VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/target-x86/IEMAllCImplSvmInstr-x86.cpp

Last change on this file was 108409, checked in by vboxsync, 7 weeks ago

VMM/IEM: Made IEMAll.cpp build targeting arm. jiraref:VBP-1531
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 68.4 KB
Line 
1/* $Id: IEMAllCImplSvmInstr-x86.cpp 108409 2025-02-27 10:35:39Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation (x86 target).
4 */
5
6/*
7 * Copyright (C) 2011-2024 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM_SVM
33#define VMCPU_INCL_CPUM_GST_CTX
34#ifdef IN_RING0
35# define VBOX_VMM_TARGET_X86
36#endif
37#include <VBox/vmm/iem.h>
38#include <VBox/vmm/cpum.h>
39#include <VBox/vmm/dbgf.h>
40#include <VBox/vmm/em.h>
41#include <VBox/vmm/hm.h>
42#include <VBox/vmm/pgm.h>
43#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
44# include <VBox/vmm/hm_svm.h>
45#endif
46#include <VBox/vmm/gim.h>
47#include <VBox/vmm/tm.h>
48#include "IEMInternal.h"
49#include <VBox/vmm/vmcc.h>
50#include <VBox/log.h>
51#include <VBox/disopcode-x86-amd64.h> /* for OP_VMMCALL */
52#include <VBox/err.h>
53#include <VBox/param.h>
54#include <iprt/assert.h>
55#include <iprt/string.h>
56#include <iprt/x86.h>
57
58#include "IEMInline.h"
59#include "IEMInline-x86.h"
60#include "IEMInlineExec.h"
61#include "IEMInlineExec-x86.h"
62
63#ifdef VBOX_WITH_NESTED_HWVIRT_SVM /* Almost the whole file. */
64
65
66/*********************************************************************************************************************************
67* Defined Constants And Macros *
68*********************************************************************************************************************************/
69/**
70 * Check the common SVM instruction preconditions.
71 */
72# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
73 do { \
74 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
75 { \
76 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
77 return iemRaiseUndefinedOpcode(a_pVCpu); \
78 } \
79 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
80 { \
81 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
82 return iemRaiseUndefinedOpcode(a_pVCpu); \
83 } \
84 if (IEM_GET_CPL(a_pVCpu) != 0) \
85 { \
86 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
87 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
88 } \
89 } while (0)
90
91
92/**
93 * Converts an IEM exception event type to an SVM event type.
94 *
95 * @returns The SVM event type.
96 * @retval UINT8_MAX if the specified type of event isn't among the set
97 * of recognized IEM event types.
98 *
99 * @param uVector The vector of the event.
100 * @param fIemXcptFlags The IEM exception / interrupt flags.
101 */
102IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
103{
104 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
105 {
106 if (uVector != X86_XCPT_NMI)
107 return SVM_EVENT_EXCEPTION;
108 return SVM_EVENT_NMI;
109 }
110
111 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
112 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
113 return SVM_EVENT_EXCEPTION;
114
115 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
116 return SVM_EVENT_EXTERNAL_IRQ;
117
118 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
119 return SVM_EVENT_SOFTWARE_INT;
120
121 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
122 return UINT8_MAX;
123}
124
125
126/**
127 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
128 *
129 * @returns Strict VBox status code from PGMChangeMode.
130 * @param pVCpu The cross context virtual CPU structure.
131 * @param cbInstr The length of the current instruction.
132 */
133DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, uint8_t cbInstr)
134{
135 /*
136 * Inform PGM about paging mode changes.
137 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
138 * see comment in iemMemPageTranslateAndCheckAccess().
139 */
140 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
141 true /* fForce */);
142 AssertRCReturn(rc, rc);
143
144 /* Invalidate IEM TLBs now that we've forced a PGM mode change. */
145 IEMTlbInvalidateAllGlobal(pVCpu);
146
147 /* Inform CPUM (recompiler), can later be removed. */
148 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
149
150 /* Re-initialize IEM cache/state after the drastic mode switch. */
151 iemReInitExec(pVCpu, cbInstr);
152 return rc;
153}
154
155
156/**
157 * SVM \#VMEXIT handler.
158 *
159 * @returns Strict VBox status code.
160 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
161 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
162 * "host state" and a shutdown is required.
163 *
164 * @param pVCpu The cross context virtual CPU structure.
165 * @param uExitCode The exit code.
166 * @param uExitInfo1 The exit info. 1 field.
167 * @param uExitInfo2 The exit info. 2 field.
168 */
169VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2) RT_NOEXCEPT
170{
171 VBOXSTRICTRC rcStrict;
172 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
173 || uExitCode == SVM_EXIT_INVALID)
174 {
175 Log2(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
176 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
177
178 /*
179 * Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
180 */
181 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
182
183 /*
184 * Map the nested-guest VMCB from its location in guest memory.
185 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
186 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
187 */
188 PSVMVMCB pVmcbMem;
189 PGMPAGEMAPLOCK PgLockMem;
190 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
191 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
192 &PgLockMem);
193 if (rcStrict == VINF_SUCCESS)
194 {
195 /*
196 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
197 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
198 * writing the VMCB back to guest memory.
199 */
200 HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
201
202 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
204 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
205 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
206
207 /*
208 * Save the nested-guest state into the VMCB state-save area.
209 */
210 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
211 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
212 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
213 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
214 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
215 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
216 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
217 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
218 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
219 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
220 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
221 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
222 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
223 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
224 /** @todo Nested paging. */
225 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u;
226 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
227 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
228 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
229 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
230 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
231 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
232 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
233 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
234 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
235
236 /*
237 * Save additional state and intercept information.
238 *
239 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
240 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
241 * SVM execution.
242 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
243 */
244 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
245 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
246 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
247 else
248 {
249 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
250 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
251 }
252
253 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
254
255 if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx)) /* Interrupt shadow. */
256 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
257 else
258 {
259 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
260 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
261 CPUMClearInterruptShadow(&pVCpu->cpum.GstCtx);
262 }
263
264 /*
265 * Save nRIP, instruction length and byte fields.
266 */
267 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
268 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
269 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
270
271 /*
272 * Save exit information.
273 */
274 pVmcbMemCtrl->u64ExitCode = uExitCode;
275 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
276 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
277
278 /*
279 * Update the exit interrupt-information field if this #VMEXIT happened as a result
280 * of delivering an event through IEM.
281 *
282 * Don't update the exit interrupt-information field if the event wasn't being injected
283 * through IEM, as it would have been updated by real hardware if the nested-guest was
284 * executed using hardware-assisted SVM.
285 */
286 {
287 uint8_t uExitIntVector;
288 uint32_t uExitIntErr;
289 uint32_t fExitIntFlags;
290 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
291 NULL /* uExitIntCr2 */);
292 if (fRaisingEvent)
293 {
294 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
295 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
296 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
297 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
298 {
299 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
300 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
301 }
302 }
303 }
304
305 /*
306 * Save the exit interrupt-information field.
307 *
308 * We write the whole field including overwriting reserved bits as it was observed on an
309 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
310 */
311 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
312
313 /*
314 * Clear event injection.
315 */
316 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
317
318 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
319 }
320
321 /*
322 * Prepare for guest's "host mode" by clearing internal processor state bits.
323 *
324 * We don't need to zero out the state-save area, just the controls should be
325 * sufficient because it has the critical bit of indicating whether we're inside
326 * the nested-guest or not.
327 */
328 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
329 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
330
331 /*
332 * Restore the subset of the inhibit flags that were preserved.
333 */
334 pVCpu->cpum.GstCtx.eflags.uBoth |= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
335
336 if (rcStrict == VINF_SUCCESS)
337 {
338 /** @todo Nested paging. */
339 /** @todo ASID. */
340
341 /*
342 * If we are switching to PAE mode host, validate the PDPEs first.
343 * Any invalid PDPEs here causes a VCPU shutdown.
344 */
345 PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
346 bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
347 if (fHostInPaeMode)
348 rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
349 if (RT_SUCCESS(rcStrict))
350 {
351 /*
352 * Reload the host state.
353 */
354 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
355
356 /*
357 * Update PGM, IEM and others of a world-switch.
358 */
359 rcStrict = iemSvmWorldSwitch(pVCpu, 0 /*cbInstr - whatever*/);
360 if (rcStrict == VINF_SUCCESS)
361 rcStrict = VINF_SVM_VMEXIT;
362 else if (RT_SUCCESS(rcStrict))
363 {
364 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
365 iemSetPassUpStatus(pVCpu, rcStrict);
366 rcStrict = VINF_SVM_VMEXIT;
367 }
368 else
369 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
370 }
371 else
372 {
373 Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
374 rcStrict = VINF_EM_TRIPLE_FAULT;
375 }
376 }
377 else
378 {
379 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
380 rcStrict = VINF_EM_TRIPLE_FAULT;
381 }
382 }
383 else
384 {
385 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
386 rcStrict = VERR_SVM_IPE_3;
387 }
388
389# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
390 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
391 if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
392 && HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
393 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
394# endif
395 return rcStrict;
396}
397
398
399/**
400 * Interface for HM and EM to emulate \#VMEXIT.
401 *
402 * @returns Strict VBox status code.
403 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
404 * @param uExitCode The exit code.
405 * @param uExitInfo1 The exit info. 1 field.
406 * @param uExitInfo2 The exit info. 2 field.
407 * @thread EMT(pVCpu)
408 */
409VMM_INT_DECL(VBOXSTRICTRC) IEMExecSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
410{
411 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
412 VBOXSTRICTRC rcStrict = iemSvmVmexit(pVCpu, uExitCode, uExitInfo1, uExitInfo2);
413 if (pVCpu->iem.s.cActiveMappings)
414 iemMemRollback(pVCpu);
415 return iemExecStatusCodeFiddling(pVCpu, rcStrict);
416}
417
418
419/**
420 * Performs the operations necessary that are part of the vmrun instruction
421 * execution in the guest.
422 *
423 * @returns Strict VBox status code (i.e. informational status codes too).
424 * @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
425 * code execution.
426 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
427 * (SVM_EXIT_INVALID most likely).
428 *
429 * @param pVCpu The cross context virtual CPU structure.
430 * @param cbInstr The length of the VMRUN instruction.
431 * @param GCPhysVmcb Guest physical address of the VMCB to run.
432 */
433static VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb) RT_NOEXCEPT
434{
435 LogFlow(("iemSvmVmrun\n"));
436
437 /*
438 * Cache the physical address of the VMCB for #VMEXIT exceptions.
439 */
440 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
441
442 /*
443 * Save the host state.
444 */
445 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
446
447 /*
448 * Read the guest VMCB.
449 */
450 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
451 int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
452 if (RT_SUCCESS(rc))
453 {
454 /*
455 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
456 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
457 * but in our implementation we try to preserve as much as we possibly can.
458 *
459 * We could read the entire page here and only write back the relevant fields on
460 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
461 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
462 * currently reserved but may be recognized as features bits in future CPUs causing
463 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
464 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
465 */
466 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
467 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
468
469 RT_ZERO(pVmcbCtrl->u8Reserved0);
470 RT_ZERO(pVmcbCtrl->u8Reserved1);
471 RT_ZERO(pVmcbCtrl->u8Reserved2);
472 RT_ZERO(pVmcbNstGst->u8Reserved0);
473 RT_ZERO(pVmcbNstGst->u8Reserved1);
474 RT_ZERO(pVmcbNstGst->u8Reserved2);
475 RT_ZERO(pVmcbNstGst->u8Reserved3);
476 RT_ZERO(pVmcbNstGst->u8Reserved4);
477 RT_ZERO(pVmcbNstGst->u8Reserved5);
478 pVmcbCtrl->u32Reserved0 = 0;
479 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
480 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
481 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
482 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
483 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
484 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
485 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
486 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
487 pVmcbCtrl->EventInject.n.u19Reserved = 0;
488 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
489
490 /*
491 * Validate guest-state and controls.
492 */
493 /* VMRUN must always be intercepted. */
494 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
495 {
496 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
497 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
498 }
499
500 /* Nested paging. */
501 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
502 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
503 {
504 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
505 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
506 }
507
508 /* AVIC. */
509 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
510 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
511 {
512 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
513 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
514 }
515
516 /* Last branch record (LBR) virtualization. */
517 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
518 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
519 {
520 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
521 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
522 }
523
524 /* Virtualized VMSAVE/VMLOAD. */
525 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
526 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
527 {
528 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
529 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
530 }
531
532 /* Virtual GIF. */
533 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
534 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
535 {
536 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
537 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
538 }
539
540 /* Guest ASID. */
541 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
542 {
543 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
544 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
545 }
546
547 /* Guest AVIC. */
548 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
549 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
550 {
551 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
552 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
553 }
554
555 /* Guest Secure Encrypted Virtualization. */
556 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
557 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
558 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
559 {
560 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
561 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
562 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
563 }
564
565 /* Flush by ASID. */
566 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
567 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
568 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
569 {
570 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
571 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
572 }
573
574 /* IO permission bitmap. */
575 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
576 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
577 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
578 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
579 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
580 {
581 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
582 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
583 }
584
585 /* MSR permission bitmap. */
586 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
587 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
588 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
589 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
590 {
591 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
592 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
593 }
594
595 /* CR0. */
596 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
597 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
598 {
599 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
600 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
601 }
602 if (pVmcbNstGst->u64CR0 >> 32)
603 {
604 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
605 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
606 }
607 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
608
609 /* DR6 and DR7. */
610 if ( pVmcbNstGst->u64DR6 >> 32
611 || pVmcbNstGst->u64DR7 >> 32)
612 {
613 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
614 pVmcbNstGst->u64DR6));
615 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
616 }
617
618 /*
619 * PAT (Page Attribute Table) MSR.
620 *
621 * The CPU only validates and loads it when nested-paging is enabled.
622 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
623 */
624 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
625 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
626 {
627 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
628 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
629 }
630
631 /*
632 * Copy the IO permission bitmap into the cache.
633 */
634 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
635 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
636 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
637 if (RT_FAILURE(rc))
638 {
639 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
640 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
641 }
642
643 /*
644 * Copy the MSR permission bitmap into the cache.
645 */
646 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
647 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
648 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
649 if (RT_FAILURE(rc))
650 {
651 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
652 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
653 }
654
655 /*
656 * Copy segments from nested-guest VMCB state to the guest-CPU state.
657 *
658 * We do this here as we need to use the CS attributes and it's easier this way
659 * then using the VMCB format selectors. It doesn't really matter where we copy
660 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
661 */
662 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
663 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
664 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
665 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
666
667 /** @todo Segment attribute overrides by VMRUN. */
668
669 /*
670 * CPL adjustments and overrides.
671 *
672 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
673 * We shall thus adjust both CS.DPL and SS.DPL here.
674 */
675 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
676 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
677 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
678 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
679 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
680 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
681
682 /*
683 * Continue validating guest-state and controls.
684 *
685 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
686 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
687 * old and new EFER value to not have any guest EFER bits influence the new
688 * nested-guest EFER.
689 */
690 uint64_t uValidEfer;
691 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
692 if (RT_FAILURE(rc))
693 {
694 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
695 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
696 }
697
698 /* Validate paging and CPU mode bits. */
699 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
700 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
701 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
702 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
703 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
704 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
705 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
706 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
707 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
708 if (fLongModeWithPaging)
709 uValidEfer |= MSR_K6_EFER_LMA;
710 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
711 if ( !fSvm
712 || (!fLongModeSupported && fLongModeActiveOrEnabled)
713 || (fLongModeWithPaging && !fPae)
714 || (fLongModeWithPaging && !fProtMode)
715 || ( fLongModeEnabled
716 && fPaging
717 && fPae
718 && fLongModeConformCS))
719 {
720 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
721 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
722 }
723
724 /*
725 * Preserve the required force-flags.
726 *
727 * We only preserve the force-flags that would affect the execution of the
728 * nested-guest (or the guest).
729 *
730 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
731 * execution of a subsequent IRET instruction in the guest.
732 *
733 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
734 * generate interrupts that should cause #VMEXITs for the nested-guest.
735 *
736 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
737 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
738 */
739 pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
740 pVCpu->cpum.GstCtx.eflags.uBoth &= ~CPUMCTX_INHIBIT_NMI;
741
742 /*
743 * Pause filter.
744 */
745 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
746 {
747 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
748 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
749 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
750 }
751
752 /*
753 * Interrupt shadow.
754 */
755 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
756 {
757 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
758 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
759 CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcbNstGst->u64RIP);
760 }
761
762 /*
763 * TLB flush control.
764 * Currently disabled since it's redundant as we unconditionally flush the TLB
765 * in iemSvmWorldSwitch() below.
766 */
767# if 0
768 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
769 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
770 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
771 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
772 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
773# endif
774
775 /*
776 * Validate and map PAE PDPEs if the guest will be using PAE paging.
777 * Invalid PAE PDPEs here causes a #VMEXIT.
778 */
779 if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
780 && CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
781 {
782 rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
783 if (RT_SUCCESS(rc))
784 { /* likely */ }
785 else
786 {
787 Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
788 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
789 }
790 }
791
792 /*
793 * Copy the remaining guest state from the VMCB to the guest-CPU context.
794 */
795 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
796 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
797 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
798 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
799 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
800 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
801 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
802 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
803 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
804 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
805 pVCpu->cpum.GstCtx.rflags.u = pVmcbNstGst->u64RFlags;
806 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
807 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
808 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
809 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
810 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
811 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
812
813 /* Mask DR6, DR7 bits mandatory set/clear bits. */
814 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
815 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
816 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
817 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
818
819 /*
820 * Check for pending virtual interrupts.
821 */
822 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
823 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
824 else
825 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
826
827 /*
828 * Update PGM, IEM and others of a world-switch.
829 */
830 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, cbInstr);
831 if (rcStrict == VINF_SUCCESS)
832 { /* likely */ }
833 else if (RT_SUCCESS(rcStrict))
834 {
835 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
836 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
837 }
838 else
839 {
840 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
841 return rcStrict;
842 }
843
844 /*
845 * Set the global-interrupt flag to allow interrupts in the guest.
846 */
847 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
848
849 /*
850 * Event injection.
851 */
852 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
853 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
854 if (pEventInject->n.u1Valid)
855 {
856 uint8_t const uVector = pEventInject->n.u8Vector;
857 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
858 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
859
860 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
861 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
862 {
863 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
864 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
865 }
866 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
867 {
868 if ( uVector == X86_XCPT_NMI
869 || uVector > X86_XCPT_LAST)
870 {
871 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
872 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
873 }
874 if ( uVector == X86_XCPT_BR
875 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
876 {
877 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
878 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
879 }
880 /** @todo any others? */
881 }
882
883 /*
884 * Invalidate the exit interrupt-information field here. This field is fully updated
885 * on #VMEXIT as events other than the one below can also cause intercepts during
886 * their injection (e.g. exceptions).
887 */
888 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
889
890 /*
891 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
892 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
893 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
894 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
895 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
896 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
897 * injecting the event through IEM here.
898 */
899 pVmcbCtrl->EventInject.n.u1Valid = 0;
900
901 /** @todo NRIP: Software interrupts can only be pushed properly if we support
902 * NRIP for the nested-guest to calculate the instruction length
903 * below. */
904 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
905 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
906 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
907
908 /*
909 * We shall not inject the event here right away. There may be paging mode related updates
910 * as a result of the world-switch above that are yet to be honored. Instead flag the event
911 * as pending for injection.
912 */
913 TRPMAssertTrap(pVCpu, uVector, enmType);
914 if (pEventInject->n.u1ErrorCodeValid)
915 TRPMSetErrorCode(pVCpu, uErrorCode);
916 if ( enmType == TRPM_TRAP
917 && uVector == X86_XCPT_PF)
918 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
919 }
920 else
921 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
922 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
923 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.eflags.u));
924
925 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
926
927# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
928 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
929 if ( HMIsEnabled(pVM)
930 && HMIsSvmVGifActive(pVM))
931 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
932# endif
933
934 return rcStrict;
935 }
936
937 /* Shouldn't really happen as the caller should've validated the physical address already. */
938 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
939 return rc;
940}
941
942
943/**
944 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
945 * intercept is active.
946 *
947 * @returns Strict VBox status code.
948 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
949 * we're not executing a nested-guest.
950 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
951 * successfully.
952 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
953 * failed and a shutdown needs to be initiated for the guest.
954 *
955 * @returns VBox strict status code.
956 * @param pVCpu The cross context virtual CPU structure of the calling thread.
957 * @param cbInstr The length of the instruction in bytes triggering the
958 * event.
959 * @param u8Vector The interrupt or exception vector.
960 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
961 * @param uErr The error-code associated with the exception.
962 * @param uCr2 The CR2 value in case of a \#PF exception.
963 */
964VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t u8Vector, uint32_t fFlags,
965 uint32_t uErr, uint64_t uCr2) RT_NOEXCEPT
966{
967 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
968
969 /*
970 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
971 *
972 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
973 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
974 * even when they use a vector in the range 0 to 31.
975 * - ICEBP should not trigger #DB intercept, but its own intercept.
976 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
977 */
978 /* Check NMI intercept */
979 if ( u8Vector == X86_XCPT_NMI
980 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
981 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
982 {
983 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
984 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
985 }
986
987 /* Check ICEBP intercept. */
988 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
989 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
990 {
991 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
992 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
993 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
994 }
995
996 /* Check CPU exception intercepts. */
997 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
998 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
999 {
1000 Assert(u8Vector <= X86_XCPT_LAST);
1001 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
1002 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
1003 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
1004 && u8Vector == X86_XCPT_PF
1005 && !(uErr & X86_TRAP_PF_ID))
1006 {
1007 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
1008# ifdef IEM_WITH_CODE_TLB
1009 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
1010 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
1011 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1012 if ( pbInstrBuf
1013 && cbInstrBuf > 0)
1014 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
1015# else
1016 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
1017 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1018 if (cbOpcode > 0)
1019 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
1020# endif
1021 }
1022 if (u8Vector == X86_XCPT_BR)
1023 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1024 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
1025 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
1026 u8Vector, uExitInfo1, uExitInfo2));
1027 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
1028 }
1029
1030 /* Check software interrupt (INTn) intercepts. */
1031 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
1032 | IEM_XCPT_FLAGS_BP_INSTR
1033 | IEM_XCPT_FLAGS_ICEBP_INSTR
1034 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
1035 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
1036 {
1037 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
1038 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
1039 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1040 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
1041 }
1042
1043 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1044}
1045
1046
1047/**
1048 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
1049 * corresponding intercept is active.
1050 *
1051 * @returns Strict VBox status code.
1052 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1053 * we're not executing a nested-guest.
1054 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1055 * successfully.
1056 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1057 * failed and a shutdown needs to be initiated for the guest.
1058 *
1059 * @returns VBox strict status code.
1060 * @param pVCpu The cross context virtual CPU structure of the calling thread.
1061 * @param u16Port The IO port being accessed.
1062 * @param enmIoType The type of IO access.
1063 * @param cbReg The IO operand size in bytes.
1064 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1065 * @param iEffSeg The effective segment number.
1066 * @param fRep Whether this is a repeating IO instruction (REP prefix).
1067 * @param fStrIo Whether this is a string IO instruction.
1068 * @param cbInstr The length of the IO instruction in bytes.
1069 */
1070VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1071 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr) RT_NOEXCEPT
1072{
1073 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1074 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
1075 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
1076
1077 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1078
1079 SVMIOIOEXITINFO IoExitInfo;
1080 bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1081 cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1082 if (fIntercept)
1083 {
1084 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1085 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1086 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1087 }
1088
1089 /** @todo remove later (for debugging as VirtualBox always traps all IO
1090 * intercepts). */
1091 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1092 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1093}
1094
1095
1096/**
1097 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1098 * corresponding intercept is active.
1099 *
1100 * @returns Strict VBox status code.
1101 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1102 * specify interception of the accessed MSR @a idMsr.
1103 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1104 * successfully.
1105 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1106 * failed and a shutdown needs to be initiated for the guest.
1107 *
1108 * @param pVCpu The cross context virtual CPU structure.
1109 * @param idMsr The MSR being accessed in the nested-guest.
1110 * @param fWrite Whether this is an MSR write access, @c false implies an
1111 * MSR read.
1112 * @param cbInstr The length of the MSR read/write instruction in bytes.
1113 */
1114VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite, uint8_t cbInstr) RT_NOEXCEPT
1115{
1116 /*
1117 * Check if any MSRs are being intercepted.
1118 */
1119 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1120 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1121
1122 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1123
1124 /*
1125 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1126 */
1127 uint16_t offMsrpm;
1128 uint8_t uMsrpmBit;
1129 int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1130 if (RT_SUCCESS(rc))
1131 {
1132 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1133 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1134 if (fWrite)
1135 ++uMsrpmBit;
1136
1137 /*
1138 * Check if the bit is set, if so, trigger a #VMEXIT.
1139 */
1140 if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1141 {
1142 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1143 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1144 }
1145 }
1146 else
1147 {
1148 /*
1149 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1150 */
1151 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1152 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1153 }
1154 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1155}
1156
1157
1158
1159/**
1160 * Implements 'VMRUN'.
1161 */
1162IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1163{
1164# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1165 RT_NOREF2(pVCpu, cbInstr);
1166 return VINF_EM_RAW_EMULATE_INSTR;
1167# else
1168 LogFlow(("iemCImpl_vmrun\n"));
1169 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1170
1171 /** @todo Check effective address size using address size prefix. */
1172 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1173 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1174 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1175 {
1176 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1177 return iemRaiseGeneralProtectionFault0(pVCpu);
1178 }
1179
1180 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1181 {
1182 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1183 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1184 }
1185
1186 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1187 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1188 {
1189 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1190 rcStrict = VINF_EM_TRIPLE_FAULT;
1191 }
1192 return rcStrict;
1193# endif
1194}
1195
1196
1197/**
1198 * Interface for HM and EM to emulate the VMRUN instruction.
1199 *
1200 * @returns Strict VBox status code.
1201 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1202 * @param cbInstr The instruction length in bytes.
1203 * @thread EMT(pVCpu)
1204 */
1205VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmrun(PVMCPUCC pVCpu, uint8_t cbInstr)
1206{
1207 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1208 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
1209
1210 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1211 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmrun);
1212 Assert(!pVCpu->iem.s.cActiveMappings);
1213 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1214}
1215
1216
1217/**
1218 * Implements 'VMLOAD'.
1219 */
1220IEM_CIMPL_DEF_0(iemCImpl_vmload)
1221{
1222# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1223 RT_NOREF2(pVCpu, cbInstr);
1224 return VINF_EM_RAW_EMULATE_INSTR;
1225# else
1226 LogFlow(("iemCImpl_vmload\n"));
1227 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1228
1229 /** @todo Check effective address size using address size prefix. */
1230 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1231 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1232 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1233 {
1234 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1235 return iemRaiseGeneralProtectionFault0(pVCpu);
1236 }
1237
1238 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1239 {
1240 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1241 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1242 }
1243
1244 SVMVMCBSTATESAVE VmcbNstGst;
1245 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1246 sizeof(SVMVMCBSTATESAVE));
1247 if (rcStrict == VINF_SUCCESS)
1248 {
1249 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1250 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1251 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1252 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1253 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1254
1255 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1256 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1257 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1258 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1259 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1260
1261 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1262 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1263 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1264
1265 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1266 }
1267 return rcStrict;
1268# endif
1269}
1270
1271
1272/**
1273 * Interface for HM and EM to emulate the VMLOAD instruction.
1274 *
1275 * @returns Strict VBox status code.
1276 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1277 * @param cbInstr The instruction length in bytes.
1278 * @thread EMT(pVCpu)
1279 */
1280VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmload(PVMCPUCC pVCpu, uint8_t cbInstr)
1281{
1282 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1283
1284 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1285 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmload);
1286 Assert(!pVCpu->iem.s.cActiveMappings);
1287 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1288}
1289
1290
1291/**
1292 * Implements 'VMSAVE'.
1293 */
1294IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1295{
1296# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1297 RT_NOREF2(pVCpu, cbInstr);
1298 return VINF_EM_RAW_EMULATE_INSTR;
1299# else
1300 LogFlow(("iemCImpl_vmsave\n"));
1301 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1302
1303 /** @todo Check effective address size using address size prefix. */
1304 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1305 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1306 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1307 {
1308 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1309 return iemRaiseGeneralProtectionFault0(pVCpu);
1310 }
1311
1312 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1313 {
1314 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1315 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1316 }
1317
1318 SVMVMCBSTATESAVE VmcbNstGst;
1319 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1320 sizeof(SVMVMCBSTATESAVE));
1321 if (rcStrict == VINF_SUCCESS)
1322 {
1323 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1324 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1325 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1326
1327 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1328 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1329 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1330 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1331
1332 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1333 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1334 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1335 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1336 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1337
1338 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1339 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1340 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1341
1342 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1343 sizeof(SVMVMCBSTATESAVE));
1344 if (rcStrict == VINF_SUCCESS)
1345 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1346 }
1347 return rcStrict;
1348# endif
1349}
1350
1351
1352/**
1353 * Interface for HM and EM to emulate the VMSAVE instruction.
1354 *
1355 * @returns Strict VBox status code.
1356 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1357 * @param cbInstr The instruction length in bytes.
1358 * @thread EMT(pVCpu)
1359 */
1360VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmsave(PVMCPUCC pVCpu, uint8_t cbInstr)
1361{
1362 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1363
1364 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1365 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmsave);
1366 Assert(!pVCpu->iem.s.cActiveMappings);
1367 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1368}
1369
1370
1371/**
1372 * Implements 'CLGI'.
1373 */
1374IEM_CIMPL_DEF_0(iemCImpl_clgi)
1375{
1376# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1377 RT_NOREF2(pVCpu, cbInstr);
1378 return VINF_EM_RAW_EMULATE_INSTR;
1379# else
1380 LogFlow(("iemCImpl_clgi\n"));
1381 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1382 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1383 {
1384 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1385 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1386 }
1387
1388 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1389
1390# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1391 iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1392 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1393# else
1394 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1395# endif
1396# endif
1397}
1398
1399
1400/**
1401 * Interface for HM and EM to emulate the CLGI instruction.
1402 *
1403 * @returns Strict VBox status code.
1404 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1405 * @param cbInstr The instruction length in bytes.
1406 * @thread EMT(pVCpu)
1407 */
1408VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedClgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1409{
1410 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1411
1412 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1413 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_clgi);
1414 Assert(!pVCpu->iem.s.cActiveMappings);
1415 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1416}
1417
1418
1419/**
1420 * Implements 'STGI'.
1421 */
1422IEM_CIMPL_DEF_0(iemCImpl_stgi)
1423{
1424# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1425 RT_NOREF2(pVCpu, cbInstr);
1426 return VINF_EM_RAW_EMULATE_INSTR;
1427# else
1428 LogFlow(("iemCImpl_stgi\n"));
1429 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1430 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1431 {
1432 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1433 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1434 }
1435
1436 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1437
1438# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1439 iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1440 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1441# else
1442 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1443# endif
1444# endif
1445}
1446
1447
1448/**
1449 * Interface for HM and EM to emulate the STGI instruction.
1450 *
1451 * @returns Strict VBox status code.
1452 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1453 * @param cbInstr The instruction length in bytes.
1454 * @thread EMT(pVCpu)
1455 */
1456VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedStgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1457{
1458 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1459
1460 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1461 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_stgi);
1462 Assert(!pVCpu->iem.s.cActiveMappings);
1463 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1464}
1465
1466
1467/**
1468 * Implements 'INVLPGA'.
1469 */
1470IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1471{
1472 /** @todo Check effective address size using address size prefix. */
1473 RTGCPTR const GCPtrPage = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1474 /** @todo PGM needs virtual ASID support. */
1475# if 0
1476 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1477# endif
1478
1479 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1480 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1481 { /* probable */ }
1482 else
1483 {
1484 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1485 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1486 }
1487
1488 PGMInvalidatePage(pVCpu, GCPtrPage);
1489 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1490}
1491
1492
1493/**
1494 * Interface for HM and EM to emulate the INVLPGA instruction.
1495 *
1496 * @returns Strict VBox status code.
1497 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1498 * @param cbInstr The instruction length in bytes.
1499 * @thread EMT(pVCpu)
1500 */
1501VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvlpga(PVMCPUCC pVCpu, uint8_t cbInstr)
1502{
1503 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1504
1505 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1506 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_invlpga);
1507 Assert(!pVCpu->iem.s.cActiveMappings);
1508 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1509}
1510
1511
1512/**
1513 * Implements 'SKINIT'.
1514 */
1515IEM_CIMPL_DEF_0(iemCImpl_skinit)
1516{
1517 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1518
1519 uint32_t uIgnore;
1520 uint32_t fFeaturesECX;
1521 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1522 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1523 return iemRaiseUndefinedOpcode(pVCpu);
1524
1525 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1526 {
1527 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1528 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1529 }
1530
1531 RT_NOREF(cbInstr);
1532 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1533}
1534
1535
1536/**
1537 * Implements SVM's implementation of PAUSE.
1538 */
1539IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1540{
1541 bool fCheckIntercept = true;
1542 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1543 {
1544 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1545
1546 /* TSC based pause-filter thresholding. */
1547 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1548 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1549 {
1550 uint64_t const uTick = TMCpuTickGet(pVCpu);
1551 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1552 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1553 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1554 }
1555
1556 /* Simple pause-filter counter. */
1557 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1558 {
1559 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1560 fCheckIntercept = false;
1561 }
1562 }
1563
1564 if (fCheckIntercept)
1565 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0, cbInstr);
1566
1567 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1568}
1569
1570#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1571
1572/**
1573 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1574 */
1575IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1576{
1577 if (EMAreHypercallInstructionsEnabled(pVCpu))
1578 {
1579 NOREF(uDisOpcode);
1580 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1581 if (RT_SUCCESS(rcStrict))
1582 {
1583 /** @todo finish: Sort out assertion here when iemRegAddToRipAndFinishingClearingRF
1584 * starts returning non-VINF_SUCCESS statuses. */
1585 if (rcStrict == VINF_SUCCESS)
1586 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1587 if ( rcStrict == VINF_SUCCESS
1588 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1589 return VINF_SUCCESS;
1590 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1591 return rcStrict;
1592 }
1593 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1594 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1595 || rcStrict == VERR_GIM_NOT_ENABLED
1596 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1597 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1598 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1599
1600 /* Raise #UD on all failures. */
1601 }
1602 return iemRaiseUndefinedOpcode(pVCpu);
1603}
1604
1605
1606/**
1607 * Implements 'VMMCALL'.
1608 */
1609IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1610{
1611 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1612 {
1613 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1614 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1615 }
1616
1617 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1618 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1619 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1620 if (VM_IS_HM_ENABLED(pVM))
1621 {
1622 int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1623 if (RT_SUCCESS(rc))
1624 {
1625 Log(("vmmcall: MovTpr\n"));
1626 return VINF_SUCCESS;
1627 }
1628 }
1629
1630 /* Join forces with vmcall. */
1631 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1632}
1633
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette