VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h@ 93666

Last change on this file since 93666 was 93115, checked in by vboxsync, 3 years ago

scm --update-copyright-year
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 62.0 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp.h 93115 2022-01-01 11:31:46Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/*********************************************************************************************************************************
20* Defined Constants And Macros *
21*********************************************************************************************************************************/
22#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
23/**
24 * Check the common SVM instruction preconditions.
25 */
26# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
27 do { \
28 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
29 { \
30 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
31 return iemRaiseUndefinedOpcode(a_pVCpu); \
32 } \
33 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
34 { \
35 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
36 return iemRaiseUndefinedOpcode(a_pVCpu); \
37 } \
38 if ((a_pVCpu)->iem.s.uCpl != 0) \
39 { \
40 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
41 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
42 } \
43 } while (0)
44
45
46/**
47 * Converts an IEM exception event type to an SVM event type.
48 *
49 * @returns The SVM event type.
50 * @retval UINT8_MAX if the specified type of event isn't among the set
51 * of recognized IEM event types.
52 *
53 * @param uVector The vector of the event.
54 * @param fIemXcptFlags The IEM exception / interrupt flags.
55 */
56IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
57{
58 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
59 {
60 if (uVector != X86_XCPT_NMI)
61 return SVM_EVENT_EXCEPTION;
62 return SVM_EVENT_NMI;
63 }
64
65 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
66 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
67 return SVM_EVENT_EXCEPTION;
68
69 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
70 return SVM_EVENT_EXTERNAL_IRQ;
71
72 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
73 return SVM_EVENT_SOFTWARE_INT;
74
75 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
76 return UINT8_MAX;
77}
78
79
80/**
81 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
82 *
83 * @returns Strict VBox status code.
84 * @param pVCpu The cross context virtual CPU structure.
85 */
86DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu)
87{
88 /*
89 * Inform PGM about paging mode changes.
90 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
91 * see comment in iemMemPageTranslateAndCheckAccess().
92 */
93 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
94 true /* fForce */);
95 AssertRCReturn(rc, rc);
96
97 /* Invalidate IEM TLBs now that we've forced a PGM mode change. */
98 IEMTlbInvalidateAll(pVCpu, false /*fVmm*/);
99
100 /* Inform CPUM (recompiler), can later be removed. */
101 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
102
103 /* Re-initialize IEM cache/state after the drastic mode switch. */
104 iemReInitExec(pVCpu);
105 return rc;
106}
107
108
109/**
110 * SVM \#VMEXIT handler.
111 *
112 * @returns Strict VBox status code.
113 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
114 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
115 * "host state" and a shutdown is required.
116 *
117 * @param pVCpu The cross context virtual CPU structure.
118 * @param uExitCode The exit code.
119 * @param uExitInfo1 The exit info. 1 field.
120 * @param uExitInfo2 The exit info. 2 field.
121 */
122IEM_STATIC VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
123{
124 VBOXSTRICTRC rcStrict;
125 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
126 || uExitCode == SVM_EXIT_INVALID)
127 {
128 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
129 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
130
131 /*
132 * Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
133 */
134 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
135
136 /*
137 * Map the nested-guest VMCB from its location in guest memory.
138 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
139 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
140 */
141 PSVMVMCB pVmcbMem;
142 PGMPAGEMAPLOCK PgLockMem;
143 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
144 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
145 &PgLockMem);
146 if (rcStrict == VINF_SUCCESS)
147 {
148 /*
149 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
150 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
151 * writing the VMCB back to guest memory.
152 */
153 HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
154
155 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
156 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
157 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
158 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
159
160 /*
161 * Save the nested-guest state into the VMCB state-save area.
162 */
163 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
164 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
165 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
166 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
167 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
168 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
169 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
170 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
171 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
172 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
173 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
174 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
175 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
176 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
177 /** @todo Nested paging. */
178 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
179 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
180 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
181 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
182 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
183 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
184 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
185 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
186 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
187 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
188
189 /*
190 * Save additional state and intercept information.
191 *
192 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
193 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
194 * SVM execution.
195 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
196 */
197 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
198 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
199 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
200 else
201 {
202 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
203 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
204 }
205
206 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
207
208 if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
209 && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
210 {
211 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
212 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
213 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
214 }
215 else
216 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
217
218 /*
219 * Save nRIP, instruction length and byte fields.
220 */
221 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
222 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
223 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
224
225 /*
226 * Save exit information.
227 */
228 pVmcbMemCtrl->u64ExitCode = uExitCode;
229 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
230 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
231
232 /*
233 * Update the exit interrupt-information field if this #VMEXIT happened as a result
234 * of delivering an event through IEM.
235 *
236 * Don't update the exit interrupt-information field if the event wasn't being injected
237 * through IEM, as it would have been updated by real hardware if the nested-guest was
238 * executed using hardware-assisted SVM.
239 */
240 {
241 uint8_t uExitIntVector;
242 uint32_t uExitIntErr;
243 uint32_t fExitIntFlags;
244 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
245 NULL /* uExitIntCr2 */);
246 if (fRaisingEvent)
247 {
248 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
249 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
250 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
251 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
252 {
253 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
254 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
255 }
256 }
257 }
258
259 /*
260 * Save the exit interrupt-information field.
261 *
262 * We write the whole field including overwriting reserved bits as it was observed on an
263 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
264 */
265 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
266
267 /*
268 * Clear event injection.
269 */
270 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
271
272 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
273 }
274
275 /*
276 * Prepare for guest's "host mode" by clearing internal processor state bits.
277 *
278 * We don't need to zero out the state-save area, just the controls should be
279 * sufficient because it has the critical bit of indicating whether we're inside
280 * the nested-guest or not.
281 */
282 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
283 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
284
285 /*
286 * Restore the subset of force-flags that were preserved.
287 */
288 if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
289 {
290 VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
291 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
292 }
293
294 if (rcStrict == VINF_SUCCESS)
295 {
296 /** @todo Nested paging. */
297 /** @todo ASID. */
298
299 /*
300 * If we are switching to PAE mode host, validate the PDPEs first.
301 * Any invalid PDPEs here causes a VCPU shutdown.
302 */
303 PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
304 bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
305 if (fHostInPaeMode)
306 rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
307 if (RT_SUCCESS(rcStrict))
308 {
309 /*
310 * Reload the host state.
311 */
312 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
313
314 /*
315 * Update PGM, IEM and others of a world-switch.
316 */
317 rcStrict = iemSvmWorldSwitch(pVCpu);
318 if (rcStrict == VINF_SUCCESS)
319 rcStrict = VINF_SVM_VMEXIT;
320 else if (RT_SUCCESS(rcStrict))
321 {
322 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
323 iemSetPassUpStatus(pVCpu, rcStrict);
324 rcStrict = VINF_SVM_VMEXIT;
325 }
326 else
327 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
328 }
329 else
330 {
331 Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
332 rcStrict = VINF_EM_TRIPLE_FAULT;
333 }
334 }
335 else
336 {
337 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
338 rcStrict = VINF_EM_TRIPLE_FAULT;
339 }
340 }
341 else
342 {
343 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
344 rcStrict = VERR_SVM_IPE_3;
345 }
346
347# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
348 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
349 if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
350 && HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
351 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
352# endif
353 return rcStrict;
354}
355
356
357/**
358 * Performs the operations necessary that are part of the vmrun instruction
359 * execution in the guest.
360 *
361 * @returns Strict VBox status code (i.e. informational status codes too).
362 * @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
363 * code execution.
364 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
365 * (SVM_EXIT_INVALID most likely).
366 *
367 * @param pVCpu The cross context virtual CPU structure.
368 * @param cbInstr The length of the VMRUN instruction.
369 * @param GCPhysVmcb Guest physical address of the VMCB to run.
370 */
371IEM_STATIC VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb)
372{
373 LogFlow(("iemSvmVmrun\n"));
374
375 /*
376 * Cache the physical address of the VMCB for #VMEXIT exceptions.
377 */
378 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
379
380 /*
381 * Save the host state.
382 */
383 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
384
385 /*
386 * Read the guest VMCB.
387 */
388 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
389 int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
390 if (RT_SUCCESS(rc))
391 {
392 /*
393 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
394 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
395 * but in our implementation we try to preserve as much as we possibly can.
396 *
397 * We could read the entire page here and only write back the relevant fields on
398 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
399 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
400 * currently reserved but may be recognized as features bits in future CPUs causing
401 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
402 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
403 */
404 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
405 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
406
407 RT_ZERO(pVmcbCtrl->u8Reserved0);
408 RT_ZERO(pVmcbCtrl->u8Reserved1);
409 RT_ZERO(pVmcbCtrl->u8Reserved2);
410 RT_ZERO(pVmcbNstGst->u8Reserved0);
411 RT_ZERO(pVmcbNstGst->u8Reserved1);
412 RT_ZERO(pVmcbNstGst->u8Reserved2);
413 RT_ZERO(pVmcbNstGst->u8Reserved3);
414 RT_ZERO(pVmcbNstGst->u8Reserved4);
415 RT_ZERO(pVmcbNstGst->u8Reserved5);
416 pVmcbCtrl->u32Reserved0 = 0;
417 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
418 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
419 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
420 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
421 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
422 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
423 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
424 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
425 pVmcbCtrl->EventInject.n.u19Reserved = 0;
426 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
427
428 /*
429 * Validate guest-state and controls.
430 */
431 /* VMRUN must always be intercepted. */
432 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
433 {
434 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
435 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
436 }
437
438 /* Nested paging. */
439 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
440 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
441 {
442 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
443 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
444 }
445
446 /* AVIC. */
447 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
448 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
449 {
450 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
451 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
452 }
453
454 /* Last branch record (LBR) virtualization. */
455 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
456 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
457 {
458 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
459 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
460 }
461
462 /* Virtualized VMSAVE/VMLOAD. */
463 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
464 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
465 {
466 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
467 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
468 }
469
470 /* Virtual GIF. */
471 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
472 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
473 {
474 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
475 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
476 }
477
478 /* Guest ASID. */
479 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
480 {
481 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
482 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
483 }
484
485 /* Guest AVIC. */
486 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
487 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
488 {
489 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
490 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
491 }
492
493 /* Guest Secure Encrypted Virtualization. */
494 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
495 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
496 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
497 {
498 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
499 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
500 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
501 }
502
503 /* Flush by ASID. */
504 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
505 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
506 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
507 {
508 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
509 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
510 }
511
512 /* IO permission bitmap. */
513 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
514 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
515 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
516 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
517 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
518 {
519 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
520 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
521 }
522
523 /* MSR permission bitmap. */
524 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
525 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
526 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
527 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
528 {
529 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
530 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
531 }
532
533 /* CR0. */
534 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
535 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
536 {
537 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
538 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
539 }
540 if (pVmcbNstGst->u64CR0 >> 32)
541 {
542 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
543 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
544 }
545 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
546
547 /* DR6 and DR7. */
548 if ( pVmcbNstGst->u64DR6 >> 32
549 || pVmcbNstGst->u64DR7 >> 32)
550 {
551 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
552 pVmcbNstGst->u64DR6));
553 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
554 }
555
556 /*
557 * PAT (Page Attribute Table) MSR.
558 *
559 * The CPU only validates and loads it when nested-paging is enabled.
560 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
561 */
562 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
563 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
564 {
565 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
566 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
567 }
568
569 /*
570 * Copy the IO permission bitmap into the cache.
571 */
572 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
573 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
574 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
575 if (RT_FAILURE(rc))
576 {
577 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
578 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
579 }
580
581 /*
582 * Copy the MSR permission bitmap into the cache.
583 */
584 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
585 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
586 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
587 if (RT_FAILURE(rc))
588 {
589 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
590 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
591 }
592
593 /*
594 * Copy segments from nested-guest VMCB state to the guest-CPU state.
595 *
596 * We do this here as we need to use the CS attributes and it's easier this way
597 * then using the VMCB format selectors. It doesn't really matter where we copy
598 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
599 */
600 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
601 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
602 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
603 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
604
605 /** @todo Segment attribute overrides by VMRUN. */
606
607 /*
608 * CPL adjustments and overrides.
609 *
610 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
611 * We shall thus adjust both CS.DPL and SS.DPL here.
612 */
613 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
614 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
615 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
616 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
617 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
618 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
619
620 /*
621 * Continue validating guest-state and controls.
622 *
623 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
624 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
625 * old and new EFER value to not have any guest EFER bits influence the new
626 * nested-guest EFER.
627 */
628 uint64_t uValidEfer;
629 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
630 if (RT_FAILURE(rc))
631 {
632 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
633 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
634 }
635
636 /* Validate paging and CPU mode bits. */
637 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
638 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
639 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
640 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
641 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
642 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
643 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
644 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
645 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
646 if (fLongModeWithPaging)
647 uValidEfer |= MSR_K6_EFER_LMA;
648 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
649 if ( !fSvm
650 || (!fLongModeSupported && fLongModeActiveOrEnabled)
651 || (fLongModeWithPaging && !fPae)
652 || (fLongModeWithPaging && !fProtMode)
653 || ( fLongModeEnabled
654 && fPaging
655 && fPae
656 && fLongModeConformCS))
657 {
658 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
659 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
660 }
661
662 /*
663 * Preserve the required force-flags.
664 *
665 * We only preserve the force-flags that would affect the execution of the
666 * nested-guest (or the guest).
667 *
668 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
669 * execution of a subsequent IRET instruction in the guest.
670 *
671 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
672 * generate interrupts that should cause #VMEXITs for the nested-guest.
673 *
674 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
675 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
676 */
677 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
678 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
679
680 /*
681 * Pause filter.
682 */
683 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
684 {
685 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
686 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
687 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
688 }
689
690 /*
691 * Interrupt shadow.
692 */
693 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
694 {
695 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
696 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
697 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
698 }
699
700 /*
701 * TLB flush control.
702 * Currently disabled since it's redundant as we unconditionally flush the TLB
703 * in iemSvmWorldSwitch() below.
704 */
705# if 0
706 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
707 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
708 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
709 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
710 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
711# endif
712
713 /*
714 * Validate and map PAE PDPEs if the guest will be using PAE paging.
715 * Invalid PAE PDPEs here causes a #VMEXIT.
716 */
717 if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
718 && CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
719 {
720 rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
721 if (RT_SUCCESS(rc))
722 { /* likely */ }
723 else
724 {
725 Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
726 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
727 }
728 }
729
730 /*
731 * Copy the remaining guest state from the VMCB to the guest-CPU context.
732 */
733 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
734 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
735 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
736 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
737 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
738 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
739 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
740 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
741 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
742 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
743 pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
744 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
745 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
746 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
747 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
748 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
749 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
750
751 /* Mask DR6, DR7 bits mandatory set/clear bits. */
752 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
753 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
754 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
755 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
756
757 /*
758 * Check for pending virtual interrupts.
759 */
760 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
761 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
762 else
763 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
764
765 /*
766 * Update PGM, IEM and others of a world-switch.
767 */
768 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
769 if (rcStrict == VINF_SUCCESS)
770 { /* likely */ }
771 else if (RT_SUCCESS(rcStrict))
772 {
773 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
774 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
775 }
776 else
777 {
778 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
779 return rcStrict;
780 }
781
782 /*
783 * Set the global-interrupt flag to allow interrupts in the guest.
784 */
785 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
786
787 /*
788 * Event injection.
789 */
790 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
791 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
792 if (pEventInject->n.u1Valid)
793 {
794 uint8_t const uVector = pEventInject->n.u8Vector;
795 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
796 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
797
798 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
799 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
800 {
801 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
802 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
803 }
804 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
805 {
806 if ( uVector == X86_XCPT_NMI
807 || uVector > X86_XCPT_LAST)
808 {
809 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
810 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
811 }
812 if ( uVector == X86_XCPT_BR
813 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
814 {
815 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
816 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
817 }
818 /** @todo any others? */
819 }
820
821 /*
822 * Invalidate the exit interrupt-information field here. This field is fully updated
823 * on #VMEXIT as events other than the one below can also cause intercepts during
824 * their injection (e.g. exceptions).
825 */
826 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
827
828 /*
829 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
830 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
831 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
832 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
833 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
834 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
835 * injecting the event through IEM here.
836 */
837 pVmcbCtrl->EventInject.n.u1Valid = 0;
838
839 /** @todo NRIP: Software interrupts can only be pushed properly if we support
840 * NRIP for the nested-guest to calculate the instruction length
841 * below. */
842 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
843 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
844 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
845
846 /*
847 * We shall not inject the event here right away. There may be paging mode related updates
848 * as a result of the world-switch above that are yet to be honored. Instead flag the event
849 * as pending for injection.
850 */
851 TRPMAssertTrap(pVCpu, uVector, enmType);
852 if (pEventInject->n.u1ErrorCodeValid)
853 TRPMSetErrorCode(pVCpu, uErrorCode);
854 if ( enmType == TRPM_TRAP
855 && uVector == X86_XCPT_PF)
856 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
857 }
858 else
859 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
860 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
861 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
862
863 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
864
865# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
866 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
867 if ( HMIsEnabled(pVM)
868 && HMIsSvmVGifActive(pVM))
869 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
870# endif
871
872 return rcStrict;
873 }
874
875 /* Shouldn't really happen as the caller should've validated the physical address already. */
876 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
877 return rc;
878}
879
880
881/**
882 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
883 * intercept is active.
884 *
885 * @returns Strict VBox status code.
886 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
887 * we're not executing a nested-guest.
888 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
889 * successfully.
890 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
891 * failed and a shutdown needs to be initiated for the guest.
892 *
893 * @returns VBox strict status code.
894 * @param pVCpu The cross context virtual CPU structure of the calling thread.
895 * @param u8Vector The interrupt or exception vector.
896 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
897 * @param uErr The error-code associated with the exception.
898 * @param uCr2 The CR2 value in case of a \#PF exception.
899 */
900IEM_STATIC VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2)
901{
902 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
903
904 /*
905 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
906 *
907 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
908 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
909 * even when they use a vector in the range 0 to 31.
910 * - ICEBP should not trigger #DB intercept, but its own intercept.
911 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
912 */
913 /* Check NMI intercept */
914 if ( u8Vector == X86_XCPT_NMI
915 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
916 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
917 {
918 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
919 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
920 }
921
922 /* Check ICEBP intercept. */
923 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
924 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
925 {
926 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
927 IEM_SVM_UPDATE_NRIP(pVCpu);
928 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
929 }
930
931 /* Check CPU exception intercepts. */
932 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
933 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
934 {
935 Assert(u8Vector <= X86_XCPT_LAST);
936 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
937 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
938 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
939 && u8Vector == X86_XCPT_PF
940 && !(uErr & X86_TRAP_PF_ID))
941 {
942 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
943# ifdef IEM_WITH_CODE_TLB
944 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
945 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
946 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
947 if ( pbInstrBuf
948 && cbInstrBuf > 0)
949 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
950# else
951 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
952 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
953 if (cbOpcode > 0)
954 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
955# endif
956 }
957 if (u8Vector == X86_XCPT_BR)
958 IEM_SVM_UPDATE_NRIP(pVCpu);
959 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
960 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
961 u8Vector, uExitInfo1, uExitInfo2));
962 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
963 }
964
965 /* Check software interrupt (INTn) intercepts. */
966 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
967 | IEM_XCPT_FLAGS_BP_INSTR
968 | IEM_XCPT_FLAGS_ICEBP_INSTR
969 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
970 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
971 {
972 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
973 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
974 IEM_SVM_UPDATE_NRIP(pVCpu);
975 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
976 }
977
978 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
979}
980
981
982/**
983 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
984 * corresponding intercept is active.
985 *
986 * @returns Strict VBox status code.
987 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
988 * we're not executing a nested-guest.
989 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
990 * successfully.
991 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
992 * failed and a shutdown needs to be initiated for the guest.
993 *
994 * @returns VBox strict status code.
995 * @param pVCpu The cross context virtual CPU structure of the calling thread.
996 * @param u16Port The IO port being accessed.
997 * @param enmIoType The type of IO access.
998 * @param cbReg The IO operand size in bytes.
999 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1000 * @param iEffSeg The effective segment number.
1001 * @param fRep Whether this is a repeating IO instruction (REP prefix).
1002 * @param fStrIo Whether this is a string IO instruction.
1003 * @param cbInstr The length of the IO instruction in bytes.
1004 */
1005IEM_STATIC VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1006 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr)
1007{
1008 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1009 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
1010 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
1011
1012 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1013
1014 SVMIOIOEXITINFO IoExitInfo;
1015 bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1016 cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1017 if (fIntercept)
1018 {
1019 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1020 IEM_SVM_UPDATE_NRIP(pVCpu);
1021 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1022 }
1023
1024 /** @todo remove later (for debugging as VirtualBox always traps all IO
1025 * intercepts). */
1026 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1027 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1028}
1029
1030
1031/**
1032 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1033 * corresponding intercept is active.
1034 *
1035 * @returns Strict VBox status code.
1036 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1037 * specify interception of the accessed MSR @a idMsr.
1038 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1039 * successfully.
1040 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1041 * failed and a shutdown needs to be initiated for the guest.
1042 *
1043 * @param pVCpu The cross context virtual CPU structure.
1044 * @param idMsr The MSR being accessed in the nested-guest.
1045 * @param fWrite Whether this is an MSR write access, @c false implies an
1046 * MSR read.
1047 * @param cbInstr The length of the MSR read/write instruction in bytes.
1048 */
1049IEM_STATIC VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite)
1050{
1051 /*
1052 * Check if any MSRs are being intercepted.
1053 */
1054 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1055 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1056
1057 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1058
1059 /*
1060 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1061 */
1062 uint16_t offMsrpm;
1063 uint8_t uMsrpmBit;
1064 int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1065 if (RT_SUCCESS(rc))
1066 {
1067 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1068 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1069 if (fWrite)
1070 ++uMsrpmBit;
1071
1072 /*
1073 * Check if the bit is set, if so, trigger a #VMEXIT.
1074 */
1075 if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1076 {
1077 IEM_SVM_UPDATE_NRIP(pVCpu);
1078 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1079 }
1080 }
1081 else
1082 {
1083 /*
1084 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1085 */
1086 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1087 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1088 }
1089 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1090}
1091
1092
1093
1094/**
1095 * Implements 'VMRUN'.
1096 */
1097IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1098{
1099# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1100 RT_NOREF2(pVCpu, cbInstr);
1101 return VINF_EM_RAW_EMULATE_INSTR;
1102# else
1103 LogFlow(("iemCImpl_vmrun\n"));
1104 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1105
1106 /** @todo Check effective address size using address size prefix. */
1107 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1108 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1109 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1110 {
1111 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1112 return iemRaiseGeneralProtectionFault0(pVCpu);
1113 }
1114
1115 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1116 {
1117 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1118 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1119 }
1120
1121 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1122 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1123 {
1124 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1125 rcStrict = VINF_EM_TRIPLE_FAULT;
1126 }
1127 return rcStrict;
1128# endif
1129}
1130
1131
1132/**
1133 * Implements 'VMLOAD'.
1134 */
1135IEM_CIMPL_DEF_0(iemCImpl_vmload)
1136{
1137# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1138 RT_NOREF2(pVCpu, cbInstr);
1139 return VINF_EM_RAW_EMULATE_INSTR;
1140# else
1141 LogFlow(("iemCImpl_vmload\n"));
1142 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1143
1144 /** @todo Check effective address size using address size prefix. */
1145 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1146 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1147 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1148 {
1149 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1150 return iemRaiseGeneralProtectionFault0(pVCpu);
1151 }
1152
1153 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1154 {
1155 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1156 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1157 }
1158
1159 SVMVMCBSTATESAVE VmcbNstGst;
1160 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1161 sizeof(SVMVMCBSTATESAVE));
1162 if (rcStrict == VINF_SUCCESS)
1163 {
1164 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1165 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1166 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1167 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1168 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1169
1170 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1171 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1172 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1173 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1174 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1175
1176 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1177 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1178 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1179
1180 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1181 }
1182 return rcStrict;
1183# endif
1184}
1185
1186
1187/**
1188 * Implements 'VMSAVE'.
1189 */
1190IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1191{
1192# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1193 RT_NOREF2(pVCpu, cbInstr);
1194 return VINF_EM_RAW_EMULATE_INSTR;
1195# else
1196 LogFlow(("iemCImpl_vmsave\n"));
1197 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1198
1199 /** @todo Check effective address size using address size prefix. */
1200 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1201 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1202 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1203 {
1204 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1205 return iemRaiseGeneralProtectionFault0(pVCpu);
1206 }
1207
1208 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1209 {
1210 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1211 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1212 }
1213
1214 SVMVMCBSTATESAVE VmcbNstGst;
1215 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1216 sizeof(SVMVMCBSTATESAVE));
1217 if (rcStrict == VINF_SUCCESS)
1218 {
1219 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1220 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1221 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1222
1223 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1224 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1225 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1226 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1227
1228 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1229 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1230 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1231 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1232 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1233
1234 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1235 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1236 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1237
1238 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1239 sizeof(SVMVMCBSTATESAVE));
1240 if (rcStrict == VINF_SUCCESS)
1241 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1242 }
1243 return rcStrict;
1244# endif
1245}
1246
1247
1248/**
1249 * Implements 'CLGI'.
1250 */
1251IEM_CIMPL_DEF_0(iemCImpl_clgi)
1252{
1253# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1254 RT_NOREF2(pVCpu, cbInstr);
1255 return VINF_EM_RAW_EMULATE_INSTR;
1256# else
1257 LogFlow(("iemCImpl_clgi\n"));
1258 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1259 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1260 {
1261 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1262 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1263 }
1264
1265 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1266 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1267
1268# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1269 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1270# else
1271 return VINF_SUCCESS;
1272# endif
1273# endif
1274}
1275
1276
1277/**
1278 * Implements 'STGI'.
1279 */
1280IEM_CIMPL_DEF_0(iemCImpl_stgi)
1281{
1282# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1283 RT_NOREF2(pVCpu, cbInstr);
1284 return VINF_EM_RAW_EMULATE_INSTR;
1285# else
1286 LogFlow(("iemCImpl_stgi\n"));
1287 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1288 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1289 {
1290 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1291 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1292 }
1293
1294 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1295 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1296
1297# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1298 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1299# else
1300 return VINF_SUCCESS;
1301# endif
1302# endif
1303}
1304
1305
1306/**
1307 * Implements 'INVLPGA'.
1308 */
1309IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1310{
1311 /** @todo Check effective address size using address size prefix. */
1312 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1313 /** @todo PGM needs virtual ASID support. */
1314# if 0
1315 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1316# endif
1317
1318 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1319 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1320 {
1321 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1322 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1323 }
1324
1325 PGMInvalidatePage(pVCpu, GCPtrPage);
1326 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1327 return VINF_SUCCESS;
1328}
1329
1330
1331/**
1332 * Implements 'SKINIT'.
1333 */
1334IEM_CIMPL_DEF_0(iemCImpl_skinit)
1335{
1336 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1337
1338 uint32_t uIgnore;
1339 uint32_t fFeaturesECX;
1340 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1341 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1342 return iemRaiseUndefinedOpcode(pVCpu);
1343
1344 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1345 {
1346 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1347 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1348 }
1349
1350 RT_NOREF(cbInstr);
1351 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1352}
1353
1354
1355/**
1356 * Implements SVM's implementation of PAUSE.
1357 */
1358IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1359{
1360 bool fCheckIntercept = true;
1361 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1362 {
1363 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1364
1365 /* TSC based pause-filter thresholding. */
1366 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1367 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1368 {
1369 uint64_t const uTick = TMCpuTickGet(pVCpu);
1370 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1371 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1372 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1373 }
1374
1375 /* Simple pause-filter counter. */
1376 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1377 {
1378 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1379 fCheckIntercept = false;
1380 }
1381 }
1382
1383 if (fCheckIntercept)
1384 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1385
1386 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1387 return VINF_SUCCESS;
1388}
1389
1390#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1391
1392/**
1393 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1394 */
1395IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1396{
1397 if (EMAreHypercallInstructionsEnabled(pVCpu))
1398 {
1399 NOREF(uDisOpcode);
1400 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1401 if (RT_SUCCESS(rcStrict))
1402 {
1403 if (rcStrict == VINF_SUCCESS)
1404 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1405 if ( rcStrict == VINF_SUCCESS
1406 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1407 return VINF_SUCCESS;
1408 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1409 return rcStrict;
1410 }
1411 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1412 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1413 || rcStrict == VERR_GIM_NOT_ENABLED
1414 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1415 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1416 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1417
1418 /* Raise #UD on all failures. */
1419 }
1420 return iemRaiseUndefinedOpcode(pVCpu);
1421}
1422
1423
1424/**
1425 * Implements 'VMMCALL'.
1426 */
1427IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1428{
1429 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1430 {
1431 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1432 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1433 }
1434
1435 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1436 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1437 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1438 if (VM_IS_HM_ENABLED(pVM))
1439 {
1440 int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1441 if (RT_SUCCESS(rc))
1442 {
1443 Log(("vmmcall: MovTpr\n"));
1444 return VINF_SUCCESS;
1445 }
1446 }
1447
1448 /* Join forces with vmcall. */
1449 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1450}
1451
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette