IEMAllCImplVmxInstr.cpp.h@ 78481

Last change on this file since 78481 was 78481, checked in by vboxsync, 6 years ago
VMM/HM, IEM: Nested VMX: bugref:9180 Hardware-assisted VMX VM-exit handling interface bits, I/O exit handling, comments and disabled code on what needs to be done with future optimizations.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 352.5 KB

Line
1	/* $Id: IEMAllCImplVmxInstr.cpp.h 78481 2019-05-13 09:52:54Z vboxsync $ */
2	/** @file
3	* IEM - VT-x instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2019 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/*********************************************************************************************************************************
20	* Defined Constants And Macros *
21	*********************************************************************************************************************************/
22	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
23	/**
24	* Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
25	* relative offsets.
26	*/
27	# ifdef IEM_WITH_CODE_TLB
28	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { } while (0)
29	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { } while (0)
30	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
31	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { } while (0)
32	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
33	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { } while (0)
34	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
35	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { } while (0)
36	# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
37	# else /* !IEM_WITH_CODE_TLB */
38	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
39	do \
40	{ \
41	Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
42	(a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
43	} while (0)
44
45	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
46
47	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
48	do \
49	{ \
50	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
51	uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
52	uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
53	(a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
54	} while (0)
55
56	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
57	do \
58	{ \
59	Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
60	(a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
61	} while (0)
62
63	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
64	do \
65	{ \
66	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
67	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
68	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
69	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
70	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
71	(a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
72	} while (0)
73
74	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
75	do \
76	{ \
77	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
78	(a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
79	} while (0)
80
81	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
82	do \
83	{ \
84	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
85	(a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
86	} while (0)
87
88	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
89	do \
90	{ \
91	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
92	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
93	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
94	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
95	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
96	(a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
97	} while (0)
98	# endif /* !IEM_WITH_CODE_TLB */
99
100	/** Gets the guest-physical address of the shadows VMCS for the given VCPU. */
101	# define IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysShadowVmcs)
102
103	/** Whether a shadow VMCS is present for the given VCPU. */
104	# define IEM_VMX_HAS_SHADOW_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_SHADOW_VMCS(a_pVCpu) != NIL_RTGCPHYS)
105
106	/** Gets the VMXON region pointer. */
107	# define IEM_VMX_GET_VMXON_PTR(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
108
109	/** Gets the guest-physical address of the current VMCS for the given VCPU. */
110	# define IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) ((a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs)
111
112	/** Whether a current VMCS is present for the given VCPU. */
113	# define IEM_VMX_HAS_CURRENT_VMCS(a_pVCpu) RT_BOOL(IEM_VMX_GET_CURRENT_VMCS(a_pVCpu) != NIL_RTGCPHYS)
114
115	/** Assigns the guest-physical address of the current VMCS for the given VCPU. */
116	# define IEM_VMX_SET_CURRENT_VMCS(a_pVCpu, a_GCPhysVmcs) \
117	do \
118	{ \
119	Assert((a_GCPhysVmcs) != NIL_RTGCPHYS); \
120	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = (a_GCPhysVmcs); \
121	} while (0)
122
123	/** Clears any current VMCS for the given VCPU. */
124	# define IEM_VMX_CLEAR_CURRENT_VMCS(a_pVCpu) \
125	do \
126	{ \
127	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs = NIL_RTGCPHYS; \
128	} while (0)
129
130	/** Check for VMX instructions requiring to be in VMX operation.
131	* @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs updating. */
132	# define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
133	do \
134	{ \
135	if (IEM_VMX_IS_ROOT_MODE(a_pVCpu)) \
136	{ /* likely */ } \
137	else \
138	{ \
139	Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
140	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = a_InsDiagPrefix##_VmxRoot; \
141	return iemRaiseUndefinedOpcode(a_pVCpu); \
142	} \
143	} while (0)
144
145	/** Marks a VM-entry failure with a diagnostic reason, logs and returns. */
146	# define IEM_VMX_VMENTRY_FAILED_RET(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag) \
147	do \
148	{ \
149	Log(("%s: VM-entry failed! enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_VmxDiag), \
150	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
151	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
152	return VERR_VMX_VMENTRY_FAILED; \
153	} while (0)
154
155	/** Marks a VM-exit failure with a diagnostic reason, logs and returns. */
156	# define IEM_VMX_VMEXIT_FAILED_RET(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
157	do \
158	{ \
159	Log(("VM-exit failed! uExitReason=%u enmDiag=%u (%s) -> %s\n", (a_uExitReason), (a_VmxDiag), \
160	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
161	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
162	return VERR_VMX_VMEXIT_FAILED; \
163	} while (0)
164
165
166	/*********************************************************************************************************************************
167	* Global Variables *
168	*********************************************************************************************************************************/
169	/** @todo NSTVMX: The following VM-exit intercepts are pending:
170	* VMX_EXIT_IO_SMI
171	* VMX_EXIT_SMI
172	* VMX_EXIT_GETSEC
173	* VMX_EXIT_RSM
174	* VMX_EXIT_MONITOR (APIC access VM-exit caused by MONITOR pending)
175	* VMX_EXIT_ERR_MACHINE_CHECK (we never need to raise this?)
176	* VMX_EXIT_APIC_ACCESS
177	* VMX_EXIT_EPT_VIOLATION
178	* VMX_EXIT_EPT_MISCONFIG
179	* VMX_EXIT_INVEPT
180	* VMX_EXIT_INVVPID
181	* VMX_EXIT_RDRAND
182	* VMX_EXIT_VMFUNC
183	* VMX_EXIT_ENCLS
184	* VMX_EXIT_RDSEED
185	* VMX_EXIT_PML_FULL
186	* VMX_EXIT_XSAVES
187	* VMX_EXIT_XRSTORS
188	*/
189	/**
190	* Map of VMCS field encodings to their virtual-VMCS structure offsets.
191	*
192	* The first array dimension is VMCS field encoding of Width OR'ed with Type and the
193	* second dimension is the Index, see VMXVMCSFIELDENC.
194	*/
195	uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
196	{
197	/* VMX_VMCS_ENC_WIDTH_16BIT \| VMX_VMCS_ENC_TYPE_CONTROL: */
198	{
199	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u16Vpid),
200	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
201	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u16EptpIndex),
202	/* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
203	/* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
204	/* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
205	},
206	/* VMX_VMCS_ENC_WIDTH_16BIT \| VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
207	{
208	/* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
209	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
210	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
211	/* 24-25 */ UINT16_MAX, UINT16_MAX
212	},
213	/* VMX_VMCS_ENC_WIDTH_16BIT \| VMX_VMCS_ENC_TYPE_GUEST_STATE: */
214	{
215	/* 0 */ RT_UOFFSETOF(VMXVVMCS, GuestEs),
216	/* 1 */ RT_UOFFSETOF(VMXVVMCS, GuestCs),
217	/* 2 */ RT_UOFFSETOF(VMXVVMCS, GuestSs),
218	/* 3 */ RT_UOFFSETOF(VMXVVMCS, GuestDs),
219	/* 4 */ RT_UOFFSETOF(VMXVVMCS, GuestFs),
220	/* 5 */ RT_UOFFSETOF(VMXVVMCS, GuestGs),
221	/* 6 */ RT_UOFFSETOF(VMXVVMCS, GuestLdtr),
222	/* 7 */ RT_UOFFSETOF(VMXVVMCS, GuestTr),
223	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u16GuestIntStatus),
224	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u16PmlIndex),
225	/* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
226	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
227	},
228	/* VMX_VMCS_ENC_WIDTH_16BIT \| VMX_VMCS_ENC_TYPE_HOST_STATE: */
229	{
230	/* 0 */ RT_UOFFSETOF(VMXVVMCS, HostEs),
231	/* 1 */ RT_UOFFSETOF(VMXVVMCS, HostCs),
232	/* 2 */ RT_UOFFSETOF(VMXVVMCS, HostSs),
233	/* 3 */ RT_UOFFSETOF(VMXVVMCS, HostDs),
234	/* 4 */ RT_UOFFSETOF(VMXVVMCS, HostFs),
235	/* 5 */ RT_UOFFSETOF(VMXVVMCS, HostGs),
236	/* 6 */ RT_UOFFSETOF(VMXVVMCS, HostTr),
237	/* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
238	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
239	/* 23-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
240	},
241	/* VMX_VMCS_ENC_WIDTH_64BIT \| VMX_VMCS_ENC_TYPE_CONTROL: */
242	{
243	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
244	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
245	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
246	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
247	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
248	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
249	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
250	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPml),
251	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64TscOffset),
252	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVirtApic),
253	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64AddrApicAccess),
254	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
255	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64VmFuncCtls),
256	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64EptpPtr),
257	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
258	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
259	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
260	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
261	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEptpList),
262	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
263	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
264	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
265	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64XssBitmap),
266	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEnclsBitmap),
267	/* 24 */ UINT16_MAX,
268	/* 25 */ RT_UOFFSETOF(VMXVVMCS, u64TscMultiplier)
269	},
270	/* VMX_VMCS_ENC_WIDTH_64BIT \| VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
271	{
272	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestPhysAddr),
273	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
274	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
275	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
276	/* 25 */ UINT16_MAX
277	},
278	/* VMX_VMCS_ENC_WIDTH_64BIT \| VMX_VMCS_ENC_TYPE_GUEST_STATE: */
279	{
280	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
281	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
282	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPatMsr),
283	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEferMsr),
284	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
285	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte0),
286	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte1),
287	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte2),
288	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte3),
289	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
290	/* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
291	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
292	},
293	/* VMX_VMCS_ENC_WIDTH_64BIT \| VMX_VMCS_ENC_TYPE_HOST_STATE: */
294	{
295	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostPatMsr),
296	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostEferMsr),
297	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
298	/* 3-10 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
299	/* 11-18 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
300	/* 19-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
301	},
302	/* VMX_VMCS_ENC_WIDTH_32BIT \| VMX_VMCS_ENC_TYPE_CONTROL: */
303	{
304	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32PinCtls),
305	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls),
306	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32XcptBitmap),
307	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMask),
308	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMatch),
309	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32Cr3TargetCount),
310	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32ExitCtls),
311	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
312	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
313	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32EntryCtls),
314	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
315	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32EntryIntInfo),
316	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
317	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32EntryInstrLen),
318	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32TprThreshold),
319	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls2),
320	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32PleGap),
321	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32PleWindow),
322	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
323	},
324	/* VMX_VMCS_ENC_WIDTH_32BIT \| VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
325	{
326	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32RoVmInstrError),
327	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitReason),
328	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntInfo),
329	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntErrCode),
330	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
331	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
332	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrLen),
333	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
334	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
335	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
336	/* 24-25 */ UINT16_MAX, UINT16_MAX
337	},
338	/* VMX_VMCS_ENC_WIDTH_32BIT \| VMX_VMCS_ENC_TYPE_GUEST_STATE: */
339	{
340	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsLimit),
341	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsLimit),
342	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsLimit),
343	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsLimit),
344	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsLimit),
345	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsLimit),
346	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
347	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrLimit),
348	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
349	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
350	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsAttr),
351	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsAttr),
352	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsAttr),
353	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsAttr),
354	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsAttr),
355	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsAttr),
356	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
357	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrAttr),
358	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIntrState),
359	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u32GuestActivityState),
360	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSmBase),
361	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSysenterCS),
362	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u32PreemptTimer),
363	/* 23-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
364	},
365	/* VMX_VMCS_ENC_WIDTH_32BIT \| VMX_VMCS_ENC_TYPE_HOST_STATE: */
366	{
367	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32HostSysenterCs),
368	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
369	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
370	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
371	/* 25 */ UINT16_MAX
372	},
373	/* VMX_VMCS_ENC_WIDTH_NATURAL \| VMX_VMCS_ENC_TYPE_CONTROL: */
374	{
375	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0Mask),
376	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4Mask),
377	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
378	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
379	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target0),
380	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target1),
381	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target2),
382	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target3),
383	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
384	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
385	/* 24-25 */ UINT16_MAX, UINT16_MAX
386	},
387	/* VMX_VMCS_ENC_WIDTH_NATURAL \| VMX_VMCS_ENC_TYPE_VMEXIT_INFO: */
388	{
389	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoExitQual),
390	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRcx),
391	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRsi),
392	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRdi),
393	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRip),
394	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestLinearAddr),
395	/* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
396	/* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
397	/* 22-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
398	},
399	/* VMX_VMCS_ENC_WIDTH_NATURAL \| VMX_VMCS_ENC_TYPE_GUEST_STATE: */
400	{
401	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr0),
402	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr3),
403	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr4),
404	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEsBase),
405	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCsBase),
406	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsBase),
407	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDsBase),
408	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestFsBase),
409	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGsBase),
410	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestLdtrBase),
411	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestTrBase),
412	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGdtrBase),
413	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIdtrBase),
414	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDr7),
415	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRsp),
416	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRip),
417	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRFlags),
418	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpt),
419	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
420	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEip),
421	/* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
422	},
423	/* VMX_VMCS_ENC_WIDTH_NATURAL \| VMX_VMCS_ENC_TYPE_HOST_STATE: */
424	{
425	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr0),
426	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr3),
427	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr4),
428	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostFsBase),
429	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64HostGsBase),
430	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64HostTrBase),
431	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64HostGdtrBase),
432	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64HostIdtrBase),
433	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEsp),
434	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEip),
435	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64HostRsp),
436	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64HostRip),
437	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
438	/* 20-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
439	}
440	};
441
442
443	/**
444	* Returns whether the given VMCS field is valid and supported by our emulation.
445	*
446	* @param pVCpu The cross context virtual CPU structure.
447	* @param u64FieldEnc The VMCS field encoding.
448	*
449	* @remarks This takes into account the CPU features exposed to the guest.
450	*/
451	IEM_STATIC bool iemVmxIsVmcsFieldValid(PCVMCPU pVCpu, uint64_t u64FieldEnc)
452	{
453	uint32_t const uFieldEncHi = RT_HI_U32(u64FieldEnc);
454	uint32_t const uFieldEncLo = RT_LO_U32(u64FieldEnc);
455	if (!uFieldEncHi)
456	{ /* likely */ }
457	else
458	return false;
459
460	PCCPUMFEATURES pFeat = IEM_GET_GUEST_CPU_FEATURES(pVCpu);
461	switch (uFieldEncLo)
462	{
463	/*
464	* 16-bit fields.
465	*/
466	/* Control fields. */
467	case VMX_VMCS16_VPID: return pFeat->fVmxVpid;
468	case VMX_VMCS16_POSTED_INT_NOTIFY_VECTOR: return pFeat->fVmxPostedInt;
469	case VMX_VMCS16_EPTP_INDEX: return pFeat->fVmxEptXcptVe;
470
471	/* Guest-state fields. */
472	case VMX_VMCS16_GUEST_ES_SEL:
473	case VMX_VMCS16_GUEST_CS_SEL:
474	case VMX_VMCS16_GUEST_SS_SEL:
475	case VMX_VMCS16_GUEST_DS_SEL:
476	case VMX_VMCS16_GUEST_FS_SEL:
477	case VMX_VMCS16_GUEST_GS_SEL:
478	case VMX_VMCS16_GUEST_LDTR_SEL:
479	case VMX_VMCS16_GUEST_TR_SEL: return true;
480	case VMX_VMCS16_GUEST_INTR_STATUS: return pFeat->fVmxVirtIntDelivery;
481	case VMX_VMCS16_GUEST_PML_INDEX: return pFeat->fVmxPml;
482
483	/* Host-state fields. */
484	case VMX_VMCS16_HOST_ES_SEL:
485	case VMX_VMCS16_HOST_CS_SEL:
486	case VMX_VMCS16_HOST_SS_SEL:
487	case VMX_VMCS16_HOST_DS_SEL:
488	case VMX_VMCS16_HOST_FS_SEL:
489	case VMX_VMCS16_HOST_GS_SEL:
490	case VMX_VMCS16_HOST_TR_SEL: return true;
491
492	/*
493	* 64-bit fields.
494	*/
495	/* Control fields. */
496	case VMX_VMCS64_CTRL_IO_BITMAP_A_FULL:
497	case VMX_VMCS64_CTRL_IO_BITMAP_A_HIGH:
498	case VMX_VMCS64_CTRL_IO_BITMAP_B_FULL:
499	case VMX_VMCS64_CTRL_IO_BITMAP_B_HIGH: return pFeat->fVmxUseIoBitmaps;
500	case VMX_VMCS64_CTRL_MSR_BITMAP_FULL:
501	case VMX_VMCS64_CTRL_MSR_BITMAP_HIGH: return pFeat->fVmxUseMsrBitmaps;
502	case VMX_VMCS64_CTRL_EXIT_MSR_STORE_FULL:
503	case VMX_VMCS64_CTRL_EXIT_MSR_STORE_HIGH:
504	case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_FULL:
505	case VMX_VMCS64_CTRL_EXIT_MSR_LOAD_HIGH:
506	case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_FULL:
507	case VMX_VMCS64_CTRL_ENTRY_MSR_LOAD_HIGH:
508	case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_FULL:
509	case VMX_VMCS64_CTRL_EXEC_VMCS_PTR_HIGH: return true;
510	case VMX_VMCS64_CTRL_EXEC_PML_ADDR_FULL:
511	case VMX_VMCS64_CTRL_EXEC_PML_ADDR_HIGH: return pFeat->fVmxPml;
512	case VMX_VMCS64_CTRL_TSC_OFFSET_FULL:
513	case VMX_VMCS64_CTRL_TSC_OFFSET_HIGH: return true;
514	case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_FULL:
515	case VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_HIGH: return pFeat->fVmxUseTprShadow;
516	case VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL:
517	case VMX_VMCS64_CTRL_APIC_ACCESSADDR_HIGH: return pFeat->fVmxVirtApicAccess;
518	case VMX_VMCS64_CTRL_POSTED_INTR_DESC_FULL:
519	case VMX_VMCS64_CTRL_POSTED_INTR_DESC_HIGH: return pFeat->fVmxPostedInt;
520	case VMX_VMCS64_CTRL_VMFUNC_CTRLS_FULL:
521	case VMX_VMCS64_CTRL_VMFUNC_CTRLS_HIGH: return pFeat->fVmxVmFunc;
522	case VMX_VMCS64_CTRL_EPTP_FULL:
523	case VMX_VMCS64_CTRL_EPTP_HIGH: return pFeat->fVmxEpt;
524	case VMX_VMCS64_CTRL_EOI_BITMAP_0_FULL:
525	case VMX_VMCS64_CTRL_EOI_BITMAP_0_HIGH:
526	case VMX_VMCS64_CTRL_EOI_BITMAP_1_FULL:
527	case VMX_VMCS64_CTRL_EOI_BITMAP_1_HIGH:
528	case VMX_VMCS64_CTRL_EOI_BITMAP_2_FULL:
529	case VMX_VMCS64_CTRL_EOI_BITMAP_2_HIGH:
530	case VMX_VMCS64_CTRL_EOI_BITMAP_3_FULL:
531	case VMX_VMCS64_CTRL_EOI_BITMAP_3_HIGH: return pFeat->fVmxVirtIntDelivery;
532	case VMX_VMCS64_CTRL_EPTP_LIST_FULL:
533	case VMX_VMCS64_CTRL_EPTP_LIST_HIGH:
534	{
535	uint64_t const uVmFuncMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64VmFunc;
536	return RT_BOOL(RT_BF_GET(uVmFuncMsr, VMX_BF_VMFUNC_EPTP_SWITCHING));
537	}
538	case VMX_VMCS64_CTRL_VMREAD_BITMAP_FULL:
539	case VMX_VMCS64_CTRL_VMREAD_BITMAP_HIGH:
540	case VMX_VMCS64_CTRL_VMWRITE_BITMAP_FULL:
541	case VMX_VMCS64_CTRL_VMWRITE_BITMAP_HIGH: return pFeat->fVmxVmcsShadowing;
542	case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_FULL:
543	case VMX_VMCS64_CTRL_VIRTXCPT_INFO_ADDR_HIGH: return pFeat->fVmxEptXcptVe;
544	case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_FULL:
545	case VMX_VMCS64_CTRL_XSS_EXITING_BITMAP_HIGH: return pFeat->fVmxXsavesXrstors;
546	case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_FULL:
547	case VMX_VMCS64_CTRL_ENCLS_EXITING_BITMAP_HIGH: return false;
548	case VMX_VMCS64_CTRL_TSC_MULTIPLIER_FULL:
549	case VMX_VMCS64_CTRL_TSC_MULTIPLIER_HIGH: return pFeat->fVmxUseTscScaling;
550
551	/* Read-only data fields. */
552	case VMX_VMCS64_RO_GUEST_PHYS_ADDR_FULL:
553	case VMX_VMCS64_RO_GUEST_PHYS_ADDR_HIGH: return pFeat->fVmxEpt;
554
555	/* Guest-state fields. */
556	case VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL:
557	case VMX_VMCS64_GUEST_VMCS_LINK_PTR_HIGH:
558	case VMX_VMCS64_GUEST_DEBUGCTL_FULL:
559	case VMX_VMCS64_GUEST_DEBUGCTL_HIGH: return true;
560	case VMX_VMCS64_GUEST_PAT_FULL:
561	case VMX_VMCS64_GUEST_PAT_HIGH: return pFeat->fVmxEntryLoadPatMsr \|\| pFeat->fVmxExitSavePatMsr;
562	case VMX_VMCS64_GUEST_EFER_FULL:
563	case VMX_VMCS64_GUEST_EFER_HIGH: return pFeat->fVmxEntryLoadEferMsr \|\| pFeat->fVmxExitSaveEferMsr;
564	case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_FULL:
565	case VMX_VMCS64_GUEST_PERF_GLOBAL_CTRL_HIGH: return false;
566	case VMX_VMCS64_GUEST_PDPTE0_FULL:
567	case VMX_VMCS64_GUEST_PDPTE0_HIGH:
568	case VMX_VMCS64_GUEST_PDPTE1_FULL:
569	case VMX_VMCS64_GUEST_PDPTE1_HIGH:
570	case VMX_VMCS64_GUEST_PDPTE2_FULL:
571	case VMX_VMCS64_GUEST_PDPTE2_HIGH:
572	case VMX_VMCS64_GUEST_PDPTE3_FULL:
573	case VMX_VMCS64_GUEST_PDPTE3_HIGH: return pFeat->fVmxEpt;
574	case VMX_VMCS64_GUEST_BNDCFGS_FULL:
575	case VMX_VMCS64_GUEST_BNDCFGS_HIGH: return false;
576
577	/* Host-state fields. */
578	case VMX_VMCS64_HOST_PAT_FULL:
579	case VMX_VMCS64_HOST_PAT_HIGH: return pFeat->fVmxExitLoadPatMsr;
580	case VMX_VMCS64_HOST_EFER_FULL:
581	case VMX_VMCS64_HOST_EFER_HIGH: return pFeat->fVmxExitLoadEferMsr;
582	case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_FULL:
583	case VMX_VMCS64_HOST_PERF_GLOBAL_CTRL_HIGH: return false;
584
585	/*
586	* 32-bit fields.
587	*/
588	/* Control fields. */
589	case VMX_VMCS32_CTRL_PIN_EXEC:
590	case VMX_VMCS32_CTRL_PROC_EXEC:
591	case VMX_VMCS32_CTRL_EXCEPTION_BITMAP:
592	case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MASK:
593	case VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH:
594	case VMX_VMCS32_CTRL_CR3_TARGET_COUNT:
595	case VMX_VMCS32_CTRL_EXIT:
596	case VMX_VMCS32_CTRL_EXIT_MSR_STORE_COUNT:
597	case VMX_VMCS32_CTRL_EXIT_MSR_LOAD_COUNT:
598	case VMX_VMCS32_CTRL_ENTRY:
599	case VMX_VMCS32_CTRL_ENTRY_MSR_LOAD_COUNT:
600	case VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO:
601	case VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE:
602	case VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH: return true;
603	case VMX_VMCS32_CTRL_TPR_THRESHOLD: return pFeat->fVmxUseTprShadow;
604	case VMX_VMCS32_CTRL_PROC_EXEC2: return pFeat->fVmxSecondaryExecCtls;
605	case VMX_VMCS32_CTRL_PLE_GAP:
606	case VMX_VMCS32_CTRL_PLE_WINDOW: return pFeat->fVmxPauseLoopExit;
607
608	/* Read-only data fields. */
609	case VMX_VMCS32_RO_VM_INSTR_ERROR:
610	case VMX_VMCS32_RO_EXIT_REASON:
611	case VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO:
612	case VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE:
613	case VMX_VMCS32_RO_IDT_VECTORING_INFO:
614	case VMX_VMCS32_RO_IDT_VECTORING_ERROR_CODE:
615	case VMX_VMCS32_RO_EXIT_INSTR_LENGTH:
616	case VMX_VMCS32_RO_EXIT_INSTR_INFO: return true;
617
618	/* Guest-state fields. */
619	case VMX_VMCS32_GUEST_ES_LIMIT:
620	case VMX_VMCS32_GUEST_CS_LIMIT:
621	case VMX_VMCS32_GUEST_SS_LIMIT:
622	case VMX_VMCS32_GUEST_DS_LIMIT:
623	case VMX_VMCS32_GUEST_FS_LIMIT:
624	case VMX_VMCS32_GUEST_GS_LIMIT:
625	case VMX_VMCS32_GUEST_LDTR_LIMIT:
626	case VMX_VMCS32_GUEST_TR_LIMIT:
627	case VMX_VMCS32_GUEST_GDTR_LIMIT:
628	case VMX_VMCS32_GUEST_IDTR_LIMIT:
629	case VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS:
630	case VMX_VMCS32_GUEST_CS_ACCESS_RIGHTS:
631	case VMX_VMCS32_GUEST_SS_ACCESS_RIGHTS:
632	case VMX_VMCS32_GUEST_DS_ACCESS_RIGHTS:
633	case VMX_VMCS32_GUEST_FS_ACCESS_RIGHTS:
634	case VMX_VMCS32_GUEST_GS_ACCESS_RIGHTS:
635	case VMX_VMCS32_GUEST_LDTR_ACCESS_RIGHTS:
636	case VMX_VMCS32_GUEST_TR_ACCESS_RIGHTS:
637	case VMX_VMCS32_GUEST_INT_STATE:
638	case VMX_VMCS32_GUEST_ACTIVITY_STATE:
639	case VMX_VMCS32_GUEST_SMBASE:
640	case VMX_VMCS32_GUEST_SYSENTER_CS: return true;
641	case VMX_VMCS32_PREEMPT_TIMER_VALUE: return pFeat->fVmxPreemptTimer;
642
643	/* Host-state fields. */
644	case VMX_VMCS32_HOST_SYSENTER_CS: return true;
645
646	/*
647	* Natural-width fields.
648	*/
649	/* Control fields. */
650	case VMX_VMCS_CTRL_CR0_MASK:
651	case VMX_VMCS_CTRL_CR4_MASK:
652	case VMX_VMCS_CTRL_CR0_READ_SHADOW:
653	case VMX_VMCS_CTRL_CR4_READ_SHADOW:
654	case VMX_VMCS_CTRL_CR3_TARGET_VAL0:
655	case VMX_VMCS_CTRL_CR3_TARGET_VAL1:
656	case VMX_VMCS_CTRL_CR3_TARGET_VAL2:
657	case VMX_VMCS_CTRL_CR3_TARGET_VAL3: return true;
658
659	/* Read-only data fields. */
660	case VMX_VMCS_RO_EXIT_QUALIFICATION:
661	case VMX_VMCS_RO_IO_RCX:
662	case VMX_VMCS_RO_IO_RSI:
663	case VMX_VMCS_RO_IO_RDI:
664	case VMX_VMCS_RO_IO_RIP:
665	case VMX_VMCS_RO_GUEST_LINEAR_ADDR: return true;
666
667	/* Guest-state fields. */
668	case VMX_VMCS_GUEST_CR0:
669	case VMX_VMCS_GUEST_CR3:
670	case VMX_VMCS_GUEST_CR4:
671	case VMX_VMCS_GUEST_ES_BASE:
672	case VMX_VMCS_GUEST_CS_BASE:
673	case VMX_VMCS_GUEST_SS_BASE:
674	case VMX_VMCS_GUEST_DS_BASE:
675	case VMX_VMCS_GUEST_FS_BASE:
676	case VMX_VMCS_GUEST_GS_BASE:
677	case VMX_VMCS_GUEST_LDTR_BASE:
678	case VMX_VMCS_GUEST_TR_BASE:
679	case VMX_VMCS_GUEST_GDTR_BASE:
680	case VMX_VMCS_GUEST_IDTR_BASE:
681	case VMX_VMCS_GUEST_DR7:
682	case VMX_VMCS_GUEST_RSP:
683	case VMX_VMCS_GUEST_RIP:
684	case VMX_VMCS_GUEST_RFLAGS:
685	case VMX_VMCS_GUEST_PENDING_DEBUG_XCPTS:
686	case VMX_VMCS_GUEST_SYSENTER_ESP:
687	case VMX_VMCS_GUEST_SYSENTER_EIP: return true;
688
689	/* Host-state fields. */
690	case VMX_VMCS_HOST_CR0:
691	case VMX_VMCS_HOST_CR3:
692	case VMX_VMCS_HOST_CR4:
693	case VMX_VMCS_HOST_FS_BASE:
694	case VMX_VMCS_HOST_GS_BASE:
695	case VMX_VMCS_HOST_TR_BASE:
696	case VMX_VMCS_HOST_GDTR_BASE:
697	case VMX_VMCS_HOST_IDTR_BASE:
698	case VMX_VMCS_HOST_SYSENTER_ESP:
699	case VMX_VMCS_HOST_SYSENTER_EIP:
700	case VMX_VMCS_HOST_RSP:
701	case VMX_VMCS_HOST_RIP: return true;
702	}
703
704	return false;
705	}
706
707
708	/**
709	* Gets a host selector from the VMCS.
710	*
711	* @param pVmcs Pointer to the virtual VMCS.
712	* @param iSelReg The index of the segment register (X86_SREG_XXX).
713	*/
714	DECLINLINE(RTSEL) iemVmxVmcsGetHostSelReg(PCVMXVVMCS pVmcs, uint8_t iSegReg)
715	{
716	Assert(iSegReg < X86_SREG_COUNT);
717	RTSEL HostSel;
718	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_16BIT;
719	uint8_t const uType = VMX_VMCS_ENC_TYPE_HOST_STATE;
720	uint8_t const uWidthType = (uWidth << 2) \| uType;
721	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_HOST_ES_SEL, VMX_BF_VMCS_ENC_INDEX);
722	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
723	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
724	uint8_t const pbVmcs = (uint8_t )pVmcs;
725	uint8_t const *pbField = pbVmcs + offField;
726	HostSel = (uint16_t )pbField;
727	return HostSel;
728	}
729
730
731	/**
732	* Sets a guest segment register in the VMCS.
733	*
734	* @param pVmcs Pointer to the virtual VMCS.
735	* @param iSegReg The index of the segment register (X86_SREG_XXX).
736	* @param pSelReg Pointer to the segment register.
737	*/
738	IEM_STATIC void iemVmxVmcsSetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCCPUMSELREG pSelReg)
739	{
740	Assert(pSelReg);
741	Assert(iSegReg < X86_SREG_COUNT);
742
743	/* Selector. */
744	{
745	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_16BIT;
746	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
747	uint8_t const uWidthType = (uWidth << 2) \| uType;
748	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCS_ENC_INDEX);
749	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
750	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
751	uint8_t pbVmcs = (uint8_t )pVmcs;
752	uint8_t *pbField = pbVmcs + offField;
753	(uint16_t )pbField = pSelReg->Sel;
754	}
755
756	/* Limit. */
757	{
758	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_32BIT;
759	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
760	uint8_t const uWidthType = (uWidth << 2) \| uType;
761	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCS_ENC_INDEX);
762	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
763	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
764	uint8_t pbVmcs = (uint8_t )pVmcs;
765	uint8_t *pbField = pbVmcs + offField;
766	(uint32_t )pbField = pSelReg->u32Limit;
767	}
768
769	/* Base. */
770	{
771	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_NATURAL;
772	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
773	uint8_t const uWidthType = (uWidth << 2) \| uType;
774	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCS_ENC_INDEX);
775	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
776	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
777	uint8_t const pbVmcs = (uint8_t )pVmcs;
778	uint8_t const *pbField = pbVmcs + offField;
779	(uint64_t )pbField = pSelReg->u64Base;
780	}
781
782	/* Attributes. */
783	{
784	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
785	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
786	\| X86DESCATTR_UNUSABLE;
787	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_32BIT;
788	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
789	uint8_t const uWidthType = (uWidth << 2) \| uType;
790	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCS_ENC_INDEX);
791	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
792	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
793	uint8_t pbVmcs = (uint8_t )pVmcs;
794	uint8_t *pbField = pbVmcs + offField;
795	(uint32_t )pbField = pSelReg->Attr.u & fValidAttrMask;
796	}
797	}
798
799
800	/**
801	* Gets a guest segment register from the VMCS.
802	*
803	* @returns VBox status code.
804	* @param pVmcs Pointer to the virtual VMCS.
805	* @param iSegReg The index of the segment register (X86_SREG_XXX).
806	* @param pSelReg Where to store the segment register (only updated when
807	* VINF_SUCCESS is returned).
808	*
809	* @remarks Warning! This does not validate the contents of the retrieved segment
810	* register.
811	*/
812	IEM_STATIC int iemVmxVmcsGetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCPUMSELREG pSelReg)
813	{
814	Assert(pSelReg);
815	Assert(iSegReg < X86_SREG_COUNT);
816
817	/* Selector. */
818	uint16_t u16Sel;
819	{
820	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_16BIT;
821	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
822	uint8_t const uWidthType = (uWidth << 2) \| uType;
823	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCS_ENC_INDEX);
824	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
825	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
826	uint8_t const pbVmcs = (uint8_t )pVmcs;
827	uint8_t const *pbField = pbVmcs + offField;
828	u16Sel = (uint16_t )pbField;
829	}
830
831	/* Limit. */
832	uint32_t u32Limit;
833	{
834	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_32BIT;
835	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
836	uint8_t const uWidthType = (uWidth << 2) \| uType;
837	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCS_ENC_INDEX);
838	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
839	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
840	uint8_t const pbVmcs = (uint8_t )pVmcs;
841	uint8_t const *pbField = pbVmcs + offField;
842	u32Limit = (uint32_t )pbField;
843	}
844
845	/* Base. */
846	uint64_t u64Base;
847	{
848	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_NATURAL;
849	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
850	uint8_t const uWidthType = (uWidth << 2) \| uType;
851	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCS_ENC_INDEX);
852	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
853	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
854	uint8_t const pbVmcs = (uint8_t )pVmcs;
855	uint8_t const *pbField = pbVmcs + offField;
856	u64Base = (uint64_t )pbField;
857	/** @todo NSTVMX: Should we zero out high bits here for 32-bit virtual CPUs? */
858	}
859
860	/* Attributes. */
861	uint32_t u32Attr;
862	{
863	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_32BIT;
864	uint8_t const uType = VMX_VMCS_ENC_TYPE_GUEST_STATE;
865	uint8_t const uWidthType = (uWidth << 2) \| uType;
866	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCS_ENC_INDEX);
867	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
868	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
869	uint8_t const pbVmcs = (uint8_t )pVmcs;
870	uint8_t const *pbField = pbVmcs + offField;
871	u32Attr = (uint32_t )pbField;
872	}
873
874	pSelReg->Sel = u16Sel;
875	pSelReg->ValidSel = u16Sel;
876	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
877	pSelReg->u32Limit = u32Limit;
878	pSelReg->u64Base = u64Base;
879	pSelReg->Attr.u = u32Attr;
880	return VINF_SUCCESS;
881	}
882
883
884	/**
885	* Gets a CR3 target value from the VMCS.
886	*
887	* @returns VBox status code.
888	* @param pVmcs Pointer to the virtual VMCS.
889	* @param idxCr3Target The index of the CR3-target value to retrieve.
890	* @param puValue Where to store the CR3-target value.
891	*/
892	IEM_STATIC uint64_t iemVmxVmcsGetCr3TargetValue(PCVMXVVMCS pVmcs, uint8_t idxCr3Target)
893	{
894	Assert(idxCr3Target < VMX_V_CR3_TARGET_COUNT);
895	uint8_t const uWidth = VMX_VMCS_ENC_WIDTH_NATURAL;
896	uint8_t const uType = VMX_VMCS_ENC_TYPE_CONTROL;
897	uint8_t const uWidthType = (uWidth << 2) \| uType;
898	uint8_t const uIndex = idxCr3Target + RT_BF_GET(VMX_VMCS_CTRL_CR3_TARGET_VAL0, VMX_BF_VMCS_ENC_INDEX);
899	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
900	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
901	uint8_t const pbVmcs = (uint8_t )pVmcs;
902	uint8_t const *pbField = pbVmcs + offField;
903	uint64_t const uCr3TargetValue = (uint64_t )pbField;
904	return uCr3TargetValue;
905	}
906
907
908	/**
909	* Converts an IEM exception event type to a VMX event type.
910	*
911	* @returns The VMX event type.
912	* @param uVector The interrupt / exception vector.
913	* @param fFlags The IEM event flag (see IEM_XCPT_FLAGS_XXX).
914	*/
915	DECLINLINE(uint8_t) iemVmxGetEventType(uint32_t uVector, uint32_t fFlags)
916	{
917	/* Paranoia (callers may use these interchangeably). */
918	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_IDT_VECTORING_INFO_TYPE_NMI);
919	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT);
920	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT);
921	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT);
922	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_IDT_VECTORING_INFO_TYPE_SW_INT);
923	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_PRIV_SW_XCPT);
924	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_ENTRY_INT_INFO_TYPE_NMI);
925	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT);
926	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_ENTRY_INT_INFO_TYPE_EXT_INT);
927	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT);
928	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_ENTRY_INT_INFO_TYPE_SW_INT);
929	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT);
930
931	if (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
932	{
933	if (uVector == X86_XCPT_NMI)
934	return VMX_EXIT_INT_INFO_TYPE_NMI;
935	return VMX_EXIT_INT_INFO_TYPE_HW_XCPT;
936	}
937
938	if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
939	{
940	if (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
941	return VMX_EXIT_INT_INFO_TYPE_SW_XCPT;
942	if (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
943	return VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT;
944	return VMX_EXIT_INT_INFO_TYPE_SW_INT;
945	}
946
947	Assert(fFlags & IEM_XCPT_FLAGS_T_EXT_INT);
948	return VMX_EXIT_INT_INFO_TYPE_EXT_INT;
949	}
950
951
952	/**
953	* Sets the VM-exit qualification VMCS field.
954	*
955	* @param pVCpu The cross context virtual CPU structure.
956	* @param uExitQual The VM-exit qualification.
957	*/
958	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitQual(PVMCPU pVCpu, uint64_t uExitQual)
959	{
960	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
961	pVmcs->u64RoExitQual.u = uExitQual;
962	}
963
964
965	/**
966	* Sets the VM-exit interruption information field.
967	*
968	* @param pVCpu The cross context virtual CPU structure.
969	* @param uExitQual The VM-exit interruption information.
970	*/
971	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntInfo(PVMCPU pVCpu, uint32_t uExitIntInfo)
972	{
973	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
974	pVmcs->u32RoExitIntInfo = uExitIntInfo;
975	}
976
977
978	/**
979	* Sets the VM-exit interruption error code.
980	*
981	* @param pVCpu The cross context virtual CPU structure.
982	* @param uErrCode The error code.
983	*/
984	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntErrCode(PVMCPU pVCpu, uint32_t uErrCode)
985	{
986	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
987	pVmcs->u32RoExitIntErrCode = uErrCode;
988	}
989
990
991	/**
992	* Sets the IDT-vectoring information field.
993	*
994	* @param pVCpu The cross context virtual CPU structure.
995	* @param uIdtVectorInfo The IDT-vectoring information.
996	*/
997	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringInfo(PVMCPU pVCpu, uint32_t uIdtVectorInfo)
998	{
999	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1000	pVmcs->u32RoIdtVectoringInfo = uIdtVectorInfo;
1001	}
1002
1003
1004	/**
1005	* Sets the IDT-vectoring error code field.
1006	*
1007	* @param pVCpu The cross context virtual CPU structure.
1008	* @param uErrCode The error code.
1009	*/
1010	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringErrCode(PVMCPU pVCpu, uint32_t uErrCode)
1011	{
1012	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1013	pVmcs->u32RoIdtVectoringErrCode = uErrCode;
1014	}
1015
1016
1017	/**
1018	* Sets the VM-exit guest-linear address VMCS field.
1019	*
1020	* @param pVCpu The cross context virtual CPU structure.
1021	* @param uGuestLinearAddr The VM-exit guest-linear address.
1022	*/
1023	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestLinearAddr(PVMCPU pVCpu, uint64_t uGuestLinearAddr)
1024	{
1025	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1026	pVmcs->u64RoGuestLinearAddr.u = uGuestLinearAddr;
1027	}
1028
1029
1030	/**
1031	* Sets the VM-exit guest-physical address VMCS field.
1032	*
1033	* @param pVCpu The cross context virtual CPU structure.
1034	* @param uGuestPhysAddr The VM-exit guest-physical address.
1035	*/
1036	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestPhysAddr(PVMCPU pVCpu, uint64_t uGuestPhysAddr)
1037	{
1038	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1039	pVmcs->u64RoGuestPhysAddr.u = uGuestPhysAddr;
1040	}
1041
1042
1043	/**
1044	* Sets the VM-exit instruction length VMCS field.
1045	*
1046	* @param pVCpu The cross context virtual CPU structure.
1047	* @param cbInstr The VM-exit instruction length in bytes.
1048	*
1049	* @remarks Callers may clear this field to 0. Hence, this function does not check
1050	* the validity of the instruction length.
1051	*/
1052	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrLen(PVMCPU pVCpu, uint32_t cbInstr)
1053	{
1054	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1055	pVmcs->u32RoExitInstrLen = cbInstr;
1056	}
1057
1058
1059	/**
1060	* Sets the VM-exit instruction info. VMCS field.
1061	*
1062	* @param pVCpu The cross context virtual CPU structure.
1063	* @param uExitInstrInfo The VM-exit instruction information.
1064	*/
1065	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrInfo(PVMCPU pVCpu, uint32_t uExitInstrInfo)
1066	{
1067	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1068	pVmcs->u32RoExitInstrInfo = uExitInstrInfo;
1069	}
1070
1071
1072	/**
1073	* Implements VMSucceed for VMX instruction success.
1074	*
1075	* @param pVCpu The cross context virtual CPU structure.
1076	*/
1077	DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPU pVCpu)
1078	{
1079	return CPUMSetGuestVmxVmSucceed(&pVCpu->cpum.GstCtx);
1080	}
1081
1082
1083	/**
1084	* Implements VMFailInvalid for VMX instruction failure.
1085	*
1086	* @param pVCpu The cross context virtual CPU structure.
1087	*/
1088	DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPU pVCpu)
1089	{
1090	return CPUMSetGuestVmxVmFailInvalid(&pVCpu->cpum.GstCtx);
1091	}
1092
1093
1094	/**
1095	* Implements VMFail for VMX instruction failure.
1096	*
1097	* @param pVCpu The cross context virtual CPU structure.
1098	* @param enmInsErr The VM instruction error.
1099	*/
1100	DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPU pVCpu, VMXINSTRERR enmInsErr)
1101	{
1102	return CPUMSetGuestVmxVmFail(&pVCpu->cpum.GstCtx, enmInsErr);
1103	}
1104
1105
1106	/**
1107	* Checks if the given auto-load/store MSR area count is valid for the
1108	* implementation.
1109	*
1110	* @returns @c true if it's within the valid limit, @c false otherwise.
1111	* @param pVCpu The cross context virtual CPU structure.
1112	* @param uMsrCount The MSR area count to check.
1113	*/
1114	DECL_FORCE_INLINE(bool) iemVmxIsAutoMsrCountValid(PCVMCPU pVCpu, uint32_t uMsrCount)
1115	{
1116	uint64_t const u64VmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
1117	uint32_t const cMaxSupportedMsrs = VMX_MISC_MAX_MSRS(u64VmxMiscMsr);
1118	Assert(cMaxSupportedMsrs <= VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
1119	if (uMsrCount <= cMaxSupportedMsrs)
1120	return true;
1121	return false;
1122	}
1123
1124
1125	/**
1126	* Flushes the current VMCS contents back to guest memory.
1127	*
1128	* @returns VBox status code.
1129	* @param pVCpu The cross context virtual CPU structure.
1130	*/
1131	DECL_FORCE_INLINE(int) iemVmxCommitCurrentVmcsToMemory(PVMCPU pVCpu)
1132	{
1133	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
1134	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
1135	pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs), sizeof(VMXVVMCS));
1136	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
1137	return rc;
1138	}
1139
1140
1141	/**
1142	* Implements VMSucceed for the VMREAD instruction and increments the guest RIP.
1143	*
1144	* @param pVCpu The cross context virtual CPU structure.
1145	*/
1146	DECL_FORCE_INLINE(void) iemVmxVmreadSuccess(PVMCPU pVCpu, uint8_t cbInstr)
1147	{
1148	iemVmxVmSucceed(pVCpu);
1149	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
1150	}
1151
1152
1153	/**
1154	* Gets the instruction diagnostic for segment base checks during VM-entry of a
1155	* nested-guest.
1156	*
1157	* @param iSegReg The segment index (X86_SREG_XXX).
1158	*/
1159	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegBase(unsigned iSegReg)
1160	{
1161	switch (iSegReg)
1162	{
1163	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseCs;
1164	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseDs;
1165	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseEs;
1166	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseFs;
1167	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseGs;
1168	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseSs;
1169	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_1);
1170	}
1171	}
1172
1173
1174	/**
1175	* Gets the instruction diagnostic for segment base checks during VM-entry of a
1176	* nested-guest that is in Virtual-8086 mode.
1177	*
1178	* @param iSegReg The segment index (X86_SREG_XXX).
1179	*/
1180	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegBaseV86(unsigned iSegReg)
1181	{
1182	switch (iSegReg)
1183	{
1184	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseV86Cs;
1185	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ds;
1186	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseV86Es;
1187	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseV86Fs;
1188	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseV86Gs;
1189	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ss;
1190	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_2);
1191	}
1192	}
1193
1194
1195	/**
1196	* Gets the instruction diagnostic for segment limit checks during VM-entry of a
1197	* nested-guest that is in Virtual-8086 mode.
1198	*
1199	* @param iSegReg The segment index (X86_SREG_XXX).
1200	*/
1201	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegLimitV86(unsigned iSegReg)
1202	{
1203	switch (iSegReg)
1204	{
1205	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegLimitV86Cs;
1206	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ds;
1207	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegLimitV86Es;
1208	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegLimitV86Fs;
1209	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegLimitV86Gs;
1210	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ss;
1211	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_3);
1212	}
1213	}
1214
1215
1216	/**
1217	* Gets the instruction diagnostic for segment attribute checks during VM-entry of a
1218	* nested-guest that is in Virtual-8086 mode.
1219	*
1220	* @param iSegReg The segment index (X86_SREG_XXX).
1221	*/
1222	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrV86(unsigned iSegReg)
1223	{
1224	switch (iSegReg)
1225	{
1226	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrV86Cs;
1227	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ds;
1228	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrV86Es;
1229	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrV86Fs;
1230	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrV86Gs;
1231	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ss;
1232	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_4);
1233	}
1234	}
1235
1236
1237	/**
1238	* Gets the instruction diagnostic for segment attributes reserved bits failure
1239	* during VM-entry of a nested-guest.
1240	*
1241	* @param iSegReg The segment index (X86_SREG_XXX).
1242	*/
1243	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrRsvd(unsigned iSegReg)
1244	{
1245	switch (iSegReg)
1246	{
1247	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdCs;
1248	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdDs;
1249	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrRsvdEs;
1250	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdFs;
1251	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdGs;
1252	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdSs;
1253	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_5);
1254	}
1255	}
1256
1257
1258	/**
1259	* Gets the instruction diagnostic for segment attributes descriptor-type
1260	* (code/segment or system) failure during VM-entry of a nested-guest.
1261	*
1262	* @param iSegReg The segment index (X86_SREG_XXX).
1263	*/
1264	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrDescType(unsigned iSegReg)
1265	{
1266	switch (iSegReg)
1267	{
1268	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeCs;
1269	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeDs;
1270	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeEs;
1271	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeFs;
1272	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeGs;
1273	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeSs;
1274	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_6);
1275	}
1276	}
1277
1278
1279	/**
1280	* Gets the instruction diagnostic for segment attributes descriptor-type
1281	* (code/segment or system) failure during VM-entry of a nested-guest.
1282	*
1283	* @param iSegReg The segment index (X86_SREG_XXX).
1284	*/
1285	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrPresent(unsigned iSegReg)
1286	{
1287	switch (iSegReg)
1288	{
1289	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrPresentCs;
1290	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrPresentDs;
1291	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrPresentEs;
1292	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrPresentFs;
1293	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrPresentGs;
1294	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrPresentSs;
1295	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_7);
1296	}
1297	}
1298
1299
1300	/**
1301	* Gets the instruction diagnostic for segment attribute granularity failure during
1302	* VM-entry of a nested-guest.
1303	*
1304	* @param iSegReg The segment index (X86_SREG_XXX).
1305	*/
1306	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrGran(unsigned iSegReg)
1307	{
1308	switch (iSegReg)
1309	{
1310	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrGranCs;
1311	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrGranDs;
1312	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrGranEs;
1313	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrGranFs;
1314	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrGranGs;
1315	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrGranSs;
1316	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_8);
1317	}
1318	}
1319
1320	/**
1321	* Gets the instruction diagnostic for segment attribute DPL/RPL failure during
1322	* VM-entry of a nested-guest.
1323	*
1324	* @param iSegReg The segment index (X86_SREG_XXX).
1325	*/
1326	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrDplRpl(unsigned iSegReg)
1327	{
1328	switch (iSegReg)
1329	{
1330	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplCs;
1331	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplDs;
1332	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDplRplEs;
1333	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplFs;
1334	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplGs;
1335	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplSs;
1336	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_9);
1337	}
1338	}
1339
1340
1341	/**
1342	* Gets the instruction diagnostic for segment attribute type accessed failure
1343	* during VM-entry of a nested-guest.
1344	*
1345	* @param iSegReg The segment index (X86_SREG_XXX).
1346	*/
1347	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentrySegAttrTypeAcc(unsigned iSegReg)
1348	{
1349	switch (iSegReg)
1350	{
1351	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccCs;
1352	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccDs;
1353	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccEs;
1354	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccFs;
1355	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccGs;
1356	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccSs;
1357	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_10);
1358	}
1359	}
1360
1361
1362	/**
1363	* Gets the instruction diagnostic for guest CR3 referenced PDPTE reserved bits
1364	* failure during VM-entry of a nested-guest.
1365	*
1366	* @param iSegReg The PDPTE entry index.
1367	*/
1368	IEM_STATIC VMXVDIAG iemVmxGetDiagVmentryPdpteRsvd(unsigned iPdpte)
1369	{
1370	Assert(iPdpte < X86_PG_PAE_PDPE_ENTRIES);
1371	switch (iPdpte)
1372	{
1373	case 0: return kVmxVDiag_Vmentry_GuestPdpte0Rsvd;
1374	case 1: return kVmxVDiag_Vmentry_GuestPdpte1Rsvd;
1375	case 2: return kVmxVDiag_Vmentry_GuestPdpte2Rsvd;
1376	case 3: return kVmxVDiag_Vmentry_GuestPdpte3Rsvd;
1377	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_11);
1378	}
1379	}
1380
1381
1382	/**
1383	* Gets the instruction diagnostic for host CR3 referenced PDPTE reserved bits
1384	* failure during VM-exit of a nested-guest.
1385	*
1386	* @param iSegReg The PDPTE entry index.
1387	*/
1388	IEM_STATIC VMXVDIAG iemVmxGetDiagVmexitPdpteRsvd(unsigned iPdpte)
1389	{
1390	Assert(iPdpte < X86_PG_PAE_PDPE_ENTRIES);
1391	switch (iPdpte)
1392	{
1393	case 0: return kVmxVDiag_Vmexit_HostPdpte0Rsvd;
1394	case 1: return kVmxVDiag_Vmexit_HostPdpte1Rsvd;
1395	case 2: return kVmxVDiag_Vmexit_HostPdpte2Rsvd;
1396	case 3: return kVmxVDiag_Vmexit_HostPdpte3Rsvd;
1397	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_12);
1398	}
1399	}
1400
1401
1402	/**
1403	* Masks the nested-guest CR0/CR4 mask subjected to the corresponding guest/host
1404	* mask and the read-shadow (CR0/CR4 read).
1405	*
1406	* @returns The masked CR0/CR4.
1407	* @param pVCpu The cross context virtual CPU structure.
1408	* @param iCrReg The control register (either CR0 or CR4).
1409	* @param uGuestCrX The current guest CR0 or guest CR4.
1410	*/
1411	IEM_STATIC uint64_t iemVmxMaskCr0CR4(PVMCPU pVCpu, uint8_t iCrReg, uint64_t uGuestCrX)
1412	{
1413	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
1414	Assert(iCrReg == 0 \|\| iCrReg == 4);
1415
1416	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1417	Assert(pVmcs);
1418
1419	/*
1420	* For each CR0 or CR4 bit owned by the host, the corresponding bit is loaded from the
1421	* CR0 read shadow or CR4 read shadow. For each CR0 or CR4 bit that is not owned by the
1422	* host, the corresponding bit from the guest CR0 or guest CR4 is loaded.
1423	*
1424	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
1425	*/
1426	uint64_t fGstHostMask;
1427	uint64_t fReadShadow;
1428	if (iCrReg == 0)
1429	{
1430	fGstHostMask = pVmcs->u64Cr0Mask.u;
1431	fReadShadow = pVmcs->u64Cr0ReadShadow.u;
1432	}
1433	else
1434	{
1435	fGstHostMask = pVmcs->u64Cr4Mask.u;
1436	fReadShadow = pVmcs->u64Cr4ReadShadow.u;
1437	}
1438
1439	uint64_t const fMaskedCrX = (fReadShadow & fGstHostMask) \| (uGuestCrX & ~fGstHostMask);
1440	return fMaskedCrX;
1441	}
1442
1443
1444	/**
1445	* Saves the guest control registers, debug registers and some MSRs are part of
1446	* VM-exit.
1447	*
1448	* @param pVCpu The cross context virtual CPU structure.
1449	*/
1450	IEM_STATIC void iemVmxVmexitSaveGuestControlRegsMsrs(PVMCPU pVCpu)
1451	{
1452	/*
1453	* Saves the guest control registers, debug registers and some MSRs.
1454	* See Intel spec. 27.3.1 "Saving Control Registers, Debug Registers and MSRs".
1455	*/
1456	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1457
1458	/* Save control registers. */
1459	pVmcs->u64GuestCr0.u = pVCpu->cpum.GstCtx.cr0;
1460	pVmcs->u64GuestCr3.u = pVCpu->cpum.GstCtx.cr3;
1461	pVmcs->u64GuestCr4.u = pVCpu->cpum.GstCtx.cr4;
1462
1463	/* Save SYSENTER CS, ESP, EIP. */
1464	pVmcs->u32GuestSysenterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1465	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1466	{
1467	pVmcs->u64GuestSysenterEsp.u = pVCpu->cpum.GstCtx.SysEnter.esp;
1468	pVmcs->u64GuestSysenterEip.u = pVCpu->cpum.GstCtx.SysEnter.eip;
1469	}
1470	else
1471	{
1472	pVmcs->u64GuestSysenterEsp.s.Lo = pVCpu->cpum.GstCtx.SysEnter.esp;
1473	pVmcs->u64GuestSysenterEip.s.Lo = pVCpu->cpum.GstCtx.SysEnter.eip;
1474	}
1475
1476	/* Save debug registers (DR7 and IA32_DEBUGCTL MSR). */
1477	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_DEBUG)
1478	{
1479	pVmcs->u64GuestDr7.u = pVCpu->cpum.GstCtx.dr[7];
1480	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1481	}
1482
1483	/* Save PAT MSR. */
1484	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PAT_MSR)
1485	pVmcs->u64GuestPatMsr.u = pVCpu->cpum.GstCtx.msrPAT;
1486
1487	/* Save EFER MSR. */
1488	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_EFER_MSR)
1489	pVmcs->u64GuestEferMsr.u = pVCpu->cpum.GstCtx.msrEFER;
1490
1491	/* We don't support clearing IA32_BNDCFGS MSR yet. */
1492	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_CLEAR_BNDCFGS_MSR));
1493
1494	/* Nothing to do for SMBASE register - We don't support SMM yet. */
1495	}
1496
1497
1498	/**
1499	* Saves the guest force-flags in preparation of entering the nested-guest.
1500	*
1501	* @param pVCpu The cross context virtual CPU structure.
1502	*/
1503	IEM_STATIC void iemVmxVmentrySaveNmiBlockingFF(PVMCPU pVCpu)
1504	{
1505	/* We shouldn't be called multiple times during VM-entry. */
1506	Assert(pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions == 0);
1507
1508	/* MTF should not be set outside VMX non-root mode. */
1509	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
1510
1511	/*
1512	* Preserve the required force-flags.
1513	*
1514	* We cache and clear force-flags that would affect the execution of the
1515	* nested-guest. Cached flags are then restored while returning to the guest
1516	* if necessary.
1517	*
1518	* - VMCPU_FF_INHIBIT_INTERRUPTS need not be cached as it only affects
1519	* interrupts until the completion of the current VMLAUNCH/VMRESUME
1520	* instruction. Interrupt inhibition for any nested-guest instruction
1521	* is supplied by the guest-interruptibility state VMCS field and will
1522	* be set up as part of loading the guest state.
1523	*
1524	* - VMCPU_FF_BLOCK_NMIS needs to be cached as VM-exits caused before
1525	* successful VM-entry (due to invalid guest-state) need to continue
1526	* blocking NMIs if it was in effect before VM-entry.
1527	*
1528	* - MTF need not be preserved as it's used only in VMX non-root mode and
1529	* is supplied through the VM-execution controls.
1530	*
1531	* The remaining FFs (e.g. timers, APIC updates) can stay in place so that
1532	* we will be able to generate interrupts that may cause VM-exits for
1533	* the nested-guest.
1534	*/
1535	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = pVCpu->fLocalForcedActions & VMCPU_FF_BLOCK_NMIS;
1536	}
1537
1538
1539	/**
1540	* Restores the guest force-flags in preparation of exiting the nested-guest.
1541	*
1542	* @param pVCpu The cross context virtual CPU structure.
1543	*/
1544	IEM_STATIC void iemVmxVmexitRestoreNmiBlockingFF(PVMCPU pVCpu)
1545	{
1546	if (pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions)
1547	{
1548	VMCPU_FF_SET_MASK(pVCpu, pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions);
1549	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions = 0;
1550	}
1551	}
1552
1553
1554	/**
1555	* Perform a VMX transition updated PGM, IEM and CPUM.
1556	*
1557	* @param pVCpu The cross context virtual CPU structure.
1558	*/
1559	IEM_STATIC int iemVmxWorldSwitch(PVMCPU pVCpu)
1560	{
1561	/*
1562	* Inform PGM about paging mode changes.
1563	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
1564	* see comment in iemMemPageTranslateAndCheckAccess().
1565	*/
1566	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
1567	# ifdef IN_RING3
1568	Assert(rc != VINF_PGM_CHANGE_MODE);
1569	# endif
1570	AssertRCReturn(rc, rc);
1571
1572	/* Inform CPUM (recompiler), can later be removed. */
1573	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
1574
1575	/*
1576	* Flush the TLB with new CR3. This is required in case the PGM mode change
1577	* above doesn't actually change anything.
1578	*/
1579	if (rc == VINF_SUCCESS)
1580	{
1581	rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true);
1582	AssertRCReturn(rc, rc);
1583	}
1584
1585	/* Re-initialize IEM cache/state after the drastic mode switch. */
1586	iemReInitExec(pVCpu);
1587	return rc;
1588	}
1589
1590
1591	/**
1592	* Calculates the current VMX-preemption timer value.
1593	*
1594	* @param pVCpu The cross context virtual CPU structure.
1595	*/
1596	IEM_STATIC uint32_t iemVmxCalcPreemptTimer(PVMCPU pVCpu)
1597	{
1598	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1599	Assert(pVmcs);
1600
1601	/*
1602	* Assume the following:
1603	* PreemptTimerShift = 5
1604	* VmcsPreemptTimer = 2 (i.e. need to decrement by 1 every 2 * RT_BIT(5) = 20000 TSC ticks)
1605	* EntryTick = 50000 (TSC at time of VM-entry)
1606	*
1607	* CurTick Delta PreemptTimerVal
1608	* ----------------------------------
1609	* 60000 10000 2
1610	* 80000 30000 1
1611	* 90000 40000 0 -> VM-exit.
1612	*
1613	* If Delta >= VmcsPreemptTimer * RT_BIT(PreemptTimerShift) cause a VMX-preemption timer VM-exit.
1614	* The saved VMX-preemption timer value is calculated as follows:
1615	* PreemptTimerVal = VmcsPreemptTimer - (Delta / (VmcsPreemptTimer * RT_BIT(PreemptTimerShift)))
1616	* E.g.:
1617	* Delta = 10000
1618	* Tmp = 10000 / (2 * 10000) = 0.5
1619	* NewPt = 2 - 0.5 = 2
1620	* Delta = 30000
1621	* Tmp = 30000 / (2 * 10000) = 1.5
1622	* NewPt = 2 - 1.5 = 1
1623	* Delta = 40000
1624	* Tmp = 40000 / 20000 = 2
1625	* NewPt = 2 - 2 = 0
1626	*/
1627	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1628	uint64_t const uCurTick = TMCpuTickGetNoCheck(pVCpu);
1629	uint64_t const uEntryTick = pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick;
1630	uint64_t const uDelta = uCurTick - uEntryTick;
1631	uint32_t const uVmcsPreemptVal = pVmcs->u32PreemptTimer;
1632	uint32_t const uPreemptTimer = uVmcsPreemptVal
1633	- ASMDivU64ByU32RetU32(uDelta, uVmcsPreemptVal * RT_BIT(VMX_V_PREEMPT_TIMER_SHIFT));
1634	return uPreemptTimer;
1635	}
1636
1637
1638	/**
1639	* Saves guest segment registers, GDTR, IDTR, LDTR, TR as part of VM-exit.
1640	*
1641	* @param pVCpu The cross context virtual CPU structure.
1642	*/
1643	IEM_STATIC void iemVmxVmexitSaveGuestSegRegs(PVMCPU pVCpu)
1644	{
1645	/*
1646	* Save guest segment registers, GDTR, IDTR, LDTR, TR.
1647	* See Intel spec 27.3.2 "Saving Segment Registers and Descriptor-Table Registers".
1648	*/
1649	/* CS, SS, ES, DS, FS, GS. */
1650	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1651	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1652	{
1653	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1654	if (!pSelReg->Attr.n.u1Unusable)
1655	iemVmxVmcsSetGuestSegReg(pVmcs, iSegReg, pSelReg);
1656	else
1657	{
1658	/*
1659	* For unusable segments the attributes are undefined except for CS and SS.
1660	* For the rest we don't bother preserving anything but the unusable bit.
1661	*/
1662	switch (iSegReg)
1663	{
1664	case X86_SREG_CS:
1665	pVmcs->GuestCs = pSelReg->Sel;
1666	pVmcs->u64GuestCsBase.u = pSelReg->u64Base;
1667	pVmcs->u32GuestCsLimit = pSelReg->u32Limit;
1668	pVmcs->u32GuestCsAttr = pSelReg->Attr.u & ( X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1669	\| X86DESCATTR_UNUSABLE);
1670	break;
1671
1672	case X86_SREG_SS:
1673	pVmcs->GuestSs = pSelReg->Sel;
1674	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1675	pVmcs->u64GuestSsBase.u &= UINT32_C(0xffffffff);
1676	pVmcs->u32GuestSsAttr = pSelReg->Attr.u & (X86DESCATTR_DPL \| X86DESCATTR_UNUSABLE);
1677	break;
1678
1679	case X86_SREG_DS:
1680	pVmcs->GuestDs = pSelReg->Sel;
1681	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1682	pVmcs->u64GuestDsBase.u &= UINT32_C(0xffffffff);
1683	pVmcs->u32GuestDsAttr = X86DESCATTR_UNUSABLE;
1684	break;
1685
1686	case X86_SREG_ES:
1687	pVmcs->GuestEs = pSelReg->Sel;
1688	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1689	pVmcs->u64GuestEsBase.u &= UINT32_C(0xffffffff);
1690	pVmcs->u32GuestEsAttr = X86DESCATTR_UNUSABLE;
1691	break;
1692
1693	case X86_SREG_FS:
1694	pVmcs->GuestFs = pSelReg->Sel;
1695	pVmcs->u64GuestFsBase.u = pSelReg->u64Base;
1696	pVmcs->u32GuestFsAttr = X86DESCATTR_UNUSABLE;
1697	break;
1698
1699	case X86_SREG_GS:
1700	pVmcs->GuestGs = pSelReg->Sel;
1701	pVmcs->u64GuestGsBase.u = pSelReg->u64Base;
1702	pVmcs->u32GuestGsAttr = X86DESCATTR_UNUSABLE;
1703	break;
1704	}
1705	}
1706	}
1707
1708	/* Segment attribute bits 31:17 and 11:8 MBZ. */
1709	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
1710	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1711	\| X86DESCATTR_UNUSABLE;
1712	/* LDTR. */
1713	{
1714	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.ldtr;
1715	pVmcs->GuestLdtr = pSelReg->Sel;
1716	pVmcs->u64GuestLdtrBase.u = pSelReg->u64Base;
1717	Assert(X86_IS_CANONICAL(pSelReg->u64Base));
1718	pVmcs->u32GuestLdtrLimit = pSelReg->u32Limit;
1719	pVmcs->u32GuestLdtrAttr = pSelReg->Attr.u & fValidAttrMask;
1720	}
1721
1722	/* TR. */
1723	{
1724	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.tr;
1725	pVmcs->GuestTr = pSelReg->Sel;
1726	pVmcs->u64GuestTrBase.u = pSelReg->u64Base;
1727	pVmcs->u32GuestTrLimit = pSelReg->u32Limit;
1728	pVmcs->u32GuestTrAttr = pSelReg->Attr.u & fValidAttrMask;
1729	}
1730
1731	/* GDTR. */
1732	pVmcs->u64GuestGdtrBase.u = pVCpu->cpum.GstCtx.gdtr.pGdt;
1733	pVmcs->u32GuestGdtrLimit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
1734
1735	/* IDTR. */
1736	pVmcs->u64GuestIdtrBase.u = pVCpu->cpum.GstCtx.idtr.pIdt;
1737	pVmcs->u32GuestIdtrLimit = pVCpu->cpum.GstCtx.idtr.cbIdt;
1738	}
1739
1740
1741	/**
1742	* Saves guest non-register state as part of VM-exit.
1743	*
1744	* @param pVCpu The cross context virtual CPU structure.
1745	* @param uExitReason The VM-exit reason.
1746	*/
1747	IEM_STATIC void iemVmxVmexitSaveGuestNonRegState(PVMCPU pVCpu, uint32_t uExitReason)
1748	{
1749	/*
1750	* Save guest non-register state.
1751	* See Intel spec. 27.3.4 "Saving Non-Register State".
1752	*/
1753	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1754
1755	/*
1756	* Activity state.
1757	* Most VM-exits will occur in the active state. However, if the first instruction
1758	* following the VM-entry is a HLT instruction, and the MTF VM-execution control is set,
1759	* the VM-exit will be from the HLT activity state.
1760	*
1761	* See Intel spec. 25.5.2 "Monitor Trap Flag".
1762	*/
1763	/** @todo NSTVMX: Does triple-fault VM-exit reflect a shutdown activity state or
1764	* not? */
1765	EMSTATE const enmActivityState = EMGetState(pVCpu);
1766	switch (enmActivityState)
1767	{
1768	case EMSTATE_HALTED: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_HLT; break;
1769	default: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_ACTIVE; break;
1770	}
1771
1772	/*
1773	* Interruptibility-state.
1774	*/
1775	/* NMI. */
1776	pVmcs->u32GuestIntrState = 0;
1777	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
1778	{
1779	if (pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking)
1780	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1781	}
1782	else
1783	{
1784	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS))
1785	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1786	}
1787
1788	/* Blocking-by-STI. */
1789	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
1790	&& pVCpu->cpum.GstCtx.rip == EMGetInhibitInterruptsPC(pVCpu))
1791	{
1792	/** @todo NSTVMX: We can't distinguish between blocking-by-MovSS and blocking-by-STI
1793	* currently. */
1794	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_STI;
1795	}
1796	/* Nothing to do for SMI/enclave. We don't support enclaves or SMM yet. */
1797
1798	/*
1799	* Pending debug exceptions.
1800	*/
1801	if ( uExitReason != VMX_EXIT_INIT_SIGNAL
1802	&& uExitReason != VMX_EXIT_SMI
1803	&& uExitReason != VMX_EXIT_ERR_MACHINE_CHECK
1804	&& !HMVmxIsVmexitTrapLike(uExitReason))
1805	{
1806	/** @todo NSTVMX: also must exclude VM-exits caused by debug exceptions when
1807	* block-by-MovSS is in effect. */
1808	pVmcs->u64GuestPendingDbgXcpt.u = 0;
1809	}
1810	else
1811	{
1812	/*
1813	* Pending debug exception field is identical to DR6 except the RTM bit (16) which needs to be flipped.
1814	* The "enabled breakpoint" bit (12) is not present in DR6, so we need to update it here.
1815	*
1816	* See Intel spec. 24.4.2 "Guest Non-Register State".
1817	*/
1818	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR6);
1819	uint64_t fPendingDbgMask = pVCpu->cpum.GstCtx.dr[6];
1820	uint64_t const fBpHitMask = VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP0 \| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP1
1821	\| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP2 \| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BP3;
1822	if (fPendingDbgMask & fBpHitMask)
1823	fPendingDbgMask \|= VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP;
1824	fPendingDbgMask ^= VMX_VMCS_GUEST_PENDING_DEBUG_RTM;
1825	pVmcs->u64GuestPendingDbgXcpt.u = fPendingDbgMask;
1826	}
1827
1828	/*
1829	* Save the VMX-preemption timer value back into the VMCS if the feature is enabled.
1830	*
1831	* For VMX-preemption timer VM-exits, we should have already written back 0 if the
1832	* feature is supported back into the VMCS, and thus there is nothing further to do here.
1833	*/
1834	if ( uExitReason != VMX_EXIT_PREEMPT_TIMER
1835	&& (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
1836	pVmcs->u32PreemptTimer = iemVmxCalcPreemptTimer(pVCpu);
1837
1838	/* PDPTEs. */
1839	/* We don't support EPT yet. */
1840	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT));
1841	pVmcs->u64GuestPdpte0.u = 0;
1842	pVmcs->u64GuestPdpte1.u = 0;
1843	pVmcs->u64GuestPdpte2.u = 0;
1844	pVmcs->u64GuestPdpte3.u = 0;
1845	}
1846
1847
1848	/**
1849	* Saves the guest-state as part of VM-exit.
1850	*
1851	* @returns VBox status code.
1852	* @param pVCpu The cross context virtual CPU structure.
1853	* @param uExitReason The VM-exit reason.
1854	*/
1855	IEM_STATIC void iemVmxVmexitSaveGuestState(PVMCPU pVCpu, uint32_t uExitReason)
1856	{
1857	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1858	Assert(pVmcs);
1859
1860	iemVmxVmexitSaveGuestControlRegsMsrs(pVCpu);
1861	iemVmxVmexitSaveGuestSegRegs(pVCpu);
1862
1863	pVmcs->u64GuestRip.u = pVCpu->cpum.GstCtx.rip;
1864	pVmcs->u64GuestRsp.u = pVCpu->cpum.GstCtx.rsp;
1865	pVmcs->u64GuestRFlags.u = pVCpu->cpum.GstCtx.rflags.u; /** @todo NSTVMX: Check RFLAGS.RF handling. */
1866
1867	iemVmxVmexitSaveGuestNonRegState(pVCpu, uExitReason);
1868	}
1869
1870
1871	/**
1872	* Saves the guest MSRs into the VM-exit MSR-store area as part of VM-exit.
1873	*
1874	* @returns VBox status code.
1875	* @param pVCpu The cross context virtual CPU structure.
1876	* @param uExitReason The VM-exit reason (for diagnostic purposes).
1877	*/
1878	IEM_STATIC int iemVmxVmexitSaveGuestAutoMsrs(PVMCPU pVCpu, uint32_t uExitReason)
1879	{
1880	/*
1881	* Save guest MSRs.
1882	* See Intel spec. 27.4 "Saving MSRs".
1883	*/
1884	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1885	const char *const pszFailure = "VMX-abort";
1886
1887	/*
1888	* The VM-exit MSR-store area address need not be a valid guest-physical address if the
1889	* VM-exit MSR-store count is 0. If this is the case, bail early without reading it.
1890	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1891	*/
1892	uint32_t const cMsrs = pVmcs->u32ExitMsrStoreCount;
1893	if (!cMsrs)
1894	return VINF_SUCCESS;
1895
1896	/*
1897	* Verify the MSR auto-store count. Physical CPUs can behave unpredictably if the count
1898	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1899	* implementation causes a VMX-abort followed by a triple-fault.
1900	*/
1901	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1902	if (fIsMsrCountValid)
1903	{ /* likely */ }
1904	else
1905	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreCount);
1906
1907	PVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pExitMsrStoreArea);
1908	Assert(pMsr);
1909	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1910	{
1911	if ( !pMsr->u32Reserved
1912	&& pMsr->u32Msr != MSR_IA32_SMBASE
1913	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1914	{
1915	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pMsr->u32Msr, &pMsr->u64Value);
1916	if (rcStrict == VINF_SUCCESS)
1917	continue;
1918
1919	/*
1920	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
1921	* If any guest hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
1922	* recording the MSR index in the auxiliary info. field and indicated further by our
1923	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
1924	* if possible, or come up with a better, generic solution.
1925	*/
1926	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1927	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_READ
1928	? kVmxVDiag_Vmexit_MsrStoreRing3
1929	: kVmxVDiag_Vmexit_MsrStore;
1930	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
1931	}
1932	else
1933	{
1934	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1935	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreRsvd);
1936	}
1937	}
1938
1939	RTGCPHYS const GCPhysVmExitMsrStoreArea = pVmcs->u64AddrExitMsrStore.u;
1940	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmExitMsrStoreArea,
1941	pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pExitMsrStoreArea), cMsrs * sizeof(VMXAUTOMSR));
1942	if (RT_SUCCESS(rc))
1943	{ /* likely */ }
1944	else
1945	{
1946	AssertMsgFailed(("VM-exit: Failed to write MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1947	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrWritePhys);
1948	}
1949
1950	NOREF(uExitReason);
1951	NOREF(pszFailure);
1952	return VINF_SUCCESS;
1953	}
1954
1955
1956	/**
1957	* Performs a VMX abort (due to an fatal error during VM-exit).
1958	*
1959	* @returns Strict VBox status code.
1960	* @param pVCpu The cross context virtual CPU structure.
1961	* @param enmAbort The VMX abort reason.
1962	*/
1963	IEM_STATIC VBOXSTRICTRC iemVmxAbort(PVMCPU pVCpu, VMXABORT enmAbort)
1964	{
1965	/*
1966	* Perform the VMX abort.
1967	* See Intel spec. 27.7 "VMX Aborts".
1968	*/
1969	LogFunc(("enmAbort=%u (%s) -> RESET\n", enmAbort, HMGetVmxAbortDesc(enmAbort)));
1970
1971	/* We don't support SMX yet. */
1972	pVCpu->cpum.GstCtx.hwvirt.vmx.enmAbort = enmAbort;
1973	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1974	{
1975	RTGCPHYS const GCPhysVmcs = IEM_VMX_GET_CURRENT_VMCS(pVCpu);
1976	uint32_t const offVmxAbort = RT_UOFFSETOF(VMXVVMCS, enmVmxAbort);
1977	PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + offVmxAbort, &enmAbort, sizeof(enmAbort));
1978	}
1979
1980	return VINF_EM_TRIPLE_FAULT;
1981	}
1982
1983
1984	/**
1985	* Loads host control registers, debug registers and MSRs as part of VM-exit.
1986	*
1987	* @param pVCpu The cross context virtual CPU structure.
1988	*/
1989	IEM_STATIC void iemVmxVmexitLoadHostControlRegsMsrs(PVMCPU pVCpu)
1990	{
1991	/*
1992	* Load host control registers, debug registers and MSRs.
1993	* See Intel spec. 27.5.1 "Loading Host Control Registers, Debug Registers, MSRs".
1994	*/
1995	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
1996	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1997
1998	/* CR0. */
1999	{
2000	/* Bits 63:32, 28:19, 17, 15:6, ET, CD, NW and CR0 MB1 bits are not modified. */
2001	uint64_t const uCr0Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed0;
2002	uint64_t const fCr0IgnMask = UINT64_C(0xffffffff1ff8ffc0) \| X86_CR0_ET \| X86_CR0_CD \| X86_CR0_NW \| uCr0Fixed0;
2003	uint64_t const uHostCr0 = pVmcs->u64HostCr0.u;
2004	uint64_t const uGuestCr0 = pVCpu->cpum.GstCtx.cr0;
2005	uint64_t const uValidCr0 = (uHostCr0 & ~fCr0IgnMask) \| (uGuestCr0 & fCr0IgnMask);
2006	CPUMSetGuestCR0(pVCpu, uValidCr0);
2007	}
2008
2009	/* CR4. */
2010	{
2011	/* CR4 MB1 bits are not modified. */
2012	uint64_t const fCr4IgnMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
2013	uint64_t const uHostCr4 = pVmcs->u64HostCr4.u;
2014	uint64_t const uGuestCr4 = pVCpu->cpum.GstCtx.cr4;
2015	uint64_t uValidCr4 = (uHostCr4 & ~fCr4IgnMask) \| (uGuestCr4 & fCr4IgnMask);
2016	if (fHostInLongMode)
2017	uValidCr4 \|= X86_CR4_PAE;
2018	else
2019	uValidCr4 &= ~X86_CR4_PCIDE;
2020	CPUMSetGuestCR4(pVCpu, uValidCr4);
2021	}
2022
2023	/* CR3 (host value validated while checking host-state during VM-entry). */
2024	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64HostCr3.u;
2025
2026	/* DR7. */
2027	pVCpu->cpum.GstCtx.dr[7] = X86_DR7_INIT_VAL;
2028
2029	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
2030
2031	/* Save SYSENTER CS, ESP, EIP (host value validated while checking host-state during VM-entry). */
2032	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64HostSysenterEip.u;
2033	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64HostSysenterEsp.u;
2034	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32HostSysenterCs;
2035
2036	/* FS, GS bases are loaded later while we load host segment registers. */
2037
2038	/* EFER MSR (host value validated while checking host-state during VM-entry). */
2039	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
2040	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64HostEferMsr.u;
2041	else if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
2042	{
2043	if (fHostInLongMode)
2044	pVCpu->cpum.GstCtx.msrEFER \|= (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
2045	else
2046	pVCpu->cpum.GstCtx.msrEFER &= ~(MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
2047	}
2048
2049	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
2050
2051	/* PAT MSR (host value is validated while checking host-state during VM-entry). */
2052	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
2053	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64HostPatMsr.u;
2054
2055	/* We don't support IA32_BNDCFGS MSR yet. */
2056	}
2057
2058
2059	/**
2060	* Loads host segment registers, GDTR, IDTR, LDTR and TR as part of VM-exit.
2061	*
2062	* @param pVCpu The cross context virtual CPU structure.
2063	*/
2064	IEM_STATIC void iemVmxVmexitLoadHostSegRegs(PVMCPU pVCpu)
2065	{
2066	/*
2067	* Load host segment registers, GDTR, IDTR, LDTR and TR.
2068	* See Intel spec. 27.5.2 "Loading Host Segment and Descriptor-Table Registers".
2069	*
2070	* Warning! Be careful to not touch fields that are reserved by VT-x,
2071	* e.g. segment limit high bits stored in segment attributes (in bits 11:8).
2072	*/
2073	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2074	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2075
2076	/* CS, SS, ES, DS, FS, GS. */
2077	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
2078	{
2079	RTSEL const HostSel = iemVmxVmcsGetHostSelReg(pVmcs, iSegReg);
2080	bool const fUnusable = RT_BOOL(HostSel == 0);
2081	PCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
2082
2083	/* Selector. */
2084	pSelReg->Sel = HostSel;
2085	pSelReg->ValidSel = HostSel;
2086	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
2087
2088	/* Limit. */
2089	pSelReg->u32Limit = 0xffffffff;
2090
2091	/* Base. */
2092	pSelReg->u64Base = 0;
2093
2094	/* Attributes. */
2095	if (iSegReg == X86_SREG_CS)
2096	{
2097	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED;
2098	pSelReg->Attr.n.u1DescType = 1;
2099	pSelReg->Attr.n.u2Dpl = 0;
2100	pSelReg->Attr.n.u1Present = 1;
2101	pSelReg->Attr.n.u1Long = fHostInLongMode;
2102	pSelReg->Attr.n.u1DefBig = !fHostInLongMode;
2103	pSelReg->Attr.n.u1Granularity = 1;
2104	Assert(!pSelReg->Attr.n.u1Unusable);
2105	Assert(!fUnusable);
2106	}
2107	else
2108	{
2109	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED;
2110	pSelReg->Attr.n.u1DescType = 1;
2111	pSelReg->Attr.n.u2Dpl = 0;
2112	pSelReg->Attr.n.u1Present = 1;
2113	pSelReg->Attr.n.u1DefBig = 1;
2114	pSelReg->Attr.n.u1Granularity = 1;
2115	pSelReg->Attr.n.u1Unusable = fUnusable;
2116	}
2117	}
2118
2119	/* FS base. */
2120	if ( !pVCpu->cpum.GstCtx.fs.Attr.n.u1Unusable
2121	\|\| fHostInLongMode)
2122	{
2123	Assert(X86_IS_CANONICAL(pVmcs->u64HostFsBase.u));
2124	pVCpu->cpum.GstCtx.fs.u64Base = pVmcs->u64HostFsBase.u;
2125	}
2126
2127	/* GS base. */
2128	if ( !pVCpu->cpum.GstCtx.gs.Attr.n.u1Unusable
2129	\|\| fHostInLongMode)
2130	{
2131	Assert(X86_IS_CANONICAL(pVmcs->u64HostGsBase.u));
2132	pVCpu->cpum.GstCtx.gs.u64Base = pVmcs->u64HostGsBase.u;
2133	}
2134
2135	/* TR. */
2136	Assert(X86_IS_CANONICAL(pVmcs->u64HostTrBase.u));
2137	Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1Unusable);
2138	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->HostTr;
2139	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->HostTr;
2140	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
2141	pVCpu->cpum.GstCtx.tr.u32Limit = X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN;
2142	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64HostTrBase.u;
2143	pVCpu->cpum.GstCtx.tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
2144	pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType = 0;
2145	pVCpu->cpum.GstCtx.tr.Attr.n.u2Dpl = 0;
2146	pVCpu->cpum.GstCtx.tr.Attr.n.u1Present = 1;
2147	pVCpu->cpum.GstCtx.tr.Attr.n.u1DefBig = 0;
2148	pVCpu->cpum.GstCtx.tr.Attr.n.u1Granularity = 0;
2149
2150	/* LDTR (Warning! do not touch the base and limits here). */
2151	pVCpu->cpum.GstCtx.ldtr.Sel = 0;
2152	pVCpu->cpum.GstCtx.ldtr.ValidSel = 0;
2153	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
2154	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
2155
2156	/* GDTR. */
2157	Assert(X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u));
2158	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64HostGdtrBase.u;
2159	pVCpu->cpum.GstCtx.gdtr.cbGdt = 0xffff;
2160
2161	/* IDTR.*/
2162	Assert(X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u));
2163	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64HostIdtrBase.u;
2164	pVCpu->cpum.GstCtx.idtr.cbIdt = 0xffff;
2165	}
2166
2167
2168	/**
2169	* Checks host PDPTes as part of VM-exit.
2170	*
2171	* @param pVCpu The cross context virtual CPU structure.
2172	* @param uExitReason The VM-exit reason (for logging purposes).
2173	*/
2174	IEM_STATIC int iemVmxVmexitCheckHostPdptes(PVMCPU pVCpu, uint32_t uExitReason)
2175	{
2176	/*
2177	* Check host PDPTEs.
2178	* See Intel spec. 27.5.4 "Checking and Loading Host Page-Directory-Pointer-Table Entries".
2179	*/
2180	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2181	const char *const pszFailure = "VMX-abort";
2182	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2183
2184	if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
2185	&& !fHostInLongMode)
2186	{
2187	uint64_t const uHostCr3 = pVCpu->cpum.GstCtx.cr3 & X86_CR3_PAE_PAGE_MASK;
2188	X86PDPE aPdptes[X86_PG_PAE_PDPE_ENTRIES];
2189	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)&aPdptes[0], uHostCr3, sizeof(aPdptes));
2190	if (RT_SUCCESS(rc))
2191	{
2192	for (unsigned iPdpte = 0; iPdpte < RT_ELEMENTS(aPdptes); iPdpte++)
2193	{
2194	if ( !(aPdptes[iPdpte].u & X86_PDPE_P)
2195	\|\| !(aPdptes[iPdpte].u & X86_PDPE_PAE_MBZ_MASK))
2196	{ /* likely */ }
2197	else
2198	{
2199	VMXVDIAG const enmDiag = iemVmxGetDiagVmexitPdpteRsvd(iPdpte);
2200	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
2201	}
2202	}
2203	}
2204	else
2205	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_HostPdpteCr3ReadPhys);
2206	}
2207
2208	NOREF(pszFailure);
2209	NOREF(uExitReason);
2210	return VINF_SUCCESS;
2211	}
2212
2213
2214	/**
2215	* Loads the host MSRs from the VM-exit MSR-load area as part of VM-exit.
2216	*
2217	* @returns VBox status code.
2218	* @param pVCpu The cross context virtual CPU structure.
2219	* @param pszInstr The VMX instruction name (for logging purposes).
2220	*/
2221	IEM_STATIC int iemVmxVmexitLoadHostAutoMsrs(PVMCPU pVCpu, uint32_t uExitReason)
2222	{
2223	/*
2224	* Load host MSRs.
2225	* See Intel spec. 27.6 "Loading MSRs".
2226	*/
2227	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2228	const char *const pszFailure = "VMX-abort";
2229
2230	/*
2231	* The VM-exit MSR-load area address need not be a valid guest-physical address if the
2232	* VM-exit MSR load count is 0. If this is the case, bail early without reading it.
2233	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
2234	*/
2235	uint32_t const cMsrs = pVmcs->u32ExitMsrLoadCount;
2236	if (!cMsrs)
2237	return VINF_SUCCESS;
2238
2239	/*
2240	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count
2241	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
2242	* implementation causes a VMX-abort followed by a triple-fault.
2243	*/
2244	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
2245	if (fIsMsrCountValid)
2246	{ /* likely */ }
2247	else
2248	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadCount);
2249
2250	RTGCPHYS const GCPhysVmExitMsrLoadArea = pVmcs->u64AddrExitMsrLoad.u;
2251	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pExitMsrLoadArea),
2252	GCPhysVmExitMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
2253	if (RT_SUCCESS(rc))
2254	{
2255	PCVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pExitMsrLoadArea);
2256	Assert(pMsr);
2257	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
2258	{
2259	if ( !pMsr->u32Reserved
2260	&& pMsr->u32Msr != MSR_K8_FS_BASE
2261	&& pMsr->u32Msr != MSR_K8_GS_BASE
2262	&& pMsr->u32Msr != MSR_K6_EFER
2263	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
2264	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
2265	{
2266	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
2267	if (rcStrict == VINF_SUCCESS)
2268	continue;
2269
2270	/*
2271	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
2272	* If any guest hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
2273	* recording the MSR index in the auxiliary info. field and indicated further by our
2274	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
2275	* if possible, or come up with a better, generic solution.
2276	*/
2277	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
2278	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
2279	? kVmxVDiag_Vmexit_MsrLoadRing3
2280	: kVmxVDiag_Vmexit_MsrLoad;
2281	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
2282	}
2283	else
2284	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadRsvd);
2285	}
2286	}
2287	else
2288	{
2289	AssertMsgFailed(("VM-exit: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrLoadArea, rc));
2290	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadPtrReadPhys);
2291	}
2292
2293	NOREF(uExitReason);
2294	NOREF(pszFailure);
2295	return VINF_SUCCESS;
2296	}
2297
2298
2299	/**
2300	* Loads the host state as part of VM-exit.
2301	*
2302	* @returns Strict VBox status code.
2303	* @param pVCpu The cross context virtual CPU structure.
2304	* @param uExitReason The VM-exit reason (for logging purposes).
2305	*/
2306	IEM_STATIC VBOXSTRICTRC iemVmxVmexitLoadHostState(PVMCPU pVCpu, uint32_t uExitReason)
2307	{
2308	/*
2309	* Load host state.
2310	* See Intel spec. 27.5 "Loading Host State".
2311	*/
2312	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2313	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2314
2315	/* We cannot return from a long-mode guest to a host that is not in long mode. */
2316	if ( CPUMIsGuestInLongMode(pVCpu)
2317	&& !fHostInLongMode)
2318	{
2319	Log(("VM-exit from long-mode guest to host not in long-mode -> VMX-Abort\n"));
2320	return iemVmxAbort(pVCpu, VMXABORT_HOST_NOT_IN_LONG_MODE);
2321	}
2322
2323	iemVmxVmexitLoadHostControlRegsMsrs(pVCpu);
2324	iemVmxVmexitLoadHostSegRegs(pVCpu);
2325
2326	/*
2327	* Load host RIP, RSP and RFLAGS.
2328	* See Intel spec. 27.5.3 "Loading Host RIP, RSP and RFLAGS"
2329	*/
2330	pVCpu->cpum.GstCtx.rip = pVmcs->u64HostRip.u;
2331	pVCpu->cpum.GstCtx.rsp = pVmcs->u64HostRsp.u;
2332	pVCpu->cpum.GstCtx.rflags.u = X86_EFL_1;
2333
2334	/* Clear address range monitoring. */
2335	EMMonitorWaitClear(pVCpu);
2336
2337	/* Perform the VMX transition (PGM updates). */
2338	VBOXSTRICTRC rcStrict = iemVmxWorldSwitch(pVCpu);
2339	if (rcStrict == VINF_SUCCESS)
2340	{
2341	/* Check host PDPTEs (only when we've fully switched page tables_. */
2342	/** @todo r=ramshankar: I don't know if PGM does this for us already or not... */
2343	int rc = iemVmxVmexitCheckHostPdptes(pVCpu, uExitReason);
2344	if (RT_FAILURE(rc))
2345	{
2346	Log(("VM-exit failed while restoring host PDPTEs -> VMX-Abort\n"));
2347	return iemVmxAbort(pVCpu, VMXBOART_HOST_PDPTE);
2348	}
2349	}
2350	else if (RT_SUCCESS(rcStrict))
2351	{
2352	Log3(("VM-exit: iemVmxWorldSwitch returns %Rrc (uExitReason=%u) -> Setting passup status\n", VBOXSTRICTRC_VAL(rcStrict),
2353	uExitReason));
2354	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
2355	}
2356	else
2357	{
2358	Log3(("VM-exit: iemVmxWorldSwitch failed! rc=%Rrc (uExitReason=%u)\n", VBOXSTRICTRC_VAL(rcStrict), uExitReason));
2359	return VBOXSTRICTRC_VAL(rcStrict);
2360	}
2361
2362	Assert(rcStrict == VINF_SUCCESS);
2363
2364	/* Load MSRs from the VM-exit auto-load MSR area. */
2365	int rc = iemVmxVmexitLoadHostAutoMsrs(pVCpu, uExitReason);
2366	if (RT_FAILURE(rc))
2367	{
2368	Log(("VM-exit failed while loading host MSRs -> VMX-Abort\n"));
2369	return iemVmxAbort(pVCpu, VMXABORT_LOAD_HOST_MSR);
2370	}
2371	return VINF_SUCCESS;
2372	}
2373
2374
2375	/**
2376	* Gets VM-exit instruction information along with any displacement for an
2377	* instruction VM-exit.
2378	*
2379	* @returns The VM-exit instruction information.
2380	* @param pVCpu The cross context virtual CPU structure.
2381	* @param uExitReason The VM-exit reason.
2382	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX).
2383	* @param pGCPtrDisp Where to store the displacement field. Optional, can be
2384	* NULL.
2385	*/
2386	IEM_STATIC uint32_t iemVmxGetExitInstrInfo(PVMCPU pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, PRTGCPTR pGCPtrDisp)
2387	{
2388	RTGCPTR GCPtrDisp;
2389	VMXEXITINSTRINFO ExitInstrInfo;
2390	ExitInstrInfo.u = 0;
2391
2392	/*
2393	* Get and parse the ModR/M byte from our decoded opcodes.
2394	*/
2395	uint8_t bRm;
2396	uint8_t const offModRm = pVCpu->iem.s.offModRm;
2397	IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
2398	if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
2399	{
2400	/*
2401	* ModR/M indicates register addressing.
2402	*
2403	* The primary/secondary register operands are reported in the iReg1 or iReg2
2404	* fields depending on whether it is a read/write form.
2405	*/
2406	uint8_t idxReg1;
2407	uint8_t idxReg2;
2408	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2409	{
2410	idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2411	idxReg2 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2412	}
2413	else
2414	{
2415	idxReg1 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2416	idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2417	}
2418	ExitInstrInfo.All.u2Scaling = 0;
2419	ExitInstrInfo.All.iReg1 = idxReg1;
2420	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2421	ExitInstrInfo.All.fIsRegOperand = 1;
2422	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2423	ExitInstrInfo.All.iSegReg = 0;
2424	ExitInstrInfo.All.iIdxReg = 0;
2425	ExitInstrInfo.All.fIdxRegInvalid = 1;
2426	ExitInstrInfo.All.iBaseReg = 0;
2427	ExitInstrInfo.All.fBaseRegInvalid = 1;
2428	ExitInstrInfo.All.iReg2 = idxReg2;
2429
2430	/* Displacement not applicable for register addressing. */
2431	GCPtrDisp = 0;
2432	}
2433	else
2434	{
2435	/*
2436	* ModR/M indicates memory addressing.
2437	*/
2438	uint8_t uScale = 0;
2439	bool fBaseRegValid = false;
2440	bool fIdxRegValid = false;
2441	uint8_t iBaseReg = 0;
2442	uint8_t iIdxReg = 0;
2443	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
2444	{
2445	/*
2446	* Parse the ModR/M, displacement for 16-bit addressing mode.
2447	* See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
2448	*/
2449	uint16_t u16Disp = 0;
2450	uint8_t const offDisp = offModRm + sizeof(bRm);
2451	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 6)
2452	{
2453	/* Displacement without any registers. */
2454	IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
2455	}
2456	else
2457	{
2458	/* Register (index and base). */
2459	switch (bRm & X86_MODRM_RM_MASK)
2460	{
2461	case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2462	case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2463	case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2464	case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2465	case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2466	case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2467	case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
2468	case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
2469	}
2470
2471	/* Register + displacement. */
2472	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2473	{
2474	case 0: break;
2475	case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
2476	case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
2477	default:
2478	{
2479	/* Register addressing, handled at the beginning. */
2480	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2481	break;
2482	}
2483	}
2484	}
2485
2486	Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
2487	GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
2488	}
2489	else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
2490	{
2491	/*
2492	* Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
2493	* See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
2494	*/
2495	uint32_t u32Disp = 0;
2496	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5)
2497	{
2498	/* Displacement without any registers. */
2499	uint8_t const offDisp = offModRm + sizeof(bRm);
2500	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2501	}
2502	else
2503	{
2504	/* Register (and perhaps scale, index and base). */
2505	uint8_t offDisp = offModRm + sizeof(bRm);
2506	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2507	if (iBaseReg == 4)
2508	{
2509	/* An SIB byte follows the ModR/M byte, parse it. */
2510	uint8_t bSib;
2511	uint8_t const offSib = offModRm + sizeof(bRm);
2512	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2513
2514	/* A displacement may follow SIB, update its offset. */
2515	offDisp += sizeof(bSib);
2516
2517	/* Get the scale. */
2518	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2519
2520	/* Get the index register. */
2521	iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
2522	fIdxRegValid = RT_BOOL(iIdxReg != 4);
2523
2524	/* Get the base register. */
2525	iBaseReg = bSib & X86_SIB_BASE_MASK;
2526	fBaseRegValid = true;
2527	if (iBaseReg == 5)
2528	{
2529	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2530	{
2531	/* Mod is 0 implies a 32-bit displacement with no base. */
2532	fBaseRegValid = false;
2533	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2534	}
2535	else
2536	{
2537	/* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
2538	iBaseReg = X86_GREG_xBP;
2539	}
2540	}
2541	}
2542
2543	/* Register + displacement. */
2544	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2545	{
2546	case 0: /* Handled above */ break;
2547	case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
2548	case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
2549	default:
2550	{
2551	/* Register addressing, handled at the beginning. */
2552	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2553	break;
2554	}
2555	}
2556	}
2557
2558	GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
2559	}
2560	else
2561	{
2562	Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
2563
2564	/*
2565	* Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
2566	* See Intel instruction spec. 2.2 "IA-32e Mode".
2567	*/
2568	uint64_t u64Disp = 0;
2569	bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5);
2570	if (fRipRelativeAddr)
2571	{
2572	/*
2573	* RIP-relative addressing mode.
2574	*
2575	* The displacement is 32-bit signed implying an offset range of +/-2G.
2576	* See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
2577	*/
2578	uint8_t const offDisp = offModRm + sizeof(bRm);
2579	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2580	}
2581	else
2582	{
2583	uint8_t offDisp = offModRm + sizeof(bRm);
2584
2585	/*
2586	* Register (and perhaps scale, index and base).
2587	*
2588	* REX.B extends the most-significant bit of the base register. However, REX.B
2589	* is ignored while determining whether an SIB follows the opcode. Hence, we
2590	* shall OR any REX.B bit -after- inspecting for an SIB byte below.
2591	*
2592	* See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
2593	*/
2594	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2595	if (iBaseReg == 4)
2596	{
2597	/* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
2598	uint8_t bSib;
2599	uint8_t const offSib = offModRm + sizeof(bRm);
2600	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2601
2602	/* Displacement may follow SIB, update its offset. */
2603	offDisp += sizeof(bSib);
2604
2605	/* Get the scale. */
2606	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2607
2608	/* Get the index. */
2609	iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) \| pVCpu->iem.s.uRexIndex;
2610	fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
2611
2612	/* Get the base. */
2613	iBaseReg = (bSib & X86_SIB_BASE_MASK);
2614	fBaseRegValid = true;
2615	if (iBaseReg == 5)
2616	{
2617	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2618	{
2619	/* Mod is 0 implies a signed 32-bit displacement with no base. */
2620	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2621	}
2622	else
2623	{
2624	/* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
2625	iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
2626	}
2627	}
2628	}
2629	iBaseReg \|= pVCpu->iem.s.uRexB;
2630
2631	/* Register + displacement. */
2632	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2633	{
2634	case 0: /* Handled above */ break;
2635	case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
2636	case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
2637	default:
2638	{
2639	/* Register addressing, handled at the beginning. */
2640	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2641	break;
2642	}
2643	}
2644	}
2645
2646	GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
2647	}
2648
2649	/*
2650	* The primary or secondary register operand is reported in iReg2 depending
2651	* on whether the primary operand is in read/write form.
2652	*/
2653	uint8_t idxReg2;
2654	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2655	{
2656	idxReg2 = bRm & X86_MODRM_RM_MASK;
2657	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2658	idxReg2 \|= pVCpu->iem.s.uRexB;
2659	}
2660	else
2661	{
2662	idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
2663	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2664	idxReg2 \|= pVCpu->iem.s.uRexReg;
2665	}
2666	ExitInstrInfo.All.u2Scaling = uScale;
2667	ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
2668	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2669	ExitInstrInfo.All.fIsRegOperand = 0;
2670	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2671	ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
2672	ExitInstrInfo.All.iIdxReg = iIdxReg;
2673	ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
2674	ExitInstrInfo.All.iBaseReg = iBaseReg;
2675	ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
2676	ExitInstrInfo.All.iReg2 = idxReg2;
2677	}
2678
2679	/*
2680	* Handle exceptions to the norm for certain instructions.
2681	* (e.g. some instructions convey an instruction identity in place of iReg2).
2682	*/
2683	switch (uExitReason)
2684	{
2685	case VMX_EXIT_GDTR_IDTR_ACCESS:
2686	{
2687	Assert(VMXINSTRID_IS_VALID(uInstrId));
2688	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2689	ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2690	ExitInstrInfo.GdtIdt.u2Undef0 = 0;
2691	break;
2692	}
2693
2694	case VMX_EXIT_LDTR_TR_ACCESS:
2695	{
2696	Assert(VMXINSTRID_IS_VALID(uInstrId));
2697	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2698	ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2699	ExitInstrInfo.LdtTr.u2Undef0 = 0;
2700	break;
2701	}
2702
2703	case VMX_EXIT_RDRAND:
2704	case VMX_EXIT_RDSEED:
2705	{
2706	Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
2707	break;
2708	}
2709	}
2710
2711	/* Update displacement and return the constructed VM-exit instruction information field. */
2712	if (pGCPtrDisp)
2713	*pGCPtrDisp = GCPtrDisp;
2714
2715	return ExitInstrInfo.u;
2716	}
2717
2718
2719	/**
2720	* VMX VM-exit handler.
2721	*
2722	* @returns Strict VBox status code.
2723	* @retval VINF_VMX_VMEXIT when the VM-exit is successful.
2724	* @retval VINF_EM_TRIPLE_FAULT when VM-exit is unsuccessful and leads to a
2725	* triple-fault.
2726	*
2727	* @param pVCpu The cross context virtual CPU structure.
2728	* @param uExitReason The VM-exit reason.
2729	*
2730	* @remarks Make sure VM-exit qualification is updated before calling this
2731	* function!
2732	*/
2733	IEM_STATIC VBOXSTRICTRC iemVmxVmexit(PVMCPU pVCpu, uint32_t uExitReason)
2734	{
2735	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2736	RT_NOREF2(pVCpu, uExitReason);
2737	return VINF_EM_RAW_EMULATE_INSTR;
2738	# else
2739	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR0 \| CPUMCTX_EXTRN_CR3 \| CPUMCTX_EXTRN_CR4 /* Control registers */
2740	\| CPUMCTX_EXTRN_DR7 \| CPUMCTX_EXTRN_DR6 /* Debug registers */
2741	\| CPUMCTX_EXTRN_EFER /* MSRs */
2742	\| CPUMCTX_EXTRN_SYSENTER_MSRS
2743	\| CPUMCTX_EXTRN_OTHER_MSRS /* PAT */
2744	\| CPUMCTX_EXTRN_RIP \| CPUMCTX_EXTRN_RSP \| CPUMCTX_EXTRN_RFLAGS /* GPRs */
2745	\| CPUMCTX_EXTRN_SREG_MASK /* Segment registers */
2746	\| CPUMCTX_EXTRN_TR /* Task register */
2747	\| CPUMCTX_EXTRN_LDTR \| CPUMCTX_EXTRN_GDTR \| CPUMCTX_EXTRN_IDTR /* Table registers */
2748	\| CPUMCTX_EXTRN_HWVIRT); /* Hardware virtualization state */
2749
2750	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
2751	Assert(pVmcs);
2752
2753	/* Ensure VM-entry interruption information valid bit isn't set. */
2754	Assert(!VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo));
2755
2756	/* Update the VM-exit reason, the other relevant data fields are expected to be updated by the caller already. */
2757	pVmcs->u32RoExitReason = uExitReason;
2758	Log3(("vmexit: uExitReason=%#RX32 uExitQual=%#RX64 cs:rip=%04x:%#RX64\n", uExitReason, pVmcs->u64RoExitQual,
2759	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip));
2760
2761	/*
2762	* Clear IDT-vectoring information fields if the VM-exit was not triggered during delivery of an event.
2763	* See Intel spec. 27.2.3 "Information for VM Exits During Event Delivery".
2764	*/
2765	{
2766	uint8_t uVector;
2767	uint32_t fFlags;
2768	uint32_t uErrCode;
2769	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, &uVector, &fFlags, &uErrCode, NULL /* uCr2 */);
2770	if (!fInEventDelivery)
2771	iemVmxVmcsSetIdtVectoringInfo(pVCpu, 0);
2772	/* else: Caller would have updated IDT-vectoring information already, see iemVmxVmexitEvent(). */
2773	}
2774
2775	/* The following VMCS fields are unsupported since we don't injecting SMIs into a guest. */
2776	Assert(pVmcs->u64RoIoRcx.u == 0);
2777	Assert(pVmcs->u64RoIoRsi.u == 0);
2778	Assert(pVmcs->u64RoIoRdi.u == 0);
2779	Assert(pVmcs->u64RoIoRip.u == 0);
2780
2781	/*
2782	* Save the guest state back into the VMCS.
2783	* We only need to save the state when the VM-entry was successful.
2784	*/
2785	bool const fVmentryFailed = VMX_EXIT_REASON_HAS_ENTRY_FAILED(uExitReason);
2786	if (!fVmentryFailed)
2787	{
2788	/*
2789	* If we support storing EFER.LMA into IA32e-mode guest field on VM-exit, we need to do that now.
2790	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry Control".
2791	*
2792	* It is not clear from the Intel spec. if this is done only when VM-entry succeeds.
2793	* If a VM-exit happens before loading guest EFER, we risk restoring the host EFER.LMA
2794	* as guest-CPU state would not been modified. Hence for now, we do this only when
2795	* the VM-entry succeeded.
2796	*/
2797	/** @todo r=ramshankar: Figure out if this bit gets set to host EFER.LMA on real
2798	* hardware when VM-exit fails during VM-entry (e.g. VERR_VMX_INVALID_GUEST_STATE). */
2799	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxExitSaveEferLma)
2800	{
2801	if (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LMA)
2802	pVmcs->u32EntryCtls \|= VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2803	else
2804	pVmcs->u32EntryCtls &= ~VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2805	}
2806
2807	/*
2808	* The rest of the high bits of the VM-exit reason are only relevant when the VM-exit
2809	* occurs in enclave mode/SMM which we don't support yet.
2810	*
2811	* If we ever add support for it, we can pass just the lower bits to the functions
2812	* below, till then an assert should suffice.
2813	*/
2814	Assert(!RT_HI_U16(uExitReason));
2815
2816	/* Save the guest state into the VMCS and restore guest MSRs from the auto-store guest MSR area. */
2817	iemVmxVmexitSaveGuestState(pVCpu, uExitReason);
2818	int rc = iemVmxVmexitSaveGuestAutoMsrs(pVCpu, uExitReason);
2819	if (RT_SUCCESS(rc))
2820	{ /* likely */ }
2821	else
2822	return iemVmxAbort(pVCpu, VMXABORT_SAVE_GUEST_MSRS);
2823
2824	/* Clear any saved NMI-blocking state so we don't assert on next VM-entry (if it was in effect on the previous one). */
2825	pVCpu->cpum.GstCtx.hwvirt.fLocalForcedActions &= ~VMCPU_FF_BLOCK_NMIS;
2826	}
2827	else
2828	{
2829	/* Restore the NMI-blocking state if VM-entry failed due to invalid guest state or while loading MSRs. */
2830	uint32_t const uExitReasonBasic = VMX_EXIT_REASON_BASIC(uExitReason);
2831	if ( uExitReasonBasic == VMX_EXIT_ERR_INVALID_GUEST_STATE
2832	\|\| uExitReasonBasic == VMX_EXIT_ERR_MSR_LOAD)
2833	iemVmxVmexitRestoreNmiBlockingFF(pVCpu);
2834	}
2835
2836	/*
2837	* Clear any pending VMX nested-guest force-flags.
2838	* These force-flags have no effect on guest execution and will
2839	* be re-evaluated and setup on the next nested-guest VM-entry.
2840	*/
2841	VMCPU_FF_CLEAR_MASK(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER
2842	\| VMCPU_FF_VMX_MTF
2843	\| VMCPU_FF_VMX_APIC_WRITE
2844	\| VMCPU_FF_VMX_INT_WINDOW
2845	\| VMCPU_FF_VMX_NMI_WINDOW);
2846
2847	/* Restore the host (outer guest) state. */
2848	VBOXSTRICTRC rcStrict = iemVmxVmexitLoadHostState(pVCpu, uExitReason);
2849	if (RT_SUCCESS(rcStrict))
2850	{
2851	Assert(rcStrict == VINF_SUCCESS);
2852	rcStrict = VINF_VMX_VMEXIT;
2853	}
2854	else
2855	Log3(("vmexit: Loading host-state failed. uExitReason=%u rc=%Rrc\n", uExitReason, VBOXSTRICTRC_VAL(rcStrict)));
2856
2857	/* We're no longer in nested-guest execution mode. */
2858	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = false;
2859
2860	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2861	/* Revert any IEM-only nested-guest execution policy, otherwise return rcStrict. */
2862	Log(("vmexit: Disabling IEM-only EM execution policy!\n"));
2863	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2864	if (rcSched != VINF_SUCCESS)
2865	iemSetPassUpStatus(pVCpu, rcSched);
2866	# endif
2867	return VINF_SUCCESS;
2868	# endif
2869	}
2870
2871
2872	/**
2873	* VMX VM-exit handler for VM-exits due to instruction execution.
2874	*
2875	* This is intended for instructions where the caller provides all the relevant
2876	* VM-exit information.
2877	*
2878	* @returns Strict VBox status code.
2879	* @param pVCpu The cross context virtual CPU structure.
2880	* @param pExitInfo Pointer to the VM-exit instruction information struct.
2881	*/
2882	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrWithInfo(PVMCPU pVCpu, PCVMXVEXITINFO pExitInfo)
2883	{
2884	/*
2885	* For instructions where any of the following fields are not applicable:
2886	* - VM-exit instruction info. is undefined.
2887	* - VM-exit qualification must be cleared.
2888	* - VM-exit guest-linear address is undefined.
2889	* - VM-exit guest-physical address is undefined.
2890	*
2891	* The VM-exit instruction length is mandatory for all VM-exits that are caused by
2892	* instruction execution. For VM-exits that are not due to instruction execution this
2893	* field is undefined.
2894	*
2895	* In our implementation in IEM, all undefined fields are generally cleared. However,
2896	* if the caller supplies information (from say the physical CPU directly) it is
2897	* then possible that the undefined fields are not cleared.
2898	*
2899	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2900	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
2901	*/
2902	Assert(pExitInfo);
2903	AssertMsg(pExitInfo->uReason <= VMX_EXIT_MAX, ("uReason=%u\n", pExitInfo->uReason));
2904	AssertMsg(pExitInfo->cbInstr >= 1 && pExitInfo->cbInstr <= 15,
2905	("uReason=%u cbInstr=%u\n", pExitInfo->uReason, pExitInfo->cbInstr));
2906
2907	/* Update all the relevant fields from the VM-exit instruction information struct. */
2908	iemVmxVmcsSetExitInstrInfo(pVCpu, pExitInfo->InstrInfo.u);
2909	iemVmxVmcsSetExitQual(pVCpu, pExitInfo->u64Qual);
2910	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
2911	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
2912	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
2913
2914	/* Perform the VM-exit. */
2915	return iemVmxVmexit(pVCpu, pExitInfo->uReason);
2916	}
2917
2918
2919	/**
2920	* VMX VM-exit handler for VM-exits due to instruction execution.
2921	*
2922	* This is intended for instructions that only provide the VM-exit instruction
2923	* length.
2924	*
2925	* @param pVCpu The cross context virtual CPU structure.
2926	* @param uExitReason The VM-exit reason.
2927	* @param cbInstr The instruction length in bytes.
2928	*/
2929	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstr(PVMCPU pVCpu, uint32_t uExitReason, uint8_t cbInstr)
2930	{
2931	VMXVEXITINFO ExitInfo;
2932	RT_ZERO(ExitInfo);
2933	ExitInfo.uReason = uExitReason;
2934	ExitInfo.cbInstr = cbInstr;
2935
2936	#ifdef VBOX_STRICT
2937	/* To prevent us from shooting ourselves in the foot. Maybe remove later. */
2938	switch (uExitReason)
2939	{
2940	case VMX_EXIT_INVEPT:
2941	case VMX_EXIT_INVPCID:
2942	case VMX_EXIT_LDTR_TR_ACCESS:
2943	case VMX_EXIT_GDTR_IDTR_ACCESS:
2944	case VMX_EXIT_VMCLEAR:
2945	case VMX_EXIT_VMPTRLD:
2946	case VMX_EXIT_VMPTRST:
2947	case VMX_EXIT_VMREAD:
2948	case VMX_EXIT_VMWRITE:
2949	case VMX_EXIT_VMXON:
2950	case VMX_EXIT_XRSTORS:
2951	case VMX_EXIT_XSAVES:
2952	case VMX_EXIT_RDRAND:
2953	case VMX_EXIT_RDSEED:
2954	case VMX_EXIT_IO_INSTR:
2955	AssertMsgFailedReturn(("Use iemVmxVmexitInstrNeedsInfo for uExitReason=%u\n", uExitReason), VERR_IEM_IPE_5);
2956	break;
2957	}
2958	#endif
2959
2960	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2961	}
2962
2963
2964	/**
2965	* VMX VM-exit handler for VM-exits due to instruction execution.
2966	*
2967	* This is intended for instructions that have a ModR/M byte and update the VM-exit
2968	* instruction information and VM-exit qualification fields.
2969	*
2970	* @param pVCpu The cross context virtual CPU structure.
2971	* @param uExitReason The VM-exit reason.
2972	* @param uInstrid The instruction identity (VMXINSTRID_XXX).
2973	* @param cbInstr The instruction length in bytes.
2974	*
2975	* @remarks Do not use this for INS/OUTS instruction.
2976	*/
2977	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrNeedsInfo(PVMCPU pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, uint8_t cbInstr)
2978	{
2979	VMXVEXITINFO ExitInfo;
2980	RT_ZERO(ExitInfo);
2981	ExitInfo.uReason = uExitReason;
2982	ExitInfo.cbInstr = cbInstr;
2983
2984	/*
2985	* Update the VM-exit qualification field with displacement bytes.
2986	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2987	*/
2988	switch (uExitReason)
2989	{
2990	case VMX_EXIT_INVEPT:
2991	case VMX_EXIT_INVPCID:
2992	case VMX_EXIT_LDTR_TR_ACCESS:
2993	case VMX_EXIT_GDTR_IDTR_ACCESS:
2994	case VMX_EXIT_VMCLEAR:
2995	case VMX_EXIT_VMPTRLD:
2996	case VMX_EXIT_VMPTRST:
2997	case VMX_EXIT_VMREAD:
2998	case VMX_EXIT_VMWRITE:
2999	case VMX_EXIT_VMXON:
3000	case VMX_EXIT_XRSTORS:
3001	case VMX_EXIT_XSAVES:
3002	case VMX_EXIT_RDRAND:
3003	case VMX_EXIT_RDSEED:
3004	{
3005	/* Construct the VM-exit instruction information. */
3006	RTGCPTR GCPtrDisp;
3007	uint32_t const uInstrInfo = iemVmxGetExitInstrInfo(pVCpu, uExitReason, uInstrId, &GCPtrDisp);
3008
3009	/* Update the VM-exit instruction information. */
3010	ExitInfo.InstrInfo.u = uInstrInfo;
3011
3012	/* Update the VM-exit qualification. */
3013	ExitInfo.u64Qual = GCPtrDisp;
3014	break;
3015	}
3016
3017	default:
3018	AssertMsgFailedReturn(("Use instruction-specific handler\n"), VERR_IEM_IPE_5);
3019	break;
3020	}
3021
3022	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3023	}
3024
3025
3026	/**
3027	* VMX VM-exit handler for VM-exits due to INVLPG.
3028	*
3029	* @returns Strict VBox status code.
3030	* @param pVCpu The cross context virtual CPU structure.
3031	* @param GCPtrPage The guest-linear address of the page being invalidated.
3032	* @param cbInstr The instruction length in bytes.
3033	*/
3034	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrInvlpg(PVMCPU pVCpu, RTGCPTR GCPtrPage, uint8_t cbInstr)
3035	{
3036	VMXVEXITINFO ExitInfo;
3037	RT_ZERO(ExitInfo);
3038	ExitInfo.uReason = VMX_EXIT_INVLPG;
3039	ExitInfo.cbInstr = cbInstr;
3040	ExitInfo.u64Qual = GCPtrPage;
3041	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(ExitInfo.u64Qual));
3042
3043	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3044	}
3045
3046
3047	/**
3048	* VMX VM-exit handler for VM-exits due to LMSW.
3049	*
3050	* @returns Strict VBox status code.
3051	* @param pVCpu The cross context virtual CPU structure.
3052	* @param uGuestCr0 The current guest CR0.
3053	* @param pu16NewMsw The machine-status word specified in LMSW's source
3054	* operand. This will be updated depending on the VMX
3055	* guest/host CR0 mask if LMSW is not intercepted.
3056	* @param GCPtrEffDst The guest-linear address of the source operand in case
3057	* of a memory operand. For register operand, pass
3058	* NIL_RTGCPTR.
3059	* @param cbInstr The instruction length in bytes.
3060	*/
3061	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrLmsw(PVMCPU pVCpu, uint32_t uGuestCr0, uint16_t *pu16NewMsw, RTGCPTR GCPtrEffDst,
3062	uint8_t cbInstr)
3063	{
3064	/*
3065	* LMSW VM-exits are subject to the CR0 guest/host mask and the CR0 read shadow.
3066	*
3067	* See Intel spec. 24.6.6 "Guest/Host Masks and Read Shadows for CR0 and CR4".
3068	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3069	*/
3070	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3071	Assert(pVmcs);
3072	Assert(pu16NewMsw);
3073
3074	bool fIntercept = false;
3075	uint32_t const fGstHostMask = pVmcs->u64Cr0Mask.u;
3076	uint32_t const fReadShadow = pVmcs->u64Cr0ReadShadow.u;
3077
3078	/*
3079	* LMSW can never clear CR0.PE but it may set it. Hence, we handle the
3080	* CR0.PE case first, before the rest of the bits in the MSW.
3081	*
3082	* If CR0.PE is owned by the host and CR0.PE differs between the
3083	* MSW (source operand) and the read-shadow, we must cause a VM-exit.
3084	*/
3085	if ( (fGstHostMask & X86_CR0_PE)
3086	&& (*pu16NewMsw & X86_CR0_PE)
3087	&& !(fReadShadow & X86_CR0_PE))
3088	fIntercept = true;
3089
3090	/*
3091	* If CR0.MP, CR0.EM or CR0.TS is owned by the host, and the corresponding
3092	* bits differ between the MSW (source operand) and the read-shadow, we must
3093	* cause a VM-exit.
3094	*/
3095	uint32_t fGstHostLmswMask = fGstHostMask & (X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3096	if ((fReadShadow & fGstHostLmswMask) != (*pu16NewMsw & fGstHostLmswMask))
3097	fIntercept = true;
3098
3099	if (fIntercept)
3100	{
3101	Log2(("lmsw: Guest intercept -> VM-exit\n"));
3102
3103	VMXVEXITINFO ExitInfo;
3104	RT_ZERO(ExitInfo);
3105	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3106	ExitInfo.cbInstr = cbInstr;
3107
3108	bool const fMemOperand = RT_BOOL(GCPtrEffDst != NIL_RTGCPTR);
3109	if (fMemOperand)
3110	{
3111	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(GCPtrEffDst));
3112	ExitInfo.u64GuestLinearAddr = GCPtrEffDst;
3113	}
3114
3115	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
3116	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_LMSW)
3117	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_OP, fMemOperand)
3118	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_DATA, *pu16NewMsw);
3119
3120	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3121	}
3122
3123	/*
3124	* If LMSW did not cause a VM-exit, any CR0 bits in the range 0:3 that is set in the
3125	* CR0 guest/host mask must be left unmodified.
3126	*
3127	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3128	*/
3129	fGstHostLmswMask = fGstHostMask & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3130	pu16NewMsw = (uGuestCr0 & fGstHostLmswMask) \| (pu16NewMsw & ~fGstHostLmswMask);
3131
3132	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3133	}
3134
3135
3136	/**
3137	* VMX VM-exit handler for VM-exits due to CLTS.
3138	*
3139	* @returns Strict VBox status code.
3140	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the CLTS instruction did not cause a
3141	* VM-exit but must not modify the guest CR0.TS bit.
3142	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the CLTS instruction did not cause a
3143	* VM-exit and modification to the guest CR0.TS bit is allowed (subject to
3144	* CR0 fixed bits in VMX operation).
3145	* @param pVCpu The cross context virtual CPU structure.
3146	* @param cbInstr The instruction length in bytes.
3147	*/
3148	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrClts(PVMCPU pVCpu, uint8_t cbInstr)
3149	{
3150	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3151	Assert(pVmcs);
3152
3153	uint32_t const fGstHostMask = pVmcs->u64Cr0Mask.u;
3154	uint32_t const fReadShadow = pVmcs->u64Cr0ReadShadow.u;
3155
3156	/*
3157	* If CR0.TS is owned by the host:
3158	* - If CR0.TS is set in the read-shadow, we must cause a VM-exit.
3159	* - If CR0.TS is cleared in the read-shadow, no VM-exit is caused and the
3160	* CLTS instruction completes without clearing CR0.TS.
3161	*
3162	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3163	*/
3164	if (fGstHostMask & X86_CR0_TS)
3165	{
3166	if (fReadShadow & X86_CR0_TS)
3167	{
3168	Log2(("clts: Guest intercept -> VM-exit\n"));
3169
3170	VMXVEXITINFO ExitInfo;
3171	RT_ZERO(ExitInfo);
3172	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3173	ExitInfo.cbInstr = cbInstr;
3174	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
3175	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_CLTS);
3176	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3177	}
3178
3179	return VINF_VMX_MODIFIES_BEHAVIOR;
3180	}
3181
3182	/*
3183	* If CR0.TS is not owned by the host, the CLTS instructions operates normally
3184	* and may modify CR0.TS (subject to CR0 fixed bits in VMX operation).
3185	*/
3186	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3187	}
3188
3189
3190	/**
3191	* VMX VM-exit handler for VM-exits due to 'Mov CR0,GReg' and 'Mov CR4,GReg'
3192	* (CR0/CR4 write).
3193	*
3194	* @returns Strict VBox status code.
3195	* @param pVCpu The cross context virtual CPU structure.
3196	* @param iCrReg The control register (either CR0 or CR4).
3197	* @param uGuestCrX The current guest CR0/CR4.
3198	* @param puNewCrX Pointer to the new CR0/CR4 value. Will be updated
3199	* if no VM-exit is caused.
3200	* @param iGReg The general register from which the CR0/CR4 value is
3201	* being loaded.
3202	* @param cbInstr The instruction length in bytes.
3203	*/
3204	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovToCr0Cr4(PVMCPU pVCpu, uint8_t iCrReg, uint64_t *puNewCrX, uint8_t iGReg,
3205	uint8_t cbInstr)
3206	{
3207	Assert(puNewCrX);
3208	Assert(iCrReg == 0 \|\| iCrReg == 4);
3209	Assert(iGReg < X86_GREG_COUNT);
3210
3211	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3212	Assert(pVmcs);
3213
3214	uint64_t uGuestCrX;
3215	uint64_t fGstHostMask;
3216	uint64_t fReadShadow;
3217	if (iCrReg == 0)
3218	{
3219	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
3220	uGuestCrX = pVCpu->cpum.GstCtx.cr0;
3221	fGstHostMask = pVmcs->u64Cr0Mask.u;
3222	fReadShadow = pVmcs->u64Cr0ReadShadow.u;
3223	}
3224	else
3225	{
3226	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
3227	uGuestCrX = pVCpu->cpum.GstCtx.cr4;
3228	fGstHostMask = pVmcs->u64Cr4Mask.u;
3229	fReadShadow = pVmcs->u64Cr4ReadShadow.u;
3230	}
3231
3232	/*
3233	* For any CR0/CR4 bit owned by the host (in the CR0/CR4 guest/host mask), if the
3234	* corresponding bits differ between the source operand and the read-shadow,
3235	* we must cause a VM-exit.
3236	*
3237	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3238	*/
3239	if ((fReadShadow & fGstHostMask) != (*puNewCrX & fGstHostMask))
3240	{
3241	Assert(fGstHostMask != 0);
3242	Log2(("mov_Cr_Rd: (CR%u) Guest intercept -> VM-exit\n", iCrReg));
3243
3244	VMXVEXITINFO ExitInfo;
3245	RT_ZERO(ExitInfo);
3246	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3247	ExitInfo.cbInstr = cbInstr;
3248	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, iCrReg)
3249	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
3250	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg);
3251	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3252	}
3253
3254	/*
3255	* If the Mov-to-CR0/CR4 did not cause a VM-exit, any bits owned by the host
3256	* must not be modified the instruction.
3257	*
3258	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3259	*/
3260	puNewCrX = (uGuestCrX & fGstHostMask) \| (puNewCrX & ~fGstHostMask);
3261
3262	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3263	}
3264
3265
3266	/**
3267	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR3' (CR3 read).
3268	*
3269	* @returns VBox strict status code.
3270	* @param pVCpu The cross context virtual CPU structure.
3271	* @param iGReg The general register to which the CR3 value is being stored.
3272	* @param cbInstr The instruction length in bytes.
3273	*/
3274	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovFromCr3(PVMCPU pVCpu, uint8_t iGReg, uint8_t cbInstr)
3275	{
3276	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3277	Assert(pVmcs);
3278	Assert(iGReg < X86_GREG_COUNT);
3279	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
3280
3281	/*
3282	* If the CR3-store exiting control is set, we must cause a VM-exit.
3283	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3284	*/
3285	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_CR3_STORE_EXIT)
3286	{
3287	Log2(("mov_Rd_Cr: (CR3) Guest intercept -> VM-exit\n"));
3288
3289	VMXVEXITINFO ExitInfo;
3290	RT_ZERO(ExitInfo);
3291	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3292	ExitInfo.cbInstr = cbInstr;
3293	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3294	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ)
3295	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg);
3296	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3297	}
3298
3299	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3300	}
3301
3302
3303	/**
3304	* VMX VM-exit handler for VM-exits due to 'Mov CR3,GReg' (CR3 write).
3305	*
3306	* @returns VBox strict status code.
3307	* @param pVCpu The cross context virtual CPU structure.
3308	* @param uNewCr3 The new CR3 value.
3309	* @param iGReg The general register from which the CR3 value is being
3310	* loaded.
3311	* @param cbInstr The instruction length in bytes.
3312	*/
3313	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovToCr3(PVMCPU pVCpu, uint64_t uNewCr3, uint8_t iGReg, uint8_t cbInstr)
3314	{
3315	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3316	Assert(pVmcs);
3317	Assert(iGReg < X86_GREG_COUNT);
3318
3319	/*
3320	* If the CR3-load exiting control is set and the new CR3 value does not
3321	* match any of the CR3-target values in the VMCS, we must cause a VM-exit.
3322	*
3323	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3324	*/
3325	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_CR3_LOAD_EXIT)
3326	{
3327	uint32_t const uCr3TargetCount = pVmcs->u32Cr3TargetCount;
3328	Assert(uCr3TargetCount <= VMX_V_CR3_TARGET_COUNT);
3329
3330	/* If the CR3-target count is 0, we must always cause a VM-exit. */
3331	bool fIntercept = RT_BOOL(uCr3TargetCount == 0);
3332	if (!fIntercept)
3333	{
3334	for (uint32_t idxCr3Target = 0; idxCr3Target < uCr3TargetCount; idxCr3Target++)
3335	{
3336	uint64_t const uCr3TargetValue = iemVmxVmcsGetCr3TargetValue(pVmcs, idxCr3Target);
3337	if (uNewCr3 != uCr3TargetValue)
3338	{
3339	fIntercept = true;
3340	break;
3341	}
3342	}
3343	}
3344
3345	if (fIntercept)
3346	{
3347	Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
3348
3349	VMXVEXITINFO ExitInfo;
3350	RT_ZERO(ExitInfo);
3351	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3352	ExitInfo.cbInstr = cbInstr;
3353	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3354	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
3355	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg);
3356	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3357	}
3358	}
3359
3360	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3361	}
3362
3363
3364	/**
3365	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR8' (CR8 read).
3366	*
3367	* @returns VBox strict status code.
3368	* @param pVCpu The cross context virtual CPU structure.
3369	* @param iGReg The general register to which the CR8 value is being stored.
3370	* @param cbInstr The instruction length in bytes.
3371	*/
3372	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovFromCr8(PVMCPU pVCpu, uint8_t iGReg, uint8_t cbInstr)
3373	{
3374	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3375	Assert(pVmcs);
3376	Assert(iGReg < X86_GREG_COUNT);
3377
3378	/*
3379	* If the CR8-store exiting control is set, we must cause a VM-exit.
3380	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3381	*/
3382	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_CR8_STORE_EXIT)
3383	{
3384	Log2(("mov_Rd_Cr: (CR8) Guest intercept -> VM-exit\n"));
3385
3386	VMXVEXITINFO ExitInfo;
3387	RT_ZERO(ExitInfo);
3388	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3389	ExitInfo.cbInstr = cbInstr;
3390	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3391	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ)
3392	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg);
3393	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3394	}
3395
3396	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3397	}
3398
3399
3400	/**
3401	* VMX VM-exit handler for VM-exits due to 'Mov CR8,GReg' (CR8 write).
3402	*
3403	* @returns VBox strict status code.
3404	* @param pVCpu The cross context virtual CPU structure.
3405	* @param iGReg The general register from which the CR8 value is being
3406	* loaded.
3407	* @param cbInstr The instruction length in bytes.
3408	*/
3409	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovToCr8(PVMCPU pVCpu, uint8_t iGReg, uint8_t cbInstr)
3410	{
3411	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3412	Assert(pVmcs);
3413	Assert(iGReg < X86_GREG_COUNT);
3414
3415	/*
3416	* If the CR8-load exiting control is set, we must cause a VM-exit.
3417	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3418	*/
3419	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_CR8_LOAD_EXIT)
3420	{
3421	Log2(("mov_Cr_Rd: (CR8) Guest intercept -> VM-exit\n"));
3422
3423	VMXVEXITINFO ExitInfo;
3424	RT_ZERO(ExitInfo);
3425	ExitInfo.uReason = VMX_EXIT_MOV_CRX;
3426	ExitInfo.cbInstr = cbInstr;
3427	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3428	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE)
3429	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg);
3430	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3431	}
3432
3433	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3434	}
3435
3436
3437	/**
3438	* VMX VM-exit handler for VM-exits due to 'Mov DRx,GReg' (DRx write) and 'Mov
3439	* GReg,DRx' (DRx read).
3440	*
3441	* @returns VBox strict status code.
3442	* @param pVCpu The cross context virtual CPU structure.
3443	* @param uInstrid The instruction identity (VMXINSTRID_MOV_TO_DRX or
3444	* VMXINSTRID_MOV_FROM_DRX).
3445	* @param iDrReg The debug register being accessed.
3446	* @param iGReg The general register to/from which the DRx value is being
3447	* store/loaded.
3448	* @param cbInstr The instruction length in bytes.
3449	*/
3450	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMovDrX(PVMCPU pVCpu, VMXINSTRID uInstrId, uint8_t iDrReg, uint8_t iGReg,
3451	uint8_t cbInstr)
3452	{
3453	Assert(iDrReg <= 7);
3454	Assert(uInstrId == VMXINSTRID_MOV_TO_DRX \|\| uInstrId == VMXINSTRID_MOV_FROM_DRX);
3455	Assert(iGReg < X86_GREG_COUNT);
3456
3457	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3458	Assert(pVmcs);
3459
3460	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_MOV_DR_EXIT)
3461	{
3462	uint32_t const uDirection = uInstrId == VMXINSTRID_MOV_TO_DRX ? VMX_EXIT_QUAL_DRX_DIRECTION_WRITE
3463	: VMX_EXIT_QUAL_DRX_DIRECTION_READ;
3464	VMXVEXITINFO ExitInfo;
3465	RT_ZERO(ExitInfo);
3466	ExitInfo.uReason = VMX_EXIT_MOV_DRX;
3467	ExitInfo.cbInstr = cbInstr;
3468	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_REGISTER, iDrReg)
3469	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_DIRECTION, uDirection)
3470	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_GENREG, iGReg);
3471	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3472	}
3473
3474	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3475	}
3476
3477
3478	/**
3479	* VMX VM-exit handler for VM-exits due to I/O instructions (IN and OUT).
3480	*
3481	* @returns VBox strict status code.
3482	* @param pVCpu The cross context virtual CPU structure.
3483	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_IN or
3484	* VMXINSTRID_IO_OUT).
3485	* @param u16Port The I/O port being accessed.
3486	* @param fImm Whether the I/O port was encoded using an immediate operand
3487	* or the implicit DX register.
3488	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3489	* @param cbInstr The instruction length in bytes.
3490	*/
3491	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrIo(PVMCPU pVCpu, VMXINSTRID uInstrId, uint16_t u16Port, bool fImm, uint8_t cbAccess,
3492	uint8_t cbInstr)
3493	{
3494	Assert(uInstrId == VMXINSTRID_IO_IN \|\| uInstrId == VMXINSTRID_IO_OUT);
3495	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3496
3497	bool const fIntercept = CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess);
3498	if (fIntercept)
3499	{
3500	uint32_t const uDirection = uInstrId == VMXINSTRID_IO_IN ? VMX_EXIT_QUAL_IO_DIRECTION_IN
3501	: VMX_EXIT_QUAL_IO_DIRECTION_OUT;
3502	VMXVEXITINFO ExitInfo;
3503	RT_ZERO(ExitInfo);
3504	ExitInfo.uReason = VMX_EXIT_IO_INSTR;
3505	ExitInfo.cbInstr = cbInstr;
3506	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3507	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION, uDirection)
3508	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING, fImm)
3509	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port);
3510	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3511	}
3512
3513	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3514	}
3515
3516
3517	/**
3518	* VMX VM-exit handler for VM-exits due to string I/O instructions (INS and OUTS).
3519	*
3520	* @returns VBox strict status code.
3521	* @param pVCpu The cross context virtual CPU structure.
3522	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_INS or
3523	* VMXINSTRID_IO_OUTS).
3524	* @param u16Port The I/O port being accessed.
3525	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3526	* @param fRep Whether the instruction has a REP prefix or not.
3527	* @param ExitInstrInfo The VM-exit instruction info. field.
3528	* @param cbInstr The instruction length in bytes.
3529	*/
3530	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrStrIo(PVMCPU pVCpu, VMXINSTRID uInstrId, uint16_t u16Port, uint8_t cbAccess, bool fRep,
3531	VMXEXITINSTRINFO ExitInstrInfo, uint8_t cbInstr)
3532	{
3533	Assert(uInstrId == VMXINSTRID_IO_INS \|\| uInstrId == VMXINSTRID_IO_OUTS);
3534	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3535	Assert(ExitInstrInfo.StrIo.iSegReg < X86_SREG_COUNT);
3536	Assert(ExitInstrInfo.StrIo.u3AddrSize == 0 \|\| ExitInstrInfo.StrIo.u3AddrSize == 1 \|\| ExitInstrInfo.StrIo.u3AddrSize == 2);
3537	Assert(uInstrId != VMXINSTRID_IO_INS \|\| ExitInstrInfo.StrIo.iSegReg == X86_SREG_ES);
3538
3539	bool const fIntercept = CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess);
3540	if (fIntercept)
3541	{
3542	/*
3543	* Figure out the guest-linear address and the direction bit (INS/OUTS).
3544	*/
3545	/** @todo r=ramshankar: Is there something in IEM that already does this? */
3546	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
3547	uint8_t const iSegReg = ExitInstrInfo.StrIo.iSegReg;
3548	uint8_t const uAddrSize = ExitInstrInfo.StrIo.u3AddrSize;
3549	uint64_t const uAddrSizeMask = s_auAddrSizeMasks[uAddrSize];
3550
3551	uint32_t uDirection;
3552	uint64_t uGuestLinearAddr;
3553	if (uInstrId == VMXINSTRID_IO_INS)
3554	{
3555	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_IN;
3556	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rdi & uAddrSizeMask);
3557	}
3558	else
3559	{
3560	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_OUT;
3561	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rsi & uAddrSizeMask);
3562	}
3563
3564	/*
3565	* If the segment is ununsable, the guest-linear address in undefined.
3566	* We shall clear it for consistency.
3567	*
3568	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
3569	*/
3570	if (pVCpu->cpum.GstCtx.aSRegs[iSegReg].Attr.n.u1Unusable)
3571	uGuestLinearAddr = 0;
3572
3573	VMXVEXITINFO ExitInfo;
3574	RT_ZERO(ExitInfo);
3575	ExitInfo.uReason = VMX_EXIT_IO_INSTR;
3576	ExitInfo.cbInstr = cbInstr;
3577	ExitInfo.InstrInfo = ExitInstrInfo;
3578	ExitInfo.u64GuestLinearAddr = uGuestLinearAddr;
3579	ExitInfo.u64Qual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3580	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION, uDirection)
3581	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_STRING, 1)
3582	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_REP, fRep)
3583	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING, VMX_EXIT_QUAL_IO_ENCODING_DX)
3584	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port);
3585	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3586	}
3587
3588	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3589	}
3590
3591
3592	/**
3593	* VMX VM-exit handler for VM-exits due to MWAIT.
3594	*
3595	* @returns VBox strict status code.
3596	* @param pVCpu The cross context virtual CPU structure.
3597	* @param fMonitorHwArmed Whether the address-range monitor hardware is armed.
3598	* @param cbInstr The instruction length in bytes.
3599	*/
3600	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrMwait(PVMCPU pVCpu, bool fMonitorHwArmed, uint8_t cbInstr)
3601	{
3602	VMXVEXITINFO ExitInfo;
3603	RT_ZERO(ExitInfo);
3604	ExitInfo.uReason = VMX_EXIT_MWAIT;
3605	ExitInfo.cbInstr = cbInstr;
3606	ExitInfo.u64Qual = fMonitorHwArmed;
3607	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3608	}
3609
3610
3611	/**
3612	* VMX VM-exit handler for VM-exits due to PAUSE.
3613	*
3614	* @returns VBox strict status code.
3615	* @param pVCpu The cross context virtual CPU structure.
3616	* @param cbInstr The instruction length in bytes.
3617	*/
3618	IEM_STATIC VBOXSTRICTRC iemVmxVmexitInstrPause(PVMCPU pVCpu, uint8_t cbInstr)
3619	{
3620	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3621	Assert(pVmcs);
3622
3623	/*
3624	* The PAUSE VM-exit is controlled by the "PAUSE exiting" control and the
3625	* "PAUSE-loop exiting" control.
3626	*
3627	* The PLE-Gap is the maximum number of TSC ticks between two successive executions of
3628	* the PAUSE instruction before we cause a VM-exit. The PLE-Window is the maximum amount
3629	* of TSC ticks the guest is allowed to execute in a pause loop before we must cause
3630	* a VM-exit.
3631	*
3632	* See Intel spec. 24.6.13 "Controls for PAUSE-Loop Exiting".
3633	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3634	*/
3635	bool fIntercept = false;
3636	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_PAUSE_EXIT)
3637	fIntercept = true;
3638	else if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PAUSE_LOOP_EXIT)
3639	&& pVCpu->iem.s.uCpl == 0)
3640	{
3641	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3642
3643	/*
3644	* A previous-PAUSE-tick value of 0 is used to identify the first time
3645	* execution of a PAUSE instruction after VM-entry at CPL 0. We must
3646	* consider this to be the first execution of PAUSE in a loop according
3647	* to the Intel.
3648	*
3649	* All subsequent records for the previous-PAUSE-tick we ensure that it
3650	* cannot be zero by OR'ing 1 to rule out the TSC wrap-around cases at 0.
3651	*/
3652	uint64_t *puFirstPauseLoopTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick;
3653	uint64_t *puPrevPauseTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick;
3654	uint64_t const uTick = TMCpuTickGet(pVCpu);
3655	uint32_t const uPleGap = pVmcs->u32PleGap;
3656	uint32_t const uPleWindow = pVmcs->u32PleWindow;
3657	if ( *puPrevPauseTick == 0
3658	\|\| uTick - *puPrevPauseTick > uPleGap)
3659	*puFirstPauseLoopTick = uTick;
3660	else if (uTick - *puFirstPauseLoopTick > uPleWindow)
3661	fIntercept = true;
3662
3663	*puPrevPauseTick = uTick \| 1;
3664	}
3665
3666	if (fIntercept)
3667	{
3668	VMXVEXITINFO ExitInfo;
3669	RT_ZERO(ExitInfo);
3670	ExitInfo.uReason = VMX_EXIT_PAUSE;
3671	ExitInfo.cbInstr = cbInstr;
3672	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3673	}
3674
3675	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3676	}
3677
3678
3679	/**
3680	* VMX VM-exit handler for VM-exits due to task switches.
3681	*
3682	* @returns VBox strict status code.
3683	* @param pVCpu The cross context virtual CPU structure.
3684	* @param enmTaskSwitch The cause of the task switch.
3685	* @param SelNewTss The selector of the new TSS.
3686	* @param cbInstr The instruction length in bytes.
3687	*/
3688	IEM_STATIC VBOXSTRICTRC iemVmxVmexitTaskSwitch(PVMCPU pVCpu, IEMTASKSWITCH enmTaskSwitch, RTSEL SelNewTss, uint8_t cbInstr)
3689	{
3690	/*
3691	* Task-switch VM-exits are unconditional and provide the VM-exit qualification.
3692	*
3693	* If the cause of the task switch is due to execution of CALL, IRET or the JMP
3694	* instruction or delivery of the exception generated by one of these instructions
3695	* lead to a task switch through a task gate in the IDT, we need to provide the
3696	* VM-exit instruction length. Any other means of invoking a task switch VM-exit
3697	* leaves the VM-exit instruction length field undefined.
3698	*
3699	* See Intel spec. 25.2 "Other Causes Of VM Exits".
3700	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
3701	*/
3702	Assert(cbInstr <= 15);
3703
3704	uint8_t uType;
3705	switch (enmTaskSwitch)
3706	{
3707	case IEMTASKSWITCH_CALL: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_CALL; break;
3708	case IEMTASKSWITCH_IRET: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IRET; break;
3709	case IEMTASKSWITCH_JUMP: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_JMP; break;
3710	case IEMTASKSWITCH_INT_XCPT: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IDT; break;
3711	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3712	}
3713
3714	uint64_t const uExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_NEW_TSS, SelNewTss)
3715	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_SOURCE, uType);
3716	iemVmxVmcsSetExitQual(pVCpu, uExitQual);
3717	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3718	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH);
3719	}
3720
3721
3722	/**
3723	* VMX VM-exit handler for VM-exits due to expiring of the preemption timer.
3724	*
3725	* @returns VBox strict status code.
3726	* @param pVCpu The cross context virtual CPU structure.
3727	*/
3728	IEM_STATIC VBOXSTRICTRC iemVmxVmexitPreemptTimer(PVMCPU pVCpu)
3729	{
3730	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3731	Assert(pVmcs);
3732
3733	/* The VM-exit is subject to "Activate VMX-preemption timer" being set. */
3734	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
3735	{
3736	/* Import the hardware virtualization state (for nested-guest VM-entry TSC-tick). */
3737	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3738
3739	/*
3740	* Calculate the current VMX-preemption timer value.
3741	* Only if the value has reached zero, we cause the VM-exit.
3742	*/
3743	uint32_t uPreemptTimer = iemVmxCalcPreemptTimer(pVCpu);
3744	if (!uPreemptTimer)
3745	{
3746	/* Save the VMX-preemption timer value (of 0) back in to the VMCS if the CPU supports this feature. */
3747	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER)
3748	pVmcs->u32PreemptTimer = 0;
3749
3750	/* Cause the VMX-preemption timer VM-exit. The VM-exit qualification MBZ. */
3751	return iemVmxVmexit(pVCpu, VMX_EXIT_PREEMPT_TIMER);
3752	}
3753	}
3754
3755	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3756	}
3757
3758
3759	/**
3760	* VMX VM-exit handler for VM-exits due to external interrupts.
3761	*
3762	* @returns VBox strict status code.
3763	* @param pVCpu The cross context virtual CPU structure.
3764	* @param uVector The external interrupt vector (pass 0 if the interrupt
3765	* is still pending since we typically won't know the
3766	* vector).
3767	* @param fIntPending Whether the external interrupt is pending or
3768	* acknowledged in the interrupt controller.
3769	*/
3770	IEM_STATIC VBOXSTRICTRC iemVmxVmexitExtInt(PVMCPU pVCpu, uint8_t uVector, bool fIntPending)
3771	{
3772	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3773	Assert(pVmcs);
3774	Assert(fIntPending \|\| uVector == 0);
3775
3776	/** @todo NSTVMX: r=ramshankar: Consider standardizing check basic/blanket
3777	* intercepts for VM-exits. Right now it is not clear which iemVmxVmexitXXX()
3778	* functions require prior checking of a blanket intercept and which don't.
3779	* It is better for the caller to check a blanket intercept performance wise
3780	* than making a function call. Leaving this as a todo because it is more
3781	* a performance issue. */
3782
3783	/* The VM-exit is subject to "External interrupt exiting" being set. */
3784	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT)
3785	{
3786	if (fIntPending)
3787	{
3788	/*
3789	* If the interrupt is pending and we don't need to acknowledge the
3790	* interrupt on VM-exit, cause the VM-exit immediately.
3791	*
3792	* See Intel spec 25.2 "Other Causes Of VM Exits".
3793	*/
3794	if (!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT))
3795	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT);
3796
3797	/*
3798	* If the interrupt is pending and we -do- need to acknowledge the interrupt
3799	* on VM-exit, postpone VM-exit till after the interrupt controller has been
3800	* acknowledged that the interrupt has been consumed.
3801	*/
3802	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3803	}
3804
3805	/*
3806	* If the interrupt is no longer pending (i.e. it has been acknowledged) and the
3807	* "External interrupt exiting" and "Acknowledge interrupt on VM-exit" controls are
3808	* all set, we cause the VM-exit now. We need to record the external interrupt that
3809	* just occurred in the VM-exit interruption information field.
3810	*
3811	* See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3812	*/
3813	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
3814	{
3815	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3816	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3817	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_EXT_INT)
3818	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3819	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3820	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3821	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT);
3822	}
3823	}
3824
3825	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3826	}
3827
3828
3829	/**
3830	* VMX VM-exit handler for VM-exits due to NMIs.
3831	*
3832	* @returns VBox strict status code.
3833	* @param pVCpu The cross context virtual CPU structure.
3834	*
3835	* @remarks This function might import externally kept DR6 if necessary.
3836	*/
3837	IEM_STATIC VBOXSTRICTRC iemVmxVmexitNmi(PVMCPU pVCpu)
3838	{
3839	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3840	Assert(pVmcs);
3841	Assert(pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT);
3842	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.fInterceptEvents);
3843	NOREF(pVmcs);
3844	return iemVmxVmexitEvent(pVCpu, X86_XCPT_NMI, IEM_XCPT_FLAGS_T_CPU_XCPT, 0 /* uErrCode /, 0 / uCr2 /, 0 / cbInstr */);
3845	}
3846
3847
3848	/**
3849	* VMX VM-exit handler for VM-exits due to startup-IPIs (SIPI).
3850	*
3851	* @returns VBox strict status code.
3852	* @param pVCpu The cross context virtual CPU structure.
3853	* @param uVector The SIPI vector.
3854	*/
3855	IEM_STATIC VBOXSTRICTRC iemVmxVmexitStartupIpi(PVMCPU pVCpu, uint8_t uVector)
3856	{
3857	iemVmxVmcsSetExitQual(pVCpu, uVector);
3858	return iemVmxVmexit(pVCpu, VMX_EXIT_SIPI);
3859	}
3860
3861
3862	/**
3863	* VMX VM-exit handler for VM-exits due to a double fault caused during delivery of
3864	* an event.
3865	*
3866	* @returns VBox strict status code.
3867	* @param pVCpu The cross context virtual CPU structure.
3868	*/
3869	IEM_STATIC VBOXSTRICTRC iemVmxVmexitEventDoubleFault(PVMCPU pVCpu)
3870	{
3871	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3872	Assert(pVmcs);
3873
3874	uint32_t const fXcptBitmap = pVmcs->u32XcptBitmap;
3875	if (fXcptBitmap & RT_BIT(X86_XCPT_DF))
3876	{
3877	uint8_t const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3878	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, X86_XCPT_DF)
3879	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_HW_XCPT)
3880	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, 1)
3881	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3882	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3883	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3884	iemVmxVmcsSetExitIntErrCode(pVCpu, 0);
3885	iemVmxVmcsSetExitQual(pVCpu, 0);
3886	iemVmxVmcsSetExitInstrLen(pVCpu, 0);
3887
3888	/*
3889	* A VM-exit is not considered to occur during event delivery when the original
3890	* event results in a double-fault that causes a VM-exit directly (i.e. intercepted
3891	* using the exception bitmap).
3892	*
3893	* Therefore, we must clear the original event from the IDT-vectoring fields which
3894	* would've been recorded before causing the VM-exit.
3895	*
3896	* 27.2.3 "Information for VM Exits During Event Delivery"
3897	*/
3898	iemVmxVmcsSetIdtVectoringInfo(pVCpu, 0);
3899	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, 0);
3900
3901	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI);
3902	}
3903
3904	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3905	}
3906
3907
3908	/**
3909	* VMX VM-exit handler for VM-exits due to delivery of an event.
3910	*
3911	* @returns VBox strict status code.
3912	* @param pVCpu The cross context virtual CPU structure.
3913	* @param uVector The interrupt / exception vector.
3914	* @param fFlags The flags (see IEM_XCPT_FLAGS_XXX).
3915	* @param uErrCode The error code associated with the event.
3916	* @param uCr2 The CR2 value in case of a \#PF exception.
3917	* @param cbInstr The instruction length in bytes.
3918	*/
3919	IEM_STATIC VBOXSTRICTRC iemVmxVmexitEvent(PVMCPU pVCpu, uint8_t uVector, uint32_t fFlags, uint32_t uErrCode, uint64_t uCr2,
3920	uint8_t cbInstr)
3921	{
3922	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
3923	Assert(pVmcs);
3924
3925	/*
3926	* If the event is being injected as part of VM-entry, it isn't subject to event
3927	* intercepts in the nested-guest. However, secondary exceptions that occur during
3928	* injection of any event -are- subject to event interception.
3929	*
3930	* See Intel spec. 26.5.1.2 "VM Exits During Event Injection".
3931	*/
3932	if (!pVCpu->cpum.GstCtx.hwvirt.vmx.fInterceptEvents)
3933	{
3934	/* Update the IDT-vectoring event in the VMCS as the source of the upcoming event. */
3935	uint8_t const uIdtVectoringType = iemVmxGetEventType(uVector, fFlags);
3936	bool const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
3937	uint32_t const uIdtVectoringInfo = RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VECTOR, uVector)
3938	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_TYPE, uIdtVectoringType)
3939	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_ERR_CODE_VALID, fErrCodeValid)
3940	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VALID, 1);
3941	iemVmxVmcsSetIdtVectoringInfo(pVCpu, uIdtVectoringInfo);
3942	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, uErrCode);
3943
3944	/*
3945	* If the event is a virtual-NMI (which is an NMI being inject during VM-entry)
3946	* virtual-NMI blocking must be set in effect rather than physical NMI blocking.
3947	*
3948	* See Intel spec. 24.6.1 "Pin-Based VM-Execution Controls".
3949	*/
3950	if ( uVector == X86_XCPT_NMI
3951	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
3952	&& (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
3953	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
3954	else
3955	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking);
3956
3957	pVCpu->cpum.GstCtx.hwvirt.vmx.fInterceptEvents = true;
3958	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3959	}
3960
3961	/*
3962	* We are injecting an external interrupt, check if we need to cause a VM-exit now.
3963	* If not, the caller will continue delivery of the external interrupt as it would
3964	* normally. The interrupt is no longer pending in the interrupt controller at this
3965	* point.
3966	*/
3967	if (fFlags & IEM_XCPT_FLAGS_T_EXT_INT)
3968	{
3969	Assert(!VMX_IDT_VECTORING_INFO_IS_VALID(pVmcs->u32RoIdtVectoringInfo));
3970	return iemVmxVmexitExtInt(pVCpu, uVector, false /* fIntPending */);
3971	}
3972
3973	/*
3974	* Evaluate intercepts for hardware exceptions including #BP, #DB, #OF
3975	* generated by INT3, INT1 (ICEBP) and INTO respectively.
3976	*/
3977	Assert(fFlags & (IEM_XCPT_FLAGS_T_CPU_XCPT \| IEM_XCPT_FLAGS_T_SOFT_INT));
3978	bool fIntercept = false;
3979	bool fIsHwXcpt = false;
3980	if ( !(fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3981	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3982	{
3983	fIsHwXcpt = true;
3984	/* NMIs have a dedicated VM-execution control for causing VM-exits. */
3985	if (uVector == X86_XCPT_NMI)
3986	fIntercept = RT_BOOL(pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT);
3987	else
3988	{
3989	/* Page-faults are subject to masking using its error code. */
3990	uint32_t fXcptBitmap = pVmcs->u32XcptBitmap;
3991	if (uVector == X86_XCPT_PF)
3992	{
3993	uint32_t const fXcptPFMask = pVmcs->u32XcptPFMask;
3994	uint32_t const fXcptPFMatch = pVmcs->u32XcptPFMatch;
3995	if ((uErrCode & fXcptPFMask) != fXcptPFMatch)
3996	fXcptBitmap ^= RT_BIT(X86_XCPT_PF);
3997	}
3998
3999	/* Consult the exception bitmap for all hardware exceptions (except NMI). */
4000	if (fXcptBitmap & RT_BIT(uVector))
4001	fIntercept = true;
4002	}
4003	}
4004	/* else: Software interrupts cannot be intercepted and therefore do not cause a VM-exit. */
4005
4006	/*
4007	* Now that we've determined whether the software interrupt or hardware exception
4008	* causes a VM-exit, we need to construct the relevant VM-exit information and
4009	* cause the VM-exit.
4010	*/
4011	if (fIntercept)
4012	{
4013	Assert(!(fFlags & IEM_XCPT_FLAGS_T_EXT_INT));
4014
4015	/* Construct the rest of the event related information fields and cause the VM-exit. */
4016	uint64_t uExitQual = 0;
4017	if (fIsHwXcpt)
4018	{
4019	if (uVector == X86_XCPT_PF)
4020	{
4021	Assert(fFlags & IEM_XCPT_FLAGS_CR2);
4022	uExitQual = uCr2;
4023	}
4024	else if (uVector == X86_XCPT_DB)
4025	{
4026	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
4027	uExitQual = pVCpu->cpum.GstCtx.dr[6] & VMX_VMCS_EXIT_QUAL_VALID_MASK;
4028	}
4029	}
4030
4031	uint8_t const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
4032	bool const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
4033	uint8_t const uIntInfoType = iemVmxGetEventType(uVector, fFlags);
4034	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
4035	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, uIntInfoType)
4036	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, fErrCodeValid)
4037	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
4038	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
4039	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
4040	iemVmxVmcsSetExitIntErrCode(pVCpu, uErrCode);
4041	iemVmxVmcsSetExitQual(pVCpu, uExitQual);
4042
4043	/*
4044	* For VM exits due to software exceptions (those generated by INT3 or INTO) or privileged
4045	* software exceptions (those generated by INT1/ICEBP) we need to supply the VM-exit instruction
4046	* length.
4047	*/
4048	if ( (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
4049	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
4050	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
4051	else
4052	iemVmxVmcsSetExitInstrLen(pVCpu, 0);
4053
4054	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI);
4055	}
4056
4057	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4058	}
4059
4060
4061	/**
4062	* VMX VM-exit handler for VM-exits due to a triple fault.
4063	*
4064	* @returns VBox strict status code.
4065	* @param pVCpu The cross context virtual CPU structure.
4066	*/
4067	IEM_STATIC VBOXSTRICTRC iemVmxVmexitTripleFault(PVMCPU pVCpu)
4068	{
4069	/*
4070	* A VM-exit is not considered to occur during event delivery when the original
4071	* event results in a triple-fault.
4072	*
4073	* Therefore, we must clear the original event from the IDT-vectoring fields which
4074	* would've been recorded before causing the VM-exit.
4075	*
4076	* 27.2.3 "Information for VM Exits During Event Delivery"
4077	*/
4078	iemVmxVmcsSetIdtVectoringInfo(pVCpu, 0);
4079	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, 0);
4080
4081	return iemVmxVmexit(pVCpu, VMX_EXIT_TRIPLE_FAULT);
4082	}
4083
4084
4085	/**
4086	* VMX VM-exit handler for APIC-accesses.
4087	*
4088	* @param pVCpu The cross context virtual CPU structure.
4089	* @param offAccess The offset of the register being accessed.
4090	* @param fAccess The type of access (must contain IEM_ACCESS_TYPE_READ or
4091	* IEM_ACCESS_TYPE_WRITE or IEM_ACCESS_INSTRUCTION).
4092	*/
4093	IEM_STATIC VBOXSTRICTRC iemVmxVmexitApicAccess(PVMCPU pVCpu, uint16_t offAccess, uint32_t fAccess)
4094	{
4095	Assert((fAccess & IEM_ACCESS_TYPE_READ) \|\| (fAccess & IEM_ACCESS_TYPE_WRITE) \|\| (fAccess & IEM_ACCESS_INSTRUCTION));
4096
4097	VMXAPICACCESS enmAccess;
4098	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, NULL, NULL, NULL, NULL);
4099	if (fInEventDelivery)
4100	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
4101	else if (fAccess & IEM_ACCESS_INSTRUCTION)
4102	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
4103	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
4104	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
4105	else
4106	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
4107
4108	uint64_t const uExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
4109	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess);
4110	iemVmxVmcsSetExitQual(pVCpu, uExitQual);
4111	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS);
4112	}
4113
4114
4115	/**
4116	* VMX VM-exit handler for APIC-write VM-exits.
4117	*
4118	* @param pVCpu The cross context virtual CPU structure.
4119	* @param offApic The write to the virtual-APIC page offset that caused this
4120	* VM-exit.
4121	*/
4122	IEM_STATIC VBOXSTRICTRC iemVmxVmexitApicWrite(PVMCPU pVCpu, uint16_t offApic)
4123	{
4124	Assert(offApic < XAPIC_OFF_END + 4);
4125
4126	/* Write only bits 11:0 of the APIC offset into the VM-exit qualification field. */
4127	offApic &= UINT16_C(0xfff);
4128	iemVmxVmcsSetExitQual(pVCpu, offApic);
4129	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_WRITE);
4130	}
4131
4132
4133	/**
4134	* VMX VM-exit handler for virtualized-EOIs.
4135	*
4136	* @param pVCpu The cross context virtual CPU structure.
4137	*/
4138	IEM_STATIC VBOXSTRICTRC iemVmxVmexitVirtEoi(PVMCPU pVCpu, uint8_t uVector)
4139	{
4140	iemVmxVmcsSetExitQual(pVCpu, uVector);
4141	return iemVmxVmexit(pVCpu, VMX_EXIT_VIRTUALIZED_EOI);
4142	}
4143
4144
4145	/**
4146	* Sets virtual-APIC write emulation as pending.
4147	*
4148	* @param pVCpu The cross context virtual CPU structure.
4149	* @param offApic The offset in the virtual-APIC page that was written.
4150	*/
4151	DECLINLINE(void) iemVmxVirtApicSetPendingWrite(PVMCPU pVCpu, uint16_t offApic)
4152	{
4153	Assert(offApic < XAPIC_OFF_END + 4);
4154
4155	/*
4156	* Record the currently updated APIC offset, as we need this later for figuring
4157	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4158	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4159	*/
4160	pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite = offApic;
4161
4162	/*
4163	* Signal that we need to perform virtual-APIC write emulation (TPR/PPR/EOI/Self-IPI
4164	* virtualization or APIC-write emulation).
4165	*/
4166	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
4167	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE);
4168	}
4169
4170
4171	/**
4172	* Clears any pending virtual-APIC write emulation.
4173	*
4174	* @returns The virtual-APIC offset that was written before clearing it.
4175	* @param pVCpu The cross context virtual CPU structure.
4176	*/
4177	DECLINLINE(uint16_t) iemVmxVirtApicClearPendingWrite(PVMCPU pVCpu)
4178	{
4179	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
4180	uint8_t const offVirtApicWrite = pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite;
4181	pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite = 0;
4182	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
4183	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_VMX_APIC_WRITE);
4184	return offVirtApicWrite;
4185	}
4186
4187
4188	/**
4189	* Reads a 32-bit register from the virtual-APIC page at the given offset.
4190	*
4191	* @returns The register from the virtual-APIC page.
4192	* @param pVCpu The cross context virtual CPU structure.
4193	* @param offReg The offset of the register being read.
4194	*/
4195	IEM_STATIC uint32_t iemVmxVirtApicReadRaw32(PVMCPU pVCpu, uint16_t offReg)
4196	{
4197	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4198	Assert(pVmcs);
4199
4200	uint32_t uReg;
4201	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uReg));
4202	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4203	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4204	if (RT_FAILURE(rc))
4205	{
4206	AssertMsgFailed(("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp\n", sizeof(uReg), offReg,
4207	GCPhysVirtApic));
4208	uReg = 0;
4209	}
4210	return uReg;
4211	}
4212
4213
4214	/**
4215	* Reads a 64-bit register from the virtual-APIC page at the given offset.
4216	*
4217	* @returns The register from the virtual-APIC page.
4218	* @param pVCpu The cross context virtual CPU structure.
4219	* @param offReg The offset of the register being read.
4220	*/
4221	IEM_STATIC uint64_t iemVmxVirtApicReadRaw64(PVMCPU pVCpu, uint16_t offReg)
4222	{
4223	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4224	Assert(pVmcs);
4225
4226	uint64_t uReg;
4227	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uReg));
4228	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4229	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4230	if (RT_FAILURE(rc))
4231	{
4232	AssertMsgFailed(("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp\n", sizeof(uReg), offReg,
4233	GCPhysVirtApic));
4234	uReg = 0;
4235	}
4236	return uReg;
4237	}
4238
4239
4240	/**
4241	* Writes a 32-bit register to the virtual-APIC page at the given offset.
4242	*
4243	* @param pVCpu The cross context virtual CPU structure.
4244	* @param offReg The offset of the register being written.
4245	* @param uReg The register value to write.
4246	*/
4247	IEM_STATIC void iemVmxVirtApicWriteRaw32(PVMCPU pVCpu, uint16_t offReg, uint32_t uReg)
4248	{
4249	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4250	Assert(pVmcs);
4251	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uReg));
4252	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4253	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4254	if (RT_FAILURE(rc))
4255	{
4256	AssertMsgFailed(("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp\n", sizeof(uReg), offReg,
4257	GCPhysVirtApic));
4258	}
4259	}
4260
4261
4262	/**
4263	* Writes a 64-bit register to the virtual-APIC page at the given offset.
4264	*
4265	* @param pVCpu The cross context virtual CPU structure.
4266	* @param offReg The offset of the register being written.
4267	* @param uReg The register value to write.
4268	*/
4269	IEM_STATIC void iemVmxVirtApicWriteRaw64(PVMCPU pVCpu, uint16_t offReg, uint64_t uReg)
4270	{
4271	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4272	Assert(pVmcs);
4273	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uReg));
4274	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4275	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4276	if (RT_FAILURE(rc))
4277	{
4278	AssertMsgFailed(("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp\n", sizeof(uReg), offReg,
4279	GCPhysVirtApic));
4280	}
4281	}
4282
4283
4284	/**
4285	* Sets the vector in a virtual-APIC 256-bit sparse register.
4286	*
4287	* @param pVCpu The cross context virtual CPU structure.
4288	* @param offReg The offset of the 256-bit spare register.
4289	* @param uVector The vector to set.
4290	*
4291	* @remarks This is based on our APIC device code.
4292	*/
4293	IEM_STATIC void iemVmxVirtApicSetVectorInReg(PVMCPU pVCpu, uint16_t offReg, uint8_t uVector)
4294	{
4295	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4296	Assert(pVmcs);
4297	uint32_t uReg;
4298	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4299	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4300	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4301	if (RT_SUCCESS(rc))
4302	{
4303	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4304	uReg \|= RT_BIT(idxVectorBit);
4305	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4306	if (RT_FAILURE(rc))
4307	{
4308	AssertMsgFailed(("Failed to set vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp\n",
4309	uVector, offReg, GCPhysVirtApic));
4310	}
4311	}
4312	else
4313	{
4314	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp\n",
4315	uVector, offReg, GCPhysVirtApic));
4316	}
4317	}
4318
4319
4320	/**
4321	* Clears the vector in a virtual-APIC 256-bit sparse register.
4322	*
4323	* @param pVCpu The cross context virtual CPU structure.
4324	* @param offReg The offset of the 256-bit spare register.
4325	* @param uVector The vector to clear.
4326	*
4327	* @remarks This is based on our APIC device code.
4328	*/
4329	IEM_STATIC void iemVmxVirtApicClearVectorInReg(PVMCPU pVCpu, uint16_t offReg, uint8_t uVector)
4330	{
4331	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4332	Assert(pVmcs);
4333	uint32_t uReg;
4334	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4335	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
4336	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4337	if (RT_SUCCESS(rc))
4338	{
4339	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4340	uReg &= ~RT_BIT(idxVectorBit);
4341	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4342	if (RT_FAILURE(rc))
4343	{
4344	AssertMsgFailed(("Failed to clear vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp\n",
4345	uVector, offReg, GCPhysVirtApic));
4346	}
4347	}
4348	else
4349	{
4350	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp\n",
4351	uVector, offReg, GCPhysVirtApic));
4352	}
4353	}
4354
4355
4356	/**
4357	* Checks if a memory access to the APIC-access page must causes an APIC-access
4358	* VM-exit.
4359	*
4360	* @param pVCpu The cross context virtual CPU structure.
4361	* @param offAccess The offset of the register being accessed.
4362	* @param cbAccess The size of the access in bytes.
4363	* @param fAccess The type of access (must be IEM_ACCESS_TYPE_READ or
4364	* IEM_ACCESS_TYPE_WRITE).
4365	*
4366	* @remarks This must not be used for MSR-based APIC-access page accesses!
4367	* @sa iemVmxVirtApicAccessMsrWrite, iemVmxVirtApicAccessMsrRead.
4368	*/
4369	IEM_STATIC bool iemVmxVirtApicIsMemAccessIntercepted(PVMCPU pVCpu, uint16_t offAccess, size_t cbAccess, uint32_t fAccess)
4370	{
4371	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4372	Assert(pVmcs);
4373	Assert(fAccess == IEM_ACCESS_TYPE_READ \|\| fAccess == IEM_ACCESS_TYPE_WRITE);
4374
4375	/*
4376	* We must cause a VM-exit if any of the following are true:
4377	* - TPR shadowing isn't active.
4378	* - The access size exceeds 32-bits.
4379	* - The access is not contained within low 4 bytes of a 16-byte aligned offset.
4380	*
4381	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4382	* See Intel spec. 29.4.3.1 "Determining Whether a Write Access is Virtualized".
4383	*/
4384	if ( !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
4385	\|\| cbAccess > sizeof(uint32_t)
4386	\|\| ((offAccess + cbAccess - 1) & 0xc)
4387	\|\| offAccess >= XAPIC_OFF_END + 4)
4388	return true;
4389
4390	/*
4391	* If the access is part of an operation where we have already
4392	* virtualized a virtual-APIC write, we must cause a VM-exit.
4393	*/
4394	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
4395	return true;
4396
4397	/*
4398	* Check write accesses to the APIC-access page that cause VM-exits.
4399	*/
4400	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4401	{
4402	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4403	{
4404	/*
4405	* With APIC-register virtualization, a write access to any of the
4406	* following registers are virtualized. Accessing any other register
4407	* causes a VM-exit.
4408	*/
4409	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4410	switch (offAlignedAccess)
4411	{
4412	case XAPIC_OFF_ID:
4413	case XAPIC_OFF_TPR:
4414	case XAPIC_OFF_EOI:
4415	case XAPIC_OFF_LDR:
4416	case XAPIC_OFF_DFR:
4417	case XAPIC_OFF_SVR:
4418	case XAPIC_OFF_ESR:
4419	case XAPIC_OFF_ICR_LO:
4420	case XAPIC_OFF_ICR_HI:
4421	case XAPIC_OFF_LVT_TIMER:
4422	case XAPIC_OFF_LVT_THERMAL:
4423	case XAPIC_OFF_LVT_PERF:
4424	case XAPIC_OFF_LVT_LINT0:
4425	case XAPIC_OFF_LVT_LINT1:
4426	case XAPIC_OFF_LVT_ERROR:
4427	case XAPIC_OFF_TIMER_ICR:
4428	case XAPIC_OFF_TIMER_DCR:
4429	break;
4430	default:
4431	return true;
4432	}
4433	}
4434	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4435	{
4436	/*
4437	* With virtual-interrupt delivery, a write access to any of the
4438	* following registers are virtualized. Accessing any other register
4439	* causes a VM-exit.
4440	*
4441	* Note! The specification does not allow writing to offsets in-between
4442	* these registers (e.g. TPR + 1 byte) unlike read accesses.
4443	*/
4444	switch (offAccess)
4445	{
4446	case XAPIC_OFF_TPR:
4447	case XAPIC_OFF_EOI:
4448	case XAPIC_OFF_ICR_LO:
4449	break;
4450	default:
4451	return true;
4452	}
4453	}
4454	else
4455	{
4456	/*
4457	* Without APIC-register virtualization or virtual-interrupt delivery,
4458	* only TPR accesses are virtualized.
4459	*/
4460	if (offAccess == XAPIC_OFF_TPR)
4461	{ /* likely */ }
4462	else
4463	return true;
4464	}
4465	}
4466	else
4467	{
4468	/*
4469	* Check read accesses to the APIC-access page that cause VM-exits.
4470	*/
4471	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4472	{
4473	/*
4474	* With APIC-register virtualization, a read access to any of the
4475	* following registers are virtualized. Accessing any other register
4476	* causes a VM-exit.
4477	*/
4478	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4479	switch (offAlignedAccess)
4480	{
4481	/** @todo r=ramshankar: What about XAPIC_OFF_LVT_CMCI? */
4482	case XAPIC_OFF_ID:
4483	case XAPIC_OFF_VERSION:
4484	case XAPIC_OFF_TPR:
4485	case XAPIC_OFF_EOI:
4486	case XAPIC_OFF_LDR:
4487	case XAPIC_OFF_DFR:
4488	case XAPIC_OFF_SVR:
4489	case XAPIC_OFF_ISR0: case XAPIC_OFF_ISR1: case XAPIC_OFF_ISR2: case XAPIC_OFF_ISR3:
4490	case XAPIC_OFF_ISR4: case XAPIC_OFF_ISR5: case XAPIC_OFF_ISR6: case XAPIC_OFF_ISR7:
4491	case XAPIC_OFF_TMR0: case XAPIC_OFF_TMR1: case XAPIC_OFF_TMR2: case XAPIC_OFF_TMR3:
4492	case XAPIC_OFF_TMR4: case XAPIC_OFF_TMR5: case XAPIC_OFF_TMR6: case XAPIC_OFF_TMR7:
4493	case XAPIC_OFF_IRR0: case XAPIC_OFF_IRR1: case XAPIC_OFF_IRR2: case XAPIC_OFF_IRR3:
4494	case XAPIC_OFF_IRR4: case XAPIC_OFF_IRR5: case XAPIC_OFF_IRR6: case XAPIC_OFF_IRR7:
4495	case XAPIC_OFF_ESR:
4496	case XAPIC_OFF_ICR_LO:
4497	case XAPIC_OFF_ICR_HI:
4498	case XAPIC_OFF_LVT_TIMER:
4499	case XAPIC_OFF_LVT_THERMAL:
4500	case XAPIC_OFF_LVT_PERF:
4501	case XAPIC_OFF_LVT_LINT0:
4502	case XAPIC_OFF_LVT_LINT1:
4503	case XAPIC_OFF_LVT_ERROR:
4504	case XAPIC_OFF_TIMER_ICR:
4505	case XAPIC_OFF_TIMER_DCR:
4506	break;
4507	default:
4508	return true;
4509	}
4510	}
4511	else
4512	{
4513	/* Without APIC-register virtualization, only TPR accesses are virtualized. */
4514	if (offAccess == XAPIC_OFF_TPR)
4515	{ /* likely */ }
4516	else
4517	return true;
4518	}
4519	}
4520
4521	/* The APIC-access is virtualized, does not cause a VM-exit. */
4522	return false;
4523	}
4524
4525
4526	/**
4527	* Virtualizes a memory-based APIC-access where the address is not used to access
4528	* memory.
4529	*
4530	* This is for instructions like MONITOR, CLFLUSH, CLFLUSHOPT, ENTER which may cause
4531	* page-faults but do not use the address to access memory.
4532	*
4533	* @param pVCpu The cross context virtual CPU structure.
4534	* @param pGCPhysAccess Pointer to the guest-physical address used.
4535	*/
4536	IEM_STATIC VBOXSTRICTRC iemVmxVirtApicAccessUnused(PVMCPU pVCpu, PRTGCPHYS pGCPhysAccess)
4537	{
4538	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4539	Assert(pVmcs);
4540	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4541	Assert(pGCPhysAccess);
4542
4543	RTGCPHYS const GCPhysAccess = *pGCPhysAccess & ~(RTGCPHYS)PAGE_OFFSET_MASK;
4544	RTGCPHYS const GCPhysApic = pVmcs->u64AddrApicAccess.u;
4545	Assert(!(GCPhysApic & PAGE_OFFSET_MASK));
4546
4547	if (GCPhysAccess == GCPhysApic)
4548	{
4549	uint16_t const offAccess = *pGCPhysAccess & PAGE_OFFSET_MASK;
4550	uint32_t const fAccess = IEM_ACCESS_TYPE_READ;
4551	uint16_t const cbAccess = 1;
4552	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4553	if (fIntercept)
4554	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4555
4556	*pGCPhysAccess = GCPhysApic \| offAccess;
4557	return VINF_VMX_MODIFIES_BEHAVIOR;
4558	}
4559
4560	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4561	}
4562
4563
4564	/**
4565	* Virtualizes a memory-based APIC-access.
4566	*
4567	* @returns VBox strict status code.
4568	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the access was virtualized.
4569	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4570	*
4571	* @param pVCpu The cross context virtual CPU structure.
4572	* @param offAccess The offset of the register being accessed (within the
4573	* APIC-access page).
4574	* @param cbAccess The size of the access in bytes.
4575	* @param pvData Pointer to the data being written or where to store the data
4576	* being read.
4577	* @param fAccess The type of access (must contain IEM_ACCESS_TYPE_READ or
4578	* IEM_ACCESS_TYPE_WRITE or IEM_ACCESS_INSTRUCTION).
4579	*/
4580	IEM_STATIC VBOXSTRICTRC iemVmxVirtApicAccessMem(PVMCPU pVCpu, uint16_t offAccess, size_t cbAccess, void *pvData,
4581	uint32_t fAccess)
4582	{
4583	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4584	Assert(pVmcs);
4585	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS); NOREF(pVmcs);
4586	Assert(pvData);
4587	Assert( (fAccess & IEM_ACCESS_TYPE_READ)
4588	\|\| (fAccess & IEM_ACCESS_TYPE_WRITE)
4589	\|\| (fAccess & IEM_ACCESS_INSTRUCTION));
4590
4591	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4592	if (fIntercept)
4593	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4594
4595	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4596	{
4597	/*
4598	* A write access to the APIC-access page that is virtualized (rather than
4599	* causing a VM-exit) writes data to the virtual-APIC page.
4600	*/
4601	uint32_t const u32Data = (uint32_t )pvData;
4602	iemVmxVirtApicWriteRaw32(pVCpu, offAccess, u32Data);
4603
4604	/*
4605	* Record the currently updated APIC offset, as we need this later for figuring
4606	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4607	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4608	*
4609	* After completion of the current operation, we need to perform TPR virtualization,
4610	* EOI virtualization or APIC-write VM-exit depending on which register was written.
4611	*
4612	* The current operation may be a REP-prefixed string instruction, execution of any
4613	* other instruction, or delivery of an event through the IDT.
4614	*
4615	* Thus things like clearing bytes 3:1 of the VTPR, clearing VEOI are not to be
4616	* performed now but later after completion of the current operation.
4617	*
4618	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
4619	*/
4620	iemVmxVirtApicSetPendingWrite(pVCpu, offAccess);
4621	}
4622	else
4623	{
4624	/*
4625	* A read access from the APIC-access page that is virtualized (rather than
4626	* causing a VM-exit) returns data from the virtual-APIC page.
4627	*
4628	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4629	*/
4630	Assert(cbAccess <= 4);
4631	Assert(offAccess < XAPIC_OFF_END + 4);
4632	static uint32_t const s_auAccessSizeMasks[] = { 0, 0xff, 0xffff, 0xffffff, 0xffffffff };
4633
4634	uint32_t u32Data = iemVmxVirtApicReadRaw32(pVCpu, offAccess);
4635	u32Data &= s_auAccessSizeMasks[cbAccess];
4636	(uint32_t )pvData = u32Data;
4637	}
4638
4639	return VINF_VMX_MODIFIES_BEHAVIOR;
4640	}
4641
4642
4643	/**
4644	* Virtualizes an MSR-based APIC read access.
4645	*
4646	* @returns VBox strict status code.
4647	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR read was virtualized.
4648	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR read access must be
4649	* handled by the x2APIC device.
4650	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4651	* not within the range of valid MSRs, caller must raise \#GP(0).
4652	* @param pVCpu The cross context virtual CPU structure.
4653	* @param idMsr The x2APIC MSR being read.
4654	* @param pu64Value Where to store the read x2APIC MSR value (only valid when
4655	* VINF_VMX_MODIFIES_BEHAVIOR is returned).
4656	*/
4657	IEM_STATIC VBOXSTRICTRC iemVmxVirtApicAccessMsrRead(PVMCPU pVCpu, uint32_t idMsr, uint64_t *pu64Value)
4658	{
4659	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4660	Assert(pVmcs);
4661	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE);
4662	Assert(pu64Value);
4663
4664	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4665	{
4666	/*
4667	* Intel has different ideas in the x2APIC spec. vs the VT-x spec. as to
4668	* what the end of the valid x2APIC MSR range is. Hence the use of different
4669	* macros here.
4670	*
4671	* See Intel spec. 10.12.1.2 "x2APIC Register Address Space".
4672	* See Intel spec. 29.5 "Virtualizing MSR-based APIC Accesses".
4673	*/
4674	if ( idMsr >= VMX_V_VIRT_APIC_MSR_START
4675	&& idMsr <= VMX_V_VIRT_APIC_MSR_END)
4676	{
4677	uint16_t const offReg = (idMsr & 0xff) << 4;
4678	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4679	*pu64Value = u64Value;
4680	return VINF_VMX_MODIFIES_BEHAVIOR;
4681	}
4682	return VERR_OUT_OF_RANGE;
4683	}
4684
4685	if (idMsr == MSR_IA32_X2APIC_TPR)
4686	{
4687	uint16_t const offReg = (idMsr & 0xff) << 4;
4688	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4689	*pu64Value = u64Value;
4690	return VINF_VMX_MODIFIES_BEHAVIOR;
4691	}
4692
4693	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4694	}
4695
4696
4697	/**
4698	* Virtualizes an MSR-based APIC write access.
4699	*
4700	* @returns VBox strict status code.
4701	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR write was virtualized.
4702	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4703	* not within the range of valid MSRs, caller must raise \#GP(0).
4704	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR must be written normally.
4705	*
4706	* @param pVCpu The cross context virtual CPU structure.
4707	* @param idMsr The x2APIC MSR being written.
4708	* @param u64Value The value of the x2APIC MSR being written.
4709	*/
4710	IEM_STATIC VBOXSTRICTRC iemVmxVirtApicAccessMsrWrite(PVMCPU pVCpu, uint32_t idMsr, uint64_t u64Value)
4711	{
4712	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4713	Assert(pVmcs);
4714
4715	/*
4716	* Check if the access is to be virtualized.
4717	* See Intel spec. 29.5 "Virtualizing MSR-based APIC Accesses".
4718	*/
4719	if ( idMsr == MSR_IA32_X2APIC_TPR
4720	\|\| ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4721	&& ( idMsr == MSR_IA32_X2APIC_EOI
4722	\|\| idMsr == MSR_IA32_X2APIC_SELF_IPI)))
4723	{
4724	/* Validate the MSR write depending on the register. */
4725	switch (idMsr)
4726	{
4727	case MSR_IA32_X2APIC_TPR:
4728	case MSR_IA32_X2APIC_SELF_IPI:
4729	{
4730	if (u64Value & UINT64_C(0xffffffffffffff00))
4731	return VERR_OUT_OF_RANGE;
4732	break;
4733	}
4734	case MSR_IA32_X2APIC_EOI:
4735	{
4736	if (u64Value != 0)
4737	return VERR_OUT_OF_RANGE;
4738	break;
4739	}
4740	}
4741
4742	/* Write the MSR to the virtual-APIC page. */
4743	uint16_t const offReg = (idMsr & 0xff) << 4;
4744	iemVmxVirtApicWriteRaw64(pVCpu, offReg, u64Value);
4745
4746	/*
4747	* Record the currently updated APIC offset, as we need this later for figuring
4748	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4749	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4750	*/
4751	iemVmxVirtApicSetPendingWrite(pVCpu, offReg);
4752
4753	return VINF_VMX_MODIFIES_BEHAVIOR;
4754	}
4755
4756	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4757	}
4758
4759
4760	/**
4761	* Finds the most significant set bit in a virtual-APIC 256-bit sparse register.
4762	*
4763	* @returns VBox status code.
4764	* @retval VINF_SUCCES when the highest set bit is found.
4765	* @retval VERR_NOT_FOUND when no bit is set.
4766	*
4767	* @param pVCpu The cross context virtual CPU structure.
4768	* @param offReg The offset of the APIC 256-bit sparse register.
4769	* @param pidxHighestBit Where to store the highest bit (most significant bit)
4770	* set in the register. Only valid when VINF_SUCCESS is
4771	* returned.
4772	*
4773	* @remarks The format of the 256-bit sparse register here mirrors that found in
4774	* real APIC hardware.
4775	*/
4776	static int iemVmxVirtApicGetHighestSetBitInReg(PVMCPU pVCpu, uint16_t offReg, uint8_t *pidxHighestBit)
4777	{
4778	Assert(offReg < XAPIC_OFF_END + 4);
4779	Assert(pidxHighestBit);
4780	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
4781
4782	/*
4783	* There are 8 contiguous fragments (of 16-bytes each) in the sparse register.
4784	* However, in each fragment only the first 4 bytes are used.
4785	*/
4786	uint8_t const cFrags = 8;
4787	for (int8_t iFrag = cFrags; iFrag >= 0; iFrag--)
4788	{
4789	uint16_t const offFrag = iFrag * 16;
4790	uint32_t const u32Frag = iemVmxVirtApicReadRaw32(pVCpu, offReg + offFrag);
4791	if (!u32Frag)
4792	continue;
4793
4794	unsigned idxHighestBit = ASMBitLastSetU32(u32Frag);
4795	Assert(idxHighestBit > 0);
4796	--idxHighestBit;
4797	Assert(idxHighestBit <= UINT8_MAX);
4798	*pidxHighestBit = idxHighestBit;
4799	return VINF_SUCCESS;
4800	}
4801	return VERR_NOT_FOUND;
4802	}
4803
4804
4805	/**
4806	* Evaluates pending virtual interrupts.
4807	*
4808	* @param pVCpu The cross context virtual CPU structure.
4809	*/
4810	IEM_STATIC void iemVmxEvalPendingVirtIntrs(PVMCPU pVCpu)
4811	{
4812	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4813	Assert(pVmcs);
4814	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4815
4816	if (!(pVmcs->u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT))
4817	{
4818	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
4819	uint8_t const uPpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_PPR);
4820
4821	if ((uRvi >> 4) > (uPpr >> 4))
4822	{
4823	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Signaling pending interrupt\n", uRvi, uPpr));
4824	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
4825	}
4826	else
4827	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Nothing to do\n", uRvi, uPpr));
4828	}
4829	}
4830
4831
4832	/**
4833	* Performs PPR virtualization.
4834	*
4835	* @returns VBox strict status code.
4836	* @param pVCpu The cross context virtual CPU structure.
4837	*/
4838	IEM_STATIC void iemVmxPprVirtualization(PVMCPU pVCpu)
4839	{
4840	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4841	Assert(pVmcs);
4842	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4843	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4844
4845	/*
4846	* PPR virtualization is caused in response to a VM-entry, TPR-virtualization,
4847	* or EOI-virtualization.
4848	*
4849	* See Intel spec. 29.1.3 "PPR Virtualization".
4850	*/
4851	uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4852	uint32_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
4853
4854	uint32_t uPpr;
4855	if (((uTpr >> 4) & 0xf) >= ((uSvi >> 4) & 0xf))
4856	uPpr = uTpr & 0xff;
4857	else
4858	uPpr = uSvi & 0xf0;
4859
4860	Log2(("ppr_virt: uTpr=%#x uSvi=%#x uPpr=%#x\n", uTpr, uSvi, uPpr));
4861	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_PPR, uPpr);
4862	}
4863
4864
4865	/**
4866	* Performs VMX TPR virtualization.
4867	*
4868	* @returns VBox strict status code.
4869	* @param pVCpu The cross context virtual CPU structure.
4870	*/
4871	IEM_STATIC VBOXSTRICTRC iemVmxTprVirtualization(PVMCPU pVCpu)
4872	{
4873	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4874	Assert(pVmcs);
4875	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4876
4877	/*
4878	* We should have already performed the virtual-APIC write to the TPR offset
4879	* in the virtual-APIC page. We now perform TPR virtualization.
4880	*
4881	* See Intel spec. 29.1.2 "TPR Virtualization".
4882	*/
4883	if (!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
4884	{
4885	uint32_t const uTprThreshold = pVmcs->u32TprThreshold;
4886	uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4887
4888	/*
4889	* If the VTPR falls below the TPR threshold, we must cause a VM-exit.
4890	* See Intel spec. 29.1.2 "TPR Virtualization".
4891	*/
4892	if (((uTpr >> 4) & 0xf) < uTprThreshold)
4893	{
4894	Log2(("tpr_virt: uTpr=%u uTprThreshold=%u -> VM-exit\n", uTpr, uTprThreshold));
4895	return iemVmxVmexit(pVCpu, VMX_EXIT_TPR_BELOW_THRESHOLD);
4896	}
4897	}
4898	else
4899	{
4900	iemVmxPprVirtualization(pVCpu);
4901	iemVmxEvalPendingVirtIntrs(pVCpu);
4902	}
4903
4904	return VINF_SUCCESS;
4905	}
4906
4907
4908	/**
4909	* Checks whether an EOI write for the given interrupt vector causes a VM-exit or
4910	* not.
4911	*
4912	* @returns @c true if the EOI write is intercepted, @c false otherwise.
4913	* @param pVCpu The cross context virtual CPU structure.
4914	* @param uVector The interrupt that was acknowledged using an EOI.
4915	*/
4916	IEM_STATIC bool iemVmxIsEoiInterceptSet(PCVMCPU pVCpu, uint8_t uVector)
4917	{
4918	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4919	Assert(pVmcs);
4920	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4921
4922	if (uVector < 64)
4923	return RT_BOOL(pVmcs->u64EoiExitBitmap0.u & RT_BIT_64(uVector));
4924	if (uVector < 128)
4925	return RT_BOOL(pVmcs->u64EoiExitBitmap1.u & RT_BIT_64(uVector));
4926	if (uVector < 192)
4927	return RT_BOOL(pVmcs->u64EoiExitBitmap2.u & RT_BIT_64(uVector));
4928	return RT_BOOL(pVmcs->u64EoiExitBitmap3.u & RT_BIT_64(uVector));
4929	}
4930
4931
4932	/**
4933	* Performs EOI virtualization.
4934	*
4935	* @returns VBox strict status code.
4936	* @param pVCpu The cross context virtual CPU structure.
4937	*/
4938	IEM_STATIC VBOXSTRICTRC iemVmxEoiVirtualization(PVMCPU pVCpu)
4939	{
4940	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4941	Assert(pVmcs);
4942	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4943
4944	/*
4945	* Clear the interrupt guest-interrupt as no longer in-service (ISR)
4946	* and get the next guest-interrupt that's in-service (if any).
4947	*
4948	* See Intel spec. 29.1.4 "EOI Virtualization".
4949	*/
4950	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
4951	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
4952	Log2(("eoi_virt: uRvi=%#x uSvi=%#x\n", uRvi, uSvi));
4953
4954	uint8_t uVector = uSvi;
4955	iemVmxVirtApicClearVectorInReg(pVCpu, XAPIC_OFF_ISR0, uVector);
4956
4957	uVector = 0;
4958	iemVmxVirtApicGetHighestSetBitInReg(pVCpu, XAPIC_OFF_ISR0, &uVector);
4959
4960	if (uVector)
4961	Log2(("eoi_virt: next interrupt %#x\n", uVector));
4962	else
4963	Log2(("eoi_virt: no interrupt pending in ISR\n"));
4964
4965	/* Update guest-interrupt status SVI (leave RVI portion as it is) in the VMCS. */
4966	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uRvi, uVector);
4967
4968	iemVmxPprVirtualization(pVCpu);
4969	if (iemVmxIsEoiInterceptSet(pVCpu, uVector))
4970	return iemVmxVmexitVirtEoi(pVCpu, uVector);
4971	iemVmxEvalPendingVirtIntrs(pVCpu);
4972	return VINF_SUCCESS;
4973	}
4974
4975
4976	/**
4977	* Performs self-IPI virtualization.
4978	*
4979	* @returns VBox strict status code.
4980	* @param pVCpu The cross context virtual CPU structure.
4981	*/
4982	IEM_STATIC VBOXSTRICTRC iemVmxSelfIpiVirtualization(PVMCPU pVCpu)
4983	{
4984	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
4985	Assert(pVmcs);
4986	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4987
4988	/*
4989	* We should have already performed the virtual-APIC write to the self-IPI offset
4990	* in the virtual-APIC page. We now perform self-IPI virtualization.
4991	*
4992	* See Intel spec. 29.1.5 "Self-IPI Virtualization".
4993	*/
4994	uint8_t const uVector = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_LO);
4995	Log2(("self_ipi_virt: uVector=%#x\n", uVector));
4996	iemVmxVirtApicSetVectorInReg(pVCpu, XAPIC_OFF_IRR0, uVector);
4997	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
4998	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
4999	if (uVector > uRvi)
5000	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uVector, uSvi);
5001	iemVmxEvalPendingVirtIntrs(pVCpu);
5002	return VINF_SUCCESS;
5003	}
5004
5005
5006	/**
5007	* Performs VMX APIC-write emulation.
5008	*
5009	* @returns VBox strict status code.
5010	* @param pVCpu The cross context virtual CPU structure.
5011	*/
5012	IEM_STATIC VBOXSTRICTRC iemVmxApicWriteEmulation(PVMCPU pVCpu)
5013	{
5014	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5015	Assert(pVmcs);
5016
5017	/* Import the virtual-APIC write offset (part of the hardware-virtualization state). */
5018	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
5019
5020	/*
5021	* Perform APIC-write emulation based on the virtual-APIC register written.
5022	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
5023	*/
5024	uint16_t const offApicWrite = iemVmxVirtApicClearPendingWrite(pVCpu);
5025	VBOXSTRICTRC rcStrict;
5026	switch (offApicWrite)
5027	{
5028	case XAPIC_OFF_TPR:
5029	{
5030	/* Clear bytes 3:1 of the VTPR and perform TPR virtualization. */
5031	uint32_t uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5032	uTpr &= UINT32_C(0x000000ff);
5033	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
5034	Log2(("iemVmxApicWriteEmulation: TPR write %#x\n", uTpr));
5035	rcStrict = iemVmxTprVirtualization(pVCpu);
5036	break;
5037	}
5038
5039	case XAPIC_OFF_EOI:
5040	{
5041	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5042	{
5043	/* Clear VEOI and perform EOI virtualization. */
5044	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_EOI, 0);
5045	Log2(("iemVmxApicWriteEmulation: EOI write\n"));
5046	rcStrict = iemVmxEoiVirtualization(pVCpu);
5047	}
5048	else
5049	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5050	break;
5051	}
5052
5053	case XAPIC_OFF_ICR_LO:
5054	{
5055	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5056	{
5057	/* If the ICR_LO is valid, write it and perform self-IPI virtualization. */
5058	uint32_t const uIcrLo = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5059	uint32_t const fIcrLoMb0 = UINT32_C(0xfffbb700);
5060	uint32_t const fIcrLoMb1 = UINT32_C(0x000000f0);
5061	if ( !(uIcrLo & fIcrLoMb0)
5062	&& (uIcrLo & fIcrLoMb1))
5063	{
5064	Log2(("iemVmxApicWriteEmulation: Self-IPI virtualization with vector %#x\n", (uIcrLo & 0xff)));
5065	rcStrict = iemVmxSelfIpiVirtualization(pVCpu);
5066	}
5067	else
5068	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5069	}
5070	else
5071	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5072	break;
5073	}
5074
5075	case XAPIC_OFF_ICR_HI:
5076	{
5077	/* Clear bytes 2:0 of VICR_HI. No other virtualization or VM-exit must occur. */
5078	uint32_t uIcrHi = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_HI);
5079	uIcrHi &= UINT32_C(0xff000000);
5080	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_ICR_HI, uIcrHi);
5081	rcStrict = VINF_SUCCESS;
5082	break;
5083	}
5084
5085	default:
5086	{
5087	/* Writes to any other virtual-APIC register causes an APIC-write VM-exit. */
5088	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5089	break;
5090	}
5091	}
5092
5093	return rcStrict;
5094	}
5095
5096
5097	/**
5098	* Checks guest control registers, debug registers and MSRs as part of VM-entry.
5099	*
5100	* @param pVCpu The cross context virtual CPU structure.
5101	* @param pszInstr The VMX instruction name (for logging purposes).
5102	*/
5103	IEM_STATIC int iemVmxVmentryCheckGuestControlRegsMsrs(PVMCPU pVCpu, const char *pszInstr)
5104	{
5105	/*
5106	* Guest Control Registers, Debug Registers, and MSRs.
5107	* See Intel spec. 26.3.1.1 "Checks on Guest Control Registers, Debug Registers, and MSRs".
5108	*/
5109	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5110	const char *const pszFailure = "VM-exit";
5111	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5112
5113	/* CR0 reserved bits. */
5114	{
5115	/* CR0 MB1 bits. */
5116	uint64_t u64Cr0Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed0;
5117	Assert(!(u64Cr0Fixed0 & (X86_CR0_NW \| X86_CR0_CD)));
5118	if (fUnrestrictedGuest)
5119	u64Cr0Fixed0 &= ~(X86_CR0_PE \| X86_CR0_PG);
5120	if ((pVmcs->u64GuestCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
5121	{ /* likely */ }
5122	else
5123	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed0);
5124
5125	/* CR0 MBZ bits. */
5126	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5127	if (!(pVmcs->u64GuestCr0.u & ~u64Cr0Fixed1))
5128	{ /* likely */ }
5129	else
5130	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed1);
5131
5132	/* Without unrestricted guest support, VT-x supports does not support unpaged protected mode. */
5133	if ( !fUnrestrictedGuest
5134	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5135	&& !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5136	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0PgPe);
5137	}
5138
5139	/* CR4 reserved bits. */
5140	{
5141	/* CR4 MB1 bits. */
5142	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
5143	if ((pVmcs->u64GuestCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
5144	{ /* likely */ }
5145	else
5146	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed0);
5147
5148	/* CR4 MBZ bits. */
5149	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
5150	if (!(pVmcs->u64GuestCr4.u & ~u64Cr4Fixed1))
5151	{ /* likely */ }
5152	else
5153	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed1);
5154	}
5155
5156	/* DEBUGCTL MSR. */
5157	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5158	\|\| !(pVmcs->u64GuestDebugCtlMsr.u & ~MSR_IA32_DEBUGCTL_VALID_MASK_INTEL))
5159	{ /* likely */ }
5160	else
5161	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDebugCtl);
5162
5163	/* 64-bit CPU checks. */
5164	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5165	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5166	{
5167	if (fGstInLongMode)
5168	{
5169	/* PAE must be set. */
5170	if ( (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5171	&& (pVmcs->u64GuestCr0.u & X86_CR4_PAE))
5172	{ /* likely */ }
5173	else
5174	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPae);
5175	}
5176	else
5177	{
5178	/* PCIDE should not be set. */
5179	if (!(pVmcs->u64GuestCr4.u & X86_CR4_PCIDE))
5180	{ /* likely */ }
5181	else
5182	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPcide);
5183	}
5184
5185	/* CR3. */
5186	if (!(pVmcs->u64GuestCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
5187	{ /* likely */ }
5188	else
5189	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr3);
5190
5191	/* DR7. */
5192	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5193	\|\| !(pVmcs->u64GuestDr7.u & X86_DR7_MBZ_MASK))
5194	{ /* likely */ }
5195	else
5196	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDr7);
5197
5198	/* SYSENTER ESP and SYSENTER EIP. */
5199	if ( X86_IS_CANONICAL(pVmcs->u64GuestSysenterEsp.u)
5200	&& X86_IS_CANONICAL(pVmcs->u64GuestSysenterEip.u))
5201	{ /* likely */ }
5202	else
5203	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSysenterEspEip);
5204	}
5205
5206	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
5207	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
5208
5209	/* PAT MSR. */
5210	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
5211	\|\| CPUMIsPatMsrValid(pVmcs->u64GuestPatMsr.u))
5212	{ /* likely */ }
5213	else
5214	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPatMsr);
5215
5216	/* EFER MSR. */
5217	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
5218	{
5219	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
5220	if (!(pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
5221	{ /* likely */ }
5222	else
5223	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsrRsvd);
5224
5225	bool const fGstLma = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LMA);
5226	bool const fGstLme = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LME);
5227	if ( fGstLma == fGstInLongMode
5228	&& ( !(pVmcs->u64GuestCr0.u & X86_CR0_PG)
5229	\|\| fGstLma == fGstLme))
5230	{ /* likely */ }
5231	else
5232	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsr);
5233	}
5234
5235	/* We don't support IA32_BNDCFGS MSR yet. */
5236	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
5237
5238	NOREF(pszInstr);
5239	NOREF(pszFailure);
5240	return VINF_SUCCESS;
5241	}
5242
5243
5244	/**
5245	* Checks guest segment registers, LDTR and TR as part of VM-entry.
5246	*
5247	* @param pVCpu The cross context virtual CPU structure.
5248	* @param pszInstr The VMX instruction name (for logging purposes).
5249	*/
5250	IEM_STATIC int iemVmxVmentryCheckGuestSegRegs(PVMCPU pVCpu, const char *pszInstr)
5251	{
5252	/*
5253	* Segment registers.
5254	* See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers".
5255	*/
5256	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5257	const char *const pszFailure = "VM-exit";
5258	bool const fGstInV86Mode = RT_BOOL(pVmcs->u64GuestRFlags.u & X86_EFL_VM);
5259	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5260	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5261
5262	/* Selectors. */
5263	if ( !fGstInV86Mode
5264	&& !fUnrestrictedGuest
5265	&& (pVmcs->GuestSs & X86_SEL_RPL) != (pVmcs->GuestCs & X86_SEL_RPL))
5266	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelCsSsRpl);
5267
5268	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
5269	{
5270	CPUMSELREG SelReg;
5271	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &SelReg);
5272	if (RT_LIKELY(rc == VINF_SUCCESS))
5273	{ /* likely */ }
5274	else
5275	return rc;
5276
5277	/*
5278	* Virtual-8086 mode checks.
5279	*/
5280	if (fGstInV86Mode)
5281	{
5282	/* Base address. */
5283	if (SelReg.u64Base == (uint64_t)SelReg.Sel << 4)
5284	{ /* likely */ }
5285	else
5286	{
5287	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBaseV86(iSegReg);
5288	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5289	}
5290
5291	/* Limit. */
5292	if (SelReg.u32Limit == 0xffff)
5293	{ /* likely */ }
5294	else
5295	{
5296	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegLimitV86(iSegReg);
5297	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5298	}
5299
5300	/* Attribute. */
5301	if (SelReg.Attr.u == 0xf3)
5302	{ /* likely */ }
5303	else
5304	{
5305	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrV86(iSegReg);
5306	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5307	}
5308
5309	/* We're done; move to checking the next segment. */
5310	continue;
5311	}
5312
5313	/* Checks done by 64-bit CPUs. */
5314	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5315	{
5316	/* Base address. */
5317	if ( iSegReg == X86_SREG_FS
5318	\|\| iSegReg == X86_SREG_GS)
5319	{
5320	if (X86_IS_CANONICAL(SelReg.u64Base))
5321	{ /* likely */ }
5322	else
5323	{
5324	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5325	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5326	}
5327	}
5328	else if (iSegReg == X86_SREG_CS)
5329	{
5330	if (!RT_HI_U32(SelReg.u64Base))
5331	{ /* likely */ }
5332	else
5333	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseCs);
5334	}
5335	else
5336	{
5337	if ( SelReg.Attr.n.u1Unusable
5338	\|\| !RT_HI_U32(SelReg.u64Base))
5339	{ /* likely */ }
5340	else
5341	{
5342	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5343	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5344	}
5345	}
5346	}
5347
5348	/*
5349	* Checks outside Virtual-8086 mode.
5350	*/
5351	uint8_t const uSegType = SelReg.Attr.n.u4Type;
5352	uint8_t const fCodeDataSeg = SelReg.Attr.n.u1DescType;
5353	uint8_t const fUsable = !SelReg.Attr.n.u1Unusable;
5354	uint8_t const uDpl = SelReg.Attr.n.u2Dpl;
5355	uint8_t const fPresent = SelReg.Attr.n.u1Present;
5356	uint8_t const uGranularity = SelReg.Attr.n.u1Granularity;
5357	uint8_t const uDefBig = SelReg.Attr.n.u1DefBig;
5358	uint8_t const fSegLong = SelReg.Attr.n.u1Long;
5359
5360	/* Code or usable segment. */
5361	if ( iSegReg == X86_SREG_CS
5362	\|\| fUsable)
5363	{
5364	/* Reserved bits (bits 31:17 and bits 11:8). */
5365	if (!(SelReg.Attr.u & 0xfffe0f00))
5366	{ /* likely */ }
5367	else
5368	{
5369	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrRsvd(iSegReg);
5370	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5371	}
5372
5373	/* Descriptor type. */
5374	if (fCodeDataSeg)
5375	{ /* likely */ }
5376	else
5377	{
5378	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDescType(iSegReg);
5379	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5380	}
5381
5382	/* Present. */
5383	if (fPresent)
5384	{ /* likely */ }
5385	else
5386	{
5387	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrPresent(iSegReg);
5388	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5389	}
5390
5391	/* Granularity. */
5392	if ( ((SelReg.u32Limit & 0x00000fff) == 0x00000fff \|\| !uGranularity)
5393	&& ((SelReg.u32Limit & 0xfff00000) == 0x00000000 \|\| uGranularity))
5394	{ /* likely */ }
5395	else
5396	{
5397	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrGran(iSegReg);
5398	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5399	}
5400	}
5401
5402	if (iSegReg == X86_SREG_CS)
5403	{
5404	/* Segment Type and DPL. */
5405	if ( uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5406	&& fUnrestrictedGuest)
5407	{
5408	if (uDpl == 0)
5409	{ /* likely */ }
5410	else
5411	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplZero);
5412	}
5413	else if ( uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_ACCESSED)
5414	\|\| uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5415	{
5416	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5417	if (uDpl == AttrSs.n.u2Dpl)
5418	{ /* likely */ }
5419	else
5420	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplEqSs);
5421	}
5422	else if ((uSegType & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5423	== (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5424	{
5425	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5426	if (uDpl <= AttrSs.n.u2Dpl)
5427	{ /* likely */ }
5428	else
5429	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplLtSs);
5430	}
5431	else
5432	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsType);
5433
5434	/* Def/Big. */
5435	if ( fGstInLongMode
5436	&& fSegLong)
5437	{
5438	if (uDefBig == 0)
5439	{ /* likely */ }
5440	else
5441	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDefBig);
5442	}
5443	}
5444	else if (iSegReg == X86_SREG_SS)
5445	{
5446	/* Segment Type. */
5447	if ( !fUsable
5448	\|\| uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5449	\|\| uSegType == (X86_SEL_TYPE_DOWN \| X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED))
5450	{ /* likely */ }
5451	else
5452	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsType);
5453
5454	/* DPL. */
5455	if (!fUnrestrictedGuest)
5456	{
5457	if (uDpl == (SelReg.Sel & X86_SEL_RPL))
5458	{ /* likely */ }
5459	else
5460	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplEqRpl);
5461	}
5462	X86DESCATTR AttrCs; AttrCs.u = pVmcs->u32GuestCsAttr;
5463	if ( AttrCs.n.u4Type == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5464	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5465	{
5466	if (uDpl == 0)
5467	{ /* likely */ }
5468	else
5469	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplZero);
5470	}
5471	}
5472	else
5473	{
5474	/* DS, ES, FS, GS. */
5475	if (fUsable)
5476	{
5477	/* Segment type. */
5478	if (uSegType & X86_SEL_TYPE_ACCESSED)
5479	{ /* likely */ }
5480	else
5481	{
5482	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrTypeAcc(iSegReg);
5483	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5484	}
5485
5486	if ( !(uSegType & X86_SEL_TYPE_CODE)
5487	\|\| (uSegType & X86_SEL_TYPE_READ))
5488	{ /* likely */ }
5489	else
5490	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsTypeRead);
5491
5492	/* DPL. */
5493	if ( !fUnrestrictedGuest
5494	&& uSegType <= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5495	{
5496	if (uDpl >= (SelReg.Sel & X86_SEL_RPL))
5497	{ /* likely */ }
5498	else
5499	{
5500	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDplRpl(iSegReg);
5501	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5502	}
5503	}
5504	}
5505	}
5506	}
5507
5508	/*
5509	* LDTR.
5510	*/
5511	{
5512	CPUMSELREG Ldtr;
5513	Ldtr.Sel = pVmcs->GuestLdtr;
5514	Ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
5515	Ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
5516	Ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
5517
5518	if (!Ldtr.Attr.n.u1Unusable)
5519	{
5520	/* Selector. */
5521	if (!(Ldtr.Sel & X86_SEL_LDT))
5522	{ /* likely */ }
5523	else
5524	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelLdtr);
5525
5526	/* Base. */
5527	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5528	{
5529	if (X86_IS_CANONICAL(Ldtr.u64Base))
5530	{ /* likely */ }
5531	else
5532	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseLdtr);
5533	}
5534
5535	/* Attributes. */
5536	/* Reserved bits (bits 31:17 and bits 11:8). */
5537	if (!(Ldtr.Attr.u & 0xfffe0f00))
5538	{ /* likely */ }
5539	else
5540	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrRsvd);
5541
5542	if (Ldtr.Attr.n.u4Type == X86_SEL_TYPE_SYS_LDT)
5543	{ /* likely */ }
5544	else
5545	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrType);
5546
5547	if (!Ldtr.Attr.n.u1DescType)
5548	{ /* likely */ }
5549	else
5550	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrDescType);
5551
5552	if (Ldtr.Attr.n.u1Present)
5553	{ /* likely */ }
5554	else
5555	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrPresent);
5556
5557	if ( ((Ldtr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Ldtr.Attr.n.u1Granularity)
5558	&& ((Ldtr.u32Limit & 0xfff00000) == 0x00000000 \|\| Ldtr.Attr.n.u1Granularity))
5559	{ /* likely */ }
5560	else
5561	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrGran);
5562	}
5563	}
5564
5565	/*
5566	* TR.
5567	*/
5568	{
5569	CPUMSELREG Tr;
5570	Tr.Sel = pVmcs->GuestTr;
5571	Tr.u32Limit = pVmcs->u32GuestTrLimit;
5572	Tr.u64Base = pVmcs->u64GuestTrBase.u;
5573	Tr.Attr.u = pVmcs->u32GuestTrAttr;
5574
5575	/* Selector. */
5576	if (!(Tr.Sel & X86_SEL_LDT))
5577	{ /* likely */ }
5578	else
5579	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelTr);
5580
5581	/* Base. */
5582	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5583	{
5584	if (X86_IS_CANONICAL(Tr.u64Base))
5585	{ /* likely */ }
5586	else
5587	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseTr);
5588	}
5589
5590	/* Attributes. */
5591	/* Reserved bits (bits 31:17 and bits 11:8). */
5592	if (!(Tr.Attr.u & 0xfffe0f00))
5593	{ /* likely */ }
5594	else
5595	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrRsvd);
5596
5597	if (!Tr.Attr.n.u1Unusable)
5598	{ /* likely */ }
5599	else
5600	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrUnusable);
5601
5602	if ( Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY
5603	\|\| ( !fGstInLongMode
5604	&& Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY))
5605	{ /* likely */ }
5606	else
5607	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrType);
5608
5609	if (!Tr.Attr.n.u1DescType)
5610	{ /* likely */ }
5611	else
5612	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrDescType);
5613
5614	if (Tr.Attr.n.u1Present)
5615	{ /* likely */ }
5616	else
5617	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrPresent);
5618
5619	if ( ((Tr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Tr.Attr.n.u1Granularity)
5620	&& ((Tr.u32Limit & 0xfff00000) == 0x00000000 \|\| Tr.Attr.n.u1Granularity))
5621	{ /* likely */ }
5622	else
5623	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrGran);
5624	}
5625
5626	NOREF(pszInstr);
5627	NOREF(pszFailure);
5628	return VINF_SUCCESS;
5629	}
5630
5631
5632	/**
5633	* Checks guest GDTR and IDTR as part of VM-entry.
5634	*
5635	* @param pVCpu The cross context virtual CPU structure.
5636	* @param pszInstr The VMX instruction name (for logging purposes).
5637	*/
5638	IEM_STATIC int iemVmxVmentryCheckGuestGdtrIdtr(PVMCPU pVCpu, const char *pszInstr)
5639	{
5640	/*
5641	* GDTR and IDTR.
5642	* See Intel spec. 26.3.1.3 "Checks on Guest Descriptor-Table Registers".
5643	*/
5644	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5645	const char *const pszFailure = "VM-exit";
5646
5647	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5648	{
5649	/* Base. */
5650	if (X86_IS_CANONICAL(pVmcs->u64GuestGdtrBase.u))
5651	{ /* likely */ }
5652	else
5653	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrBase);
5654
5655	if (X86_IS_CANONICAL(pVmcs->u64GuestIdtrBase.u))
5656	{ /* likely */ }
5657	else
5658	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrBase);
5659	}
5660
5661	/* Limit. */
5662	if (!RT_HI_U16(pVmcs->u32GuestGdtrLimit))
5663	{ /* likely */ }
5664	else
5665	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrLimit);
5666
5667	if (!RT_HI_U16(pVmcs->u32GuestIdtrLimit))
5668	{ /* likely */ }
5669	else
5670	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrLimit);
5671
5672	NOREF(pszInstr);
5673	NOREF(pszFailure);
5674	return VINF_SUCCESS;
5675	}
5676
5677
5678	/**
5679	* Checks guest RIP and RFLAGS as part of VM-entry.
5680	*
5681	* @param pVCpu The cross context virtual CPU structure.
5682	* @param pszInstr The VMX instruction name (for logging purposes).
5683	*/
5684	IEM_STATIC int iemVmxVmentryCheckGuestRipRFlags(PVMCPU pVCpu, const char *pszInstr)
5685	{
5686	/*
5687	* RIP and RFLAGS.
5688	* See Intel spec. 26.3.1.4 "Checks on Guest RIP and RFLAGS".
5689	*/
5690	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5691	const char *const pszFailure = "VM-exit";
5692	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5693
5694	/* RIP. */
5695	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5696	{
5697	X86DESCATTR AttrCs; AttrCs.u = pVmcs->u32GuestCsAttr;
5698	if ( !fGstInLongMode
5699	\|\| !AttrCs.n.u1Long)
5700	{
5701	if (!RT_HI_U32(pVmcs->u64GuestRip.u))
5702	{ /* likely */ }
5703	else
5704	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRipRsvd);
5705	}
5706
5707	if ( fGstInLongMode
5708	&& AttrCs.n.u1Long)
5709	{
5710	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth == 48); /* Canonical. */
5711	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth < 64
5712	&& X86_IS_CANONICAL(pVmcs->u64GuestRip.u))
5713	{ /* likely */ }
5714	else
5715	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRip);
5716	}
5717	}
5718
5719	/* RFLAGS (bits 63:22 (or 31:22), bits 15, 5, 3 are reserved, bit 1 MB1). */
5720	uint64_t const uGuestRFlags = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode ? pVmcs->u64GuestRFlags.u
5721	: pVmcs->u64GuestRFlags.s.Lo;
5722	if ( !(uGuestRFlags & ~(X86_EFL_LIVE_MASK \| X86_EFL_RA1_MASK))
5723	&& (uGuestRFlags & X86_EFL_RA1_MASK) == X86_EFL_RA1_MASK)
5724	{ /* likely */ }
5725	else
5726	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsRsvd);
5727
5728	if ( fGstInLongMode
5729	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5730	{
5731	if (!(uGuestRFlags & X86_EFL_VM))
5732	{ /* likely */ }
5733	else
5734	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsVm);
5735	}
5736
5737	if ( VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo)
5738	&& VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo) == VMX_ENTRY_INT_INFO_TYPE_EXT_INT)
5739	{
5740	if (uGuestRFlags & X86_EFL_IF)
5741	{ /* likely */ }
5742	else
5743	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsIf);
5744	}
5745
5746	NOREF(pszInstr);
5747	NOREF(pszFailure);
5748	return VINF_SUCCESS;
5749	}
5750
5751
5752	/**
5753	* Checks guest non-register state as part of VM-entry.
5754	*
5755	* @param pVCpu The cross context virtual CPU structure.
5756	* @param pszInstr The VMX instruction name (for logging purposes).
5757	*/
5758	IEM_STATIC int iemVmxVmentryCheckGuestNonRegState(PVMCPU pVCpu, const char *pszInstr)
5759	{
5760	/*
5761	* Guest non-register state.
5762	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
5763	*/
5764	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
5765	const char *const pszFailure = "VM-exit";
5766
5767	/*
5768	* Activity state.
5769	*/
5770	uint64_t const u64GuestVmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
5771	uint32_t const fActivityStateMask = RT_BF_GET(u64GuestVmxMiscMsr, VMX_BF_MISC_ACTIVITY_STATES);
5772	if (!(pVmcs->u32GuestActivityState & fActivityStateMask))
5773	{ /* likely */ }
5774	else
5775	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateRsvd);
5776
5777	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5778	if ( !AttrSs.n.u2Dpl
5779	\|\| pVmcs->u32GuestActivityState != VMX_VMCS_GUEST_ACTIVITY_HLT)
5780	{ /* likely */ }
5781	else
5782	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateSsDpl);
5783
5784	if ( pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_STI
5785	\|\| pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
5786	{
5787	if (pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_ACTIVE)
5788	{ /* likely */ }
5789	else
5790	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateStiMovSs);
5791	}
5792
5793	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5794	{
5795	uint8_t const uIntType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5796	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
5797	AssertCompile(VMX_V_GUEST_ACTIVITY_STATE_MASK == (VMX_VMCS_GUEST_ACTIVITY_HLT \| VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN));
5798	switch (pVmcs->u32GuestActivityState)
5799	{
5800	case VMX_VMCS_GUEST_ACTIVITY_HLT:
5801	{
5802	if ( uIntType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT
5803	\|\| uIntType == VMX_ENTRY_INT_INFO_TYPE_NMI
5804	\|\| ( uIntType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5805	&& ( uVector == X86_XCPT_DB
5806	\|\| uVector == X86_XCPT_MC))
5807	\|\| ( uIntType == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT
5808	&& uVector == VMX_ENTRY_INT_INFO_VECTOR_MTF))
5809	{ /* likely */ }
5810	else
5811	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateHlt);
5812	break;
5813	}
5814
5815	case VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN:
5816	{
5817	if ( uIntType == VMX_ENTRY_INT_INFO_TYPE_NMI
5818	\|\| ( uIntType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5819	&& uVector == X86_XCPT_MC))
5820	{ /* likely */ }
5821	else
5822	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateShutdown);
5823	break;
5824	}
5825
5826	case VMX_VMCS_GUEST_ACTIVITY_ACTIVE:
5827	default:
5828	break;
5829	}
5830	}
5831
5832	/*
5833	* Interruptibility state.
5834	*/
5835	if (!(pVmcs->u32GuestIntrState & ~VMX_VMCS_GUEST_INT_STATE_MASK))
5836	{ /* likely */ }
5837	else
5838	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRsvd);
5839
5840	if ((pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5841	!= (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5842	{ /* likely */ }
5843	else
5844	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateStiMovSs);
5845
5846	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_IF)
5847	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5848	{ /* likely */ }
5849	else
5850	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRFlagsSti);
5851
5852	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5853	{
5854	uint8_t const uIntType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5855	if (uIntType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT)
5856	{
5857	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5858	{ /* likely */ }
5859	else
5860	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateExtInt);
5861	}
5862	else if (uIntType == VMX_ENTRY_INT_INFO_TYPE_NMI)
5863	{
5864	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5865	{ /* likely */ }
5866	else
5867	{
5868	/*
5869	* We don't support injecting NMIs when blocking-by-STI would be in effect.
5870	* We update the VM-exit qualification only when blocking-by-STI is set
5871	* without blocking-by-MovSS being set. Although in practise it does not
5872	* make much difference since the order of checks are implementation defined.
5873	*/
5874	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
5875	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_NMI_INJECT);
5876	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateNmi);
5877	}
5878
5879	if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
5880	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI))
5881	{ /* likely */ }
5882	else
5883	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateVirtNmi);
5884	}
5885	}
5886
5887	/* We don't support SMM yet. So blocking-by-SMIs must not be set. */
5888	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_SMI))
5889	{ /* likely */ }
5890	else
5891	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateSmi);
5892
5893	/* We don't support SGX yet. So enclave-interruption must not be set. */
5894	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_ENCLAVE))
5895	{ /* likely */ }
5896	else
5897	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateEnclave);
5898
5899	/*
5900	* Pending debug exceptions.
5901	*/
5902	uint64_t const uPendingDbgXcpt = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode
5903	? pVmcs->u64GuestPendingDbgXcpt.u
5904	: pVmcs->u64GuestPendingDbgXcpt.s.Lo;
5905	if (!(uPendingDbgXcpt & ~VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK))
5906	{ /* likely */ }
5907	else
5908	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRsvd);
5909
5910	if ( (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5911	\|\| pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_HLT)
5912	{
5913	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5914	&& !(pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF)
5915	&& !(uPendingDbgXcpt & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5916	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsTf);
5917
5918	if ( ( !(pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5919	\|\| (pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF))
5920	&& (uPendingDbgXcpt & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5921	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsNoTf);
5922	}
5923
5924	/* We don't support RTM (Real-time Transactional Memory) yet. */
5925	if (!(uPendingDbgXcpt & VMX_VMCS_GUEST_PENDING_DEBUG_RTM))
5926	{ /* likely */ }
5927	else
5928	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRtm);
5929
5930	/*
5931	* VMCS link pointer.
5932	*/
5933	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
5934	{
5935	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
5936	/* We don't support SMM yet (so VMCS link pointer cannot be the current VMCS). */
5937	if (GCPhysShadowVmcs != IEM_VMX_GET_CURRENT_VMCS(pVCpu))
5938	{ /* likely */ }
5939	else
5940	{
5941	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
5942	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrCurVmcs);
5943	}
5944
5945	/* Validate the address. */
5946	if ( !(GCPhysShadowVmcs & X86_PAGE_4K_OFFSET_MASK)
5947	&& !(GCPhysShadowVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
5948	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysShadowVmcs))
5949	{ /* likely */ }
5950	else
5951	{
5952	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
5953	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmcsLinkPtr);
5954	}
5955
5956	/* Read the VMCS-link pointer from guest memory. */
5957	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs));
5958	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs),
5959	GCPhysShadowVmcs, VMX_V_VMCS_SIZE);
5960	if (RT_SUCCESS(rc))
5961	{ /* likely */ }
5962	else
5963	{
5964	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
5965	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrReadPhys);
5966	}
5967
5968	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
5969	if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs)->u32VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID)
5970	{ /* likely */ }
5971	else
5972	{
5973	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
5974	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrRevId);
5975	}
5976
5977	/* Verify the shadow bit is set if VMCS shadowing is enabled . */
5978	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
5979	\|\| pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs)->u32VmcsRevId.n.fIsShadowVmcs)
5980	{ /* likely */ }
5981	else
5982	{
5983	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
5984	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrShadow);
5985	}
5986
5987	/* Finally update our cache of the guest physical address of the shadow VMCS. */
5988	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysShadowVmcs = GCPhysShadowVmcs;
5989	}
5990
5991	NOREF(pszInstr);
5992	NOREF(pszFailure);
5993	return VINF_SUCCESS;
5994	}
5995
5996
5997	/**
5998	* Checks if the PDPTEs referenced by the nested-guest CR3 are valid as part of
5999	* VM-entry.
6000	*
6001	* @returns @c true if all PDPTEs are valid, @c false otherwise.
6002	* @param pVCpu The cross context virtual CPU structure.
6003	* @param pszInstr The VMX instruction name (for logging purposes).
6004	* @param pVmcs Pointer to the virtual VMCS.
6005	*/
6006	IEM_STATIC int iemVmxVmentryCheckGuestPdptesForCr3(PVMCPU pVCpu, const char *pszInstr, PVMXVVMCS pVmcs)
6007	{
6008	/*
6009	* Check PDPTEs.
6010	* See Intel spec. 4.4.1 "PDPTE Registers".
6011	*/
6012	uint64_t const uGuestCr3 = pVmcs->u64GuestCr3.u & X86_CR3_PAE_PAGE_MASK;
6013	const char *const pszFailure = "VM-exit";
6014
6015	X86PDPE aPdptes[X86_PG_PAE_PDPE_ENTRIES];
6016	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)&aPdptes[0], uGuestCr3, sizeof(aPdptes));
6017	if (RT_SUCCESS(rc))
6018	{
6019	for (unsigned iPdpte = 0; iPdpte < RT_ELEMENTS(aPdptes); iPdpte++)
6020	{
6021	if ( !(aPdptes[iPdpte].u & X86_PDPE_P)
6022	\|\| !(aPdptes[iPdpte].u & X86_PDPE_PAE_MBZ_MASK))
6023	{ /* likely */ }
6024	else
6025	{
6026	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
6027	VMXVDIAG const enmDiag = iemVmxGetDiagVmentryPdpteRsvd(iPdpte);
6028	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
6029	}
6030	}
6031	}
6032	else
6033	{
6034	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
6035	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpteCr3ReadPhys);
6036	}
6037
6038	NOREF(pszFailure);
6039	NOREF(pszInstr);
6040	return rc;
6041	}
6042
6043
6044	/**
6045	* Checks guest PDPTEs as part of VM-entry.
6046	*
6047	* @param pVCpu The cross context virtual CPU structure.
6048	* @param pszInstr The VMX instruction name (for logging purposes).
6049	*/
6050	IEM_STATIC int iemVmxVmentryCheckGuestPdptes(PVMCPU pVCpu, const char *pszInstr)
6051	{
6052	/*
6053	* Guest PDPTEs.
6054	* See Intel spec. 26.3.1.5 "Checks on Guest Page-Directory-Pointer-Table Entries".
6055	*/
6056	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6057	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6058
6059	/* Check PDPTes if the VM-entry is to a guest using PAE paging. */
6060	int rc;
6061	if ( !fGstInLongMode
6062	&& (pVmcs->u64GuestCr4.u & X86_CR4_PAE)
6063	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG))
6064	{
6065	/*
6066	* We don't support nested-paging for nested-guests yet.
6067	*
6068	* Without nested-paging for nested-guests, PDPTEs in the VMCS are not used,
6069	* rather we need to check the PDPTEs referenced by the guest CR3.
6070	*/
6071	rc = iemVmxVmentryCheckGuestPdptesForCr3(pVCpu, pszInstr, pVmcs);
6072	}
6073	else
6074	rc = VINF_SUCCESS;
6075	return rc;
6076	}
6077
6078
6079	/**
6080	* Checks guest-state as part of VM-entry.
6081	*
6082	* @returns VBox status code.
6083	* @param pVCpu The cross context virtual CPU structure.
6084	* @param pszInstr The VMX instruction name (for logging purposes).
6085	*/
6086	IEM_STATIC int iemVmxVmentryCheckGuestState(PVMCPU pVCpu, const char *pszInstr)
6087	{
6088	int rc = iemVmxVmentryCheckGuestControlRegsMsrs(pVCpu, pszInstr);
6089	if (RT_SUCCESS(rc))
6090	{
6091	rc = iemVmxVmentryCheckGuestSegRegs(pVCpu, pszInstr);
6092	if (RT_SUCCESS(rc))
6093	{
6094	rc = iemVmxVmentryCheckGuestGdtrIdtr(pVCpu, pszInstr);
6095	if (RT_SUCCESS(rc))
6096	{
6097	rc = iemVmxVmentryCheckGuestRipRFlags(pVCpu, pszInstr);
6098	if (RT_SUCCESS(rc))
6099	{
6100	rc = iemVmxVmentryCheckGuestNonRegState(pVCpu, pszInstr);
6101	if (RT_SUCCESS(rc))
6102	return iemVmxVmentryCheckGuestPdptes(pVCpu, pszInstr);
6103	}
6104	}
6105	}
6106	}
6107	return rc;
6108	}
6109
6110
6111	/**
6112	* Checks host-state as part of VM-entry.
6113	*
6114	* @returns VBox status code.
6115	* @param pVCpu The cross context virtual CPU structure.
6116	* @param pszInstr The VMX instruction name (for logging purposes).
6117	*/
6118	IEM_STATIC int iemVmxVmentryCheckHostState(PVMCPU pVCpu, const char *pszInstr)
6119	{
6120	/*
6121	* Host Control Registers and MSRs.
6122	* See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
6123	*/
6124	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6125	const char * const pszFailure = "VMFail";
6126
6127	/* CR0 reserved bits. */
6128	{
6129	/* CR0 MB1 bits. */
6130	uint64_t const u64Cr0Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed0;
6131	if ((pVmcs->u64HostCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
6132	{ /* likely */ }
6133	else
6134	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed0);
6135
6136	/* CR0 MBZ bits. */
6137	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6138	if (!(pVmcs->u64HostCr0.u & ~u64Cr0Fixed1))
6139	{ /* likely */ }
6140	else
6141	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed1);
6142	}
6143
6144	/* CR4 reserved bits. */
6145	{
6146	/* CR4 MB1 bits. */
6147	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6148	if ((pVmcs->u64HostCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
6149	{ /* likely */ }
6150	else
6151	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed0);
6152
6153	/* CR4 MBZ bits. */
6154	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6155	if (!(pVmcs->u64HostCr4.u & ~u64Cr4Fixed1))
6156	{ /* likely */ }
6157	else
6158	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed1);
6159	}
6160
6161	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6162	{
6163	/* CR3 reserved bits. */
6164	if (!(pVmcs->u64HostCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
6165	{ /* likely */ }
6166	else
6167	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr3);
6168
6169	/* SYSENTER ESP and SYSENTER EIP. */
6170	if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
6171	&& X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
6172	{ /* likely */ }
6173	else
6174	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSysenterEspEip);
6175	}
6176
6177	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6178	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR));
6179
6180	/* PAT MSR. */
6181	if ( !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
6182	\|\| CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
6183	{ /* likely */ }
6184	else
6185	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostPatMsr);
6186
6187	/* EFER MSR. */
6188	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
6189	if ( !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
6190	\|\| !(pVmcs->u64HostEferMsr.u & ~uValidEferMask))
6191	{ /* likely */ }
6192	else
6193	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsrRsvd);
6194
6195	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
6196	bool const fHostLma = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LMA);
6197	bool const fHostLme = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LME);
6198	if ( fHostInLongMode == fHostLma
6199	&& fHostInLongMode == fHostLme)
6200	{ /* likely */ }
6201	else
6202	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsr);
6203
6204	/*
6205	* Host Segment and Descriptor-Table Registers.
6206	* See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
6207	*/
6208	/* Selector RPL and TI. */
6209	if ( !(pVmcs->HostCs & (X86_SEL_RPL \| X86_SEL_LDT))
6210	&& !(pVmcs->HostSs & (X86_SEL_RPL \| X86_SEL_LDT))
6211	&& !(pVmcs->HostDs & (X86_SEL_RPL \| X86_SEL_LDT))
6212	&& !(pVmcs->HostEs & (X86_SEL_RPL \| X86_SEL_LDT))
6213	&& !(pVmcs->HostFs & (X86_SEL_RPL \| X86_SEL_LDT))
6214	&& !(pVmcs->HostGs & (X86_SEL_RPL \| X86_SEL_LDT))
6215	&& !(pVmcs->HostTr & (X86_SEL_RPL \| X86_SEL_LDT)))
6216	{ /* likely */ }
6217	else
6218	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSel);
6219
6220	/* CS and TR selectors cannot be 0. */
6221	if ( pVmcs->HostCs
6222	&& pVmcs->HostTr)
6223	{ /* likely */ }
6224	else
6225	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCsTr);
6226
6227	/* SS cannot be 0 if 32-bit host. */
6228	if ( fHostInLongMode
6229	\|\| pVmcs->HostSs)
6230	{ /* likely */ }
6231	else
6232	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSs);
6233
6234	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6235	{
6236	/* FS, GS, GDTR, IDTR, TR base address. */
6237	if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6238	&& X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6239	&& X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
6240	&& X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
6241	&& X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
6242	{ /* likely */ }
6243	else
6244	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSegBase);
6245	}
6246
6247	/*
6248	* Host address-space size for 64-bit CPUs.
6249	* See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
6250	*/
6251	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6252	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6253	{
6254	bool const fCpuInLongMode = CPUMIsGuestInLongMode(pVCpu);
6255
6256	/* Logical processor in IA-32e mode. */
6257	if (fCpuInLongMode)
6258	{
6259	if (fHostInLongMode)
6260	{
6261	/* PAE must be set. */
6262	if (pVmcs->u64HostCr4.u & X86_CR4_PAE)
6263	{ /* likely */ }
6264	else
6265	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pae);
6266
6267	/* RIP must be canonical. */
6268	if (X86_IS_CANONICAL(pVmcs->u64HostRip.u))
6269	{ /* likely */ }
6270	else
6271	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRip);
6272	}
6273	else
6274	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostLongMode);
6275	}
6276	else
6277	{
6278	/* Logical processor is outside IA-32e mode. */
6279	if ( !fGstInLongMode
6280	&& !fHostInLongMode)
6281	{
6282	/* PCIDE should not be set. */
6283	if (!(pVmcs->u64HostCr4.u & X86_CR4_PCIDE))
6284	{ /* likely */ }
6285	else
6286	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pcide);
6287
6288	/* The high 32-bits of RIP MBZ. */
6289	if (!pVmcs->u64HostRip.s.Hi)
6290	{ /* likely */ }
6291	else
6292	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRipRsvd);
6293	}
6294	else
6295	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongMode);
6296	}
6297	}
6298	else
6299	{
6300	/* Host address-space size for 32-bit CPUs. */
6301	if ( !fGstInLongMode
6302	&& !fHostInLongMode)
6303	{ /* likely */ }
6304	else
6305	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongModeNoCpu);
6306	}
6307
6308	NOREF(pszInstr);
6309	NOREF(pszFailure);
6310	return VINF_SUCCESS;
6311	}
6312
6313
6314	/**
6315	* Checks VM-entry controls fields as part of VM-entry.
6316	* See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
6317	*
6318	* @returns VBox status code.
6319	* @param pVCpu The cross context virtual CPU structure.
6320	* @param pszInstr The VMX instruction name (for logging purposes).
6321	*/
6322	IEM_STATIC int iemVmxVmentryCheckEntryCtls(PVMCPU pVCpu, const char *pszInstr)
6323	{
6324	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6325	const char * const pszFailure = "VMFail";
6326
6327	/* VM-entry controls. */
6328	VMXCTLSMSR const EntryCtls = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.EntryCtls;
6329	if (!(~pVmcs->u32EntryCtls & EntryCtls.n.allowed0))
6330	{ /* likely */ }
6331	else
6332	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsDisallowed0);
6333
6334	if (!(pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1))
6335	{ /* likely */ }
6336	else
6337	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsAllowed1);
6338
6339	/* Event injection. */
6340	uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
6341	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
6342	{
6343	/* Type and vector. */
6344	uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
6345	uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
6346	uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
6347	if ( !uRsvd
6348	&& HMVmxIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
6349	&& HMVmxIsEntryIntInfoVectorValid(uVector, uType))
6350	{ /* likely */ }
6351	else
6352	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoTypeVecRsvd);
6353
6354	/* Exception error code. */
6355	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
6356	{
6357	/* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
6358	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
6359	\|\| (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
6360	{ /* likely */ }
6361	else
6362	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodePe);
6363
6364	/* Exceptions that provide an error code. */
6365	if ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
6366	&& ( uVector == X86_XCPT_DF
6367	\|\| uVector == X86_XCPT_TS
6368	\|\| uVector == X86_XCPT_NP
6369	\|\| uVector == X86_XCPT_SS
6370	\|\| uVector == X86_XCPT_GP
6371	\|\| uVector == X86_XCPT_PF
6372	\|\| uVector == X86_XCPT_AC))
6373	{ /* likely */ }
6374	else
6375	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodeVec);
6376
6377	/* Exception error-code reserved bits. */
6378	if (!(pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK))
6379	{ /* likely */ }
6380	else
6381	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryXcptErrCodeRsvd);
6382
6383	/* Injecting a software interrupt, software exception or privileged software exception. */
6384	if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
6385	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
6386	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
6387	{
6388	/* Instruction length must be in the range 0-15. */
6389	if (pVmcs->u32EntryInstrLen <= VMX_ENTRY_INSTR_LEN_MAX)
6390	{ /* likely */ }
6391	else
6392	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLen);
6393
6394	/* Instruction length of 0 is allowed only when its CPU feature is present. */
6395	if ( pVmcs->u32EntryInstrLen == 0
6396	&& !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
6397	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLenZero);
6398	}
6399	}
6400	}
6401
6402	/* VM-entry MSR-load count and VM-entry MSR-load area address. */
6403	if (pVmcs->u32EntryMsrLoadCount)
6404	{
6405	if ( !(pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6406	&& !(pVmcs->u64AddrEntryMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6407	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
6408	{ /* likely */ }
6409	else
6410	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrEntryMsrLoad);
6411	}
6412
6413	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
6414	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
6415
6416	NOREF(pszInstr);
6417	NOREF(pszFailure);
6418	return VINF_SUCCESS;
6419	}
6420
6421
6422	/**
6423	* Checks VM-exit controls fields as part of VM-entry.
6424	* See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
6425	*
6426	* @returns VBox status code.
6427	* @param pVCpu The cross context virtual CPU structure.
6428	* @param pszInstr The VMX instruction name (for logging purposes).
6429	*/
6430	IEM_STATIC int iemVmxVmentryCheckExitCtls(PVMCPU pVCpu, const char *pszInstr)
6431	{
6432	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6433	const char * const pszFailure = "VMFail";
6434
6435	/* VM-exit controls. */
6436	VMXCTLSMSR const ExitCtls = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ExitCtls;
6437	if (!(~pVmcs->u32ExitCtls & ExitCtls.n.allowed0))
6438	{ /* likely */ }
6439	else
6440	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsDisallowed0);
6441
6442	if (!(pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1))
6443	{ /* likely */ }
6444	else
6445	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsAllowed1);
6446
6447	/* Save preemption timer without activating it. */
6448	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
6449	\|\| !(pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
6450	{ /* likely */ }
6451	else
6452	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_SavePreemptTimer);
6453
6454	/* VM-exit MSR-store count and VM-exit MSR-store area address. */
6455	if (pVmcs->u32ExitMsrStoreCount)
6456	{
6457	if ( !(pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
6458	&& !(pVmcs->u64AddrExitMsrStore.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6459	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
6460	{ /* likely */ }
6461	else
6462	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrStore);
6463	}
6464
6465	/* VM-exit MSR-load count and VM-exit MSR-load area address. */
6466	if (pVmcs->u32ExitMsrLoadCount)
6467	{
6468	if ( !(pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6469	&& !(pVmcs->u64AddrExitMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6470	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
6471	{ /* likely */ }
6472	else
6473	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrLoad);
6474	}
6475
6476	NOREF(pszInstr);
6477	NOREF(pszFailure);
6478	return VINF_SUCCESS;
6479	}
6480
6481
6482	/**
6483	* Checks VM-execution controls fields as part of VM-entry.
6484	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6485	*
6486	* @returns VBox status code.
6487	* @param pVCpu The cross context virtual CPU structure.
6488	* @param pszInstr The VMX instruction name (for logging purposes).
6489	*
6490	* @remarks This may update secondary-processor based VM-execution control fields
6491	* in the current VMCS if necessary.
6492	*/
6493	IEM_STATIC int iemVmxVmentryCheckExecCtls(PVMCPU pVCpu, const char *pszInstr)
6494	{
6495	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6496	const char * const pszFailure = "VMFail";
6497
6498	/* Pin-based VM-execution controls. */
6499	{
6500	VMXCTLSMSR const PinCtls = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.PinCtls;
6501	if (!(~pVmcs->u32PinCtls & PinCtls.n.allowed0))
6502	{ /* likely */ }
6503	else
6504	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsDisallowed0);
6505
6506	if (!(pVmcs->u32PinCtls & ~PinCtls.n.allowed1))
6507	{ /* likely */ }
6508	else
6509	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsAllowed1);
6510	}
6511
6512	/* Processor-based VM-execution controls. */
6513	{
6514	VMXCTLSMSR const ProcCtls = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls;
6515	if (!(~pVmcs->u32ProcCtls & ProcCtls.n.allowed0))
6516	{ /* likely */ }
6517	else
6518	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsDisallowed0);
6519
6520	if (!(pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1))
6521	{ /* likely */ }
6522	else
6523	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsAllowed1);
6524	}
6525
6526	/* Secondary processor-based VM-execution controls. */
6527	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
6528	{
6529	VMXCTLSMSR const ProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls2;
6530	if (!(~pVmcs->u32ProcCtls2 & ProcCtls2.n.allowed0))
6531	{ /* likely */ }
6532	else
6533	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Disallowed0);
6534
6535	if (!(pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1))
6536	{ /* likely */ }
6537	else
6538	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Allowed1);
6539	}
6540	else
6541	Assert(!pVmcs->u32ProcCtls2);
6542
6543	/* CR3-target count. */
6544	if (pVmcs->u32Cr3TargetCount <= VMX_V_CR3_TARGET_COUNT)
6545	{ /* likely */ }
6546	else
6547	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Cr3TargetCount);
6548
6549	/* I/O bitmaps physical addresses. */
6550	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
6551	{
6552	if ( !(pVmcs->u64AddrIoBitmapA.u & X86_PAGE_4K_OFFSET_MASK)
6553	&& !(pVmcs->u64AddrIoBitmapA.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6554	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapA.u))
6555	{ /* likely */ }
6556	else
6557	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapA);
6558
6559	if ( !(pVmcs->u64AddrIoBitmapB.u & X86_PAGE_4K_OFFSET_MASK)
6560	&& !(pVmcs->u64AddrIoBitmapB.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6561	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrIoBitmapB.u))
6562	{ /* likely */ }
6563	else
6564	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapB);
6565	}
6566
6567	/* MSR bitmap physical address. */
6568	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
6569	{
6570	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
6571	if ( !(GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
6572	&& !(GCPhysMsrBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6573	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysMsrBitmap))
6574	{ /* likely */ }
6575	else
6576	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrMsrBitmap);
6577
6578	/* Read the MSR bitmap. */
6579	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvMsrBitmap));
6580	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvMsrBitmap),
6581	GCPhysMsrBitmap, VMX_V_MSR_BITMAP_SIZE);
6582	if (RT_SUCCESS(rc))
6583	{ /* likely */ }
6584	else
6585	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrBitmapPtrReadPhys);
6586	}
6587
6588	/* TPR shadow related controls. */
6589	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6590	{
6591	/* Virtual-APIC page physical address. */
6592	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6593	if ( !(GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
6594	&& !(GCPhysVirtApic >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6595	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
6596	{ /* likely */ }
6597	else
6598	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVirtApicPage);
6599
6600	/* TPR threshold without virtual-interrupt delivery. */
6601	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
6602	&& (pVmcs->u32TprThreshold & ~VMX_TPR_THRESHOLD_MASK))
6603	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdRsvd);
6604
6605	/* TPR threshold and VTPR. */
6606	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
6607	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6608	{
6609	/* Read the VTPR from the virtual-APIC page. */
6610	uint8_t u8VTpr;
6611	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &u8VTpr, GCPhysVirtApic + XAPIC_OFF_TPR, sizeof(u8VTpr));
6612	if (RT_SUCCESS(rc))
6613	{ /* likely */ }
6614	else
6615	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtApicPagePtrReadPhys);
6616
6617	/* Bits 3:0 of the TPR-threshold must not be greater than bits 7:4 of VTPR. */
6618	if ((uint8_t)RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) <= (u8VTpr & 0xf0))
6619	{ /* likely */ }
6620	else
6621	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdVTpr);
6622	}
6623	}
6624	else
6625	{
6626	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6627	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6628	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6629	{ /* likely */ }
6630	else
6631	{
6632	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6633	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicTprShadow);
6634	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6635	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ApicRegVirt);
6636	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
6637	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtIntDelivery);
6638	}
6639	}
6640
6641	/* NMI exiting and virtual-NMIs. */
6642	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
6643	\|\| !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
6644	{ /* likely */ }
6645	else
6646	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtNmi);
6647
6648	/* Virtual-NMIs and NMI-window exiting. */
6649	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
6650	\|\| !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
6651	{ /* likely */ }
6652	else
6653	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_NmiWindowExit);
6654
6655	/* Virtualize APIC accesses. */
6656	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
6657	{
6658	/* APIC-access physical address. */
6659	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
6660	if ( !(GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
6661	&& !(GCPhysApicAccess >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6662	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
6663	{ /* likely */ }
6664	else
6665	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccess);
6666
6667	/*
6668	* Disallow APIC-access page and virtual-APIC page from being the same address.
6669	* Note! This is not an Intel requirement, but one imposed by our implementation.
6670	*/
6671	/** @todo r=ramshankar: This is done primarily to simplify recursion scenarios while
6672	* redirecting accesses between the APIC-access page and the virtual-APIC
6673	* page. If any nested hypervisor requires this, we can implement it later. */
6674	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6675	{
6676	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6677	if (GCPhysVirtApic != GCPhysApicAccess)
6678	{ /* likely */ }
6679	else
6680	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessEqVirtApic);
6681	}
6682
6683	/*
6684	* Register the handler for the APIC-access page.
6685	*
6686	* We don't deregister the APIC-access page handler during the VM-exit as a different
6687	* nested-VCPU might be using the same guest-physical address for its APIC-access page.
6688	*
6689	* We leave the page registered until the first access that happens outside VMX non-root
6690	* mode. Guest software is allowed to access structures such as the APIC-access page
6691	* only when no logical processor with a current VMCS references it in VMX non-root mode,
6692	* otherwise it can lead to unpredictable behavior including guest triple-faults.
6693	*
6694	* See Intel spec. 24.11.4 "Software Access to Related Structures".
6695	*/
6696	int rc = PGMHandlerPhysicalRegister(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess, GCPhysApicAccess,
6697	pVCpu->iem.s.hVmxApicAccessPage, NIL_RTR3PTR /* pvUserR3 */,
6698	NIL_RTR0PTR /* pvUserR0 /, NIL_RTRCPTR / pvUserRC /, NULL / pszDesc */);
6699	if (RT_SUCCESS(rc))
6700	{ /* likely */ }
6701	else
6702	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessHandlerReg);
6703	}
6704
6705	/* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
6706	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6707	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
6708	{ /* likely */ }
6709	else
6710	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6711
6712	/* Virtual-interrupt delivery requires external interrupt exiting. */
6713	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
6714	\|\| (pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
6715	{ /* likely */ }
6716	else
6717	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6718
6719	/* VPID. */
6720	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
6721	\|\| pVmcs->u16Vpid != 0)
6722	{ /* likely */ }
6723	else
6724	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Vpid);
6725
6726	Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
6727	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)); /* We don't support EPT yet. */
6728	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
6729	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)); /* We don't support Unrestricted-guests yet. */
6730	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
6731	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_VE)); /* We don't support EPT-violation #VE yet. */
6732	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PAUSE_LOOP_EXIT)); /* We don't support Pause-loop exiting yet. */
6733
6734	/* VMCS shadowing. */
6735	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
6736	{
6737	/* VMREAD-bitmap physical address. */
6738	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
6739	if ( !(GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
6740	&& !(GCPhysVmreadBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6741	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
6742	{ /* likely */ }
6743	else
6744	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmreadBitmap);
6745
6746	/* VMWRITE-bitmap physical address. */
6747	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
6748	if ( !(GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
6749	&& !(GCPhysVmwriteBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6750	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
6751	{ /* likely */ }
6752	else
6753	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmwriteBitmap);
6754
6755	/* Read the VMREAD-bitmap. */
6756	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap));
6757	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap),
6758	GCPhysVmreadBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
6759	if (RT_SUCCESS(rc))
6760	{ /* likely */ }
6761	else
6762	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmreadBitmapPtrReadPhys);
6763
6764	/* Read the VMWRITE-bitmap. */
6765	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap));
6766	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap),
6767	GCPhysVmwriteBitmap, VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
6768	if (RT_SUCCESS(rc))
6769	{ /* likely */ }
6770	else
6771	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmwriteBitmapPtrReadPhys);
6772	}
6773
6774	NOREF(pszInstr);
6775	NOREF(pszFailure);
6776	return VINF_SUCCESS;
6777	}
6778
6779
6780	/**
6781	* Loads the guest control registers, debug register and some MSRs as part of
6782	* VM-entry.
6783	*
6784	* @param pVCpu The cross context virtual CPU structure.
6785	*/
6786	IEM_STATIC void iemVmxVmentryLoadGuestControlRegsMsrs(PVMCPU pVCpu)
6787	{
6788	/*
6789	* Load guest control registers, debug registers and MSRs.
6790	* See Intel spec. 26.3.2.1 "Loading Guest Control Registers, Debug Registers and MSRs".
6791	*/
6792	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6793
6794	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6795	uint64_t const uGstCr0 = (pVmcs->u64GuestCr0.u & ~VMX_ENTRY_CR0_IGNORE_MASK)
6796	\| (pVCpu->cpum.GstCtx.cr0 & VMX_ENTRY_CR0_IGNORE_MASK);
6797	CPUMSetGuestCR0(pVCpu, uGstCr0);
6798	CPUMSetGuestCR4(pVCpu, pVmcs->u64GuestCr4.u);
6799	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64GuestCr3.u;
6800
6801	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
6802	pVCpu->cpum.GstCtx.dr[7] = (pVmcs->u64GuestDr7.u & ~VMX_ENTRY_DR7_MBZ_MASK) \| VMX_ENTRY_DR7_MB1_MASK;
6803
6804	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64GuestSysenterEip.s.Lo;
6805	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64GuestSysenterEsp.s.Lo;
6806	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32GuestSysenterCS;
6807
6808	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6809	{
6810	/* FS base and GS base are loaded while loading the rest of the guest segment registers. */
6811
6812	/* EFER MSR. */
6813	if (!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR))
6814	{
6815	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_EFER);
6816	uint64_t const uHostEfer = pVCpu->cpum.GstCtx.msrEFER;
6817	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6818	bool const fGstPaging = RT_BOOL(uGstCr0 & X86_CR0_PG);
6819	if (fGstInLongMode)
6820	{
6821	/* If the nested-guest is in long mode, LMA and LME are both set. */
6822	Assert(fGstPaging);
6823	pVCpu->cpum.GstCtx.msrEFER = uHostEfer \| (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
6824	}
6825	else
6826	{
6827	/*
6828	* If the nested-guest is outside long mode:
6829	* - With paging: LMA is cleared, LME is cleared.
6830	* - Without paging: LMA is cleared, LME is left unmodified.
6831	*/
6832	uint64_t const fLmaLmeMask = MSR_K6_EFER_LMA \| (fGstPaging ? MSR_K6_EFER_LME : 0);
6833	pVCpu->cpum.GstCtx.msrEFER = uHostEfer & ~fLmaLmeMask;
6834	}
6835	}
6836	/* else: see below. */
6837	}
6838
6839	/* PAT MSR. */
6840	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
6841	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64GuestPatMsr.u;
6842
6843	/* EFER MSR. */
6844	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
6845	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64GuestEferMsr.u;
6846
6847	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6848	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
6849
6850	/* We don't support IA32_BNDCFGS MSR yet. */
6851	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
6852
6853	/* Nothing to do for SMBASE register - We don't support SMM yet. */
6854	}
6855
6856
6857	/**
6858	* Loads the guest segment registers, GDTR, IDTR, LDTR and TR as part of VM-entry.
6859	*
6860	* @param pVCpu The cross context virtual CPU structure.
6861	*/
6862	IEM_STATIC void iemVmxVmentryLoadGuestSegRegs(PVMCPU pVCpu)
6863	{
6864	/*
6865	* Load guest segment registers, GDTR, IDTR, LDTR and TR.
6866	* See Intel spec. 26.3.2.2 "Loading Guest Segment Registers and Descriptor-Table Registers".
6867	*/
6868	/* CS, SS, ES, DS, FS, GS. */
6869	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6870	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
6871	{
6872	PCPUMSELREG pGstSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
6873	CPUMSELREG VmcsSelReg;
6874	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &VmcsSelReg);
6875	AssertRC(rc); NOREF(rc);
6876	if (!(VmcsSelReg.Attr.u & X86DESCATTR_UNUSABLE))
6877	{
6878	pGstSelReg->Sel = VmcsSelReg.Sel;
6879	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6880	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6881	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6882	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6883	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6884	}
6885	else
6886	{
6887	pGstSelReg->Sel = VmcsSelReg.Sel;
6888	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6889	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6890	switch (iSegReg)
6891	{
6892	case X86_SREG_CS:
6893	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6894	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6895	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6896	break;
6897
6898	case X86_SREG_SS:
6899	pGstSelReg->u64Base = VmcsSelReg.u64Base & UINT32_C(0xfffffff0);
6900	pGstSelReg->u32Limit = 0;
6901	pGstSelReg->Attr.u = (VmcsSelReg.Attr.u & X86DESCATTR_DPL) \| X86DESCATTR_D \| X86DESCATTR_UNUSABLE;
6902	break;
6903
6904	case X86_SREG_ES:
6905	case X86_SREG_DS:
6906	pGstSelReg->u64Base = 0;
6907	pGstSelReg->u32Limit = 0;
6908	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6909	break;
6910
6911	case X86_SREG_FS:
6912	case X86_SREG_GS:
6913	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6914	pGstSelReg->u32Limit = 0;
6915	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6916	break;
6917	}
6918	Assert(pGstSelReg->Attr.n.u1Unusable);
6919	}
6920	}
6921
6922	/* LDTR. */
6923	pVCpu->cpum.GstCtx.ldtr.Sel = pVmcs->GuestLdtr;
6924	pVCpu->cpum.GstCtx.ldtr.ValidSel = pVmcs->GuestLdtr;
6925	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
6926	if (!(pVmcs->u32GuestLdtrAttr & X86DESCATTR_UNUSABLE))
6927	{
6928	pVCpu->cpum.GstCtx.ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
6929	pVCpu->cpum.GstCtx.ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
6930	pVCpu->cpum.GstCtx.ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
6931	}
6932	else
6933	{
6934	pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
6935	pVCpu->cpum.GstCtx.ldtr.u32Limit = 0;
6936	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
6937	}
6938
6939	/* TR. */
6940	Assert(!(pVmcs->u32GuestTrAttr & X86DESCATTR_UNUSABLE));
6941	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->GuestTr;
6942	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->GuestTr;
6943	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
6944	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64GuestTrBase.u;
6945	pVCpu->cpum.GstCtx.tr.u32Limit = pVmcs->u32GuestTrLimit;
6946	pVCpu->cpum.GstCtx.tr.Attr.u = pVmcs->u32GuestTrAttr;
6947
6948	/* GDTR. */
6949	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcs->u32GuestGdtrLimit;
6950	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64GuestGdtrBase.u;
6951
6952	/* IDTR. */
6953	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcs->u32GuestIdtrLimit;
6954	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64GuestIdtrBase.u;
6955	}
6956
6957
6958	/**
6959	* Loads the guest MSRs from the VM-entry MSR-load area as part of VM-entry.
6960	*
6961	* @returns VBox status code.
6962	* @param pVCpu The cross context virtual CPU structure.
6963	* @param pszInstr The VMX instruction name (for logging purposes).
6964	*/
6965	IEM_STATIC int iemVmxVmentryLoadGuestAutoMsrs(PVMCPU pVCpu, const char *pszInstr)
6966	{
6967	/*
6968	* Load guest MSRs.
6969	* See Intel spec. 26.4 "Loading MSRs".
6970	*/
6971	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
6972	const char *const pszFailure = "VM-exit";
6973
6974	/*
6975	* The VM-entry MSR-load area address need not be a valid guest-physical address if the
6976	* VM-entry MSR load count is 0. If this is the case, bail early without reading it.
6977	* See Intel spec. 24.8.2 "VM-Entry Controls for MSRs".
6978	*/
6979	uint32_t const cMsrs = pVmcs->u32EntryMsrLoadCount;
6980	if (!cMsrs)
6981	return VINF_SUCCESS;
6982
6983	/*
6984	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count is
6985	* exceeded including possibly raising #MC exceptions during VMX transition. Our
6986	* implementation shall fail VM-entry with an VMX_EXIT_ERR_MSR_LOAD VM-exit.
6987	*/
6988	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
6989	if (fIsMsrCountValid)
6990	{ /* likely */ }
6991	else
6992	{
6993	iemVmxVmcsSetExitQual(pVCpu, VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
6994	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadCount);
6995	}
6996
6997	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
6998	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pEntryMsrLoadArea),
6999	GCPhysVmEntryMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
7000	if (RT_SUCCESS(rc))
7001	{
7002	PCVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pEntryMsrLoadArea);
7003	Assert(pMsr);
7004	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
7005	{
7006	if ( !pMsr->u32Reserved
7007	&& pMsr->u32Msr != MSR_K8_FS_BASE
7008	&& pMsr->u32Msr != MSR_K8_GS_BASE
7009	&& pMsr->u32Msr != MSR_K6_EFER
7010	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
7011	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
7012	{
7013	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
7014	if (rcStrict == VINF_SUCCESS)
7015	continue;
7016
7017	/*
7018	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-entry.
7019	* If any guest hypervisor loads MSRs that require ring-3 handling, we cause a VM-entry failure
7020	* recording the MSR index in the VM-exit qualification (as per the Intel spec.) and indicated
7021	* further by our own, specific diagnostic code. Later, we can try implement handling of the
7022	* MSR in ring-0 if possible, or come up with a better, generic solution.
7023	*/
7024	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7025	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
7026	? kVmxVDiag_Vmentry_MsrLoadRing3
7027	: kVmxVDiag_Vmentry_MsrLoad;
7028	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
7029	}
7030	else
7031	{
7032	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7033	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadRsvd);
7034	}
7035	}
7036	}
7037	else
7038	{
7039	AssertMsgFailed(("%s: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmEntryMsrLoadArea, rc));
7040	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadPtrReadPhys);
7041	}
7042
7043	NOREF(pszInstr);
7044	NOREF(pszFailure);
7045	return VINF_SUCCESS;
7046	}
7047
7048
7049	/**
7050	* Loads the guest-state non-register state as part of VM-entry.
7051	*
7052	* @returns VBox status code.
7053	* @param pVCpu The cross context virtual CPU structure.
7054	*
7055	* @remarks This must be called only after loading the nested-guest register state
7056	* (especially nested-guest RIP).
7057	*/
7058	IEM_STATIC void iemVmxVmentryLoadGuestNonRegState(PVMCPU pVCpu)
7059	{
7060	/*
7061	* Load guest non-register state.
7062	* See Intel spec. 26.6 "Special Features of VM Entry"
7063	*/
7064	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7065
7066	/*
7067	* If VM-entry is not vectoring, block-by-STI and block-by-MovSS state must be loaded.
7068	* If VM-entry is vectoring, there is no block-by-STI or block-by-MovSS.
7069	*
7070	* See Intel spec. 26.6.1 "Interruptibility State".
7071	*/
7072	bool const fEntryVectoring = HMVmxIsVmentryVectoring(pVmcs->u32EntryIntInfo, NULL /* puEntryIntInfoType */);
7073	if ( !fEntryVectoring
7074	&& (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI \| VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)))
7075	EMSetInhibitInterruptsPC(pVCpu, pVmcs->u64GuestRip.u);
7076	else if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
7077	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
7078
7079	/* NMI blocking. */
7080	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI)
7081	{
7082	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
7083	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
7084	else
7085	{
7086	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7087	if (!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS))
7088	VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
7089	}
7090	}
7091	else
7092	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7093
7094	/* SMI blocking is irrelevant. We don't support SMIs yet. */
7095
7096	/* Loading PDPTEs will be taken care when we switch modes. We don't support EPT yet. */
7097	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT));
7098
7099	/* VPID is irrelevant. We don't support VPID yet. */
7100
7101	/* Clear address-range monitoring. */
7102	EMMonitorWaitClear(pVCpu);
7103	}
7104
7105
7106	/**
7107	* Loads the guest-state as part of VM-entry.
7108	*
7109	* @returns VBox status code.
7110	* @param pVCpu The cross context virtual CPU structure.
7111	* @param pszInstr The VMX instruction name (for logging purposes).
7112	*
7113	* @remarks This must be done after all the necessary steps prior to loading of
7114	* guest-state (e.g. checking various VMCS state).
7115	*/
7116	IEM_STATIC int iemVmxVmentryLoadGuestState(PVMCPU pVCpu, const char *pszInstr)
7117	{
7118	iemVmxVmentryLoadGuestControlRegsMsrs(pVCpu);
7119	iemVmxVmentryLoadGuestSegRegs(pVCpu);
7120
7121	/*
7122	* Load guest RIP, RSP and RFLAGS.
7123	* See Intel spec. 26.3.2.3 "Loading Guest RIP, RSP and RFLAGS".
7124	*/
7125	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7126	pVCpu->cpum.GstCtx.rsp = pVmcs->u64GuestRsp.u;
7127	pVCpu->cpum.GstCtx.rip = pVmcs->u64GuestRip.u;
7128	pVCpu->cpum.GstCtx.rflags.u = pVmcs->u64GuestRFlags.u;
7129
7130	/* Initialize the PAUSE-loop controls as part of VM-entry. */
7131	pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick = 0;
7132	pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick = 0;
7133
7134	iemVmxVmentryLoadGuestNonRegState(pVCpu);
7135
7136	NOREF(pszInstr);
7137	return VINF_SUCCESS;
7138	}
7139
7140
7141	/**
7142	* Returns whether there are is a pending debug exception on VM-entry.
7143	*
7144	* @param pVCpu The cross context virtual CPU structure.
7145	* @param pszInstr The VMX instruction name (for logging purposes).
7146	*/
7147	IEM_STATIC bool iemVmxVmentryIsPendingDebugXcpt(PVMCPU pVCpu, const char *pszInstr)
7148	{
7149	/*
7150	* Pending debug exceptions.
7151	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7152	*/
7153	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7154	Assert(pVmcs);
7155
7156	bool fPendingDbgXcpt = RT_BOOL(pVmcs->u64GuestPendingDbgXcpt.u & ( VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS
7157	\| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP));
7158	if (fPendingDbgXcpt)
7159	{
7160	uint8_t uEntryIntInfoType;
7161	bool const fEntryVectoring = HMVmxIsVmentryVectoring(pVmcs->u32EntryIntInfo, &uEntryIntInfoType);
7162	if (fEntryVectoring)
7163	{
7164	switch (uEntryIntInfoType)
7165	{
7166	case VMX_ENTRY_INT_INFO_TYPE_EXT_INT:
7167	case VMX_ENTRY_INT_INFO_TYPE_NMI:
7168	case VMX_ENTRY_INT_INFO_TYPE_HW_XCPT:
7169	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7170	fPendingDbgXcpt = false;
7171	break;
7172
7173	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7174	{
7175	/*
7176	* Whether the pending debug exception for software exceptions other than
7177	* #BP and #OF is delivered after injecting the exception or is discard
7178	* is CPU implementation specific. We will discard them (easier).
7179	*/
7180	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
7181	if ( uVector != X86_XCPT_BP
7182	&& uVector != X86_XCPT_OF)
7183	fPendingDbgXcpt = false;
7184	RT_FALL_THRU();
7185	}
7186	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7187	{
7188	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
7189	fPendingDbgXcpt = false;
7190	break;
7191	}
7192	}
7193	}
7194	else
7195	{
7196	/*
7197	* When the VM-entry is not vectoring but there is blocking-by-MovSS, whether the
7198	* pending debug exception is held pending or is discarded is CPU implementation
7199	* specific. We will discard them (easier).
7200	*/
7201	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
7202	fPendingDbgXcpt = false;
7203
7204	/* There's no pending debug exception in the shutdown or wait-for-SIPI state. */
7205	if (pVmcs->u32GuestActivityState & (VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN \| VMX_VMCS_GUEST_ACTIVITY_SIPI_WAIT))
7206	fPendingDbgXcpt = false;
7207	}
7208	}
7209
7210	NOREF(pszInstr);
7211	return fPendingDbgXcpt;
7212	}
7213
7214
7215	/**
7216	* Set up the monitor-trap flag (MTF).
7217	*
7218	* @param pVCpu The cross context virtual CPU structure.
7219	* @param pszInstr The VMX instruction name (for logging purposes).
7220	*/
7221	IEM_STATIC void iemVmxVmentrySetupMtf(PVMCPU pVCpu, const char *pszInstr)
7222	{
7223	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7224	Assert(pVmcs);
7225	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_MONITOR_TRAP_FLAG)
7226	{
7227	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7228	Log(("%s: Monitor-trap flag set on VM-entry\n", pszInstr));
7229	}
7230	else
7231	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
7232	NOREF(pszInstr);
7233	}
7234
7235
7236	/**
7237	* Set up the VMX-preemption timer.
7238	*
7239	* @param pVCpu The cross context virtual CPU structure.
7240	* @param pszInstr The VMX instruction name (for logging purposes).
7241	*/
7242	IEM_STATIC void iemVmxVmentrySetupPreemptTimer(PVMCPU pVCpu, const char *pszInstr)
7243	{
7244	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7245	Assert(pVmcs);
7246	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
7247	{
7248	uint64_t const uEntryTick = TMCpuTickGetNoCheck(pVCpu);
7249	pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick = uEntryTick;
7250	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER);
7251
7252	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64\n", pszInstr, uEntryTick));
7253	}
7254	else
7255	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
7256
7257	NOREF(pszInstr);
7258	}
7259
7260
7261	/**
7262	* Injects an event using TRPM given a VM-entry interruption info. and related
7263	* fields.
7264	*
7265	* @returns VBox status code.
7266	* @param pVCpu The cross context virtual CPU structure.
7267	* @param uEntryIntInfo The VM-entry interruption info.
7268	* @param uErrCode The error code associated with the event if any.
7269	* @param cbInstr The VM-entry instruction length (for software
7270	* interrupts and software exceptions). Pass 0
7271	* otherwise.
7272	* @param GCPtrFaultAddress The guest CR2 if this is a \#PF event.
7273	*/
7274	IEM_STATIC int iemVmxVmentryInjectTrpmEvent(PVMCPU pVCpu, uint32_t uEntryIntInfo, uint32_t uErrCode, uint32_t cbInstr,
7275	RTGCUINTPTR GCPtrFaultAddress)
7276	{
7277	Assert(VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo));
7278
7279	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo);
7280	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo);
7281	bool const fErrCodeValid = VMX_ENTRY_INT_INFO_IS_ERROR_CODE_VALID(uEntryIntInfo);
7282
7283	TRPMEVENT enmTrapType;
7284	switch (uType)
7285	{
7286	case VMX_ENTRY_INT_INFO_TYPE_EXT_INT:
7287	enmTrapType = TRPM_HARDWARE_INT;
7288	break;
7289
7290	case VMX_ENTRY_INT_INFO_TYPE_NMI:
7291	case VMX_ENTRY_INT_INFO_TYPE_HW_XCPT:
7292	enmTrapType = TRPM_TRAP;
7293	break;
7294
7295	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7296	enmTrapType = TRPM_SOFTWARE_INT;
7297	break;
7298
7299	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT: /* #BP and #OF */
7300	Assert(uVector == X86_XCPT_BP \|\| uVector == X86_XCPT_OF);
7301	enmTrapType = TRPM_SOFTWARE_INT;
7302	break;
7303
7304	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT: /* #DB (INT1/ICEBP). */
7305	Assert(uVector == X86_XCPT_DB);
7306	enmTrapType = TRPM_SOFTWARE_INT;
7307	break;
7308
7309	default:
7310	/* Shouldn't really happen. */
7311	AssertMsgFailedReturn(("Invalid trap type %#x\n", uType), VERR_VMX_IPE_4);
7312	break;
7313	}
7314
7315	int rc = TRPMAssertTrap(pVCpu, uVector, enmTrapType);
7316	AssertRCReturn(rc, rc);
7317
7318	if (fErrCodeValid)
7319	TRPMSetErrorCode(pVCpu, uErrCode);
7320
7321	if ( enmTrapType == TRPM_TRAP
7322	&& uVector == X86_XCPT_PF)
7323	TRPMSetFaultAddress(pVCpu, GCPtrFaultAddress);
7324	else if (enmTrapType == TRPM_SOFTWARE_INT)
7325	TRPMSetInstrLength(pVCpu, cbInstr);
7326
7327	return VINF_SUCCESS;
7328	}
7329
7330
7331	/**
7332	* Performs event injection (if any) as part of VM-entry.
7333	*
7334	* @param pVCpu The cross context virtual CPU structure.
7335	* @param pszInstr The VMX instruction name (for logging purposes).
7336	*/
7337	IEM_STATIC int iemVmxVmentryInjectEvent(PVMCPU pVCpu, const char *pszInstr)
7338	{
7339	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7340
7341	/*
7342	* Inject events.
7343	* The event that is going to be made pending for injection is not subject to VMX intercepts,
7344	* thus we flag ignoring of intercepts. However, recursive exceptions if any during delivery
7345	* of the current event -are- subject to intercepts, hence this flag will be flipped during
7346	* the actually delivery of this event.
7347	*
7348	* See Intel spec. 26.5 "Event Injection".
7349	*/
7350	uint32_t const uEntryIntInfo = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->u32EntryIntInfo;
7351	bool const fEntryIntInfoValid = VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo);
7352
7353	pVCpu->cpum.GstCtx.hwvirt.vmx.fInterceptEvents = !fEntryIntInfoValid;
7354	if (fEntryIntInfoValid)
7355	{
7356	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo);
7357	if (uType == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT)
7358	{
7359	Assert(VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo) == VMX_ENTRY_INT_INFO_VECTOR_MTF);
7360	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7361	return VINF_SUCCESS;
7362	}
7363
7364	int rc = iemVmxVmentryInjectTrpmEvent(pVCpu, uEntryIntInfo, pVmcs->u32EntryXcptErrCode, pVmcs->u32EntryInstrLen,
7365	pVCpu->cpum.GstCtx.cr2);
7366	if (RT_SUCCESS(rc))
7367	{
7368	/*
7369	* We need to clear the VM-entry interruption information field's valid bit on VM-exit.
7370	*
7371	* However, we do it here on VM-entry because while it continues to not be visible to
7372	* guest software until VM-exit, when HM looks at the VMCS to continue nested-guest
7373	* execution using hardware-assisted VT-x, it can simply copy the VM-entry interruption
7374	* information field.
7375	*
7376	* See Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
7377	*/
7378	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
7379	}
7380	return rc;
7381	}
7382
7383	/*
7384	* Inject any pending guest debug exception.
7385	* Unlike injecting events, this #DB injection on VM-entry is subject to #DB VMX intercept.
7386	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7387	*/
7388	bool const fPendingDbgXcpt = iemVmxVmentryIsPendingDebugXcpt(pVCpu, pszInstr);
7389	if (fPendingDbgXcpt)
7390	{
7391	uint32_t const uDbgXcptInfo = RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VECTOR, X86_XCPT_DB)
7392	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_TYPE, VMX_ENTRY_INT_INFO_TYPE_HW_XCPT)
7393	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VALID, 1);
7394	return iemVmxVmentryInjectTrpmEvent(pVCpu, uDbgXcptInfo, 0 /* uErrCode */, pVmcs->u32EntryInstrLen,
7395	0 /* GCPtrFaultAddress */);
7396	}
7397
7398	NOREF(pszInstr);
7399	return VINF_SUCCESS;
7400	}
7401
7402
7403	/**
7404	* Initializes all read-only VMCS fields as part of VM-entry.
7405	*
7406	* @param pVCpu The cross context virtual CPU structure.
7407	*/
7408	IEM_STATIC void iemVmxVmentryInitReadOnlyFields(PVMCPU pVCpu)
7409	{
7410	/*
7411	* Any VMCS field which we do not establish on every VM-exit but may potentially
7412	* be used on the VM-exit path of a nested hypervisor -and- is not explicitly
7413	* specified to be undefined needs to be initialized here.
7414	*
7415	* Thus, it is especially important to clear the VM-exit qualification field
7416	* since it must be zero for VM-exits where it is not used. Similarly, the
7417	* VM-exit interruption information field's valid bit needs to be cleared for
7418	* the same reasons.
7419	*/
7420	PVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7421	Assert(pVmcs);
7422
7423	/* 16-bit (none currently). */
7424	/* 32-bit. */
7425	pVmcs->u32RoVmInstrError = 0;
7426	pVmcs->u32RoExitReason = 0;
7427	pVmcs->u32RoExitIntInfo = 0;
7428	pVmcs->u32RoExitIntErrCode = 0;
7429	pVmcs->u32RoIdtVectoringInfo = 0;
7430	pVmcs->u32RoIdtVectoringErrCode = 0;
7431	pVmcs->u32RoExitInstrLen = 0;
7432	pVmcs->u32RoExitInstrInfo = 0;
7433
7434	/* 64-bit. */
7435	pVmcs->u64RoGuestPhysAddr.u = 0;
7436
7437	/* Natural-width. */
7438	pVmcs->u64RoExitQual.u = 0;
7439	pVmcs->u64RoIoRcx.u = 0;
7440	pVmcs->u64RoIoRsi.u = 0;
7441	pVmcs->u64RoIoRdi.u = 0;
7442	pVmcs->u64RoIoRip.u = 0;
7443	pVmcs->u64RoGuestLinearAddr.u = 0;
7444	}
7445
7446
7447	/**
7448	* VMLAUNCH/VMRESUME instruction execution worker.
7449	*
7450	* @returns Strict VBox status code.
7451	* @param pVCpu The cross context virtual CPU structure.
7452	* @param cbInstr The instruction length in bytes.
7453	* @param uInstrId The instruction identity (VMXINSTRID_VMLAUNCH or
7454	* VMXINSTRID_VMRESUME).
7455	*
7456	* @remarks Common VMX instruction checks are already expected to by the caller,
7457	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
7458	*/
7459	IEM_STATIC VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPU pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId)
7460	{
7461	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
7462	RT_NOREF3(pVCpu, cbInstr, uInstrId);
7463	return VINF_EM_RAW_EMULATE_INSTR;
7464	# else
7465	Assert( uInstrId == VMXINSTRID_VMLAUNCH
7466	\|\| uInstrId == VMXINSTRID_VMRESUME);
7467	const char *pszInstr = uInstrId == VMXINSTRID_VMRESUME ? "vmresume" : "vmlaunch";
7468
7469	/* Nested-guest intercept. */
7470	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7471	return iemVmxVmexitInstr(pVCpu, uInstrId == VMXINSTRID_VMRESUME ? VMX_EXIT_VMRESUME : VMX_EXIT_VMLAUNCH, cbInstr);
7472
7473	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
7474
7475	/*
7476	* Basic VM-entry checks.
7477	* The order of the CPL, current and shadow VMCS and block-by-MovSS are important.
7478	* The checks following that do not have to follow a specific order.
7479	*
7480	* See Intel spec. 26.1 "Basic VM-entry Checks".
7481	*/
7482
7483	/* CPL. */
7484	if (pVCpu->iem.s.uCpl == 0)
7485	{ /* likely */ }
7486	else
7487	{
7488	Log(("%s: CPL %u -> #GP(0)\n", pszInstr, pVCpu->iem.s.uCpl));
7489	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_Cpl;
7490	return iemRaiseGeneralProtectionFault0(pVCpu);
7491	}
7492
7493	/* Current VMCS valid. */
7494	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
7495	{ /* likely */ }
7496	else
7497	{
7498	Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7499	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrInvalid;
7500	iemVmxVmFailInvalid(pVCpu);
7501	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7502	return VINF_SUCCESS;
7503	}
7504
7505	/* Current VMCS is not a shadow VMCS. */
7506	if (!pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->u32VmcsRevId.n.fIsShadowVmcs)
7507	{ /* likely */ }
7508	else
7509	{
7510	Log(("%s: VMCS pointer %#RGp is a shadow VMCS -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7511	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrShadowVmcs;
7512	iemVmxVmFailInvalid(pVCpu);
7513	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7514	return VINF_SUCCESS;
7515	}
7516
7517	/** @todo Distinguish block-by-MovSS from block-by-STI. Currently we
7518	* use block-by-STI here which is not quite correct. */
7519	if ( !VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
7520	\|\| pVCpu->cpum.GstCtx.rip != EMGetInhibitInterruptsPC(pVCpu))
7521	{ /* likely */ }
7522	else
7523	{
7524	Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
7525	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_BlocKMovSS;
7526	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
7527	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7528	return VINF_SUCCESS;
7529	}
7530
7531	if (uInstrId == VMXINSTRID_VMLAUNCH)
7532	{
7533	/* VMLAUNCH with non-clear VMCS. */
7534	if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR)
7535	{ /* likely */ }
7536	else
7537	{
7538	Log(("vmlaunch: VMLAUNCH with non-clear VMCS -> VMFail\n"));
7539	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsClear;
7540	iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
7541	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7542	return VINF_SUCCESS;
7543	}
7544	}
7545	else
7546	{
7547	/* VMRESUME with non-launched VMCS. */
7548	if (pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState == VMX_V_VMCS_LAUNCH_STATE_LAUNCHED)
7549	{ /* likely */ }
7550	else
7551	{
7552	Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
7553	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsLaunch;
7554	iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
7555	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7556	return VINF_SUCCESS;
7557	}
7558	}
7559
7560	/*
7561	* We are allowed to cache VMCS related data structures (such as I/O bitmaps, MSR bitmaps)
7562	* while entering VMX non-root mode. We do some of this while checking VM-execution
7563	* controls. The guest hypervisor should not make assumptions and cannot expect
7564	* predictable behavior if changes to these structures are made in guest memory while
7565	* executing in VMX non-root mode. As far as VirtualBox is concerned, the guest cannot
7566	* modify them anyway as we cache them in host memory. We are trade memory for speed here.
7567	*
7568	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7569	*/
7570	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
7571	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
7572	int rc = iemVmxVmentryCheckExecCtls(pVCpu, pszInstr);
7573	if (RT_SUCCESS(rc))
7574	{
7575	rc = iemVmxVmentryCheckExitCtls(pVCpu, pszInstr);
7576	if (RT_SUCCESS(rc))
7577	{
7578	rc = iemVmxVmentryCheckEntryCtls(pVCpu, pszInstr);
7579	if (RT_SUCCESS(rc))
7580	{
7581	rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
7582	if (RT_SUCCESS(rc))
7583	{
7584	/* Initialize read-only VMCS fields before VM-entry since we don't update all of them for every VM-exit. */
7585	iemVmxVmentryInitReadOnlyFields(pVCpu);
7586
7587	/*
7588	* Blocking of NMIs need to be restored if VM-entry fails due to invalid-guest state.
7589	* So we save the the VMCPU_FF_BLOCK_NMI force-flag here so we can restore it on
7590	* VM-exit when required.
7591	* See Intel spec. 26.7 "VM-entry Failures During or After Loading Guest State"
7592	*/
7593	iemVmxVmentrySaveNmiBlockingFF(pVCpu);
7594
7595	rc = iemVmxVmentryCheckGuestState(pVCpu, pszInstr);
7596	if (RT_SUCCESS(rc))
7597	{
7598	rc = iemVmxVmentryLoadGuestState(pVCpu, pszInstr);
7599	if (RT_SUCCESS(rc))
7600	{
7601	rc = iemVmxVmentryLoadGuestAutoMsrs(pVCpu, pszInstr);
7602	if (RT_SUCCESS(rc))
7603	{
7604	Assert(rc != VINF_CPUM_R3_MSR_WRITE);
7605
7606	/* VMLAUNCH instruction must update the VMCS launch state. */
7607	if (uInstrId == VMXINSTRID_VMLAUNCH)
7608	pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState = VMX_V_VMCS_LAUNCH_STATE_LAUNCHED;
7609
7610	/* Perform the VMX transition (PGM updates). */
7611	VBOXSTRICTRC rcStrict = iemVmxWorldSwitch(pVCpu);
7612	if (rcStrict == VINF_SUCCESS)
7613	{ /* likely */ }
7614	else if (RT_SUCCESS(rcStrict))
7615	{
7616	Log3(("%s: iemVmxWorldSwitch returns %Rrc -> Setting passup status\n", pszInstr,
7617	VBOXSTRICTRC_VAL(rcStrict)));
7618	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7619	}
7620	else
7621	{
7622	Log3(("%s: iemVmxWorldSwitch failed! rc=%Rrc\n", pszInstr, VBOXSTRICTRC_VAL(rcStrict)));
7623	return rcStrict;
7624	}
7625
7626	/* We've now entered nested-guest execution. */
7627	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = true;
7628
7629	/*
7630	* The priority of potential VM-exits during VM-entry is important.
7631	* The priorities of VM-exits and events are listed from highest
7632	* to lowest as follows:
7633	*
7634	* 1. Event injection.
7635	* 2. Trap on task-switch (T flag set in TSS).
7636	* 3. TPR below threshold / APIC-write.
7637	* 4. SMI, INIT.
7638	* 5. MTF exit.
7639	* 6. Debug-trap exceptions (EFLAGS.TF), pending debug exceptions.
7640	* 7. VMX-preemption timer.
7641	* 9. NMI-window exit.
7642	* 10. NMI injection.
7643	* 11. Interrupt-window exit.
7644	* 12. Virtual-interrupt injection.
7645	* 13. Interrupt injection.
7646	* 14. Process next instruction (fetch, decode, execute).
7647	*/
7648
7649	/* Setup the VMX-preemption timer. */
7650	iemVmxVmentrySetupPreemptTimer(pVCpu, pszInstr);
7651
7652	/* Setup monitor-trap flag. */
7653	iemVmxVmentrySetupMtf(pVCpu, pszInstr);
7654
7655	/* Now that we've switched page tables, we can go ahead and inject any event. */
7656	rcStrict = iemVmxVmentryInjectEvent(pVCpu, pszInstr);
7657	if (RT_SUCCESS(rcStrict))
7658	{
7659	/* Reschedule to IEM-only execution of the nested-guest or return VINF_SUCCESS. */
7660	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
7661	Log(("%s: Enabling IEM-only EM execution policy!\n", pszInstr));
7662	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
7663	if (rcSched != VINF_SUCCESS)
7664	iemSetPassUpStatus(pVCpu, rcSched);
7665	# endif
7666	return VINF_SUCCESS;
7667	}
7668
7669	Log(("%s: VM-entry event injection failed. rc=%Rrc\n", pszInstr, VBOXSTRICTRC_VAL(rcStrict)));
7670	return rcStrict;
7671	}
7672	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_MSR_LOAD \| VMX_EXIT_REASON_ENTRY_FAILED);
7673	}
7674	}
7675	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_INVALID_GUEST_STATE \| VMX_EXIT_REASON_ENTRY_FAILED);
7676	}
7677
7678	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
7679	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7680	return VINF_SUCCESS;
7681	}
7682	}
7683	}
7684
7685	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
7686	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7687	return VINF_SUCCESS;
7688	# endif
7689	}
7690
7691
7692	/**
7693	* Checks whether an RDMSR or WRMSR instruction for the given MSR is intercepted
7694	* (causes a VM-exit) or not.
7695	*
7696	* @returns @c true if the instruction is intercepted, @c false otherwise.
7697	* @param pVCpu The cross context virtual CPU structure.
7698	* @param uExitReason The VM-exit reason (VMX_EXIT_RDMSR or
7699	* VMX_EXIT_WRMSR).
7700	* @param idMsr The MSR.
7701	*/
7702	IEM_STATIC bool iemVmxIsRdmsrWrmsrInterceptSet(PCVMCPU pVCpu, uint32_t uExitReason, uint32_t idMsr)
7703	{
7704	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
7705	Assert( uExitReason == VMX_EXIT_RDMSR
7706	\|\| uExitReason == VMX_EXIT_WRMSR);
7707
7708	/* Consult the MSR bitmap if the feature is supported. */
7709	PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7710	Assert(pVmcs);
7711	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
7712	{
7713	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvMsrBitmap));
7714	uint32_t const fMsrpm = CPUMGetVmxMsrPermission(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvMsrBitmap), idMsr);
7715	if (uExitReason == VMX_EXIT_RDMSR)
7716	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_RD);
7717	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_WR);
7718	}
7719
7720	/* Without MSR bitmaps, all MSR accesses are intercepted. */
7721	return true;
7722	}
7723
7724
7725	/**
7726	* Checks whether a VMREAD or VMWRITE instruction for the given VMCS field is
7727	* intercepted (causes a VM-exit) or not.
7728	*
7729	* @returns @c true if the instruction is intercepted, @c false otherwise.
7730	* @param pVCpu The cross context virtual CPU structure.
7731	* @param u64FieldEnc The VMCS field encoding.
7732	* @param uExitReason The VM-exit reason (VMX_EXIT_VMREAD or
7733	* VMX_EXIT_VMREAD).
7734	*/
7735	IEM_STATIC bool iemVmxIsVmreadVmwriteInterceptSet(PCVMCPU pVCpu, uint32_t uExitReason, uint64_t u64FieldEnc)
7736	{
7737	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
7738	Assert( uExitReason == VMX_EXIT_VMREAD
7739	\|\| uExitReason == VMX_EXIT_VMWRITE);
7740
7741	/* Without VMCS shadowing, all VMREAD and VMWRITE instructions are intercepted. */
7742	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing)
7743	return true;
7744
7745	/*
7746	* If any reserved bit in the 64-bit VMCS field encoding is set, the VMREAD/VMWRITE is intercepted.
7747	* This excludes any reserved bits in the valid parts of the field encoding (i.e. bit 12).
7748	*/
7749	if (u64FieldEnc & VMX_VMCS_ENC_RSVD_MASK)
7750	return true;
7751
7752	/* Finally, consult the VMREAD/VMWRITE bitmap whether to intercept the instruction or not. */
7753	uint32_t const u32FieldEnc = RT_LO_U32(u64FieldEnc);
7754	Assert(u32FieldEnc >> 3 < VMX_V_VMREAD_VMWRITE_BITMAP_SIZE);
7755	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap));
7756	uint8_t const *pbBitmap = uExitReason == VMX_EXIT_VMREAD
7757	? (uint8_t const *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmreadBitmap)
7758	: (uint8_t const *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvVmwriteBitmap);
7759	pbBitmap += (u32FieldEnc >> 3);
7760	if (*pbBitmap & RT_BIT(u32FieldEnc & 7))
7761	return true;
7762
7763	return false;
7764	}
7765
7766
7767	/**
7768	* VMREAD common (memory/register) instruction execution worker
7769	*
7770	* @returns Strict VBox status code.
7771	* @param pVCpu The cross context virtual CPU structure.
7772	* @param cbInstr The instruction length in bytes.
7773	* @param pu64Dst Where to write the VMCS value (only updated when
7774	* VINF_SUCCESS is returned).
7775	* @param u64FieldEnc The VMCS field encoding.
7776	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
7777	* be NULL.
7778	*/
7779	IEM_STATIC VBOXSTRICTRC iemVmxVmreadCommon(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
7780	PCVMXVEXITINFO pExitInfo)
7781	{
7782	/* Nested-guest intercept. */
7783	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7784	&& iemVmxIsVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMREAD, u64FieldEnc))
7785	{
7786	if (pExitInfo)
7787	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
7788	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMREAD, VMXINSTRID_VMREAD, cbInstr);
7789	}
7790
7791	/* CPL. */
7792	if (pVCpu->iem.s.uCpl == 0)
7793	{ /* likely */ }
7794	else
7795	{
7796	Log(("vmread: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
7797	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_Cpl;
7798	return iemRaiseGeneralProtectionFault0(pVCpu);
7799	}
7800
7801	/* VMCS pointer in root mode. */
7802	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
7803	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
7804	{ /* likely */ }
7805	else
7806	{
7807	Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7808	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrInvalid;
7809	iemVmxVmFailInvalid(pVCpu);
7810	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7811	return VINF_SUCCESS;
7812	}
7813
7814	/* VMCS-link pointer in non-root mode. */
7815	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7816	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
7817	{ /* likely */ }
7818	else
7819	{
7820	Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
7821	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_LinkPtrInvalid;
7822	iemVmxVmFailInvalid(pVCpu);
7823	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7824	return VINF_SUCCESS;
7825	}
7826
7827	/* Supported VMCS field. */
7828	if (iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
7829	{ /* likely */ }
7830	else
7831	{
7832	Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
7833	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_FieldInvalid;
7834	iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
7835	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7836	return VINF_SUCCESS;
7837	}
7838
7839	/*
7840	* Setup reading from the current or shadow VMCS.
7841	*/
7842	uint8_t *pbVmcs;
7843	if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7844	pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
7845	else
7846	pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
7847	Assert(pbVmcs);
7848
7849	VMXVMCSFIELDENC FieldEnc;
7850	FieldEnc.u = u64FieldEnc;
7851	uint8_t const uWidth = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_WIDTH);
7852	uint8_t const uType = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_TYPE);
7853	uint8_t const uWidthType = (uWidth << 2) \| uType;
7854	uint8_t const uIndex = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_INDEX);
7855	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
7856	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
7857	Assert(offField < VMX_V_VMCS_SIZE);
7858
7859	/*
7860	* Read the VMCS component based on the field's effective width.
7861	*
7862	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
7863	* indicates high bits (little endian).
7864	*
7865	* Note! The caller is responsible to trim the result and update registers
7866	* or memory locations are required. Here we just zero-extend to the largest
7867	* type (i.e. 64-bits).
7868	*/
7869	uint8_t *pbField = pbVmcs + offField;
7870	uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
7871	switch (uEffWidth)
7872	{
7873	case VMX_VMCS_ENC_WIDTH_64BIT:
7874	case VMX_VMCS_ENC_WIDTH_NATURAL: pu64Dst = (uint64_t *)pbField; break;
7875	case VMX_VMCS_ENC_WIDTH_32BIT: pu64Dst = (uint32_t *)pbField; break;
7876	case VMX_VMCS_ENC_WIDTH_16BIT: pu64Dst = (uint16_t *)pbField; break;
7877	}
7878	return VINF_SUCCESS;
7879	}
7880
7881
7882	/**
7883	* VMREAD (64-bit register) instruction execution worker.
7884	*
7885	* @returns Strict VBox status code.
7886	* @param pVCpu The cross context virtual CPU structure.
7887	* @param cbInstr The instruction length in bytes.
7888	* @param pu64Dst Where to store the VMCS field's value.
7889	* @param u64FieldEnc The VMCS field encoding.
7890	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
7891	* be NULL.
7892	*/
7893	IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg64(PVMCPU pVCpu, uint8_t cbInstr, uint64_t *pu64Dst, uint64_t u64FieldEnc,
7894	PCVMXVEXITINFO pExitInfo)
7895	{
7896	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
7897	if (rcStrict == VINF_SUCCESS)
7898	{
7899	iemVmxVmreadSuccess(pVCpu, cbInstr);
7900	return VINF_SUCCESS;
7901	}
7902
7903	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
7904	return rcStrict;
7905	}
7906
7907
7908	/**
7909	* VMREAD (32-bit register) instruction execution worker.
7910	*
7911	* @returns Strict VBox status code.
7912	* @param pVCpu The cross context virtual CPU structure.
7913	* @param cbInstr The instruction length in bytes.
7914	* @param pu32Dst Where to store the VMCS field's value.
7915	* @param u32FieldEnc The VMCS field encoding.
7916	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
7917	* be NULL.
7918	*/
7919	IEM_STATIC VBOXSTRICTRC iemVmxVmreadReg32(PVMCPU pVCpu, uint8_t cbInstr, uint32_t *pu32Dst, uint64_t u32FieldEnc,
7920	PCVMXVEXITINFO pExitInfo)
7921	{
7922	uint64_t u64Dst;
7923	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32FieldEnc, pExitInfo);
7924	if (rcStrict == VINF_SUCCESS)
7925	{
7926	*pu32Dst = u64Dst;
7927	iemVmxVmreadSuccess(pVCpu, cbInstr);
7928	return VINF_SUCCESS;
7929	}
7930
7931	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
7932	return rcStrict;
7933	}
7934
7935
7936	/**
7937	* VMREAD (memory) instruction execution worker.
7938	*
7939	* @returns Strict VBox status code.
7940	* @param pVCpu The cross context virtual CPU structure.
7941	* @param cbInstr The instruction length in bytes.
7942	* @param iEffSeg The effective segment register to use with @a u64Val.
7943	* Pass UINT8_MAX if it is a register access.
7944	* @param enmEffAddrMode The effective addressing mode (only used with memory
7945	* operand).
7946	* @param GCPtrDst The guest linear address to store the VMCS field's
7947	* value.
7948	* @param u64FieldEnc The VMCS field encoding.
7949	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
7950	* be NULL.
7951	*/
7952	IEM_STATIC VBOXSTRICTRC iemVmxVmreadMem(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode,
7953	RTGCPTR GCPtrDst, uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
7954	{
7955	uint64_t u64Dst;
7956	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64FieldEnc, pExitInfo);
7957	if (rcStrict == VINF_SUCCESS)
7958	{
7959	/*
7960	* Write the VMCS field's value to the location specified in guest-memory.
7961	*
7962	* The pointer size depends on the address size (address-size prefix allowed).
7963	* The operand size depends on IA-32e mode (operand-size prefix not allowed).
7964	*/
7965	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
7966	Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
7967	GCPtrDst &= s_auAddrSizeMasks[enmEffAddrMode];
7968
7969	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
7970	rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
7971	else
7972	rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
7973	if (rcStrict == VINF_SUCCESS)
7974	{
7975	iemVmxVmreadSuccess(pVCpu, cbInstr);
7976	return VINF_SUCCESS;
7977	}
7978
7979	Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
7980	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrMap;
7981	return rcStrict;
7982	}
7983
7984	Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
7985	return rcStrict;
7986	}
7987
7988
7989	/**
7990	* VMWRITE instruction execution worker.
7991	*
7992	* @returns Strict VBox status code.
7993	* @param pVCpu The cross context virtual CPU structure.
7994	* @param cbInstr The instruction length in bytes.
7995	* @param iEffSeg The effective segment register to use with @a u64Val.
7996	* Pass UINT8_MAX if it is a register access.
7997	* @param enmEffAddrMode The effective addressing mode (only used with memory
7998	* operand).
7999	* @param u64Val The value to write (or guest linear address to the
8000	* value), @a iEffSeg will indicate if it's a memory
8001	* operand.
8002	* @param u64FieldEnc The VMCS field encoding.
8003	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
8004	* be NULL.
8005	*/
8006	IEM_STATIC VBOXSTRICTRC iemVmxVmwrite(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, IEMMODE enmEffAddrMode, uint64_t u64Val,
8007	uint64_t u64FieldEnc, PCVMXVEXITINFO pExitInfo)
8008	{
8009	/* Nested-guest intercept. */
8010	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8011	&& iemVmxIsVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMWRITE, u64FieldEnc))
8012	{
8013	if (pExitInfo)
8014	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8015	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMWRITE, VMXINSTRID_VMWRITE, cbInstr);
8016	}
8017
8018	/* CPL. */
8019	if (pVCpu->iem.s.uCpl == 0)
8020	{ /* likely */ }
8021	else
8022	{
8023	Log(("vmwrite: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8024	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_Cpl;
8025	return iemRaiseGeneralProtectionFault0(pVCpu);
8026	}
8027
8028	/* VMCS pointer in root mode. */
8029	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8030	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8031	{ /* likely */ }
8032	else
8033	{
8034	Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8035	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrInvalid;
8036	iemVmxVmFailInvalid(pVCpu);
8037	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8038	return VINF_SUCCESS;
8039	}
8040
8041	/* VMCS-link pointer in non-root mode. */
8042	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8043	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8044	{ /* likely */ }
8045	else
8046	{
8047	Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8048	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_LinkPtrInvalid;
8049	iemVmxVmFailInvalid(pVCpu);
8050	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8051	return VINF_SUCCESS;
8052	}
8053
8054	/* If the VMWRITE instruction references memory, access the specified memory operand. */
8055	bool const fIsRegOperand = iEffSeg == UINT8_MAX;
8056	if (!fIsRegOperand)
8057	{
8058	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
8059	Assert(enmEffAddrMode < RT_ELEMENTS(s_auAddrSizeMasks));
8060	RTGCPTR const GCPtrVal = u64Val & s_auAddrSizeMasks[enmEffAddrMode];
8061
8062	/* Read the value from the specified guest memory location. */
8063	VBOXSTRICTRC rcStrict;
8064	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8065	rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8066	else
8067	{
8068	uint32_t u32Val;
8069	rcStrict = iemMemFetchDataU32(pVCpu, &u32Val, iEffSeg, GCPtrVal);
8070	u64Val = u32Val;
8071	}
8072	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
8073	{
8074	Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
8075	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrMap;
8076	return rcStrict;
8077	}
8078	}
8079	else
8080	Assert(!pExitInfo \|\| pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
8081
8082	/* Supported VMCS field. */
8083	if (iemVmxIsVmcsFieldValid(pVCpu, u64FieldEnc))
8084	{ /* likely */ }
8085	else
8086	{
8087	Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64FieldEnc));
8088	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldInvalid;
8089	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
8090	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8091	return VINF_SUCCESS;
8092	}
8093
8094	/* Read-only VMCS field. */
8095	bool const fIsFieldReadOnly = HMVmxIsVmcsFieldReadOnly(u64FieldEnc);
8096	if ( !fIsFieldReadOnly
8097	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
8098	{ /* likely */ }
8099	else
8100	{
8101	Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64FieldEnc));
8102	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldRo;
8103	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
8104	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8105	return VINF_SUCCESS;
8106	}
8107
8108	/*
8109	* Setup writing to the current or shadow VMCS.
8110	*/
8111	uint8_t *pbVmcs;
8112	if (!IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8113	pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
8114	else
8115	pbVmcs = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pShadowVmcs);
8116	Assert(pbVmcs);
8117
8118	VMXVMCSFIELDENC FieldEnc;
8119	FieldEnc.u = u64FieldEnc;
8120	uint8_t const uWidth = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_WIDTH);
8121	uint8_t const uType = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_TYPE);
8122	uint8_t const uWidthType = (uWidth << 2) \| uType;
8123	uint8_t const uIndex = RT_BF_GET(FieldEnc.u, VMX_BF_VMCS_ENC_INDEX);
8124	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_2);
8125	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8126	Assert(offField < VMX_V_VMCS_SIZE);
8127
8128	/*
8129	* Write the VMCS component based on the field's effective width.
8130	*
8131	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8132	* indicates high bits (little endian).
8133	*/
8134	uint8_t *pbField = pbVmcs + offField;
8135	uint8_t const uEffWidth = HMVmxGetVmcsFieldWidthEff(FieldEnc.u);
8136	switch (uEffWidth)
8137	{
8138	case VMX_VMCS_ENC_WIDTH_64BIT:
8139	case VMX_VMCS_ENC_WIDTH_NATURAL: (uint64_t )pbField = u64Val; break;
8140	case VMX_VMCS_ENC_WIDTH_32BIT: (uint32_t )pbField = u64Val; break;
8141	case VMX_VMCS_ENC_WIDTH_16BIT: (uint16_t )pbField = u64Val; break;
8142	}
8143
8144	iemVmxVmSucceed(pVCpu);
8145	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8146	return VINF_SUCCESS;
8147	}
8148
8149
8150	/**
8151	* VMCLEAR instruction execution worker.
8152	*
8153	* @returns Strict VBox status code.
8154	* @param pVCpu The cross context virtual CPU structure.
8155	* @param cbInstr The instruction length in bytes.
8156	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8157	* @param GCPtrVmcs The linear address of the VMCS pointer.
8158	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
8159	* be NULL.
8160	*
8161	* @remarks Common VMX instruction checks are already expected to by the caller,
8162	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8163	*/
8164	IEM_STATIC VBOXSTRICTRC iemVmxVmclear(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
8165	PCVMXVEXITINFO pExitInfo)
8166	{
8167	/* Nested-guest intercept. */
8168	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8169	{
8170	if (pExitInfo)
8171	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8172	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMCLEAR, VMXINSTRID_NONE, cbInstr);
8173	}
8174
8175	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8176
8177	/* CPL. */
8178	if (pVCpu->iem.s.uCpl == 0)
8179	{ /* likely */ }
8180	else
8181	{
8182	Log(("vmclear: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8183	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_Cpl;
8184	return iemRaiseGeneralProtectionFault0(pVCpu);
8185	}
8186
8187	/* Get the VMCS pointer from the location specified by the source memory operand. */
8188	RTGCPHYS GCPhysVmcs;
8189	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8190	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8191	{ /* likely */ }
8192	else
8193	{
8194	Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8195	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrMap;
8196	return rcStrict;
8197	}
8198
8199	/* VMCS pointer alignment. */
8200	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8201	{ /* likely */ }
8202	else
8203	{
8204	Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
8205	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAlign;
8206	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8207	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8208	return VINF_SUCCESS;
8209	}
8210
8211	/* VMCS physical-address width limits. */
8212	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8213	{ /* likely */ }
8214	else
8215	{
8216	Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8217	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrWidth;
8218	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8219	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8220	return VINF_SUCCESS;
8221	}
8222
8223	/* VMCS is not the VMXON region. */
8224	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8225	{ /* likely */ }
8226	else
8227	{
8228	Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8229	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrVmxon;
8230	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
8231	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8232	return VINF_SUCCESS;
8233	}
8234
8235	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8236	restriction imposed by our implementation. */
8237	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8238	{ /* likely */ }
8239	else
8240	{
8241	Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
8242	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAbnormal;
8243	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8244	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8245	return VINF_SUCCESS;
8246	}
8247
8248	/*
8249	* VMCLEAR allows committing and clearing any valid VMCS pointer.
8250	*
8251	* If the current VMCS is the one being cleared, set its state to 'clear' and commit
8252	* to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
8253	* to 'clear'.
8254	*/
8255	uint8_t const fVmcsLaunchStateClear = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
8256	if ( IEM_VMX_HAS_CURRENT_VMCS(pVCpu)
8257	&& IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
8258	{
8259	Assert(GCPhysVmcs != NIL_RTGCPHYS); /* Paranoia. */
8260	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs));
8261	pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs)->fVmcsState = fVmcsLaunchStateClear;
8262	iemVmxCommitCurrentVmcsToMemory(pVCpu);
8263	Assert(!IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
8264	}
8265	else
8266	{
8267	AssertCompileMemberSize(VMXVVMCS, fVmcsState, sizeof(fVmcsLaunchStateClear));
8268	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + RT_UOFFSETOF(VMXVVMCS, fVmcsState),
8269	(const void *)&fVmcsLaunchStateClear, sizeof(fVmcsLaunchStateClear));
8270	if (RT_FAILURE(rcStrict))
8271	return rcStrict;
8272	}
8273
8274	iemVmxVmSucceed(pVCpu);
8275	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8276	return VINF_SUCCESS;
8277	}
8278
8279
8280	/**
8281	* VMPTRST instruction execution worker.
8282	*
8283	* @returns Strict VBox status code.
8284	* @param pVCpu The cross context virtual CPU structure.
8285	* @param cbInstr The instruction length in bytes.
8286	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8287	* @param GCPtrVmcs The linear address of where to store the current VMCS
8288	* pointer.
8289	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
8290	* be NULL.
8291	*
8292	* @remarks Common VMX instruction checks are already expected to by the caller,
8293	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8294	*/
8295	IEM_STATIC VBOXSTRICTRC iemVmxVmptrst(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
8296	PCVMXVEXITINFO pExitInfo)
8297	{
8298	/* Nested-guest intercept. */
8299	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8300	{
8301	if (pExitInfo)
8302	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8303	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRST, VMXINSTRID_NONE, cbInstr);
8304	}
8305
8306	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8307
8308	/* CPL. */
8309	if (pVCpu->iem.s.uCpl == 0)
8310	{ /* likely */ }
8311	else
8312	{
8313	Log(("vmptrst: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8314	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_Cpl;
8315	return iemRaiseGeneralProtectionFault0(pVCpu);
8316	}
8317
8318	/* Set the VMCS pointer to the location specified by the destination memory operand. */
8319	AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
8320	VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
8321	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8322	{
8323	iemVmxVmSucceed(pVCpu);
8324	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8325	return rcStrict;
8326	}
8327
8328	Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8329	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_PtrMap;
8330	return rcStrict;
8331	}
8332
8333
8334	/**
8335	* VMPTRLD instruction execution worker.
8336	*
8337	* @returns Strict VBox status code.
8338	* @param pVCpu The cross context virtual CPU structure.
8339	* @param cbInstr The instruction length in bytes.
8340	* @param GCPtrVmcs The linear address of the current VMCS pointer.
8341	* @param pExitInfo Pointer to the VM-exit information struct. Optional, can
8342	* be NULL.
8343	*
8344	* @remarks Common VMX instruction checks are already expected to by the caller,
8345	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8346	*/
8347	IEM_STATIC VBOXSTRICTRC iemVmxVmptrld(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmcs,
8348	PCVMXVEXITINFO pExitInfo)
8349	{
8350	/* Nested-guest intercept. */
8351	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8352	{
8353	if (pExitInfo)
8354	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8355	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRLD, VMXINSTRID_NONE, cbInstr);
8356	}
8357
8358	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8359
8360	/* CPL. */
8361	if (pVCpu->iem.s.uCpl == 0)
8362	{ /* likely */ }
8363	else
8364	{
8365	Log(("vmptrld: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8366	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_Cpl;
8367	return iemRaiseGeneralProtectionFault0(pVCpu);
8368	}
8369
8370	/* Get the VMCS pointer from the location specified by the source memory operand. */
8371	RTGCPHYS GCPhysVmcs;
8372	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8373	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8374	{ /* likely */ }
8375	else
8376	{
8377	Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8378	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrMap;
8379	return rcStrict;
8380	}
8381
8382	/* VMCS pointer alignment. */
8383	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8384	{ /* likely */ }
8385	else
8386	{
8387	Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
8388	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAlign;
8389	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8390	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8391	return VINF_SUCCESS;
8392	}
8393
8394	/* VMCS physical-address width limits. */
8395	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8396	{ /* likely */ }
8397	else
8398	{
8399	Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8400	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrWidth;
8401	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8402	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8403	return VINF_SUCCESS;
8404	}
8405
8406	/* VMCS is not the VMXON region. */
8407	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8408	{ /* likely */ }
8409	else
8410	{
8411	Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8412	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrVmxon;
8413	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
8414	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8415	return VINF_SUCCESS;
8416	}
8417
8418	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8419	restriction imposed by our implementation. */
8420	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8421	{ /* likely */ }
8422	else
8423	{
8424	Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
8425	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAbnormal;
8426	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8427	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8428	return VINF_SUCCESS;
8429	}
8430
8431	/* Read just the VMCS revision from the VMCS. */
8432	VMXVMCSREVID VmcsRevId;
8433	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
8434	if (RT_SUCCESS(rc))
8435	{ /* likely */ }
8436	else
8437	{
8438	Log(("vmptrld: Failed to read revision identifier from VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8439	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_RevPtrReadPhys;
8440	return rc;
8441	}
8442
8443	/*
8444	* Verify the VMCS revision specified by the guest matches what we reported to the guest.
8445	* Verify the VMCS is not a shadow VMCS, if the VMCS shadowing feature is supported.
8446	*/
8447	if ( VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID
8448	&& ( !VmcsRevId.n.fIsShadowVmcs
8449	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
8450	{ /* likely */ }
8451	else
8452	{
8453	if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
8454	{
8455	Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32, GCPtrVmcs=%#RGv GCPhysVmcs=%#RGp -> VMFail()\n",
8456	VMX_V_VMCS_REVISION_ID, VmcsRevId.n.u31RevisionId, GCPtrVmcs, GCPhysVmcs));
8457	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_VmcsRevId;
8458	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
8459	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8460	return VINF_SUCCESS;
8461	}
8462
8463	Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
8464	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_ShadowVmcs;
8465	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
8466	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8467	return VINF_SUCCESS;
8468	}
8469
8470	/*
8471	* We cache only the current VMCS in CPUMCTX. Therefore, VMPTRLD should always flush
8472	* the cache of an existing, current VMCS back to guest memory before loading a new,
8473	* different current VMCS.
8474	*/
8475	bool fLoadVmcsFromMem;
8476	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8477	{
8478	if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
8479	{
8480	iemVmxCommitCurrentVmcsToMemory(pVCpu);
8481	Assert(!IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
8482	fLoadVmcsFromMem = true;
8483	}
8484	else
8485	fLoadVmcsFromMem = false;
8486	}
8487	else
8488	fLoadVmcsFromMem = true;
8489
8490	if (fLoadVmcsFromMem)
8491	{
8492	/* Finally, cache the new VMCS from guest memory and mark it as the current VMCS. */
8493	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), (void *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs), GCPhysVmcs,
8494	sizeof(VMXVVMCS));
8495	if (RT_SUCCESS(rc))
8496	{ /* likely */ }
8497	else
8498	{
8499	Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8500	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrReadPhys;
8501	return rc;
8502	}
8503	IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
8504	}
8505
8506	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
8507	iemVmxVmSucceed(pVCpu);
8508	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8509	return VINF_SUCCESS;
8510	}
8511
8512
8513	/**
8514	* VMXON instruction execution worker.
8515	*
8516	* @returns Strict VBox status code.
8517	* @param pVCpu The cross context virtual CPU structure.
8518	* @param cbInstr The instruction length in bytes.
8519	* @param iEffSeg The effective segment register to use with @a
8520	* GCPtrVmxon.
8521	* @param GCPtrVmxon The linear address of the VMXON pointer.
8522	* @param pExitInfo Pointer to the VM-exit instruction information struct.
8523	* Optional, can be NULL.
8524	*
8525	* @remarks Common VMX instruction checks are already expected to by the caller,
8526	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8527	*/
8528	IEM_STATIC VBOXSTRICTRC iemVmxVmxon(PVMCPU pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPHYS GCPtrVmxon,
8529	PCVMXVEXITINFO pExitInfo)
8530	{
8531	if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
8532	{
8533	/* CPL. */
8534	if (pVCpu->iem.s.uCpl == 0)
8535	{ /* likely */ }
8536	else
8537	{
8538	Log(("vmxon: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8539	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cpl;
8540	return iemRaiseGeneralProtectionFault0(pVCpu);
8541	}
8542
8543	/* A20M (A20 Masked) mode. */
8544	if (PGMPhysIsA20Enabled(pVCpu))
8545	{ /* likely */ }
8546	else
8547	{
8548	Log(("vmxon: A20M mode -> #GP(0)\n"));
8549	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_A20M;
8550	return iemRaiseGeneralProtectionFault0(pVCpu);
8551	}
8552
8553	/* CR0. */
8554	{
8555	/* CR0 MB1 bits. */
8556	uint64_t const uCr0Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed0;
8557	if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) == uCr0Fixed0)
8558	{ /* likely */ }
8559	else
8560	{
8561	Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
8562	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed0;
8563	return iemRaiseGeneralProtectionFault0(pVCpu);
8564	}
8565
8566	/* CR0 MBZ bits. */
8567	uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
8568	if (!(pVCpu->cpum.GstCtx.cr0 & ~uCr0Fixed1))
8569	{ /* likely */ }
8570	else
8571	{
8572	Log(("vmxon: CR0 fixed1 bits set -> #GP(0)\n"));
8573	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed1;
8574	return iemRaiseGeneralProtectionFault0(pVCpu);
8575	}
8576	}
8577
8578	/* CR4. */
8579	{
8580	/* CR4 MB1 bits. */
8581	uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
8582	if ((pVCpu->cpum.GstCtx.cr4 & uCr4Fixed0) == uCr4Fixed0)
8583	{ /* likely */ }
8584	else
8585	{
8586	Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
8587	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed0;
8588	return iemRaiseGeneralProtectionFault0(pVCpu);
8589	}
8590
8591	/* CR4 MBZ bits. */
8592	uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
8593	if (!(pVCpu->cpum.GstCtx.cr4 & ~uCr4Fixed1))
8594	{ /* likely */ }
8595	else
8596	{
8597	Log(("vmxon: CR4 fixed1 bits set -> #GP(0)\n"));
8598	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed1;
8599	return iemRaiseGeneralProtectionFault0(pVCpu);
8600	}
8601	}
8602
8603	/* Feature control MSR's LOCK and VMXON bits. */
8604	uint64_t const uMsrFeatCtl = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64FeatCtrl;
8605	if ((uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
8606	== (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
8607	{ /* likely */ }
8608	else
8609	{
8610	Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
8611	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_MsrFeatCtl;
8612	return iemRaiseGeneralProtectionFault0(pVCpu);
8613	}
8614
8615	/* Get the VMXON pointer from the location specified by the source memory operand. */
8616	RTGCPHYS GCPhysVmxon;
8617	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
8618	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8619	{ /* likely */ }
8620	else
8621	{
8622	Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
8623	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrMap;
8624	return rcStrict;
8625	}
8626
8627	/* VMXON region pointer alignment. */
8628	if (!(GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK))
8629	{ /* likely */ }
8630	else
8631	{
8632	Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
8633	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAlign;
8634	iemVmxVmFailInvalid(pVCpu);
8635	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8636	return VINF_SUCCESS;
8637	}
8638
8639	/* VMXON physical-address width limits. */
8640	if (!(GCPhysVmxon >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8641	{ /* likely */ }
8642	else
8643	{
8644	Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
8645	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrWidth;
8646	iemVmxVmFailInvalid(pVCpu);
8647	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8648	return VINF_SUCCESS;
8649	}
8650
8651	/* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
8652	restriction imposed by our implementation. */
8653	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
8654	{ /* likely */ }
8655	else
8656	{
8657	Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
8658	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAbnormal;
8659	iemVmxVmFailInvalid(pVCpu);
8660	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8661	return VINF_SUCCESS;
8662	}
8663
8664	/* Read the VMCS revision ID from the VMXON region. */
8665	VMXVMCSREVID VmcsRevId;
8666	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
8667	if (RT_SUCCESS(rc))
8668	{ /* likely */ }
8669	else
8670	{
8671	Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
8672	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrReadPhys;
8673	return rc;
8674	}
8675
8676	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
8677	if (RT_LIKELY(VmcsRevId.u == VMX_V_VMCS_REVISION_ID))
8678	{ /* likely */ }
8679	else
8680	{
8681	/* Revision ID mismatch. */
8682	if (!VmcsRevId.n.fIsShadowVmcs)
8683	{
8684	Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
8685	VmcsRevId.n.u31RevisionId));
8686	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmcsRevId;
8687	iemVmxVmFailInvalid(pVCpu);
8688	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8689	return VINF_SUCCESS;
8690	}
8691
8692	/* Shadow VMCS disallowed. */
8693	Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
8694	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_ShadowVmcs;
8695	iemVmxVmFailInvalid(pVCpu);
8696	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8697	return VINF_SUCCESS;
8698	}
8699
8700	/*
8701	* Record that we're in VMX operation, block INIT, block and disable A20M.
8702	*/
8703	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
8704	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8705	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
8706
8707	/* Clear address-range monitoring. */
8708	EMMonitorWaitClear(pVCpu);
8709	/** @todo NSTVMX: Intel PT. */
8710
8711	iemVmxVmSucceed(pVCpu);
8712	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8713	return VINF_SUCCESS;
8714	}
8715	else if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8716	{
8717	/* Nested-guest intercept. */
8718	if (pExitInfo)
8719	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8720	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMXON, VMXINSTRID_NONE, cbInstr);
8721	}
8722
8723	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8724
8725	/* CPL. */
8726	if (pVCpu->iem.s.uCpl > 0)
8727	{
8728	Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8729	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxRootCpl;
8730	return iemRaiseGeneralProtectionFault0(pVCpu);
8731	}
8732
8733	/* VMXON when already in VMX root mode. */
8734	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
8735	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxAlreadyRoot;
8736	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8737	return VINF_SUCCESS;
8738	}
8739
8740
8741	/**
8742	* Implements 'VMXOFF'.
8743	*
8744	* @remarks Common VMX instruction checks are already expected to by the caller,
8745	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8746	*/
8747	IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
8748	{
8749	/* Nested-guest intercept. */
8750	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8751	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMXOFF, cbInstr);
8752
8753	/* CPL. */
8754	if (pVCpu->iem.s.uCpl == 0)
8755	{ /* likely */ }
8756	else
8757	{
8758	Log(("vmxoff: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8759	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxoff_Cpl;
8760	return iemRaiseGeneralProtectionFault0(pVCpu);
8761	}
8762
8763	/* Dual monitor treatment of SMIs and SMM. */
8764	uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
8765	if (!(fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID))
8766	{ /* likely */ }
8767	else
8768	{
8769	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
8770	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8771	return VINF_SUCCESS;
8772	}
8773
8774	/* Record that we're no longer in VMX root operation, block INIT, block and disable A20M. */
8775	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
8776	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
8777
8778	if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
8779	{ /** @todo NSTVMX: Unblock SMI. */ }
8780
8781	EMMonitorWaitClear(pVCpu);
8782	/** @todo NSTVMX: Unblock and enable A20M. */
8783
8784	iemVmxVmSucceed(pVCpu);
8785	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8786	return VINF_SUCCESS;
8787	}
8788
8789
8790	/**
8791	* Implements 'VMXON'.
8792	*/
8793	IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
8794	{
8795	return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
8796	}
8797
8798
8799	/**
8800	* Implements 'VMLAUNCH'.
8801	*/
8802	IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
8803	{
8804	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH);
8805	}
8806
8807
8808	/**
8809	* Implements 'VMRESUME'.
8810	*/
8811	IEM_CIMPL_DEF_0(iemCImpl_vmresume)
8812	{
8813	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME);
8814	}
8815
8816
8817	/**
8818	* Implements 'VMPTRLD'.
8819	*/
8820	IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
8821	{
8822	return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
8823	}
8824
8825
8826	/**
8827	* Implements 'VMPTRST'.
8828	*/
8829	IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
8830	{
8831	return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
8832	}
8833
8834
8835	/**
8836	* Implements 'VMCLEAR'.
8837	*/
8838	IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
8839	{
8840	return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
8841	}
8842
8843
8844	/**
8845	* Implements 'VMWRITE' register.
8846	*/
8847	IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64FieldEnc)
8848	{
8849	return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg /, IEMMODE_64BIT / N/A */, u64Val, u64FieldEnc,
8850	NULL /* pExitInfo */);
8851	}
8852
8853
8854	/**
8855	* Implements 'VMWRITE' memory.
8856	*/
8857	IEM_CIMPL_DEF_4(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrVal, uint32_t, u64FieldEnc)
8858	{
8859	return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrVal, u64FieldEnc, NULL /* pExitInfo */);
8860	}
8861
8862
8863	/**
8864	* Implements 'VMREAD' register (64-bit).
8865	*/
8866	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg64, uint64_t *, pu64Dst, uint64_t, u64FieldEnc)
8867	{
8868	return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, NULL /* pExitInfo */);
8869	}
8870
8871
8872	/**
8873	* Implements 'VMREAD' register (32-bit).
8874	*/
8875	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg32, uint32_t *, pu32Dst, uint32_t, u32FieldEnc)
8876	{
8877	return iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u32FieldEnc, NULL /* pExitInfo */);
8878	}
8879
8880
8881	/**
8882	* Implements 'VMREAD' memory, 64-bit register.
8883	*/
8884	IEM_CIMPL_DEF_4(iemCImpl_vmread_mem_reg64, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrDst, uint32_t, u64FieldEnc)
8885	{
8886	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrDst, u64FieldEnc, NULL /* pExitInfo */);
8887	}
8888
8889
8890	/**
8891	* Implements 'VMREAD' memory, 32-bit register.
8892	*/
8893	IEM_CIMPL_DEF_4(iemCImpl_vmread_mem_reg32, uint8_t, iEffSeg, IEMMODE, enmEffAddrMode, RTGCPTR, GCPtrDst, uint32_t, u32FieldEnc)
8894	{
8895	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, enmEffAddrMode, GCPtrDst, u32FieldEnc, NULL /* pExitInfo */);
8896	}
8897
8898
8899	/**
8900	* Implements VMX's implementation of PAUSE.
8901	*/
8902	IEM_CIMPL_DEF_0(iemCImpl_vmx_pause)
8903	{
8904	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8905	{
8906	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrPause(pVCpu, cbInstr);
8907	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
8908	return rcStrict;
8909	}
8910
8911	/*
8912	* Outside VMX non-root operation or if the PAUSE instruction does not cause
8913	* a VM-exit, the instruction operates normally.
8914	*/
8915	iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8916	return VINF_SUCCESS;
8917	}
8918
8919	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
8920
8921
8922	/**
8923	* Implements 'VMCALL'.
8924	*/
8925	IEM_CIMPL_DEF_0(iemCImpl_vmcall)
8926	{
8927	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
8928	/* Nested-guest intercept. */
8929	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8930	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMCALL, cbInstr);
8931	#endif
8932
8933	/* Join forces with vmmcall. */
8934	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
8935	}
8936

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h@ 78481

Download in other formats: