IEMAllCImplSvmInstr.cpp.h@ 92583

Last change on this file since 92583 was 92583, checked in by vboxsync, 3 years ago
VMM: Nested VMX: bugref:10092 Renamed fPdpesMapped as it's rather misleading. More importantly CR3 is mapped and in case of PAE paging, the PAE PDPTEs have been mapped.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 62.4 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp.h 92583 2021-11-24 09:13:14Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2020 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Defined Constants And Macros *
21	*********************************************************************************************************************************/
22	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23	/**
24	* Check the common SVM instruction preconditions.
25	*/
26	# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27	do { \
28	if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29	{ \
30	Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31	return iemRaiseUndefinedOpcode(a_pVCpu); \
32	} \
33	if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34	{ \
35	Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36	return iemRaiseUndefinedOpcode(a_pVCpu); \
37	} \
38	if ((a_pVCpu)->iem.s.uCpl != 0) \
39	{ \
40	Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41	return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42	} \
43	} while (0)
44
45
46	/**
47	* Converts an IEM exception event type to an SVM event type.
48	*
49	* @returns The SVM event type.
50	* @retval UINT8_MAX if the specified type of event isn't among the set
51	* of recognized IEM event types.
52	*
53	* @param uVector The vector of the event.
54	* @param fIemXcptFlags The IEM exception / interrupt flags.
55	*/
56	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57	{
58	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59	{
60	if (uVector != X86_XCPT_NMI)
61	return SVM_EVENT_EXCEPTION;
62	return SVM_EVENT_NMI;
63	}
64
65	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
67	return SVM_EVENT_EXCEPTION;
68
69	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70	return SVM_EVENT_EXTERNAL_IRQ;
71
72	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73	return SVM_EVENT_SOFTWARE_INT;
74
75	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76	return UINT8_MAX;
77	}
78
79
80	/**
81	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82	*
83	* @returns Strict VBox status code.
84	* @param pVCpu The cross context virtual CPU structure.
85	* @param fCr3Mapped Whether CR3 (and in case of PAE paging, whether PDPEs
86	* and PDPT) have been mapped.
87	*/
88	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, bool fCr3Mapped)
89	{
90	/*
91	* Inform PGM about paging mode changes.
92	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
93	* see comment in iemMemPageTranslateAndCheckAccess().
94	*/
95	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
96	true /* fForce */);
97	AssertRCReturn(rc, rc);
98
99	/* Inform CPUM (recompiler), can later be removed. */
100	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
101
102	/*
103	* Flush the TLB with new CR3. This is required in case the PGM mode change
104	* above doesn't actually change anything.
105	*/
106	if (rc == VINF_SUCCESS)
107	{
108	rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* fGlobal */, fCr3Mapped);
109	AssertRCReturn(rc, rc);
110	}
111
112	/* Re-initialize IEM cache/state after the drastic mode switch. */
113	iemReInitExec(pVCpu);
114	return rc;
115	}
116
117
118	/**
119	* SVM \#VMEXIT handler.
120	*
121	* @returns Strict VBox status code.
122	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
123	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
124	* "host state" and a shutdown is required.
125	*
126	* @param pVCpu The cross context virtual CPU structure.
127	* @param uExitCode The exit code.
128	* @param uExitInfo1 The exit info. 1 field.
129	* @param uExitInfo2 The exit info. 2 field.
130	*/
131	IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
132	{
133	VBOXSTRICTRC rcStrict;
134	if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
135	\|\| uExitCode == SVM_EXIT_INVALID)
136	{
137	LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
138	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
139
140	/*
141	* Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
142	*/
143	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
144
145	/*
146	* Map the nested-guest VMCB from its location in guest memory.
147	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
148	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
149	*/
150	PSVMVMCB pVmcbMem;
151	PGMPAGEMAPLOCK PgLockMem;
152	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
153	rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
154	&PgLockMem);
155	if (rcStrict == VINF_SUCCESS)
156	{
157	/*
158	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
159	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
160	* writing the VMCB back to guest memory.
161	*/
162	HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
163
164	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
165	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
166	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
167	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
168
169	/*
170	* Save the nested-guest state into the VMCB state-save area.
171	*/
172	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
173	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
174	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
175	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
176	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
177	pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
178	pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
179	pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
180	pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
181	pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
182	pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
183	pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
184	pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
185	pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
186	/** @todo Nested paging. */
187	pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
188	pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
189	pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
190	pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
191	pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
192	pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
193	pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
194	Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
195	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
196	pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
197
198	/*
199	* Save additional state and intercept information.
200	*
201	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
202	* - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
203	* SVM execution.
204	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
205	*/
206	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
207	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
208	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
209	else
210	{
211	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
212	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
213	}
214
215	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
216
217	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
218	&& EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
219	{
220	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
221	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
222	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
223	}
224	else
225	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
226
227	/*
228	* Save nRIP, instruction length and byte fields.
229	*/
230	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
231	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
232	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
233
234	/*
235	* Save exit information.
236	*/
237	pVmcbMemCtrl->u64ExitCode = uExitCode;
238	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
239	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
240
241	/*
242	* Update the exit interrupt-information field if this #VMEXIT happened as a result
243	* of delivering an event through IEM.
244	*
245	* Don't update the exit interrupt-information field if the event wasn't being injected
246	* through IEM, as it would have been updated by real hardware if the nested-guest was
247	* executed using hardware-assisted SVM.
248	*/
249	{
250	uint8_t uExitIntVector;
251	uint32_t uExitIntErr;
252	uint32_t fExitIntFlags;
253	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
254	NULL /* uExitIntCr2 */);
255	if (fRaisingEvent)
256	{
257	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
258	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
259	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
260	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
261	{
262	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
263	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
264	}
265	}
266	}
267
268	/*
269	* Save the exit interrupt-information field.
270	*
271	* We write the whole field including overwriting reserved bits as it was observed on an
272	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
273	*/
274	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
275
276	/*
277	* Clear event injection.
278	*/
279	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
280
281	iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
282	}
283
284	/*
285	* Prepare for guest's "host mode" by clearing internal processor state bits.
286	*
287	* We don't need to zero out the state-save area, just the controls should be
288	* sufficient because it has the critical bit of indicating whether we're inside
289	* the nested-guest or not.
290	*/
291	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
292	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
293
294	/*
295	* Restore the subset of force-flags that were preserved.
296	*/
297	if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
298	{
299	VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
300	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
301	}
302
303	if (rcStrict == VINF_SUCCESS)
304	{
305	/** @todo Nested paging. */
306	/** @todo ASID. */
307
308	/*
309	* If we are switching to PAE mode host, validate the PDPEs first.
310	* Any invalid PDPEs here causes a VCPU shutdown.
311	*/
312	PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
313	bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
314	if (fHostInPaeMode)
315	rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
316	if (RT_SUCCESS(rcStrict))
317	{
318	/*
319	* Reload the host state.
320	*/
321	CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
322
323	/*
324	* Update PGM, IEM and others of a world-switch.
325	*/
326	rcStrict = iemSvmWorldSwitch(pVCpu, fHostInPaeMode);
327	if (rcStrict == VINF_SUCCESS)
328	rcStrict = VINF_SVM_VMEXIT;
329	else if (RT_SUCCESS(rcStrict))
330	{
331	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
332	iemSetPassUpStatus(pVCpu, rcStrict);
333	rcStrict = VINF_SVM_VMEXIT;
334	}
335	else
336	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
337	}
338	else
339	{
340	Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
341	rcStrict = VINF_EM_TRIPLE_FAULT;
342	}
343	}
344	else
345	{
346	AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
347	rcStrict = VINF_EM_TRIPLE_FAULT;
348	}
349	}
350	else
351	{
352	AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
353	rcStrict = VERR_SVM_IPE_3;
354	}
355
356	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
357	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
358	if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
359	&& HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
360	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
361	# endif
362	return rcStrict;
363	}
364
365
366	/**
367	* Performs the operations necessary that are part of the vmrun instruction
368	* execution in the guest.
369	*
370	* @returns Strict VBox status code (i.e. informational status codes too).
371	* @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
372	* code execution.
373	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
374	* (SVM_EXIT_INVALID most likely).
375	*
376	* @param pVCpu The cross context virtual CPU structure.
377	* @param cbInstr The length of the VMRUN instruction.
378	* @param GCPhysVmcb Guest physical address of the VMCB to run.
379	*/
380	IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
381	{
382	LogFlow(("iemSvmVmrun\n"));
383
384	/*
385	* Cache the physical address of the VMCB for #VMEXIT exceptions.
386	*/
387	pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
388
389	/*
390	* Save the host state.
391	*/
392	CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
393
394	/*
395	* Read the guest VMCB.
396	*/
397	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
398	int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
399	if (RT_SUCCESS(rc))
400	{
401	/*
402	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
403	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
404	* but in our implementation we try to preserve as much as we possibly can.
405	*
406	* We could read the entire page here and only write back the relevant fields on
407	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
408	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
409	* currently reserved but may be recognized as features bits in future CPUs causing
410	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
411	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
412	*/
413	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
414	PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
415
416	RT_ZERO(pVmcbCtrl->u8Reserved0);
417	RT_ZERO(pVmcbCtrl->u8Reserved1);
418	RT_ZERO(pVmcbCtrl->u8Reserved2);
419	RT_ZERO(pVmcbNstGst->u8Reserved0);
420	RT_ZERO(pVmcbNstGst->u8Reserved1);
421	RT_ZERO(pVmcbNstGst->u8Reserved2);
422	RT_ZERO(pVmcbNstGst->u8Reserved3);
423	RT_ZERO(pVmcbNstGst->u8Reserved4);
424	RT_ZERO(pVmcbNstGst->u8Reserved5);
425	pVmcbCtrl->u32Reserved0 = 0;
426	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
427	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
428	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
429	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
430	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
431	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
432	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
433	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
434	pVmcbCtrl->EventInject.n.u19Reserved = 0;
435	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
436
437	/*
438	* Validate guest-state and controls.
439	*/
440	/* VMRUN must always be intercepted. */
441	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
442	{
443	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
444	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
445	}
446
447	/* Nested paging. */
448	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
449	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
450	{
451	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
452	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
453	}
454
455	/* AVIC. */
456	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
457	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
458	{
459	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
460	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
461	}
462
463	/* Last branch record (LBR) virtualization. */
464	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
465	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
466	{
467	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
468	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
469	}
470
471	/* Virtualized VMSAVE/VMLOAD. */
472	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
473	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
474	{
475	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
476	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
477	}
478
479	/* Virtual GIF. */
480	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
481	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
482	{
483	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
484	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
485	}
486
487	/* Guest ASID. */
488	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
489	{
490	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
491	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
492	}
493
494	/* Guest AVIC. */
495	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
496	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
497	{
498	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
499	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
500	}
501
502	/* Guest Secure Encrypted Virtualization. */
503	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
504	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
505	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
506	{
507	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
508	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
509	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
510	}
511
512	/* Flush by ASID. */
513	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
514	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
515	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
516	{
517	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
518	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
519	}
520
521	/* IO permission bitmap. */
522	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
523	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
524	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
525	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
526	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
527	{
528	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
529	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
530	}
531
532	/* MSR permission bitmap. */
533	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
534	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
535	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
536	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
537	{
538	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
539	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
540	}
541
542	/* CR0. */
543	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
544	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
545	{
546	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
547	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
548	}
549	if (pVmcbNstGst->u64CR0 >> 32)
550	{
551	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
552	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
553	}
554	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
555
556	/* DR6 and DR7. */
557	if ( pVmcbNstGst->u64DR6 >> 32
558	\|\| pVmcbNstGst->u64DR7 >> 32)
559	{
560	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
561	pVmcbNstGst->u64DR6));
562	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
563	}
564
565	/*
566	* PAT (Page Attribute Table) MSR.
567	*
568	* The CPU only validates and loads it when nested-paging is enabled.
569	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
570	*/
571	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
572	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
573	{
574	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
575	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
576	}
577
578	/*
579	* Copy the IO permission bitmap into the cache.
580	*/
581	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
582	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
583	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
584	if (RT_FAILURE(rc))
585	{
586	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
587	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
588	}
589
590	/*
591	* Copy the MSR permission bitmap into the cache.
592	*/
593	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
594	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
595	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
596	if (RT_FAILURE(rc))
597	{
598	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
599	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
600	}
601
602	/*
603	* Copy segments from nested-guest VMCB state to the guest-CPU state.
604	*
605	* We do this here as we need to use the CS attributes and it's easier this way
606	* then using the VMCB format selectors. It doesn't really matter where we copy
607	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
608	*/
609	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
610	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
611	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
612	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
613
614	/** @todo Segment attribute overrides by VMRUN. */
615
616	/*
617	* CPL adjustments and overrides.
618	*
619	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
620	* We shall thus adjust both CS.DPL and SS.DPL here.
621	*/
622	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
623	if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
624	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
625	if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
626	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
627	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
628
629	/*
630	* Continue validating guest-state and controls.
631	*
632	* We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
633	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
634	* old and new EFER value to not have any guest EFER bits influence the new
635	* nested-guest EFER.
636	*/
637	uint64_t uValidEfer;
638	rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
639	if (RT_FAILURE(rc))
640	{
641	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
642	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
643	}
644
645	/* Validate paging and CPU mode bits. */
646	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
647	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
648	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
649	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
650	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
651	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
652	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
653	bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
654	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
655	if (fLongModeWithPaging)
656	uValidEfer \|= MSR_K6_EFER_LMA;
657	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
658	if ( !fSvm
659	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
660	\|\| (fLongModeWithPaging && !fPae)
661	\|\| (fLongModeWithPaging && !fProtMode)
662	\|\| ( fLongModeEnabled
663	&& fPaging
664	&& fPae
665	&& fLongModeConformCS))
666	{
667	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
668	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
669	}
670
671	/*
672	* Preserve the required force-flags.
673	*
674	* We only preserve the force-flags that would affect the execution of the
675	* nested-guest (or the guest).
676	*
677	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
678	* execution of a subsequent IRET instruction in the guest.
679	*
680	* The remaining FFs (e.g. timers) can stay in place so that we will be able to
681	* generate interrupts that should cause #VMEXITs for the nested-guest.
682	*
683	* VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
684	* preserve VMCPU_FF_INHIBIT_INTERRUPTS.
685	*/
686	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
687	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
688
689	/*
690	* Pause filter.
691	*/
692	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
693	{
694	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
695	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
696	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
697	}
698
699	/*
700	* Interrupt shadow.
701	*/
702	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
703	{
704	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
705	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
706	EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
707	}
708
709	/*
710	* TLB flush control.
711	* Currently disabled since it's redundant as we unconditionally flush the TLB
712	* in iemSvmWorldSwitch() below.
713	*/
714	# if 0
715	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
716	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
717	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
718	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
719	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
720	# endif
721
722	/*
723	* Validate and map PAE PDPEs if the guest will be using PAE paging.
724	* Invalid PAE PDPEs here causes a #VMEXIT.
725	*/
726	bool fCr3Mapped;
727	if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
728	&& CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
729	{
730	rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
731	if (RT_SUCCESS(rc))
732	fCr3Mapped = true;
733	else
734	{
735	Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
736	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
737	}
738	}
739	else
740	fCr3Mapped = false;
741
742	/*
743	* Copy the remaining guest state from the VMCB to the guest-CPU context.
744	*/
745	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
746	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
747	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
748	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
749	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
750	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
751	pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
752	pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
753	pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
754	pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
755	pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
756	pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
757	pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
758	pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
759	CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
760	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
761	pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
762
763	/* Mask DR6, DR7 bits mandatory set/clear bits. */
764	pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
765	pVCpu->cpum.GstCtx.dr[6] \|= X86_DR6_RA1_MASK;
766	pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
767	pVCpu->cpum.GstCtx.dr[7] \|= X86_DR7_RA1_MASK;
768
769	/*
770	* Check for pending virtual interrupts.
771	*/
772	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
773	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
774	else
775	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
776
777	/*
778	* Update PGM, IEM and others of a world-switch.
779	*/
780	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, fCr3Mapped);
781	if (rcStrict == VINF_SUCCESS)
782	{ /* likely */ }
783	else if (RT_SUCCESS(rcStrict))
784	{
785	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
786	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
787	}
788	else
789	{
790	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
791	return rcStrict;
792	}
793
794	/*
795	* Set the global-interrupt flag to allow interrupts in the guest.
796	*/
797	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
798
799	/*
800	* Event injection.
801	*/
802	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
803	pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
804	if (pEventInject->n.u1Valid)
805	{
806	uint8_t const uVector = pEventInject->n.u8Vector;
807	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
808	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
809
810	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
811	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
812	{
813	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
814	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
815	}
816	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
817	{
818	if ( uVector == X86_XCPT_NMI
819	\|\| uVector > X86_XCPT_LAST)
820	{
821	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
822	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
823	}
824	if ( uVector == X86_XCPT_BR
825	&& CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
826	{
827	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
828	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
829	}
830	/** @todo any others? */
831	}
832
833	/*
834	* Invalidate the exit interrupt-information field here. This field is fully updated
835	* on #VMEXIT as events other than the one below can also cause intercepts during
836	* their injection (e.g. exceptions).
837	*/
838	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
839
840	/*
841	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
842	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
843	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
844	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
845	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
846	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
847	* injecting the event through IEM here.
848	*/
849	pVmcbCtrl->EventInject.n.u1Valid = 0;
850
851	/** @todo NRIP: Software interrupts can only be pushed properly if we support
852	* NRIP for the nested-guest to calculate the instruction length
853	* below. */
854	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
855	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
856	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
857
858	/*
859	* We shall not inject the event here right away. There may be paging mode related updates
860	* as a result of the world-switch above that are yet to be honored. Instead flag the event
861	* as pending for injection.
862	*/
863	TRPMAssertTrap(pVCpu, uVector, enmType);
864	if (pEventInject->n.u1ErrorCodeValid)
865	TRPMSetErrorCode(pVCpu, uErrorCode);
866	if ( enmType == TRPM_TRAP
867	&& uVector == X86_XCPT_PF)
868	TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
869	}
870	else
871	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
872	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
873	pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
874
875	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
876
877	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
878	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
879	if ( HMIsEnabled(pVM)
880	&& HMIsSvmVGifActive(pVM))
881	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
882	# endif
883
884	return rcStrict;
885	}
886
887	/* Shouldn't really happen as the caller should've validated the physical address already. */
888	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
889	return rc;
890	}
891
892
893	/**
894	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
895	* intercept is active.
896	*
897	* @returns Strict VBox status code.
898	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
899	* we're not executing a nested-guest.
900	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
901	* successfully.
902	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
903	* failed and a shutdown needs to be initiated for the guest.
904	*
905	* @returns VBox strict status code.
906	* @param pVCpu The cross context virtual CPU structure of the calling thread.
907	* @param u8Vector The interrupt or exception vector.
908	* @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
909	* @param uErr The error-code associated with the exception.
910	* @param uCr2 The CR2 value in case of a \#PF exception.
911	*/
912	IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
913	{
914	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
915
916	/*
917	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
918	*
919	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
920	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
921	* even when they use a vector in the range 0 to 31.
922	* - ICEBP should not trigger #DB intercept, but its own intercept.
923	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
924	*/
925	/* Check NMI intercept */
926	if ( u8Vector == X86_XCPT_NMI
927	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
928	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
929	{
930	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
931	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
932	}
933
934	/* Check ICEBP intercept. */
935	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
936	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
937	{
938	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
939	IEM_SVM_UPDATE_NRIP(pVCpu);
940	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
941	}
942
943	/* Check CPU exception intercepts. */
944	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
945	&& IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
946	{
947	Assert(u8Vector <= X86_XCPT_LAST);
948	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
949	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
950	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
951	&& u8Vector == X86_XCPT_PF
952	&& !(uErr & X86_TRAP_PF_ID))
953	{
954	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
955	# ifdef IEM_WITH_CODE_TLB
956	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
957	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
958	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
959	if ( pbInstrBuf
960	&& cbInstrBuf > 0)
961	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
962	# else
963	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
964	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
965	if (cbOpcode > 0)
966	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
967	# endif
968	}
969	if (u8Vector == X86_XCPT_BR)
970	IEM_SVM_UPDATE_NRIP(pVCpu);
971	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
972	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
973	u8Vector, uExitInfo1, uExitInfo2));
974	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
975	}
976
977	/* Check software interrupt (INTn) intercepts. */
978	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
979	\| IEM_XCPT_FLAGS_BP_INSTR
980	\| IEM_XCPT_FLAGS_ICEBP_INSTR
981	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
982	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
983	{
984	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
985	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
986	IEM_SVM_UPDATE_NRIP(pVCpu);
987	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
988	}
989
990	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
991	}
992
993
994	/**
995	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
996	* corresponding intercept is active.
997	*
998	* @returns Strict VBox status code.
999	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1000	* we're not executing a nested-guest.
1001	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1002	* successfully.
1003	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1004	* failed and a shutdown needs to be initiated for the guest.
1005	*
1006	* @returns VBox strict status code.
1007	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1008	* @param u16Port The IO port being accessed.
1009	* @param enmIoType The type of IO access.
1010	* @param cbReg The IO operand size in bytes.
1011	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1012	* @param iEffSeg The effective segment number.
1013	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1014	* @param fStrIo Whether this is a string IO instruction.
1015	* @param cbInstr The length of the IO instruction in bytes.
1016	*/
1017	IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1018	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1019	{
1020	Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1021	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1022	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1023
1024	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1025
1026	SVMIOIOEXITINFO IoExitInfo;
1027	bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1028	cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1029	if (fIntercept)
1030	{
1031	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1032	IEM_SVM_UPDATE_NRIP(pVCpu);
1033	return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1034	}
1035
1036	/** @todo remove later (for debugging as VirtualBox always traps all IO
1037	* intercepts). */
1038	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1039	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1040	}
1041
1042
1043	/**
1044	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1045	* corresponding intercept is active.
1046	*
1047	* @returns Strict VBox status code.
1048	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1049	* specify interception of the accessed MSR @a idMsr.
1050	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1051	* successfully.
1052	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1053	* failed and a shutdown needs to be initiated for the guest.
1054	*
1055	* @param pVCpu The cross context virtual CPU structure.
1056	* @param idMsr The MSR being accessed in the nested-guest.
1057	* @param fWrite Whether this is an MSR write access, @c false implies an
1058	* MSR read.
1059	* @param cbInstr The length of the MSR read/write instruction in bytes.
1060	*/
1061	IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite)
1062	{
1063	/*
1064	* Check if any MSRs are being intercepted.
1065	*/
1066	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1067	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1068
1069	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1070
1071	/*
1072	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1073	*/
1074	uint16_t offMsrpm;
1075	uint8_t uMsrpmBit;
1076	int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1077	if (RT_SUCCESS(rc))
1078	{
1079	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1080	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1081	if (fWrite)
1082	++uMsrpmBit;
1083
1084	/*
1085	* Check if the bit is set, if so, trigger a #VMEXIT.
1086	*/
1087	if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1088	{
1089	IEM_SVM_UPDATE_NRIP(pVCpu);
1090	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1091	}
1092	}
1093	else
1094	{
1095	/*
1096	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1097	*/
1098	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1099	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1100	}
1101	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1102	}
1103
1104
1105
1106	/**
1107	* Implements 'VMRUN'.
1108	*/
1109	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1110	{
1111	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1112	RT_NOREF2(pVCpu, cbInstr);
1113	return VINF_EM_RAW_EMULATE_INSTR;
1114	# else
1115	LogFlow(("iemCImpl_vmrun\n"));
1116	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1117
1118	/** @todo Check effective address size using address size prefix. */
1119	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1120	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1121	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1122	{
1123	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1124	return iemRaiseGeneralProtectionFault0(pVCpu);
1125	}
1126
1127	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1128	{
1129	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1130	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1131	}
1132
1133	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1134	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1135	{
1136	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1137	rcStrict = VINF_EM_TRIPLE_FAULT;
1138	}
1139	return rcStrict;
1140	# endif
1141	}
1142
1143
1144	/**
1145	* Implements 'VMLOAD'.
1146	*/
1147	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1148	{
1149	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1150	RT_NOREF2(pVCpu, cbInstr);
1151	return VINF_EM_RAW_EMULATE_INSTR;
1152	# else
1153	LogFlow(("iemCImpl_vmload\n"));
1154	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1155
1156	/** @todo Check effective address size using address size prefix. */
1157	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1158	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1159	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1160	{
1161	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1162	return iemRaiseGeneralProtectionFault0(pVCpu);
1163	}
1164
1165	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1166	{
1167	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1168	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1169	}
1170
1171	SVMVMCBSTATESAVE VmcbNstGst;
1172	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1173	sizeof(SVMVMCBSTATESAVE));
1174	if (rcStrict == VINF_SUCCESS)
1175	{
1176	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1177	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1178	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1179	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1180	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1181
1182	pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1183	pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1184	pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1185	pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1186	pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1187
1188	pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1189	pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1190	pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1191
1192	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1193	}
1194	return rcStrict;
1195	# endif
1196	}
1197
1198
1199	/**
1200	* Implements 'VMSAVE'.
1201	*/
1202	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1203	{
1204	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1205	RT_NOREF2(pVCpu, cbInstr);
1206	return VINF_EM_RAW_EMULATE_INSTR;
1207	# else
1208	LogFlow(("iemCImpl_vmsave\n"));
1209	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1210
1211	/** @todo Check effective address size using address size prefix. */
1212	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1213	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1214	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1215	{
1216	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1217	return iemRaiseGeneralProtectionFault0(pVCpu);
1218	}
1219
1220	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1221	{
1222	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1223	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1224	}
1225
1226	SVMVMCBSTATESAVE VmcbNstGst;
1227	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1228	sizeof(SVMVMCBSTATESAVE));
1229	if (rcStrict == VINF_SUCCESS)
1230	{
1231	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1232	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS \| CPUMCTX_EXTRN_GS \| CPUMCTX_EXTRN_TR \| CPUMCTX_EXTRN_LDTR
1233	\| CPUMCTX_EXTRN_KERNEL_GS_BASE \| CPUMCTX_EXTRN_SYSCALL_MSRS \| CPUMCTX_EXTRN_SYSENTER_MSRS);
1234
1235	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1236	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1237	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1238	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1239
1240	VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1241	VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1242	VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1243	VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1244	VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1245
1246	VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1247	VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1248	VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1249
1250	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1251	sizeof(SVMVMCBSTATESAVE));
1252	if (rcStrict == VINF_SUCCESS)
1253	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1254	}
1255	return rcStrict;
1256	# endif
1257	}
1258
1259
1260	/**
1261	* Implements 'CLGI'.
1262	*/
1263	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1264	{
1265	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1266	RT_NOREF2(pVCpu, cbInstr);
1267	return VINF_EM_RAW_EMULATE_INSTR;
1268	# else
1269	LogFlow(("iemCImpl_clgi\n"));
1270	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1271	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1272	{
1273	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1274	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1275	}
1276
1277	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1278	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1279
1280	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1281	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1282	# else
1283	return VINF_SUCCESS;
1284	# endif
1285	# endif
1286	}
1287
1288
1289	/**
1290	* Implements 'STGI'.
1291	*/
1292	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1293	{
1294	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1295	RT_NOREF2(pVCpu, cbInstr);
1296	return VINF_EM_RAW_EMULATE_INSTR;
1297	# else
1298	LogFlow(("iemCImpl_stgi\n"));
1299	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1300	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1301	{
1302	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1303	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1304	}
1305
1306	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1307	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1308
1309	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1310	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1311	# else
1312	return VINF_SUCCESS;
1313	# endif
1314	# endif
1315	}
1316
1317
1318	/**
1319	* Implements 'INVLPGA'.
1320	*/
1321	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1322	{
1323	/** @todo Check effective address size using address size prefix. */
1324	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1325	/** @todo PGM needs virtual ASID support. */
1326	# if 0
1327	uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1328	# endif
1329
1330	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1331	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1332	{
1333	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1334	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1335	}
1336
1337	PGMInvalidatePage(pVCpu, GCPtrPage);
1338	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1339	return VINF_SUCCESS;
1340	}
1341
1342
1343	/**
1344	* Implements 'SKINIT'.
1345	*/
1346	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1347	{
1348	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1349
1350	uint32_t uIgnore;
1351	uint32_t fFeaturesECX;
1352	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1353	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1354	return iemRaiseUndefinedOpcode(pVCpu);
1355
1356	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1357	{
1358	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1359	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1360	}
1361
1362	RT_NOREF(cbInstr);
1363	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1364	}
1365
1366
1367	/**
1368	* Implements SVM's implementation of PAUSE.
1369	*/
1370	IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1371	{
1372	bool fCheckIntercept = true;
1373	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1374	{
1375	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1376
1377	/* TSC based pause-filter thresholding. */
1378	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1379	&& pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1380	{
1381	uint64_t const uTick = TMCpuTickGet(pVCpu);
1382	if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1383	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1384	pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1385	}
1386
1387	/* Simple pause-filter counter. */
1388	if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1389	{
1390	--pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1391	fCheckIntercept = false;
1392	}
1393	}
1394
1395	if (fCheckIntercept)
1396	IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1397
1398	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1399	return VINF_SUCCESS;
1400	}
1401
1402	#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1403
1404	/**
1405	* Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1406	*/
1407	IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1408	{
1409	if (EMAreHypercallInstructionsEnabled(pVCpu))
1410	{
1411	NOREF(uDisOpcode);
1412	VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1413	if (RT_SUCCESS(rcStrict))
1414	{
1415	if (rcStrict == VINF_SUCCESS)
1416	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1417	if ( rcStrict == VINF_SUCCESS
1418	\|\| rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1419	return VINF_SUCCESS;
1420	AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1421	return rcStrict;
1422	}
1423	AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1424	\|\| rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1425	\|\| rcStrict == VERR_GIM_NOT_ENABLED
1426	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1427	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1428	("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1429
1430	/* Raise #UD on all failures. */
1431	}
1432	return iemRaiseUndefinedOpcode(pVCpu);
1433	}
1434
1435
1436	/**
1437	* Implements 'VMMCALL'.
1438	*/
1439	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1440	{
1441	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1442	{
1443	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1444	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1445	}
1446
1447	/* This is a little bit more complicated than the VT-x version because HM/SVM may
1448	patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1449	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1450	if (VM_IS_HM_ENABLED(pVM))
1451	{
1452	int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1453	if (RT_SUCCESS(rc))
1454	{
1455	Log(("vmmcall: MovTpr\n"));
1456	return VINF_SUCCESS;
1457	}
1458	}
1459
1460	/* Join forces with vmcall. */
1461	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1462	}
1463

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 92583

Download in other formats: