VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp@ 96811

Last change on this file since 96811 was 96407, checked in by vboxsync, 22 months ago

scm copyright and license note update
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 67.8 KB
Line 
1/* $Id: IEMAllCImplSvmInstr.cpp 96407 2022-08-22 17:43:14Z vboxsync $ */
2/** @file
3 * IEM - AMD-V (Secure Virtual Machine) instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2022 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * SPDX-License-Identifier: GPL-3.0-only
26 */
27
28
29/*********************************************************************************************************************************
30* Header Files *
31*********************************************************************************************************************************/
32#define LOG_GROUP LOG_GROUP_IEM
33#define VMCPU_INCL_CPUM_GST_CTX
34#include <VBox/vmm/iem.h>
35#include <VBox/vmm/cpum.h>
36#include <VBox/vmm/apic.h>
37#include <VBox/vmm/pgm.h>
38#include <VBox/vmm/em.h>
39#include <VBox/vmm/hm.h>
40#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
41# include <VBox/vmm/hm_svm.h>
42#endif
43#include <VBox/vmm/gim.h>
44#include <VBox/vmm/tm.h>
45#include "IEMInternal.h"
46#include <VBox/vmm/vmcc.h>
47#include <VBox/log.h>
48#include <VBox/disopcode.h> /* for OP_VMMCALL */
49#include <VBox/err.h>
50#include <VBox/param.h>
51#include <iprt/assert.h>
52#include <iprt/string.h>
53#include <iprt/x86.h>
54
55#include "IEMInline.h"
56
57
58/*********************************************************************************************************************************
59* Defined Constants And Macros *
60*********************************************************************************************************************************/
61#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
62/**
63 * Check the common SVM instruction preconditions.
64 */
65# define IEM_SVM_INSTR_COMMON_CHECKS(a_pVCpu, a_Instr) \
66 do { \
67 if (!CPUMIsGuestSvmEnabled(IEM_GET_CTX(a_pVCpu))) \
68 { \
69 Log((RT_STR(a_Instr) ": EFER.SVME not enabled -> #UD\n")); \
70 return iemRaiseUndefinedOpcode(a_pVCpu); \
71 } \
72 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
73 { \
74 Log((RT_STR(a_Instr) ": Real or v8086 mode -> #UD\n")); \
75 return iemRaiseUndefinedOpcode(a_pVCpu); \
76 } \
77 if ((a_pVCpu)->iem.s.uCpl != 0) \
78 { \
79 Log((RT_STR(a_Instr) ": CPL != 0 -> #GP(0)\n")); \
80 return iemRaiseGeneralProtectionFault0(a_pVCpu); \
81 } \
82 } while (0)
83
84
85/**
86 * Converts an IEM exception event type to an SVM event type.
87 *
88 * @returns The SVM event type.
89 * @retval UINT8_MAX if the specified type of event isn't among the set
90 * of recognized IEM event types.
91 *
92 * @param uVector The vector of the event.
93 * @param fIemXcptFlags The IEM exception / interrupt flags.
94 */
95IEM_STATIC uint8_t iemGetSvmEventType(uint32_t uVector, uint32_t fIemXcptFlags)
96{
97 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
98 {
99 if (uVector != X86_XCPT_NMI)
100 return SVM_EVENT_EXCEPTION;
101 return SVM_EVENT_NMI;
102 }
103
104 /* See AMD spec. Table 15-1. "Guest Exception or Interrupt Types". */
105 if (fIemXcptFlags & (IEM_XCPT_FLAGS_BP_INSTR | IEM_XCPT_FLAGS_ICEBP_INSTR | IEM_XCPT_FLAGS_OF_INSTR))
106 return SVM_EVENT_EXCEPTION;
107
108 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_EXT_INT)
109 return SVM_EVENT_EXTERNAL_IRQ;
110
111 if (fIemXcptFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
112 return SVM_EVENT_SOFTWARE_INT;
113
114 AssertMsgFailed(("iemGetSvmEventType: Invalid IEM xcpt/int. type %#x, uVector=%#x\n", fIemXcptFlags, uVector));
115 return UINT8_MAX;
116}
117
118
119/**
120 * Performs an SVM world-switch (VMRUN, \#VMEXIT) updating PGM and IEM internals.
121 *
122 * @returns Strict VBox status code.
123 * @param pVCpu The cross context virtual CPU structure.
124 */
125DECLINLINE(VBOXSTRICTRC) iemSvmWorldSwitch(PVMCPUCC pVCpu)
126{
127 /*
128 * Inform PGM about paging mode changes.
129 * We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
130 * see comment in iemMemPageTranslateAndCheckAccess().
131 */
132 int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
133 true /* fForce */);
134 AssertRCReturn(rc, rc);
135
136 /* Invalidate IEM TLBs now that we've forced a PGM mode change. */
137 IEMTlbInvalidateAll(pVCpu);
138
139 /* Inform CPUM (recompiler), can later be removed. */
140 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
141
142 /* Re-initialize IEM cache/state after the drastic mode switch. */
143 iemReInitExec(pVCpu);
144 return rc;
145}
146
147
148/**
149 * SVM \#VMEXIT handler.
150 *
151 * @returns Strict VBox status code.
152 * @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
153 * @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
154 * "host state" and a shutdown is required.
155 *
156 * @param pVCpu The cross context virtual CPU structure.
157 * @param uExitCode The exit code.
158 * @param uExitInfo1 The exit info. 1 field.
159 * @param uExitInfo2 The exit info. 2 field.
160 */
161VBOXSTRICTRC iemSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2) RT_NOEXCEPT
162{
163 VBOXSTRICTRC rcStrict;
164 if ( CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu))
165 || uExitCode == SVM_EXIT_INVALID)
166 {
167 LogFlow(("iemSvmVmexit: CS:RIP=%04x:%08RX64 uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n",
168 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uExitCode, uExitInfo1, uExitInfo2));
169
170 /*
171 * Disable the global-interrupt flag to prevent interrupts during the 'atomic' world switch.
172 */
173 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
174
175 /*
176 * Map the nested-guest VMCB from its location in guest memory.
177 * Write exactly what the CPU does on #VMEXIT thereby preserving most other bits in the
178 * guest's VMCB in memory, see @bugref{7243#c113} and related comment on iemSvmVmrun().
179 */
180 PSVMVMCB pVmcbMem;
181 PGMPAGEMAPLOCK PgLockMem;
182 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
183 rcStrict = iemMemPageMap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, (void **)&pVmcbMem,
184 &PgLockMem);
185 if (rcStrict == VINF_SUCCESS)
186 {
187 /*
188 * Notify HM in case the nested-guest was executed using hardware-assisted SVM (which
189 * would have modified some VMCB state) that might need to be restored on #VMEXIT before
190 * writing the VMCB back to guest memory.
191 */
192 HMNotifySvmNstGstVmexit(pVCpu, IEM_GET_CTX(pVCpu));
193
194 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.es));
195 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.cs));
196 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
197 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ds));
198
199 /*
200 * Save the nested-guest state into the VMCB state-save area.
201 */
202 PSVMVMCBSTATESAVE pVmcbMemState = &pVmcbMem->guest;
203 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, ES, es);
204 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, CS, cs);
205 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, SS, ss);
206 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), pVmcbMemState, DS, ds);
207 pVmcbMemState->GDTR.u32Limit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
208 pVmcbMemState->GDTR.u64Base = pVCpu->cpum.GstCtx.gdtr.pGdt;
209 pVmcbMemState->IDTR.u32Limit = pVCpu->cpum.GstCtx.idtr.cbIdt;
210 pVmcbMemState->IDTR.u64Base = pVCpu->cpum.GstCtx.idtr.pIdt;
211 pVmcbMemState->u64EFER = pVCpu->cpum.GstCtx.msrEFER;
212 pVmcbMemState->u64CR4 = pVCpu->cpum.GstCtx.cr4;
213 pVmcbMemState->u64CR3 = pVCpu->cpum.GstCtx.cr3;
214 pVmcbMemState->u64CR2 = pVCpu->cpum.GstCtx.cr2;
215 pVmcbMemState->u64CR0 = pVCpu->cpum.GstCtx.cr0;
216 /** @todo Nested paging. */
217 pVmcbMemState->u64RFlags = pVCpu->cpum.GstCtx.rflags.u64;
218 pVmcbMemState->u64RIP = pVCpu->cpum.GstCtx.rip;
219 pVmcbMemState->u64RSP = pVCpu->cpum.GstCtx.rsp;
220 pVmcbMemState->u64RAX = pVCpu->cpum.GstCtx.rax;
221 pVmcbMemState->u64DR7 = pVCpu->cpum.GstCtx.dr[7];
222 pVmcbMemState->u64DR6 = pVCpu->cpum.GstCtx.dr[6];
223 pVmcbMemState->u8CPL = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
224 Assert(CPUMGetGuestCPL(pVCpu) == pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl);
225 if (CPUMIsGuestSvmNestedPagingEnabled(pVCpu, IEM_GET_CTX(pVCpu)))
226 pVmcbMemState->u64PAT = pVCpu->cpum.GstCtx.msrPAT;
227
228 /*
229 * Save additional state and intercept information.
230 *
231 * - V_IRQ: Tracked using VMCPU_FF_INTERRUPT_NESTED_GUEST force-flag and updated below.
232 * - V_TPR: Updated by iemCImpl_load_CrX or by the physical CPU for hardware-assisted
233 * SVM execution.
234 * - Interrupt shadow: Tracked using VMCPU_FF_INHIBIT_INTERRUPTS and RIP.
235 */
236 PSVMVMCBCTRL pVmcbMemCtrl = &pVmcbMem->ctrl;
237 if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST)) /* V_IRQ. */
238 pVmcbMemCtrl->IntCtrl.n.u1VIrqPending = 0;
239 else
240 {
241 Assert(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
242 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
243 }
244
245 pVmcbMemCtrl->IntCtrl.n.u8VTPR = pVmcbCtrl->IntCtrl.n.u8VTPR; /* V_TPR. */
246
247 if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS) /* Interrupt shadow. */
248 && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->cpum.GstCtx.rip)
249 {
250 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 1;
251 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
252 LogFlow(("iemSvmVmexit: Interrupt shadow till %#RX64\n", pVCpu->cpum.GstCtx.rip));
253 }
254 else
255 pVmcbMemCtrl->IntShadow.n.u1IntShadow = 0;
256
257 /*
258 * Save nRIP, instruction length and byte fields.
259 */
260 pVmcbMemCtrl->u64NextRIP = pVmcbCtrl->u64NextRIP;
261 pVmcbMemCtrl->cbInstrFetched = pVmcbCtrl->cbInstrFetched;
262 memcpy(&pVmcbMemCtrl->abInstr[0], &pVmcbCtrl->abInstr[0], sizeof(pVmcbMemCtrl->abInstr));
263
264 /*
265 * Save exit information.
266 */
267 pVmcbMemCtrl->u64ExitCode = uExitCode;
268 pVmcbMemCtrl->u64ExitInfo1 = uExitInfo1;
269 pVmcbMemCtrl->u64ExitInfo2 = uExitInfo2;
270
271 /*
272 * Update the exit interrupt-information field if this #VMEXIT happened as a result
273 * of delivering an event through IEM.
274 *
275 * Don't update the exit interrupt-information field if the event wasn't being injected
276 * through IEM, as it would have been updated by real hardware if the nested-guest was
277 * executed using hardware-assisted SVM.
278 */
279 {
280 uint8_t uExitIntVector;
281 uint32_t uExitIntErr;
282 uint32_t fExitIntFlags;
283 bool const fRaisingEvent = IEMGetCurrentXcpt(pVCpu, &uExitIntVector, &fExitIntFlags, &uExitIntErr,
284 NULL /* uExitIntCr2 */);
285 if (fRaisingEvent)
286 {
287 pVmcbCtrl->ExitIntInfo.n.u1Valid = 1;
288 pVmcbCtrl->ExitIntInfo.n.u8Vector = uExitIntVector;
289 pVmcbCtrl->ExitIntInfo.n.u3Type = iemGetSvmEventType(uExitIntVector, fExitIntFlags);
290 if (fExitIntFlags & IEM_XCPT_FLAGS_ERR)
291 {
292 pVmcbCtrl->ExitIntInfo.n.u1ErrorCodeValid = true;
293 pVmcbCtrl->ExitIntInfo.n.u32ErrorCode = uExitIntErr;
294 }
295 }
296 }
297
298 /*
299 * Save the exit interrupt-information field.
300 *
301 * We write the whole field including overwriting reserved bits as it was observed on an
302 * AMD Ryzen 5 Pro 1500 that the CPU does not preserve reserved bits in EXITINTINFO.
303 */
304 pVmcbMemCtrl->ExitIntInfo = pVmcbCtrl->ExitIntInfo;
305
306 /*
307 * Clear event injection.
308 */
309 pVmcbMemCtrl->EventInject.n.u1Valid = 0;
310
311 iemMemPageUnmap(pVCpu, pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, IEM_ACCESS_DATA_RW, pVmcbMem, &PgLockMem);
312 }
313
314 /*
315 * Prepare for guest's "host mode" by clearing internal processor state bits.
316 *
317 * We don't need to zero out the state-save area, just the controls should be
318 * sufficient because it has the critical bit of indicating whether we're inside
319 * the nested-guest or not.
320 */
321 memset(pVmcbCtrl, 0, sizeof(*pVmcbCtrl));
322 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
323
324 /*
325 * Restore the subset of force-flags that were preserved.
326 */
327 if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
328 {
329 VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
330 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
331 }
332
333 if (rcStrict == VINF_SUCCESS)
334 {
335 /** @todo Nested paging. */
336 /** @todo ASID. */
337
338 /*
339 * If we are switching to PAE mode host, validate the PDPEs first.
340 * Any invalid PDPEs here causes a VCPU shutdown.
341 */
342 PCSVMHOSTSTATE pHostState = &pVCpu->cpum.GstCtx.hwvirt.svm.HostState;
343 bool const fHostInPaeMode = CPUMIsPaePagingEnabled(pHostState->uCr0, pHostState->uCr4, pHostState->uEferMsr);
344 if (fHostInPaeMode)
345 rcStrict = PGMGstMapPaePdpesAtCr3(pVCpu, pHostState->uCr3);
346 if (RT_SUCCESS(rcStrict))
347 {
348 /*
349 * Reload the host state.
350 */
351 CPUMSvmVmExitRestoreHostState(pVCpu, IEM_GET_CTX(pVCpu));
352
353 /*
354 * Update PGM, IEM and others of a world-switch.
355 */
356 rcStrict = iemSvmWorldSwitch(pVCpu);
357 if (rcStrict == VINF_SUCCESS)
358 rcStrict = VINF_SVM_VMEXIT;
359 else if (RT_SUCCESS(rcStrict))
360 {
361 LogFlow(("iemSvmVmexit: Setting passup status from iemSvmWorldSwitch %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
362 iemSetPassUpStatus(pVCpu, rcStrict);
363 rcStrict = VINF_SVM_VMEXIT;
364 }
365 else
366 LogFlow(("iemSvmVmexit: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
367 }
368 else
369 {
370 Log(("iemSvmVmexit: PAE PDPEs invalid while restoring host state. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
371 rcStrict = VINF_EM_TRIPLE_FAULT;
372 }
373 }
374 else
375 {
376 AssertMsgFailed(("iemSvmVmexit: Mapping VMCB at %#RGp failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb, VBOXSTRICTRC_VAL(rcStrict)));
377 rcStrict = VINF_EM_TRIPLE_FAULT;
378 }
379 }
380 else
381 {
382 AssertMsgFailed(("iemSvmVmexit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode, uExitInfo1, uExitInfo2));
383 rcStrict = VERR_SVM_IPE_3;
384 }
385
386# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
387 /* CLGI/STGI may not have been intercepted and thus not executed in IEM. */
388 if ( HMIsEnabled(pVCpu->CTX_SUFF(pVM))
389 && HMIsSvmVGifActive(pVCpu->CTX_SUFF(pVM)))
390 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
391# endif
392 return rcStrict;
393}
394
395
396/**
397 * Interface for HM and EM to emulate \#VMEXIT.
398 *
399 * @returns Strict VBox status code.
400 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
401 * @param uExitCode The exit code.
402 * @param uExitInfo1 The exit info. 1 field.
403 * @param uExitInfo2 The exit info. 2 field.
404 * @thread EMT(pVCpu)
405 */
406VMM_INT_DECL(VBOXSTRICTRC) IEMExecSvmVmexit(PVMCPUCC pVCpu, uint64_t uExitCode, uint64_t uExitInfo1, uint64_t uExitInfo2)
407{
408 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
409 VBOXSTRICTRC rcStrict = iemSvmVmexit(pVCpu, uExitCode, uExitInfo1, uExitInfo2);
410 if (pVCpu->iem.s.cActiveMappings)
411 iemMemRollback(pVCpu);
412 return iemExecStatusCodeFiddling(pVCpu, rcStrict);
413}
414
415
416/**
417 * Performs the operations necessary that are part of the vmrun instruction
418 * execution in the guest.
419 *
420 * @returns Strict VBox status code (i.e. informational status codes too).
421 * @retval VINF_SUCCESS successfully executed VMRUN and entered nested-guest
422 * code execution.
423 * @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
424 * (SVM_EXIT_INVALID most likely).
425 *
426 * @param pVCpu The cross context virtual CPU structure.
427 * @param cbInstr The length of the VMRUN instruction.
428 * @param GCPhysVmcb Guest physical address of the VMCB to run.
429 */
430static VBOXSTRICTRC iemSvmVmrun(PVMCPUCC pVCpu, uint8_t cbInstr, RTGCPHYS GCPhysVmcb) RT_NOEXCEPT
431{
432 LogFlow(("iemSvmVmrun\n"));
433
434 /*
435 * Cache the physical address of the VMCB for #VMEXIT exceptions.
436 */
437 pVCpu->cpum.GstCtx.hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
438
439 /*
440 * Save the host state.
441 */
442 CPUMSvmVmRunSaveHostState(IEM_GET_CTX(pVCpu), cbInstr);
443
444 /*
445 * Read the guest VMCB.
446 */
447 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
448 int rc = PGMPhysSimpleReadGCPhys(pVM, &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb, GCPhysVmcb, sizeof(SVMVMCB));
449 if (RT_SUCCESS(rc))
450 {
451 /*
452 * AMD-V seems to preserve reserved fields and only writes back selected, recognized
453 * fields on #VMEXIT. However, not all reserved bits are preserved (e.g, EXITINTINFO)
454 * but in our implementation we try to preserve as much as we possibly can.
455 *
456 * We could read the entire page here and only write back the relevant fields on
457 * #VMEXIT but since our internal VMCB is also being used by HM during hardware-assisted
458 * SVM execution, it creates a potential for a nested-hypervisor to set bits that are
459 * currently reserved but may be recognized as features bits in future CPUs causing
460 * unexpected & undesired results. Hence, we zero out unrecognized fields here as we
461 * typically enter hardware-assisted SVM soon anyway, see @bugref{7243#c113}.
462 */
463 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
464 PSVMVMCBSTATESAVE pVmcbNstGst = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.guest;
465
466 RT_ZERO(pVmcbCtrl->u8Reserved0);
467 RT_ZERO(pVmcbCtrl->u8Reserved1);
468 RT_ZERO(pVmcbCtrl->u8Reserved2);
469 RT_ZERO(pVmcbNstGst->u8Reserved0);
470 RT_ZERO(pVmcbNstGst->u8Reserved1);
471 RT_ZERO(pVmcbNstGst->u8Reserved2);
472 RT_ZERO(pVmcbNstGst->u8Reserved3);
473 RT_ZERO(pVmcbNstGst->u8Reserved4);
474 RT_ZERO(pVmcbNstGst->u8Reserved5);
475 pVmcbCtrl->u32Reserved0 = 0;
476 pVmcbCtrl->TLBCtrl.n.u24Reserved = 0;
477 pVmcbCtrl->IntCtrl.n.u6Reserved = 0;
478 pVmcbCtrl->IntCtrl.n.u3Reserved = 0;
479 pVmcbCtrl->IntCtrl.n.u5Reserved = 0;
480 pVmcbCtrl->IntCtrl.n.u24Reserved = 0;
481 pVmcbCtrl->IntShadow.n.u30Reserved = 0;
482 pVmcbCtrl->ExitIntInfo.n.u19Reserved = 0;
483 pVmcbCtrl->NestedPagingCtrl.n.u29Reserved = 0;
484 pVmcbCtrl->EventInject.n.u19Reserved = 0;
485 pVmcbCtrl->LbrVirt.n.u30Reserved = 0;
486
487 /*
488 * Validate guest-state and controls.
489 */
490 /* VMRUN must always be intercepted. */
491 if (!CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_VMRUN))
492 {
493 Log(("iemSvmVmrun: VMRUN instruction not intercepted -> #VMEXIT\n"));
494 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
495 }
496
497 /* Nested paging. */
498 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
499 && !pVM->cpum.ro.GuestFeatures.fSvmNestedPaging)
500 {
501 Log(("iemSvmVmrun: Nested paging not supported -> Disabling\n"));
502 pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging = 0;
503 }
504
505 /* AVIC. */
506 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
507 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
508 {
509 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
510 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
511 }
512
513 /* Last branch record (LBR) virtualization. */
514 if ( pVmcbCtrl->LbrVirt.n.u1LbrVirt
515 && !pVM->cpum.ro.GuestFeatures.fSvmLbrVirt)
516 {
517 Log(("iemSvmVmrun: LBR virtualization not supported -> Disabling\n"));
518 pVmcbCtrl->LbrVirt.n.u1LbrVirt = 0;
519 }
520
521 /* Virtualized VMSAVE/VMLOAD. */
522 if ( pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload
523 && !pVM->cpum.ro.GuestFeatures.fSvmVirtVmsaveVmload)
524 {
525 Log(("iemSvmVmrun: Virtualized VMSAVE/VMLOAD not supported -> Disabling\n"));
526 pVmcbCtrl->LbrVirt.n.u1VirtVmsaveVmload = 0;
527 }
528
529 /* Virtual GIF. */
530 if ( pVmcbCtrl->IntCtrl.n.u1VGifEnable
531 && !pVM->cpum.ro.GuestFeatures.fSvmVGif)
532 {
533 Log(("iemSvmVmrun: Virtual GIF not supported -> Disabling\n"));
534 pVmcbCtrl->IntCtrl.n.u1VGifEnable = 0;
535 }
536
537 /* Guest ASID. */
538 if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
539 {
540 Log(("iemSvmVmrun: Guest ASID is invalid -> #VMEXIT\n"));
541 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
542 }
543
544 /* Guest AVIC. */
545 if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
546 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
547 {
548 Log(("iemSvmVmrun: AVIC not supported -> Disabling\n"));
549 pVmcbCtrl->IntCtrl.n.u1AvicEnable = 0;
550 }
551
552 /* Guest Secure Encrypted Virtualization. */
553 if ( ( pVmcbCtrl->NestedPagingCtrl.n.u1Sev
554 || pVmcbCtrl->NestedPagingCtrl.n.u1SevEs)
555 && !pVM->cpum.ro.GuestFeatures.fSvmAvic)
556 {
557 Log(("iemSvmVmrun: SEV not supported -> Disabling\n"));
558 pVmcbCtrl->NestedPagingCtrl.n.u1Sev = 0;
559 pVmcbCtrl->NestedPagingCtrl.n.u1SevEs = 0;
560 }
561
562 /* Flush by ASID. */
563 if ( !pVM->cpum.ro.GuestFeatures.fSvmFlusbByAsid
564 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_NOTHING
565 && pVmcbCtrl->TLBCtrl.n.u8TLBFlush != SVM_TLB_FLUSH_ENTIRE)
566 {
567 Log(("iemSvmVmrun: Flush-by-ASID not supported -> #VMEXIT\n"));
568 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
569 }
570
571 /* IO permission bitmap. */
572 RTGCPHYS const GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
573 if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
574 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap)
575 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + X86_PAGE_4K_SIZE)
576 || !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap + (X86_PAGE_4K_SIZE << 1)))
577 {
578 Log(("iemSvmVmrun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
579 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
580 }
581
582 /* MSR permission bitmap. */
583 RTGCPHYS const GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
584 if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
585 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap)
586 || !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap + X86_PAGE_4K_SIZE))
587 {
588 Log(("iemSvmVmrun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
589 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
590 }
591
592 /* CR0. */
593 if ( !(pVmcbNstGst->u64CR0 & X86_CR0_CD)
594 && (pVmcbNstGst->u64CR0 & X86_CR0_NW))
595 {
596 Log(("iemSvmVmrun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
597 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
598 }
599 if (pVmcbNstGst->u64CR0 >> 32)
600 {
601 Log(("iemSvmVmrun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64CR0));
602 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
603 }
604 /** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
605
606 /* DR6 and DR7. */
607 if ( pVmcbNstGst->u64DR6 >> 32
608 || pVmcbNstGst->u64DR7 >> 32)
609 {
610 Log(("iemSvmVmrun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64DR6,
611 pVmcbNstGst->u64DR6));
612 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
613 }
614
615 /*
616 * PAT (Page Attribute Table) MSR.
617 *
618 * The CPU only validates and loads it when nested-paging is enabled.
619 * See AMD spec. "15.25.4 Nested Paging and VMRUN/#VMEXIT".
620 */
621 if ( pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
622 && !CPUMIsPatMsrValid(pVmcbNstGst->u64PAT))
623 {
624 Log(("iemSvmVmrun: PAT invalid. u64PAT=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64PAT));
625 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
626 }
627
628 /*
629 * Copy the IO permission bitmap into the cache.
630 */
631 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
632 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
633 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
634 if (RT_FAILURE(rc))
635 {
636 Log(("iemSvmVmrun: Failed reading the IO permission bitmap at %#RGp. rc=%Rrc\n", GCPhysIOBitmap, rc));
637 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
638 }
639
640 /*
641 * Copy the MSR permission bitmap into the cache.
642 */
643 AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
644 rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
645 sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
646 if (RT_FAILURE(rc))
647 {
648 Log(("iemSvmVmrun: Failed reading the MSR permission bitmap at %#RGp. rc=%Rrc\n", GCPhysMsrBitmap, rc));
649 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
650 }
651
652 /*
653 * Copy segments from nested-guest VMCB state to the guest-CPU state.
654 *
655 * We do this here as we need to use the CS attributes and it's easier this way
656 * then using the VMCB format selectors. It doesn't really matter where we copy
657 * the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
658 */
659 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, ES, es);
660 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, CS, cs);
661 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, SS, ss);
662 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), pVmcbNstGst, DS, ds);
663
664 /** @todo Segment attribute overrides by VMRUN. */
665
666 /*
667 * CPL adjustments and overrides.
668 *
669 * SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
670 * We shall thus adjust both CS.DPL and SS.DPL here.
671 */
672 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = pVmcbNstGst->u8CPL;
673 if (CPUMIsGuestInV86ModeEx(IEM_GET_CTX(pVCpu)))
674 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 3;
675 if (CPUMIsGuestInRealModeEx(IEM_GET_CTX(pVCpu)))
676 pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl = pVCpu->cpum.GstCtx.ss.Attr.n.u2Dpl = 0;
677 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
678
679 /*
680 * Continue validating guest-state and controls.
681 *
682 * We pass CR0 as 0 to CPUMIsGuestEferMsrWriteValid() below to skip the illegal
683 * EFER.LME bit transition check. We pass the nested-guest's EFER as both the
684 * old and new EFER value to not have any guest EFER bits influence the new
685 * nested-guest EFER.
686 */
687 uint64_t uValidEfer;
688 rc = CPUMIsGuestEferMsrWriteValid(pVM, 0 /* CR0 */, pVmcbNstGst->u64EFER, pVmcbNstGst->u64EFER, &uValidEfer);
689 if (RT_FAILURE(rc))
690 {
691 Log(("iemSvmVmrun: EFER invalid uOldEfer=%#RX64 -> #VMEXIT\n", pVmcbNstGst->u64EFER));
692 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
693 }
694
695 /* Validate paging and CPU mode bits. */
696 bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
697 bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
698 bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
699 bool const fPaging = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PG);
700 bool const fPae = RT_BOOL(pVmcbNstGst->u64CR4 & X86_CR4_PAE);
701 bool const fProtMode = RT_BOOL(pVmcbNstGst->u64CR0 & X86_CR0_PE);
702 bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
703 bool const fLongModeConformCS = pVCpu->cpum.GstCtx.cs.Attr.n.u1Long && pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig;
704 /* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
705 if (fLongModeWithPaging)
706 uValidEfer |= MSR_K6_EFER_LMA;
707 bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME | MSR_K6_EFER_LMA));
708 if ( !fSvm
709 || (!fLongModeSupported && fLongModeActiveOrEnabled)
710 || (fLongModeWithPaging && !fPae)
711 || (fLongModeWithPaging && !fProtMode)
712 || ( fLongModeEnabled
713 && fPaging
714 && fPae
715 && fLongModeConformCS))
716 {
717 Log(("iemSvmVmrun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
718 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
719 }
720
721 /*
722 * Preserve the required force-flags.
723 *
724 * We only preserve the force-flags that would affect the execution of the
725 * nested-guest (or the guest).
726 *
727 * - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
728 * execution of a subsequent IRET instruction in the guest.
729 *
730 * The remaining FFs (e.g. timers) can stay in place so that we will be able to
731 * generate interrupts that should cause #VMEXITs for the nested-guest.
732 *
733 * VMRUN has implicit GIF (Global Interrupt Flag) handling, we don't need to
734 * preserve VMCPU_FF_INHIBIT_INTERRUPTS.
735 */
736 pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
737 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
738
739 /*
740 * Pause filter.
741 */
742 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilter)
743 {
744 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = pVmcbCtrl->u16PauseFilterCount;
745 if (pVM->cpum.ro.GuestFeatures.fSvmPauseFilterThreshold)
746 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold = pVmcbCtrl->u16PauseFilterCount;
747 }
748
749 /*
750 * Interrupt shadow.
751 */
752 if (pVmcbCtrl->IntShadow.n.u1IntShadow)
753 {
754 LogFlow(("iemSvmVmrun: setting interrupt shadow. inhibit PC=%#RX64\n", pVmcbNstGst->u64RIP));
755 /** @todo will this cause trouble if the nested-guest is 64-bit but the guest is 32-bit? */
756 EMSetInhibitInterruptsPC(pVCpu, pVmcbNstGst->u64RIP);
757 }
758
759 /*
760 * TLB flush control.
761 * Currently disabled since it's redundant as we unconditionally flush the TLB
762 * in iemSvmWorldSwitch() below.
763 */
764# if 0
765 /** @todo @bugref{7243}: ASID based PGM TLB flushes. */
766 if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
767 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
768 || pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
769 PGMFlushTLB(pVCpu, pVmcbNstGst->u64CR3, true /* fGlobal */);
770# endif
771
772 /*
773 * Validate and map PAE PDPEs if the guest will be using PAE paging.
774 * Invalid PAE PDPEs here causes a #VMEXIT.
775 */
776 if ( !pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging
777 && CPUMIsPaePagingEnabled(pVmcbNstGst->u64CR0, pVmcbNstGst->u64CR4, uValidEfer))
778 {
779 rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcbNstGst->u64CR3);
780 if (RT_SUCCESS(rc))
781 { /* likely */ }
782 else
783 {
784 Log(("iemSvmVmrun: PAE PDPEs invalid -> #VMEXIT\n"));
785 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
786 }
787 }
788
789 /*
790 * Copy the remaining guest state from the VMCB to the guest-CPU context.
791 */
792 pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcbNstGst->GDTR.u32Limit;
793 pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcbNstGst->GDTR.u64Base;
794 pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcbNstGst->IDTR.u32Limit;
795 pVCpu->cpum.GstCtx.idtr.pIdt = pVmcbNstGst->IDTR.u64Base;
796 CPUMSetGuestCR0(pVCpu, pVmcbNstGst->u64CR0);
797 CPUMSetGuestCR4(pVCpu, pVmcbNstGst->u64CR4);
798 pVCpu->cpum.GstCtx.cr3 = pVmcbNstGst->u64CR3;
799 pVCpu->cpum.GstCtx.cr2 = pVmcbNstGst->u64CR2;
800 pVCpu->cpum.GstCtx.dr[6] = pVmcbNstGst->u64DR6;
801 pVCpu->cpum.GstCtx.dr[7] = pVmcbNstGst->u64DR7;
802 pVCpu->cpum.GstCtx.rflags.u64 = pVmcbNstGst->u64RFlags;
803 pVCpu->cpum.GstCtx.rax = pVmcbNstGst->u64RAX;
804 pVCpu->cpum.GstCtx.rsp = pVmcbNstGst->u64RSP;
805 pVCpu->cpum.GstCtx.rip = pVmcbNstGst->u64RIP;
806 CPUMSetGuestEferMsrNoChecks(pVCpu, pVCpu->cpum.GstCtx.msrEFER, uValidEfer);
807 if (pVmcbCtrl->NestedPagingCtrl.n.u1NestedPaging)
808 pVCpu->cpum.GstCtx.msrPAT = pVmcbNstGst->u64PAT;
809
810 /* Mask DR6, DR7 bits mandatory set/clear bits. */
811 pVCpu->cpum.GstCtx.dr[6] &= ~(X86_DR6_RAZ_MASK | X86_DR6_MBZ_MASK);
812 pVCpu->cpum.GstCtx.dr[6] |= X86_DR6_RA1_MASK;
813 pVCpu->cpum.GstCtx.dr[7] &= ~(X86_DR7_RAZ_MASK | X86_DR7_MBZ_MASK);
814 pVCpu->cpum.GstCtx.dr[7] |= X86_DR7_RA1_MASK;
815
816 /*
817 * Check for pending virtual interrupts.
818 */
819 if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
820 VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
821 else
822 Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST));
823
824 /*
825 * Update PGM, IEM and others of a world-switch.
826 */
827 VBOXSTRICTRC rcStrict = iemSvmWorldSwitch(pVCpu);
828 if (rcStrict == VINF_SUCCESS)
829 { /* likely */ }
830 else if (RT_SUCCESS(rcStrict))
831 {
832 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch returned %Rrc, setting passup status\n", VBOXSTRICTRC_VAL(rcStrict)));
833 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
834 }
835 else
836 {
837 LogFlow(("iemSvmVmrun: iemSvmWorldSwitch unexpected failure. rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
838 return rcStrict;
839 }
840
841 /*
842 * Set the global-interrupt flag to allow interrupts in the guest.
843 */
844 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
845
846 /*
847 * Event injection.
848 */
849 PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
850 pVCpu->cpum.GstCtx.hwvirt.svm.fInterceptEvents = !pEventInject->n.u1Valid;
851 if (pEventInject->n.u1Valid)
852 {
853 uint8_t const uVector = pEventInject->n.u8Vector;
854 TRPMEVENT const enmType = HMSvmEventToTrpmEventType(pEventInject, uVector);
855 uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
856
857 /* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
858 if (RT_UNLIKELY(enmType == TRPM_32BIT_HACK))
859 {
860 Log(("iemSvmVmrun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
861 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
862 }
863 if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
864 {
865 if ( uVector == X86_XCPT_NMI
866 || uVector > X86_XCPT_LAST)
867 {
868 Log(("iemSvmVmrun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
869 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
870 }
871 if ( uVector == X86_XCPT_BR
872 && CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
873 {
874 Log(("iemSvmVmrun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
875 return iemSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
876 }
877 /** @todo any others? */
878 }
879
880 /*
881 * Invalidate the exit interrupt-information field here. This field is fully updated
882 * on #VMEXIT as events other than the one below can also cause intercepts during
883 * their injection (e.g. exceptions).
884 */
885 pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
886
887 /*
888 * Clear the event injection valid bit here. While the AMD spec. mentions that the CPU
889 * clears this bit from the VMCB unconditionally on #VMEXIT, internally the CPU could be
890 * clearing it at any time, most likely before/after injecting the event. Since VirtualBox
891 * doesn't have any virtual-CPU internal representation of this bit, we clear/update the
892 * VMCB here. This also has the added benefit that we avoid the risk of injecting the event
893 * twice if we fallback to executing the nested-guest using hardware-assisted SVM after
894 * injecting the event through IEM here.
895 */
896 pVmcbCtrl->EventInject.n.u1Valid = 0;
897
898 /** @todo NRIP: Software interrupts can only be pushed properly if we support
899 * NRIP for the nested-guest to calculate the instruction length
900 * below. */
901 LogFlow(("iemSvmVmrun: Injecting event: %04x:%08RX64 vec=%#x type=%d uErr=%u cr2=%#RX64 cr3=%#RX64 efer=%#RX64\n",
902 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, uVector, enmType, uErrorCode, pVCpu->cpum.GstCtx.cr2,
903 pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.msrEFER));
904
905 /*
906 * We shall not inject the event here right away. There may be paging mode related updates
907 * as a result of the world-switch above that are yet to be honored. Instead flag the event
908 * as pending for injection.
909 */
910 TRPMAssertTrap(pVCpu, uVector, enmType);
911 if (pEventInject->n.u1ErrorCodeValid)
912 TRPMSetErrorCode(pVCpu, uErrorCode);
913 if ( enmType == TRPM_TRAP
914 && uVector == X86_XCPT_PF)
915 TRPMSetFaultAddress(pVCpu, pVCpu->cpum.GstCtx.cr2);
916 }
917 else
918 LogFlow(("iemSvmVmrun: Entering nested-guest: %04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 efer=%#RX64 efl=%#x\n",
919 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr3,
920 pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER, pVCpu->cpum.GstCtx.rflags.u64));
921
922 LogFlow(("iemSvmVmrun: returns %d\n", VBOXSTRICTRC_VAL(rcStrict)));
923
924# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
925 /* If CLGI/STGI isn't intercepted we force IEM-only nested-guest execution here. */
926 if ( HMIsEnabled(pVM)
927 && HMIsSvmVGifActive(pVM))
928 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
929# endif
930
931 return rcStrict;
932 }
933
934 /* Shouldn't really happen as the caller should've validated the physical address already. */
935 Log(("iemSvmVmrun: Failed to read nested-guest VMCB at %#RGp (rc=%Rrc) -> #VMEXIT\n", GCPhysVmcb, rc));
936 return rc;
937}
938
939
940/**
941 * Checks if the event intercepts and performs the \#VMEXIT if the corresponding
942 * intercept is active.
943 *
944 * @returns Strict VBox status code.
945 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
946 * we're not executing a nested-guest.
947 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
948 * successfully.
949 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
950 * failed and a shutdown needs to be initiated for the guest.
951 *
952 * @returns VBox strict status code.
953 * @param pVCpu The cross context virtual CPU structure of the calling thread.
954 * @param u8Vector The interrupt or exception vector.
955 * @param fFlags The exception flags (see IEM_XCPT_FLAGS_XXX).
956 * @param uErr The error-code associated with the exception.
957 * @param uCr2 The CR2 value in case of a \#PF exception.
958 */
959VBOXSTRICTRC iemHandleSvmEventIntercept(PVMCPUCC pVCpu, uint8_t u8Vector, uint32_t fFlags, uint32_t uErr, uint64_t uCr2) RT_NOEXCEPT
960{
961 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
962
963 /*
964 * Handle SVM exception and software interrupt intercepts, see AMD spec. 15.12 "Exception Intercepts".
965 *
966 * - NMI intercepts have their own exit code and do not cause SVM_EXIT_XCPT_2 #VMEXITs.
967 * - External interrupts and software interrupts (INTn instruction) do not check the exception intercepts
968 * even when they use a vector in the range 0 to 31.
969 * - ICEBP should not trigger #DB intercept, but its own intercept.
970 * - For #PF exceptions, its intercept is checked before CR2 is written by the exception.
971 */
972 /* Check NMI intercept */
973 if ( u8Vector == X86_XCPT_NMI
974 && (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
975 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_NMI))
976 {
977 Log2(("iemHandleSvmNstGstEventIntercept: NMI intercept -> #VMEXIT\n"));
978 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_NMI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
979 }
980
981 /* Check ICEBP intercept. */
982 if ( (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
983 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_ICEBP))
984 {
985 Log2(("iemHandleSvmNstGstEventIntercept: ICEBP intercept -> #VMEXIT\n"));
986 IEM_SVM_UPDATE_NRIP(pVCpu);
987 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_ICEBP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
988 }
989
990 /* Check CPU exception intercepts. */
991 if ( (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
992 && IEM_SVM_IS_XCPT_INTERCEPT_SET(pVCpu, u8Vector))
993 {
994 Assert(u8Vector <= X86_XCPT_LAST);
995 uint64_t const uExitInfo1 = fFlags & IEM_XCPT_FLAGS_ERR ? uErr : 0;
996 uint64_t const uExitInfo2 = fFlags & IEM_XCPT_FLAGS_CR2 ? uCr2 : 0;
997 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists
998 && u8Vector == X86_XCPT_PF
999 && !(uErr & X86_TRAP_PF_ID))
1000 {
1001 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl;
1002# ifdef IEM_WITH_CODE_TLB
1003 uint8_t const *pbInstrBuf = pVCpu->iem.s.pbInstrBuf;
1004 uint8_t const cbInstrBuf = pVCpu->iem.s.cbInstrBuf;
1005 pVmcbCtrl->cbInstrFetched = RT_MIN(cbInstrBuf, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1006 if ( pbInstrBuf
1007 && cbInstrBuf > 0)
1008 memcpy(&pVmcbCtrl->abInstr[0], pbInstrBuf, pVmcbCtrl->cbInstrFetched);
1009# else
1010 uint8_t const cbOpcode = pVCpu->iem.s.cbOpcode;
1011 pVmcbCtrl->cbInstrFetched = RT_MIN(cbOpcode, SVM_CTRL_GUEST_INSTR_BYTES_MAX);
1012 if (cbOpcode > 0)
1013 memcpy(&pVmcbCtrl->abInstr[0], &pVCpu->iem.s.abOpcode[0], pVmcbCtrl->cbInstrFetched);
1014# endif
1015 }
1016 if (u8Vector == X86_XCPT_BR)
1017 IEM_SVM_UPDATE_NRIP(pVCpu);
1018 Log2(("iemHandleSvmNstGstEventIntercept: Xcpt intercept u32InterceptXcpt=%#RX32 u8Vector=%#x "
1019 "uExitInfo1=%#RX64 uExitInfo2=%#RX64 -> #VMEXIT\n", pVCpu->cpum.GstCtx.hwvirt.svm.Vmcb.ctrl.u32InterceptXcpt,
1020 u8Vector, uExitInfo1, uExitInfo2));
1021 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XCPT_0 + u8Vector, uExitInfo1, uExitInfo2);
1022 }
1023
1024 /* Check software interrupt (INTn) intercepts. */
1025 if ( (fFlags & ( IEM_XCPT_FLAGS_T_SOFT_INT
1026 | IEM_XCPT_FLAGS_BP_INSTR
1027 | IEM_XCPT_FLAGS_ICEBP_INSTR
1028 | IEM_XCPT_FLAGS_OF_INSTR)) == IEM_XCPT_FLAGS_T_SOFT_INT
1029 && IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INTN))
1030 {
1031 uint64_t const uExitInfo1 = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? u8Vector : 0;
1032 Log2(("iemHandleSvmNstGstEventIntercept: Software INT intercept (u8Vector=%#x) -> #VMEXIT\n", u8Vector));
1033 IEM_SVM_UPDATE_NRIP(pVCpu);
1034 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SWINT, uExitInfo1, 0 /* uExitInfo2 */);
1035 }
1036
1037 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1038}
1039
1040
1041/**
1042 * Checks the SVM IO permission bitmap and performs the \#VMEXIT if the
1043 * corresponding intercept is active.
1044 *
1045 * @returns Strict VBox status code.
1046 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
1047 * we're not executing a nested-guest.
1048 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1049 * successfully.
1050 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1051 * failed and a shutdown needs to be initiated for the guest.
1052 *
1053 * @returns VBox strict status code.
1054 * @param pVCpu The cross context virtual CPU structure of the calling thread.
1055 * @param u16Port The IO port being accessed.
1056 * @param enmIoType The type of IO access.
1057 * @param cbReg The IO operand size in bytes.
1058 * @param cAddrSizeBits The address size bits (for 16, 32 or 64).
1059 * @param iEffSeg The effective segment number.
1060 * @param fRep Whether this is a repeating IO instruction (REP prefix).
1061 * @param fStrIo Whether this is a string IO instruction.
1062 * @param cbInstr The length of the IO instruction in bytes.
1063 */
1064VBOXSTRICTRC iemSvmHandleIOIntercept(PVMCPUCC pVCpu, uint16_t u16Port, SVMIOIOTYPE enmIoType, uint8_t cbReg,
1065 uint8_t cAddrSizeBits, uint8_t iEffSeg, bool fRep, bool fStrIo, uint8_t cbInstr) RT_NOEXCEPT
1066{
1067 Assert(IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT));
1068 Assert(cAddrSizeBits == 16 || cAddrSizeBits == 32 || cAddrSizeBits == 64);
1069 Assert(cbReg == 1 || cbReg == 2 || cbReg == 4 || cbReg == 8);
1070
1071 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u)\n", u16Port, u16Port));
1072
1073 SVMIOIOEXITINFO IoExitInfo;
1074 bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
1075 cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
1076 if (fIntercept)
1077 {
1078 Log3(("iemSvmHandleIOIntercept: u16Port=%#x (%u) -> #VMEXIT\n", u16Port, u16Port));
1079 IEM_SVM_UPDATE_NRIP(pVCpu);
1080 return iemSvmVmexit(pVCpu, SVM_EXIT_IOIO, IoExitInfo.u, pVCpu->cpum.GstCtx.rip + cbInstr);
1081 }
1082
1083 /** @todo remove later (for debugging as VirtualBox always traps all IO
1084 * intercepts). */
1085 AssertMsgFailed(("iemSvmHandleIOIntercept: We expect an IO intercept here!\n"));
1086 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1087}
1088
1089
1090/**
1091 * Checks the SVM MSR permission bitmap and performs the \#VMEXIT if the
1092 * corresponding intercept is active.
1093 *
1094 * @returns Strict VBox status code.
1095 * @retval VINF_HM_INTERCEPT_NOT_ACTIVE if the MSR permission bitmap does not
1096 * specify interception of the accessed MSR @a idMsr.
1097 * @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
1098 * successfully.
1099 * @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
1100 * failed and a shutdown needs to be initiated for the guest.
1101 *
1102 * @param pVCpu The cross context virtual CPU structure.
1103 * @param idMsr The MSR being accessed in the nested-guest.
1104 * @param fWrite Whether this is an MSR write access, @c false implies an
1105 * MSR read.
1106 * @param cbInstr The length of the MSR read/write instruction in bytes.
1107 */
1108VBOXSTRICTRC iemSvmHandleMsrIntercept(PVMCPUCC pVCpu, uint32_t idMsr, bool fWrite) RT_NOEXCEPT
1109{
1110 /*
1111 * Check if any MSRs are being intercepted.
1112 */
1113 Assert(CPUMIsGuestSvmCtrlInterceptSet(pVCpu, IEM_GET_CTX(pVCpu), SVM_CTRL_INTERCEPT_MSR_PROT));
1114 Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1115
1116 uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
1117
1118 /*
1119 * Get the byte and bit offset of the permission bits corresponding to the MSR.
1120 */
1121 uint16_t offMsrpm;
1122 uint8_t uMsrpmBit;
1123 int rc = CPUMGetSvmMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
1124 if (RT_SUCCESS(rc))
1125 {
1126 Assert(uMsrpmBit == 0 || uMsrpmBit == 2 || uMsrpmBit == 4 || uMsrpmBit == 6);
1127 Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
1128 if (fWrite)
1129 ++uMsrpmBit;
1130
1131 /*
1132 * Check if the bit is set, if so, trigger a #VMEXIT.
1133 */
1134 if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
1135 {
1136 IEM_SVM_UPDATE_NRIP(pVCpu);
1137 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1138 }
1139 }
1140 else
1141 {
1142 /*
1143 * This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (nested hypervisor) deal with it.
1144 */
1145 Log(("iemSvmHandleMsrIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool -> #VMEXIT\n", idMsr, fWrite));
1146 return iemSvmVmexit(pVCpu, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1147 }
1148 return VINF_SVM_INTERCEPT_NOT_ACTIVE;
1149}
1150
1151
1152
1153/**
1154 * Implements 'VMRUN'.
1155 */
1156IEM_CIMPL_DEF_0(iemCImpl_vmrun)
1157{
1158# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1159 RT_NOREF2(pVCpu, cbInstr);
1160 return VINF_EM_RAW_EMULATE_INSTR;
1161# else
1162 LogFlow(("iemCImpl_vmrun\n"));
1163 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmrun);
1164
1165 /** @todo Check effective address size using address size prefix. */
1166 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1167 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1168 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1169 {
1170 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1171 return iemRaiseGeneralProtectionFault0(pVCpu);
1172 }
1173
1174 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
1175 {
1176 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
1177 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1178 }
1179
1180 VBOXSTRICTRC rcStrict = iemSvmVmrun(pVCpu, cbInstr, GCPhysVmcb);
1181 if (rcStrict == VERR_SVM_VMEXIT_FAILED)
1182 {
1183 Assert(!CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
1184 rcStrict = VINF_EM_TRIPLE_FAULT;
1185 }
1186 return rcStrict;
1187# endif
1188}
1189
1190
1191/**
1192 * Interface for HM and EM to emulate the VMRUN instruction.
1193 *
1194 * @returns Strict VBox status code.
1195 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1196 * @param cbInstr The instruction length in bytes.
1197 * @thread EMT(pVCpu)
1198 */
1199VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmrun(PVMCPUCC pVCpu, uint8_t cbInstr)
1200{
1201 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1202 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
1203
1204 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1205 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmrun);
1206 Assert(!pVCpu->iem.s.cActiveMappings);
1207 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1208}
1209
1210
1211/**
1212 * Implements 'VMLOAD'.
1213 */
1214IEM_CIMPL_DEF_0(iemCImpl_vmload)
1215{
1216# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1217 RT_NOREF2(pVCpu, cbInstr);
1218 return VINF_EM_RAW_EMULATE_INSTR;
1219# else
1220 LogFlow(("iemCImpl_vmload\n"));
1221 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
1222
1223 /** @todo Check effective address size using address size prefix. */
1224 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1225 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1226 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1227 {
1228 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1229 return iemRaiseGeneralProtectionFault0(pVCpu);
1230 }
1231
1232 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
1233 {
1234 Log(("vmload: Guest intercept -> #VMEXIT\n"));
1235 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1236 }
1237
1238 SVMVMCBSTATESAVE VmcbNstGst;
1239 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1240 sizeof(SVMVMCBSTATESAVE));
1241 if (rcStrict == VINF_SUCCESS)
1242 {
1243 LogFlow(("vmload: Loading VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1244 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1245 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1246 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1247 HMSVM_SEG_REG_COPY_FROM_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1248
1249 pVCpu->cpum.GstCtx.msrKERNELGSBASE = VmcbNstGst.u64KernelGSBase;
1250 pVCpu->cpum.GstCtx.msrSTAR = VmcbNstGst.u64STAR;
1251 pVCpu->cpum.GstCtx.msrLSTAR = VmcbNstGst.u64LSTAR;
1252 pVCpu->cpum.GstCtx.msrCSTAR = VmcbNstGst.u64CSTAR;
1253 pVCpu->cpum.GstCtx.msrSFMASK = VmcbNstGst.u64SFMASK;
1254
1255 pVCpu->cpum.GstCtx.SysEnter.cs = VmcbNstGst.u64SysEnterCS;
1256 pVCpu->cpum.GstCtx.SysEnter.esp = VmcbNstGst.u64SysEnterESP;
1257 pVCpu->cpum.GstCtx.SysEnter.eip = VmcbNstGst.u64SysEnterEIP;
1258
1259 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1260 }
1261 return rcStrict;
1262# endif
1263}
1264
1265
1266/**
1267 * Interface for HM and EM to emulate the VMLOAD instruction.
1268 *
1269 * @returns Strict VBox status code.
1270 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1271 * @param cbInstr The instruction length in bytes.
1272 * @thread EMT(pVCpu)
1273 */
1274VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmload(PVMCPUCC pVCpu, uint8_t cbInstr)
1275{
1276 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1277
1278 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1279 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmload);
1280 Assert(!pVCpu->iem.s.cActiveMappings);
1281 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1282}
1283
1284
1285/**
1286 * Implements 'VMSAVE'.
1287 */
1288IEM_CIMPL_DEF_0(iemCImpl_vmsave)
1289{
1290# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1291 RT_NOREF2(pVCpu, cbInstr);
1292 return VINF_EM_RAW_EMULATE_INSTR;
1293# else
1294 LogFlow(("iemCImpl_vmsave\n"));
1295 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
1296
1297 /** @todo Check effective address size using address size prefix. */
1298 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1299 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
1300 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
1301 {
1302 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
1303 return iemRaiseGeneralProtectionFault0(pVCpu);
1304 }
1305
1306 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
1307 {
1308 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
1309 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1310 }
1311
1312 SVMVMCBSTATESAVE VmcbNstGst;
1313 VBOXSTRICTRC rcStrict = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcbNstGst, GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest),
1314 sizeof(SVMVMCBSTATESAVE));
1315 if (rcStrict == VINF_SUCCESS)
1316 {
1317 LogFlow(("vmsave: Saving VMCB at %#RGp enmEffAddrMode=%d\n", GCPhysVmcb, pVCpu->iem.s.enmEffAddrMode));
1318 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_FS | CPUMCTX_EXTRN_GS | CPUMCTX_EXTRN_TR | CPUMCTX_EXTRN_LDTR
1319 | CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS | CPUMCTX_EXTRN_SYSENTER_MSRS);
1320
1321 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, FS, fs);
1322 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, GS, gs);
1323 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, TR, tr);
1324 HMSVM_SEG_REG_COPY_TO_VMCB(IEM_GET_CTX(pVCpu), &VmcbNstGst, LDTR, ldtr);
1325
1326 VmcbNstGst.u64KernelGSBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
1327 VmcbNstGst.u64STAR = pVCpu->cpum.GstCtx.msrSTAR;
1328 VmcbNstGst.u64LSTAR = pVCpu->cpum.GstCtx.msrLSTAR;
1329 VmcbNstGst.u64CSTAR = pVCpu->cpum.GstCtx.msrCSTAR;
1330 VmcbNstGst.u64SFMASK = pVCpu->cpum.GstCtx.msrSFMASK;
1331
1332 VmcbNstGst.u64SysEnterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1333 VmcbNstGst.u64SysEnterESP = pVCpu->cpum.GstCtx.SysEnter.esp;
1334 VmcbNstGst.u64SysEnterEIP = pVCpu->cpum.GstCtx.SysEnter.eip;
1335
1336 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcb + RT_UOFFSETOF(SVMVMCB, guest), &VmcbNstGst,
1337 sizeof(SVMVMCBSTATESAVE));
1338 if (rcStrict == VINF_SUCCESS)
1339 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1340 }
1341 return rcStrict;
1342# endif
1343}
1344
1345
1346/**
1347 * Interface for HM and EM to emulate the VMSAVE instruction.
1348 *
1349 * @returns Strict VBox status code.
1350 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1351 * @param cbInstr The instruction length in bytes.
1352 * @thread EMT(pVCpu)
1353 */
1354VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmsave(PVMCPUCC pVCpu, uint8_t cbInstr)
1355{
1356 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1357
1358 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1359 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmsave);
1360 Assert(!pVCpu->iem.s.cActiveMappings);
1361 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1362}
1363
1364
1365/**
1366 * Implements 'CLGI'.
1367 */
1368IEM_CIMPL_DEF_0(iemCImpl_clgi)
1369{
1370# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1371 RT_NOREF2(pVCpu, cbInstr);
1372 return VINF_EM_RAW_EMULATE_INSTR;
1373# else
1374 LogFlow(("iemCImpl_clgi\n"));
1375 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
1376 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
1377 {
1378 Log(("clgi: Guest intercept -> #VMEXIT\n"));
1379 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1380 }
1381
1382 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, false);
1383 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1384
1385# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1386 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1387# else
1388 return VINF_SUCCESS;
1389# endif
1390# endif
1391}
1392
1393
1394/**
1395 * Interface for HM and EM to emulate the CLGI instruction.
1396 *
1397 * @returns Strict VBox status code.
1398 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1399 * @param cbInstr The instruction length in bytes.
1400 * @thread EMT(pVCpu)
1401 */
1402VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedClgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1403{
1404 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1405
1406 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1407 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_clgi);
1408 Assert(!pVCpu->iem.s.cActiveMappings);
1409 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1410}
1411
1412
1413/**
1414 * Implements 'STGI'.
1415 */
1416IEM_CIMPL_DEF_0(iemCImpl_stgi)
1417{
1418# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1419 RT_NOREF2(pVCpu, cbInstr);
1420 return VINF_EM_RAW_EMULATE_INSTR;
1421# else
1422 LogFlow(("iemCImpl_stgi\n"));
1423 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
1424 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
1425 {
1426 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
1427 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1428 }
1429
1430 CPUMSetGuestGif(&pVCpu->cpum.GstCtx, true);
1431 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1432
1433# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1434 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
1435# else
1436 return VINF_SUCCESS;
1437# endif
1438# endif
1439}
1440
1441
1442/**
1443 * Interface for HM and EM to emulate the STGI instruction.
1444 *
1445 * @returns Strict VBox status code.
1446 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1447 * @param cbInstr The instruction length in bytes.
1448 * @thread EMT(pVCpu)
1449 */
1450VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedStgi(PVMCPUCC pVCpu, uint8_t cbInstr)
1451{
1452 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1453
1454 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1455 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_stgi);
1456 Assert(!pVCpu->iem.s.cActiveMappings);
1457 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1458}
1459
1460
1461/**
1462 * Implements 'INVLPGA'.
1463 */
1464IEM_CIMPL_DEF_0(iemCImpl_invlpga)
1465{
1466 /** @todo Check effective address size using address size prefix. */
1467 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
1468 /** @todo PGM needs virtual ASID support. */
1469# if 0
1470 uint32_t const uAsid = pVCpu->cpum.GstCtx.ecx;
1471# endif
1472
1473 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1474 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
1475 {
1476 Log2(("invlpga: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
1477 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1478 }
1479
1480 PGMInvalidatePage(pVCpu, GCPtrPage);
1481 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1482 return VINF_SUCCESS;
1483}
1484
1485
1486/**
1487 * Interface for HM and EM to emulate the INVLPGA instruction.
1488 *
1489 * @returns Strict VBox status code.
1490 * @param pVCpu The cross context virtual CPU structure of the calling EMT.
1491 * @param cbInstr The instruction length in bytes.
1492 * @thread EMT(pVCpu)
1493 */
1494VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvlpga(PVMCPUCC pVCpu, uint8_t cbInstr)
1495{
1496 IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
1497
1498 iemInitExec(pVCpu, false /*fBypassHandlers*/);
1499 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_invlpga);
1500 Assert(!pVCpu->iem.s.cActiveMappings);
1501 return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
1502}
1503
1504
1505/**
1506 * Implements 'SKINIT'.
1507 */
1508IEM_CIMPL_DEF_0(iemCImpl_skinit)
1509{
1510 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
1511
1512 uint32_t uIgnore;
1513 uint32_t fFeaturesECX;
1514 CPUMGetGuestCpuId(pVCpu, 0x80000001, 0 /* iSubLeaf */, -1 /*f64BitMode*/, &uIgnore, &uIgnore, &fFeaturesECX, &uIgnore);
1515 if (!(fFeaturesECX & X86_CPUID_AMD_FEATURE_ECX_SKINIT))
1516 return iemRaiseUndefinedOpcode(pVCpu);
1517
1518 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_SKINIT))
1519 {
1520 Log2(("skinit: Guest intercept -> #VMEXIT\n"));
1521 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_SKINIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1522 }
1523
1524 RT_NOREF(cbInstr);
1525 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
1526}
1527
1528
1529/**
1530 * Implements SVM's implementation of PAUSE.
1531 */
1532IEM_CIMPL_DEF_0(iemCImpl_svm_pause)
1533{
1534 bool fCheckIntercept = true;
1535 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilter)
1536 {
1537 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1538
1539 /* TSC based pause-filter thresholding. */
1540 if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmPauseFilterThreshold
1541 && pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold > 0)
1542 {
1543 uint64_t const uTick = TMCpuTickGet(pVCpu);
1544 if (uTick - pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick > pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilterThreshold)
1545 pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter = CPUMGetGuestSvmPauseFilterCount(pVCpu, IEM_GET_CTX(pVCpu));
1546 pVCpu->cpum.GstCtx.hwvirt.svm.uPrevPauseTick = uTick;
1547 }
1548
1549 /* Simple pause-filter counter. */
1550 if (pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter > 0)
1551 {
1552 --pVCpu->cpum.GstCtx.hwvirt.svm.cPauseFilter;
1553 fCheckIntercept = false;
1554 }
1555 }
1556
1557 if (fCheckIntercept)
1558 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_PAUSE, SVM_EXIT_PAUSE, 0, 0);
1559
1560 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1561 return VINF_SUCCESS;
1562}
1563
1564#endif /* VBOX_WITH_NESTED_HWVIRT_SVM */
1565
1566/**
1567 * Common code for iemCImpl_vmmcall and iemCImpl_vmcall (latter in IEMAllCImplVmxInstr.cpp.h).
1568 */
1569IEM_CIMPL_DEF_1(iemCImpl_Hypercall, uint16_t, uDisOpcode)
1570{
1571 if (EMAreHypercallInstructionsEnabled(pVCpu))
1572 {
1573 NOREF(uDisOpcode);
1574 VBOXSTRICTRC rcStrict = GIMHypercallEx(pVCpu, IEM_GET_CTX(pVCpu), uDisOpcode, cbInstr);
1575 if (RT_SUCCESS(rcStrict))
1576 {
1577 if (rcStrict == VINF_SUCCESS)
1578 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1579 if ( rcStrict == VINF_SUCCESS
1580 || rcStrict == VINF_GIM_HYPERCALL_CONTINUING)
1581 return VINF_SUCCESS;
1582 AssertMsgReturn(rcStrict == VINF_GIM_R3_HYPERCALL, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1583 return rcStrict;
1584 }
1585 AssertMsgReturn( rcStrict == VERR_GIM_HYPERCALL_ACCESS_DENIED
1586 || rcStrict == VERR_GIM_HYPERCALLS_NOT_AVAILABLE
1587 || rcStrict == VERR_GIM_NOT_ENABLED
1588 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_READ_FAILED
1589 || rcStrict == VERR_GIM_HYPERCALL_MEMORY_WRITE_FAILED,
1590 ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IEM_IPE_4);
1591
1592 /* Raise #UD on all failures. */
1593 }
1594 return iemRaiseUndefinedOpcode(pVCpu);
1595}
1596
1597
1598/**
1599 * Implements 'VMMCALL'.
1600 */
1601IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
1602{
1603 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
1604 {
1605 Log(("vmmcall: Guest intercept -> #VMEXIT\n"));
1606 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
1607 }
1608
1609 /* This is a little bit more complicated than the VT-x version because HM/SVM may
1610 patch MOV CR8 instructions to speed up APIC.TPR access for 32-bit windows guests. */
1611 PVMCC pVM = pVCpu->CTX_SUFF(pVM);
1612 if (VM_IS_HM_ENABLED(pVM))
1613 {
1614 int rc = HMHCMaybeMovTprSvmHypercall(pVM, pVCpu);
1615 if (RT_SUCCESS(rc))
1616 {
1617 Log(("vmmcall: MovTpr\n"));
1618 return VINF_SUCCESS;
1619 }
1620 }
1621
1622 /* Join forces with vmcall. */
1623 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMMCALL);
1624}
1625
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use