VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h@ 74105

Last change on this file since 74105 was 74105, checked in by vboxsync, 6 years ago

VMM/IEM: Nested VMX: bugref:9180 Confusing terminology.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 127.6 KB
Line 
1/* $Id: IEMAllCImplVmxInstr.cpp.h 74105 2018-09-06 08:18:31Z vboxsync $ */
2/** @file
3 * IEM - VT-x instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2018 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/**
20 * Implements 'VMCALL'.
21 */
22IEM_CIMPL_DEF_0(iemCImpl_vmcall)
23{
24 /** @todo NSTVMX: intercept. */
25
26 /* Join forces with vmmcall. */
27 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
28}
29
30#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
31/**
32 * Map of VMCS field encodings to their virtual-VMCS structure offsets.
33 *
34 * The first array dimension is VMCS field encoding of Width OR'ed with Type and the
35 * second dimension is the Index, see VMXVMCSFIELDENC.
36 */
37uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
38{
39 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
40 {
41 /* 0 */ RT_OFFSETOF(VMXVVMCS, u16Vpid),
42 /* 1 */ RT_OFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
43 /* 2 */ RT_OFFSETOF(VMXVVMCS, u16EptpIndex),
44 /* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
45 /* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
46 /* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
47 },
48 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
49 {
50 /* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
51 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
52 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
53 /* 24-25 */ UINT16_MAX, UINT16_MAX
54 },
55 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
56 {
57 /* 0 */ RT_OFFSETOF(VMXVVMCS, GuestEs),
58 /* 1 */ RT_OFFSETOF(VMXVVMCS, GuestCs),
59 /* 2 */ RT_OFFSETOF(VMXVVMCS, GuestSs),
60 /* 3 */ RT_OFFSETOF(VMXVVMCS, GuestDs),
61 /* 4 */ RT_OFFSETOF(VMXVVMCS, GuestFs),
62 /* 5 */ RT_OFFSETOF(VMXVVMCS, GuestGs),
63 /* 6 */ RT_OFFSETOF(VMXVVMCS, GuestLdtr),
64 /* 7 */ RT_OFFSETOF(VMXVVMCS, GuestTr),
65 /* 8 */ RT_OFFSETOF(VMXVVMCS, u16GuestIntStatus),
66 /* 9 */ RT_OFFSETOF(VMXVVMCS, u16PmlIndex),
67 /* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
68 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
69 },
70 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
71 {
72 /* 0 */ RT_OFFSETOF(VMXVVMCS, HostEs),
73 /* 1 */ RT_OFFSETOF(VMXVVMCS, HostCs),
74 /* 2 */ RT_OFFSETOF(VMXVVMCS, HostSs),
75 /* 3 */ RT_OFFSETOF(VMXVVMCS, HostDs),
76 /* 4 */ RT_OFFSETOF(VMXVVMCS, HostFs),
77 /* 5 */ RT_OFFSETOF(VMXVVMCS, HostGs),
78 /* 6 */ RT_OFFSETOF(VMXVVMCS, HostTr),
79 /* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
80 /* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
81 /* 23-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
82 },
83 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
84 {
85 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
86 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
87 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
88 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
89 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
90 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
91 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
92 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64AddrPml),
93 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64TscOffset),
94 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64AddrVirtApic),
95 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64AddrApicAccess),
96 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
97 /* 12 */ RT_OFFSETOF(VMXVVMCS, u64VmFuncCtls),
98 /* 13 */ RT_OFFSETOF(VMXVVMCS, u64EptpPtr),
99 /* 14 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
100 /* 15 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
101 /* 16 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
102 /* 17 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
103 /* 18 */ RT_OFFSETOF(VMXVVMCS, u64AddrEptpList),
104 /* 19 */ RT_OFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
105 /* 20 */ RT_OFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
106 /* 21 */ RT_OFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
107 /* 22 */ RT_OFFSETOF(VMXVVMCS, u64AddrXssBitmap),
108 /* 23 */ RT_OFFSETOF(VMXVVMCS, u64AddrEnclsBitmap),
109 /* 24 */ UINT16_MAX,
110 /* 25 */ RT_OFFSETOF(VMXVVMCS, u64TscMultiplier)
111 },
112 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
113 {
114 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64GuestPhysAddr),
115 /* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
116 /* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
117 /* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
118 /* 25 */ UINT16_MAX
119 },
120 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
121 {
122 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
123 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
124 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64GuestPatMsr),
125 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64GuestEferMsr),
126 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
127 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte0),
128 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte1),
129 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte2),
130 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte3),
131 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
132 /* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
133 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
134 },
135 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
136 {
137 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64HostPatMsr),
138 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64HostEferMsr),
139 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
140 /* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
141 /* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
142 /* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
143 },
144 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
145 {
146 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32PinCtls),
147 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32ProcCtls),
148 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32XcptBitmap),
149 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32XcptPFMask),
150 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32XcptPFMatch),
151 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32Cr3TargetCount),
152 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32ExitCtls),
153 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
154 /* 8 */ RT_OFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
155 /* 9 */ RT_OFFSETOF(VMXVVMCS, u32EntryCtls),
156 /* 10 */ RT_OFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
157 /* 11 */ RT_OFFSETOF(VMXVVMCS, u32EntryIntInfo),
158 /* 12 */ RT_OFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
159 /* 13 */ RT_OFFSETOF(VMXVVMCS, u32EntryInstrLen),
160 /* 14 */ RT_OFFSETOF(VMXVVMCS, u32TprThreshold),
161 /* 15 */ RT_OFFSETOF(VMXVVMCS, u32ProcCtls2),
162 /* 16 */ RT_OFFSETOF(VMXVVMCS, u32PleGap),
163 /* 17 */ RT_OFFSETOF(VMXVVMCS, u32PleWindow),
164 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
165 },
166 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
167 {
168 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32RoVmInstrError),
169 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32RoExitReason),
170 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32RoExitIntInfo),
171 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32RoExitErrCode),
172 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
173 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
174 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32RoExitInstrLen),
175 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
176 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
177 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
178 /* 24-25 */ UINT16_MAX, UINT16_MAX
179 },
180 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
181 {
182 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsLimit),
183 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32GuestCsLimit),
184 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32GuestSsLimit),
185 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32GuestDsLimit),
186 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsLimit),
187 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32GuestFsLimit),
188 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32GuestGsLimit),
189 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
190 /* 8 */ RT_OFFSETOF(VMXVVMCS, u32GuestTrLimit),
191 /* 9 */ RT_OFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
192 /* 10 */ RT_OFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
193 /* 11 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsAttr),
194 /* 12 */ RT_OFFSETOF(VMXVVMCS, u32GuestCsAttr),
195 /* 13 */ RT_OFFSETOF(VMXVVMCS, u32GuestSsAttr),
196 /* 14 */ RT_OFFSETOF(VMXVVMCS, u32GuestDsAttr),
197 /* 15 */ RT_OFFSETOF(VMXVVMCS, u32GuestFsAttr),
198 /* 16 */ RT_OFFSETOF(VMXVVMCS, u32GuestGsAttr),
199 /* 17 */ RT_OFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
200 /* 18 */ RT_OFFSETOF(VMXVVMCS, u32GuestTrAttr),
201 /* 19 */ RT_OFFSETOF(VMXVVMCS, u32GuestIntrState),
202 /* 20 */ RT_OFFSETOF(VMXVVMCS, u32GuestActivityState),
203 /* 21 */ RT_OFFSETOF(VMXVVMCS, u32GuestSmBase),
204 /* 22 */ RT_OFFSETOF(VMXVVMCS, u32GuestSysenterCS),
205 /* 23 */ RT_OFFSETOF(VMXVVMCS, u32PreemptTimer),
206 /* 24-25 */ UINT16_MAX, UINT16_MAX
207 },
208 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
209 {
210 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32HostSysenterCs),
211 /* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
212 /* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
213 /* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
214 /* 25 */ UINT16_MAX
215 },
216 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_CONTROL: */
217 {
218 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64Cr0Mask),
219 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64Cr4Mask),
220 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
221 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
222 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target0),
223 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target1),
224 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target2),
225 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target3),
226 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
227 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
228 /* 24-25 */ UINT16_MAX, UINT16_MAX
229 },
230 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
231 {
232 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64ExitQual),
233 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64IoRcx),
234 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64IoRsi),
235 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64IoRdi),
236 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64IoRip),
237 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestLinearAddr),
238 /* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
239 /* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
240 /* 22-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
241 },
242 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
243 {
244 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr0),
245 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr3),
246 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr4),
247 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64GuestEsBase),
248 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64GuestCsBase),
249 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestSsBase),
250 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64GuestDsBase),
251 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64GuestFsBase),
252 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64GuestGsBase),
253 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64GuestLdtrBase),
254 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64GuestTrBase),
255 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64GuestGdtrBase),
256 /* 12 */ RT_OFFSETOF(VMXVVMCS, u64GuestIdtrBase),
257 /* 13 */ RT_OFFSETOF(VMXVVMCS, u64GuestDr7),
258 /* 14 */ RT_OFFSETOF(VMXVVMCS, u64GuestRsp),
259 /* 15 */ RT_OFFSETOF(VMXVVMCS, u64GuestRip),
260 /* 16 */ RT_OFFSETOF(VMXVVMCS, u64GuestRFlags),
261 /* 17 */ RT_OFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpt),
262 /* 18 */ RT_OFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
263 /* 19 */ RT_OFFSETOF(VMXVVMCS, u64GuestSysenterEip),
264 /* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
265 },
266 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_HOST_STATE: */
267 {
268 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64HostCr0),
269 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64HostCr3),
270 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64HostCr4),
271 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64HostFsBase),
272 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64HostGsBase),
273 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64HostTrBase),
274 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64HostGdtrBase),
275 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64HostIdtrBase),
276 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64HostSysenterEsp),
277 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64HostSysenterEip),
278 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64HostRsp),
279 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64HostRip),
280 /* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
281 /* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
282 }
283};
284
285
286/**
287 * Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
288 * relative offsets.
289 */
290# ifdef IEM_WITH_CODE_TLB
291# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { } while (0)
292# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { } while (0)
293# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
294# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
295# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
296# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
297# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
298# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
299# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
300# else /* !IEM_WITH_CODE_TLB */
301# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
302 do \
303 { \
304 Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
305 (a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
306 } while (0)
307
308# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
309
310# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
311 do \
312 { \
313 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
314 uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
315 uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
316 (a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
317 } while (0)
318
319# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
320 do \
321 { \
322 Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
323 (a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
324 } while (0)
325
326# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
327 do \
328 { \
329 Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
330 uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
331 uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
332 uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
333 uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
334 (a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
335 } while (0)
336
337# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
338 do \
339 { \
340 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
341 (a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
342 } while (0)
343
344# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
345 do \
346 { \
347 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
348 (a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
349 } while (0)
350
351# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
352 do \
353 { \
354 Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
355 uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
356 uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
357 uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
358 uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
359 (a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
360 } while (0)
361# endif /* !IEM_WITH_CODE_TLB */
362
363/** Whether a shadow VMCS is present for the given VCPU. */
364#define IEM_VMX_HAS_SHADOW_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) != NIL_RTGCPHYS)
365
366/** Gets the guest-physical address of the shadows VMCS for the given VCPU. */
367#define IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->u64VmcsLinkPtr.u)
368
369/** Whether a current VMCS is present for the given VCPU. */
370#define IEM_VMX_HAS_CURRENT_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) != NIL_RTGCPHYS)
371
372/** Gets the guest-physical address of the current VMCS for the given VCPU. */
373#define IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs)
374
375/** Assigns the guest-physical address of the current VMCS for the given VCPU. */
376#define IEM_VMX_SET_CURRENT_VMCS(a_pVCpu, a_GCPhysVmcs) \
377 do \
378 { \
379 Assert((a_GCPhysVmcs) != NIL_RTGCPHYS); \
380 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = (a_GCPhysVmcs); \
381 } while (0)
382
383/** Clears any current VMCS for the given VCPU. */
384#define IEM_VMX_CLEAR_CURRENT_VMCS(a_pVCpu) \
385 do \
386 { \
387 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = NIL_RTGCPHYS; \
388 } while (0)
389
390/** Check the common VMX instruction preconditions.
391 * @note Any changes here, also check if IEMOP_HLP_VMX_INSTR needs updating.
392 */
393#define IEM_VMX_INSTR_CHECKS(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
394 do { \
395 if ( !IEM_IS_REAL_OR_V86_MODE(a_pVCpu) \
396 && ( !IEM_IS_LONG_MODE(a_pVCpu) \
397 || IEM_IS_64BIT_CODE(a_pVCpu))) \
398 { /* likely */ } \
399 else \
400 { \
401 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
402 { \
403 Log((a_szInstr ": Real or v8086 mode -> #UD\n")); \
404 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_RealOrV86Mode; \
405 return iemRaiseUndefinedOpcode(a_pVCpu); \
406 } \
407 if (IEM_IS_LONG_MODE(a_pVCpu) && !IEM_IS_64BIT_CODE(a_pVCpu)) \
408 { \
409 Log((a_szInstr ": Long mode without 64-bit code segment -> #UD\n")); \
410 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_LongModeCS; \
411 return iemRaiseUndefinedOpcode(a_pVCpu); \
412 } \
413 } \
414 } while (0)
415
416/** Check for VMX instructions requiring to be in VMX operation.
417 * @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs udpating. */
418#define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
419 do \
420 { \
421 if (IEM_IS_VMX_ROOT_MODE(a_pVCpu)) \
422 { /* likely */ } \
423 else \
424 { \
425 Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
426 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_VmxRoot; \
427 return iemRaiseUndefinedOpcode(a_pVCpu); \
428 } \
429 } while (0)
430
431
432/**
433 * Returns whether the given VMCS field is valid and supported by our emulation.
434 *
435 * @param pVCpu The cross context virtual CPU structure.
436 * @param u64FieldEnc The VMCS field encoding.
437 *
438 * @remarks This takes into account the CPU features exposed to the guest.
439 */
440IEM_STATIC bool iemVmxIsVmcsFieldValid(PVMCPU pVCpu, uint64_t u64FieldEnc)
441{
442 uint32_t const uFieldEncHi = RT_HI_U32(u64FieldEnc);
443 uint32_t const uFieldEncLo = RT_LO_U32(u64FieldEnc);
444 if (!uFieldEncHi)
445 { /* likely */ }
446 else
447 return false;
448
449 PCCPUMFEATURES pFeat = IEM_GET_GUEST_CPU_FEATURES(pVCpu);
450 switch (uFieldEncLo)
451 {
452 /*
453 * 16-bit fields.
454 */
455 /* Control fields. */
456 case VMX_VMCS16_VPID: return pFeat->fVmxVpid;
457 case VMX_VMCS16_POSTED_INT_NOTIFY_VECTOR: return pFeat->fVmxPostedInt;
458 case VMX_VMCS16_EPTP_INDEX: return pFeat->fVmxEptXcptVe;
459
460 /* Guest-state fields. */
461 case VMX_VMCS16_GUEST_ES_SEL:
462 case VMX_VMCS16_GUEST_CS_SEL:
463 case VMX_VMCS16_GUEST_SS_SEL:
464 case VMX_VMCS16_GUEST_DS_SEL:
465 case VMX_VMCS16_GUEST_FS_SEL:
466 case VMX_VMCS16_GUEST_GS_SEL:
467 case VMX_VMCS16_GUEST_LDTR_SEL:
468 case VMX_VMCS16_GUEST_TR_SEL:
469 case VMX_VMCS16_GUEST_INTR_STATUS: return pFeat->fVmxVirtIntDelivery;
470 case VMX_VMCS16_GUEST_PML_INDEX: return pFeat->fVmxPml;
471
472 /* Host-state fields. */
473 case VMX_VMCS16_HOST_ES_SEL:
474 case VMX_VMCS16_HOST_CS_SEL:
475 case VMX_VMCS16_HOST_SS_SEL:
476 case VMX_VMCS16_HOST_DS_SEL:
477 case VMX_VMCS16_HOST_FS_SEL:
478 case VMX_VMCS16_HOST_GS_SEL:
479 case VMX_VMCS16_HOST_TR_SEL: return true;
480
481 /*
482 * 64-bit fields.
483 */
484 /* Control fields. */
485 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
486 case VMX_VMCS64_CTRL_IO_BITMAP_A_HIGH:
487 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
488 case VMX_VMCS64_CTRL_IO_BITMAP_B_HIGH: return pFeat->fVmxUseIoBitmaps;
489 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
490 case VMX_VMCS64_CTRL_MSR_BITMAP_HIGH: return pFeat->fVmxUseMsrBitmaps;
491 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
492 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_HIGH:
493 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
494 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_HIGH:
495 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
496 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_HIGH:
497 case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_FULL:
498 case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_HIGH: return true;
499 case VMX_VMCS64_CTRL_EXEC_PML_ADDR_FULL:
500 case VMX_VMCS64_CTRL_EXEC_PML_ADDR_HIGH: return pFeat->fVmxPml;
501 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
502 case VMX_VMCS64_CTRL_TSC_OFFSET_HIGH: return true;
503 case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_FULL:
504 case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_HIGH: return pFeat->fVmxUseTprShadow;
505 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
506 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_HIGH: return pFeat->fVmxVirtApicAccess;
507 case VMX_VMCS64_CTRL_POSTED_INTR_DESC_FULL:
508 case VMX_VMCS64_CTRL_POSTED_INTR_DESC_HIGH: return pFeat->fVmxPostedInt;
509 case VMX_VMCS64_CTRL_VMFUNC_CTRLS_FULL:
510 case VMX_VMCS64_CTRL_VMFUNC_CTRLS_HIGH: return pFeat->fVmxVmFunc;
511 case VMX_VMCS64_CTRL_EPTP_FULL:
512 case VMX_VMCS64_CTRL_EPTP_HIGH: return pFeat->fVmxEpt;
513 case VMX_VMCS64_CTRL_EOI_BITMAP_0_FULL:
514 case VMX_VMCS64_CTRL_EOI_BITMAP_0_HIGH:
515 case VMX_VMCS64_CTRL_EOI_BITMAP_1_FULL:
516 case VMX_VMCS64_CTRL_EOI_BITMAP_1_HIGH:
517 case VMX_VMCS64_CTRL_EOI_BITMAP_2_FULL:
518 case VMX_VMCS64_CTRL_EOI_BITMAP_2_HIGH:
519 case VMX_VMCS64_CTRL_EOI_BITMAP_3_FULL:
520 case VMX_VMCS64_CTRL_EOI_BITMAP_3_HIGH: return pFeat->fVmxVirtIntDelivery;
521 case VMX_VMCS64_CTRL_EPTP_LIST_FULL:
522 case VMX_VMCS64_CTRL_EPTP_LIST_HIGH:
523 {
524 uint64_t const uVmFuncMsr = CPUMGetGuestIa32VmxVmFunc(pVCpu);
525 return RT_BOOL(RT_BF_GET(uVmFuncMsr, VMX_BF_VMFUNC_EPTP_SWITCHING));
526 }
527 case VMX_VMCS64_CTRL_VMREAD_BITMAP_FULL:
528 case VMX_VMCS64_CTRL_VMREAD_BITMAP_HIGH:
529 case VMX_VMCS64_CTRL_VMWRITE_BITMAP_FULL:
530 case VMX_VMCS64_CTRL_VMWRITE_BITMAP_HIGH: return pFeat->fVmxVmcsShadowing;
531 case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_FULL:
532 case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_HIGH: return pFeat->fVmxEptXcptVe;
533 case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_FULL:
534 case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_HIGH: return pFeat->fVmxXsavesXrstors;
535 case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_FULL:
536 case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_HIGH: return false;
537 case VMX_VMCS64_CTRL_TSC_MULTIPLIER_FULL:
538 case VMX_VMCS64_CTRL_TSC_MULTIPLIER_HIGH: return pFeat->fVmxUseTscScaling;
539
540 /* Read-only data fields. */
541 case VMX_VMCS64_RO_GUEST_PHYS_ADDR_FULL:
542 case VMX_VMCS64_RO_GUEST_PHYS_ADDR_HIGH: return pFeat->fVmxEpt;
543
544 /* Guest-state fields. */
545 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
546 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_HIGH:
547 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
548 case VMX_VMCS64_GUEST_DEBUGCTL_HIGH: return true;
549 case VMX_VMCS64_GUEST_PAT_FULL:
550 case VMX_VMCS64_GUEST_PAT_HIGH: return pFeat->fVmxEntryLoadPatMsr || pFeat->fVmxExitSavePatMsr;
551 case VMX_VMCS64_GUEST_EFER_FULL:
552 case VMX_VMCS64_GUEST_EFER_HIGH: return pFeat->fVmxEntryLoadEferMsr || pFeat->fVmxExitSaveEferMsr;
553 case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_FULL:
554 case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_HIGH: return false;
555 case VMX_VMCS64_GUEST_PDPTE0_FULL:
556 case VMX_VMCS64_GUEST_PDPTE0_HIGH:
557 case VMX_VMCS64_GUEST_PDPTE1_FULL:
558 case VMX_VMCS64_GUEST_PDPTE1_HIGH:
559 case VMX_VMCS64_GUEST_PDPTE2_FULL:
560 case VMX_VMCS64_GUEST_PDPTE2_HIGH:
561 case VMX_VMCS64_GUEST_PDPTE3_FULL:
562 case VMX_VMCS64_GUEST_PDPTE3_HIGH: return pFeat->fVmxEpt;
563 case VMX_VMCS64_GUEST_BNDCFGS_FULL:
564 case VMX_VMCS64_GUEST_BNDCFGS_HIGH: return false;
565
566 /* Host-state fields. */
567 case VMX_VMCS64_HOST_PAT_FULL:
568 case VMX_VMCS64_HOST_PAT_HIGH: return pFeat->fVmxExitLoadPatMsr;
569 case VMX_VMCS64_HOST_EFER_FULL:
570 case VMX_VMCS64_HOST_EFER_HIGH: return pFeat->fVmxExitLoadEferMsr;
571 case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_FULL:
572 case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_HIGH: return false;
573
574 /*
575 * 32-bit fields.
576 */
577 /* Control fields. */
578 case VMX_VMCS32_CTRL_PIN_EXEC:
579 case VMX_VMCS32_CTRL_PROC_EXEC:
580 case VMX_VMCS32_CTRL_EXCEPTION_BITMAP:
581 case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK:
582 case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH:
583 case VMX_VMCS32_CTRL_CR3_TARGET_COUNT:
584 case VMX_VMCS32_CTRL_EXIT:
585 case VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT:
586 case VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT:
587 case VMX_VMCS32_CTRL_ENTRY:
588 case VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT:
589 case VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO:
590 case VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE:
591 case VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH: return true;
592 case VMX_VMCS32_CTRL_TPR_THRESHOLD: return pFeat->fVmxUseTprShadow;
593 case VMX_VMCS32_CTRL_PROC_EXEC2: return pFeat->fVmxSecondaryExecCtls;
594 case VMX_VMCS32_CTRL_PLE_GAP:
595 case VMX_VMCS32_CTRL_PLE_WINDOW: return pFeat->fVmxPauseLoopExit;
596
597 /* Read-only data fields. */
598 case VMX_VMCS32_RO_VM_INSTR_ERROR:
599 case VMX_VMCS32_RO_EXIT_REASON:
600 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
601 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
602 case VMX_VMCS32_RO_IDT_VECTORING_INFO:
603 case VMX_VMCS32_RO_IDT_VECTORING_ERROR_CODE:
604 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
605 case VMX_VMCS32_RO_EXIT_INSTR_INFO: return true;
606
607 /* Guest-state fields. */
608 case VMX_VMCS32_GUEST_ES_LIMIT:
609 case VMX_VMCS32_GUEST_CS_LIMIT:
610 case VMX_VMCS32_GUEST_SS_LIMIT:
611 case VMX_VMCS32_GUEST_DS_LIMIT:
612 case VMX_VMCS32_GUEST_FS_LIMIT:
613 case VMX_VMCS32_GUEST_GS_LIMIT:
614 case VMX_VMCS32_GUEST_LDTR_LIMIT:
615 case VMX_VMCS32_GUEST_TR_LIMIT:
616 case VMX_VMCS32_GUEST_GDTR_LIMIT:
617 case VMX_VMCS32_GUEST_IDTR_LIMIT:
618 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
619 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
620 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
621 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
622 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
623 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
624 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
625 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
626 case VMX_VMCS32_GUEST_INT_STATE:
627 case VMX_VMCS32_GUEST_ACTIVITY_STATE:
628 case VMX_VMCS32_GUEST_SMBASE:
629 case VMX_VMCS32_GUEST_SYSENTER_CS: return true;
630 case VMX_VMCS32_PREEMPT_TIMER_VALUE: return pFeat->fVmxPreemptTimer;
631
632 /* Host-state fields. */
633 case VMX_VMCS32_HOST_SYSENTER_CS: return true;
634
635 /*
636 * Natural-width fields.
637 */
638 /* Control fields. */
639 case VMX_VMCS_CTRL_CR0_MASK:
640 case VMX_VMCS_CTRL_CR4_MASK:
641 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
642 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
643 case VMX_VMCS_CTRL_CR3_TARGET_VAL0:
644 case VMX_VMCS_CTRL_CR3_TARGET_VAL1:
645 case VMX_VMCS_CTRL_CR3_TARGET_VAL2:
646 case VMX_VMCS_CTRL_CR3_TARGET_VAL3: return true;
647
648 /* Read-only data fields. */
649 case VMX_VMCS_RO_EXIT_QUALIFICATION:
650 case VMX_VMCS_RO_IO_RCX:
651 case VMX_VMCS_RO_IO_RSX:
652 case VMX_VMCS_RO_IO_RDI:
653 case VMX_VMCS_RO_IO_RIP:
654 case VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR: return true;
655
656 /* Guest-state fields. */
657 case VMX_VMCS_GUEST_CR0:
658 case VMX_VMCS_GUEST_CR3:
659 case VMX_VMCS_GUEST_CR4:
660 case VMX_VMCS_GUEST_ES_BASE:
661 case VMX_VMCS_GUEST_CS_BASE:
662 case VMX_VMCS_GUEST_SS_BASE:
663 case VMX_VMCS_GUEST_DS_BASE:
664 case VMX_VMCS_GUEST_FS_BASE:
665 case VMX_VMCS_GUEST_GS_BASE:
666 case VMX_VMCS_GUEST_LDTR_BASE:
667 case VMX_VMCS_GUEST_TR_BASE:
668 case VMX_VMCS_GUEST_GDTR_BASE:
669 case VMX_VMCS_GUEST_IDTR_BASE:
670 case VMX_VMCS_GUEST_DR7:
671 case VMX_VMCS_GUEST_RSP:
672 case VMX_VMCS_GUEST_RIP:
673 case VMX_VMCS_GUEST_RFLAGS:
674 case VMX_VMCS_GUEST_PENDING_DEBUG_XCPTS:
675 case VMX_VMCS_GUEST_SYSENTER_ESP:
676 case VMX_VMCS_GUEST_SYSENTER_EIP: return true;
677
678 /* Host-state fields. */
679 case VMX_VMCS_HOST_CR0:
680 case VMX_VMCS_HOST_CR3:
681 case VMX_VMCS_HOST_CR4:
682 case VMX_VMCS_HOST_FS_BASE:
683 case VMX_VMCS_HOST_GS_BASE:
684 case VMX_VMCS_HOST_TR_BASE:
685 case VMX_VMCS_HOST_GDTR_BASE:
686 case VMX_VMCS_HOST_IDTR_BASE:
687 case VMX_VMCS_HOST_SYSENTER_ESP:
688 case VMX_VMCS_HOST_SYSENTER_EIP:
689 case VMX_VMCS_HOST_RSP:
690 case VMX_VMCS_HOST_RIP: return true;
691 }
692
693 return false;
694}
695
696
697/**
698 * Gets VM-exit instruction information along with any displacement for an
699 * instruction VM-exit.
700 *
701 * @returns The VM-exit instruction information.
702 * @param pVCpu The cross context virtual CPU structure.
703 * @param uExitReason The VM-exit reason.
704 * @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX) if
705 * any. Pass VMXINSTRID_NONE otherwise.
706 * @param fPrimaryOpRead If the primary operand of the ModR/M byte (bits 0:3) is
707 * a read or write.
708 * @param pGCPtrDisp Where to store the displacement field. Optional, can be
709 * NULL.
710 */
711IEM_STATIC uint32_t iemVmxGetExitInstrInfo(PVMCPU pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, bool fPrimaryOpRead,
712 PRTGCPTR pGCPtrDisp)
713{
714 RTGCPTR GCPtrDisp;
715 VMXEXITINSTRINFO ExitInstrInfo;
716 ExitInstrInfo.u = 0;
717
718 /*
719 * Get and parse the ModR/M byte from our decoded opcodes.
720 */
721 uint8_t bRm;
722 uint8_t const offModRm = pVCpu->iem.s.offModRm;
723 IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
724 if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
725 {
726 /*
727 * ModR/M indicates register addressing.
728 *
729 * The primary/secondary register operands are reported in the iReg1 or iReg2
730 * fields depending on whether it is a read/write form.
731 */
732 uint8_t idxReg1;
733 uint8_t idxReg2;
734 if (fPrimaryOpRead)
735 {
736 idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
737 idxReg2 = (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB;
738 }
739 else
740 {
741 idxReg1 = (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB;
742 idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
743 }
744 ExitInstrInfo.All.u2Scaling = 0;
745 ExitInstrInfo.All.iReg1 = idxReg1;
746 ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
747 ExitInstrInfo.All.fIsRegOperand = 1;
748 ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
749 ExitInstrInfo.All.iSegReg = 0;
750 ExitInstrInfo.All.iIdxReg = 0;
751 ExitInstrInfo.All.fIdxRegInvalid = 1;
752 ExitInstrInfo.All.iBaseReg = 0;
753 ExitInstrInfo.All.fBaseRegInvalid = 1;
754 ExitInstrInfo.All.iReg2 = idxReg2;
755
756 /* Displacement not applicable for register addressing. */
757 GCPtrDisp = 0;
758 }
759 else
760 {
761 /*
762 * ModR/M indicates memory addressing.
763 */
764 uint8_t uScale = 0;
765 bool fBaseRegValid = false;
766 bool fIdxRegValid = false;
767 uint8_t iBaseReg = 0;
768 uint8_t iIdxReg = 0;
769 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
770 {
771 /*
772 * Parse the ModR/M, displacement for 16-bit addressing mode.
773 * See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
774 */
775 uint16_t u16Disp = 0;
776 uint8_t const offDisp = offModRm + sizeof(bRm);
777 if ((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 6)
778 {
779 /* Displacement without any registers. */
780 IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
781 }
782 else
783 {
784 /* Register (index and base). */
785 switch (bRm & X86_MODRM_RM_MASK)
786 {
787 case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
788 case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
789 case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
790 case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
791 case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
792 case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
793 case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
794 case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
795 }
796
797 /* Register + displacement. */
798 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
799 {
800 case 0: break;
801 case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
802 case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
803 default:
804 {
805 /* Register addressing, handled at the beginning. */
806 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
807 break;
808 }
809 }
810 }
811
812 Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
813 GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
814 }
815 else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
816 {
817 /*
818 * Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
819 * See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
820 */
821 uint32_t u32Disp = 0;
822 if ((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5)
823 {
824 /* Displacement without any registers. */
825 uint8_t const offDisp = offModRm + sizeof(bRm);
826 IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
827 }
828 else
829 {
830 /* Register (and perhaps scale, index and base). */
831 uint8_t offDisp = offModRm + sizeof(bRm);
832 iBaseReg = (bRm & X86_MODRM_RM_MASK);
833 if (iBaseReg == 4)
834 {
835 /* An SIB byte follows the ModR/M byte, parse it. */
836 uint8_t bSib;
837 uint8_t const offSib = offModRm + sizeof(bRm);
838 IEM_SIB_GET_U8(pVCpu, bSib, offSib);
839
840 /* A displacement may follow SIB, update its offset. */
841 offDisp += sizeof(bSib);
842
843 /* Get the scale. */
844 uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
845
846 /* Get the index register. */
847 iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
848 fIdxRegValid = RT_BOOL(iIdxReg != 4);
849
850 /* Get the base register. */
851 iBaseReg = bSib & X86_SIB_BASE_MASK;
852 fBaseRegValid = true;
853 if (iBaseReg == 5)
854 {
855 if ((bRm & X86_MODRM_MOD_MASK) == 0)
856 {
857 /* Mod is 0 implies a 32-bit displacement with no base. */
858 fBaseRegValid = false;
859 IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
860 }
861 else
862 {
863 /* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
864 iBaseReg = X86_GREG_xBP;
865 }
866 }
867 }
868
869 /* Register + displacement. */
870 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
871 {
872 case 0: /* Handled above */ break;
873 case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
874 case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
875 default:
876 {
877 /* Register addressing, handled at the beginning. */
878 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
879 break;
880 }
881 }
882 }
883
884 GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
885 }
886 else
887 {
888 Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
889
890 /*
891 * Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
892 * See Intel instruction spec. 2.2 "IA-32e Mode".
893 */
894 uint64_t u64Disp = 0;
895 bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5);
896 if (fRipRelativeAddr)
897 {
898 /*
899 * RIP-relative addressing mode.
900 *
901 * The displacment is 32-bit signed implying an offset range of +/-2G.
902 * See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
903 */
904 uint8_t const offDisp = offModRm + sizeof(bRm);
905 IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
906 }
907 else
908 {
909 uint8_t offDisp = offModRm + sizeof(bRm);
910
911 /*
912 * Register (and perhaps scale, index and base).
913 *
914 * REX.B extends the most-significant bit of the base register. However, REX.B
915 * is ignored while determining whether an SIB follows the opcode. Hence, we
916 * shall OR any REX.B bit -after- inspecting for an SIB byte below.
917 *
918 * See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
919 */
920 iBaseReg = (bRm & X86_MODRM_RM_MASK);
921 if (iBaseReg == 4)
922 {
923 /* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
924 uint8_t bSib;
925 uint8_t const offSib = offModRm + sizeof(bRm);
926 IEM_SIB_GET_U8(pVCpu, bSib, offSib);
927
928 /* Displacement may follow SIB, update its offset. */
929 offDisp += sizeof(bSib);
930
931 /* Get the scale. */
932 uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
933
934 /* Get the index. */
935 iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pVCpu->iem.s.uRexIndex;
936 fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
937
938 /* Get the base. */
939 iBaseReg = (bSib & X86_SIB_BASE_MASK);
940 fBaseRegValid = true;
941 if (iBaseReg == 5)
942 {
943 if ((bRm & X86_MODRM_MOD_MASK) == 0)
944 {
945 /* Mod is 0 implies a signed 32-bit displacement with no base. */
946 IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
947 }
948 else
949 {
950 /* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
951 iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
952 }
953 }
954 }
955 iBaseReg |= pVCpu->iem.s.uRexB;
956
957 /* Register + displacement. */
958 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
959 {
960 case 0: /* Handled above */ break;
961 case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
962 case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
963 default:
964 {
965 /* Register addressing, handled at the beginning. */
966 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
967 break;
968 }
969 }
970 }
971
972 GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
973 }
974
975 /*
976 * The primary or secondary register operand is reported in iReg2 depending
977 * on whether the primary operand is in read/write form.
978 */
979 uint8_t idxReg2;
980 if (fPrimaryOpRead)
981 {
982 idxReg2 = bRm & X86_MODRM_RM_MASK;
983 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
984 idxReg2 |= pVCpu->iem.s.uRexB;
985 }
986 else
987 {
988 idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
989 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
990 idxReg2 |= pVCpu->iem.s.uRexReg;
991 }
992 ExitInstrInfo.All.u2Scaling = uScale;
993 ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
994 ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
995 ExitInstrInfo.All.fIsRegOperand = 0;
996 ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
997 ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
998 ExitInstrInfo.All.iIdxReg = iIdxReg;
999 ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
1000 ExitInstrInfo.All.iBaseReg = iBaseReg;
1001 ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
1002 ExitInstrInfo.All.iReg2 = idxReg2;
1003 }
1004
1005 /*
1006 * Handle exceptions to the norm for certain instructions.
1007 * (e.g. some instructions convey an instruction identity in place of iReg2).
1008 */
1009 switch (uExitReason)
1010 {
1011 case VMX_EXIT_GDTR_IDTR_ACCESS:
1012 {
1013 Assert(VMXINSTRID_IS_VALID(uInstrId));
1014 ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
1015 ExitInstrInfo.GdtIdt.u2Undef0 = 0;
1016 break;
1017 }
1018
1019 case VMX_EXIT_LDTR_TR_ACCESS:
1020 {
1021 Assert(VMXINSTRID_IS_VALID(uInstrId));
1022 ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
1023 ExitInstrInfo.LdtTr.u2Undef0 = 0;
1024 break;
1025 }
1026
1027 case VMX_EXIT_RDRAND:
1028 case VMX_EXIT_RDSEED:
1029 {
1030 Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
1031 break;
1032 }
1033 }
1034
1035 /* Update displacement and return the constructed VM-exit instruction information field. */
1036 if (pGCPtrDisp)
1037 *pGCPtrDisp = GCPtrDisp;
1038 return ExitInstrInfo.u;
1039}
1040
1041
1042/**
1043 * Implements VMSucceed for VMX instruction success.
1044 *
1045 * @param pVCpu The cross context virtual CPU structure.
1046 */
1047DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPU pVCpu)
1048{
1049 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1050}
1051
1052
1053/**
1054 * Implements VMFailInvalid for VMX instruction failure.
1055 *
1056 * @param pVCpu The cross context virtual CPU structure.
1057 */
1058DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPU pVCpu)
1059{
1060 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1061 pVCpu->cpum.GstCtx.eflags.u32 |= X86_EFL_CF;
1062}
1063
1064
1065/**
1066 * Implements VMFailValid for VMX instruction failure.
1067 *
1068 * @param pVCpu The cross context virtual CPU structure.
1069 * @param enmInsErr The VM instruction error.
1070 */
1071DECL_FORCE_INLINE(void) iemVmxVmFailValid(PVMCPU pVCpu, VMXINSTRERR enmInsErr)
1072{
1073 if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1074 {
1075 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1076 pVCpu->cpum.GstCtx.eflags.u32 |= X86_EFL_ZF;
1077 /** @todo NSTVMX: VMWrite enmInsErr to VM-instruction error field. */
1078 RT_NOREF(enmInsErr);
1079 }
1080}
1081
1082
1083/**
1084 * Implements VMFail for VMX instruction failure.
1085 *
1086 * @param pVCpu The cross context virtual CPU structure.
1087 * @param enmInsErr The VM instruction error.
1088 */
1089DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPU pVCpu, VMXINSTRERR enmInsErr)
1090{
1091 if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1092 {
1093 iemVmxVmFailValid(pVCpu, enmInsErr);
1094 /** @todo Set VM-instruction error field in the current virtual-VMCS. */
1095 }
1096 else
1097 iemVmxVmFailInvalid(pVCpu);
1098}
1099
1100
1101/**
1102 * Flushes the current VMCS contents back to guest memory.
1103 *
1104 * @returns VBox status code.
1105 * @param pVCpu The cross context virtual CPU structure.
1106 */
1107DECL_FORCE_INLINE(int) iemVmxCommitCurrentVmcsToMemory(PVMCPU pVCpu)
1108{
1109 Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
1110 int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
1111 pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs), sizeof(VMXVVMCS));
1112 IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
1113 return rc;
1114}
1115
1116
1117/**
1118 * Implements VMSucceed for the VMREAD instruction and increments the guest RIP.
1119 *
1120 * @param pVCpu The cross context virtual CPU structure.
1121 */
1122DECL_FORCE_INLINE(void) iemVmxVmreadSuccess(PVMCPU pVCpu, uint8_t cbInstr)
1123{
1124 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_Success;
1125 iemVmxVmSucceed(pVCpu);
1126 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1127}
1128
1129
1130/**
1131 * VMREAD common (memory/register) instruction execution worker
1132 *
1133 * @param pVCpu The cross context virtual CPU structure.
1134 * @param cbInstr The instruction length.
1135 * @param pu64Dst Where to write the VMCS value (only updated when
1136 * VINF_SUCCESS is returned).
1137 * @param u64FieldEnc The VMCS field encoding.
1138 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1139 * be NULL.
1140 */
1141IEM_STATIC VBOXSTRICTRC iemVmxVmreadCommon(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
1142 PCVMXVEXITINFO pExitInfo)
1143{
1144 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1145 {
1146 RT_NOREF(pExitInfo); RT_NOREF(cbInstr);
1147 /** @todo NSTVMX: intercept. */
1148 /** @todo NSTVMX: VMCS shadowing intercept (VMREAD bitmap). */
1149 }
1150
1151 /* CPL. */
1152 if (pVCpu->iem.s.uCpl > 0)
1153 {
1154 Log(("vmread: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1155 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_Cpl;
1156 return iemRaiseGeneralProtectionFault0(pVCpu);
1157 }
1158
1159 /* VMCS pointer in root mode. */
1160 if ( IEM_IS_VMX_ROOT_MODE(pVCpu)
1161 && !IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1162 {
1163 Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
1164 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_PtrInvalid;
1165 iemVmxVmFailInvalid(pVCpu);
1166 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1167 return VINF_SUCCESS;
1168 }
1169
1170 /* VMCS-link pointer in non-root mode. */
1171 if ( IEM_IS_VMX_NON_ROOT_MODE(pVCpu)
1172 && !IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
1173 {
1174 Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
1175 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_LinkPtrInvalid;
1176 iemVmxVmFailInvalid(pVCpu);
1177 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1178 return VINF_SUCCESS;
1179 }
1180
1181 /* Supported VMCS field. */
1182 if (iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
1183 {
1184 Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
1185 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_FieldInvalid;
1186 iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
1187 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1188 return VINF_SUCCESS;
1189 }
1190
1191 /*
1192 * Setup reading from the current or shadow VMCS.
1193 */
1194 uint8_t *pbVmcs;
1195 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1196 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
1197 else
1198 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1199 Assert(pbVmcs);
1200
1201 VMXVMCSFIELDENC FieldEnc;
1202 FieldEnc.u = RT_LO_U32(u64FieldEnc);
1203 uint8_t const uWidth = FieldEnc.n.u2Width;
1204 uint8_t const uType = FieldEnc.n.u2Type;
1205 uint8_t const uWidthType = (uWidth << 2) | uType;
1206 uint8_t const uIndex = FieldEnc.n.u8Index;
1207 AssertRCReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
1208 uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
1209
1210 /*
1211 * Read the VMCS component based on the field's effective width.
1212 *
1213 * The effective width is 64-bit fields adjusted to 32-bits if the access-type
1214 * indicates high bits (little endian).
1215 *
1216 * Note! The caller is responsible to trim the result and update registers
1217 * or memory locations are required. Here we just zero-extend to the largest
1218 * type (i.e. 64-bits).
1219 */
1220 uint8_t *pbField = pbVmcs + offField;
1221 uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
1222 switch (uEffWidth)
1223 {
1224 case VMX_VMCS_ENC_WIDTH_64BIT:
1225 case VMX_VMCS_ENC_WIDTH_NATURAL: *pu64Dst = *(uint64_t *)pbField; break;
1226 case VMX_VMCS_ENC_WIDTH_32BIT: *pu64Dst = *(uint32_t *)pbField; break;
1227 case VMX_VMCS_ENC_WIDTH_16BIT: *pu64Dst = *(uint16_t *)pbField; break;
1228 }
1229 return VINF_SUCCESS;
1230}
1231
1232
1233/**
1234 * VMREAD (64-bit register) instruction execution worker.
1235 *
1236 * @param pVCpu The cross context virtual CPU structure.
1237 * @param cbInstr The instruction length.
1238 * @param pu64Dst Where to store the VMCS field's value.
1239 * @param u64FieldEnc The VMCS field encoding.
1240 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1241 * be NULL.
1242 */
1243IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg64(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
1244 PCVMXVEXITINFO pExitInfo)
1245{
1246 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
1247 if (rcStrict == VINF_SUCCESS)
1248 {
1249 iemVmxVmreadSuccess(pVCpu, cbInstr);
1250 return VINF_SUCCESS;
1251 }
1252
1253 Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1254 return rcStrict;
1255}
1256
1257
1258/**
1259 * VMREAD (32-bit register) instruction execution worker.
1260 *
1261 * @param pVCpu The cross context virtual CPU structure.
1262 * @param cbInstr The instruction length.
1263 * @param pu32Dst Where to store the VMCS field's value.
1264 * @param u32FieldEnc The VMCS field encoding.
1265 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1266 * be NULL.
1267 */
1268IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg32(PVMCPU pVCpu, uint8_t cbInstr, uint32_t *pu32Dst, uint64_t u32FieldEnc,
1269 PCVMXVEXITINFO pExitInfo)
1270{
1271 uint64_t u64Dst;
1272 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32FieldEnc, pExitInfo);
1273 if (rcStrict == VINF_SUCCESS)
1274 {
1275 *pu32Dst = u64Dst;
1276 iemVmxVmreadSuccess(pVCpu, cbInstr);
1277 return VINF_SUCCESS;
1278 }
1279
1280 Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1281 return rcStrict;
1282}
1283
1284
1285/**
1286 * VMREAD (memory) instruction execution worker.
1287 *
1288 * @param pVCpu The cross context virtual CPU structure.
1289 * @param cbInstr The instruction length.
1290 * @param iEffSeg The effective segment register to use with @a u64Val.
1291 * Pass UINT8_MAX if it is a register access.
1292 * @param enmEffAddrMode The effective addressing mode (only used with memory
1293 * operand).
1294 * @param GCPtrDst The guest linear address to store the VMCS field's
1295 * value.
1296 * @param u64FieldEnc The VMCS field encoding.
1297 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1298 * be NULL.
1299 */
1300IEM_STATIC VBOXSTRICTRC iemVmxVmreadMem(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode,
1301 RTGCPTR GCPtrDst, uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
1302{
1303 uint64_t u64Dst;
1304 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64FieldEnc, pExitInfo);
1305 if (rcStrict == VINF_SUCCESS)
1306 {
1307 /*
1308 * Write the VMCS field's value to the location specified in guest-memory.
1309 *
1310 * The pointer size depends on the address size (address-size prefix allowed).
1311 * The operand size depends on IA-32e mode (operand-size prefix not allowed).
1312 */
1313 static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
1314 Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
1315 GCPtrDst &= s_auAddrSizeMasks[enmEffAddrMode];
1316
1317 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
1318 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
1319 else
1320 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
1321 if (rcStrict == VINF_SUCCESS)
1322 {
1323 iemVmxVmreadSuccess(pVCpu, cbInstr);
1324 return VINF_SUCCESS;
1325 }
1326
1327 Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
1328 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_PtrMap;
1329 return rcStrict;
1330 }
1331
1332 Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1333 return rcStrict;
1334}
1335
1336
1337/**
1338 * VMWRITE instruction execution worker.
1339 *
1340 * @param pVCpu The cross context virtual CPU structure.
1341 * @param cbInstr The instruction length.
1342 * @param iEffSeg The effective segment register to use with @a u64Val.
1343 * Pass UINT8_MAX if it is a register access.
1344 * @param enmEffAddrMode The effective addressing mode (only used with memory
1345 * operand).
1346 * @param u64Val The value to write (or guest linear address to the
1347 * value), @a iEffSeg will indicate if it's a memory
1348 * operand.
1349 * @param u64FieldEnc The VMCS field encoding.
1350 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1351 * be NULL.
1352 */
1353IEM_STATIC VBOXSTRICTRC iemVmxVmwrite(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode, uint64_t u64Val,
1354 uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
1355{
1356 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1357 {
1358 RT_NOREF(pExitInfo);
1359 /** @todo NSTVMX: intercept. */
1360 /** @todo NSTVMX: VMCS shadowing intercept (VMWRITE bitmap). */
1361 }
1362
1363 /* CPL. */
1364 if (pVCpu->iem.s.uCpl > 0)
1365 {
1366 Log(("vmwrite: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1367 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_Cpl;
1368 return iemRaiseGeneralProtectionFault0(pVCpu);
1369 }
1370
1371 /* VMCS pointer in root mode. */
1372 if ( IEM_IS_VMX_ROOT_MODE(pVCpu)
1373 && !IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1374 {
1375 Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
1376 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_PtrInvalid;
1377 iemVmxVmFailInvalid(pVCpu);
1378 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1379 return VINF_SUCCESS;
1380 }
1381
1382 /* VMCS-link pointer in non-root mode. */
1383 if ( IEM_IS_VMX_NON_ROOT_MODE(pVCpu)
1384 && !IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
1385 {
1386 Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
1387 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_LinkPtrInvalid;
1388 iemVmxVmFailInvalid(pVCpu);
1389 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1390 return VINF_SUCCESS;
1391 }
1392
1393 /* If the VMWRITE instruction references memory, access the specified memory operand. */
1394 bool const fIsRegOperand = iEffSeg == UINT8_MAX;
1395 if (!fIsRegOperand)
1396 {
1397 static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
1398 Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
1399 RTGCPTR const GCPtrVal = u64Val & s_auAddrSizeMasks[enmEffAddrMode];
1400
1401 /* Read the value from the specified guest memory location. */
1402 VBOXSTRICTRC rcStrict;
1403 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
1404 rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
1405 else
1406 {
1407 uint32_t u32Val;
1408 rcStrict = iemMemFetchDataU32(pVCpu, &u32Val, iEffSeg, GCPtrVal);
1409 u64Val = u32Val;
1410 }
1411 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1412 {
1413 Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
1414 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_PtrMap;
1415 return rcStrict;
1416 }
1417 }
1418 else
1419 Assert(!pExitInfo || pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
1420
1421 /* Supported VMCS field. */
1422 if (!iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
1423 {
1424 Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
1425 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_FieldInvalid;
1426 iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
1427 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1428 return VINF_SUCCESS;
1429 }
1430
1431 /* Read-only VMCS field. */
1432 bool const fReadOnlyField = HMVmxIsVmcsFieldReadOnly(u64FieldEnc);
1433 if ( fReadOnlyField
1434 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
1435 {
1436 Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64FieldEnc));
1437 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_FieldRo;
1438 iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
1439 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1440 return VINF_SUCCESS;
1441 }
1442
1443 /*
1444 * Setup writing to the current or shadow VMCS.
1445 */
1446 uint8_t *pbVmcs;
1447 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1448 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
1449 else
1450 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1451 Assert(pbVmcs);
1452
1453 VMXVMCSFIELDENC FieldEnc;
1454 FieldEnc.u = RT_LO_U32(u64FieldEnc);
1455 uint8_t const uWidth = FieldEnc.n.u2Width;
1456 uint8_t const uType = FieldEnc.n.u2Type;
1457 uint8_t const uWidthType = (uWidth << 2) | uType;
1458 uint8_t const uIndex = FieldEnc.n.u8Index;
1459 AssertRCReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
1460 uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
1461
1462 /*
1463 * Write the VMCS component based on the field's effective width.
1464 *
1465 * The effective width is 64-bit fields adjusted to 32-bits if the access-type
1466 * indicates high bits (little endian).
1467 */
1468 uint8_t *pbField = pbVmcs + offField;
1469 uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
1470 switch (uEffWidth)
1471 {
1472 case VMX_VMCS_ENC_WIDTH_64BIT:
1473 case VMX_VMCS_ENC_WIDTH_NATURAL: *(uint64_t *)pbField = u64Val; break;
1474 case VMX_VMCS_ENC_WIDTH_32BIT: *(uint32_t *)pbField = u64Val; break;
1475 case VMX_VMCS_ENC_WIDTH_16BIT: *(uint16_t *)pbField = u64Val; break;
1476 }
1477
1478 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_Success;
1479 iemVmxVmSucceed(pVCpu);
1480 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1481 return VINF_SUCCESS;
1482}
1483
1484
1485/**
1486 * VMCLEAR instruction execution worker.
1487 *
1488 * @param pVCpu The cross context virtual CPU structure.
1489 * @param cbInstr The instruction length.
1490 * @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
1491 * @param GCPtrVmcs The linear address of the VMCS pointer.
1492 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1493 * be NULL.
1494 *
1495 * @remarks Common VMX instruction checks are already expected to by the caller,
1496 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1497 */
1498IEM_STATIC VBOXSTRICTRC iemVmxVmclear(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1499 PCVMXVEXITINFO pExitInfo)
1500{
1501 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1502 {
1503 RT_NOREF(pExitInfo);
1504 /** @todo NSTVMX: intercept. */
1505 }
1506 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1507
1508 /* CPL. */
1509 if (pVCpu->iem.s.uCpl > 0)
1510 {
1511 Log(("vmclear: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1512 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_Cpl;
1513 return iemRaiseGeneralProtectionFault0(pVCpu);
1514 }
1515
1516 /* Get the VMCS pointer from the location specified by the source memory operand. */
1517 RTGCPHYS GCPhysVmcs;
1518 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
1519 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1520 {
1521 Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
1522 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrMap;
1523 return rcStrict;
1524 }
1525
1526 /* VMCS pointer alignment. */
1527 if (GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK)
1528 {
1529 Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
1530 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrAlign;
1531 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1532 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1533 return VINF_SUCCESS;
1534 }
1535
1536 /* VMCS physical-address width limits. */
1537 Assert(!VMX_V_VMCS_PHYSADDR_4G_LIMIT);
1538 if (GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
1539 {
1540 Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
1541 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrWidth;
1542 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1543 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1544 return VINF_SUCCESS;
1545 }
1546
1547 /* VMCS is not the VMXON region. */
1548 if (GCPhysVmcs == pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
1549 {
1550 Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
1551 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrVmxon;
1552 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
1553 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1554 return VINF_SUCCESS;
1555 }
1556
1557 /* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
1558 restriction imposed by our implementation. */
1559 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
1560 {
1561 Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
1562 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrAbnormal;
1563 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1564 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1565 return VINF_SUCCESS;
1566 }
1567
1568 /*
1569 * VMCLEAR allows committing and clearing any valid VMCS pointer.
1570 *
1571 * If the current VMCS is the one being cleared, set its state to 'clear' and commit
1572 * to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
1573 * to 'clear'.
1574 */
1575 uint8_t const fVmcsStateClear = VMX_V_VMCS_STATE_CLEAR;
1576 if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
1577 {
1578 Assert(GCPhysVmcs != NIL_RTGCPHYS); /* Paranoia. */
1579 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
1580 pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState = fVmcsStateClear;
1581 iemVmxCommitCurrentVmcsToMemory(pVCpu);
1582 Assert(!IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
1583 }
1584 else
1585 {
1586 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPtrVmcs + RT_OFFSETOF(VMXVVMCS, fVmcsState),
1587 (const void *)&fVmcsStateClear, sizeof(fVmcsStateClear));
1588 }
1589
1590 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_Success;
1591 iemVmxVmSucceed(pVCpu);
1592 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1593 return rcStrict;
1594}
1595
1596
1597/**
1598 * VMPTRST instruction execution worker.
1599 *
1600 * @param pVCpu The cross context virtual CPU structure.
1601 * @param cbInstr The instruction length.
1602 * @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
1603 * @param GCPtrVmcs The linear address of where to store the current VMCS
1604 * pointer.
1605 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1606 * be NULL.
1607 *
1608 * @remarks Common VMX instruction checks are already expected to by the caller,
1609 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1610 */
1611IEM_STATIC VBOXSTRICTRC iemVmxVmptrst(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1612 PCVMXVEXITINFO pExitInfo)
1613{
1614 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1615 {
1616 RT_NOREF(pExitInfo);
1617 /** @todo NSTVMX: intercept. */
1618 }
1619 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1620
1621 /* CPL. */
1622 if (pVCpu->iem.s.uCpl > 0)
1623 {
1624 Log(("vmptrst: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1625 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_Cpl;
1626 return iemRaiseGeneralProtectionFault0(pVCpu);
1627 }
1628
1629 /* Set the VMCS pointer to the location specified by the destination memory operand. */
1630 AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
1631 VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
1632 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1633 {
1634 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_Success;
1635 iemVmxVmSucceed(pVCpu);
1636 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1637 return rcStrict;
1638 }
1639
1640 Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1641 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_PtrMap;
1642 return rcStrict;
1643}
1644
1645
1646/**
1647 * VMPTRLD instruction execution worker.
1648 *
1649 * @param pVCpu The cross context virtual CPU structure.
1650 * @param cbInstr The instruction length.
1651 * @param GCPtrVmcs The linear address of the current VMCS pointer.
1652 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1653 * be NULL.
1654 *
1655 * @remarks Common VMX instruction checks are already expected to by the caller,
1656 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1657 */
1658IEM_STATIC VBOXSTRICTRC iemVmxVmptrld(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1659 PCVMXVEXITINFO pExitInfo)
1660{
1661 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1662 {
1663 RT_NOREF(pExitInfo);
1664 /** @todo NSTVMX: intercept. */
1665 }
1666 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1667
1668 /* CPL. */
1669 if (pVCpu->iem.s.uCpl > 0)
1670 {
1671 Log(("vmptrld: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1672 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_Cpl;
1673 return iemRaiseGeneralProtectionFault0(pVCpu);
1674 }
1675
1676 /* Get the VMCS pointer from the location specified by the source memory operand. */
1677 RTGCPHYS GCPhysVmcs;
1678 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
1679 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1680 {
1681 Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
1682 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrMap;
1683 return rcStrict;
1684 }
1685
1686 /* VMCS pointer alignment. */
1687 if (GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK)
1688 {
1689 Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
1690 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrAlign;
1691 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1692 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1693 return VINF_SUCCESS;
1694 }
1695
1696 /* VMCS physical-address width limits. */
1697 Assert(!VMX_V_VMCS_PHYSADDR_4G_LIMIT);
1698 if (GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
1699 {
1700 Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
1701 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrWidth;
1702 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1703 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1704 return VINF_SUCCESS;
1705 }
1706
1707 /* VMCS is not the VMXON region. */
1708 if (GCPhysVmcs == pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
1709 {
1710 Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
1711 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrVmxon;
1712 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
1713 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1714 return VINF_SUCCESS;
1715 }
1716
1717 /* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
1718 restriction imposed by our implementation. */
1719 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
1720 {
1721 Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
1722 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrAbnormal;
1723 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1724 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1725 return VINF_SUCCESS;
1726 }
1727
1728 /* Read the VMCS revision ID from the VMCS. */
1729 VMXVMCSREVID VmcsRevId;
1730 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
1731 if (RT_FAILURE(rc))
1732 {
1733 Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
1734 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrReadPhys;
1735 return rc;
1736 }
1737
1738 /* Verify the VMCS revision specified by the guest matches what we reported to the guest,
1739 also check VMCS shadowing feature. */
1740 if ( VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID
1741 || ( VmcsRevId.n.fIsShadowVmcs
1742 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
1743 {
1744 if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
1745 {
1746 Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFail()\n", VMX_V_VMCS_REVISION_ID,
1747 VmcsRevId.n.u31RevisionId));
1748 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_VmcsRevId;
1749 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
1750 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1751 return VINF_SUCCESS;
1752 }
1753
1754 Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
1755 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_ShadowVmcs;
1756 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
1757 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1758 return VINF_SUCCESS;
1759 }
1760
1761 /*
1762 * We only maintain only the current VMCS in our virtual CPU context (CPUMCTX). Therefore,
1763 * VMPTRLD shall always flush any existing current VMCS back to guest memory before loading
1764 * a new VMCS as current.
1765 */
1766 if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
1767 {
1768 iemVmxCommitCurrentVmcsToMemory(pVCpu);
1769 IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
1770 }
1771 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_Success;
1772 iemVmxVmSucceed(pVCpu);
1773 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1774 return VINF_SUCCESS;
1775}
1776
1777
1778/**
1779 * VMXON instruction execution worker.
1780 *
1781 * @param pVCpu The cross context virtual CPU structure.
1782 * @param cbInstr The instruction length.
1783 * @param iEffSeg The effective segment register to use with @a
1784 * GCPtrVmxon.
1785 * @param GCPtrVmxon The linear address of the VMXON pointer.
1786 * @param pExitInfo Pointer to the VM-exit instruction information struct.
1787 * Optional, can be NULL.
1788 *
1789 * @remarks Common VMX instruction checks are already expected to by the caller,
1790 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1791 */
1792IEM_STATIC VBOXSTRICTRC iemVmxVmxon(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmxon,
1793 PCVMXVEXITINFO pExitInfo)
1794{
1795#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1796 RT_NOREF5(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, pExitInfo);
1797 return VINF_EM_RAW_EMULATE_INSTR;
1798#else
1799 if (!IEM_IS_VMX_ROOT_MODE(pVCpu))
1800 {
1801 /* CPL. */
1802 if (pVCpu->iem.s.uCpl > 0)
1803 {
1804 Log(("vmxon: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1805 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cpl;
1806 return iemRaiseGeneralProtectionFault0(pVCpu);
1807 }
1808
1809 /* A20M (A20 Masked) mode. */
1810 if (!PGMPhysIsA20Enabled(pVCpu))
1811 {
1812 Log(("vmxon: A20M mode -> #GP(0)\n"));
1813 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_A20M;
1814 return iemRaiseGeneralProtectionFault0(pVCpu);
1815 }
1816
1817 /* CR0 fixed bits. */
1818 bool const fUnrestrictedGuest = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxUnrestrictedGuest;
1819 uint64_t const uCr0Fixed0 = fUnrestrictedGuest ? VMX_V_CR0_FIXED0_UX : VMX_V_CR0_FIXED0;
1820 if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) != uCr0Fixed0)
1821 {
1822 Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
1823 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cr0Fixed0;
1824 return iemRaiseGeneralProtectionFault0(pVCpu);
1825 }
1826
1827 /* CR4 fixed bits. */
1828 if ((pVCpu->cpum.GstCtx.cr4 & VMX_V_CR4_FIXED0) != VMX_V_CR4_FIXED0)
1829 {
1830 Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
1831 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cr4Fixed0;
1832 return iemRaiseGeneralProtectionFault0(pVCpu);
1833 }
1834
1835 /* Feature control MSR's LOCK and VMXON bits. */
1836 uint64_t const uMsrFeatCtl = CPUMGetGuestIa32FeatureControl(pVCpu);
1837 if (!(uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK | MSR_IA32_FEATURE_CONTROL_VMXON)))
1838 {
1839 Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
1840 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_MsrFeatCtl;
1841 return iemRaiseGeneralProtectionFault0(pVCpu);
1842 }
1843
1844 /* Get the VMXON pointer from the location specified by the source memory operand. */
1845 RTGCPHYS GCPhysVmxon;
1846 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
1847 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1848 {
1849 Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
1850 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrMap;
1851 return rcStrict;
1852 }
1853
1854 /* VMXON region pointer alignment. */
1855 if (GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK)
1856 {
1857 Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
1858 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrAlign;
1859 iemVmxVmFailInvalid(pVCpu);
1860 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1861 return VINF_SUCCESS;
1862 }
1863
1864 /* VMXON physical-address width limits. */
1865 Assert(!VMX_V_VMCS_PHYSADDR_4G_LIMIT);
1866 if (GCPhysVmxon >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth)
1867 {
1868 Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
1869 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrWidth;
1870 iemVmxVmFailInvalid(pVCpu);
1871 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1872 return VINF_SUCCESS;
1873 }
1874
1875 /* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
1876 restriction imposed by our implementation. */
1877 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
1878 {
1879 Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
1880 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrAbnormal;
1881 iemVmxVmFailInvalid(pVCpu);
1882 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1883 return VINF_SUCCESS;
1884 }
1885
1886 /* Read the VMCS revision ID from the VMXON region. */
1887 VMXVMCSREVID VmcsRevId;
1888 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
1889 if (RT_FAILURE(rc))
1890 {
1891 Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
1892 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrReadPhys;
1893 return rc;
1894 }
1895
1896 /* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
1897 if (RT_UNLIKELY(VmcsRevId.u != VMX_V_VMCS_REVISION_ID))
1898 {
1899 /* Revision ID mismatch. */
1900 if (!VmcsRevId.n.fIsShadowVmcs)
1901 {
1902 Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
1903 VmcsRevId.n.u31RevisionId));
1904 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmcsRevId;
1905 iemVmxVmFailInvalid(pVCpu);
1906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1907 return VINF_SUCCESS;
1908 }
1909
1910 /* Shadow VMCS disallowed. */
1911 Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
1912 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_ShadowVmcs;
1913 iemVmxVmFailInvalid(pVCpu);
1914 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1915 return VINF_SUCCESS;
1916 }
1917
1918 /*
1919 * Record that we're in VMX operation, block INIT, block and disable A20M.
1920 */
1921 pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
1922 IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
1923 pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
1924 /** @todo NSTVMX: clear address-range monitoring. */
1925 /** @todo NSTVMX: Intel PT. */
1926 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Success;
1927 iemVmxVmSucceed(pVCpu);
1928 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1929# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1930 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1931# else
1932 return VINF_SUCCESS;
1933# endif
1934 }
1935 else if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1936 {
1937 RT_NOREF(pExitInfo);
1938 /** @todo NSTVMX: intercept. */
1939 }
1940
1941 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1942
1943 /* CPL. */
1944 if (pVCpu->iem.s.uCpl > 0)
1945 {
1946 Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1947 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmxRootCpl;
1948 return iemRaiseGeneralProtectionFault0(pVCpu);
1949 }
1950
1951 /* VMXON when already in VMX root mode. */
1952 iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
1953 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmxAlreadyRoot;
1954 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1955 return VINF_SUCCESS;
1956#endif
1957}
1958
1959
1960/**
1961 * Clears the high 32-bits of all natural-width fields in the given VMCS.
1962 *
1963 * @param pVmcs Pointer to the virtual VMCS.
1964 */
1965IEM_STATIC void iemVmxVmcsFixNaturalWidthFields(PVMXVVMCS pVmcs)
1966{
1967 /* Natural-width Control fields. */
1968 pVmcs->u64Cr0Mask.s.Hi = 0;
1969 pVmcs->u64Cr4Mask.s.Hi = 0;
1970 pVmcs->u64Cr0ReadShadow.s.Hi = 0;
1971 pVmcs->u64Cr4ReadShadow.s.Hi = 0;
1972 pVmcs->u64Cr3Target0.s.Hi = 0;
1973 pVmcs->u64Cr3Target1.s.Hi = 0;
1974 pVmcs->u64Cr3Target2.s.Hi = 0;
1975 pVmcs->u64Cr3Target3.s.Hi = 0;
1976
1977 /* Natural-width Read-only data fields. */
1978 pVmcs->u64ExitQual.s.Hi = 0;
1979 pVmcs->u64IoRcx.s.Hi = 0;
1980 pVmcs->u64IoRsi.s.Hi = 0;
1981 pVmcs->u64IoRdi.s.Hi = 0;
1982 pVmcs->u64IoRip.s.Hi = 0;
1983 pVmcs->u64GuestLinearAddr.s.Hi = 0;
1984
1985 /* Natural-width Guest-state Fields. */
1986 pVmcs->u64GuestCr0.s.Hi = 0;
1987 pVmcs->u64GuestCr3.s.Hi = 0;
1988 pVmcs->u64GuestCr4.s.Hi = 0;
1989 pVmcs->u64GuestEsBase.s.Hi = 0;
1990 pVmcs->u64GuestCsBase.s.Hi = 0;
1991 pVmcs->u64GuestSsBase.s.Hi = 0;
1992 pVmcs->u64GuestDsBase.s.Hi = 0;
1993 pVmcs->u64GuestFsBase.s.Hi = 0;
1994 pVmcs->u64GuestGsBase.s.Hi = 0;
1995 pVmcs->u64GuestLdtrBase.s.Hi = 0;
1996 pVmcs->u64GuestTrBase.s.Hi = 0;
1997 pVmcs->u64GuestGdtrBase.s.Hi = 0;
1998 pVmcs->u64GuestIdtrBase.s.Hi = 0;
1999 pVmcs->u64GuestDr7.s.Hi = 0;
2000 pVmcs->u64GuestRsp.s.Hi = 0;
2001 pVmcs->u64GuestRip.s.Hi = 0;
2002 pVmcs->u64GuestRFlags.s.Hi = 0;
2003 pVmcs->u64GuestPendingDbgXcpt.s.Hi = 0;
2004 pVmcs->u64GuestSysenterEsp.s.Hi = 0;
2005 pVmcs->u64GuestSysenterEip.s.Hi = 0;
2006
2007 /* Natural-width Host-state fields. */
2008 pVmcs->u64HostCr0.s.Hi = 0;
2009 pVmcs->u64HostCr3.s.Hi = 0;
2010 pVmcs->u64HostCr4.s.Hi = 0;
2011 pVmcs->u64HostFsBase.s.Hi = 0;
2012 pVmcs->u64HostGsBase.s.Hi = 0;
2013 pVmcs->u64HostTrBase.s.Hi = 0;
2014 pVmcs->u64HostGdtrBase.s.Hi = 0;
2015 pVmcs->u64HostIdtrBase.s.Hi = 0;
2016 pVmcs->u64HostSysenterEsp.s.Hi = 0;
2017 pVmcs->u64HostSysenterEip.s.Hi = 0;
2018 pVmcs->u64HostRsp.s.Hi = 0;
2019 pVmcs->u64HostRip.s.Hi = 0;
2020}
2021
2022
2023/**
2024 * Checks host state as part of VM-entry.
2025 *
2026 * @returns VBox status code.
2027 * @param pVCpu The cross context virtual CPU structure.
2028 * @param pszInstr The VMX instruction name (for logging purposes).
2029 */
2030IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckHostState(PVMCPU pVCpu, const char *pszInstr)
2031{
2032 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2033
2034 /*
2035 * Host Control Registers and MSRs.
2036 * See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
2037 */
2038 /* CR0 reserved bits. */
2039 {
2040 /* CR0 MB1 bits. */
2041 uint64_t const u64Cr0Fixed0 = CPUMGetGuestIa32VmxCr0Fixed0(pVCpu);
2042 if (~pVmcs->u64HostCr0.u & u64Cr0Fixed0)
2043 {
2044 Log(("%s: Invalid host CR0 %#RX32 (fixed0) -> VMFail\n", pszInstr, pVmcs->u64HostCr0));
2045 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr0Fixed0;
2046 return VERR_VMX_VMENTRY_FAILED;
2047 }
2048
2049 /* CR0 MBZ bits. */
2050 uint64_t const u64Cr0Fixed1 = CPUMGetGuestIa32VmxCr0Fixed1(pVCpu);
2051 if (pVmcs->u64HostCr0.u & ~u64Cr0Fixed1)
2052 {
2053 Log(("%s: Invalid host CR0 %#RX32 (fixed1) -> VMFail\n", pszInstr, pVmcs->u64HostCr0));
2054 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr0Fixed1;
2055 return VERR_VMX_VMENTRY_FAILED;
2056 }
2057 }
2058
2059 /* CR4 reserved bits. */
2060 {
2061 /* CR4 MB1 bits. */
2062 uint64_t const u64Cr4Fixed0 = CPUMGetGuestIa32VmxCr4Fixed0(pVCpu);
2063 if (~pVmcs->u64HostCr4.u & u64Cr4Fixed0)
2064 {
2065 Log(("%s: Invalid host CR4 %#RX64 (fixed0) -> VMFail\n", pszInstr, pVmcs->u64HostCr4));
2066 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Fixed0;
2067 return VERR_VMX_VMENTRY_FAILED;
2068 }
2069
2070 /* CR4 MBZ bits. */
2071 uint64_t const u64Cr4Fixed1 = CPUMGetGuestIa32VmxCr4Fixed1(pVCpu);
2072 if (pVmcs->u64HostCr4.u & ~u64Cr4Fixed1)
2073 {
2074 Log(("%s: Invalid host CR4 %#RX64 (fixed1) -> VMFail\n", pszInstr, pVmcs->u64HostCr4));
2075 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Fixed1;
2076 return VERR_VMX_VMENTRY_FAILED;
2077 }
2078 }
2079
2080 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2081 {
2082 /* CR3 reserved bits. */
2083 uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
2084 if (pVmcs->u64HostCr3.u >> cMaxPhysAddrWidth)
2085 {
2086 Log(("%s: Invalid host CR3 %#RX64 -> VMFail\n", pszInstr, pVmcs->u64HostCr3));
2087 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr3;
2088 return VERR_VMX_VMENTRY_FAILED;
2089 }
2090
2091 /* SYSENTER ESP and SYSENTER EIP. */
2092 if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
2093 && X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
2094 { /* likely */ }
2095 else
2096 {
2097 Log(("%s: Host Sysenter ESP (%#RX64) / EIP (%#RX64) not canonical -> VMFail\n", pszInstr,
2098 pVmcs->u64HostSysenterEsp.u, pVmcs->u64HostSysenterEip.u));
2099 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSysenterEspEip;
2100 return VERR_VMX_VMENTRY_FAILED;
2101 }
2102 }
2103
2104 Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR)); /* We don't support loading IA32_PERF_GLOBAL_CTRL MSR yet. */
2105
2106 /* PAT MSR. */
2107 if ( (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
2108 && !CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
2109 {
2110 Log(("%s: Host PAT MSR (%#RX64) invalid\n", pszInstr, pVmcs->u64HostPatMsr.u));
2111 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostPatMsr;
2112 return VERR_VMX_VMENTRY_FAILED;
2113 }
2114
2115 /* EFER MSR. */
2116 uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
2117 if ( (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
2118 && (pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
2119 {
2120 Log(("%s: Host EFER MSR (%#RX64) reserved bits set\n", pszInstr, pVmcs->u64HostEferMsr.u));
2121 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostEferMsr;
2122 return VERR_VMX_VMENTRY_FAILED;
2123 }
2124 bool const fVirtHostLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2125 bool const fNstGstLongModeActive = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_BIT_LMA);
2126 bool const fNstGstLongModeEnabled = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_BIT_LME);
2127 if (fVirtHostLongMode == fNstGstLongModeActive == fNstGstLongModeEnabled)
2128 { /* likely */ }
2129 else
2130 {
2131 Log(("%s: Host EFER MSR (%#RX64) LMA, LME, host addr-space size mismatch\n", pszInstr, pVmcs->u64HostEferMsr.u));
2132 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostAddrSpace;
2133 return VERR_VMX_VMENTRY_FAILED;
2134 }
2135
2136 /*
2137 * Host Segment and Descriptor-Table Registers.
2138 * See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
2139 */
2140 /* Selector RPL and TI. */
2141 if ( !(pVmcs->HostCs & (X86_SEL_RPL | X86_SEL_LDT))
2142 && !(pVmcs->HostSs & (X86_SEL_RPL | X86_SEL_LDT))
2143 && !(pVmcs->HostDs & (X86_SEL_RPL | X86_SEL_LDT))
2144 && !(pVmcs->HostEs & (X86_SEL_RPL | X86_SEL_LDT))
2145 && !(pVmcs->HostFs & (X86_SEL_RPL | X86_SEL_LDT))
2146 && !(pVmcs->HostGs & (X86_SEL_RPL | X86_SEL_LDT))
2147 && !(pVmcs->HostTr & (X86_SEL_RPL | X86_SEL_LDT)))
2148 { /* likely */ }
2149 else
2150 {
2151 Log(("%s: One or more host selector registers invalid\n", pszInstr));
2152 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSel;
2153 return VERR_VMX_VMENTRY_FAILED;
2154 }
2155
2156 /* CS and TR selectors cannot be 0. */
2157 if ( pVmcs->HostCs
2158 && pVmcs->HostTr)
2159 { /* likely */ }
2160 else
2161 {
2162 Log(("%s: Host CS/TR selector is invalid\n", pszInstr));
2163 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCsTr;
2164 return VERR_VMX_VMENTRY_FAILED;
2165 }
2166
2167 /* SS cannot be 0 if 32-bit host. */
2168 if ( fVirtHostLongMode
2169 || pVmcs->HostSs)
2170 { /* likely */ }
2171 else
2172 {
2173 Log(("%s: Host SS selector invalid for 32-bit host\n", pszInstr));
2174 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSs;
2175 return VERR_VMX_VMENTRY_FAILED;
2176 }
2177
2178 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2179 {
2180 /* FS, GS, GDTR, IDTR, TR base address. */
2181 if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
2182 && X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
2183 && X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
2184 && X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
2185 && X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
2186 { /* likely */ }
2187 else
2188 {
2189 Log(("%s: Host segment register (FS/GS/GDTR/IDTR/TR) base address is not canonical\n", pszInstr));
2190 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSegBase;
2191 return VERR_VMX_VMENTRY_FAILED;
2192 }
2193
2194 /*
2195 * Host address-space size for 64-bit CPUs.
2196 * See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
2197 */
2198 }
2199 else
2200 {
2201 /* Host address-space size for 32-bit CPUs. */
2202 bool const fNstGstLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
2203 if ( !fNstGstLongMode
2204 && !fVirtHostLongMode)
2205 { /* likely */ }
2206 else
2207 {
2208 Log(("%s: Host/guest cannot be in long mode on 32-bit CPUs\n", pszInstr));
2209 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostGuestLongMode;
2210 return VERR_VMX_VMENTRY_FAILED;
2211 }
2212 }
2213
2214 NOREF(pszInstr);
2215 return VINF_SUCCESS;
2216}
2217
2218
2219/**
2220 * Checks VM-entry controls fields as part of VM-entry.
2221 * See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
2222 *
2223 * @returns VBox status code.
2224 * @param pVCpu The cross context virtual CPU structure.
2225 * @param pszInstr The VMX instruction name (for logging purposes).
2226 */
2227IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckEntryCtls(PVMCPU pVCpu, const char *pszInstr)
2228{
2229 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2230
2231 /* VM-entry controls. */
2232 VMXCTLSMSR EntryCtls;
2233 EntryCtls.u = CPUMGetGuestIa32VmxEntryCtls(pVCpu);
2234 if (~pVmcs->u32EntryCtls & EntryCtls.n.disallowed0)
2235 {
2236 Log(("%s: Invalid EntryCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32EntryCtls));
2237 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryCtlsDisallowed0;
2238 return VERR_VMX_VMENTRY_FAILED;
2239 }
2240 if (pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1)
2241 {
2242 Log(("%s: Invalid EntryCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32EntryCtls));
2243 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryCtlsAllowed1;
2244 return VERR_VMX_VMENTRY_FAILED;
2245 }
2246
2247 /* Event injection. */
2248 uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
2249 if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
2250 {
2251 /* Type and vector. */
2252 uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
2253 uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
2254 uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
2255 if ( uRsvd == 0
2256 && HMVmxIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
2257 && HMVmxIsEntryIntInfoVectorValid(uVector, uType))
2258 { /* likely */ }
2259 else
2260 {
2261 Log(("%s: VM-entry interruption info (%#RX32) invalid (rsvd/type/vector) -> VMFail\n", pszInstr, uIntInfo));
2262 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoTypeVecRsvd;
2263 return VERR_VMX_VMENTRY_FAILED;
2264 }
2265
2266 /* Exception error code. */
2267 if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
2268 {
2269 /* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
2270 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
2271 || (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
2272 { /* likely */ }
2273 else
2274 {
2275 Log(("%s: VM-entry interruption (%#RX32) invalid error-code (paging-mode) -> VMFail\n", pszInstr, uIntInfo));
2276 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoErrCodePe;
2277 return VERR_VMX_VMENTRY_FAILED;
2278 }
2279
2280 /* Exceptions that provide an error code. */
2281 if ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
2282 && ( uVector == X86_XCPT_DF
2283 || uVector == X86_XCPT_TS
2284 || uVector == X86_XCPT_NP
2285 || uVector == X86_XCPT_SS
2286 || uVector == X86_XCPT_GP
2287 || uVector == X86_XCPT_PF
2288 || uVector == X86_XCPT_AC))
2289 { /* likely */ }
2290 else
2291 {
2292 Log(("%s: VM-entry interruption (%#RX32) invalid error-code (vector) -> VMFail\n", pszInstr, uIntInfo));
2293 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoErrCodeVec;
2294 return VERR_VMX_VMENTRY_FAILED;
2295 }
2296
2297 /* Exception error-code reserved bits. */
2298 if (pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK)
2299 {
2300 Log(("%s: VM-entry exception error-code (%#RX32) invalid -> VMFail\n", pszInstr, uIntInfo));
2301 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryXcptErrCodeRsvd;
2302 return VERR_VMX_VMENTRY_FAILED;
2303 }
2304
2305 /* Injecting a software interrupt, software exception or privileged software exception. */
2306 if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
2307 || uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
2308 || uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
2309 {
2310 /* Instruction length must be in the range 0-15. */
2311 if (pVmcs->u32EntryInstrLen > VMX_ENTRY_INSTR_LEN_MAX)
2312 {
2313 Log(("%s: VM-entry instruction length (%#RX32) invalid -> VMFail\n", pszInstr, pVmcs->u32EntryInstrLen));
2314 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryInstrLen;
2315 return VERR_VMX_VMENTRY_FAILED;
2316 }
2317
2318 /* Zero instruction length is allowed only when the CPU supports it explicitly. */
2319 if ( pVmcs->u32EntryInstrLen == 0
2320 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
2321 {
2322 Log(("%s: VM-entry instruction length zero invalid (swint/xcpt/priv) -> VMFail\n", pszInstr));
2323 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryInstrLenZero;
2324 return VERR_VMX_VMENTRY_FAILED;
2325 }
2326 }
2327 }
2328 }
2329
2330 /* VM-entry MSR-load count and VM-entry MSR-load area address. */
2331 uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
2332 if (pVmcs->u32EntryMsrLoadCount)
2333 {
2334 if ( (pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
2335 || (pVmcs->u64AddrEntryMsrLoad.u >> cMaxPhysAddrWidth)
2336 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
2337 {
2338 Log(("%s: VM-entry MSR-load area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrEntryMsrLoad.u));
2339 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrEntryMsrLoad;
2340 return VERR_VMX_VMENTRY_FAILED;
2341 }
2342 }
2343
2344 Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
2345 Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
2346
2347 NOREF(pszInstr);
2348 return VINF_SUCCESS;
2349}
2350
2351
2352/**
2353 * Checks VM-exit controls fields as part of VM-entry.
2354 * See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
2355 *
2356 * @returns VBox status code.
2357 * @param pVCpu The cross context virtual CPU structure.
2358 * @param pszInstr The VMX instruction name (for logging purposes).
2359 */
2360IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckExitCtls(PVMCPU pVCpu, const char *pszInstr)
2361{
2362 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2363
2364 /* VM-exit controls. */
2365 VMXCTLSMSR ExitCtls;
2366 ExitCtls.u = CPUMGetGuestIa32VmxExitCtls(pVCpu);
2367 if (~pVmcs->u32ExitCtls & ExitCtls.n.disallowed0)
2368 {
2369 Log(("%s: Invalid ExitCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2370 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ExitCtlsDisallowed0;
2371 return VERR_VMX_VMENTRY_FAILED;
2372 }
2373 if (pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1)
2374 {
2375 Log(("%s: Invalid ExitCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2376 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ExitCtlsAllowed1;
2377 return VERR_VMX_VMENTRY_FAILED;
2378 }
2379
2380 /* Save preemption timer without activating it. */
2381 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
2382 && (pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
2383 {
2384 Log(("%s: Save Preempt-Timer without activate Preempt timer -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2385 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_SavePreemptTimer;
2386 return VERR_VMX_VMENTRY_FAILED;
2387 }
2388
2389 /* VM-exit MSR-store count and VM-exit MSR-store area address. */
2390 uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
2391 if (pVmcs->u32ExitMsrStoreCount)
2392 {
2393 if ( (pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
2394 || (pVmcs->u64AddrExitMsrStore.u >> cMaxPhysAddrWidth)
2395 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
2396 {
2397 Log(("%s: VM-exit MSR-store area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrExitMsrStore.u));
2398 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrExitMsrStore;
2399 return VERR_VMX_VMENTRY_FAILED;
2400 }
2401 }
2402
2403 /* VM-exit MSR-load count and VM-exit MSR-load area address. */
2404 if (pVmcs->u32ExitMsrLoadCount)
2405 {
2406 if ( (pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
2407 || (pVmcs->u64AddrExitMsrLoad.u >> cMaxPhysAddrWidth)
2408 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
2409 {
2410 Log(("%s: VM-exit MSR-store area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrExitMsrLoad.u));
2411 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrExitMsrLoad;
2412 return VERR_VMX_VMENTRY_FAILED;
2413 }
2414 }
2415
2416 NOREF(pszInstr);
2417 return VINF_SUCCESS;
2418}
2419
2420
2421/**
2422 * Checks VM-execution controls fields as part of VM-entry.
2423 * See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
2424 *
2425 * @returns VBox status code.
2426 * @param pVCpu The cross context virtual CPU structure.
2427 * @param pszInstr The VMX instruction name (for logging purposes).
2428 *
2429 * @remarks This may update secondary-processor based VM-execution control fields
2430 * in the current VMCS if necessary.
2431 */
2432IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckExecCtls(PVMCPU pVCpu, const char *pszInstr)
2433{
2434 PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2435 /* Pin-based VM-execution controls. */
2436 {
2437 VMXCTLSMSR PinCtls;
2438 PinCtls.u = CPUMGetGuestIa32VmxPinbasedCtls(pVCpu);
2439 if (~pVmcs->u32PinCtls & PinCtls.n.disallowed0)
2440 {
2441 Log(("%s: Invalid PinCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32PinCtls));
2442 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PinCtlsDisallowed0;
2443 return VERR_VMX_VMENTRY_FAILED;
2444 }
2445 if (pVmcs->u32PinCtls & ~PinCtls.n.allowed1)
2446 {
2447 Log(("%s: Invalid PinCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32PinCtls));
2448 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PinCtlsAllowed1;
2449 return VERR_VMX_VMENTRY_FAILED;
2450 }
2451 }
2452
2453 /* Processor-based VM-execution controls. */
2454 {
2455 VMXCTLSMSR ProcCtls;
2456 ProcCtls.u = CPUMGetGuestIa32VmxProcbasedCtls(pVCpu);
2457 if (~pVmcs->u32ProcCtls & ProcCtls.n.disallowed0)
2458 {
2459 Log(("%s: Invalid ProcCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls));
2460 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtlsDisallowed0;
2461 return VERR_VMX_VMENTRY_FAILED;
2462 }
2463 if (pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1)
2464 {
2465 Log(("%s: Invalid ProcCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls));
2466 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtlsAllowed1;
2467 return VERR_VMX_VMENTRY_FAILED;
2468 }
2469 }
2470
2471 /* Secondary processor-based VM-execution controls. */
2472 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
2473 {
2474 VMXCTLSMSR ProcCtls2;
2475 ProcCtls2.u = CPUMGetGuestIa32VmxProcbasedCtls(pVCpu);
2476 if (~pVmcs->u32ProcCtls2 & ProcCtls2.n.disallowed0)
2477 {
2478 Log(("%s: Invalid ProcCtls2 %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls2));
2479 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtls2Disallowed0;
2480 return VERR_VMX_VMENTRY_FAILED;
2481 }
2482 if (pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1)
2483 {
2484 Log(("%s: Invalid ProcCtls2 %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls2));
2485 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtls2Allowed1;
2486 return VERR_VMX_VMENTRY_FAILED;
2487 }
2488 }
2489 else
2490 {
2491 /*
2492 * The guest is always capable of corrupting the VMCS by writing to the VMCS is guest
2493 * memory directly rather than follow the rules. So we don't make any assumptions that
2494 * u32ProcCtls2 will be 0 if no secondary-processor based VM-execution control support
2495 * is reported to the guest.
2496 */
2497 pVmcs->u32ProcCtls2 = 0;
2498 }
2499
2500 /* CR3-target count. */
2501 if (pVmcs->u32Cr3TargetCount > VMX_V_CR3_TARGET_COUNT)
2502 {
2503 Log(("%s: CR3-target count exceeded %#x -> VMFail\n", pszInstr, pVmcs->u32Cr3TargetCount));
2504 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Cr3TargetCount;
2505 return VERR_VMX_VMENTRY_FAILED;
2506 }
2507
2508 /* IO bitmaps physical addresses. */
2509 uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
2510 Assert(!VMX_V_VMCS_PHYSADDR_4G_LIMIT);
2511 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
2512 {
2513 if ( (pVmcs->u64AddrIoBitmapA.u & X86_PAGE_4K_OFFSET_MASK)
2514 || (pVmcs->u64AddrIoBitmapA.u >> cMaxPhysAddrWidth)
2515 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapA.u))
2516 {
2517 Log(("%s: I/O Bitmap A physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrIoBitmapA.u));
2518 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrIoBitmapA;
2519 return VERR_VMX_VMENTRY_FAILED;
2520 }
2521
2522 if ( (pVmcs->u64AddrIoBitmapB.u & X86_PAGE_4K_OFFSET_MASK)
2523 || (pVmcs->u64AddrIoBitmapB.u >> cMaxPhysAddrWidth)
2524 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapB.u))
2525 {
2526 Log(("%s: I/O Bitmap B physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrIoBitmapB.u));
2527 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrIoBitmapB;
2528 return VERR_VMX_VMENTRY_FAILED;
2529 }
2530 }
2531
2532 /* MSR bitmap physical address. */
2533 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
2534 {
2535 if ( (pVmcs->u64AddrMsrBitmap.u & X86_PAGE_4K_OFFSET_MASK)
2536 || (pVmcs->u64AddrMsrBitmap.u >> cMaxPhysAddrWidth)
2537 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrMsrBitmap.u))
2538 {
2539 Log(("%s: MSR Bitmap physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrMsrBitmap.u));
2540 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrMsrBitmap;
2541 return VERR_VMX_VMENTRY_FAILED;
2542 }
2543 }
2544
2545 /* TPR shadow related controls. */
2546 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
2547 {
2548 /* Virtual-APIC page physical address. */
2549 RTGCPHYS GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
2550 if ( (GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
2551 || (GCPhysVirtApic >> cMaxPhysAddrWidth)
2552 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
2553 {
2554 Log(("%s: Virtual-APIC page physaddr invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVirtApic));
2555 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVirtApicPage;
2556 return VERR_VMX_VMENTRY_FAILED;
2557 }
2558
2559 /* Read the Virtual-APIC page. */
2560 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage));
2561 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage),
2562 GCPhysVirtApic, VMX_V_VIRT_APIC_PAGES);
2563 if (RT_FAILURE(rc))
2564 {
2565 Log(("%s: Failed to read Virtual-APIC page at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVirtApic, rc));
2566 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtApicPagePtrReadPhys;
2567 return rc;
2568 }
2569
2570 /* TPR threshold without virtual-interrupt delivery. */
2571 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2572 && (pVmcs->u32TprThreshold & VMX_TPR_THRESHOLD_MASK))
2573 {
2574 Log(("%s: TPR-threshold (%#RX32) invalid -> VMFail\n", pszInstr, pVmcs->u32TprThreshold));
2575 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_TprThreshold;
2576 return VERR_VMX_VMENTRY_FAILED;
2577 }
2578
2579 /* TPR threshold and VTPR. */
2580 uint8_t const *pbVirtApic = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage);
2581 uint8_t const u8VTpr = *(pbVirtApic + XAPIC_OFF_TPR);
2582 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
2583 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2584 && RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) > ((u8VTpr >> 4) & UINT32_C(0xf)) /* Bits 4:7 */)
2585 {
2586 Log(("%s: TPR-threshold (%#x) exceeds VTPR (%#x) -> VMFail\n", pszInstr,
2587 (pVmcs->u32TprThreshold & VMX_TPR_THRESHOLD_MASK), u8VTpr));
2588 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_TprThresholdVTpr;
2589 return VERR_VMX_VMENTRY_FAILED;
2590 }
2591 }
2592 else
2593 {
2594 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2595 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
2596 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
2597 { /* likely */ }
2598 else
2599 {
2600 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2601 {
2602 Log(("%s: Virtualize x2APIC access without TPR shadowing -> VMFail\n", pszInstr));
2603 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicTprShadow;
2604 return VERR_VMX_VMENTRY_FAILED;
2605 }
2606 else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
2607 {
2608 Log(("%s: APIC-register virtualization without TPR shadowing -> VMFail\n", pszInstr));
2609 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ApicRegVirt;
2610 return VERR_VMX_VMENTRY_FAILED;
2611 }
2612 else
2613 {
2614 Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
2615 Log(("%s: Virtual-interrupt delivery without TPR shadowing -> VMFail\n", pszInstr));
2616 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtIntDelivery;
2617 return VERR_VMX_VMENTRY_FAILED;
2618 }
2619 }
2620 }
2621
2622 /* NMI exiting and virtual-NMIs. */
2623 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
2624 && (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
2625 {
2626 Log(("%s: Virtual-NMIs invalid without NMI-exiting -> VMFail\n", pszInstr));
2627 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtNmi;
2628 return VERR_VMX_VMENTRY_FAILED;
2629 }
2630
2631 /* Virtual-NMIs and NMI-window exiting. */
2632 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
2633 && (pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
2634 {
2635 Log(("%s: NMI-window exiting invalid without virtual-NMIs -> VMFail\n", pszInstr));
2636 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_NmiWindowExit;
2637 return VERR_VMX_VMENTRY_FAILED;
2638 }
2639
2640 /* Virtualize APIC accesses. */
2641 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
2642 {
2643 /* APIC-access physical address. */
2644 RTGCPHYS GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
2645 if ( (GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
2646 || (GCPhysApicAccess >> cMaxPhysAddrWidth)
2647 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
2648 {
2649 Log(("%s: APIC-access address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysApicAccess));
2650 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrApicAccess;
2651 return VERR_VMX_VMENTRY_FAILED;
2652 }
2653 }
2654
2655 /* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
2656 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2657 && (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
2658 {
2659 Log(("%s: Virtualize-APIC access when virtualize-x2APIC mode is enabled -> VMFail", pszInstr));
2660 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicVirtApic;
2661 return VERR_VMX_VMENTRY_FAILED;
2662 }
2663
2664 /* Virtual-interrupt delivery requires external interrupt exiting. */
2665 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2666 && !(pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
2667 {
2668 Log(("%s: Virtual-interrupt delivery without external interrupt exiting -> VMFail\n", pszInstr));
2669 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicVirtApic;
2670 return VERR_VMX_VMENTRY_FAILED;
2671 }
2672
2673 /* VPID. */
2674 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
2675 && pVmcs->u16Vpid == 0)
2676 {
2677 Log(("%s: VPID invalid -> VMFail\n", pszInstr));
2678 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Vpid;
2679 return VERR_VMX_VMENTRY_FAILED;
2680 }
2681
2682 Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
2683 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)); /* We don't support EPT yet. */
2684 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
2685 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)); /* We don't support Unrestricted-guests yet. */
2686 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
2687 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_VE)); /* We don't support EPT-violation #VE yet. */
2688
2689 /* VMCS shadowing. */
2690 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
2691 {
2692 /* VMREAD-bitmap physical address. */
2693 RTGCPHYS GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
2694 if ( ( GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
2695 || ( GCPhysVmreadBitmap >> cMaxPhysAddrWidth)
2696 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
2697 {
2698 Log(("%s: VMREAD-bitmap address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVmreadBitmap));
2699 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVmreadBitmap;
2700 return VERR_VMX_VMENTRY_FAILED;
2701 }
2702
2703 /* VMWRITE-bitmap physical address. */
2704 RTGCPHYS GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
2705 if ( ( GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
2706 || ( GCPhysVmwriteBitmap >> cMaxPhysAddrWidth)
2707 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
2708 {
2709 Log(("%s: VMWRITE-bitmap address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVmwriteBitmap));
2710 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVmwriteBitmap;
2711 return VERR_VMX_VMENTRY_FAILED;
2712 }
2713
2714 /* Read the VMREAD-bitmap. */
2715 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap));
2716 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap),
2717 GCPhysVmreadBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
2718 if (RT_FAILURE(rc))
2719 {
2720 Log(("%s: Failed to read VMREAD-bitmap at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmreadBitmap, rc));
2721 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmreadBitmapPtrReadPhys;
2722 return rc;
2723 }
2724
2725 /* Read the VMWRITE-bitmap. */
2726 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap));
2727 rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap),
2728 GCPhysVmwriteBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
2729 if (RT_FAILURE(rc))
2730 {
2731 Log(("%s: Failed to read VMWRITE-bitmap at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmwriteBitmap, rc));
2732 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmwriteBitmapPtrReadPhys;
2733 return rc;
2734 }
2735 }
2736
2737 NOREF(pszInstr);
2738 return VINF_SUCCESS;
2739}
2740
2741
2742/**
2743 * VMLAUNCH/VMRESUME instruction execution worker.
2744 *
2745 * @param pVCpu The cross context virtual CPU structure.
2746 * @param cbInstr The instruction length.
2747 * @param uInstrId The instruction identity (either VMXINSTRID_VMLAUNCH or
2748 * VMXINSTRID_VMRESUME).
2749 * @param pExitInfo Pointer to the VM-exit instruction information struct.
2750 * Optional, can be NULL.
2751 *
2752 * @remarks Common VMX instruction checks are already expected to by the caller,
2753 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
2754 */
2755IEM_STATIC VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPU pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId, PCVMXVEXITINFO pExitInfo)
2756{
2757 Assert( uInstrId == VMXINSTRID_VMLAUNCH
2758 || uInstrId == VMXINSTRID_VMRESUME);
2759
2760 const char *pszInstr = uInstrId == VMXINSTRID_VMLAUNCH ? "vmlaunch" : "vmresume";
2761 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
2762 {
2763 RT_NOREF(pExitInfo);
2764 /** @todo NSTVMX: intercept. */
2765 }
2766 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
2767
2768 /* CPL. */
2769 if (pVCpu->iem.s.uCpl > 0)
2770 {
2771 Log(("%s: CPL %u -> #GP(0)\n", pszInstr, pVCpu->iem.s.uCpl));
2772 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Cpl;
2773 return iemRaiseGeneralProtectionFault0(pVCpu);
2774 }
2775
2776 /* Current VMCS valid. */
2777 if (!IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
2778 {
2779 Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
2780 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PtrInvalid;
2781 iemVmxVmFailInvalid(pVCpu);
2782 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2783 return VINF_SUCCESS;
2784 }
2785
2786 /** @todo Distinguish block-by-MOV-SS from block-by-STI. Currently we
2787 * use block-by-STI here which is not quite correct. */
2788 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
2789 && pVCpu->cpum.GstCtx.rip == EMGetInhibitInterruptsPC(pVCpu))
2790 {
2791 Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
2792 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_BlocKMovSS;
2793 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
2794 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2795 return VINF_SUCCESS;
2796 }
2797
2798 if (uInstrId == VMXINSTRID_VMLAUNCH)
2799 {
2800 /* VMLAUNCH with non-clear VMCS. */
2801 if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState != VMX_V_VMCS_STATE_CLEAR)
2802 {
2803 Log(("vmlaunch: VMLAUNCH with non-clear VMCS -> VMFail\n"));
2804 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmcsClear;
2805 iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
2806 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2807 return VINF_SUCCESS;
2808 }
2809 }
2810 else
2811 {
2812 /* VMRESUME with non-launched VMCS. */
2813 if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState != VMX_V_VMCS_STATE_LAUNCHED)
2814 {
2815 Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
2816 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmcsLaunch;
2817 iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
2818 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2819 return VINF_SUCCESS;
2820 }
2821 }
2822
2823 /*
2824 * Load the current VMCS.
2825 */
2826 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
2827 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs),
2828 IEM_VMX_GET_CURRENT_VMCS(pVCpu), VMX_V_VMCS_SIZE);
2829 if (RT_FAILURE(rc))
2830 {
2831 Log(("%s: Failed to read VMCS at %#RGp, rc=%Rrc\n", pszInstr, rc));
2832 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PtrReadPhys;
2833 return rc;
2834 }
2835
2836 /*
2837 * Clear the high 32-bits of all natural-width fields in the VMCS if the guest
2838 * does not support long mode.
2839 */
2840 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2841 iemVmxVmcsFixNaturalWidthFields(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
2842
2843 /*
2844 * Check VM-execution control fields.
2845 */
2846 rc = iemVmxVmentryCheckExecCtls(pVCpu, pszInstr);
2847 if (rc == VINF_SUCCESS)
2848 { /* likely */ }
2849 else
2850 {
2851 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2852 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2853 return VINF_SUCCESS;
2854 }
2855
2856 /*
2857 * Check VM-exit control fields.
2858 */
2859 rc = iemVmxVmentryCheckExitCtls(pVCpu, pszInstr);
2860 if (rc == VINF_SUCCESS)
2861 { /* likely */ }
2862 else
2863 {
2864 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2865 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2866 return VINF_SUCCESS;
2867 }
2868
2869 /*
2870 * Check VM-entry control fields.
2871 */
2872 rc = iemVmxVmentryCheckEntryCtls(pVCpu, pszInstr);
2873 if (rc == VINF_SUCCESS)
2874 { /* likely */ }
2875 else
2876 {
2877 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2878 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2879 return VINF_SUCCESS;
2880 }
2881
2882 /*
2883 * Check host-state fields.
2884 */
2885 rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
2886 if (rc == VINF_SUCCESS)
2887 { /* likely */ }
2888 else
2889 {
2890 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
2891 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2892 return VINF_SUCCESS;
2893 }
2894
2895 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Success;
2896 iemVmxVmSucceed(pVCpu);
2897 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2898 return VERR_IEM_IPE_2;
2899}
2900
2901
2902/**
2903 * Implements 'VMXON'.
2904 */
2905IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
2906{
2907 return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
2908}
2909
2910
2911/**
2912 * Implements 'VMXOFF'.
2913 *
2914 * @remarks Common VMX instruction checks are already expected to by the caller,
2915 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
2916 */
2917IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
2918{
2919# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2920 RT_NOREF2(pVCpu, cbInstr);
2921 return VINF_EM_RAW_EMULATE_INSTR;
2922# else
2923 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
2924 {
2925 /** @todo NSTVMX: intercept. */
2926 }
2927
2928 /* CPL. */
2929 if (pVCpu->iem.s.uCpl > 0)
2930 {
2931 Log(("vmxoff: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
2932 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxoff_Cpl;
2933 return iemRaiseGeneralProtectionFault0(pVCpu);
2934 }
2935
2936 /* Dual monitor treatment of SMIs and SMM. */
2937 uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
2938 if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID)
2939 {
2940 iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
2941 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2942 return VINF_SUCCESS;
2943 }
2944
2945 /*
2946 * Record that we're no longer in VMX root operation, block INIT, block and disable A20M.
2947 */
2948 pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
2949 Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
2950
2951 if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
2952 { /** @todo NSTVMX: Unblock SMI. */ }
2953 /** @todo NSTVMX: Unblock and enable A20M. */
2954 /** @todo NSTVMX: Clear address-range monitoring. */
2955
2956 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxoff_Success;
2957 iemVmxVmSucceed(pVCpu);
2958 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2959# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2960 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2961# else
2962 return VINF_SUCCESS;
2963# endif
2964# endif
2965}
2966
2967
2968/**
2969 * Implements 'VMLAUNCH'.
2970 */
2971IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
2972{
2973 return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH, NULL /* pExitInfo */);
2974}
2975
2976
2977/**
2978 * Implements 'VMRESUME'.
2979 */
2980IEM_CIMPL_DEF_0(iemCImpl_vmresume)
2981{
2982 return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME, NULL /* pExitInfo */);
2983}
2984
2985
2986/**
2987 * Implements 'VMPTRLD'.
2988 */
2989IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
2990{
2991 return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
2992}
2993
2994
2995/**
2996 * Implements 'VMPTRST'.
2997 */
2998IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
2999{
3000 return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
3001}
3002
3003
3004/**
3005 * Implements 'VMCLEAR'.
3006 */
3007IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
3008{
3009 return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
3010}
3011
3012
3013/**
3014 * Implements 'VMWRITE' register.
3015 */
3016IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64FieldEnc)
3017{
3018 return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg */, IEMMODE_64BIT /* N/A */, u64Val, u64FieldEnc,
3019 NULL /* pExitInfo */);
3020}
3021
3022
3023/**
3024 * Implements 'VMWRITE' memory.
3025 */
3026IEM_CIMPL_DEF_4(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrVal, uint32_t, u64FieldEnc)
3027{
3028 return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrVal, u64FieldEnc, NULL /* pExitInfo */);
3029}
3030
3031
3032/**
3033 * Implements 'VMREAD' 64-bit register.
3034 */
3035IEM_CIMPL_DEF_2(iemCImpl_vmread64_reg, uint64_t *, pu64Dst, uint64_t, u64FieldEnc)
3036{
3037 return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, NULL /* pExitInfo */);
3038}
3039
3040
3041/**
3042 * Implements 'VMREAD' 32-bit register.
3043 */
3044IEM_CIMPL_DEF_2(iemCImpl_vmread32_reg, uint32_t *, pu32Dst, uint32_t, u32FieldEnc)
3045{
3046 return iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u32FieldEnc, NULL /* pExitInfo */);
3047}
3048
3049
3050/**
3051 * Implements 'VMREAD' memory.
3052 */
3053IEM_CIMPL_DEF_4(iemCImpl_vmread_mem, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrDst, uint32_t, u64FieldEnc)
3054{
3055 return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrDst, u64FieldEnc, NULL /* pExitInfo */);
3056}
3057
3058#endif
3059
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette