VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/target-x86/IEMAllCImplSvmInstr-x86.cpp@ 108196

Last change on this file since 108196 was 108196, checked in by vboxsync, 3 months ago

VMM/IEM: Moving x86 target specific files to VMMAll/target-x86/... jiraref:VBP-1431
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 68.4 KB
Line 
1/* $Id: IEMAllCImplSvmInstr-x86.cpp 108196 2025-02-13 15:18:18Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation (x86 target).
4 */
5
6/*
7 * Copyright (C) 2011-2024 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM_SVM
33#define VMCPU_INCL_CPUM_GST_CTX
34#ifdef IN_RING0
35# define VBOX_VMM_TARGET_X86
36#endif
37#include <VBox/vmm/iem.h>
38#include <VBox/vmm/pdmapic.h>
39#include <VBox/vmm/cpum.h>
40#include <VBox/vmm/dbgf.h>
41#include <VBox/vmm/em.h>
42#include <VBox/vmm/hm.h>
43#include <VBox/vmm/pgm.h>
44#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
45# include <VBox/vmm/hm_svm.h>
46#endif
47#include <VBox/vmm/gim.h>
48#include <VBox/vmm/tm.h>
49#include "IEMInternal.h"
50#include <VBox/vmm/vmcc.h>
51#include <VBox/log.h>
52#include <VBox/disopcode-x86-amd64.h> /* for OP_VMMCALL */
53#include <VBox/err.h>
54#include <VBox/param.h>
55#include <iprt/assert.h>
56#include <iprt/string.h>
57#include <iprt/x86.h>
58
59#include "IEMInline.h"
60
61#ifdef VBOX_WITH_NESTED_HWVIRT_SVM /* Almost the whole file. */
62
63
64/*********************************************************************************************************************************
65* Defined Constants And Macros *
66*********************************************************************************************************************************/
67/**
68 * Check the common SVM instruction preconditions.
69 */
70# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
71 do { \
72 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
73 { \
74 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
75 return iemRaiseUndefinedOpcode(a_pVCpu); \
76 } \
77 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
78 { \
79 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
80 return iemRaiseUndefinedOpcode(a_pVCpu); \
81 } \
82 if (IEM_GET_CPL(a_pVCpu) != 0) \
83 { \
84 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
85 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
86 } \
87 } while (0)
88
89
90/**
91 * Converts an IEM exception event type to an SVM event type.
92 *
93 * @returns The SVM event type.
94 * @retval UINT8_MAX if the specified type of event isn't among the set
95 * of recognized IEM event types.
96 *
97 * @param uVector The vector of the event.
98 * @param fIemXcptFlags The IEM exception / interrupt flags.
99 */
100IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
101{
102 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
103 {
104 if (uVector != X86_XCPT_NMI)
105 return SVM_EVENT_EXCEPTION;
106 return SVM_EVENT_NMI;
107 }
108
109 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
110 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
111 return SVM_EVENT_EXCEPTION;
112
113 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
114 return SVM_EVENT_EXTERNAL_IRQ;
115
116 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
117 return SVM_EVENT_SOFTWARE_INT;
118
119 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
120 return UINT8_MAX;
121}
122
123
124/**
125 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
126 *
127 * @returns Strict VBox status code from PGMChangeMode.
128 * @param pVCpu The cross context virtual CPU structure.
129 * @param cbInstr The length of the current instruction.
130 */
131DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu, uint8_t cbInstr)
132{
133 /*
134 * Inform PGM about paging mode changes.
135 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
136 * see comment in iemMemPageTranslateAndCheckAccess().
137 */
138 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
139 true /* fForce */);
140 AssertRCReturn(rc, rc);
141
142 /* Invalidate IEM TLBs now that we've forced a PGM mode change. */
143 IEMTlbInvalidateAllGlobal(pVCpu);
144
145 /* Inform CPUM (recompiler), can later be removed. */
146 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
147
148 /* Re-initialize IEM cache/state after the drastic mode switch. */
149 iemReInitExec(pVCpu, cbInstr);
150 return rc;
151}
152
153
154/**
155 * SVM \#VMEXIT handler.
156 *
157 * @returns Strict VBox status code.
158 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
159 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
160 * "host state" and a shutdown is required.
161 *
162 * @param pVCpu The cross context virtual CPU structure.
163 * @param uExitCode The exit code.
164 * @param uExitInfo1 The exit info. 1 field.
165 * @param uExitInfo2 The exit info. 2 field.
166 */
167VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2) RT_NOEXCEPT
168{
169 VBOXSTRICTRC rcStrict;
170 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
171 || uExitCode == SVM_EXIT_INVALID)
172 {
173 Log2(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
174 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
175
176 /*
177 * Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
178 */
179 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
180
181 /*
182 * Map the nested-guest VMCB from its location in guest memory.
183 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
184 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
185 */
186 PSVMVMCB pVmcbMem;
187 PGMPAGEMAPLOCK PgLockMem;
188 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
189 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
190 &PgLockMem);
191 if (rcStrict == VINF_SUCCESS)
192 {
193 /*
194 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
195 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
196 * writing the VMCB back to guest memory.
197 */
198 HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
199
200 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
201 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
202 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
204
205 /*
206 * Save the nested-guest state into the VMCB state-save area.
207 */
208 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
209 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
210 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
211 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
212 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
213 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
214 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
215 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
216 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
217 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
218 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
219 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
220 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
221 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
222 /** @todo Nested paging. */
223 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u;
224 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
225 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
226 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
227 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
228 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
229 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
230 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
231 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
232 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
233
234 /*
235 * Save additional state and intercept information.
236 *
237 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
238 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
239 * SVM execution.
240 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
241 */
242 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
243 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
244 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
245 else
246 {
247 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
248 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
249 }
250
251 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
252
253 if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx)) /* Interrupt shadow. */
254 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
255 else
256 {
257 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
258 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
259 CPUMClearInterruptShadow(&pVCpu->cpum.GstCtx);
260 }
261
262 /*
263 * Save nRIP, instruction length and byte fields.
264 */
265 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
266 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
267 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
268
269 /*
270 * Save exit information.
271 */
272 pVmcbMemCtrl->u64ExitCode = uExitCode;
273 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
274 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
275
276 /*
277 * Update the exit interrupt-information field if this #VMEXIT happened as a result
278 * of delivering an event through IEM.
279 *
280 * Don't update the exit interrupt-information field if the event wasn't being injected
281 * through IEM, as it would have been updated by real hardware if the nested-guest was
282 * executed using hardware-assisted SVM.
283 */
284 {
285 uint8_t uExitIntVector;
286 uint32_t uExitIntErr;
287 uint32_t fExitIntFlags;
288 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
289 NULL /* uExitIntCr2 */);
290 if (fRaisingEvent)
291 {
292 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
293 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
294 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
295 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
296 {
297 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
298 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
299 }
300 }
301 }
302
303 /*
304 * Save the exit interrupt-information field.
305 *
306 * We write the whole field including overwriting reserved bits as it was observed on an
307 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
308 */
309 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
310
311 /*
312 * Clear event injection.
313 */
314 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
315
316 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
317 }
318
319 /*
320 * Prepare for guest's "host mode" by clearing internal processor state bits.
321 *
322 * We don't need to zero out the state-save area, just the controls should be
323 * sufficient because it has the critical bit of indicating whether we're inside
324 * the nested-guest or not.
325 */
326 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
327 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
328
329 /*
330 * Restore the subset of the inhibit flags that were preserved.
331 */
332 pVCpu->cpum.GstCtx.eflags.uBoth |= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
333
334 if (rcStrict == VINF_SUCCESS)
335 {
336 /** @todo Nested paging. */
337 /** @todo ASID. */
338
339 /*
340 * If we are switching to PAE mode host, validate the PDPEs first.
341 * Any invalid PDPEs here causes a VCPU shutdown.
342 */
343 PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
344 bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
345 if (fHostInPaeMode)
346 rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
347 if (RT_SUCCESS(rcStrict))
348 {
349 /*
350 * Reload the host state.
351 */
352 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
353
354 /*
355 * Update PGM, IEM and others of a world-switch.
356 */
357 rcStrict = iemSvmWorldSwitch(pVCpu, 0 /*cbInstr - whatever*/);
358 if (rcStrict == VINF_SUCCESS)
359 rcStrict = VINF_SVM_VMEXIT;
360 else if (RT_SUCCESS(rcStrict))
361 {
362 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
363 iemSetPassUpStatus(pVCpu, rcStrict);
364 rcStrict = VINF_SVM_VMEXIT;
365 }
366 else
367 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
368 }
369 else
370 {
371 Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
372 rcStrict = VINF_EM_TRIPLE_FAULT;
373 }
374 }
375 else
376 {
377 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
378 rcStrict = VINF_EM_TRIPLE_FAULT;
379 }
380 }
381 else
382 {
383 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
384 rcStrict = VERR_SVM_IPE_3;
385 }
386
387# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
388 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
389 if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
390 && HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
391 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
392# endif
393 return rcStrict;
394}
395
396
397/**
398 * Interface for HM and EM to emulate \#VMEXIT.
399 *
400 * @returns Strict VBox status code.
401 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
402 * @param uExitCode The exit code.
403 * @param uExitInfo1 The exit info. 1 field.
404 * @param uExitInfo2 The exit info. 2 field.
405 * @thread EMT(pVCpu)
406 */
407VMM_INT_DECL(VBOXSTRICTRC) IEMExecSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
408{
409 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
410 VBOXSTRICTRC rcStrict = iemSvmVmexit(pVCpu, uExitCode, uExitInfo1, uExitInfo2);
411 if (pVCpu->iem.s.cActiveMappings)
412 iemMemRollback(pVCpu);
413 return iemExecStatusCodeFiddling(pVCpu, rcStrict);
414}
415
416
417/**
418 * Performs the operations necessary that are part of the vmrun instruction
419 * execution in the guest.
420 *
421 * @returns Strict VBox status code (i.e. informational status codes too).
422 * @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
423 * code execution.
424 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
425 * (SVM_EXIT_INVALID most likely).
426 *
427 * @param pVCpu The cross context virtual CPU structure.
428 * @param cbInstr The length of the VMRUN instruction.
429 * @param GCPhysVmcb Guest physical address of the VMCB to run.
430 */
431static VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb) RT_NOEXCEPT
432{
433 LogFlow(("iemSvmVmrun\n"));
434
435 /*
436 * Cache the physical address of the VMCB for #VMEXIT exceptions.
437 */
438 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
439
440 /*
441 * Save the host state.
442 */
443 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
444
445 /*
446 * Read the guest VMCB.
447 */
448 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
449 int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
450 if (RT_SUCCESS(rc))
451 {
452 /*
453 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
454 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
455 * but in our implementation we try to preserve as much as we possibly can.
456 *
457 * We could read the entire page here and only write back the relevant fields on
458 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
459 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
460 * currently reserved but may be recognized as features bits in future CPUs causing
461 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
462 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
463 */
464 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
465 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
466
467 RT_ZERO(pVmcbCtrl->u8Reserved0);
468 RT_ZERO(pVmcbCtrl->u8Reserved1);
469 RT_ZERO(pVmcbCtrl->u8Reserved2);
470 RT_ZERO(pVmcbNstGst->u8Reserved0);
471 RT_ZERO(pVmcbNstGst->u8Reserved1);
472 RT_ZERO(pVmcbNstGst->u8Reserved2);
473 RT_ZERO(pVmcbNstGst->u8Reserved3);
474 RT_ZERO(pVmcbNstGst->u8Reserved4);
475 RT_ZERO(pVmcbNstGst->u8Reserved5);
476 pVmcbCtrl->u32Reserved0 = 0;
477 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
478 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
479 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
480 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
481 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
482 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
483 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
484 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
485 pVmcbCtrl->EventInject.n.u19Reserved = 0;
486 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
487
488 /*
489 * Validate guest-state and controls.
490 */
491 /* VMRUN must always be intercepted. */
492 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
493 {
494 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
495 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
496 }
497
498 /* Nested paging. */
499 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
500 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
501 {
502 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
503 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
504 }
505
506 /* AVIC. */
507 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
508 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
509 {
510 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
511 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
512 }
513
514 /* Last branch record (LBR) virtualization. */
515 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
516 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
517 {
518 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
519 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
520 }
521
522 /* Virtualized VMSAVE/VMLOAD. */
523 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
524 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
525 {
526 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
527 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
528 }
529
530 /* Virtual GIF. */
531 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
532 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
533 {
534 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
535 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
536 }
537
538 /* Guest ASID. */
539 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
540 {
541 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
542 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
543 }
544
545 /* Guest AVIC. */
546 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
547 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
548 {
549 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
550 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
551 }
552
553 /* Guest Secure Encrypted Virtualization. */
554 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
555 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
556 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
557 {
558 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
559 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
560 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
561 }
562
563 /* Flush by ASID. */
564 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
565 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
566 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
567 {
568 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
569 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
570 }
571
572 /* IO permission bitmap. */
573 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
574 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
575 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
576 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
577 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
578 {
579 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
580 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
581 }
582
583 /* MSR permission bitmap. */
584 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
585 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
586 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
587 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
588 {
589 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
590 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
591 }
592
593 /* CR0. */
594 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
595 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
596 {
597 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
598 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
599 }
600 if (pVmcbNstGst->u64CR0 >> 32)
601 {
602 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
603 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
604 }
605 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
606
607 /* DR6 and DR7. */
608 if ( pVmcbNstGst->u64DR6 >> 32
609 || pVmcbNstGst->u64DR7 >> 32)
610 {
611 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
612 pVmcbNstGst->u64DR6));
613 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
614 }
615
616 /*
617 * PAT (Page Attribute Table) MSR.
618 *
619 * The CPU only validates and loads it when nested-paging is enabled.
620 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
621 */
622 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
623 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
624 {
625 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
626 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
627 }
628
629 /*
630 * Copy the IO permission bitmap into the cache.
631 */
632 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
633 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
634 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
635 if (RT_FAILURE(rc))
636 {
637 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
638 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
639 }
640
641 /*
642 * Copy the MSR permission bitmap into the cache.
643 */
644 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
645 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
646 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
647 if (RT_FAILURE(rc))
648 {
649 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
650 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
651 }
652
653 /*
654 * Copy segments from nested-guest VMCB state to the guest-CPU state.
655 *
656 * We do this here as we need to use the CS attributes and it's easier this way
657 * then using the VMCB format selectors. It doesn't really matter where we copy
658 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
659 */
660 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
661 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
662 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
663 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
664
665 /** @todo Segment attribute overrides by VMRUN. */
666
667 /*
668 * CPL adjustments and overrides.
669 *
670 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
671 * We shall thus adjust both CS.DPL and SS.DPL here.
672 */
673 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
674 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
675 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
676 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
677 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
678 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
679
680 /*
681 * Continue validating guest-state and controls.
682 *
683 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
684 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
685 * old and new EFER value to not have any guest EFER bits influence the new
686 * nested-guest EFER.
687 */
688 uint64_t uValidEfer;
689 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
690 if (RT_FAILURE(rc))
691 {
692 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
693 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
694 }
695
696 /* Validate paging and CPU mode bits. */
697 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
698 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
699 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
700 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
701 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
702 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
703 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
704 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
705 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
706 if (fLongModeWithPaging)
707 uValidEfer |= MSR_K6_EFER_LMA;
708 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
709 if ( !fSvm
710 || (!fLongModeSupported && fLongModeActiveOrEnabled)
711 || (fLongModeWithPaging && !fPae)
712 || (fLongModeWithPaging && !fProtMode)
713 || ( fLongModeEnabled
714 && fPaging
715 && fPae
716 && fLongModeConformCS))
717 {
718 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
719 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
720 }
721
722 /*
723 * Preserve the required force-flags.
724 *
725 * We only preserve the force-flags that would affect the execution of the
726 * nested-guest (or the guest).
727 *
728 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
729 * execution of a subsequent IRET instruction in the guest.
730 *
731 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
732 * generate interrupts that should cause #VMEXITs for the nested-guest.
733 *
734 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
735 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
736 */
737 pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
738 pVCpu->cpum.GstCtx.eflags.uBoth &= ~CPUMCTX_INHIBIT_NMI;
739
740 /*
741 * Pause filter.
742 */
743 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
744 {
745 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
746 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
747 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
748 }
749
750 /*
751 * Interrupt shadow.
752 */
753 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
754 {
755 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
756 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
757 CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcbNstGst->u64RIP);
758 }
759
760 /*
761 * TLB flush control.
762 * Currently disabled since it's redundant as we unconditionally flush the TLB
763 * in iemSvmWorldSwitch() below.
764 */
765# if 0
766 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
767 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
768 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
769 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
770 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
771# endif
772
773 /*
774 * Validate and map PAE PDPEs if the guest will be using PAE paging.
775 * Invalid PAE PDPEs here causes a #VMEXIT.
776 */
777 if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
778 && CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
779 {
780 rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
781 if (RT_SUCCESS(rc))
782 { /* likely */ }
783 else
784 {
785 Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
786 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
787 }
788 }
789
790 /*
791 * Copy the remaining guest state from the VMCB to the guest-CPU context.
792 */
793 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
794 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
795 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
796 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
797 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
798 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
799 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
800 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
801 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
802 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
803 pVCpu->cpum.GstCtx.rflags.u = pVmcbNstGst->u64RFlags;
804 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
805 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
806 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
807 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
808 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
809 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
810
811 /* Mask DR6, DR7 bits mandatory set/clear bits. */
812 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
813 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
814 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
815 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
816
817 /*
818 * Check for pending virtual interrupts.
819 */
820 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
821 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
822 else
823 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
824
825 /*
826 * Update PGM, IEM and others of a world-switch.
827 */
828 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu, cbInstr);
829 if (rcStrict == VINF_SUCCESS)
830 { /* likely */ }
831 else if (RT_SUCCESS(rcStrict))
832 {
833 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
834 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
835 }
836 else
837 {
838 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
839 return rcStrict;
840 }
841
842 /*
843 * Set the global-interrupt flag to allow interrupts in the guest.
844 */
845 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
846
847 /*
848 * Event injection.
849 */
850 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
851 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
852 if (pEventInject->n.u1Valid)
853 {
854 uint8_t const uVector = pEventInject->n.u8Vector;
855 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
856 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
857
858 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
859 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
860 {
861 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
862 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
863 }
864 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
865 {
866 if ( uVector == X86_XCPT_NMI
867 || uVector > X86_XCPT_LAST)
868 {
869 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
870 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
871 }
872 if ( uVector == X86_XCPT_BR
873 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
874 {
875 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
876 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
877 }
878 /** @todo any others? */
879 }
880
881 /*
882 * Invalidate the exit interrupt-information field here. This field is fully updated
883 * on #VMEXIT as events other than the one below can also cause intercepts during
884 * their injection (e.g. exceptions).
885 */
886 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
887
888 /*
889 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
890 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
891 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
892 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
893 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
894 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
895 * injecting the event through IEM here.
896 */
897 pVmcbCtrl->EventInject.n.u1Valid = 0;
898
899 /** @todo NRIP: Software interrupts can only be pushed properly if we support
900 * NRIP for the nested-guest to calculate the instruction length
901 * below. */
902 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
903 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
904 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
905
906 /*
907 * We shall not inject the event here right away. There may be paging mode related updates
908 * as a result of the world-switch above that are yet to be honored. Instead flag the event
909 * as pending for injection.
910 */
911 TRPMAssertTrap(pVCpu, uVector, enmType);
912 if (pEventInject->n.u1ErrorCodeValid)
913 TRPMSetErrorCode(pVCpu, uErrorCode);
914 if ( enmType == TRPM_TRAP
915 && uVector == X86_XCPT_PF)
916 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
917 }
918 else
919 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
920 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
921 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.eflags.u));
922
923 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
924
925# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
926 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
927 if ( HMIsEnabled(pVM)
928 && HMIsSvmVGifActive(pVM))
929 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
930# endif
931
932 return rcStrict;
933 }
934
935 /* Shouldn't really happen as the caller should've validated the physical address already. */
936 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
937 return rc;
938}
939
940
941/**
942 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
943 * intercept is active.
944 *
945 * @returns Strict VBox status code.
946 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
947 * we're not executing a nested-guest.
948 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
949 * successfully.
950 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
951 * failed and a shutdown needs to be initiated for the guest.
952 *
953 * @returns VBox strict status code.
954 * @param pVCpu The cross context virtual CPU structure of the calling thread.
955 * @param cbInstr The length of the instruction in bytes triggering the
956 * event.
957 * @param u8Vector The interrupt or exception vector.
958 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
959 * @param uErr The error-code associated with the exception.
960 * @param uCr2 The CR2 value in case of a \#PF exception.
961 */
962VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t u8Vector, uint32_t fFlags,
963 uint32_t uErr, uint64_t uCr2) RT_NOEXCEPT
964{
965 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
966
967 /*
968 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
969 *
970 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
971 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
972 * even when they use a vector in the range 0 to 31.
973 * - ICEBP should not trigger #DB intercept, but its own intercept.
974 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
975 */
976 /* Check NMI intercept */
977 if ( u8Vector == X86_XCPT_NMI
978 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
979 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
980 {
981 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
982 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
983 }
984
985 /* Check ICEBP intercept. */
986 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
987 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
988 {
989 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
990 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
991 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
992 }
993
994 /* Check CPU exception intercepts. */
995 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
996 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
997 {
998 Assert(u8Vector <= X86_XCPT_LAST);
999 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
1000 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
1001 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
1002 && u8Vector == X86_XCPT_PF
1003 && !(uErr & X86_TRAP_PF_ID))
1004 {
1005 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
1006# ifdef IEM_WITH_CODE_TLB
1007 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
1008 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
1009 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1010 if ( pbInstrBuf
1011 && cbInstrBuf > 0)
1012 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
1013# else
1014 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
1015 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1016 if (cbOpcode > 0)
1017 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
1018# endif
1019 }
1020 if (u8Vector == X86_XCPT_BR)
1021 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1022 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
1023 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
1024 u8Vector, uExitInfo1, uExitInfo2));
1025 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
1026 }
1027
1028 /* Check software interrupt (INTn) intercepts. */
1029 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
1030 | IEM_XCPT_FLAGS_BP_INSTR
1031 | IEM_XCPT_FLAGS_ICEBP_INSTR
1032 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
1033 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
1034 {
1035 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
1036 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
1037 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1038 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
1039 }
1040
1041 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1042}
1043
1044
1045/**
1046 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
1047 * corresponding intercept is active.
1048 *
1049 * @returns Strict VBox status code.
1050 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1051 * we're not executing a nested-guest.
1052 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1053 * successfully.
1054 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1055 * failed and a shutdown needs to be initiated for the guest.
1056 *
1057 * @returns VBox strict status code.
1058 * @param pVCpu The cross context virtual CPU structure of the calling thread.
1059 * @param u16Port The IO port being accessed.
1060 * @param enmIoType The type of IO access.
1061 * @param cbReg The IO operand size in bytes.
1062 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1063 * @param iEffSeg The effective segment number.
1064 * @param fRep Whether this is a repeating IO instruction (REP prefix).
1065 * @param fStrIo Whether this is a string IO instruction.
1066 * @param cbInstr The length of the IO instruction in bytes.
1067 */
1068VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1069 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr) RT_NOEXCEPT
1070{
1071 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1072 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
1073 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
1074
1075 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1076
1077 SVMIOIOEXITINFO IoExitInfo;
1078 bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1079 cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1080 if (fIntercept)
1081 {
1082 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1083 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1084 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1085 }
1086
1087 /** @todo remove later (for debugging as VirtualBox always traps all IO
1088 * intercepts). */
1089 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1090 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1091}
1092
1093
1094/**
1095 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1096 * corresponding intercept is active.
1097 *
1098 * @returns Strict VBox status code.
1099 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1100 * specify interception of the accessed MSR @a idMsr.
1101 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1102 * successfully.
1103 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1104 * failed and a shutdown needs to be initiated for the guest.
1105 *
1106 * @param pVCpu The cross context virtual CPU structure.
1107 * @param idMsr The MSR being accessed in the nested-guest.
1108 * @param fWrite Whether this is an MSR write access, @c false implies an
1109 * MSR read.
1110 * @param cbInstr The length of the MSR read/write instruction in bytes.
1111 */
1112VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite, uint8_t cbInstr) RT_NOEXCEPT
1113{
1114 /*
1115 * Check if any MSRs are being intercepted.
1116 */
1117 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1118 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1119
1120 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1121
1122 /*
1123 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1124 */
1125 uint16_t offMsrpm;
1126 uint8_t uMsrpmBit;
1127 int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1128 if (RT_SUCCESS(rc))
1129 {
1130 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1131 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1132 if (fWrite)
1133 ++uMsrpmBit;
1134
1135 /*
1136 * Check if the bit is set, if so, trigger a #VMEXIT.
1137 */
1138 if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1139 {
1140 IEM_SVM_UPDATE_NRIP(pVCpu, cbInstr);
1141 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1142 }
1143 }
1144 else
1145 {
1146 /*
1147 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1148 */
1149 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1150 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1151 }
1152 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1153}
1154
1155
1156
1157/**
1158 * Implements 'VMRUN'.
1159 */
1160IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1161{
1162# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1163 RT_NOREF2(pVCpu, cbInstr);
1164 return VINF_EM_RAW_EMULATE_INSTR;
1165# else
1166 LogFlow(("iemCImpl_vmrun\n"));
1167 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1168
1169 /** @todo Check effective address size using address size prefix. */
1170 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1171 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1172 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1173 {
1174 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1175 return iemRaiseGeneralProtectionFault0(pVCpu);
1176 }
1177
1178 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1179 {
1180 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1181 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1182 }
1183
1184 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1185 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1186 {
1187 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1188 rcStrict = VINF_EM_TRIPLE_FAULT;
1189 }
1190 return rcStrict;
1191# endif
1192}
1193
1194
1195/**
1196 * Interface for HM and EM to emulate the VMRUN instruction.
1197 *
1198 * @returns Strict VBox status code.
1199 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1200 * @param cbInstr The instruction length in bytes.
1201 * @thread EMT(pVCpu)
1202 */
1203VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmrun(PVMCPUCC pVCpu, uint8_t cbInstr)
1204{
1205 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1206 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
1207
1208 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1209 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmrun);
1210 Assert(!pVCpu->iem.s.cActiveMappings);
1211 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1212}
1213
1214
1215/**
1216 * Implements 'VMLOAD'.
1217 */
1218IEM_CIMPL_DEF_0(iemCImpl_vmload)
1219{
1220# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1221 RT_NOREF2(pVCpu, cbInstr);
1222 return VINF_EM_RAW_EMULATE_INSTR;
1223# else
1224 LogFlow(("iemCImpl_vmload\n"));
1225 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1226
1227 /** @todo Check effective address size using address size prefix. */
1228 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1229 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1230 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1231 {
1232 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1233 return iemRaiseGeneralProtectionFault0(pVCpu);
1234 }
1235
1236 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1237 {
1238 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1239 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1240 }
1241
1242 SVMVMCBSTATESAVE VmcbNstGst;
1243 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1244 sizeof(SVMVMCBSTATESAVE));
1245 if (rcStrict == VINF_SUCCESS)
1246 {
1247 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1248 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1249 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1250 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1251 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1252
1253 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1254 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1255 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1256 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1257 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1258
1259 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1260 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1261 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1262
1263 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1264 }
1265 return rcStrict;
1266# endif
1267}
1268
1269
1270/**
1271 * Interface for HM and EM to emulate the VMLOAD instruction.
1272 *
1273 * @returns Strict VBox status code.
1274 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1275 * @param cbInstr The instruction length in bytes.
1276 * @thread EMT(pVCpu)
1277 */
1278VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmload(PVMCPUCC pVCpu, uint8_t cbInstr)
1279{
1280 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1281
1282 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1283 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmload);
1284 Assert(!pVCpu->iem.s.cActiveMappings);
1285 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1286}
1287
1288
1289/**
1290 * Implements 'VMSAVE'.
1291 */
1292IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1293{
1294# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1295 RT_NOREF2(pVCpu, cbInstr);
1296 return VINF_EM_RAW_EMULATE_INSTR;
1297# else
1298 LogFlow(("iemCImpl_vmsave\n"));
1299 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1300
1301 /** @todo Check effective address size using address size prefix. */
1302 RTGCPHYS const GCPhysVmcb = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1303 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1304 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1305 {
1306 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1307 return iemRaiseGeneralProtectionFault0(pVCpu);
1308 }
1309
1310 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1311 {
1312 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1313 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1314 }
1315
1316 SVMVMCBSTATESAVE VmcbNstGst;
1317 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1318 sizeof(SVMVMCBSTATESAVE));
1319 if (rcStrict == VINF_SUCCESS)
1320 {
1321 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1322 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1323 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1324
1325 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1326 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1327 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1328 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1329
1330 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1331 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1332 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1333 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1334 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1335
1336 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1337 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1338 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1339
1340 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1341 sizeof(SVMVMCBSTATESAVE));
1342 if (rcStrict == VINF_SUCCESS)
1343 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1344 }
1345 return rcStrict;
1346# endif
1347}
1348
1349
1350/**
1351 * Interface for HM and EM to emulate the VMSAVE instruction.
1352 *
1353 * @returns Strict VBox status code.
1354 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1355 * @param cbInstr The instruction length in bytes.
1356 * @thread EMT(pVCpu)
1357 */
1358VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmsave(PVMCPUCC pVCpu, uint8_t cbInstr)
1359{
1360 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1361
1362 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1363 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmsave);
1364 Assert(!pVCpu->iem.s.cActiveMappings);
1365 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1366}
1367
1368
1369/**
1370 * Implements 'CLGI'.
1371 */
1372IEM_CIMPL_DEF_0(iemCImpl_clgi)
1373{
1374# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1375 RT_NOREF2(pVCpu, cbInstr);
1376 return VINF_EM_RAW_EMULATE_INSTR;
1377# else
1378 LogFlow(("iemCImpl_clgi\n"));
1379 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1380 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1381 {
1382 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1383 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1384 }
1385
1386 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1387
1388# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1389 iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1390 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1391# else
1392 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1393# endif
1394# endif
1395}
1396
1397
1398/**
1399 * Interface for HM and EM to emulate the CLGI instruction.
1400 *
1401 * @returns Strict VBox status code.
1402 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1403 * @param cbInstr The instruction length in bytes.
1404 * @thread EMT(pVCpu)
1405 */
1406VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedClgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1407{
1408 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1409
1410 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1411 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_clgi);
1412 Assert(!pVCpu->iem.s.cActiveMappings);
1413 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1414}
1415
1416
1417/**
1418 * Implements 'STGI'.
1419 */
1420IEM_CIMPL_DEF_0(iemCImpl_stgi)
1421{
1422# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1423 RT_NOREF2(pVCpu, cbInstr);
1424 return VINF_EM_RAW_EMULATE_INSTR;
1425# else
1426 LogFlow(("iemCImpl_stgi\n"));
1427 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1428 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1429 {
1430 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1431 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1432 }
1433
1434 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1435
1436# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1437 iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1438 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1439# else
1440 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1441# endif
1442# endif
1443}
1444
1445
1446/**
1447 * Interface for HM and EM to emulate the STGI instruction.
1448 *
1449 * @returns Strict VBox status code.
1450 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1451 * @param cbInstr The instruction length in bytes.
1452 * @thread EMT(pVCpu)
1453 */
1454VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedStgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1455{
1456 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1457
1458 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1459 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_stgi);
1460 Assert(!pVCpu->iem.s.cActiveMappings);
1461 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1462}
1463
1464
1465/**
1466 * Implements 'INVLPGA'.
1467 */
1468IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1469{
1470 /** @todo Check effective address size using address size prefix. */
1471 RTGCPTR const GCPtrPage = IEM_IS_64BIT_CODE(pVCpu) ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1472 /** @todo PGM needs virtual ASID support. */
1473# if 0
1474 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1475# endif
1476
1477 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1478 if (!IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1479 { /* probable */ }
1480 else
1481 {
1482 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1483 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1484 }
1485
1486 PGMInvalidatePage(pVCpu, GCPtrPage);
1487 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1488}
1489
1490
1491/**
1492 * Interface for HM and EM to emulate the INVLPGA instruction.
1493 *
1494 * @returns Strict VBox status code.
1495 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1496 * @param cbInstr The instruction length in bytes.
1497 * @thread EMT(pVCpu)
1498 */
1499VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvlpga(PVMCPUCC pVCpu, uint8_t cbInstr)
1500{
1501 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1502
1503 iemInitExec(pVCpu, 0 /*fExecOpts*/);
1504 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_invlpga);
1505 Assert(!pVCpu->iem.s.cActiveMappings);
1506 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1507}
1508
1509
1510/**
1511 * Implements 'SKINIT'.
1512 */
1513IEM_CIMPL_DEF_0(iemCImpl_skinit)
1514{
1515 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1516
1517 uint32_t uIgnore;
1518 uint32_t fFeaturesECX;
1519 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1520 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1521 return iemRaiseUndefinedOpcode(pVCpu);
1522
1523 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1524 {
1525 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1526 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1527 }
1528
1529 RT_NOREF(cbInstr);
1530 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1531}
1532
1533
1534/**
1535 * Implements SVM's implementation of PAUSE.
1536 */
1537IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1538{
1539 bool fCheckIntercept = true;
1540 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1541 {
1542 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1543
1544 /* TSC based pause-filter thresholding. */
1545 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1546 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1547 {
1548 uint64_t const uTick = TMCpuTickGet(pVCpu);
1549 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1550 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1551 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1552 }
1553
1554 /* Simple pause-filter counter. */
1555 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1556 {
1557 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1558 fCheckIntercept = false;
1559 }
1560 }
1561
1562 if (fCheckIntercept)
1563 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0, cbInstr);
1564
1565 return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1566}
1567
1568#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1569
1570/**
1571 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1572 */
1573IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1574{
1575 if (EMAreHypercallInstructionsEnabled(pVCpu))
1576 {
1577 NOREF(uDisOpcode);
1578 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1579 if (RT_SUCCESS(rcStrict))
1580 {
1581 /** @todo finish: Sort out assertion here when iemRegAddToRipAndFinishingClearingRF
1582 * starts returning non-VINF_SUCCESS statuses. */
1583 if (rcStrict == VINF_SUCCESS)
1584 rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
1585 if ( rcStrict == VINF_SUCCESS
1586 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1587 return VINF_SUCCESS;
1588 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1589 return rcStrict;
1590 }
1591 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1592 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1593 || rcStrict == VERR_GIM_NOT_ENABLED
1594 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1595 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1596 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1597
1598 /* Raise #UD on all failures. */
1599 }
1600 return iemRaiseUndefinedOpcode(pVCpu);
1601}
1602
1603
1604/**
1605 * Implements 'VMMCALL'.
1606 */
1607IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1608{
1609 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1610 {
1611 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1612 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1613 }
1614
1615 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1616 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1617 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1618 if (VM_IS_HM_ENABLED(pVM))
1619 {
1620 int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1621 if (RT_SUCCESS(rc))
1622 {
1623 Log(("vmmcall: MovTpr\n"));
1624 return VINF_SUCCESS;
1625 }
1626 }
1627
1628 /* Join forces with vmcall. */
1629 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1630}
1631
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette