304
1305	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1306	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1307
1308	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1309	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1310	# else
1311	return VINF_SUCCESS;
1312	# endif
1313	# endif
1314	}
1315
1316
1317	/**
1318	* Implements 'INVLPGA'.
1319	*/
1320	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1321	{
1322	/** @todo Check effective address size using address size prefix. */
1323	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1324	/** @todo PGM needs virtual ASID support. */
1325	# if 0
1326	uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1327	# endif
1328
1329	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1330	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1331	{
1332	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1333	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1334	}
1335
1336	PGMInvalidatePage(pVCpu, GCPtrPage);
1337	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1338	return VINF_SUCCESS;
1339	}
1340
1341
1342	/**
1343	* Implements 'SKINIT'.
1344	*/
1345	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1346	{
1347	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1348
1349	uint32_t uIgnore;
1350	uint32_t fFeaturesECX;
1351	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1352	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1353	return iemRaiseUndefinedOpcode(pVCpu);
1354
1355	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1356	{
1357	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1358	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1359	}
1360
1361	RT_NOREF(cbInstr);
1362	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1363	}
1364
1365
1366	/**
1367	* Implements SVM's implementation of PAUSE.
1368	*/
1369	IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1370	{
1371	bool fCheckIntercept = true;
1372	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1373	{
1374	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1375
1376	/* TSC based pause-filter thresholding. */
1377	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1378	&& pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1379	{
1380	uint64_t const uTick = TMCpuTickGet(pVCpu);
1381	if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1382	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1383	pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1384	}
1385
1386	/* Simple pause-filter counter. */
1387	if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1388	{
1389	--pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1390	fCheckIntercept = false;
1391	}
1392	}
1393
1394	if (fCheckIntercept)
1395	IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1396
1397	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1398	return VINF_SUCCESS;
1399	}
1400
1401	#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1402
1403	/**
1404	* Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1405	*/
1406	IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1407	{
1408	if (EMAreHypercallInstructionsEnabled(pVCpu))
1409	{
1410	NOREF(uDisOpcode);
1411	VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1412	if (RT_SUCCESS(rcStrict))
1413	{
1414	if (rcStrict == VINF_SUCCESS)
1415	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1416	if ( rcStrict == VINF_SUCCESS
1417	\|\| rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1418	return VINF_SUCCESS;
1419	AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1420	return rcStrict;
1421	}
1422	AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1423	\|\| rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1424	\|\| rcStrict == VERR_GIM_NOT_ENABLED
1425	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1426	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1427	("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1428
1429	/* Raise #UD on all failures. */
1430	}
1431	return iemRaiseUndefinedOpcode(pVCpu);
1432	}
1433
1434
1435	/**
1436	* Implements 'VMMCALL'.
1437	*/
1438	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1439	{
1440	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1441	{
1442	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1443	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1444	}
1445
1446	/* This is a little bit more complicated than the VT-x version because HM/SVM may
1447	patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1448	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1449	if (VM_IS_HM_ENABLED(pVM))
1450	{
1451	int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1452	if (RT_SUCCESS(rc))
1453	{
1454	Log(("vmmcall: MovTpr\n"));
1455	return VINF_SUCCESS;
1456	}
1457	}
1458
1459	/* Join forces with vmcall. */
1460	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1461	}
1462

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 92561

Download in other formats: