IEMAllCImplVmxInstr.cpp@ 101584

Last change on this file since 101584 was 101487, checked in by vboxsync, 14 months ago
VMM/IEM: Nested VMX: bugref:10318 Add assertions to verify NMI inhibition state (esp. since virtual NMIs are supported)
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 411.5 KB

Line
1	/* $Id: IEMAllCImplVmxInstr.cpp 101487 2023-10-18 06:57:30Z vboxsync $ */
2	/** @file
3	* IEM - VT-x instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_IEM_VMX
33	#define VMCPU_INCL_CPUM_GST_CTX
34	#include <VBox/vmm/iem.h>
35	#include <VBox/vmm/apic.h>
36	#include <VBox/vmm/cpum.h>
37	#include <VBox/vmm/dbgf.h>
38	#include <VBox/vmm/em.h>
39	#include <VBox/vmm/gim.h>
40	#include <VBox/vmm/hm.h>
41	#include <VBox/vmm/pgm.h>
42	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
43	# include <VBox/vmm/hmvmxinline.h>
44	#endif
45	#include <VBox/vmm/tm.h>
46	#include "IEMInternal.h"
47	#include <VBox/vmm/vmcc.h>
48	#include <VBox/log.h>
49	#include <VBox/err.h>
50	#include <VBox/param.h>
51	#include <VBox/disopcode-x86-amd64.h>
52	#include <iprt/asm-math.h>
53	#include <iprt/assert.h>
54	#include <iprt/string.h>
55	#include <iprt/x86.h>
56
57	#include "IEMInline.h"
58
59
60	/*********************************************************************************************************************************
61	* Defined Constants And Macros *
62	*********************************************************************************************************************************/
63	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
64	/**
65	* Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
66	* relative offsets.
67	*/
68	# ifdef IEM_WITH_CODE_TLB /** @todo IEM TLB */
69	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { a_bModRm = 0; RT_NOREF(a_offModRm); } while (0)
70	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { a_bSib = 0; RT_NOREF(a_offSib); } while (0)
71	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
72	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
73	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
74	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
75	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
76	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
77	# if 0
78	# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
79	# endif
80	# else /* !IEM_WITH_CODE_TLB */
81	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
82	do \
83	{ \
84	Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
85	(a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
86	} while (0)
87
88	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
89
90	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
91	do \
92	{ \
93	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
94	uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
95	uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
96	(a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
97	} while (0)
98
99	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
100	do \
101	{ \
102	Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
103	(a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
104	} while (0)
105
106	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
107	do \
108	{ \
109	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
110	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
111	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
112	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
113	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
114	(a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
115	} while (0)
116
117	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
118	do \
119	{ \
120	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
121	(a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
122	} while (0)
123
124	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
125	do \
126	{ \
127	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
128	(a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
129	} while (0)
130
131	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
132	do \
133	{ \
134	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
135	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
136	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
137	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
138	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
139	(a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
140	} while (0)
141	# endif /* !IEM_WITH_CODE_TLB */
142
143	/** Check for VMX instructions requiring to be in VMX operation.
144	* @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs updating. */
145	# define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
146	do \
147	{ \
148	if (IEM_VMX_IS_ROOT_MODE(a_pVCpu)) \
149	{ /* likely */ } \
150	else \
151	{ \
152	Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
153	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = a_InsDiagPrefix##_VmxRoot; \
154	return iemRaiseUndefinedOpcode(a_pVCpu); \
155	} \
156	} while (0)
157
158	/** Marks a VM-entry failure with a diagnostic reason, logs and returns. */
159	# define IEM_VMX_VMENTRY_FAILED_RET(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag) \
160	do \
161	{ \
162	LogRel(("%s: VM-entry failed! enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_VmxDiag), \
163	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
164	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
165	return VERR_VMX_VMENTRY_FAILED; \
166	} while (0)
167
168	/** Marks a VM-entry failure with an return code, diagnostic reason, logs and
169	* returns. */
170	# define IEM_VMX_VMENTRY_FAILED_RET_2(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag, a_rc) \
171	do \
172	{ \
173	LogRel(("%s: VM-entry failed! rc=%Rrc enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_rc), (a_VmxDiag), \
174	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
175	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
176	return VERR_VMX_VMENTRY_FAILED; \
177	} while (0)
178
179	/** Marks a VM-exit failure with a diagnostic reason and logs. */
180	# define IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
181	do \
182	{ \
183	LogRel(("VM-exit failed! uExitReason=%u enmDiag=%u (%s) -> %s\n", (a_uExitReason), (a_VmxDiag), \
184	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
185	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
186	} while (0)
187
188	/** Marks a VM-exit failure with a diagnostic reason, logs and returns. */
189	# define IEM_VMX_VMEXIT_FAILED_RET(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
190	do \
191	{ \
192	IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag); \
193	return VERR_VMX_VMEXIT_FAILED; \
194	} while (0)
195
196
197	/*********************************************************************************************************************************
198	* Global Variables *
199	*********************************************************************************************************************************/
200	/** @todo NSTVMX: The following VM-exit intercepts are pending:
201	* VMX_EXIT_IO_SMI
202	* VMX_EXIT_SMI
203	* VMX_EXIT_GETSEC
204	* VMX_EXIT_RSM
205	* VMX_EXIT_MONITOR (APIC access VM-exit caused by MONITOR pending)
206	* VMX_EXIT_ERR_MACHINE_CHECK (we never need to raise this?)
207	* VMX_EXIT_VMFUNC
208	* VMX_EXIT_ENCLS
209	* VMX_EXIT_PML_FULL
210	* VMX_EXIT_XSAVES
211	* VMX_EXIT_XRSTORS
212	*/
213	/**
214	* Map of VMCS field encodings to their virtual-VMCS structure offsets.
215	*
216	* The first array dimension is VMCS field encoding of Width OR'ed with Type and the
217	* second dimension is the Index, see VMXVMCSFIELD.
218	*/
219	uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
220	{
221	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
222	{
223	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u16Vpid),
224	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
225	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u16EptpIndex),
226	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u16HlatPrefixSize),
227	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
228	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
229	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
230	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
231	},
232	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
233	{
234	/* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
235	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
236	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
237	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
238	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
239	},
240	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
241	{
242	/* 0 */ RT_UOFFSETOF(VMXVVMCS, GuestEs),
243	/* 1 */ RT_UOFFSETOF(VMXVVMCS, GuestCs),
244	/* 2 */ RT_UOFFSETOF(VMXVVMCS, GuestSs),
245	/* 3 */ RT_UOFFSETOF(VMXVVMCS, GuestDs),
246	/* 4 */ RT_UOFFSETOF(VMXVVMCS, GuestFs),
247	/* 5 */ RT_UOFFSETOF(VMXVVMCS, GuestGs),
248	/* 6 */ RT_UOFFSETOF(VMXVVMCS, GuestLdtr),
249	/* 7 */ RT_UOFFSETOF(VMXVVMCS, GuestTr),
250	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u16GuestIntStatus),
251	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u16PmlIndex),
252	/* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
253	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
254	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
255	/* 34 */ UINT16_MAX
256	},
257	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
258	{
259	/* 0 */ RT_UOFFSETOF(VMXVVMCS, HostEs),
260	/* 1 */ RT_UOFFSETOF(VMXVVMCS, HostCs),
261	/* 2 */ RT_UOFFSETOF(VMXVVMCS, HostSs),
262	/* 3 */ RT_UOFFSETOF(VMXVVMCS, HostDs),
263	/* 4 */ RT_UOFFSETOF(VMXVVMCS, HostFs),
264	/* 5 */ RT_UOFFSETOF(VMXVVMCS, HostGs),
265	/* 6 */ RT_UOFFSETOF(VMXVVMCS, HostTr),
266	/* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
267	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
268	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
269	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
270	},
271	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
272	{
273	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
274	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
275	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
276	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
277	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
278	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
279	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
280	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPml),
281	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64TscOffset),
282	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVirtApic),
283	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64AddrApicAccess),
284	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
285	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64VmFuncCtls),
286	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64EptPtr),
287	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
288	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
289	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
290	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
291	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEptpList),
292	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
293	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
294	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
295	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64XssExitBitmap),
296	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u64EnclsExitBitmap),
297	/* 24 */ RT_UOFFSETOF(VMXVVMCS, u64SppTablePtr),
298	/* 25 */ RT_UOFFSETOF(VMXVVMCS, u64TscMultiplier),
299	/* 26 */ RT_UOFFSETOF(VMXVVMCS, u64ProcCtls3),
300	/* 27 */ RT_UOFFSETOF(VMXVVMCS, u64EnclvExitBitmap),
301	/* 28 */ UINT16_MAX,
302	/* 29 */ UINT16_MAX,
303	/* 30 */ UINT16_MAX,
304	/* 31 */ RT_UOFFSETOF(VMXVVMCS, u64PconfigExitBitmap),
305	/* 32 */ RT_UOFFSETOF(VMXVVMCS, u64HlatPtr),
306	/* 33 */ UINT16_MAX,
307	/* 34 */ RT_UOFFSETOF(VMXVVMCS, u64ExitCtls2)
308	},
309	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
310	{
311	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestPhysAddr),
312	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
313	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
314	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
315	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
316	/* 33-34*/ UINT16_MAX, UINT16_MAX
317	},
318	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
319	{
320	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
321	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
322	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPatMsr),
323	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEferMsr),
324	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
325	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte0),
326	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte1),
327	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte2),
328	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte3),
329	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
330	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRtitCtlMsr),
331	/* 11 */ UINT16_MAX,
332	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPkrsMsr),
333	/* 13-20 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
334	/* 21-28 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
335	/* 29-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
336	},
337	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
338	{
339	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostPatMsr),
340	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostEferMsr),
341	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
342	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostPkrsMsr),
343	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
344	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
345	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
346	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
347	},
348	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
349	{
350	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32PinCtls),
351	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls),
352	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32XcptBitmap),
353	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMask),
354	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMatch),
355	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32Cr3TargetCount),
356	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32ExitCtls),
357	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
358	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
359	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32EntryCtls),
360	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
361	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32EntryIntInfo),
362	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
363	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32EntryInstrLen),
364	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32TprThreshold),
365	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls2),
366	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32PleGap),
367	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32PleWindow),
368	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
369	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
370	/* 34 */ UINT16_MAX
371	},
372	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
373	{
374	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32RoVmInstrError),
375	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitReason),
376	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntInfo),
377	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntErrCode),
378	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
379	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
380	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrLen),
381	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
382	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
383	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
384	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
385	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
386	},
387	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
388	{
389	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsLimit),
390	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsLimit),
391	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsLimit),
392	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsLimit),
393	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsLimit),
394	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsLimit),
395	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
396	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrLimit),
397	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
398	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
399	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsAttr),
400	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsAttr),
401	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsAttr),
402	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsAttr),
403	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsAttr),
404	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsAttr),
405	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
406	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrAttr),
407	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIntrState),
408	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u32GuestActivityState),
409	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSmBase),
410	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSysenterCS),
411	/* 22 */ UINT16_MAX,
412	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u32PreemptTimer),
413	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
414	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
415	},
416	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
417	{
418	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32HostSysenterCs),
419	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
420	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
421	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
422	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
423	/* 33-34 */ UINT16_MAX, UINT16_MAX
424	},
425	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_CONTROL: */
426	{
427	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0Mask),
428	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4Mask),
429	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
430	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
431	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target0),
432	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target1),
433	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target2),
434	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target3),
435	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
436	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
437	/* 24-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
438	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
439	},
440	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
441	{
442	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoExitQual),
443	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRcx),
444	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRsi),
445	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRdi),
446	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRip),
447	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestLinearAddr),
448	/* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
449	/* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
450	/* 22-29 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
451	/* 30-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
452	},
453	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
454	{
455	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr0),
456	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr3),
457	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr4),
458	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEsBase),
459	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCsBase),
460	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsBase),
461	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDsBase),
462	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestFsBase),
463	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGsBase),
464	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestLdtrBase),
465	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestTrBase),
466	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGdtrBase),
467	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIdtrBase),
468	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDr7),
469	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRsp),
470	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRip),
471	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRFlags),
472	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpts),
473	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
474	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEip),
475	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSCetMsr),
476	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsp),
477	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIntrSspTableAddrMsr),
478	/* 23-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
479	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
480	},
481	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
482	{
483	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr0),
484	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr3),
485	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr4),
486	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostFsBase),
487	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64HostGsBase),
488	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64HostTrBase),
489	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64HostGdtrBase),
490	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64HostIdtrBase),
491	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEsp),
492	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEip),
493	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64HostRsp),
494	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64HostRip),
495	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64HostSCetMsr),
496	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64HostSsp),
497	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64HostIntrSspTableAddrMsr),
498	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
499	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
500	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
501	}
502	};
503
504
505	/**
506	* Gets a host selector from the VMCS.
507	*
508	* @param pVmcs Pointer to the virtual VMCS.
509	* @param iSelReg The index of the segment register (X86_SREG_XXX).
510	*/
511	DECLINLINE(RTSEL) iemVmxVmcsGetHostSelReg(PCVMXVVMCS pVmcs, uint8_t iSegReg)
512	{
513	Assert(iSegReg < X86_SREG_COUNT);
514	RTSEL HostSel;
515	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
516	uint8_t const uType = VMX_VMCSFIELD_TYPE_HOST_STATE;
517	uint8_t const uWidthType = (uWidth << 2) \| uType;
518	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_HOST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
519	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
520	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
521	uint8_t const pbVmcs = (uint8_t )pVmcs;
522	uint8_t const *pbField = pbVmcs + offField;
523	HostSel = (uint16_t )pbField;
524	return HostSel;
525	}
526
527
528	/**
529	* Sets a guest segment register in the VMCS.
530	*
531	* @param pVmcs Pointer to the virtual VMCS.
532	* @param iSegReg The index of the segment register (X86_SREG_XXX).
533	* @param pSelReg Pointer to the segment register.
534	*/
535	static void iemVmxVmcsSetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCCPUMSELREG pSelReg) RT_NOEXCEPT
536	{
537	Assert(pSelReg);
538	Assert(iSegReg < X86_SREG_COUNT);
539
540	/* Selector. */
541	{
542	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
543	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
544	uint8_t const uWidthType = (uWidth << 2) \| uType;
545	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
546	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
547	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
548	uint8_t pbVmcs = (uint8_t )pVmcs;
549	uint8_t *pbField = pbVmcs + offField;
550	(uint16_t )pbField = pSelReg->Sel;
551	}
552
553	/* Limit. */
554	{
555	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
556	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
557	uint8_t const uWidthType = (uWidth << 2) \| uType;
558	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
559	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
560	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
561	uint8_t pbVmcs = (uint8_t )pVmcs;
562	uint8_t *pbField = pbVmcs + offField;
563	(uint32_t )pbField = pSelReg->u32Limit;
564	}
565
566	/* Base. */
567	{
568	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
569	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
570	uint8_t const uWidthType = (uWidth << 2) \| uType;
571	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
572	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
573	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
574	uint8_t const pbVmcs = (uint8_t )pVmcs;
575	uint8_t const *pbField = pbVmcs + offField;
576	(uint64_t )pbField = pSelReg->u64Base;
577	}
578
579	/* Attributes. */
580	{
581	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
582	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
583	\| X86DESCATTR_UNUSABLE;
584	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
585	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
586	uint8_t const uWidthType = (uWidth << 2) \| uType;
587	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
588	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
589	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
590	uint8_t pbVmcs = (uint8_t )pVmcs;
591	uint8_t *pbField = pbVmcs + offField;
592	(uint32_t )pbField = pSelReg->Attr.u & fValidAttrMask;
593	}
594	}
595
596
597	/**
598	* Gets a guest segment register from the VMCS.
599	*
600	* @returns VBox status code.
601	* @param pVmcs Pointer to the virtual VMCS.
602	* @param iSegReg The index of the segment register (X86_SREG_XXX).
603	* @param pSelReg Where to store the segment register (only updated when
604	* VINF_SUCCESS is returned).
605	*
606	* @remarks Warning! This does not validate the contents of the retrieved segment
607	* register.
608	*/
609	static int iemVmxVmcsGetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCPUMSELREG pSelReg) RT_NOEXCEPT
610	{
611	Assert(pSelReg);
612	Assert(iSegReg < X86_SREG_COUNT);
613
614	/* Selector. */
615	uint16_t u16Sel;
616	{
617	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
618	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
619	uint8_t const uWidthType = (uWidth << 2) \| uType;
620	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
621	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
622	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
623	uint8_t const pbVmcs = (uint8_t )pVmcs;
624	uint8_t const *pbField = pbVmcs + offField;
625	u16Sel = (uint16_t )pbField;
626	}
627
628	/* Limit. */
629	uint32_t u32Limit;
630	{
631	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
632	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
633	uint8_t const uWidthType = (uWidth << 2) \| uType;
634	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
635	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
636	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
637	uint8_t const pbVmcs = (uint8_t )pVmcs;
638	uint8_t const *pbField = pbVmcs + offField;
639	u32Limit = (uint32_t )pbField;
640	}
641
642	/* Base. */
643	uint64_t u64Base;
644	{
645	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
646	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
647	uint8_t const uWidthType = (uWidth << 2) \| uType;
648	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
649	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
650	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
651	uint8_t const pbVmcs = (uint8_t )pVmcs;
652	uint8_t const *pbField = pbVmcs + offField;
653	u64Base = (uint64_t )pbField;
654	/** @todo NSTVMX: Should we zero out high bits here for 32-bit virtual CPUs? */
655	}
656
657	/* Attributes. */
658	uint32_t u32Attr;
659	{
660	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
661	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
662	uint8_t const uWidthType = (uWidth << 2) \| uType;
663	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
664	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
665	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
666	uint8_t const pbVmcs = (uint8_t )pVmcs;
667	uint8_t const *pbField = pbVmcs + offField;
668	u32Attr = (uint32_t )pbField;
669	}
670
671	pSelReg->Sel = u16Sel;
672	pSelReg->ValidSel = u16Sel;
673	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
674	pSelReg->u32Limit = u32Limit;
675	pSelReg->u64Base = u64Base;
676	pSelReg->Attr.u = u32Attr;
677	return VINF_SUCCESS;
678	}
679
680
681	/**
682	* Converts an IEM exception event type to a VMX event type.
683	*
684	* @returns The VMX event type.
685	* @param uVector The interrupt / exception vector.
686	* @param fFlags The IEM event flag (see IEM_XCPT_FLAGS_XXX).
687	*/
688	DECLINLINE(uint8_t) iemVmxGetEventType(uint32_t uVector, uint32_t fFlags)
689	{
690	/* Paranoia (callers may use these interchangeably). */
691	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_IDT_VECTORING_INFO_TYPE_NMI);
692	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT);
693	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT);
694	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT);
695	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_IDT_VECTORING_INFO_TYPE_SW_INT);
696	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_PRIV_SW_XCPT);
697	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_ENTRY_INT_INFO_TYPE_NMI);
698	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT);
699	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_ENTRY_INT_INFO_TYPE_EXT_INT);
700	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT);
701	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_ENTRY_INT_INFO_TYPE_SW_INT);
702	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT);
703
704	if (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
705	{
706	if (uVector == X86_XCPT_NMI)
707	return VMX_EXIT_INT_INFO_TYPE_NMI;
708	return VMX_EXIT_INT_INFO_TYPE_HW_XCPT;
709	}
710
711	if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
712	{
713	if (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
714	return VMX_EXIT_INT_INFO_TYPE_SW_XCPT;
715	if (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
716	return VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT;
717	return VMX_EXIT_INT_INFO_TYPE_SW_INT;
718	}
719
720	Assert(fFlags & IEM_XCPT_FLAGS_T_EXT_INT);
721	return VMX_EXIT_INT_INFO_TYPE_EXT_INT;
722	}
723
724
725	/**
726	* Determines whether the guest is using PAE paging given the VMCS.
727	*
728	* @returns @c true if PAE paging mode is used, @c false otherwise.
729	* @param pVmcs Pointer to the virtual VMCS.
730	*
731	* @warning Only use this prior to switching the guest-CPU state with the
732	* nested-guest CPU state!
733	*/
734	DECL_FORCE_INLINE(bool) iemVmxVmcsIsGuestPaePagingEnabled(PCVMXVVMCS pVmcs)
735	{
736	return ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST)
737	&& (pVmcs->u64GuestCr4.u & X86_CR4_PAE)
738	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG));
739	}
740
741
742	/**
743	* Sets the Exit qualification VMCS field.
744	*
745	* @param pVCpu The cross context virtual CPU structure.
746	* @param u64ExitQual The Exit qualification.
747	*/
748	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitQual(PVMCPUCC pVCpu, uint64_t u64ExitQual)
749	{
750	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoExitQual.u = u64ExitQual;
751	}
752
753
754	/**
755	* Sets the VM-exit interruption information field.
756	*
757	* @param pVCpu The cross context virtual CPU structure.
758	* @param uExitIntInfo The VM-exit interruption information.
759	*/
760	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntInfo(PVMCPUCC pVCpu, uint32_t uExitIntInfo)
761	{
762	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntInfo = uExitIntInfo;
763	}
764
765
766	/**
767	* Sets the VM-exit interruption error code.
768	*
769	* @param pVCpu The cross context virtual CPU structure.
770	* @param uErrCode The error code.
771	*/
772	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
773	{
774	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntErrCode = uErrCode;
775	}
776
777
778	/**
779	* Sets the IDT-vectoring information field.
780	*
781	* @param pVCpu The cross context virtual CPU structure.
782	* @param uIdtVectorInfo The IDT-vectoring information.
783	*/
784	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringInfo(PVMCPUCC pVCpu, uint32_t uIdtVectorInfo)
785	{
786	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo = uIdtVectorInfo;
787	}
788
789
790	/**
791	* Sets the IDT-vectoring error code field.
792	*
793	* @param pVCpu The cross context virtual CPU structure.
794	* @param uErrCode The error code.
795	*/
796	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
797	{
798	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringErrCode = uErrCode;
799	}
800
801
802	/**
803	* Sets the VM-exit guest-linear address VMCS field.
804	*
805	* @param pVCpu The cross context virtual CPU structure.
806	* @param uGuestLinearAddr The VM-exit guest-linear address.
807	*/
808	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestLinearAddr(PVMCPUCC pVCpu, uint64_t uGuestLinearAddr)
809	{
810	/* Bits 63:32 of guest-linear address MBZ if the guest isn't in long mode prior to the VM-exit. */
811	Assert(CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)) \|\| !(uGuestLinearAddr & UINT64_C(0xffffffff00000000)));
812	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestLinearAddr.u = uGuestLinearAddr;
813	}
814
815
816	/**
817	* Sets the VM-exit guest-physical address VMCS field.
818	*
819	* @param pVCpu The cross context virtual CPU structure.
820	* @param uGuestPhysAddr The VM-exit guest-physical address.
821	*/
822	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestPhysAddr(PVMCPUCC pVCpu, uint64_t uGuestPhysAddr)
823	{
824	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestPhysAddr.u = uGuestPhysAddr;
825	}
826
827
828	/**
829	* Sets the VM-exit instruction length VMCS field.
830	*
831	* @param pVCpu The cross context virtual CPU structure.
832	* @param cbInstr The VM-exit instruction length in bytes.
833	*
834	* @remarks Callers may clear this field to 0. Hence, this function does not check
835	* the validity of the instruction length.
836	*/
837	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrLen(PVMCPUCC pVCpu, uint32_t cbInstr)
838	{
839	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrLen = cbInstr;
840	}
841
842
843	/**
844	* Sets the VM-exit instruction info. VMCS field.
845	*
846	* @param pVCpu The cross context virtual CPU structure.
847	* @param uExitInstrInfo The VM-exit instruction information.
848	*/
849	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitInstrInfo)
850	{
851	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrInfo = uExitInstrInfo;
852	}
853
854
855	/**
856	* Sets the guest pending-debug exceptions field.
857	*
858	* @param pVCpu The cross context virtual CPU structure.
859	* @param uGuestPendingDbgXcpts The guest pending-debug exceptions.
860	*/
861	DECL_FORCE_INLINE(void) iemVmxVmcsSetGuestPendingDbgXcpts(PVMCPUCC pVCpu, uint64_t uGuestPendingDbgXcpts)
862	{
863	Assert(!(uGuestPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK));
864	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestPendingDbgXcpts.u = uGuestPendingDbgXcpts;
865	}
866
867
868	/**
869	* Implements VMSucceed for VMX instruction success.
870	*
871	* @param pVCpu The cross context virtual CPU structure.
872	*/
873	DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPUCC pVCpu)
874	{
875	return CPUMSetGuestVmxVmSucceed(&pVCpu->cpum.GstCtx);
876	}
877
878
879	/**
880	* Implements VMFailInvalid for VMX instruction failure.
881	*
882	* @param pVCpu The cross context virtual CPU structure.
883	*/
884	DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPUCC pVCpu)
885	{
886	return CPUMSetGuestVmxVmFailInvalid(&pVCpu->cpum.GstCtx);
887	}
888
889
890	/**
891	* Implements VMFail for VMX instruction failure.
892	*
893	* @param pVCpu The cross context virtual CPU structure.
894	* @param enmInsErr The VM instruction error.
895	*/
896	DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPUCC pVCpu, VMXINSTRERR enmInsErr)
897	{
898	return CPUMSetGuestVmxVmFail(&pVCpu->cpum.GstCtx, enmInsErr);
899	}
900
901
902	/**
903	* Checks if the given auto-load/store MSR area count is valid for the
904	* implementation.
905	*
906	* @returns @c true if it's within the valid limit, @c false otherwise.
907	* @param pVCpu The cross context virtual CPU structure.
908	* @param uMsrCount The MSR area count to check.
909	*/
910	DECL_FORCE_INLINE(bool) iemVmxIsAutoMsrCountValid(PCVMCPU pVCpu, uint32_t uMsrCount)
911	{
912	uint64_t const u64VmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
913	uint32_t const cMaxSupportedMsrs = VMX_MISC_MAX_MSRS(u64VmxMiscMsr);
914	Assert(cMaxSupportedMsrs <= VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
915	if (uMsrCount <= cMaxSupportedMsrs)
916	return true;
917	return false;
918	}
919
920
921	/**
922	* Flushes the current VMCS contents back to guest memory.
923	*
924	* @returns VBox status code.
925	* @param pVCpu The cross context virtual CPU structure.
926	*/
927	DECL_FORCE_INLINE(int) iemVmxWriteCurrentVmcsToGstMem(PVMCPUCC pVCpu)
928	{
929	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
930	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
931	&pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
932	return rc;
933	}
934
935
936	/**
937	* Populates the current VMCS contents from guest memory.
938	*
939	* @returns VBox status code.
940	* @param pVCpu The cross context virtual CPU structure.
941	*/
942	DECL_FORCE_INLINE(int) iemVmxReadCurrentVmcsFromGstMem(PVMCPUCC pVCpu)
943	{
944	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
945	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs,
946	IEM_VMX_GET_CURRENT_VMCS(pVCpu), sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
947	return rc;
948	}
949
950
951	/**
952	* Gets the instruction diagnostic for segment base checks during VM-entry of a
953	* nested-guest.
954	*
955	* @param iSegReg The segment index (X86_SREG_XXX).
956	*/
957	static VMXVDIAG iemVmxGetDiagVmentrySegBase(unsigned iSegReg) RT_NOEXCEPT
958	{
959	switch (iSegReg)
960	{
961	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseCs;
962	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseDs;
963	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseEs;
964	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseFs;
965	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseGs;
966	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseSs;
967	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_1);
968	}
969	}
970
971
972	/**
973	* Gets the instruction diagnostic for segment base checks during VM-entry of a
974	* nested-guest that is in Virtual-8086 mode.
975	*
976	* @param iSegReg The segment index (X86_SREG_XXX).
977	*/
978	static VMXVDIAG iemVmxGetDiagVmentrySegBaseV86(unsigned iSegReg) RT_NOEXCEPT
979	{
980	switch (iSegReg)
981	{
982	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseV86Cs;
983	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ds;
984	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseV86Es;
985	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseV86Fs;
986	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseV86Gs;
987	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ss;
988	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_2);
989	}
990	}
991
992
993	/**
994	* Gets the instruction diagnostic for segment limit checks during VM-entry of a
995	* nested-guest that is in Virtual-8086 mode.
996	*
997	* @param iSegReg The segment index (X86_SREG_XXX).
998	*/
999	static VMXVDIAG iemVmxGetDiagVmentrySegLimitV86(unsigned iSegReg) RT_NOEXCEPT
1000	{
1001	switch (iSegReg)
1002	{
1003	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegLimitV86Cs;
1004	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ds;
1005	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegLimitV86Es;
1006	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegLimitV86Fs;
1007	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegLimitV86Gs;
1008	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ss;
1009	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_3);
1010	}
1011	}
1012
1013
1014	/**
1015	* Gets the instruction diagnostic for segment attribute checks during VM-entry of a
1016	* nested-guest that is in Virtual-8086 mode.
1017	*
1018	* @param iSegReg The segment index (X86_SREG_XXX).
1019	*/
1020	static VMXVDIAG iemVmxGetDiagVmentrySegAttrV86(unsigned iSegReg) RT_NOEXCEPT
1021	{
1022	switch (iSegReg)
1023	{
1024	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrV86Cs;
1025	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ds;
1026	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrV86Es;
1027	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrV86Fs;
1028	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrV86Gs;
1029	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ss;
1030	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_4);
1031	}
1032	}
1033
1034
1035	/**
1036	* Gets the instruction diagnostic for segment attributes reserved bits failure
1037	* during VM-entry of a nested-guest.
1038	*
1039	* @param iSegReg The segment index (X86_SREG_XXX).
1040	*/
1041	static VMXVDIAG iemVmxGetDiagVmentrySegAttrRsvd(unsigned iSegReg) RT_NOEXCEPT
1042	{
1043	switch (iSegReg)
1044	{
1045	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdCs;
1046	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdDs;
1047	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrRsvdEs;
1048	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdFs;
1049	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdGs;
1050	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdSs;
1051	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_5);
1052	}
1053	}
1054
1055
1056	/**
1057	* Gets the instruction diagnostic for segment attributes descriptor-type
1058	* (code/segment or system) failure during VM-entry of a nested-guest.
1059	*
1060	* @param iSegReg The segment index (X86_SREG_XXX).
1061	*/
1062	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDescType(unsigned iSegReg) RT_NOEXCEPT
1063	{
1064	switch (iSegReg)
1065	{
1066	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeCs;
1067	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeDs;
1068	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeEs;
1069	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeFs;
1070	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeGs;
1071	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeSs;
1072	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_6);
1073	}
1074	}
1075
1076
1077	/**
1078	* Gets the instruction diagnostic for segment attributes descriptor-type
1079	* (code/segment or system) failure during VM-entry of a nested-guest.
1080	*
1081	* @param iSegReg The segment index (X86_SREG_XXX).
1082	*/
1083	static VMXVDIAG iemVmxGetDiagVmentrySegAttrPresent(unsigned iSegReg) RT_NOEXCEPT
1084	{
1085	switch (iSegReg)
1086	{
1087	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrPresentCs;
1088	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrPresentDs;
1089	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrPresentEs;
1090	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrPresentFs;
1091	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrPresentGs;
1092	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrPresentSs;
1093	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_7);
1094	}
1095	}
1096
1097
1098	/**
1099	* Gets the instruction diagnostic for segment attribute granularity failure during
1100	* VM-entry of a nested-guest.
1101	*
1102	* @param iSegReg The segment index (X86_SREG_XXX).
1103	*/
1104	static VMXVDIAG iemVmxGetDiagVmentrySegAttrGran(unsigned iSegReg) RT_NOEXCEPT
1105	{
1106	switch (iSegReg)
1107	{
1108	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrGranCs;
1109	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrGranDs;
1110	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrGranEs;
1111	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrGranFs;
1112	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrGranGs;
1113	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrGranSs;
1114	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_8);
1115	}
1116	}
1117
1118	/**
1119	* Gets the instruction diagnostic for segment attribute DPL/RPL failure during
1120	* VM-entry of a nested-guest.
1121	*
1122	* @param iSegReg The segment index (X86_SREG_XXX).
1123	*/
1124	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDplRpl(unsigned iSegReg) RT_NOEXCEPT
1125	{
1126	switch (iSegReg)
1127	{
1128	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplCs;
1129	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplDs;
1130	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDplRplEs;
1131	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplFs;
1132	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplGs;
1133	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplSs;
1134	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_9);
1135	}
1136	}
1137
1138
1139	/**
1140	* Gets the instruction diagnostic for segment attribute type accessed failure
1141	* during VM-entry of a nested-guest.
1142	*
1143	* @param iSegReg The segment index (X86_SREG_XXX).
1144	*/
1145	static VMXVDIAG iemVmxGetDiagVmentrySegAttrTypeAcc(unsigned iSegReg) RT_NOEXCEPT
1146	{
1147	switch (iSegReg)
1148	{
1149	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccCs;
1150	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccDs;
1151	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccEs;
1152	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccFs;
1153	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccGs;
1154	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccSs;
1155	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_10);
1156	}
1157	}
1158
1159
1160	/**
1161	* Saves the guest control registers, debug registers and some MSRs are part of
1162	* VM-exit.
1163	*
1164	* @param pVCpu The cross context virtual CPU structure.
1165	*/
1166	static void iemVmxVmexitSaveGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1167	{
1168	/*
1169	* Saves the guest control registers, debug registers and some MSRs.
1170	* See Intel spec. 27.3.1 "Saving Control Registers, Debug Registers and MSRs".
1171	*/
1172	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1173
1174	/* Save control registers. */
1175	pVmcs->u64GuestCr0.u = pVCpu->cpum.GstCtx.cr0;
1176	pVmcs->u64GuestCr3.u = pVCpu->cpum.GstCtx.cr3;
1177	pVmcs->u64GuestCr4.u = pVCpu->cpum.GstCtx.cr4;
1178
1179	/* Save SYSENTER CS, ESP, EIP. */
1180	pVmcs->u32GuestSysenterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1181	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1182	{
1183	pVmcs->u64GuestSysenterEsp.u = pVCpu->cpum.GstCtx.SysEnter.esp;
1184	pVmcs->u64GuestSysenterEip.u = pVCpu->cpum.GstCtx.SysEnter.eip;
1185	}
1186	else
1187	{
1188	pVmcs->u64GuestSysenterEsp.s.Lo = pVCpu->cpum.GstCtx.SysEnter.esp;
1189	pVmcs->u64GuestSysenterEip.s.Lo = pVCpu->cpum.GstCtx.SysEnter.eip;
1190	}
1191
1192	/* Save debug registers (DR7 and IA32_DEBUGCTL MSR). */
1193	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_DEBUG)
1194	{
1195	pVmcs->u64GuestDr7.u = pVCpu->cpum.GstCtx.dr[7];
1196	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1197	}
1198
1199	/* Save PAT MSR. */
1200	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PAT_MSR)
1201	pVmcs->u64GuestPatMsr.u = pVCpu->cpum.GstCtx.msrPAT;
1202
1203	/* Save EFER MSR. */
1204	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_EFER_MSR)
1205	pVmcs->u64GuestEferMsr.u = pVCpu->cpum.GstCtx.msrEFER;
1206
1207	/* We don't support clearing IA32_BNDCFGS MSR yet. */
1208	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_CLEAR_BNDCFGS_MSR));
1209
1210	/* Nothing to do for SMBASE register - We don't support SMM yet. */
1211	}
1212
1213
1214	/**
1215	* Saves the guest force-flags in preparation of entering the nested-guest.
1216	*
1217	* @param pVCpu The cross context virtual CPU structure.
1218	*/
1219	static void iemVmxVmentrySaveNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1220	{
1221	/* We shouldn't be called multiple times during VM-entry. */
1222	Assert(pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit == 0);
1223
1224	/* MTF should not be set outside VMX non-root mode. */
1225	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
1226
1227	/*
1228	* Preserve the required force-flags.
1229	*
1230	* We cache and clear force-flags that would affect the execution of the
1231	* nested-guest. Cached flags are then restored while returning to the guest
1232	* if necessary.
1233	*
1234	* - VMCPU_FF_INHIBIT_INTERRUPTS need not be cached as it only affects
1235	* interrupts until the completion of the current VMLAUNCH/VMRESUME
1236	* instruction. Interrupt inhibition for any nested-guest instruction
1237	* is supplied by the guest-interruptibility state VMCS field and will
1238	* be set up as part of loading the guest state. Technically
1239	* blocking-by-STI is possible with VMLAUNCH/VMRESUME but we currently
1240	* disallow it since we can't distinguish it from blocking-by-MovSS
1241	* and no nested-hypervisor we care about uses STI immediately
1242	* followed by VMLAUNCH/VMRESUME.
1243	*
1244	* - VMCPU_FF_BLOCK_NMIS needs to be cached as VM-exits caused before
1245	* successful VM-entry (due to invalid guest-state) need to continue
1246	* blocking NMIs if it was in effect before VM-entry.
1247	*
1248	* - MTF need not be preserved as it's used only in VMX non-root mode and
1249	* is supplied through the VM-execution controls.
1250	*
1251	* The remaining FFs (e.g. timers, APIC updates) can stay in place so that
1252	* we will be able to generate interrupts that may cause VM-exits for
1253	* the nested-guest.
1254	*/
1255	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
1256	}
1257
1258
1259	/**
1260	* Restores the guest force-flags in preparation of exiting the nested-guest.
1261	*
1262	* @param pVCpu The cross context virtual CPU structure.
1263	*/
1264	static void iemVmxVmexitRestoreNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1265	{
1266	/** @todo r=bird: why aren't we clearing the nested guest flags first here?
1267	* If there is some other code doing that already, it would be great
1268	* to point to it here... */
1269	pVCpu->cpum.GstCtx.eflags.uBoth \|= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
1270	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = 0;
1271	}
1272
1273
1274	/**
1275	* Performs the VMX transition to/from VMX non-root mode.
1276	*
1277	* @param pVCpu The cross context virtual CPU structure.
1278	* @param cbInstr The length of the current instruction.
1279	*/
1280	static int iemVmxTransition(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
1281	{
1282	/*
1283	* Inform PGM about paging mode changes.
1284	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
1285	* see comment in iemMemPageTranslateAndCheckAccess().
1286	*/
1287	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
1288	true /* fForce */);
1289	if (RT_SUCCESS(rc))
1290	{ /* likely */ }
1291	else
1292	return rc;
1293
1294	/* Invalidate IEM TLBs now that we've forced a PGM mode change. */
1295	IEMTlbInvalidateAll(pVCpu);
1296
1297	/* Inform CPUM (recompiler), can later be removed. */
1298	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
1299
1300	/* Re-initialize IEM cache/state after the drastic mode switch. */
1301	iemReInitExec(pVCpu, cbInstr);
1302	return rc;
1303	}
1304
1305
1306	/**
1307	* Calculates the current VMX-preemption timer value.
1308	*
1309	* @returns The current VMX-preemption timer value.
1310	* @param pVCpu The cross context virtual CPU structure.
1311	*/
1312	static uint32_t iemVmxCalcPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
1313	{
1314	/*
1315	* Assume the following:
1316	* PreemptTimerShift = 5
1317	* VmcsPreemptTimer = 2 (i.e. need to decrement by 1 every 2 * RT_BIT(5) = 20000 TSC ticks)
1318	* EntryTick = 50000 (TSC at time of VM-entry)
1319	*
1320	* CurTick Delta PreemptTimerVal
1321	* ----------------------------------
1322	* 60000 10000 2
1323	* 80000 30000 1
1324	* 90000 40000 0 -> VM-exit.
1325	*
1326	* If Delta >= VmcsPreemptTimer * RT_BIT(PreemptTimerShift) cause a VMX-preemption timer VM-exit.
1327	* The saved VMX-preemption timer value is calculated as follows:
1328	* PreemptTimerVal = VmcsPreemptTimer - (Delta / (VmcsPreemptTimer * RT_BIT(PreemptTimerShift)))
1329	* E.g.:
1330	* Delta = 10000
1331	* Tmp = 10000 / (2 * 10000) = 0.5
1332	* NewPt = 2 - 0.5 = 2
1333	* Delta = 30000
1334	* Tmp = 30000 / (2 * 10000) = 1.5
1335	* NewPt = 2 - 1.5 = 1
1336	* Delta = 40000
1337	* Tmp = 40000 / 20000 = 2
1338	* NewPt = 2 - 2 = 0
1339	*/
1340	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1341	uint32_t const uVmcsPreemptVal = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer;
1342	if (uVmcsPreemptVal > 0)
1343	{
1344	uint64_t const uCurTick = TMCpuTickGetNoCheck(pVCpu);
1345	uint64_t const uEntryTick = pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick;
1346	uint64_t const uDelta = uCurTick - uEntryTick;
1347	uint32_t const uPreemptTimer = uVmcsPreemptVal
1348	- ASMDivU64ByU32RetU32(uDelta, uVmcsPreemptVal * RT_BIT(VMX_V_PREEMPT_TIMER_SHIFT));
1349	return uPreemptTimer;
1350	}
1351	return 0;
1352	}
1353
1354
1355	/**
1356	* Saves guest segment registers, GDTR, IDTR, LDTR, TR as part of VM-exit.
1357	*
1358	* @param pVCpu The cross context virtual CPU structure.
1359	*/
1360	static void iemVmxVmexitSaveGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1361	{
1362	/*
1363	* Save guest segment registers, GDTR, IDTR, LDTR, TR.
1364	* See Intel spec 27.3.2 "Saving Segment Registers and Descriptor-Table Registers".
1365	*/
1366	/* CS, SS, ES, DS, FS, GS. */
1367	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1368	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1369	{
1370	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1371	if (!pSelReg->Attr.n.u1Unusable)
1372	iemVmxVmcsSetGuestSegReg(pVmcs, iSegReg, pSelReg);
1373	else
1374	{
1375	/*
1376	* For unusable segments the attributes are undefined except for CS and SS.
1377	* For the rest we don't bother preserving anything but the unusable bit.
1378	*/
1379	switch (iSegReg)
1380	{
1381	case X86_SREG_CS:
1382	pVmcs->GuestCs = pSelReg->Sel;
1383	pVmcs->u64GuestCsBase.u = pSelReg->u64Base;
1384	pVmcs->u32GuestCsLimit = pSelReg->u32Limit;
1385	pVmcs->u32GuestCsAttr = pSelReg->Attr.u & ( X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1386	\| X86DESCATTR_UNUSABLE);
1387	break;
1388
1389	case X86_SREG_SS:
1390	pVmcs->GuestSs = pSelReg->Sel;
1391	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1392	pVmcs->u64GuestSsBase.u &= UINT32_C(0xffffffff);
1393	pVmcs->u32GuestSsAttr = pSelReg->Attr.u & (X86DESCATTR_DPL \| X86DESCATTR_UNUSABLE);
1394	break;
1395
1396	case X86_SREG_DS:
1397	pVmcs->GuestDs = pSelReg->Sel;
1398	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1399	pVmcs->u64GuestDsBase.u &= UINT32_C(0xffffffff);
1400	pVmcs->u32GuestDsAttr = X86DESCATTR_UNUSABLE;
1401	break;
1402
1403	case X86_SREG_ES:
1404	pVmcs->GuestEs = pSelReg->Sel;
1405	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1406	pVmcs->u64GuestEsBase.u &= UINT32_C(0xffffffff);
1407	pVmcs->u32GuestEsAttr = X86DESCATTR_UNUSABLE;
1408	break;
1409
1410	case X86_SREG_FS:
1411	pVmcs->GuestFs = pSelReg->Sel;
1412	pVmcs->u64GuestFsBase.u = pSelReg->u64Base;
1413	pVmcs->u32GuestFsAttr = X86DESCATTR_UNUSABLE;
1414	break;
1415
1416	case X86_SREG_GS:
1417	pVmcs->GuestGs = pSelReg->Sel;
1418	pVmcs->u64GuestGsBase.u = pSelReg->u64Base;
1419	pVmcs->u32GuestGsAttr = X86DESCATTR_UNUSABLE;
1420	break;
1421	}
1422	}
1423	}
1424
1425	/* Segment attribute bits 31:17 and 11:8 MBZ. */
1426	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
1427	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1428	\| X86DESCATTR_UNUSABLE;
1429	/* LDTR. */
1430	{
1431	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.ldtr;
1432	pVmcs->GuestLdtr = pSelReg->Sel;
1433	pVmcs->u64GuestLdtrBase.u = pSelReg->u64Base;
1434	Assert(X86_IS_CANONICAL(pSelReg->u64Base));
1435	pVmcs->u32GuestLdtrLimit = pSelReg->u32Limit;
1436	pVmcs->u32GuestLdtrAttr = pSelReg->Attr.u & fValidAttrMask;
1437	}
1438
1439	/* TR. */
1440	{
1441	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.tr;
1442	pVmcs->GuestTr = pSelReg->Sel;
1443	pVmcs->u64GuestTrBase.u = pSelReg->u64Base;
1444	pVmcs->u32GuestTrLimit = pSelReg->u32Limit;
1445	pVmcs->u32GuestTrAttr = pSelReg->Attr.u & fValidAttrMask;
1446	}
1447
1448	/* GDTR. */
1449	pVmcs->u64GuestGdtrBase.u = pVCpu->cpum.GstCtx.gdtr.pGdt;
1450	pVmcs->u32GuestGdtrLimit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
1451
1452	/* IDTR. */
1453	pVmcs->u64GuestIdtrBase.u = pVCpu->cpum.GstCtx.idtr.pIdt;
1454	pVmcs->u32GuestIdtrLimit = pVCpu->cpum.GstCtx.idtr.cbIdt;
1455	}
1456
1457
1458	/**
1459	* Saves guest non-register state as part of VM-exit.
1460	*
1461	* @param pVCpu The cross context virtual CPU structure.
1462	* @param uExitReason The VM-exit reason.
1463	*/
1464	static void iemVmxVmexitSaveGuestNonRegState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1465	{
1466	/*
1467	* Save guest non-register state.
1468	* See Intel spec. 27.3.4 "Saving Non-Register State".
1469	*/
1470	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1471
1472	/*
1473	* Activity state.
1474	* Most VM-exits will occur in the active state. However, if the first instruction
1475	* following the VM-entry is a HLT instruction, and the MTF VM-execution control is set,
1476	* the VM-exit will be from the HLT activity state.
1477	*
1478	* See Intel spec. 25.5.2 "Monitor Trap Flag".
1479	*/
1480	/** @todo NSTVMX: Does triple-fault VM-exit reflect a shutdown activity state or
1481	* not? */
1482	EMSTATE const enmActivityState = EMGetState(pVCpu);
1483	switch (enmActivityState)
1484	{
1485	case EMSTATE_HALTED: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_HLT; break;
1486	default: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_ACTIVE; break;
1487	}
1488
1489	/*
1490	* Interruptibility-state.
1491	*/
1492	/* NMI. */
1493	pVmcs->u32GuestIntrState = 0;
1494	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
1495	{
1496	if (pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking)
1497	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1498	}
1499	else
1500	{
1501	if (CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx))
1502	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1503	}
1504
1505	/* Blocking-by-STI or blocking-by-MovSS. */
1506	uint32_t fInhibitShw;
1507	if (!CPUMIsInInterruptShadowWithUpdateEx(&pVCpu->cpum.GstCtx, &fInhibitShw))
1508	{ /* probable */}
1509	else
1510	{
1511	if (pVCpu->cpum.GstCtx.rip == pVCpu->cpum.GstCtx.uRipInhibitInt)
1512	{
1513	/*
1514	* We must ensure only one of these bits is set.
1515	* Our emulation can have both set (perhaps because AMD doesn't distinguish
1516	* between the two?). Hence, the 'else' with blocking-by-MovSS taking priority
1517	* since it blocks more. Nested Ubuntu 22.04.2 running inside a Hyper-V enabled
1518	* Windows Server 2008 R2 guest runs into this issue.
1519	*
1520	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
1521	*/
1522	if (fInhibitShw & CPUMCTX_INHIBIT_SHADOW_SS)
1523	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS;
1524	else
1525	{
1526	Assert(fInhibitShw & CPUMCTX_INHIBIT_SHADOW_STI);
1527	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_STI;
1528	}
1529	}
1530	}
1531	/* Nothing to do for SMI/enclave. We don't support enclaves or SMM yet. */
1532
1533	/*
1534	* Pending debug exceptions.
1535	*
1536	* For VM-exits where it is not applicable, we can safely zero out the field.
1537	* For VM-exits where it is applicable, it's expected to be updated by the caller already.
1538	*/
1539	if ( uExitReason != VMX_EXIT_INIT_SIGNAL
1540	&& uExitReason != VMX_EXIT_SMI
1541	&& uExitReason != VMX_EXIT_ERR_MACHINE_CHECK
1542	&& !VMXIsVmexitTrapLike(uExitReason))
1543	{
1544	/** @todo NSTVMX: also must exclude VM-exits caused by debug exceptions when
1545	* block-by-MovSS is in effect. */
1546	pVmcs->u64GuestPendingDbgXcpts.u = 0;
1547	}
1548
1549	/*
1550	* Save the VMX-preemption timer value back into the VMCS if the feature is enabled.
1551	*
1552	* For VMX-preemption timer VM-exits, we should have already written back 0 if the
1553	* feature is supported back into the VMCS, and thus there is nothing further to do here.
1554	*/
1555	if ( uExitReason != VMX_EXIT_PREEMPT_TIMER
1556	&& (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
1557	pVmcs->u32PreemptTimer = iemVmxCalcPreemptTimer(pVCpu);
1558
1559	/*
1560	* Save the guest PAE PDPTEs.
1561	*/
1562	if ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
1563	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
1564	{
1565	/*
1566	* Without EPT or when the nested-guest is not using PAE paging, the values saved
1567	* in the VMCS during VM-exit are undefined. We zero them here for consistency.
1568	*/
1569	pVmcs->u64GuestPdpte0.u = 0;
1570	pVmcs->u64GuestPdpte1.u = 0;
1571	pVmcs->u64GuestPdpte2.u = 0;
1572	pVmcs->u64GuestPdpte3.u = 0;
1573	}
1574	else
1575	{
1576	/*
1577	* With EPT and when the nested-guest is using PAE paging, we update the PDPTEs from
1578	* the nested-guest CPU context. Both IEM (Mov CRx) and hardware-assisted execution
1579	* of the nested-guest is expected to have updated them.
1580	*/
1581	pVmcs->u64GuestPdpte0.u = pVCpu->cpum.GstCtx.aPaePdpes[0].u;
1582	pVmcs->u64GuestPdpte1.u = pVCpu->cpum.GstCtx.aPaePdpes[1].u;
1583	pVmcs->u64GuestPdpte2.u = pVCpu->cpum.GstCtx.aPaePdpes[2].u;
1584	pVmcs->u64GuestPdpte3.u = pVCpu->cpum.GstCtx.aPaePdpes[3].u;
1585	}
1586
1587	/* Clear PGM's copy of the EPT pointer for added safety. */
1588	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
1589	PGMSetGuestEptPtr(pVCpu, 0 /* uEptPtr */);
1590	}
1591
1592
1593	/**
1594	* Saves the guest-state as part of VM-exit.
1595	*
1596	* @returns VBox status code.
1597	* @param pVCpu The cross context virtual CPU structure.
1598	* @param uExitReason The VM-exit reason.
1599	*/
1600	static void iemVmxVmexitSaveGuestState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1601	{
1602	iemVmxVmexitSaveGuestControlRegsMsrs(pVCpu);
1603	iemVmxVmexitSaveGuestSegRegs(pVCpu);
1604
1605	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRip.u = pVCpu->cpum.GstCtx.rip;
1606	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRsp.u = pVCpu->cpum.GstCtx.rsp;
1607	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRFlags.u = pVCpu->cpum.GstCtx.rflags.u; /** @todo NSTVMX: Check RFLAGS.RF handling. */
1608
1609	iemVmxVmexitSaveGuestNonRegState(pVCpu, uExitReason);
1610	}
1611
1612
1613	/**
1614	* Saves the guest MSRs into the VM-exit MSR-store area as part of VM-exit.
1615	*
1616	* @returns VBox status code.
1617	* @param pVCpu The cross context virtual CPU structure.
1618	* @param uExitReason The VM-exit reason (for diagnostic purposes).
1619	*/
1620	static int iemVmxVmexitSaveGuestAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1621	{
1622	/*
1623	* Save guest MSRs.
1624	* See Intel spec. 27.4 "Saving MSRs".
1625	*/
1626	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1627	const char * const pszFailure = "VMX-abort";
1628
1629	/*
1630	* The VM-exit MSR-store area address need not be a valid guest-physical address if the
1631	* VM-exit MSR-store count is 0. If this is the case, bail early without reading it.
1632	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1633	*/
1634	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrStoreCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea));
1635	if (!cMsrs)
1636	return VINF_SUCCESS;
1637
1638	/*
1639	* Verify the MSR auto-store count. Physical CPUs can behave unpredictably if the count
1640	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1641	* implementation causes a VMX-abort followed by a triple-fault.
1642	*/
1643	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1644	if (fIsMsrCountValid)
1645	{ /* likely */ }
1646	else
1647	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreCount);
1648
1649	/*
1650	* Optimization if the nested hypervisor is using the same guest-physical page for both
1651	* the VM-entry MSR-load area as well as the VM-exit MSR store area.
1652	*/
1653	PVMXAUTOMSR pMsrArea;
1654	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
1655	RTGCPHYS const GCPhysVmExitMsrStoreArea = pVmcs->u64AddrExitMsrStore.u;
1656	if (GCPhysVmEntryMsrLoadArea == GCPhysVmExitMsrStoreArea)
1657	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea;
1658	else
1659	{
1660	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea[0],
1661	GCPhysVmExitMsrStoreArea, cMsrs * sizeof(VMXAUTOMSR));
1662	if (RT_SUCCESS(rc))
1663	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea;
1664	else
1665	{
1666	AssertMsgFailed(("VM-exit: Failed to read MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1667	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrReadPhys);
1668	}
1669	}
1670
1671	/*
1672	* Update VM-exit MSR store area.
1673	*/
1674	PVMXAUTOMSR pMsr = pMsrArea;
1675	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1676	{
1677	if ( !pMsr->u32Reserved
1678	&& pMsr->u32Msr != MSR_IA32_SMBASE
1679	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1680	{
1681	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pMsr->u32Msr, &pMsr->u64Value);
1682	if (rcStrict == VINF_SUCCESS)
1683	continue;
1684
1685	/*
1686	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
1687	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
1688	* recording the MSR index in the auxiliary info. field and indicated further by our
1689	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
1690	* if possible, or come up with a better, generic solution.
1691	*/
1692	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1693	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_READ
1694	? kVmxVDiag_Vmexit_MsrStoreRing3
1695	: kVmxVDiag_Vmexit_MsrStore;
1696	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
1697	}
1698	else
1699	{
1700	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1701	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreRsvd);
1702	}
1703	}
1704
1705	/*
1706	* Commit the VM-exit MSR store are to guest memory.
1707	*/
1708	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmExitMsrStoreArea, pMsrArea, cMsrs * sizeof(VMXAUTOMSR));
1709	if (RT_SUCCESS(rc))
1710	return VINF_SUCCESS;
1711
1712	NOREF(uExitReason);
1713	NOREF(pszFailure);
1714
1715	AssertMsgFailed(("VM-exit: Failed to write MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1716	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrWritePhys);
1717	}
1718
1719
1720	/**
1721	* Performs a VMX abort (due to an fatal error during VM-exit).
1722	*
1723	* @returns Strict VBox status code.
1724	* @param pVCpu The cross context virtual CPU structure.
1725	* @param enmAbort The VMX abort reason.
1726	*/
1727	static VBOXSTRICTRC iemVmxAbort(PVMCPUCC pVCpu, VMXABORT enmAbort) RT_NOEXCEPT
1728	{
1729	/*
1730	* Perform the VMX abort.
1731	* See Intel spec. 27.7 "VMX Aborts".
1732	*/
1733	LogFunc(("enmAbort=%u (%s) -> RESET\n", enmAbort, VMXGetAbortDesc(enmAbort)));
1734
1735	/* We don't support SMX yet. */
1736	pVCpu->cpum.GstCtx.hwvirt.vmx.enmAbort = enmAbort;
1737	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1738	{
1739	RTGCPHYS const GCPhysVmcs = IEM_VMX_GET_CURRENT_VMCS(pVCpu);
1740	uint32_t const offVmxAbort = RT_UOFFSETOF(VMXVVMCS, enmVmxAbort);
1741	PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + offVmxAbort, &enmAbort, sizeof(enmAbort));
1742	}
1743
1744	return VINF_EM_TRIPLE_FAULT;
1745	}
1746
1747
1748	/**
1749	* Loads host control registers, debug registers and MSRs as part of VM-exit.
1750	*
1751	* @param pVCpu The cross context virtual CPU structure.
1752	*/
1753	static void iemVmxVmexitLoadHostControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1754	{
1755	/*
1756	* Load host control registers, debug registers and MSRs.
1757	* See Intel spec. 27.5.1 "Loading Host Control Registers, Debug Registers, MSRs".
1758	*/
1759	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1760	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1761
1762	/* CR0. */
1763	{
1764	/* Bits 63:32, 28:19, 17, 15:6, ET, CD, NW and CR0 fixed bits are not modified. */
1765	uint64_t const fCr0IgnMask = VMX_EXIT_HOST_CR0_IGNORE_MASK;
1766	uint64_t const uHostCr0 = pVmcs->u64HostCr0.u;
1767	uint64_t const uGuestCr0 = pVCpu->cpum.GstCtx.cr0;
1768	uint64_t const uValidHostCr0 = (uHostCr0 & ~fCr0IgnMask) \| (uGuestCr0 & fCr0IgnMask);
1769
1770	/* Verify we have not modified CR0 fixed bits in VMX operation. */
1771	#ifdef VBOX_STRICT
1772	uint64_t const uCr0Mb1 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
1773	bool const fUx = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
1774	AssertMsg( (uValidHostCr0 & uCr0Mb1) == uCr0Mb1
1775	&& (uValidHostCr0 & ~VMX_V_CR0_FIXED1) == 0,
1776	("host=%#RX64 guest=%#RX64 mb1=%#RX64 valid_host_cr0=%#RX64 fUx=%RTbool\n",
1777	uHostCr0, uGuestCr0, uCr0Mb1, uValidHostCr0, fUx));
1778	#endif
1779	Assert(!(uValidHostCr0 >> 32));
1780	CPUMSetGuestCR0(pVCpu, uValidHostCr0);
1781	}
1782
1783	/* CR4. */
1784	{
1785	/* CR4 fixed bits are not modified. */
1786	uint64_t const uCr4Mb1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
1787	uint64_t const uCr4Mb0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
1788	uint64_t const uHostCr4 = pVmcs->u64HostCr4.u;
1789	uint64_t uValidHostCr4 = (uHostCr4 & uCr4Mb0) \| uCr4Mb1;
1790	if (fHostInLongMode)
1791	uValidHostCr4 \|= X86_CR4_PAE;
1792	else
1793	uValidHostCr4 &= ~(uint64_t)X86_CR4_PCIDE;
1794
1795	/* Verify we have not modified CR4 fixed bits in VMX non-root operation. */
1796	AssertMsg( (uValidHostCr4 & uCr4Mb1) == uCr4Mb1
1797	&& (uValidHostCr4 & ~uCr4Mb0) == 0,
1798	("host=%#RX64 guest=%#RX64, uCr4Mb1=%#RX64 uCr4Mb0=%#RX64 valid_host_cr4=%#RX64\n",
1799	uHostCr4, pVCpu->cpum.GstCtx.cr4, uCr4Mb1, uCr4Mb0, uValidHostCr4));
1800	CPUMSetGuestCR4(pVCpu, uValidHostCr4);
1801	}
1802
1803	/* CR3 (host value validated while checking host-state during VM-entry). */
1804	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64HostCr3.u;
1805
1806	/* DR7. */
1807	pVCpu->cpum.GstCtx.dr[7] = X86_DR7_INIT_VAL;
1808
1809	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1810
1811	/* Save SYSENTER CS, ESP, EIP (host value validated while checking host-state during VM-entry). */
1812	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64HostSysenterEip.u;
1813	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64HostSysenterEsp.u;
1814	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32HostSysenterCs;
1815
1816	/* FS, GS bases are loaded later while we load host segment registers. */
1817
1818	/* EFER MSR (host value validated while checking host-state during VM-entry). */
1819	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
1820	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64HostEferMsr.u;
1821	else if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1822	{
1823	if (fHostInLongMode)
1824	pVCpu->cpum.GstCtx.msrEFER \|= (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1825	else
1826	pVCpu->cpum.GstCtx.msrEFER &= ~(MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1827	}
1828
1829	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
1830
1831	/* PAT MSR (host value is validated while checking host-state during VM-entry). */
1832	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
1833	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64HostPatMsr.u;
1834
1835	/* We don't support IA32_BNDCFGS MSR yet. */
1836	}
1837
1838
1839	/**
1840	* Loads host segment registers, GDTR, IDTR, LDTR and TR as part of VM-exit.
1841	*
1842	* @param pVCpu The cross context virtual CPU structure.
1843	*/
1844	static void iemVmxVmexitLoadHostSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1845	{
1846	/*
1847	* Load host segment registers, GDTR, IDTR, LDTR and TR.
1848	* See Intel spec. 27.5.2 "Loading Host Segment and Descriptor-Table Registers".
1849	*
1850	* Warning! Be careful to not touch fields that are reserved by VT-x,
1851	* e.g. segment limit high bits stored in segment attributes (in bits 11:8).
1852	*/
1853	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1854	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1855
1856	/* CS, SS, ES, DS, FS, GS. */
1857	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1858	{
1859	RTSEL const HostSel = iemVmxVmcsGetHostSelReg(pVmcs, iSegReg);
1860	bool const fUnusable = RT_BOOL(HostSel == 0);
1861	PCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1862
1863	/* Selector. */
1864	pSelReg->Sel = HostSel;
1865	pSelReg->ValidSel = HostSel;
1866	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
1867
1868	/* Limit. */
1869	pSelReg->u32Limit = 0xffffffff;
1870
1871	/* Base. */
1872	pSelReg->u64Base = 0;
1873
1874	/* Attributes. */
1875	if (iSegReg == X86_SREG_CS)
1876	{
1877	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED;
1878	pSelReg->Attr.n.u1DescType = 1;
1879	pSelReg->Attr.n.u2Dpl = 0;
1880	pSelReg->Attr.n.u1Present = 1;
1881	pSelReg->Attr.n.u1Long = fHostInLongMode;
1882	pSelReg->Attr.n.u1DefBig = !fHostInLongMode;
1883	pSelReg->Attr.n.u1Granularity = 1;
1884	Assert(!pSelReg->Attr.n.u1Unusable);
1885	Assert(!fUnusable);
1886	}
1887	else
1888	{
1889	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED;
1890	pSelReg->Attr.n.u1DescType = 1;
1891	pSelReg->Attr.n.u2Dpl = 0;
1892	pSelReg->Attr.n.u1Present = 1;
1893	pSelReg->Attr.n.u1DefBig = 1;
1894	pSelReg->Attr.n.u1Granularity = 1;
1895	pSelReg->Attr.n.u1Unusable = fUnusable;
1896	}
1897	}
1898
1899	/* FS base. */
1900	if ( !pVCpu->cpum.GstCtx.fs.Attr.n.u1Unusable
1901	\|\| fHostInLongMode)
1902	{
1903	Assert(X86_IS_CANONICAL(pVmcs->u64HostFsBase.u));
1904	pVCpu->cpum.GstCtx.fs.u64Base = pVmcs->u64HostFsBase.u;
1905	}
1906
1907	/* GS base. */
1908	if ( !pVCpu->cpum.GstCtx.gs.Attr.n.u1Unusable
1909	\|\| fHostInLongMode)
1910	{
1911	Assert(X86_IS_CANONICAL(pVmcs->u64HostGsBase.u));
1912	pVCpu->cpum.GstCtx.gs.u64Base = pVmcs->u64HostGsBase.u;
1913	}
1914
1915	/* TR. */
1916	Assert(X86_IS_CANONICAL(pVmcs->u64HostTrBase.u));
1917	Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1Unusable);
1918	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->HostTr;
1919	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->HostTr;
1920	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
1921	pVCpu->cpum.GstCtx.tr.u32Limit = X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN;
1922	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64HostTrBase.u;
1923	pVCpu->cpum.GstCtx.tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1924	pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType = 0;
1925	pVCpu->cpum.GstCtx.tr.Attr.n.u2Dpl = 0;
1926	pVCpu->cpum.GstCtx.tr.Attr.n.u1Present = 1;
1927	pVCpu->cpum.GstCtx.tr.Attr.n.u1DefBig = 0;
1928	pVCpu->cpum.GstCtx.tr.Attr.n.u1Granularity = 0;
1929
1930	/* LDTR (Warning! do not touch the base and limits here). */
1931	pVCpu->cpum.GstCtx.ldtr.Sel = 0;
1932	pVCpu->cpum.GstCtx.ldtr.ValidSel = 0;
1933	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
1934	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
1935
1936	/* GDTR. */
1937	Assert(X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u));
1938	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64HostGdtrBase.u;
1939	pVCpu->cpum.GstCtx.gdtr.cbGdt = 0xffff;
1940
1941	/* IDTR.*/
1942	Assert(X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u));
1943	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64HostIdtrBase.u;
1944	pVCpu->cpum.GstCtx.idtr.cbIdt = 0xffff;
1945	}
1946
1947
1948	/**
1949	* Loads the host MSRs from the VM-exit MSR-load area as part of VM-exit.
1950	*
1951	* @returns VBox status code.
1952	* @param pVCpu The cross context virtual CPU structure.
1953	* @param uExitReason The VMX instruction name (for logging purposes).
1954	*/
1955	static int iemVmxVmexitLoadHostAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1956	{
1957	/*
1958	* Load host MSRs.
1959	* See Intel spec. 27.6 "Loading MSRs".
1960	*/
1961	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1962	const char * const pszFailure = "VMX-abort";
1963
1964	/*
1965	* The VM-exit MSR-load area address need not be a valid guest-physical address if the
1966	* VM-exit MSR load count is 0. If this is the case, bail early without reading it.
1967	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1968	*/
1969	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea));
1970	if (!cMsrs)
1971	return VINF_SUCCESS;
1972
1973	/*
1974	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count
1975	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1976	* implementation causes a VMX-abort followed by a triple-fault.
1977	*/
1978	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1979	if (fIsMsrCountValid)
1980	{ /* likely */ }
1981	else
1982	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadCount);
1983
1984	RTGCPHYS const GCPhysVmExitMsrLoadArea = pVmcs->u64AddrExitMsrLoad.u;
1985	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea[0],
1986	GCPhysVmExitMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
1987	if (RT_SUCCESS(rc))
1988	{
1989	PCVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea;
1990	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1991	{
1992	if ( !pMsr->u32Reserved
1993	&& pMsr->u32Msr != MSR_K8_FS_BASE
1994	&& pMsr->u32Msr != MSR_K8_GS_BASE
1995	&& pMsr->u32Msr != MSR_K6_EFER
1996	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
1997	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1998	{
1999	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
2000	if (rcStrict == VINF_SUCCESS)
2001	continue;
2002
2003	/*
2004	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
2005	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
2006	* recording the MSR index in the auxiliary info. field and indicated further by our
2007	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
2008	* if possible, or come up with a better, generic solution.
2009	*/
2010	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
2011	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
2012	? kVmxVDiag_Vmexit_MsrLoadRing3
2013	: kVmxVDiag_Vmexit_MsrLoad;
2014	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
2015	}
2016	else
2017	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadRsvd);
2018	}
2019	}
2020	else
2021	{
2022	AssertMsgFailed(("VM-exit: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrLoadArea, rc));
2023	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadPtrReadPhys);
2024	}
2025
2026	NOREF(uExitReason);
2027	NOREF(pszFailure);
2028	return VINF_SUCCESS;
2029	}
2030
2031
2032	/**
2033	* Loads the host state as part of VM-exit.
2034	*
2035	* @returns Strict VBox status code.
2036	* @param pVCpu The cross context virtual CPU structure.
2037	* @param uExitReason The VM-exit reason (for logging purposes).
2038	*/
2039	static VBOXSTRICTRC iemVmxVmexitLoadHostState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
2040	{
2041	/*
2042	* Load host state.
2043	* See Intel spec. 27.5 "Loading Host State".
2044	*/
2045	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2046	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2047
2048	/* We cannot return from a long-mode guest to a host that is not in long mode. */
2049	if ( CPUMIsGuestInLongMode(pVCpu)
2050	&& !fHostInLongMode)
2051	{
2052	Log(("VM-exit from long-mode guest to host not in long-mode -> VMX-Abort\n"));
2053	return iemVmxAbort(pVCpu, VMXABORT_HOST_NOT_IN_LONG_MODE);
2054	}
2055
2056	/*
2057	* Check host PAE PDPTEs prior to loading the host state.
2058	* See Intel spec. 26.5.4 "Checking and Loading Host Page-Directory-Pointer-Table Entries".
2059	*/
2060	if ( (pVmcs->u64HostCr4.u & X86_CR4_PAE)
2061	&& !fHostInLongMode
2062	&& ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
2063	\|\| pVmcs->u64HostCr3.u != pVCpu->cpum.GstCtx.cr3))
2064	{
2065	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64HostCr3.u);
2066	if (RT_SUCCESS(rc))
2067	{ /* likely*/ }
2068	else
2069	{
2070	IEM_VMX_VMEXIT_FAILED(pVCpu, uExitReason, "VMX-abort", kVmxVDiag_Vmexit_HostPdpte);
2071	return iemVmxAbort(pVCpu, VMXBOART_HOST_PDPTE);
2072	}
2073	}
2074
2075	iemVmxVmexitLoadHostControlRegsMsrs(pVCpu);
2076	iemVmxVmexitLoadHostSegRegs(pVCpu);
2077
2078	/*
2079	* Load host RIP, RSP and RFLAGS.
2080	* See Intel spec. 27.5.3 "Loading Host RIP, RSP and RFLAGS"
2081	*/
2082	pVCpu->cpum.GstCtx.rip = pVmcs->u64HostRip.u;
2083	pVCpu->cpum.GstCtx.rsp = pVmcs->u64HostRsp.u;
2084	pVCpu->cpum.GstCtx.rflags.u = X86_EFL_1;
2085
2086	/* Clear address range monitoring. */
2087	EMMonitorWaitClear(pVCpu);
2088
2089	/* Perform the VMX transition (PGM updates). */
2090	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu, 0 /cbInstr - whatever/);
2091	if (rcStrict == VINF_SUCCESS)
2092	{ /* likely */ }
2093	else if (RT_SUCCESS(rcStrict))
2094	{
2095	Log3(("VM-exit: iemVmxTransition returns %Rrc (uExitReason=%u) -> Setting passup status\n", VBOXSTRICTRC_VAL(rcStrict),
2096	uExitReason));
2097	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
2098	}
2099	else
2100	{
2101	Log3(("VM-exit: iemVmxTransition failed! rc=%Rrc (uExitReason=%u)\n", VBOXSTRICTRC_VAL(rcStrict), uExitReason));
2102	return VBOXSTRICTRC_VAL(rcStrict);
2103	}
2104
2105	Assert(rcStrict == VINF_SUCCESS);
2106
2107	/* Load MSRs from the VM-exit auto-load MSR area. */
2108	int rc = iemVmxVmexitLoadHostAutoMsrs(pVCpu, uExitReason);
2109	if (RT_FAILURE(rc))
2110	{
2111	Log(("VM-exit failed while loading host MSRs -> VMX-Abort\n"));
2112	return iemVmxAbort(pVCpu, VMXABORT_LOAD_HOST_MSR);
2113	}
2114	return VINF_SUCCESS;
2115	}
2116
2117
2118	/**
2119	* Gets VM-exit instruction information along with any displacement for an
2120	* instruction VM-exit.
2121	*
2122	* @returns The VM-exit instruction information.
2123	* @param pVCpu The cross context virtual CPU structure.
2124	* @param uExitReason The VM-exit reason.
2125	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX).
2126	* @param pGCPtrDisp Where to store the displacement field. Optional, can be
2127	* NULL.
2128	*/
2129	static uint32_t iemVmxGetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, PRTGCPTR pGCPtrDisp) RT_NOEXCEPT
2130	{
2131	RTGCPTR GCPtrDisp;
2132	VMXEXITINSTRINFO ExitInstrInfo;
2133	ExitInstrInfo.u = 0;
2134
2135	/*
2136	* Get and parse the ModR/M byte from our decoded opcodes.
2137	*/
2138	uint8_t bRm;
2139	uint8_t const offModRm = pVCpu->iem.s.offModRm;
2140	IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
2141	if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
2142	{
2143	/*
2144	* ModR/M indicates register addressing.
2145	*
2146	* The primary/secondary register operands are reported in the iReg1 or iReg2
2147	* fields depending on whether it is a read/write form.
2148	*/
2149	uint8_t idxReg1;
2150	uint8_t idxReg2;
2151	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2152	{
2153	idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2154	idxReg2 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2155	}
2156	else
2157	{
2158	idxReg1 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2159	idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2160	}
2161	ExitInstrInfo.All.u2Scaling = 0;
2162	ExitInstrInfo.All.iReg1 = idxReg1;
2163	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2164	ExitInstrInfo.All.fIsRegOperand = 1;
2165	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2166	ExitInstrInfo.All.iSegReg = 0;
2167	ExitInstrInfo.All.iIdxReg = 0;
2168	ExitInstrInfo.All.fIdxRegInvalid = 1;
2169	ExitInstrInfo.All.iBaseReg = 0;
2170	ExitInstrInfo.All.fBaseRegInvalid = 1;
2171	ExitInstrInfo.All.iReg2 = idxReg2;
2172
2173	/* Displacement not applicable for register addressing. */
2174	GCPtrDisp = 0;
2175	}
2176	else
2177	{
2178	/*
2179	* ModR/M indicates memory addressing.
2180	*/
2181	uint8_t uScale = 0;
2182	bool fBaseRegValid = false;
2183	bool fIdxRegValid = false;
2184	uint8_t iBaseReg = 0;
2185	uint8_t iIdxReg = 0;
2186	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
2187	{
2188	/*
2189	* Parse the ModR/M, displacement for 16-bit addressing mode.
2190	* See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
2191	*/
2192	uint16_t u16Disp = 0;
2193	uint8_t const offDisp = offModRm + sizeof(bRm);
2194	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 6)
2195	{
2196	/* Displacement without any registers. */
2197	IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
2198	}
2199	else
2200	{
2201	/* Register (index and base). */
2202	switch (bRm & X86_MODRM_RM_MASK)
2203	{
2204	case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2205	case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2206	case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2207	case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2208	case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2209	case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2210	case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
2211	case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
2212	}
2213
2214	/* Register + displacement. */
2215	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2216	{
2217	case 0: break;
2218	case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
2219	case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
2220	default:
2221	{
2222	/* Register addressing, handled at the beginning. */
2223	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2224	break;
2225	}
2226	}
2227	}
2228
2229	Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
2230	GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
2231	}
2232	else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
2233	{
2234	/*
2235	* Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
2236	* See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
2237	*/
2238	uint32_t u32Disp = 0;
2239	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5)
2240	{
2241	/* Displacement without any registers. */
2242	uint8_t const offDisp = offModRm + sizeof(bRm);
2243	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2244	}
2245	else
2246	{
2247	/* Register (and perhaps scale, index and base). */
2248	uint8_t offDisp = offModRm + sizeof(bRm);
2249	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2250	if (iBaseReg == 4)
2251	{
2252	/* An SIB byte follows the ModR/M byte, parse it. */
2253	uint8_t bSib;
2254	uint8_t const offSib = offModRm + sizeof(bRm);
2255	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2256
2257	/* A displacement may follow SIB, update its offset. */
2258	offDisp += sizeof(bSib);
2259
2260	/* Get the scale. */
2261	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2262
2263	/* Get the index register. */
2264	iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
2265	fIdxRegValid = RT_BOOL(iIdxReg != 4);
2266
2267	/* Get the base register. */
2268	iBaseReg = bSib & X86_SIB_BASE_MASK;
2269	fBaseRegValid = true;
2270	if (iBaseReg == 5)
2271	{
2272	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2273	{
2274	/* Mod is 0 implies a 32-bit displacement with no base. */
2275	fBaseRegValid = false;
2276	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2277	}
2278	else
2279	{
2280	/* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
2281	iBaseReg = X86_GREG_xBP;
2282	}
2283	}
2284	}
2285
2286	/* Register + displacement. */
2287	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2288	{
2289	case 0: /* Handled above */ break;
2290	case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
2291	case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
2292	default:
2293	{
2294	/* Register addressing, handled at the beginning. */
2295	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2296	break;
2297	}
2298	}
2299	}
2300
2301	GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
2302	}
2303	else
2304	{
2305	Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
2306
2307	/*
2308	* Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
2309	* See Intel instruction spec. 2.2 "IA-32e Mode".
2310	*/
2311	uint64_t u64Disp = 0;
2312	bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5);
2313	if (fRipRelativeAddr)
2314	{
2315	/*
2316	* RIP-relative addressing mode.
2317	*
2318	* The displacement is 32-bit signed implying an offset range of +/-2G.
2319	* See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
2320	*/
2321	uint8_t const offDisp = offModRm + sizeof(bRm);
2322	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2323	}
2324	else
2325	{
2326	uint8_t offDisp = offModRm + sizeof(bRm);
2327
2328	/*
2329	* Register (and perhaps scale, index and base).
2330	*
2331	* REX.B extends the most-significant bit of the base register. However, REX.B
2332	* is ignored while determining whether an SIB follows the opcode. Hence, we
2333	* shall OR any REX.B bit -after- inspecting for an SIB byte below.
2334	*
2335	* See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
2336	*/
2337	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2338	if (iBaseReg == 4)
2339	{
2340	/* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
2341	uint8_t bSib;
2342	uint8_t const offSib = offModRm + sizeof(bRm);
2343	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2344
2345	/* Displacement may follow SIB, update its offset. */
2346	offDisp += sizeof(bSib);
2347
2348	/* Get the scale. */
2349	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2350
2351	/* Get the index. */
2352	iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) \| pVCpu->iem.s.uRexIndex;
2353	fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
2354
2355	/* Get the base. */
2356	iBaseReg = (bSib & X86_SIB_BASE_MASK);
2357	fBaseRegValid = true;
2358	if (iBaseReg == 5)
2359	{
2360	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2361	{
2362	/* Mod is 0 implies a signed 32-bit displacement with no base. */
2363	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2364	}
2365	else
2366	{
2367	/* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
2368	iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
2369	}
2370	}
2371	}
2372	iBaseReg \|= pVCpu->iem.s.uRexB;
2373
2374	/* Register + displacement. */
2375	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2376	{
2377	case 0: /* Handled above */ break;
2378	case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
2379	case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
2380	default:
2381	{
2382	/* Register addressing, handled at the beginning. */
2383	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2384	break;
2385	}
2386	}
2387	}
2388
2389	GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
2390	}
2391
2392	/*
2393	* The primary or secondary register operand is reported in iReg2 depending
2394	* on whether the primary operand is in read/write form.
2395	*/
2396	uint8_t idxReg2;
2397	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2398	{
2399	idxReg2 = bRm & X86_MODRM_RM_MASK;
2400	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2401	idxReg2 \|= pVCpu->iem.s.uRexB;
2402	}
2403	else
2404	{
2405	idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
2406	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2407	idxReg2 \|= pVCpu->iem.s.uRexReg;
2408	}
2409	ExitInstrInfo.All.u2Scaling = uScale;
2410	ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
2411	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2412	ExitInstrInfo.All.fIsRegOperand = 0;
2413	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2414	ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
2415	ExitInstrInfo.All.iIdxReg = iIdxReg;
2416	ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
2417	ExitInstrInfo.All.iBaseReg = iBaseReg;
2418	ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
2419	ExitInstrInfo.All.iReg2 = idxReg2;
2420	}
2421
2422	/*
2423	* Handle exceptions to the norm for certain instructions.
2424	* (e.g. some instructions convey an instruction identity in place of iReg2).
2425	*/
2426	switch (uExitReason)
2427	{
2428	case VMX_EXIT_GDTR_IDTR_ACCESS:
2429	{
2430	Assert(VMXINSTRID_IS_VALID(uInstrId));
2431	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2432	ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2433	ExitInstrInfo.GdtIdt.u2Undef0 = 0;
2434	break;
2435	}
2436
2437	case VMX_EXIT_LDTR_TR_ACCESS:
2438	{
2439	Assert(VMXINSTRID_IS_VALID(uInstrId));
2440	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2441	ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2442	ExitInstrInfo.LdtTr.u2Undef0 = 0;
2443	break;
2444	}
2445
2446	case VMX_EXIT_RDRAND:
2447	case VMX_EXIT_RDSEED:
2448	{
2449	Assert(VMXINSTRID_IS_VALID(uInstrId));
2450	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2451	Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
2452	ExitInstrInfo.RdrandRdseed.u3Undef0 = 0;
2453	ExitInstrInfo.RdrandRdseed.u4Undef0 = 0;
2454	ExitInstrInfo.RdrandRdseed.u19Undef0 = 0;
2455	break;
2456	}
2457	}
2458
2459	/* Update displacement and return the constructed VM-exit instruction information field. */
2460	if (pGCPtrDisp)
2461	*pGCPtrDisp = GCPtrDisp;
2462
2463	return ExitInstrInfo.u;
2464	}
2465
2466
2467	/**
2468	* VMX VM-exit handler.
2469	*
2470	* @returns Strict VBox status code.
2471	* @retval VINF_VMX_VMEXIT when the VM-exit is successful.
2472	* @retval VINF_EM_TRIPLE_FAULT when VM-exit is unsuccessful and leads to a
2473	* triple-fault.
2474	*
2475	* @param pVCpu The cross context virtual CPU structure.
2476	* @param uExitReason The VM-exit reason.
2477	* @param u64ExitQual The Exit qualification.
2478	*
2479	* @remarks We need not necessarily have completed VM-entry before a VM-exit is
2480	* called. Failures during VM-entry can cause VM-exits as well, so we
2481	* -cannot- assert we're in VMX non-root mode here.
2482	*/
2483	VBOXSTRICTRC iemVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual) RT_NOEXCEPT
2484	{
2485	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2486	RT_NOREF3(pVCpu, uExitReason, u64ExitQual);
2487	AssertMsgFailed(("VM-exit should only be invoked from ring-3 when nested-guest executes only in ring-3!\n"));
2488	return VERR_IEM_IPE_7;
2489	# else
2490	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2491
2492	/* Just count this as an exit and be done with that. */
2493	pVCpu->iem.s.cPotentialExits++;
2494
2495	/*
2496	* Import all the guest-CPU state.
2497	*
2498	* HM on returning to guest execution would have to reset up a whole lot of state
2499	* anyway, (e.g., VM-entry/VM-exit controls) and we do not ever import a part of
2500	* the state and flag reloading the entire state on re-entry. So import the entire
2501	* state here, see HMNotifyVmxNstGstVmexit() for more comments.
2502	*/
2503	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL);
2504
2505	/*
2506	* Ensure VM-entry interruption information valid bit is cleared.
2507	*
2508	* We do it here on every VM-exit so that even premature VM-exits (e.g. those caused
2509	* by invalid-guest state or machine-check exceptions) also clear this bit.
2510	*
2511	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry control fields".
2512	*/
2513	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
2514	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
2515
2516	/*
2517	* Update the VM-exit reason and Exit qualification.
2518	* Other VMCS read-only data fields are expected to be updated by the caller already.
2519	*/
2520	pVmcs->u32RoExitReason = uExitReason;
2521	pVmcs->u64RoExitQual.u = u64ExitQual;
2522
2523	Log2(("vmexit: reason=%u qual=%#RX64 cs:rip=%04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 eflags=%#RX32\n", uExitReason,
2524	pVmcs->u64RoExitQual.u, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
2525	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.eflags.u));
2526
2527	/*
2528	* Update the IDT-vectoring information fields if the VM-exit is triggered during delivery of an event.
2529	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2530	*/
2531	{
2532	uint8_t uVector;
2533	uint32_t fFlags;
2534	uint32_t uErrCode;
2535	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, &uVector, &fFlags, &uErrCode, NULL /* puCr2 */);
2536	if (fInEventDelivery)
2537	{
2538	/*
2539	* A VM-exit is not considered to occur during event delivery when the VM-exit is
2540	* caused by a triple-fault or the original event results in a double-fault that
2541	* causes the VM exit directly (exception bitmap). Therefore, we must not set the
2542	* original event information into the IDT-vectoring information fields.
2543	*
2544	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2545	*/
2546	if ( uExitReason != VMX_EXIT_TRIPLE_FAULT
2547	&& ( uExitReason != VMX_EXIT_XCPT_OR_NMI
2548	\|\| !VMX_EXIT_INT_INFO_IS_XCPT_DF(pVmcs->u32RoExitIntInfo)))
2549	{
2550	uint8_t const uIdtVectoringType = iemVmxGetEventType(uVector, fFlags);
2551	uint8_t const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
2552	uint32_t const uIdtVectoringInfo = RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VECTOR, uVector)
2553	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_TYPE, uIdtVectoringType)
2554	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_ERR_CODE_VALID, fErrCodeValid)
2555	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VALID, 1);
2556	iemVmxVmcsSetIdtVectoringInfo(pVCpu, uIdtVectoringInfo);
2557	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, uErrCode);
2558	Log2(("vmexit: idt_info=%#RX32 idt_err_code=%#RX32 cr2=%#RX64\n", uIdtVectoringInfo, uErrCode,
2559	pVCpu->cpum.GstCtx.cr2));
2560	}
2561	}
2562	}
2563
2564	/* The following VMCS fields should always be zero since we don't support injecting SMIs into a guest. */
2565	Assert(pVmcs->u64RoIoRcx.u == 0);
2566	Assert(pVmcs->u64RoIoRsi.u == 0);
2567	Assert(pVmcs->u64RoIoRdi.u == 0);
2568	Assert(pVmcs->u64RoIoRip.u == 0);
2569
2570	/*
2571	* Save the guest state back into the VMCS.
2572	* We only need to save the state when the VM-entry was successful.
2573	*/
2574	bool const fVmentryFailed = VMX_EXIT_REASON_HAS_ENTRY_FAILED(uExitReason);
2575	if (!fVmentryFailed)
2576	{
2577	/* We should not cause an NMI-window/interrupt-window VM-exit when injecting events as part of VM-entry. */
2578	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
2579	{
2580	Assert(uExitReason != VMX_EXIT_NMI_WINDOW);
2581	Assert(uExitReason != VMX_EXIT_INT_WINDOW);
2582	}
2583
2584	/* For exception or NMI VM-exits, the VM-exit interruption info. field must be valid. */
2585	Assert(uExitReason != VMX_EXIT_XCPT_OR_NMI \|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2586
2587	/* For external interrupts that occur while "acknowledge interrupt on exit" VM-exit is set,
2588	the VM-exit interruption info. field must be valid. */
2589	Assert( uExitReason != VMX_EXIT_EXT_INT
2590	\|\| !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
2591	\|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2592
2593	/*
2594	* If we support storing EFER.LMA into IA32e-mode guest field on VM-exit, we need to do that now.
2595	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry Control".
2596	*
2597	* It is not clear from the Intel spec. if this is done only when VM-entry succeeds.
2598	* If a VM-exit happens before loading guest EFER, we risk restoring the host EFER.LMA
2599	* as guest-CPU state would not been modified. Hence for now, we do this only when
2600	* the VM-entry succeeded.
2601	*/
2602	/** @todo r=ramshankar: Figure out if this bit gets set to host EFER.LMA on real
2603	* hardware when VM-exit fails during VM-entry (e.g. VERR_VMX_INVALID_GUEST_STATE). */
2604	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxExitSaveEferLma)
2605	{
2606	if (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LMA)
2607	pVmcs->u32EntryCtls \|= VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2608	else
2609	pVmcs->u32EntryCtls &= ~VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2610	}
2611
2612	/*
2613	* The rest of the high bits of the VM-exit reason are only relevant when the VM-exit
2614	* occurs in enclave mode/SMM which we don't support yet.
2615	*
2616	* If we ever add support for it, we can pass just the lower bits to the functions
2617	* below, till then an assert should suffice.
2618	*/
2619	Assert(!RT_HI_U16(uExitReason));
2620
2621	/* Save the guest state into the VMCS and restore guest MSRs from the auto-store guest MSR area. */
2622	iemVmxVmexitSaveGuestState(pVCpu, uExitReason);
2623	int rc = iemVmxVmexitSaveGuestAutoMsrs(pVCpu, uExitReason);
2624	if (RT_SUCCESS(rc))
2625	{ /* likely */ }
2626	else
2627	return iemVmxAbort(pVCpu, VMXABORT_SAVE_GUEST_MSRS);
2628
2629	/* Clear any saved NMI-blocking state so we don't assert on next VM-entry (if it was in effect on the previous one). */
2630	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit &= ~CPUMCTX_INHIBIT_NMI;
2631	}
2632	else
2633	{
2634	/* Restore the NMI-blocking state if VM-entry failed due to invalid guest state or while loading MSRs. */
2635	uint32_t const uExitReasonBasic = VMX_EXIT_REASON_BASIC(uExitReason);
2636	if ( uExitReasonBasic == VMX_EXIT_ERR_INVALID_GUEST_STATE
2637	\|\| uExitReasonBasic == VMX_EXIT_ERR_MSR_LOAD)
2638	iemVmxVmexitRestoreNmiBlockingFF(pVCpu);
2639	}
2640
2641	/*
2642	* Stop any running VMX-preemption timer if necessary.
2643	*/
2644	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
2645	CPUMStopGuestVmxPremptTimer(pVCpu);
2646
2647	/*
2648	* Clear the state of "NMI unblocked due to IRET" as otherwise we risk
2649	* reporting a stale state on a subsequent VM-exit. This state will be
2650	* re-established while emulating IRET in VMX non-root mode.
2651	*/
2652	pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
2653
2654	/*
2655	* Clear any pending VMX nested-guest force-flags.
2656	* These force-flags have no effect on (outer) guest execution and will
2657	* be re-evaluated and setup on the next nested-guest VM-entry.
2658	*/
2659	VMCPU_FF_CLEAR_MASK(pVCpu, VMCPU_FF_VMX_ALL_MASK);
2660
2661	/*
2662	* We're no longer in nested-guest execution mode.
2663	*
2664	* It is important to do this prior to loading the host state because
2665	* PGM looks at fInVmxNonRootMode to determine if it needs to perform
2666	* second-level address translation while switching to host CR3.
2667	*/
2668	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = false;
2669
2670	/* Restore the host (outer guest) state. */
2671	VBOXSTRICTRC rcStrict = iemVmxVmexitLoadHostState(pVCpu, uExitReason);
2672	if (RT_SUCCESS(rcStrict))
2673	{
2674	Assert(rcStrict == VINF_SUCCESS);
2675	rcStrict = VINF_VMX_VMEXIT;
2676	}
2677	else
2678	Log(("vmexit: Loading host-state failed. uExitReason=%u rc=%Rrc\n", uExitReason, VBOXSTRICTRC_VAL(rcStrict)));
2679
2680	/*
2681	* Restore non-zero Secondary-processor based VM-execution controls
2682	* when the "activate secondary controls" bit was not set.
2683	*/
2684	if (pVmcs->u32RestoreProcCtls2)
2685	{
2686	Assert(!(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS));
2687	pVmcs->u32ProcCtls2 = pVmcs->u32RestoreProcCtls2;
2688	pVmcs->u32RestoreProcCtls2 = 0;
2689	}
2690
2691	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
2692	{
2693	/* Notify HM that the current VMCS fields have been modified. */
2694	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
2695
2696	/* Notify HM that we've completed the VM-exit. */
2697	HMNotifyVmxNstGstVmexit(pVCpu);
2698	}
2699
2700	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2701	/* Revert any IEM-only nested-guest execution policy, otherwise return rcStrict. */
2702	Log(("vmexit: Disabling IEM-only EM execution policy!\n"));
2703	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2704	if (rcSched != VINF_SUCCESS)
2705	iemSetPassUpStatus(pVCpu, rcSched);
2706	# endif
2707	return rcStrict;
2708	# endif
2709	}
2710
2711
2712	/**
2713	* VMX VM-exit handler for VM-exits due to instruction execution.
2714	*
2715	* This is intended for instructions where the caller provides all the relevant
2716	* VM-exit information.
2717	*
2718	* @returns Strict VBox status code.
2719	* @param pVCpu The cross context virtual CPU structure.
2720	* @param pExitInfo Pointer to the VM-exit information.
2721	*/
2722	static VBOXSTRICTRC iemVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
2723	{
2724	/*
2725	* For instructions where any of the following fields are not applicable:
2726	* - Exit qualification must be cleared.
2727	* - VM-exit instruction info. is undefined.
2728	* - Guest-linear address is undefined.
2729	* - Guest-physical address is undefined.
2730	*
2731	* The VM-exit instruction length is mandatory for all VM-exits that are caused by
2732	* instruction execution. For VM-exits that are not due to instruction execution this
2733	* field is undefined.
2734	*
2735	* In our implementation in IEM, all undefined fields are generally cleared. However,
2736	* if the caller supplies information (from say the physical CPU directly) it is
2737	* then possible that the undefined fields are not cleared.
2738	*
2739	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2740	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
2741	*/
2742	Assert(pExitInfo);
2743	AssertMsg(pExitInfo->uReason <= VMX_EXIT_MAX, ("uReason=%u\n", pExitInfo->uReason));
2744	AssertMsg(pExitInfo->cbInstr >= 1 && pExitInfo->cbInstr <= 15,
2745	("uReason=%u cbInstr=%u\n", pExitInfo->uReason, pExitInfo->cbInstr));
2746
2747	/* Update all the relevant fields from the VM-exit instruction information struct. */
2748	iemVmxVmcsSetExitInstrInfo(pVCpu, pExitInfo->InstrInfo.u);
2749	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
2750	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
2751	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
2752
2753	/* Perform the VM-exit. */
2754	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
2755	}
2756
2757
2758	/**
2759	* VMX VM-exit handler for VM-exits due to instruction execution.
2760	*
2761	* This is intended for instructions that only provide the VM-exit instruction
2762	* length.
2763	*
2764	* @param pVCpu The cross context virtual CPU structure.
2765	* @param uExitReason The VM-exit reason.
2766	* @param cbInstr The instruction length in bytes.
2767	*/
2768	VBOXSTRICTRC iemVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr) RT_NOEXCEPT
2769	{
2770	#ifdef VBOX_STRICT
2771	/*
2772	* To prevent us from shooting ourselves in the foot.
2773	* The follow instructions should convey more than just the instruction length.
2774	*/
2775	switch (uExitReason)
2776	{
2777	case VMX_EXIT_INVEPT:
2778	case VMX_EXIT_INVPCID:
2779	case VMX_EXIT_INVVPID:
2780	case VMX_EXIT_LDTR_TR_ACCESS:
2781	case VMX_EXIT_GDTR_IDTR_ACCESS:
2782	case VMX_EXIT_VMCLEAR:
2783	case VMX_EXIT_VMPTRLD:
2784	case VMX_EXIT_VMPTRST:
2785	case VMX_EXIT_VMREAD:
2786	case VMX_EXIT_VMWRITE:
2787	case VMX_EXIT_VMXON:
2788	case VMX_EXIT_XRSTORS:
2789	case VMX_EXIT_XSAVES:
2790	case VMX_EXIT_RDRAND:
2791	case VMX_EXIT_RDSEED:
2792	case VMX_EXIT_IO_INSTR:
2793	AssertMsgFailedReturn(("Use iemVmxVmexitInstrNeedsInfo for uExitReason=%u\n", uExitReason), VERR_IEM_IPE_5);
2794	break;
2795	}
2796	#endif
2797
2798	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_INSTR_LEN(uExitReason, cbInstr);
2799	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2800	}
2801
2802
2803	/**
2804	* Interface for HM and EM to emulate VM-exit due to a triple-fault.
2805	*
2806	* @returns Strict VBox status code.
2807	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2808	* @thread EMT(pVCpu)
2809	*/
2810	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTripleFault(PVMCPUCC pVCpu)
2811	{
2812	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_TRIPLE_FAULT, 0 /* u64ExitQual */);
2813	Assert(!pVCpu->iem.s.cActiveMappings);
2814	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2815	}
2816
2817
2818	/**
2819	* Interface for HM and EM to emulate VM-exit due to startup-IPI (SIPI).
2820	*
2821	* @returns Strict VBox status code.
2822	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2823	* @param uVector The SIPI vector.
2824	* @thread EMT(pVCpu)
2825	*/
2826	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitStartupIpi(PVMCPUCC pVCpu, uint8_t uVector)
2827	{
2828	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_SIPI, uVector);
2829	Assert(!pVCpu->iem.s.cActiveMappings);
2830	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2831	}
2832
2833
2834	/**
2835	* Interface for HM and EM to emulate a VM-exit.
2836	*
2837	* If a specialized version of a VM-exit handler exists, that must be used instead.
2838	*
2839	* @returns Strict VBox status code.
2840	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2841	* @param uExitReason The VM-exit reason.
2842	* @param u64ExitQual The Exit qualification.
2843	* @thread EMT(pVCpu)
2844	*/
2845	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual)
2846	{
2847	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, uExitReason, u64ExitQual);
2848	Assert(!pVCpu->iem.s.cActiveMappings);
2849	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2850	}
2851
2852
2853	/**
2854	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2855	*
2856	* This is meant to be used for those instructions that VMX provides additional
2857	* decoding information beyond just the instruction length!
2858	*
2859	* @returns Strict VBox status code.
2860	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2861	* @param pExitInfo Pointer to the VM-exit information.
2862	* @thread EMT(pVCpu)
2863	*/
2864	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
2865	{
2866	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
2867	Assert(!pVCpu->iem.s.cActiveMappings);
2868	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2869	}
2870
2871
2872	/**
2873	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2874	*
2875	* This is meant to be used for those instructions that VMX provides only the
2876	* instruction length.
2877	*
2878	* @returns Strict VBox status code.
2879	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2880	* @param pExitInfo Pointer to the VM-exit information.
2881	* @param cbInstr The instruction length in bytes.
2882	* @thread EMT(pVCpu)
2883	*/
2884	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr)
2885	{
2886	VBOXSTRICTRC rcStrict = iemVmxVmexitInstr(pVCpu, uExitReason, cbInstr);
2887	Assert(!pVCpu->iem.s.cActiveMappings);
2888	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2889	}
2890
2891
2892	/**
2893	* VMX VM-exit handler for VM-exits due to instruction execution.
2894	*
2895	* This is intended for instructions that have a ModR/M byte and update the VM-exit
2896	* instruction information and Exit qualification fields.
2897	*
2898	* @param pVCpu The cross context virtual CPU structure.
2899	* @param uExitReason The VM-exit reason.
2900	* @param uInstrid The instruction identity (VMXINSTRID_XXX).
2901	* @param cbInstr The instruction length in bytes.
2902	*
2903	* @remarks Do not use this for INS/OUTS instruction.
2904	*/
2905	VBOXSTRICTRC iemVmxVmexitInstrNeedsInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, uint8_t cbInstr) RT_NOEXCEPT
2906	{
2907	#ifdef VBOX_STRICT
2908	/*
2909	* To prevent us from shooting ourselves in the foot.
2910	* The follow instructions convey specific info that require using their respective handlers.
2911	*/
2912	switch (uExitReason)
2913	{
2914	case VMX_EXIT_INVEPT:
2915	case VMX_EXIT_INVPCID:
2916	case VMX_EXIT_INVVPID:
2917	case VMX_EXIT_LDTR_TR_ACCESS:
2918	case VMX_EXIT_GDTR_IDTR_ACCESS:
2919	case VMX_EXIT_VMCLEAR:
2920	case VMX_EXIT_VMPTRLD:
2921	case VMX_EXIT_VMPTRST:
2922	case VMX_EXIT_VMREAD:
2923	case VMX_EXIT_VMWRITE:
2924	case VMX_EXIT_VMXON:
2925	case VMX_EXIT_XRSTORS:
2926	case VMX_EXIT_XSAVES:
2927	case VMX_EXIT_RDRAND:
2928	case VMX_EXIT_RDSEED:
2929	break;
2930	default:
2931	AssertMsgFailedReturn(("Use instruction-specific handler\n"), VERR_IEM_IPE_5);
2932	break;
2933	}
2934	#endif
2935
2936	/*
2937	* Update the Exit qualification field with displacement bytes.
2938	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2939	*/
2940	/* Construct the VM-exit instruction information. */
2941	RTGCPTR GCPtrDisp;
2942	uint32_t const uInstrInfo = iemVmxGetExitInstrInfo(pVCpu, uExitReason, uInstrId, &GCPtrDisp);
2943
2944	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO(uExitReason, GCPtrDisp, uInstrInfo, cbInstr);
2945	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2946	}
2947
2948
2949	/**
2950	* VMX VM-exit handler for VM-exits due to INVLPG.
2951	*
2952	* @returns Strict VBox status code.
2953	* @param pVCpu The cross context virtual CPU structure.
2954	* @param GCPtrPage The guest-linear address of the page being invalidated.
2955	* @param cbInstr The instruction length in bytes.
2956	*/
2957	VBOXSTRICTRC iemVmxVmexitInstrInvlpg(PVMCPUCC pVCpu, RTGCPTR GCPtrPage, uint8_t cbInstr) RT_NOEXCEPT
2958	{
2959	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_INVLPG, GCPtrPage, cbInstr);
2960	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(ExitInfo.u64Qual));
2961	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2962	}
2963
2964
2965	/**
2966	* VMX VM-exit handler for VM-exits due to LMSW.
2967	*
2968	* @returns Strict VBox status code.
2969	* @param pVCpu The cross context virtual CPU structure.
2970	* @param uGuestCr0 The current guest CR0.
2971	* @param pu16NewMsw The machine-status word specified in LMSW's source
2972	* operand. This will be updated depending on the VMX
2973	* guest/host CR0 mask if LMSW is not intercepted.
2974	* @param GCPtrEffDst The guest-linear address of the source operand in case
2975	* of a memory operand. For register operand, pass
2976	* NIL_RTGCPTR.
2977	* @param cbInstr The instruction length in bytes.
2978	*/
2979	VBOXSTRICTRC iemVmxVmexitInstrLmsw(PVMCPUCC pVCpu, uint32_t uGuestCr0, uint16_t *pu16NewMsw,
2980	RTGCPTR GCPtrEffDst, uint8_t cbInstr) RT_NOEXCEPT
2981	{
2982	Assert(pu16NewMsw);
2983
2984	uint16_t const uNewMsw = *pu16NewMsw;
2985	if (CPUMIsGuestVmxLmswInterceptSet(&pVCpu->cpum.GstCtx, uNewMsw))
2986	{
2987	Log2(("lmsw: Guest intercept -> VM-exit\n"));
2988	bool const fMemOperand = RT_BOOL(GCPtrEffDst != NIL_RTGCPTR);
2989	VMXVEXITINFO ExitInfo
2990	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
2991	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
2992	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_OP, fMemOperand)
2993	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_DATA, uNewMsw)
2994	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_LMSW),
2995	cbInstr);
2996	if (fMemOperand)
2997	{
2998	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(GCPtrEffDst));
2999	ExitInfo.u64GuestLinearAddr = GCPtrEffDst;
3000	}
3001	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3002	}
3003
3004	/*
3005	* If LMSW did not cause a VM-exit, any CR0 bits in the range 0:3 that is set in the
3006	* CR0 guest/host mask must be left unmodified.
3007	*
3008	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3009	*/
3010	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3011	uint32_t const fGstHostLmswMask = fGstHostMask & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3012	*pu16NewMsw = (uGuestCr0 & fGstHostLmswMask) \| (uNewMsw & ~fGstHostLmswMask);
3013
3014	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3015	}
3016
3017
3018	/**
3019	* VMX VM-exit handler for VM-exits due to CLTS.
3020	*
3021	* @returns Strict VBox status code.
3022	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the CLTS instruction did not cause a
3023	* VM-exit but must not modify the guest CR0.TS bit.
3024	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the CLTS instruction did not cause a
3025	* VM-exit and modification to the guest CR0.TS bit is allowed (subject to
3026	* CR0 fixed bits in VMX operation).
3027	* @param pVCpu The cross context virtual CPU structure.
3028	* @param cbInstr The instruction length in bytes.
3029	*/
3030	VBOXSTRICTRC iemVmxVmexitInstrClts(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3031	{
3032	/*
3033	* If CR0.TS is owned by the host:
3034	* - If CR0.TS is set in the read-shadow, we must cause a VM-exit.
3035	* - If CR0.TS is cleared in the read-shadow, no VM-exit is caused and the
3036	* CLTS instruction completes without clearing CR0.TS.
3037	*
3038	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3039	*/
3040	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3041	if (fGstHostMask & X86_CR0_TS)
3042	{
3043	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0ReadShadow.u & X86_CR0_TS)
3044	{
3045	Log2(("clts: Guest intercept -> VM-exit\n"));
3046	VMXVEXITINFO const ExitInfo
3047	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3048	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
3049	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3050	VMX_EXIT_QUAL_CRX_ACCESS_CLTS),
3051	cbInstr);
3052	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3053	}
3054	return VINF_VMX_MODIFIES_BEHAVIOR;
3055	}
3056
3057	/*
3058	* If CR0.TS is not owned by the host, the CLTS instructions operates normally
3059	* and may modify CR0.TS (subject to CR0 fixed bits in VMX operation).
3060	*/
3061	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3062	}
3063
3064
3065	/**
3066	* VMX VM-exit handler for VM-exits due to 'Mov CR0,GReg' and 'Mov CR4,GReg'
3067	* (CR0/CR4 write).
3068	*
3069	* @returns Strict VBox status code.
3070	* @param pVCpu The cross context virtual CPU structure.
3071	* @param iCrReg The control register (either CR0 or CR4).
3072	* @param uGuestCrX The current guest CR0/CR4.
3073	* @param puNewCrX Pointer to the new CR0/CR4 value. Will be updated if no
3074	* VM-exit is caused.
3075	* @param iGReg The general register from which the CR0/CR4 value is being
3076	* loaded.
3077	* @param cbInstr The instruction length in bytes.
3078	*/
3079	VBOXSTRICTRC iemVmxVmexitInstrMovToCr0Cr4(PVMCPUCC pVCpu, uint8_t iCrReg, uint64_t *puNewCrX,
3080	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3081	{
3082	Assert(puNewCrX);
3083	Assert(iCrReg == 0 \|\| iCrReg == 4);
3084	Assert(iGReg < X86_GREG_COUNT);
3085
3086	uint64_t const uNewCrX = *puNewCrX;
3087	if (CPUMIsGuestVmxMovToCr0Cr4InterceptSet(&pVCpu->cpum.GstCtx, iCrReg, uNewCrX))
3088	{
3089	Log2(("mov_Cr_Rd: (CR%u) Guest intercept -> VM-exit\n", iCrReg));
3090	VMXVEXITINFO const ExitInfo
3091	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3092	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, iCrReg)
3093	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3094	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3095	cbInstr);
3096	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3097	}
3098
3099	/*
3100	* If the Mov-to-CR0/CR4 did not cause a VM-exit, any bits owned by the host
3101	* must not be modified the instruction.
3102	*
3103	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3104	*/
3105	uint64_t uGuestCrX;
3106	uint64_t fGstHostMask;
3107	if (iCrReg == 0)
3108	{
3109	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
3110	uGuestCrX = pVCpu->cpum.GstCtx.cr0;
3111	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3112	}
3113	else
3114	{
3115	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
3116	uGuestCrX = pVCpu->cpum.GstCtx.cr4;
3117	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u;
3118	}
3119
3120	puNewCrX = (uGuestCrX & fGstHostMask) \| (puNewCrX & ~fGstHostMask);
3121	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3122	}
3123
3124
3125	/**
3126	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR3' (CR3 read).
3127	*
3128	* @returns VBox strict status code.
3129	* @param pVCpu The cross context virtual CPU structure.
3130	* @param iGReg The general register to which the CR3 value is being stored.
3131	* @param cbInstr The instruction length in bytes.
3132	*/
3133	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr3(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3134	{
3135	Assert(iGReg < X86_GREG_COUNT);
3136	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
3137
3138	/*
3139	* If the CR3-store exiting control is set, we must cause a VM-exit.
3140	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3141	*/
3142	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR3_STORE_EXIT)
3143	{
3144	Log2(("mov_Rd_Cr: (CR3) Guest intercept -> VM-exit\n"));
3145	VMXVEXITINFO const ExitInfo
3146	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3147	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3148	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3149	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3150	cbInstr);
3151	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3152	}
3153	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3154	}
3155
3156
3157	/**
3158	* VMX VM-exit handler for VM-exits due to 'Mov CR3,GReg' (CR3 write).
3159	*
3160	* @returns VBox strict status code.
3161	* @param pVCpu The cross context virtual CPU structure.
3162	* @param uNewCr3 The new CR3 value.
3163	* @param iGReg The general register from which the CR3 value is being
3164	* loaded.
3165	* @param cbInstr The instruction length in bytes.
3166	*/
3167	VBOXSTRICTRC iemVmxVmexitInstrMovToCr3(PVMCPUCC pVCpu, uint64_t uNewCr3, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3168	{
3169	Assert(iGReg < X86_GREG_COUNT);
3170
3171	/*
3172	* If the CR3-load exiting control is set and the new CR3 value does not
3173	* match any of the CR3-target values in the VMCS, we must cause a VM-exit.
3174	*
3175	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3176	*/
3177	if (CPUMIsGuestVmxMovToCr3InterceptSet(pVCpu, uNewCr3))
3178	{
3179	Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
3180	VMXVEXITINFO const ExitInfo
3181	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3182	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3183	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3184	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3185	VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3186	cbInstr);
3187	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3188	}
3189	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3190	}
3191
3192
3193	/**
3194	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR8' (CR8 read).
3195	*
3196	* @returns VBox strict status code.
3197	* @param pVCpu The cross context virtual CPU structure.
3198	* @param iGReg The general register to which the CR8 value is being stored.
3199	* @param cbInstr The instruction length in bytes.
3200	*/
3201	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3202	{
3203	Assert(iGReg < X86_GREG_COUNT);
3204
3205	/*
3206	* If the CR8-store exiting control is set, we must cause a VM-exit.
3207	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3208	*/
3209	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_STORE_EXIT)
3210	{
3211	Log2(("mov_Rd_Cr: (CR8) Guest intercept -> VM-exit\n"));
3212	VMXVEXITINFO const ExitInfo
3213	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3214	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3215	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3216	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3217	cbInstr);
3218	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3219	}
3220	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3221	}
3222
3223
3224	/**
3225	* VMX VM-exit handler for VM-exits due to 'Mov CR8,GReg' (CR8 write).
3226	*
3227	* @returns VBox strict status code.
3228	* @param pVCpu The cross context virtual CPU structure.
3229	* @param iGReg The general register from which the CR8 value is being
3230	* loaded.
3231	* @param cbInstr The instruction length in bytes.
3232	*/
3233	VBOXSTRICTRC iemVmxVmexitInstrMovToCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3234	{
3235	Assert(iGReg < X86_GREG_COUNT);
3236
3237	/*
3238	* If the CR8-load exiting control is set, we must cause a VM-exit.
3239	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3240	*/
3241	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_LOAD_EXIT)
3242	{
3243	Log2(("mov_Cr_Rd: (CR8) Guest intercept -> VM-exit\n"));
3244	VMXVEXITINFO const ExitInfo
3245	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3246	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3247	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3248	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3249	cbInstr);
3250	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3251	}
3252	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3253	}
3254
3255
3256	/**
3257	* VMX VM-exit handler for VM-exits due to 'Mov DRx,GReg' (DRx write) and 'Mov
3258	* GReg,DRx' (DRx read).
3259	*
3260	* @returns VBox strict status code.
3261	* @param pVCpu The cross context virtual CPU structure.
3262	* @param uInstrid The instruction identity (VMXINSTRID_MOV_TO_DRX or
3263	* VMXINSTRID_MOV_FROM_DRX).
3264	* @param iDrReg The debug register being accessed.
3265	* @param iGReg The general register to/from which the DRx value is being
3266	* store/loaded.
3267	* @param cbInstr The instruction length in bytes.
3268	*/
3269	VBOXSTRICTRC iemVmxVmexitInstrMovDrX(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint8_t iDrReg,
3270	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3271	{
3272	Assert(iDrReg <= 7);
3273	Assert(uInstrId == VMXINSTRID_MOV_TO_DRX \|\| uInstrId == VMXINSTRID_MOV_FROM_DRX);
3274	Assert(iGReg < X86_GREG_COUNT);
3275
3276	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_MOV_DR_EXIT)
3277	{
3278	VMXVEXITINFO const ExitInfo
3279	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_DRX,
3280	RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_REGISTER, iDrReg)
3281	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_GENREG, iGReg)
3282	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_DIRECTION,
3283	uInstrId == VMXINSTRID_MOV_TO_DRX
3284	? VMX_EXIT_QUAL_DRX_DIRECTION_WRITE
3285	: VMX_EXIT_QUAL_DRX_DIRECTION_READ),
3286	cbInstr);
3287	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3288	}
3289
3290	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3291	}
3292
3293
3294	/**
3295	* VMX VM-exit handler for VM-exits due to I/O instructions (IN and OUT).
3296	*
3297	* @returns VBox strict status code.
3298	* @param pVCpu The cross context virtual CPU structure.
3299	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_IN or
3300	* VMXINSTRID_IO_OUT).
3301	* @param u16Port The I/O port being accessed.
3302	* @param fImm Whether the I/O port was encoded using an immediate operand
3303	* or the implicit DX register.
3304	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3305	* @param cbInstr The instruction length in bytes.
3306	*/
3307	VBOXSTRICTRC iemVmxVmexitInstrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port,
3308	bool fImm, uint8_t cbAccess, uint8_t cbInstr) RT_NOEXCEPT
3309	{
3310	Assert(uInstrId == VMXINSTRID_IO_IN \|\| uInstrId == VMXINSTRID_IO_OUT);
3311	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3312
3313	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3314	{
3315	VMXVEXITINFO const ExitInfo
3316	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_IO_INSTR,
3317	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3318	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING, fImm)
3319	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port)
3320	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION,
3321	uInstrId == VMXINSTRID_IO_IN
3322	? VMX_EXIT_QUAL_IO_DIRECTION_IN
3323	: VMX_EXIT_QUAL_IO_DIRECTION_OUT),
3324	cbInstr);
3325	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3326	}
3327	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3328	}
3329
3330
3331	/**
3332	* VMX VM-exit handler for VM-exits due to string I/O instructions (INS and OUTS).
3333	*
3334	* @returns VBox strict status code.
3335	* @param pVCpu The cross context virtual CPU structure.
3336	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_INS or
3337	* VMXINSTRID_IO_OUTS).
3338	* @param u16Port The I/O port being accessed.
3339	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3340	* @param fRep Whether the instruction has a REP prefix or not.
3341	* @param ExitInstrInfo The VM-exit instruction info. field.
3342	* @param cbInstr The instruction length in bytes.
3343	*/
3344	VBOXSTRICTRC iemVmxVmexitInstrStrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port, uint8_t cbAccess,
3345	bool fRep, VMXEXITINSTRINFO ExitInstrInfo, uint8_t cbInstr) RT_NOEXCEPT
3346	{
3347	Assert(uInstrId == VMXINSTRID_IO_INS \|\| uInstrId == VMXINSTRID_IO_OUTS);
3348	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3349	Assert(ExitInstrInfo.StrIo.iSegReg < X86_SREG_COUNT);
3350	Assert(ExitInstrInfo.StrIo.u3AddrSize == 0 \|\| ExitInstrInfo.StrIo.u3AddrSize == 1 \|\| ExitInstrInfo.StrIo.u3AddrSize == 2);
3351	Assert(uInstrId != VMXINSTRID_IO_INS \|\| ExitInstrInfo.StrIo.iSegReg == X86_SREG_ES);
3352
3353	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3354	{
3355	/*
3356	* Figure out the guest-linear address and the direction bit (INS/OUTS).
3357	*/
3358	/** @todo r=ramshankar: Is there something in IEM that already does this? */
3359	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
3360	uint8_t const iSegReg = ExitInstrInfo.StrIo.iSegReg;
3361	uint8_t const uAddrSize = ExitInstrInfo.StrIo.u3AddrSize;
3362	uint64_t const uAddrSizeMask = s_auAddrSizeMasks[uAddrSize];
3363
3364	uint32_t uDirection;
3365	uint64_t uGuestLinearAddr;
3366	if (uInstrId == VMXINSTRID_IO_INS)
3367	{
3368	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_IN;
3369	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rdi & uAddrSizeMask);
3370	}
3371	else
3372	{
3373	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_OUT;
3374	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rsi & uAddrSizeMask);
3375	}
3376
3377	/*
3378	* If the segment is unusable, the guest-linear address in undefined.
3379	* We shall clear it for consistency.
3380	*
3381	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
3382	*/
3383	if (pVCpu->cpum.GstCtx.aSRegs[iSegReg].Attr.n.u1Unusable)
3384	uGuestLinearAddr = 0;
3385
3386	VMXVEXITINFO const ExitInfo
3387	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO_AND_LIN_ADDR(VMX_EXIT_IO_INSTR,
3388	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3389	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION, uDirection)
3390	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_STRING, 1)
3391	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_REP, fRep)
3392	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING,
3393	VMX_EXIT_QUAL_IO_ENCODING_DX)
3394	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port),
3395	IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxInsOutInfo
3396	? ExitInstrInfo.u : 0,
3397	cbInstr,
3398	uGuestLinearAddr);
3399	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3400	}
3401
3402	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3403	}
3404
3405
3406	/**
3407	* VMX VM-exit handler for VM-exits due to MWAIT.
3408	*
3409	* @returns VBox strict status code.
3410	* @param pVCpu The cross context virtual CPU structure.
3411	* @param fMonitorHwArmed Whether the address-range monitor hardware is armed.
3412	* @param cbInstr The instruction length in bytes.
3413	*/
3414	VBOXSTRICTRC iemVmxVmexitInstrMwait(PVMCPUCC pVCpu, bool fMonitorHwArmed, uint8_t cbInstr) RT_NOEXCEPT
3415	{
3416	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MWAIT, fMonitorHwArmed, cbInstr);
3417	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3418	}
3419
3420
3421	/**
3422	* VMX VM-exit handler for VM-exits due to PAUSE.
3423	*
3424	* @returns VBox strict status code.
3425	* @param pVCpu The cross context virtual CPU structure.
3426	* @param cbInstr The instruction length in bytes.
3427	*/
3428	static VBOXSTRICTRC iemVmxVmexitInstrPause(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3429	{
3430	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
3431
3432	/*
3433	* The PAUSE VM-exit is controlled by the "PAUSE exiting" control and the
3434	* "PAUSE-loop exiting" control.
3435	*
3436	* The PLE-Gap is the maximum number of TSC ticks between two successive executions of
3437	* the PAUSE instruction before we cause a VM-exit. The PLE-Window is the maximum amount
3438	* of TSC ticks the guest is allowed to execute in a pause loop before we must cause
3439	* a VM-exit.
3440	*
3441	* See Intel spec. 24.6.13 "Controls for PAUSE-Loop Exiting".
3442	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3443	*/
3444	bool fIntercept = false;
3445	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_PAUSE_EXIT)
3446	fIntercept = true;
3447	else if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PAUSE_LOOP_EXIT)
3448	&& IEM_GET_CPL(pVCpu) == 0)
3449	{
3450	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3451
3452	/*
3453	* A previous-PAUSE-tick value of 0 is used to identify the first time
3454	* execution of a PAUSE instruction after VM-entry at CPL 0. We must
3455	* consider this to be the first execution of PAUSE in a loop according
3456	* to the Intel.
3457	*
3458	* All subsequent records for the previous-PAUSE-tick we ensure that it
3459	* cannot be zero by OR'ing 1 to rule out the TSC wrap-around cases at 0.
3460	*/
3461	uint64_t *puFirstPauseLoopTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick;
3462	uint64_t *puPrevPauseTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick;
3463	uint64_t const uTick = TMCpuTickGet(pVCpu);
3464	uint32_t const uPleGap = pVmcs->u32PleGap;
3465	uint32_t const uPleWindow = pVmcs->u32PleWindow;
3466	if ( *puPrevPauseTick == 0
3467	\|\| uTick - *puPrevPauseTick > uPleGap)
3468	*puFirstPauseLoopTick = uTick;
3469	else if (uTick - *puFirstPauseLoopTick > uPleWindow)
3470	fIntercept = true;
3471
3472	*puPrevPauseTick = uTick \| 1;
3473	}
3474
3475	if (fIntercept)
3476	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_PAUSE, cbInstr);
3477
3478	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3479	}
3480
3481
3482	/**
3483	* VMX VM-exit handler for VM-exits due to task switches.
3484	*
3485	* @returns VBox strict status code.
3486	* @param pVCpu The cross context virtual CPU structure.
3487	* @param enmTaskSwitch The cause of the task switch.
3488	* @param SelNewTss The selector of the new TSS.
3489	* @param cbInstr The instruction length in bytes.
3490	*/
3491	VBOXSTRICTRC iemVmxVmexitTaskSwitch(PVMCPUCC pVCpu, IEMTASKSWITCH enmTaskSwitch, RTSEL SelNewTss, uint8_t cbInstr) RT_NOEXCEPT
3492	{
3493	/*
3494	* Task-switch VM-exits are unconditional and provide the Exit qualification.
3495	*
3496	* If the cause of the task switch is due to execution of CALL, IRET or the JMP
3497	* instruction or delivery of the exception generated by one of these instructions
3498	* lead to a task switch through a task gate in the IDT, we need to provide the
3499	* VM-exit instruction length. Any other means of invoking a task switch VM-exit
3500	* leaves the VM-exit instruction length field undefined.
3501	*
3502	* See Intel spec. 25.2 "Other Causes Of VM Exits".
3503	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
3504	*/
3505	Assert(cbInstr <= 15);
3506
3507	uint8_t uType;
3508	switch (enmTaskSwitch)
3509	{
3510	case IEMTASKSWITCH_CALL: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_CALL; break;
3511	case IEMTASKSWITCH_IRET: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IRET; break;
3512	case IEMTASKSWITCH_JUMP: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_JMP; break;
3513	case IEMTASKSWITCH_INT_XCPT: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IDT; break;
3514	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3515	}
3516
3517	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_NEW_TSS, SelNewTss)
3518	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_SOURCE, uType);
3519	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3520	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, u64ExitQual);
3521	}
3522
3523
3524	/**
3525	* VMX VM-exit handler for trap-like VM-exits.
3526	*
3527	* @returns VBox strict status code.
3528	* @param pVCpu The cross context virtual CPU structure.
3529	* @param pExitInfo Pointer to the VM-exit information.
3530	* @param pExitEventInfo Pointer to the VM-exit event information.
3531	*/
3532	static VBOXSTRICTRC iemVmxVmexitTrapLikeWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
3533	{
3534	Assert(VMXIsVmexitTrapLike(pExitInfo->uReason));
3535	iemVmxVmcsSetGuestPendingDbgXcpts(pVCpu, pExitInfo->u64GuestPendingDbgXcpts);
3536	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
3537	}
3538
3539
3540	/**
3541	* Interface for HM and EM to emulate a trap-like VM-exit (MTF, APIC-write,
3542	* Virtualized-EOI, TPR-below threshold).
3543	*
3544	* @returns Strict VBox status code.
3545	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3546	* @param pExitInfo Pointer to the VM-exit information.
3547	* @thread EMT(pVCpu)
3548	*/
3549	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTrapLike(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
3550	{
3551	Assert(pExitInfo);
3552	VBOXSTRICTRC rcStrict = iemVmxVmexitTrapLikeWithInfo(pVCpu, pExitInfo);
3553	Assert(!pVCpu->iem.s.cActiveMappings);
3554	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3555	}
3556
3557
3558	/**
3559	* VMX VM-exit handler for VM-exits due to task switches.
3560	*
3561	* This is intended for task switches where the caller provides all the relevant
3562	* VM-exit information.
3563	*
3564	* @returns VBox strict status code.
3565	* @param pVCpu The cross context virtual CPU structure.
3566	* @param pExitInfo Pointer to the VM-exit information.
3567	* @param pExitEventInfo Pointer to the VM-exit event information.
3568	*/
3569	static VBOXSTRICTRC iemVmxVmexitTaskSwitchWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
3570	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3571	{
3572	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3573	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3574	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3575	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3576	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, pExitInfo->u64Qual);
3577	}
3578
3579
3580	/**
3581	* Interface for HM and EM to emulate a VM-exit due to a task switch.
3582	*
3583	* @returns Strict VBox status code.
3584	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3585	* @param pExitInfo Pointer to the VM-exit information.
3586	* @param pExitEventInfo Pointer to the VM-exit event information.
3587	* @thread EMT(pVCpu)
3588	*/
3589	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTaskSwitch(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3590	{
3591	Assert(pExitInfo);
3592	Assert(pExitEventInfo);
3593	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3594	VBOXSTRICTRC rcStrict = iemVmxVmexitTaskSwitchWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3595	Assert(!pVCpu->iem.s.cActiveMappings);
3596	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3597	}
3598
3599
3600	/**
3601	* VMX VM-exit handler for VM-exits due to expiring of the preemption timer.
3602	*
3603	* @returns VBox strict status code.
3604	* @param pVCpu The cross context virtual CPU structure.
3605	*/
3606	VBOXSTRICTRC iemVmxVmexitPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
3607	{
3608	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
3609	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER);
3610
3611	/* Import the hardware virtualization state (for nested-guest VM-entry TSC-tick). */
3612	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3613
3614	/* Save the VMX-preemption timer value (of 0) back in to the VMCS if the CPU supports this feature. */
3615	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER)
3616	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer = 0;
3617
3618	/* Cause the VMX-preemption timer VM-exit. The Exit qualification MBZ. */
3619	return iemVmxVmexit(pVCpu, VMX_EXIT_PREEMPT_TIMER, 0 /* u64ExitQual */);
3620	}
3621
3622
3623	/**
3624	* Interface for HM and EM to emulate VM-exit due to expiry of the preemption timer.
3625	*
3626	* @returns Strict VBox status code.
3627	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3628	* @thread EMT(pVCpu)
3629	*/
3630	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitPreemptTimer(PVMCPUCC pVCpu)
3631	{
3632	VBOXSTRICTRC rcStrict = iemVmxVmexitPreemptTimer(pVCpu);
3633	Assert(!pVCpu->iem.s.cActiveMappings);
3634	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3635	}
3636
3637
3638	/**
3639	* VMX VM-exit handler for VM-exits due to external interrupts.
3640	*
3641	* @returns VBox strict status code.
3642	* @param pVCpu The cross context virtual CPU structure.
3643	* @param uVector The external interrupt vector (pass 0 if the interrupt
3644	* is still pending since we typically won't know the
3645	* vector).
3646	* @param fIntPending Whether the external interrupt is pending or
3647	* acknowledged in the interrupt controller.
3648	*/
3649	static VBOXSTRICTRC iemVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending) RT_NOEXCEPT
3650	{
3651	Assert(!fIntPending \|\| uVector == 0);
3652
3653	/* The VM-exit is subject to "External interrupt exiting" being set. */
3654	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT)
3655	{
3656	if (fIntPending)
3657	{
3658	/*
3659	* If the interrupt is pending and we don't need to acknowledge the
3660	* interrupt on VM-exit, cause the VM-exit immediately.
3661	*
3662	* See Intel spec 25.2 "Other Causes Of VM Exits".
3663	*/
3664	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT))
3665	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3666
3667	/*
3668	* If the interrupt is pending and we -do- need to acknowledge the interrupt
3669	* on VM-exit, postpone VM-exit till after the interrupt controller has been
3670	* acknowledged that the interrupt has been consumed. Callers would have to call
3671	* us again after getting the vector (and ofc, with fIntPending with false).
3672	*/
3673	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3674	}
3675
3676	/*
3677	* If the interrupt is no longer pending (i.e. it has been acknowledged) and the
3678	* "External interrupt exiting" and "Acknowledge interrupt on VM-exit" controls are
3679	* all set, we need to record the vector of the external interrupt in the
3680	* VM-exit interruption information field. Otherwise, mark this field as invalid.
3681	*
3682	* See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3683	*/
3684	uint32_t uExitIntInfo;
3685	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
3686	{
3687	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3688	uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3689	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_EXT_INT)
3690	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3691	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3692	}
3693	else
3694	uExitIntInfo = 0;
3695	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3696
3697	/*
3698	* Cause the VM-exit whether or not the vector has been stored
3699	* in the VM-exit interruption-information field.
3700	*/
3701	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3702	}
3703
3704	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3705	}
3706
3707
3708	/**
3709	* Interface for HM and EM to emulate VM-exit due to external interrupts.
3710	*
3711	* @returns Strict VBox status code.
3712	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3713	* @param uVector The external interrupt vector (pass 0 if the external
3714	* interrupt is still pending).
3715	* @param fIntPending Whether the external interrupt is pending or
3716	* acknowledged in the interrupt controller.
3717	* @thread EMT(pVCpu)
3718	*/
3719	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending)
3720	{
3721	VBOXSTRICTRC rcStrict = iemVmxVmexitExtInt(pVCpu, uVector, fIntPending);
3722	Assert(!pVCpu->iem.s.cActiveMappings);
3723	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3724	}
3725
3726
3727	/**
3728	* VMX VM-exit handler for VM-exits due to a double fault caused during delivery of
3729	* an event.
3730	*
3731	* @returns VBox strict status code.
3732	* @param pVCpu The cross context virtual CPU structure.
3733	*/
3734	VBOXSTRICTRC iemVmxVmexitEventDoubleFault(PVMCPUCC pVCpu) RT_NOEXCEPT
3735	{
3736	uint32_t const fXcptBitmap = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32XcptBitmap;
3737	if (fXcptBitmap & RT_BIT(X86_XCPT_DF))
3738	{
3739	/*
3740	* The NMI-unblocking due to IRET field need not be set for double faults.
3741	* See Intel spec. 31.7.1.2 "Resuming Guest Software After Handling An Exception".
3742	*/
3743	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, X86_XCPT_DF)
3744	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_HW_XCPT)
3745	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, 1)
3746	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, 0)
3747	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3748	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3749	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, 0 /* u64ExitQual */);
3750	}
3751
3752	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3753	}
3754
3755
3756	/**
3757	* VMX VM-exit handler for VM-exit due to delivery of an events.
3758	*
3759	* This is intended for VM-exit due to exceptions or NMIs where the caller provides
3760	* all the relevant VM-exit information.
3761	*
3762	* @returns VBox strict status code.
3763	* @param pVCpu The cross context virtual CPU structure.
3764	* @param pExitInfo Pointer to the VM-exit information.
3765	* @param pExitEventInfo Pointer to the VM-exit event information.
3766	*/
3767	static VBOXSTRICTRC iemVmxVmexitEventWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3768	{
3769	Assert(pExitInfo);
3770	Assert(pExitEventInfo);
3771	Assert(pExitInfo->uReason == VMX_EXIT_XCPT_OR_NMI);
3772	Assert(VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3773
3774	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3775	iemVmxVmcsSetExitIntInfo(pVCpu, pExitEventInfo->uExitIntInfo);
3776	iemVmxVmcsSetExitIntErrCode(pVCpu, pExitEventInfo->uExitIntErrCode);
3777	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3778	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3779	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, pExitInfo->u64Qual);
3780	}
3781
3782
3783	/**
3784	* Interface for HM and EM to emulate VM-exit due to NMIs.
3785	*
3786	* @returns Strict VBox status code.
3787	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3788	* @thread EMT(pVCpu)
3789	*/
3790	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcptNmi(PVMCPUCC pVCpu)
3791	{
3792	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_ONLY_REASON(VMX_EXIT_XCPT_OR_NMI);
3793	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_INT( RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1)
3794	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE,
3795	VMX_EXIT_INT_INFO_TYPE_NMI)
3796	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR,
3797	X86_XCPT_NMI),
3798	0);
3799	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
3800	Assert(!pVCpu->iem.s.cActiveMappings);
3801	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3802	}
3803
3804
3805	/**
3806	* Interface for HM and EM to emulate VM-exit due to exceptions.
3807	*
3808	* Exception includes NMIs, software exceptions (those generated by INT3 or
3809	* INTO) and privileged software exceptions (those generated by INT1/ICEBP).
3810	*
3811	* @returns Strict VBox status code.
3812	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3813	* @param pExitInfo Pointer to the VM-exit information.
3814	* @param pExitEventInfo Pointer to the VM-exit event information.
3815	* @thread EMT(pVCpu)
3816	*/
3817	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcpt(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3818	{
3819	Assert(pExitInfo);
3820	Assert(pExitEventInfo);
3821	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3822	Assert(!pVCpu->iem.s.cActiveMappings);
3823	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3824	}
3825
3826
3827	/**
3828	* VMX VM-exit handler for VM-exits due to delivery of an event.
3829	*
3830	* @returns VBox strict status code.
3831	* @param pVCpu The cross context virtual CPU structure.
3832	* @param uVector The interrupt / exception vector.
3833	* @param fFlags The flags (see IEM_XCPT_FLAGS_XXX).
3834	* @param uErrCode The error code associated with the event.
3835	* @param uCr2 The CR2 value in case of a \#PF exception.
3836	* @param cbInstr The instruction length in bytes.
3837	*/
3838	VBOXSTRICTRC iemVmxVmexitEvent(PVMCPUCC pVCpu, uint8_t uVector, uint32_t fFlags, uint32_t uErrCode,
3839	uint64_t uCr2, uint8_t cbInstr) RT_NOEXCEPT
3840	{
3841	/*
3842	* If the event is being injected as part of VM-entry, it is -not- subject to event
3843	* intercepts in the nested-guest. However, secondary exceptions that occur during
3844	* injection of any event -are- subject to event interception.
3845	*
3846	* See Intel spec. 26.5.1.2 "VM Exits During Event Injection".
3847	*/
3848	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
3849	{
3850	/*
3851	* If the event is a virtual-NMI (which is an NMI being inject during VM-entry)
3852	* virtual-NMI blocking must be set in effect rather than physical NMI blocking.
3853	*
3854	* See Intel spec. 24.6.1 "Pin-Based VM-Execution Controls".
3855	*/
3856	if ( uVector == X86_XCPT_NMI
3857	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
3858	&& (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
3859	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
3860	else
3861	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking);
3862
3863	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, true);
3864	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3865	}
3866
3867	/*
3868	* We are injecting an external interrupt, check if we need to cause a VM-exit now.
3869	* If not, the caller will continue delivery of the external interrupt as it would
3870	* normally. The interrupt is no longer pending in the interrupt controller at this
3871	* point.
3872	*/
3873	if (fFlags & IEM_XCPT_FLAGS_T_EXT_INT)
3874	{
3875	Assert(!VMX_IDT_VECTORING_INFO_IS_VALID(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo));
3876	return iemVmxVmexitExtInt(pVCpu, uVector, false /* fIntPending */);
3877	}
3878
3879	/*
3880	* Evaluate intercepts for hardware exceptions, software exceptions (#BP, #OF),
3881	* and privileged software exceptions (#DB generated by INT1/ICEBP) and software
3882	* interrupts.
3883	*/
3884	Assert(fFlags & (IEM_XCPT_FLAGS_T_CPU_XCPT \| IEM_XCPT_FLAGS_T_SOFT_INT));
3885	bool fIntercept;
3886	if ( !(fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3887	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3888	fIntercept = CPUMIsGuestVmxXcptInterceptSet(&pVCpu->cpum.GstCtx, uVector, uErrCode);
3889	else
3890	{
3891	/* Software interrupts cannot be intercepted and therefore do not cause a VM-exit. */
3892	fIntercept = false;
3893	}
3894
3895	/*
3896	* Now that we've determined whether the event causes a VM-exit, we need to construct the
3897	* relevant VM-exit information and cause the VM-exit.
3898	*/
3899	if (fIntercept)
3900	{
3901	Assert(!(fFlags & IEM_XCPT_FLAGS_T_EXT_INT));
3902
3903	/* Construct the rest of the event related information fields and cause the VM-exit. */
3904	uint64_t u64ExitQual;
3905	if (uVector == X86_XCPT_PF)
3906	{
3907	Assert(fFlags & IEM_XCPT_FLAGS_CR2);
3908	u64ExitQual = uCr2;
3909	}
3910	else if (uVector == X86_XCPT_DB)
3911	{
3912	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
3913	u64ExitQual = pVCpu->cpum.GstCtx.dr[6] & VMX_VMCS_EXIT_QUAL_VALID_MASK;
3914	}
3915	else
3916	u64ExitQual = 0;
3917
3918	uint8_t const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3919	bool const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
3920	uint8_t const uIntInfoType = iemVmxGetEventType(uVector, fFlags);
3921	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3922	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, uIntInfoType)
3923	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, fErrCodeValid)
3924	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3925	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3926	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3927	iemVmxVmcsSetExitIntErrCode(pVCpu, uErrCode);
3928
3929	/*
3930	* For VM-exits due to software exceptions (those generated by INT3 or INTO) or privileged
3931	* software exceptions (those generated by INT1/ICEBP) we need to supply the VM-exit instruction
3932	* length.
3933	*/
3934	if ( (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3935	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3936	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3937	else
3938	iemVmxVmcsSetExitInstrLen(pVCpu, 0);
3939
3940	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, u64ExitQual);
3941	}
3942
3943	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3944	}
3945
3946
3947	/**
3948	* VMX VM-exit handler for EPT misconfiguration.
3949	*
3950	* @param pVCpu The cross context virtual CPU structure.
3951	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3952	* This need not be page aligned (e.g. nested-guest in real
3953	* mode).
3954	*/
3955	static VBOXSTRICTRC iemVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr) RT_NOEXCEPT
3956	{
3957	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3958	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3959	}
3960
3961
3962	/**
3963	* VMX VM-exit handler for EPT misconfiguration.
3964	*
3965	* This is intended for EPT misconfigurations where the caller provides all the
3966	* relevant VM-exit information.
3967	*
3968	* @param pVCpu The cross context virtual CPU structure.
3969	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3970	* This need not be page aligned (e.g. nested-guest in real
3971	* mode).
3972	* @param pExitEventInfo Pointer to the VM-exit event information.
3973	*/
3974	static VBOXSTRICTRC iemVmxVmexitEptMisconfigWithInfo(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3975	{
3976	Assert(pExitEventInfo);
3977	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3978	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3979	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3980	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3981	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3982	}
3983
3984
3985	/**
3986	* Interface for HM and EM to emulate a VM-exit due to an EPT misconfiguration.
3987	*
3988	* @returns Strict VBox status code.
3989	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3990	* @param GCPhysAddr The nested-guest physical address causing the EPT
3991	* misconfiguration.
3992	* @param pExitEventInfo Pointer to the VM-exit event information.
3993	* @thread EMT(pVCpu)
3994	*/
3995	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo)
3996	{
3997	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
3998
3999	iemInitExec(pVCpu, 0 /fExecOpts/);
4000	VBOXSTRICTRC rcStrict = iemVmxVmexitEptMisconfigWithInfo(pVCpu, GCPhysAddr, pExitEventInfo);
4001	Assert(!pVCpu->iem.s.cActiveMappings);
4002	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
4003	}
4004
4005
4006	/**
4007	* VMX VM-exit handler for EPT violation.
4008	*
4009	* @param pVCpu The cross context virtual CPU structure.
4010	* @param fAccess The access causing the EPT violation, IEM_ACCESS_XXX.
4011	* @param fSlatFail The SLAT failure info, IEM_SLAT_FAIL_XXX.
4012	* @param fEptAccess The EPT paging structure bits.
4013	* @param GCPhysAddr The physical address causing the EPT violation. This
4014	* need not be page aligned (e.g. nested-guest in real
4015	* mode).
4016	* @param fIsLinearAddrValid Whether translation of a linear address caused this
4017	* EPT violation. If @c false, GCPtrAddr must be 0.
4018	* @param GCPtrAddr The linear address causing the EPT violation.
4019	* @param cbInstr The VM-exit instruction length.
4020	*/
4021	static VBOXSTRICTRC iemVmxVmexitEptViolation(PVMCPUCC pVCpu, uint32_t fAccess, uint32_t fSlatFail,
4022	uint64_t fEptAccess, RTGCPHYS GCPhysAddr, bool fIsLinearAddrValid,
4023	uint64_t GCPtrAddr, uint8_t cbInstr) RT_NOEXCEPT
4024	{
4025	/*
4026	* If the linear address isn't valid (can happen when loading PDPTEs
4027	* as part of MOV CR execution) the linear address field is undefined.
4028	* While we can leave it this way, it's preferable to zero it for consistency.
4029	*/
4030	Assert(fIsLinearAddrValid \|\| GCPtrAddr == 0);
4031
4032	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
4033	bool const fSupportsAccessDirty = RT_BOOL(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ACCESS_DIRTY);
4034
4035	uint32_t const fDataRdMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_READ;
4036	uint32_t const fDataWrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_WRITE;
4037	uint32_t const fInstrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_EXEC;
4038	bool const fDataRead = ((fAccess & fDataRdMask) == IEM_ACCESS_DATA_R) \| fSupportsAccessDirty;
4039	bool const fDataWrite = ((fAccess & fDataWrMask) == IEM_ACCESS_DATA_W) \| fSupportsAccessDirty;
4040	bool const fInstrFetch = ((fAccess & fInstrMask) == IEM_ACCESS_INSTRUCTION);
4041	bool const fEptRead = RT_BOOL(fEptAccess & EPT_E_READ);
4042	bool const fEptWrite = RT_BOOL(fEptAccess & EPT_E_WRITE);
4043	bool const fEptExec = RT_BOOL(fEptAccess & EPT_E_EXECUTE);
4044	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
4045	bool const fIsLinearToPhysAddr = fIsLinearAddrValid & RT_BOOL(fSlatFail & IEM_SLAT_FAIL_LINEAR_TO_PHYS_ADDR);
4046
4047	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_READ, fDataRead)
4048	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_WRITE, fDataWrite)
4049	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_INSTR_FETCH, fInstrFetch)
4050	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_READ, fEptRead)
4051	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_WRITE, fEptWrite)
4052	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_EXECUTE, fEptExec)
4053	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID, fIsLinearAddrValid)
4054	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_TO_PHYS_ADDR, fIsLinearToPhysAddr)
4055	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_NMI_UNBLOCK_IRET, fNmiUnblocking);
4056
4057	#ifdef VBOX_STRICT
4058	uint64_t const fMiscCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
4059	uint32_t const fProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2;
4060	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ADVEXITINFO_EPT_VIOLATION)); /* Advanced VM-exit info. not supported */
4061	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_SUPER_SHW_STACK)); /* Supervisor shadow stack control not supported. */
4062	Assert(!(RT_BF_GET(fMiscCaps, VMX_BF_MISC_INTEL_PT))); /* Intel PT not supported. */
4063	Assert(!(fProcCtls2 & VMX_PROC_CTLS2_MODE_BASED_EPT_PERM)); /* Mode-based execute control not supported. */
4064	#endif
4065
4066	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
4067	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, GCPtrAddr);
4068	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
4069
4070	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, u64ExitQual);
4071	}
4072
4073
4074	/**
4075	* VMX VM-exit handler for EPT violation.
4076	*
4077	* This is intended for EPT violations where the caller provides all the
4078	* relevant VM-exit information.
4079	*
4080	* @returns VBox strict status code.
4081	* @param pVCpu The cross context virtual CPU structure.
4082	* @param pExitInfo Pointer to the VM-exit information.
4083	* @param pExitEventInfo Pointer to the VM-exit event information.
4084	*/
4085	static VBOXSTRICTRC iemVmxVmexitEptViolationWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4086	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4087	{
4088	Assert(pExitInfo);
4089	Assert(pExitEventInfo);
4090	Assert(pExitInfo->uReason == VMX_EXIT_EPT_VIOLATION);
4091	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4092
4093	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4094	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4095
4096	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
4097	if (pExitInfo->u64Qual & VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID_MASK)
4098	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
4099	else
4100	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, 0);
4101	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4102	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, pExitInfo->u64Qual);
4103	}
4104
4105
4106	/**
4107	* Interface for HM and EM to emulate a VM-exit due to an EPT violation.
4108	*
4109	* @returns Strict VBox status code.
4110	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4111	* @param pExitInfo Pointer to the VM-exit information.
4112	* @param pExitEventInfo Pointer to the VM-exit event information.
4113	* @thread EMT(pVCpu)
4114	*/
4115	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptViolation(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4116	PCVMXVEXITEVENTINFO pExitEventInfo)
4117	{
4118	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
4119
4120	iemInitExec(pVCpu, 0 /fExecOpts/);
4121	VBOXSTRICTRC rcStrict = iemVmxVmexitEptViolationWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4122	Assert(!pVCpu->iem.s.cActiveMappings);
4123	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
4124	}
4125
4126
4127	/**
4128	* VMX VM-exit handler for EPT-induced VM-exits.
4129	*
4130	* @param pVCpu The cross context virtual CPU structure.
4131	* @param pWalk The page walk info.
4132	* @param fAccess The access causing the EPT event, IEM_ACCESS_XXX.
4133	* @param fSlatFail Additional SLAT info, IEM_SLAT_FAIL_XXX.
4134	* @param cbInstr The VM-exit instruction length if applicable. Pass 0 if not
4135	* applicable.
4136	*/
4137	VBOXSTRICTRC iemVmxVmexitEpt(PVMCPUCC pVCpu, PPGMPTWALK pWalk, uint32_t fAccess, uint32_t fSlatFail, uint8_t cbInstr) RT_NOEXCEPT
4138	{
4139	Assert(pWalk->fIsSlat);
4140	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT);
4141	Assert(!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEptXcptVe); /* #VE exceptions not supported. */
4142	Assert(!(pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION_CONVERTIBLE)); /* Without #VE, convertible violations not possible. */
4143
4144	if (pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION)
4145	{
4146	LogFlow(("EptViolation: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4147	uint64_t const fEptAccess = (pWalk->fEffective & PGM_PTATTRS_EPT_MASK) >> PGM_PTATTRS_EPT_SHIFT;
4148	return iemVmxVmexitEptViolation(pVCpu, fAccess, fSlatFail, fEptAccess, pWalk->GCPhysNested, pWalk->fIsLinearAddrValid,
4149	pWalk->GCPtr, cbInstr);
4150	}
4151
4152	LogFlow(("EptMisconfig: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4153	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT_MISCONFIG);
4154	return iemVmxVmexitEptMisconfig(pVCpu, pWalk->GCPhysNested);
4155	}
4156
4157
4158	/**
4159	* VMX VM-exit handler for APIC accesses.
4160	*
4161	* @param pVCpu The cross context virtual CPU structure.
4162	* @param offAccess The offset of the register being accessed.
4163	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4164	*/
4165	static VBOXSTRICTRC iemVmxVmexitApicAccess(PVMCPUCC pVCpu, uint16_t offAccess, uint32_t fAccess) RT_NOEXCEPT
4166	{
4167	VMXAPICACCESS enmAccess;
4168	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, NULL, NULL, NULL, NULL);
4169	if (fInEventDelivery)
4170	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
4171	else if ((fAccess & (IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_MASK)) == IEM_ACCESS_INSTRUCTION)
4172	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
4173	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
4174	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
4175	else
4176	enmAccess = VMXAPICACCESS_LINEAR_READ;
4177
4178	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
4179	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess);
4180	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, u64ExitQual);
4181	}
4182
4183
4184	/**
4185	* VMX VM-exit handler for APIC accesses.
4186	*
4187	* This is intended for APIC accesses where the caller provides all the
4188	* relevant VM-exit information.
4189	*
4190	* @returns VBox strict status code.
4191	* @param pVCpu The cross context virtual CPU structure.
4192	* @param pExitInfo Pointer to the VM-exit information.
4193	* @param pExitEventInfo Pointer to the VM-exit event information.
4194	*/
4195	static VBOXSTRICTRC iemVmxVmexitApicAccessWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4196	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4197	{
4198	/* VM-exit interruption information should not be valid for APIC-access VM-exits. */
4199	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4200	Assert(pExitInfo->uReason == VMX_EXIT_APIC_ACCESS);
4201	iemVmxVmcsSetExitIntInfo(pVCpu, 0);
4202	iemVmxVmcsSetExitIntErrCode(pVCpu, 0);
4203	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4204	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4205	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4206	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, pExitInfo->u64Qual);
4207	}
4208
4209
4210	/**
4211	* Interface for HM and EM to virtualize memory-mapped APIC accesses.
4212	*
4213	* @returns Strict VBox status code.
4214	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the memory access was virtualized.
4215	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4216	*
4217	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4218	* @param pExitInfo Pointer to the VM-exit information.
4219	* @param pExitEventInfo Pointer to the VM-exit event information.
4220	* @thread EMT(pVCpu)
4221	*/
4222	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicAccess(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
4223	{
4224	Assert(pExitInfo);
4225	Assert(pExitEventInfo);
4226	VBOXSTRICTRC rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4227	Assert(!pVCpu->iem.s.cActiveMappings);
4228	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4229	}
4230
4231
4232	/**
4233	* VMX VM-exit handler for APIC-write VM-exits.
4234	*
4235	* @param pVCpu The cross context virtual CPU structure.
4236	* @param offApic The write to the virtual-APIC page offset that caused this
4237	* VM-exit.
4238	*/
4239	static VBOXSTRICTRC iemVmxVmexitApicWrite(PVMCPUCC pVCpu, uint16_t offApic) RT_NOEXCEPT
4240	{
4241	Assert(offApic < XAPIC_OFF_END + 4);
4242	/* Write only bits 11:0 of the APIC offset into the Exit qualification field. */
4243	offApic &= UINT16_C(0xfff);
4244	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_WRITE, offApic);
4245	}
4246
4247
4248	/**
4249	* Clears any pending virtual-APIC write emulation.
4250	*
4251	* @returns The virtual-APIC offset that was written before clearing it.
4252	* @param pVCpu The cross context virtual CPU structure.
4253	*/
4254	DECLINLINE(uint16_t) iemVmxVirtApicClearPendingWrite(PVMCPUCC pVCpu)
4255	{
4256	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
4257	uint8_t const offVirtApicWrite = pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite;
4258	pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite = 0;
4259	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
4260	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_VMX_APIC_WRITE);
4261	return offVirtApicWrite;
4262	}
4263
4264
4265	/**
4266	* Reads a 32-bit register from the virtual-APIC page at the given offset.
4267	*
4268	* @returns The register from the virtual-APIC page.
4269	* @param pVCpu The cross context virtual CPU structure.
4270	* @param offReg The offset of the register being read.
4271	*/
4272	uint32_t iemVmxVirtApicReadRaw32(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4273	{
4274	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4275
4276	uint32_t uReg = 0;
4277	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4278	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4279	AssertMsgStmt(RT_SUCCESS(rc),
4280	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4281	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4282	uReg = 0);
4283	return uReg;
4284	}
4285
4286
4287	/**
4288	* Reads a 64-bit register from the virtual-APIC page at the given offset.
4289	*
4290	* @returns The register from the virtual-APIC page.
4291	* @param pVCpu The cross context virtual CPU structure.
4292	* @param offReg The offset of the register being read.
4293	*/
4294	static uint64_t iemVmxVirtApicReadRaw64(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4295	{
4296	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4297
4298	uint64_t uReg = 0;
4299	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4300	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4301	AssertMsgStmt(RT_SUCCESS(rc),
4302	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4303	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4304	uReg = 0);
4305	return uReg;
4306	}
4307
4308
4309	/**
4310	* Writes a 32-bit register to the virtual-APIC page at the given offset.
4311	*
4312	* @param pVCpu The cross context virtual CPU structure.
4313	* @param offReg The offset of the register being written.
4314	* @param uReg The register value to write.
4315	*/
4316	void iemVmxVirtApicWriteRaw32(PVMCPUCC pVCpu, uint16_t offReg, uint32_t uReg) RT_NOEXCEPT
4317	{
4318	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4319
4320	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4321	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4322	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4323	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4324	}
4325
4326
4327	/**
4328	* Writes a 64-bit register to the virtual-APIC page at the given offset.
4329	*
4330	* @param pVCpu The cross context virtual CPU structure.
4331	* @param offReg The offset of the register being written.
4332	* @param uReg The register value to write.
4333	*/
4334	static void iemVmxVirtApicWriteRaw64(PVMCPUCC pVCpu, uint16_t offReg, uint64_t uReg) RT_NOEXCEPT
4335	{
4336	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4337
4338	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4339	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4340	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4341	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4342	}
4343
4344
4345	/**
4346	* Sets the vector in a virtual-APIC 256-bit sparse register.
4347	*
4348	* @param pVCpu The cross context virtual CPU structure.
4349	* @param offReg The offset of the 256-bit spare register.
4350	* @param uVector The vector to set.
4351	*
4352	* @remarks This is based on our APIC device code.
4353	*/
4354	static void iemVmxVirtApicSetVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4355	{
4356	/* Determine the vector offset within the chunk. */
4357	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4358
4359	/* Read the chunk at the offset. */
4360	uint32_t uReg;
4361	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4362	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4363	if (RT_SUCCESS(rc))
4364	{
4365	/* Modify the chunk. */
4366	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4367	uReg \|= RT_BIT(idxVectorBit);
4368
4369	/* Write the chunk. */
4370	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4371	AssertMsgRC(rc, ("Failed to set vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4372	uVector, offReg, GCPhysVirtApic, rc));
4373	}
4374	else
4375	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4376	uVector, offReg, GCPhysVirtApic, rc));
4377	}
4378
4379
4380	/**
4381	* Clears the vector in a virtual-APIC 256-bit sparse register.
4382	*
4383	* @param pVCpu The cross context virtual CPU structure.
4384	* @param offReg The offset of the 256-bit spare register.
4385	* @param uVector The vector to clear.
4386	*
4387	* @remarks This is based on our APIC device code.
4388	*/
4389	static void iemVmxVirtApicClearVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4390	{
4391	/* Determine the vector offset within the chunk. */
4392	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4393
4394	/* Read the chunk at the offset. */
4395	uint32_t uReg;
4396	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4397	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4398	if (RT_SUCCESS(rc))
4399	{
4400	/* Modify the chunk. */
4401	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4402	uReg &= ~RT_BIT(idxVectorBit);
4403
4404	/* Write the chunk. */
4405	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4406	AssertMsgRC(rc, ("Failed to clear vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4407	uVector, offReg, GCPhysVirtApic, rc));
4408	}
4409	else
4410	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4411	uVector, offReg, GCPhysVirtApic, rc));
4412	}
4413
4414
4415	/**
4416	* Checks if a memory access to the APIC-access page must causes an APIC-access
4417	* VM-exit.
4418	*
4419	* @param pVCpu The cross context virtual CPU structure.
4420	* @param offAccess The offset of the register being accessed.
4421	* @param cbAccess The size of the access in bytes.
4422	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4423	*
4424	* @remarks This must not be used for MSR-based APIC-access page accesses!
4425	* @sa iemVmxVirtApicAccessMsrWrite, iemVmxVirtApicAccessMsrRead.
4426	*/
4427	static bool iemVmxVirtApicIsMemAccessIntercepted(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4428	{
4429	Assert(cbAccess > 0);
4430	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4431
4432	/*
4433	* We must cause a VM-exit if any of the following are true:
4434	* - TPR shadowing isn't active.
4435	* - The access size exceeds 32-bits.
4436	* - The access is not contained within low 4 bytes of a 16-byte aligned offset.
4437	*
4438	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4439	* See Intel spec. 29.4.3.1 "Determining Whether a Write Access is Virtualized".
4440	*/
4441	if ( !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
4442	\|\| cbAccess > sizeof(uint32_t)
4443	\|\| ((offAccess + cbAccess - 1) & 0xc)
4444	\|\| offAccess >= XAPIC_OFF_END + 4)
4445	return true;
4446
4447	/*
4448	* If the access is part of an operation where we have already
4449	* virtualized a virtual-APIC write, we must cause a VM-exit.
4450	*/
4451	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
4452	return true;
4453
4454	/*
4455	* Check write accesses to the APIC-access page that cause VM-exits.
4456	*/
4457	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4458	{
4459	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4460	{
4461	/*
4462	* With APIC-register virtualization, a write access to any of the
4463	* following registers are virtualized. Accessing any other register
4464	* causes a VM-exit.
4465	*/
4466	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4467	switch (offAlignedAccess)
4468	{
4469	case XAPIC_OFF_ID:
4470	case XAPIC_OFF_TPR:
4471	case XAPIC_OFF_EOI:
4472	case XAPIC_OFF_LDR:
4473	case XAPIC_OFF_DFR:
4474	case XAPIC_OFF_SVR:
4475	case XAPIC_OFF_ESR:
4476	case XAPIC_OFF_ICR_LO:
4477	case XAPIC_OFF_ICR_HI:
4478	case XAPIC_OFF_LVT_TIMER:
4479	case XAPIC_OFF_LVT_THERMAL:
4480	case XAPIC_OFF_LVT_PERF:
4481	case XAPIC_OFF_LVT_LINT0:
4482	case XAPIC_OFF_LVT_LINT1:
4483	case XAPIC_OFF_LVT_ERROR:
4484	case XAPIC_OFF_TIMER_ICR:
4485	case XAPIC_OFF_TIMER_DCR:
4486	break;
4487	default:
4488	return true;
4489	}
4490	}
4491	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4492	{
4493	/*
4494	* With virtual-interrupt delivery, a write access to any of the
4495	* following registers are virtualized. Accessing any other register
4496	* causes a VM-exit.
4497	*
4498	* Note! The specification does not allow writing to offsets in-between
4499	* these registers (e.g. TPR + 1 byte) unlike read accesses.
4500	*/
4501	switch (offAccess)
4502	{
4503	case XAPIC_OFF_TPR:
4504	case XAPIC_OFF_EOI:
4505	case XAPIC_OFF_ICR_LO:
4506	break;
4507	default:
4508	return true;
4509	}
4510	}
4511	else
4512	{
4513	/*
4514	* Without APIC-register virtualization or virtual-interrupt delivery,
4515	* only TPR accesses are virtualized.
4516	*/
4517	if (offAccess == XAPIC_OFF_TPR)
4518	{ /* likely */ }
4519	else
4520	return true;
4521	}
4522	}
4523	else
4524	{
4525	/*
4526	* Check read accesses to the APIC-access page that cause VM-exits.
4527	*/
4528	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4529	{
4530	/*
4531	* With APIC-register virtualization, a read access to any of the
4532	* following registers are virtualized. Accessing any other register
4533	* causes a VM-exit.
4534	*/
4535	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4536	switch (offAlignedAccess)
4537	{
4538	/** @todo r=ramshankar: What about XAPIC_OFF_LVT_CMCI? */
4539	case XAPIC_OFF_ID:
4540	case XAPIC_OFF_VERSION:
4541	case XAPIC_OFF_TPR:
4542	case XAPIC_OFF_EOI:
4543	case XAPIC_OFF_LDR:
4544	case XAPIC_OFF_DFR:
4545	case XAPIC_OFF_SVR:
4546	case XAPIC_OFF_ISR0: case XAPIC_OFF_ISR1: case XAPIC_OFF_ISR2: case XAPIC_OFF_ISR3:
4547	case XAPIC_OFF_ISR4: case XAPIC_OFF_ISR5: case XAPIC_OFF_ISR6: case XAPIC_OFF_ISR7:
4548	case XAPIC_OFF_TMR0: case XAPIC_OFF_TMR1: case XAPIC_OFF_TMR2: case XAPIC_OFF_TMR3:
4549	case XAPIC_OFF_TMR4: case XAPIC_OFF_TMR5: case XAPIC_OFF_TMR6: case XAPIC_OFF_TMR7:
4550	case XAPIC_OFF_IRR0: case XAPIC_OFF_IRR1: case XAPIC_OFF_IRR2: case XAPIC_OFF_IRR3:
4551	case XAPIC_OFF_IRR4: case XAPIC_OFF_IRR5: case XAPIC_OFF_IRR6: case XAPIC_OFF_IRR7:
4552	case XAPIC_OFF_ESR:
4553	case XAPIC_OFF_ICR_LO:
4554	case XAPIC_OFF_ICR_HI:
4555	case XAPIC_OFF_LVT_TIMER:
4556	case XAPIC_OFF_LVT_THERMAL:
4557	case XAPIC_OFF_LVT_PERF:
4558	case XAPIC_OFF_LVT_LINT0:
4559	case XAPIC_OFF_LVT_LINT1:
4560	case XAPIC_OFF_LVT_ERROR:
4561	case XAPIC_OFF_TIMER_ICR:
4562	case XAPIC_OFF_TIMER_DCR:
4563	break;
4564	default:
4565	return true;
4566	}
4567	}
4568	else
4569	{
4570	/* Without APIC-register virtualization, only TPR accesses are virtualized. */
4571	if (offAccess == XAPIC_OFF_TPR)
4572	{ /* likely */ }
4573	else
4574	return true;
4575	}
4576	}
4577
4578	/* The APIC access is virtualized, does not cause a VM-exit. */
4579	return false;
4580	}
4581
4582
4583	/**
4584	* Virtualizes a memory-based APIC access by certain instructions even though they
4585	* do not use the address to access memory.
4586	*
4587	* This is for instructions like MONITOR, CLFLUSH, CLFLUSHOPT, ENTER which may cause
4588	* page-faults but do not use the address to access memory.
4589	*
4590	* @param pVCpu The cross context virtual CPU structure.
4591	* @param pGCPhysAccess Pointer to the guest-physical address accessed.
4592	* @param cbAccess The size of the access in bytes.
4593	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4594	*/
4595	VBOXSTRICTRC iemVmxVirtApicAccessUnused(PVMCPUCC pVCpu, PRTGCPHYS pGCPhysAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4596	{
4597	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4598	Assert(pGCPhysAccess);
4599
4600	RTGCPHYS const GCPhysAccess = *pGCPhysAccess & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
4601	RTGCPHYS const GCPhysApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrApicAccess.u;
4602	Assert(!(GCPhysApic & GUEST_PAGE_OFFSET_MASK));
4603
4604	if (GCPhysAccess == GCPhysApic)
4605	{
4606	uint16_t const offAccess = *pGCPhysAccess & GUEST_PAGE_OFFSET_MASK;
4607	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4608	if (fIntercept)
4609	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4610
4611	*pGCPhysAccess = GCPhysApic \| offAccess;
4612	return VINF_VMX_MODIFIES_BEHAVIOR;
4613	}
4614
4615	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4616	}
4617
4618
4619	/**
4620	* Virtualizes a memory-based APIC access.
4621	*
4622	* @returns VBox strict status code.
4623	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the access was virtualized.
4624	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4625	*
4626	* @param pVCpu The cross context virtual CPU structure.
4627	* @param offAccess The offset of the register being accessed (within the
4628	* APIC-access page).
4629	* @param cbAccess The size of the access in bytes.
4630	* @param pvData Pointer to the data being written or where to store the data
4631	* being read.
4632	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4633	*/
4634	static VBOXSTRICTRC iemVmxVirtApicAccessMem(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess,
4635	void *pvData, uint32_t fAccess) RT_NOEXCEPT
4636	{
4637	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4638	Assert(pvData);
4639
4640	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4641	if (fIntercept)
4642	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4643
4644	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4645	{
4646	/*
4647	* A write access to the APIC-access page that is virtualized (rather than
4648	* causing a VM-exit) writes data to the virtual-APIC page.
4649	*/
4650	uint32_t const u32Data = (uint32_t )pvData;
4651	iemVmxVirtApicWriteRaw32(pVCpu, offAccess, u32Data);
4652
4653	/*
4654	* Record the currently updated APIC offset, as we need this later for figuring
4655	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4656	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4657	*
4658	* After completion of the current operation, we need to perform TPR virtualization,
4659	* EOI virtualization or APIC-write VM-exit depending on which register was written.
4660	*
4661	* The current operation may be a REP-prefixed string instruction, execution of any
4662	* other instruction, or delivery of an event through the IDT.
4663	*
4664	* Thus things like clearing bytes 3:1 of the VTPR, clearing VEOI are not to be
4665	* performed now but later after completion of the current operation.
4666	*
4667	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
4668	*/
4669	iemVmxVirtApicSetPendingWrite(pVCpu, offAccess);
4670
4671	LogFlowFunc(("Write access at offset %#x not intercepted -> Wrote %#RX32\n", offAccess, u32Data));
4672	}
4673	else
4674	{
4675	/*
4676	* A read access from the APIC-access page that is virtualized (rather than
4677	* causing a VM-exit) returns data from the virtual-APIC page.
4678	*
4679	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4680	*/
4681	Assert(fAccess & IEM_ACCESS_TYPE_READ);
4682
4683	Assert(cbAccess <= 4);
4684	Assert(offAccess < XAPIC_OFF_END + 4);
4685	static uint32_t const s_auAccessSizeMasks[] = { 0, 0xff, 0xffff, 0xffffff, 0xffffffff };
4686
4687	uint32_t u32Data = iemVmxVirtApicReadRaw32(pVCpu, offAccess);
4688	u32Data &= s_auAccessSizeMasks[cbAccess];
4689	(uint32_t )pvData = u32Data;
4690
4691	LogFlowFunc(("Read access at offset %#x not intercepted -> Read %#RX32\n", offAccess, u32Data));
4692	}
4693
4694	return VINF_VMX_MODIFIES_BEHAVIOR;
4695	}
4696
4697
4698	/**
4699	* Virtualizes an MSR-based APIC read access.
4700	*
4701	* @returns VBox strict status code.
4702	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR read was virtualized.
4703	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR read access must be
4704	* handled by the x2APIC device.
4705	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4706	* not within the range of valid MSRs, caller must raise \#GP(0).
4707	* @param pVCpu The cross context virtual CPU structure.
4708	* @param idMsr The x2APIC MSR being read.
4709	* @param pu64Value Where to store the read x2APIC MSR value (only valid when
4710	* VINF_VMX_MODIFIES_BEHAVIOR is returned).
4711	*/
4712	static VBOXSTRICTRC iemVmxVirtApicAccessMsrRead(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value) RT_NOEXCEPT
4713	{
4714	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE);
4715	Assert(pu64Value);
4716
4717	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4718	{
4719	if ( idMsr >= MSR_IA32_X2APIC_START
4720	&& idMsr <= MSR_IA32_X2APIC_END)
4721	{
4722	uint16_t const offReg = (idMsr & 0xff) << 4;
4723	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4724	*pu64Value = u64Value;
4725	return VINF_VMX_MODIFIES_BEHAVIOR;
4726	}
4727	return VERR_OUT_OF_RANGE;
4728	}
4729
4730	if (idMsr == MSR_IA32_X2APIC_TPR)
4731	{
4732	uint16_t const offReg = (idMsr & 0xff) << 4;
4733	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4734	*pu64Value = u64Value;
4735	return VINF_VMX_MODIFIES_BEHAVIOR;
4736	}
4737
4738	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4739	}
4740
4741
4742	/**
4743	* Virtualizes an MSR-based APIC write access.
4744	*
4745	* @returns VBox strict status code.
4746	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR write was virtualized.
4747	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4748	* not within the range of valid MSRs, caller must raise \#GP(0).
4749	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR must be written normally.
4750	*
4751	* @param pVCpu The cross context virtual CPU structure.
4752	* @param idMsr The x2APIC MSR being written.
4753	* @param u64Value The value of the x2APIC MSR being written.
4754	*/
4755	static VBOXSTRICTRC iemVmxVirtApicAccessMsrWrite(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t u64Value) RT_NOEXCEPT
4756	{
4757	/*
4758	* Check if the access is to be virtualized.
4759	* See Intel spec. 29.5 "Virtualizing MSR-based APIC Accesses".
4760	*/
4761	if ( idMsr == MSR_IA32_X2APIC_TPR
4762	\|\| ( (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4763	&& ( idMsr == MSR_IA32_X2APIC_EOI
4764	\|\| idMsr == MSR_IA32_X2APIC_SELF_IPI)))
4765	{
4766	/* Validate the MSR write depending on the register. */
4767	switch (idMsr)
4768	{
4769	case MSR_IA32_X2APIC_TPR:
4770	case MSR_IA32_X2APIC_SELF_IPI:
4771	{
4772	if (u64Value & UINT64_C(0xffffffffffffff00))
4773	return VERR_OUT_OF_RANGE;
4774	break;
4775	}
4776	case MSR_IA32_X2APIC_EOI:
4777	{
4778	if (u64Value != 0)
4779	return VERR_OUT_OF_RANGE;
4780	break;
4781	}
4782	}
4783
4784	/* Write the MSR to the virtual-APIC page. */
4785	uint16_t const offReg = (idMsr & 0xff) << 4;
4786	iemVmxVirtApicWriteRaw64(pVCpu, offReg, u64Value);
4787
4788	/*
4789	* Record the currently updated APIC offset, as we need this later for figuring
4790	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4791	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4792	*/
4793	iemVmxVirtApicSetPendingWrite(pVCpu, offReg);
4794
4795	return VINF_VMX_MODIFIES_BEHAVIOR;
4796	}
4797
4798	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4799	}
4800
4801
4802	/**
4803	* Interface for HM and EM to virtualize x2APIC MSR accesses.
4804	*
4805	* @returns Strict VBox status code.
4806	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR access was virtualized.
4807	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR access must be handled by
4808	* the x2APIC device.
4809	* @retval VERR_OUT_RANGE if the caller must raise \#GP(0).
4810	*
4811	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4812	* @param idMsr The MSR being read.
4813	* @param pu64Value Pointer to the value being written or where to store the
4814	* value being read.
4815	* @param fWrite Whether this is an MSR write or read access.
4816	* @thread EMT(pVCpu)
4817	*/
4818	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVirtApicAccessMsr(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value, bool fWrite)
4819	{
4820	Assert(pu64Value);
4821
4822	VBOXSTRICTRC rcStrict;
4823	if (fWrite)
4824	rcStrict = iemVmxVirtApicAccessMsrWrite(pVCpu, idMsr, *pu64Value);
4825	else
4826	rcStrict = iemVmxVirtApicAccessMsrRead(pVCpu, idMsr, pu64Value);
4827	Assert(!pVCpu->iem.s.cActiveMappings);
4828	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4829
4830	}
4831
4832
4833	/**
4834	* Finds the most significant set bit in a virtual-APIC 256-bit sparse register.
4835	*
4836	* @returns VBox status code.
4837	* @retval VINF_SUCCESS when the highest set bit is found.
4838	* @retval VERR_NOT_FOUND when no bit is set.
4839	*
4840	* @param pVCpu The cross context virtual CPU structure.
4841	* @param offReg The offset of the APIC 256-bit sparse register.
4842	* @param pidxHighestBit Where to store the highest bit (most significant bit)
4843	* set in the register. Only valid when VINF_SUCCESS is
4844	* returned.
4845	*
4846	* @remarks The format of the 256-bit sparse register here mirrors that found in
4847	* real APIC hardware.
4848	*/
4849	static int iemVmxVirtApicGetHighestSetBitInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t *pidxHighestBit)
4850	{
4851	Assert(offReg < XAPIC_OFF_END + 4);
4852	Assert(pidxHighestBit);
4853
4854	/*
4855	* There are 8 contiguous fragments (of 16-bytes each) in the sparse register.
4856	* However, in each fragment only the first 4 bytes are used.
4857	*/
4858	uint8_t const cFrags = 8;
4859	for (int8_t iFrag = cFrags; iFrag >= 0; iFrag--)
4860	{
4861	uint16_t const offFrag = iFrag * 16;
4862	uint32_t const u32Frag = iemVmxVirtApicReadRaw32(pVCpu, offReg + offFrag);
4863	if (!u32Frag)
4864	continue;
4865
4866	unsigned idxHighestBit = ASMBitLastSetU32(u32Frag);
4867	Assert(idxHighestBit > 0);
4868	--idxHighestBit;
4869	Assert(idxHighestBit <= UINT8_MAX);
4870	*pidxHighestBit = idxHighestBit;
4871	return VINF_SUCCESS;
4872	}
4873	return VERR_NOT_FOUND;
4874	}
4875
4876
4877	/**
4878	* Evaluates pending virtual interrupts.
4879	*
4880	* @param pVCpu The cross context virtual CPU structure.
4881	*/
4882	static void iemVmxEvalPendingVirtIntrs(PVMCPUCC pVCpu) RT_NOEXCEPT
4883	{
4884	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4885
4886	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT))
4887	{
4888	uint8_t const uRvi = RT_LO_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus);
4889	uint8_t const uPpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_PPR);
4890
4891	if ((uRvi >> 4) > (uPpr >> 4))
4892	{
4893	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Signalling pending interrupt\n", uRvi, uPpr));
4894	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
4895	}
4896	else
4897	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Nothing to do\n", uRvi, uPpr));
4898	}
4899	}
4900
4901
4902	/**
4903	* Performs PPR virtualization.
4904	*
4905	* @returns VBox strict status code.
4906	* @param pVCpu The cross context virtual CPU structure.
4907	*/
4908	static void iemVmxPprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4909	{
4910	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4911	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4912
4913	/*
4914	* PPR virtualization is caused in response to a VM-entry, TPR-virtualization,
4915	* or EOI-virtualization.
4916	*
4917	* See Intel spec. 29.1.3 "PPR Virtualization".
4918	*/
4919	uint8_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4920	uint8_t const uSvi = RT_HI_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus) & 0xf0;
4921
4922	uint32_t uPpr;
4923	if ((uTpr & 0xf0) >= uSvi)
4924	uPpr = uTpr;
4925	else
4926	uPpr = uSvi;
4927
4928	Log2(("ppr_virt: uTpr=%#x uSvi=%#x uPpr=%#x\n", uTpr, uSvi, uPpr));
4929	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_PPR, uPpr);
4930	}
4931
4932
4933	/**
4934	* Performs VMX TPR virtualization.
4935	*
4936	* @returns VBox strict status code.
4937	* @param pVCpu The cross context virtual CPU structure.
4938	*/
4939	static VBOXSTRICTRC iemVmxTprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4940	{
4941	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4942
4943	/*
4944	* We should have already performed the virtual-APIC write to the TPR offset
4945	* in the virtual-APIC page. We now perform TPR virtualization.
4946	*
4947	* See Intel spec. 29.1.2 "TPR Virtualization".
4948	*/
4949	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
4950	{
4951	uint32_t const uTprThreshold = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32TprThreshold;
4952	uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4953
4954	/*
4955	* If the VTPR falls below the TPR threshold, we must cause a VM-exit.
4956	* See Intel spec. 29.1.2 "TPR Virtualization".
4957	*/
4958	if (((uTpr >> 4) & 0xf) < uTprThreshold)
4959	{
4960	Log2(("tpr_virt: uTpr=%u uTprThreshold=%u -> VM-exit\n", uTpr, uTprThreshold));
4961	return iemVmxVmexit(pVCpu, VMX_EXIT_TPR_BELOW_THRESHOLD, 0 /* u64ExitQual */);
4962	}
4963	}
4964	else
4965	{
4966	iemVmxPprVirtualization(pVCpu);
4967	iemVmxEvalPendingVirtIntrs(pVCpu);
4968	}
4969
4970	return VINF_SUCCESS;
4971	}
4972
4973
4974	/**
4975	* Checks whether an EOI write for the given interrupt vector causes a VM-exit or
4976	* not.
4977	*
4978	* @returns @c true if the EOI write is intercepted, @c false otherwise.
4979	* @param pVCpu The cross context virtual CPU structure.
4980	* @param uVector The interrupt that was acknowledged using an EOI.
4981	*/
4982	static bool iemVmxIsEoiInterceptSet(PCVMCPU pVCpu, uint8_t uVector) RT_NOEXCEPT
4983	{
4984	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4985	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4986
4987	if (uVector < 64)
4988	return RT_BOOL(pVmcs->u64EoiExitBitmap0.u & RT_BIT_64(uVector));
4989	if (uVector < 128)
4990	return RT_BOOL(pVmcs->u64EoiExitBitmap1.u & RT_BIT_64(uVector));
4991	if (uVector < 192)
4992	return RT_BOOL(pVmcs->u64EoiExitBitmap2.u & RT_BIT_64(uVector));
4993	return RT_BOOL(pVmcs->u64EoiExitBitmap3.u & RT_BIT_64(uVector));
4994	}
4995
4996
4997	/**
4998	* Performs EOI virtualization.
4999	*
5000	* @returns VBox strict status code.
5001	* @param pVCpu The cross context virtual CPU structure.
5002	*/
5003	static VBOXSTRICTRC iemVmxEoiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5004	{
5005	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5006	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
5007
5008	/*
5009	* Clear the interrupt guest-interrupt as no longer in-service (ISR)
5010	* and get the next guest-interrupt that's in-service (if any).
5011	*
5012	* See Intel spec. 29.1.4 "EOI Virtualization".
5013	*/
5014	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5015	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5016	Log2(("eoi_virt: uRvi=%#x uSvi=%#x\n", uRvi, uSvi));
5017
5018	uint8_t uVector = uSvi;
5019	iemVmxVirtApicClearVectorInReg(pVCpu, XAPIC_OFF_ISR0, uVector);
5020
5021	uVector = 0;
5022	iemVmxVirtApicGetHighestSetBitInReg(pVCpu, XAPIC_OFF_ISR0, &uVector);
5023
5024	if (uVector)
5025	Log2(("eoi_virt: next interrupt %#x\n", uVector));
5026	else
5027	Log2(("eoi_virt: no interrupt pending in ISR\n"));
5028
5029	/* Update guest-interrupt status SVI (leave RVI portion as it is) in the VMCS. */
5030	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uRvi, uVector);
5031
5032	iemVmxPprVirtualization(pVCpu);
5033	if (iemVmxIsEoiInterceptSet(pVCpu, uVector))
5034	return iemVmxVmexit(pVCpu, VMX_EXIT_VIRTUALIZED_EOI, uVector);
5035	iemVmxEvalPendingVirtIntrs(pVCpu);
5036	return VINF_SUCCESS;
5037	}
5038
5039
5040	/**
5041	* Performs self-IPI virtualization.
5042	*
5043	* @returns VBox strict status code.
5044	* @param pVCpu The cross context virtual CPU structure.
5045	*/
5046	static VBOXSTRICTRC iemVmxSelfIpiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5047	{
5048	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5049	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
5050
5051	/*
5052	* We should have already performed the virtual-APIC write to the self-IPI offset
5053	* in the virtual-APIC page. We now perform self-IPI virtualization.
5054	*
5055	* See Intel spec. 29.1.5 "Self-IPI Virtualization".
5056	*/
5057	uint8_t const uVector = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_LO);
5058	Log2(("self_ipi_virt: uVector=%#x\n", uVector));
5059	iemVmxVirtApicSetVectorInReg(pVCpu, XAPIC_OFF_IRR0, uVector);
5060	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5061	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5062	if (uVector > uRvi)
5063	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uVector, uSvi);
5064	iemVmxEvalPendingVirtIntrs(pVCpu);
5065	return VINF_SUCCESS;
5066	}
5067
5068
5069	/**
5070	* Performs VMX APIC-write emulation.
5071	*
5072	* @returns VBox strict status code.
5073	* @param pVCpu The cross context virtual CPU structure.
5074	*/
5075	VBOXSTRICTRC iemVmxApicWriteEmulation(PVMCPUCC pVCpu) RT_NOEXCEPT
5076	{
5077	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5078
5079	/* Import the virtual-APIC write offset (part of the hardware-virtualization state). */
5080	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
5081
5082	/*
5083	* Perform APIC-write emulation based on the virtual-APIC register written.
5084	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
5085	*/
5086	uint16_t const offApicWrite = iemVmxVirtApicClearPendingWrite(pVCpu);
5087	VBOXSTRICTRC rcStrict;
5088	switch (offApicWrite)
5089	{
5090	case XAPIC_OFF_TPR:
5091	{
5092	/* Clear bytes 3:1 of the VTPR and perform TPR virtualization. */
5093	uint32_t uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5094	uTpr &= UINT32_C(0x000000ff);
5095	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
5096	Log2(("iemVmxApicWriteEmulation: TPR write %#x\n", uTpr));
5097	rcStrict = iemVmxTprVirtualization(pVCpu);
5098	break;
5099	}
5100
5101	case XAPIC_OFF_EOI:
5102	{
5103	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5104	{
5105	/* Clear VEOI and perform EOI virtualization. */
5106	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_EOI, 0);
5107	Log2(("iemVmxApicWriteEmulation: EOI write\n"));
5108	rcStrict = iemVmxEoiVirtualization(pVCpu);
5109	}
5110	else
5111	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5112	break;
5113	}
5114
5115	case XAPIC_OFF_ICR_LO:
5116	{
5117	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5118	{
5119	/* If the ICR_LO is valid, write it and perform self-IPI virtualization. */
5120	uint32_t const uIcrLo = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5121	uint32_t const fIcrLoMb0 = UINT32_C(0xfffbb700);
5122	uint32_t const fIcrLoMb1 = UINT32_C(0x000000f0);
5123	if ( !(uIcrLo & fIcrLoMb0)
5124	&& (uIcrLo & fIcrLoMb1))
5125	{
5126	Log2(("iemVmxApicWriteEmulation: Self-IPI virtualization with vector %#x\n", (uIcrLo & 0xff)));
5127	rcStrict = iemVmxSelfIpiVirtualization(pVCpu);
5128	}
5129	else
5130	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5131	}
5132	else
5133	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5134	break;
5135	}
5136
5137	case XAPIC_OFF_ICR_HI:
5138	{
5139	/* Clear bytes 2:0 of VICR_HI. No other virtualization or VM-exit must occur. */
5140	uint32_t uIcrHi = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_HI);
5141	uIcrHi &= UINT32_C(0xff000000);
5142	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_ICR_HI, uIcrHi);
5143	rcStrict = VINF_SUCCESS;
5144	break;
5145	}
5146
5147	default:
5148	{
5149	/* Writes to any other virtual-APIC register causes an APIC-write VM-exit. */
5150	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5151	break;
5152	}
5153	}
5154
5155	return rcStrict;
5156	}
5157
5158
5159	/**
5160	* Interface for HM and EM to perform an APIC-write emulation which may cause a
5161	* VM-exit.
5162	*
5163	* @returns Strict VBox status code.
5164	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
5165	* @thread EMT(pVCpu)
5166	*/
5167	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicWrite(PVMCPUCC pVCpu)
5168	{
5169	VBOXSTRICTRC rcStrict = iemVmxApicWriteEmulation(pVCpu);
5170	Assert(!pVCpu->iem.s.cActiveMappings);
5171	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
5172	}
5173
5174
5175	/**
5176	* Checks guest control registers, debug registers and MSRs as part of VM-entry.
5177	*
5178	* @param pVCpu The cross context virtual CPU structure.
5179	* @param pszInstr The VMX instruction name (for logging purposes).
5180	*/
5181	DECLINLINE(int) iemVmxVmentryCheckGuestControlRegsMsrs(PVMCPUCC pVCpu, const char *pszInstr)
5182	{
5183	/*
5184	* Guest Control Registers, Debug Registers, and MSRs.
5185	* See Intel spec. 26.3.1.1 "Checks on Guest Control Registers, Debug Registers, and MSRs".
5186	*/
5187	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5188	const char * const pszFailure = "VM-exit";
5189	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5190
5191	/* CR0 reserved bits. */
5192	{
5193	/* CR0 MB1 bits. */
5194	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
5195	if ((pVmcs->u64GuestCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
5196	{ /* likely */ }
5197	else
5198	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed0);
5199
5200	/* CR0 MBZ bits. */
5201	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5202	if (!(pVmcs->u64GuestCr0.u & ~u64Cr0Fixed1))
5203	{ /* likely */ }
5204	else
5205	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed1);
5206
5207	/* Without unrestricted guest support, VT-x supports does not support unpaged protected mode. */
5208	if ( !fUnrestrictedGuest
5209	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5210	&& !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5211	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0PgPe);
5212	}
5213
5214	/* CR4 reserved bits. */
5215	{
5216	/* CR4 MB1 bits. */
5217	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
5218	if ((pVmcs->u64GuestCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
5219	{ /* likely */ }
5220	else
5221	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed0);
5222
5223	/* CR4 MBZ bits. */
5224	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
5225	if (!(pVmcs->u64GuestCr4.u & ~u64Cr4Fixed1))
5226	{ /* likely */ }
5227	else
5228	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed1);
5229	}
5230
5231	/* DEBUGCTL MSR. */
5232	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5233	\|\| !(pVmcs->u64GuestDebugCtlMsr.u & ~MSR_IA32_DEBUGCTL_VALID_MASK_INTEL))
5234	{ /* likely */ }
5235	else
5236	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDebugCtl);
5237
5238	/* 64-bit CPU checks. */
5239	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5240	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5241	{
5242	if (fGstInLongMode)
5243	{
5244	/* PAE must be set. */
5245	if ( (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5246	&& (pVmcs->u64GuestCr0.u & X86_CR4_PAE))
5247	{ /* likely */ }
5248	else
5249	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPae);
5250	}
5251	else
5252	{
5253	/* PCIDE should not be set. */
5254	if (!(pVmcs->u64GuestCr4.u & X86_CR4_PCIDE))
5255	{ /* likely */ }
5256	else
5257	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPcide);
5258	}
5259
5260	/* CR3. */
5261	if (!(pVmcs->u64GuestCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
5262	{ /* likely */ }
5263	else
5264	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr3);
5265
5266	/* DR7. */
5267	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5268	\|\| !(pVmcs->u64GuestDr7.u & X86_DR7_MBZ_MASK))
5269	{ /* likely */ }
5270	else
5271	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDr7);
5272
5273	/* SYSENTER ESP and SYSENTER EIP. */
5274	if ( X86_IS_CANONICAL(pVmcs->u64GuestSysenterEsp.u)
5275	&& X86_IS_CANONICAL(pVmcs->u64GuestSysenterEip.u))
5276	{ /* likely */ }
5277	else
5278	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSysenterEspEip);
5279	}
5280
5281	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
5282	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
5283
5284	/* PAT MSR. */
5285	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
5286	\|\| CPUMIsPatMsrValid(pVmcs->u64GuestPatMsr.u))
5287	{ /* likely */ }
5288	else
5289	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPatMsr);
5290
5291	/* EFER MSR. */
5292	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
5293	{
5294	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
5295	if (!(pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
5296	{ /* likely */ }
5297	else
5298	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsrRsvd);
5299
5300	bool const fGstLma = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LMA);
5301	bool const fGstLme = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LME);
5302	if ( fGstLma == fGstInLongMode
5303	&& ( !(pVmcs->u64GuestCr0.u & X86_CR0_PG)
5304	\|\| fGstLma == fGstLme))
5305	{ /* likely */ }
5306	else
5307	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsr);
5308	}
5309
5310	/* We don't support IA32_BNDCFGS MSR yet. */
5311	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
5312
5313	NOREF(pszInstr);
5314	NOREF(pszFailure);
5315	return VINF_SUCCESS;
5316	}
5317
5318
5319	/**
5320	* Checks guest segment registers, LDTR and TR as part of VM-entry.
5321	*
5322	* @param pVCpu The cross context virtual CPU structure.
5323	* @param pszInstr The VMX instruction name (for logging purposes).
5324	*/
5325	DECLINLINE(int) iemVmxVmentryCheckGuestSegRegs(PVMCPUCC pVCpu, const char *pszInstr)
5326	{
5327	/*
5328	* Segment registers.
5329	* See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers".
5330	*/
5331	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5332	const char * const pszFailure = "VM-exit";
5333	bool const fGstInV86Mode = RT_BOOL(pVmcs->u64GuestRFlags.u & X86_EFL_VM);
5334	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5335	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5336
5337	/* Selectors. */
5338	if ( !fGstInV86Mode
5339	&& !fUnrestrictedGuest
5340	&& (pVmcs->GuestSs & X86_SEL_RPL) != (pVmcs->GuestCs & X86_SEL_RPL))
5341	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelCsSsRpl);
5342
5343	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
5344	{
5345	CPUMSELREG SelReg;
5346	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &SelReg);
5347	if (RT_LIKELY(rc == VINF_SUCCESS))
5348	{ /* likely */ }
5349	else
5350	return rc;
5351
5352	/*
5353	* Virtual-8086 mode checks.
5354	*/
5355	if (fGstInV86Mode)
5356	{
5357	/* Base address. */
5358	if (SelReg.u64Base == (uint64_t)SelReg.Sel << 4)
5359	{ /* likely */ }
5360	else
5361	{
5362	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBaseV86(iSegReg);
5363	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5364	}
5365
5366	/* Limit. */
5367	if (SelReg.u32Limit == 0xffff)
5368	{ /* likely */ }
5369	else
5370	{
5371	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegLimitV86(iSegReg);
5372	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5373	}
5374
5375	/* Attribute. */
5376	if (SelReg.Attr.u == 0xf3)
5377	{ /* likely */ }
5378	else
5379	{
5380	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrV86(iSegReg);
5381	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5382	}
5383
5384	/* We're done; move to checking the next segment. */
5385	continue;
5386	}
5387
5388	/* Checks done by 64-bit CPUs. */
5389	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5390	{
5391	/* Base address. */
5392	if ( iSegReg == X86_SREG_FS
5393	\|\| iSegReg == X86_SREG_GS)
5394	{
5395	if (X86_IS_CANONICAL(SelReg.u64Base))
5396	{ /* likely */ }
5397	else
5398	{
5399	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5400	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5401	}
5402	}
5403	else if (iSegReg == X86_SREG_CS)
5404	{
5405	if (!RT_HI_U32(SelReg.u64Base))
5406	{ /* likely */ }
5407	else
5408	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseCs);
5409	}
5410	else
5411	{
5412	if ( SelReg.Attr.n.u1Unusable
5413	\|\| !RT_HI_U32(SelReg.u64Base))
5414	{ /* likely */ }
5415	else
5416	{
5417	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5418	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5419	}
5420	}
5421	}
5422
5423	/*
5424	* Checks outside Virtual-8086 mode.
5425	*/
5426	uint8_t const uSegType = SelReg.Attr.n.u4Type;
5427	uint8_t const fCodeDataSeg = SelReg.Attr.n.u1DescType;
5428	uint8_t const fUsable = !SelReg.Attr.n.u1Unusable;
5429	uint8_t const uDpl = SelReg.Attr.n.u2Dpl;
5430	uint8_t const fPresent = SelReg.Attr.n.u1Present;
5431	uint8_t const uGranularity = SelReg.Attr.n.u1Granularity;
5432	uint8_t const uDefBig = SelReg.Attr.n.u1DefBig;
5433	uint8_t const fSegLong = SelReg.Attr.n.u1Long;
5434
5435	/* Code or usable segment. */
5436	if ( iSegReg == X86_SREG_CS
5437	\|\| fUsable)
5438	{
5439	/* Reserved bits (bits 31:17 and bits 11:8). */
5440	if (!(SelReg.Attr.u & 0xfffe0f00))
5441	{ /* likely */ }
5442	else
5443	{
5444	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrRsvd(iSegReg);
5445	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5446	}
5447
5448	/* Descriptor type. */
5449	if (fCodeDataSeg)
5450	{ /* likely */ }
5451	else
5452	{
5453	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDescType(iSegReg);
5454	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5455	}
5456
5457	/* Present. */
5458	if (fPresent)
5459	{ /* likely */ }
5460	else
5461	{
5462	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrPresent(iSegReg);
5463	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5464	}
5465
5466	/* Granularity. */
5467	if ( ((SelReg.u32Limit & 0x00000fff) == 0x00000fff \|\| !uGranularity)
5468	&& ((SelReg.u32Limit & 0xfff00000) == 0x00000000 \|\| uGranularity))
5469	{ /* likely */ }
5470	else
5471	{
5472	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrGran(iSegReg);
5473	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5474	}
5475	}
5476
5477	if (iSegReg == X86_SREG_CS)
5478	{
5479	/* Segment Type and DPL. */
5480	if ( uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5481	&& fUnrestrictedGuest)
5482	{
5483	if (uDpl == 0)
5484	{ /* likely */ }
5485	else
5486	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplZero);
5487	}
5488	else if ( uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_ACCESSED)
5489	\|\| uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5490	{
5491	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5492	if (uDpl == AttrSs.n.u2Dpl)
5493	{ /* likely */ }
5494	else
5495	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplEqSs);
5496	}
5497	else if ((uSegType & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5498	== (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5499	{
5500	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5501	if (uDpl <= AttrSs.n.u2Dpl)
5502	{ /* likely */ }
5503	else
5504	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplLtSs);
5505	}
5506	else
5507	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsType);
5508
5509	/* Def/Big. */
5510	if ( fGstInLongMode
5511	&& fSegLong)
5512	{
5513	if (uDefBig == 0)
5514	{ /* likely */ }
5515	else
5516	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDefBig);
5517	}
5518	}
5519	else if (iSegReg == X86_SREG_SS)
5520	{
5521	/* Segment Type. */
5522	if ( !fUsable
5523	\|\| uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5524	\|\| uSegType == (X86_SEL_TYPE_DOWN \| X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED))
5525	{ /* likely */ }
5526	else
5527	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsType);
5528
5529	/* DPL. */
5530	if (!fUnrestrictedGuest)
5531	{
5532	if (uDpl == (SelReg.Sel & X86_SEL_RPL))
5533	{ /* likely */ }
5534	else
5535	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplEqRpl);
5536	}
5537	X86DESCATTR AttrCs; AttrCs.u = pVmcs->u32GuestCsAttr;
5538	if ( AttrCs.n.u4Type == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5539	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5540	{
5541	if (uDpl == 0)
5542	{ /* likely */ }
5543	else
5544	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplZero);
5545	}
5546	}
5547	else
5548	{
5549	/* DS, ES, FS, GS. */
5550	if (fUsable)
5551	{
5552	/* Segment type. */
5553	if (uSegType & X86_SEL_TYPE_ACCESSED)
5554	{ /* likely */ }
5555	else
5556	{
5557	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrTypeAcc(iSegReg);
5558	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5559	}
5560
5561	if ( !(uSegType & X86_SEL_TYPE_CODE)
5562	\|\| (uSegType & X86_SEL_TYPE_READ))
5563	{ /* likely */ }
5564	else
5565	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsTypeRead);
5566
5567	/* DPL. */
5568	if ( !fUnrestrictedGuest
5569	&& uSegType <= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5570	{
5571	if (uDpl >= (SelReg.Sel & X86_SEL_RPL))
5572	{ /* likely */ }
5573	else
5574	{
5575	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDplRpl(iSegReg);
5576	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5577	}
5578	}
5579	}
5580	}
5581	}
5582
5583	/*
5584	* LDTR.
5585	*/
5586	{
5587	CPUMSELREG Ldtr;
5588	Ldtr.Sel = pVmcs->GuestLdtr;
5589	Ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
5590	Ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
5591	Ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
5592
5593	if (!Ldtr.Attr.n.u1Unusable)
5594	{
5595	/* Selector. */
5596	if (!(Ldtr.Sel & X86_SEL_LDT))
5597	{ /* likely */ }
5598	else
5599	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelLdtr);
5600
5601	/* Base. */
5602	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5603	{
5604	if (X86_IS_CANONICAL(Ldtr.u64Base))
5605	{ /* likely */ }
5606	else
5607	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseLdtr);
5608	}
5609
5610	/* Attributes. */
5611	/* Reserved bits (bits 31:17 and bits 11:8). */
5612	if (!(Ldtr.Attr.u & 0xfffe0f00))
5613	{ /* likely */ }
5614	else
5615	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrRsvd);
5616
5617	if (Ldtr.Attr.n.u4Type == X86_SEL_TYPE_SYS_LDT)
5618	{ /* likely */ }
5619	else
5620	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrType);
5621
5622	if (!Ldtr.Attr.n.u1DescType)
5623	{ /* likely */ }
5624	else
5625	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrDescType);
5626
5627	if (Ldtr.Attr.n.u1Present)
5628	{ /* likely */ }
5629	else
5630	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrPresent);
5631
5632	if ( ((Ldtr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Ldtr.Attr.n.u1Granularity)
5633	&& ((Ldtr.u32Limit & 0xfff00000) == 0x00000000 \|\| Ldtr.Attr.n.u1Granularity))
5634	{ /* likely */ }
5635	else
5636	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrGran);
5637	}
5638	}
5639
5640	/*
5641	* TR.
5642	*/
5643	{
5644	CPUMSELREG Tr;
5645	Tr.Sel = pVmcs->GuestTr;
5646	Tr.u32Limit = pVmcs->u32GuestTrLimit;
5647	Tr.u64Base = pVmcs->u64GuestTrBase.u;
5648	Tr.Attr.u = pVmcs->u32GuestTrAttr;
5649
5650	/* Selector. */
5651	if (!(Tr.Sel & X86_SEL_LDT))
5652	{ /* likely */ }
5653	else
5654	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelTr);
5655
5656	/* Base. */
5657	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5658	{
5659	if (X86_IS_CANONICAL(Tr.u64Base))
5660	{ /* likely */ }
5661	else
5662	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseTr);
5663	}
5664
5665	/* Attributes. */
5666	/* Reserved bits (bits 31:17 and bits 11:8). */
5667	if (!(Tr.Attr.u & 0xfffe0f00))
5668	{ /* likely */ }
5669	else
5670	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrRsvd);
5671
5672	if (!Tr.Attr.n.u1Unusable)
5673	{ /* likely */ }
5674	else
5675	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrUnusable);
5676
5677	if ( Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY
5678	\|\| ( !fGstInLongMode
5679	&& Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY))
5680	{ /* likely */ }
5681	else
5682	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrType);
5683
5684	if (!Tr.Attr.n.u1DescType)
5685	{ /* likely */ }
5686	else
5687	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrDescType);
5688
5689	if (Tr.Attr.n.u1Present)
5690	{ /* likely */ }
5691	else
5692	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrPresent);
5693
5694	if ( ((Tr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Tr.Attr.n.u1Granularity)
5695	&& ((Tr.u32Limit & 0xfff00000) == 0x00000000 \|\| Tr.Attr.n.u1Granularity))
5696	{ /* likely */ }
5697	else
5698	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrGran);
5699	}
5700
5701	NOREF(pszInstr);
5702	NOREF(pszFailure);
5703	return VINF_SUCCESS;
5704	}
5705
5706
5707	/**
5708	* Checks guest GDTR and IDTR as part of VM-entry.
5709	*
5710	* @param pVCpu The cross context virtual CPU structure.
5711	* @param pszInstr The VMX instruction name (for logging purposes).
5712	*/
5713	DECLINLINE(int) iemVmxVmentryCheckGuestGdtrIdtr(PVMCPUCC pVCpu, const char *pszInstr)
5714	{
5715	/*
5716	* GDTR and IDTR.
5717	* See Intel spec. 26.3.1.3 "Checks on Guest Descriptor-Table Registers".
5718	*/
5719	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5720	const char *const pszFailure = "VM-exit";
5721
5722	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5723	{
5724	/* Base. */
5725	if (X86_IS_CANONICAL(pVmcs->u64GuestGdtrBase.u))
5726	{ /* likely */ }
5727	else
5728	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrBase);
5729
5730	if (X86_IS_CANONICAL(pVmcs->u64GuestIdtrBase.u))
5731	{ /* likely */ }
5732	else
5733	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrBase);
5734	}
5735
5736	/* Limit. */
5737	if (!RT_HI_U16(pVmcs->u32GuestGdtrLimit))
5738	{ /* likely */ }
5739	else
5740	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrLimit);
5741
5742	if (!RT_HI_U16(pVmcs->u32GuestIdtrLimit))
5743	{ /* likely */ }
5744	else
5745	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrLimit);
5746
5747	NOREF(pszInstr);
5748	NOREF(pszFailure);
5749	return VINF_SUCCESS;
5750	}
5751
5752
5753	/**
5754	* Checks guest RIP and RFLAGS as part of VM-entry.
5755	*
5756	* @param pVCpu The cross context virtual CPU structure.
5757	* @param pszInstr The VMX instruction name (for logging purposes).
5758	*/
5759	DECLINLINE(int) iemVmxVmentryCheckGuestRipRFlags(PVMCPUCC pVCpu, const char *pszInstr)
5760	{
5761	/*
5762	* RIP and RFLAGS.
5763	* See Intel spec. 26.3.1.4 "Checks on Guest RIP and RFLAGS".
5764	*/
5765	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5766	const char *const pszFailure = "VM-exit";
5767	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5768
5769	/* RIP. */
5770	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5771	{
5772	X86DESCATTR AttrCs;
5773	AttrCs.u = pVmcs->u32GuestCsAttr;
5774	if ( !fGstInLongMode
5775	\|\| !AttrCs.n.u1Long)
5776	{
5777	if (!RT_HI_U32(pVmcs->u64GuestRip.u))
5778	{ /* likely */ }
5779	else
5780	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRipRsvd);
5781	}
5782
5783	if ( fGstInLongMode
5784	&& AttrCs.n.u1Long)
5785	{
5786	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth == 48); /* Canonical. */
5787	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth < 64
5788	&& X86_IS_CANONICAL(pVmcs->u64GuestRip.u))
5789	{ /* likely */ }
5790	else
5791	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRip);
5792	}
5793	}
5794
5795	/* RFLAGS (bits 63:22 (or 31:22), bits 15, 5, 3 are reserved, bit 1 MB1). */
5796	uint64_t const uGuestRFlags = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode ? pVmcs->u64GuestRFlags.u
5797	: pVmcs->u64GuestRFlags.s.Lo;
5798	if ( !(uGuestRFlags & ~(X86_EFL_LIVE_MASK \| X86_EFL_RA1_MASK))
5799	&& (uGuestRFlags & X86_EFL_RA1_MASK) == X86_EFL_RA1_MASK)
5800	{ /* likely */ }
5801	else
5802	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsRsvd);
5803
5804	if (!(uGuestRFlags & X86_EFL_VM))
5805	{ /* likely */ }
5806	else
5807	{
5808	if ( fGstInLongMode
5809	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5810	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsVm);
5811	}
5812
5813	if (VMX_ENTRY_INT_INFO_IS_EXT_INT(pVmcs->u32EntryIntInfo))
5814	{
5815	if (uGuestRFlags & X86_EFL_IF)
5816	{ /* likely */ }
5817	else
5818	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsIf);
5819	}
5820
5821	NOREF(pszInstr);
5822	NOREF(pszFailure);
5823	return VINF_SUCCESS;
5824	}
5825
5826
5827	/**
5828	* Checks guest non-register state as part of VM-entry.
5829	*
5830	* @param pVCpu The cross context virtual CPU structure.
5831	* @param pszInstr The VMX instruction name (for logging purposes).
5832	*/
5833	DECLINLINE(int) iemVmxVmentryCheckGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr)
5834	{
5835	/*
5836	* Guest non-register state.
5837	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
5838	*/
5839	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5840	const char *const pszFailure = "VM-exit";
5841
5842	/*
5843	* Activity state.
5844	*/
5845	uint64_t const u64GuestVmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
5846	uint32_t const fActivityStateMask = RT_BF_GET(u64GuestVmxMiscMsr, VMX_BF_MISC_ACTIVITY_STATES);
5847	if (!(pVmcs->u32GuestActivityState & fActivityStateMask))
5848	{ /* likely */ }
5849	else
5850	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateRsvd);
5851
5852	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5853	if ( !AttrSs.n.u2Dpl
5854	\|\| pVmcs->u32GuestActivityState != VMX_VMCS_GUEST_ACTIVITY_HLT)
5855	{ /* likely */ }
5856	else
5857	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateSsDpl);
5858
5859	if ( pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_STI
5860	\|\| pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
5861	{
5862	if (pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_ACTIVE)
5863	{ /* likely */ }
5864	else
5865	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateStiMovSs);
5866	}
5867
5868	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5869	{
5870	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5871	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
5872	AssertCompile(VMX_V_GUEST_ACTIVITY_STATE_MASK == (VMX_VMCS_GUEST_ACTIVITY_HLT \| VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN));
5873	switch (pVmcs->u32GuestActivityState)
5874	{
5875	case VMX_VMCS_GUEST_ACTIVITY_HLT:
5876	{
5877	if ( uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT
5878	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5879	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5880	&& ( uVector == X86_XCPT_DB
5881	\|\| uVector == X86_XCPT_MC))
5882	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT
5883	&& uVector == VMX_ENTRY_INT_INFO_VECTOR_MTF))
5884	{ /* likely */ }
5885	else
5886	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateHlt);
5887	break;
5888	}
5889
5890	case VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN:
5891	{
5892	if ( uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5893	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5894	&& uVector == X86_XCPT_MC))
5895	{ /* likely */ }
5896	else
5897	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateShutdown);
5898	break;
5899	}
5900
5901	case VMX_VMCS_GUEST_ACTIVITY_ACTIVE:
5902	default:
5903	break;
5904	}
5905	}
5906
5907	/*
5908	* Interruptibility state.
5909	*/
5910	if (!(pVmcs->u32GuestIntrState & ~VMX_VMCS_GUEST_INT_STATE_MASK))
5911	{ /* likely */ }
5912	else
5913	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRsvd);
5914
5915	if ((pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5916	!= (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5917	{ /* likely */ }
5918	else
5919	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateStiMovSs);
5920
5921	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_IF)
5922	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5923	{ /* likely */ }
5924	else
5925	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRFlagsSti);
5926
5927	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5928	{
5929	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5930	if (uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT)
5931	{
5932	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5933	{ /* likely */ }
5934	else
5935	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateExtInt);
5936	}
5937	else if (uType == VMX_ENTRY_INT_INFO_TYPE_NMI)
5938	{
5939	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5940	{ /* likely */ }
5941	else
5942	{
5943	/*
5944	* We don't support injecting NMIs when blocking-by-STI would be in effect.
5945	* We update the Exit qualification only when blocking-by-STI is set
5946	* without blocking-by-MovSS being set. Although in practise it does not
5947	* make much difference since the order of checks are implementation defined.
5948	*/
5949	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
5950	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_NMI_INJECT);
5951	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateNmi);
5952	}
5953
5954	if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
5955	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI))
5956	{ /* likely */ }
5957	else
5958	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateVirtNmi);
5959	}
5960	}
5961
5962	/* We don't support SMM yet. So blocking-by-SMIs must not be set. */
5963	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_SMI))
5964	{ /* likely */ }
5965	else
5966	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateSmi);
5967
5968	/* We don't support SGX yet. So enclave-interruption must not be set. */
5969	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_ENCLAVE))
5970	{ /* likely */ }
5971	else
5972	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateEnclave);
5973
5974	/*
5975	* Pending debug exceptions.
5976	*/
5977	uint64_t const uPendingDbgXcpts = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode
5978	? pVmcs->u64GuestPendingDbgXcpts.u
5979	: pVmcs->u64GuestPendingDbgXcpts.s.Lo;
5980	if (!(uPendingDbgXcpts & ~VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK))
5981	{ /* likely */ }
5982	else
5983	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRsvd);
5984
5985	if ( (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5986	\|\| pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_HLT)
5987	{
5988	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5989	&& !(pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF)
5990	&& !(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5991	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsTf);
5992
5993	if ( ( !(pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5994	\|\| (pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF))
5995	&& (uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5996	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsNoTf);
5997	}
5998
5999	/* We don't support RTM (Real-time Transactional Memory) yet. */
6000	if (!(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_RTM))
6001	{ /* likely */ }
6002	else
6003	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRtm);
6004
6005	/*
6006	* VMCS link pointer.
6007	*/
6008	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
6009	{
6010	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
6011	/* We don't support SMM yet (so VMCS link pointer cannot be the current VMCS). */
6012	if (GCPhysShadowVmcs != IEM_VMX_GET_CURRENT_VMCS(pVCpu))
6013	{ /* likely */ }
6014	else
6015	{
6016	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6017	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrCurVmcs);
6018	}
6019
6020	/* Validate the address. */
6021	if ( !(GCPhysShadowVmcs & X86_PAGE_4K_OFFSET_MASK)
6022	&& !(GCPhysShadowVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6023	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysShadowVmcs))
6024	{ /* likely */ }
6025	else
6026	{
6027	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6028	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmcsLinkPtr);
6029	}
6030	}
6031
6032	NOREF(pszInstr);
6033	NOREF(pszFailure);
6034	return VINF_SUCCESS;
6035	}
6036
6037
6038	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6039	/**
6040	* Checks guest PDPTEs as part of VM-entry.
6041	*
6042	* @param pVCpu The cross context virtual CPU structure.
6043	* @param pszInstr The VMX instruction name (for logging purposes).
6044	*/
6045	static int iemVmxVmentryCheckGuestPdptes(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6046	{
6047	/*
6048	* Guest PDPTEs.
6049	* See Intel spec. 26.3.1.5 "Checks on Guest Page-Directory-Pointer-Table Entries".
6050	*/
6051	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6052	const char * const pszFailure = "VM-exit";
6053
6054	/*
6055	* When EPT is used, we need to validate the PAE PDPTEs provided in the VMCS.
6056	* Otherwise, we load any PAE PDPTEs referenced by CR3 at a later point.
6057	*/
6058	if ( iemVmxVmcsIsGuestPaePagingEnabled(pVmcs)
6059	&& (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
6060	{
6061	/* Get PDPTEs from the VMCS. */
6062	X86PDPE aPaePdptes[X86_PG_PAE_PDPE_ENTRIES];
6063	aPaePdptes[0].u = pVmcs->u64GuestPdpte0.u;
6064	aPaePdptes[1].u = pVmcs->u64GuestPdpte1.u;
6065	aPaePdptes[2].u = pVmcs->u64GuestPdpte2.u;
6066	aPaePdptes[3].u = pVmcs->u64GuestPdpte3.u;
6067
6068	/* Check validity of the PDPTEs. */
6069	if (PGMGstArePaePdpesValid(pVCpu, &aPaePdptes[0]))
6070	{ /* likely */ }
6071	else
6072	{
6073	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
6074	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte);
6075	}
6076	}
6077
6078	NOREF(pszFailure);
6079	NOREF(pszInstr);
6080	return VINF_SUCCESS;
6081	}
6082	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
6083
6084
6085	/**
6086	* Checks guest-state as part of VM-entry.
6087	*
6088	* @returns VBox status code.
6089	* @param pVCpu The cross context virtual CPU structure.
6090	* @param pszInstr The VMX instruction name (for logging purposes).
6091	*/
6092	static int iemVmxVmentryCheckGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6093	{
6094	int rc = iemVmxVmentryCheckGuestControlRegsMsrs(pVCpu, pszInstr);
6095	if (RT_SUCCESS(rc))
6096	{
6097	rc = iemVmxVmentryCheckGuestSegRegs(pVCpu, pszInstr);
6098	if (RT_SUCCESS(rc))
6099	{
6100	rc = iemVmxVmentryCheckGuestGdtrIdtr(pVCpu, pszInstr);
6101	if (RT_SUCCESS(rc))
6102	{
6103	rc = iemVmxVmentryCheckGuestRipRFlags(pVCpu, pszInstr);
6104	if (RT_SUCCESS(rc))
6105	{
6106	rc = iemVmxVmentryCheckGuestNonRegState(pVCpu, pszInstr);
6107	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6108	if (RT_SUCCESS(rc))
6109	rc = iemVmxVmentryCheckGuestPdptes(pVCpu, pszInstr);
6110	#endif
6111	}
6112	}
6113	}
6114	}
6115	return rc;
6116	}
6117
6118
6119	/**
6120	* Checks host-state as part of VM-entry.
6121	*
6122	* @returns VBox status code.
6123	* @param pVCpu The cross context virtual CPU structure.
6124	* @param pszInstr The VMX instruction name (for logging purposes).
6125	*/
6126	static int iemVmxVmentryCheckHostState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6127	{
6128	/*
6129	* Host Control Registers and MSRs.
6130	* See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
6131	*/
6132	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6133	const char * const pszFailure = "VMFail";
6134
6135	/* CR0 reserved bits. */
6136	{
6137	/* CR0 MB1 bits. */
6138	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
6139	if ((pVmcs->u64HostCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
6140	{ /* likely */ }
6141	else
6142	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed0);
6143
6144	/* CR0 MBZ bits. */
6145	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6146	if (!(pVmcs->u64HostCr0.u & ~u64Cr0Fixed1))
6147	{ /* likely */ }
6148	else
6149	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed1);
6150	}
6151
6152	/* CR4 reserved bits. */
6153	{
6154	/* CR4 MB1 bits. */
6155	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6156	if ((pVmcs->u64HostCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
6157	{ /* likely */ }
6158	else
6159	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed0);
6160
6161	/* CR4 MBZ bits. */
6162	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6163	if (!(pVmcs->u64HostCr4.u & ~u64Cr4Fixed1))
6164	{ /* likely */ }
6165	else
6166	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed1);
6167	}
6168
6169	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6170	{
6171	/* CR3 reserved bits. */
6172	if (!(pVmcs->u64HostCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
6173	{ /* likely */ }
6174	else
6175	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr3);
6176
6177	/* SYSENTER ESP and SYSENTER EIP. */
6178	if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
6179	&& X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
6180	{ /* likely */ }
6181	else
6182	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSysenterEspEip);
6183	}
6184
6185	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6186	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR));
6187
6188	/* PAT MSR. */
6189	if ( !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
6190	\|\| CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
6191	{ /* likely */ }
6192	else
6193	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostPatMsr);
6194
6195	/* EFER MSR. */
6196	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
6197	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
6198	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
6199	{
6200	if (!(pVmcs->u64HostEferMsr.u & ~uValidEferMask))
6201	{ /* likely */ }
6202	else
6203	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsrRsvd);
6204
6205	bool const fHostLma = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LMA);
6206	bool const fHostLme = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LME);
6207	if ( fHostInLongMode == fHostLma
6208	&& fHostInLongMode == fHostLme)
6209	{ /* likely */ }
6210	else
6211	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsr);
6212	}
6213
6214	/*
6215	* Host Segment and Descriptor-Table Registers.
6216	* See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
6217	*/
6218	/* Selector RPL and TI. */
6219	if ( !(pVmcs->HostCs & (X86_SEL_RPL \| X86_SEL_LDT))
6220	&& !(pVmcs->HostSs & (X86_SEL_RPL \| X86_SEL_LDT))
6221	&& !(pVmcs->HostDs & (X86_SEL_RPL \| X86_SEL_LDT))
6222	&& !(pVmcs->HostEs & (X86_SEL_RPL \| X86_SEL_LDT))
6223	&& !(pVmcs->HostFs & (X86_SEL_RPL \| X86_SEL_LDT))
6224	&& !(pVmcs->HostGs & (X86_SEL_RPL \| X86_SEL_LDT))
6225	&& !(pVmcs->HostTr & (X86_SEL_RPL \| X86_SEL_LDT)))
6226	{ /* likely */ }
6227	else
6228	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSel);
6229
6230	/* CS and TR selectors cannot be 0. */
6231	if ( pVmcs->HostCs
6232	&& pVmcs->HostTr)
6233	{ /* likely */ }
6234	else
6235	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCsTr);
6236
6237	/* SS cannot be 0 if 32-bit host. */
6238	if ( fHostInLongMode
6239	\|\| pVmcs->HostSs)
6240	{ /* likely */ }
6241	else
6242	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSs);
6243
6244	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6245	{
6246	/* FS, GS, GDTR, IDTR, TR base address. */
6247	if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6248	&& X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6249	&& X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
6250	&& X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
6251	&& X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
6252	{ /* likely */ }
6253	else
6254	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSegBase);
6255	}
6256
6257	/*
6258	* Host address-space size for 64-bit CPUs.
6259	* See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
6260	*/
6261	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6262	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6263	{
6264	bool const fCpuInLongMode = CPUMIsGuestInLongMode(pVCpu);
6265
6266	/* Logical processor in IA-32e mode. */
6267	if (fCpuInLongMode)
6268	{
6269	if (fHostInLongMode)
6270	{
6271	/* PAE must be set. */
6272	if (pVmcs->u64HostCr4.u & X86_CR4_PAE)
6273	{ /* likely */ }
6274	else
6275	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pae);
6276
6277	/* RIP must be canonical. */
6278	if (X86_IS_CANONICAL(pVmcs->u64HostRip.u))
6279	{ /* likely */ }
6280	else
6281	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRip);
6282	}
6283	else
6284	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostLongMode);
6285	}
6286	else
6287	{
6288	/* Logical processor is outside IA-32e mode. */
6289	if ( !fGstInLongMode
6290	&& !fHostInLongMode)
6291	{
6292	/* PCIDE should not be set. */
6293	if (!(pVmcs->u64HostCr4.u & X86_CR4_PCIDE))
6294	{ /* likely */ }
6295	else
6296	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pcide);
6297
6298	/* The high 32-bits of RIP MBZ. */
6299	if (!pVmcs->u64HostRip.s.Hi)
6300	{ /* likely */ }
6301	else
6302	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRipRsvd);
6303	}
6304	else
6305	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongMode);
6306	}
6307	}
6308	else
6309	{
6310	/* Host address-space size for 32-bit CPUs. */
6311	if ( !fGstInLongMode
6312	&& !fHostInLongMode)
6313	{ /* likely */ }
6314	else
6315	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongModeNoCpu);
6316	}
6317
6318	NOREF(pszInstr);
6319	NOREF(pszFailure);
6320	return VINF_SUCCESS;
6321	}
6322
6323
6324	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6325	/**
6326	* Checks the EPT pointer VMCS field as part of VM-entry.
6327	*
6328	* @returns VBox status code.
6329	* @param pVCpu The cross context virtual CPU structure.
6330	* @param uEptPtr The EPT pointer to check.
6331	* @param penmVmxDiag Where to store the diagnostic reason on failure (not
6332	* updated on success). Optional, can be NULL.
6333	*/
6334	static int iemVmxVmentryCheckEptPtr(PVMCPUCC pVCpu, uint64_t uEptPtr, VMXVDIAG *penmVmxDiag) RT_NOEXCEPT
6335	{
6336	VMXVDIAG enmVmxDiag;
6337
6338	/* Reserved bits. */
6339	uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
6340	uint64_t const fValidMask = VMX_EPTP_VALID_MASK & ~(UINT64_MAX << cMaxPhysAddrWidth);
6341	if (uEptPtr & fValidMask)
6342	{
6343	/* Memory Type. */
6344	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
6345	uint8_t const fMemType = RT_BF_GET(uEptPtr, VMX_BF_EPTP_MEMTYPE);
6346	if ( ( fMemType == VMX_EPTP_MEMTYPE_WB
6347	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_WB))
6348	\|\| ( fMemType == VMX_EPTP_MEMTYPE_UC
6349	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_UC)))
6350	{
6351	/*
6352	* Page walk length (PML4).
6353	* Intel used to specify bit 7 of IA32_VMX_EPT_VPID_CAP as page walk length
6354	* of 5 but that seems to be removed from the latest specs. leaving only PML4
6355	* as the maximum supported page-walk level hence we hardcode it as 3 (1 less than 4)
6356	*/
6357	Assert(RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_PAGE_WALK_LENGTH_4));
6358	if (RT_BF_GET(uEptPtr, VMX_BF_EPTP_PAGE_WALK_LENGTH) == 3)
6359	{
6360	/* Access and dirty bits support in EPT structures. */
6361	if ( !RT_BF_GET(uEptPtr, VMX_BF_EPTP_ACCESS_DIRTY)
6362	\|\| RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_ACCESS_DIRTY))
6363	return VINF_SUCCESS;
6364
6365	enmVmxDiag = kVmxVDiag_Vmentry_EptpAccessDirty;
6366	}
6367	else
6368	enmVmxDiag = kVmxVDiag_Vmentry_EptpPageWalkLength;
6369	}
6370	else
6371	enmVmxDiag = kVmxVDiag_Vmentry_EptpMemType;
6372	}
6373	else
6374	enmVmxDiag = kVmxVDiag_Vmentry_EptpRsvd;
6375
6376	if (penmVmxDiag)
6377	*penmVmxDiag = enmVmxDiag;
6378	return VERR_VMX_VMENTRY_FAILED;
6379	}
6380	#endif
6381
6382
6383	/**
6384	* Checks VMCS controls fields as part of VM-entry.
6385	*
6386	* @returns VBox status code.
6387	* @param pVCpu The cross context virtual CPU structure.
6388	* @param pszInstr The VMX instruction name (for logging purposes).
6389	*
6390	* @remarks This may update secondary-processor based VM-execution control fields
6391	* in the current VMCS if necessary.
6392	*/
6393	static int iemVmxVmentryCheckCtls(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6394	{
6395	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6396	const char * const pszFailure = "VMFail";
6397	bool const fVmxTrueMsrs = RT_BOOL(pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Basic & VMX_BF_BASIC_TRUE_CTLS_MASK);
6398
6399	/*
6400	* VM-execution controls.
6401	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6402	*/
6403	{
6404	/* Pin-based VM-execution controls. */
6405	{
6406	VMXCTLSMSR const PinCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TruePinCtls
6407	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.PinCtls;
6408	if (!(~pVmcs->u32PinCtls & PinCtls.n.allowed0))
6409	{ /* likely */ }
6410	else
6411	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsDisallowed0);
6412
6413	if (!(pVmcs->u32PinCtls & ~PinCtls.n.allowed1))
6414	{ /* likely */ }
6415	else
6416	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsAllowed1);
6417	}
6418
6419	/* Processor-based VM-execution controls. */
6420	{
6421	VMXCTLSMSR const ProcCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueProcCtls
6422	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls;
6423	if (!(~pVmcs->u32ProcCtls & ProcCtls.n.allowed0))
6424	{ /* likely */ }
6425	else
6426	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsDisallowed0);
6427
6428	if (!(pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1))
6429	{ /* likely */ }
6430	else
6431	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsAllowed1);
6432	}
6433
6434	/* Secondary processor-based VM-execution controls. */
6435	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
6436	{
6437	VMXCTLSMSR const ProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls2;
6438	if (!(~pVmcs->u32ProcCtls2 & ProcCtls2.n.allowed0))
6439	{ /* likely */ }
6440	else
6441	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Disallowed0);
6442
6443	if (!(pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1))
6444	{ /* likely */ }
6445	else
6446	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Allowed1);
6447	}
6448	else if (pVmcs->u32ProcCtls2)
6449	{
6450	/*
6451	* If the "activate secondary controls" is clear, then the secondary processor-based VM-execution controls
6452	* is treated as 0.
6453	*
6454	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6455	*
6456	* Since this is a rather rare occurrence (only observed for a few VM-entries with Microsoft Hyper-V
6457	* enabled Windows Server 2008 R2 guest), it's not worth changing every place that reads this control to
6458	* also check the "activate secondary controls" bit. Instead, we temporarily save the guest programmed
6459	* control here, zero out the value the rest of our code uses and restore the guest programmed value
6460	* on VM-exit.
6461	*/
6462	pVmcs->u32RestoreProcCtls2 = pVmcs->u32ProcCtls2;
6463	pVmcs->u32ProcCtls2 = 0;
6464	}
6465
6466	/* CR3-target count. */
6467	if (pVmcs->u32Cr3TargetCount <= VMX_V_CR3_TARGET_COUNT)
6468	{ /* likely */ }
6469	else
6470	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Cr3TargetCount);
6471
6472	/* I/O bitmaps physical addresses. */
6473	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
6474	{
6475	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
6476	if ( !(GCPhysIoBitmapA & X86_PAGE_4K_OFFSET_MASK)
6477	&& !(GCPhysIoBitmapA >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6478	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapA))
6479	{ /* likely */ }
6480	else
6481	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapA);
6482
6483	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
6484	if ( !(GCPhysIoBitmapB & X86_PAGE_4K_OFFSET_MASK)
6485	&& !(GCPhysIoBitmapB >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6486	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapB))
6487	{ /* likely */ }
6488	else
6489	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapB);
6490	}
6491
6492	/* MSR bitmap physical address. */
6493	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
6494	{
6495	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
6496	if ( !(GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
6497	&& !(GCPhysMsrBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6498	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysMsrBitmap))
6499	{ /* likely */ }
6500	else
6501	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrMsrBitmap);
6502	}
6503
6504	/* TPR shadow related controls. */
6505	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6506	{
6507	/* Virtual-APIC page physical address. */
6508	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6509	if ( !(GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
6510	&& !(GCPhysVirtApic >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6511	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
6512	{ /* likely */ }
6513	else
6514	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVirtApicPage);
6515
6516	/* TPR threshold bits 31:4 MBZ without virtual-interrupt delivery. */
6517	if ( !(pVmcs->u32TprThreshold & ~VMX_TPR_THRESHOLD_MASK)
6518	\|\| (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6519	{ /* likely */ }
6520	else
6521	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdRsvd);
6522
6523	/* The rest done XXX document */
6524	}
6525	else
6526	{
6527	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6528	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6529	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6530	{ /* likely */ }
6531	else
6532	{
6533	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6534	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicTprShadow);
6535	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6536	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ApicRegVirt);
6537	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
6538	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtIntDelivery);
6539	}
6540	}
6541
6542	/* NMI exiting and virtual-NMIs. */
6543	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
6544	\|\| !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
6545	{ /* likely */ }
6546	else
6547	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtNmi);
6548
6549	/* Virtual-NMIs and NMI-window exiting. */
6550	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
6551	\|\| !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
6552	{ /* likely */ }
6553	else
6554	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_NmiWindowExit);
6555
6556	/* Virtualize APIC accesses. */
6557	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
6558	{
6559	/* APIC-access physical address. */
6560	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
6561	if ( !(GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
6562	&& !(GCPhysApicAccess >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6563	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
6564	{ /* likely */ }
6565	else
6566	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccess);
6567
6568	/*
6569	* Disallow APIC-access page and virtual-APIC page from being the same address.
6570	* Note! This is not an Intel requirement, but one imposed by our implementation.
6571	* This is done primarily to simplify recursion scenarios while redirecting accesses
6572	* between the APIC-access page and the virtual-APIC page. If any nested hypervisor
6573	* requires this, we can implement it later
6574	*/
6575	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6576	{
6577	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6578	if (GCPhysVirtApic != GCPhysApicAccess)
6579	{ /* likely */ }
6580	else
6581	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessEqVirtApic);
6582	}
6583	}
6584
6585	/* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
6586	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6587	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
6588	{ /* likely */ }
6589	else
6590	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6591
6592	/* Virtual-interrupt delivery requires external interrupt exiting. */
6593	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
6594	\|\| (pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
6595	{ /* likely */ }
6596	else
6597	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6598
6599	/* VPID. */
6600	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
6601	\|\| pVmcs->u16Vpid != 0)
6602	{ /* likely */ }
6603	else
6604	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Vpid);
6605
6606	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6607	/* Extended-Page-Table Pointer (EPTP). */
6608	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
6609	{
6610	VMXVDIAG enmVmxDiag;
6611	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, pVmcs->u64EptPtr.u, &enmVmxDiag);
6612	if (RT_SUCCESS(rc))
6613	{ /* likely */ }
6614	else
6615	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, enmVmxDiag, rc);
6616	}
6617	#else
6618	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT));
6619	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST));
6620	#endif
6621	Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
6622	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
6623	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
6624	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_XCPT_VE)); /* We don't support EPT-violation #VE yet. */
6625	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_TSC_SCALING)); /* We don't support TSC-scaling yet. */
6626
6627	/* VMCS shadowing. */
6628	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
6629	{
6630	/* VMREAD-bitmap physical address. */
6631	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
6632	if ( !(GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
6633	&& !(GCPhysVmreadBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6634	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
6635	{ /* likely */ }
6636	else
6637	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmreadBitmap);
6638
6639	/* VMWRITE-bitmap physical address. */
6640	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
6641	if ( !(GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
6642	&& !(GCPhysVmwriteBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6643	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
6644	{ /* likely */ }
6645	else
6646	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmwriteBitmap);
6647	}
6648	}
6649
6650	/*
6651	* VM-exit controls.
6652	* See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
6653	*/
6654	{
6655	VMXCTLSMSR const ExitCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueExitCtls
6656	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ExitCtls;
6657	if (!(~pVmcs->u32ExitCtls & ExitCtls.n.allowed0))
6658	{ /* likely */ }
6659	else
6660	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsDisallowed0);
6661
6662	if (!(pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1))
6663	{ /* likely */ }
6664	else
6665	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsAllowed1);
6666
6667	/* Save preemption timer without activating it. */
6668	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
6669	\|\| !(pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
6670	{ /* likely */ }
6671	else
6672	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_SavePreemptTimer);
6673
6674	/* VM-exit MSR-store count and VM-exit MSR-store area address. */
6675	if (pVmcs->u32ExitMsrStoreCount)
6676	{
6677	if ( !(pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
6678	&& !(pVmcs->u64AddrExitMsrStore.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6679	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
6680	{ /* likely */ }
6681	else
6682	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrStore);
6683	}
6684
6685	/* VM-exit MSR-load count and VM-exit MSR-load area address. */
6686	if (pVmcs->u32ExitMsrLoadCount)
6687	{
6688	if ( !(pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6689	&& !(pVmcs->u64AddrExitMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6690	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
6691	{ /* likely */ }
6692	else
6693	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrLoad);
6694	}
6695	}
6696
6697	/*
6698	* VM-entry controls.
6699	* See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
6700	*/
6701	{
6702	VMXCTLSMSR const EntryCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueEntryCtls
6703	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.EntryCtls;
6704	if (!(~pVmcs->u32EntryCtls & EntryCtls.n.allowed0))
6705	{ /* likely */ }
6706	else
6707	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsDisallowed0);
6708
6709	if (!(pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1))
6710	{ /* likely */ }
6711	else
6712	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsAllowed1);
6713
6714	/* Event injection. */
6715	uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
6716	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
6717	{
6718	/* Type and vector. */
6719	uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
6720	uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
6721	uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
6722	if ( !uRsvd
6723	&& VMXIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
6724	&& VMXIsEntryIntInfoVectorValid(uVector, uType))
6725	{ /* likely */ }
6726	else
6727	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoTypeVecRsvd);
6728
6729	/* Exception error code. */
6730	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
6731	{
6732	/* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
6733	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
6734	\|\| (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
6735	{ /* likely */ }
6736	else
6737	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodePe);
6738
6739	/* Exceptions that provide an error code. */
6740	if ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
6741	&& ( uVector == X86_XCPT_DF
6742	\|\| uVector == X86_XCPT_TS
6743	\|\| uVector == X86_XCPT_NP
6744	\|\| uVector == X86_XCPT_SS
6745	\|\| uVector == X86_XCPT_GP
6746	\|\| uVector == X86_XCPT_PF
6747	\|\| uVector == X86_XCPT_AC))
6748	{ /* likely */ }
6749	else
6750	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodeVec);
6751
6752	/* Exception error-code reserved bits. */
6753	if (!(pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK))
6754	{ /* likely */ }
6755	else
6756	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryXcptErrCodeRsvd);
6757
6758	/* Injecting a software interrupt, software exception or privileged software exception. */
6759	if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
6760	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
6761	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
6762	{
6763	/* Instruction length must be in the range 0-15. */
6764	if (pVmcs->u32EntryInstrLen <= VMX_ENTRY_INSTR_LEN_MAX)
6765	{ /* likely */ }
6766	else
6767	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLen);
6768
6769	/* However, instruction length of 0 is allowed only when its CPU feature is present. */
6770	if ( pVmcs->u32EntryInstrLen != 0
6771	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
6772	{ /* likely */ }
6773	else
6774	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLenZero);
6775	}
6776	}
6777	}
6778
6779	/* VM-entry MSR-load count and VM-entry MSR-load area address. */
6780	if (pVmcs->u32EntryMsrLoadCount)
6781	{
6782	if ( !(pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6783	&& !(pVmcs->u64AddrEntryMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6784	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
6785	{ /* likely */ }
6786	else
6787	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrEntryMsrLoad);
6788	}
6789
6790	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
6791	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
6792	}
6793
6794	NOREF(pszInstr);
6795	NOREF(pszFailure);
6796	return VINF_SUCCESS;
6797	}
6798
6799
6800	/**
6801	* Loads the guest control registers, debug register and some MSRs as part of
6802	* VM-entry.
6803	*
6804	* @param pVCpu The cross context virtual CPU structure.
6805	*/
6806	static void iemVmxVmentryLoadGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
6807	{
6808	/*
6809	* Load guest control registers, debug registers and MSRs.
6810	* See Intel spec. 26.3.2.1 "Loading Guest Control Registers, Debug Registers and MSRs".
6811	*/
6812	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6813
6814	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6815	uint64_t const uGstCr0 = (pVmcs->u64GuestCr0.u & ~VMX_ENTRY_GUEST_CR0_IGNORE_MASK)
6816	\| (pVCpu->cpum.GstCtx.cr0 & VMX_ENTRY_GUEST_CR0_IGNORE_MASK);
6817	pVCpu->cpum.GstCtx.cr0 = uGstCr0;
6818	pVCpu->cpum.GstCtx.cr4 = pVmcs->u64GuestCr4.u;
6819	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64GuestCr3.u;
6820
6821	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
6822	pVCpu->cpum.GstCtx.dr[7] = (pVmcs->u64GuestDr7.u & ~VMX_ENTRY_GUEST_DR7_MBZ_MASK) \| VMX_ENTRY_GUEST_DR7_MB1_MASK;
6823
6824	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64GuestSysenterEip.s.Lo;
6825	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64GuestSysenterEsp.s.Lo;
6826	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32GuestSysenterCS;
6827
6828	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6829	{
6830	/* FS base and GS base are loaded while loading the rest of the guest segment registers. */
6831
6832	/* EFER MSR. */
6833	if (!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR))
6834	{
6835	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_EFER);
6836	uint64_t const uHostEfer = pVCpu->cpum.GstCtx.msrEFER;
6837	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6838	bool const fGstPaging = RT_BOOL(uGstCr0 & X86_CR0_PG);
6839	if (fGstInLongMode)
6840	{
6841	/* If the nested-guest is in long mode, LMA and LME are both set. */
6842	Assert(fGstPaging);
6843	pVCpu->cpum.GstCtx.msrEFER = uHostEfer \| (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
6844	}
6845	else
6846	{
6847	/*
6848	* If the nested-guest is outside long mode:
6849	* - With paging: LMA is cleared, LME is cleared.
6850	* - Without paging: LMA is cleared, LME is left unmodified.
6851	*/
6852	uint64_t const fLmaLmeMask = MSR_K6_EFER_LMA \| (fGstPaging ? MSR_K6_EFER_LME : 0);
6853	pVCpu->cpum.GstCtx.msrEFER = uHostEfer & ~fLmaLmeMask;
6854	}
6855	}
6856	/* else: see below. */
6857	}
6858
6859	/* PAT MSR. */
6860	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
6861	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64GuestPatMsr.u;
6862
6863	/* EFER MSR. */
6864	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
6865	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64GuestEferMsr.u;
6866
6867	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6868	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
6869
6870	/* We don't support IA32_BNDCFGS MSR yet. */
6871	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
6872
6873	/* Nothing to do for SMBASE register - We don't support SMM yet. */
6874	}
6875
6876
6877	/**
6878	* Loads the guest segment registers, GDTR, IDTR, LDTR and TR as part of VM-entry.
6879	*
6880	* @param pVCpu The cross context virtual CPU structure.
6881	*/
6882	static void iemVmxVmentryLoadGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
6883	{
6884	/*
6885	* Load guest segment registers, GDTR, IDTR, LDTR and TR.
6886	* See Intel spec. 26.3.2.2 "Loading Guest Segment Registers and Descriptor-Table Registers".
6887	*/
6888	/* CS, SS, ES, DS, FS, GS. */
6889	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6890	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
6891	{
6892	PCPUMSELREG pGstSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
6893	CPUMSELREG VmcsSelReg;
6894	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &VmcsSelReg);
6895	AssertRC(rc); NOREF(rc);
6896	if (!(VmcsSelReg.Attr.u & X86DESCATTR_UNUSABLE))
6897	{
6898	pGstSelReg->Sel = VmcsSelReg.Sel;
6899	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6900	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6901	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6902	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6903	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6904	}
6905	else
6906	{
6907	pGstSelReg->Sel = VmcsSelReg.Sel;
6908	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6909	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6910	switch (iSegReg)
6911	{
6912	case X86_SREG_CS:
6913	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6914	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6915	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6916	break;
6917
6918	case X86_SREG_SS:
6919	pGstSelReg->u64Base = VmcsSelReg.u64Base & UINT32_C(0xfffffff0);
6920	pGstSelReg->u32Limit = 0;
6921	pGstSelReg->Attr.u = (VmcsSelReg.Attr.u & X86DESCATTR_DPL) \| X86DESCATTR_D \| X86DESCATTR_UNUSABLE;
6922	break;
6923
6924	case X86_SREG_ES:
6925	case X86_SREG_DS:
6926	pGstSelReg->u64Base = 0;
6927	pGstSelReg->u32Limit = 0;
6928	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6929	break;
6930
6931	case X86_SREG_FS:
6932	case X86_SREG_GS:
6933	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6934	pGstSelReg->u32Limit = 0;
6935	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6936	break;
6937	}
6938	Assert(pGstSelReg->Attr.n.u1Unusable);
6939	}
6940	}
6941
6942	/* LDTR. */
6943	pVCpu->cpum.GstCtx.ldtr.Sel = pVmcs->GuestLdtr;
6944	pVCpu->cpum.GstCtx.ldtr.ValidSel = pVmcs->GuestLdtr;
6945	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
6946	if (!(pVmcs->u32GuestLdtrAttr & X86DESCATTR_UNUSABLE))
6947	{
6948	pVCpu->cpum.GstCtx.ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
6949	pVCpu->cpum.GstCtx.ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
6950	pVCpu->cpum.GstCtx.ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
6951	}
6952	else
6953	{
6954	pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
6955	pVCpu->cpum.GstCtx.ldtr.u32Limit = 0;
6956	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
6957	}
6958
6959	/* TR. */
6960	Assert(!(pVmcs->u32GuestTrAttr & X86DESCATTR_UNUSABLE));
6961	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->GuestTr;
6962	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->GuestTr;
6963	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
6964	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64GuestTrBase.u;
6965	pVCpu->cpum.GstCtx.tr.u32Limit = pVmcs->u32GuestTrLimit;
6966	pVCpu->cpum.GstCtx.tr.Attr.u = pVmcs->u32GuestTrAttr;
6967
6968	/* GDTR. */
6969	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcs->u32GuestGdtrLimit;
6970	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64GuestGdtrBase.u;
6971
6972	/* IDTR. */
6973	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcs->u32GuestIdtrLimit;
6974	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64GuestIdtrBase.u;
6975	}
6976
6977
6978	/**
6979	* Loads the guest MSRs from the VM-entry MSR-load area as part of VM-entry.
6980	*
6981	* @returns VBox status code.
6982	* @param pVCpu The cross context virtual CPU structure.
6983	* @param pszInstr The VMX instruction name (for logging purposes).
6984	*/
6985	static int iemVmxVmentryLoadGuestAutoMsrs(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6986	{
6987	/*
6988	* Load guest MSRs.
6989	* See Intel spec. 26.4 "Loading MSRs".
6990	*/
6991	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6992	const char *const pszFailure = "VM-exit";
6993
6994	/*
6995	* The VM-entry MSR-load area address need not be a valid guest-physical address if the
6996	* VM-entry MSR load count is 0. If this is the case, bail early without reading it.
6997	* See Intel spec. 24.8.2 "VM-Entry Controls for MSRs".
6998	*/
6999	uint32_t const cMsrs = RT_MIN(pVmcs->u32EntryMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea));
7000	if (!cMsrs)
7001	return VINF_SUCCESS;
7002
7003	/*
7004	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count is
7005	* exceeded including possibly raising #MC exceptions during VMX transition. Our
7006	* implementation shall fail VM-entry with an VMX_EXIT_ERR_MSR_LOAD VM-exit.
7007	*/
7008	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
7009	if (fIsMsrCountValid)
7010	{ /* likely */ }
7011	else
7012	{
7013	iemVmxVmcsSetExitQual(pVCpu, VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
7014	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadCount);
7015	}
7016
7017	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
7018	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0],
7019	GCPhysVmEntryMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
7020	if (RT_SUCCESS(rc))
7021	{
7022	PCVMXAUTOMSR pMsr = &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0];
7023	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
7024	{
7025	if ( !pMsr->u32Reserved
7026	&& pMsr->u32Msr != MSR_K8_FS_BASE
7027	&& pMsr->u32Msr != MSR_K8_GS_BASE
7028	&& pMsr->u32Msr != MSR_K6_EFER
7029	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
7030	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
7031	{
7032	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
7033	if (rcStrict == VINF_SUCCESS)
7034	continue;
7035
7036	/*
7037	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-entry.
7038	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VM-entry failure
7039	* recording the MSR index in the Exit qualification (as per the Intel spec.) and indicated
7040	* further by our own, specific diagnostic code. Later, we can try implement handling of the
7041	* MSR in ring-0 if possible, or come up with a better, generic solution.
7042	*/
7043	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7044	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
7045	? kVmxVDiag_Vmentry_MsrLoadRing3
7046	: kVmxVDiag_Vmentry_MsrLoad;
7047	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
7048	}
7049	else
7050	{
7051	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7052	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadRsvd);
7053	}
7054	}
7055	}
7056	else
7057	{
7058	AssertMsgFailed(("%s: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmEntryMsrLoadArea, rc));
7059	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadPtrReadPhys, rc);
7060	}
7061
7062	NOREF(pszInstr);
7063	NOREF(pszFailure);
7064	return VINF_SUCCESS;
7065	}
7066
7067
7068	/**
7069	* Loads the guest-state non-register state as part of VM-entry.
7070	*
7071	* @returns VBox status code.
7072	* @param pVCpu The cross context virtual CPU structure.
7073	* @param pszInstr The VMX instruction name (for logging purposes).
7074	*
7075	* @remarks This must be called only after loading the nested-guest register state
7076	* (especially nested-guest RIP).
7077	*/
7078	static int iemVmxVmentryLoadGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7079	{
7080	/*
7081	* Load guest non-register state.
7082	* See Intel spec. 26.6 "Special Features of VM Entry"
7083	*/
7084	const char *const pszFailure = "VM-exit";
7085	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7086
7087	/*
7088	* If VM-entry is not vectoring, block-by-STI and block-by-MovSS state must be loaded.
7089	* If VM-entry is vectoring, there is no block-by-STI or block-by-MovSS.
7090	*
7091	* See Intel spec. 26.6.1 "Interruptibility State".
7092	*/
7093	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, NULL /* puEntryIntInfoType */);
7094	if ( !fEntryVectoring
7095	&& (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI \| VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)))
7096	CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcs->u64GuestRip.u);
7097	else
7098	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
7099
7100	/* NMI blocking. */
7101	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI)
7102	{
7103	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
7104	{
7105	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
7106	Assert(!CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx));
7107	}
7108	else
7109	{
7110	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7111	CPUMSetInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
7112	}
7113	}
7114	else
7115	{
7116	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7117	Assert(!CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx));
7118	}
7119
7120	/* SMI blocking is irrelevant. We don't support SMIs yet. */
7121
7122	/*
7123	* Set PGM's copy of the EPT pointer.
7124	* The EPTP has already been validated while checking guest state.
7125	*
7126	* It is important to do this prior to mapping PAE PDPTEs (below).
7127	*/
7128	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7129	PGMSetGuestEptPtr(pVCpu, pVmcs->u64EptPtr.u);
7130
7131	/*
7132	* Load the guest's PAE PDPTEs.
7133	*/
7134	if (!iemVmxVmcsIsGuestPaePagingEnabled(pVmcs))
7135	{
7136	/*
7137	* When PAE paging is not used we clear the PAE PDPTEs for safety
7138	* in case we might be switching from a PAE host to a non-PAE guest.
7139	*/
7140	pVCpu->cpum.GstCtx.aPaePdpes[0].u = 0;
7141	pVCpu->cpum.GstCtx.aPaePdpes[1].u = 0;
7142	pVCpu->cpum.GstCtx.aPaePdpes[2].u = 0;
7143	pVCpu->cpum.GstCtx.aPaePdpes[3].u = 0;
7144	}
7145	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7146	{
7147	/*
7148	* With EPT and the nested-guest using PAE paging, we've already validated the PAE PDPTEs
7149	* while checking the guest state. We can load them into the nested-guest CPU state now.
7150	* They'll later be used while mapping CR3 and the PAE PDPTEs.
7151	*/
7152	pVCpu->cpum.GstCtx.aPaePdpes[0].u = pVmcs->u64GuestPdpte0.u;
7153	pVCpu->cpum.GstCtx.aPaePdpes[1].u = pVmcs->u64GuestPdpte1.u;
7154	pVCpu->cpum.GstCtx.aPaePdpes[2].u = pVmcs->u64GuestPdpte2.u;
7155	pVCpu->cpum.GstCtx.aPaePdpes[3].u = pVmcs->u64GuestPdpte3.u;
7156	}
7157	else
7158	{
7159	/*
7160	* Without EPT and the nested-guest using PAE paging, we must load the PAE PDPTEs
7161	* referenced by CR3. This involves loading (and mapping) CR3 and validating them now.
7162	*/
7163	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64GuestCr3.u);
7164	if (RT_SUCCESS(rc))
7165	{ /* likely */ }
7166	else
7167	{
7168	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
7169	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte, rc);
7170	}
7171	}
7172
7173	/* VPID is irrelevant. We don't support VPID yet. */
7174
7175	/* Clear address-range monitoring. */
7176	EMMonitorWaitClear(pVCpu);
7177
7178	return VINF_SUCCESS;
7179	}
7180
7181
7182	/**
7183	* Loads the guest VMCS referenced state (such as MSR bitmaps, I/O bitmaps etc).
7184	*
7185	* @param pVCpu The cross context virtual CPU structure.
7186	* @param pszInstr The VMX instruction name (for logging purposes).
7187	*
7188	* @remarks This assumes various VMCS related data structure pointers have already
7189	* been verified prior to calling this function.
7190	*/
7191	static int iemVmxVmentryLoadGuestVmcsRefState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7192	{
7193	const char *const pszFailure = "VM-exit";
7194	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7195
7196	/*
7197	* Virtualize APIC accesses.
7198	*/
7199	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7200	{
7201	/* APIC-access physical address. */
7202	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
7203
7204	/*
7205	* Register the handler for the APIC-access page.
7206	*
7207	* We don't deregister the APIC-access page handler during the VM-exit as a different
7208	* nested-VCPU might be using the same guest-physical address for its APIC-access page.
7209	*
7210	* We leave the page registered until the first access that happens outside VMX non-root
7211	* mode. Guest software is allowed to access structures such as the APIC-access page
7212	* only when no logical processor with a current VMCS references it in VMX non-root mode,
7213	* otherwise it can lead to unpredictable behavior including guest triple-faults.
7214	*
7215	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7216	*/
7217	/** @todo r=bird: The lazy deregistration of the page is potentially slightly
7218	* problematic, as the guest may cause us to create lots of access
7219	* handler entries. However, any slowdown or similar effects should
7220	* only ever affect the guest itself, so not a big issue. Though, I
7221	* wish there was most recently used approach or something to tracking
7222	* these... */
7223	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
7224	int rc = PGMHandlerPhysicalRegisterVmxApicAccessPage(pVM, GCPhysApicAccess, pVM->iem.s.hVmxApicAccessPage);
7225	if (RT_SUCCESS(rc))
7226	{ /* likely */ }
7227	else
7228	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessHandlerReg, rc);
7229	}
7230
7231	/*
7232	* VMCS shadowing.
7233	*/
7234	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7235	{
7236	/* Read the VMREAD-bitmap. */
7237	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
7238	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap[0],
7239	GCPhysVmreadBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap));
7240	if (RT_SUCCESS(rc))
7241	{ /* likely */ }
7242	else
7243	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmreadBitmapPtrReadPhys, rc);
7244
7245	/* Read the VMWRITE-bitmap. */
7246	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmwriteBitmap.u;
7247	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap[0],
7248	GCPhysVmwriteBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap));
7249	if (RT_SUCCESS(rc))
7250	{ /* likely */ }
7251	else
7252	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmwriteBitmapPtrReadPhys, rc);
7253	}
7254
7255	/*
7256	* I/O bitmaps.
7257	*/
7258	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
7259	{
7260	/* Read the IO bitmap A. */
7261	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
7262	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[0],
7263	GCPhysIoBitmapA, VMX_V_IO_BITMAP_A_SIZE);
7264	if (RT_SUCCESS(rc))
7265	{ /* likely */ }
7266	else
7267	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapAPtrReadPhys, rc);
7268
7269	/* Read the IO bitmap B. */
7270	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
7271	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[VMX_V_IO_BITMAP_A_SIZE],
7272	GCPhysIoBitmapB, VMX_V_IO_BITMAP_B_SIZE);
7273	if (RT_SUCCESS(rc))
7274	{ /* likely */ }
7275	else
7276	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapBPtrReadPhys, rc);
7277	}
7278
7279	/*
7280	* TPR shadow and Virtual-APIC page.
7281	*/
7282	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
7283	{
7284	/* Verify TPR threshold and VTPR when both virtualize-APIC accesses and virtual-interrupt delivery aren't used. */
7285	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7286	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
7287	{
7288	/* Read the VTPR from the virtual-APIC page. */
7289	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
7290	uint8_t u8VTpr;
7291	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &u8VTpr, GCPhysVirtApic + XAPIC_OFF_TPR, sizeof(u8VTpr));
7292	if (RT_SUCCESS(rc))
7293	{ /* likely */ }
7294	else
7295	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtApicPagePtrReadPhys, rc);
7296
7297	/* Bits 3:0 of the TPR-threshold must not be greater than bits 7:4 of VTPR. */
7298	if ((uint8_t)RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) <= (u8VTpr & 0xf0))
7299	{ /* likely */ }
7300	else
7301	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdVTpr);
7302	}
7303	}
7304
7305	/*
7306	* VMCS link pointer.
7307	*/
7308	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
7309	{
7310	/* Read the VMCS-link pointer from guest memory. */
7311	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
7312	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs,
7313	GCPhysShadowVmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs));
7314	if (RT_SUCCESS(rc))
7315	{ /* likely */ }
7316	else
7317	{
7318	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7319	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrReadPhys, rc);
7320	}
7321
7322	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
7323	if (pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID)
7324	{ /* likely */ }
7325	else
7326	{
7327	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7328	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrRevId);
7329	}
7330
7331	/* Verify the shadow bit is set if VMCS shadowing is enabled . */
7332	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7333	\|\| pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.fIsShadowVmcs)
7334	{ /* likely */ }
7335	else
7336	{
7337	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7338	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrShadow);
7339	}
7340
7341	/* Update our cache of the guest physical address of the shadow VMCS. */
7342	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysShadowVmcs = GCPhysShadowVmcs;
7343	}
7344
7345	/*
7346	* MSR bitmap.
7347	*/
7348	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
7349	{
7350	/* Read the MSR bitmap. */
7351	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
7352	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap[0],
7353	GCPhysMsrBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap));
7354	if (RT_SUCCESS(rc))
7355	{ /* likely */ }
7356	else
7357	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrBitmapPtrReadPhys, rc);
7358	}
7359
7360	NOREF(pszFailure);
7361	NOREF(pszInstr);
7362	return VINF_SUCCESS;
7363	}
7364
7365
7366	/**
7367	* Loads the guest-state as part of VM-entry.
7368	*
7369	* @returns VBox status code.
7370	* @param pVCpu The cross context virtual CPU structure.
7371	* @param pszInstr The VMX instruction name (for logging purposes).
7372	*
7373	* @remarks This must be done after all the necessary steps prior to loading of
7374	* guest-state (e.g. checking various VMCS state).
7375	*/
7376	static int iemVmxVmentryLoadGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7377	{
7378	/* Load guest control registers, MSRs (that are directly part of the VMCS). */
7379	iemVmxVmentryLoadGuestControlRegsMsrs(pVCpu);
7380
7381	/* Load guest segment registers. */
7382	iemVmxVmentryLoadGuestSegRegs(pVCpu);
7383
7384	/*
7385	* Load guest RIP, RSP and RFLAGS.
7386	* See Intel spec. 26.3.2.3 "Loading Guest RIP, RSP and RFLAGS".
7387	*/
7388	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7389	pVCpu->cpum.GstCtx.rsp = pVmcs->u64GuestRsp.u;
7390	pVCpu->cpum.GstCtx.rip = pVmcs->u64GuestRip.u;
7391	pVCpu->cpum.GstCtx.rflags.u = pVmcs->u64GuestRFlags.u;
7392
7393	/* Initialize the PAUSE-loop controls as part of VM-entry. */
7394	pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick = 0;
7395	pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick = 0;
7396
7397	/* Load guest non-register state (such as interrupt shadows, NMI blocking etc). */
7398	int rc = iemVmxVmentryLoadGuestNonRegState(pVCpu, pszInstr);
7399	if (rc == VINF_SUCCESS)
7400	{ /* likely */ }
7401	else
7402	return rc;
7403
7404	/* Load VMX related structures and state referenced by the VMCS. */
7405	rc = iemVmxVmentryLoadGuestVmcsRefState(pVCpu, pszInstr);
7406	if (rc == VINF_SUCCESS)
7407	{ /* likely */ }
7408	else
7409	return rc;
7410
7411	NOREF(pszInstr);
7412	return VINF_SUCCESS;
7413	}
7414
7415
7416	/**
7417	* Returns whether there are is a pending debug exception on VM-entry.
7418	*
7419	* @param pVCpu The cross context virtual CPU structure.
7420	* @param pszInstr The VMX instruction name (for logging purposes).
7421	*/
7422	static bool iemVmxVmentryIsPendingDebugXcpt(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7423	{
7424	/*
7425	* Pending debug exceptions.
7426	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7427	*/
7428	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7429	Assert(pVmcs);
7430
7431	bool fPendingDbgXcpt = RT_BOOL(pVmcs->u64GuestPendingDbgXcpts.u & ( VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS
7432	\| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP));
7433	if (fPendingDbgXcpt)
7434	{
7435	uint8_t uEntryIntInfoType;
7436	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, &uEntryIntInfoType);
7437	if (fEntryVectoring)
7438	{
7439	switch (uEntryIntInfoType)
7440	{
7441	case VMX_ENTRY_INT_INFO_TYPE_EXT_INT:
7442	case VMX_ENTRY_INT_INFO_TYPE_NMI:
7443	case VMX_ENTRY_INT_INFO_TYPE_HW_XCPT:
7444	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7445	fPendingDbgXcpt = false;
7446	break;
7447
7448	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7449	{
7450	/*
7451	* Whether the pending debug exception for software exceptions other than
7452	* #BP and #OF is delivered after injecting the exception or is discard
7453	* is CPU implementation specific. We will discard them (easier).
7454	*/
7455	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
7456	if ( uVector != X86_XCPT_BP
7457	&& uVector != X86_XCPT_OF)
7458	fPendingDbgXcpt = false;
7459	RT_FALL_THRU();
7460	}
7461	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7462	{
7463	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
7464	fPendingDbgXcpt = false;
7465	break;
7466	}
7467	}
7468	}
7469	else
7470	{
7471	/*
7472	* When the VM-entry is not vectoring but there is blocking-by-MovSS, whether the
7473	* pending debug exception is held pending or is discarded is CPU implementation
7474	* specific. We will discard them (easier).
7475	*/
7476	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
7477	fPendingDbgXcpt = false;
7478
7479	/* There's no pending debug exception in the shutdown or wait-for-SIPI state. */
7480	if (pVmcs->u32GuestActivityState & (VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN \| VMX_VMCS_GUEST_ACTIVITY_SIPI_WAIT))
7481	fPendingDbgXcpt = false;
7482	}
7483	}
7484
7485	NOREF(pszInstr);
7486	return fPendingDbgXcpt;
7487	}
7488
7489
7490	/**
7491	* Set up the monitor-trap flag (MTF).
7492	*
7493	* @param pVCpu The cross context virtual CPU structure.
7494	* @param pszInstr The VMX instruction name (for logging purposes).
7495	*/
7496	static void iemVmxVmentrySetupMtf(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7497	{
7498	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7499	Assert(pVmcs);
7500	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_MONITOR_TRAP_FLAG)
7501	{
7502	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7503	Log(("%s: Monitor-trap flag set on VM-entry\n", pszInstr));
7504	}
7505	else
7506	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
7507	NOREF(pszInstr);
7508	}
7509
7510
7511	/**
7512	* Sets up NMI-window exiting.
7513	*
7514	* @param pVCpu The cross context virtual CPU structure.
7515	* @param pszInstr The VMX instruction name (for logging purposes).
7516	*/
7517	static void iemVmxVmentrySetupNmiWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7518	{
7519	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7520	Assert(pVmcs);
7521	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT)
7522	{
7523	Assert(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI);
7524	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW);
7525	Log(("%s: NMI-window set on VM-entry\n", pszInstr));
7526	}
7527	else
7528	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW));
7529	NOREF(pszInstr);
7530	}
7531
7532
7533	/**
7534	* Sets up interrupt-window exiting.
7535	*
7536	* @param pVCpu The cross context virtual CPU structure.
7537	* @param pszInstr The VMX instruction name (for logging purposes).
7538	*/
7539	static void iemVmxVmentrySetupIntWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7540	{
7541	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7542	Assert(pVmcs);
7543	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT)
7544	{
7545	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW);
7546	Log(("%s: Interrupt-window set on VM-entry\n", pszInstr));
7547	}
7548	else
7549	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW));
7550	NOREF(pszInstr);
7551	}
7552
7553
7554	/**
7555	* Set up the VMX-preemption timer.
7556	*
7557	* @param pVCpu The cross context virtual CPU structure.
7558	* @param pszInstr The VMX instruction name (for logging purposes).
7559	*/
7560	static void iemVmxVmentrySetupPreemptTimer(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7561	{
7562	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7563	Assert(pVmcs);
7564	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
7565	{
7566	/*
7567	* If the timer is 0, we must cause a VM-exit before executing the first
7568	* nested-guest instruction. So we can flag as though the timer has already
7569	* expired and we will check and cause a VM-exit at the right priority elsewhere
7570	* in the code.
7571	*/
7572	uint64_t uEntryTick;
7573	uint32_t const uPreemptTimer = pVmcs->u32PreemptTimer;
7574	if (uPreemptTimer)
7575	{
7576	int rc = CPUMStartGuestVmxPremptTimer(pVCpu, uPreemptTimer, VMX_V_PREEMPT_TIMER_SHIFT, &uEntryTick);
7577	AssertRC(rc);
7578	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64\n", pszInstr, uEntryTick));
7579	}
7580	else
7581	{
7582	uEntryTick = TMCpuTickGetNoCheck(pVCpu);
7583	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER);
7584	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64 to expire immediately!\n", pszInstr, uEntryTick));
7585	}
7586
7587	pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick = uEntryTick;
7588	}
7589	else
7590	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
7591
7592	NOREF(pszInstr);
7593	}
7594
7595
7596	/**
7597	* Injects an event using TRPM given a VM-entry interruption info and related
7598	* fields.
7599	*
7600	* @param pVCpu The cross context virtual CPU structure.
7601	* @param pszInstr The VMX instruction name (for logging purposes).
7602	* @param uEntryIntInfo The VM-entry interruption info.
7603	* @param uErrCode The error code associated with the event if any.
7604	* @param cbInstr The VM-entry instruction length (for software
7605	* interrupts and software exceptions). Pass 0
7606	* otherwise.
7607	* @param GCPtrFaultAddress The guest CR2 if this is a \#PF event.
7608	*/
7609	static void iemVmxVmentryInjectTrpmEvent(PVMCPUCC pVCpu, const char *pszInstr, uint32_t uEntryIntInfo, uint32_t uErrCode,
7610	uint32_t cbInstr, RTGCUINTPTR GCPtrFaultAddress) RT_NOEXCEPT
7611	{
7612	Assert(VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo));
7613
7614	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo);
7615	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo);
7616	TRPMEVENT const enmTrpmEvent = HMVmxEventTypeToTrpmEventType(uEntryIntInfo);
7617
7618	Assert(uType != VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT);
7619
7620	int rc = TRPMAssertTrap(pVCpu, uVector, enmTrpmEvent);
7621	AssertRC(rc);
7622	Log(("%s: Injecting: vector=%#x type=%#x (%s)\n", pszInstr, uVector, uType, VMXGetEntryIntInfoTypeDesc(uType)));
7623
7624	if (VMX_ENTRY_INT_INFO_IS_ERROR_CODE_VALID(uEntryIntInfo))
7625	{
7626	TRPMSetErrorCode(pVCpu, uErrCode);
7627	Log(("%s: Injecting: err_code=%#x\n", pszInstr, uErrCode));
7628	}
7629
7630	if (VMX_ENTRY_INT_INFO_IS_XCPT_PF(uEntryIntInfo))
7631	{
7632	TRPMSetFaultAddress(pVCpu, GCPtrFaultAddress);
7633	Log(("%s: Injecting: fault_addr=%RGp\n", pszInstr, GCPtrFaultAddress));
7634	}
7635	else
7636	{
7637	switch (uType)
7638	{
7639	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7640	TRPMSetTrapDueToIcebp(pVCpu);
7641	Log(("%s: Injecting: icebp\n", pszInstr));
7642	RT_FALL_THRU();
7643	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7644	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7645	TRPMSetInstrLength(pVCpu, cbInstr);
7646	Log(("%s: Injecting: instr_len=%u\n", pszInstr, cbInstr));
7647	break;
7648	}
7649	}
7650
7651	NOREF(pszInstr);
7652	}
7653
7654
7655	/**
7656	* Performs event injection (if any) as part of VM-entry.
7657	*
7658	* @param pVCpu The cross context virtual CPU structure.
7659	* @param pszInstr The VMX instruction name (for logging purposes).
7660	*/
7661	static void iemVmxVmentryInjectEvent(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7662	{
7663	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7664
7665	/*
7666	* Inject events.
7667	* The event that is going to be made pending for injection is not subject to VMX intercepts,
7668	* thus we flag ignoring of intercepts. However, recursive exceptions if any during delivery
7669	* of the current event -are- subject to intercepts, hence this flag will be flipped during
7670	* the actually delivery of this event.
7671	*
7672	* See Intel spec. 26.5 "Event Injection".
7673	*/
7674	uint32_t const uEntryIntInfo = pVmcs->u32EntryIntInfo;
7675	bool const fEntryIntInfoValid = VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo);
7676
7677	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, !fEntryIntInfoValid);
7678	if (fEntryIntInfoValid)
7679	{
7680	if (VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo) != VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT)
7681	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uEntryIntInfo, pVmcs->u32EntryXcptErrCode, pVmcs->u32EntryInstrLen,
7682	pVCpu->cpum.GstCtx.cr2);
7683	else
7684	{
7685	Assert(VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo) == VMX_ENTRY_INT_INFO_VECTOR_MTF);
7686	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7687	}
7688
7689	/*
7690	* We need to clear the VM-entry interruption information field's valid bit on VM-exit.
7691	*
7692	* However, we do it here on VM-entry as well because while it isn't visible to guest
7693	* software until VM-exit, when and if HM looks at the VMCS to continue nested-guest
7694	* execution using hardware-assisted VMX, it will not try to inject the event again.
7695	*
7696	* See Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
7697	*/
7698	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
7699	}
7700	else
7701	{
7702	/*
7703	* Inject any pending guest debug exception.
7704	* Unlike injecting events, this #DB injection on VM-entry is subject to #DB VMX intercept.
7705	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7706	*/
7707	bool const fPendingDbgXcpt = iemVmxVmentryIsPendingDebugXcpt(pVCpu, pszInstr);
7708	if (fPendingDbgXcpt)
7709	{
7710	uint32_t const uDbgXcptInfo = RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VECTOR, X86_XCPT_DB)
7711	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_TYPE, VMX_ENTRY_INT_INFO_TYPE_HW_XCPT)
7712	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VALID, 1);
7713	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uDbgXcptInfo, 0 /* uErrCode */, pVmcs->u32EntryInstrLen,
7714	0 /* GCPtrFaultAddress */);
7715	}
7716	}
7717
7718	NOREF(pszInstr);
7719	}
7720
7721
7722	/**
7723	* Initializes all read-only VMCS fields as part of VM-entry.
7724	*
7725	* @param pVCpu The cross context virtual CPU structure.
7726	*/
7727	static void iemVmxVmentryInitReadOnlyFields(PVMCPUCC pVCpu) RT_NOEXCEPT
7728	{
7729	/*
7730	* Any VMCS field which we do not establish on every VM-exit but may potentially
7731	* be used on the VM-exit path of a nested hypervisor -and- is not explicitly
7732	* specified to be undefined, needs to be initialized here.
7733	*
7734	* Thus, it is especially important to clear the Exit qualification field
7735	* since it must be zero for VM-exits where it is not used. Similarly, the
7736	* VM-exit interruption information field's valid bit needs to be cleared for
7737	* the same reasons.
7738	*/
7739	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7740	Assert(pVmcs);
7741
7742	/* 16-bit (none currently). */
7743	/* 32-bit. */
7744	pVmcs->u32RoVmInstrError = 0;
7745	pVmcs->u32RoExitReason = 0;
7746	pVmcs->u32RoExitIntInfo = 0;
7747	pVmcs->u32RoExitIntErrCode = 0;
7748	pVmcs->u32RoIdtVectoringInfo = 0;
7749	pVmcs->u32RoIdtVectoringErrCode = 0;
7750	pVmcs->u32RoExitInstrLen = 0;
7751	pVmcs->u32RoExitInstrInfo = 0;
7752
7753	/* 64-bit. */
7754	pVmcs->u64RoGuestPhysAddr.u = 0;
7755
7756	/* Natural-width. */
7757	pVmcs->u64RoExitQual.u = 0;
7758	pVmcs->u64RoIoRcx.u = 0;
7759	pVmcs->u64RoIoRsi.u = 0;
7760	pVmcs->u64RoIoRdi.u = 0;
7761	pVmcs->u64RoIoRip.u = 0;
7762	pVmcs->u64RoGuestLinearAddr.u = 0;
7763	}
7764
7765
7766	/**
7767	* VMLAUNCH/VMRESUME instruction execution worker.
7768	*
7769	* @returns Strict VBox status code.
7770	* @param pVCpu The cross context virtual CPU structure.
7771	* @param cbInstr The instruction length in bytes.
7772	* @param uInstrId The instruction identity (VMXINSTRID_VMLAUNCH or
7773	* VMXINSTRID_VMRESUME).
7774	*
7775	* @remarks Common VMX instruction checks are already expected to by the caller,
7776	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
7777	*/
7778	static VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId) RT_NOEXCEPT
7779	{
7780	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
7781	RT_NOREF3(pVCpu, cbInstr, uInstrId);
7782	return VINF_EM_RAW_EMULATE_INSTR;
7783	# else
7784	Assert( uInstrId == VMXINSTRID_VMLAUNCH
7785	\|\| uInstrId == VMXINSTRID_VMRESUME);
7786	const char * const pszInstr = uInstrId == VMXINSTRID_VMRESUME ? "vmresume" : "vmlaunch";
7787
7788	/* Nested-guest intercept. */
7789	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7790	return iemVmxVmexitInstr(pVCpu, uInstrId == VMXINSTRID_VMRESUME ? VMX_EXIT_VMRESUME : VMX_EXIT_VMLAUNCH, cbInstr);
7791
7792	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
7793
7794	/*
7795	* Basic VM-entry checks.
7796	* The order of the CPL, current and shadow VMCS and block-by-MovSS are important.
7797	* The checks following that do not have to follow a specific order.
7798	*
7799	* See Intel spec. 26.1 "Basic VM-entry Checks".
7800	*/
7801
7802	/* CPL. */
7803	if (IEM_GET_CPL(pVCpu) == 0)
7804	{ /* likely */ }
7805	else
7806	{
7807	Log(("%s: CPL %u -> #GP(0)\n", pszInstr, IEM_GET_CPL(pVCpu)));
7808	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_Cpl;
7809	return iemRaiseGeneralProtectionFault0(pVCpu);
7810	}
7811
7812	/* Current VMCS valid. */
7813	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
7814	{ /* likely */ }
7815	else
7816	{
7817	Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7818	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrInvalid;
7819	iemVmxVmFailInvalid(pVCpu);
7820	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7821	}
7822
7823	/* Current VMCS is not a shadow VMCS. */
7824	if (!pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32VmcsRevId.n.fIsShadowVmcs)
7825	{ /* likely */ }
7826	else
7827	{
7828	Log(("%s: VMCS pointer %#RGp is a shadow VMCS -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7829	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrShadowVmcs;
7830	iemVmxVmFailInvalid(pVCpu);
7831	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7832	}
7833
7834	/** @todo Distinguish block-by-MovSS from block-by-STI. Currently we
7835	* use block-by-STI here which is not quite correct. */
7836	if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx))
7837	{ /* likely */ }
7838	else
7839	{
7840	Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
7841	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_BlocKMovSS;
7842	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
7843	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7844	}
7845
7846	if (uInstrId == VMXINSTRID_VMLAUNCH)
7847	{
7848	/* VMLAUNCH with non-clear VMCS. */
7849	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR)
7850	{ /* likely */ }
7851	else
7852	{
7853	Log(("vmlaunch: VMLAUNCH with non-clear VMCS -> VMFail\n"));
7854	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsClear;
7855	iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
7856	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7857	}
7858	}
7859	else
7860	{
7861	/* VMRESUME with non-launched VMCS. */
7862	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_LAUNCHED)
7863	{ /* likely */ }
7864	else
7865	{
7866	Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
7867	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsLaunch;
7868	iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
7869	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7870	}
7871	}
7872
7873	/*
7874	* We are allowed to cache VMCS related data structures (such as I/O bitmaps, MSR bitmaps)
7875	* while entering VMX non-root mode. We do some of this while checking VM-execution
7876	* controls. The nested hypervisor should not make assumptions and cannot expect
7877	* predictable behavior if changes to these structures are made in guest memory while
7878	* executing in VMX non-root mode. As far as VirtualBox is concerned, the guest cannot
7879	* modify them anyway as we cache them in host memory.
7880	*
7881	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7882	*/
7883	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
7884
7885	int rc = iemVmxVmentryCheckCtls(pVCpu, pszInstr);
7886	if (RT_SUCCESS(rc))
7887	{
7888	rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
7889	if (RT_SUCCESS(rc))
7890	{
7891	/*
7892	* Initialize read-only VMCS fields before VM-entry since we don't update all of them
7893	* for every VM-exit. This needs to be done before invoking a VM-exit (even those
7894	* ones that may occur during VM-entry below).
7895	*/
7896	iemVmxVmentryInitReadOnlyFields(pVCpu);
7897
7898	/*
7899	* Blocking of NMIs need to be restored if VM-entry fails due to invalid-guest state.
7900	* So we save the VMCPU_FF_BLOCK_NMI force-flag here so we can restore it on
7901	* VM-exit when required.
7902	* See Intel spec. 26.7 "VM-entry Failures During or After Loading Guest State"
7903	*/
7904	iemVmxVmentrySaveNmiBlockingFF(pVCpu);
7905
7906	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7907	Assert(pVmcs);
7908
7909	rc = iemVmxVmentryCheckGuestState(pVCpu, pszInstr);
7910	if (RT_SUCCESS(rc))
7911	{
7912	/*
7913	* We've now entered nested-guest execution.
7914	*
7915	* It is important do this prior to loading the guest state because
7916	* as part of loading the guest state, PGM (and perhaps other components
7917	* in the future) relies on detecting whether VMX non-root mode has been
7918	* entered.
7919	*/
7920	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = true;
7921
7922	rc = iemVmxVmentryLoadGuestState(pVCpu, pszInstr);
7923	if (RT_SUCCESS(rc))
7924	{
7925	rc = iemVmxVmentryLoadGuestAutoMsrs(pVCpu, pszInstr);
7926	if (RT_SUCCESS(rc))
7927	{
7928	Assert(rc != VINF_CPUM_R3_MSR_WRITE);
7929
7930	/* VMLAUNCH instruction must update the VMCS launch state. */
7931	if (uInstrId == VMXINSTRID_VMLAUNCH)
7932	pVmcs->fVmcsState = VMX_V_VMCS_LAUNCH_STATE_LAUNCHED;
7933
7934	/* Perform the VMX transition (PGM updates). */
7935	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu, cbInstr);
7936	if (rcStrict == VINF_SUCCESS)
7937	{ /* likely */ }
7938	else if (RT_SUCCESS(rcStrict))
7939	{
7940	Log3(("%s: iemVmxTransition returns %Rrc -> Setting passup status\n", pszInstr,
7941	VBOXSTRICTRC_VAL(rcStrict)));
7942	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7943	}
7944	else
7945	{
7946	Log3(("%s: iemVmxTransition failed! rc=%Rrc\n", pszInstr, VBOXSTRICTRC_VAL(rcStrict)));
7947	return rcStrict;
7948	}
7949
7950	/* Paranoia. */
7951	Assert(rcStrict == VINF_SUCCESS);
7952
7953	/*
7954	* The priority of potential VM-exits during VM-entry is important.
7955	* The priorities of VM-exits and events are listed from highest
7956	* to lowest as follows:
7957	*
7958	* 1. Event injection.
7959	* 2. Trap on task-switch (T flag set in TSS).
7960	* 3. TPR below threshold / APIC-write.
7961	* 4. SMI, INIT.
7962	* 5. MTF exit.
7963	* 6. Debug-trap exceptions (EFLAGS.TF), pending debug exceptions.
7964	* 7. VMX-preemption timer.
7965	* 9. NMI-window exit.
7966	* 10. NMI injection.
7967	* 11. Interrupt-window exit.
7968	* 12. Virtual-interrupt injection.
7969	* 13. Interrupt injection.
7970	* 14. Process next instruction (fetch, decode, execute).
7971	*/
7972
7973	/* Setup VMX-preemption timer. */
7974	iemVmxVmentrySetupPreemptTimer(pVCpu, pszInstr);
7975
7976	/* Setup monitor-trap flag. */
7977	iemVmxVmentrySetupMtf(pVCpu, pszInstr);
7978
7979	/* Setup NMI-window exiting. */
7980	iemVmxVmentrySetupNmiWindow(pVCpu, pszInstr);
7981
7982	/* Setup interrupt-window exiting. */
7983	iemVmxVmentrySetupIntWindow(pVCpu, pszInstr);
7984
7985	/*
7986	* Inject any event that the nested hypervisor wants to inject.
7987	* Note! We cannot immediately perform the event injection here as we may have
7988	* pending PGM operations to perform due to switching page tables and/or
7989	* mode.
7990	*/
7991	iemVmxVmentryInjectEvent(pVCpu, pszInstr);
7992
7993	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
7994	/* Reschedule to IEM-only execution of the nested-guest. */
7995	LogFlow(("%s: Enabling IEM-only EM execution policy!\n", pszInstr));
7996	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
7997	if (rcSched != VINF_SUCCESS)
7998	iemSetPassUpStatus(pVCpu, rcSched);
7999	# endif
8000
8001	/* Finally, done. */
8002	Log2(("vmentry: %s: cs:rip=%04x:%08RX64 cr0=%#RX64 (%#RX64) cr4=%#RX64 (%#RX64) efer=%#RX64 (%#RX64)\n",
8003	pszInstr, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
8004	pVmcs->u64Cr0ReadShadow.u, pVCpu->cpum.GstCtx.cr4, pVmcs->u64Cr4ReadShadow.u,
8005	pVCpu->cpum.GstCtx.msrEFER, pVmcs->u64GuestEferMsr.u));
8006	return VINF_SUCCESS;
8007	}
8008	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_MSR_LOAD \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
8009	}
8010	}
8011	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_INVALID_GUEST_STATE \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
8012	}
8013
8014	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
8015	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8016	}
8017
8018	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
8019	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8020	# endif
8021	}
8022
8023
8024	/**
8025	* Interface for HM and EM to emulate the VMLAUNCH/VMRESUME instruction.
8026	*
8027	* @returns Strict VBox status code.
8028	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8029	* @param cbInstr The instruction length in bytes.
8030	* @param uInstrId The instruction ID (VMXINSTRID_VMLAUNCH or
8031	* VMXINSTRID_VMRESUME).
8032	* @thread EMT(pVCpu)
8033	*/
8034	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId)
8035	{
8036	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
8037	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_VMX_VMENTRY_MASK);
8038
8039	iemInitExec(pVCpu, 0 /fExecOpts/);
8040	VBOXSTRICTRC rcStrict = iemVmxVmlaunchVmresume(pVCpu, cbInstr, uInstrId);
8041	Assert(!pVCpu->iem.s.cActiveMappings);
8042	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8043	}
8044
8045
8046	/**
8047	* Checks whether an RDMSR or WRMSR instruction for the given MSR is intercepted
8048	* (causes a VM-exit) or not.
8049	*
8050	* @returns @c true if the instruction is intercepted, @c false otherwise.
8051	* @param pVCpu The cross context virtual CPU structure.
8052	* @param uExitReason The VM-exit reason (VMX_EXIT_RDMSR or
8053	* VMX_EXIT_WRMSR).
8054	* @param idMsr The MSR.
8055	*/
8056	bool iemVmxIsRdmsrWrmsrInterceptSet(PCVMCPU pVCpu, uint32_t uExitReason, uint32_t idMsr) RT_NOEXCEPT
8057	{
8058	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
8059	Assert( uExitReason == VMX_EXIT_RDMSR
8060	\|\| uExitReason == VMX_EXIT_WRMSR);
8061
8062	/* Consult the MSR bitmap if the feature is supported. */
8063	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
8064	Assert(pVmcs);
8065	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
8066	{
8067	uint32_t const fMsrpm = CPUMGetVmxMsrPermission(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap, idMsr);
8068	if (uExitReason == VMX_EXIT_RDMSR)
8069	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_RD);
8070	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_WR);
8071	}
8072
8073	/* Without MSR bitmaps, all MSR accesses are intercepted. */
8074	return true;
8075	}
8076
8077
8078	/**
8079	* VMREAD instruction execution worker that does not perform any validation checks.
8080	*
8081	* Callers are expected to have performed the necessary checks and to ensure the
8082	* VMREAD will succeed.
8083	*
8084	* @param pVmcs Pointer to the virtual VMCS.
8085	* @param pu64Dst Where to write the VMCS value.
8086	* @param u64VmcsField The VMCS field.
8087	*
8088	* @remarks May be called with interrupts disabled.
8089	*/
8090	static void iemVmxVmreadNoCheck(PCVMXVVMCS pVmcs, uint64_t *pu64Dst, uint64_t u64VmcsField) RT_NOEXCEPT
8091	{
8092	VMXVMCSFIELD VmcsField;
8093	VmcsField.u = u64VmcsField;
8094	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8095	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8096	uint8_t const uWidthType = (uWidth << 2) \| uType;
8097	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8098	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8099	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8100	AssertMsg(offField < VMX_V_VMCS_SIZE, ("off=%u field=%#RX64 width=%#x type=%#x index=%#x (%u)\n", offField, u64VmcsField,
8101	uWidth, uType, uIndex, uIndex));
8102	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8103
8104	/*
8105	* Read the VMCS component based on the field's effective width.
8106	*
8107	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8108	* indicates high bits (little endian).
8109	*
8110	* Note! The caller is responsible to trim the result and update registers
8111	* or memory locations are required. Here we just zero-extend to the largest
8112	* type (i.e. 64-bits).
8113	*/
8114	uint8_t const pbVmcs = (uint8_t const )pVmcs;
8115	uint8_t const *pbField = pbVmcs + offField;
8116	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8117	switch (uEffWidth)
8118	{
8119	case VMX_VMCSFIELD_WIDTH_64BIT:
8120	case VMX_VMCSFIELD_WIDTH_NATURAL: pu64Dst = (uint64_t const *)pbField; break;
8121	case VMX_VMCSFIELD_WIDTH_32BIT: pu64Dst = (uint32_t const *)pbField; break;
8122	case VMX_VMCSFIELD_WIDTH_16BIT: pu64Dst = (uint16_t const *)pbField; break;
8123	}
8124	}
8125
8126
8127	/**
8128	* Interface for HM and EM to read a VMCS field from the nested-guest VMCS.
8129	*
8130	* It is ASSUMED the caller knows what they're doing. No VMREAD instruction checks
8131	* are performed. Bounds checks are strict builds only.
8132	*
8133	* @param pVmcs Pointer to the virtual VMCS.
8134	* @param u64VmcsField The VMCS field.
8135	* @param pu64Dst Where to store the VMCS value.
8136	*
8137	* @remarks May be called with interrupts disabled.
8138	* @todo This should probably be moved to CPUM someday.
8139	*/
8140	VMM_INT_DECL(void) IEMReadVmxVmcsField(PCVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t *pu64Dst)
8141	{
8142	AssertPtr(pVmcs);
8143	AssertPtr(pu64Dst);
8144	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8145	}
8146
8147
8148	/**
8149	* VMREAD common (memory/register) instruction execution worker.
8150	*
8151	* @returns Strict VBox status code.
8152	* @param pVCpu The cross context virtual CPU structure.
8153	* @param cbInstr The instruction length in bytes.
8154	* @param pu64Dst Where to write the VMCS value (only updated when
8155	* VINF_SUCCESS is returned).
8156	* @param u64VmcsField The VMCS field.
8157	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8158	* NULL.
8159	*/
8160	static VBOXSTRICTRC iemVmxVmreadCommon(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8161	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8162	{
8163	/* Nested-guest intercept. */
8164	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8165	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMREAD, u64VmcsField))
8166	{
8167	if (pExitInfo)
8168	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8169	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMREAD, VMXINSTRID_VMREAD, cbInstr);
8170	}
8171
8172	/* CPL. */
8173	if (IEM_GET_CPL(pVCpu) == 0)
8174	{ /* likely */ }
8175	else
8176	{
8177	Log(("vmread: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8178	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_Cpl;
8179	return iemRaiseGeneralProtectionFault0(pVCpu);
8180	}
8181
8182	pVCpu->iem.s.cPotentialExits++;
8183
8184	/* VMCS pointer in root mode. */
8185	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8186	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8187	{ /* likely */ }
8188	else
8189	{
8190	Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8191	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrInvalid;
8192	iemVmxVmFailInvalid(pVCpu);
8193	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8194	}
8195
8196	/* VMCS-link pointer in non-root mode. */
8197	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8198	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8199	{ /* likely */ }
8200	else
8201	{
8202	Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8203	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_LinkPtrInvalid;
8204	iemVmxVmFailInvalid(pVCpu);
8205	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8206	}
8207
8208	/* Supported VMCS field. */
8209	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8210	{ /* likely */ }
8211	else
8212	{
8213	Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8214	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_FieldInvalid;
8215	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8216	iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
8217	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8218	}
8219
8220	/*
8221	* Reading from the current or shadow VMCS.
8222	*/
8223	PCVMXVVMCS pVmcs = !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8224	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8225	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8226	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8227	Log4(("vmread %#RX64 => %#RX64\n", u64VmcsField, *pu64Dst));
8228	return VINF_SUCCESS;
8229	}
8230
8231
8232	/**
8233	* VMREAD (64-bit register) instruction execution worker.
8234	*
8235	* @returns Strict VBox status code.
8236	* @param pVCpu The cross context virtual CPU structure.
8237	* @param cbInstr The instruction length in bytes.
8238	* @param pu64Dst Where to store the VMCS field's value.
8239	* @param u64VmcsField The VMCS field.
8240	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8241	* NULL.
8242	*/
8243	static VBOXSTRICTRC iemVmxVmreadReg64(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8244	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8245	{
8246	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64VmcsField, pExitInfo);
8247	if (rcStrict == VINF_SUCCESS)
8248	{
8249	iemVmxVmSucceed(pVCpu);
8250	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8251	}
8252
8253	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8254	return rcStrict;
8255	}
8256
8257
8258	/**
8259	* VMREAD (32-bit register) instruction execution worker.
8260	*
8261	* @returns Strict VBox status code.
8262	* @param pVCpu The cross context virtual CPU structure.
8263	* @param cbInstr The instruction length in bytes.
8264	* @param pu32Dst Where to store the VMCS field's value.
8265	* @param u32VmcsField The VMCS field.
8266	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8267	* NULL.
8268	*/
8269	static VBOXSTRICTRC iemVmxVmreadReg32(PVMCPUCC pVCpu, uint8_t cbInstr, uint32_t *pu32Dst,
8270	uint64_t u32VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8271	{
8272	uint64_t u64Dst;
8273	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32VmcsField, pExitInfo);
8274	if (rcStrict == VINF_SUCCESS)
8275	{
8276	*pu32Dst = u64Dst;
8277	iemVmxVmSucceed(pVCpu);
8278	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8279	}
8280
8281	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8282	return rcStrict;
8283	}
8284
8285
8286	/**
8287	* VMREAD (memory) instruction execution worker.
8288	*
8289	* @returns Strict VBox status code.
8290	* @param pVCpu The cross context virtual CPU structure.
8291	* @param cbInstr The instruction length in bytes.
8292	* @param iEffSeg The effective segment register to use with @a u64Val.
8293	* Pass UINT8_MAX if it is a register access.
8294	* @param GCPtrDst The guest linear address to store the VMCS field's
8295	* value.
8296	* @param u64VmcsField The VMCS field.
8297	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8298	* NULL.
8299	*/
8300	static VBOXSTRICTRC iemVmxVmreadMem(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrDst,
8301	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8302	{
8303	uint64_t u64Dst;
8304	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64VmcsField, pExitInfo);
8305	if (rcStrict == VINF_SUCCESS)
8306	{
8307	/*
8308	* Write the VMCS field's value to the location specified in guest-memory.
8309	*/
8310	if (IEM_IS_64BIT_CODE(pVCpu))
8311	rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8312	else
8313	rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8314	if (rcStrict == VINF_SUCCESS)
8315	{
8316	iemVmxVmSucceed(pVCpu);
8317	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8318	}
8319
8320	Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
8321	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrMap;
8322	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrDst;
8323	return rcStrict;
8324	}
8325
8326	Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8327	return rcStrict;
8328	}
8329
8330
8331	/**
8332	* Interface for HM and EM to emulate the VMREAD instruction.
8333	*
8334	* @returns Strict VBox status code.
8335	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8336	* @param pExitInfo Pointer to the VM-exit information.
8337	* @thread EMT(pVCpu)
8338	*/
8339	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmread(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8340	{
8341	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8342	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8343	Assert(pExitInfo);
8344
8345	iemInitExec(pVCpu, 0 /fExecOpts/);
8346
8347	VBOXSTRICTRC rcStrict;
8348	uint8_t const cbInstr = pExitInfo->cbInstr;
8349	bool const fIs64BitMode = RT_BOOL(IEM_IS_64BIT_CODE(pVCpu));
8350	uint64_t const u64FieldEnc = fIs64BitMode
8351	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8352	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8353	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8354	{
8355	if (fIs64BitMode)
8356	{
8357	uint64_t *pu64Dst = iemGRegRefU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8358	rcStrict = iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
8359	}
8360	else
8361	{
8362	uint32_t *pu32Dst = iemGRegRefU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8363	rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u64FieldEnc, pExitInfo);
8364	}
8365	}
8366	else
8367	{
8368	RTGCPTR const GCPtrDst = pExitInfo->GCPtrEffAddr;
8369	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8370	rcStrict = iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64FieldEnc, pExitInfo);
8371	}
8372	Assert(!pVCpu->iem.s.cActiveMappings);
8373	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8374	}
8375
8376
8377	/**
8378	* VMWRITE instruction execution worker that does not perform any validation
8379	* checks.
8380	*
8381	* Callers are expected to have performed the necessary checks and to ensure the
8382	* VMWRITE will succeed.
8383	*
8384	* @param pVmcs Pointer to the virtual VMCS.
8385	* @param u64Val The value to write.
8386	* @param u64VmcsField The VMCS field.
8387	*
8388	* @remarks May be called with interrupts disabled.
8389	*/
8390	static void iemVmxVmwriteNoCheck(PVMXVVMCS pVmcs, uint64_t u64Val, uint64_t u64VmcsField) RT_NOEXCEPT
8391	{
8392	VMXVMCSFIELD VmcsField;
8393	VmcsField.u = u64VmcsField;
8394	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8395	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8396	uint8_t const uWidthType = (uWidth << 2) \| uType;
8397	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8398	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8399	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8400	Assert(offField < VMX_V_VMCS_SIZE);
8401	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8402
8403	/*
8404	* Write the VMCS component based on the field's effective width.
8405	*
8406	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8407	* indicates high bits (little endian).
8408	*/
8409	uint8_t pbVmcs = (uint8_t )pVmcs;
8410	uint8_t *pbField = pbVmcs + offField;
8411	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8412	switch (uEffWidth)
8413	{
8414	case VMX_VMCSFIELD_WIDTH_64BIT:
8415	case VMX_VMCSFIELD_WIDTH_NATURAL: (uint64_t )pbField = u64Val; break;
8416	case VMX_VMCSFIELD_WIDTH_32BIT: (uint32_t )pbField = u64Val; break;
8417	case VMX_VMCSFIELD_WIDTH_16BIT: (uint16_t )pbField = u64Val; break;
8418	}
8419	}
8420
8421
8422	/**
8423	* Interface for HM and EM to write a VMCS field in the nested-guest VMCS.
8424	*
8425	* It is ASSUMED the caller knows what they're doing. No VMWRITE instruction checks
8426	* are performed. Bounds checks are strict builds only.
8427	*
8428	* @param pVmcs Pointer to the virtual VMCS.
8429	* @param u64VmcsField The VMCS field.
8430	* @param u64Val The value to write.
8431	*
8432	* @remarks May be called with interrupts disabled.
8433	* @todo This should probably be moved to CPUM someday.
8434	*/
8435	VMM_INT_DECL(void) IEMWriteVmxVmcsField(PVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t u64Val)
8436	{
8437	AssertPtr(pVmcs);
8438	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8439	}
8440
8441
8442	/**
8443	* VMWRITE instruction execution worker.
8444	*
8445	* @returns Strict VBox status code.
8446	* @param pVCpu The cross context virtual CPU structure.
8447	* @param cbInstr The instruction length in bytes.
8448	* @param iEffSeg The effective segment register to use with @a u64Val.
8449	* Pass UINT8_MAX if it is a register access.
8450	* @param u64Val The value to write (or guest linear address to the
8451	* value), @a iEffSeg will indicate if it's a memory
8452	* operand.
8453	* @param u64VmcsField The VMCS field.
8454	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8455	* NULL.
8456	*/
8457	static VBOXSTRICTRC iemVmxVmwrite(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, uint64_t u64Val,
8458	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8459	{
8460	/* Nested-guest intercept. */
8461	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8462	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMWRITE, u64VmcsField))
8463	{
8464	if (pExitInfo)
8465	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8466	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMWRITE, VMXINSTRID_VMWRITE, cbInstr);
8467	}
8468
8469	/* CPL. */
8470	if (IEM_GET_CPL(pVCpu) == 0)
8471	{ /* likely */ }
8472	else
8473	{
8474	Log(("vmwrite: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8475	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_Cpl;
8476	return iemRaiseGeneralProtectionFault0(pVCpu);
8477	}
8478
8479	pVCpu->iem.s.cPotentialExits++;
8480
8481	/* VMCS pointer in root mode. */
8482	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8483	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8484	{ /* likely */ }
8485	else
8486	{
8487	Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8488	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrInvalid;
8489	iemVmxVmFailInvalid(pVCpu);
8490	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8491	}
8492
8493	/* VMCS-link pointer in non-root mode. */
8494	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8495	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8496	{ /* likely */ }
8497	else
8498	{
8499	Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8500	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_LinkPtrInvalid;
8501	iemVmxVmFailInvalid(pVCpu);
8502	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8503	}
8504
8505	/* If the VMWRITE instruction references memory, access the specified memory operand. */
8506	bool const fIsRegOperand = iEffSeg == UINT8_MAX;
8507	if (!fIsRegOperand)
8508	{
8509	/* Read the value from the specified guest memory location. */
8510	VBOXSTRICTRC rcStrict;
8511	RTGCPTR const GCPtrVal = u64Val;
8512	if (IEM_IS_64BIT_CODE(pVCpu))
8513	rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8514	else
8515	rcStrict = iemMemFetchDataU32_ZX_U64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8516	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
8517	{
8518	Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
8519	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrMap;
8520	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVal;
8521	return rcStrict;
8522	}
8523	}
8524	else
8525	Assert(!pExitInfo \|\| pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
8526
8527	/* Supported VMCS field. */
8528	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8529	{ /* likely */ }
8530	else
8531	{
8532	Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8533	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldInvalid;
8534	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8535	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
8536	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8537	}
8538
8539	/* Read-only VMCS field. */
8540	bool const fIsFieldReadOnly = VMXIsVmcsFieldReadOnly(u64VmcsField);
8541	if ( !fIsFieldReadOnly
8542	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
8543	{ /* likely */ }
8544	else
8545	{
8546	Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64VmcsField));
8547	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldRo;
8548	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8549	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
8550	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8551	}
8552
8553	/*
8554	* Write to the current or shadow VMCS.
8555	*/
8556	bool const fInVmxNonRootMode = IEM_VMX_IS_NON_ROOT_MODE(pVCpu);
8557	PVMXVVMCS pVmcs = !fInVmxNonRootMode
8558	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8559	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8560	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8561	Log4(("vmwrite %#RX64 <= %#RX64\n", u64VmcsField, u64Val));
8562
8563	if ( !fInVmxNonRootMode
8564	&& VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
8565	{
8566	/* Notify HM that the VMCS content might have changed. */
8567	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
8568	}
8569
8570	iemVmxVmSucceed(pVCpu);
8571	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8572	}
8573
8574
8575	/**
8576	* Interface for HM and EM to emulate the VMWRITE instruction.
8577	*
8578	* @returns Strict VBox status code.
8579	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8580	* @param pExitInfo Pointer to the VM-exit information.
8581	* @thread EMT(pVCpu)
8582	*/
8583	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmwrite(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8584	{
8585	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8586	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8587	Assert(pExitInfo);
8588
8589	iemInitExec(pVCpu, 0 /fExecOpts/);
8590
8591	uint64_t u64Val;
8592	uint8_t iEffSeg;
8593	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8594	{
8595	u64Val = iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8596	iEffSeg = UINT8_MAX;
8597	}
8598	else
8599	{
8600	u64Val = pExitInfo->GCPtrEffAddr;
8601	iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8602	}
8603	uint8_t const cbInstr = pExitInfo->cbInstr;
8604	uint64_t const u64FieldEnc = IEM_IS_64BIT_CODE(pVCpu)
8605	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8606	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8607	VBOXSTRICTRC rcStrict = iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, u64Val, u64FieldEnc, pExitInfo);
8608	Assert(!pVCpu->iem.s.cActiveMappings);
8609	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8610	}
8611
8612
8613	/**
8614	* VMCLEAR instruction execution worker.
8615	*
8616	* @returns Strict VBox status code.
8617	* @param pVCpu The cross context virtual CPU structure.
8618	* @param cbInstr The instruction length in bytes.
8619	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8620	* @param GCPtrVmcs The linear address of the VMCS pointer.
8621	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8622	*
8623	* @remarks Common VMX instruction checks are already expected to by the caller,
8624	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8625	*/
8626	static VBOXSTRICTRC iemVmxVmclear(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8627	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8628	{
8629	/* Nested-guest intercept. */
8630	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8631	{
8632	if (pExitInfo)
8633	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8634	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMCLEAR, VMXINSTRID_NONE, cbInstr);
8635	}
8636
8637	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8638
8639	/* CPL. */
8640	if (IEM_GET_CPL(pVCpu) == 0)
8641	{ /* likely */ }
8642	else
8643	{
8644	Log(("vmclear: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8645	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_Cpl;
8646	return iemRaiseGeneralProtectionFault0(pVCpu);
8647	}
8648
8649	/* Get the VMCS pointer from the location specified by the source memory operand. */
8650	RTGCPHYS GCPhysVmcs;
8651	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8652	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8653	{ /* likely */ }
8654	else
8655	{
8656	Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8657	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrMap;
8658	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8659	return rcStrict;
8660	}
8661
8662	/* VMCS pointer alignment. */
8663	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8664	{ /* likely */ }
8665	else
8666	{
8667	Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
8668	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAlign;
8669	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8670	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8671	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8672	}
8673
8674	/* VMCS physical-address width limits. */
8675	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8676	{ /* likely */ }
8677	else
8678	{
8679	Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8680	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrWidth;
8681	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8682	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8683	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8684	}
8685
8686	/* VMCS is not the VMXON region. */
8687	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8688	{ /* likely */ }
8689	else
8690	{
8691	Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8692	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrVmxon;
8693	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8694	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
8695	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8696	}
8697
8698	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8699	restriction imposed by our implementation. */
8700	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8701	{ /* likely */ }
8702	else
8703	{
8704	Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
8705	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAbnormal;
8706	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8707	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8708	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8709	}
8710
8711	/*
8712	* VMCLEAR allows committing and clearing any valid VMCS pointer.
8713	*
8714	* If the current VMCS is the one being cleared, set its state to 'clear' and commit
8715	* to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
8716	* to 'clear'.
8717	*/
8718	uint8_t const fVmcsLaunchStateClear = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
8719	if ( IEM_VMX_HAS_CURRENT_VMCS(pVCpu)
8720	&& IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
8721	{
8722	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState = fVmcsLaunchStateClear;
8723	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
8724	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8725	}
8726	else
8727	{
8728	AssertCompileMemberSize(VMXVVMCS, fVmcsState, sizeof(fVmcsLaunchStateClear));
8729	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + RT_UOFFSETOF(VMXVVMCS, fVmcsState),
8730	(const void *)&fVmcsLaunchStateClear, sizeof(fVmcsLaunchStateClear));
8731	if (RT_FAILURE(rcStrict))
8732	return rcStrict;
8733	}
8734
8735	iemVmxVmSucceed(pVCpu);
8736	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8737	}
8738
8739
8740	/**
8741	* Interface for HM and EM to emulate the VMCLEAR instruction.
8742	*
8743	* @returns Strict VBox status code.
8744	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8745	* @param pExitInfo Pointer to the VM-exit information.
8746	* @thread EMT(pVCpu)
8747	*/
8748	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmclear(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8749	{
8750	Assert(pExitInfo);
8751	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8752	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8753
8754	iemInitExec(pVCpu, 0 /fExecOpts/);
8755
8756	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8757	uint8_t const cbInstr = pExitInfo->cbInstr;
8758	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8759	VBOXSTRICTRC rcStrict = iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8760	Assert(!pVCpu->iem.s.cActiveMappings);
8761	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8762	}
8763
8764
8765	/**
8766	* VMPTRST instruction execution worker.
8767	*
8768	* @returns Strict VBox status code.
8769	* @param pVCpu The cross context virtual CPU structure.
8770	* @param cbInstr The instruction length in bytes.
8771	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8772	* @param GCPtrVmcs The linear address of where to store the current VMCS
8773	* pointer.
8774	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8775	*
8776	* @remarks Common VMX instruction checks are already expected to by the caller,
8777	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8778	*/
8779	static VBOXSTRICTRC iemVmxVmptrst(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8780	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8781	{
8782	/* Nested-guest intercept. */
8783	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8784	{
8785	if (pExitInfo)
8786	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8787	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRST, VMXINSTRID_NONE, cbInstr);
8788	}
8789
8790	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8791
8792	/* CPL. */
8793	if (IEM_GET_CPL(pVCpu) == 0)
8794	{ /* likely */ }
8795	else
8796	{
8797	Log(("vmptrst: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8798	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_Cpl;
8799	return iemRaiseGeneralProtectionFault0(pVCpu);
8800	}
8801
8802	/* Set the VMCS pointer to the location specified by the destination memory operand. */
8803	AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
8804	VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
8805	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8806	{
8807	iemVmxVmSucceed(pVCpu);
8808	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8809	}
8810
8811	Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8812	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_PtrMap;
8813	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8814	return rcStrict;
8815	}
8816
8817
8818	/**
8819	* Interface for HM and EM to emulate the VMPTRST instruction.
8820	*
8821	* @returns Strict VBox status code.
8822	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8823	* @param pExitInfo Pointer to the VM-exit information.
8824	* @thread EMT(pVCpu)
8825	*/
8826	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrst(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8827	{
8828	Assert(pExitInfo);
8829	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8830	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8831
8832	iemInitExec(pVCpu, 0 /fExecOpts/);
8833
8834	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8835	uint8_t const cbInstr = pExitInfo->cbInstr;
8836	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8837	VBOXSTRICTRC rcStrict = iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8838	Assert(!pVCpu->iem.s.cActiveMappings);
8839	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8840	}
8841
8842
8843	/**
8844	* VMPTRLD instruction execution worker.
8845	*
8846	* @returns Strict VBox status code.
8847	* @param pVCpu The cross context virtual CPU structure.
8848	* @param cbInstr The instruction length in bytes.
8849	* @param GCPtrVmcs The linear address of the current VMCS pointer.
8850	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8851	*
8852	* @remarks Common VMX instruction checks are already expected to by the caller,
8853	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8854	*/
8855	static VBOXSTRICTRC iemVmxVmptrld(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8856	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8857	{
8858	/* Nested-guest intercept. */
8859	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8860	{
8861	if (pExitInfo)
8862	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8863	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRLD, VMXINSTRID_NONE, cbInstr);
8864	}
8865
8866	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8867
8868	/* CPL. */
8869	if (IEM_GET_CPL(pVCpu) == 0)
8870	{ /* likely */ }
8871	else
8872	{
8873	Log(("vmptrld: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8874	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_Cpl;
8875	return iemRaiseGeneralProtectionFault0(pVCpu);
8876	}
8877
8878	/* Get the VMCS pointer from the location specified by the source memory operand. */
8879	RTGCPHYS GCPhysVmcs;
8880	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8881	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8882	{ /* likely */ }
8883	else
8884	{
8885	Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8886	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrMap;
8887	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8888	return rcStrict;
8889	}
8890
8891	/* VMCS pointer alignment. */
8892	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8893	{ /* likely */ }
8894	else
8895	{
8896	Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
8897	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAlign;
8898	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8899	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8900	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8901	}
8902
8903	/* VMCS physical-address width limits. */
8904	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8905	{ /* likely */ }
8906	else
8907	{
8908	Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8909	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrWidth;
8910	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8911	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8912	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8913	}
8914
8915	/* VMCS is not the VMXON region. */
8916	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8917	{ /* likely */ }
8918	else
8919	{
8920	Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8921	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrVmxon;
8922	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8923	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
8924	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8925	}
8926
8927	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8928	restriction imposed by our implementation. */
8929	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8930	{ /* likely */ }
8931	else
8932	{
8933	Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
8934	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAbnormal;
8935	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8936	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8937	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8938	}
8939
8940	/* Read just the VMCS revision from the VMCS. */
8941	VMXVMCSREVID VmcsRevId;
8942	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
8943	if (RT_SUCCESS(rc))
8944	{ /* likely */ }
8945	else
8946	{
8947	Log(("vmptrld: Failed to read revision identifier from VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8948	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_RevPtrReadPhys;
8949	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8950	return rc;
8951	}
8952
8953	/*
8954	* Verify the VMCS revision specified by the guest matches what we reported to the guest.
8955	* Verify the VMCS is not a shadow VMCS, if the VMCS shadowing feature is supported.
8956	*/
8957	if ( VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID
8958	&& ( !VmcsRevId.n.fIsShadowVmcs
8959	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
8960	{ /* likely */ }
8961	else
8962	{
8963	if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
8964	{
8965	Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32, GCPtrVmcs=%#RGv GCPhysVmcs=%#RGp -> VMFail()\n",
8966	VMX_V_VMCS_REVISION_ID, VmcsRevId.n.u31RevisionId, GCPtrVmcs, GCPhysVmcs));
8967	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_VmcsRevId;
8968	}
8969	else
8970	{
8971	Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
8972	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_ShadowVmcs;
8973	}
8974	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
8975	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8976	}
8977
8978	/*
8979	* We cache only the current VMCS in CPUMCTX. Therefore, VMPTRLD should always flush
8980	* the cache of an existing, current VMCS back to guest memory before loading a new,
8981	* different current VMCS.
8982	*/
8983	if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
8984	{
8985	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8986	{
8987	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
8988	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8989	}
8990
8991	/* Set the new VMCS as the current VMCS and read it from guest memory. */
8992	IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
8993	rc = iemVmxReadCurrentVmcsFromGstMem(pVCpu);
8994	if (RT_SUCCESS(rc))
8995	{
8996	/* Notify HM that a new, current VMCS is loaded. */
8997	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
8998	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
8999	}
9000	else
9001	{
9002	Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
9003	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrReadPhys;
9004	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
9005	return rc;
9006	}
9007	}
9008
9009	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
9010	iemVmxVmSucceed(pVCpu);
9011	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9012	}
9013
9014
9015	/**
9016	* Interface for HM and EM to emulate the VMPTRLD instruction.
9017	*
9018	* @returns Strict VBox status code.
9019	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9020	* @param pExitInfo Pointer to the VM-exit information.
9021	* @thread EMT(pVCpu)
9022	*/
9023	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrld(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9024	{
9025	Assert(pExitInfo);
9026	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9027	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9028
9029	iemInitExec(pVCpu, 0 /fExecOpts/);
9030
9031	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9032	uint8_t const cbInstr = pExitInfo->cbInstr;
9033	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
9034	VBOXSTRICTRC rcStrict = iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
9035	Assert(!pVCpu->iem.s.cActiveMappings);
9036	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9037	}
9038
9039
9040	/**
9041	* INVVPID instruction execution worker.
9042	*
9043	* @returns Strict VBox status code.
9044	* @param pVCpu The cross context virtual CPU structure.
9045	* @param cbInstr The instruction length in bytes.
9046	* @param iEffSeg The segment of the invvpid descriptor.
9047	* @param GCPtrInvvpidDesc The address of invvpid descriptor.
9048	* @param u64InvvpidType The invalidation type.
9049	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9050	* NULL.
9051	*
9052	* @remarks Common VMX instruction checks are already expected to by the caller,
9053	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9054	*/
9055	VBOXSTRICTRC iemVmxInvvpid(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInvvpidDesc,
9056	uint64_t u64InvvpidType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9057	{
9058	/* Check if INVVPID instruction is supported, otherwise raise #UD. */
9059	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVpid)
9060	return iemRaiseUndefinedOpcode(pVCpu);
9061
9062	/* Nested-guest intercept. */
9063	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9064	{
9065	if (pExitInfo)
9066	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9067	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVVPID, VMXINSTRID_NONE, cbInstr);
9068	}
9069
9070	/* CPL. */
9071	if (IEM_GET_CPL(pVCpu) != 0)
9072	{
9073	Log(("invvpid: CPL != 0 -> #GP(0)\n"));
9074	return iemRaiseGeneralProtectionFault0(pVCpu);
9075	}
9076
9077	/*
9078	* Validate INVVPID invalidation type.
9079	*
9080	* The instruction specifies exactly ONE of the supported invalidation types.
9081	*
9082	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9083	* supported. In theory, it's possible for a CPU to not support flushing individual
9084	* addresses but all the other types or any other combination. We do not take any
9085	* shortcuts here by assuming the types we currently expose to the guest.
9086	*/
9087	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9088	bool const fInvvpidSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID);
9089	bool const fTypeIndivAddr = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_INDIV_ADDR);
9090	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX);
9091	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_ALL_CTX);
9092	bool const fTypeSingleCtxRetainGlobals = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX_RETAIN_GLOBALS);
9093
9094	bool afSupportedTypes[4];
9095	afSupportedTypes[0] = fTypeIndivAddr;
9096	afSupportedTypes[1] = fTypeSingleCtx;
9097	afSupportedTypes[2] = fTypeAllCtx;
9098	afSupportedTypes[3] = fTypeSingleCtxRetainGlobals;
9099
9100	if ( fInvvpidSupported
9101	&& !(u64InvvpidType & ~(uint64_t)VMX_INVVPID_VALID_MASK)
9102	&& afSupportedTypes[u64InvvpidType & 3])
9103	{ /* likely */ }
9104	else
9105	{
9106	Log(("invvpid: invalid/unsupported invvpid type %#x -> VMFail\n", u64InvvpidType));
9107	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_TypeInvalid;
9108	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9109	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9110	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9111	}
9112
9113	/*
9114	* Fetch the invvpid descriptor from guest memory.
9115	*/
9116	RTUINT128U uDesc;
9117	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvvpidDesc);
9118	if (rcStrict == VINF_SUCCESS)
9119	{
9120	/*
9121	* Validate the descriptor.
9122	*/
9123	if (uDesc.s.Lo <= 0xffff)
9124	{ /* likely */ }
9125	else
9126	{
9127	Log(("invvpid: reserved bits set in invvpid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
9128	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_DescRsvd;
9129	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Lo;
9130	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9131	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9132	}
9133
9134	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9135	RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
9136	uint16_t const uVpid = uDesc.Words.w0;
9137	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9138	switch (u64InvvpidType)
9139	{
9140	case VMXTLBFLUSHVPID_INDIV_ADDR:
9141	{
9142	if (uVpid != 0)
9143	{
9144	if (IEM_IS_CANONICAL(GCPtrInvAddr))
9145	{
9146	/* Invalidate mappings for the linear address tagged with VPID. */
9147	/** @todo PGM support for VPID? Currently just flush everything. */
9148	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9149	iemVmxVmSucceed(pVCpu);
9150	}
9151	else
9152	{
9153	Log(("invvpid: invalidation address %#RGP is not canonical -> VMFail\n", GCPtrInvAddr));
9154	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidAddr;
9155	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrInvAddr;
9156	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9157	}
9158	}
9159	else
9160	{
9161	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9162	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidVpid;
9163	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9164	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9165	}
9166	break;
9167	}
9168
9169	case VMXTLBFLUSHVPID_SINGLE_CONTEXT:
9170	{
9171	if (uVpid != 0)
9172	{
9173	/* Invalidate all mappings with VPID. */
9174	/** @todo PGM support for VPID? Currently just flush everything. */
9175	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9176	iemVmxVmSucceed(pVCpu);
9177	}
9178	else
9179	{
9180	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9181	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type1InvalidVpid;
9182	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9183	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9184	}
9185	break;
9186	}
9187
9188	case VMXTLBFLUSHVPID_ALL_CONTEXTS:
9189	{
9190	/* Invalidate all mappings with non-zero VPIDs. */
9191	/** @todo PGM support for VPID? Currently just flush everything. */
9192	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9193	iemVmxVmSucceed(pVCpu);
9194	break;
9195	}
9196
9197	case VMXTLBFLUSHVPID_SINGLE_CONTEXT_RETAIN_GLOBALS:
9198	{
9199	if (uVpid != 0)
9200	{
9201	/* Invalidate all mappings with VPID except global translations. */
9202	/** @todo PGM support for VPID? Currently just flush everything. */
9203	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9204	iemVmxVmSucceed(pVCpu);
9205	}
9206	else
9207	{
9208	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9209	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type3InvalidVpid;
9210	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uVpid;
9211	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9212	}
9213	break;
9214	}
9215	IEM_NOT_REACHED_DEFAULT_CASE_RET();
9216	}
9217	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9218	}
9219	return rcStrict;
9220	}
9221
9222
9223	/**
9224	* Interface for HM and EM to emulate the INVVPID instruction.
9225	*
9226	* @returns Strict VBox status code.
9227	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9228	* @param pExitInfo Pointer to the VM-exit information.
9229	* @thread EMT(pVCpu)
9230	*/
9231	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvvpid(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9232	{
9233	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9234	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9235	Assert(pExitInfo);
9236
9237	iemInitExec(pVCpu, 0 /fExecOpts/);
9238
9239	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9240	uint8_t const cbInstr = pExitInfo->cbInstr;
9241	RTGCPTR const GCPtrInvvpidDesc = pExitInfo->GCPtrEffAddr;
9242	uint64_t const u64InvvpidType = IEM_IS_64BIT_CODE(pVCpu)
9243	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9244	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9245	VBOXSTRICTRC rcStrict = iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, u64InvvpidType, pExitInfo);
9246	Assert(!pVCpu->iem.s.cActiveMappings);
9247	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9248	}
9249
9250	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9251
9252	/**
9253	* INVEPT instruction execution worker.
9254	*
9255	* @returns Strict VBox status code.
9256	* @param pVCpu The cross context virtual CPU structure.
9257	* @param cbInstr The instruction length in bytes.
9258	* @param iEffSeg The segment of the invept descriptor.
9259	* @param GCPtrInveptDesc The address of invept descriptor.
9260	* @param u64InveptType The invalidation type.
9261	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9262	* NULL.
9263	*
9264	* @remarks Common VMX instruction checks are already expected to by the caller,
9265	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9266	*/
9267	static VBOXSTRICTRC iemVmxInvept(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInveptDesc,
9268	uint64_t u64InveptType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9269	{
9270	/* Check if EPT is supported, otherwise raise #UD. */
9271	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEpt)
9272	return iemRaiseUndefinedOpcode(pVCpu);
9273
9274	/* Nested-guest intercept. */
9275	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9276	{
9277	if (pExitInfo)
9278	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9279	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVEPT, VMXINSTRID_NONE, cbInstr);
9280	}
9281
9282	/* CPL. */
9283	if (IEM_GET_CPL(pVCpu) != 0)
9284	{
9285	Log(("invept: CPL != 0 -> #GP(0)\n"));
9286	return iemRaiseGeneralProtectionFault0(pVCpu);
9287	}
9288
9289	/*
9290	* Validate INVEPT invalidation type.
9291	*
9292	* The instruction specifies exactly ONE of the supported invalidation types.
9293	*
9294	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9295	* supported. In theory, it's possible for a CPU to not support flushing individual
9296	* addresses but all the other types or any other combination. We do not take any
9297	* shortcuts here by assuming the types we currently expose to the guest.
9298	*/
9299	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9300	bool const fInveptSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT);
9301	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_SINGLE_CTX);
9302	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_ALL_CTX);
9303
9304	bool afSupportedTypes[4];
9305	afSupportedTypes[0] = false;
9306	afSupportedTypes[1] = fTypeSingleCtx;
9307	afSupportedTypes[2] = fTypeAllCtx;
9308	afSupportedTypes[3] = false;
9309
9310	if ( fInveptSupported
9311	&& !(u64InveptType & ~(uint64_t)VMX_INVEPT_VALID_MASK)
9312	&& afSupportedTypes[u64InveptType & 3])
9313	{ /* likely */ }
9314	else
9315	{
9316	Log(("invept: invalid/unsupported invvpid type %#x -> VMFail\n", u64InveptType));
9317	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_TypeInvalid;
9318	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InveptType;
9319	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9320	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9321	}
9322
9323	/*
9324	* Fetch the invept descriptor from guest memory.
9325	*/
9326	RTUINT128U uDesc;
9327	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInveptDesc);
9328	if (rcStrict == VINF_SUCCESS)
9329	{
9330	/*
9331	* Validate the descriptor.
9332	*
9333	* The Intel spec. does not explicit say the INVEPT instruction fails when reserved
9334	* bits in the descriptor are set, but it -does- for INVVPID. Until we test on real
9335	* hardware, it's assumed INVEPT behaves the same as INVVPID in this regard. It's
9336	* better to be strict in our emulation until proven otherwise.
9337	*/
9338	if (uDesc.s.Hi)
9339	{
9340	Log(("invept: reserved bits set in invept descriptor %#RX64 -> VMFail\n", uDesc.s.Hi));
9341	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_DescRsvd;
9342	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Hi;
9343	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9344	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9345	}
9346
9347	/*
9348	* Flush TLB mappings based on the EPT type.
9349	*/
9350	if (u64InveptType == VMXTLBFLUSHEPT_SINGLE_CONTEXT)
9351	{
9352	uint64_t const GCPhysEptPtr = uDesc.s.Lo;
9353	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, GCPhysEptPtr, NULL /* enmDiag */);
9354	if (RT_SUCCESS(rc))
9355	{ /* likely */ }
9356	else
9357	{
9358	Log(("invept: EPTP invalid %#RX64 -> VMFail\n", GCPhysEptPtr));
9359	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_EptpInvalid;
9360	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysEptPtr;
9361	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9362	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9363	}
9364	}
9365
9366	/** @todo PGM support for EPT tags? Currently just flush everything. */
9367	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9368	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9369	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9370
9371	iemVmxVmSucceed(pVCpu);
9372	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9373	}
9374
9375	return rcStrict;
9376	}
9377
9378
9379	/**
9380	* Interface for HM and EM to emulate the INVEPT instruction.
9381	*
9382	* @returns Strict VBox status code.
9383	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9384	* @param pExitInfo Pointer to the VM-exit information.
9385	* @thread EMT(pVCpu)
9386	*/
9387	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvept(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9388	{
9389	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9390	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9391	Assert(pExitInfo);
9392
9393	iemInitExec(pVCpu, 0 /fExecOpts/);
9394
9395	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9396	uint8_t const cbInstr = pExitInfo->cbInstr;
9397	RTGCPTR const GCPtrInveptDesc = pExitInfo->GCPtrEffAddr;
9398	uint64_t const u64InveptType = IEM_IS_64BIT_CODE(pVCpu)
9399	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9400	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9401	VBOXSTRICTRC rcStrict = iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, u64InveptType, pExitInfo);
9402	Assert(!pVCpu->iem.s.cActiveMappings);
9403	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9404	}
9405
9406	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
9407
9408	/**
9409	* VMXON instruction execution worker.
9410	*
9411	* @returns Strict VBox status code.
9412	* @param pVCpu The cross context virtual CPU structure.
9413	* @param cbInstr The instruction length in bytes.
9414	* @param iEffSeg The effective segment register to use with @a
9415	* GCPtrVmxon.
9416	* @param GCPtrVmxon The linear address of the VMXON pointer.
9417	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
9418	*
9419	* @remarks Common VMX instruction checks are already expected to by the caller,
9420	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9421	*/
9422	static VBOXSTRICTRC iemVmxVmxon(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
9423	RTGCPHYS GCPtrVmxon, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9424	{
9425	if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
9426	{
9427	/* CPL. */
9428	if (IEM_GET_CPL(pVCpu) == 0)
9429	{ /* likely */ }
9430	else
9431	{
9432	Log(("vmxon: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9433	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cpl;
9434	return iemRaiseGeneralProtectionFault0(pVCpu);
9435	}
9436
9437	/* A20M (A20 Masked) mode. */
9438	if (PGMPhysIsA20Enabled(pVCpu))
9439	{ /* likely */ }
9440	else
9441	{
9442	Log(("vmxon: A20M mode -> #GP(0)\n"));
9443	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_A20M;
9444	return iemRaiseGeneralProtectionFault0(pVCpu);
9445	}
9446
9447	/* CR0. */
9448	{
9449	/*
9450	* CR0 MB1 bits.
9451	*
9452	* We use VMX_V_CR0_FIXED0 below to ensure CR0.PE and CR0.PG are always set
9453	* while executing VMXON. CR0.PE and CR0.PG are only allowed to be clear
9454	* when the guest running in VMX non-root mode with unrestricted-guest control
9455	* enabled in the VMCS.
9456	*/
9457	uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
9458	if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) == uCr0Fixed0)
9459	{ /* likely */ }
9460	else
9461	{
9462	Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
9463	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed0;
9464	return iemRaiseGeneralProtectionFault0(pVCpu);
9465	}
9466
9467	/* CR0 MBZ bits. */
9468	uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
9469	if (!(pVCpu->cpum.GstCtx.cr0 & ~uCr0Fixed1))
9470	{ /* likely */ }
9471	else
9472	{
9473	Log(("vmxon: CR0 fixed1 bits set -> #GP(0)\n"));
9474	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed1;
9475	return iemRaiseGeneralProtectionFault0(pVCpu);
9476	}
9477	}
9478
9479	/* CR4. */
9480	{
9481	/* CR4 MB1 bits. */
9482	uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
9483	if ((pVCpu->cpum.GstCtx.cr4 & uCr4Fixed0) == uCr4Fixed0)
9484	{ /* likely */ }
9485	else
9486	{
9487	Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
9488	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed0;
9489	return iemRaiseGeneralProtectionFault0(pVCpu);
9490	}
9491
9492	/* CR4 MBZ bits. */
9493	uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
9494	if (!(pVCpu->cpum.GstCtx.cr4 & ~uCr4Fixed1))
9495	{ /* likely */ }
9496	else
9497	{
9498	Log(("vmxon: CR4 fixed1 bits set -> #GP(0)\n"));
9499	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed1;
9500	return iemRaiseGeneralProtectionFault0(pVCpu);
9501	}
9502	}
9503
9504	/* Feature control MSR's LOCK and VMXON bits. */
9505	uint64_t const uMsrFeatCtl = CPUMGetGuestIa32FeatCtrl(pVCpu);
9506	if ((uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9507	== (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9508	{ /* likely */ }
9509	else
9510	{
9511	Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
9512	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_MsrFeatCtl;
9513	return iemRaiseGeneralProtectionFault0(pVCpu);
9514	}
9515
9516	/* Get the VMXON pointer from the location specified by the source memory operand. */
9517	RTGCPHYS GCPhysVmxon;
9518	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
9519	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
9520	{ /* likely */ }
9521	else
9522	{
9523	Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
9524	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrMap;
9525	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmxon;
9526	return rcStrict;
9527	}
9528
9529	/* VMXON region pointer alignment. */
9530	if (!(GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK))
9531	{ /* likely */ }
9532	else
9533	{
9534	Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
9535	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAlign;
9536	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9537	iemVmxVmFailInvalid(pVCpu);
9538	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9539	}
9540
9541	/* VMXON physical-address width limits. */
9542	if (!(GCPhysVmxon >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
9543	{ /* likely */ }
9544	else
9545	{
9546	Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
9547	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrWidth;
9548	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9549	iemVmxVmFailInvalid(pVCpu);
9550	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9551	}
9552
9553	/* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
9554	restriction imposed by our implementation. */
9555	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
9556	{ /* likely */ }
9557	else
9558	{
9559	Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
9560	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAbnormal;
9561	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9562	iemVmxVmFailInvalid(pVCpu);
9563	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9564	}
9565
9566	/* Read the VMCS revision ID from the VMXON region. */
9567	VMXVMCSREVID VmcsRevId;
9568	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
9569	if (RT_SUCCESS(rc))
9570	{ /* likely */ }
9571	else
9572	{
9573	Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
9574	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrReadPhys;
9575	return rc;
9576	}
9577
9578	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
9579	if (RT_LIKELY(VmcsRevId.u == VMX_V_VMCS_REVISION_ID))
9580	{ /* likely */ }
9581	else
9582	{
9583	/* Revision ID mismatch. */
9584	if (!VmcsRevId.n.fIsShadowVmcs)
9585	{
9586	Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
9587	VmcsRevId.n.u31RevisionId));
9588	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmcsRevId;
9589	iemVmxVmFailInvalid(pVCpu);
9590	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9591	}
9592
9593	/* Shadow VMCS disallowed. */
9594	Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
9595	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_ShadowVmcs;
9596	iemVmxVmFailInvalid(pVCpu);
9597	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9598	}
9599
9600	/*
9601	* Record that we're in VMX operation, block INIT, block and disable A20M.
9602	*/
9603	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
9604	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
9605	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
9606
9607	/* Clear address-range monitoring. */
9608	EMMonitorWaitClear(pVCpu);
9609	/** @todo NSTVMX: Intel PT. */
9610
9611	iemVmxVmSucceed(pVCpu);
9612	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9613	}
9614	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9615	{
9616	/* Nested-guest intercept. */
9617	if (pExitInfo)
9618	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9619	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMXON, VMXINSTRID_NONE, cbInstr);
9620	}
9621
9622	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
9623
9624	/* CPL. */
9625	if (IEM_GET_CPL(pVCpu) > 0)
9626	{
9627	Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9628	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxRootCpl;
9629	return iemRaiseGeneralProtectionFault0(pVCpu);
9630	}
9631
9632	/* VMXON when already in VMX root mode. */
9633	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
9634	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxAlreadyRoot;
9635	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9636	}
9637
9638
9639	/**
9640	* Interface for HM and EM to emulate the VMXON instruction.
9641	*
9642	* @returns Strict VBox status code.
9643	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9644	* @param pExitInfo Pointer to the VM-exit information.
9645	* @thread EMT(pVCpu)
9646	*/
9647	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxon(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9648	{
9649	Assert(pExitInfo);
9650	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9651	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9652
9653	iemInitExec(pVCpu, 0 /fExecOpts/);
9654
9655	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9656	uint8_t const cbInstr = pExitInfo->cbInstr;
9657	RTGCPTR const GCPtrVmxon = pExitInfo->GCPtrEffAddr;
9658	VBOXSTRICTRC rcStrict = iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, pExitInfo);
9659	Assert(!pVCpu->iem.s.cActiveMappings);
9660	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9661	}
9662
9663
9664	/**
9665	* Implements 'VMXOFF'.
9666	*
9667	* @remarks Common VMX instruction checks are already expected to by the caller,
9668	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9669	*/
9670	IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
9671	{
9672	/* Nested-guest intercept. */
9673	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9674	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMXOFF, cbInstr);
9675
9676	/* CPL. */
9677	if (IEM_GET_CPL(pVCpu) == 0)
9678	{ /* likely */ }
9679	else
9680	{
9681	Log(("vmxoff: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9682	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxoff_Cpl;
9683	return iemRaiseGeneralProtectionFault0(pVCpu);
9684	}
9685
9686	/* Dual monitor treatment of SMIs and SMM. */
9687	uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
9688	if (!(fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID))
9689	{ /* likely */ }
9690	else
9691	{
9692	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
9693	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9694	}
9695
9696	/* Record that we're no longer in VMX root operation, block INIT, block and disable A20M. */
9697	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
9698	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
9699
9700	if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
9701	{ /** @todo NSTVMX: Unblock SMI. */ }
9702
9703	EMMonitorWaitClear(pVCpu);
9704	/** @todo NSTVMX: Unblock and enable A20M. */
9705
9706	iemVmxVmSucceed(pVCpu);
9707	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9708	}
9709
9710
9711	/**
9712	* Interface for HM and EM to emulate the VMXOFF instruction.
9713	*
9714	* @returns Strict VBox status code.
9715	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9716	* @param cbInstr The instruction length in bytes.
9717	* @thread EMT(pVCpu)
9718	*/
9719	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxoff(PVMCPUCC pVCpu, uint8_t cbInstr)
9720	{
9721	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
9722	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_NO_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9723
9724	iemInitExec(pVCpu, 0 /fExecOpts/);
9725	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmxoff);
9726	Assert(!pVCpu->iem.s.cActiveMappings);
9727	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9728	}
9729
9730
9731	/**
9732	* Implements 'VMXON'.
9733	*/
9734	IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
9735	{
9736	return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
9737	}
9738
9739
9740	/**
9741	* Implements 'VMLAUNCH'.
9742	*/
9743	IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
9744	{
9745	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH);
9746	}
9747
9748
9749	/**
9750	* Implements 'VMRESUME'.
9751	*/
9752	IEM_CIMPL_DEF_0(iemCImpl_vmresume)
9753	{
9754	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME);
9755	}
9756
9757
9758	/**
9759	* Implements 'VMPTRLD'.
9760	*/
9761	IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9762	{
9763	return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9764	}
9765
9766
9767	/**
9768	* Implements 'VMPTRST'.
9769	*/
9770	IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9771	{
9772	return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9773	}
9774
9775
9776	/**
9777	* Implements 'VMCLEAR'.
9778	*/
9779	IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9780	{
9781	return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9782	}
9783
9784
9785	/**
9786	* Implements 'VMWRITE' register.
9787	*/
9788	IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64VmcsField)
9789	{
9790	return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg /, u64Val, u64VmcsField, NULL / pExitInfo */);
9791	}
9792
9793
9794	/**
9795	* Implements 'VMWRITE' memory.
9796	*/
9797	IEM_CIMPL_DEF_3(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrVal, uint32_t, u64VmcsField)
9798	{
9799	return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, GCPtrVal, u64VmcsField, NULL /* pExitInfo */);
9800	}
9801
9802
9803	/**
9804	* Implements 'VMREAD' register (64-bit).
9805	*/
9806	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg64, uint64_t *, pu64Dst, uint64_t, u64VmcsField)
9807	{
9808	return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64VmcsField, NULL /* pExitInfo */);
9809	}
9810
9811
9812	/**
9813	* Implements 'VMREAD' register (32-bit).
9814	*/
9815	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg32, uint64_t *, pu64Dst, uint32_t, u32VmcsField)
9816	{
9817	VBOXSTRICTRC const rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, (uint32_t )pu64Dst, u32VmcsField, NULL / pExitInfo */);
9818	/* Zero the high part of the register on success. */
9819	if (rcStrict == VINF_SUCCESS)
9820	pu64Dst = (uint32_t)pu64Dst;
9821	return rcStrict;
9822	}
9823
9824
9825	/**
9826	* Implements 'VMREAD' memory, 64-bit register.
9827	*/
9828	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg64, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u64VmcsField)
9829	{
9830	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64VmcsField, NULL /* pExitInfo */);
9831	}
9832
9833
9834	/**
9835	* Implements 'VMREAD' memory, 32-bit register.
9836	*/
9837	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg32, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u32VmcsField)
9838	{
9839	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u32VmcsField, NULL /* pExitInfo */);
9840	}
9841
9842
9843	/**
9844	* Implements 'INVVPID'.
9845	*/
9846	IEM_CIMPL_DEF_3(iemCImpl_invvpid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvvpidDesc, uint64_t, uInvvpidType)
9847	{
9848	return iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, uInvvpidType, NULL /* pExitInfo */);
9849	}
9850
9851
9852	#if defined(VBOX_WITH_NESTED_HWVIRT_VMX_EPT) \|\| defined(VBOX_WITH_IEM_RECOMPILER) /* HACK ALERT: Linking trick. */
9853	/**
9854	* Implements 'INVEPT'.
9855	*/
9856	IEM_CIMPL_DEF_3(iemCImpl_invept, uint8_t, iEffSeg, RTGCPTR, GCPtrInveptDesc, uint64_t, uInveptType)
9857	{
9858	# ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9859	return iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, uInveptType, NULL /* pExitInfo */);
9860	# else
9861	RT_NOREF(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, uInveptType);
9862	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9863	# endif
9864	}
9865	#endif
9866
9867
9868	/**
9869	* Implements VMX's implementation of PAUSE.
9870	*/
9871	IEM_CIMPL_DEF_0(iemCImpl_vmx_pause)
9872	{
9873	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9874	{
9875	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrPause(pVCpu, cbInstr);
9876	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
9877	return rcStrict;
9878	}
9879
9880	/*
9881	* Outside VMX non-root operation or if the PAUSE instruction does not cause
9882	* a VM-exit, the instruction operates normally.
9883	*/
9884	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9885	}
9886
9887	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
9888
9889
9890	/**
9891	* Implements 'VMCALL'.
9892	*/
9893	IEM_CIMPL_DEF_0(iemCImpl_vmcall)
9894	{
9895	pVCpu->iem.s.cPotentialExits++;
9896
9897	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9898	/* Nested-guest intercept. */
9899	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9900	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMCALL, cbInstr);
9901	#endif
9902
9903	/* Join forces with vmmcall. */
9904	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
9905	}
9906
9907
9908	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9909
9910	/**
9911	* @callback_method_impl{FNPGMPHYSHANDLER, VMX APIC-access page accesses}
9912	*
9913	* @remarks The @a uUser argument is currently unused.
9914	*/
9915	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPageHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhysFault, void *pvPhys,
9916	void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType,
9917	PGMACCESSORIGIN enmOrigin, uint64_t uUser)
9918	{
9919	RT_NOREF3(pvPhys, enmOrigin, uUser);
9920
9921	RTGCPHYS const GCPhysAccessBase = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9922	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9923	{
9924	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9925	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysAccessBase);
9926
9927	uint32_t const fAccess = enmAccessType == PGMACCESSTYPE_WRITE ? IEM_ACCESS_DATA_W : IEM_ACCESS_DATA_R;
9928	uint16_t const offAccess = GCPhysFault & GUEST_PAGE_OFFSET_MASK;
9929
9930	LogFlowFunc(("Fault at %#RGp (cbBuf=%u fAccess=%#x)\n", GCPhysFault, cbBuf, fAccess));
9931	VBOXSTRICTRC rcStrict = iemVmxVirtApicAccessMem(pVCpu, offAccess, cbBuf, pvBuf, fAccess);
9932	if (RT_FAILURE(rcStrict))
9933	return rcStrict;
9934
9935	/* Any access on this APIC-access page has been handled, caller should not carry out the access. */
9936	return VINF_SUCCESS;
9937	}
9938
9939	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysAccessBase));
9940	int rc = PGMHandlerPhysicalDeregister(pVM, GCPhysAccessBase);
9941	if (RT_FAILURE(rc))
9942	return rc;
9943
9944	/* Instruct the caller of this handler to perform the read/write as normal memory. */
9945	return VINF_PGM_HANDLER_DO_DEFAULT;
9946	}
9947
9948
9949	# ifndef IN_RING3
9950	/**
9951	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
9952	* \#PF access handler callback for guest VMX APIC-access page.}
9953	*/
9954	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPagePfHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErr, PCPUMCTX pCtx,
9955	RTGCPTR pvFault, RTGCPHYS GCPhysFault, uint64_t uUser)
9956
9957	{
9958	RT_NOREF3(pVM, pCtx, uUser);
9959
9960	/*
9961	* Handle the VMX APIC-access page only when the guest is in VMX non-root mode.
9962	* Otherwise we must deregister the page and allow regular RAM access.
9963	* Failing to do so lands us with endless EPT VM-exits.
9964	*/
9965	RTGCPHYS const GCPhysPage = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9966	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9967	{
9968	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9969	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysPage);
9970
9971	/*
9972	* Check if the access causes an APIC-access VM-exit.
9973	*/
9974	uint32_t fAccess;
9975	if (uErr & X86_TRAP_PF_ID)
9976	fAccess = IEM_ACCESS_INSTRUCTION;
9977	else if (uErr & X86_TRAP_PF_RW)
9978	fAccess = IEM_ACCESS_DATA_W;
9979	else
9980	fAccess = IEM_ACCESS_DATA_R;
9981
9982	RTGCPHYS const GCPhysNestedFault = (RTGCPHYS)pvFault;
9983	uint16_t const offAccess = GCPhysNestedFault & GUEST_PAGE_OFFSET_MASK;
9984	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, 1 /* cbAccess */, fAccess);
9985	LogFlowFunc(("#PF at %#RGp (GCPhysNestedFault=%#RGp offAccess=%#x)\n", GCPhysFault, GCPhysNestedFault, offAccess));
9986	if (fIntercept)
9987	{
9988	/*
9989	* Query the source VM-exit (from the execution engine) that caused this access
9990	* within the APIC-access page. Currently only HM is supported.
9991	*/
9992	AssertMsg(VM_IS_HM_ENABLED(pVM),
9993	("VM-exit auxiliary info. fetching not supported for execution engine %d\n", pVM->bMainExecutionEngine));
9994
9995	HMEXITAUX HmExitAux;
9996	RT_ZERO(HmExitAux);
9997	int const rc = HMR0GetExitAuxInfo(pVCpu, &HmExitAux, HMVMX_READ_EXIT_INSTR_LEN
9998	\| HMVMX_READ_EXIT_QUALIFICATION
9999	\| HMVMX_READ_IDT_VECTORING_INFO
10000	\| HMVMX_READ_IDT_VECTORING_ERROR_CODE);
10001	AssertRC(rc);
10002
10003	/*
10004	* Verify the VM-exit reason must be an EPT violation.
10005	* Other accesses should go through the other handler (iemVmxApicAccessPageHandler).
10006	* Refer to @bugref{10092#c33s} for a more detailed explanation.
10007	*/
10008	AssertMsgReturn(HmExitAux.Vmx.uReason == VMX_EXIT_EPT_VIOLATION,
10009	("Unexpected call to APIC-access page #PF handler for %#RGp offAcesss=%u uErr=%#RGx uReason=%u\n",
10010	GCPhysPage, offAccess, uErr, HmExitAux.Vmx.uReason), VERR_IEM_IPE_7);
10011
10012	/*
10013	* Construct the virtual APIC-access VM-exit.
10014	*/
10015	VMXAPICACCESS enmAccess;
10016	if (HmExitAux.Vmx.u64Qual & VMX_EXIT_QUAL_EPT_LINEAR_ADDR_VALID)
10017	{
10018	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10019	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
10020	else if (fAccess == IEM_ACCESS_INSTRUCTION)
10021	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
10022	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
10023	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
10024	else
10025	enmAccess = VMXAPICACCESS_LINEAR_READ;
10026
10027	/* For linear-address accesss the instruction length must be valid. */
10028	AssertMsg(HmExitAux.Vmx.cbInstr > 0,
10029	("Invalid APIC-access VM-exit instruction length. cbInstr=%u\n", HmExitAux.Vmx.cbInstr));
10030	}
10031	else
10032	{
10033	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10034	enmAccess = VMXAPICACCESS_PHYSICAL_EVENT_DELIVERY;
10035	else
10036	{
10037	/** @todo How to distinguish between monitoring/trace vs other instructions
10038	* here? */
10039	enmAccess = VMXAPICACCESS_PHYSICAL_INSTR;
10040	}
10041
10042	/* For physical accesses the instruction length is undefined, we zero it for safety and consistency. */
10043	HmExitAux.Vmx.cbInstr = 0;
10044	}
10045
10046	/*
10047	* Raise the APIC-access VM-exit.
10048	*/
10049	LogFlowFunc(("Raising APIC-access VM-exit from #PF handler at offset %#x\n", offAccess));
10050	VMXVEXITINFO const ExitInfo
10051	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_APIC_ACCESS,
10052	RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
10053	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess),
10054	HmExitAux.Vmx.cbInstr);
10055	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_IDT(HmExitAux.Vmx.uIdtVectoringInfo,
10056	HmExitAux.Vmx.uIdtVectoringErrCode);
10057	VBOXSTRICTRC const rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
10058	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
10059	}
10060
10061	/*
10062	* The access isn't intercepted, which means it needs to be virtualized.
10063	*
10064	* This requires emulating the instruction because we need the bytes being
10065	* read/written by the instruction not just the offset being accessed within
10066	* the APIC-access page (which we derive from the faulting address).
10067	*/
10068	LogFlowFunc(("Access at offset %#x not intercepted -> VINF_EM_RAW_EMULATE_INSTR\n", offAccess));
10069	return VINF_EM_RAW_EMULATE_INSTR;
10070	}
10071
10072	/** @todo This isn't ideal but works for now as nested-hypervisors generally play
10073	* nice because the spec states that this page should be modified only when
10074	* no CPU refers to it VMX non-root mode. Nonetheless, we could use an atomic
10075	* reference counter to ensure the aforementioned condition before
10076	* de-registering the page. */
10077	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysPage));
10078	int const rc = PGMHandlerPhysicalDeregister(pVM, GCPhysPage);
10079	if (RT_FAILURE(rc))
10080	return rc;
10081
10082	return VINF_SUCCESS;
10083	}
10084	# endif /* !IN_RING3 */
10085
10086	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
10087

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp@ 101584

Download in other formats: