HMSVMAll.cpp@ 66371

最後變更在這個檔案從66371是 66371,由 vboxsync 提交於 8 年前
VMM: Nested Hw.virt: MSR and IO intercept helpers for SVM.
屬性 svn:eol-style 設為 `native` 屬性 svn:keywords 設為 `Author Date Id Revision`
檔案大小: 47.9 KB

行
1	/* $Id: HMSVMAll.cpp 66371 2017-03-30 17:49:00Z vboxsync $ */
2	/** @file
3	* HM SVM (AMD-V) - All contexts.
4	*/
5
6	/*
7	* Copyright (C) 2017 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.alldomusa.eu.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Header Files *
21	*********************************************************************************************************************************/
22	#define LOG_GROUP LOG_GROUP_HM
23	#define VMCPU_INCL_CPUM_GST_CTX
24	#include "HMInternal.h"
25	#include <VBox/vmm/apic.h>
26	#include <VBox/vmm/gim.h>
27	#include <VBox/vmm/hm.h>
28	#include <VBox/vmm/iem.h>
29	#include <VBox/vmm/vm.h>
30	#include <VBox/vmm/hm_svm.h>
31
32
33	#ifndef IN_RC
34	/**
35	* Emulates a simple MOV TPR (CR8) instruction, used for TPR patching on 32-bit
36	* guests. This simply looks up the patch record at EIP and does the required.
37	*
38	* This VMMCALL is used a fallback mechanism when mov to/from cr8 isn't exactly
39	* like how we want it to be (e.g. not followed by shr 4 as is usually done for
40	* TPR). See hmR3ReplaceTprInstr() for the details.
41	*
42	* @returns VBox status code.
43	* @retval VINF_SUCCESS if the access was handled successfully.
44	* @retval VERR_NOT_FOUND if no patch record for this RIP could be found.
45	* @retval VERR_SVM_UNEXPECTED_PATCH_TYPE if the found patch type is invalid.
46	*
47	* @param pVCpu The cross context virtual CPU structure.
48	* @param pCtx Pointer to the guest-CPU context.
49	* @param pfUpdateRipAndRF Whether the guest RIP/EIP has been updated as
50	* part of the TPR patch operation.
51	*/
52	static int hmSvmEmulateMovTpr(PVMCPU pVCpu, PCPUMCTX pCtx, bool *pfUpdateRipAndRF)
53	{
54	Log4(("Emulated VMMCall TPR access replacement at RIP=%RGv\n", pCtx->rip));
55
56	/*
57	* We do this in a loop as we increment the RIP after a successful emulation
58	* and the new RIP may be a patched instruction which needs emulation as well.
59	*/
60	bool fUpdateRipAndRF = false;
61	bool fPatchFound = false;
62	PVM pVM = pVCpu->CTX_SUFF(pVM);
63	for (;;)
64	{
65	bool fPending;
66	uint8_t u8Tpr;
67
68	PHMTPRPATCH pPatch = (PHMTPRPATCH)RTAvloU32Get(&pVM->hm.s.PatchTree, (AVLOU32KEY)pCtx->eip);
69	if (!pPatch)
70	break;
71
72	fPatchFound = true;
73	switch (pPatch->enmType)
74	{
75	case HMTPRINSTR_READ:
76	{
77	int rc = APICGetTpr(pVCpu, &u8Tpr, &fPending, NULL /* pu8PendingIrq */);
78	AssertRC(rc);
79
80	rc = DISWriteReg32(CPUMCTX2CORE(pCtx), pPatch->uDstOperand, u8Tpr);
81	AssertRC(rc);
82	pCtx->rip += pPatch->cbOp;
83	pCtx->eflags.Bits.u1RF = 0;
84	fUpdateRipAndRF = true;
85	break;
86	}
87
88	case HMTPRINSTR_WRITE_REG:
89	case HMTPRINSTR_WRITE_IMM:
90	{
91	if (pPatch->enmType == HMTPRINSTR_WRITE_REG)
92	{
93	uint32_t u32Val;
94	int rc = DISFetchReg32(CPUMCTX2CORE(pCtx), pPatch->uSrcOperand, &u32Val);
95	AssertRC(rc);
96	u8Tpr = u32Val;
97	}
98	else
99	u8Tpr = (uint8_t)pPatch->uSrcOperand;
100
101	int rc2 = APICSetTpr(pVCpu, u8Tpr);
102	AssertRC(rc2);
103	HMCPU_CF_SET(pVCpu, HM_CHANGED_SVM_GUEST_APIC_STATE);
104
105	pCtx->rip += pPatch->cbOp;
106	pCtx->eflags.Bits.u1RF = 0;
107	fUpdateRipAndRF = true;
108	break;
109	}
110
111	default:
112	{
113	AssertMsgFailed(("Unexpected patch type %d\n", pPatch->enmType));
114	pVCpu->hm.s.u32HMError = pPatch->enmType;
115	*pfUpdateRipAndRF = fUpdateRipAndRF;
116	return VERR_SVM_UNEXPECTED_PATCH_TYPE;
117	}
118	}
119	}
120
121	*pfUpdateRipAndRF = fUpdateRipAndRF;
122	if (fPatchFound)
123	return VINF_SUCCESS;
124	return VERR_NOT_FOUND;
125	}
126	#endif /* !IN_RC */
127
128
129	/**
130	* Performs the operations necessary that are part of the vmmcall instruction
131	* execution in the guest.
132	*
133	* @returns Strict VBox status code (i.e. informational status codes too).
134	* @retval VINF_SUCCESS on successful handling, no \#UD needs to be thrown,
135	* update RIP and eflags.RF depending on @a pfUpdatedRipAndRF and
136	* continue guest execution.
137	* @retval VINF_GIM_HYPERCALL_CONTINUING continue hypercall without updating
138	* RIP.
139	* @retval VINF_GIM_R3_HYPERCALL re-start the hypercall from ring-3.
140	*
141	* @param pVCpu The cross context virtual CPU structure.
142	* @param pCtx Pointer to the guest-CPU context.
143	* @param pfUpdatedRipAndRF Whether the guest RIP/EIP has been updated as
144	* part of handling the VMMCALL operation.
145	*/
146	VMM_INT_DECL(VBOXSTRICTRC) HMSvmVmmcall(PVMCPU pVCpu, PCPUMCTX pCtx, bool *pfUpdatedRipAndRF)
147	{
148	#ifndef IN_RC
149	/*
150	* TPR patched instruction emulation for 32-bit guests.
151	*/
152	PVM pVM = pVCpu->CTX_SUFF(pVM);
153	if (pVM->hm.s.fTprPatchingAllowed)
154	{
155	int rc = hmSvmEmulateMovTpr(pVCpu, pCtx, pfUpdatedRipAndRF);
156	if (RT_SUCCESS(rc))
157	return VINF_SUCCESS;
158
159	if (rc != VERR_NOT_FOUND)
160	{
161	Log(("hmSvmExitVmmCall: hmSvmEmulateMovTpr returns %Rrc\n", rc));
162	return rc;
163	}
164	}
165	#endif
166
167	/*
168	* Paravirtualized hypercalls.
169	*/
170	*pfUpdatedRipAndRF = false;
171	if (pVCpu->hm.s.fHypercallsEnabled)
172	return GIMHypercall(pVCpu, pCtx);
173
174	return VERR_NOT_AVAILABLE;
175	}
176
177
178	#ifndef IN_RC
179	/**
180	* Performs the operations necessary that are part of the vmrun instruction
181	* execution in the guest.
182	*
183	* @returns Strict VBox status code (i.e. informational status codes too).
184	* @retval VINF_SUCCESS successully executed VMRUN and entered nested-guest
185	* code execution.
186	* @retval VINF_SVM_VMEXIT when executing VMRUN causes a \#VMEXIT
187	* (SVM_EXIT_INVALID most likely).
188	*
189	* @param pVCpu The cross context virtual CPU structure.
190	* @param pCtx Pointer to the guest-CPU context.
191	* @param GCPhysVmcb Guest physical address of the VMCB to run.
192	*/
193	/** @todo move this to IEM and make the VMRUN version that can execute under
194	* hardware SVM here instead. */
195	VMM_INT_DECL(VBOXSTRICTRC) HMSvmVmrun(PVMCPU pVCpu, PCPUMCTX pCtx, RTGCPHYS GCPhysVmcb)
196	{
197	Assert(pVCpu);
198	Assert(pCtx);
199	PVM pVM = pVCpu->CTX_SUFF(pVM);
200
201	/*
202	* Cache the physical address of the VMCB for #VMEXIT exceptions.
203	*/
204	pCtx->hwvirt.svm.GCPhysVmcb = GCPhysVmcb;
205
206	/*
207	* Save host state.
208	*/
209	SVMVMCBSTATESAVE VmcbNstGst;
210	int rc = PGMPhysSimpleReadGCPhys(pVM, &VmcbNstGst, GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest), sizeof(SVMVMCBSTATESAVE));
211	if (RT_SUCCESS(rc))
212	{
213	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
214	pHostState->es = pCtx->es;
215	pHostState->cs = pCtx->cs;
216	pHostState->ss = pCtx->ss;
217	pHostState->ds = pCtx->ds;
218	pHostState->gdtr = pCtx->gdtr;
219	pHostState->idtr = pCtx->idtr;
220	pHostState->uEferMsr = pCtx->msrEFER;
221	pHostState->uCr0 = pCtx->cr0;
222	pHostState->uCr3 = pCtx->cr3;
223	pHostState->uCr4 = pCtx->cr4;
224	pHostState->rflags = pCtx->rflags;
225	pHostState->uRip = pCtx->rip;
226	pHostState->uRsp = pCtx->rsp;
227	pHostState->uRax = pCtx->rax;
228
229	/*
230	* Load the VMCB controls.
231	*/
232	rc = PGMPhysSimpleReadGCPhys(pVM, &pCtx->hwvirt.svm.VmcbCtrl, GCPhysVmcb, sizeof(pCtx->hwvirt.svm.VmcbCtrl));
233	if (RT_SUCCESS(rc))
234	{
235	PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.VmcbCtrl;
236
237	/*
238	* Validate guest-state and controls.
239	*/
240	/* VMRUN must always be intercepted. */
241	if (!CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_VMRUN))
242	{
243	Log(("HMSvmVmRun: VMRUN instruction not intercepted -> #VMEXIT\n"));
244	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
245	}
246
247	/* Nested paging. */
248	if ( pVmcbCtrl->NestedPaging.n.u1NestedPaging
249	&& !pVM->cpum.ro.GuestFeatures.svm.feat.n.fNestedPaging)
250	{
251	Log(("HMSvmVmRun: Nested paging not supported -> #VMEXIT\n"));
252	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
253	}
254
255	/* AVIC. */
256	if ( pVmcbCtrl->IntCtrl.n.u1AvicEnable
257	&& !pVM->cpum.ro.GuestFeatures.svm.feat.n.fAvic)
258	{
259	Log(("HMSvmVmRun: AVIC not supported -> #VMEXIT\n"));
260	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
261	}
262
263	/* Last branch record (LBR) virtualization. */
264	if ( (pVmcbCtrl->u64LBRVirt & SVM_LBR_VIRT_ENABLE)
265	&& !pVM->cpum.ro.GuestFeatures.svm.feat.n.fLbrVirt)
266	{
267	Log(("HMSvmVmRun: LBR virtualization not supported -> #VMEXIT\n"));
268	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
269	}
270
271	/* Guest ASID. */
272	if (!pVmcbCtrl->TLBCtrl.n.u32ASID)
273	{
274	Log(("HMSvmVmRun: Guest ASID is invalid -> #VMEXIT\n"));
275	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
276	}
277
278	/* IO permission bitmap. */
279	RTGCPHYS GCPhysIOBitmap = pVmcbCtrl->u64IOPMPhysAddr;
280	if ( (GCPhysIOBitmap & X86_PAGE_4K_OFFSET_MASK)
281	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysIOBitmap))
282	{
283	Log(("HMSvmVmRun: IO bitmap physaddr invalid. GCPhysIOBitmap=%#RX64 -> #VMEXIT\n", GCPhysIOBitmap));
284	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
285	}
286
287	/* MSR permission bitmap. */
288	RTGCPHYS GCPhysMsrBitmap = pVmcbCtrl->u64MSRPMPhysAddr;
289	if ( (GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
290	\|\| !PGMPhysIsGCPhysNormal(pVM, GCPhysMsrBitmap))
291	{
292	Log(("HMSvmVmRun: MSR bitmap physaddr invalid. GCPhysMsrBitmap=%#RX64 -> #VMEXIT\n", GCPhysMsrBitmap));
293	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
294	}
295
296	/* CR0. */
297	if ( !(VmcbNstGst.u64CR0 & X86_CR0_CD)
298	&& (VmcbNstGst.u64CR0 & X86_CR0_NW))
299	{
300	Log(("HMSvmVmRun: CR0 no-write through with cache disabled. CR0=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64CR0));
301	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
302	}
303	if (VmcbNstGst.u64CR0 >> 32)
304	{
305	Log(("HMSvmVmRun: CR0 reserved bits set. CR0=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64CR0));
306	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
307	}
308	/** @todo Implement all reserved bits/illegal combinations for CR3, CR4. */
309
310	/* DR6 and DR7. */
311	if ( VmcbNstGst.u64DR6 >> 32
312	\|\| VmcbNstGst.u64DR7 >> 32)
313	{
314	Log(("HMSvmVmRun: DR6 and/or DR7 reserved bits set. DR6=%#RX64 DR7=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64DR6,
315	VmcbNstGst.u64DR6));
316	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
317	}
318
319	/** @todo gPAT MSR validation? */
320
321	/*
322	* Copy segments from nested-guest VMCB state to the guest-CPU state.
323	*
324	* We do this here as we need to use the CS attributes and it's easier this way
325	* then using the VMCB format selectors. It doesn't really matter where we copy
326	* the state, we restore the guest-CPU context state on the \#VMEXIT anyway.
327	*/
328	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, ES, es);
329	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, CS, cs);
330	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, SS, ss);
331	HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &VmcbNstGst, DS, ds);
332
333	/** @todo Segment attribute overrides by VMRUN. */
334
335	/*
336	* CPL adjustments and overrides.
337	*
338	* SS.DPL is apparently the CPU's CPL, see comment in CPUMGetGuestCPL().
339	* We shall thus adjust both CS.DPL and SS.DPL here.
340	*/
341	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = VmcbNstGst.u8CPL;
342	if (CPUMIsGuestInV86ModeEx(pCtx))
343	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 3;
344	if (CPUMIsGuestInRealModeEx(pCtx))
345	pCtx->cs.Attr.n.u2Dpl = pCtx->ss.Attr.n.u2Dpl = 0;
346
347	/*
348	* Continue validating guest-state and controls.
349	*/
350	/* EFER, CR0 and CR4. */
351	uint64_t uValidEfer;
352	rc = CPUMGetValidateEfer(pVM, VmcbNstGst.u64CR0, 0 /* uOldEfer */, VmcbNstGst.u64EFER, &uValidEfer);
353	if (RT_FAILURE(rc))
354	{
355	Log(("HMSvmVmRun: EFER invalid uOldEfer=%#RX64 uValidEfer=%#RX64 -> #VMEXIT\n", VmcbNstGst.u64EFER, uValidEfer));
356	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
357	}
358	bool const fSvm = RT_BOOL(uValidEfer & MSR_K6_EFER_SVME);
359	bool const fLongModeSupported = RT_BOOL(pVM->cpum.ro.GuestFeatures.fLongMode);
360	bool const fLongModeEnabled = RT_BOOL(uValidEfer & MSR_K6_EFER_LME);
361	bool const fPaging = RT_BOOL(VmcbNstGst.u64CR0 & X86_CR0_PG);
362	bool const fPae = RT_BOOL(VmcbNstGst.u64CR4 & X86_CR4_PAE);
363	bool const fProtMode = RT_BOOL(VmcbNstGst.u64CR0 & X86_CR0_PE);
364	bool const fLongModeWithPaging = fLongModeEnabled && fPaging;
365	bool const fLongModeConformCS = pCtx->cs.Attr.n.u1Long && pCtx->cs.Attr.n.u1DefBig;
366	/* Adjust EFER.LMA (this is normally done by the CPU when system software writes CR0). */
367	if (fLongModeWithPaging)
368	uValidEfer \|= MSR_K6_EFER_LMA;
369	bool const fLongModeActiveOrEnabled = RT_BOOL(uValidEfer & (MSR_K6_EFER_LME \| MSR_K6_EFER_LMA));
370	if ( !fSvm
371	\|\| (!fLongModeSupported && fLongModeActiveOrEnabled)
372	\|\| (fLongModeWithPaging && !fPae)
373	\|\| (fLongModeWithPaging && !fProtMode)
374	\|\| ( fLongModeEnabled
375	&& fPaging
376	&& fPae
377	&& fLongModeConformCS))
378	{
379	Log(("HMSvmVmRun: EFER invalid. uValidEfer=%#RX64 -> #VMEXIT\n", uValidEfer));
380	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
381	}
382
383	/*
384	* Preserve the required force-flags.
385	*
386	* We only preserve the force-flags that would affect the execution of the
387	* nested-guest (or the guest).
388	*
389	* - VMCPU_FF_INHIBIT_INTERRUPTS need not be preserved as it's for a single
390	* instruction which is this VMRUN instruction itself.
391	*
392	* - VMCPU_FF_BLOCK_NMIS needs to be preserved as it blocks NMI until the
393	* execution of a subsequent IRET instruction in the guest.
394	*
395	* - The remaining FFs (e.g. timers) can stay in place so that we will be
396	* able to generate interrupts that should cause #VMEXITs for the
397	* nested-guest.
398	*/
399	/** @todo anything missed more here? */
400	pCtx->hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
401
402	/*
403	* Interrupt shadow.
404	*/
405	if (pVmcbCtrl->u64IntShadow & SVM_INTERRUPT_SHADOW_ACTIVE)
406	EMSetInhibitInterruptsPC(pVCpu, VmcbNstGst.u64RIP);
407
408	/*
409	* TLB flush control.
410	*/
411	/** @todo @bugref{7243}: ASID based PGM TLB flushes. */
412	if ( pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_ENTIRE
413	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT
414	\|\| pVmcbCtrl->TLBCtrl.n.u8TLBFlush == SVM_TLB_FLUSH_SINGLE_CONTEXT_RETAIN_GLOBALS)
415	PGMFlushTLB(pVCpu, VmcbNstGst.u64CR3, true /* fGlobal */);
416
417	/** @todo @bugref{7243}: SVM TSC offset, see tmCpuTickGetInternal. */
418
419	/*
420	* Copy the remaining guest state from the VMCB to the guest-CPU context.
421	*/
422	pCtx->gdtr.cbGdt = VmcbNstGst.GDTR.u32Limit;
423	pCtx->gdtr.pGdt = VmcbNstGst.GDTR.u64Base;
424	pCtx->idtr.cbIdt = VmcbNstGst.IDTR.u32Limit;
425	pCtx->idtr.pIdt = VmcbNstGst.IDTR.u64Base;
426	pCtx->cr0 = VmcbNstGst.u64CR0; /** @todo What about informing PGM about CR0.WP? */
427	pCtx->cr4 = VmcbNstGst.u64CR4;
428	pCtx->cr3 = VmcbNstGst.u64CR3;
429	pCtx->cr2 = VmcbNstGst.u64CR2;
430	pCtx->dr[6] = VmcbNstGst.u64DR6;
431	pCtx->dr[7] = VmcbNstGst.u64DR7;
432	pCtx->rflags.u = VmcbNstGst.u64RFlags;
433	pCtx->rax = VmcbNstGst.u64RAX;
434	pCtx->rsp = VmcbNstGst.u64RSP;
435	pCtx->rip = VmcbNstGst.u64RIP;
436	pCtx->msrEFER = uValidEfer;
437
438	/* Mask DR6, DR7 bits mandatory set/clear bits. */
439	pCtx->dr[6] &= ~(X86_DR6_RAZ_MASK \| X86_DR6_MBZ_MASK);
440	pCtx->dr[6] \|= X86_DR6_RA1_MASK;
441	pCtx->dr[7] &= ~(X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
442	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
443
444	/*
445	* Check for pending virtual interrupts.
446	*/
447	if (pVmcbCtrl->IntCtrl.n.u1VIrqPending)
448	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
449
450	/*
451	* Clear global interrupt flags to allow interrupts in the guest.
452	*/
453	pCtx->hwvirt.svm.fGif = 1;
454
455	/*
456	* Event injection.
457	*/
458	PCSVMEVENT pEventInject = &pVmcbCtrl->EventInject;
459	if (pEventInject->n.u1Valid)
460	{
461	uint8_t const uVector = pEventInject->n.u8Vector;
462	TRPMEVENT const enmType = hmSvmEventToTrpmEventType(pEventInject);
463	uint16_t const uErrorCode = pEventInject->n.u1ErrorCodeValid ? pEventInject->n.u32ErrorCode : 0;
464
465	/* Validate vectors for hardware exceptions, see AMD spec. 15.20 "Event Injection". */
466	if (enmType == TRPM_32BIT_HACK)
467	{
468	Log(("HMSvmVmRun: Invalid event type =%#x -> #VMEXIT\n", (uint8_t)pEventInject->n.u3Type));
469	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
470	}
471	if (pEventInject->n.u3Type == SVM_EVENT_EXCEPTION)
472	{
473	if ( uVector == X86_XCPT_NMI
474	\|\| uVector > 31 /* X86_XCPT_MAX */)
475	{
476	Log(("HMSvmVmRun: Invalid vector for hardware exception. uVector=%#x -> #VMEXIT\n", uVector));
477	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
478	}
479	if ( uVector == X86_XCPT_BR
480	&& CPUMIsGuestInLongModeEx(pCtx))
481	{
482	Log(("HMSvmVmRun: Cannot inject #BR when not in long mode -> #VMEXIT\n"));
483	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVALID, 0 /* uExitInfo1 /, 0 / uExitInfo2 */);
484	}
485	/** @todo any others? */
486	}
487
488	/*
489	* Update the exit interruption info field so that if an exception occurs
490	* while delivering the event causing a #VMEXIT, we only need to update
491	* the valid bit while the rest is already in place.
492	*/
493	pVmcbCtrl->ExitIntInfo.u = pVmcbCtrl->EventInject.u;
494	pVmcbCtrl->ExitIntInfo.n.u1Valid = 0;
495
496	/** @todo NRIP: Software interrupts can only be pushed properly if we support
497	* NRIP for the nested-guest to calculate the instruction length
498	* below. */
499	VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, uVector, enmType, uErrorCode, pCtx->cr2, 0 /* cbInstr */);
500	if ( rcStrict == VINF_SVM_VMEXIT
501	\|\| rcStrict == VERR_SVM_VMEXIT_FAILED)
502	return rcStrict;
503	}
504
505	return VINF_SUCCESS;
506	}
507
508	/* Shouldn't really happen as the caller should've validated the physical address already. */
509	Log(("HMSvmVmRun: Failed to read nested-guest VMCB control area at %#RGp -> #VMEXIT\n",
510	GCPhysVmcb));
511	return VERR_SVM_IPE_4;
512	}
513
514	/* Shouldn't really happen as the caller should've validated the physical address already. */
515	Log(("HMSvmVmRun: Failed to read nested-guest VMCB save-state area at %#RGp -> #VMEXIT\n",
516	GCPhysVmcb + RT_OFFSETOF(SVMVMCB, guest)));
517	return VERR_SVM_IPE_5;
518	}
519
520
521	/**
522	* SVM nested-guest \#VMEXIT handler.
523	*
524	* @returns Strict VBox status code.
525	* @retval VINF_SVM_VMEXIT when the \#VMEXIT is successful.
526	* @retval VERR_SVM_VMEXIT_FAILED when the \#VMEXIT failed restoring the guest's
527	* "host state" and a shutdown is required.
528	*
529	* @param pVCpu The cross context virtual CPU structure.
530	* @param pCtx The guest-CPU context.
531	* @param uExitCode The exit code.
532	* @param uExitInfo1 The exit info. 1 field.
533	* @param uExitInfo2 The exit info. 2 field.
534	*/
535	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstVmExit(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
536	uint64_t uExitInfo2)
537	{
538	if ( CPUMIsGuestInNestedHwVirtMode(pCtx)
539	\|\| uExitCode == SVM_EXIT_INVALID)
540	{
541	RT_NOREF(pVCpu);
542
543	pCtx->hwvirt.svm.fGif = 0;
544	#ifdef VBOX_STRICT
545	RT_ZERO(pCtx->hwvirt.svm.VmcbCtrl);
546	RT_ZERO(pCtx->hwvirt.svm.HostState);
547	pCtx->hwvirt.svm.GCPhysVmcb = NIL_RTGCPHYS;
548	#endif
549
550	/*
551	* Save the nested-guest state into the VMCB state-save area.
552	*/
553	SVMVMCBSTATESAVE VmcbNstGst;
554	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, ES, es);
555	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, CS, cs);
556	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, SS, ss);
557	HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &VmcbNstGst, DS, ds);
558	VmcbNstGst.GDTR.u32Limit = pCtx->gdtr.cbGdt;
559	VmcbNstGst.GDTR.u64Base = pCtx->gdtr.pGdt;
560	VmcbNstGst.IDTR.u32Limit = pCtx->idtr.cbIdt;
561	VmcbNstGst.IDTR.u32Limit = pCtx->idtr.pIdt;
562	VmcbNstGst.u64EFER = pCtx->msrEFER;
563	VmcbNstGst.u64CR4 = pCtx->cr4;
564	VmcbNstGst.u64CR3 = pCtx->cr3;
565	VmcbNstGst.u64CR2 = pCtx->cr2;
566	VmcbNstGst.u64CR0 = pCtx->cr0;
567	/** @todo Nested paging. */
568	VmcbNstGst.u64RFlags = pCtx->rflags.u64;
569	VmcbNstGst.u64RIP = pCtx->rip;
570	VmcbNstGst.u64RSP = pCtx->rsp;
571	VmcbNstGst.u64RAX = pCtx->rax;
572	VmcbNstGst.u64DR7 = pCtx->dr[6];
573	VmcbNstGst.u64DR6 = pCtx->dr[7];
574	VmcbNstGst.u8CPL = pCtx->ss.Attr.n.u2Dpl; /* See comment in CPUMGetGuestCPL(). */
575
576	/* Save interrupt shadow of the nested-guest instruction if any. */
577	if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
578	&& EMGetInhibitInterruptsPC(pVCpu) == pCtx->rip)
579	{
580	RT_ZERO(pCtx->hwvirt.svm.VmcbCtrl);
581	pCtx->hwvirt.svm.VmcbCtrl.u64IntShadow \|= SVM_INTERRUPT_SHADOW_ACTIVE;
582	}
583
584	/*
585	* Save additional state and intercept information.
586	*/
587	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
588	{
589	Assert(pCtx->hwvirt.svm.VmcbCtrl.IntCtrl.n.u1VIrqPending);
590	Assert(pCtx->hwvirt.svm.VmcbCtrl.IntCtrl.n.u8VIntrVector);
591	}
592	/** @todo Save V_TPR, V_IRQ. */
593	/** @todo NRIP. */
594
595	/* Save exit information. */
596	pCtx->hwvirt.svm.VmcbCtrl.u64ExitCode = uExitCode;
597	pCtx->hwvirt.svm.VmcbCtrl.u64ExitInfo1 = uExitInfo1;
598	pCtx->hwvirt.svm.VmcbCtrl.u64ExitInfo2 = uExitInfo2;
599
600	/*
601	* Clear event injection in the VMCB.
602	*/
603	pCtx->hwvirt.svm.VmcbCtrl.EventInject.n.u1Valid = 0;
604
605	/*
606	* Write back the VMCB controls to the guest VMCB in guest physical memory.
607	*/
608	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), pCtx->hwvirt.svm.GCPhysVmcb, &pCtx->hwvirt.svm.VmcbCtrl,
609	sizeof(pCtx->hwvirt.svm.VmcbCtrl));
610	if (RT_SUCCESS(rc))
611	{
612	/*
613	* Prepare for guest's "host mode" by clearing internal processor state bits.
614	*
615	* Some of these like TSC offset can then be used unconditionally in our TM code
616	* but the offset in the guest's VMCB will remain as it should as we've written
617	* back the VMCB controls above.
618	*/
619	RT_ZERO(pCtx->hwvirt.svm.VmcbCtrl);
620	#if 0
621	/* Clear TSC offset. */
622	pCtx->hwvirt.svm.VmcbCtrl.u64TSCOffset = 0;
623	pCtx->hwvirt.svm.VmcbCtrl.IntCtrl.n.u1VIrqValid = 0;
624	pCtx->hwvirt.svm.VmcbCtrl.IntCtrl.n.u1VIntrMasking = 0;
625	#endif
626	/* Restore guest's force-flags. */
627	if (pCtx->hwvirt.fLocalForcedActions)
628	VMCPU_FF_SET(pVCpu, pCtx->hwvirt.fLocalForcedActions);
629
630	/* Clear nested-guest's interrupt pending. */
631	if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
632	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
633
634	/** @todo Nested paging. */
635	/** @todo ASID. */
636
637	/*
638	* Reload the guest's "host state".
639	*/
640	PSVMHOSTSTATE pHostState = &pCtx->hwvirt.svm.HostState;
641	pCtx->es = pHostState->es;
642	pCtx->cs = pHostState->cs;
643	pCtx->ss = pHostState->ss;
644	pCtx->ds = pHostState->ds;
645	pCtx->gdtr = pHostState->gdtr;
646	pCtx->idtr = pHostState->idtr;
647	pCtx->msrEFER = pHostState->uEferMsr;
648	pCtx->cr0 = pHostState->uCr0 \| X86_CR0_PE;
649	pCtx->cr3 = pHostState->uCr3;
650	pCtx->cr4 = pHostState->uCr4;
651	pCtx->rflags = pHostState->rflags;
652	pCtx->rflags.Bits.u1VM = 0;
653	pCtx->rip = pHostState->uRip;
654	pCtx->rsp = pHostState->uRsp;
655	pCtx->rax = pHostState->uRax;
656	pCtx->dr[7] &= ~(X86_DR7_ENABLED_MASK \| X86_DR7_RAZ_MASK \| X86_DR7_MBZ_MASK);
657	pCtx->dr[7] \|= X86_DR7_RA1_MASK;
658
659	/** @todo if RIP is not canonical or outside the CS segment limit, we need to
660	* raise \#GP(0) in the guest. */
661
662	/** @todo check the loaded host-state for consistency. Figure out what
663	* exactly this involves? */
664
665	rc = VINF_SVM_VMEXIT;
666	}
667	else
668	{
669	Log(("HMNstGstSvmVmExit: Writing VMCB at %#RGp failed\n", pCtx->hwvirt.svm.GCPhysVmcb));
670	Assert(!CPUMIsGuestInNestedHwVirtMode(pCtx));
671	rc = VERR_SVM_VMEXIT_FAILED;
672	}
673
674	return rc;
675	}
676
677	Log(("HMNstGstSvmVmExit: Not in SVM guest mode! uExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uExitCode,
678	uExitInfo1, uExitInfo2));
679	RT_NOREF2(uExitInfo1, uExitInfo2);
680	return VERR_SVM_IPE_5;
681	}
682
683
684	/**
685	* Checks whether an interrupt is pending for the nested-guest.
686	*
687	* @returns VBox status code.
688	* @retval true if there's a pending interrupt, false otherwise.
689	*
690	* @param pCtx The guest-CPU context.
691	*/
692	VMM_INT_DECL(bool) HMSvmNstGstIsInterruptPending(PCCPUMCTX pCtx)
693	{
694	PCSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.VmcbCtrl;
695	if (!CPUMIsGuestInNestedHwVirtMode(pCtx))
696	return false;
697
698	X86RFLAGS RFlags;
699	if (pVmcbCtrl->IntCtrl.n.u1VIntrMasking)
700	RFlags.u = pCtx->rflags.u;
701	else
702	RFlags.u = pCtx->hwvirt.svm.HostState.rflags.u;
703
704	if (!RFlags.Bits.u1IF)
705	return false;
706
707	return RT_BOOL(pVmcbCtrl->IntCtrl.n.u1VIrqPending);
708	}
709
710
711	/**
712	* Gets the pending nested-guest interrupt.
713	*
714	* @returns VBox status code.
715	* @retval VINF_SUCCESS on success.
716	* @retval VERR_APIC_INTR_MASKED_BY_TPR when an APIC interrupt is pending but
717	* can't be delivered due to TPR priority.
718	* @retval VERR_NO_DATA if there is no interrupt to be delivered (either APIC
719	* has been software-disabled since it flagged something was pending,
720	* or other reasons).
721	*
722	* @param pCtx The guest-CPU context.
723	* @param pu8Interrupt Where to store the interrupt.
724	*/
725	VMM_INT_DECL(int) HMSvmNstGstGetInterrupt(PCCPUMCTX pCtx, uint8_t *pu8Interrupt)
726	{
727	PCSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.VmcbCtrl;
728	/** @todo remove later, paranoia for now. */
729	#ifdef DEBUG_ramshankar
730	Assert(HMSvmNstGstIsInterruptPending(pCtx));
731	#endif
732
733	*pu8Interrupt = pVmcbCtrl->IntCtrl.n.u8VIntrVector;
734	if ( pVmcbCtrl->IntCtrl.n.u1IgnoreTPR
735	\|\| pVmcbCtrl->IntCtrl.n.u4VIntrPrio > pVmcbCtrl->IntCtrl.n.u8VTPR)
736	return VINF_SUCCESS;
737
738	return VERR_APIC_INTR_MASKED_BY_TPR;
739	}
740
741
742	/**
743	* Handles nested-guest SVM control intercepts and performs the \#VMEXIT if the
744	* intercept is active.
745	*
746	* @returns Strict VBox status code.
747	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
748	* we're not executing a nested-guest.
749	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
750	* successfully.
751	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
752	* failed and a shutdown needs to be initiated for the geust.
753	*
754	* @param pVCpu The cross context virtual CPU structure.
755	* @param pCtx The guest-CPU context.
756	* @param uExitCode The SVM exit code (see SVM_EXIT_XXX).
757	* @param uExitInfo1 The exit info. 1 field.
758	* @param uExitInfo2 The exit info. 2 field.
759	*/
760	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleCtrlIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t uExitCode, uint64_t uExitInfo1,
761	uint64_t uExitInfo2)
762	{
763	#define HMSVM_VMEXIT_RET() do { return HMSvmNstGstVmExit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); } while (0)
764	#define HMSVM_CTRL_INTERCEPT_VMEXIT_RET(a_Intercept) \
765	do { \
766	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, (a_Intercept))) \
767	return HMSvmNstGstVmExit(pVCpu, pCtx, uExitCode, uExitInfo1, uExitInfo2); \
768	break; \
769	} while (0)
770
771	if (!CPUMIsGuestInNestedHwVirtMode(pCtx))
772	return VINF_HM_INTERCEPT_NOT_ACTIVE;
773
774	switch (uExitCode)
775	{
776	case SVM_EXIT_EXCEPTION_0: case SVM_EXIT_EXCEPTION_1: case SVM_EXIT_EXCEPTION_2: case SVM_EXIT_EXCEPTION_3:
777	case SVM_EXIT_EXCEPTION_4: case SVM_EXIT_EXCEPTION_5: case SVM_EXIT_EXCEPTION_6: case SVM_EXIT_EXCEPTION_7:
778	case SVM_EXIT_EXCEPTION_8: case SVM_EXIT_EXCEPTION_9: case SVM_EXIT_EXCEPTION_10: case SVM_EXIT_EXCEPTION_11:
779	case SVM_EXIT_EXCEPTION_12: case SVM_EXIT_EXCEPTION_13: case SVM_EXIT_EXCEPTION_14: case SVM_EXIT_EXCEPTION_15:
780	case SVM_EXIT_EXCEPTION_16: case SVM_EXIT_EXCEPTION_17: case SVM_EXIT_EXCEPTION_18: case SVM_EXIT_EXCEPTION_19:
781	case SVM_EXIT_EXCEPTION_20: case SVM_EXIT_EXCEPTION_21: case SVM_EXIT_EXCEPTION_22: case SVM_EXIT_EXCEPTION_23:
782	case SVM_EXIT_EXCEPTION_24: case SVM_EXIT_EXCEPTION_25: case SVM_EXIT_EXCEPTION_26: case SVM_EXIT_EXCEPTION_27:
783	case SVM_EXIT_EXCEPTION_28: case SVM_EXIT_EXCEPTION_29: case SVM_EXIT_EXCEPTION_30: case SVM_EXIT_EXCEPTION_31:
784	if (CPUMIsGuestSvmXcptInterceptSet(pCtx, (X86XCPT)(uExitCode - SVM_EXIT_EXCEPTION_0)))
785	HMSVM_VMEXIT_RET();
786	break;
787
788	case SVM_EXIT_WRITE_CR0: case SVM_EXIT_WRITE_CR1: case SVM_EXIT_WRITE_CR2: case SVM_EXIT_WRITE_CR3:
789	case SVM_EXIT_WRITE_CR4: case SVM_EXIT_WRITE_CR5: case SVM_EXIT_WRITE_CR6: case SVM_EXIT_WRITE_CR7:
790	case SVM_EXIT_WRITE_CR8: case SVM_EXIT_WRITE_CR9: case SVM_EXIT_WRITE_CR10: case SVM_EXIT_WRITE_CR11:
791	case SVM_EXIT_WRITE_CR12: case SVM_EXIT_WRITE_CR13: case SVM_EXIT_WRITE_CR14: case SVM_EXIT_WRITE_CR15:
792	if (CPUMIsGuestSvmWriteCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_CR0))
793	HMSVM_VMEXIT_RET();
794	break;
795
796	case SVM_EXIT_READ_CR0: case SVM_EXIT_READ_CR1: case SVM_EXIT_READ_CR2: case SVM_EXIT_READ_CR3:
797	case SVM_EXIT_READ_CR4: case SVM_EXIT_READ_CR5: case SVM_EXIT_READ_CR6: case SVM_EXIT_READ_CR7:
798	case SVM_EXIT_READ_CR8: case SVM_EXIT_READ_CR9: case SVM_EXIT_READ_CR10: case SVM_EXIT_READ_CR11:
799	case SVM_EXIT_READ_CR12: case SVM_EXIT_READ_CR13: case SVM_EXIT_READ_CR14: case SVM_EXIT_READ_CR15:
800	if (CPUMIsGuestSvmReadCRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_CR0))
801	HMSVM_VMEXIT_RET();
802	break;
803
804	case SVM_EXIT_READ_DR0: case SVM_EXIT_READ_DR1: case SVM_EXIT_READ_DR2: case SVM_EXIT_READ_DR3:
805	case SVM_EXIT_READ_DR4: case SVM_EXIT_READ_DR5: case SVM_EXIT_READ_DR6: case SVM_EXIT_READ_DR7:
806	case SVM_EXIT_READ_DR8: case SVM_EXIT_READ_DR9: case SVM_EXIT_READ_DR10: case SVM_EXIT_READ_DR11:
807	case SVM_EXIT_READ_DR12: case SVM_EXIT_READ_DR13: case SVM_EXIT_READ_DR14: case SVM_EXIT_READ_DR15:
808	if (CPUMIsGuestSvmReadDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_READ_DR0))
809	HMSVM_VMEXIT_RET();
810	break;
811
812	case SVM_EXIT_WRITE_DR0: case SVM_EXIT_WRITE_DR1: case SVM_EXIT_WRITE_DR2: case SVM_EXIT_WRITE_DR3:
813	case SVM_EXIT_WRITE_DR4: case SVM_EXIT_WRITE_DR5: case SVM_EXIT_WRITE_DR6: case SVM_EXIT_WRITE_DR7:
814	case SVM_EXIT_WRITE_DR8: case SVM_EXIT_WRITE_DR9: case SVM_EXIT_WRITE_DR10: case SVM_EXIT_WRITE_DR11:
815	case SVM_EXIT_WRITE_DR12: case SVM_EXIT_WRITE_DR13: case SVM_EXIT_WRITE_DR14: case SVM_EXIT_WRITE_DR15:
816	if (CPUMIsGuestSvmWriteDRxInterceptSet(pCtx, uExitCode - SVM_EXIT_WRITE_DR0))
817	HMSVM_VMEXIT_RET();
818	break;
819
820	case SVM_EXIT_INTR: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INTR);
821	case SVM_EXIT_NMI: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_NMI);
822	case SVM_EXIT_SMI: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_SMI);
823	case SVM_EXIT_INIT: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INIT);
824	case SVM_EXIT_VINTR: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_VINTR);
825	case SVM_EXIT_CR0_SEL_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_CR0_SEL_WRITES);
826	case SVM_EXIT_IDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_IDTR_READS);
827	case SVM_EXIT_GDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_GDTR_READS);
828	case SVM_EXIT_LDTR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_LDTR_READS);
829	case SVM_EXIT_TR_READ: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_TR_READS);
830	case SVM_EXIT_IDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_IDTR_WRITES);
831	case SVM_EXIT_GDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_GDTR_WRITES);
832	case SVM_EXIT_LDTR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_LDTR_WRITES);
833	case SVM_EXIT_TR_WRITE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_TR_WRITES);
834	case SVM_EXIT_RDTSC: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_RDTSC);
835	case SVM_EXIT_RDPMC: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_RDPMC);
836	case SVM_EXIT_PUSHF: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_PUSHF);
837	case SVM_EXIT_POPF: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_POPF);
838	case SVM_EXIT_CPUID: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_CPUID);
839	case SVM_EXIT_RSM: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_RSM);
840	case SVM_EXIT_IRET: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_IRET);
841	case SVM_EXIT_SWINT: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INTN);
842	case SVM_EXIT_INVD: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INVD);
843	case SVM_EXIT_PAUSE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_PAUSE);
844	case SVM_EXIT_HLT: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_HLT);
845	case SVM_EXIT_INVLPG: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INVLPG);
846	case SVM_EXIT_INVLPGA: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_INVLPGA);
847	case SVM_EXIT_TASK_SWITCH: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_TASK_SWITCH);
848	case SVM_EXIT_FERR_FREEZE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_FERR_FREEZE);
849	case SVM_EXIT_SHUTDOWN: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_SHUTDOWN);
850	case SVM_EXIT_VMRUN: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_VMRUN);
851	case SVM_EXIT_VMMCALL: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_VMMCALL);
852	case SVM_EXIT_VMLOAD: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_VMLOAD);
853	case SVM_EXIT_VMSAVE: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_VMSAVE);
854	case SVM_EXIT_STGI: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_STGI);
855	case SVM_EXIT_CLGI: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_CLGI);
856	case SVM_EXIT_SKINIT: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_SKINIT);
857	case SVM_EXIT_RDTSCP: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_RDTSCP);
858	case SVM_EXIT_ICEBP: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_ICEBP);
859	case SVM_EXIT_WBINVD: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_WBINVD);
860	case SVM_EXIT_MONITOR: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_MONITOR);
861	case SVM_EXIT_MWAIT: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_MWAIT);
862	case SVM_EXIT_MWAIT_ARMED: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_MWAIT_ARMED);
863	case SVM_EXIT_XSETBV: HMSVM_CTRL_INTERCEPT_VMEXIT_RET(SVM_CTRL_INTERCEPT_XSETBV);
864
865	#if 0
866	case SVM_EXIT_IOIO:
867	{
868	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_IOIO_PROT))
869	{
870	SVMIOIOEXIT IOExitInfo;
871	IOExitInfo.u = uExitInfo1;
872	const volatile void *pvIOPM = pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
873	uint16_t const offIoBitmap = pVIOPM + (IOExitInfo.n.u16Port / 8);
874	uint16_t const u16Port = IOExitInfo.n.u16Port;
875	uint8_t const cbIoSize = IOExitInfo.n.u1OP32 ? 4 : IOExitInfo.n.u1OP16;
876	}
877	break;
878	}
879	#endif
880
881	case SVM_EXIT_MSR:
882	AssertMsgFailed(("Use HMSvmNstGstHandleMsrIntercept!\n"));
883	return VERR_SVM_IPE_1;
884
885	case SVM_EXIT_NPF:
886	case SVM_EXIT_AVIC_INCOMPLETE_IPI:
887	case SVM_EXIT_AVIC_NOACCEL:
888	AssertMsgFailed(("Todo Implement.\n"));
889	return VERR_SVM_IPE_1;
890
891	default:
892	AssertMsgFailed(("Unsupported.\n"));
893	return VERR_SVM_IPE_1;
894	}
895
896	return VINF_HM_INTERCEPT_NOT_ACTIVE;
897
898	#undef HMSVM_VMEXIT_RET
899	#undef HMSVM_CTRL_INTERCEPT_VMEXIT_RET
900	}
901
902
903	/**
904	* Handles nested-guest SVM IO intercepts and performs the \#VMEXIT
905	* if the intercept is active.
906	*
907	* @returns Strict VBox status code.
908	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
909	* we're not executing a nested-guest.
910	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
911	* successfully.
912	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
913	* failed and a shutdown needs to be initiated for the geust.
914	*
915	* @param pVCpu The cross context virtual CPU structure.
916	* @param pCtx The guest-CPU context.
917	* @param pIoExitInfo The SVM IOIO exit info. structure.
918	* @param uNextRip The RIP of the instruction following the IO
919	* instruction.
920	*/
921	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleIOIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, PCSVMIOIOEXITINFO pIoExitInfo,
922	uint64_t uNextRip)
923	{
924	/*
925	* Check if any IO accesses are being intercepted.
926	*/
927	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_IOIO_PROT))
928	{
929	Assert(CPUMIsGuestInNestedHwVirtMode(pCtx));
930
931	/*
932	* The IOPM layout:
933	* Each bit represents one 8-bit port. That makes a total of 0..65535 bits or
934	* two 4K pages. However, since it's possible to do a 32-bit port IO at port
935	* 65534 (thus accessing 4 bytes), we need 3 extra bits beyond the two 4K page.
936	*
937	* For IO instructions that access more than a single byte, the permission bits
938	* for all bytes are checked; if any bit is set to 1, the IO access is intercepted.
939	*/
940	uint8_t pbIopm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvIoBitmap);
941
942	uint16_t const u16Port = pIoExitInfo->n.u16Port;
943	uint16_t const offIoBitmap = u16Port >> 3;
944	uint16_t const fSizeMask = pIoExitInfo->n.u1OP32 ? 0xf : pIoExitInfo->n.u1OP16 ? 3 : 1;
945	uint8_t const cShift = u16Port - (offIoBitmap << 3);
946	uint16_t const fIopmMask = (1 << cShift) \| (fSizeMask << cShift);
947
948	pbIopm += offIoBitmap;
949	uint16_t const fIopmBits = (uint16_t )pbIopm;
950	if (fIopmBits & fIopmMask)
951	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_IOIO, pIoExitInfo->u, uNextRip);
952	}
953	return VINF_HM_INTERCEPT_NOT_ACTIVE;
954	}
955
956
957	/**
958	* Handles nested-guest SVM MSR read/write intercepts and performs the \#VMEXIT
959	* if the intercept is active.
960	*
961	* @returns Strict VBox status code.
962	* @retval VINF_SVM_INTERCEPT_NOT_ACTIVE if the intercept is not active or
963	* we're not executing a nested-guest.
964	* @retval VINF_SVM_VMEXIT if the intercept is active and the \#VMEXIT occurred
965	* successfully.
966	* @retval VERR_SVM_VMEXIT_FAILED if the intercept is active and the \#VMEXIT
967	* failed and a shutdown needs to be initiated for the geust.
968	*
969	* @param pVCpu The cross context virtual CPU structure.
970	* @param pCtx The guest-CPU context.
971	* @param idMsr The MSR being accessed in the nested-guest.
972	* @param fWrite Whether this is an MSR write access, @c false implies an
973	* MSR read.
974	*/
975	VMM_INT_DECL(VBOXSTRICTRC) HMSvmNstGstHandleMsrIntercept(PVMCPU pVCpu, PCPUMCTX pCtx, uint32_t idMsr, bool fWrite)
976	{
977	/*
978	* Check if any MSRs are being intercepted.
979	*/
980	if (CPUMIsGuestSvmCtrlInterceptSet(pCtx, SVM_CTRL_INTERCEPT_MSR_PROT))
981	{
982	Assert(CPUMIsGuestInNestedHwVirtMode(pCtx));
983	uint64_t const uExitInfo1 = fWrite ? SVM_EXIT1_MSR_WRITE : SVM_EXIT1_MSR_READ;
984
985	/*
986	* Get the byte and bit offset of the permission bits corresponding to the MSR.
987	*/
988	uint16_t offMsrpm;
989	uint32_t uMsrpmBit;
990	int rc = hmSvmGetMsrpmOffsetAndBit(idMsr, &offMsrpm, &uMsrpmBit);
991	if (RT_SUCCESS(rc))
992	{
993	Assert(uMsrpmBit < 0x3fff);
994	Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
995	if (fWrite)
996	++uMsrpmBit;
997
998	/*
999	* Check if the bit is set, if so, trigger a #VMEXIT.
1000	*/
1001	uint8_t pbMsrpm = (uint8_t )pCtx->hwvirt.svm.CTX_SUFF(pvMsrBitmap);
1002	pbMsrpm += offMsrpm;
1003	if (ASMBitTest(pbMsrpm, uMsrpmBit))
1004	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1005	}
1006	else
1007	{
1008	/*
1009	* This shouldn't happen, but if it does, cause a #VMEXIT and let the "host" (guest hypervisor) deal with it.
1010	*/
1011	Log(("HMSvmNstGstHandleIntercept: Invalid/out-of-range MSR %#RX32 fWrite=%RTbool\n", idMsr, fWrite));
1012	return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_MSR, uExitInfo1, 0 /* uExitInfo2 */);
1013	}
1014	}
1015	return VINF_HM_INTERCEPT_NOT_ACTIVE;
1016	}
1017
1018
1019	/**
1020	* Gets the MSR permission bitmap byte and bit offset for the specified MSR.
1021	*
1022	* @returns VBox status code.
1023	* @param idMsr The MSR being requested.
1024	* @param pbOffMsrpm Where to store the byte offset in the MSR permission
1025	* bitmap for @a idMsr.
1026	* @param puMsrpmBit Where to store the bit offset starting at the byte
1027	* returned in @a pbOffMsrpm.
1028	*/
1029	VMM_INT_DECL(int) hmSvmGetMsrpmOffsetAndBit(uint32_t idMsr, uint16_t pbOffMsrpm, uint32_t puMsrpmBit)
1030	{
1031	Assert(pbOffMsrpm);
1032	Assert(puMsrpmBit);
1033
1034	/*
1035	* MSRPM Layout:
1036	* Byte offset MSR range
1037	* 0x000 - 0x7ff 0x00000000 - 0x00001fff
1038	* 0x800 - 0xfff 0xc0000000 - 0xc0001fff
1039	* 0x1000 - 0x17ff 0xc0010000 - 0xc0011fff
1040	* 0x1800 - 0x1fff Reserved
1041	*
1042	* Each MSR is represented by 2 permission bits (read and write).
1043	*/
1044	if (idMsr <= 0x00001fff)
1045	{
1046	/* Pentium-compatible MSRs. */
1047	*pbOffMsrpm = 0;
1048	*puMsrpmBit = idMsr << 1;
1049	return VINF_SUCCESS;
1050	}
1051
1052	if ( idMsr >= 0xc0000000
1053	&& idMsr <= 0xc0001fff)
1054	{
1055	/* AMD Sixth Generation x86 Processor MSRs. */
1056	*pbOffMsrpm = 0x800;
1057	*puMsrpmBit = (idMsr - 0xc0000000) << 1;
1058	return VINF_SUCCESS;
1059	}
1060
1061	if ( idMsr >= 0xc0010000
1062	&& idMsr <= 0xc0011fff)
1063	{
1064	/* AMD Seventh and Eighth Generation Processor MSRs. */
1065	*pbOffMsrpm += 0x1000;
1066	*puMsrpmBit = (idMsr - 0xc0001000) << 1;
1067	return VINF_SUCCESS;
1068	}
1069
1070	*pbOffMsrpm = 0;
1071	*puMsrpmBit = 0;
1072	return VERR_OUT_OF_RANGE;
1073	}
1074	#endif /* !IN_RC */
1075
1076
1077	/**
1078	* Converts an SVM event type to a TRPM event type.
1079	*
1080	* @returns The TRPM event type.
1081	* @retval TRPM_32BIT_HACK if the specified type of event isn't among the set
1082	* of recognized trap types.
1083	*
1084	* @param pEvent Pointer to the SVM event.
1085	*/
1086	VMM_INT_DECL(TRPMEVENT) hmSvmEventToTrpmEventType(PCSVMEVENT pEvent)
1087	{
1088	uint8_t const uType = pEvent->n.u3Type;
1089	switch (uType)
1090	{
1091	case SVM_EVENT_EXTERNAL_IRQ: return TRPM_HARDWARE_INT;
1092	case SVM_EVENT_SOFTWARE_INT: return TRPM_SOFTWARE_INT;
1093	case SVM_EVENT_EXCEPTION:
1094	case SVM_EVENT_NMI: return TRPM_TRAP;
1095	default:
1096	break;
1097	}
1098	AssertMsgFailed(("HMSvmEventToTrpmEvent: Invalid pending-event type %#x\n", uType));
1099	return TRPM_32BIT_HACK;
1100	}
1101

注意: 瀏覽 TracBrowser 來幫助您使用儲存庫瀏覽器

source: vbox/trunk/src/VBox/VMM/VMMAll/HMSVMAll.cpp@ 66371

以其他格式下載: