IEMAllCImplSvmInstr.cpp@ 97694

Last change on this file since 97694 was 97694, checked in by vboxsync, 2 years ago
VMM/IEM: Added support for hardware instruction breakpoints (DRx). Corrected some DR6 updating for single stepping. bugref:9898
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 68.0 KB

Line
1	/* $Id: IEMAllCImplSvmInstr.cpp 97694 2022-11-28 22:08:14Z vboxsync $ */
2	/** @file
3	* IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2022 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_IEM_SVM
33	#define VMCPU_INCL_CPUM_GST_CTX
34	#include <VBox/vmm/iem.h>
35	#include <VBox/vmm/apic.h>
36	#include <VBox/vmm/cpum.h>
37	#include <VBox/vmm/dbgf.h>
38	#include <VBox/vmm/em.h>
39	#include <VBox/vmm/hm.h>
40	#include <VBox/vmm/pgm.h>
41	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
42	# include <VBox/vmm/hm_svm.h>
43	#endif
44	#include <VBox/vmm/gim.h>
45	#include <VBox/vmm/tm.h>
46	#include "IEMInternal.h"
47	#include <VBox/vmm/vmcc.h>
48	#include <VBox/log.h>
49	#include <VBox/disopcode.h> /* for OP_VMMCALL */
50	#include <VBox/err.h>
51	#include <VBox/param.h>
52	#include <iprt/assert.h>
53	#include <iprt/string.h>
54	#include <iprt/x86.h>
55
56	#include "IEMInline.h"
57
58	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM /* Almost the whole file. */
59
60
61	/*********************************************************************************************************************************
62	* Defined Constants And Macros *
63	*********************************************************************************************************************************/
64	/**
65	* Check the common SVM instruction preconditions.
66	*/
67	# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
68	do { \
69	if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
70	{ \
71	Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
72	return iemRaiseUndefinedOpcode(a_pVCpu); \
73	} \
74	if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
75	{ \
76	Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
77	return iemRaiseUndefinedOpcode(a_pVCpu); \
78	} \
79	if ((a_pVCpu)->iem.s.uCpl != 0) \
80	{ \
81	Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
82	return iemRaiseGeneralProtectionFault0(a_pVCpu); \
83	} \
84	} while (0)
85
86
87	/**
88	* Converts an IEM exception event type to an SVM event type.
89	*
90	* @returns The SVM event type.
91	* @retval UINT8_MAX if the specified type of event isn't among the set
92	* of recognized IEM event types.
93	*
94	* @param uVector The vector of the event.
95	* @param fIemXcptFlags The IEM exception / interrupt flags.
96	*/
97	IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
98	{
99	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
100	{
101	if (uVector != X86_XCPT_NMI)
102	return SVM_EVENT_EXCEPTION;
103	return SVM_EVENT_NMI;
104	}
105
106	/* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
107	if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
108	return SVM_EVENT_EXCEPTION;
109
110	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
111	return SVM_EVENT_EXTERNAL_IRQ;
112
113	if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
114	return SVM_EVENT_SOFTWARE_INT;
115
116	AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
117	return UINT8_MAX;
118	}
119
120
121	/**
122	* Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
123	*
124	* @returns Strict VBox status code from PGMChangeMode.
125	* @param pVCpu The cross context virtual CPU structure.
126	*/
127	DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu)
128	{
129	/*
130	* Inform PGM about paging mode changes.
131	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
132	* see comment in iemMemPageTranslateAndCheckAccess().
133	*/
134	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
135	true /* fForce */);
136	AssertRCReturn(rc, rc);
137
138	/* Invalidate IEM TLBs now that we've forced a PGM mode change. */
139	IEMTlbInvalidateAll(pVCpu);
140
141	/* Inform CPUM (recompiler), can later be removed. */
142	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
143
144	/* Re-initialize IEM cache/state after the drastic mode switch. */
145	iemReInitExec(pVCpu);
146	return rc;
147	}
148
149
150	/**
151	* SVM \#VMEXIT handler.
152	*
153	* @returns Strict VBox status code.
154	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
155	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
156	* "host state" and a shutdown is required.
157	*
158	* @param pVCpu The cross context virtual CPU structure.
159	* @param uExitCode The exit code.
160	* @param uExitInfo1 The exit info. 1 field.
161	* @param uExitInfo2 The exit info. 2 field.
162	*/
163	VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2) RT_NOEXCEPT
164	{
165	VBOXSTRICTRC rcStrict;
166	if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
167	\|\| uExitCode == SVM_EXIT_INVALID)
168	{
169	Log2(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
170	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
171
172	/*
173	* Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
174	*/
175	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
176
177	/*
178	* Map the nested-guest VMCB from its location in guest memory.
179	* Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
180	* guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
181	*/
182	PSVMVMCB pVmcbMem;
183	PGMPAGEMAPLOCK PgLockMem;
184	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
185	rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
186	&PgLockMem);
187	if (rcStrict == VINF_SUCCESS)
188	{
189	/*
190	* Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
191	* would have modified some VMCB state) that might need to be restored on #VMEXIT before
192	* writing the VMCB back to guest memory.
193	*/
194	HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
195
196	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
197	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
198	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
199	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
200
201	/*
202	* Save the nested-guest state into the VMCB state-save area.
203	*/
204	PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
205	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
206	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
207	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
208	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
209	pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
210	pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
211	pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
212	pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
213	pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
214	pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
215	pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
216	pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
217	pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
218	/** @todo Nested paging. */
219	pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u;
220	pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
221	pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
222	pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
223	pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
224	pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
225	pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
226	Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
227	if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
228	pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
229
230	/*
231	* Save additional state and intercept information.
232	*
233	* - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
234	* - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
235	* SVM execution.
236	* - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
237	*/
238	PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
239	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
240	pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
241	else
242	{
243	Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
244	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
245	}
246
247	pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
248
249	if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx)) /* Interrupt shadow. */
250	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
251	else
252	{
253	pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
254	LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
255	CPUMClearInterruptShadow(&pVCpu->cpum.GstCtx);
256	}
257
258	/*
259	* Save nRIP, instruction length and byte fields.
260	*/
261	pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
262	pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
263	memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
264
265	/*
266	* Save exit information.
267	*/
268	pVmcbMemCtrl->u64ExitCode = uExitCode;
269	pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
270	pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
271
272	/*
273	* Update the exit interrupt-information field if this #VMEXIT happened as a result
274	* of delivering an event through IEM.
275	*
276	* Don't update the exit interrupt-information field if the event wasn't being injected
277	* through IEM, as it would have been updated by real hardware if the nested-guest was
278	* executed using hardware-assisted SVM.
279	*/
280	{
281	uint8_t uExitIntVector;
282	uint32_t uExitIntErr;
283	uint32_t fExitIntFlags;
284	bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
285	NULL /* uExitIntCr2 */);
286	if (fRaisingEvent)
287	{
288	pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
289	pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
290	pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
291	if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
292	{
293	pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
294	pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
295	}
296	}
297	}
298
299	/*
300	* Save the exit interrupt-information field.
301	*
302	* We write the whole field including overwriting reserved bits as it was observed on an
303	* AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
304	*/
305	pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
306
307	/*
308	* Clear event injection.
309	*/
310	pVmcbMemCtrl->EventInject.n.u1Valid = 0;
311
312	iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
313	}
314
315	/*
316	* Prepare for guest's "host mode" by clearing internal processor state bits.
317	*
318	* We don't need to zero out the state-save area, just the controls should be
319	* sufficient because it has the critical bit of indicating whether we're inside
320	* the nested-guest or not.
321	*/
322	memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
323	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
324
325	/*
326	* Restore the subset of the inhibit flags that were preserved.
327	*/
328	pVCpu->cpum.GstCtx.eflags.uBoth \|= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
329
330	if (rcStrict == VINF_SUCCESS)
331	{
332	/** @todo Nested paging. */
333	/** @todo ASID. */
334
335	/*
336	* If we are switching to PAE mode host, validate the PDPEs first.
337	* Any invalid PDPEs here causes a VCPU shutdown.
338	*/
339	PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
340	bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
341	if (fHostInPaeMode)
342	rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
343	if (RT_SUCCESS(rcStrict))
344	{
345	/*
346	* Reload the host state.
347	*/
348	CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
349
350	/*
351	* Update PGM, IEM and others of a world-switch.
352	*/
353	rcStrict = iemSvmWorldSwitch(pVCpu);
354	if (rcStrict == VINF_SUCCESS)
355	rcStrict = VINF_SVM_VMEXIT;
356	else if (RT_SUCCESS(rcStrict))
357	{
358	LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
359	iemSetPassUpStatus(pVCpu, rcStrict);
360	rcStrict = VINF_SVM_VMEXIT;
361	}
362	else
363	LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
364	}
365	else
366	{
367	Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
368	rcStrict = VINF_EM_TRIPLE_FAULT;
369	}
370	}
371	else
372	{
373	AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
374	rcStrict = VINF_EM_TRIPLE_FAULT;
375	}
376	}
377	else
378	{
379	AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
380	rcStrict = VERR_SVM_IPE_3;
381	}
382
383	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
384	/* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
385	if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
386	&& HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
387	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
388	# endif
389	return rcStrict;
390	}
391
392
393	/**
394	* Interface for HM and EM to emulate \#VMEXIT.
395	*
396	* @returns Strict VBox status code.
397	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
398	* @param uExitCode The exit code.
399	* @param uExitInfo1 The exit info. 1 field.
400	* @param uExitInfo2 The exit info. 2 field.
401	* @thread EMT(pVCpu)
402	*/
403	VMM_INT_DECL(VBOXSTRICTRC) IEMExecSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
404	{
405	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
406	VBOXSTRICTRC rcStrict = iemSvmVmexit(pVCpu, uExitCode, uExitInfo1, uExitInfo2);
407	if (pVCpu->iem.s.cActiveMappings)
408	iemMemRollback(pVCpu);
409	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
410	}
411
412
413	/**
414	* Performs the operations necessary that are part of the vmrun instruction
415	* execution in the guest.
416	*
417	* @returns Strict VBox status code (i.e. informational status codes too).
418	* @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
419	* code execution.
420	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
421	* (SVM_EXIT_INVALID most likely).
422	*
423	* @param pVCpu The cross context virtual CPU structure.
424	* @param cbInstr The length of the VMRUN instruction.
425	* @param GCPhysVmcb Guest physical address of the VMCB to run.
426	*/
427	static VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb) RT_NOEXCEPT
428	{
429	LogFlow(("iemSvmVmrun\n"));
430
431	/*
432	* Cache the physical address of the VMCB for #VMEXIT exceptions.
433	*/
434	pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
435
436	/*
437	* Save the host state.
438	*/
439	CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
440
441	/*
442	* Read the guest VMCB.
443	*/
444	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
445	int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
446	if (RT_SUCCESS(rc))
447	{
448	/*
449	* AMD-V seems to preserve reserved fields and only writes back selected, recognized
450	* fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
451	* but in our implementation we try to preserve as much as we possibly can.
452	*
453	* We could read the entire page here and only write back the relevant fields on
454	* #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
455	* SVM execution, it creates a potential for a nested-hypervisor to set bits that are
456	* currently reserved but may be recognized as features bits in future CPUs causing
457	* unexpected & undesired results. Hence, we zero out unrecognized fields here as we
458	* typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
459	*/
460	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
461	PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
462
463	RT_ZERO(pVmcbCtrl->u8Reserved0);
464	RT_ZERO(pVmcbCtrl->u8Reserved1);
465	RT_ZERO(pVmcbCtrl->u8Reserved2);
466	RT_ZERO(pVmcbNstGst->u8Reserved0);
467	RT_ZERO(pVmcbNstGst->u8Reserved1);
468	RT_ZERO(pVmcbNstGst->u8Reserved2);
469	RT_ZERO(pVmcbNstGst->u8Reserved3);
470	RT_ZERO(pVmcbNstGst->u8Reserved4);
471	RT_ZERO(pVmcbNstGst->u8Reserved5);
472	pVmcbCtrl->u32Reserved0 = 0;
473	pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
474	pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
475	pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
476	pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
477	pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
478	pVmcbCtrl->IntShadow.n.u30Reserved = 0;
479	pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
480	pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
481	pVmcbCtrl->EventInject.n.u19Reserved = 0;
482	pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
483
484	/*
485	* Validate guest-state and controls.
486	*/
487	/* VMRUN must always be intercepted. */
488	if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
489	{
490	Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
491	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
492	}
493
494	/* Nested paging. */
495	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
496	&& !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
497	{
498	Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
499	pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
500	}
501
502	/* AVIC. */
503	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
504	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
505	{
506	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
507	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
508	}
509
510	/* Last branch record (LBR) virtualization. */
511	if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
512	&& !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
513	{
514	Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
515	pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
516	}
517
518	/* Virtualized VMSAVE/VMLOAD. */
519	if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
520	&& !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
521	{
522	Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
523	pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
524	}
525
526	/* Virtual GIF. */
527	if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
528	&& !pVM->cpum.ro.GuestFeatures.fSvmVGif)
529	{
530	Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
531	pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
532	}
533
534	/* Guest ASID. */
535	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
536	{
537	Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
538	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
539	}
540
541	/* Guest AVIC. */
542	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
543	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
544	{
545	Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
546	pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
547	}
548
549	/* Guest Secure Encrypted Virtualization. */
550	if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
551	\|\| pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
552	&& !pVM->cpum.ro.GuestFeatures.fSvmAvic)
553	{
554	Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
555	pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
556	pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
557	}
558
559	/* Flush by ASID. */
560	if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
561	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
562	&& pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
563	{
564	Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
565	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
566	}
567
568	/* IO permission bitmap. */
569	RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
570	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
571	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
572	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
573	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
574	{
575	Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
576	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
577	}
578
579	/* MSR permission bitmap. */
580	RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
581	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
582	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
583	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
584	{
585	Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
586	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
587	}
588
589	/* CR0. */
590	if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
591	&& (pVmcbNstGst->u64CR0 & X86_CR0_NW))
592	{
593	Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
594	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
595	}
596	if (pVmcbNstGst->u64CR0 >> 32)
597	{
598	Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
599	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
600	}
601	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
602
603	/* DR6 and DR7. */
604	if ( pVmcbNstGst->u64DR6 >> 32
605	\|\| pVmcbNstGst->u64DR7 >> 32)
606	{
607	Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
608	pVmcbNstGst->u64DR6));
609	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
610	}
611
612	/*
613	* PAT (Page Attribute Table) MSR.
614	*
615	* The CPU only validates and loads it when nested-paging is enabled.
616	* See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
617	*/
618	if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
619	&& !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
620	{
621	Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
622	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
623	}
624
625	/*
626	* Copy the IO permission bitmap into the cache.
627	*/
628	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
629	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
630	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
631	if (RT_FAILURE(rc))
632	{
633	Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
634	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
635	}
636
637	/*
638	* Copy the MSR permission bitmap into the cache.
639	*/
640	AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
641	rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
642	sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
643	if (RT_FAILURE(rc))
644	{
645	Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
646	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
647	}
648
649	/*
650	* Copy segments from nested-guest VMCB state to the guest-CPU state.
651	*
652	* We do this here as we need to use the CS attributes and it's easier this way
653	* then using the VMCB format selectors. It doesn't really matter where we copy
654	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
655	*/
656	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
657	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
658	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
659	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
660
661	/** @todo Segment attribute overrides by VMRUN. */
662
663	/*
664	* CPL adjustments and overrides.
665	*
666	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
667	* We shall thus adjust both CS.DPL and SS.DPL here.
668	*/
669	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
670	if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
671	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
672	if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
673	pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
674	Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
675
676	/*
677	* Continue validating guest-state and controls.
678	*
679	* We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
680	* EFER.LME bit transition check. We pass the nested-guest's EFER as both the
681	* old and new EFER value to not have any guest EFER bits influence the new
682	* nested-guest EFER.
683	*/
684	uint64_t uValidEfer;
685	rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
686	if (RT_FAILURE(rc))
687	{
688	Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
689	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
690	}
691
692	/* Validate paging and CPU mode bits. */
693	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
694	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
695	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
696	bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
697	bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
698	bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
699	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
700	bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
701	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
702	if (fLongModeWithPaging)
703	uValidEfer \|= MSR_K6_EFER_LMA;
704	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
705	if ( !fSvm
706	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
707	\|\| (fLongModeWithPaging && !fPae)
708	\|\| (fLongModeWithPaging && !fProtMode)
709	\|\| ( fLongModeEnabled
710	&& fPaging
711	&& fPae
712	&& fLongModeConformCS))
713	{
714	Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
715	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
716	}
717
718	/*
719	* Preserve the required force-flags.
720	*
721	* We only preserve the force-flags that would affect the execution of the
722	* nested-guest (or the guest).
723	*
724	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
725	* execution of a subsequent IRET instruction in the guest.
726	*
727	* The remaining FFs (e.g. timers) can stay in place so that we will be able to
728	* generate interrupts that should cause #VMEXITs for the nested-guest.
729	*
730	* VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
731	* preserve VMCPU_FF_INHIBIT_INTERRUPTS.
732	*/
733	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
734	pVCpu->cpum.GstCtx.eflags.uBoth &= ~CPUMCTX_INHIBIT_NMI;
735
736	/*
737	* Pause filter.
738	*/
739	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
740	{
741	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
742	if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
743	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
744	}
745
746	/*
747	* Interrupt shadow.
748	*/
749	if (pVmcbCtrl->IntShadow.n.u1IntShadow)
750	{
751	LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
752	/** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
753	CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcbNstGst->u64RIP);
754	}
755
756	/*
757	* TLB flush control.
758	* Currently disabled since it's redundant as we unconditionally flush the TLB
759	* in iemSvmWorldSwitch() below.
760	*/
761	# if 0
762	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
763	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
764	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
765	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
766	PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
767	# endif
768
769	/*
770	* Validate and map PAE PDPEs if the guest will be using PAE paging.
771	* Invalid PAE PDPEs here causes a #VMEXIT.
772	*/
773	if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
774	&& CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
775	{
776	rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
777	if (RT_SUCCESS(rc))
778	{ /* likely */ }
779	else
780	{
781	Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
782	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
783	}
784	}
785
786	/*
787	* Copy the remaining guest state from the VMCB to the guest-CPU context.
788	*/
789	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
790	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
791	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
792	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
793	CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
794	CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
795	pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
796	pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
797	pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
798	pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
799	pVCpu->cpum.GstCtx.rflags.u = pVmcbNstGst->u64RFlags;
800	pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
801	pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
802	pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
803	CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
804	if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
805	pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
806
807	/* Mask DR6, DR7 bits mandatory set/clear bits. */
808	pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
809	pVCpu->cpum.GstCtx.dr[6] \|= X86_DR6_RA1_MASK;
810	pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
811	pVCpu->cpum.GstCtx.dr[7] \|= X86_DR7_RA1_MASK;
812
813	/*
814	* Check for pending virtual interrupts.
815	*/
816	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
817	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
818	else
819	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
820
821	/*
822	* Update PGM, IEM and others of a world-switch.
823	*/
824	VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
825	if (rcStrict == VINF_SUCCESS)
826	{ /* likely */ }
827	else if (RT_SUCCESS(rcStrict))
828	{
829	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
830	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
831	}
832	else
833	{
834	LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
835	return rcStrict;
836	}
837
838	/*
839	* Set the global-interrupt flag to allow interrupts in the guest.
840	*/
841	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
842
843	/*
844	* Event injection.
845	*/
846	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
847	pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
848	if (pEventInject->n.u1Valid)
849	{
850	uint8_t const uVector = pEventInject->n.u8Vector;
851	TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
852	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
853
854	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
855	if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
856	{
857	Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
858	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
859	}
860	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
861	{
862	if ( uVector == X86_XCPT_NMI
863	\|\| uVector > X86_XCPT_LAST)
864	{
865	Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
866	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
867	}
868	if ( uVector == X86_XCPT_BR
869	&& CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
870	{
871	Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
872	return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
873	}
874	/** @todo any others? */
875	}
876
877	/*
878	* Invalidate the exit interrupt-information field here. This field is fully updated
879	* on #VMEXIT as events other than the one below can also cause intercepts during
880	* their injection (e.g. exceptions).
881	*/
882	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
883
884	/*
885	* Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
886	* clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
887	* clearing it at any time, most likely before/after injecting the event. Since VirtualBox
888	* doesn't have any virtual-CPU internal representation of this bit, we clear/update the
889	* VMCB here. This also has the added benefit that we avoid the risk of injecting the event
890	* twice if we fallback to executing the nested-guest using hardware-assisted SVM after
891	* injecting the event through IEM here.
892	*/
893	pVmcbCtrl->EventInject.n.u1Valid = 0;
894
895	/** @todo NRIP: Software interrupts can only be pushed properly if we support
896	* NRIP for the nested-guest to calculate the instruction length
897	* below. */
898	LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
899	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
900	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
901
902	/*
903	* We shall not inject the event here right away. There may be paging mode related updates
904	* as a result of the world-switch above that are yet to be honored. Instead flag the event
905	* as pending for injection.
906	*/
907	TRPMAssertTrap(pVCpu, uVector, enmType);
908	if (pEventInject->n.u1ErrorCodeValid)
909	TRPMSetErrorCode(pVCpu, uErrorCode);
910	if ( enmType == TRPM_TRAP
911	&& uVector == X86_XCPT_PF)
912	TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
913	}
914	else
915	LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
916	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
917	pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.eflags.u));
918
919	LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
920
921	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
922	/* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
923	if ( HMIsEnabled(pVM)
924	&& HMIsSvmVGifActive(pVM))
925	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
926	# endif
927
928	return rcStrict;
929	}
930
931	/* Shouldn't really happen as the caller should've validated the physical address already. */
932	Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
933	return rc;
934	}
935
936
937	/**
938	* Checks if the event intercepts and performs the \#VMEXIT if the corresponding
939	* intercept is active.
940	*
941	* @returns Strict VBox status code.
942	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
943	* we're not executing a nested-guest.
944	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
945	* successfully.
946	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
947	* failed and a shutdown needs to be initiated for the guest.
948	*
949	* @returns VBox strict status code.
950	* @param pVCpu The cross context virtual CPU structure of the calling thread.
951	* @param u8Vector The interrupt or exception vector.
952	* @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
953	* @param uErr The error-code associated with the exception.
954	* @param uCr2 The CR2 value in case of a \#PF exception.
955	*/
956	VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2) RT_NOEXCEPT
957	{
958	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
959
960	/*
961	* Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
962	*
963	* - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
964	* - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
965	* even when they use a vector in the range 0 to 31.
966	* - ICEBP should not trigger #DB intercept, but its own intercept.
967	* - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
968	*/
969	/* Check NMI intercept */
970	if ( u8Vector == X86_XCPT_NMI
971	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
972	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
973	{
974	Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
975	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
976	}
977
978	/* Check ICEBP intercept. */
979	if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
980	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
981	{
982	Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
983	IEM_SVM_UPDATE_NRIP(pVCpu);
984	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
985	}
986
987	/* Check CPU exception intercepts. */
988	if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
989	&& IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
990	{
991	Assert(u8Vector <= X86_XCPT_LAST);
992	uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
993	uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
994	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
995	&& u8Vector == X86_XCPT_PF
996	&& !(uErr & X86_TRAP_PF_ID))
997	{
998	PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
999	# ifdef IEM_WITH_CODE_TLB
1000	uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
1001	uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
1002	pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1003	if ( pbInstrBuf
1004	&& cbInstrBuf > 0)
1005	memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
1006	# else
1007	uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
1008	pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1009	if (cbOpcode > 0)
1010	memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
1011	# endif
1012	}
1013	if (u8Vector == X86_XCPT_BR)
1014	IEM_SVM_UPDATE_NRIP(pVCpu);
1015	Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
1016	"uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
1017	u8Vector, uExitInfo1, uExitInfo2));
1018	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
1019	}
1020
1021	/* Check software interrupt (INTn) intercepts. */
1022	if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
1023	\| IEM_XCPT_FLAGS_BP_INSTR
1024	\| IEM_XCPT_FLAGS_ICEBP_INSTR
1025	\| IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
1026	&& IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
1027	{
1028	uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
1029	Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
1030	IEM_SVM_UPDATE_NRIP(pVCpu);
1031	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
1032	}
1033
1034	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1035	}
1036
1037
1038	/**
1039	* Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
1040	* corresponding intercept is active.
1041	*
1042	* @returns Strict VBox status code.
1043	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1044	* we're not executing a nested-guest.
1045	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1046	* successfully.
1047	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1048	* failed and a shutdown needs to be initiated for the guest.
1049	*
1050	* @returns VBox strict status code.
1051	* @param pVCpu The cross context virtual CPU structure of the calling thread.
1052	* @param u16Port The IO port being accessed.
1053	* @param enmIoType The type of IO access.
1054	* @param cbReg The IO operand size in bytes.
1055	* @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1056	* @param iEffSeg The effective segment number.
1057	* @param fRep Whether this is a repeating IO instruction (REP prefix).
1058	* @param fStrIo Whether this is a string IO instruction.
1059	* @param cbInstr The length of the IO instruction in bytes.
1060	*/
1061	VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1062	uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr) RT_NOEXCEPT
1063	{
1064	Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1065	Assert(cAddrSizeBits == 16 \|\| cAddrSizeBits == 32 \|\| cAddrSizeBits == 64);
1066	Assert(cbReg == 1 \|\| cbReg == 2 \|\| cbReg == 4 \|\| cbReg == 8);
1067
1068	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1069
1070	SVMIOIOEXITINFO IoExitInfo;
1071	bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1072	cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1073	if (fIntercept)
1074	{
1075	Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1076	IEM_SVM_UPDATE_NRIP(pVCpu);
1077	return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1078	}
1079
1080	/** @todo remove later (for debugging as VirtualBox always traps all IO
1081	* intercepts). */
1082	AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1083	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1084	}
1085
1086
1087	/**
1088	* Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1089	* corresponding intercept is active.
1090	*
1091	* @returns Strict VBox status code.
1092	* @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1093	* specify interception of the accessed MSR @a idMsr.
1094	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1095	* successfully.
1096	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1097	* failed and a shutdown needs to be initiated for the guest.
1098	*
1099	* @param pVCpu The cross context virtual CPU structure.
1100	* @param idMsr The MSR being accessed in the nested-guest.
1101	* @param fWrite Whether this is an MSR write access, @c false implies an
1102	* MSR read.
1103	* @param cbInstr The length of the MSR read/write instruction in bytes.
1104	*/
1105	VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite) RT_NOEXCEPT
1106	{
1107	/*
1108	* Check if any MSRs are being intercepted.
1109	*/
1110	Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1111	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1112
1113	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1114
1115	/*
1116	* Get the byte and bit offset of the permission bits corresponding to the MSR.
1117	*/
1118	uint16_t offMsrpm;
1119	uint8_t uMsrpmBit;
1120	int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1121	if (RT_SUCCESS(rc))
1122	{
1123	Assert(uMsrpmBit == 0 \|\| uMsrpmBit == 2 \|\| uMsrpmBit == 4 \|\| uMsrpmBit == 6);
1124	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1125	if (fWrite)
1126	++uMsrpmBit;
1127
1128	/*
1129	* Check if the bit is set, if so, trigger a #VMEXIT.
1130	*/
1131	if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1132	{
1133	IEM_SVM_UPDATE_NRIP(pVCpu);
1134	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1135	}
1136	}
1137	else
1138	{
1139	/*
1140	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1141	*/
1142	Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1143	return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1144	}
1145	return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1146	}
1147
1148
1149
1150	/**
1151	* Implements 'VMRUN'.
1152	*/
1153	IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1154	{
1155	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1156	RT_NOREF2(pVCpu, cbInstr);
1157	return VINF_EM_RAW_EMULATE_INSTR;
1158	# else
1159	LogFlow(("iemCImpl_vmrun\n"));
1160	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1161
1162	/** @todo Check effective address size using address size prefix. */
1163	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1164	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1165	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1166	{
1167	Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1168	return iemRaiseGeneralProtectionFault0(pVCpu);
1169	}
1170
1171	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1172	{
1173	Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1174	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1175	}
1176
1177	VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1178	if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1179	{
1180	Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1181	rcStrict = VINF_EM_TRIPLE_FAULT;
1182	}
1183	return rcStrict;
1184	# endif
1185	}
1186
1187
1188	/**
1189	* Interface for HM and EM to emulate the VMRUN instruction.
1190	*
1191	* @returns Strict VBox status code.
1192	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1193	* @param cbInstr The instruction length in bytes.
1194	* @thread EMT(pVCpu)
1195	*/
1196	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmrun(PVMCPUCC pVCpu, uint8_t cbInstr)
1197	{
1198	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1199	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
1200
1201	iemInitExec(pVCpu, false /fBypassHandlers/);
1202	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmrun);
1203	Assert(!pVCpu->iem.s.cActiveMappings);
1204	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1205	}
1206
1207
1208	/**
1209	* Implements 'VMLOAD'.
1210	*/
1211	IEM_CIMPL_DEF_0(iemCImpl_vmload)
1212	{
1213	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1214	RT_NOREF2(pVCpu, cbInstr);
1215	return VINF_EM_RAW_EMULATE_INSTR;
1216	# else
1217	LogFlow(("iemCImpl_vmload\n"));
1218	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1219
1220	/** @todo Check effective address size using address size prefix. */
1221	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1222	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1223	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1224	{
1225	Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1226	return iemRaiseGeneralProtectionFault0(pVCpu);
1227	}
1228
1229	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1230	{
1231	Log(("vmload: Guest intercept -> #VMEXIT\n"));
1232	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1233	}
1234
1235	SVMVMCBSTATESAVE VmcbNstGst;
1236	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1237	sizeof(SVMVMCBSTATESAVE));
1238	if (rcStrict == VINF_SUCCESS)
1239	{
1240	LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1241	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1242	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1243	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1244	HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1245
1246	pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1247	pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1248	pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1249	pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1250	pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1251
1252	pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1253	pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1254	pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1255
1256	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1257	}
1258	return rcStrict;
1259	# endif
1260	}
1261
1262
1263	/**
1264	* Interface for HM and EM to emulate the VMLOAD instruction.
1265	*
1266	* @returns Strict VBox status code.
1267	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1268	* @param cbInstr The instruction length in bytes.
1269	* @thread EMT(pVCpu)
1270	*/
1271	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmload(PVMCPUCC pVCpu, uint8_t cbInstr)
1272	{
1273	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1274
1275	iemInitExec(pVCpu, false /fBypassHandlers/);
1276	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmload);
1277	Assert(!pVCpu->iem.s.cActiveMappings);
1278	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1279	}
1280
1281
1282	/**
1283	* Implements 'VMSAVE'.
1284	*/
1285	IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1286	{
1287	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1288	RT_NOREF2(pVCpu, cbInstr);
1289	return VINF_EM_RAW_EMULATE_INSTR;
1290	# else
1291	LogFlow(("iemCImpl_vmsave\n"));
1292	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1293
1294	/** @todo Check effective address size using address size prefix. */
1295	RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1296	if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1297	\|\| !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1298	{
1299	Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1300	return iemRaiseGeneralProtectionFault0(pVCpu);
1301	}
1302
1303	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1304	{
1305	Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1306	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1307	}
1308
1309	SVMVMCBSTATESAVE VmcbNstGst;
1310	VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1311	sizeof(SVMVMCBSTATESAVE));
1312	if (rcStrict == VINF_SUCCESS)
1313	{
1314	LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1315	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS \| CPUMCTX_EXTRN_GS \| CPUMCTX_EXTRN_TR \| CPUMCTX_EXTRN_LDTR
1316	\| CPUMCTX_EXTRN_KERNEL_GS_BASE \| CPUMCTX_EXTRN_SYSCALL_MSRS \| CPUMCTX_EXTRN_SYSENTER_MSRS);
1317
1318	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1319	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1320	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1321	HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1322
1323	VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1324	VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1325	VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1326	VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1327	VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1328
1329	VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1330	VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1331	VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1332
1333	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1334	sizeof(SVMVMCBSTATESAVE));
1335	if (rcStrict == VINF_SUCCESS)
1336	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1337	}
1338	return rcStrict;
1339	# endif
1340	}
1341
1342
1343	/**
1344	* Interface for HM and EM to emulate the VMSAVE instruction.
1345	*
1346	* @returns Strict VBox status code.
1347	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1348	* @param cbInstr The instruction length in bytes.
1349	* @thread EMT(pVCpu)
1350	*/
1351	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmsave(PVMCPUCC pVCpu, uint8_t cbInstr)
1352	{
1353	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1354
1355	iemInitExec(pVCpu, false /fBypassHandlers/);
1356	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmsave);
1357	Assert(!pVCpu->iem.s.cActiveMappings);
1358	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1359	}
1360
1361
1362	/**
1363	* Implements 'CLGI'.
1364	*/
1365	IEM_CIMPL_DEF_0(iemCImpl_clgi)
1366	{
1367	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1368	RT_NOREF2(pVCpu, cbInstr);
1369	return VINF_EM_RAW_EMULATE_INSTR;
1370	# else
1371	LogFlow(("iemCImpl_clgi\n"));
1372	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1373	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1374	{
1375	Log(("clgi: Guest intercept -> #VMEXIT\n"));
1376	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1377	}
1378
1379	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1380
1381	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1382	iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1383	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1384	# else
1385	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1386	# endif
1387	# endif
1388	}
1389
1390
1391	/**
1392	* Interface for HM and EM to emulate the CLGI instruction.
1393	*
1394	* @returns Strict VBox status code.
1395	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1396	* @param cbInstr The instruction length in bytes.
1397	* @thread EMT(pVCpu)
1398	*/
1399	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedClgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1400	{
1401	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1402
1403	iemInitExec(pVCpu, false /fBypassHandlers/);
1404	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_clgi);
1405	Assert(!pVCpu->iem.s.cActiveMappings);
1406	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1407	}
1408
1409
1410	/**
1411	* Implements 'STGI'.
1412	*/
1413	IEM_CIMPL_DEF_0(iemCImpl_stgi)
1414	{
1415	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1416	RT_NOREF2(pVCpu, cbInstr);
1417	return VINF_EM_RAW_EMULATE_INSTR;
1418	# else
1419	LogFlow(("iemCImpl_stgi\n"));
1420	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1421	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1422	{
1423	Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1424	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1425	}
1426
1427	CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1428
1429	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1430	iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1431	return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1432	# else
1433	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1434	# endif
1435	# endif
1436	}
1437
1438
1439	/**
1440	* Interface for HM and EM to emulate the STGI instruction.
1441	*
1442	* @returns Strict VBox status code.
1443	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1444	* @param cbInstr The instruction length in bytes.
1445	* @thread EMT(pVCpu)
1446	*/
1447	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedStgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1448	{
1449	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1450
1451	iemInitExec(pVCpu, false /fBypassHandlers/);
1452	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_stgi);
1453	Assert(!pVCpu->iem.s.cActiveMappings);
1454	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1455	}
1456
1457
1458	/**
1459	* Implements 'INVLPGA'.
1460	*/
1461	IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1462	{
1463	/** @todo Check effective address size using address size prefix. */
1464	RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1465	/** @todo PGM needs virtual ASID support. */
1466	# if 0
1467	uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1468	# endif
1469
1470	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1471	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1472	{
1473	Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1474	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1475	}
1476
1477	PGMInvalidatePage(pVCpu, GCPtrPage);
1478	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1479	}
1480
1481
1482	/**
1483	* Interface for HM and EM to emulate the INVLPGA instruction.
1484	*
1485	* @returns Strict VBox status code.
1486	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1487	* @param cbInstr The instruction length in bytes.
1488	* @thread EMT(pVCpu)
1489	*/
1490	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvlpga(PVMCPUCC pVCpu, uint8_t cbInstr)
1491	{
1492	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1493
1494	iemInitExec(pVCpu, false /fBypassHandlers/);
1495	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_invlpga);
1496	Assert(!pVCpu->iem.s.cActiveMappings);
1497	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1498	}
1499
1500
1501	/**
1502	* Implements 'SKINIT'.
1503	*/
1504	IEM_CIMPL_DEF_0(iemCImpl_skinit)
1505	{
1506	IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1507
1508	uint32_t uIgnore;
1509	uint32_t fFeaturesECX;
1510	CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf /, -1 /f64BitMode*/, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1511	if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1512	return iemRaiseUndefinedOpcode(pVCpu);
1513
1514	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1515	{
1516	Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1517	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1518	}
1519
1520	RT_NOREF(cbInstr);
1521	return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1522	}
1523
1524
1525	/**
1526	* Implements SVM's implementation of PAUSE.
1527	*/
1528	IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1529	{
1530	bool fCheckIntercept = true;
1531	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1532	{
1533	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1534
1535	/* TSC based pause-filter thresholding. */
1536	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1537	&& pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1538	{
1539	uint64_t const uTick = TMCpuTickGet(pVCpu);
1540	if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1541	pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1542	pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1543	}
1544
1545	/* Simple pause-filter counter. */
1546	if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1547	{
1548	--pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1549	fCheckIntercept = false;
1550	}
1551	}
1552
1553	if (fCheckIntercept)
1554	IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1555
1556	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1557	}
1558
1559	#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1560
1561	/**
1562	* Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1563	*/
1564	IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1565	{
1566	if (EMAreHypercallInstructionsEnabled(pVCpu))
1567	{
1568	NOREF(uDisOpcode);
1569	VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1570	if (RT_SUCCESS(rcStrict))
1571	{
1572	/** @todo finish: Sort out assertion here when iemRegAddToRipAndFinishingClearingRF
1573	* starts returning non-VINF_SUCCESS statuses. */
1574	if (rcStrict == VINF_SUCCESS)
1575	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1576	if ( rcStrict == VINF_SUCCESS
1577	\|\| rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1578	return VINF_SUCCESS;
1579	AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1580	return rcStrict;
1581	}
1582	AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1583	\|\| rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1584	\|\| rcStrict == VERR_GIM_NOT_ENABLED
1585	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1586	\|\| rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1587	("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1588
1589	/* Raise #UD on all failures. */
1590	}
1591	return iemRaiseUndefinedOpcode(pVCpu);
1592	}
1593
1594
1595	/**
1596	* Implements 'VMMCALL'.
1597	*/
1598	IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1599	{
1600	if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1601	{
1602	Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1603	IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
1604	}
1605
1606	/* This is a little bit more complicated than the VT-x version because HM/SVM may
1607	patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1608	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1609	if (VM_IS_HM_ENABLED(pVM))
1610	{
1611	int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1612	if (RT_SUCCESS(rc))
1613	{
1614	Log(("vmmcall: MovTpr\n"));
1615	return VINF_SUCCESS;
1616	}
1617	}
1618
1619	/* Join forces with vmcall. */
1620	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1621	}
1622

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp@ 97694

Download in other formats: