VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h@ 74121

Last change on this file since 74121 was 74114, checked in by vboxsync, 6 years ago

VMM/IEM: Nested VMX: bugref:9180 vmlaunch/vmresume bits.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 128.1 KB
Line 
1/* $Id: IEMAllCImplVmxInstr.cpp.h 74114 2018-09-06 12:10:09Z vboxsync $ */
2/** @file
3 * IEM - VT-x instruction implementation.
4 */
5
6/*
7 * Copyright (C) 2011-2018 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/**
20 * Implements 'VMCALL'.
21 */
22IEM_CIMPL_DEF_0(iemCImpl_vmcall)
23{
24 /** @todo NSTVMX: intercept. */
25
26 /* Join forces with vmmcall. */
27 return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
28}
29
30#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
31/**
32 * Map of VMCS field encodings to their virtual-VMCS structure offsets.
33 *
34 * The first array dimension is VMCS field encoding of Width OR'ed with Type and the
35 * second dimension is the Index, see VMXVMCSFIELDENC.
36 */
37uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
38{
39 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
40 {
41 /* 0 */ RT_OFFSETOF(VMXVVMCS, u16Vpid),
42 /* 1 */ RT_OFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
43 /* 2 */ RT_OFFSETOF(VMXVVMCS, u16EptpIndex),
44 /* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
45 /* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
46 /* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
47 },
48 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
49 {
50 /* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
51 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
52 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
53 /* 24-25 */ UINT16_MAX, UINT16_MAX
54 },
55 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
56 {
57 /* 0 */ RT_OFFSETOF(VMXVVMCS, GuestEs),
58 /* 1 */ RT_OFFSETOF(VMXVVMCS, GuestCs),
59 /* 2 */ RT_OFFSETOF(VMXVVMCS, GuestSs),
60 /* 3 */ RT_OFFSETOF(VMXVVMCS, GuestDs),
61 /* 4 */ RT_OFFSETOF(VMXVVMCS, GuestFs),
62 /* 5 */ RT_OFFSETOF(VMXVVMCS, GuestGs),
63 /* 6 */ RT_OFFSETOF(VMXVVMCS, GuestLdtr),
64 /* 7 */ RT_OFFSETOF(VMXVVMCS, GuestTr),
65 /* 8 */ RT_OFFSETOF(VMXVVMCS, u16GuestIntStatus),
66 /* 9 */ RT_OFFSETOF(VMXVVMCS, u16PmlIndex),
67 /* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
68 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
69 },
70 /* VMX_VMCS_ENC_WIDTH_16BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
71 {
72 /* 0 */ RT_OFFSETOF(VMXVVMCS, HostEs),
73 /* 1 */ RT_OFFSETOF(VMXVVMCS, HostCs),
74 /* 2 */ RT_OFFSETOF(VMXVVMCS, HostSs),
75 /* 3 */ RT_OFFSETOF(VMXVVMCS, HostDs),
76 /* 4 */ RT_OFFSETOF(VMXVVMCS, HostFs),
77 /* 5 */ RT_OFFSETOF(VMXVVMCS, HostGs),
78 /* 6 */ RT_OFFSETOF(VMXVVMCS, HostTr),
79 /* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
80 /* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
81 /* 23-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
82 },
83 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
84 {
85 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
86 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
87 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
88 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
89 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
90 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
91 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
92 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64AddrPml),
93 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64TscOffset),
94 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64AddrVirtApic),
95 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64AddrApicAccess),
96 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
97 /* 12 */ RT_OFFSETOF(VMXVVMCS, u64VmFuncCtls),
98 /* 13 */ RT_OFFSETOF(VMXVVMCS, u64EptpPtr),
99 /* 14 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
100 /* 15 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
101 /* 16 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
102 /* 17 */ RT_OFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
103 /* 18 */ RT_OFFSETOF(VMXVVMCS, u64AddrEptpList),
104 /* 19 */ RT_OFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
105 /* 20 */ RT_OFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
106 /* 21 */ RT_OFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
107 /* 22 */ RT_OFFSETOF(VMXVVMCS, u64AddrXssBitmap),
108 /* 23 */ RT_OFFSETOF(VMXVVMCS, u64AddrEnclsBitmap),
109 /* 24 */ UINT16_MAX,
110 /* 25 */ RT_OFFSETOF(VMXVVMCS, u64TscMultiplier)
111 },
112 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
113 {
114 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64GuestPhysAddr),
115 /* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
116 /* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
117 /* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
118 /* 25 */ UINT16_MAX
119 },
120 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
121 {
122 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
123 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
124 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64GuestPatMsr),
125 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64GuestEferMsr),
126 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
127 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte0),
128 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte1),
129 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte2),
130 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64GuestPdpte3),
131 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
132 /* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
133 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
134 },
135 /* VMX_VMCS_ENC_WIDTH_64BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
136 {
137 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64HostPatMsr),
138 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64HostEferMsr),
139 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
140 /* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
141 /* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
142 /* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
143 },
144 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_CONTROL: */
145 {
146 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32PinCtls),
147 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32ProcCtls),
148 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32XcptBitmap),
149 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32XcptPFMask),
150 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32XcptPFMatch),
151 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32Cr3TargetCount),
152 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32ExitCtls),
153 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
154 /* 8 */ RT_OFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
155 /* 9 */ RT_OFFSETOF(VMXVVMCS, u32EntryCtls),
156 /* 10 */ RT_OFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
157 /* 11 */ RT_OFFSETOF(VMXVVMCS, u32EntryIntInfo),
158 /* 12 */ RT_OFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
159 /* 13 */ RT_OFFSETOF(VMXVVMCS, u32EntryInstrLen),
160 /* 14 */ RT_OFFSETOF(VMXVVMCS, u32TprThreshold),
161 /* 15 */ RT_OFFSETOF(VMXVVMCS, u32ProcCtls2),
162 /* 16 */ RT_OFFSETOF(VMXVVMCS, u32PleGap),
163 /* 17 */ RT_OFFSETOF(VMXVVMCS, u32PleWindow),
164 /* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
165 },
166 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
167 {
168 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32RoVmInstrError),
169 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32RoExitReason),
170 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32RoExitIntInfo),
171 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32RoExitErrCode),
172 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
173 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
174 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32RoExitInstrLen),
175 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
176 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
177 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
178 /* 24-25 */ UINT16_MAX, UINT16_MAX
179 },
180 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
181 {
182 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsLimit),
183 /* 1 */ RT_OFFSETOF(VMXVVMCS, u32GuestCsLimit),
184 /* 2 */ RT_OFFSETOF(VMXVVMCS, u32GuestSsLimit),
185 /* 3 */ RT_OFFSETOF(VMXVVMCS, u32GuestDsLimit),
186 /* 4 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsLimit),
187 /* 5 */ RT_OFFSETOF(VMXVVMCS, u32GuestFsLimit),
188 /* 6 */ RT_OFFSETOF(VMXVVMCS, u32GuestGsLimit),
189 /* 7 */ RT_OFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
190 /* 8 */ RT_OFFSETOF(VMXVVMCS, u32GuestTrLimit),
191 /* 9 */ RT_OFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
192 /* 10 */ RT_OFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
193 /* 11 */ RT_OFFSETOF(VMXVVMCS, u32GuestEsAttr),
194 /* 12 */ RT_OFFSETOF(VMXVVMCS, u32GuestCsAttr),
195 /* 13 */ RT_OFFSETOF(VMXVVMCS, u32GuestSsAttr),
196 /* 14 */ RT_OFFSETOF(VMXVVMCS, u32GuestDsAttr),
197 /* 15 */ RT_OFFSETOF(VMXVVMCS, u32GuestFsAttr),
198 /* 16 */ RT_OFFSETOF(VMXVVMCS, u32GuestGsAttr),
199 /* 17 */ RT_OFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
200 /* 18 */ RT_OFFSETOF(VMXVVMCS, u32GuestTrAttr),
201 /* 19 */ RT_OFFSETOF(VMXVVMCS, u32GuestIntrState),
202 /* 20 */ RT_OFFSETOF(VMXVVMCS, u32GuestActivityState),
203 /* 21 */ RT_OFFSETOF(VMXVVMCS, u32GuestSmBase),
204 /* 22 */ RT_OFFSETOF(VMXVVMCS, u32GuestSysenterCS),
205 /* 23 */ RT_OFFSETOF(VMXVVMCS, u32PreemptTimer),
206 /* 24-25 */ UINT16_MAX, UINT16_MAX
207 },
208 /* VMX_VMCS_ENC_WIDTH_32BIT | VMX_VMCS_ENC_TYPE_HOST_STATE: */
209 {
210 /* 0 */ RT_OFFSETOF(VMXVVMCS, u32HostSysenterCs),
211 /* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
212 /* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
213 /* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
214 /* 25 */ UINT16_MAX
215 },
216 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_CONTROL: */
217 {
218 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64Cr0Mask),
219 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64Cr4Mask),
220 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
221 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
222 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target0),
223 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target1),
224 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target2),
225 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64Cr3Target3),
226 /* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
227 /* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
228 /* 24-25 */ UINT16_MAX, UINT16_MAX
229 },
230 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
231 {
232 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64ExitQual),
233 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64IoRcx),
234 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64IoRsi),
235 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64IoRdi),
236 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64IoRip),
237 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestLinearAddr),
238 /* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
239 /* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
240 /* 22-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
241 },
242 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_GUEST_STATE: */
243 {
244 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr0),
245 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr3),
246 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64GuestCr4),
247 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64GuestEsBase),
248 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64GuestCsBase),
249 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64GuestSsBase),
250 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64GuestDsBase),
251 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64GuestFsBase),
252 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64GuestGsBase),
253 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64GuestLdtrBase),
254 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64GuestTrBase),
255 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64GuestGdtrBase),
256 /* 12 */ RT_OFFSETOF(VMXVVMCS, u64GuestIdtrBase),
257 /* 13 */ RT_OFFSETOF(VMXVVMCS, u64GuestDr7),
258 /* 14 */ RT_OFFSETOF(VMXVVMCS, u64GuestRsp),
259 /* 15 */ RT_OFFSETOF(VMXVVMCS, u64GuestRip),
260 /* 16 */ RT_OFFSETOF(VMXVVMCS, u64GuestRFlags),
261 /* 17 */ RT_OFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpt),
262 /* 18 */ RT_OFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
263 /* 19 */ RT_OFFSETOF(VMXVVMCS, u64GuestSysenterEip),
264 /* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
265 },
266 /* VMX_VMCS_ENC_WIDTH_NATURAL | VMX_VMCS_ENC_TYPE_HOST_STATE: */
267 {
268 /* 0 */ RT_OFFSETOF(VMXVVMCS, u64HostCr0),
269 /* 1 */ RT_OFFSETOF(VMXVVMCS, u64HostCr3),
270 /* 2 */ RT_OFFSETOF(VMXVVMCS, u64HostCr4),
271 /* 3 */ RT_OFFSETOF(VMXVVMCS, u64HostFsBase),
272 /* 4 */ RT_OFFSETOF(VMXVVMCS, u64HostGsBase),
273 /* 5 */ RT_OFFSETOF(VMXVVMCS, u64HostTrBase),
274 /* 6 */ RT_OFFSETOF(VMXVVMCS, u64HostGdtrBase),
275 /* 7 */ RT_OFFSETOF(VMXVVMCS, u64HostIdtrBase),
276 /* 8 */ RT_OFFSETOF(VMXVVMCS, u64HostSysenterEsp),
277 /* 9 */ RT_OFFSETOF(VMXVVMCS, u64HostSysenterEip),
278 /* 10 */ RT_OFFSETOF(VMXVVMCS, u64HostRsp),
279 /* 11 */ RT_OFFSETOF(VMXVVMCS, u64HostRip),
280 /* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
281 /* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
282 }
283};
284
285
286/**
287 * Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
288 * relative offsets.
289 */
290# ifdef IEM_WITH_CODE_TLB
291# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { } while (0)
292# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { } while (0)
293# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
294# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
295# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
296# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
297# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
298# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
299# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
300# else /* !IEM_WITH_CODE_TLB */
301# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
302 do \
303 { \
304 Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
305 (a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
306 } while (0)
307
308# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
309
310# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
311 do \
312 { \
313 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
314 uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
315 uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
316 (a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
317 } while (0)
318
319# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
320 do \
321 { \
322 Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
323 (a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
324 } while (0)
325
326# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
327 do \
328 { \
329 Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
330 uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
331 uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
332 uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
333 uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
334 (a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
335 } while (0)
336
337# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
338 do \
339 { \
340 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
341 (a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
342 } while (0)
343
344# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
345 do \
346 { \
347 Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
348 (a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
349 } while (0)
350
351# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
352 do \
353 { \
354 Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
355 uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
356 uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
357 uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
358 uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
359 (a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
360 } while (0)
361# endif /* !IEM_WITH_CODE_TLB */
362
363/** The maximum physical address width in bits. */
364#define IEM_VMX_MAX_PHYSADDR_WIDTH(a_pVCpu) (IEM_GET_GUEST_CPU_FEATURES(a_pVCpu)->cVmxMaxPhysAddrWidth)
365
366/** Whether a shadow VMCS is present for the given VCPU. */
367#define IEM_VMX_HAS_SHADOW_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) != NIL_RTGCPHYS)
368
369/** Gets the guest-physical address of the shadows VMCS for the given VCPU. */
370#define IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->u64VmcsLinkPtr.u)
371
372/** Whether a current VMCS is present for the given VCPU. */
373#define IEM_VMX_HAS_CURRENT_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) != NIL_RTGCPHYS)
374
375/** Gets the guest-physical address of the current VMCS for the given VCPU. */
376#define IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs)
377
378/** Assigns the guest-physical address of the current VMCS for the given VCPU. */
379#define IEM_VMX_SET_CURRENT_VMCS(a_pVCpu, a_GCPhysVmcs) \
380 do \
381 { \
382 Assert((a_GCPhysVmcs) != NIL_RTGCPHYS); \
383 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = (a_GCPhysVmcs); \
384 } while (0)
385
386/** Clears any current VMCS for the given VCPU. */
387#define IEM_VMX_CLEAR_CURRENT_VMCS(a_pVCpu) \
388 do \
389 { \
390 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = NIL_RTGCPHYS; \
391 } while (0)
392
393/** Check the common VMX instruction preconditions.
394 * @note Any changes here, also check if IEMOP_HLP_VMX_INSTR needs updating.
395 */
396#define IEM_VMX_INSTR_CHECKS(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
397 do { \
398 if ( !IEM_IS_REAL_OR_V86_MODE(a_pVCpu) \
399 && ( !IEM_IS_LONG_MODE(a_pVCpu) \
400 || IEM_IS_64BIT_CODE(a_pVCpu))) \
401 { /* likely */ } \
402 else \
403 { \
404 if (IEM_IS_REAL_OR_V86_MODE(a_pVCpu)) \
405 { \
406 Log((a_szInstr ": Real or v8086 mode -> #UD\n")); \
407 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_RealOrV86Mode; \
408 return iemRaiseUndefinedOpcode(a_pVCpu); \
409 } \
410 if (IEM_IS_LONG_MODE(a_pVCpu) && !IEM_IS_64BIT_CODE(a_pVCpu)) \
411 { \
412 Log((a_szInstr ": Long mode without 64-bit code segment -> #UD\n")); \
413 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_LongModeCS; \
414 return iemRaiseUndefinedOpcode(a_pVCpu); \
415 } \
416 } \
417 } while (0)
418
419/** Check for VMX instructions requiring to be in VMX operation.
420 * @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs udpating. */
421#define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
422 do \
423 { \
424 if (IEM_IS_VMX_ROOT_MODE(a_pVCpu)) \
425 { /* likely */ } \
426 else \
427 { \
428 Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
429 (a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = a_InsDiagPrefix##_VmxRoot; \
430 return iemRaiseUndefinedOpcode(a_pVCpu); \
431 } \
432 } while (0)
433
434
435/**
436 * Returns whether the given VMCS field is valid and supported by our emulation.
437 *
438 * @param pVCpu The cross context virtual CPU structure.
439 * @param u64FieldEnc The VMCS field encoding.
440 *
441 * @remarks This takes into account the CPU features exposed to the guest.
442 */
443IEM_STATIC bool iemVmxIsVmcsFieldValid(PVMCPU pVCpu, uint64_t u64FieldEnc)
444{
445 uint32_t const uFieldEncHi = RT_HI_U32(u64FieldEnc);
446 uint32_t const uFieldEncLo = RT_LO_U32(u64FieldEnc);
447 if (!uFieldEncHi)
448 { /* likely */ }
449 else
450 return false;
451
452 PCCPUMFEATURES pFeat = IEM_GET_GUEST_CPU_FEATURES(pVCpu);
453 switch (uFieldEncLo)
454 {
455 /*
456 * 16-bit fields.
457 */
458 /* Control fields. */
459 case VMX_VMCS16_VPID: return pFeat->fVmxVpid;
460 case VMX_VMCS16_POSTED_INT_NOTIFY_VECTOR: return pFeat->fVmxPostedInt;
461 case VMX_VMCS16_EPTP_INDEX: return pFeat->fVmxEptXcptVe;
462
463 /* Guest-state fields. */
464 case VMX_VMCS16_GUEST_ES_SEL:
465 case VMX_VMCS16_GUEST_CS_SEL:
466 case VMX_VMCS16_GUEST_SS_SEL:
467 case VMX_VMCS16_GUEST_DS_SEL:
468 case VMX_VMCS16_GUEST_FS_SEL:
469 case VMX_VMCS16_GUEST_GS_SEL:
470 case VMX_VMCS16_GUEST_LDTR_SEL:
471 case VMX_VMCS16_GUEST_TR_SEL:
472 case VMX_VMCS16_GUEST_INTR_STATUS: return pFeat->fVmxVirtIntDelivery;
473 case VMX_VMCS16_GUEST_PML_INDEX: return pFeat->fVmxPml;
474
475 /* Host-state fields. */
476 case VMX_VMCS16_HOST_ES_SEL:
477 case VMX_VMCS16_HOST_CS_SEL:
478 case VMX_VMCS16_HOST_SS_SEL:
479 case VMX_VMCS16_HOST_DS_SEL:
480 case VMX_VMCS16_HOST_FS_SEL:
481 case VMX_VMCS16_HOST_GS_SEL:
482 case VMX_VMCS16_HOST_TR_SEL: return true;
483
484 /*
485 * 64-bit fields.
486 */
487 /* Control fields. */
488 case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
489 case VMX_VMCS64_CTRL_IO_BITMAP_A_HIGH:
490 case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
491 case VMX_VMCS64_CTRL_IO_BITMAP_B_HIGH: return pFeat->fVmxUseIoBitmaps;
492 case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
493 case VMX_VMCS64_CTRL_MSR_BITMAP_HIGH: return pFeat->fVmxUseMsrBitmaps;
494 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
495 case VMX_VMCS64_CTRL_EXIT_MSR_STORE_HIGH:
496 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
497 case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_HIGH:
498 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
499 case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_HIGH:
500 case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_FULL:
501 case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_HIGH: return true;
502 case VMX_VMCS64_CTRL_EXEC_PML_ADDR_FULL:
503 case VMX_VMCS64_CTRL_EXEC_PML_ADDR_HIGH: return pFeat->fVmxPml;
504 case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
505 case VMX_VMCS64_CTRL_TSC_OFFSET_HIGH: return true;
506 case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_FULL:
507 case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_HIGH: return pFeat->fVmxUseTprShadow;
508 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
509 case VMX_VMCS64_CTRL_APIC_ACCESSADDR_HIGH: return pFeat->fVmxVirtApicAccess;
510 case VMX_VMCS64_CTRL_POSTED_INTR_DESC_FULL:
511 case VMX_VMCS64_CTRL_POSTED_INTR_DESC_HIGH: return pFeat->fVmxPostedInt;
512 case VMX_VMCS64_CTRL_VMFUNC_CTRLS_FULL:
513 case VMX_VMCS64_CTRL_VMFUNC_CTRLS_HIGH: return pFeat->fVmxVmFunc;
514 case VMX_VMCS64_CTRL_EPTP_FULL:
515 case VMX_VMCS64_CTRL_EPTP_HIGH: return pFeat->fVmxEpt;
516 case VMX_VMCS64_CTRL_EOI_BITMAP_0_FULL:
517 case VMX_VMCS64_CTRL_EOI_BITMAP_0_HIGH:
518 case VMX_VMCS64_CTRL_EOI_BITMAP_1_FULL:
519 case VMX_VMCS64_CTRL_EOI_BITMAP_1_HIGH:
520 case VMX_VMCS64_CTRL_EOI_BITMAP_2_FULL:
521 case VMX_VMCS64_CTRL_EOI_BITMAP_2_HIGH:
522 case VMX_VMCS64_CTRL_EOI_BITMAP_3_FULL:
523 case VMX_VMCS64_CTRL_EOI_BITMAP_3_HIGH: return pFeat->fVmxVirtIntDelivery;
524 case VMX_VMCS64_CTRL_EPTP_LIST_FULL:
525 case VMX_VMCS64_CTRL_EPTP_LIST_HIGH:
526 {
527 uint64_t const uVmFuncMsr = CPUMGetGuestIa32VmxVmFunc(pVCpu);
528 return RT_BOOL(RT_BF_GET(uVmFuncMsr, VMX_BF_VMFUNC_EPTP_SWITCHING));
529 }
530 case VMX_VMCS64_CTRL_VMREAD_BITMAP_FULL:
531 case VMX_VMCS64_CTRL_VMREAD_BITMAP_HIGH:
532 case VMX_VMCS64_CTRL_VMWRITE_BITMAP_FULL:
533 case VMX_VMCS64_CTRL_VMWRITE_BITMAP_HIGH: return pFeat->fVmxVmcsShadowing;
534 case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_FULL:
535 case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_HIGH: return pFeat->fVmxEptXcptVe;
536 case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_FULL:
537 case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_HIGH: return pFeat->fVmxXsavesXrstors;
538 case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_FULL:
539 case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_HIGH: return false;
540 case VMX_VMCS64_CTRL_TSC_MULTIPLIER_FULL:
541 case VMX_VMCS64_CTRL_TSC_MULTIPLIER_HIGH: return pFeat->fVmxUseTscScaling;
542
543 /* Read-only data fields. */
544 case VMX_VMCS64_RO_GUEST_PHYS_ADDR_FULL:
545 case VMX_VMCS64_RO_GUEST_PHYS_ADDR_HIGH: return pFeat->fVmxEpt;
546
547 /* Guest-state fields. */
548 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
549 case VMX_VMCS64_GUEST_VMCS_LINK_PTR_HIGH:
550 case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
551 case VMX_VMCS64_GUEST_DEBUGCTL_HIGH: return true;
552 case VMX_VMCS64_GUEST_PAT_FULL:
553 case VMX_VMCS64_GUEST_PAT_HIGH: return pFeat->fVmxEntryLoadPatMsr || pFeat->fVmxExitSavePatMsr;
554 case VMX_VMCS64_GUEST_EFER_FULL:
555 case VMX_VMCS64_GUEST_EFER_HIGH: return pFeat->fVmxEntryLoadEferMsr || pFeat->fVmxExitSaveEferMsr;
556 case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_FULL:
557 case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_HIGH: return false;
558 case VMX_VMCS64_GUEST_PDPTE0_FULL:
559 case VMX_VMCS64_GUEST_PDPTE0_HIGH:
560 case VMX_VMCS64_GUEST_PDPTE1_FULL:
561 case VMX_VMCS64_GUEST_PDPTE1_HIGH:
562 case VMX_VMCS64_GUEST_PDPTE2_FULL:
563 case VMX_VMCS64_GUEST_PDPTE2_HIGH:
564 case VMX_VMCS64_GUEST_PDPTE3_FULL:
565 case VMX_VMCS64_GUEST_PDPTE3_HIGH: return pFeat->fVmxEpt;
566 case VMX_VMCS64_GUEST_BNDCFGS_FULL:
567 case VMX_VMCS64_GUEST_BNDCFGS_HIGH: return false;
568
569 /* Host-state fields. */
570 case VMX_VMCS64_HOST_PAT_FULL:
571 case VMX_VMCS64_HOST_PAT_HIGH: return pFeat->fVmxExitLoadPatMsr;
572 case VMX_VMCS64_HOST_EFER_FULL:
573 case VMX_VMCS64_HOST_EFER_HIGH: return pFeat->fVmxExitLoadEferMsr;
574 case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_FULL:
575 case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_HIGH: return false;
576
577 /*
578 * 32-bit fields.
579 */
580 /* Control fields. */
581 case VMX_VMCS32_CTRL_PIN_EXEC:
582 case VMX_VMCS32_CTRL_PROC_EXEC:
583 case VMX_VMCS32_CTRL_EXCEPTION_BITMAP:
584 case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK:
585 case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH:
586 case VMX_VMCS32_CTRL_CR3_TARGET_COUNT:
587 case VMX_VMCS32_CTRL_EXIT:
588 case VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT:
589 case VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT:
590 case VMX_VMCS32_CTRL_ENTRY:
591 case VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT:
592 case VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO:
593 case VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE:
594 case VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH: return true;
595 case VMX_VMCS32_CTRL_TPR_THRESHOLD: return pFeat->fVmxUseTprShadow;
596 case VMX_VMCS32_CTRL_PROC_EXEC2: return pFeat->fVmxSecondaryExecCtls;
597 case VMX_VMCS32_CTRL_PLE_GAP:
598 case VMX_VMCS32_CTRL_PLE_WINDOW: return pFeat->fVmxPauseLoopExit;
599
600 /* Read-only data fields. */
601 case VMX_VMCS32_RO_VM_INSTR_ERROR:
602 case VMX_VMCS32_RO_EXIT_REASON:
603 case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
604 case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
605 case VMX_VMCS32_RO_IDT_VECTORING_INFO:
606 case VMX_VMCS32_RO_IDT_VECTORING_ERROR_CODE:
607 case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
608 case VMX_VMCS32_RO_EXIT_INSTR_INFO: return true;
609
610 /* Guest-state fields. */
611 case VMX_VMCS32_GUEST_ES_LIMIT:
612 case VMX_VMCS32_GUEST_CS_LIMIT:
613 case VMX_VMCS32_GUEST_SS_LIMIT:
614 case VMX_VMCS32_GUEST_DS_LIMIT:
615 case VMX_VMCS32_GUEST_FS_LIMIT:
616 case VMX_VMCS32_GUEST_GS_LIMIT:
617 case VMX_VMCS32_GUEST_LDTR_LIMIT:
618 case VMX_VMCS32_GUEST_TR_LIMIT:
619 case VMX_VMCS32_GUEST_GDTR_LIMIT:
620 case VMX_VMCS32_GUEST_IDTR_LIMIT:
621 case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
622 case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
623 case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
624 case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
625 case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
626 case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
627 case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
628 case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
629 case VMX_VMCS32_GUEST_INT_STATE:
630 case VMX_VMCS32_GUEST_ACTIVITY_STATE:
631 case VMX_VMCS32_GUEST_SMBASE:
632 case VMX_VMCS32_GUEST_SYSENTER_CS: return true;
633 case VMX_VMCS32_PREEMPT_TIMER_VALUE: return pFeat->fVmxPreemptTimer;
634
635 /* Host-state fields. */
636 case VMX_VMCS32_HOST_SYSENTER_CS: return true;
637
638 /*
639 * Natural-width fields.
640 */
641 /* Control fields. */
642 case VMX_VMCS_CTRL_CR0_MASK:
643 case VMX_VMCS_CTRL_CR4_MASK:
644 case VMX_VMCS_CTRL_CR0_READ_SHADOW:
645 case VMX_VMCS_CTRL_CR4_READ_SHADOW:
646 case VMX_VMCS_CTRL_CR3_TARGET_VAL0:
647 case VMX_VMCS_CTRL_CR3_TARGET_VAL1:
648 case VMX_VMCS_CTRL_CR3_TARGET_VAL2:
649 case VMX_VMCS_CTRL_CR3_TARGET_VAL3: return true;
650
651 /* Read-only data fields. */
652 case VMX_VMCS_RO_EXIT_QUALIFICATION:
653 case VMX_VMCS_RO_IO_RCX:
654 case VMX_VMCS_RO_IO_RSX:
655 case VMX_VMCS_RO_IO_RDI:
656 case VMX_VMCS_RO_IO_RIP:
657 case VMX_VMCS_RO_EXIT_GUEST_LINEAR_ADDR: return true;
658
659 /* Guest-state fields. */
660 case VMX_VMCS_GUEST_CR0:
661 case VMX_VMCS_GUEST_CR3:
662 case VMX_VMCS_GUEST_CR4:
663 case VMX_VMCS_GUEST_ES_BASE:
664 case VMX_VMCS_GUEST_CS_BASE:
665 case VMX_VMCS_GUEST_SS_BASE:
666 case VMX_VMCS_GUEST_DS_BASE:
667 case VMX_VMCS_GUEST_FS_BASE:
668 case VMX_VMCS_GUEST_GS_BASE:
669 case VMX_VMCS_GUEST_LDTR_BASE:
670 case VMX_VMCS_GUEST_TR_BASE:
671 case VMX_VMCS_GUEST_GDTR_BASE:
672 case VMX_VMCS_GUEST_IDTR_BASE:
673 case VMX_VMCS_GUEST_DR7:
674 case VMX_VMCS_GUEST_RSP:
675 case VMX_VMCS_GUEST_RIP:
676 case VMX_VMCS_GUEST_RFLAGS:
677 case VMX_VMCS_GUEST_PENDING_DEBUG_XCPTS:
678 case VMX_VMCS_GUEST_SYSENTER_ESP:
679 case VMX_VMCS_GUEST_SYSENTER_EIP: return true;
680
681 /* Host-state fields. */
682 case VMX_VMCS_HOST_CR0:
683 case VMX_VMCS_HOST_CR3:
684 case VMX_VMCS_HOST_CR4:
685 case VMX_VMCS_HOST_FS_BASE:
686 case VMX_VMCS_HOST_GS_BASE:
687 case VMX_VMCS_HOST_TR_BASE:
688 case VMX_VMCS_HOST_GDTR_BASE:
689 case VMX_VMCS_HOST_IDTR_BASE:
690 case VMX_VMCS_HOST_SYSENTER_ESP:
691 case VMX_VMCS_HOST_SYSENTER_EIP:
692 case VMX_VMCS_HOST_RSP:
693 case VMX_VMCS_HOST_RIP: return true;
694 }
695
696 return false;
697}
698
699
700/**
701 * Gets VM-exit instruction information along with any displacement for an
702 * instruction VM-exit.
703 *
704 * @returns The VM-exit instruction information.
705 * @param pVCpu The cross context virtual CPU structure.
706 * @param uExitReason The VM-exit reason.
707 * @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX) if
708 * any. Pass VMXINSTRID_NONE otherwise.
709 * @param fPrimaryOpRead If the primary operand of the ModR/M byte (bits 0:3) is
710 * a read or write.
711 * @param pGCPtrDisp Where to store the displacement field. Optional, can be
712 * NULL.
713 */
714IEM_STATIC uint32_t iemVmxGetExitInstrInfo(PVMCPU pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, bool fPrimaryOpRead,
715 PRTGCPTR pGCPtrDisp)
716{
717 RTGCPTR GCPtrDisp;
718 VMXEXITINSTRINFO ExitInstrInfo;
719 ExitInstrInfo.u = 0;
720
721 /*
722 * Get and parse the ModR/M byte from our decoded opcodes.
723 */
724 uint8_t bRm;
725 uint8_t const offModRm = pVCpu->iem.s.offModRm;
726 IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
727 if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
728 {
729 /*
730 * ModR/M indicates register addressing.
731 *
732 * The primary/secondary register operands are reported in the iReg1 or iReg2
733 * fields depending on whether it is a read/write form.
734 */
735 uint8_t idxReg1;
736 uint8_t idxReg2;
737 if (fPrimaryOpRead)
738 {
739 idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
740 idxReg2 = (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB;
741 }
742 else
743 {
744 idxReg1 = (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB;
745 idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
746 }
747 ExitInstrInfo.All.u2Scaling = 0;
748 ExitInstrInfo.All.iReg1 = idxReg1;
749 ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
750 ExitInstrInfo.All.fIsRegOperand = 1;
751 ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
752 ExitInstrInfo.All.iSegReg = 0;
753 ExitInstrInfo.All.iIdxReg = 0;
754 ExitInstrInfo.All.fIdxRegInvalid = 1;
755 ExitInstrInfo.All.iBaseReg = 0;
756 ExitInstrInfo.All.fBaseRegInvalid = 1;
757 ExitInstrInfo.All.iReg2 = idxReg2;
758
759 /* Displacement not applicable for register addressing. */
760 GCPtrDisp = 0;
761 }
762 else
763 {
764 /*
765 * ModR/M indicates memory addressing.
766 */
767 uint8_t uScale = 0;
768 bool fBaseRegValid = false;
769 bool fIdxRegValid = false;
770 uint8_t iBaseReg = 0;
771 uint8_t iIdxReg = 0;
772 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
773 {
774 /*
775 * Parse the ModR/M, displacement for 16-bit addressing mode.
776 * See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
777 */
778 uint16_t u16Disp = 0;
779 uint8_t const offDisp = offModRm + sizeof(bRm);
780 if ((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 6)
781 {
782 /* Displacement without any registers. */
783 IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
784 }
785 else
786 {
787 /* Register (index and base). */
788 switch (bRm & X86_MODRM_RM_MASK)
789 {
790 case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
791 case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
792 case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
793 case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
794 case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
795 case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
796 case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
797 case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
798 }
799
800 /* Register + displacement. */
801 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
802 {
803 case 0: break;
804 case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
805 case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
806 default:
807 {
808 /* Register addressing, handled at the beginning. */
809 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
810 break;
811 }
812 }
813 }
814
815 Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
816 GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
817 }
818 else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
819 {
820 /*
821 * Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
822 * See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
823 */
824 uint32_t u32Disp = 0;
825 if ((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5)
826 {
827 /* Displacement without any registers. */
828 uint8_t const offDisp = offModRm + sizeof(bRm);
829 IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
830 }
831 else
832 {
833 /* Register (and perhaps scale, index and base). */
834 uint8_t offDisp = offModRm + sizeof(bRm);
835 iBaseReg = (bRm & X86_MODRM_RM_MASK);
836 if (iBaseReg == 4)
837 {
838 /* An SIB byte follows the ModR/M byte, parse it. */
839 uint8_t bSib;
840 uint8_t const offSib = offModRm + sizeof(bRm);
841 IEM_SIB_GET_U8(pVCpu, bSib, offSib);
842
843 /* A displacement may follow SIB, update its offset. */
844 offDisp += sizeof(bSib);
845
846 /* Get the scale. */
847 uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
848
849 /* Get the index register. */
850 iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
851 fIdxRegValid = RT_BOOL(iIdxReg != 4);
852
853 /* Get the base register. */
854 iBaseReg = bSib & X86_SIB_BASE_MASK;
855 fBaseRegValid = true;
856 if (iBaseReg == 5)
857 {
858 if ((bRm & X86_MODRM_MOD_MASK) == 0)
859 {
860 /* Mod is 0 implies a 32-bit displacement with no base. */
861 fBaseRegValid = false;
862 IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
863 }
864 else
865 {
866 /* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
867 iBaseReg = X86_GREG_xBP;
868 }
869 }
870 }
871
872 /* Register + displacement. */
873 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
874 {
875 case 0: /* Handled above */ break;
876 case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
877 case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
878 default:
879 {
880 /* Register addressing, handled at the beginning. */
881 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
882 break;
883 }
884 }
885 }
886
887 GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
888 }
889 else
890 {
891 Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
892
893 /*
894 * Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
895 * See Intel instruction spec. 2.2 "IA-32e Mode".
896 */
897 uint64_t u64Disp = 0;
898 bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK | X86_MODRM_RM_MASK)) == 5);
899 if (fRipRelativeAddr)
900 {
901 /*
902 * RIP-relative addressing mode.
903 *
904 * The displacment is 32-bit signed implying an offset range of +/-2G.
905 * See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
906 */
907 uint8_t const offDisp = offModRm + sizeof(bRm);
908 IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
909 }
910 else
911 {
912 uint8_t offDisp = offModRm + sizeof(bRm);
913
914 /*
915 * Register (and perhaps scale, index and base).
916 *
917 * REX.B extends the most-significant bit of the base register. However, REX.B
918 * is ignored while determining whether an SIB follows the opcode. Hence, we
919 * shall OR any REX.B bit -after- inspecting for an SIB byte below.
920 *
921 * See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
922 */
923 iBaseReg = (bRm & X86_MODRM_RM_MASK);
924 if (iBaseReg == 4)
925 {
926 /* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
927 uint8_t bSib;
928 uint8_t const offSib = offModRm + sizeof(bRm);
929 IEM_SIB_GET_U8(pVCpu, bSib, offSib);
930
931 /* Displacement may follow SIB, update its offset. */
932 offDisp += sizeof(bSib);
933
934 /* Get the scale. */
935 uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
936
937 /* Get the index. */
938 iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pVCpu->iem.s.uRexIndex;
939 fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
940
941 /* Get the base. */
942 iBaseReg = (bSib & X86_SIB_BASE_MASK);
943 fBaseRegValid = true;
944 if (iBaseReg == 5)
945 {
946 if ((bRm & X86_MODRM_MOD_MASK) == 0)
947 {
948 /* Mod is 0 implies a signed 32-bit displacement with no base. */
949 IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
950 }
951 else
952 {
953 /* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
954 iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
955 }
956 }
957 }
958 iBaseReg |= pVCpu->iem.s.uRexB;
959
960 /* Register + displacement. */
961 switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
962 {
963 case 0: /* Handled above */ break;
964 case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
965 case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
966 default:
967 {
968 /* Register addressing, handled at the beginning. */
969 AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
970 break;
971 }
972 }
973 }
974
975 GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
976 }
977
978 /*
979 * The primary or secondary register operand is reported in iReg2 depending
980 * on whether the primary operand is in read/write form.
981 */
982 uint8_t idxReg2;
983 if (fPrimaryOpRead)
984 {
985 idxReg2 = bRm & X86_MODRM_RM_MASK;
986 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
987 idxReg2 |= pVCpu->iem.s.uRexB;
988 }
989 else
990 {
991 idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
992 if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
993 idxReg2 |= pVCpu->iem.s.uRexReg;
994 }
995 ExitInstrInfo.All.u2Scaling = uScale;
996 ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
997 ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
998 ExitInstrInfo.All.fIsRegOperand = 0;
999 ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
1000 ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
1001 ExitInstrInfo.All.iIdxReg = iIdxReg;
1002 ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
1003 ExitInstrInfo.All.iBaseReg = iBaseReg;
1004 ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
1005 ExitInstrInfo.All.iReg2 = idxReg2;
1006 }
1007
1008 /*
1009 * Handle exceptions to the norm for certain instructions.
1010 * (e.g. some instructions convey an instruction identity in place of iReg2).
1011 */
1012 switch (uExitReason)
1013 {
1014 case VMX_EXIT_GDTR_IDTR_ACCESS:
1015 {
1016 Assert(VMXINSTRID_IS_VALID(uInstrId));
1017 ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
1018 ExitInstrInfo.GdtIdt.u2Undef0 = 0;
1019 break;
1020 }
1021
1022 case VMX_EXIT_LDTR_TR_ACCESS:
1023 {
1024 Assert(VMXINSTRID_IS_VALID(uInstrId));
1025 ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
1026 ExitInstrInfo.LdtTr.u2Undef0 = 0;
1027 break;
1028 }
1029
1030 case VMX_EXIT_RDRAND:
1031 case VMX_EXIT_RDSEED:
1032 {
1033 Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
1034 break;
1035 }
1036 }
1037
1038 /* Update displacement and return the constructed VM-exit instruction information field. */
1039 if (pGCPtrDisp)
1040 *pGCPtrDisp = GCPtrDisp;
1041 return ExitInstrInfo.u;
1042}
1043
1044
1045/**
1046 * Implements VMSucceed for VMX instruction success.
1047 *
1048 * @param pVCpu The cross context virtual CPU structure.
1049 */
1050DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPU pVCpu)
1051{
1052 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1053}
1054
1055
1056/**
1057 * Implements VMFailInvalid for VMX instruction failure.
1058 *
1059 * @param pVCpu The cross context virtual CPU structure.
1060 */
1061DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPU pVCpu)
1062{
1063 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1064 pVCpu->cpum.GstCtx.eflags.u32 |= X86_EFL_CF;
1065}
1066
1067
1068/**
1069 * Implements VMFailValid for VMX instruction failure.
1070 *
1071 * @param pVCpu The cross context virtual CPU structure.
1072 * @param enmInsErr The VM instruction error.
1073 */
1074DECL_FORCE_INLINE(void) iemVmxVmFailValid(PVMCPU pVCpu, VMXINSTRERR enmInsErr)
1075{
1076 if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1077 {
1078 pVCpu->cpum.GstCtx.eflags.u32 &= ~(X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF);
1079 pVCpu->cpum.GstCtx.eflags.u32 |= X86_EFL_ZF;
1080 /** @todo NSTVMX: VMWrite enmInsErr to VM-instruction error field. */
1081 RT_NOREF(enmInsErr);
1082 }
1083}
1084
1085
1086/**
1087 * Implements VMFail for VMX instruction failure.
1088 *
1089 * @param pVCpu The cross context virtual CPU structure.
1090 * @param enmInsErr The VM instruction error.
1091 */
1092DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPU pVCpu, VMXINSTRERR enmInsErr)
1093{
1094 if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1095 {
1096 iemVmxVmFailValid(pVCpu, enmInsErr);
1097 /** @todo Set VM-instruction error field in the current virtual-VMCS. */
1098 }
1099 else
1100 iemVmxVmFailInvalid(pVCpu);
1101}
1102
1103
1104/**
1105 * Flushes the current VMCS contents back to guest memory.
1106 *
1107 * @returns VBox status code.
1108 * @param pVCpu The cross context virtual CPU structure.
1109 */
1110DECL_FORCE_INLINE(int) iemVmxCommitCurrentVmcsToMemory(PVMCPU pVCpu)
1111{
1112 Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
1113 int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
1114 pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs), sizeof(VMXVVMCS));
1115 IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
1116 return rc;
1117}
1118
1119
1120/**
1121 * Implements VMSucceed for the VMREAD instruction and increments the guest RIP.
1122 *
1123 * @param pVCpu The cross context virtual CPU structure.
1124 */
1125DECL_FORCE_INLINE(void) iemVmxVmreadSuccess(PVMCPU pVCpu, uint8_t cbInstr)
1126{
1127 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_Success;
1128 iemVmxVmSucceed(pVCpu);
1129 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1130}
1131
1132
1133/**
1134 * VMREAD common (memory/register) instruction execution worker
1135 *
1136 * @param pVCpu The cross context virtual CPU structure.
1137 * @param cbInstr The instruction length.
1138 * @param pu64Dst Where to write the VMCS value (only updated when
1139 * VINF_SUCCESS is returned).
1140 * @param u64FieldEnc The VMCS field encoding.
1141 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1142 * be NULL.
1143 */
1144IEM_STATIC VBOXSTRICTRC iemVmxVmreadCommon(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
1145 PCVMXVEXITINFO pExitInfo)
1146{
1147 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1148 {
1149 RT_NOREF(pExitInfo); RT_NOREF(cbInstr);
1150 /** @todo NSTVMX: intercept. */
1151 /** @todo NSTVMX: VMCS shadowing intercept (VMREAD bitmap). */
1152 }
1153
1154 /* CPL. */
1155 if (pVCpu->iem.s.uCpl > 0)
1156 {
1157 Log(("vmread: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1158 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_Cpl;
1159 return iemRaiseGeneralProtectionFault0(pVCpu);
1160 }
1161
1162 /* VMCS pointer in root mode. */
1163 if ( IEM_IS_VMX_ROOT_MODE(pVCpu)
1164 && !IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1165 {
1166 Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
1167 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_PtrInvalid;
1168 iemVmxVmFailInvalid(pVCpu);
1169 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1170 return VINF_SUCCESS;
1171 }
1172
1173 /* VMCS-link pointer in non-root mode. */
1174 if ( IEM_IS_VMX_NON_ROOT_MODE(pVCpu)
1175 && !IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
1176 {
1177 Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
1178 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_LinkPtrInvalid;
1179 iemVmxVmFailInvalid(pVCpu);
1180 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1181 return VINF_SUCCESS;
1182 }
1183
1184 /* Supported VMCS field. */
1185 if (iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
1186 {
1187 Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
1188 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_FieldInvalid;
1189 iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
1190 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1191 return VINF_SUCCESS;
1192 }
1193
1194 /*
1195 * Setup reading from the current or shadow VMCS.
1196 */
1197 uint8_t *pbVmcs;
1198 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1199 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
1200 else
1201 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1202 Assert(pbVmcs);
1203
1204 VMXVMCSFIELDENC FieldEnc;
1205 FieldEnc.u = RT_LO_U32(u64FieldEnc);
1206 uint8_t const uWidth = FieldEnc.n.u2Width;
1207 uint8_t const uType = FieldEnc.n.u2Type;
1208 uint8_t const uWidthType = (uWidth << 2) | uType;
1209 uint8_t const uIndex = FieldEnc.n.u8Index;
1210 AssertRCReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
1211 uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
1212
1213 /*
1214 * Read the VMCS component based on the field's effective width.
1215 *
1216 * The effective width is 64-bit fields adjusted to 32-bits if the access-type
1217 * indicates high bits (little endian).
1218 *
1219 * Note! The caller is responsible to trim the result and update registers
1220 * or memory locations are required. Here we just zero-extend to the largest
1221 * type (i.e. 64-bits).
1222 */
1223 uint8_t *pbField = pbVmcs + offField;
1224 uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
1225 switch (uEffWidth)
1226 {
1227 case VMX_VMCS_ENC_WIDTH_64BIT:
1228 case VMX_VMCS_ENC_WIDTH_NATURAL: *pu64Dst = *(uint64_t *)pbField; break;
1229 case VMX_VMCS_ENC_WIDTH_32BIT: *pu64Dst = *(uint32_t *)pbField; break;
1230 case VMX_VMCS_ENC_WIDTH_16BIT: *pu64Dst = *(uint16_t *)pbField; break;
1231 }
1232 return VINF_SUCCESS;
1233}
1234
1235
1236/**
1237 * VMREAD (64-bit register) instruction execution worker.
1238 *
1239 * @param pVCpu The cross context virtual CPU structure.
1240 * @param cbInstr The instruction length.
1241 * @param pu64Dst Where to store the VMCS field's value.
1242 * @param u64FieldEnc The VMCS field encoding.
1243 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1244 * be NULL.
1245 */
1246IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg64(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
1247 PCVMXVEXITINFO pExitInfo)
1248{
1249 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
1250 if (rcStrict == VINF_SUCCESS)
1251 {
1252 iemVmxVmreadSuccess(pVCpu, cbInstr);
1253 return VINF_SUCCESS;
1254 }
1255
1256 Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1257 return rcStrict;
1258}
1259
1260
1261/**
1262 * VMREAD (32-bit register) instruction execution worker.
1263 *
1264 * @param pVCpu The cross context virtual CPU structure.
1265 * @param cbInstr The instruction length.
1266 * @param pu32Dst Where to store the VMCS field's value.
1267 * @param u32FieldEnc The VMCS field encoding.
1268 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1269 * be NULL.
1270 */
1271IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg32(PVMCPU pVCpu, uint8_t cbInstr, uint32_t *pu32Dst, uint64_t u32FieldEnc,
1272 PCVMXVEXITINFO pExitInfo)
1273{
1274 uint64_t u64Dst;
1275 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32FieldEnc, pExitInfo);
1276 if (rcStrict == VINF_SUCCESS)
1277 {
1278 *pu32Dst = u64Dst;
1279 iemVmxVmreadSuccess(pVCpu, cbInstr);
1280 return VINF_SUCCESS;
1281 }
1282
1283 Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1284 return rcStrict;
1285}
1286
1287
1288/**
1289 * VMREAD (memory) instruction execution worker.
1290 *
1291 * @param pVCpu The cross context virtual CPU structure.
1292 * @param cbInstr The instruction length.
1293 * @param iEffSeg The effective segment register to use with @a u64Val.
1294 * Pass UINT8_MAX if it is a register access.
1295 * @param enmEffAddrMode The effective addressing mode (only used with memory
1296 * operand).
1297 * @param GCPtrDst The guest linear address to store the VMCS field's
1298 * value.
1299 * @param u64FieldEnc The VMCS field encoding.
1300 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1301 * be NULL.
1302 */
1303IEM_STATIC VBOXSTRICTRC iemVmxVmreadMem(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode,
1304 RTGCPTR GCPtrDst, uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
1305{
1306 uint64_t u64Dst;
1307 VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64FieldEnc, pExitInfo);
1308 if (rcStrict == VINF_SUCCESS)
1309 {
1310 /*
1311 * Write the VMCS field's value to the location specified in guest-memory.
1312 *
1313 * The pointer size depends on the address size (address-size prefix allowed).
1314 * The operand size depends on IA-32e mode (operand-size prefix not allowed).
1315 */
1316 static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
1317 Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
1318 GCPtrDst &= s_auAddrSizeMasks[enmEffAddrMode];
1319
1320 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
1321 rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
1322 else
1323 rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
1324 if (rcStrict == VINF_SUCCESS)
1325 {
1326 iemVmxVmreadSuccess(pVCpu, cbInstr);
1327 return VINF_SUCCESS;
1328 }
1329
1330 Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
1331 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmread_PtrMap;
1332 return rcStrict;
1333 }
1334
1335 Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1336 return rcStrict;
1337}
1338
1339
1340/**
1341 * VMWRITE instruction execution worker.
1342 *
1343 * @param pVCpu The cross context virtual CPU structure.
1344 * @param cbInstr The instruction length.
1345 * @param iEffSeg The effective segment register to use with @a u64Val.
1346 * Pass UINT8_MAX if it is a register access.
1347 * @param enmEffAddrMode The effective addressing mode (only used with memory
1348 * operand).
1349 * @param u64Val The value to write (or guest linear address to the
1350 * value), @a iEffSeg will indicate if it's a memory
1351 * operand.
1352 * @param u64FieldEnc The VMCS field encoding.
1353 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1354 * be NULL.
1355 */
1356IEM_STATIC VBOXSTRICTRC iemVmxVmwrite(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode, uint64_t u64Val,
1357 uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
1358{
1359 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1360 {
1361 RT_NOREF(pExitInfo);
1362 /** @todo NSTVMX: intercept. */
1363 /** @todo NSTVMX: VMCS shadowing intercept (VMWRITE bitmap). */
1364 }
1365
1366 /* CPL. */
1367 if (pVCpu->iem.s.uCpl > 0)
1368 {
1369 Log(("vmwrite: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1370 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_Cpl;
1371 return iemRaiseGeneralProtectionFault0(pVCpu);
1372 }
1373
1374 /* VMCS pointer in root mode. */
1375 if ( IEM_IS_VMX_ROOT_MODE(pVCpu)
1376 && !IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1377 {
1378 Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
1379 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_PtrInvalid;
1380 iemVmxVmFailInvalid(pVCpu);
1381 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1382 return VINF_SUCCESS;
1383 }
1384
1385 /* VMCS-link pointer in non-root mode. */
1386 if ( IEM_IS_VMX_NON_ROOT_MODE(pVCpu)
1387 && !IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
1388 {
1389 Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
1390 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_LinkPtrInvalid;
1391 iemVmxVmFailInvalid(pVCpu);
1392 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1393 return VINF_SUCCESS;
1394 }
1395
1396 /* If the VMWRITE instruction references memory, access the specified memory operand. */
1397 bool const fIsRegOperand = iEffSeg == UINT8_MAX;
1398 if (!fIsRegOperand)
1399 {
1400 static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
1401 Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
1402 RTGCPTR const GCPtrVal = u64Val & s_auAddrSizeMasks[enmEffAddrMode];
1403
1404 /* Read the value from the specified guest memory location. */
1405 VBOXSTRICTRC rcStrict;
1406 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
1407 rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
1408 else
1409 {
1410 uint32_t u32Val;
1411 rcStrict = iemMemFetchDataU32(pVCpu, &u32Val, iEffSeg, GCPtrVal);
1412 u64Val = u32Val;
1413 }
1414 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1415 {
1416 Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
1417 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_PtrMap;
1418 return rcStrict;
1419 }
1420 }
1421 else
1422 Assert(!pExitInfo || pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
1423
1424 /* Supported VMCS field. */
1425 if (!iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
1426 {
1427 Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
1428 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_FieldInvalid;
1429 iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
1430 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1431 return VINF_SUCCESS;
1432 }
1433
1434 /* Read-only VMCS field. */
1435 bool const fReadOnlyField = HMVmxIsVmcsFieldReadOnly(u64FieldEnc);
1436 if ( fReadOnlyField
1437 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
1438 {
1439 Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64FieldEnc));
1440 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_FieldRo;
1441 iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
1442 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1443 return VINF_SUCCESS;
1444 }
1445
1446 /*
1447 * Setup writing to the current or shadow VMCS.
1448 */
1449 uint8_t *pbVmcs;
1450 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1451 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
1452 else
1453 pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1454 Assert(pbVmcs);
1455
1456 VMXVMCSFIELDENC FieldEnc;
1457 FieldEnc.u = RT_LO_U32(u64FieldEnc);
1458 uint8_t const uWidth = FieldEnc.n.u2Width;
1459 uint8_t const uType = FieldEnc.n.u2Type;
1460 uint8_t const uWidthType = (uWidth << 2) | uType;
1461 uint8_t const uIndex = FieldEnc.n.u8Index;
1462 AssertRCReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
1463 uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
1464
1465 /*
1466 * Write the VMCS component based on the field's effective width.
1467 *
1468 * The effective width is 64-bit fields adjusted to 32-bits if the access-type
1469 * indicates high bits (little endian).
1470 */
1471 uint8_t *pbField = pbVmcs + offField;
1472 uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
1473 switch (uEffWidth)
1474 {
1475 case VMX_VMCS_ENC_WIDTH_64BIT:
1476 case VMX_VMCS_ENC_WIDTH_NATURAL: *(uint64_t *)pbField = u64Val; break;
1477 case VMX_VMCS_ENC_WIDTH_32BIT: *(uint32_t *)pbField = u64Val; break;
1478 case VMX_VMCS_ENC_WIDTH_16BIT: *(uint16_t *)pbField = u64Val; break;
1479 }
1480
1481 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmwrite_Success;
1482 iemVmxVmSucceed(pVCpu);
1483 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1484 return VINF_SUCCESS;
1485}
1486
1487
1488/**
1489 * VMCLEAR instruction execution worker.
1490 *
1491 * @param pVCpu The cross context virtual CPU structure.
1492 * @param cbInstr The instruction length.
1493 * @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
1494 * @param GCPtrVmcs The linear address of the VMCS pointer.
1495 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1496 * be NULL.
1497 *
1498 * @remarks Common VMX instruction checks are already expected to by the caller,
1499 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1500 */
1501IEM_STATIC VBOXSTRICTRC iemVmxVmclear(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1502 PCVMXVEXITINFO pExitInfo)
1503{
1504 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1505 {
1506 RT_NOREF(pExitInfo);
1507 /** @todo NSTVMX: intercept. */
1508 }
1509 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1510
1511 /* CPL. */
1512 if (pVCpu->iem.s.uCpl > 0)
1513 {
1514 Log(("vmclear: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1515 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_Cpl;
1516 return iemRaiseGeneralProtectionFault0(pVCpu);
1517 }
1518
1519 /* Get the VMCS pointer from the location specified by the source memory operand. */
1520 RTGCPHYS GCPhysVmcs;
1521 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
1522 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1523 {
1524 Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
1525 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrMap;
1526 return rcStrict;
1527 }
1528
1529 /* VMCS pointer alignment. */
1530 if (GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK)
1531 {
1532 Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
1533 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrAlign;
1534 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1535 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1536 return VINF_SUCCESS;
1537 }
1538
1539 /* VMCS physical-address width limits. */
1540 if (GCPhysVmcs >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
1541 {
1542 Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
1543 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrWidth;
1544 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1545 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1546 return VINF_SUCCESS;
1547 }
1548
1549 /* VMCS is not the VMXON region. */
1550 if (GCPhysVmcs == pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
1551 {
1552 Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
1553 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrVmxon;
1554 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
1555 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1556 return VINF_SUCCESS;
1557 }
1558
1559 /* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
1560 restriction imposed by our implementation. */
1561 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
1562 {
1563 Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
1564 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_PtrAbnormal;
1565 iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
1566 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1567 return VINF_SUCCESS;
1568 }
1569
1570 /*
1571 * VMCLEAR allows committing and clearing any valid VMCS pointer.
1572 *
1573 * If the current VMCS is the one being cleared, set its state to 'clear' and commit
1574 * to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
1575 * to 'clear'.
1576 */
1577 uint8_t const fVmcsStateClear = VMX_V_VMCS_STATE_CLEAR;
1578 if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
1579 {
1580 Assert(GCPhysVmcs != NIL_RTGCPHYS); /* Paranoia. */
1581 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
1582 pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState = fVmcsStateClear;
1583 iemVmxCommitCurrentVmcsToMemory(pVCpu);
1584 Assert(!IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
1585 }
1586 else
1587 {
1588 rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPtrVmcs + RT_OFFSETOF(VMXVVMCS, fVmcsState),
1589 (const void *)&fVmcsStateClear, sizeof(fVmcsStateClear));
1590 }
1591
1592 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmclear_Success;
1593 iemVmxVmSucceed(pVCpu);
1594 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1595 return rcStrict;
1596}
1597
1598
1599/**
1600 * VMPTRST instruction execution worker.
1601 *
1602 * @param pVCpu The cross context virtual CPU structure.
1603 * @param cbInstr The instruction length.
1604 * @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
1605 * @param GCPtrVmcs The linear address of where to store the current VMCS
1606 * pointer.
1607 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1608 * be NULL.
1609 *
1610 * @remarks Common VMX instruction checks are already expected to by the caller,
1611 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1612 */
1613IEM_STATIC VBOXSTRICTRC iemVmxVmptrst(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1614 PCVMXVEXITINFO pExitInfo)
1615{
1616 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1617 {
1618 RT_NOREF(pExitInfo);
1619 /** @todo NSTVMX: intercept. */
1620 }
1621 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1622
1623 /* CPL. */
1624 if (pVCpu->iem.s.uCpl > 0)
1625 {
1626 Log(("vmptrst: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1627 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_Cpl;
1628 return iemRaiseGeneralProtectionFault0(pVCpu);
1629 }
1630
1631 /* Set the VMCS pointer to the location specified by the destination memory operand. */
1632 AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
1633 VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
1634 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1635 {
1636 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_Success;
1637 iemVmxVmSucceed(pVCpu);
1638 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1639 return rcStrict;
1640 }
1641
1642 Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
1643 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrst_PtrMap;
1644 return rcStrict;
1645}
1646
1647
1648/**
1649 * VMPTRLD instruction execution worker.
1650 *
1651 * @param pVCpu The cross context virtual CPU structure.
1652 * @param cbInstr The instruction length.
1653 * @param GCPtrVmcs The linear address of the current VMCS pointer.
1654 * @param pExitInfo Pointer to the VM-exit information struct. Optional, can
1655 * be NULL.
1656 *
1657 * @remarks Common VMX instruction checks are already expected to by the caller,
1658 * i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1659 */
1660IEM_STATIC VBOXSTRICTRC iemVmxVmptrld(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
1661 PCVMXVEXITINFO pExitInfo)
1662{
1663 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1664 {
1665 RT_NOREF(pExitInfo);
1666 /** @todo NSTVMX: intercept. */
1667 }
1668 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1669
1670 /* CPL. */
1671 if (pVCpu->iem.s.uCpl > 0)
1672 {
1673 Log(("vmptrld: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1674 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_Cpl;
1675 return iemRaiseGeneralProtectionFault0(pVCpu);
1676 }
1677
1678 /* Get the VMCS pointer from the location specified by the source memory operand. */
1679 RTGCPHYS GCPhysVmcs;
1680 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
1681 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1682 {
1683 Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
1684 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrMap;
1685 return rcStrict;
1686 }
1687
1688 /* VMCS pointer alignment. */
1689 if (GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK)
1690 {
1691 Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
1692 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrAlign;
1693 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1694 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1695 return VINF_SUCCESS;
1696 }
1697
1698 /* VMCS physical-address width limits. */
1699 if (GCPhysVmcs >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
1700 {
1701 Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
1702 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrWidth;
1703 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1704 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1705 return VINF_SUCCESS;
1706 }
1707
1708 /* VMCS is not the VMXON region. */
1709 if (GCPhysVmcs == pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
1710 {
1711 Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
1712 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrVmxon;
1713 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
1714 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1715 return VINF_SUCCESS;
1716 }
1717
1718 /* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
1719 restriction imposed by our implementation. */
1720 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
1721 {
1722 Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
1723 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrAbnormal;
1724 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
1725 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1726 return VINF_SUCCESS;
1727 }
1728
1729 /* Read the VMCS revision ID from the VMCS. */
1730 VMXVMCSREVID VmcsRevId;
1731 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
1732 if (RT_FAILURE(rc))
1733 {
1734 Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
1735 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_PtrReadPhys;
1736 return rc;
1737 }
1738
1739 /* Verify the VMCS revision specified by the guest matches what we reported to the guest,
1740 also check VMCS shadowing feature. */
1741 if ( VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID
1742 || ( VmcsRevId.n.fIsShadowVmcs
1743 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
1744 {
1745 if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
1746 {
1747 Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFail()\n", VMX_V_VMCS_REVISION_ID,
1748 VmcsRevId.n.u31RevisionId));
1749 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_VmcsRevId;
1750 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
1751 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1752 return VINF_SUCCESS;
1753 }
1754
1755 Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
1756 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_ShadowVmcs;
1757 iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
1758 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1759 return VINF_SUCCESS;
1760 }
1761
1762 /*
1763 * We only maintain only the current VMCS in our virtual CPU context (CPUMCTX). Therefore,
1764 * VMPTRLD shall always flush any existing current VMCS back to guest memory before loading
1765 * a new VMCS as current.
1766 */
1767 if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
1768 {
1769 iemVmxCommitCurrentVmcsToMemory(pVCpu);
1770 IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
1771 }
1772 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmptrld_Success;
1773 iemVmxVmSucceed(pVCpu);
1774 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1775 return VINF_SUCCESS;
1776}
1777
1778
1779/**
1780 * VMXON instruction execution worker.
1781 *
1782 * @param pVCpu The cross context virtual CPU structure.
1783 * @param cbInstr The instruction length.
1784 * @param iEffSeg The effective segment register to use with @a
1785 * GCPtrVmxon.
1786 * @param GCPtrVmxon The linear address of the VMXON pointer.
1787 * @param pExitInfo Pointer to the VM-exit instruction information struct.
1788 * Optional, can be NULL.
1789 *
1790 * @remarks Common VMX instruction checks are already expected to by the caller,
1791 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
1792 */
1793IEM_STATIC VBOXSTRICTRC iemVmxVmxon(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmxon,
1794 PCVMXVEXITINFO pExitInfo)
1795{
1796#if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
1797 RT_NOREF5(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, pExitInfo);
1798 return VINF_EM_RAW_EMULATE_INSTR;
1799#else
1800 if (!IEM_IS_VMX_ROOT_MODE(pVCpu))
1801 {
1802 /* CPL. */
1803 if (pVCpu->iem.s.uCpl > 0)
1804 {
1805 Log(("vmxon: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1806 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cpl;
1807 return iemRaiseGeneralProtectionFault0(pVCpu);
1808 }
1809
1810 /* A20M (A20 Masked) mode. */
1811 if (!PGMPhysIsA20Enabled(pVCpu))
1812 {
1813 Log(("vmxon: A20M mode -> #GP(0)\n"));
1814 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_A20M;
1815 return iemRaiseGeneralProtectionFault0(pVCpu);
1816 }
1817
1818 /* CR0 fixed bits. */
1819 bool const fUnrestrictedGuest = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxUnrestrictedGuest;
1820 uint64_t const uCr0Fixed0 = fUnrestrictedGuest ? VMX_V_CR0_FIXED0_UX : VMX_V_CR0_FIXED0;
1821 if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) != uCr0Fixed0)
1822 {
1823 Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
1824 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cr0Fixed0;
1825 return iemRaiseGeneralProtectionFault0(pVCpu);
1826 }
1827
1828 /* CR4 fixed bits. */
1829 if ((pVCpu->cpum.GstCtx.cr4 & VMX_V_CR4_FIXED0) != VMX_V_CR4_FIXED0)
1830 {
1831 Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
1832 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Cr4Fixed0;
1833 return iemRaiseGeneralProtectionFault0(pVCpu);
1834 }
1835
1836 /* Feature control MSR's LOCK and VMXON bits. */
1837 uint64_t const uMsrFeatCtl = CPUMGetGuestIa32FeatureControl(pVCpu);
1838 if (!(uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK | MSR_IA32_FEATURE_CONTROL_VMXON)))
1839 {
1840 Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
1841 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_MsrFeatCtl;
1842 return iemRaiseGeneralProtectionFault0(pVCpu);
1843 }
1844
1845 /* Get the VMXON pointer from the location specified by the source memory operand. */
1846 RTGCPHYS GCPhysVmxon;
1847 VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
1848 if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
1849 {
1850 Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
1851 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrMap;
1852 return rcStrict;
1853 }
1854
1855 /* VMXON region pointer alignment. */
1856 if (GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK)
1857 {
1858 Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
1859 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrAlign;
1860 iemVmxVmFailInvalid(pVCpu);
1861 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1862 return VINF_SUCCESS;
1863 }
1864
1865 /* VMXON physical-address width limits. */
1866 if (GCPhysVmxon >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
1867 {
1868 Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
1869 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrWidth;
1870 iemVmxVmFailInvalid(pVCpu);
1871 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1872 return VINF_SUCCESS;
1873 }
1874
1875 /* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
1876 restriction imposed by our implementation. */
1877 if (!PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
1878 {
1879 Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
1880 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrAbnormal;
1881 iemVmxVmFailInvalid(pVCpu);
1882 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1883 return VINF_SUCCESS;
1884 }
1885
1886 /* Read the VMCS revision ID from the VMXON region. */
1887 VMXVMCSREVID VmcsRevId;
1888 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
1889 if (RT_FAILURE(rc))
1890 {
1891 Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
1892 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_PtrReadPhys;
1893 return rc;
1894 }
1895
1896 /* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
1897 if (RT_UNLIKELY(VmcsRevId.u != VMX_V_VMCS_REVISION_ID))
1898 {
1899 /* Revision ID mismatch. */
1900 if (!VmcsRevId.n.fIsShadowVmcs)
1901 {
1902 Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
1903 VmcsRevId.n.u31RevisionId));
1904 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmcsRevId;
1905 iemVmxVmFailInvalid(pVCpu);
1906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1907 return VINF_SUCCESS;
1908 }
1909
1910 /* Shadow VMCS disallowed. */
1911 Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
1912 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_ShadowVmcs;
1913 iemVmxVmFailInvalid(pVCpu);
1914 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1915 return VINF_SUCCESS;
1916 }
1917
1918 /*
1919 * Record that we're in VMX operation, block INIT, block and disable A20M.
1920 */
1921 pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
1922 IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
1923 pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
1924 /** @todo NSTVMX: clear address-range monitoring. */
1925 /** @todo NSTVMX: Intel PT. */
1926 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_Success;
1927 iemVmxVmSucceed(pVCpu);
1928 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1929# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
1930 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
1931# else
1932 return VINF_SUCCESS;
1933# endif
1934 }
1935 else if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
1936 {
1937 RT_NOREF(pExitInfo);
1938 /** @todo NSTVMX: intercept. */
1939 }
1940
1941 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
1942
1943 /* CPL. */
1944 if (pVCpu->iem.s.uCpl > 0)
1945 {
1946 Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
1947 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmxRootCpl;
1948 return iemRaiseGeneralProtectionFault0(pVCpu);
1949 }
1950
1951 /* VMXON when already in VMX root mode. */
1952 iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
1953 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxon_VmxAlreadyRoot;
1954 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1955 return VINF_SUCCESS;
1956#endif
1957}
1958
1959
1960/**
1961 * Checks host state as part of VM-entry.
1962 *
1963 * @returns VBox status code.
1964 * @param pVCpu The cross context virtual CPU structure.
1965 * @param pszInstr The VMX instruction name (for logging purposes).
1966 */
1967IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckHostState(PVMCPU pVCpu, const char *pszInstr)
1968{
1969 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1970
1971 /*
1972 * Host Control Registers and MSRs.
1973 * See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
1974 */
1975 /* CR0 reserved bits. */
1976 {
1977 /* CR0 MB1 bits. */
1978 uint64_t const u64Cr0Fixed0 = CPUMGetGuestIa32VmxCr0Fixed0(pVCpu);
1979 if (~pVmcs->u64HostCr0.u & u64Cr0Fixed0)
1980 {
1981 Log(("%s: Invalid host CR0 %#RX32 (fixed0) -> VMFail\n", pszInstr, pVmcs->u64HostCr0));
1982 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr0Fixed0;
1983 return VERR_VMX_VMENTRY_FAILED;
1984 }
1985
1986 /* CR0 MBZ bits. */
1987 uint64_t const u64Cr0Fixed1 = CPUMGetGuestIa32VmxCr0Fixed1(pVCpu);
1988 if (pVmcs->u64HostCr0.u & ~u64Cr0Fixed1)
1989 {
1990 Log(("%s: Invalid host CR0 %#RX32 (fixed1) -> VMFail\n", pszInstr, pVmcs->u64HostCr0));
1991 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr0Fixed1;
1992 return VERR_VMX_VMENTRY_FAILED;
1993 }
1994 }
1995
1996 /* CR4 reserved bits. */
1997 {
1998 /* CR4 MB1 bits. */
1999 uint64_t const u64Cr4Fixed0 = CPUMGetGuestIa32VmxCr4Fixed0(pVCpu);
2000 if (~pVmcs->u64HostCr4.u & u64Cr4Fixed0)
2001 {
2002 Log(("%s: Invalid host CR4 %#RX64 (fixed0) -> VMFail\n", pszInstr, pVmcs->u64HostCr4));
2003 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Fixed0;
2004 return VERR_VMX_VMENTRY_FAILED;
2005 }
2006
2007 /* CR4 MBZ bits. */
2008 uint64_t const u64Cr4Fixed1 = CPUMGetGuestIa32VmxCr4Fixed1(pVCpu);
2009 if (pVmcs->u64HostCr4.u & ~u64Cr4Fixed1)
2010 {
2011 Log(("%s: Invalid host CR4 %#RX64 (fixed1) -> VMFail\n", pszInstr, pVmcs->u64HostCr4));
2012 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Fixed1;
2013 return VERR_VMX_VMENTRY_FAILED;
2014 }
2015 }
2016
2017 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2018 {
2019 /* CR3 reserved bits. */
2020 if (pVmcs->u64HostCr3.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2021 {
2022 Log(("%s: Invalid host CR3 %#RX64 -> VMFail\n", pszInstr, pVmcs->u64HostCr3));
2023 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr3;
2024 return VERR_VMX_VMENTRY_FAILED;
2025 }
2026
2027 /* SYSENTER ESP and SYSENTER EIP. */
2028 if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
2029 && X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
2030 { /* likely */ }
2031 else
2032 {
2033 Log(("%s: Host Sysenter ESP (%#RX64) / EIP (%#RX64) not canonical -> VMFail\n", pszInstr,
2034 pVmcs->u64HostSysenterEsp.u, pVmcs->u64HostSysenterEip.u));
2035 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSysenterEspEip;
2036 return VERR_VMX_VMENTRY_FAILED;
2037 }
2038 }
2039
2040 Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR)); /* We don't support loading IA32_PERF_GLOBAL_CTRL MSR yet. */
2041
2042 /* PAT MSR. */
2043 if ( (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
2044 && !CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
2045 {
2046 Log(("%s: Host PAT MSR (%#RX64) invalid\n", pszInstr, pVmcs->u64HostPatMsr.u));
2047 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostPatMsr;
2048 return VERR_VMX_VMENTRY_FAILED;
2049 }
2050
2051 /* EFER MSR. */
2052 uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
2053 if ( (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
2054 && (pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
2055 {
2056 Log(("%s: Host EFER MSR (%#RX64) reserved bits set\n", pszInstr, pVmcs->u64HostEferMsr.u));
2057 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostEferMsr;
2058 return VERR_VMX_VMENTRY_FAILED;
2059 }
2060 bool const fVirtHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2061 bool const fNstGstLongModeActive = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_BIT_LMA);
2062 bool const fNstGstLongModeEnabled = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_BIT_LME);
2063 if (fVirtHostInLongMode == fNstGstLongModeActive == fNstGstLongModeEnabled)
2064 { /* likely */ }
2065 else
2066 {
2067 Log(("%s: Host EFER MSR (%#RX64) LMA, LME, host addr-space size mismatch\n", pszInstr, pVmcs->u64HostEferMsr.u));
2068 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostAddrSpace;
2069 return VERR_VMX_VMENTRY_FAILED;
2070 }
2071
2072 /*
2073 * Host Segment and Descriptor-Table Registers.
2074 * See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
2075 */
2076 /* Selector RPL and TI. */
2077 if ( !(pVmcs->HostCs & (X86_SEL_RPL | X86_SEL_LDT))
2078 && !(pVmcs->HostSs & (X86_SEL_RPL | X86_SEL_LDT))
2079 && !(pVmcs->HostDs & (X86_SEL_RPL | X86_SEL_LDT))
2080 && !(pVmcs->HostEs & (X86_SEL_RPL | X86_SEL_LDT))
2081 && !(pVmcs->HostFs & (X86_SEL_RPL | X86_SEL_LDT))
2082 && !(pVmcs->HostGs & (X86_SEL_RPL | X86_SEL_LDT))
2083 && !(pVmcs->HostTr & (X86_SEL_RPL | X86_SEL_LDT)))
2084 { /* likely */ }
2085 else
2086 {
2087 Log(("%s: One or more host selector registers invalid\n", pszInstr));
2088 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSel;
2089 return VERR_VMX_VMENTRY_FAILED;
2090 }
2091
2092 /* CS and TR selectors cannot be 0. */
2093 if ( pVmcs->HostCs
2094 && pVmcs->HostTr)
2095 { /* likely */ }
2096 else
2097 {
2098 Log(("%s: Host CS/TR selector is invalid\n", pszInstr));
2099 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCsTr;
2100 return VERR_VMX_VMENTRY_FAILED;
2101 }
2102
2103 /* SS cannot be 0 if 32-bit host. */
2104 if ( fVirtHostInLongMode
2105 || pVmcs->HostSs)
2106 { /* likely */ }
2107 else
2108 {
2109 Log(("%s: Host SS selector invalid for 32-bit host\n", pszInstr));
2110 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSs;
2111 return VERR_VMX_VMENTRY_FAILED;
2112 }
2113
2114 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2115 {
2116 /* FS, GS, GDTR, IDTR, TR base address. */
2117 if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
2118 && X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
2119 && X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
2120 && X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
2121 && X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
2122 { /* likely */ }
2123 else
2124 {
2125 Log(("%s: Host segment register (FS/GS/GDTR/IDTR/TR) base address is not canonical\n", pszInstr));
2126 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostSegBase;
2127 return VERR_VMX_VMENTRY_FAILED;
2128 }
2129 }
2130
2131 /*
2132 * Host address-space size for 64-bit CPUs.
2133 * See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
2134 */
2135 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2136 {
2137 bool const fGstInLongMode = CPUMIsGuestInLongMode(pVCpu);
2138 bool const fNstGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
2139
2140 /* Logical processor in IA-32e mode. */
2141 if (fGstInLongMode)
2142 {
2143 if (fVirtHostInLongMode)
2144 {
2145 /* PAE must be set. */
2146 if (pVmcs->u64HostCr4.u & X86_CR4_PAE)
2147 { /* likely */ }
2148 else
2149 {
2150 Log(("%s: Host CR4.PAE not set when logical CPU is in long mode\n", pszInstr));
2151 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Pae;
2152 return VERR_VMX_VMENTRY_FAILED;
2153 }
2154
2155 /* RIP must be canonical. */
2156 if (X86_IS_CANONICAL(pVmcs->u64HostRip.u))
2157 { /* likely */ }
2158 else
2159 {
2160 Log(("%s: Host RIP must be canonicalwhen logical CPU in long mode\n", pszInstr));
2161 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostRip;
2162 return VERR_VMX_VMENTRY_FAILED;
2163 }
2164 }
2165 else
2166 {
2167 Log(("%s: Host must be in long mode when logical CPU in long mode\n", pszInstr));
2168 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostLongMode;
2169 return VERR_VMX_VMENTRY_FAILED;
2170 }
2171 }
2172 else
2173 {
2174 /* Logical processor is outside IA-32e mode. */
2175 if ( !fNstGstInLongMode
2176 && !fVirtHostInLongMode)
2177 {
2178 /* PCIDE should not be set. */
2179 if (!(pVmcs->u64HostCr4.u & X86_CR4_PCIDE))
2180 { /* likely */ }
2181 else
2182 {
2183 Log(("%s: Host CR4.PCIDE must be clear when logical CPU is not in long mode\n", pszInstr));
2184 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostCr4Pcide;
2185 return VERR_VMX_VMENTRY_FAILED;
2186 }
2187
2188 /* The high 32-bits of RIP MBZ. */
2189 if (!pVmcs->u64HostRip.s.Hi)
2190 { /* likely */ }
2191 else
2192 {
2193 Log(("%s: Host RIP high 32-bits must be clear when logical CPU is not in long mode\n", pszInstr));
2194 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostRipRsvd;
2195 return VERR_VMX_VMENTRY_FAILED;
2196 }
2197 }
2198 else
2199 {
2200 Log(("%s: Host/guest cannot be in long mode when logical CPU is not in long mode\n", pszInstr));
2201 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostGuestLongMode;
2202 return VERR_VMX_VMENTRY_FAILED;
2203 }
2204 }
2205 }
2206 else
2207 {
2208 /* Host address-space size for 32-bit CPUs. */
2209 bool const fNstGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
2210 if ( !fNstGstInLongMode
2211 && !fVirtHostInLongMode)
2212 { /* likely */ }
2213 else
2214 {
2215 Log(("%s: Host/guest cannot be in long mode on 32-bit CPUs\n", pszInstr));
2216 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_HostGuestLongModeNoCpu;
2217 return VERR_VMX_VMENTRY_FAILED;
2218 }
2219 }
2220
2221 NOREF(pszInstr);
2222 return VINF_SUCCESS;
2223}
2224
2225
2226/**
2227 * Checks VM-entry controls fields as part of VM-entry.
2228 * See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
2229 *
2230 * @returns VBox status code.
2231 * @param pVCpu The cross context virtual CPU structure.
2232 * @param pszInstr The VMX instruction name (for logging purposes).
2233 */
2234IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckEntryCtls(PVMCPU pVCpu, const char *pszInstr)
2235{
2236 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2237
2238 /* VM-entry controls. */
2239 VMXCTLSMSR EntryCtls;
2240 EntryCtls.u = CPUMGetGuestIa32VmxEntryCtls(pVCpu);
2241 if (~pVmcs->u32EntryCtls & EntryCtls.n.disallowed0)
2242 {
2243 Log(("%s: Invalid EntryCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32EntryCtls));
2244 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryCtlsDisallowed0;
2245 return VERR_VMX_VMENTRY_FAILED;
2246 }
2247 if (pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1)
2248 {
2249 Log(("%s: Invalid EntryCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32EntryCtls));
2250 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryCtlsAllowed1;
2251 return VERR_VMX_VMENTRY_FAILED;
2252 }
2253
2254 /* Event injection. */
2255 uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
2256 if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
2257 {
2258 /* Type and vector. */
2259 uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
2260 uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
2261 uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
2262 if ( uRsvd == 0
2263 && HMVmxIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
2264 && HMVmxIsEntryIntInfoVectorValid(uVector, uType))
2265 { /* likely */ }
2266 else
2267 {
2268 Log(("%s: VM-entry interruption info (%#RX32) invalid (rsvd/type/vector) -> VMFail\n", pszInstr, uIntInfo));
2269 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoTypeVecRsvd;
2270 return VERR_VMX_VMENTRY_FAILED;
2271 }
2272
2273 /* Exception error code. */
2274 if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
2275 {
2276 /* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
2277 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
2278 || (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
2279 { /* likely */ }
2280 else
2281 {
2282 Log(("%s: VM-entry interruption (%#RX32) invalid error-code (paging-mode) -> VMFail\n", pszInstr, uIntInfo));
2283 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoErrCodePe;
2284 return VERR_VMX_VMENTRY_FAILED;
2285 }
2286
2287 /* Exceptions that provide an error code. */
2288 if ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
2289 && ( uVector == X86_XCPT_DF
2290 || uVector == X86_XCPT_TS
2291 || uVector == X86_XCPT_NP
2292 || uVector == X86_XCPT_SS
2293 || uVector == X86_XCPT_GP
2294 || uVector == X86_XCPT_PF
2295 || uVector == X86_XCPT_AC))
2296 { /* likely */ }
2297 else
2298 {
2299 Log(("%s: VM-entry interruption (%#RX32) invalid error-code (vector) -> VMFail\n", pszInstr, uIntInfo));
2300 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryIntInfoErrCodeVec;
2301 return VERR_VMX_VMENTRY_FAILED;
2302 }
2303
2304 /* Exception error-code reserved bits. */
2305 if (pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK)
2306 {
2307 Log(("%s: VM-entry exception error-code (%#RX32) invalid -> VMFail\n", pszInstr, uIntInfo));
2308 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryXcptErrCodeRsvd;
2309 return VERR_VMX_VMENTRY_FAILED;
2310 }
2311
2312 /* Injecting a software interrupt, software exception or privileged software exception. */
2313 if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
2314 || uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
2315 || uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
2316 {
2317 /* Instruction length must be in the range 0-15. */
2318 if (pVmcs->u32EntryInstrLen > VMX_ENTRY_INSTR_LEN_MAX)
2319 {
2320 Log(("%s: VM-entry instruction length (%#RX32) invalid -> VMFail\n", pszInstr, pVmcs->u32EntryInstrLen));
2321 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryInstrLen;
2322 return VERR_VMX_VMENTRY_FAILED;
2323 }
2324
2325 /* Zero instruction length is allowed only when the CPU supports it explicitly. */
2326 if ( pVmcs->u32EntryInstrLen == 0
2327 && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
2328 {
2329 Log(("%s: VM-entry instruction length zero invalid (swint/xcpt/priv) -> VMFail\n", pszInstr));
2330 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_EntryInstrLenZero;
2331 return VERR_VMX_VMENTRY_FAILED;
2332 }
2333 }
2334 }
2335 }
2336
2337 /* VM-entry MSR-load count and VM-entry MSR-load area address. */
2338 if (pVmcs->u32EntryMsrLoadCount)
2339 {
2340 if ( (pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
2341 || (pVmcs->u64AddrEntryMsrLoad.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2342 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
2343 {
2344 Log(("%s: VM-entry MSR-load area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrEntryMsrLoad.u));
2345 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrEntryMsrLoad;
2346 return VERR_VMX_VMENTRY_FAILED;
2347 }
2348 }
2349
2350 Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
2351 Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
2352
2353 NOREF(pszInstr);
2354 return VINF_SUCCESS;
2355}
2356
2357
2358/**
2359 * Checks VM-exit controls fields as part of VM-entry.
2360 * See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
2361 *
2362 * @returns VBox status code.
2363 * @param pVCpu The cross context virtual CPU structure.
2364 * @param pszInstr The VMX instruction name (for logging purposes).
2365 */
2366IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckExitCtls(PVMCPU pVCpu, const char *pszInstr)
2367{
2368 PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2369
2370 /* VM-exit controls. */
2371 VMXCTLSMSR ExitCtls;
2372 ExitCtls.u = CPUMGetGuestIa32VmxExitCtls(pVCpu);
2373 if (~pVmcs->u32ExitCtls & ExitCtls.n.disallowed0)
2374 {
2375 Log(("%s: Invalid ExitCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2376 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ExitCtlsDisallowed0;
2377 return VERR_VMX_VMENTRY_FAILED;
2378 }
2379 if (pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1)
2380 {
2381 Log(("%s: Invalid ExitCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2382 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ExitCtlsAllowed1;
2383 return VERR_VMX_VMENTRY_FAILED;
2384 }
2385
2386 /* Save preemption timer without activating it. */
2387 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
2388 && (pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
2389 {
2390 Log(("%s: Save Preempt-Timer without activate Preempt timer -> VMFail\n", pszInstr, pVmcs->u32ExitCtls));
2391 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_SavePreemptTimer;
2392 return VERR_VMX_VMENTRY_FAILED;
2393 }
2394
2395 /* VM-exit MSR-store count and VM-exit MSR-store area address. */
2396 if (pVmcs->u32ExitMsrStoreCount)
2397 {
2398 if ( (pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
2399 || (pVmcs->u64AddrExitMsrStore.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2400 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
2401 {
2402 Log(("%s: VM-exit MSR-store area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrExitMsrStore.u));
2403 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrExitMsrStore;
2404 return VERR_VMX_VMENTRY_FAILED;
2405 }
2406 }
2407
2408 /* VM-exit MSR-load count and VM-exit MSR-load area address. */
2409 if (pVmcs->u32ExitMsrLoadCount)
2410 {
2411 if ( (pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
2412 || (pVmcs->u64AddrExitMsrLoad.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2413 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
2414 {
2415 Log(("%s: VM-exit MSR-store area address %#RX64 invalid -> VMFail\n", pszInstr, pVmcs->u64AddrExitMsrLoad.u));
2416 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrExitMsrLoad;
2417 return VERR_VMX_VMENTRY_FAILED;
2418 }
2419 }
2420
2421 NOREF(pszInstr);
2422 return VINF_SUCCESS;
2423}
2424
2425
2426/**
2427 * Checks VM-execution controls fields as part of VM-entry.
2428 * See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
2429 *
2430 * @returns VBox status code.
2431 * @param pVCpu The cross context virtual CPU structure.
2432 * @param pszInstr The VMX instruction name (for logging purposes).
2433 *
2434 * @remarks This may update secondary-processor based VM-execution control fields
2435 * in the current VMCS if necessary.
2436 */
2437IEM_STATIC VBOXSTRICTRC iemVmxVmentryCheckExecCtls(PVMCPU pVCpu, const char *pszInstr)
2438{
2439 PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2440 /* Pin-based VM-execution controls. */
2441 {
2442 VMXCTLSMSR PinCtls;
2443 PinCtls.u = CPUMGetGuestIa32VmxPinbasedCtls(pVCpu);
2444 if (~pVmcs->u32PinCtls & PinCtls.n.disallowed0)
2445 {
2446 Log(("%s: Invalid PinCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32PinCtls));
2447 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PinCtlsDisallowed0;
2448 return VERR_VMX_VMENTRY_FAILED;
2449 }
2450 if (pVmcs->u32PinCtls & ~PinCtls.n.allowed1)
2451 {
2452 Log(("%s: Invalid PinCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32PinCtls));
2453 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PinCtlsAllowed1;
2454 return VERR_VMX_VMENTRY_FAILED;
2455 }
2456 }
2457
2458 /* Processor-based VM-execution controls. */
2459 {
2460 VMXCTLSMSR ProcCtls;
2461 ProcCtls.u = CPUMGetGuestIa32VmxProcbasedCtls(pVCpu);
2462 if (~pVmcs->u32ProcCtls & ProcCtls.n.disallowed0)
2463 {
2464 Log(("%s: Invalid ProcCtls %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls));
2465 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtlsDisallowed0;
2466 return VERR_VMX_VMENTRY_FAILED;
2467 }
2468 if (pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1)
2469 {
2470 Log(("%s: Invalid ProcCtls %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls));
2471 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtlsAllowed1;
2472 return VERR_VMX_VMENTRY_FAILED;
2473 }
2474 }
2475
2476 /* Secondary processor-based VM-execution controls. */
2477 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
2478 {
2479 VMXCTLSMSR ProcCtls2;
2480 ProcCtls2.u = CPUMGetGuestIa32VmxProcbasedCtls(pVCpu);
2481 if (~pVmcs->u32ProcCtls2 & ProcCtls2.n.disallowed0)
2482 {
2483 Log(("%s: Invalid ProcCtls2 %#RX32 (disallowed0) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls2));
2484 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtls2Disallowed0;
2485 return VERR_VMX_VMENTRY_FAILED;
2486 }
2487 if (pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1)
2488 {
2489 Log(("%s: Invalid ProcCtls2 %#RX32 (allowed1) -> VMFail\n", pszInstr, pVmcs->u32ProcCtls2));
2490 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ProcCtls2Allowed1;
2491 return VERR_VMX_VMENTRY_FAILED;
2492 }
2493 }
2494 else
2495 {
2496 /*
2497 * The guest is always capable of corrupting the VMCS by writing to the VMCS is guest
2498 * memory directly rather than follow the rules. So we don't make any assumptions that
2499 * u32ProcCtls2 will be 0 if no secondary-processor based VM-execution control support
2500 * is reported to the guest.
2501 */
2502 pVmcs->u32ProcCtls2 = 0;
2503 }
2504
2505 /* CR3-target count. */
2506 if (pVmcs->u32Cr3TargetCount > VMX_V_CR3_TARGET_COUNT)
2507 {
2508 Log(("%s: CR3-target count exceeded %#x -> VMFail\n", pszInstr, pVmcs->u32Cr3TargetCount));
2509 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Cr3TargetCount;
2510 return VERR_VMX_VMENTRY_FAILED;
2511 }
2512
2513 /* IO bitmaps physical addresses. */
2514 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
2515 {
2516 if ( (pVmcs->u64AddrIoBitmapA.u & X86_PAGE_4K_OFFSET_MASK)
2517 || (pVmcs->u64AddrIoBitmapA.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2518 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapA.u))
2519 {
2520 Log(("%s: I/O Bitmap A physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrIoBitmapA.u));
2521 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrIoBitmapA;
2522 return VERR_VMX_VMENTRY_FAILED;
2523 }
2524
2525 if ( (pVmcs->u64AddrIoBitmapB.u & X86_PAGE_4K_OFFSET_MASK)
2526 || (pVmcs->u64AddrIoBitmapB.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2527 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapB.u))
2528 {
2529 Log(("%s: I/O Bitmap B physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrIoBitmapB.u));
2530 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrIoBitmapB;
2531 return VERR_VMX_VMENTRY_FAILED;
2532 }
2533 }
2534
2535 /* MSR bitmap physical address. */
2536 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
2537 {
2538 if ( (pVmcs->u64AddrMsrBitmap.u & X86_PAGE_4K_OFFSET_MASK)
2539 || (pVmcs->u64AddrMsrBitmap.u >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2540 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrMsrBitmap.u))
2541 {
2542 Log(("%s: MSR Bitmap physaddr invalid %#RX64 -> VMFail\n", pszInstr, pVmcs->u64AddrMsrBitmap.u));
2543 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrMsrBitmap;
2544 return VERR_VMX_VMENTRY_FAILED;
2545 }
2546 }
2547
2548 /* TPR shadow related controls. */
2549 if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
2550 {
2551 /* Virtual-APIC page physical address. */
2552 RTGCPHYS GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
2553 if ( (GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
2554 || (GCPhysVirtApic >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2555 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
2556 {
2557 Log(("%s: Virtual-APIC page physaddr invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVirtApic));
2558 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVirtApicPage;
2559 return VERR_VMX_VMENTRY_FAILED;
2560 }
2561
2562 /* Read the Virtual-APIC page. */
2563 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage));
2564 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage),
2565 GCPhysVirtApic, VMX_V_VIRT_APIC_PAGES);
2566 if (RT_FAILURE(rc))
2567 {
2568 Log(("%s: Failed to read Virtual-APIC page at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVirtApic, rc));
2569 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtApicPagePtrReadPhys;
2570 return rc;
2571 }
2572
2573 /* TPR threshold without virtual-interrupt delivery. */
2574 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2575 && (pVmcs->u32TprThreshold & VMX_TPR_THRESHOLD_MASK))
2576 {
2577 Log(("%s: TPR-threshold (%#RX32) invalid -> VMFail\n", pszInstr, pVmcs->u32TprThreshold));
2578 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_TprThreshold;
2579 return VERR_VMX_VMENTRY_FAILED;
2580 }
2581
2582 /* TPR threshold and VTPR. */
2583 uint8_t const *pbVirtApic = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVirtApicPage);
2584 uint8_t const u8VTpr = *(pbVirtApic + XAPIC_OFF_TPR);
2585 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
2586 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2587 && RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) > ((u8VTpr >> 4) & UINT32_C(0xf)) /* Bits 4:7 */)
2588 {
2589 Log(("%s: TPR-threshold (%#x) exceeds VTPR (%#x) -> VMFail\n", pszInstr,
2590 (pVmcs->u32TprThreshold & VMX_TPR_THRESHOLD_MASK), u8VTpr));
2591 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_TprThresholdVTpr;
2592 return VERR_VMX_VMENTRY_FAILED;
2593 }
2594 }
2595 else
2596 {
2597 if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2598 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
2599 && !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
2600 { /* likely */ }
2601 else
2602 {
2603 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2604 {
2605 Log(("%s: Virtualize x2APIC access without TPR shadowing -> VMFail\n", pszInstr));
2606 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicTprShadow;
2607 return VERR_VMX_VMENTRY_FAILED;
2608 }
2609 else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
2610 {
2611 Log(("%s: APIC-register virtualization without TPR shadowing -> VMFail\n", pszInstr));
2612 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_ApicRegVirt;
2613 return VERR_VMX_VMENTRY_FAILED;
2614 }
2615 else
2616 {
2617 Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
2618 Log(("%s: Virtual-interrupt delivery without TPR shadowing -> VMFail\n", pszInstr));
2619 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtIntDelivery;
2620 return VERR_VMX_VMENTRY_FAILED;
2621 }
2622 }
2623 }
2624
2625 /* NMI exiting and virtual-NMIs. */
2626 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
2627 && (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
2628 {
2629 Log(("%s: Virtual-NMIs invalid without NMI-exiting -> VMFail\n", pszInstr));
2630 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtNmi;
2631 return VERR_VMX_VMENTRY_FAILED;
2632 }
2633
2634 /* Virtual-NMIs and NMI-window exiting. */
2635 if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
2636 && (pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
2637 {
2638 Log(("%s: NMI-window exiting invalid without virtual-NMIs -> VMFail\n", pszInstr));
2639 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_NmiWindowExit;
2640 return VERR_VMX_VMENTRY_FAILED;
2641 }
2642
2643 /* Virtualize APIC accesses. */
2644 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
2645 {
2646 /* APIC-access physical address. */
2647 RTGCPHYS GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
2648 if ( (GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
2649 || (GCPhysApicAccess >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2650 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
2651 {
2652 Log(("%s: APIC-access address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysApicAccess));
2653 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrApicAccess;
2654 return VERR_VMX_VMENTRY_FAILED;
2655 }
2656 }
2657
2658 /* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
2659 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
2660 && (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
2661 {
2662 Log(("%s: Virtualize-APIC access when virtualize-x2APIC mode is enabled -> VMFail", pszInstr));
2663 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicVirtApic;
2664 return VERR_VMX_VMENTRY_FAILED;
2665 }
2666
2667 /* Virtual-interrupt delivery requires external interrupt exiting. */
2668 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
2669 && !(pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
2670 {
2671 Log(("%s: Virtual-interrupt delivery without external interrupt exiting -> VMFail\n", pszInstr));
2672 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VirtX2ApicVirtApic;
2673 return VERR_VMX_VMENTRY_FAILED;
2674 }
2675
2676 /* VPID. */
2677 if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
2678 && pVmcs->u16Vpid == 0)
2679 {
2680 Log(("%s: VPID invalid -> VMFail\n", pszInstr));
2681 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Vpid;
2682 return VERR_VMX_VMENTRY_FAILED;
2683 }
2684
2685 Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
2686 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)); /* We don't support EPT yet. */
2687 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
2688 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)); /* We don't support Unrestricted-guests yet. */
2689 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
2690 Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_VE)); /* We don't support EPT-violation #VE yet. */
2691
2692 /* VMCS shadowing. */
2693 if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
2694 {
2695 /* VMREAD-bitmap physical address. */
2696 RTGCPHYS GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
2697 if ( ( GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
2698 || ( GCPhysVmreadBitmap >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2699 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
2700 {
2701 Log(("%s: VMREAD-bitmap address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVmreadBitmap));
2702 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVmreadBitmap;
2703 return VERR_VMX_VMENTRY_FAILED;
2704 }
2705
2706 /* VMWRITE-bitmap physical address. */
2707 RTGCPHYS GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
2708 if ( ( GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
2709 || ( GCPhysVmwriteBitmap >> IEM_VMX_MAX_PHYSADDR_WIDTH(pVCpu))
2710 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
2711 {
2712 Log(("%s: VMWRITE-bitmap address invalid %#RX64 -> VMFail\n", pszInstr, GCPhysVmwriteBitmap));
2713 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_AddrVmwriteBitmap;
2714 return VERR_VMX_VMENTRY_FAILED;
2715 }
2716
2717 /* Read the VMREAD-bitmap. */
2718 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap));
2719 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap),
2720 GCPhysVmreadBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
2721 if (RT_FAILURE(rc))
2722 {
2723 Log(("%s: Failed to read VMREAD-bitmap at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmreadBitmap, rc));
2724 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmreadBitmapPtrReadPhys;
2725 return rc;
2726 }
2727
2728 /* Read the VMWRITE-bitmap. */
2729 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap));
2730 rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap),
2731 GCPhysVmwriteBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
2732 if (RT_FAILURE(rc))
2733 {
2734 Log(("%s: Failed to read VMWRITE-bitmap at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmwriteBitmap, rc));
2735 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmwriteBitmapPtrReadPhys;
2736 return rc;
2737 }
2738 }
2739
2740 NOREF(pszInstr);
2741 return VINF_SUCCESS;
2742}
2743
2744
2745/**
2746 * VMLAUNCH/VMRESUME instruction execution worker.
2747 *
2748 * @param pVCpu The cross context virtual CPU structure.
2749 * @param cbInstr The instruction length.
2750 * @param uInstrId The instruction identity (either VMXINSTRID_VMLAUNCH or
2751 * VMXINSTRID_VMRESUME).
2752 * @param pExitInfo Pointer to the VM-exit instruction information struct.
2753 * Optional, can be NULL.
2754 *
2755 * @remarks Common VMX instruction checks are already expected to by the caller,
2756 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
2757 */
2758IEM_STATIC VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPU pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId, PCVMXVEXITINFO pExitInfo)
2759{
2760 Assert( uInstrId == VMXINSTRID_VMLAUNCH
2761 || uInstrId == VMXINSTRID_VMRESUME);
2762
2763 const char *pszInstr = uInstrId == VMXINSTRID_VMLAUNCH ? "vmlaunch" : "vmresume";
2764 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
2765 {
2766 RT_NOREF(pExitInfo);
2767 /** @todo NSTVMX: intercept. */
2768 }
2769 Assert(IEM_IS_VMX_ROOT_MODE(pVCpu));
2770
2771 /* CPL. */
2772 if (pVCpu->iem.s.uCpl > 0)
2773 {
2774 Log(("%s: CPL %u -> #GP(0)\n", pszInstr, pVCpu->iem.s.uCpl));
2775 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Cpl;
2776 return iemRaiseGeneralProtectionFault0(pVCpu);
2777 }
2778
2779 /* Current VMCS valid. */
2780 if (!IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
2781 {
2782 Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
2783 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PtrInvalid;
2784 iemVmxVmFailInvalid(pVCpu);
2785 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2786 return VINF_SUCCESS;
2787 }
2788
2789 /** @todo Distinguish block-by-MOV-SS from block-by-STI. Currently we
2790 * use block-by-STI here which is not quite correct. */
2791 if ( VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
2792 && pVCpu->cpum.GstCtx.rip == EMGetInhibitInterruptsPC(pVCpu))
2793 {
2794 Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
2795 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_BlocKMovSS;
2796 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
2797 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2798 return VINF_SUCCESS;
2799 }
2800
2801 if (uInstrId == VMXINSTRID_VMLAUNCH)
2802 {
2803 /* VMLAUNCH with non-clear VMCS. */
2804 if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState != VMX_V_VMCS_STATE_CLEAR)
2805 {
2806 Log(("vmlaunch: VMLAUNCH with non-clear VMCS -> VMFail\n"));
2807 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmcsClear;
2808 iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
2809 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2810 return VINF_SUCCESS;
2811 }
2812 }
2813 else
2814 {
2815 /* VMRESUME with non-launched VMCS. */
2816 if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState != VMX_V_VMCS_STATE_LAUNCHED)
2817 {
2818 Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
2819 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_VmcsLaunch;
2820 iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
2821 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2822 return VINF_SUCCESS;
2823 }
2824 }
2825
2826 /*
2827 * Load the current VMCS.
2828 */
2829 Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
2830 int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs),
2831 IEM_VMX_GET_CURRENT_VMCS(pVCpu), VMX_V_VMCS_SIZE);
2832 if (RT_FAILURE(rc))
2833 {
2834 Log(("%s: Failed to read VMCS at %#RGp, rc=%Rrc\n", pszInstr, rc));
2835 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_PtrReadPhys;
2836 return rc;
2837 }
2838
2839 /*
2840 * Check VM-execution control fields.
2841 */
2842 rc = iemVmxVmentryCheckExecCtls(pVCpu, pszInstr);
2843 if (rc == VINF_SUCCESS)
2844 { /* likely */ }
2845 else
2846 {
2847 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2848 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2849 return VINF_SUCCESS;
2850 }
2851
2852 /*
2853 * Check VM-exit control fields.
2854 */
2855 rc = iemVmxVmentryCheckExitCtls(pVCpu, pszInstr);
2856 if (rc == VINF_SUCCESS)
2857 { /* likely */ }
2858 else
2859 {
2860 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2861 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2862 return VINF_SUCCESS;
2863 }
2864
2865 /*
2866 * Check VM-entry control fields.
2867 */
2868 rc = iemVmxVmentryCheckEntryCtls(pVCpu, pszInstr);
2869 if (rc == VINF_SUCCESS)
2870 { /* likely */ }
2871 else
2872 {
2873 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
2874 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2875 return VINF_SUCCESS;
2876 }
2877
2878 /*
2879 * Check host-state fields.
2880 */
2881 rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
2882 if (rc == VINF_SUCCESS)
2883 { /* likely */ }
2884 else
2885 {
2886 iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
2887 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2888 return VINF_SUCCESS;
2889 }
2890
2891 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmentry_Success;
2892 iemVmxVmSucceed(pVCpu);
2893 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2894 return VERR_IEM_IPE_2;
2895}
2896
2897
2898/**
2899 * Implements 'VMXON'.
2900 */
2901IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
2902{
2903 return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
2904}
2905
2906
2907/**
2908 * Implements 'VMXOFF'.
2909 *
2910 * @remarks Common VMX instruction checks are already expected to by the caller,
2911 * i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
2912 */
2913IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
2914{
2915# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2916 RT_NOREF2(pVCpu, cbInstr);
2917 return VINF_EM_RAW_EMULATE_INSTR;
2918# else
2919 if (IEM_IS_VMX_NON_ROOT_MODE(pVCpu))
2920 {
2921 /** @todo NSTVMX: intercept. */
2922 }
2923
2924 /* CPL. */
2925 if (pVCpu->iem.s.uCpl > 0)
2926 {
2927 Log(("vmxoff: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
2928 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxoff_Cpl;
2929 return iemRaiseGeneralProtectionFault0(pVCpu);
2930 }
2931
2932 /* Dual monitor treatment of SMIs and SMM. */
2933 uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
2934 if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID)
2935 {
2936 iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
2937 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2938 return VINF_SUCCESS;
2939 }
2940
2941 /*
2942 * Record that we're no longer in VMX root operation, block INIT, block and disable A20M.
2943 */
2944 pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
2945 Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
2946
2947 if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
2948 { /** @todo NSTVMX: Unblock SMI. */ }
2949 /** @todo NSTVMX: Unblock and enable A20M. */
2950 /** @todo NSTVMX: Clear address-range monitoring. */
2951
2952 pVCpu->cpum.GstCtx.hwvirt.vmx.enmInstrDiag = kVmxVInstrDiag_Vmxoff_Success;
2953 iemVmxVmSucceed(pVCpu);
2954 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2955# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2956 return EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2957# else
2958 return VINF_SUCCESS;
2959# endif
2960# endif
2961}
2962
2963
2964/**
2965 * Implements 'VMLAUNCH'.
2966 */
2967IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
2968{
2969 return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH, NULL /* pExitInfo */);
2970}
2971
2972
2973/**
2974 * Implements 'VMRESUME'.
2975 */
2976IEM_CIMPL_DEF_0(iemCImpl_vmresume)
2977{
2978 return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME, NULL /* pExitInfo */);
2979}
2980
2981
2982/**
2983 * Implements 'VMPTRLD'.
2984 */
2985IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
2986{
2987 return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
2988}
2989
2990
2991/**
2992 * Implements 'VMPTRST'.
2993 */
2994IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
2995{
2996 return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
2997}
2998
2999
3000/**
3001 * Implements 'VMCLEAR'.
3002 */
3003IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
3004{
3005 return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
3006}
3007
3008
3009/**
3010 * Implements 'VMWRITE' register.
3011 */
3012IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64FieldEnc)
3013{
3014 return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg */, IEMMODE_64BIT /* N/A */, u64Val, u64FieldEnc,
3015 NULL /* pExitInfo */);
3016}
3017
3018
3019/**
3020 * Implements 'VMWRITE' memory.
3021 */
3022IEM_CIMPL_DEF_4(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrVal, uint32_t, u64FieldEnc)
3023{
3024 return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrVal, u64FieldEnc, NULL /* pExitInfo */);
3025}
3026
3027
3028/**
3029 * Implements 'VMREAD' 64-bit register.
3030 */
3031IEM_CIMPL_DEF_2(iemCImpl_vmread64_reg, uint64_t *, pu64Dst, uint64_t, u64FieldEnc)
3032{
3033 return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, NULL /* pExitInfo */);
3034}
3035
3036
3037/**
3038 * Implements 'VMREAD' 32-bit register.
3039 */
3040IEM_CIMPL_DEF_2(iemCImpl_vmread32_reg, uint32_t *, pu32Dst, uint32_t, u32FieldEnc)
3041{
3042 return iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u32FieldEnc, NULL /* pExitInfo */);
3043}
3044
3045
3046/**
3047 * Implements 'VMREAD' memory.
3048 */
3049IEM_CIMPL_DEF_4(iemCImpl_vmread_mem, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrDst, uint32_t, u64FieldEnc)
3050{
3051 return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrDst, u64FieldEnc, NULL /* pExitInfo */);
3052}
3053
3054#endif
3055
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette