IEMAllCImplVmxInstr.cpp@ 99681

Last change on this file since 99681 was 99650, checked in by vboxsync, 20 months ago
VMM/IEM: Nested VMX: bugref:10318 Clear "NMI unblocked due to IRET" state on VM-exit. Minor optimization while injecting an event. Comments, assertions.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 411.0 KB

Line
1	/* $Id: IEMAllCImplVmxInstr.cpp 99650 2023-05-08 06:49:25Z vboxsync $ */
2	/** @file
3	* IEM - VT-x instruction implementation.
4	*/
5
6	/*
7	* Copyright (C) 2011-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_IEM_VMX
33	#define VMCPU_INCL_CPUM_GST_CTX
34	#include <VBox/vmm/iem.h>
35	#include <VBox/vmm/apic.h>
36	#include <VBox/vmm/cpum.h>
37	#include <VBox/vmm/dbgf.h>
38	#include <VBox/vmm/em.h>
39	#include <VBox/vmm/gim.h>
40	#include <VBox/vmm/hm.h>
41	#include <VBox/vmm/pgm.h>
42	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
43	# include <VBox/vmm/hmvmxinline.h>
44	#endif
45	#include <VBox/vmm/tm.h>
46	#include "IEMInternal.h"
47	#include <VBox/vmm/vmcc.h>
48	#include <VBox/log.h>
49	#include <VBox/err.h>
50	#include <VBox/param.h>
51	#include <VBox/disopcode-x86-amd64.h>
52	#include <iprt/asm-math.h>
53	#include <iprt/assert.h>
54	#include <iprt/string.h>
55	#include <iprt/x86.h>
56
57	#include "IEMInline.h"
58
59
60	/*********************************************************************************************************************************
61	* Defined Constants And Macros *
62	*********************************************************************************************************************************/
63	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
64	/**
65	* Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
66	* relative offsets.
67	*/
68	# ifdef IEM_WITH_CODE_TLB /** @todo IEM TLB */
69	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { a_bModRm = 0; RT_NOREF(a_offModRm); } while (0)
70	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { a_bSib = 0; RT_NOREF(a_offSib); } while (0)
71	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
72	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
73	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
74	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
75	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
76	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
77	# if 0
78	# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
79	# endif
80	# else /* !IEM_WITH_CODE_TLB */
81	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
82	do \
83	{ \
84	Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
85	(a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
86	} while (0)
87
88	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
89
90	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
91	do \
92	{ \
93	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
94	uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
95	uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
96	(a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
97	} while (0)
98
99	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
100	do \
101	{ \
102	Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
103	(a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
104	} while (0)
105
106	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
107	do \
108	{ \
109	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
110	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
111	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
112	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
113	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
114	(a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
115	} while (0)
116
117	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
118	do \
119	{ \
120	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
121	(a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
122	} while (0)
123
124	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
125	do \
126	{ \
127	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
128	(a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
129	} while (0)
130
131	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
132	do \
133	{ \
134	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
135	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
136	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
137	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
138	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
139	(a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
140	} while (0)
141	# endif /* !IEM_WITH_CODE_TLB */
142
143	/** Check for VMX instructions requiring to be in VMX operation.
144	* @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs updating. */
145	# define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
146	do \
147	{ \
148	if (IEM_VMX_IS_ROOT_MODE(a_pVCpu)) \
149	{ /* likely */ } \
150	else \
151	{ \
152	Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
153	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = a_InsDiagPrefix##_VmxRoot; \
154	return iemRaiseUndefinedOpcode(a_pVCpu); \
155	} \
156	} while (0)
157
158	/** Marks a VM-entry failure with a diagnostic reason, logs and returns. */
159	# define IEM_VMX_VMENTRY_FAILED_RET(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag) \
160	do \
161	{ \
162	LogRel(("%s: VM-entry failed! enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_VmxDiag), \
163	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
164	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
165	return VERR_VMX_VMENTRY_FAILED; \
166	} while (0)
167
168	/** Marks a VM-entry failure with an return code, diagnostic reason, logs and
169	* returns. */
170	# define IEM_VMX_VMENTRY_FAILED_RET_2(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag, a_rc) \
171	do \
172	{ \
173	LogRel(("%s: VM-entry failed! rc=%Rrc enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_rc), (a_VmxDiag), \
174	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
175	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
176	return VERR_VMX_VMENTRY_FAILED; \
177	} while (0)
178
179	/** Marks a VM-exit failure with a diagnostic reason and logs. */
180	# define IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
181	do \
182	{ \
183	LogRel(("VM-exit failed! uExitReason=%u enmDiag=%u (%s) -> %s\n", (a_uExitReason), (a_VmxDiag), \
184	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
185	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
186	} while (0)
187
188	/** Marks a VM-exit failure with a diagnostic reason, logs and returns. */
189	# define IEM_VMX_VMEXIT_FAILED_RET(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
190	do \
191	{ \
192	IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag); \
193	return VERR_VMX_VMEXIT_FAILED; \
194	} while (0)
195
196
197	/*********************************************************************************************************************************
198	* Global Variables *
199	*********************************************************************************************************************************/
200	/** @todo NSTVMX: The following VM-exit intercepts are pending:
201	* VMX_EXIT_IO_SMI
202	* VMX_EXIT_SMI
203	* VMX_EXIT_GETSEC
204	* VMX_EXIT_RSM
205	* VMX_EXIT_MONITOR (APIC access VM-exit caused by MONITOR pending)
206	* VMX_EXIT_ERR_MACHINE_CHECK (we never need to raise this?)
207	* VMX_EXIT_RDRAND
208	* VMX_EXIT_VMFUNC
209	* VMX_EXIT_ENCLS
210	* VMX_EXIT_RDSEED
211	* VMX_EXIT_PML_FULL
212	* VMX_EXIT_XSAVES
213	* VMX_EXIT_XRSTORS
214	*/
215	/**
216	* Map of VMCS field encodings to their virtual-VMCS structure offsets.
217	*
218	* The first array dimension is VMCS field encoding of Width OR'ed with Type and the
219	* second dimension is the Index, see VMXVMCSFIELD.
220	*/
221	uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
222	{
223	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
224	{
225	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u16Vpid),
226	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
227	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u16EptpIndex),
228	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u16HlatPrefixSize),
229	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
230	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
231	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
232	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
233	},
234	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
235	{
236	/* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
237	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
238	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
239	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
240	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
241	},
242	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
243	{
244	/* 0 */ RT_UOFFSETOF(VMXVVMCS, GuestEs),
245	/* 1 */ RT_UOFFSETOF(VMXVVMCS, GuestCs),
246	/* 2 */ RT_UOFFSETOF(VMXVVMCS, GuestSs),
247	/* 3 */ RT_UOFFSETOF(VMXVVMCS, GuestDs),
248	/* 4 */ RT_UOFFSETOF(VMXVVMCS, GuestFs),
249	/* 5 */ RT_UOFFSETOF(VMXVVMCS, GuestGs),
250	/* 6 */ RT_UOFFSETOF(VMXVVMCS, GuestLdtr),
251	/* 7 */ RT_UOFFSETOF(VMXVVMCS, GuestTr),
252	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u16GuestIntStatus),
253	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u16PmlIndex),
254	/* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
255	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
256	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
257	/* 34 */ UINT16_MAX
258	},
259	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
260	{
261	/* 0 */ RT_UOFFSETOF(VMXVVMCS, HostEs),
262	/* 1 */ RT_UOFFSETOF(VMXVVMCS, HostCs),
263	/* 2 */ RT_UOFFSETOF(VMXVVMCS, HostSs),
264	/* 3 */ RT_UOFFSETOF(VMXVVMCS, HostDs),
265	/* 4 */ RT_UOFFSETOF(VMXVVMCS, HostFs),
266	/* 5 */ RT_UOFFSETOF(VMXVVMCS, HostGs),
267	/* 6 */ RT_UOFFSETOF(VMXVVMCS, HostTr),
268	/* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
269	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
270	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
271	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
272	},
273	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
274	{
275	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
276	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
277	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
278	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
279	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
280	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
281	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
282	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPml),
283	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64TscOffset),
284	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVirtApic),
285	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64AddrApicAccess),
286	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
287	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64VmFuncCtls),
288	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64EptPtr),
289	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
290	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
291	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
292	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
293	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEptpList),
294	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
295	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
296	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
297	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64XssExitBitmap),
298	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u64EnclsExitBitmap),
299	/* 24 */ RT_UOFFSETOF(VMXVVMCS, u64SppTablePtr),
300	/* 25 */ RT_UOFFSETOF(VMXVVMCS, u64TscMultiplier),
301	/* 26 */ RT_UOFFSETOF(VMXVVMCS, u64ProcCtls3),
302	/* 27 */ RT_UOFFSETOF(VMXVVMCS, u64EnclvExitBitmap),
303	/* 28 */ UINT16_MAX,
304	/* 29 */ UINT16_MAX,
305	/* 30 */ UINT16_MAX,
306	/* 31 */ RT_UOFFSETOF(VMXVVMCS, u64PconfigExitBitmap),
307	/* 32 */ RT_UOFFSETOF(VMXVVMCS, u64HlatPtr),
308	/* 33 */ UINT16_MAX,
309	/* 34 */ RT_UOFFSETOF(VMXVVMCS, u64ExitCtls2)
310	},
311	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
312	{
313	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestPhysAddr),
314	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
315	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
316	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
317	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
318	/* 33-34*/ UINT16_MAX, UINT16_MAX
319	},
320	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
321	{
322	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
323	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
324	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPatMsr),
325	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEferMsr),
326	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
327	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte0),
328	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte1),
329	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte2),
330	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte3),
331	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
332	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRtitCtlMsr),
333	/* 11 */ UINT16_MAX,
334	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPkrsMsr),
335	/* 13-20 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
336	/* 21-28 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
337	/* 29-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
338	},
339	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
340	{
341	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostPatMsr),
342	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostEferMsr),
343	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
344	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostPkrsMsr),
345	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
346	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
347	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
348	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
349	},
350	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
351	{
352	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32PinCtls),
353	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls),
354	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32XcptBitmap),
355	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMask),
356	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMatch),
357	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32Cr3TargetCount),
358	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32ExitCtls),
359	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
360	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
361	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32EntryCtls),
362	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
363	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32EntryIntInfo),
364	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
365	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32EntryInstrLen),
366	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32TprThreshold),
367	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls2),
368	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32PleGap),
369	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32PleWindow),
370	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
371	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
372	/* 34 */ UINT16_MAX
373	},
374	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
375	{
376	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32RoVmInstrError),
377	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitReason),
378	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntInfo),
379	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntErrCode),
380	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
381	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
382	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrLen),
383	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
384	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
385	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
386	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
387	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
388	},
389	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
390	{
391	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsLimit),
392	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsLimit),
393	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsLimit),
394	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsLimit),
395	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsLimit),
396	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsLimit),
397	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
398	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrLimit),
399	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
400	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
401	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsAttr),
402	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsAttr),
403	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsAttr),
404	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsAttr),
405	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsAttr),
406	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsAttr),
407	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
408	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrAttr),
409	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIntrState),
410	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u32GuestActivityState),
411	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSmBase),
412	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSysenterCS),
413	/* 22 */ UINT16_MAX,
414	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u32PreemptTimer),
415	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
416	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
417	},
418	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
419	{
420	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32HostSysenterCs),
421	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
422	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
423	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
424	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
425	/* 33-34 */ UINT16_MAX, UINT16_MAX
426	},
427	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_CONTROL: */
428	{
429	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0Mask),
430	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4Mask),
431	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
432	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
433	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target0),
434	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target1),
435	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target2),
436	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target3),
437	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
438	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
439	/* 24-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
440	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
441	},
442	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
443	{
444	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoExitQual),
445	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRcx),
446	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRsi),
447	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRdi),
448	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRip),
449	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestLinearAddr),
450	/* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
451	/* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
452	/* 22-29 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
453	/* 30-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
454	},
455	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
456	{
457	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr0),
458	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr3),
459	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr4),
460	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEsBase),
461	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCsBase),
462	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsBase),
463	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDsBase),
464	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestFsBase),
465	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGsBase),
466	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestLdtrBase),
467	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestTrBase),
468	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGdtrBase),
469	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIdtrBase),
470	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDr7),
471	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRsp),
472	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRip),
473	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRFlags),
474	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpts),
475	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
476	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEip),
477	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSCetMsr),
478	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsp),
479	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIntrSspTableAddrMsr),
480	/* 23-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
481	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
482	},
483	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
484	{
485	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr0),
486	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr3),
487	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr4),
488	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostFsBase),
489	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64HostGsBase),
490	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64HostTrBase),
491	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64HostGdtrBase),
492	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64HostIdtrBase),
493	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEsp),
494	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEip),
495	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64HostRsp),
496	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64HostRip),
497	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64HostSCetMsr),
498	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64HostSsp),
499	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64HostIntrSspTableAddrMsr),
500	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
501	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
502	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
503	}
504	};
505
506
507	/**
508	* Gets a host selector from the VMCS.
509	*
510	* @param pVmcs Pointer to the virtual VMCS.
511	* @param iSelReg The index of the segment register (X86_SREG_XXX).
512	*/
513	DECLINLINE(RTSEL) iemVmxVmcsGetHostSelReg(PCVMXVVMCS pVmcs, uint8_t iSegReg)
514	{
515	Assert(iSegReg < X86_SREG_COUNT);
516	RTSEL HostSel;
517	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
518	uint8_t const uType = VMX_VMCSFIELD_TYPE_HOST_STATE;
519	uint8_t const uWidthType = (uWidth << 2) \| uType;
520	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_HOST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
521	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
522	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
523	uint8_t const pbVmcs = (uint8_t )pVmcs;
524	uint8_t const *pbField = pbVmcs + offField;
525	HostSel = (uint16_t )pbField;
526	return HostSel;
527	}
528
529
530	/**
531	* Sets a guest segment register in the VMCS.
532	*
533	* @param pVmcs Pointer to the virtual VMCS.
534	* @param iSegReg The index of the segment register (X86_SREG_XXX).
535	* @param pSelReg Pointer to the segment register.
536	*/
537	static void iemVmxVmcsSetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCCPUMSELREG pSelReg) RT_NOEXCEPT
538	{
539	Assert(pSelReg);
540	Assert(iSegReg < X86_SREG_COUNT);
541
542	/* Selector. */
543	{
544	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
545	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
546	uint8_t const uWidthType = (uWidth << 2) \| uType;
547	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
548	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
549	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
550	uint8_t pbVmcs = (uint8_t )pVmcs;
551	uint8_t *pbField = pbVmcs + offField;
552	(uint16_t )pbField = pSelReg->Sel;
553	}
554
555	/* Limit. */
556	{
557	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
558	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
559	uint8_t const uWidthType = (uWidth << 2) \| uType;
560	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
561	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
562	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
563	uint8_t pbVmcs = (uint8_t )pVmcs;
564	uint8_t *pbField = pbVmcs + offField;
565	(uint32_t )pbField = pSelReg->u32Limit;
566	}
567
568	/* Base. */
569	{
570	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
571	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
572	uint8_t const uWidthType = (uWidth << 2) \| uType;
573	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
574	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
575	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
576	uint8_t const pbVmcs = (uint8_t )pVmcs;
577	uint8_t const *pbField = pbVmcs + offField;
578	(uint64_t )pbField = pSelReg->u64Base;
579	}
580
581	/* Attributes. */
582	{
583	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
584	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
585	\| X86DESCATTR_UNUSABLE;
586	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
587	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
588	uint8_t const uWidthType = (uWidth << 2) \| uType;
589	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
590	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
591	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
592	uint8_t pbVmcs = (uint8_t )pVmcs;
593	uint8_t *pbField = pbVmcs + offField;
594	(uint32_t )pbField = pSelReg->Attr.u & fValidAttrMask;
595	}
596	}
597
598
599	/**
600	* Gets a guest segment register from the VMCS.
601	*
602	* @returns VBox status code.
603	* @param pVmcs Pointer to the virtual VMCS.
604	* @param iSegReg The index of the segment register (X86_SREG_XXX).
605	* @param pSelReg Where to store the segment register (only updated when
606	* VINF_SUCCESS is returned).
607	*
608	* @remarks Warning! This does not validate the contents of the retrieved segment
609	* register.
610	*/
611	static int iemVmxVmcsGetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCPUMSELREG pSelReg) RT_NOEXCEPT
612	{
613	Assert(pSelReg);
614	Assert(iSegReg < X86_SREG_COUNT);
615
616	/* Selector. */
617	uint16_t u16Sel;
618	{
619	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
620	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
621	uint8_t const uWidthType = (uWidth << 2) \| uType;
622	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
623	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
624	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
625	uint8_t const pbVmcs = (uint8_t )pVmcs;
626	uint8_t const *pbField = pbVmcs + offField;
627	u16Sel = (uint16_t )pbField;
628	}
629
630	/* Limit. */
631	uint32_t u32Limit;
632	{
633	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
634	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
635	uint8_t const uWidthType = (uWidth << 2) \| uType;
636	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
637	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
638	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
639	uint8_t const pbVmcs = (uint8_t )pVmcs;
640	uint8_t const *pbField = pbVmcs + offField;
641	u32Limit = (uint32_t )pbField;
642	}
643
644	/* Base. */
645	uint64_t u64Base;
646	{
647	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
648	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
649	uint8_t const uWidthType = (uWidth << 2) \| uType;
650	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
651	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
652	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
653	uint8_t const pbVmcs = (uint8_t )pVmcs;
654	uint8_t const *pbField = pbVmcs + offField;
655	u64Base = (uint64_t )pbField;
656	/** @todo NSTVMX: Should we zero out high bits here for 32-bit virtual CPUs? */
657	}
658
659	/* Attributes. */
660	uint32_t u32Attr;
661	{
662	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
663	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
664	uint8_t const uWidthType = (uWidth << 2) \| uType;
665	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
666	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
667	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
668	uint8_t const pbVmcs = (uint8_t )pVmcs;
669	uint8_t const *pbField = pbVmcs + offField;
670	u32Attr = (uint32_t )pbField;
671	}
672
673	pSelReg->Sel = u16Sel;
674	pSelReg->ValidSel = u16Sel;
675	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
676	pSelReg->u32Limit = u32Limit;
677	pSelReg->u64Base = u64Base;
678	pSelReg->Attr.u = u32Attr;
679	return VINF_SUCCESS;
680	}
681
682
683	/**
684	* Converts an IEM exception event type to a VMX event type.
685	*
686	* @returns The VMX event type.
687	* @param uVector The interrupt / exception vector.
688	* @param fFlags The IEM event flag (see IEM_XCPT_FLAGS_XXX).
689	*/
690	DECLINLINE(uint8_t) iemVmxGetEventType(uint32_t uVector, uint32_t fFlags)
691	{
692	/* Paranoia (callers may use these interchangeably). */
693	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_IDT_VECTORING_INFO_TYPE_NMI);
694	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT);
695	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT);
696	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT);
697	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_IDT_VECTORING_INFO_TYPE_SW_INT);
698	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_PRIV_SW_XCPT);
699	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_ENTRY_INT_INFO_TYPE_NMI);
700	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT);
701	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_ENTRY_INT_INFO_TYPE_EXT_INT);
702	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT);
703	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_ENTRY_INT_INFO_TYPE_SW_INT);
704	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT);
705
706	if (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
707	{
708	if (uVector == X86_XCPT_NMI)
709	return VMX_EXIT_INT_INFO_TYPE_NMI;
710	return VMX_EXIT_INT_INFO_TYPE_HW_XCPT;
711	}
712
713	if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
714	{
715	if (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
716	return VMX_EXIT_INT_INFO_TYPE_SW_XCPT;
717	if (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
718	return VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT;
719	return VMX_EXIT_INT_INFO_TYPE_SW_INT;
720	}
721
722	Assert(fFlags & IEM_XCPT_FLAGS_T_EXT_INT);
723	return VMX_EXIT_INT_INFO_TYPE_EXT_INT;
724	}
725
726
727	/**
728	* Determines whether the guest is using PAE paging given the VMCS.
729	*
730	* @returns @c true if PAE paging mode is used, @c false otherwise.
731	* @param pVmcs Pointer to the virtual VMCS.
732	*
733	* @warning Only use this prior to switching the guest-CPU state with the
734	* nested-guest CPU state!
735	*/
736	DECL_FORCE_INLINE(bool) iemVmxVmcsIsGuestPaePagingEnabled(PCVMXVVMCS pVmcs)
737	{
738	return ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST)
739	&& (pVmcs->u64GuestCr4.u & X86_CR4_PAE)
740	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG));
741	}
742
743
744	/**
745	* Sets the Exit qualification VMCS field.
746	*
747	* @param pVCpu The cross context virtual CPU structure.
748	* @param u64ExitQual The Exit qualification.
749	*/
750	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitQual(PVMCPUCC pVCpu, uint64_t u64ExitQual)
751	{
752	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoExitQual.u = u64ExitQual;
753	}
754
755
756	/**
757	* Sets the VM-exit interruption information field.
758	*
759	* @param pVCpu The cross context virtual CPU structure.
760	* @param uExitIntInfo The VM-exit interruption information.
761	*/
762	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntInfo(PVMCPUCC pVCpu, uint32_t uExitIntInfo)
763	{
764	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntInfo = uExitIntInfo;
765	}
766
767
768	/**
769	* Sets the VM-exit interruption error code.
770	*
771	* @param pVCpu The cross context virtual CPU structure.
772	* @param uErrCode The error code.
773	*/
774	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
775	{
776	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntErrCode = uErrCode;
777	}
778
779
780	/**
781	* Sets the IDT-vectoring information field.
782	*
783	* @param pVCpu The cross context virtual CPU structure.
784	* @param uIdtVectorInfo The IDT-vectoring information.
785	*/
786	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringInfo(PVMCPUCC pVCpu, uint32_t uIdtVectorInfo)
787	{
788	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo = uIdtVectorInfo;
789	}
790
791
792	/**
793	* Sets the IDT-vectoring error code field.
794	*
795	* @param pVCpu The cross context virtual CPU structure.
796	* @param uErrCode The error code.
797	*/
798	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
799	{
800	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringErrCode = uErrCode;
801	}
802
803
804	/**
805	* Sets the VM-exit guest-linear address VMCS field.
806	*
807	* @param pVCpu The cross context virtual CPU structure.
808	* @param uGuestLinearAddr The VM-exit guest-linear address.
809	*/
810	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestLinearAddr(PVMCPUCC pVCpu, uint64_t uGuestLinearAddr)
811	{
812	/* Bits 63:32 of guest-linear address MBZ if the guest isn't in long mode prior to the VM-exit. */
813	Assert(CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)) \|\| !(uGuestLinearAddr & UINT64_C(0xffffffff00000000)));
814	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestLinearAddr.u = uGuestLinearAddr;
815	}
816
817
818	/**
819	* Sets the VM-exit guest-physical address VMCS field.
820	*
821	* @param pVCpu The cross context virtual CPU structure.
822	* @param uGuestPhysAddr The VM-exit guest-physical address.
823	*/
824	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestPhysAddr(PVMCPUCC pVCpu, uint64_t uGuestPhysAddr)
825	{
826	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestPhysAddr.u = uGuestPhysAddr;
827	}
828
829
830	/**
831	* Sets the VM-exit instruction length VMCS field.
832	*
833	* @param pVCpu The cross context virtual CPU structure.
834	* @param cbInstr The VM-exit instruction length in bytes.
835	*
836	* @remarks Callers may clear this field to 0. Hence, this function does not check
837	* the validity of the instruction length.
838	*/
839	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrLen(PVMCPUCC pVCpu, uint32_t cbInstr)
840	{
841	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrLen = cbInstr;
842	}
843
844
845	/**
846	* Sets the VM-exit instruction info. VMCS field.
847	*
848	* @param pVCpu The cross context virtual CPU structure.
849	* @param uExitInstrInfo The VM-exit instruction information.
850	*/
851	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitInstrInfo)
852	{
853	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrInfo = uExitInstrInfo;
854	}
855
856
857	/**
858	* Sets the guest pending-debug exceptions field.
859	*
860	* @param pVCpu The cross context virtual CPU structure.
861	* @param uGuestPendingDbgXcpts The guest pending-debug exceptions.
862	*/
863	DECL_FORCE_INLINE(void) iemVmxVmcsSetGuestPendingDbgXcpts(PVMCPUCC pVCpu, uint64_t uGuestPendingDbgXcpts)
864	{
865	Assert(!(uGuestPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK));
866	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestPendingDbgXcpts.u = uGuestPendingDbgXcpts;
867	}
868
869
870	/**
871	* Implements VMSucceed for VMX instruction success.
872	*
873	* @param pVCpu The cross context virtual CPU structure.
874	*/
875	DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPUCC pVCpu)
876	{
877	return CPUMSetGuestVmxVmSucceed(&pVCpu->cpum.GstCtx);
878	}
879
880
881	/**
882	* Implements VMFailInvalid for VMX instruction failure.
883	*
884	* @param pVCpu The cross context virtual CPU structure.
885	*/
886	DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPUCC pVCpu)
887	{
888	return CPUMSetGuestVmxVmFailInvalid(&pVCpu->cpum.GstCtx);
889	}
890
891
892	/**
893	* Implements VMFail for VMX instruction failure.
894	*
895	* @param pVCpu The cross context virtual CPU structure.
896	* @param enmInsErr The VM instruction error.
897	*/
898	DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPUCC pVCpu, VMXINSTRERR enmInsErr)
899	{
900	return CPUMSetGuestVmxVmFail(&pVCpu->cpum.GstCtx, enmInsErr);
901	}
902
903
904	/**
905	* Checks if the given auto-load/store MSR area count is valid for the
906	* implementation.
907	*
908	* @returns @c true if it's within the valid limit, @c false otherwise.
909	* @param pVCpu The cross context virtual CPU structure.
910	* @param uMsrCount The MSR area count to check.
911	*/
912	DECL_FORCE_INLINE(bool) iemVmxIsAutoMsrCountValid(PCVMCPU pVCpu, uint32_t uMsrCount)
913	{
914	uint64_t const u64VmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
915	uint32_t const cMaxSupportedMsrs = VMX_MISC_MAX_MSRS(u64VmxMiscMsr);
916	Assert(cMaxSupportedMsrs <= VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
917	if (uMsrCount <= cMaxSupportedMsrs)
918	return true;
919	return false;
920	}
921
922
923	/**
924	* Flushes the current VMCS contents back to guest memory.
925	*
926	* @returns VBox status code.
927	* @param pVCpu The cross context virtual CPU structure.
928	*/
929	DECL_FORCE_INLINE(int) iemVmxWriteCurrentVmcsToGstMem(PVMCPUCC pVCpu)
930	{
931	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
932	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
933	&pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
934	return rc;
935	}
936
937
938	/**
939	* Populates the current VMCS contents from guest memory.
940	*
941	* @returns VBox status code.
942	* @param pVCpu The cross context virtual CPU structure.
943	*/
944	DECL_FORCE_INLINE(int) iemVmxReadCurrentVmcsFromGstMem(PVMCPUCC pVCpu)
945	{
946	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
947	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs,
948	IEM_VMX_GET_CURRENT_VMCS(pVCpu), sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
949	return rc;
950	}
951
952
953	/**
954	* Gets the instruction diagnostic for segment base checks during VM-entry of a
955	* nested-guest.
956	*
957	* @param iSegReg The segment index (X86_SREG_XXX).
958	*/
959	static VMXVDIAG iemVmxGetDiagVmentrySegBase(unsigned iSegReg) RT_NOEXCEPT
960	{
961	switch (iSegReg)
962	{
963	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseCs;
964	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseDs;
965	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseEs;
966	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseFs;
967	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseGs;
968	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseSs;
969	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_1);
970	}
971	}
972
973
974	/**
975	* Gets the instruction diagnostic for segment base checks during VM-entry of a
976	* nested-guest that is in Virtual-8086 mode.
977	*
978	* @param iSegReg The segment index (X86_SREG_XXX).
979	*/
980	static VMXVDIAG iemVmxGetDiagVmentrySegBaseV86(unsigned iSegReg) RT_NOEXCEPT
981	{
982	switch (iSegReg)
983	{
984	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseV86Cs;
985	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ds;
986	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseV86Es;
987	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseV86Fs;
988	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseV86Gs;
989	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ss;
990	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_2);
991	}
992	}
993
994
995	/**
996	* Gets the instruction diagnostic for segment limit checks during VM-entry of a
997	* nested-guest that is in Virtual-8086 mode.
998	*
999	* @param iSegReg The segment index (X86_SREG_XXX).
1000	*/
1001	static VMXVDIAG iemVmxGetDiagVmentrySegLimitV86(unsigned iSegReg) RT_NOEXCEPT
1002	{
1003	switch (iSegReg)
1004	{
1005	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegLimitV86Cs;
1006	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ds;
1007	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegLimitV86Es;
1008	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegLimitV86Fs;
1009	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegLimitV86Gs;
1010	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ss;
1011	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_3);
1012	}
1013	}
1014
1015
1016	/**
1017	* Gets the instruction diagnostic for segment attribute checks during VM-entry of a
1018	* nested-guest that is in Virtual-8086 mode.
1019	*
1020	* @param iSegReg The segment index (X86_SREG_XXX).
1021	*/
1022	static VMXVDIAG iemVmxGetDiagVmentrySegAttrV86(unsigned iSegReg) RT_NOEXCEPT
1023	{
1024	switch (iSegReg)
1025	{
1026	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrV86Cs;
1027	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ds;
1028	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrV86Es;
1029	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrV86Fs;
1030	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrV86Gs;
1031	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ss;
1032	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_4);
1033	}
1034	}
1035
1036
1037	/**
1038	* Gets the instruction diagnostic for segment attributes reserved bits failure
1039	* during VM-entry of a nested-guest.
1040	*
1041	* @param iSegReg The segment index (X86_SREG_XXX).
1042	*/
1043	static VMXVDIAG iemVmxGetDiagVmentrySegAttrRsvd(unsigned iSegReg) RT_NOEXCEPT
1044	{
1045	switch (iSegReg)
1046	{
1047	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdCs;
1048	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdDs;
1049	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrRsvdEs;
1050	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdFs;
1051	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdGs;
1052	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdSs;
1053	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_5);
1054	}
1055	}
1056
1057
1058	/**
1059	* Gets the instruction diagnostic for segment attributes descriptor-type
1060	* (code/segment or system) failure during VM-entry of a nested-guest.
1061	*
1062	* @param iSegReg The segment index (X86_SREG_XXX).
1063	*/
1064	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDescType(unsigned iSegReg) RT_NOEXCEPT
1065	{
1066	switch (iSegReg)
1067	{
1068	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeCs;
1069	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeDs;
1070	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeEs;
1071	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeFs;
1072	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeGs;
1073	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeSs;
1074	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_6);
1075	}
1076	}
1077
1078
1079	/**
1080	* Gets the instruction diagnostic for segment attributes descriptor-type
1081	* (code/segment or system) failure during VM-entry of a nested-guest.
1082	*
1083	* @param iSegReg The segment index (X86_SREG_XXX).
1084	*/
1085	static VMXVDIAG iemVmxGetDiagVmentrySegAttrPresent(unsigned iSegReg) RT_NOEXCEPT
1086	{
1087	switch (iSegReg)
1088	{
1089	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrPresentCs;
1090	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrPresentDs;
1091	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrPresentEs;
1092	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrPresentFs;
1093	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrPresentGs;
1094	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrPresentSs;
1095	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_7);
1096	}
1097	}
1098
1099
1100	/**
1101	* Gets the instruction diagnostic for segment attribute granularity failure during
1102	* VM-entry of a nested-guest.
1103	*
1104	* @param iSegReg The segment index (X86_SREG_XXX).
1105	*/
1106	static VMXVDIAG iemVmxGetDiagVmentrySegAttrGran(unsigned iSegReg) RT_NOEXCEPT
1107	{
1108	switch (iSegReg)
1109	{
1110	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrGranCs;
1111	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrGranDs;
1112	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrGranEs;
1113	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrGranFs;
1114	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrGranGs;
1115	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrGranSs;
1116	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_8);
1117	}
1118	}
1119
1120	/**
1121	* Gets the instruction diagnostic for segment attribute DPL/RPL failure during
1122	* VM-entry of a nested-guest.
1123	*
1124	* @param iSegReg The segment index (X86_SREG_XXX).
1125	*/
1126	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDplRpl(unsigned iSegReg) RT_NOEXCEPT
1127	{
1128	switch (iSegReg)
1129	{
1130	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplCs;
1131	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplDs;
1132	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDplRplEs;
1133	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplFs;
1134	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplGs;
1135	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplSs;
1136	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_9);
1137	}
1138	}
1139
1140
1141	/**
1142	* Gets the instruction diagnostic for segment attribute type accessed failure
1143	* during VM-entry of a nested-guest.
1144	*
1145	* @param iSegReg The segment index (X86_SREG_XXX).
1146	*/
1147	static VMXVDIAG iemVmxGetDiagVmentrySegAttrTypeAcc(unsigned iSegReg) RT_NOEXCEPT
1148	{
1149	switch (iSegReg)
1150	{
1151	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccCs;
1152	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccDs;
1153	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccEs;
1154	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccFs;
1155	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccGs;
1156	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccSs;
1157	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_10);
1158	}
1159	}
1160
1161
1162	/**
1163	* Saves the guest control registers, debug registers and some MSRs are part of
1164	* VM-exit.
1165	*
1166	* @param pVCpu The cross context virtual CPU structure.
1167	*/
1168	static void iemVmxVmexitSaveGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1169	{
1170	/*
1171	* Saves the guest control registers, debug registers and some MSRs.
1172	* See Intel spec. 27.3.1 "Saving Control Registers, Debug Registers and MSRs".
1173	*/
1174	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1175
1176	/* Save control registers. */
1177	pVmcs->u64GuestCr0.u = pVCpu->cpum.GstCtx.cr0;
1178	pVmcs->u64GuestCr3.u = pVCpu->cpum.GstCtx.cr3;
1179	pVmcs->u64GuestCr4.u = pVCpu->cpum.GstCtx.cr4;
1180
1181	/* Save SYSENTER CS, ESP, EIP. */
1182	pVmcs->u32GuestSysenterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1183	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1184	{
1185	pVmcs->u64GuestSysenterEsp.u = pVCpu->cpum.GstCtx.SysEnter.esp;
1186	pVmcs->u64GuestSysenterEip.u = pVCpu->cpum.GstCtx.SysEnter.eip;
1187	}
1188	else
1189	{
1190	pVmcs->u64GuestSysenterEsp.s.Lo = pVCpu->cpum.GstCtx.SysEnter.esp;
1191	pVmcs->u64GuestSysenterEip.s.Lo = pVCpu->cpum.GstCtx.SysEnter.eip;
1192	}
1193
1194	/* Save debug registers (DR7 and IA32_DEBUGCTL MSR). */
1195	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_DEBUG)
1196	{
1197	pVmcs->u64GuestDr7.u = pVCpu->cpum.GstCtx.dr[7];
1198	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1199	}
1200
1201	/* Save PAT MSR. */
1202	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PAT_MSR)
1203	pVmcs->u64GuestPatMsr.u = pVCpu->cpum.GstCtx.msrPAT;
1204
1205	/* Save EFER MSR. */
1206	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_EFER_MSR)
1207	pVmcs->u64GuestEferMsr.u = pVCpu->cpum.GstCtx.msrEFER;
1208
1209	/* We don't support clearing IA32_BNDCFGS MSR yet. */
1210	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_CLEAR_BNDCFGS_MSR));
1211
1212	/* Nothing to do for SMBASE register - We don't support SMM yet. */
1213	}
1214
1215
1216	/**
1217	* Saves the guest force-flags in preparation of entering the nested-guest.
1218	*
1219	* @param pVCpu The cross context virtual CPU structure.
1220	*/
1221	static void iemVmxVmentrySaveNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1222	{
1223	/* We shouldn't be called multiple times during VM-entry. */
1224	Assert(pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit == 0);
1225
1226	/* MTF should not be set outside VMX non-root mode. */
1227	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
1228
1229	/*
1230	* Preserve the required force-flags.
1231	*
1232	* We cache and clear force-flags that would affect the execution of the
1233	* nested-guest. Cached flags are then restored while returning to the guest
1234	* if necessary.
1235	*
1236	* - VMCPU_FF_INHIBIT_INTERRUPTS need not be cached as it only affects
1237	* interrupts until the completion of the current VMLAUNCH/VMRESUME
1238	* instruction. Interrupt inhibition for any nested-guest instruction
1239	* is supplied by the guest-interruptibility state VMCS field and will
1240	* be set up as part of loading the guest state. Technically
1241	* blocking-by-STI is possible with VMLAUNCH/VMRESUME but we currently
1242	* disallow it since we can't distinguish it from blocking-by-MovSS
1243	* and no nested-hypervisor we care about uses STI immediately
1244	* followed by VMLAUNCH/VMRESUME.
1245	*
1246	* - VMCPU_FF_BLOCK_NMIS needs to be cached as VM-exits caused before
1247	* successful VM-entry (due to invalid guest-state) need to continue
1248	* blocking NMIs if it was in effect before VM-entry.
1249	*
1250	* - MTF need not be preserved as it's used only in VMX non-root mode and
1251	* is supplied through the VM-execution controls.
1252	*
1253	* The remaining FFs (e.g. timers, APIC updates) can stay in place so that
1254	* we will be able to generate interrupts that may cause VM-exits for
1255	* the nested-guest.
1256	*/
1257	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
1258	}
1259
1260
1261	/**
1262	* Restores the guest force-flags in preparation of exiting the nested-guest.
1263	*
1264	* @param pVCpu The cross context virtual CPU structure.
1265	*/
1266	static void iemVmxVmexitRestoreNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1267	{
1268	/** @todo r=bird: why aren't we clearing the nested guest flags first here?
1269	* If there is some other code doing that already, it would be great
1270	* to point to it here... */
1271	pVCpu->cpum.GstCtx.eflags.uBoth \|= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
1272	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = 0;
1273	}
1274
1275
1276	/**
1277	* Performs the VMX transition to/from VMX non-root mode.
1278	*
1279	* @param pVCpu The cross context virtual CPU structure.
1280	*/
1281	static int iemVmxTransition(PVMCPUCC pVCpu) RT_NOEXCEPT
1282	{
1283	/*
1284	* Inform PGM about paging mode changes.
1285	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
1286	* see comment in iemMemPageTranslateAndCheckAccess().
1287	*/
1288	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
1289	true /* fForce */);
1290	if (RT_SUCCESS(rc))
1291	{ /* likely */ }
1292	else
1293	return rc;
1294
1295	/* Invalidate IEM TLBs now that we've forced a PGM mode change. */
1296	IEMTlbInvalidateAll(pVCpu);
1297
1298	/* Inform CPUM (recompiler), can later be removed. */
1299	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
1300
1301	/* Re-initialize IEM cache/state after the drastic mode switch. */
1302	iemReInitExec(pVCpu);
1303	return rc;
1304	}
1305
1306
1307	/**
1308	* Calculates the current VMX-preemption timer value.
1309	*
1310	* @returns The current VMX-preemption timer value.
1311	* @param pVCpu The cross context virtual CPU structure.
1312	*/
1313	static uint32_t iemVmxCalcPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
1314	{
1315	/*
1316	* Assume the following:
1317	* PreemptTimerShift = 5
1318	* VmcsPreemptTimer = 2 (i.e. need to decrement by 1 every 2 * RT_BIT(5) = 20000 TSC ticks)
1319	* EntryTick = 50000 (TSC at time of VM-entry)
1320	*
1321	* CurTick Delta PreemptTimerVal
1322	* ----------------------------------
1323	* 60000 10000 2
1324	* 80000 30000 1
1325	* 90000 40000 0 -> VM-exit.
1326	*
1327	* If Delta >= VmcsPreemptTimer * RT_BIT(PreemptTimerShift) cause a VMX-preemption timer VM-exit.
1328	* The saved VMX-preemption timer value is calculated as follows:
1329	* PreemptTimerVal = VmcsPreemptTimer - (Delta / (VmcsPreemptTimer * RT_BIT(PreemptTimerShift)))
1330	* E.g.:
1331	* Delta = 10000
1332	* Tmp = 10000 / (2 * 10000) = 0.5
1333	* NewPt = 2 - 0.5 = 2
1334	* Delta = 30000
1335	* Tmp = 30000 / (2 * 10000) = 1.5
1336	* NewPt = 2 - 1.5 = 1
1337	* Delta = 40000
1338	* Tmp = 40000 / 20000 = 2
1339	* NewPt = 2 - 2 = 0
1340	*/
1341	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1342	uint32_t const uVmcsPreemptVal = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer;
1343	if (uVmcsPreemptVal > 0)
1344	{
1345	uint64_t const uCurTick = TMCpuTickGetNoCheck(pVCpu);
1346	uint64_t const uEntryTick = pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick;
1347	uint64_t const uDelta = uCurTick - uEntryTick;
1348	uint32_t const uPreemptTimer = uVmcsPreemptVal
1349	- ASMDivU64ByU32RetU32(uDelta, uVmcsPreemptVal * RT_BIT(VMX_V_PREEMPT_TIMER_SHIFT));
1350	return uPreemptTimer;
1351	}
1352	return 0;
1353	}
1354
1355
1356	/**
1357	* Saves guest segment registers, GDTR, IDTR, LDTR, TR as part of VM-exit.
1358	*
1359	* @param pVCpu The cross context virtual CPU structure.
1360	*/
1361	static void iemVmxVmexitSaveGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1362	{
1363	/*
1364	* Save guest segment registers, GDTR, IDTR, LDTR, TR.
1365	* See Intel spec 27.3.2 "Saving Segment Registers and Descriptor-Table Registers".
1366	*/
1367	/* CS, SS, ES, DS, FS, GS. */
1368	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1369	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1370	{
1371	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1372	if (!pSelReg->Attr.n.u1Unusable)
1373	iemVmxVmcsSetGuestSegReg(pVmcs, iSegReg, pSelReg);
1374	else
1375	{
1376	/*
1377	* For unusable segments the attributes are undefined except for CS and SS.
1378	* For the rest we don't bother preserving anything but the unusable bit.
1379	*/
1380	switch (iSegReg)
1381	{
1382	case X86_SREG_CS:
1383	pVmcs->GuestCs = pSelReg->Sel;
1384	pVmcs->u64GuestCsBase.u = pSelReg->u64Base;
1385	pVmcs->u32GuestCsLimit = pSelReg->u32Limit;
1386	pVmcs->u32GuestCsAttr = pSelReg->Attr.u & ( X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1387	\| X86DESCATTR_UNUSABLE);
1388	break;
1389
1390	case X86_SREG_SS:
1391	pVmcs->GuestSs = pSelReg->Sel;
1392	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1393	pVmcs->u64GuestSsBase.u &= UINT32_C(0xffffffff);
1394	pVmcs->u32GuestSsAttr = pSelReg->Attr.u & (X86DESCATTR_DPL \| X86DESCATTR_UNUSABLE);
1395	break;
1396
1397	case X86_SREG_DS:
1398	pVmcs->GuestDs = pSelReg->Sel;
1399	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1400	pVmcs->u64GuestDsBase.u &= UINT32_C(0xffffffff);
1401	pVmcs->u32GuestDsAttr = X86DESCATTR_UNUSABLE;
1402	break;
1403
1404	case X86_SREG_ES:
1405	pVmcs->GuestEs = pSelReg->Sel;
1406	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1407	pVmcs->u64GuestEsBase.u &= UINT32_C(0xffffffff);
1408	pVmcs->u32GuestEsAttr = X86DESCATTR_UNUSABLE;
1409	break;
1410
1411	case X86_SREG_FS:
1412	pVmcs->GuestFs = pSelReg->Sel;
1413	pVmcs->u64GuestFsBase.u = pSelReg->u64Base;
1414	pVmcs->u32GuestFsAttr = X86DESCATTR_UNUSABLE;
1415	break;
1416
1417	case X86_SREG_GS:
1418	pVmcs->GuestGs = pSelReg->Sel;
1419	pVmcs->u64GuestGsBase.u = pSelReg->u64Base;
1420	pVmcs->u32GuestGsAttr = X86DESCATTR_UNUSABLE;
1421	break;
1422	}
1423	}
1424	}
1425
1426	/* Segment attribute bits 31:17 and 11:8 MBZ. */
1427	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
1428	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1429	\| X86DESCATTR_UNUSABLE;
1430	/* LDTR. */
1431	{
1432	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.ldtr;
1433	pVmcs->GuestLdtr = pSelReg->Sel;
1434	pVmcs->u64GuestLdtrBase.u = pSelReg->u64Base;
1435	Assert(X86_IS_CANONICAL(pSelReg->u64Base));
1436	pVmcs->u32GuestLdtrLimit = pSelReg->u32Limit;
1437	pVmcs->u32GuestLdtrAttr = pSelReg->Attr.u & fValidAttrMask;
1438	}
1439
1440	/* TR. */
1441	{
1442	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.tr;
1443	pVmcs->GuestTr = pSelReg->Sel;
1444	pVmcs->u64GuestTrBase.u = pSelReg->u64Base;
1445	pVmcs->u32GuestTrLimit = pSelReg->u32Limit;
1446	pVmcs->u32GuestTrAttr = pSelReg->Attr.u & fValidAttrMask;
1447	}
1448
1449	/* GDTR. */
1450	pVmcs->u64GuestGdtrBase.u = pVCpu->cpum.GstCtx.gdtr.pGdt;
1451	pVmcs->u32GuestGdtrLimit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
1452
1453	/* IDTR. */
1454	pVmcs->u64GuestIdtrBase.u = pVCpu->cpum.GstCtx.idtr.pIdt;
1455	pVmcs->u32GuestIdtrLimit = pVCpu->cpum.GstCtx.idtr.cbIdt;
1456	}
1457
1458
1459	/**
1460	* Saves guest non-register state as part of VM-exit.
1461	*
1462	* @param pVCpu The cross context virtual CPU structure.
1463	* @param uExitReason The VM-exit reason.
1464	*/
1465	static void iemVmxVmexitSaveGuestNonRegState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1466	{
1467	/*
1468	* Save guest non-register state.
1469	* See Intel spec. 27.3.4 "Saving Non-Register State".
1470	*/
1471	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1472
1473	/*
1474	* Activity state.
1475	* Most VM-exits will occur in the active state. However, if the first instruction
1476	* following the VM-entry is a HLT instruction, and the MTF VM-execution control is set,
1477	* the VM-exit will be from the HLT activity state.
1478	*
1479	* See Intel spec. 25.5.2 "Monitor Trap Flag".
1480	*/
1481	/** @todo NSTVMX: Does triple-fault VM-exit reflect a shutdown activity state or
1482	* not? */
1483	EMSTATE const enmActivityState = EMGetState(pVCpu);
1484	switch (enmActivityState)
1485	{
1486	case EMSTATE_HALTED: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_HLT; break;
1487	default: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_ACTIVE; break;
1488	}
1489
1490	/*
1491	* Interruptibility-state.
1492	*/
1493	/* NMI. */
1494	pVmcs->u32GuestIntrState = 0;
1495	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
1496	{
1497	if (pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking)
1498	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1499	}
1500	else
1501	{
1502	if (CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx))
1503	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1504	}
1505
1506	/* Blocking-by-STI or blocking-by-MovSS. */
1507	uint32_t fInhibitShw;
1508	if (!CPUMIsInInterruptShadowWithUpdateEx(&pVCpu->cpum.GstCtx, &fInhibitShw))
1509	{ /* probable */}
1510	else
1511	{
1512	if (pVCpu->cpum.GstCtx.rip == pVCpu->cpum.GstCtx.uRipInhibitInt)
1513	{
1514	/*
1515	* We must ensure only one of these bits is set.
1516	* Our emulation can have both set (perhaps because AMD doesn't distinguish
1517	* between the two?). Hence, the 'else' with blocking-by-MovSS taking priority
1518	* since it blocks more. Nested Ubuntu 22.04.2 running inside a Hyper-V enabled
1519	* Windows Server 2008 R2 guest runs into this issue.
1520	*
1521	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
1522	*/
1523	if (fInhibitShw & CPUMCTX_INHIBIT_SHADOW_SS)
1524	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS;
1525	else
1526	{
1527	Assert(fInhibitShw & CPUMCTX_INHIBIT_SHADOW_STI);
1528	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_STI;
1529	}
1530	}
1531	}
1532	/* Nothing to do for SMI/enclave. We don't support enclaves or SMM yet. */
1533
1534	/*
1535	* Pending debug exceptions.
1536	*
1537	* For VM-exits where it is not applicable, we can safely zero out the field.
1538	* For VM-exits where it is applicable, it's expected to be updated by the caller already.
1539	*/
1540	if ( uExitReason != VMX_EXIT_INIT_SIGNAL
1541	&& uExitReason != VMX_EXIT_SMI
1542	&& uExitReason != VMX_EXIT_ERR_MACHINE_CHECK
1543	&& !VMXIsVmexitTrapLike(uExitReason))
1544	{
1545	/** @todo NSTVMX: also must exclude VM-exits caused by debug exceptions when
1546	* block-by-MovSS is in effect. */
1547	pVmcs->u64GuestPendingDbgXcpts.u = 0;
1548	}
1549
1550	/*
1551	* Save the VMX-preemption timer value back into the VMCS if the feature is enabled.
1552	*
1553	* For VMX-preemption timer VM-exits, we should have already written back 0 if the
1554	* feature is supported back into the VMCS, and thus there is nothing further to do here.
1555	*/
1556	if ( uExitReason != VMX_EXIT_PREEMPT_TIMER
1557	&& (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
1558	pVmcs->u32PreemptTimer = iemVmxCalcPreemptTimer(pVCpu);
1559
1560	/*
1561	* Save the guest PAE PDPTEs.
1562	*/
1563	if ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
1564	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
1565	{
1566	/*
1567	* Without EPT or when the nested-guest is not using PAE paging, the values saved
1568	* in the VMCS during VM-exit are undefined. We zero them here for consistency.
1569	*/
1570	pVmcs->u64GuestPdpte0.u = 0;
1571	pVmcs->u64GuestPdpte1.u = 0;
1572	pVmcs->u64GuestPdpte2.u = 0;
1573	pVmcs->u64GuestPdpte3.u = 0;
1574	}
1575	else
1576	{
1577	/*
1578	* With EPT and when the nested-guest is using PAE paging, we update the PDPTEs from
1579	* the nested-guest CPU context. Both IEM (Mov CRx) and hardware-assisted execution
1580	* of the nested-guest is expected to have updated them.
1581	*/
1582	pVmcs->u64GuestPdpte0.u = pVCpu->cpum.GstCtx.aPaePdpes[0].u;
1583	pVmcs->u64GuestPdpte1.u = pVCpu->cpum.GstCtx.aPaePdpes[1].u;
1584	pVmcs->u64GuestPdpte2.u = pVCpu->cpum.GstCtx.aPaePdpes[2].u;
1585	pVmcs->u64GuestPdpte3.u = pVCpu->cpum.GstCtx.aPaePdpes[3].u;
1586	}
1587
1588	/* Clear PGM's copy of the EPT pointer for added safety. */
1589	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
1590	PGMSetGuestEptPtr(pVCpu, 0 /* uEptPtr */);
1591	}
1592
1593
1594	/**
1595	* Saves the guest-state as part of VM-exit.
1596	*
1597	* @returns VBox status code.
1598	* @param pVCpu The cross context virtual CPU structure.
1599	* @param uExitReason The VM-exit reason.
1600	*/
1601	static void iemVmxVmexitSaveGuestState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1602	{
1603	iemVmxVmexitSaveGuestControlRegsMsrs(pVCpu);
1604	iemVmxVmexitSaveGuestSegRegs(pVCpu);
1605
1606	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRip.u = pVCpu->cpum.GstCtx.rip;
1607	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRsp.u = pVCpu->cpum.GstCtx.rsp;
1608	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRFlags.u = pVCpu->cpum.GstCtx.rflags.u; /** @todo NSTVMX: Check RFLAGS.RF handling. */
1609
1610	iemVmxVmexitSaveGuestNonRegState(pVCpu, uExitReason);
1611	}
1612
1613
1614	/**
1615	* Saves the guest MSRs into the VM-exit MSR-store area as part of VM-exit.
1616	*
1617	* @returns VBox status code.
1618	* @param pVCpu The cross context virtual CPU structure.
1619	* @param uExitReason The VM-exit reason (for diagnostic purposes).
1620	*/
1621	static int iemVmxVmexitSaveGuestAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1622	{
1623	/*
1624	* Save guest MSRs.
1625	* See Intel spec. 27.4 "Saving MSRs".
1626	*/
1627	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1628	const char * const pszFailure = "VMX-abort";
1629
1630	/*
1631	* The VM-exit MSR-store area address need not be a valid guest-physical address if the
1632	* VM-exit MSR-store count is 0. If this is the case, bail early without reading it.
1633	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1634	*/
1635	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrStoreCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea));
1636	if (!cMsrs)
1637	return VINF_SUCCESS;
1638
1639	/*
1640	* Verify the MSR auto-store count. Physical CPUs can behave unpredictably if the count
1641	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1642	* implementation causes a VMX-abort followed by a triple-fault.
1643	*/
1644	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1645	if (fIsMsrCountValid)
1646	{ /* likely */ }
1647	else
1648	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreCount);
1649
1650	/*
1651	* Optimization if the nested hypervisor is using the same guest-physical page for both
1652	* the VM-entry MSR-load area as well as the VM-exit MSR store area.
1653	*/
1654	PVMXAUTOMSR pMsrArea;
1655	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
1656	RTGCPHYS const GCPhysVmExitMsrStoreArea = pVmcs->u64AddrExitMsrStore.u;
1657	if (GCPhysVmEntryMsrLoadArea == GCPhysVmExitMsrStoreArea)
1658	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea;
1659	else
1660	{
1661	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea[0],
1662	GCPhysVmExitMsrStoreArea, cMsrs * sizeof(VMXAUTOMSR));
1663	if (RT_SUCCESS(rc))
1664	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea;
1665	else
1666	{
1667	AssertMsgFailed(("VM-exit: Failed to read MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1668	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrReadPhys);
1669	}
1670	}
1671
1672	/*
1673	* Update VM-exit MSR store area.
1674	*/
1675	PVMXAUTOMSR pMsr = pMsrArea;
1676	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1677	{
1678	if ( !pMsr->u32Reserved
1679	&& pMsr->u32Msr != MSR_IA32_SMBASE
1680	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1681	{
1682	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pMsr->u32Msr, &pMsr->u64Value);
1683	if (rcStrict == VINF_SUCCESS)
1684	continue;
1685
1686	/*
1687	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
1688	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
1689	* recording the MSR index in the auxiliary info. field and indicated further by our
1690	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
1691	* if possible, or come up with a better, generic solution.
1692	*/
1693	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1694	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_READ
1695	? kVmxVDiag_Vmexit_MsrStoreRing3
1696	: kVmxVDiag_Vmexit_MsrStore;
1697	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
1698	}
1699	else
1700	{
1701	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1702	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreRsvd);
1703	}
1704	}
1705
1706	/*
1707	* Commit the VM-exit MSR store are to guest memory.
1708	*/
1709	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmExitMsrStoreArea, pMsrArea, cMsrs * sizeof(VMXAUTOMSR));
1710	if (RT_SUCCESS(rc))
1711	return VINF_SUCCESS;
1712
1713	NOREF(uExitReason);
1714	NOREF(pszFailure);
1715
1716	AssertMsgFailed(("VM-exit: Failed to write MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1717	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrWritePhys);
1718	}
1719
1720
1721	/**
1722	* Performs a VMX abort (due to an fatal error during VM-exit).
1723	*
1724	* @returns Strict VBox status code.
1725	* @param pVCpu The cross context virtual CPU structure.
1726	* @param enmAbort The VMX abort reason.
1727	*/
1728	static VBOXSTRICTRC iemVmxAbort(PVMCPUCC pVCpu, VMXABORT enmAbort) RT_NOEXCEPT
1729	{
1730	/*
1731	* Perform the VMX abort.
1732	* See Intel spec. 27.7 "VMX Aborts".
1733	*/
1734	LogFunc(("enmAbort=%u (%s) -> RESET\n", enmAbort, VMXGetAbortDesc(enmAbort)));
1735
1736	/* We don't support SMX yet. */
1737	pVCpu->cpum.GstCtx.hwvirt.vmx.enmAbort = enmAbort;
1738	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1739	{
1740	RTGCPHYS const GCPhysVmcs = IEM_VMX_GET_CURRENT_VMCS(pVCpu);
1741	uint32_t const offVmxAbort = RT_UOFFSETOF(VMXVVMCS, enmVmxAbort);
1742	PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + offVmxAbort, &enmAbort, sizeof(enmAbort));
1743	}
1744
1745	return VINF_EM_TRIPLE_FAULT;
1746	}
1747
1748
1749	/**
1750	* Loads host control registers, debug registers and MSRs as part of VM-exit.
1751	*
1752	* @param pVCpu The cross context virtual CPU structure.
1753	*/
1754	static void iemVmxVmexitLoadHostControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1755	{
1756	/*
1757	* Load host control registers, debug registers and MSRs.
1758	* See Intel spec. 27.5.1 "Loading Host Control Registers, Debug Registers, MSRs".
1759	*/
1760	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1761	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1762
1763	/* CR0. */
1764	{
1765	/* Bits 63:32, 28:19, 17, 15:6, ET, CD, NW and CR0 fixed bits are not modified. */
1766	uint64_t const fCr0IgnMask = VMX_EXIT_HOST_CR0_IGNORE_MASK;
1767	uint64_t const uHostCr0 = pVmcs->u64HostCr0.u;
1768	uint64_t const uGuestCr0 = pVCpu->cpum.GstCtx.cr0;
1769	uint64_t const uValidHostCr0 = (uHostCr0 & ~fCr0IgnMask) \| (uGuestCr0 & fCr0IgnMask);
1770
1771	/* Verify we have not modified CR0 fixed bits in VMX operation. */
1772	#ifdef VBOX_STRICT
1773	uint64_t const uCr0Mb1 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
1774	bool const fUx = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
1775	AssertMsg( (uValidHostCr0 & uCr0Mb1) == uCr0Mb1
1776	&& (uValidHostCr0 & ~VMX_V_CR0_FIXED1) == 0,
1777	("host=%#RX64 guest=%#RX64 mb1=%#RX64 valid_host_cr0=%#RX64 fUx=%RTbool\n",
1778	uHostCr0, uGuestCr0, uCr0Mb1, uValidHostCr0, fUx));
1779	#endif
1780	Assert(!(uValidHostCr0 >> 32));
1781	CPUMSetGuestCR0(pVCpu, uValidHostCr0);
1782	}
1783
1784	/* CR4. */
1785	{
1786	/* CR4 fixed bits are not modified. */
1787	uint64_t const uCr4Mb1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
1788	uint64_t const uCr4Mb0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
1789	uint64_t const uHostCr4 = pVmcs->u64HostCr4.u;
1790	uint64_t uValidHostCr4 = (uHostCr4 & uCr4Mb0) \| uCr4Mb1;
1791	if (fHostInLongMode)
1792	uValidHostCr4 \|= X86_CR4_PAE;
1793	else
1794	uValidHostCr4 &= ~(uint64_t)X86_CR4_PCIDE;
1795
1796	/* Verify we have not modified CR4 fixed bits in VMX non-root operation. */
1797	AssertMsg( (uValidHostCr4 & uCr4Mb1) == uCr4Mb1
1798	&& (uValidHostCr4 & ~uCr4Mb0) == 0,
1799	("host=%#RX64 guest=%#RX64, uCr4Mb1=%#RX64 uCr4Mb0=%#RX64 valid_host_cr4=%#RX64\n",
1800	uHostCr4, pVCpu->cpum.GstCtx.cr4, uCr4Mb1, uCr4Mb0, uValidHostCr4));
1801	CPUMSetGuestCR4(pVCpu, uValidHostCr4);
1802	}
1803
1804	/* CR3 (host value validated while checking host-state during VM-entry). */
1805	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64HostCr3.u;
1806
1807	/* DR7. */
1808	pVCpu->cpum.GstCtx.dr[7] = X86_DR7_INIT_VAL;
1809
1810	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1811
1812	/* Save SYSENTER CS, ESP, EIP (host value validated while checking host-state during VM-entry). */
1813	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64HostSysenterEip.u;
1814	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64HostSysenterEsp.u;
1815	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32HostSysenterCs;
1816
1817	/* FS, GS bases are loaded later while we load host segment registers. */
1818
1819	/* EFER MSR (host value validated while checking host-state during VM-entry). */
1820	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
1821	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64HostEferMsr.u;
1822	else if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1823	{
1824	if (fHostInLongMode)
1825	pVCpu->cpum.GstCtx.msrEFER \|= (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1826	else
1827	pVCpu->cpum.GstCtx.msrEFER &= ~(MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1828	}
1829
1830	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
1831
1832	/* PAT MSR (host value is validated while checking host-state during VM-entry). */
1833	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
1834	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64HostPatMsr.u;
1835
1836	/* We don't support IA32_BNDCFGS MSR yet. */
1837	}
1838
1839
1840	/**
1841	* Loads host segment registers, GDTR, IDTR, LDTR and TR as part of VM-exit.
1842	*
1843	* @param pVCpu The cross context virtual CPU structure.
1844	*/
1845	static void iemVmxVmexitLoadHostSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1846	{
1847	/*
1848	* Load host segment registers, GDTR, IDTR, LDTR and TR.
1849	* See Intel spec. 27.5.2 "Loading Host Segment and Descriptor-Table Registers".
1850	*
1851	* Warning! Be careful to not touch fields that are reserved by VT-x,
1852	* e.g. segment limit high bits stored in segment attributes (in bits 11:8).
1853	*/
1854	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1855	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1856
1857	/* CS, SS, ES, DS, FS, GS. */
1858	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1859	{
1860	RTSEL const HostSel = iemVmxVmcsGetHostSelReg(pVmcs, iSegReg);
1861	bool const fUnusable = RT_BOOL(HostSel == 0);
1862	PCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1863
1864	/* Selector. */
1865	pSelReg->Sel = HostSel;
1866	pSelReg->ValidSel = HostSel;
1867	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
1868
1869	/* Limit. */
1870	pSelReg->u32Limit = 0xffffffff;
1871
1872	/* Base. */
1873	pSelReg->u64Base = 0;
1874
1875	/* Attributes. */
1876	if (iSegReg == X86_SREG_CS)
1877	{
1878	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED;
1879	pSelReg->Attr.n.u1DescType = 1;
1880	pSelReg->Attr.n.u2Dpl = 0;
1881	pSelReg->Attr.n.u1Present = 1;
1882	pSelReg->Attr.n.u1Long = fHostInLongMode;
1883	pSelReg->Attr.n.u1DefBig = !fHostInLongMode;
1884	pSelReg->Attr.n.u1Granularity = 1;
1885	Assert(!pSelReg->Attr.n.u1Unusable);
1886	Assert(!fUnusable);
1887	}
1888	else
1889	{
1890	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED;
1891	pSelReg->Attr.n.u1DescType = 1;
1892	pSelReg->Attr.n.u2Dpl = 0;
1893	pSelReg->Attr.n.u1Present = 1;
1894	pSelReg->Attr.n.u1DefBig = 1;
1895	pSelReg->Attr.n.u1Granularity = 1;
1896	pSelReg->Attr.n.u1Unusable = fUnusable;
1897	}
1898	}
1899
1900	/* FS base. */
1901	if ( !pVCpu->cpum.GstCtx.fs.Attr.n.u1Unusable
1902	\|\| fHostInLongMode)
1903	{
1904	Assert(X86_IS_CANONICAL(pVmcs->u64HostFsBase.u));
1905	pVCpu->cpum.GstCtx.fs.u64Base = pVmcs->u64HostFsBase.u;
1906	}
1907
1908	/* GS base. */
1909	if ( !pVCpu->cpum.GstCtx.gs.Attr.n.u1Unusable
1910	\|\| fHostInLongMode)
1911	{
1912	Assert(X86_IS_CANONICAL(pVmcs->u64HostGsBase.u));
1913	pVCpu->cpum.GstCtx.gs.u64Base = pVmcs->u64HostGsBase.u;
1914	}
1915
1916	/* TR. */
1917	Assert(X86_IS_CANONICAL(pVmcs->u64HostTrBase.u));
1918	Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1Unusable);
1919	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->HostTr;
1920	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->HostTr;
1921	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
1922	pVCpu->cpum.GstCtx.tr.u32Limit = X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN;
1923	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64HostTrBase.u;
1924	pVCpu->cpum.GstCtx.tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1925	pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType = 0;
1926	pVCpu->cpum.GstCtx.tr.Attr.n.u2Dpl = 0;
1927	pVCpu->cpum.GstCtx.tr.Attr.n.u1Present = 1;
1928	pVCpu->cpum.GstCtx.tr.Attr.n.u1DefBig = 0;
1929	pVCpu->cpum.GstCtx.tr.Attr.n.u1Granularity = 0;
1930
1931	/* LDTR (Warning! do not touch the base and limits here). */
1932	pVCpu->cpum.GstCtx.ldtr.Sel = 0;
1933	pVCpu->cpum.GstCtx.ldtr.ValidSel = 0;
1934	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
1935	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
1936
1937	/* GDTR. */
1938	Assert(X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u));
1939	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64HostGdtrBase.u;
1940	pVCpu->cpum.GstCtx.gdtr.cbGdt = 0xffff;
1941
1942	/* IDTR.*/
1943	Assert(X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u));
1944	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64HostIdtrBase.u;
1945	pVCpu->cpum.GstCtx.idtr.cbIdt = 0xffff;
1946	}
1947
1948
1949	/**
1950	* Loads the host MSRs from the VM-exit MSR-load area as part of VM-exit.
1951	*
1952	* @returns VBox status code.
1953	* @param pVCpu The cross context virtual CPU structure.
1954	* @param uExitReason The VMX instruction name (for logging purposes).
1955	*/
1956	static int iemVmxVmexitLoadHostAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1957	{
1958	/*
1959	* Load host MSRs.
1960	* See Intel spec. 27.6 "Loading MSRs".
1961	*/
1962	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1963	const char * const pszFailure = "VMX-abort";
1964
1965	/*
1966	* The VM-exit MSR-load area address need not be a valid guest-physical address if the
1967	* VM-exit MSR load count is 0. If this is the case, bail early without reading it.
1968	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1969	*/
1970	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea));
1971	if (!cMsrs)
1972	return VINF_SUCCESS;
1973
1974	/*
1975	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count
1976	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1977	* implementation causes a VMX-abort followed by a triple-fault.
1978	*/
1979	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1980	if (fIsMsrCountValid)
1981	{ /* likely */ }
1982	else
1983	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadCount);
1984
1985	RTGCPHYS const GCPhysVmExitMsrLoadArea = pVmcs->u64AddrExitMsrLoad.u;
1986	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea[0],
1987	GCPhysVmExitMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
1988	if (RT_SUCCESS(rc))
1989	{
1990	PCVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea;
1991	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1992	{
1993	if ( !pMsr->u32Reserved
1994	&& pMsr->u32Msr != MSR_K8_FS_BASE
1995	&& pMsr->u32Msr != MSR_K8_GS_BASE
1996	&& pMsr->u32Msr != MSR_K6_EFER
1997	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
1998	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1999	{
2000	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
2001	if (rcStrict == VINF_SUCCESS)
2002	continue;
2003
2004	/*
2005	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
2006	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
2007	* recording the MSR index in the auxiliary info. field and indicated further by our
2008	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
2009	* if possible, or come up with a better, generic solution.
2010	*/
2011	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
2012	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
2013	? kVmxVDiag_Vmexit_MsrLoadRing3
2014	: kVmxVDiag_Vmexit_MsrLoad;
2015	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
2016	}
2017	else
2018	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadRsvd);
2019	}
2020	}
2021	else
2022	{
2023	AssertMsgFailed(("VM-exit: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrLoadArea, rc));
2024	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadPtrReadPhys);
2025	}
2026
2027	NOREF(uExitReason);
2028	NOREF(pszFailure);
2029	return VINF_SUCCESS;
2030	}
2031
2032
2033	/**
2034	* Loads the host state as part of VM-exit.
2035	*
2036	* @returns Strict VBox status code.
2037	* @param pVCpu The cross context virtual CPU structure.
2038	* @param uExitReason The VM-exit reason (for logging purposes).
2039	*/
2040	static VBOXSTRICTRC iemVmxVmexitLoadHostState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
2041	{
2042	/*
2043	* Load host state.
2044	* See Intel spec. 27.5 "Loading Host State".
2045	*/
2046	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2047	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2048
2049	/* We cannot return from a long-mode guest to a host that is not in long mode. */
2050	if ( CPUMIsGuestInLongMode(pVCpu)
2051	&& !fHostInLongMode)
2052	{
2053	Log(("VM-exit from long-mode guest to host not in long-mode -> VMX-Abort\n"));
2054	return iemVmxAbort(pVCpu, VMXABORT_HOST_NOT_IN_LONG_MODE);
2055	}
2056
2057	/*
2058	* Check host PAE PDPTEs prior to loading the host state.
2059	* See Intel spec. 26.5.4 "Checking and Loading Host Page-Directory-Pointer-Table Entries".
2060	*/
2061	if ( (pVmcs->u64HostCr4.u & X86_CR4_PAE)
2062	&& !fHostInLongMode
2063	&& ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
2064	\|\| pVmcs->u64HostCr3.u != pVCpu->cpum.GstCtx.cr3))
2065	{
2066	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64HostCr3.u);
2067	if (RT_SUCCESS(rc))
2068	{ /* likely*/ }
2069	else
2070	{
2071	IEM_VMX_VMEXIT_FAILED(pVCpu, uExitReason, "VMX-abort", kVmxVDiag_Vmexit_HostPdpte);
2072	return iemVmxAbort(pVCpu, VMXBOART_HOST_PDPTE);
2073	}
2074	}
2075
2076	iemVmxVmexitLoadHostControlRegsMsrs(pVCpu);
2077	iemVmxVmexitLoadHostSegRegs(pVCpu);
2078
2079	/*
2080	* Load host RIP, RSP and RFLAGS.
2081	* See Intel spec. 27.5.3 "Loading Host RIP, RSP and RFLAGS"
2082	*/
2083	pVCpu->cpum.GstCtx.rip = pVmcs->u64HostRip.u;
2084	pVCpu->cpum.GstCtx.rsp = pVmcs->u64HostRsp.u;
2085	pVCpu->cpum.GstCtx.rflags.u = X86_EFL_1;
2086
2087	/* Clear address range monitoring. */
2088	EMMonitorWaitClear(pVCpu);
2089
2090	/* Perform the VMX transition (PGM updates). */
2091	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu);
2092	if (rcStrict == VINF_SUCCESS)
2093	{ /* likely */ }
2094	else if (RT_SUCCESS(rcStrict))
2095	{
2096	Log3(("VM-exit: iemVmxTransition returns %Rrc (uExitReason=%u) -> Setting passup status\n", VBOXSTRICTRC_VAL(rcStrict),
2097	uExitReason));
2098	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
2099	}
2100	else
2101	{
2102	Log3(("VM-exit: iemVmxTransition failed! rc=%Rrc (uExitReason=%u)\n", VBOXSTRICTRC_VAL(rcStrict), uExitReason));
2103	return VBOXSTRICTRC_VAL(rcStrict);
2104	}
2105
2106	Assert(rcStrict == VINF_SUCCESS);
2107
2108	/* Load MSRs from the VM-exit auto-load MSR area. */
2109	int rc = iemVmxVmexitLoadHostAutoMsrs(pVCpu, uExitReason);
2110	if (RT_FAILURE(rc))
2111	{
2112	Log(("VM-exit failed while loading host MSRs -> VMX-Abort\n"));
2113	return iemVmxAbort(pVCpu, VMXABORT_LOAD_HOST_MSR);
2114	}
2115	return VINF_SUCCESS;
2116	}
2117
2118
2119	/**
2120	* Gets VM-exit instruction information along with any displacement for an
2121	* instruction VM-exit.
2122	*
2123	* @returns The VM-exit instruction information.
2124	* @param pVCpu The cross context virtual CPU structure.
2125	* @param uExitReason The VM-exit reason.
2126	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX).
2127	* @param pGCPtrDisp Where to store the displacement field. Optional, can be
2128	* NULL.
2129	*/
2130	static uint32_t iemVmxGetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, PRTGCPTR pGCPtrDisp) RT_NOEXCEPT
2131	{
2132	RTGCPTR GCPtrDisp;
2133	VMXEXITINSTRINFO ExitInstrInfo;
2134	ExitInstrInfo.u = 0;
2135
2136	/*
2137	* Get and parse the ModR/M byte from our decoded opcodes.
2138	*/
2139	uint8_t bRm;
2140	uint8_t const offModRm = pVCpu->iem.s.offModRm;
2141	IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
2142	if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
2143	{
2144	/*
2145	* ModR/M indicates register addressing.
2146	*
2147	* The primary/secondary register operands are reported in the iReg1 or iReg2
2148	* fields depending on whether it is a read/write form.
2149	*/
2150	uint8_t idxReg1;
2151	uint8_t idxReg2;
2152	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2153	{
2154	idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2155	idxReg2 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2156	}
2157	else
2158	{
2159	idxReg1 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2160	idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2161	}
2162	ExitInstrInfo.All.u2Scaling = 0;
2163	ExitInstrInfo.All.iReg1 = idxReg1;
2164	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2165	ExitInstrInfo.All.fIsRegOperand = 1;
2166	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2167	ExitInstrInfo.All.iSegReg = 0;
2168	ExitInstrInfo.All.iIdxReg = 0;
2169	ExitInstrInfo.All.fIdxRegInvalid = 1;
2170	ExitInstrInfo.All.iBaseReg = 0;
2171	ExitInstrInfo.All.fBaseRegInvalid = 1;
2172	ExitInstrInfo.All.iReg2 = idxReg2;
2173
2174	/* Displacement not applicable for register addressing. */
2175	GCPtrDisp = 0;
2176	}
2177	else
2178	{
2179	/*
2180	* ModR/M indicates memory addressing.
2181	*/
2182	uint8_t uScale = 0;
2183	bool fBaseRegValid = false;
2184	bool fIdxRegValid = false;
2185	uint8_t iBaseReg = 0;
2186	uint8_t iIdxReg = 0;
2187	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
2188	{
2189	/*
2190	* Parse the ModR/M, displacement for 16-bit addressing mode.
2191	* See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
2192	*/
2193	uint16_t u16Disp = 0;
2194	uint8_t const offDisp = offModRm + sizeof(bRm);
2195	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 6)
2196	{
2197	/* Displacement without any registers. */
2198	IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
2199	}
2200	else
2201	{
2202	/* Register (index and base). */
2203	switch (bRm & X86_MODRM_RM_MASK)
2204	{
2205	case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2206	case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2207	case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2208	case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2209	case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2210	case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2211	case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
2212	case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
2213	}
2214
2215	/* Register + displacement. */
2216	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2217	{
2218	case 0: break;
2219	case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
2220	case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
2221	default:
2222	{
2223	/* Register addressing, handled at the beginning. */
2224	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2225	break;
2226	}
2227	}
2228	}
2229
2230	Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
2231	GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
2232	}
2233	else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
2234	{
2235	/*
2236	* Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
2237	* See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
2238	*/
2239	uint32_t u32Disp = 0;
2240	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5)
2241	{
2242	/* Displacement without any registers. */
2243	uint8_t const offDisp = offModRm + sizeof(bRm);
2244	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2245	}
2246	else
2247	{
2248	/* Register (and perhaps scale, index and base). */
2249	uint8_t offDisp = offModRm + sizeof(bRm);
2250	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2251	if (iBaseReg == 4)
2252	{
2253	/* An SIB byte follows the ModR/M byte, parse it. */
2254	uint8_t bSib;
2255	uint8_t const offSib = offModRm + sizeof(bRm);
2256	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2257
2258	/* A displacement may follow SIB, update its offset. */
2259	offDisp += sizeof(bSib);
2260
2261	/* Get the scale. */
2262	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2263
2264	/* Get the index register. */
2265	iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
2266	fIdxRegValid = RT_BOOL(iIdxReg != 4);
2267
2268	/* Get the base register. */
2269	iBaseReg = bSib & X86_SIB_BASE_MASK;
2270	fBaseRegValid = true;
2271	if (iBaseReg == 5)
2272	{
2273	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2274	{
2275	/* Mod is 0 implies a 32-bit displacement with no base. */
2276	fBaseRegValid = false;
2277	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2278	}
2279	else
2280	{
2281	/* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
2282	iBaseReg = X86_GREG_xBP;
2283	}
2284	}
2285	}
2286
2287	/* Register + displacement. */
2288	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2289	{
2290	case 0: /* Handled above */ break;
2291	case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
2292	case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
2293	default:
2294	{
2295	/* Register addressing, handled at the beginning. */
2296	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2297	break;
2298	}
2299	}
2300	}
2301
2302	GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
2303	}
2304	else
2305	{
2306	Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
2307
2308	/*
2309	* Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
2310	* See Intel instruction spec. 2.2 "IA-32e Mode".
2311	*/
2312	uint64_t u64Disp = 0;
2313	bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5);
2314	if (fRipRelativeAddr)
2315	{
2316	/*
2317	* RIP-relative addressing mode.
2318	*
2319	* The displacement is 32-bit signed implying an offset range of +/-2G.
2320	* See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
2321	*/
2322	uint8_t const offDisp = offModRm + sizeof(bRm);
2323	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2324	}
2325	else
2326	{
2327	uint8_t offDisp = offModRm + sizeof(bRm);
2328
2329	/*
2330	* Register (and perhaps scale, index and base).
2331	*
2332	* REX.B extends the most-significant bit of the base register. However, REX.B
2333	* is ignored while determining whether an SIB follows the opcode. Hence, we
2334	* shall OR any REX.B bit -after- inspecting for an SIB byte below.
2335	*
2336	* See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
2337	*/
2338	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2339	if (iBaseReg == 4)
2340	{
2341	/* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
2342	uint8_t bSib;
2343	uint8_t const offSib = offModRm + sizeof(bRm);
2344	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2345
2346	/* Displacement may follow SIB, update its offset. */
2347	offDisp += sizeof(bSib);
2348
2349	/* Get the scale. */
2350	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2351
2352	/* Get the index. */
2353	iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) \| pVCpu->iem.s.uRexIndex;
2354	fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
2355
2356	/* Get the base. */
2357	iBaseReg = (bSib & X86_SIB_BASE_MASK);
2358	fBaseRegValid = true;
2359	if (iBaseReg == 5)
2360	{
2361	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2362	{
2363	/* Mod is 0 implies a signed 32-bit displacement with no base. */
2364	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2365	}
2366	else
2367	{
2368	/* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
2369	iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
2370	}
2371	}
2372	}
2373	iBaseReg \|= pVCpu->iem.s.uRexB;
2374
2375	/* Register + displacement. */
2376	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2377	{
2378	case 0: /* Handled above */ break;
2379	case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
2380	case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
2381	default:
2382	{
2383	/* Register addressing, handled at the beginning. */
2384	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2385	break;
2386	}
2387	}
2388	}
2389
2390	GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
2391	}
2392
2393	/*
2394	* The primary or secondary register operand is reported in iReg2 depending
2395	* on whether the primary operand is in read/write form.
2396	*/
2397	uint8_t idxReg2;
2398	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2399	{
2400	idxReg2 = bRm & X86_MODRM_RM_MASK;
2401	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2402	idxReg2 \|= pVCpu->iem.s.uRexB;
2403	}
2404	else
2405	{
2406	idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
2407	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2408	idxReg2 \|= pVCpu->iem.s.uRexReg;
2409	}
2410	ExitInstrInfo.All.u2Scaling = uScale;
2411	ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
2412	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2413	ExitInstrInfo.All.fIsRegOperand = 0;
2414	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2415	ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
2416	ExitInstrInfo.All.iIdxReg = iIdxReg;
2417	ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
2418	ExitInstrInfo.All.iBaseReg = iBaseReg;
2419	ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
2420	ExitInstrInfo.All.iReg2 = idxReg2;
2421	}
2422
2423	/*
2424	* Handle exceptions to the norm for certain instructions.
2425	* (e.g. some instructions convey an instruction identity in place of iReg2).
2426	*/
2427	switch (uExitReason)
2428	{
2429	case VMX_EXIT_GDTR_IDTR_ACCESS:
2430	{
2431	Assert(VMXINSTRID_IS_VALID(uInstrId));
2432	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2433	ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2434	ExitInstrInfo.GdtIdt.u2Undef0 = 0;
2435	break;
2436	}
2437
2438	case VMX_EXIT_LDTR_TR_ACCESS:
2439	{
2440	Assert(VMXINSTRID_IS_VALID(uInstrId));
2441	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2442	ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2443	ExitInstrInfo.LdtTr.u2Undef0 = 0;
2444	break;
2445	}
2446
2447	case VMX_EXIT_RDRAND:
2448	case VMX_EXIT_RDSEED:
2449	{
2450	Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
2451	break;
2452	}
2453	}
2454
2455	/* Update displacement and return the constructed VM-exit instruction information field. */
2456	if (pGCPtrDisp)
2457	*pGCPtrDisp = GCPtrDisp;
2458
2459	return ExitInstrInfo.u;
2460	}
2461
2462
2463	/**
2464	* VMX VM-exit handler.
2465	*
2466	* @returns Strict VBox status code.
2467	* @retval VINF_VMX_VMEXIT when the VM-exit is successful.
2468	* @retval VINF_EM_TRIPLE_FAULT when VM-exit is unsuccessful and leads to a
2469	* triple-fault.
2470	*
2471	* @param pVCpu The cross context virtual CPU structure.
2472	* @param uExitReason The VM-exit reason.
2473	* @param u64ExitQual The Exit qualification.
2474	*
2475	* @remarks We need not necessarily have completed VM-entry before a VM-exit is
2476	* called. Failures during VM-entry can cause VM-exits as well, so we
2477	* -cannot- assert we're in VMX non-root mode here.
2478	*/
2479	VBOXSTRICTRC iemVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual) RT_NOEXCEPT
2480	{
2481	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2482	RT_NOREF3(pVCpu, uExitReason, u64ExitQual);
2483	AssertMsgFailed(("VM-exit should only be invoked from ring-3 when nested-guest executes only in ring-3!\n"));
2484	return VERR_IEM_IPE_7;
2485	# else
2486	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2487
2488	/* Just count this as an exit and be done with that. */
2489	pVCpu->iem.s.cPotentialExits++;
2490
2491	/*
2492	* Import all the guest-CPU state.
2493	*
2494	* HM on returning to guest execution would have to reset up a whole lot of state
2495	* anyway, (e.g., VM-entry/VM-exit controls) and we do not ever import a part of
2496	* the state and flag reloading the entire state on re-entry. So import the entire
2497	* state here, see HMNotifyVmxNstGstVmexit() for more comments.
2498	*/
2499	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL);
2500
2501	/*
2502	* Ensure VM-entry interruption information valid bit is cleared.
2503	*
2504	* We do it here on every VM-exit so that even premature VM-exits (e.g. those caused
2505	* by invalid-guest state or machine-check exceptions) also clear this bit.
2506	*
2507	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry control fields".
2508	*/
2509	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
2510	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
2511
2512	/*
2513	* Update the VM-exit reason and Exit qualification.
2514	* Other VMCS read-only data fields are expected to be updated by the caller already.
2515	*/
2516	pVmcs->u32RoExitReason = uExitReason;
2517	pVmcs->u64RoExitQual.u = u64ExitQual;
2518
2519	Log2(("vmexit: reason=%u qual=%#RX64 cs:rip=%04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 eflags=%#RX32\n", uExitReason,
2520	pVmcs->u64RoExitQual.u, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
2521	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.eflags.u));
2522
2523	/*
2524	* Update the IDT-vectoring information fields if the VM-exit is triggered during delivery of an event.
2525	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2526	*/
2527	{
2528	uint8_t uVector;
2529	uint32_t fFlags;
2530	uint32_t uErrCode;
2531	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, &uVector, &fFlags, &uErrCode, NULL /* puCr2 */);
2532	if (fInEventDelivery)
2533	{
2534	/*
2535	* A VM-exit is not considered to occur during event delivery when the VM-exit is
2536	* caused by a triple-fault or the original event results in a double-fault that
2537	* causes the VM exit directly (exception bitmap). Therefore, we must not set the
2538	* original event information into the IDT-vectoring information fields.
2539	*
2540	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2541	*/
2542	if ( uExitReason != VMX_EXIT_TRIPLE_FAULT
2543	&& ( uExitReason != VMX_EXIT_XCPT_OR_NMI
2544	\|\| !VMX_EXIT_INT_INFO_IS_XCPT_DF(pVmcs->u32RoExitIntInfo)))
2545	{
2546	uint8_t const uIdtVectoringType = iemVmxGetEventType(uVector, fFlags);
2547	uint8_t const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
2548	uint32_t const uIdtVectoringInfo = RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VECTOR, uVector)
2549	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_TYPE, uIdtVectoringType)
2550	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_ERR_CODE_VALID, fErrCodeValid)
2551	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VALID, 1);
2552	iemVmxVmcsSetIdtVectoringInfo(pVCpu, uIdtVectoringInfo);
2553	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, uErrCode);
2554	Log2(("vmexit: idt_info=%#RX32 idt_err_code=%#RX32 cr2=%#RX64\n", uIdtVectoringInfo, uErrCode,
2555	pVCpu->cpum.GstCtx.cr2));
2556	}
2557	}
2558	}
2559
2560	/* The following VMCS fields should always be zero since we don't support injecting SMIs into a guest. */
2561	Assert(pVmcs->u64RoIoRcx.u == 0);
2562	Assert(pVmcs->u64RoIoRsi.u == 0);
2563	Assert(pVmcs->u64RoIoRdi.u == 0);
2564	Assert(pVmcs->u64RoIoRip.u == 0);
2565
2566	/*
2567	* Save the guest state back into the VMCS.
2568	* We only need to save the state when the VM-entry was successful.
2569	*/
2570	bool const fVmentryFailed = VMX_EXIT_REASON_HAS_ENTRY_FAILED(uExitReason);
2571	if (!fVmentryFailed)
2572	{
2573	/* We should not cause an NMI-window/interrupt-window VM-exit when injecting events as part of VM-entry. */
2574	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
2575	{
2576	Assert(uExitReason != VMX_EXIT_NMI_WINDOW);
2577	Assert(uExitReason != VMX_EXIT_INT_WINDOW);
2578	}
2579
2580	/* For exception or NMI VM-exits, the VM-exit interruption info. field must be valid. */
2581	Assert(uExitReason != VMX_EXIT_XCPT_OR_NMI \|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2582
2583	/* For external interrupts that occur while "acknowledge interrupt on exit" VM-exit is set,
2584	the VM-exit interruption info. field must be valid. */
2585	Assert( uExitReason != VMX_EXIT_EXT_INT
2586	\|\| !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
2587	\|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2588
2589	/*
2590	* If we support storing EFER.LMA into IA32e-mode guest field on VM-exit, we need to do that now.
2591	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry Control".
2592	*
2593	* It is not clear from the Intel spec. if this is done only when VM-entry succeeds.
2594	* If a VM-exit happens before loading guest EFER, we risk restoring the host EFER.LMA
2595	* as guest-CPU state would not been modified. Hence for now, we do this only when
2596	* the VM-entry succeeded.
2597	*/
2598	/** @todo r=ramshankar: Figure out if this bit gets set to host EFER.LMA on real
2599	* hardware when VM-exit fails during VM-entry (e.g. VERR_VMX_INVALID_GUEST_STATE). */
2600	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxExitSaveEferLma)
2601	{
2602	if (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LMA)
2603	pVmcs->u32EntryCtls \|= VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2604	else
2605	pVmcs->u32EntryCtls &= ~VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2606	}
2607
2608	/*
2609	* The rest of the high bits of the VM-exit reason are only relevant when the VM-exit
2610	* occurs in enclave mode/SMM which we don't support yet.
2611	*
2612	* If we ever add support for it, we can pass just the lower bits to the functions
2613	* below, till then an assert should suffice.
2614	*/
2615	Assert(!RT_HI_U16(uExitReason));
2616
2617	/* Save the guest state into the VMCS and restore guest MSRs from the auto-store guest MSR area. */
2618	iemVmxVmexitSaveGuestState(pVCpu, uExitReason);
2619	int rc = iemVmxVmexitSaveGuestAutoMsrs(pVCpu, uExitReason);
2620	if (RT_SUCCESS(rc))
2621	{ /* likely */ }
2622	else
2623	return iemVmxAbort(pVCpu, VMXABORT_SAVE_GUEST_MSRS);
2624
2625	/* Clear any saved NMI-blocking state so we don't assert on next VM-entry (if it was in effect on the previous one). */
2626	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit &= ~CPUMCTX_INHIBIT_NMI;
2627	}
2628	else
2629	{
2630	/* Restore the NMI-blocking state if VM-entry failed due to invalid guest state or while loading MSRs. */
2631	uint32_t const uExitReasonBasic = VMX_EXIT_REASON_BASIC(uExitReason);
2632	if ( uExitReasonBasic == VMX_EXIT_ERR_INVALID_GUEST_STATE
2633	\|\| uExitReasonBasic == VMX_EXIT_ERR_MSR_LOAD)
2634	iemVmxVmexitRestoreNmiBlockingFF(pVCpu);
2635	}
2636
2637	/*
2638	* Stop any running VMX-preemption timer if necessary.
2639	*/
2640	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
2641	CPUMStopGuestVmxPremptTimer(pVCpu);
2642
2643	/*
2644	* Clear the state of "NMI unblocked due to IRET" as otherwise we risk
2645	* reporting a stale state on a subsequent VM-exit. This state will be
2646	* re-established while emulating IRET in VMX non-root mode.
2647	*/
2648	pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
2649
2650	/*
2651	* Clear any pending VMX nested-guest force-flags.
2652	* These force-flags have no effect on (outer) guest execution and will
2653	* be re-evaluated and setup on the next nested-guest VM-entry.
2654	*/
2655	VMCPU_FF_CLEAR_MASK(pVCpu, VMCPU_FF_VMX_ALL_MASK);
2656
2657	/*
2658	* We're no longer in nested-guest execution mode.
2659	*
2660	* It is important to do this prior to loading the host state because
2661	* PGM looks at fInVmxNonRootMode to determine if it needs to perform
2662	* second-level address translation while switching to host CR3.
2663	*/
2664	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = false;
2665
2666	/* Restore the host (outer guest) state. */
2667	VBOXSTRICTRC rcStrict = iemVmxVmexitLoadHostState(pVCpu, uExitReason);
2668	if (RT_SUCCESS(rcStrict))
2669	{
2670	Assert(rcStrict == VINF_SUCCESS);
2671	rcStrict = VINF_VMX_VMEXIT;
2672	}
2673	else
2674	Log(("vmexit: Loading host-state failed. uExitReason=%u rc=%Rrc\n", uExitReason, VBOXSTRICTRC_VAL(rcStrict)));
2675
2676	/*
2677	* Restore non-zero Secondary-processor based VM-execution controls
2678	* when the "activate secondary controls" bit was not set.
2679	*/
2680	if (pVmcs->u32RestoreProcCtls2)
2681	{
2682	Assert(!(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS));
2683	pVmcs->u32ProcCtls2 = pVmcs->u32RestoreProcCtls2;
2684	pVmcs->u32RestoreProcCtls2 = 0;
2685	}
2686
2687	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
2688	{
2689	/* Notify HM that the current VMCS fields have been modified. */
2690	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
2691
2692	/* Notify HM that we've completed the VM-exit. */
2693	HMNotifyVmxNstGstVmexit(pVCpu);
2694	}
2695
2696	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2697	/* Revert any IEM-only nested-guest execution policy, otherwise return rcStrict. */
2698	Log(("vmexit: Disabling IEM-only EM execution policy!\n"));
2699	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2700	if (rcSched != VINF_SUCCESS)
2701	iemSetPassUpStatus(pVCpu, rcSched);
2702	# endif
2703	return rcStrict;
2704	# endif
2705	}
2706
2707
2708	/**
2709	* VMX VM-exit handler for VM-exits due to instruction execution.
2710	*
2711	* This is intended for instructions where the caller provides all the relevant
2712	* VM-exit information.
2713	*
2714	* @returns Strict VBox status code.
2715	* @param pVCpu The cross context virtual CPU structure.
2716	* @param pExitInfo Pointer to the VM-exit information.
2717	*/
2718	static VBOXSTRICTRC iemVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
2719	{
2720	/*
2721	* For instructions where any of the following fields are not applicable:
2722	* - Exit qualification must be cleared.
2723	* - VM-exit instruction info. is undefined.
2724	* - Guest-linear address is undefined.
2725	* - Guest-physical address is undefined.
2726	*
2727	* The VM-exit instruction length is mandatory for all VM-exits that are caused by
2728	* instruction execution. For VM-exits that are not due to instruction execution this
2729	* field is undefined.
2730	*
2731	* In our implementation in IEM, all undefined fields are generally cleared. However,
2732	* if the caller supplies information (from say the physical CPU directly) it is
2733	* then possible that the undefined fields are not cleared.
2734	*
2735	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2736	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
2737	*/
2738	Assert(pExitInfo);
2739	AssertMsg(pExitInfo->uReason <= VMX_EXIT_MAX, ("uReason=%u\n", pExitInfo->uReason));
2740	AssertMsg(pExitInfo->cbInstr >= 1 && pExitInfo->cbInstr <= 15,
2741	("uReason=%u cbInstr=%u\n", pExitInfo->uReason, pExitInfo->cbInstr));
2742
2743	/* Update all the relevant fields from the VM-exit instruction information struct. */
2744	iemVmxVmcsSetExitInstrInfo(pVCpu, pExitInfo->InstrInfo.u);
2745	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
2746	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
2747	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
2748
2749	/* Perform the VM-exit. */
2750	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
2751	}
2752
2753
2754	/**
2755	* VMX VM-exit handler for VM-exits due to instruction execution.
2756	*
2757	* This is intended for instructions that only provide the VM-exit instruction
2758	* length.
2759	*
2760	* @param pVCpu The cross context virtual CPU structure.
2761	* @param uExitReason The VM-exit reason.
2762	* @param cbInstr The instruction length in bytes.
2763	*/
2764	VBOXSTRICTRC iemVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr) RT_NOEXCEPT
2765	{
2766	#ifdef VBOX_STRICT
2767	/*
2768	* To prevent us from shooting ourselves in the foot.
2769	* The follow instructions should convey more than just the instruction length.
2770	*/
2771	switch (uExitReason)
2772	{
2773	case VMX_EXIT_INVEPT:
2774	case VMX_EXIT_INVPCID:
2775	case VMX_EXIT_INVVPID:
2776	case VMX_EXIT_LDTR_TR_ACCESS:
2777	case VMX_EXIT_GDTR_IDTR_ACCESS:
2778	case VMX_EXIT_VMCLEAR:
2779	case VMX_EXIT_VMPTRLD:
2780	case VMX_EXIT_VMPTRST:
2781	case VMX_EXIT_VMREAD:
2782	case VMX_EXIT_VMWRITE:
2783	case VMX_EXIT_VMXON:
2784	case VMX_EXIT_XRSTORS:
2785	case VMX_EXIT_XSAVES:
2786	case VMX_EXIT_RDRAND:
2787	case VMX_EXIT_RDSEED:
2788	case VMX_EXIT_IO_INSTR:
2789	AssertMsgFailedReturn(("Use iemVmxVmexitInstrNeedsInfo for uExitReason=%u\n", uExitReason), VERR_IEM_IPE_5);
2790	break;
2791	}
2792	#endif
2793
2794	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_INSTR_LEN(uExitReason, cbInstr);
2795	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2796	}
2797
2798
2799	/**
2800	* Interface for HM and EM to emulate VM-exit due to a triple-fault.
2801	*
2802	* @returns Strict VBox status code.
2803	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2804	* @thread EMT(pVCpu)
2805	*/
2806	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTripleFault(PVMCPUCC pVCpu)
2807	{
2808	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_TRIPLE_FAULT, 0 /* u64ExitQual */);
2809	Assert(!pVCpu->iem.s.cActiveMappings);
2810	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2811	}
2812
2813
2814	/**
2815	* Interface for HM and EM to emulate VM-exit due to startup-IPI (SIPI).
2816	*
2817	* @returns Strict VBox status code.
2818	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2819	* @param uVector The SIPI vector.
2820	* @thread EMT(pVCpu)
2821	*/
2822	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitStartupIpi(PVMCPUCC pVCpu, uint8_t uVector)
2823	{
2824	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_SIPI, uVector);
2825	Assert(!pVCpu->iem.s.cActiveMappings);
2826	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2827	}
2828
2829
2830	/**
2831	* Interface for HM and EM to emulate a VM-exit.
2832	*
2833	* If a specialized version of a VM-exit handler exists, that must be used instead.
2834	*
2835	* @returns Strict VBox status code.
2836	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2837	* @param uExitReason The VM-exit reason.
2838	* @param u64ExitQual The Exit qualification.
2839	* @thread EMT(pVCpu)
2840	*/
2841	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual)
2842	{
2843	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, uExitReason, u64ExitQual);
2844	Assert(!pVCpu->iem.s.cActiveMappings);
2845	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2846	}
2847
2848
2849	/**
2850	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2851	*
2852	* This is meant to be used for those instructions that VMX provides additional
2853	* decoding information beyond just the instruction length!
2854	*
2855	* @returns Strict VBox status code.
2856	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2857	* @param pExitInfo Pointer to the VM-exit information.
2858	* @thread EMT(pVCpu)
2859	*/
2860	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
2861	{
2862	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
2863	Assert(!pVCpu->iem.s.cActiveMappings);
2864	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2865	}
2866
2867
2868	/**
2869	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2870	*
2871	* This is meant to be used for those instructions that VMX provides only the
2872	* instruction length.
2873	*
2874	* @returns Strict VBox status code.
2875	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2876	* @param pExitInfo Pointer to the VM-exit information.
2877	* @param cbInstr The instruction length in bytes.
2878	* @thread EMT(pVCpu)
2879	*/
2880	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr)
2881	{
2882	VBOXSTRICTRC rcStrict = iemVmxVmexitInstr(pVCpu, uExitReason, cbInstr);
2883	Assert(!pVCpu->iem.s.cActiveMappings);
2884	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2885	}
2886
2887
2888	/**
2889	* VMX VM-exit handler for VM-exits due to instruction execution.
2890	*
2891	* This is intended for instructions that have a ModR/M byte and update the VM-exit
2892	* instruction information and Exit qualification fields.
2893	*
2894	* @param pVCpu The cross context virtual CPU structure.
2895	* @param uExitReason The VM-exit reason.
2896	* @param uInstrid The instruction identity (VMXINSTRID_XXX).
2897	* @param cbInstr The instruction length in bytes.
2898	*
2899	* @remarks Do not use this for INS/OUTS instruction.
2900	*/
2901	VBOXSTRICTRC iemVmxVmexitInstrNeedsInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, uint8_t cbInstr) RT_NOEXCEPT
2902	{
2903	#ifdef VBOX_STRICT
2904	/*
2905	* To prevent us from shooting ourselves in the foot.
2906	* The follow instructions convey specific info that require using their respective handlers.
2907	*/
2908	switch (uExitReason)
2909	{
2910	case VMX_EXIT_INVEPT:
2911	case VMX_EXIT_INVPCID:
2912	case VMX_EXIT_INVVPID:
2913	case VMX_EXIT_LDTR_TR_ACCESS:
2914	case VMX_EXIT_GDTR_IDTR_ACCESS:
2915	case VMX_EXIT_VMCLEAR:
2916	case VMX_EXIT_VMPTRLD:
2917	case VMX_EXIT_VMPTRST:
2918	case VMX_EXIT_VMREAD:
2919	case VMX_EXIT_VMWRITE:
2920	case VMX_EXIT_VMXON:
2921	case VMX_EXIT_XRSTORS:
2922	case VMX_EXIT_XSAVES:
2923	case VMX_EXIT_RDRAND:
2924	case VMX_EXIT_RDSEED:
2925	break;
2926	default:
2927	AssertMsgFailedReturn(("Use instruction-specific handler\n"), VERR_IEM_IPE_5);
2928	break;
2929	}
2930	#endif
2931
2932	/*
2933	* Update the Exit qualification field with displacement bytes.
2934	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2935	*/
2936	/* Construct the VM-exit instruction information. */
2937	RTGCPTR GCPtrDisp;
2938	uint32_t const uInstrInfo = iemVmxGetExitInstrInfo(pVCpu, uExitReason, uInstrId, &GCPtrDisp);
2939
2940	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO(uExitReason, GCPtrDisp, uInstrInfo, cbInstr);
2941	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2942	}
2943
2944
2945	/**
2946	* VMX VM-exit handler for VM-exits due to INVLPG.
2947	*
2948	* @returns Strict VBox status code.
2949	* @param pVCpu The cross context virtual CPU structure.
2950	* @param GCPtrPage The guest-linear address of the page being invalidated.
2951	* @param cbInstr The instruction length in bytes.
2952	*/
2953	VBOXSTRICTRC iemVmxVmexitInstrInvlpg(PVMCPUCC pVCpu, RTGCPTR GCPtrPage, uint8_t cbInstr) RT_NOEXCEPT
2954	{
2955	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_INVLPG, GCPtrPage, cbInstr);
2956	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(ExitInfo.u64Qual));
2957	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2958	}
2959
2960
2961	/**
2962	* VMX VM-exit handler for VM-exits due to LMSW.
2963	*
2964	* @returns Strict VBox status code.
2965	* @param pVCpu The cross context virtual CPU structure.
2966	* @param uGuestCr0 The current guest CR0.
2967	* @param pu16NewMsw The machine-status word specified in LMSW's source
2968	* operand. This will be updated depending on the VMX
2969	* guest/host CR0 mask if LMSW is not intercepted.
2970	* @param GCPtrEffDst The guest-linear address of the source operand in case
2971	* of a memory operand. For register operand, pass
2972	* NIL_RTGCPTR.
2973	* @param cbInstr The instruction length in bytes.
2974	*/
2975	VBOXSTRICTRC iemVmxVmexitInstrLmsw(PVMCPUCC pVCpu, uint32_t uGuestCr0, uint16_t *pu16NewMsw,
2976	RTGCPTR GCPtrEffDst, uint8_t cbInstr) RT_NOEXCEPT
2977	{
2978	Assert(pu16NewMsw);
2979
2980	uint16_t const uNewMsw = *pu16NewMsw;
2981	if (CPUMIsGuestVmxLmswInterceptSet(&pVCpu->cpum.GstCtx, uNewMsw))
2982	{
2983	Log2(("lmsw: Guest intercept -> VM-exit\n"));
2984	bool const fMemOperand = RT_BOOL(GCPtrEffDst != NIL_RTGCPTR);
2985	VMXVEXITINFO ExitInfo
2986	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
2987	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
2988	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_OP, fMemOperand)
2989	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_DATA, uNewMsw)
2990	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_LMSW),
2991	cbInstr);
2992	if (fMemOperand)
2993	{
2994	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(GCPtrEffDst));
2995	ExitInfo.u64GuestLinearAddr = GCPtrEffDst;
2996	}
2997	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2998	}
2999
3000	/*
3001	* If LMSW did not cause a VM-exit, any CR0 bits in the range 0:3 that is set in the
3002	* CR0 guest/host mask must be left unmodified.
3003	*
3004	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3005	*/
3006	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3007	uint32_t const fGstHostLmswMask = fGstHostMask & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3008	*pu16NewMsw = (uGuestCr0 & fGstHostLmswMask) \| (uNewMsw & ~fGstHostLmswMask);
3009
3010	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3011	}
3012
3013
3014	/**
3015	* VMX VM-exit handler for VM-exits due to CLTS.
3016	*
3017	* @returns Strict VBox status code.
3018	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the CLTS instruction did not cause a
3019	* VM-exit but must not modify the guest CR0.TS bit.
3020	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the CLTS instruction did not cause a
3021	* VM-exit and modification to the guest CR0.TS bit is allowed (subject to
3022	* CR0 fixed bits in VMX operation).
3023	* @param pVCpu The cross context virtual CPU structure.
3024	* @param cbInstr The instruction length in bytes.
3025	*/
3026	VBOXSTRICTRC iemVmxVmexitInstrClts(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3027	{
3028	/*
3029	* If CR0.TS is owned by the host:
3030	* - If CR0.TS is set in the read-shadow, we must cause a VM-exit.
3031	* - If CR0.TS is cleared in the read-shadow, no VM-exit is caused and the
3032	* CLTS instruction completes without clearing CR0.TS.
3033	*
3034	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3035	*/
3036	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3037	if (fGstHostMask & X86_CR0_TS)
3038	{
3039	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0ReadShadow.u & X86_CR0_TS)
3040	{
3041	Log2(("clts: Guest intercept -> VM-exit\n"));
3042	VMXVEXITINFO const ExitInfo
3043	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3044	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
3045	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3046	VMX_EXIT_QUAL_CRX_ACCESS_CLTS),
3047	cbInstr);
3048	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3049	}
3050	return VINF_VMX_MODIFIES_BEHAVIOR;
3051	}
3052
3053	/*
3054	* If CR0.TS is not owned by the host, the CLTS instructions operates normally
3055	* and may modify CR0.TS (subject to CR0 fixed bits in VMX operation).
3056	*/
3057	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3058	}
3059
3060
3061	/**
3062	* VMX VM-exit handler for VM-exits due to 'Mov CR0,GReg' and 'Mov CR4,GReg'
3063	* (CR0/CR4 write).
3064	*
3065	* @returns Strict VBox status code.
3066	* @param pVCpu The cross context virtual CPU structure.
3067	* @param iCrReg The control register (either CR0 or CR4).
3068	* @param uGuestCrX The current guest CR0/CR4.
3069	* @param puNewCrX Pointer to the new CR0/CR4 value. Will be updated if no
3070	* VM-exit is caused.
3071	* @param iGReg The general register from which the CR0/CR4 value is being
3072	* loaded.
3073	* @param cbInstr The instruction length in bytes.
3074	*/
3075	VBOXSTRICTRC iemVmxVmexitInstrMovToCr0Cr4(PVMCPUCC pVCpu, uint8_t iCrReg, uint64_t *puNewCrX,
3076	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3077	{
3078	Assert(puNewCrX);
3079	Assert(iCrReg == 0 \|\| iCrReg == 4);
3080	Assert(iGReg < X86_GREG_COUNT);
3081
3082	uint64_t const uNewCrX = *puNewCrX;
3083	if (CPUMIsGuestVmxMovToCr0Cr4InterceptSet(&pVCpu->cpum.GstCtx, iCrReg, uNewCrX))
3084	{
3085	Log2(("mov_Cr_Rd: (CR%u) Guest intercept -> VM-exit\n", iCrReg));
3086	VMXVEXITINFO const ExitInfo
3087	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3088	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, iCrReg)
3089	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3090	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3091	cbInstr);
3092	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3093	}
3094
3095	/*
3096	* If the Mov-to-CR0/CR4 did not cause a VM-exit, any bits owned by the host
3097	* must not be modified the instruction.
3098	*
3099	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3100	*/
3101	uint64_t uGuestCrX;
3102	uint64_t fGstHostMask;
3103	if (iCrReg == 0)
3104	{
3105	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
3106	uGuestCrX = pVCpu->cpum.GstCtx.cr0;
3107	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3108	}
3109	else
3110	{
3111	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
3112	uGuestCrX = pVCpu->cpum.GstCtx.cr4;
3113	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u;
3114	}
3115
3116	puNewCrX = (uGuestCrX & fGstHostMask) \| (puNewCrX & ~fGstHostMask);
3117	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3118	}
3119
3120
3121	/**
3122	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR3' (CR3 read).
3123	*
3124	* @returns VBox strict status code.
3125	* @param pVCpu The cross context virtual CPU structure.
3126	* @param iGReg The general register to which the CR3 value is being stored.
3127	* @param cbInstr The instruction length in bytes.
3128	*/
3129	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr3(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3130	{
3131	Assert(iGReg < X86_GREG_COUNT);
3132	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
3133
3134	/*
3135	* If the CR3-store exiting control is set, we must cause a VM-exit.
3136	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3137	*/
3138	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR3_STORE_EXIT)
3139	{
3140	Log2(("mov_Rd_Cr: (CR3) Guest intercept -> VM-exit\n"));
3141	VMXVEXITINFO const ExitInfo
3142	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3143	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3144	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3145	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3146	cbInstr);
3147	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3148	}
3149	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3150	}
3151
3152
3153	/**
3154	* VMX VM-exit handler for VM-exits due to 'Mov CR3,GReg' (CR3 write).
3155	*
3156	* @returns VBox strict status code.
3157	* @param pVCpu The cross context virtual CPU structure.
3158	* @param uNewCr3 The new CR3 value.
3159	* @param iGReg The general register from which the CR3 value is being
3160	* loaded.
3161	* @param cbInstr The instruction length in bytes.
3162	*/
3163	VBOXSTRICTRC iemVmxVmexitInstrMovToCr3(PVMCPUCC pVCpu, uint64_t uNewCr3, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3164	{
3165	Assert(iGReg < X86_GREG_COUNT);
3166
3167	/*
3168	* If the CR3-load exiting control is set and the new CR3 value does not
3169	* match any of the CR3-target values in the VMCS, we must cause a VM-exit.
3170	*
3171	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3172	*/
3173	if (CPUMIsGuestVmxMovToCr3InterceptSet(pVCpu, uNewCr3))
3174	{
3175	Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
3176	VMXVEXITINFO const ExitInfo
3177	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3178	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3179	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3180	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3181	VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3182	cbInstr);
3183	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3184	}
3185	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3186	}
3187
3188
3189	/**
3190	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR8' (CR8 read).
3191	*
3192	* @returns VBox strict status code.
3193	* @param pVCpu The cross context virtual CPU structure.
3194	* @param iGReg The general register to which the CR8 value is being stored.
3195	* @param cbInstr The instruction length in bytes.
3196	*/
3197	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3198	{
3199	Assert(iGReg < X86_GREG_COUNT);
3200
3201	/*
3202	* If the CR8-store exiting control is set, we must cause a VM-exit.
3203	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3204	*/
3205	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_STORE_EXIT)
3206	{
3207	Log2(("mov_Rd_Cr: (CR8) Guest intercept -> VM-exit\n"));
3208	VMXVEXITINFO const ExitInfo
3209	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3210	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3211	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3212	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3213	cbInstr);
3214	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3215	}
3216	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3217	}
3218
3219
3220	/**
3221	* VMX VM-exit handler for VM-exits due to 'Mov CR8,GReg' (CR8 write).
3222	*
3223	* @returns VBox strict status code.
3224	* @param pVCpu The cross context virtual CPU structure.
3225	* @param iGReg The general register from which the CR8 value is being
3226	* loaded.
3227	* @param cbInstr The instruction length in bytes.
3228	*/
3229	VBOXSTRICTRC iemVmxVmexitInstrMovToCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3230	{
3231	Assert(iGReg < X86_GREG_COUNT);
3232
3233	/*
3234	* If the CR8-load exiting control is set, we must cause a VM-exit.
3235	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3236	*/
3237	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_LOAD_EXIT)
3238	{
3239	Log2(("mov_Cr_Rd: (CR8) Guest intercept -> VM-exit\n"));
3240	VMXVEXITINFO const ExitInfo
3241	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3242	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3243	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3244	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3245	cbInstr);
3246	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3247	}
3248	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3249	}
3250
3251
3252	/**
3253	* VMX VM-exit handler for VM-exits due to 'Mov DRx,GReg' (DRx write) and 'Mov
3254	* GReg,DRx' (DRx read).
3255	*
3256	* @returns VBox strict status code.
3257	* @param pVCpu The cross context virtual CPU structure.
3258	* @param uInstrid The instruction identity (VMXINSTRID_MOV_TO_DRX or
3259	* VMXINSTRID_MOV_FROM_DRX).
3260	* @param iDrReg The debug register being accessed.
3261	* @param iGReg The general register to/from which the DRx value is being
3262	* store/loaded.
3263	* @param cbInstr The instruction length in bytes.
3264	*/
3265	VBOXSTRICTRC iemVmxVmexitInstrMovDrX(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint8_t iDrReg,
3266	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3267	{
3268	Assert(iDrReg <= 7);
3269	Assert(uInstrId == VMXINSTRID_MOV_TO_DRX \|\| uInstrId == VMXINSTRID_MOV_FROM_DRX);
3270	Assert(iGReg < X86_GREG_COUNT);
3271
3272	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_MOV_DR_EXIT)
3273	{
3274	VMXVEXITINFO const ExitInfo
3275	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_DRX,
3276	RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_REGISTER, iDrReg)
3277	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_GENREG, iGReg)
3278	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_DIRECTION,
3279	uInstrId == VMXINSTRID_MOV_TO_DRX
3280	? VMX_EXIT_QUAL_DRX_DIRECTION_WRITE
3281	: VMX_EXIT_QUAL_DRX_DIRECTION_READ),
3282	cbInstr);
3283	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3284	}
3285
3286	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3287	}
3288
3289
3290	/**
3291	* VMX VM-exit handler for VM-exits due to I/O instructions (IN and OUT).
3292	*
3293	* @returns VBox strict status code.
3294	* @param pVCpu The cross context virtual CPU structure.
3295	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_IN or
3296	* VMXINSTRID_IO_OUT).
3297	* @param u16Port The I/O port being accessed.
3298	* @param fImm Whether the I/O port was encoded using an immediate operand
3299	* or the implicit DX register.
3300	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3301	* @param cbInstr The instruction length in bytes.
3302	*/
3303	VBOXSTRICTRC iemVmxVmexitInstrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port,
3304	bool fImm, uint8_t cbAccess, uint8_t cbInstr) RT_NOEXCEPT
3305	{
3306	Assert(uInstrId == VMXINSTRID_IO_IN \|\| uInstrId == VMXINSTRID_IO_OUT);
3307	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3308
3309	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3310	{
3311	VMXVEXITINFO const ExitInfo
3312	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_IO_INSTR,
3313	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3314	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING, fImm)
3315	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port)
3316	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION,
3317	uInstrId == VMXINSTRID_IO_IN
3318	? VMX_EXIT_QUAL_IO_DIRECTION_IN
3319	: VMX_EXIT_QUAL_IO_DIRECTION_OUT),
3320	cbInstr);
3321	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3322	}
3323	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3324	}
3325
3326
3327	/**
3328	* VMX VM-exit handler for VM-exits due to string I/O instructions (INS and OUTS).
3329	*
3330	* @returns VBox strict status code.
3331	* @param pVCpu The cross context virtual CPU structure.
3332	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_INS or
3333	* VMXINSTRID_IO_OUTS).
3334	* @param u16Port The I/O port being accessed.
3335	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3336	* @param fRep Whether the instruction has a REP prefix or not.
3337	* @param ExitInstrInfo The VM-exit instruction info. field.
3338	* @param cbInstr The instruction length in bytes.
3339	*/
3340	VBOXSTRICTRC iemVmxVmexitInstrStrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port, uint8_t cbAccess,
3341	bool fRep, VMXEXITINSTRINFO ExitInstrInfo, uint8_t cbInstr) RT_NOEXCEPT
3342	{
3343	Assert(uInstrId == VMXINSTRID_IO_INS \|\| uInstrId == VMXINSTRID_IO_OUTS);
3344	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3345	Assert(ExitInstrInfo.StrIo.iSegReg < X86_SREG_COUNT);
3346	Assert(ExitInstrInfo.StrIo.u3AddrSize == 0 \|\| ExitInstrInfo.StrIo.u3AddrSize == 1 \|\| ExitInstrInfo.StrIo.u3AddrSize == 2);
3347	Assert(uInstrId != VMXINSTRID_IO_INS \|\| ExitInstrInfo.StrIo.iSegReg == X86_SREG_ES);
3348
3349	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3350	{
3351	/*
3352	* Figure out the guest-linear address and the direction bit (INS/OUTS).
3353	*/
3354	/** @todo r=ramshankar: Is there something in IEM that already does this? */
3355	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
3356	uint8_t const iSegReg = ExitInstrInfo.StrIo.iSegReg;
3357	uint8_t const uAddrSize = ExitInstrInfo.StrIo.u3AddrSize;
3358	uint64_t const uAddrSizeMask = s_auAddrSizeMasks[uAddrSize];
3359
3360	uint32_t uDirection;
3361	uint64_t uGuestLinearAddr;
3362	if (uInstrId == VMXINSTRID_IO_INS)
3363	{
3364	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_IN;
3365	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rdi & uAddrSizeMask);
3366	}
3367	else
3368	{
3369	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_OUT;
3370	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rsi & uAddrSizeMask);
3371	}
3372
3373	/*
3374	* If the segment is unusable, the guest-linear address in undefined.
3375	* We shall clear it for consistency.
3376	*
3377	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
3378	*/
3379	if (pVCpu->cpum.GstCtx.aSRegs[iSegReg].Attr.n.u1Unusable)
3380	uGuestLinearAddr = 0;
3381
3382	VMXVEXITINFO const ExitInfo
3383	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO_AND_LIN_ADDR(VMX_EXIT_IO_INSTR,
3384	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3385	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION, uDirection)
3386	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_STRING, 1)
3387	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_REP, fRep)
3388	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING,
3389	VMX_EXIT_QUAL_IO_ENCODING_DX)
3390	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port),
3391	IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxInsOutInfo
3392	? ExitInstrInfo.u : 0,
3393	cbInstr,
3394	uGuestLinearAddr);
3395	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3396	}
3397
3398	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3399	}
3400
3401
3402	/**
3403	* VMX VM-exit handler for VM-exits due to MWAIT.
3404	*
3405	* @returns VBox strict status code.
3406	* @param pVCpu The cross context virtual CPU structure.
3407	* @param fMonitorHwArmed Whether the address-range monitor hardware is armed.
3408	* @param cbInstr The instruction length in bytes.
3409	*/
3410	VBOXSTRICTRC iemVmxVmexitInstrMwait(PVMCPUCC pVCpu, bool fMonitorHwArmed, uint8_t cbInstr) RT_NOEXCEPT
3411	{
3412	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MWAIT, fMonitorHwArmed, cbInstr);
3413	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3414	}
3415
3416
3417	/**
3418	* VMX VM-exit handler for VM-exits due to PAUSE.
3419	*
3420	* @returns VBox strict status code.
3421	* @param pVCpu The cross context virtual CPU structure.
3422	* @param cbInstr The instruction length in bytes.
3423	*/
3424	static VBOXSTRICTRC iemVmxVmexitInstrPause(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3425	{
3426	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
3427
3428	/*
3429	* The PAUSE VM-exit is controlled by the "PAUSE exiting" control and the
3430	* "PAUSE-loop exiting" control.
3431	*
3432	* The PLE-Gap is the maximum number of TSC ticks between two successive executions of
3433	* the PAUSE instruction before we cause a VM-exit. The PLE-Window is the maximum amount
3434	* of TSC ticks the guest is allowed to execute in a pause loop before we must cause
3435	* a VM-exit.
3436	*
3437	* See Intel spec. 24.6.13 "Controls for PAUSE-Loop Exiting".
3438	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3439	*/
3440	bool fIntercept = false;
3441	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_PAUSE_EXIT)
3442	fIntercept = true;
3443	else if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PAUSE_LOOP_EXIT)
3444	&& pVCpu->iem.s.uCpl == 0)
3445	{
3446	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3447
3448	/*
3449	* A previous-PAUSE-tick value of 0 is used to identify the first time
3450	* execution of a PAUSE instruction after VM-entry at CPL 0. We must
3451	* consider this to be the first execution of PAUSE in a loop according
3452	* to the Intel.
3453	*
3454	* All subsequent records for the previous-PAUSE-tick we ensure that it
3455	* cannot be zero by OR'ing 1 to rule out the TSC wrap-around cases at 0.
3456	*/
3457	uint64_t *puFirstPauseLoopTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick;
3458	uint64_t *puPrevPauseTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick;
3459	uint64_t const uTick = TMCpuTickGet(pVCpu);
3460	uint32_t const uPleGap = pVmcs->u32PleGap;
3461	uint32_t const uPleWindow = pVmcs->u32PleWindow;
3462	if ( *puPrevPauseTick == 0
3463	\|\| uTick - *puPrevPauseTick > uPleGap)
3464	*puFirstPauseLoopTick = uTick;
3465	else if (uTick - *puFirstPauseLoopTick > uPleWindow)
3466	fIntercept = true;
3467
3468	*puPrevPauseTick = uTick \| 1;
3469	}
3470
3471	if (fIntercept)
3472	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_PAUSE, cbInstr);
3473
3474	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3475	}
3476
3477
3478	/**
3479	* VMX VM-exit handler for VM-exits due to task switches.
3480	*
3481	* @returns VBox strict status code.
3482	* @param pVCpu The cross context virtual CPU structure.
3483	* @param enmTaskSwitch The cause of the task switch.
3484	* @param SelNewTss The selector of the new TSS.
3485	* @param cbInstr The instruction length in bytes.
3486	*/
3487	VBOXSTRICTRC iemVmxVmexitTaskSwitch(PVMCPUCC pVCpu, IEMTASKSWITCH enmTaskSwitch, RTSEL SelNewTss, uint8_t cbInstr) RT_NOEXCEPT
3488	{
3489	/*
3490	* Task-switch VM-exits are unconditional and provide the Exit qualification.
3491	*
3492	* If the cause of the task switch is due to execution of CALL, IRET or the JMP
3493	* instruction or delivery of the exception generated by one of these instructions
3494	* lead to a task switch through a task gate in the IDT, we need to provide the
3495	* VM-exit instruction length. Any other means of invoking a task switch VM-exit
3496	* leaves the VM-exit instruction length field undefined.
3497	*
3498	* See Intel spec. 25.2 "Other Causes Of VM Exits".
3499	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
3500	*/
3501	Assert(cbInstr <= 15);
3502
3503	uint8_t uType;
3504	switch (enmTaskSwitch)
3505	{
3506	case IEMTASKSWITCH_CALL: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_CALL; break;
3507	case IEMTASKSWITCH_IRET: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IRET; break;
3508	case IEMTASKSWITCH_JUMP: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_JMP; break;
3509	case IEMTASKSWITCH_INT_XCPT: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IDT; break;
3510	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3511	}
3512
3513	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_NEW_TSS, SelNewTss)
3514	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_SOURCE, uType);
3515	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3516	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, u64ExitQual);
3517	}
3518
3519
3520	/**
3521	* VMX VM-exit handler for trap-like VM-exits.
3522	*
3523	* @returns VBox strict status code.
3524	* @param pVCpu The cross context virtual CPU structure.
3525	* @param pExitInfo Pointer to the VM-exit information.
3526	* @param pExitEventInfo Pointer to the VM-exit event information.
3527	*/
3528	static VBOXSTRICTRC iemVmxVmexitTrapLikeWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
3529	{
3530	Assert(VMXIsVmexitTrapLike(pExitInfo->uReason));
3531	iemVmxVmcsSetGuestPendingDbgXcpts(pVCpu, pExitInfo->u64GuestPendingDbgXcpts);
3532	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
3533	}
3534
3535
3536	/**
3537	* Interface for HM and EM to emulate a trap-like VM-exit (MTF, APIC-write,
3538	* Virtualized-EOI, TPR-below threshold).
3539	*
3540	* @returns Strict VBox status code.
3541	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3542	* @param pExitInfo Pointer to the VM-exit information.
3543	* @thread EMT(pVCpu)
3544	*/
3545	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTrapLike(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
3546	{
3547	Assert(pExitInfo);
3548	VBOXSTRICTRC rcStrict = iemVmxVmexitTrapLikeWithInfo(pVCpu, pExitInfo);
3549	Assert(!pVCpu->iem.s.cActiveMappings);
3550	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3551	}
3552
3553
3554	/**
3555	* VMX VM-exit handler for VM-exits due to task switches.
3556	*
3557	* This is intended for task switches where the caller provides all the relevant
3558	* VM-exit information.
3559	*
3560	* @returns VBox strict status code.
3561	* @param pVCpu The cross context virtual CPU structure.
3562	* @param pExitInfo Pointer to the VM-exit information.
3563	* @param pExitEventInfo Pointer to the VM-exit event information.
3564	*/
3565	static VBOXSTRICTRC iemVmxVmexitTaskSwitchWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
3566	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3567	{
3568	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3569	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3570	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3571	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3572	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, pExitInfo->u64Qual);
3573	}
3574
3575
3576	/**
3577	* Interface for HM and EM to emulate a VM-exit due to a task switch.
3578	*
3579	* @returns Strict VBox status code.
3580	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3581	* @param pExitInfo Pointer to the VM-exit information.
3582	* @param pExitEventInfo Pointer to the VM-exit event information.
3583	* @thread EMT(pVCpu)
3584	*/
3585	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTaskSwitch(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3586	{
3587	Assert(pExitInfo);
3588	Assert(pExitEventInfo);
3589	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3590	VBOXSTRICTRC rcStrict = iemVmxVmexitTaskSwitchWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3591	Assert(!pVCpu->iem.s.cActiveMappings);
3592	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3593	}
3594
3595
3596	/**
3597	* VMX VM-exit handler for VM-exits due to expiring of the preemption timer.
3598	*
3599	* @returns VBox strict status code.
3600	* @param pVCpu The cross context virtual CPU structure.
3601	*/
3602	VBOXSTRICTRC iemVmxVmexitPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
3603	{
3604	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
3605	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER);
3606
3607	/* Import the hardware virtualization state (for nested-guest VM-entry TSC-tick). */
3608	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3609
3610	/* Save the VMX-preemption timer value (of 0) back in to the VMCS if the CPU supports this feature. */
3611	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER)
3612	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer = 0;
3613
3614	/* Cause the VMX-preemption timer VM-exit. The Exit qualification MBZ. */
3615	return iemVmxVmexit(pVCpu, VMX_EXIT_PREEMPT_TIMER, 0 /* u64ExitQual */);
3616	}
3617
3618
3619	/**
3620	* Interface for HM and EM to emulate VM-exit due to expiry of the preemption timer.
3621	*
3622	* @returns Strict VBox status code.
3623	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3624	* @thread EMT(pVCpu)
3625	*/
3626	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitPreemptTimer(PVMCPUCC pVCpu)
3627	{
3628	VBOXSTRICTRC rcStrict = iemVmxVmexitPreemptTimer(pVCpu);
3629	Assert(!pVCpu->iem.s.cActiveMappings);
3630	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3631	}
3632
3633
3634	/**
3635	* VMX VM-exit handler for VM-exits due to external interrupts.
3636	*
3637	* @returns VBox strict status code.
3638	* @param pVCpu The cross context virtual CPU structure.
3639	* @param uVector The external interrupt vector (pass 0 if the interrupt
3640	* is still pending since we typically won't know the
3641	* vector).
3642	* @param fIntPending Whether the external interrupt is pending or
3643	* acknowledged in the interrupt controller.
3644	*/
3645	static VBOXSTRICTRC iemVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending) RT_NOEXCEPT
3646	{
3647	Assert(!fIntPending \|\| uVector == 0);
3648
3649	/* The VM-exit is subject to "External interrupt exiting" being set. */
3650	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT)
3651	{
3652	if (fIntPending)
3653	{
3654	/*
3655	* If the interrupt is pending and we don't need to acknowledge the
3656	* interrupt on VM-exit, cause the VM-exit immediately.
3657	*
3658	* See Intel spec 25.2 "Other Causes Of VM Exits".
3659	*/
3660	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT))
3661	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3662
3663	/*
3664	* If the interrupt is pending and we -do- need to acknowledge the interrupt
3665	* on VM-exit, postpone VM-exit till after the interrupt controller has been
3666	* acknowledged that the interrupt has been consumed. Callers would have to call
3667	* us again after getting the vector (and ofc, with fIntPending with false).
3668	*/
3669	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3670	}
3671
3672	/*
3673	* If the interrupt is no longer pending (i.e. it has been acknowledged) and the
3674	* "External interrupt exiting" and "Acknowledge interrupt on VM-exit" controls are
3675	* all set, we need to record the vector of the external interrupt in the
3676	* VM-exit interruption information field. Otherwise, mark this field as invalid.
3677	*
3678	* See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3679	*/
3680	uint32_t uExitIntInfo;
3681	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
3682	{
3683	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3684	uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3685	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_EXT_INT)
3686	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3687	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3688	}
3689	else
3690	uExitIntInfo = 0;
3691	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3692
3693	/*
3694	* Cause the VM-exit whether or not the vector has been stored
3695	* in the VM-exit interruption-information field.
3696	*/
3697	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3698	}
3699
3700	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3701	}
3702
3703
3704	/**
3705	* Interface for HM and EM to emulate VM-exit due to external interrupts.
3706	*
3707	* @returns Strict VBox status code.
3708	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3709	* @param uVector The external interrupt vector (pass 0 if the external
3710	* interrupt is still pending).
3711	* @param fIntPending Whether the external interrupt is pending or
3712	* acknowledged in the interrupt controller.
3713	* @thread EMT(pVCpu)
3714	*/
3715	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending)
3716	{
3717	VBOXSTRICTRC rcStrict = iemVmxVmexitExtInt(pVCpu, uVector, fIntPending);
3718	Assert(!pVCpu->iem.s.cActiveMappings);
3719	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3720	}
3721
3722
3723	/**
3724	* VMX VM-exit handler for VM-exits due to a double fault caused during delivery of
3725	* an event.
3726	*
3727	* @returns VBox strict status code.
3728	* @param pVCpu The cross context virtual CPU structure.
3729	*/
3730	VBOXSTRICTRC iemVmxVmexitEventDoubleFault(PVMCPUCC pVCpu) RT_NOEXCEPT
3731	{
3732	uint32_t const fXcptBitmap = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32XcptBitmap;
3733	if (fXcptBitmap & RT_BIT(X86_XCPT_DF))
3734	{
3735	/*
3736	* The NMI-unblocking due to IRET field need not be set for double faults.
3737	* See Intel spec. 31.7.1.2 "Resuming Guest Software After Handling An Exception".
3738	*/
3739	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, X86_XCPT_DF)
3740	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_HW_XCPT)
3741	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, 1)
3742	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, 0)
3743	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3744	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3745	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, 0 /* u64ExitQual */);
3746	}
3747
3748	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3749	}
3750
3751
3752	/**
3753	* VMX VM-exit handler for VM-exit due to delivery of an events.
3754	*
3755	* This is intended for VM-exit due to exceptions or NMIs where the caller provides
3756	* all the relevant VM-exit information.
3757	*
3758	* @returns VBox strict status code.
3759	* @param pVCpu The cross context virtual CPU structure.
3760	* @param pExitInfo Pointer to the VM-exit information.
3761	* @param pExitEventInfo Pointer to the VM-exit event information.
3762	*/
3763	static VBOXSTRICTRC iemVmxVmexitEventWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3764	{
3765	Assert(pExitInfo);
3766	Assert(pExitEventInfo);
3767	Assert(pExitInfo->uReason == VMX_EXIT_XCPT_OR_NMI);
3768	Assert(VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3769
3770	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3771	iemVmxVmcsSetExitIntInfo(pVCpu, pExitEventInfo->uExitIntInfo);
3772	iemVmxVmcsSetExitIntErrCode(pVCpu, pExitEventInfo->uExitIntErrCode);
3773	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3774	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3775	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, pExitInfo->u64Qual);
3776	}
3777
3778
3779	/**
3780	* Interface for HM and EM to emulate VM-exit due to NMIs.
3781	*
3782	* @returns Strict VBox status code.
3783	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3784	* @thread EMT(pVCpu)
3785	*/
3786	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcptNmi(PVMCPUCC pVCpu)
3787	{
3788	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_ONLY_REASON(VMX_EXIT_XCPT_OR_NMI);
3789	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_INT( RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1)
3790	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE,
3791	VMX_EXIT_INT_INFO_TYPE_NMI)
3792	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR,
3793	X86_XCPT_NMI),
3794	0);
3795	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
3796	Assert(!pVCpu->iem.s.cActiveMappings);
3797	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3798	}
3799
3800
3801	/**
3802	* Interface for HM and EM to emulate VM-exit due to exceptions.
3803	*
3804	* Exception includes NMIs, software exceptions (those generated by INT3 or
3805	* INTO) and privileged software exceptions (those generated by INT1/ICEBP).
3806	*
3807	* @returns Strict VBox status code.
3808	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3809	* @param pExitInfo Pointer to the VM-exit information.
3810	* @param pExitEventInfo Pointer to the VM-exit event information.
3811	* @thread EMT(pVCpu)
3812	*/
3813	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcpt(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3814	{
3815	Assert(pExitInfo);
3816	Assert(pExitEventInfo);
3817	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3818	Assert(!pVCpu->iem.s.cActiveMappings);
3819	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3820	}
3821
3822
3823	/**
3824	* VMX VM-exit handler for VM-exits due to delivery of an event.
3825	*
3826	* @returns VBox strict status code.
3827	* @param pVCpu The cross context virtual CPU structure.
3828	* @param uVector The interrupt / exception vector.
3829	* @param fFlags The flags (see IEM_XCPT_FLAGS_XXX).
3830	* @param uErrCode The error code associated with the event.
3831	* @param uCr2 The CR2 value in case of a \#PF exception.
3832	* @param cbInstr The instruction length in bytes.
3833	*/
3834	VBOXSTRICTRC iemVmxVmexitEvent(PVMCPUCC pVCpu, uint8_t uVector, uint32_t fFlags, uint32_t uErrCode,
3835	uint64_t uCr2, uint8_t cbInstr) RT_NOEXCEPT
3836	{
3837	/*
3838	* If the event is being injected as part of VM-entry, it is -not- subject to event
3839	* intercepts in the nested-guest. However, secondary exceptions that occur during
3840	* injection of any event -are- subject to event interception.
3841	*
3842	* See Intel spec. 26.5.1.2 "VM Exits During Event Injection".
3843	*/
3844	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
3845	{
3846	/*
3847	* If the event is a virtual-NMI (which is an NMI being inject during VM-entry)
3848	* virtual-NMI blocking must be set in effect rather than physical NMI blocking.
3849	*
3850	* See Intel spec. 24.6.1 "Pin-Based VM-Execution Controls".
3851	*/
3852	if ( uVector == X86_XCPT_NMI
3853	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
3854	&& (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
3855	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
3856	else
3857	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking);
3858
3859	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, true);
3860	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3861	}
3862
3863	/*
3864	* We are injecting an external interrupt, check if we need to cause a VM-exit now.
3865	* If not, the caller will continue delivery of the external interrupt as it would
3866	* normally. The interrupt is no longer pending in the interrupt controller at this
3867	* point.
3868	*/
3869	if (fFlags & IEM_XCPT_FLAGS_T_EXT_INT)
3870	{
3871	Assert(!VMX_IDT_VECTORING_INFO_IS_VALID(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo));
3872	return iemVmxVmexitExtInt(pVCpu, uVector, false /* fIntPending */);
3873	}
3874
3875	/*
3876	* Evaluate intercepts for hardware exceptions, software exceptions (#BP, #OF),
3877	* and privileged software exceptions (#DB generated by INT1/ICEBP) and software
3878	* interrupts.
3879	*/
3880	Assert(fFlags & (IEM_XCPT_FLAGS_T_CPU_XCPT \| IEM_XCPT_FLAGS_T_SOFT_INT));
3881	bool fIntercept;
3882	if ( !(fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3883	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3884	fIntercept = CPUMIsGuestVmxXcptInterceptSet(&pVCpu->cpum.GstCtx, uVector, uErrCode);
3885	else
3886	{
3887	/* Software interrupts cannot be intercepted and therefore do not cause a VM-exit. */
3888	fIntercept = false;
3889	}
3890
3891	/*
3892	* Now that we've determined whether the event causes a VM-exit, we need to construct the
3893	* relevant VM-exit information and cause the VM-exit.
3894	*/
3895	if (fIntercept)
3896	{
3897	Assert(!(fFlags & IEM_XCPT_FLAGS_T_EXT_INT));
3898
3899	/* Construct the rest of the event related information fields and cause the VM-exit. */
3900	uint64_t u64ExitQual;
3901	if (uVector == X86_XCPT_PF)
3902	{
3903	Assert(fFlags & IEM_XCPT_FLAGS_CR2);
3904	u64ExitQual = uCr2;
3905	}
3906	else if (uVector == X86_XCPT_DB)
3907	{
3908	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
3909	u64ExitQual = pVCpu->cpum.GstCtx.dr[6] & VMX_VMCS_EXIT_QUAL_VALID_MASK;
3910	}
3911	else
3912	u64ExitQual = 0;
3913
3914	uint8_t const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3915	bool const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
3916	uint8_t const uIntInfoType = iemVmxGetEventType(uVector, fFlags);
3917	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3918	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, uIntInfoType)
3919	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, fErrCodeValid)
3920	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3921	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3922	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3923	iemVmxVmcsSetExitIntErrCode(pVCpu, uErrCode);
3924
3925	/*
3926	* For VM-exits due to software exceptions (those generated by INT3 or INTO) or privileged
3927	* software exceptions (those generated by INT1/ICEBP) we need to supply the VM-exit instruction
3928	* length.
3929	*/
3930	if ( (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3931	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3932	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3933	else
3934	iemVmxVmcsSetExitInstrLen(pVCpu, 0);
3935
3936	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, u64ExitQual);
3937	}
3938
3939	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3940	}
3941
3942
3943	/**
3944	* VMX VM-exit handler for EPT misconfiguration.
3945	*
3946	* @param pVCpu The cross context virtual CPU structure.
3947	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3948	* This need not be page aligned (e.g. nested-guest in real
3949	* mode).
3950	*/
3951	static VBOXSTRICTRC iemVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr) RT_NOEXCEPT
3952	{
3953	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3954	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3955	}
3956
3957
3958	/**
3959	* VMX VM-exit handler for EPT misconfiguration.
3960	*
3961	* This is intended for EPT misconfigurations where the caller provides all the
3962	* relevant VM-exit information.
3963	*
3964	* @param pVCpu The cross context virtual CPU structure.
3965	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3966	* This need not be page aligned (e.g. nested-guest in real
3967	* mode).
3968	* @param pExitEventInfo Pointer to the VM-exit event information.
3969	*/
3970	static VBOXSTRICTRC iemVmxVmexitEptMisconfigWithInfo(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3971	{
3972	Assert(pExitEventInfo);
3973	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3974	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3975	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3976	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3977	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3978	}
3979
3980
3981	/**
3982	* Interface for HM and EM to emulate a VM-exit due to an EPT misconfiguration.
3983	*
3984	* @returns Strict VBox status code.
3985	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3986	* @param GCPhysAddr The nested-guest physical address causing the EPT
3987	* misconfiguration.
3988	* @param pExitEventInfo Pointer to the VM-exit event information.
3989	* @thread EMT(pVCpu)
3990	*/
3991	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo)
3992	{
3993	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
3994
3995	iemInitExec(pVCpu, false /fBypassHandlers/);
3996	VBOXSTRICTRC rcStrict = iemVmxVmexitEptMisconfigWithInfo(pVCpu, GCPhysAddr, pExitEventInfo);
3997	Assert(!pVCpu->iem.s.cActiveMappings);
3998	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
3999	}
4000
4001
4002	/**
4003	* VMX VM-exit handler for EPT violation.
4004	*
4005	* @param pVCpu The cross context virtual CPU structure.
4006	* @param fAccess The access causing the EPT violation, IEM_ACCESS_XXX.
4007	* @param fSlatFail The SLAT failure info, IEM_SLAT_FAIL_XXX.
4008	* @param fEptAccess The EPT paging structure bits.
4009	* @param GCPhysAddr The physical address causing the EPT violation. This
4010	* need not be page aligned (e.g. nested-guest in real
4011	* mode).
4012	* @param fIsLinearAddrValid Whether translation of a linear address caused this
4013	* EPT violation. If @c false, GCPtrAddr must be 0.
4014	* @param GCPtrAddr The linear address causing the EPT violation.
4015	* @param cbInstr The VM-exit instruction length.
4016	*/
4017	static VBOXSTRICTRC iemVmxVmexitEptViolation(PVMCPUCC pVCpu, uint32_t fAccess, uint32_t fSlatFail,
4018	uint64_t fEptAccess, RTGCPHYS GCPhysAddr, bool fIsLinearAddrValid,
4019	uint64_t GCPtrAddr, uint8_t cbInstr) RT_NOEXCEPT
4020	{
4021	/*
4022	* If the linear address isn't valid (can happen when loading PDPTEs
4023	* as part of MOV CR execution) the linear address field is undefined.
4024	* While we can leave it this way, it's preferable to zero it for consistency.
4025	*/
4026	Assert(fIsLinearAddrValid \|\| GCPtrAddr == 0);
4027
4028	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
4029	bool const fSupportsAccessDirty = RT_BOOL(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ACCESS_DIRTY);
4030
4031	uint32_t const fDataRdMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_READ;
4032	uint32_t const fDataWrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_WRITE;
4033	uint32_t const fInstrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_EXEC;
4034	bool const fDataRead = ((fAccess & fDataRdMask) == IEM_ACCESS_DATA_R) \| fSupportsAccessDirty;
4035	bool const fDataWrite = ((fAccess & fDataWrMask) == IEM_ACCESS_DATA_W) \| fSupportsAccessDirty;
4036	bool const fInstrFetch = ((fAccess & fInstrMask) == IEM_ACCESS_INSTRUCTION);
4037	bool const fEptRead = RT_BOOL(fEptAccess & EPT_E_READ);
4038	bool const fEptWrite = RT_BOOL(fEptAccess & EPT_E_WRITE);
4039	bool const fEptExec = RT_BOOL(fEptAccess & EPT_E_EXECUTE);
4040	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
4041	bool const fIsLinearToPhysAddr = fIsLinearAddrValid & RT_BOOL(fSlatFail & IEM_SLAT_FAIL_LINEAR_TO_PHYS_ADDR);
4042
4043	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_READ, fDataRead)
4044	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_WRITE, fDataWrite)
4045	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_INSTR_FETCH, fInstrFetch)
4046	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_READ, fEptRead)
4047	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_WRITE, fEptWrite)
4048	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_EXECUTE, fEptExec)
4049	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID, fIsLinearAddrValid)
4050	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_TO_PHYS_ADDR, fIsLinearToPhysAddr)
4051	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_NMI_UNBLOCK_IRET, fNmiUnblocking);
4052
4053	#ifdef VBOX_STRICT
4054	uint64_t const fMiscCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
4055	uint32_t const fProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2;
4056	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ADVEXITINFO_EPT_VIOLATION)); /* Advanced VM-exit info. not supported */
4057	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_SUPER_SHW_STACK)); /* Supervisor shadow stack control not supported. */
4058	Assert(!(RT_BF_GET(fMiscCaps, VMX_BF_MISC_INTEL_PT))); /* Intel PT not supported. */
4059	Assert(!(fProcCtls2 & VMX_PROC_CTLS2_MODE_BASED_EPT_PERM)); /* Mode-based execute control not supported. */
4060	#endif
4061
4062	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
4063	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, GCPtrAddr);
4064	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
4065
4066	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, u64ExitQual);
4067	}
4068
4069
4070	/**
4071	* VMX VM-exit handler for EPT violation.
4072	*
4073	* This is intended for EPT violations where the caller provides all the
4074	* relevant VM-exit information.
4075	*
4076	* @returns VBox strict status code.
4077	* @param pVCpu The cross context virtual CPU structure.
4078	* @param pExitInfo Pointer to the VM-exit information.
4079	* @param pExitEventInfo Pointer to the VM-exit event information.
4080	*/
4081	static VBOXSTRICTRC iemVmxVmexitEptViolationWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4082	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4083	{
4084	Assert(pExitInfo);
4085	Assert(pExitEventInfo);
4086	Assert(pExitInfo->uReason == VMX_EXIT_EPT_VIOLATION);
4087	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4088
4089	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4090	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4091
4092	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
4093	if (pExitInfo->u64Qual & VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID_MASK)
4094	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
4095	else
4096	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, 0);
4097	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4098	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, pExitInfo->u64Qual);
4099	}
4100
4101
4102	/**
4103	* Interface for HM and EM to emulate a VM-exit due to an EPT violation.
4104	*
4105	* @returns Strict VBox status code.
4106	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4107	* @param pExitInfo Pointer to the VM-exit information.
4108	* @param pExitEventInfo Pointer to the VM-exit event information.
4109	* @thread EMT(pVCpu)
4110	*/
4111	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptViolation(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4112	PCVMXVEXITEVENTINFO pExitEventInfo)
4113	{
4114	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
4115
4116	iemInitExec(pVCpu, false /fBypassHandlers/);
4117	VBOXSTRICTRC rcStrict = iemVmxVmexitEptViolationWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4118	Assert(!pVCpu->iem.s.cActiveMappings);
4119	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
4120	}
4121
4122
4123	/**
4124	* VMX VM-exit handler for EPT-induced VM-exits.
4125	*
4126	* @param pVCpu The cross context virtual CPU structure.
4127	* @param pWalk The page walk info.
4128	* @param fAccess The access causing the EPT event, IEM_ACCESS_XXX.
4129	* @param fSlatFail Additional SLAT info, IEM_SLAT_FAIL_XXX.
4130	* @param cbInstr The VM-exit instruction length if applicable. Pass 0 if not
4131	* applicable.
4132	*/
4133	VBOXSTRICTRC iemVmxVmexitEpt(PVMCPUCC pVCpu, PPGMPTWALK pWalk, uint32_t fAccess, uint32_t fSlatFail, uint8_t cbInstr) RT_NOEXCEPT
4134	{
4135	Assert(pWalk->fIsSlat);
4136	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT);
4137	Assert(!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEptXcptVe); /* #VE exceptions not supported. */
4138	Assert(!(pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION_CONVERTIBLE)); /* Without #VE, convertible violations not possible. */
4139
4140	if (pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION)
4141	{
4142	LogFlow(("EptViolation: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4143	uint64_t const fEptAccess = (pWalk->fEffective & PGM_PTATTRS_EPT_MASK) >> PGM_PTATTRS_EPT_SHIFT;
4144	return iemVmxVmexitEptViolation(pVCpu, fAccess, fSlatFail, fEptAccess, pWalk->GCPhysNested, pWalk->fIsLinearAddrValid,
4145	pWalk->GCPtr, cbInstr);
4146	}
4147
4148	LogFlow(("EptMisconfig: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4149	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT_MISCONFIG);
4150	return iemVmxVmexitEptMisconfig(pVCpu, pWalk->GCPhysNested);
4151	}
4152
4153
4154	/**
4155	* VMX VM-exit handler for APIC accesses.
4156	*
4157	* @param pVCpu The cross context virtual CPU structure.
4158	* @param offAccess The offset of the register being accessed.
4159	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4160	*/
4161	static VBOXSTRICTRC iemVmxVmexitApicAccess(PVMCPUCC pVCpu, uint16_t offAccess, uint32_t fAccess) RT_NOEXCEPT
4162	{
4163	VMXAPICACCESS enmAccess;
4164	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, NULL, NULL, NULL, NULL);
4165	if (fInEventDelivery)
4166	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
4167	else if ((fAccess & (IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_MASK)) == IEM_ACCESS_INSTRUCTION)
4168	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
4169	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
4170	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
4171	else
4172	enmAccess = VMXAPICACCESS_LINEAR_READ;
4173
4174	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
4175	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess);
4176	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, u64ExitQual);
4177	}
4178
4179
4180	/**
4181	* VMX VM-exit handler for APIC accesses.
4182	*
4183	* This is intended for APIC accesses where the caller provides all the
4184	* relevant VM-exit information.
4185	*
4186	* @returns VBox strict status code.
4187	* @param pVCpu The cross context virtual CPU structure.
4188	* @param pExitInfo Pointer to the VM-exit information.
4189	* @param pExitEventInfo Pointer to the VM-exit event information.
4190	*/
4191	static VBOXSTRICTRC iemVmxVmexitApicAccessWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4192	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4193	{
4194	/* VM-exit interruption information should not be valid for APIC-access VM-exits. */
4195	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4196	Assert(pExitInfo->uReason == VMX_EXIT_APIC_ACCESS);
4197	iemVmxVmcsSetExitIntInfo(pVCpu, 0);
4198	iemVmxVmcsSetExitIntErrCode(pVCpu, 0);
4199	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4200	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4201	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4202	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, pExitInfo->u64Qual);
4203	}
4204
4205
4206	/**
4207	* Interface for HM and EM to virtualize memory-mapped APIC accesses.
4208	*
4209	* @returns Strict VBox status code.
4210	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the memory access was virtualized.
4211	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4212	*
4213	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4214	* @param pExitInfo Pointer to the VM-exit information.
4215	* @param pExitEventInfo Pointer to the VM-exit event information.
4216	* @thread EMT(pVCpu)
4217	*/
4218	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicAccess(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
4219	{
4220	Assert(pExitInfo);
4221	Assert(pExitEventInfo);
4222	VBOXSTRICTRC rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4223	Assert(!pVCpu->iem.s.cActiveMappings);
4224	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4225	}
4226
4227
4228	/**
4229	* VMX VM-exit handler for APIC-write VM-exits.
4230	*
4231	* @param pVCpu The cross context virtual CPU structure.
4232	* @param offApic The write to the virtual-APIC page offset that caused this
4233	* VM-exit.
4234	*/
4235	static VBOXSTRICTRC iemVmxVmexitApicWrite(PVMCPUCC pVCpu, uint16_t offApic) RT_NOEXCEPT
4236	{
4237	Assert(offApic < XAPIC_OFF_END + 4);
4238	/* Write only bits 11:0 of the APIC offset into the Exit qualification field. */
4239	offApic &= UINT16_C(0xfff);
4240	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_WRITE, offApic);
4241	}
4242
4243
4244	/**
4245	* Clears any pending virtual-APIC write emulation.
4246	*
4247	* @returns The virtual-APIC offset that was written before clearing it.
4248	* @param pVCpu The cross context virtual CPU structure.
4249	*/
4250	DECLINLINE(uint16_t) iemVmxVirtApicClearPendingWrite(PVMCPUCC pVCpu)
4251	{
4252	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
4253	uint8_t const offVirtApicWrite = pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite;
4254	pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite = 0;
4255	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
4256	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_VMX_APIC_WRITE);
4257	return offVirtApicWrite;
4258	}
4259
4260
4261	/**
4262	* Reads a 32-bit register from the virtual-APIC page at the given offset.
4263	*
4264	* @returns The register from the virtual-APIC page.
4265	* @param pVCpu The cross context virtual CPU structure.
4266	* @param offReg The offset of the register being read.
4267	*/
4268	uint32_t iemVmxVirtApicReadRaw32(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4269	{
4270	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4271
4272	uint32_t uReg = 0;
4273	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4274	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4275	AssertMsgStmt(RT_SUCCESS(rc),
4276	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4277	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4278	uReg = 0);
4279	return uReg;
4280	}
4281
4282
4283	/**
4284	* Reads a 64-bit register from the virtual-APIC page at the given offset.
4285	*
4286	* @returns The register from the virtual-APIC page.
4287	* @param pVCpu The cross context virtual CPU structure.
4288	* @param offReg The offset of the register being read.
4289	*/
4290	static uint64_t iemVmxVirtApicReadRaw64(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4291	{
4292	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4293
4294	uint64_t uReg = 0;
4295	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4296	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4297	AssertMsgStmt(RT_SUCCESS(rc),
4298	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4299	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4300	uReg = 0);
4301	return uReg;
4302	}
4303
4304
4305	/**
4306	* Writes a 32-bit register to the virtual-APIC page at the given offset.
4307	*
4308	* @param pVCpu The cross context virtual CPU structure.
4309	* @param offReg The offset of the register being written.
4310	* @param uReg The register value to write.
4311	*/
4312	void iemVmxVirtApicWriteRaw32(PVMCPUCC pVCpu, uint16_t offReg, uint32_t uReg) RT_NOEXCEPT
4313	{
4314	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4315
4316	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4317	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4318	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4319	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4320	}
4321
4322
4323	/**
4324	* Writes a 64-bit register to the virtual-APIC page at the given offset.
4325	*
4326	* @param pVCpu The cross context virtual CPU structure.
4327	* @param offReg The offset of the register being written.
4328	* @param uReg The register value to write.
4329	*/
4330	static void iemVmxVirtApicWriteRaw64(PVMCPUCC pVCpu, uint16_t offReg, uint64_t uReg) RT_NOEXCEPT
4331	{
4332	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4333
4334	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4335	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4336	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4337	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4338	}
4339
4340
4341	/**
4342	* Sets the vector in a virtual-APIC 256-bit sparse register.
4343	*
4344	* @param pVCpu The cross context virtual CPU structure.
4345	* @param offReg The offset of the 256-bit spare register.
4346	* @param uVector The vector to set.
4347	*
4348	* @remarks This is based on our APIC device code.
4349	*/
4350	static void iemVmxVirtApicSetVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4351	{
4352	/* Determine the vector offset within the chunk. */
4353	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4354
4355	/* Read the chunk at the offset. */
4356	uint32_t uReg;
4357	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4358	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4359	if (RT_SUCCESS(rc))
4360	{
4361	/* Modify the chunk. */
4362	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4363	uReg \|= RT_BIT(idxVectorBit);
4364
4365	/* Write the chunk. */
4366	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4367	AssertMsgRC(rc, ("Failed to set vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4368	uVector, offReg, GCPhysVirtApic, rc));
4369	}
4370	else
4371	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4372	uVector, offReg, GCPhysVirtApic, rc));
4373	}
4374
4375
4376	/**
4377	* Clears the vector in a virtual-APIC 256-bit sparse register.
4378	*
4379	* @param pVCpu The cross context virtual CPU structure.
4380	* @param offReg The offset of the 256-bit spare register.
4381	* @param uVector The vector to clear.
4382	*
4383	* @remarks This is based on our APIC device code.
4384	*/
4385	static void iemVmxVirtApicClearVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4386	{
4387	/* Determine the vector offset within the chunk. */
4388	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4389
4390	/* Read the chunk at the offset. */
4391	uint32_t uReg;
4392	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4393	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4394	if (RT_SUCCESS(rc))
4395	{
4396	/* Modify the chunk. */
4397	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4398	uReg &= ~RT_BIT(idxVectorBit);
4399
4400	/* Write the chunk. */
4401	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4402	AssertMsgRC(rc, ("Failed to clear vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4403	uVector, offReg, GCPhysVirtApic, rc));
4404	}
4405	else
4406	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4407	uVector, offReg, GCPhysVirtApic, rc));
4408	}
4409
4410
4411	/**
4412	* Checks if a memory access to the APIC-access page must causes an APIC-access
4413	* VM-exit.
4414	*
4415	* @param pVCpu The cross context virtual CPU structure.
4416	* @param offAccess The offset of the register being accessed.
4417	* @param cbAccess The size of the access in bytes.
4418	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4419	*
4420	* @remarks This must not be used for MSR-based APIC-access page accesses!
4421	* @sa iemVmxVirtApicAccessMsrWrite, iemVmxVirtApicAccessMsrRead.
4422	*/
4423	static bool iemVmxVirtApicIsMemAccessIntercepted(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4424	{
4425	Assert(cbAccess > 0);
4426	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4427
4428	/*
4429	* We must cause a VM-exit if any of the following are true:
4430	* - TPR shadowing isn't active.
4431	* - The access size exceeds 32-bits.
4432	* - The access is not contained within low 4 bytes of a 16-byte aligned offset.
4433	*
4434	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4435	* See Intel spec. 29.4.3.1 "Determining Whether a Write Access is Virtualized".
4436	*/
4437	if ( !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
4438	\|\| cbAccess > sizeof(uint32_t)
4439	\|\| ((offAccess + cbAccess - 1) & 0xc)
4440	\|\| offAccess >= XAPIC_OFF_END + 4)
4441	return true;
4442
4443	/*
4444	* If the access is part of an operation where we have already
4445	* virtualized a virtual-APIC write, we must cause a VM-exit.
4446	*/
4447	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
4448	return true;
4449
4450	/*
4451	* Check write accesses to the APIC-access page that cause VM-exits.
4452	*/
4453	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4454	{
4455	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4456	{
4457	/*
4458	* With APIC-register virtualization, a write access to any of the
4459	* following registers are virtualized. Accessing any other register
4460	* causes a VM-exit.
4461	*/
4462	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4463	switch (offAlignedAccess)
4464	{
4465	case XAPIC_OFF_ID:
4466	case XAPIC_OFF_TPR:
4467	case XAPIC_OFF_EOI:
4468	case XAPIC_OFF_LDR:
4469	case XAPIC_OFF_DFR:
4470	case XAPIC_OFF_SVR:
4471	case XAPIC_OFF_ESR:
4472	case XAPIC_OFF_ICR_LO:
4473	case XAPIC_OFF_ICR_HI:
4474	case XAPIC_OFF_LVT_TIMER:
4475	case XAPIC_OFF_LVT_THERMAL:
4476	case XAPIC_OFF_LVT_PERF:
4477	case XAPIC_OFF_LVT_LINT0:
4478	case XAPIC_OFF_LVT_LINT1:
4479	case XAPIC_OFF_LVT_ERROR:
4480	case XAPIC_OFF_TIMER_ICR:
4481	case XAPIC_OFF_TIMER_DCR:
4482	break;
4483	default:
4484	return true;
4485	}
4486	}
4487	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4488	{
4489	/*
4490	* With virtual-interrupt delivery, a write access to any of the
4491	* following registers are virtualized. Accessing any other register
4492	* causes a VM-exit.
4493	*
4494	* Note! The specification does not allow writing to offsets in-between
4495	* these registers (e.g. TPR + 1 byte) unlike read accesses.
4496	*/
4497	switch (offAccess)
4498	{
4499	case XAPIC_OFF_TPR:
4500	case XAPIC_OFF_EOI:
4501	case XAPIC_OFF_ICR_LO:
4502	break;
4503	default:
4504	return true;
4505	}
4506	}
4507	else
4508	{
4509	/*
4510	* Without APIC-register virtualization or virtual-interrupt delivery,
4511	* only TPR accesses are virtualized.
4512	*/
4513	if (offAccess == XAPIC_OFF_TPR)
4514	{ /* likely */ }
4515	else
4516	return true;
4517	}
4518	}
4519	else
4520	{
4521	/*
4522	* Check read accesses to the APIC-access page that cause VM-exits.
4523	*/
4524	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4525	{
4526	/*
4527	* With APIC-register virtualization, a read access to any of the
4528	* following registers are virtualized. Accessing any other register
4529	* causes a VM-exit.
4530	*/
4531	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4532	switch (offAlignedAccess)
4533	{
4534	/** @todo r=ramshankar: What about XAPIC_OFF_LVT_CMCI? */
4535	case XAPIC_OFF_ID:
4536	case XAPIC_OFF_VERSION:
4537	case XAPIC_OFF_TPR:
4538	case XAPIC_OFF_EOI:
4539	case XAPIC_OFF_LDR:
4540	case XAPIC_OFF_DFR:
4541	case XAPIC_OFF_SVR:
4542	case XAPIC_OFF_ISR0: case XAPIC_OFF_ISR1: case XAPIC_OFF_ISR2: case XAPIC_OFF_ISR3:
4543	case XAPIC_OFF_ISR4: case XAPIC_OFF_ISR5: case XAPIC_OFF_ISR6: case XAPIC_OFF_ISR7:
4544	case XAPIC_OFF_TMR0: case XAPIC_OFF_TMR1: case XAPIC_OFF_TMR2: case XAPIC_OFF_TMR3:
4545	case XAPIC_OFF_TMR4: case XAPIC_OFF_TMR5: case XAPIC_OFF_TMR6: case XAPIC_OFF_TMR7:
4546	case XAPIC_OFF_IRR0: case XAPIC_OFF_IRR1: case XAPIC_OFF_IRR2: case XAPIC_OFF_IRR3:
4547	case XAPIC_OFF_IRR4: case XAPIC_OFF_IRR5: case XAPIC_OFF_IRR6: case XAPIC_OFF_IRR7:
4548	case XAPIC_OFF_ESR:
4549	case XAPIC_OFF_ICR_LO:
4550	case XAPIC_OFF_ICR_HI:
4551	case XAPIC_OFF_LVT_TIMER:
4552	case XAPIC_OFF_LVT_THERMAL:
4553	case XAPIC_OFF_LVT_PERF:
4554	case XAPIC_OFF_LVT_LINT0:
4555	case XAPIC_OFF_LVT_LINT1:
4556	case XAPIC_OFF_LVT_ERROR:
4557	case XAPIC_OFF_TIMER_ICR:
4558	case XAPIC_OFF_TIMER_DCR:
4559	break;
4560	default:
4561	return true;
4562	}
4563	}
4564	else
4565	{
4566	/* Without APIC-register virtualization, only TPR accesses are virtualized. */
4567	if (offAccess == XAPIC_OFF_TPR)
4568	{ /* likely */ }
4569	else
4570	return true;
4571	}
4572	}
4573
4574	/* The APIC access is virtualized, does not cause a VM-exit. */
4575	return false;
4576	}
4577
4578
4579	/**
4580	* Virtualizes a memory-based APIC access by certain instructions even though they
4581	* do not use the address to access memory.
4582	*
4583	* This is for instructions like MONITOR, CLFLUSH, CLFLUSHOPT, ENTER which may cause
4584	* page-faults but do not use the address to access memory.
4585	*
4586	* @param pVCpu The cross context virtual CPU structure.
4587	* @param pGCPhysAccess Pointer to the guest-physical address accessed.
4588	* @param cbAccess The size of the access in bytes.
4589	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4590	*/
4591	VBOXSTRICTRC iemVmxVirtApicAccessUnused(PVMCPUCC pVCpu, PRTGCPHYS pGCPhysAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4592	{
4593	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4594	Assert(pGCPhysAccess);
4595
4596	RTGCPHYS const GCPhysAccess = *pGCPhysAccess & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
4597	RTGCPHYS const GCPhysApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrApicAccess.u;
4598	Assert(!(GCPhysApic & GUEST_PAGE_OFFSET_MASK));
4599
4600	if (GCPhysAccess == GCPhysApic)
4601	{
4602	uint16_t const offAccess = *pGCPhysAccess & GUEST_PAGE_OFFSET_MASK;
4603	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4604	if (fIntercept)
4605	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4606
4607	*pGCPhysAccess = GCPhysApic \| offAccess;
4608	return VINF_VMX_MODIFIES_BEHAVIOR;
4609	}
4610
4611	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4612	}
4613
4614
4615	/**
4616	* Virtualizes a memory-based APIC access.
4617	*
4618	* @returns VBox strict status code.
4619	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the access was virtualized.
4620	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4621	*
4622	* @param pVCpu The cross context virtual CPU structure.
4623	* @param offAccess The offset of the register being accessed (within the
4624	* APIC-access page).
4625	* @param cbAccess The size of the access in bytes.
4626	* @param pvData Pointer to the data being written or where to store the data
4627	* being read.
4628	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4629	*/
4630	static VBOXSTRICTRC iemVmxVirtApicAccessMem(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess,
4631	void *pvData, uint32_t fAccess) RT_NOEXCEPT
4632	{
4633	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4634	Assert(pvData);
4635
4636	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4637	if (fIntercept)
4638	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4639
4640	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4641	{
4642	/*
4643	* A write access to the APIC-access page that is virtualized (rather than
4644	* causing a VM-exit) writes data to the virtual-APIC page.
4645	*/
4646	uint32_t const u32Data = (uint32_t )pvData;
4647	iemVmxVirtApicWriteRaw32(pVCpu, offAccess, u32Data);
4648
4649	/*
4650	* Record the currently updated APIC offset, as we need this later for figuring
4651	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4652	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4653	*
4654	* After completion of the current operation, we need to perform TPR virtualization,
4655	* EOI virtualization or APIC-write VM-exit depending on which register was written.
4656	*
4657	* The current operation may be a REP-prefixed string instruction, execution of any
4658	* other instruction, or delivery of an event through the IDT.
4659	*
4660	* Thus things like clearing bytes 3:1 of the VTPR, clearing VEOI are not to be
4661	* performed now but later after completion of the current operation.
4662	*
4663	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
4664	*/
4665	iemVmxVirtApicSetPendingWrite(pVCpu, offAccess);
4666
4667	LogFlowFunc(("Write access at offset %#x not intercepted -> Wrote %#RX32\n", offAccess, u32Data));
4668	}
4669	else
4670	{
4671	/*
4672	* A read access from the APIC-access page that is virtualized (rather than
4673	* causing a VM-exit) returns data from the virtual-APIC page.
4674	*
4675	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4676	*/
4677	Assert(fAccess & IEM_ACCESS_TYPE_READ);
4678
4679	Assert(cbAccess <= 4);
4680	Assert(offAccess < XAPIC_OFF_END + 4);
4681	static uint32_t const s_auAccessSizeMasks[] = { 0, 0xff, 0xffff, 0xffffff, 0xffffffff };
4682
4683	uint32_t u32Data = iemVmxVirtApicReadRaw32(pVCpu, offAccess);
4684	u32Data &= s_auAccessSizeMasks[cbAccess];
4685	(uint32_t )pvData = u32Data;
4686
4687	LogFlowFunc(("Read access at offset %#x not intercepted -> Read %#RX32\n", offAccess, u32Data));
4688	}
4689
4690	return VINF_VMX_MODIFIES_BEHAVIOR;
4691	}
4692
4693
4694	/**
4695	* Virtualizes an MSR-based APIC read access.
4696	*
4697	* @returns VBox strict status code.
4698	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR read was virtualized.
4699	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR read access must be
4700	* handled by the x2APIC device.
4701	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4702	* not within the range of valid MSRs, caller must raise \#GP(0).
4703	* @param pVCpu The cross context virtual CPU structure.
4704	* @param idMsr The x2APIC MSR being read.
4705	* @param pu64Value Where to store the read x2APIC MSR value (only valid when
4706	* VINF_VMX_MODIFIES_BEHAVIOR is returned).
4707	*/
4708	static VBOXSTRICTRC iemVmxVirtApicAccessMsrRead(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value) RT_NOEXCEPT
4709	{
4710	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE);
4711	Assert(pu64Value);
4712
4713	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4714	{
4715	if ( idMsr >= MSR_IA32_X2APIC_START
4716	&& idMsr <= MSR_IA32_X2APIC_END)
4717	{
4718	uint16_t const offReg = (idMsr & 0xff) << 4;
4719	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4720	*pu64Value = u64Value;
4721	return VINF_VMX_MODIFIES_BEHAVIOR;
4722	}
4723	return VERR_OUT_OF_RANGE;
4724	}
4725
4726	if (idMsr == MSR_IA32_X2APIC_TPR)
4727	{
4728	uint16_t const offReg = (idMsr & 0xff) << 4;
4729	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4730	*pu64Value = u64Value;
4731	return VINF_VMX_MODIFIES_BEHAVIOR;
4732	}
4733
4734	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4735	}
4736
4737
4738	/**
4739	* Virtualizes an MSR-based APIC write access.
4740	*
4741	* @returns VBox strict status code.
4742	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR write was virtualized.
4743	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4744	* not within the range of valid MSRs, caller must raise \#GP(0).
4745	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR must be written normally.
4746	*
4747	* @param pVCpu The cross context virtual CPU structure.
4748	* @param idMsr The x2APIC MSR being written.
4749	* @param u64Value The value of the x2APIC MSR being written.
4750	*/
4751	static VBOXSTRICTRC iemVmxVirtApicAccessMsrWrite(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t u64Value) RT_NOEXCEPT
4752	{
4753	/*
4754	* Check if the access is to be virtualized.
4755	* See Intel spec. 29.5 "Virtualizing MSR-based APIC Accesses".
4756	*/
4757	if ( idMsr == MSR_IA32_X2APIC_TPR
4758	\|\| ( (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4759	&& ( idMsr == MSR_IA32_X2APIC_EOI
4760	\|\| idMsr == MSR_IA32_X2APIC_SELF_IPI)))
4761	{
4762	/* Validate the MSR write depending on the register. */
4763	switch (idMsr)
4764	{
4765	case MSR_IA32_X2APIC_TPR:
4766	case MSR_IA32_X2APIC_SELF_IPI:
4767	{
4768	if (u64Value & UINT64_C(0xffffffffffffff00))
4769	return VERR_OUT_OF_RANGE;
4770	break;
4771	}
4772	case MSR_IA32_X2APIC_EOI:
4773	{
4774	if (u64Value != 0)
4775	return VERR_OUT_OF_RANGE;
4776	break;
4777	}
4778	}
4779
4780	/* Write the MSR to the virtual-APIC page. */
4781	uint16_t const offReg = (idMsr & 0xff) << 4;
4782	iemVmxVirtApicWriteRaw64(pVCpu, offReg, u64Value);
4783
4784	/*
4785	* Record the currently updated APIC offset, as we need this later for figuring
4786	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4787	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4788	*/
4789	iemVmxVirtApicSetPendingWrite(pVCpu, offReg);
4790
4791	return VINF_VMX_MODIFIES_BEHAVIOR;
4792	}
4793
4794	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4795	}
4796
4797
4798	/**
4799	* Interface for HM and EM to virtualize x2APIC MSR accesses.
4800	*
4801	* @returns Strict VBox status code.
4802	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR access was virtualized.
4803	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR access must be handled by
4804	* the x2APIC device.
4805	* @retval VERR_OUT_RANGE if the caller must raise \#GP(0).
4806	*
4807	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4808	* @param idMsr The MSR being read.
4809	* @param pu64Value Pointer to the value being written or where to store the
4810	* value being read.
4811	* @param fWrite Whether this is an MSR write or read access.
4812	* @thread EMT(pVCpu)
4813	*/
4814	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVirtApicAccessMsr(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value, bool fWrite)
4815	{
4816	Assert(pu64Value);
4817
4818	VBOXSTRICTRC rcStrict;
4819	if (fWrite)
4820	rcStrict = iemVmxVirtApicAccessMsrWrite(pVCpu, idMsr, *pu64Value);
4821	else
4822	rcStrict = iemVmxVirtApicAccessMsrRead(pVCpu, idMsr, pu64Value);
4823	Assert(!pVCpu->iem.s.cActiveMappings);
4824	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4825
4826	}
4827
4828
4829	/**
4830	* Finds the most significant set bit in a virtual-APIC 256-bit sparse register.
4831	*
4832	* @returns VBox status code.
4833	* @retval VINF_SUCCESS when the highest set bit is found.
4834	* @retval VERR_NOT_FOUND when no bit is set.
4835	*
4836	* @param pVCpu The cross context virtual CPU structure.
4837	* @param offReg The offset of the APIC 256-bit sparse register.
4838	* @param pidxHighestBit Where to store the highest bit (most significant bit)
4839	* set in the register. Only valid when VINF_SUCCESS is
4840	* returned.
4841	*
4842	* @remarks The format of the 256-bit sparse register here mirrors that found in
4843	* real APIC hardware.
4844	*/
4845	static int iemVmxVirtApicGetHighestSetBitInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t *pidxHighestBit)
4846	{
4847	Assert(offReg < XAPIC_OFF_END + 4);
4848	Assert(pidxHighestBit);
4849
4850	/*
4851	* There are 8 contiguous fragments (of 16-bytes each) in the sparse register.
4852	* However, in each fragment only the first 4 bytes are used.
4853	*/
4854	uint8_t const cFrags = 8;
4855	for (int8_t iFrag = cFrags; iFrag >= 0; iFrag--)
4856	{
4857	uint16_t const offFrag = iFrag * 16;
4858	uint32_t const u32Frag = iemVmxVirtApicReadRaw32(pVCpu, offReg + offFrag);
4859	if (!u32Frag)
4860	continue;
4861
4862	unsigned idxHighestBit = ASMBitLastSetU32(u32Frag);
4863	Assert(idxHighestBit > 0);
4864	--idxHighestBit;
4865	Assert(idxHighestBit <= UINT8_MAX);
4866	*pidxHighestBit = idxHighestBit;
4867	return VINF_SUCCESS;
4868	}
4869	return VERR_NOT_FOUND;
4870	}
4871
4872
4873	/**
4874	* Evaluates pending virtual interrupts.
4875	*
4876	* @param pVCpu The cross context virtual CPU structure.
4877	*/
4878	static void iemVmxEvalPendingVirtIntrs(PVMCPUCC pVCpu) RT_NOEXCEPT
4879	{
4880	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4881
4882	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT))
4883	{
4884	uint8_t const uRvi = RT_LO_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus);
4885	uint8_t const uPpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_PPR);
4886
4887	if ((uRvi >> 4) > (uPpr >> 4))
4888	{
4889	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Signalling pending interrupt\n", uRvi, uPpr));
4890	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
4891	}
4892	else
4893	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Nothing to do\n", uRvi, uPpr));
4894	}
4895	}
4896
4897
4898	/**
4899	* Performs PPR virtualization.
4900	*
4901	* @returns VBox strict status code.
4902	* @param pVCpu The cross context virtual CPU structure.
4903	*/
4904	static void iemVmxPprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4905	{
4906	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4907	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4908
4909	/*
4910	* PPR virtualization is caused in response to a VM-entry, TPR-virtualization,
4911	* or EOI-virtualization.
4912	*
4913	* See Intel spec. 29.1.3 "PPR Virtualization".
4914	*/
4915	uint8_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4916	uint8_t const uSvi = RT_HI_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus) & 0xf0;
4917
4918	uint32_t uPpr;
4919	if ((uTpr & 0xf0) >= uSvi)
4920	uPpr = uTpr;
4921	else
4922	uPpr = uSvi;
4923
4924	Log2(("ppr_virt: uTpr=%#x uSvi=%#x uPpr=%#x\n", uTpr, uSvi, uPpr));
4925	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_PPR, uPpr);
4926	}
4927
4928
4929	/**
4930	* Performs VMX TPR virtualization.
4931	*
4932	* @returns VBox strict status code.
4933	* @param pVCpu The cross context virtual CPU structure.
4934	*/
4935	static VBOXSTRICTRC iemVmxTprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4936	{
4937	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4938
4939	/*
4940	* We should have already performed the virtual-APIC write to the TPR offset
4941	* in the virtual-APIC page. We now perform TPR virtualization.
4942	*
4943	* See Intel spec. 29.1.2 "TPR Virtualization".
4944	*/
4945	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
4946	{
4947	uint32_t const uTprThreshold = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32TprThreshold;
4948	uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4949
4950	/*
4951	* If the VTPR falls below the TPR threshold, we must cause a VM-exit.
4952	* See Intel spec. 29.1.2 "TPR Virtualization".
4953	*/
4954	if (((uTpr >> 4) & 0xf) < uTprThreshold)
4955	{
4956	Log2(("tpr_virt: uTpr=%u uTprThreshold=%u -> VM-exit\n", uTpr, uTprThreshold));
4957	return iemVmxVmexit(pVCpu, VMX_EXIT_TPR_BELOW_THRESHOLD, 0 /* u64ExitQual */);
4958	}
4959	}
4960	else
4961	{
4962	iemVmxPprVirtualization(pVCpu);
4963	iemVmxEvalPendingVirtIntrs(pVCpu);
4964	}
4965
4966	return VINF_SUCCESS;
4967	}
4968
4969
4970	/**
4971	* Checks whether an EOI write for the given interrupt vector causes a VM-exit or
4972	* not.
4973	*
4974	* @returns @c true if the EOI write is intercepted, @c false otherwise.
4975	* @param pVCpu The cross context virtual CPU structure.
4976	* @param uVector The interrupt that was acknowledged using an EOI.
4977	*/
4978	static bool iemVmxIsEoiInterceptSet(PCVMCPU pVCpu, uint8_t uVector) RT_NOEXCEPT
4979	{
4980	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4981	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4982
4983	if (uVector < 64)
4984	return RT_BOOL(pVmcs->u64EoiExitBitmap0.u & RT_BIT_64(uVector));
4985	if (uVector < 128)
4986	return RT_BOOL(pVmcs->u64EoiExitBitmap1.u & RT_BIT_64(uVector));
4987	if (uVector < 192)
4988	return RT_BOOL(pVmcs->u64EoiExitBitmap2.u & RT_BIT_64(uVector));
4989	return RT_BOOL(pVmcs->u64EoiExitBitmap3.u & RT_BIT_64(uVector));
4990	}
4991
4992
4993	/**
4994	* Performs EOI virtualization.
4995	*
4996	* @returns VBox strict status code.
4997	* @param pVCpu The cross context virtual CPU structure.
4998	*/
4999	static VBOXSTRICTRC iemVmxEoiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5000	{
5001	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5002	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
5003
5004	/*
5005	* Clear the interrupt guest-interrupt as no longer in-service (ISR)
5006	* and get the next guest-interrupt that's in-service (if any).
5007	*
5008	* See Intel spec. 29.1.4 "EOI Virtualization".
5009	*/
5010	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5011	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5012	Log2(("eoi_virt: uRvi=%#x uSvi=%#x\n", uRvi, uSvi));
5013
5014	uint8_t uVector = uSvi;
5015	iemVmxVirtApicClearVectorInReg(pVCpu, XAPIC_OFF_ISR0, uVector);
5016
5017	uVector = 0;
5018	iemVmxVirtApicGetHighestSetBitInReg(pVCpu, XAPIC_OFF_ISR0, &uVector);
5019
5020	if (uVector)
5021	Log2(("eoi_virt: next interrupt %#x\n", uVector));
5022	else
5023	Log2(("eoi_virt: no interrupt pending in ISR\n"));
5024
5025	/* Update guest-interrupt status SVI (leave RVI portion as it is) in the VMCS. */
5026	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uRvi, uVector);
5027
5028	iemVmxPprVirtualization(pVCpu);
5029	if (iemVmxIsEoiInterceptSet(pVCpu, uVector))
5030	return iemVmxVmexit(pVCpu, VMX_EXIT_VIRTUALIZED_EOI, uVector);
5031	iemVmxEvalPendingVirtIntrs(pVCpu);
5032	return VINF_SUCCESS;
5033	}
5034
5035
5036	/**
5037	* Performs self-IPI virtualization.
5038	*
5039	* @returns VBox strict status code.
5040	* @param pVCpu The cross context virtual CPU structure.
5041	*/
5042	static VBOXSTRICTRC iemVmxSelfIpiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5043	{
5044	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5045	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
5046
5047	/*
5048	* We should have already performed the virtual-APIC write to the self-IPI offset
5049	* in the virtual-APIC page. We now perform self-IPI virtualization.
5050	*
5051	* See Intel spec. 29.1.5 "Self-IPI Virtualization".
5052	*/
5053	uint8_t const uVector = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_LO);
5054	Log2(("self_ipi_virt: uVector=%#x\n", uVector));
5055	iemVmxVirtApicSetVectorInReg(pVCpu, XAPIC_OFF_IRR0, uVector);
5056	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5057	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5058	if (uVector > uRvi)
5059	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uVector, uSvi);
5060	iemVmxEvalPendingVirtIntrs(pVCpu);
5061	return VINF_SUCCESS;
5062	}
5063
5064
5065	/**
5066	* Performs VMX APIC-write emulation.
5067	*
5068	* @returns VBox strict status code.
5069	* @param pVCpu The cross context virtual CPU structure.
5070	*/
5071	VBOXSTRICTRC iemVmxApicWriteEmulation(PVMCPUCC pVCpu) RT_NOEXCEPT
5072	{
5073	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5074
5075	/* Import the virtual-APIC write offset (part of the hardware-virtualization state). */
5076	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
5077
5078	/*
5079	* Perform APIC-write emulation based on the virtual-APIC register written.
5080	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
5081	*/
5082	uint16_t const offApicWrite = iemVmxVirtApicClearPendingWrite(pVCpu);
5083	VBOXSTRICTRC rcStrict;
5084	switch (offApicWrite)
5085	{
5086	case XAPIC_OFF_TPR:
5087	{
5088	/* Clear bytes 3:1 of the VTPR and perform TPR virtualization. */
5089	uint32_t uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5090	uTpr &= UINT32_C(0x000000ff);
5091	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
5092	Log2(("iemVmxApicWriteEmulation: TPR write %#x\n", uTpr));
5093	rcStrict = iemVmxTprVirtualization(pVCpu);
5094	break;
5095	}
5096
5097	case XAPIC_OFF_EOI:
5098	{
5099	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5100	{
5101	/* Clear VEOI and perform EOI virtualization. */
5102	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_EOI, 0);
5103	Log2(("iemVmxApicWriteEmulation: EOI write\n"));
5104	rcStrict = iemVmxEoiVirtualization(pVCpu);
5105	}
5106	else
5107	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5108	break;
5109	}
5110
5111	case XAPIC_OFF_ICR_LO:
5112	{
5113	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5114	{
5115	/* If the ICR_LO is valid, write it and perform self-IPI virtualization. */
5116	uint32_t const uIcrLo = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5117	uint32_t const fIcrLoMb0 = UINT32_C(0xfffbb700);
5118	uint32_t const fIcrLoMb1 = UINT32_C(0x000000f0);
5119	if ( !(uIcrLo & fIcrLoMb0)
5120	&& (uIcrLo & fIcrLoMb1))
5121	{
5122	Log2(("iemVmxApicWriteEmulation: Self-IPI virtualization with vector %#x\n", (uIcrLo & 0xff)));
5123	rcStrict = iemVmxSelfIpiVirtualization(pVCpu);
5124	}
5125	else
5126	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5127	}
5128	else
5129	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5130	break;
5131	}
5132
5133	case XAPIC_OFF_ICR_HI:
5134	{
5135	/* Clear bytes 2:0 of VICR_HI. No other virtualization or VM-exit must occur. */
5136	uint32_t uIcrHi = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_HI);
5137	uIcrHi &= UINT32_C(0xff000000);
5138	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_ICR_HI, uIcrHi);
5139	rcStrict = VINF_SUCCESS;
5140	break;
5141	}
5142
5143	default:
5144	{
5145	/* Writes to any other virtual-APIC register causes an APIC-write VM-exit. */
5146	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5147	break;
5148	}
5149	}
5150
5151	return rcStrict;
5152	}
5153
5154
5155	/**
5156	* Interface for HM and EM to perform an APIC-write emulation which may cause a
5157	* VM-exit.
5158	*
5159	* @returns Strict VBox status code.
5160	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
5161	* @thread EMT(pVCpu)
5162	*/
5163	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicWrite(PVMCPUCC pVCpu)
5164	{
5165	VBOXSTRICTRC rcStrict = iemVmxApicWriteEmulation(pVCpu);
5166	Assert(!pVCpu->iem.s.cActiveMappings);
5167	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
5168	}
5169
5170
5171	/**
5172	* Checks guest control registers, debug registers and MSRs as part of VM-entry.
5173	*
5174	* @param pVCpu The cross context virtual CPU structure.
5175	* @param pszInstr The VMX instruction name (for logging purposes).
5176	*/
5177	DECLINLINE(int) iemVmxVmentryCheckGuestControlRegsMsrs(PVMCPUCC pVCpu, const char *pszInstr)
5178	{
5179	/*
5180	* Guest Control Registers, Debug Registers, and MSRs.
5181	* See Intel spec. 26.3.1.1 "Checks on Guest Control Registers, Debug Registers, and MSRs".
5182	*/
5183	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5184	const char * const pszFailure = "VM-exit";
5185	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5186
5187	/* CR0 reserved bits. */
5188	{
5189	/* CR0 MB1 bits. */
5190	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
5191	if ((pVmcs->u64GuestCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
5192	{ /* likely */ }
5193	else
5194	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed0);
5195
5196	/* CR0 MBZ bits. */
5197	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5198	if (!(pVmcs->u64GuestCr0.u & ~u64Cr0Fixed1))
5199	{ /* likely */ }
5200	else
5201	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed1);
5202
5203	/* Without unrestricted guest support, VT-x supports does not support unpaged protected mode. */
5204	if ( !fUnrestrictedGuest
5205	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5206	&& !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5207	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0PgPe);
5208	}
5209
5210	/* CR4 reserved bits. */
5211	{
5212	/* CR4 MB1 bits. */
5213	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
5214	if ((pVmcs->u64GuestCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
5215	{ /* likely */ }
5216	else
5217	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed0);
5218
5219	/* CR4 MBZ bits. */
5220	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
5221	if (!(pVmcs->u64GuestCr4.u & ~u64Cr4Fixed1))
5222	{ /* likely */ }
5223	else
5224	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed1);
5225	}
5226
5227	/* DEBUGCTL MSR. */
5228	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5229	\|\| !(pVmcs->u64GuestDebugCtlMsr.u & ~MSR_IA32_DEBUGCTL_VALID_MASK_INTEL))
5230	{ /* likely */ }
5231	else
5232	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDebugCtl);
5233
5234	/* 64-bit CPU checks. */
5235	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5236	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5237	{
5238	if (fGstInLongMode)
5239	{
5240	/* PAE must be set. */
5241	if ( (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5242	&& (pVmcs->u64GuestCr0.u & X86_CR4_PAE))
5243	{ /* likely */ }
5244	else
5245	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPae);
5246	}
5247	else
5248	{
5249	/* PCIDE should not be set. */
5250	if (!(pVmcs->u64GuestCr4.u & X86_CR4_PCIDE))
5251	{ /* likely */ }
5252	else
5253	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPcide);
5254	}
5255
5256	/* CR3. */
5257	if (!(pVmcs->u64GuestCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
5258	{ /* likely */ }
5259	else
5260	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr3);
5261
5262	/* DR7. */
5263	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5264	\|\| !(pVmcs->u64GuestDr7.u & X86_DR7_MBZ_MASK))
5265	{ /* likely */ }
5266	else
5267	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDr7);
5268
5269	/* SYSENTER ESP and SYSENTER EIP. */
5270	if ( X86_IS_CANONICAL(pVmcs->u64GuestSysenterEsp.u)
5271	&& X86_IS_CANONICAL(pVmcs->u64GuestSysenterEip.u))
5272	{ /* likely */ }
5273	else
5274	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSysenterEspEip);
5275	}
5276
5277	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
5278	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
5279
5280	/* PAT MSR. */
5281	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
5282	\|\| CPUMIsPatMsrValid(pVmcs->u64GuestPatMsr.u))
5283	{ /* likely */ }
5284	else
5285	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPatMsr);
5286
5287	/* EFER MSR. */
5288	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
5289	{
5290	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
5291	if (!(pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
5292	{ /* likely */ }
5293	else
5294	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsrRsvd);
5295
5296	bool const fGstLma = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LMA);
5297	bool const fGstLme = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LME);
5298	if ( fGstLma == fGstInLongMode
5299	&& ( !(pVmcs->u64GuestCr0.u & X86_CR0_PG)
5300	\|\| fGstLma == fGstLme))
5301	{ /* likely */ }
5302	else
5303	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsr);
5304	}
5305
5306	/* We don't support IA32_BNDCFGS MSR yet. */
5307	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
5308
5309	NOREF(pszInstr);
5310	NOREF(pszFailure);
5311	return VINF_SUCCESS;
5312	}
5313
5314
5315	/**
5316	* Checks guest segment registers, LDTR and TR as part of VM-entry.
5317	*
5318	* @param pVCpu The cross context virtual CPU structure.
5319	* @param pszInstr The VMX instruction name (for logging purposes).
5320	*/
5321	DECLINLINE(int) iemVmxVmentryCheckGuestSegRegs(PVMCPUCC pVCpu, const char *pszInstr)
5322	{
5323	/*
5324	* Segment registers.
5325	* See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers".
5326	*/
5327	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5328	const char * const pszFailure = "VM-exit";
5329	bool const fGstInV86Mode = RT_BOOL(pVmcs->u64GuestRFlags.u & X86_EFL_VM);
5330	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5331	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5332
5333	/* Selectors. */
5334	if ( !fGstInV86Mode
5335	&& !fUnrestrictedGuest
5336	&& (pVmcs->GuestSs & X86_SEL_RPL) != (pVmcs->GuestCs & X86_SEL_RPL))
5337	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelCsSsRpl);
5338
5339	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
5340	{
5341	CPUMSELREG SelReg;
5342	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &SelReg);
5343	if (RT_LIKELY(rc == VINF_SUCCESS))
5344	{ /* likely */ }
5345	else
5346	return rc;
5347
5348	/*
5349	* Virtual-8086 mode checks.
5350	*/
5351	if (fGstInV86Mode)
5352	{
5353	/* Base address. */
5354	if (SelReg.u64Base == (uint64_t)SelReg.Sel << 4)
5355	{ /* likely */ }
5356	else
5357	{
5358	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBaseV86(iSegReg);
5359	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5360	}
5361
5362	/* Limit. */
5363	if (SelReg.u32Limit == 0xffff)
5364	{ /* likely */ }
5365	else
5366	{
5367	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegLimitV86(iSegReg);
5368	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5369	}
5370
5371	/* Attribute. */
5372	if (SelReg.Attr.u == 0xf3)
5373	{ /* likely */ }
5374	else
5375	{
5376	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrV86(iSegReg);
5377	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5378	}
5379
5380	/* We're done; move to checking the next segment. */
5381	continue;
5382	}
5383
5384	/* Checks done by 64-bit CPUs. */
5385	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5386	{
5387	/* Base address. */
5388	if ( iSegReg == X86_SREG_FS
5389	\|\| iSegReg == X86_SREG_GS)
5390	{
5391	if (X86_IS_CANONICAL(SelReg.u64Base))
5392	{ /* likely */ }
5393	else
5394	{
5395	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5396	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5397	}
5398	}
5399	else if (iSegReg == X86_SREG_CS)
5400	{
5401	if (!RT_HI_U32(SelReg.u64Base))
5402	{ /* likely */ }
5403	else
5404	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseCs);
5405	}
5406	else
5407	{
5408	if ( SelReg.Attr.n.u1Unusable
5409	\|\| !RT_HI_U32(SelReg.u64Base))
5410	{ /* likely */ }
5411	else
5412	{
5413	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5414	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5415	}
5416	}
5417	}
5418
5419	/*
5420	* Checks outside Virtual-8086 mode.
5421	*/
5422	uint8_t const uSegType = SelReg.Attr.n.u4Type;
5423	uint8_t const fCodeDataSeg = SelReg.Attr.n.u1DescType;
5424	uint8_t const fUsable = !SelReg.Attr.n.u1Unusable;
5425	uint8_t const uDpl = SelReg.Attr.n.u2Dpl;
5426	uint8_t const fPresent = SelReg.Attr.n.u1Present;
5427	uint8_t const uGranularity = SelReg.Attr.n.u1Granularity;
5428	uint8_t const uDefBig = SelReg.Attr.n.u1DefBig;
5429	uint8_t const fSegLong = SelReg.Attr.n.u1Long;
5430
5431	/* Code or usable segment. */
5432	if ( iSegReg == X86_SREG_CS
5433	\|\| fUsable)
5434	{
5435	/* Reserved bits (bits 31:17 and bits 11:8). */
5436	if (!(SelReg.Attr.u & 0xfffe0f00))
5437	{ /* likely */ }
5438	else
5439	{
5440	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrRsvd(iSegReg);
5441	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5442	}
5443
5444	/* Descriptor type. */
5445	if (fCodeDataSeg)
5446	{ /* likely */ }
5447	else
5448	{
5449	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDescType(iSegReg);
5450	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5451	}
5452
5453	/* Present. */
5454	if (fPresent)
5455	{ /* likely */ }
5456	else
5457	{
5458	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrPresent(iSegReg);
5459	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5460	}
5461
5462	/* Granularity. */
5463	if ( ((SelReg.u32Limit & 0x00000fff) == 0x00000fff \|\| !uGranularity)
5464	&& ((SelReg.u32Limit & 0xfff00000) == 0x00000000 \|\| uGranularity))
5465	{ /* likely */ }
5466	else
5467	{
5468	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrGran(iSegReg);
5469	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5470	}
5471	}
5472
5473	if (iSegReg == X86_SREG_CS)
5474	{
5475	/* Segment Type and DPL. */
5476	if ( uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5477	&& fUnrestrictedGuest)
5478	{
5479	if (uDpl == 0)
5480	{ /* likely */ }
5481	else
5482	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplZero);
5483	}
5484	else if ( uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_ACCESSED)
5485	\|\| uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5486	{
5487	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5488	if (uDpl == AttrSs.n.u2Dpl)
5489	{ /* likely */ }
5490	else
5491	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplEqSs);
5492	}
5493	else if ((uSegType & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5494	== (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5495	{
5496	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5497	if (uDpl <= AttrSs.n.u2Dpl)
5498	{ /* likely */ }
5499	else
5500	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplLtSs);
5501	}
5502	else
5503	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsType);
5504
5505	/* Def/Big. */
5506	if ( fGstInLongMode
5507	&& fSegLong)
5508	{
5509	if (uDefBig == 0)
5510	{ /* likely */ }
5511	else
5512	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDefBig);
5513	}
5514	}
5515	else if (iSegReg == X86_SREG_SS)
5516	{
5517	/* Segment Type. */
5518	if ( !fUsable
5519	\|\| uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5520	\|\| uSegType == (X86_SEL_TYPE_DOWN \| X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED))
5521	{ /* likely */ }
5522	else
5523	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsType);
5524
5525	/* DPL. */
5526	if (!fUnrestrictedGuest)
5527	{
5528	if (uDpl == (SelReg.Sel & X86_SEL_RPL))
5529	{ /* likely */ }
5530	else
5531	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplEqRpl);
5532	}
5533	X86DESCATTR AttrCs; AttrCs.u = pVmcs->u32GuestCsAttr;
5534	if ( AttrCs.n.u4Type == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5535	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5536	{
5537	if (uDpl == 0)
5538	{ /* likely */ }
5539	else
5540	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplZero);
5541	}
5542	}
5543	else
5544	{
5545	/* DS, ES, FS, GS. */
5546	if (fUsable)
5547	{
5548	/* Segment type. */
5549	if (uSegType & X86_SEL_TYPE_ACCESSED)
5550	{ /* likely */ }
5551	else
5552	{
5553	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrTypeAcc(iSegReg);
5554	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5555	}
5556
5557	if ( !(uSegType & X86_SEL_TYPE_CODE)
5558	\|\| (uSegType & X86_SEL_TYPE_READ))
5559	{ /* likely */ }
5560	else
5561	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsTypeRead);
5562
5563	/* DPL. */
5564	if ( !fUnrestrictedGuest
5565	&& uSegType <= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5566	{
5567	if (uDpl >= (SelReg.Sel & X86_SEL_RPL))
5568	{ /* likely */ }
5569	else
5570	{
5571	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDplRpl(iSegReg);
5572	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5573	}
5574	}
5575	}
5576	}
5577	}
5578
5579	/*
5580	* LDTR.
5581	*/
5582	{
5583	CPUMSELREG Ldtr;
5584	Ldtr.Sel = pVmcs->GuestLdtr;
5585	Ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
5586	Ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
5587	Ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
5588
5589	if (!Ldtr.Attr.n.u1Unusable)
5590	{
5591	/* Selector. */
5592	if (!(Ldtr.Sel & X86_SEL_LDT))
5593	{ /* likely */ }
5594	else
5595	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelLdtr);
5596
5597	/* Base. */
5598	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5599	{
5600	if (X86_IS_CANONICAL(Ldtr.u64Base))
5601	{ /* likely */ }
5602	else
5603	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseLdtr);
5604	}
5605
5606	/* Attributes. */
5607	/* Reserved bits (bits 31:17 and bits 11:8). */
5608	if (!(Ldtr.Attr.u & 0xfffe0f00))
5609	{ /* likely */ }
5610	else
5611	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrRsvd);
5612
5613	if (Ldtr.Attr.n.u4Type == X86_SEL_TYPE_SYS_LDT)
5614	{ /* likely */ }
5615	else
5616	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrType);
5617
5618	if (!Ldtr.Attr.n.u1DescType)
5619	{ /* likely */ }
5620	else
5621	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrDescType);
5622
5623	if (Ldtr.Attr.n.u1Present)
5624	{ /* likely */ }
5625	else
5626	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrPresent);
5627
5628	if ( ((Ldtr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Ldtr.Attr.n.u1Granularity)
5629	&& ((Ldtr.u32Limit & 0xfff00000) == 0x00000000 \|\| Ldtr.Attr.n.u1Granularity))
5630	{ /* likely */ }
5631	else
5632	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrGran);
5633	}
5634	}
5635
5636	/*
5637	* TR.
5638	*/
5639	{
5640	CPUMSELREG Tr;
5641	Tr.Sel = pVmcs->GuestTr;
5642	Tr.u32Limit = pVmcs->u32GuestTrLimit;
5643	Tr.u64Base = pVmcs->u64GuestTrBase.u;
5644	Tr.Attr.u = pVmcs->u32GuestTrAttr;
5645
5646	/* Selector. */
5647	if (!(Tr.Sel & X86_SEL_LDT))
5648	{ /* likely */ }
5649	else
5650	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelTr);
5651
5652	/* Base. */
5653	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5654	{
5655	if (X86_IS_CANONICAL(Tr.u64Base))
5656	{ /* likely */ }
5657	else
5658	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseTr);
5659	}
5660
5661	/* Attributes. */
5662	/* Reserved bits (bits 31:17 and bits 11:8). */
5663	if (!(Tr.Attr.u & 0xfffe0f00))
5664	{ /* likely */ }
5665	else
5666	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrRsvd);
5667
5668	if (!Tr.Attr.n.u1Unusable)
5669	{ /* likely */ }
5670	else
5671	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrUnusable);
5672
5673	if ( Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY
5674	\|\| ( !fGstInLongMode
5675	&& Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY))
5676	{ /* likely */ }
5677	else
5678	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrType);
5679
5680	if (!Tr.Attr.n.u1DescType)
5681	{ /* likely */ }
5682	else
5683	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrDescType);
5684
5685	if (Tr.Attr.n.u1Present)
5686	{ /* likely */ }
5687	else
5688	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrPresent);
5689
5690	if ( ((Tr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Tr.Attr.n.u1Granularity)
5691	&& ((Tr.u32Limit & 0xfff00000) == 0x00000000 \|\| Tr.Attr.n.u1Granularity))
5692	{ /* likely */ }
5693	else
5694	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrGran);
5695	}
5696
5697	NOREF(pszInstr);
5698	NOREF(pszFailure);
5699	return VINF_SUCCESS;
5700	}
5701
5702
5703	/**
5704	* Checks guest GDTR and IDTR as part of VM-entry.
5705	*
5706	* @param pVCpu The cross context virtual CPU structure.
5707	* @param pszInstr The VMX instruction name (for logging purposes).
5708	*/
5709	DECLINLINE(int) iemVmxVmentryCheckGuestGdtrIdtr(PVMCPUCC pVCpu, const char *pszInstr)
5710	{
5711	/*
5712	* GDTR and IDTR.
5713	* See Intel spec. 26.3.1.3 "Checks on Guest Descriptor-Table Registers".
5714	*/
5715	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5716	const char *const pszFailure = "VM-exit";
5717
5718	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5719	{
5720	/* Base. */
5721	if (X86_IS_CANONICAL(pVmcs->u64GuestGdtrBase.u))
5722	{ /* likely */ }
5723	else
5724	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrBase);
5725
5726	if (X86_IS_CANONICAL(pVmcs->u64GuestIdtrBase.u))
5727	{ /* likely */ }
5728	else
5729	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrBase);
5730	}
5731
5732	/* Limit. */
5733	if (!RT_HI_U16(pVmcs->u32GuestGdtrLimit))
5734	{ /* likely */ }
5735	else
5736	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrLimit);
5737
5738	if (!RT_HI_U16(pVmcs->u32GuestIdtrLimit))
5739	{ /* likely */ }
5740	else
5741	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrLimit);
5742
5743	NOREF(pszInstr);
5744	NOREF(pszFailure);
5745	return VINF_SUCCESS;
5746	}
5747
5748
5749	/**
5750	* Checks guest RIP and RFLAGS as part of VM-entry.
5751	*
5752	* @param pVCpu The cross context virtual CPU structure.
5753	* @param pszInstr The VMX instruction name (for logging purposes).
5754	*/
5755	DECLINLINE(int) iemVmxVmentryCheckGuestRipRFlags(PVMCPUCC pVCpu, const char *pszInstr)
5756	{
5757	/*
5758	* RIP and RFLAGS.
5759	* See Intel spec. 26.3.1.4 "Checks on Guest RIP and RFLAGS".
5760	*/
5761	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5762	const char *const pszFailure = "VM-exit";
5763	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5764
5765	/* RIP. */
5766	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5767	{
5768	X86DESCATTR AttrCs;
5769	AttrCs.u = pVmcs->u32GuestCsAttr;
5770	if ( !fGstInLongMode
5771	\|\| !AttrCs.n.u1Long)
5772	{
5773	if (!RT_HI_U32(pVmcs->u64GuestRip.u))
5774	{ /* likely */ }
5775	else
5776	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRipRsvd);
5777	}
5778
5779	if ( fGstInLongMode
5780	&& AttrCs.n.u1Long)
5781	{
5782	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth == 48); /* Canonical. */
5783	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth < 64
5784	&& X86_IS_CANONICAL(pVmcs->u64GuestRip.u))
5785	{ /* likely */ }
5786	else
5787	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRip);
5788	}
5789	}
5790
5791	/* RFLAGS (bits 63:22 (or 31:22), bits 15, 5, 3 are reserved, bit 1 MB1). */
5792	uint64_t const uGuestRFlags = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode ? pVmcs->u64GuestRFlags.u
5793	: pVmcs->u64GuestRFlags.s.Lo;
5794	if ( !(uGuestRFlags & ~(X86_EFL_LIVE_MASK \| X86_EFL_RA1_MASK))
5795	&& (uGuestRFlags & X86_EFL_RA1_MASK) == X86_EFL_RA1_MASK)
5796	{ /* likely */ }
5797	else
5798	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsRsvd);
5799
5800	if (!(uGuestRFlags & X86_EFL_VM))
5801	{ /* likely */ }
5802	else
5803	{
5804	if ( fGstInLongMode
5805	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5806	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsVm);
5807	}
5808
5809	if (VMX_ENTRY_INT_INFO_IS_EXT_INT(pVmcs->u32EntryIntInfo))
5810	{
5811	if (uGuestRFlags & X86_EFL_IF)
5812	{ /* likely */ }
5813	else
5814	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsIf);
5815	}
5816
5817	NOREF(pszInstr);
5818	NOREF(pszFailure);
5819	return VINF_SUCCESS;
5820	}
5821
5822
5823	/**
5824	* Checks guest non-register state as part of VM-entry.
5825	*
5826	* @param pVCpu The cross context virtual CPU structure.
5827	* @param pszInstr The VMX instruction name (for logging purposes).
5828	*/
5829	DECLINLINE(int) iemVmxVmentryCheckGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr)
5830	{
5831	/*
5832	* Guest non-register state.
5833	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
5834	*/
5835	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5836	const char *const pszFailure = "VM-exit";
5837
5838	/*
5839	* Activity state.
5840	*/
5841	uint64_t const u64GuestVmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
5842	uint32_t const fActivityStateMask = RT_BF_GET(u64GuestVmxMiscMsr, VMX_BF_MISC_ACTIVITY_STATES);
5843	if (!(pVmcs->u32GuestActivityState & fActivityStateMask))
5844	{ /* likely */ }
5845	else
5846	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateRsvd);
5847
5848	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5849	if ( !AttrSs.n.u2Dpl
5850	\|\| pVmcs->u32GuestActivityState != VMX_VMCS_GUEST_ACTIVITY_HLT)
5851	{ /* likely */ }
5852	else
5853	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateSsDpl);
5854
5855	if ( pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_STI
5856	\|\| pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
5857	{
5858	if (pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_ACTIVE)
5859	{ /* likely */ }
5860	else
5861	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateStiMovSs);
5862	}
5863
5864	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5865	{
5866	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5867	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
5868	AssertCompile(VMX_V_GUEST_ACTIVITY_STATE_MASK == (VMX_VMCS_GUEST_ACTIVITY_HLT \| VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN));
5869	switch (pVmcs->u32GuestActivityState)
5870	{
5871	case VMX_VMCS_GUEST_ACTIVITY_HLT:
5872	{
5873	if ( uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT
5874	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5875	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5876	&& ( uVector == X86_XCPT_DB
5877	\|\| uVector == X86_XCPT_MC))
5878	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT
5879	&& uVector == VMX_ENTRY_INT_INFO_VECTOR_MTF))
5880	{ /* likely */ }
5881	else
5882	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateHlt);
5883	break;
5884	}
5885
5886	case VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN:
5887	{
5888	if ( uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5889	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5890	&& uVector == X86_XCPT_MC))
5891	{ /* likely */ }
5892	else
5893	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateShutdown);
5894	break;
5895	}
5896
5897	case VMX_VMCS_GUEST_ACTIVITY_ACTIVE:
5898	default:
5899	break;
5900	}
5901	}
5902
5903	/*
5904	* Interruptibility state.
5905	*/
5906	if (!(pVmcs->u32GuestIntrState & ~VMX_VMCS_GUEST_INT_STATE_MASK))
5907	{ /* likely */ }
5908	else
5909	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRsvd);
5910
5911	if ((pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5912	!= (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5913	{ /* likely */ }
5914	else
5915	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateStiMovSs);
5916
5917	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_IF)
5918	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5919	{ /* likely */ }
5920	else
5921	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRFlagsSti);
5922
5923	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5924	{
5925	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5926	if (uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT)
5927	{
5928	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5929	{ /* likely */ }
5930	else
5931	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateExtInt);
5932	}
5933	else if (uType == VMX_ENTRY_INT_INFO_TYPE_NMI)
5934	{
5935	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5936	{ /* likely */ }
5937	else
5938	{
5939	/*
5940	* We don't support injecting NMIs when blocking-by-STI would be in effect.
5941	* We update the Exit qualification only when blocking-by-STI is set
5942	* without blocking-by-MovSS being set. Although in practise it does not
5943	* make much difference since the order of checks are implementation defined.
5944	*/
5945	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
5946	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_NMI_INJECT);
5947	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateNmi);
5948	}
5949
5950	if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
5951	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI))
5952	{ /* likely */ }
5953	else
5954	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateVirtNmi);
5955	}
5956	}
5957
5958	/* We don't support SMM yet. So blocking-by-SMIs must not be set. */
5959	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_SMI))
5960	{ /* likely */ }
5961	else
5962	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateSmi);
5963
5964	/* We don't support SGX yet. So enclave-interruption must not be set. */
5965	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_ENCLAVE))
5966	{ /* likely */ }
5967	else
5968	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateEnclave);
5969
5970	/*
5971	* Pending debug exceptions.
5972	*/
5973	uint64_t const uPendingDbgXcpts = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode
5974	? pVmcs->u64GuestPendingDbgXcpts.u
5975	: pVmcs->u64GuestPendingDbgXcpts.s.Lo;
5976	if (!(uPendingDbgXcpts & ~VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK))
5977	{ /* likely */ }
5978	else
5979	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRsvd);
5980
5981	if ( (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5982	\|\| pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_HLT)
5983	{
5984	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5985	&& !(pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF)
5986	&& !(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5987	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsTf);
5988
5989	if ( ( !(pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5990	\|\| (pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF))
5991	&& (uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5992	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsNoTf);
5993	}
5994
5995	/* We don't support RTM (Real-time Transactional Memory) yet. */
5996	if (!(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_RTM))
5997	{ /* likely */ }
5998	else
5999	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRtm);
6000
6001	/*
6002	* VMCS link pointer.
6003	*/
6004	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
6005	{
6006	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
6007	/* We don't support SMM yet (so VMCS link pointer cannot be the current VMCS). */
6008	if (GCPhysShadowVmcs != IEM_VMX_GET_CURRENT_VMCS(pVCpu))
6009	{ /* likely */ }
6010	else
6011	{
6012	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6013	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrCurVmcs);
6014	}
6015
6016	/* Validate the address. */
6017	if ( !(GCPhysShadowVmcs & X86_PAGE_4K_OFFSET_MASK)
6018	&& !(GCPhysShadowVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6019	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysShadowVmcs))
6020	{ /* likely */ }
6021	else
6022	{
6023	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6024	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmcsLinkPtr);
6025	}
6026	}
6027
6028	NOREF(pszInstr);
6029	NOREF(pszFailure);
6030	return VINF_SUCCESS;
6031	}
6032
6033
6034	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6035	/**
6036	* Checks guest PDPTEs as part of VM-entry.
6037	*
6038	* @param pVCpu The cross context virtual CPU structure.
6039	* @param pszInstr The VMX instruction name (for logging purposes).
6040	*/
6041	static int iemVmxVmentryCheckGuestPdptes(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6042	{
6043	/*
6044	* Guest PDPTEs.
6045	* See Intel spec. 26.3.1.5 "Checks on Guest Page-Directory-Pointer-Table Entries".
6046	*/
6047	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6048	const char * const pszFailure = "VM-exit";
6049
6050	/*
6051	* When EPT is used, we need to validate the PAE PDPTEs provided in the VMCS.
6052	* Otherwise, we load any PAE PDPTEs referenced by CR3 at a later point.
6053	*/
6054	if ( iemVmxVmcsIsGuestPaePagingEnabled(pVmcs)
6055	&& (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
6056	{
6057	/* Get PDPTEs from the VMCS. */
6058	X86PDPE aPaePdptes[X86_PG_PAE_PDPE_ENTRIES];
6059	aPaePdptes[0].u = pVmcs->u64GuestPdpte0.u;
6060	aPaePdptes[1].u = pVmcs->u64GuestPdpte1.u;
6061	aPaePdptes[2].u = pVmcs->u64GuestPdpte2.u;
6062	aPaePdptes[3].u = pVmcs->u64GuestPdpte3.u;
6063
6064	/* Check validity of the PDPTEs. */
6065	if (PGMGstArePaePdpesValid(pVCpu, &aPaePdptes[0]))
6066	{ /* likely */ }
6067	else
6068	{
6069	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
6070	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte);
6071	}
6072	}
6073
6074	NOREF(pszFailure);
6075	NOREF(pszInstr);
6076	return VINF_SUCCESS;
6077	}
6078	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
6079
6080
6081	/**
6082	* Checks guest-state as part of VM-entry.
6083	*
6084	* @returns VBox status code.
6085	* @param pVCpu The cross context virtual CPU structure.
6086	* @param pszInstr The VMX instruction name (for logging purposes).
6087	*/
6088	static int iemVmxVmentryCheckGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6089	{
6090	int rc = iemVmxVmentryCheckGuestControlRegsMsrs(pVCpu, pszInstr);
6091	if (RT_SUCCESS(rc))
6092	{
6093	rc = iemVmxVmentryCheckGuestSegRegs(pVCpu, pszInstr);
6094	if (RT_SUCCESS(rc))
6095	{
6096	rc = iemVmxVmentryCheckGuestGdtrIdtr(pVCpu, pszInstr);
6097	if (RT_SUCCESS(rc))
6098	{
6099	rc = iemVmxVmentryCheckGuestRipRFlags(pVCpu, pszInstr);
6100	if (RT_SUCCESS(rc))
6101	{
6102	rc = iemVmxVmentryCheckGuestNonRegState(pVCpu, pszInstr);
6103	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6104	if (RT_SUCCESS(rc))
6105	rc = iemVmxVmentryCheckGuestPdptes(pVCpu, pszInstr);
6106	#endif
6107	}
6108	}
6109	}
6110	}
6111	return rc;
6112	}
6113
6114
6115	/**
6116	* Checks host-state as part of VM-entry.
6117	*
6118	* @returns VBox status code.
6119	* @param pVCpu The cross context virtual CPU structure.
6120	* @param pszInstr The VMX instruction name (for logging purposes).
6121	*/
6122	static int iemVmxVmentryCheckHostState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6123	{
6124	/*
6125	* Host Control Registers and MSRs.
6126	* See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
6127	*/
6128	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6129	const char * const pszFailure = "VMFail";
6130
6131	/* CR0 reserved bits. */
6132	{
6133	/* CR0 MB1 bits. */
6134	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
6135	if ((pVmcs->u64HostCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
6136	{ /* likely */ }
6137	else
6138	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed0);
6139
6140	/* CR0 MBZ bits. */
6141	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6142	if (!(pVmcs->u64HostCr0.u & ~u64Cr0Fixed1))
6143	{ /* likely */ }
6144	else
6145	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed1);
6146	}
6147
6148	/* CR4 reserved bits. */
6149	{
6150	/* CR4 MB1 bits. */
6151	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6152	if ((pVmcs->u64HostCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
6153	{ /* likely */ }
6154	else
6155	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed0);
6156
6157	/* CR4 MBZ bits. */
6158	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6159	if (!(pVmcs->u64HostCr4.u & ~u64Cr4Fixed1))
6160	{ /* likely */ }
6161	else
6162	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed1);
6163	}
6164
6165	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6166	{
6167	/* CR3 reserved bits. */
6168	if (!(pVmcs->u64HostCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
6169	{ /* likely */ }
6170	else
6171	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr3);
6172
6173	/* SYSENTER ESP and SYSENTER EIP. */
6174	if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
6175	&& X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
6176	{ /* likely */ }
6177	else
6178	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSysenterEspEip);
6179	}
6180
6181	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6182	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR));
6183
6184	/* PAT MSR. */
6185	if ( !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
6186	\|\| CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
6187	{ /* likely */ }
6188	else
6189	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostPatMsr);
6190
6191	/* EFER MSR. */
6192	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
6193	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
6194	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
6195	{
6196	if (!(pVmcs->u64HostEferMsr.u & ~uValidEferMask))
6197	{ /* likely */ }
6198	else
6199	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsrRsvd);
6200
6201	bool const fHostLma = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LMA);
6202	bool const fHostLme = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LME);
6203	if ( fHostInLongMode == fHostLma
6204	&& fHostInLongMode == fHostLme)
6205	{ /* likely */ }
6206	else
6207	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsr);
6208	}
6209
6210	/*
6211	* Host Segment and Descriptor-Table Registers.
6212	* See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
6213	*/
6214	/* Selector RPL and TI. */
6215	if ( !(pVmcs->HostCs & (X86_SEL_RPL \| X86_SEL_LDT))
6216	&& !(pVmcs->HostSs & (X86_SEL_RPL \| X86_SEL_LDT))
6217	&& !(pVmcs->HostDs & (X86_SEL_RPL \| X86_SEL_LDT))
6218	&& !(pVmcs->HostEs & (X86_SEL_RPL \| X86_SEL_LDT))
6219	&& !(pVmcs->HostFs & (X86_SEL_RPL \| X86_SEL_LDT))
6220	&& !(pVmcs->HostGs & (X86_SEL_RPL \| X86_SEL_LDT))
6221	&& !(pVmcs->HostTr & (X86_SEL_RPL \| X86_SEL_LDT)))
6222	{ /* likely */ }
6223	else
6224	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSel);
6225
6226	/* CS and TR selectors cannot be 0. */
6227	if ( pVmcs->HostCs
6228	&& pVmcs->HostTr)
6229	{ /* likely */ }
6230	else
6231	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCsTr);
6232
6233	/* SS cannot be 0 if 32-bit host. */
6234	if ( fHostInLongMode
6235	\|\| pVmcs->HostSs)
6236	{ /* likely */ }
6237	else
6238	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSs);
6239
6240	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6241	{
6242	/* FS, GS, GDTR, IDTR, TR base address. */
6243	if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6244	&& X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6245	&& X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
6246	&& X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
6247	&& X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
6248	{ /* likely */ }
6249	else
6250	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSegBase);
6251	}
6252
6253	/*
6254	* Host address-space size for 64-bit CPUs.
6255	* See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
6256	*/
6257	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6258	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6259	{
6260	bool const fCpuInLongMode = CPUMIsGuestInLongMode(pVCpu);
6261
6262	/* Logical processor in IA-32e mode. */
6263	if (fCpuInLongMode)
6264	{
6265	if (fHostInLongMode)
6266	{
6267	/* PAE must be set. */
6268	if (pVmcs->u64HostCr4.u & X86_CR4_PAE)
6269	{ /* likely */ }
6270	else
6271	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pae);
6272
6273	/* RIP must be canonical. */
6274	if (X86_IS_CANONICAL(pVmcs->u64HostRip.u))
6275	{ /* likely */ }
6276	else
6277	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRip);
6278	}
6279	else
6280	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostLongMode);
6281	}
6282	else
6283	{
6284	/* Logical processor is outside IA-32e mode. */
6285	if ( !fGstInLongMode
6286	&& !fHostInLongMode)
6287	{
6288	/* PCIDE should not be set. */
6289	if (!(pVmcs->u64HostCr4.u & X86_CR4_PCIDE))
6290	{ /* likely */ }
6291	else
6292	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pcide);
6293
6294	/* The high 32-bits of RIP MBZ. */
6295	if (!pVmcs->u64HostRip.s.Hi)
6296	{ /* likely */ }
6297	else
6298	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRipRsvd);
6299	}
6300	else
6301	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongMode);
6302	}
6303	}
6304	else
6305	{
6306	/* Host address-space size for 32-bit CPUs. */
6307	if ( !fGstInLongMode
6308	&& !fHostInLongMode)
6309	{ /* likely */ }
6310	else
6311	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongModeNoCpu);
6312	}
6313
6314	NOREF(pszInstr);
6315	NOREF(pszFailure);
6316	return VINF_SUCCESS;
6317	}
6318
6319
6320	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6321	/**
6322	* Checks the EPT pointer VMCS field as part of VM-entry.
6323	*
6324	* @returns VBox status code.
6325	* @param pVCpu The cross context virtual CPU structure.
6326	* @param uEptPtr The EPT pointer to check.
6327	* @param penmVmxDiag Where to store the diagnostic reason on failure (not
6328	* updated on success). Optional, can be NULL.
6329	*/
6330	static int iemVmxVmentryCheckEptPtr(PVMCPUCC pVCpu, uint64_t uEptPtr, VMXVDIAG *penmVmxDiag) RT_NOEXCEPT
6331	{
6332	VMXVDIAG enmVmxDiag;
6333
6334	/* Reserved bits. */
6335	uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
6336	uint64_t const fValidMask = VMX_EPTP_VALID_MASK & ~(UINT64_MAX << cMaxPhysAddrWidth);
6337	if (uEptPtr & fValidMask)
6338	{
6339	/* Memory Type. */
6340	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
6341	uint8_t const fMemType = RT_BF_GET(uEptPtr, VMX_BF_EPTP_MEMTYPE);
6342	if ( ( fMemType == VMX_EPTP_MEMTYPE_WB
6343	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_WB))
6344	\|\| ( fMemType == VMX_EPTP_MEMTYPE_UC
6345	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_UC)))
6346	{
6347	/*
6348	* Page walk length (PML4).
6349	* Intel used to specify bit 7 of IA32_VMX_EPT_VPID_CAP as page walk length
6350	* of 5 but that seems to be removed from the latest specs. leaving only PML4
6351	* as the maximum supported page-walk level hence we hardcode it as 3 (1 less than 4)
6352	*/
6353	Assert(RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_PAGE_WALK_LENGTH_4));
6354	if (RT_BF_GET(uEptPtr, VMX_BF_EPTP_PAGE_WALK_LENGTH) == 3)
6355	{
6356	/* Access and dirty bits support in EPT structures. */
6357	if ( !RT_BF_GET(uEptPtr, VMX_BF_EPTP_ACCESS_DIRTY)
6358	\|\| RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_ACCESS_DIRTY))
6359	return VINF_SUCCESS;
6360
6361	enmVmxDiag = kVmxVDiag_Vmentry_EptpAccessDirty;
6362	}
6363	else
6364	enmVmxDiag = kVmxVDiag_Vmentry_EptpPageWalkLength;
6365	}
6366	else
6367	enmVmxDiag = kVmxVDiag_Vmentry_EptpMemType;
6368	}
6369	else
6370	enmVmxDiag = kVmxVDiag_Vmentry_EptpRsvd;
6371
6372	if (penmVmxDiag)
6373	*penmVmxDiag = enmVmxDiag;
6374	return VERR_VMX_VMENTRY_FAILED;
6375	}
6376	#endif
6377
6378
6379	/**
6380	* Checks VMCS controls fields as part of VM-entry.
6381	*
6382	* @returns VBox status code.
6383	* @param pVCpu The cross context virtual CPU structure.
6384	* @param pszInstr The VMX instruction name (for logging purposes).
6385	*
6386	* @remarks This may update secondary-processor based VM-execution control fields
6387	* in the current VMCS if necessary.
6388	*/
6389	static int iemVmxVmentryCheckCtls(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6390	{
6391	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6392	const char * const pszFailure = "VMFail";
6393	bool const fVmxTrueMsrs = RT_BOOL(pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Basic & VMX_BF_BASIC_TRUE_CTLS_MASK);
6394
6395	/*
6396	* VM-execution controls.
6397	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6398	*/
6399	{
6400	/* Pin-based VM-execution controls. */
6401	{
6402	VMXCTLSMSR const PinCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TruePinCtls
6403	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.PinCtls;
6404	if (!(~pVmcs->u32PinCtls & PinCtls.n.allowed0))
6405	{ /* likely */ }
6406	else
6407	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsDisallowed0);
6408
6409	if (!(pVmcs->u32PinCtls & ~PinCtls.n.allowed1))
6410	{ /* likely */ }
6411	else
6412	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsAllowed1);
6413	}
6414
6415	/* Processor-based VM-execution controls. */
6416	{
6417	VMXCTLSMSR const ProcCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueProcCtls
6418	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls;
6419	if (!(~pVmcs->u32ProcCtls & ProcCtls.n.allowed0))
6420	{ /* likely */ }
6421	else
6422	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsDisallowed0);
6423
6424	if (!(pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1))
6425	{ /* likely */ }
6426	else
6427	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsAllowed1);
6428	}
6429
6430	/* Secondary processor-based VM-execution controls. */
6431	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
6432	{
6433	VMXCTLSMSR const ProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls2;
6434	if (!(~pVmcs->u32ProcCtls2 & ProcCtls2.n.allowed0))
6435	{ /* likely */ }
6436	else
6437	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Disallowed0);
6438
6439	if (!(pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1))
6440	{ /* likely */ }
6441	else
6442	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Allowed1);
6443	}
6444	else if (pVmcs->u32ProcCtls2)
6445	{
6446	/*
6447	* If the "activate secondary controls" is clear, then the secondary processor-based VM-execution controls
6448	* is treated as 0.
6449	*
6450	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6451	*
6452	* Since this is a rather rare occurrence (only observed for a few VM-entries with Microsoft Hyper-V
6453	* enabled Windows Server 2008 R2 guest), it's not worth changing every place that reads this control to
6454	* also check the "activate secondary controls" bit. Instead, we temporarily save the guest programmed
6455	* control here, zero out the value the rest of our code uses and restore the guest programmed value
6456	* on VM-exit.
6457	*/
6458	pVmcs->u32RestoreProcCtls2 = pVmcs->u32ProcCtls2;
6459	pVmcs->u32ProcCtls2 = 0;
6460	}
6461
6462	/* CR3-target count. */
6463	if (pVmcs->u32Cr3TargetCount <= VMX_V_CR3_TARGET_COUNT)
6464	{ /* likely */ }
6465	else
6466	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Cr3TargetCount);
6467
6468	/* I/O bitmaps physical addresses. */
6469	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
6470	{
6471	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
6472	if ( !(GCPhysIoBitmapA & X86_PAGE_4K_OFFSET_MASK)
6473	&& !(GCPhysIoBitmapA >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6474	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapA))
6475	{ /* likely */ }
6476	else
6477	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapA);
6478
6479	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
6480	if ( !(GCPhysIoBitmapB & X86_PAGE_4K_OFFSET_MASK)
6481	&& !(GCPhysIoBitmapB >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6482	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapB))
6483	{ /* likely */ }
6484	else
6485	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapB);
6486	}
6487
6488	/* MSR bitmap physical address. */
6489	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
6490	{
6491	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
6492	if ( !(GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
6493	&& !(GCPhysMsrBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6494	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysMsrBitmap))
6495	{ /* likely */ }
6496	else
6497	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrMsrBitmap);
6498	}
6499
6500	/* TPR shadow related controls. */
6501	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6502	{
6503	/* Virtual-APIC page physical address. */
6504	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6505	if ( !(GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
6506	&& !(GCPhysVirtApic >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6507	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
6508	{ /* likely */ }
6509	else
6510	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVirtApicPage);
6511
6512	/* TPR threshold bits 31:4 MBZ without virtual-interrupt delivery. */
6513	if ( !(pVmcs->u32TprThreshold & ~VMX_TPR_THRESHOLD_MASK)
6514	\|\| (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6515	{ /* likely */ }
6516	else
6517	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdRsvd);
6518
6519	/* The rest done XXX document */
6520	}
6521	else
6522	{
6523	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6524	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6525	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6526	{ /* likely */ }
6527	else
6528	{
6529	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6530	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicTprShadow);
6531	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6532	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ApicRegVirt);
6533	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
6534	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtIntDelivery);
6535	}
6536	}
6537
6538	/* NMI exiting and virtual-NMIs. */
6539	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
6540	\|\| !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
6541	{ /* likely */ }
6542	else
6543	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtNmi);
6544
6545	/* Virtual-NMIs and NMI-window exiting. */
6546	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
6547	\|\| !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
6548	{ /* likely */ }
6549	else
6550	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_NmiWindowExit);
6551
6552	/* Virtualize APIC accesses. */
6553	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
6554	{
6555	/* APIC-access physical address. */
6556	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
6557	if ( !(GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
6558	&& !(GCPhysApicAccess >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6559	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
6560	{ /* likely */ }
6561	else
6562	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccess);
6563
6564	/*
6565	* Disallow APIC-access page and virtual-APIC page from being the same address.
6566	* Note! This is not an Intel requirement, but one imposed by our implementation.
6567	*/
6568	/** @todo r=ramshankar: This is done primarily to simplify recursion scenarios while
6569	* redirecting accesses between the APIC-access page and the virtual-APIC
6570	* page. If any nested hypervisor requires this, we can implement it later. */
6571	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6572	{
6573	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6574	if (GCPhysVirtApic != GCPhysApicAccess)
6575	{ /* likely */ }
6576	else
6577	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessEqVirtApic);
6578	}
6579	}
6580
6581	/* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
6582	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6583	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
6584	{ /* likely */ }
6585	else
6586	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6587
6588	/* Virtual-interrupt delivery requires external interrupt exiting. */
6589	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
6590	\|\| (pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
6591	{ /* likely */ }
6592	else
6593	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6594
6595	/* VPID. */
6596	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
6597	\|\| pVmcs->u16Vpid != 0)
6598	{ /* likely */ }
6599	else
6600	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Vpid);
6601
6602	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6603	/* Extended-Page-Table Pointer (EPTP). */
6604	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
6605	{
6606	VMXVDIAG enmVmxDiag;
6607	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, pVmcs->u64EptPtr.u, &enmVmxDiag);
6608	if (RT_SUCCESS(rc))
6609	{ /* likely */ }
6610	else
6611	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, enmVmxDiag, rc);
6612	}
6613	#else
6614	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT));
6615	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST));
6616	#endif
6617	Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
6618	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
6619	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
6620	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_XCPT_VE)); /* We don't support EPT-violation #VE yet. */
6621	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_TSC_SCALING)); /* We don't support TSC-scaling yet. */
6622
6623	/* VMCS shadowing. */
6624	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
6625	{
6626	/* VMREAD-bitmap physical address. */
6627	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
6628	if ( !(GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
6629	&& !(GCPhysVmreadBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6630	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
6631	{ /* likely */ }
6632	else
6633	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmreadBitmap);
6634
6635	/* VMWRITE-bitmap physical address. */
6636	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
6637	if ( !(GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
6638	&& !(GCPhysVmwriteBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6639	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
6640	{ /* likely */ }
6641	else
6642	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmwriteBitmap);
6643	}
6644	}
6645
6646	/*
6647	* VM-exit controls.
6648	* See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
6649	*/
6650	{
6651	VMXCTLSMSR const ExitCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueExitCtls
6652	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ExitCtls;
6653	if (!(~pVmcs->u32ExitCtls & ExitCtls.n.allowed0))
6654	{ /* likely */ }
6655	else
6656	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsDisallowed0);
6657
6658	if (!(pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1))
6659	{ /* likely */ }
6660	else
6661	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsAllowed1);
6662
6663	/* Save preemption timer without activating it. */
6664	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
6665	\|\| !(pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
6666	{ /* likely */ }
6667	else
6668	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_SavePreemptTimer);
6669
6670	/* VM-exit MSR-store count and VM-exit MSR-store area address. */
6671	if (pVmcs->u32ExitMsrStoreCount)
6672	{
6673	if ( !(pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
6674	&& !(pVmcs->u64AddrExitMsrStore.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6675	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
6676	{ /* likely */ }
6677	else
6678	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrStore);
6679	}
6680
6681	/* VM-exit MSR-load count and VM-exit MSR-load area address. */
6682	if (pVmcs->u32ExitMsrLoadCount)
6683	{
6684	if ( !(pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6685	&& !(pVmcs->u64AddrExitMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6686	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
6687	{ /* likely */ }
6688	else
6689	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrLoad);
6690	}
6691	}
6692
6693	/*
6694	* VM-entry controls.
6695	* See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
6696	*/
6697	{
6698	VMXCTLSMSR const EntryCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueEntryCtls
6699	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.EntryCtls;
6700	if (!(~pVmcs->u32EntryCtls & EntryCtls.n.allowed0))
6701	{ /* likely */ }
6702	else
6703	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsDisallowed0);
6704
6705	if (!(pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1))
6706	{ /* likely */ }
6707	else
6708	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsAllowed1);
6709
6710	/* Event injection. */
6711	uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
6712	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
6713	{
6714	/* Type and vector. */
6715	uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
6716	uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
6717	uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
6718	if ( !uRsvd
6719	&& VMXIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
6720	&& VMXIsEntryIntInfoVectorValid(uVector, uType))
6721	{ /* likely */ }
6722	else
6723	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoTypeVecRsvd);
6724
6725	/* Exception error code. */
6726	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
6727	{
6728	/* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
6729	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
6730	\|\| (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
6731	{ /* likely */ }
6732	else
6733	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodePe);
6734
6735	/* Exceptions that provide an error code. */
6736	if ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
6737	&& ( uVector == X86_XCPT_DF
6738	\|\| uVector == X86_XCPT_TS
6739	\|\| uVector == X86_XCPT_NP
6740	\|\| uVector == X86_XCPT_SS
6741	\|\| uVector == X86_XCPT_GP
6742	\|\| uVector == X86_XCPT_PF
6743	\|\| uVector == X86_XCPT_AC))
6744	{ /* likely */ }
6745	else
6746	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodeVec);
6747
6748	/* Exception error-code reserved bits. */
6749	if (!(pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK))
6750	{ /* likely */ }
6751	else
6752	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryXcptErrCodeRsvd);
6753
6754	/* Injecting a software interrupt, software exception or privileged software exception. */
6755	if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
6756	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
6757	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
6758	{
6759	/* Instruction length must be in the range 0-15. */
6760	if (pVmcs->u32EntryInstrLen <= VMX_ENTRY_INSTR_LEN_MAX)
6761	{ /* likely */ }
6762	else
6763	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLen);
6764
6765	/* However, instruction length of 0 is allowed only when its CPU feature is present. */
6766	if ( pVmcs->u32EntryInstrLen != 0
6767	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
6768	{ /* likely */ }
6769	else
6770	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLenZero);
6771	}
6772	}
6773	}
6774
6775	/* VM-entry MSR-load count and VM-entry MSR-load area address. */
6776	if (pVmcs->u32EntryMsrLoadCount)
6777	{
6778	if ( !(pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6779	&& !(pVmcs->u64AddrEntryMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6780	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
6781	{ /* likely */ }
6782	else
6783	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrEntryMsrLoad);
6784	}
6785
6786	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
6787	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
6788	}
6789
6790	NOREF(pszInstr);
6791	NOREF(pszFailure);
6792	return VINF_SUCCESS;
6793	}
6794
6795
6796	/**
6797	* Loads the guest control registers, debug register and some MSRs as part of
6798	* VM-entry.
6799	*
6800	* @param pVCpu The cross context virtual CPU structure.
6801	*/
6802	static void iemVmxVmentryLoadGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
6803	{
6804	/*
6805	* Load guest control registers, debug registers and MSRs.
6806	* See Intel spec. 26.3.2.1 "Loading Guest Control Registers, Debug Registers and MSRs".
6807	*/
6808	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6809
6810	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6811	uint64_t const uGstCr0 = (pVmcs->u64GuestCr0.u & ~VMX_ENTRY_GUEST_CR0_IGNORE_MASK)
6812	\| (pVCpu->cpum.GstCtx.cr0 & VMX_ENTRY_GUEST_CR0_IGNORE_MASK);
6813	pVCpu->cpum.GstCtx.cr0 = uGstCr0;
6814	pVCpu->cpum.GstCtx.cr4 = pVmcs->u64GuestCr4.u;
6815	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64GuestCr3.u;
6816
6817	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
6818	pVCpu->cpum.GstCtx.dr[7] = (pVmcs->u64GuestDr7.u & ~VMX_ENTRY_GUEST_DR7_MBZ_MASK) \| VMX_ENTRY_GUEST_DR7_MB1_MASK;
6819
6820	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64GuestSysenterEip.s.Lo;
6821	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64GuestSysenterEsp.s.Lo;
6822	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32GuestSysenterCS;
6823
6824	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6825	{
6826	/* FS base and GS base are loaded while loading the rest of the guest segment registers. */
6827
6828	/* EFER MSR. */
6829	if (!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR))
6830	{
6831	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_EFER);
6832	uint64_t const uHostEfer = pVCpu->cpum.GstCtx.msrEFER;
6833	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6834	bool const fGstPaging = RT_BOOL(uGstCr0 & X86_CR0_PG);
6835	if (fGstInLongMode)
6836	{
6837	/* If the nested-guest is in long mode, LMA and LME are both set. */
6838	Assert(fGstPaging);
6839	pVCpu->cpum.GstCtx.msrEFER = uHostEfer \| (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
6840	}
6841	else
6842	{
6843	/*
6844	* If the nested-guest is outside long mode:
6845	* - With paging: LMA is cleared, LME is cleared.
6846	* - Without paging: LMA is cleared, LME is left unmodified.
6847	*/
6848	uint64_t const fLmaLmeMask = MSR_K6_EFER_LMA \| (fGstPaging ? MSR_K6_EFER_LME : 0);
6849	pVCpu->cpum.GstCtx.msrEFER = uHostEfer & ~fLmaLmeMask;
6850	}
6851	}
6852	/* else: see below. */
6853	}
6854
6855	/* PAT MSR. */
6856	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
6857	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64GuestPatMsr.u;
6858
6859	/* EFER MSR. */
6860	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
6861	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64GuestEferMsr.u;
6862
6863	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6864	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
6865
6866	/* We don't support IA32_BNDCFGS MSR yet. */
6867	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
6868
6869	/* Nothing to do for SMBASE register - We don't support SMM yet. */
6870	}
6871
6872
6873	/**
6874	* Loads the guest segment registers, GDTR, IDTR, LDTR and TR as part of VM-entry.
6875	*
6876	* @param pVCpu The cross context virtual CPU structure.
6877	*/
6878	static void iemVmxVmentryLoadGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
6879	{
6880	/*
6881	* Load guest segment registers, GDTR, IDTR, LDTR and TR.
6882	* See Intel spec. 26.3.2.2 "Loading Guest Segment Registers and Descriptor-Table Registers".
6883	*/
6884	/* CS, SS, ES, DS, FS, GS. */
6885	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6886	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
6887	{
6888	PCPUMSELREG pGstSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
6889	CPUMSELREG VmcsSelReg;
6890	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &VmcsSelReg);
6891	AssertRC(rc); NOREF(rc);
6892	if (!(VmcsSelReg.Attr.u & X86DESCATTR_UNUSABLE))
6893	{
6894	pGstSelReg->Sel = VmcsSelReg.Sel;
6895	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6896	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6897	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6898	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6899	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6900	}
6901	else
6902	{
6903	pGstSelReg->Sel = VmcsSelReg.Sel;
6904	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6905	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6906	switch (iSegReg)
6907	{
6908	case X86_SREG_CS:
6909	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6910	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6911	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6912	break;
6913
6914	case X86_SREG_SS:
6915	pGstSelReg->u64Base = VmcsSelReg.u64Base & UINT32_C(0xfffffff0);
6916	pGstSelReg->u32Limit = 0;
6917	pGstSelReg->Attr.u = (VmcsSelReg.Attr.u & X86DESCATTR_DPL) \| X86DESCATTR_D \| X86DESCATTR_UNUSABLE;
6918	break;
6919
6920	case X86_SREG_ES:
6921	case X86_SREG_DS:
6922	pGstSelReg->u64Base = 0;
6923	pGstSelReg->u32Limit = 0;
6924	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6925	break;
6926
6927	case X86_SREG_FS:
6928	case X86_SREG_GS:
6929	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6930	pGstSelReg->u32Limit = 0;
6931	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6932	break;
6933	}
6934	Assert(pGstSelReg->Attr.n.u1Unusable);
6935	}
6936	}
6937
6938	/* LDTR. */
6939	pVCpu->cpum.GstCtx.ldtr.Sel = pVmcs->GuestLdtr;
6940	pVCpu->cpum.GstCtx.ldtr.ValidSel = pVmcs->GuestLdtr;
6941	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
6942	if (!(pVmcs->u32GuestLdtrAttr & X86DESCATTR_UNUSABLE))
6943	{
6944	pVCpu->cpum.GstCtx.ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
6945	pVCpu->cpum.GstCtx.ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
6946	pVCpu->cpum.GstCtx.ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
6947	}
6948	else
6949	{
6950	pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
6951	pVCpu->cpum.GstCtx.ldtr.u32Limit = 0;
6952	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
6953	}
6954
6955	/* TR. */
6956	Assert(!(pVmcs->u32GuestTrAttr & X86DESCATTR_UNUSABLE));
6957	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->GuestTr;
6958	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->GuestTr;
6959	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
6960	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64GuestTrBase.u;
6961	pVCpu->cpum.GstCtx.tr.u32Limit = pVmcs->u32GuestTrLimit;
6962	pVCpu->cpum.GstCtx.tr.Attr.u = pVmcs->u32GuestTrAttr;
6963
6964	/* GDTR. */
6965	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcs->u32GuestGdtrLimit;
6966	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64GuestGdtrBase.u;
6967
6968	/* IDTR. */
6969	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcs->u32GuestIdtrLimit;
6970	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64GuestIdtrBase.u;
6971	}
6972
6973
6974	/**
6975	* Loads the guest MSRs from the VM-entry MSR-load area as part of VM-entry.
6976	*
6977	* @returns VBox status code.
6978	* @param pVCpu The cross context virtual CPU structure.
6979	* @param pszInstr The VMX instruction name (for logging purposes).
6980	*/
6981	static int iemVmxVmentryLoadGuestAutoMsrs(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6982	{
6983	/*
6984	* Load guest MSRs.
6985	* See Intel spec. 26.4 "Loading MSRs".
6986	*/
6987	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6988	const char *const pszFailure = "VM-exit";
6989
6990	/*
6991	* The VM-entry MSR-load area address need not be a valid guest-physical address if the
6992	* VM-entry MSR load count is 0. If this is the case, bail early without reading it.
6993	* See Intel spec. 24.8.2 "VM-Entry Controls for MSRs".
6994	*/
6995	uint32_t const cMsrs = RT_MIN(pVmcs->u32EntryMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea));
6996	if (!cMsrs)
6997	return VINF_SUCCESS;
6998
6999	/*
7000	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count is
7001	* exceeded including possibly raising #MC exceptions during VMX transition. Our
7002	* implementation shall fail VM-entry with an VMX_EXIT_ERR_MSR_LOAD VM-exit.
7003	*/
7004	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
7005	if (fIsMsrCountValid)
7006	{ /* likely */ }
7007	else
7008	{
7009	iemVmxVmcsSetExitQual(pVCpu, VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
7010	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadCount);
7011	}
7012
7013	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
7014	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0],
7015	GCPhysVmEntryMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
7016	if (RT_SUCCESS(rc))
7017	{
7018	PCVMXAUTOMSR pMsr = &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0];
7019	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
7020	{
7021	if ( !pMsr->u32Reserved
7022	&& pMsr->u32Msr != MSR_K8_FS_BASE
7023	&& pMsr->u32Msr != MSR_K8_GS_BASE
7024	&& pMsr->u32Msr != MSR_K6_EFER
7025	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
7026	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
7027	{
7028	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
7029	if (rcStrict == VINF_SUCCESS)
7030	continue;
7031
7032	/*
7033	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-entry.
7034	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VM-entry failure
7035	* recording the MSR index in the Exit qualification (as per the Intel spec.) and indicated
7036	* further by our own, specific diagnostic code. Later, we can try implement handling of the
7037	* MSR in ring-0 if possible, or come up with a better, generic solution.
7038	*/
7039	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7040	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
7041	? kVmxVDiag_Vmentry_MsrLoadRing3
7042	: kVmxVDiag_Vmentry_MsrLoad;
7043	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
7044	}
7045	else
7046	{
7047	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7048	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadRsvd);
7049	}
7050	}
7051	}
7052	else
7053	{
7054	AssertMsgFailed(("%s: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmEntryMsrLoadArea, rc));
7055	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadPtrReadPhys, rc);
7056	}
7057
7058	NOREF(pszInstr);
7059	NOREF(pszFailure);
7060	return VINF_SUCCESS;
7061	}
7062
7063
7064	/**
7065	* Loads the guest-state non-register state as part of VM-entry.
7066	*
7067	* @returns VBox status code.
7068	* @param pVCpu The cross context virtual CPU structure.
7069	* @param pszInstr The VMX instruction name (for logging purposes).
7070	*
7071	* @remarks This must be called only after loading the nested-guest register state
7072	* (especially nested-guest RIP).
7073	*/
7074	static int iemVmxVmentryLoadGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7075	{
7076	/*
7077	* Load guest non-register state.
7078	* See Intel spec. 26.6 "Special Features of VM Entry"
7079	*/
7080	const char *const pszFailure = "VM-exit";
7081	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7082
7083	/*
7084	* If VM-entry is not vectoring, block-by-STI and block-by-MovSS state must be loaded.
7085	* If VM-entry is vectoring, there is no block-by-STI or block-by-MovSS.
7086	*
7087	* See Intel spec. 26.6.1 "Interruptibility State".
7088	*/
7089	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, NULL /* puEntryIntInfoType */);
7090	if ( !fEntryVectoring
7091	&& (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI \| VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)))
7092	CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcs->u64GuestRip.u);
7093	else
7094	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
7095
7096	/* NMI blocking. */
7097	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI)
7098	{
7099	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
7100	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
7101	else
7102	{
7103	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7104	CPUMSetInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
7105	}
7106	}
7107	else
7108	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7109
7110	/* SMI blocking is irrelevant. We don't support SMIs yet. */
7111
7112	/*
7113	* Set PGM's copy of the EPT pointer.
7114	* The EPTP has already been validated while checking guest state.
7115	*
7116	* It is important to do this prior to mapping PAE PDPTEs (below).
7117	*/
7118	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7119	PGMSetGuestEptPtr(pVCpu, pVmcs->u64EptPtr.u);
7120
7121	/*
7122	* Load the guest's PAE PDPTEs.
7123	*/
7124	if (!iemVmxVmcsIsGuestPaePagingEnabled(pVmcs))
7125	{
7126	/*
7127	* When PAE paging is not used we clear the PAE PDPTEs for safety
7128	* in case we might be switching from a PAE host to a non-PAE guest.
7129	*/
7130	pVCpu->cpum.GstCtx.aPaePdpes[0].u = 0;
7131	pVCpu->cpum.GstCtx.aPaePdpes[1].u = 0;
7132	pVCpu->cpum.GstCtx.aPaePdpes[2].u = 0;
7133	pVCpu->cpum.GstCtx.aPaePdpes[3].u = 0;
7134	}
7135	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7136	{
7137	/*
7138	* With EPT and the nested-guest using PAE paging, we've already validated the PAE PDPTEs
7139	* while checking the guest state. We can load them into the nested-guest CPU state now.
7140	* They'll later be used while mapping CR3 and the PAE PDPTEs.
7141	*/
7142	pVCpu->cpum.GstCtx.aPaePdpes[0].u = pVmcs->u64GuestPdpte0.u;
7143	pVCpu->cpum.GstCtx.aPaePdpes[1].u = pVmcs->u64GuestPdpte1.u;
7144	pVCpu->cpum.GstCtx.aPaePdpes[2].u = pVmcs->u64GuestPdpte2.u;
7145	pVCpu->cpum.GstCtx.aPaePdpes[3].u = pVmcs->u64GuestPdpte3.u;
7146	}
7147	else
7148	{
7149	/*
7150	* Without EPT and the nested-guest using PAE paging, we must load the PAE PDPTEs
7151	* referenced by CR3. This involves loading (and mapping) CR3 and validating them now.
7152	*/
7153	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64GuestCr3.u);
7154	if (RT_SUCCESS(rc))
7155	{ /* likely */ }
7156	else
7157	{
7158	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
7159	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte, rc);
7160	}
7161	}
7162
7163	/* VPID is irrelevant. We don't support VPID yet. */
7164
7165	/* Clear address-range monitoring. */
7166	EMMonitorWaitClear(pVCpu);
7167
7168	return VINF_SUCCESS;
7169	}
7170
7171
7172	/**
7173	* Loads the guest VMCS referenced state (such as MSR bitmaps, I/O bitmaps etc).
7174	*
7175	* @param pVCpu The cross context virtual CPU structure.
7176	* @param pszInstr The VMX instruction name (for logging purposes).
7177	*
7178	* @remarks This assumes various VMCS related data structure pointers have already
7179	* been verified prior to calling this function.
7180	*/
7181	static int iemVmxVmentryLoadGuestVmcsRefState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7182	{
7183	const char *const pszFailure = "VM-exit";
7184	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7185
7186	/*
7187	* Virtualize APIC accesses.
7188	*/
7189	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7190	{
7191	/* APIC-access physical address. */
7192	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
7193
7194	/*
7195	* Register the handler for the APIC-access page.
7196	*
7197	* We don't deregister the APIC-access page handler during the VM-exit as a different
7198	* nested-VCPU might be using the same guest-physical address for its APIC-access page.
7199	*
7200	* We leave the page registered until the first access that happens outside VMX non-root
7201	* mode. Guest software is allowed to access structures such as the APIC-access page
7202	* only when no logical processor with a current VMCS references it in VMX non-root mode,
7203	* otherwise it can lead to unpredictable behavior including guest triple-faults.
7204	*
7205	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7206	*/
7207	/** @todo r=bird: The lazy deregistration of the page is potentially slightly
7208	* problematic, as the guest may cause us to create lots of access
7209	* handler entries. However, any slowdown or similar effects should
7210	* only ever affect the guest itself, so not a big issue. Though, I
7211	* wish there was most recently used approach or something to tracking
7212	* these... */
7213	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
7214	int rc = PGMHandlerPhysicalRegisterVmxApicAccessPage(pVM, GCPhysApicAccess, pVM->iem.s.hVmxApicAccessPage);
7215	if (RT_SUCCESS(rc))
7216	{ /* likely */ }
7217	else
7218	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessHandlerReg, rc);
7219	}
7220
7221	/*
7222	* VMCS shadowing.
7223	*/
7224	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7225	{
7226	/* Read the VMREAD-bitmap. */
7227	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
7228	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap[0],
7229	GCPhysVmreadBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap));
7230	if (RT_SUCCESS(rc))
7231	{ /* likely */ }
7232	else
7233	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmreadBitmapPtrReadPhys, rc);
7234
7235	/* Read the VMWRITE-bitmap. */
7236	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmwriteBitmap.u;
7237	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap[0],
7238	GCPhysVmwriteBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap));
7239	if (RT_SUCCESS(rc))
7240	{ /* likely */ }
7241	else
7242	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmwriteBitmapPtrReadPhys, rc);
7243	}
7244
7245	/*
7246	* I/O bitmaps.
7247	*/
7248	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
7249	{
7250	/* Read the IO bitmap A. */
7251	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
7252	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[0],
7253	GCPhysIoBitmapA, VMX_V_IO_BITMAP_A_SIZE);
7254	if (RT_SUCCESS(rc))
7255	{ /* likely */ }
7256	else
7257	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapAPtrReadPhys, rc);
7258
7259	/* Read the IO bitmap B. */
7260	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
7261	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[VMX_V_IO_BITMAP_A_SIZE],
7262	GCPhysIoBitmapB, VMX_V_IO_BITMAP_B_SIZE);
7263	if (RT_SUCCESS(rc))
7264	{ /* likely */ }
7265	else
7266	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapBPtrReadPhys, rc);
7267	}
7268
7269	/*
7270	* TPR shadow and Virtual-APIC page.
7271	*/
7272	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
7273	{
7274	/* Verify TPR threshold and VTPR when both virtualize-APIC accesses and virtual-interrupt delivery aren't used. */
7275	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7276	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
7277	{
7278	/* Read the VTPR from the virtual-APIC page. */
7279	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
7280	uint8_t u8VTpr;
7281	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &u8VTpr, GCPhysVirtApic + XAPIC_OFF_TPR, sizeof(u8VTpr));
7282	if (RT_SUCCESS(rc))
7283	{ /* likely */ }
7284	else
7285	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtApicPagePtrReadPhys, rc);
7286
7287	/* Bits 3:0 of the TPR-threshold must not be greater than bits 7:4 of VTPR. */
7288	if ((uint8_t)RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) <= (u8VTpr & 0xf0))
7289	{ /* likely */ }
7290	else
7291	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdVTpr);
7292	}
7293	}
7294
7295	/*
7296	* VMCS link pointer.
7297	*/
7298	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
7299	{
7300	/* Read the VMCS-link pointer from guest memory. */
7301	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
7302	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs,
7303	GCPhysShadowVmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs));
7304	if (RT_SUCCESS(rc))
7305	{ /* likely */ }
7306	else
7307	{
7308	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7309	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrReadPhys, rc);
7310	}
7311
7312	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
7313	if (pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID)
7314	{ /* likely */ }
7315	else
7316	{
7317	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7318	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrRevId);
7319	}
7320
7321	/* Verify the shadow bit is set if VMCS shadowing is enabled . */
7322	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7323	\|\| pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.fIsShadowVmcs)
7324	{ /* likely */ }
7325	else
7326	{
7327	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7328	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrShadow);
7329	}
7330
7331	/* Update our cache of the guest physical address of the shadow VMCS. */
7332	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysShadowVmcs = GCPhysShadowVmcs;
7333	}
7334
7335	/*
7336	* MSR bitmap.
7337	*/
7338	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
7339	{
7340	/* Read the MSR bitmap. */
7341	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
7342	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap[0],
7343	GCPhysMsrBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap));
7344	if (RT_SUCCESS(rc))
7345	{ /* likely */ }
7346	else
7347	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrBitmapPtrReadPhys, rc);
7348	}
7349
7350	NOREF(pszFailure);
7351	NOREF(pszInstr);
7352	return VINF_SUCCESS;
7353	}
7354
7355
7356	/**
7357	* Loads the guest-state as part of VM-entry.
7358	*
7359	* @returns VBox status code.
7360	* @param pVCpu The cross context virtual CPU structure.
7361	* @param pszInstr The VMX instruction name (for logging purposes).
7362	*
7363	* @remarks This must be done after all the necessary steps prior to loading of
7364	* guest-state (e.g. checking various VMCS state).
7365	*/
7366	static int iemVmxVmentryLoadGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7367	{
7368	/* Load guest control registers, MSRs (that are directly part of the VMCS). */
7369	iemVmxVmentryLoadGuestControlRegsMsrs(pVCpu);
7370
7371	/* Load guest segment registers. */
7372	iemVmxVmentryLoadGuestSegRegs(pVCpu);
7373
7374	/*
7375	* Load guest RIP, RSP and RFLAGS.
7376	* See Intel spec. 26.3.2.3 "Loading Guest RIP, RSP and RFLAGS".
7377	*/
7378	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7379	pVCpu->cpum.GstCtx.rsp = pVmcs->u64GuestRsp.u;
7380	pVCpu->cpum.GstCtx.rip = pVmcs->u64GuestRip.u;
7381	pVCpu->cpum.GstCtx.rflags.u = pVmcs->u64GuestRFlags.u;
7382
7383	/* Initialize the PAUSE-loop controls as part of VM-entry. */
7384	pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick = 0;
7385	pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick = 0;
7386
7387	/* Load guest non-register state (such as interrupt shadows, NMI blocking etc). */
7388	int rc = iemVmxVmentryLoadGuestNonRegState(pVCpu, pszInstr);
7389	if (rc == VINF_SUCCESS)
7390	{ /* likely */ }
7391	else
7392	return rc;
7393
7394	/* Load VMX related structures and state referenced by the VMCS. */
7395	rc = iemVmxVmentryLoadGuestVmcsRefState(pVCpu, pszInstr);
7396	if (rc == VINF_SUCCESS)
7397	{ /* likely */ }
7398	else
7399	return rc;
7400
7401	NOREF(pszInstr);
7402	return VINF_SUCCESS;
7403	}
7404
7405
7406	/**
7407	* Returns whether there are is a pending debug exception on VM-entry.
7408	*
7409	* @param pVCpu The cross context virtual CPU structure.
7410	* @param pszInstr The VMX instruction name (for logging purposes).
7411	*/
7412	static bool iemVmxVmentryIsPendingDebugXcpt(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7413	{
7414	/*
7415	* Pending debug exceptions.
7416	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7417	*/
7418	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7419	Assert(pVmcs);
7420
7421	bool fPendingDbgXcpt = RT_BOOL(pVmcs->u64GuestPendingDbgXcpts.u & ( VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS
7422	\| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP));
7423	if (fPendingDbgXcpt)
7424	{
7425	uint8_t uEntryIntInfoType;
7426	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, &uEntryIntInfoType);
7427	if (fEntryVectoring)
7428	{
7429	switch (uEntryIntInfoType)
7430	{
7431	case VMX_ENTRY_INT_INFO_TYPE_EXT_INT:
7432	case VMX_ENTRY_INT_INFO_TYPE_NMI:
7433	case VMX_ENTRY_INT_INFO_TYPE_HW_XCPT:
7434	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7435	fPendingDbgXcpt = false;
7436	break;
7437
7438	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7439	{
7440	/*
7441	* Whether the pending debug exception for software exceptions other than
7442	* #BP and #OF is delivered after injecting the exception or is discard
7443	* is CPU implementation specific. We will discard them (easier).
7444	*/
7445	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
7446	if ( uVector != X86_XCPT_BP
7447	&& uVector != X86_XCPT_OF)
7448	fPendingDbgXcpt = false;
7449	RT_FALL_THRU();
7450	}
7451	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7452	{
7453	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
7454	fPendingDbgXcpt = false;
7455	break;
7456	}
7457	}
7458	}
7459	else
7460	{
7461	/*
7462	* When the VM-entry is not vectoring but there is blocking-by-MovSS, whether the
7463	* pending debug exception is held pending or is discarded is CPU implementation
7464	* specific. We will discard them (easier).
7465	*/
7466	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
7467	fPendingDbgXcpt = false;
7468
7469	/* There's no pending debug exception in the shutdown or wait-for-SIPI state. */
7470	if (pVmcs->u32GuestActivityState & (VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN \| VMX_VMCS_GUEST_ACTIVITY_SIPI_WAIT))
7471	fPendingDbgXcpt = false;
7472	}
7473	}
7474
7475	NOREF(pszInstr);
7476	return fPendingDbgXcpt;
7477	}
7478
7479
7480	/**
7481	* Set up the monitor-trap flag (MTF).
7482	*
7483	* @param pVCpu The cross context virtual CPU structure.
7484	* @param pszInstr The VMX instruction name (for logging purposes).
7485	*/
7486	static void iemVmxVmentrySetupMtf(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7487	{
7488	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7489	Assert(pVmcs);
7490	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_MONITOR_TRAP_FLAG)
7491	{
7492	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7493	Log(("%s: Monitor-trap flag set on VM-entry\n", pszInstr));
7494	}
7495	else
7496	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
7497	NOREF(pszInstr);
7498	}
7499
7500
7501	/**
7502	* Sets up NMI-window exiting.
7503	*
7504	* @param pVCpu The cross context virtual CPU structure.
7505	* @param pszInstr The VMX instruction name (for logging purposes).
7506	*/
7507	static void iemVmxVmentrySetupNmiWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7508	{
7509	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7510	Assert(pVmcs);
7511	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT)
7512	{
7513	Assert(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI);
7514	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW);
7515	Log(("%s: NMI-window set on VM-entry\n", pszInstr));
7516	}
7517	else
7518	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW));
7519	NOREF(pszInstr);
7520	}
7521
7522
7523	/**
7524	* Sets up interrupt-window exiting.
7525	*
7526	* @param pVCpu The cross context virtual CPU structure.
7527	* @param pszInstr The VMX instruction name (for logging purposes).
7528	*/
7529	static void iemVmxVmentrySetupIntWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7530	{
7531	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7532	Assert(pVmcs);
7533	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT)
7534	{
7535	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW);
7536	Log(("%s: Interrupt-window set on VM-entry\n", pszInstr));
7537	}
7538	else
7539	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW));
7540	NOREF(pszInstr);
7541	}
7542
7543
7544	/**
7545	* Set up the VMX-preemption timer.
7546	*
7547	* @param pVCpu The cross context virtual CPU structure.
7548	* @param pszInstr The VMX instruction name (for logging purposes).
7549	*/
7550	static void iemVmxVmentrySetupPreemptTimer(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7551	{
7552	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7553	Assert(pVmcs);
7554	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
7555	{
7556	/*
7557	* If the timer is 0, we must cause a VM-exit before executing the first
7558	* nested-guest instruction. So we can flag as though the timer has already
7559	* expired and we will check and cause a VM-exit at the right priority elsewhere
7560	* in the code.
7561	*/
7562	uint64_t uEntryTick;
7563	uint32_t const uPreemptTimer = pVmcs->u32PreemptTimer;
7564	if (uPreemptTimer)
7565	{
7566	int rc = CPUMStartGuestVmxPremptTimer(pVCpu, uPreemptTimer, VMX_V_PREEMPT_TIMER_SHIFT, &uEntryTick);
7567	AssertRC(rc);
7568	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64\n", pszInstr, uEntryTick));
7569	}
7570	else
7571	{
7572	uEntryTick = TMCpuTickGetNoCheck(pVCpu);
7573	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER);
7574	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64 to expire immediately!\n", pszInstr, uEntryTick));
7575	}
7576
7577	pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick = uEntryTick;
7578	}
7579	else
7580	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
7581
7582	NOREF(pszInstr);
7583	}
7584
7585
7586	/**
7587	* Injects an event using TRPM given a VM-entry interruption info and related
7588	* fields.
7589	*
7590	* @param pVCpu The cross context virtual CPU structure.
7591	* @param pszInstr The VMX instruction name (for logging purposes).
7592	* @param uEntryIntInfo The VM-entry interruption info.
7593	* @param uErrCode The error code associated with the event if any.
7594	* @param cbInstr The VM-entry instruction length (for software
7595	* interrupts and software exceptions). Pass 0
7596	* otherwise.
7597	* @param GCPtrFaultAddress The guest CR2 if this is a \#PF event.
7598	*/
7599	static void iemVmxVmentryInjectTrpmEvent(PVMCPUCC pVCpu, const char *pszInstr, uint32_t uEntryIntInfo, uint32_t uErrCode,
7600	uint32_t cbInstr, RTGCUINTPTR GCPtrFaultAddress) RT_NOEXCEPT
7601	{
7602	Assert(VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo));
7603
7604	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo);
7605	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo);
7606	TRPMEVENT const enmTrpmEvent = HMVmxEventTypeToTrpmEventType(uEntryIntInfo);
7607
7608	Assert(uType != VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT);
7609
7610	int rc = TRPMAssertTrap(pVCpu, uVector, enmTrpmEvent);
7611	AssertRC(rc);
7612	Log(("%s: Injecting: vector=%#x type=%#x (%s)\n", pszInstr, uVector, uType, VMXGetEntryIntInfoTypeDesc(uType)));
7613
7614	if (VMX_ENTRY_INT_INFO_IS_ERROR_CODE_VALID(uEntryIntInfo))
7615	{
7616	TRPMSetErrorCode(pVCpu, uErrCode);
7617	Log(("%s: Injecting: err_code=%#x\n", pszInstr, uErrCode));
7618	}
7619
7620	if (VMX_ENTRY_INT_INFO_IS_XCPT_PF(uEntryIntInfo))
7621	{
7622	TRPMSetFaultAddress(pVCpu, GCPtrFaultAddress);
7623	Log(("%s: Injecting: fault_addr=%RGp\n", pszInstr, GCPtrFaultAddress));
7624	}
7625	else
7626	{
7627	switch (uType)
7628	{
7629	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7630	TRPMSetTrapDueToIcebp(pVCpu);
7631	Log(("%s: Injecting: icebp\n", pszInstr));
7632	RT_FALL_THRU();
7633	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7634	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7635	TRPMSetInstrLength(pVCpu, cbInstr);
7636	Log(("%s: Injecting: instr_len=%u\n", pszInstr, cbInstr));
7637	break;
7638	}
7639	}
7640
7641	NOREF(pszInstr);
7642	}
7643
7644
7645	/**
7646	* Performs event injection (if any) as part of VM-entry.
7647	*
7648	* @param pVCpu The cross context virtual CPU structure.
7649	* @param pszInstr The VMX instruction name (for logging purposes).
7650	*/
7651	static void iemVmxVmentryInjectEvent(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7652	{
7653	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7654
7655	/*
7656	* Inject events.
7657	* The event that is going to be made pending for injection is not subject to VMX intercepts,
7658	* thus we flag ignoring of intercepts. However, recursive exceptions if any during delivery
7659	* of the current event -are- subject to intercepts, hence this flag will be flipped during
7660	* the actually delivery of this event.
7661	*
7662	* See Intel spec. 26.5 "Event Injection".
7663	*/
7664	uint32_t const uEntryIntInfo = pVmcs->u32EntryIntInfo;
7665	bool const fEntryIntInfoValid = VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo);
7666
7667	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, !fEntryIntInfoValid);
7668	if (fEntryIntInfoValid)
7669	{
7670	if (VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo) == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT)
7671	{
7672	Assert(VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo) == VMX_ENTRY_INT_INFO_VECTOR_MTF);
7673	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7674	}
7675	else
7676	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uEntryIntInfo, pVmcs->u32EntryXcptErrCode, pVmcs->u32EntryInstrLen,
7677	pVCpu->cpum.GstCtx.cr2);
7678
7679	/*
7680	* We need to clear the VM-entry interruption information field's valid bit on VM-exit.
7681	*
7682	* However, we do it here on VM-entry as well because while it isn't visible to guest
7683	* software until VM-exit, when and if HM looks at the VMCS to continue nested-guest
7684	* execution using hardware-assisted VMX, it will not try to inject the event again.
7685	*
7686	* See Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
7687	*/
7688	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
7689	}
7690	else
7691	{
7692	/*
7693	* Inject any pending guest debug exception.
7694	* Unlike injecting events, this #DB injection on VM-entry is subject to #DB VMX intercept.
7695	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7696	*/
7697	bool const fPendingDbgXcpt = iemVmxVmentryIsPendingDebugXcpt(pVCpu, pszInstr);
7698	if (fPendingDbgXcpt)
7699	{
7700	uint32_t const uDbgXcptInfo = RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VECTOR, X86_XCPT_DB)
7701	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_TYPE, VMX_ENTRY_INT_INFO_TYPE_HW_XCPT)
7702	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VALID, 1);
7703	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uDbgXcptInfo, 0 /* uErrCode */, pVmcs->u32EntryInstrLen,
7704	0 /* GCPtrFaultAddress */);
7705	}
7706	}
7707
7708	NOREF(pszInstr);
7709	}
7710
7711
7712	/**
7713	* Initializes all read-only VMCS fields as part of VM-entry.
7714	*
7715	* @param pVCpu The cross context virtual CPU structure.
7716	*/
7717	static void iemVmxVmentryInitReadOnlyFields(PVMCPUCC pVCpu) RT_NOEXCEPT
7718	{
7719	/*
7720	* Any VMCS field which we do not establish on every VM-exit but may potentially
7721	* be used on the VM-exit path of a nested hypervisor -and- is not explicitly
7722	* specified to be undefined, needs to be initialized here.
7723	*
7724	* Thus, it is especially important to clear the Exit qualification field
7725	* since it must be zero for VM-exits where it is not used. Similarly, the
7726	* VM-exit interruption information field's valid bit needs to be cleared for
7727	* the same reasons.
7728	*/
7729	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7730	Assert(pVmcs);
7731
7732	/* 16-bit (none currently). */
7733	/* 32-bit. */
7734	pVmcs->u32RoVmInstrError = 0;
7735	pVmcs->u32RoExitReason = 0;
7736	pVmcs->u32RoExitIntInfo = 0;
7737	pVmcs->u32RoExitIntErrCode = 0;
7738	pVmcs->u32RoIdtVectoringInfo = 0;
7739	pVmcs->u32RoIdtVectoringErrCode = 0;
7740	pVmcs->u32RoExitInstrLen = 0;
7741	pVmcs->u32RoExitInstrInfo = 0;
7742
7743	/* 64-bit. */
7744	pVmcs->u64RoGuestPhysAddr.u = 0;
7745
7746	/* Natural-width. */
7747	pVmcs->u64RoExitQual.u = 0;
7748	pVmcs->u64RoIoRcx.u = 0;
7749	pVmcs->u64RoIoRsi.u = 0;
7750	pVmcs->u64RoIoRdi.u = 0;
7751	pVmcs->u64RoIoRip.u = 0;
7752	pVmcs->u64RoGuestLinearAddr.u = 0;
7753	}
7754
7755
7756	/**
7757	* VMLAUNCH/VMRESUME instruction execution worker.
7758	*
7759	* @returns Strict VBox status code.
7760	* @param pVCpu The cross context virtual CPU structure.
7761	* @param cbInstr The instruction length in bytes.
7762	* @param uInstrId The instruction identity (VMXINSTRID_VMLAUNCH or
7763	* VMXINSTRID_VMRESUME).
7764	*
7765	* @remarks Common VMX instruction checks are already expected to by the caller,
7766	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
7767	*/
7768	static VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId) RT_NOEXCEPT
7769	{
7770	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
7771	RT_NOREF3(pVCpu, cbInstr, uInstrId);
7772	return VINF_EM_RAW_EMULATE_INSTR;
7773	# else
7774	Assert( uInstrId == VMXINSTRID_VMLAUNCH
7775	\|\| uInstrId == VMXINSTRID_VMRESUME);
7776	const char * const pszInstr = uInstrId == VMXINSTRID_VMRESUME ? "vmresume" : "vmlaunch";
7777
7778	/* Nested-guest intercept. */
7779	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7780	return iemVmxVmexitInstr(pVCpu, uInstrId == VMXINSTRID_VMRESUME ? VMX_EXIT_VMRESUME : VMX_EXIT_VMLAUNCH, cbInstr);
7781
7782	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
7783
7784	/*
7785	* Basic VM-entry checks.
7786	* The order of the CPL, current and shadow VMCS and block-by-MovSS are important.
7787	* The checks following that do not have to follow a specific order.
7788	*
7789	* See Intel spec. 26.1 "Basic VM-entry Checks".
7790	*/
7791
7792	/* CPL. */
7793	if (pVCpu->iem.s.uCpl == 0)
7794	{ /* likely */ }
7795	else
7796	{
7797	Log(("%s: CPL %u -> #GP(0)\n", pszInstr, pVCpu->iem.s.uCpl));
7798	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_Cpl;
7799	return iemRaiseGeneralProtectionFault0(pVCpu);
7800	}
7801
7802	/* Current VMCS valid. */
7803	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
7804	{ /* likely */ }
7805	else
7806	{
7807	Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7808	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrInvalid;
7809	iemVmxVmFailInvalid(pVCpu);
7810	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7811	}
7812
7813	/* Current VMCS is not a shadow VMCS. */
7814	if (!pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32VmcsRevId.n.fIsShadowVmcs)
7815	{ /* likely */ }
7816	else
7817	{
7818	Log(("%s: VMCS pointer %#RGp is a shadow VMCS -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7819	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrShadowVmcs;
7820	iemVmxVmFailInvalid(pVCpu);
7821	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7822	}
7823
7824	/** @todo Distinguish block-by-MovSS from block-by-STI. Currently we
7825	* use block-by-STI here which is not quite correct. */
7826	if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx))
7827	{ /* likely */ }
7828	else
7829	{
7830	Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
7831	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_BlocKMovSS;
7832	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
7833	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7834	}
7835
7836	if (uInstrId == VMXINSTRID_VMLAUNCH)
7837	{
7838	/* VMLAUNCH with non-clear VMCS. */
7839	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR)
7840	{ /* likely */ }
7841	else
7842	{
7843	Log(("vmlaunch: VMLAUNCH with non-clear VMCS -> VMFail\n"));
7844	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsClear;
7845	iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
7846	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7847	}
7848	}
7849	else
7850	{
7851	/* VMRESUME with non-launched VMCS. */
7852	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_LAUNCHED)
7853	{ /* likely */ }
7854	else
7855	{
7856	Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
7857	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsLaunch;
7858	iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
7859	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7860	}
7861	}
7862
7863	/*
7864	* We are allowed to cache VMCS related data structures (such as I/O bitmaps, MSR bitmaps)
7865	* while entering VMX non-root mode. We do some of this while checking VM-execution
7866	* controls. The nested hypervisor should not make assumptions and cannot expect
7867	* predictable behavior if changes to these structures are made in guest memory while
7868	* executing in VMX non-root mode. As far as VirtualBox is concerned, the guest cannot
7869	* modify them anyway as we cache them in host memory.
7870	*
7871	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7872	*/
7873	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
7874
7875	int rc = iemVmxVmentryCheckCtls(pVCpu, pszInstr);
7876	if (RT_SUCCESS(rc))
7877	{
7878	rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
7879	if (RT_SUCCESS(rc))
7880	{
7881	/*
7882	* Initialize read-only VMCS fields before VM-entry since we don't update all of them
7883	* for every VM-exit. This needs to be done before invoking a VM-exit (even those
7884	* ones that may occur during VM-entry below).
7885	*/
7886	iemVmxVmentryInitReadOnlyFields(pVCpu);
7887
7888	/*
7889	* Blocking of NMIs need to be restored if VM-entry fails due to invalid-guest state.
7890	* So we save the VMCPU_FF_BLOCK_NMI force-flag here so we can restore it on
7891	* VM-exit when required.
7892	* See Intel spec. 26.7 "VM-entry Failures During or After Loading Guest State"
7893	*/
7894	iemVmxVmentrySaveNmiBlockingFF(pVCpu);
7895
7896	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7897	Assert(pVmcs);
7898
7899	rc = iemVmxVmentryCheckGuestState(pVCpu, pszInstr);
7900	if (RT_SUCCESS(rc))
7901	{
7902	/*
7903	* We've now entered nested-guest execution.
7904	*
7905	* It is important do this prior to loading the guest state because
7906	* as part of loading the guest state, PGM (and perhaps other components
7907	* in the future) relies on detecting whether VMX non-root mode has been
7908	* entered.
7909	*/
7910	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = true;
7911
7912	rc = iemVmxVmentryLoadGuestState(pVCpu, pszInstr);
7913	if (RT_SUCCESS(rc))
7914	{
7915	rc = iemVmxVmentryLoadGuestAutoMsrs(pVCpu, pszInstr);
7916	if (RT_SUCCESS(rc))
7917	{
7918	Assert(rc != VINF_CPUM_R3_MSR_WRITE);
7919
7920	/* VMLAUNCH instruction must update the VMCS launch state. */
7921	if (uInstrId == VMXINSTRID_VMLAUNCH)
7922	pVmcs->fVmcsState = VMX_V_VMCS_LAUNCH_STATE_LAUNCHED;
7923
7924	/* Perform the VMX transition (PGM updates). */
7925	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu);
7926	if (rcStrict == VINF_SUCCESS)
7927	{ /* likely */ }
7928	else if (RT_SUCCESS(rcStrict))
7929	{
7930	Log3(("%s: iemVmxTransition returns %Rrc -> Setting passup status\n", pszInstr,
7931	VBOXSTRICTRC_VAL(rcStrict)));
7932	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7933	}
7934	else
7935	{
7936	Log3(("%s: iemVmxTransition failed! rc=%Rrc\n", pszInstr, VBOXSTRICTRC_VAL(rcStrict)));
7937	return rcStrict;
7938	}
7939
7940	/* Paranoia. */
7941	Assert(rcStrict == VINF_SUCCESS);
7942
7943	/*
7944	* The priority of potential VM-exits during VM-entry is important.
7945	* The priorities of VM-exits and events are listed from highest
7946	* to lowest as follows:
7947	*
7948	* 1. Event injection.
7949	* 2. Trap on task-switch (T flag set in TSS).
7950	* 3. TPR below threshold / APIC-write.
7951	* 4. SMI, INIT.
7952	* 5. MTF exit.
7953	* 6. Debug-trap exceptions (EFLAGS.TF), pending debug exceptions.
7954	* 7. VMX-preemption timer.
7955	* 9. NMI-window exit.
7956	* 10. NMI injection.
7957	* 11. Interrupt-window exit.
7958	* 12. Virtual-interrupt injection.
7959	* 13. Interrupt injection.
7960	* 14. Process next instruction (fetch, decode, execute).
7961	*/
7962
7963	/* Setup VMX-preemption timer. */
7964	iemVmxVmentrySetupPreemptTimer(pVCpu, pszInstr);
7965
7966	/* Setup monitor-trap flag. */
7967	iemVmxVmentrySetupMtf(pVCpu, pszInstr);
7968
7969	/* Setup NMI-window exiting. */
7970	iemVmxVmentrySetupNmiWindow(pVCpu, pszInstr);
7971
7972	/* Setup interrupt-window exiting. */
7973	iemVmxVmentrySetupIntWindow(pVCpu, pszInstr);
7974
7975	/*
7976	* Inject any event that the nested hypervisor wants to inject.
7977	* Note! We cannot immediately perform the event injection here as we may have
7978	* pending PGM operations to perform due to switching page tables and/or
7979	* mode.
7980	*/
7981	iemVmxVmentryInjectEvent(pVCpu, pszInstr);
7982
7983	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
7984	/* Reschedule to IEM-only execution of the nested-guest. */
7985	LogFlow(("%s: Enabling IEM-only EM execution policy!\n", pszInstr));
7986	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
7987	if (rcSched != VINF_SUCCESS)
7988	iemSetPassUpStatus(pVCpu, rcSched);
7989	# endif
7990
7991	/* Finally, done. */
7992	Log2(("vmentry: %s: cs:rip=%04x:%08RX64 cr0=%#RX64 (%#RX64) cr4=%#RX64 (%#RX64) efer=%#RX64 (%#RX64)\n",
7993	pszInstr, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
7994	pVmcs->u64Cr0ReadShadow.u, pVCpu->cpum.GstCtx.cr4, pVmcs->u64Cr4ReadShadow.u,
7995	pVCpu->cpum.GstCtx.msrEFER, pVmcs->u64GuestEferMsr.u));
7996	return VINF_SUCCESS;
7997	}
7998	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_MSR_LOAD \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
7999	}
8000	}
8001	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_INVALID_GUEST_STATE \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
8002	}
8003
8004	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
8005	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8006	}
8007
8008	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
8009	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8010	# endif
8011	}
8012
8013
8014	/**
8015	* Interface for HM and EM to emulate the VMLAUNCH/VMRESUME instruction.
8016	*
8017	* @returns Strict VBox status code.
8018	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8019	* @param cbInstr The instruction length in bytes.
8020	* @param uInstrId The instruction ID (VMXINSTRID_VMLAUNCH or
8021	* VMXINSTRID_VMRESUME).
8022	* @thread EMT(pVCpu)
8023	*/
8024	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId)
8025	{
8026	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
8027	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_VMX_VMENTRY_MASK);
8028
8029	iemInitExec(pVCpu, false /fBypassHandlers/);
8030	VBOXSTRICTRC rcStrict = iemVmxVmlaunchVmresume(pVCpu, cbInstr, uInstrId);
8031	Assert(!pVCpu->iem.s.cActiveMappings);
8032	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8033	}
8034
8035
8036	/**
8037	* Checks whether an RDMSR or WRMSR instruction for the given MSR is intercepted
8038	* (causes a VM-exit) or not.
8039	*
8040	* @returns @c true if the instruction is intercepted, @c false otherwise.
8041	* @param pVCpu The cross context virtual CPU structure.
8042	* @param uExitReason The VM-exit reason (VMX_EXIT_RDMSR or
8043	* VMX_EXIT_WRMSR).
8044	* @param idMsr The MSR.
8045	*/
8046	bool iemVmxIsRdmsrWrmsrInterceptSet(PCVMCPU pVCpu, uint32_t uExitReason, uint32_t idMsr) RT_NOEXCEPT
8047	{
8048	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
8049	Assert( uExitReason == VMX_EXIT_RDMSR
8050	\|\| uExitReason == VMX_EXIT_WRMSR);
8051
8052	/* Consult the MSR bitmap if the feature is supported. */
8053	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
8054	Assert(pVmcs);
8055	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
8056	{
8057	uint32_t const fMsrpm = CPUMGetVmxMsrPermission(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap, idMsr);
8058	if (uExitReason == VMX_EXIT_RDMSR)
8059	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_RD);
8060	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_WR);
8061	}
8062
8063	/* Without MSR bitmaps, all MSR accesses are intercepted. */
8064	return true;
8065	}
8066
8067
8068	/**
8069	* VMREAD instruction execution worker that does not perform any validation checks.
8070	*
8071	* Callers are expected to have performed the necessary checks and to ensure the
8072	* VMREAD will succeed.
8073	*
8074	* @param pVmcs Pointer to the virtual VMCS.
8075	* @param pu64Dst Where to write the VMCS value.
8076	* @param u64VmcsField The VMCS field.
8077	*
8078	* @remarks May be called with interrupts disabled.
8079	*/
8080	static void iemVmxVmreadNoCheck(PCVMXVVMCS pVmcs, uint64_t *pu64Dst, uint64_t u64VmcsField) RT_NOEXCEPT
8081	{
8082	VMXVMCSFIELD VmcsField;
8083	VmcsField.u = u64VmcsField;
8084	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8085	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8086	uint8_t const uWidthType = (uWidth << 2) \| uType;
8087	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8088	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8089	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8090	AssertMsg(offField < VMX_V_VMCS_SIZE, ("off=%u field=%#RX64 width=%#x type=%#x index=%#x (%u)\n", offField, u64VmcsField,
8091	uWidth, uType, uIndex, uIndex));
8092	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8093
8094	/*
8095	* Read the VMCS component based on the field's effective width.
8096	*
8097	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8098	* indicates high bits (little endian).
8099	*
8100	* Note! The caller is responsible to trim the result and update registers
8101	* or memory locations are required. Here we just zero-extend to the largest
8102	* type (i.e. 64-bits).
8103	*/
8104	uint8_t const pbVmcs = (uint8_t const )pVmcs;
8105	uint8_t const *pbField = pbVmcs + offField;
8106	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8107	switch (uEffWidth)
8108	{
8109	case VMX_VMCSFIELD_WIDTH_64BIT:
8110	case VMX_VMCSFIELD_WIDTH_NATURAL: pu64Dst = (uint64_t const *)pbField; break;
8111	case VMX_VMCSFIELD_WIDTH_32BIT: pu64Dst = (uint32_t const *)pbField; break;
8112	case VMX_VMCSFIELD_WIDTH_16BIT: pu64Dst = (uint16_t const *)pbField; break;
8113	}
8114	}
8115
8116
8117	/**
8118	* Interface for HM and EM to read a VMCS field from the nested-guest VMCS.
8119	*
8120	* It is ASSUMED the caller knows what they're doing. No VMREAD instruction checks
8121	* are performed. Bounds checks are strict builds only.
8122	*
8123	* @param pVmcs Pointer to the virtual VMCS.
8124	* @param u64VmcsField The VMCS field.
8125	* @param pu64Dst Where to store the VMCS value.
8126	*
8127	* @remarks May be called with interrupts disabled.
8128	* @todo This should probably be moved to CPUM someday.
8129	*/
8130	VMM_INT_DECL(void) IEMReadVmxVmcsField(PCVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t *pu64Dst)
8131	{
8132	AssertPtr(pVmcs);
8133	AssertPtr(pu64Dst);
8134	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8135	}
8136
8137
8138	/**
8139	* VMREAD common (memory/register) instruction execution worker.
8140	*
8141	* @returns Strict VBox status code.
8142	* @param pVCpu The cross context virtual CPU structure.
8143	* @param cbInstr The instruction length in bytes.
8144	* @param pu64Dst Where to write the VMCS value (only updated when
8145	* VINF_SUCCESS is returned).
8146	* @param u64VmcsField The VMCS field.
8147	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8148	* NULL.
8149	*/
8150	static VBOXSTRICTRC iemVmxVmreadCommon(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8151	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8152	{
8153	/* Nested-guest intercept. */
8154	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8155	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMREAD, u64VmcsField))
8156	{
8157	if (pExitInfo)
8158	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8159	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMREAD, VMXINSTRID_VMREAD, cbInstr);
8160	}
8161
8162	/* CPL. */
8163	if (pVCpu->iem.s.uCpl == 0)
8164	{ /* likely */ }
8165	else
8166	{
8167	Log(("vmread: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8168	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_Cpl;
8169	return iemRaiseGeneralProtectionFault0(pVCpu);
8170	}
8171
8172	pVCpu->iem.s.cPotentialExits++;
8173
8174	/* VMCS pointer in root mode. */
8175	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8176	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8177	{ /* likely */ }
8178	else
8179	{
8180	Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8181	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrInvalid;
8182	iemVmxVmFailInvalid(pVCpu);
8183	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8184	}
8185
8186	/* VMCS-link pointer in non-root mode. */
8187	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8188	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8189	{ /* likely */ }
8190	else
8191	{
8192	Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8193	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_LinkPtrInvalid;
8194	iemVmxVmFailInvalid(pVCpu);
8195	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8196	}
8197
8198	/* Supported VMCS field. */
8199	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8200	{ /* likely */ }
8201	else
8202	{
8203	Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8204	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_FieldInvalid;
8205	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8206	iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
8207	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8208	}
8209
8210	/*
8211	* Reading from the current or shadow VMCS.
8212	*/
8213	PCVMXVVMCS pVmcs = !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8214	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8215	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8216	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8217	Log4(("vmread %#RX64 => %#RX64\n", u64VmcsField, *pu64Dst));
8218	return VINF_SUCCESS;
8219	}
8220
8221
8222	/**
8223	* VMREAD (64-bit register) instruction execution worker.
8224	*
8225	* @returns Strict VBox status code.
8226	* @param pVCpu The cross context virtual CPU structure.
8227	* @param cbInstr The instruction length in bytes.
8228	* @param pu64Dst Where to store the VMCS field's value.
8229	* @param u64VmcsField The VMCS field.
8230	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8231	* NULL.
8232	*/
8233	static VBOXSTRICTRC iemVmxVmreadReg64(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8234	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8235	{
8236	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64VmcsField, pExitInfo);
8237	if (rcStrict == VINF_SUCCESS)
8238	{
8239	iemVmxVmSucceed(pVCpu);
8240	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8241	}
8242
8243	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8244	return rcStrict;
8245	}
8246
8247
8248	/**
8249	* VMREAD (32-bit register) instruction execution worker.
8250	*
8251	* @returns Strict VBox status code.
8252	* @param pVCpu The cross context virtual CPU structure.
8253	* @param cbInstr The instruction length in bytes.
8254	* @param pu32Dst Where to store the VMCS field's value.
8255	* @param u32VmcsField The VMCS field.
8256	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8257	* NULL.
8258	*/
8259	static VBOXSTRICTRC iemVmxVmreadReg32(PVMCPUCC pVCpu, uint8_t cbInstr, uint32_t *pu32Dst,
8260	uint64_t u32VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8261	{
8262	uint64_t u64Dst;
8263	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32VmcsField, pExitInfo);
8264	if (rcStrict == VINF_SUCCESS)
8265	{
8266	*pu32Dst = u64Dst;
8267	iemVmxVmSucceed(pVCpu);
8268	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8269	}
8270
8271	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8272	return rcStrict;
8273	}
8274
8275
8276	/**
8277	* VMREAD (memory) instruction execution worker.
8278	*
8279	* @returns Strict VBox status code.
8280	* @param pVCpu The cross context virtual CPU structure.
8281	* @param cbInstr The instruction length in bytes.
8282	* @param iEffSeg The effective segment register to use with @a u64Val.
8283	* Pass UINT8_MAX if it is a register access.
8284	* @param GCPtrDst The guest linear address to store the VMCS field's
8285	* value.
8286	* @param u64VmcsField The VMCS field.
8287	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8288	* NULL.
8289	*/
8290	static VBOXSTRICTRC iemVmxVmreadMem(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrDst,
8291	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8292	{
8293	uint64_t u64Dst;
8294	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64VmcsField, pExitInfo);
8295	if (rcStrict == VINF_SUCCESS)
8296	{
8297	/*
8298	* Write the VMCS field's value to the location specified in guest-memory.
8299	*/
8300	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8301	rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8302	else
8303	rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8304	if (rcStrict == VINF_SUCCESS)
8305	{
8306	iemVmxVmSucceed(pVCpu);
8307	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8308	}
8309
8310	Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
8311	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrMap;
8312	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrDst;
8313	return rcStrict;
8314	}
8315
8316	Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8317	return rcStrict;
8318	}
8319
8320
8321	/**
8322	* Interface for HM and EM to emulate the VMREAD instruction.
8323	*
8324	* @returns Strict VBox status code.
8325	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8326	* @param pExitInfo Pointer to the VM-exit information.
8327	* @thread EMT(pVCpu)
8328	*/
8329	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmread(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8330	{
8331	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8332	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8333	Assert(pExitInfo);
8334
8335	iemInitExec(pVCpu, false /fBypassHandlers/);
8336
8337	VBOXSTRICTRC rcStrict;
8338	uint8_t const cbInstr = pExitInfo->cbInstr;
8339	bool const fIs64BitMode = RT_BOOL(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT);
8340	uint64_t const u64FieldEnc = fIs64BitMode
8341	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8342	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8343	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8344	{
8345	if (fIs64BitMode)
8346	{
8347	uint64_t *pu64Dst = iemGRegRefU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8348	rcStrict = iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
8349	}
8350	else
8351	{
8352	uint32_t *pu32Dst = iemGRegRefU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8353	rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u64FieldEnc, pExitInfo);
8354	}
8355	}
8356	else
8357	{
8358	RTGCPTR const GCPtrDst = pExitInfo->GCPtrEffAddr;
8359	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8360	rcStrict = iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64FieldEnc, pExitInfo);
8361	}
8362	Assert(!pVCpu->iem.s.cActiveMappings);
8363	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8364	}
8365
8366
8367	/**
8368	* VMWRITE instruction execution worker that does not perform any validation
8369	* checks.
8370	*
8371	* Callers are expected to have performed the necessary checks and to ensure the
8372	* VMWRITE will succeed.
8373	*
8374	* @param pVmcs Pointer to the virtual VMCS.
8375	* @param u64Val The value to write.
8376	* @param u64VmcsField The VMCS field.
8377	*
8378	* @remarks May be called with interrupts disabled.
8379	*/
8380	static void iemVmxVmwriteNoCheck(PVMXVVMCS pVmcs, uint64_t u64Val, uint64_t u64VmcsField) RT_NOEXCEPT
8381	{
8382	VMXVMCSFIELD VmcsField;
8383	VmcsField.u = u64VmcsField;
8384	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8385	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8386	uint8_t const uWidthType = (uWidth << 2) \| uType;
8387	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8388	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8389	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8390	Assert(offField < VMX_V_VMCS_SIZE);
8391	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8392
8393	/*
8394	* Write the VMCS component based on the field's effective width.
8395	*
8396	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8397	* indicates high bits (little endian).
8398	*/
8399	uint8_t pbVmcs = (uint8_t )pVmcs;
8400	uint8_t *pbField = pbVmcs + offField;
8401	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8402	switch (uEffWidth)
8403	{
8404	case VMX_VMCSFIELD_WIDTH_64BIT:
8405	case VMX_VMCSFIELD_WIDTH_NATURAL: (uint64_t )pbField = u64Val; break;
8406	case VMX_VMCSFIELD_WIDTH_32BIT: (uint32_t )pbField = u64Val; break;
8407	case VMX_VMCSFIELD_WIDTH_16BIT: (uint16_t )pbField = u64Val; break;
8408	}
8409	}
8410
8411
8412	/**
8413	* Interface for HM and EM to write a VMCS field in the nested-guest VMCS.
8414	*
8415	* It is ASSUMED the caller knows what they're doing. No VMWRITE instruction checks
8416	* are performed. Bounds checks are strict builds only.
8417	*
8418	* @param pVmcs Pointer to the virtual VMCS.
8419	* @param u64VmcsField The VMCS field.
8420	* @param u64Val The value to write.
8421	*
8422	* @remarks May be called with interrupts disabled.
8423	* @todo This should probably be moved to CPUM someday.
8424	*/
8425	VMM_INT_DECL(void) IEMWriteVmxVmcsField(PVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t u64Val)
8426	{
8427	AssertPtr(pVmcs);
8428	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8429	}
8430
8431
8432	/**
8433	* VMWRITE instruction execution worker.
8434	*
8435	* @returns Strict VBox status code.
8436	* @param pVCpu The cross context virtual CPU structure.
8437	* @param cbInstr The instruction length in bytes.
8438	* @param iEffSeg The effective segment register to use with @a u64Val.
8439	* Pass UINT8_MAX if it is a register access.
8440	* @param u64Val The value to write (or guest linear address to the
8441	* value), @a iEffSeg will indicate if it's a memory
8442	* operand.
8443	* @param u64VmcsField The VMCS field.
8444	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8445	* NULL.
8446	*/
8447	static VBOXSTRICTRC iemVmxVmwrite(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, uint64_t u64Val,
8448	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8449	{
8450	/* Nested-guest intercept. */
8451	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8452	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMWRITE, u64VmcsField))
8453	{
8454	if (pExitInfo)
8455	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8456	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMWRITE, VMXINSTRID_VMWRITE, cbInstr);
8457	}
8458
8459	/* CPL. */
8460	if (pVCpu->iem.s.uCpl == 0)
8461	{ /* likely */ }
8462	else
8463	{
8464	Log(("vmwrite: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8465	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_Cpl;
8466	return iemRaiseGeneralProtectionFault0(pVCpu);
8467	}
8468
8469	pVCpu->iem.s.cPotentialExits++;
8470
8471	/* VMCS pointer in root mode. */
8472	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8473	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8474	{ /* likely */ }
8475	else
8476	{
8477	Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8478	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrInvalid;
8479	iemVmxVmFailInvalid(pVCpu);
8480	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8481	}
8482
8483	/* VMCS-link pointer in non-root mode. */
8484	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8485	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8486	{ /* likely */ }
8487	else
8488	{
8489	Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8490	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_LinkPtrInvalid;
8491	iemVmxVmFailInvalid(pVCpu);
8492	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8493	}
8494
8495	/* If the VMWRITE instruction references memory, access the specified memory operand. */
8496	bool const fIsRegOperand = iEffSeg == UINT8_MAX;
8497	if (!fIsRegOperand)
8498	{
8499	/* Read the value from the specified guest memory location. */
8500	VBOXSTRICTRC rcStrict;
8501	RTGCPTR const GCPtrVal = u64Val;
8502	if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8503	rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8504	else
8505	rcStrict = iemMemFetchDataU32_ZX_U64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8506	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
8507	{
8508	Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
8509	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrMap;
8510	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVal;
8511	return rcStrict;
8512	}
8513	}
8514	else
8515	Assert(!pExitInfo \|\| pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
8516
8517	/* Supported VMCS field. */
8518	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8519	{ /* likely */ }
8520	else
8521	{
8522	Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8523	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldInvalid;
8524	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8525	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
8526	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8527	}
8528
8529	/* Read-only VMCS field. */
8530	bool const fIsFieldReadOnly = VMXIsVmcsFieldReadOnly(u64VmcsField);
8531	if ( !fIsFieldReadOnly
8532	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
8533	{ /* likely */ }
8534	else
8535	{
8536	Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64VmcsField));
8537	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldRo;
8538	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8539	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
8540	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8541	}
8542
8543	/*
8544	* Write to the current or shadow VMCS.
8545	*/
8546	bool const fInVmxNonRootMode = IEM_VMX_IS_NON_ROOT_MODE(pVCpu);
8547	PVMXVVMCS pVmcs = !fInVmxNonRootMode
8548	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8549	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8550	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8551	Log4(("vmwrite %#RX64 <= %#RX64\n", u64VmcsField, u64Val));
8552
8553	if ( !fInVmxNonRootMode
8554	&& VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
8555	{
8556	/* Notify HM that the VMCS content might have changed. */
8557	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
8558	}
8559
8560	iemVmxVmSucceed(pVCpu);
8561	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8562	}
8563
8564
8565	/**
8566	* Interface for HM and EM to emulate the VMWRITE instruction.
8567	*
8568	* @returns Strict VBox status code.
8569	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8570	* @param pExitInfo Pointer to the VM-exit information.
8571	* @thread EMT(pVCpu)
8572	*/
8573	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmwrite(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8574	{
8575	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8576	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8577	Assert(pExitInfo);
8578
8579	iemInitExec(pVCpu, false /fBypassHandlers/);
8580
8581	uint64_t u64Val;
8582	uint8_t iEffSeg;
8583	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8584	{
8585	u64Val = iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8586	iEffSeg = UINT8_MAX;
8587	}
8588	else
8589	{
8590	u64Val = pExitInfo->GCPtrEffAddr;
8591	iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8592	}
8593	uint8_t const cbInstr = pExitInfo->cbInstr;
8594	uint64_t const u64FieldEnc = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
8595	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8596	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8597	VBOXSTRICTRC rcStrict = iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, u64Val, u64FieldEnc, pExitInfo);
8598	Assert(!pVCpu->iem.s.cActiveMappings);
8599	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8600	}
8601
8602
8603	/**
8604	* VMCLEAR instruction execution worker.
8605	*
8606	* @returns Strict VBox status code.
8607	* @param pVCpu The cross context virtual CPU structure.
8608	* @param cbInstr The instruction length in bytes.
8609	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8610	* @param GCPtrVmcs The linear address of the VMCS pointer.
8611	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8612	*
8613	* @remarks Common VMX instruction checks are already expected to by the caller,
8614	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8615	*/
8616	static VBOXSTRICTRC iemVmxVmclear(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8617	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8618	{
8619	/* Nested-guest intercept. */
8620	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8621	{
8622	if (pExitInfo)
8623	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8624	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMCLEAR, VMXINSTRID_NONE, cbInstr);
8625	}
8626
8627	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8628
8629	/* CPL. */
8630	if (pVCpu->iem.s.uCpl == 0)
8631	{ /* likely */ }
8632	else
8633	{
8634	Log(("vmclear: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8635	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_Cpl;
8636	return iemRaiseGeneralProtectionFault0(pVCpu);
8637	}
8638
8639	/* Get the VMCS pointer from the location specified by the source memory operand. */
8640	RTGCPHYS GCPhysVmcs;
8641	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8642	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8643	{ /* likely */ }
8644	else
8645	{
8646	Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8647	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrMap;
8648	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8649	return rcStrict;
8650	}
8651
8652	/* VMCS pointer alignment. */
8653	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8654	{ /* likely */ }
8655	else
8656	{
8657	Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
8658	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAlign;
8659	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8660	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8661	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8662	}
8663
8664	/* VMCS physical-address width limits. */
8665	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8666	{ /* likely */ }
8667	else
8668	{
8669	Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8670	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrWidth;
8671	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8672	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8673	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8674	}
8675
8676	/* VMCS is not the VMXON region. */
8677	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8678	{ /* likely */ }
8679	else
8680	{
8681	Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8682	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrVmxon;
8683	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8684	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
8685	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8686	}
8687
8688	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8689	restriction imposed by our implementation. */
8690	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8691	{ /* likely */ }
8692	else
8693	{
8694	Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
8695	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAbnormal;
8696	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8697	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8698	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8699	}
8700
8701	/*
8702	* VMCLEAR allows committing and clearing any valid VMCS pointer.
8703	*
8704	* If the current VMCS is the one being cleared, set its state to 'clear' and commit
8705	* to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
8706	* to 'clear'.
8707	*/
8708	uint8_t const fVmcsLaunchStateClear = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
8709	if ( IEM_VMX_HAS_CURRENT_VMCS(pVCpu)
8710	&& IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
8711	{
8712	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState = fVmcsLaunchStateClear;
8713	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
8714	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8715	}
8716	else
8717	{
8718	AssertCompileMemberSize(VMXVVMCS, fVmcsState, sizeof(fVmcsLaunchStateClear));
8719	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + RT_UOFFSETOF(VMXVVMCS, fVmcsState),
8720	(const void *)&fVmcsLaunchStateClear, sizeof(fVmcsLaunchStateClear));
8721	if (RT_FAILURE(rcStrict))
8722	return rcStrict;
8723	}
8724
8725	iemVmxVmSucceed(pVCpu);
8726	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8727	}
8728
8729
8730	/**
8731	* Interface for HM and EM to emulate the VMCLEAR instruction.
8732	*
8733	* @returns Strict VBox status code.
8734	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8735	* @param pExitInfo Pointer to the VM-exit information.
8736	* @thread EMT(pVCpu)
8737	*/
8738	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmclear(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8739	{
8740	Assert(pExitInfo);
8741	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8742	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8743
8744	iemInitExec(pVCpu, false /fBypassHandlers/);
8745
8746	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8747	uint8_t const cbInstr = pExitInfo->cbInstr;
8748	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8749	VBOXSTRICTRC rcStrict = iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8750	Assert(!pVCpu->iem.s.cActiveMappings);
8751	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8752	}
8753
8754
8755	/**
8756	* VMPTRST instruction execution worker.
8757	*
8758	* @returns Strict VBox status code.
8759	* @param pVCpu The cross context virtual CPU structure.
8760	* @param cbInstr The instruction length in bytes.
8761	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8762	* @param GCPtrVmcs The linear address of where to store the current VMCS
8763	* pointer.
8764	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8765	*
8766	* @remarks Common VMX instruction checks are already expected to by the caller,
8767	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8768	*/
8769	static VBOXSTRICTRC iemVmxVmptrst(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8770	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8771	{
8772	/* Nested-guest intercept. */
8773	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8774	{
8775	if (pExitInfo)
8776	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8777	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRST, VMXINSTRID_NONE, cbInstr);
8778	}
8779
8780	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8781
8782	/* CPL. */
8783	if (pVCpu->iem.s.uCpl == 0)
8784	{ /* likely */ }
8785	else
8786	{
8787	Log(("vmptrst: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8788	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_Cpl;
8789	return iemRaiseGeneralProtectionFault0(pVCpu);
8790	}
8791
8792	/* Set the VMCS pointer to the location specified by the destination memory operand. */
8793	AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
8794	VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
8795	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8796	{
8797	iemVmxVmSucceed(pVCpu);
8798	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8799	}
8800
8801	Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8802	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_PtrMap;
8803	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8804	return rcStrict;
8805	}
8806
8807
8808	/**
8809	* Interface for HM and EM to emulate the VMPTRST instruction.
8810	*
8811	* @returns Strict VBox status code.
8812	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8813	* @param pExitInfo Pointer to the VM-exit information.
8814	* @thread EMT(pVCpu)
8815	*/
8816	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrst(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8817	{
8818	Assert(pExitInfo);
8819	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8820	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8821
8822	iemInitExec(pVCpu, false /fBypassHandlers/);
8823
8824	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8825	uint8_t const cbInstr = pExitInfo->cbInstr;
8826	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8827	VBOXSTRICTRC rcStrict = iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8828	Assert(!pVCpu->iem.s.cActiveMappings);
8829	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8830	}
8831
8832
8833	/**
8834	* VMPTRLD instruction execution worker.
8835	*
8836	* @returns Strict VBox status code.
8837	* @param pVCpu The cross context virtual CPU structure.
8838	* @param cbInstr The instruction length in bytes.
8839	* @param GCPtrVmcs The linear address of the current VMCS pointer.
8840	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8841	*
8842	* @remarks Common VMX instruction checks are already expected to by the caller,
8843	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8844	*/
8845	static VBOXSTRICTRC iemVmxVmptrld(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8846	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8847	{
8848	/* Nested-guest intercept. */
8849	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8850	{
8851	if (pExitInfo)
8852	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8853	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRLD, VMXINSTRID_NONE, cbInstr);
8854	}
8855
8856	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8857
8858	/* CPL. */
8859	if (pVCpu->iem.s.uCpl == 0)
8860	{ /* likely */ }
8861	else
8862	{
8863	Log(("vmptrld: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
8864	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_Cpl;
8865	return iemRaiseGeneralProtectionFault0(pVCpu);
8866	}
8867
8868	/* Get the VMCS pointer from the location specified by the source memory operand. */
8869	RTGCPHYS GCPhysVmcs;
8870	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8871	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8872	{ /* likely */ }
8873	else
8874	{
8875	Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8876	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrMap;
8877	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8878	return rcStrict;
8879	}
8880
8881	/* VMCS pointer alignment. */
8882	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8883	{ /* likely */ }
8884	else
8885	{
8886	Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
8887	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAlign;
8888	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8889	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8890	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8891	}
8892
8893	/* VMCS physical-address width limits. */
8894	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8895	{ /* likely */ }
8896	else
8897	{
8898	Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8899	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrWidth;
8900	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8901	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8902	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8903	}
8904
8905	/* VMCS is not the VMXON region. */
8906	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8907	{ /* likely */ }
8908	else
8909	{
8910	Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8911	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrVmxon;
8912	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8913	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
8914	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8915	}
8916
8917	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8918	restriction imposed by our implementation. */
8919	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8920	{ /* likely */ }
8921	else
8922	{
8923	Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
8924	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAbnormal;
8925	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8926	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8927	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8928	}
8929
8930	/* Read just the VMCS revision from the VMCS. */
8931	VMXVMCSREVID VmcsRevId;
8932	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
8933	if (RT_SUCCESS(rc))
8934	{ /* likely */ }
8935	else
8936	{
8937	Log(("vmptrld: Failed to read revision identifier from VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8938	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_RevPtrReadPhys;
8939	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8940	return rc;
8941	}
8942
8943	/*
8944	* Verify the VMCS revision specified by the guest matches what we reported to the guest.
8945	* Verify the VMCS is not a shadow VMCS, if the VMCS shadowing feature is supported.
8946	*/
8947	if ( VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID
8948	&& ( !VmcsRevId.n.fIsShadowVmcs
8949	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
8950	{ /* likely */ }
8951	else
8952	{
8953	if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
8954	{
8955	Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32, GCPtrVmcs=%#RGv GCPhysVmcs=%#RGp -> VMFail()\n",
8956	VMX_V_VMCS_REVISION_ID, VmcsRevId.n.u31RevisionId, GCPtrVmcs, GCPhysVmcs));
8957	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_VmcsRevId;
8958	}
8959	else
8960	{
8961	Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
8962	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_ShadowVmcs;
8963	}
8964	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
8965	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8966	}
8967
8968	/*
8969	* We cache only the current VMCS in CPUMCTX. Therefore, VMPTRLD should always flush
8970	* the cache of an existing, current VMCS back to guest memory before loading a new,
8971	* different current VMCS.
8972	*/
8973	if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
8974	{
8975	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8976	{
8977	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
8978	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8979	}
8980
8981	/* Set the new VMCS as the current VMCS and read it from guest memory. */
8982	IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
8983	rc = iemVmxReadCurrentVmcsFromGstMem(pVCpu);
8984	if (RT_SUCCESS(rc))
8985	{
8986	/* Notify HM that a new, current VMCS is loaded. */
8987	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
8988	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
8989	}
8990	else
8991	{
8992	Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8993	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrReadPhys;
8994	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8995	return rc;
8996	}
8997	}
8998
8999	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
9000	iemVmxVmSucceed(pVCpu);
9001	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9002	}
9003
9004
9005	/**
9006	* Interface for HM and EM to emulate the VMPTRLD instruction.
9007	*
9008	* @returns Strict VBox status code.
9009	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9010	* @param pExitInfo Pointer to the VM-exit information.
9011	* @thread EMT(pVCpu)
9012	*/
9013	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrld(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9014	{
9015	Assert(pExitInfo);
9016	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9017	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9018
9019	iemInitExec(pVCpu, false /fBypassHandlers/);
9020
9021	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9022	uint8_t const cbInstr = pExitInfo->cbInstr;
9023	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
9024	VBOXSTRICTRC rcStrict = iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
9025	Assert(!pVCpu->iem.s.cActiveMappings);
9026	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9027	}
9028
9029
9030	/**
9031	* INVVPID instruction execution worker.
9032	*
9033	* @returns Strict VBox status code.
9034	* @param pVCpu The cross context virtual CPU structure.
9035	* @param cbInstr The instruction length in bytes.
9036	* @param iEffSeg The segment of the invvpid descriptor.
9037	* @param GCPtrInvvpidDesc The address of invvpid descriptor.
9038	* @param u64InvvpidType The invalidation type.
9039	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9040	* NULL.
9041	*
9042	* @remarks Common VMX instruction checks are already expected to by the caller,
9043	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9044	*/
9045	VBOXSTRICTRC iemVmxInvvpid(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInvvpidDesc,
9046	uint64_t u64InvvpidType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9047	{
9048	/* Check if INVVPID instruction is supported, otherwise raise #UD. */
9049	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVpid)
9050	return iemRaiseUndefinedOpcode(pVCpu);
9051
9052	/* Nested-guest intercept. */
9053	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9054	{
9055	if (pExitInfo)
9056	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9057	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVVPID, VMXINSTRID_NONE, cbInstr);
9058	}
9059
9060	/* CPL. */
9061	if (pVCpu->iem.s.uCpl != 0)
9062	{
9063	Log(("invvpid: CPL != 0 -> #GP(0)\n"));
9064	return iemRaiseGeneralProtectionFault0(pVCpu);
9065	}
9066
9067	/*
9068	* Validate INVVPID invalidation type.
9069	*
9070	* The instruction specifies exactly ONE of the supported invalidation types.
9071	*
9072	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9073	* supported. In theory, it's possible for a CPU to not support flushing individual
9074	* addresses but all the other types or any other combination. We do not take any
9075	* shortcuts here by assuming the types we currently expose to the guest.
9076	*/
9077	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9078	bool const fInvvpidSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID);
9079	bool const fTypeIndivAddr = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_INDIV_ADDR);
9080	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX);
9081	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_ALL_CTX);
9082	bool const fTypeSingleCtxRetainGlobals = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX_RETAIN_GLOBALS);
9083
9084	bool afSupportedTypes[4];
9085	afSupportedTypes[0] = fTypeIndivAddr;
9086	afSupportedTypes[1] = fTypeSingleCtx;
9087	afSupportedTypes[2] = fTypeAllCtx;
9088	afSupportedTypes[3] = fTypeSingleCtxRetainGlobals;
9089
9090	if ( fInvvpidSupported
9091	&& !(u64InvvpidType & ~(uint64_t)VMX_INVVPID_VALID_MASK)
9092	&& afSupportedTypes[u64InvvpidType & 3])
9093	{ /* likely */ }
9094	else
9095	{
9096	Log(("invvpid: invalid/unsupported invvpid type %#x -> VMFail\n", u64InvvpidType));
9097	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_TypeInvalid;
9098	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9099	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9100	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9101	}
9102
9103	/*
9104	* Fetch the invvpid descriptor from guest memory.
9105	*/
9106	RTUINT128U uDesc;
9107	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvvpidDesc);
9108	if (rcStrict == VINF_SUCCESS)
9109	{
9110	/*
9111	* Validate the descriptor.
9112	*/
9113	if (uDesc.s.Lo <= 0xffff)
9114	{ /* likely */ }
9115	else
9116	{
9117	Log(("invvpid: reserved bits set in invvpid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
9118	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_DescRsvd;
9119	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Lo;
9120	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9121	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9122	}
9123
9124	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9125	RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
9126	uint16_t const uVpid = uDesc.Words.w0;
9127	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9128	switch (u64InvvpidType)
9129	{
9130	case VMXTLBFLUSHVPID_INDIV_ADDR:
9131	{
9132	if (uVpid != 0)
9133	{
9134	if (IEM_IS_CANONICAL(GCPtrInvAddr))
9135	{
9136	/* Invalidate mappings for the linear address tagged with VPID. */
9137	/** @todo PGM support for VPID? Currently just flush everything. */
9138	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9139	iemVmxVmSucceed(pVCpu);
9140	}
9141	else
9142	{
9143	Log(("invvpid: invalidation address %#RGP is not canonical -> VMFail\n", GCPtrInvAddr));
9144	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidAddr;
9145	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrInvAddr;
9146	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9147	}
9148	}
9149	else
9150	{
9151	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9152	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidVpid;
9153	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9154	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9155	}
9156	break;
9157	}
9158
9159	case VMXTLBFLUSHVPID_SINGLE_CONTEXT:
9160	{
9161	if (uVpid != 0)
9162	{
9163	/* Invalidate all mappings with VPID. */
9164	/** @todo PGM support for VPID? Currently just flush everything. */
9165	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9166	iemVmxVmSucceed(pVCpu);
9167	}
9168	else
9169	{
9170	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9171	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type1InvalidVpid;
9172	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9173	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9174	}
9175	break;
9176	}
9177
9178	case VMXTLBFLUSHVPID_ALL_CONTEXTS:
9179	{
9180	/* Invalidate all mappings with non-zero VPIDs. */
9181	/** @todo PGM support for VPID? Currently just flush everything. */
9182	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9183	iemVmxVmSucceed(pVCpu);
9184	break;
9185	}
9186
9187	case VMXTLBFLUSHVPID_SINGLE_CONTEXT_RETAIN_GLOBALS:
9188	{
9189	if (uVpid != 0)
9190	{
9191	/* Invalidate all mappings with VPID except global translations. */
9192	/** @todo PGM support for VPID? Currently just flush everything. */
9193	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9194	iemVmxVmSucceed(pVCpu);
9195	}
9196	else
9197	{
9198	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9199	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type3InvalidVpid;
9200	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uVpid;
9201	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9202	}
9203	break;
9204	}
9205	IEM_NOT_REACHED_DEFAULT_CASE_RET();
9206	}
9207	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9208	}
9209	return rcStrict;
9210	}
9211
9212
9213	/**
9214	* Interface for HM and EM to emulate the INVVPID instruction.
9215	*
9216	* @returns Strict VBox status code.
9217	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9218	* @param pExitInfo Pointer to the VM-exit information.
9219	* @thread EMT(pVCpu)
9220	*/
9221	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvvpid(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9222	{
9223	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9224	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9225	Assert(pExitInfo);
9226
9227	iemInitExec(pVCpu, false /fBypassHandlers/);
9228
9229	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9230	uint8_t const cbInstr = pExitInfo->cbInstr;
9231	RTGCPTR const GCPtrInvvpidDesc = pExitInfo->GCPtrEffAddr;
9232	uint64_t const u64InvvpidType = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
9233	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9234	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9235	VBOXSTRICTRC rcStrict = iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, u64InvvpidType, pExitInfo);
9236	Assert(!pVCpu->iem.s.cActiveMappings);
9237	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9238	}
9239
9240	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9241
9242	/**
9243	* INVEPT instruction execution worker.
9244	*
9245	* @returns Strict VBox status code.
9246	* @param pVCpu The cross context virtual CPU structure.
9247	* @param cbInstr The instruction length in bytes.
9248	* @param iEffSeg The segment of the invept descriptor.
9249	* @param GCPtrInveptDesc The address of invept descriptor.
9250	* @param u64InveptType The invalidation type.
9251	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9252	* NULL.
9253	*
9254	* @remarks Common VMX instruction checks are already expected to by the caller,
9255	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9256	*/
9257	static VBOXSTRICTRC iemVmxInvept(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInveptDesc,
9258	uint64_t u64InveptType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9259	{
9260	/* Check if EPT is supported, otherwise raise #UD. */
9261	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEpt)
9262	return iemRaiseUndefinedOpcode(pVCpu);
9263
9264	/* Nested-guest intercept. */
9265	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9266	{
9267	if (pExitInfo)
9268	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9269	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVEPT, VMXINSTRID_NONE, cbInstr);
9270	}
9271
9272	/* CPL. */
9273	if (pVCpu->iem.s.uCpl != 0)
9274	{
9275	Log(("invept: CPL != 0 -> #GP(0)\n"));
9276	return iemRaiseGeneralProtectionFault0(pVCpu);
9277	}
9278
9279	/*
9280	* Validate INVEPT invalidation type.
9281	*
9282	* The instruction specifies exactly ONE of the supported invalidation types.
9283	*
9284	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9285	* supported. In theory, it's possible for a CPU to not support flushing individual
9286	* addresses but all the other types or any other combination. We do not take any
9287	* shortcuts here by assuming the types we currently expose to the guest.
9288	*/
9289	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9290	bool const fInveptSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT);
9291	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_SINGLE_CTX);
9292	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_ALL_CTX);
9293
9294	bool afSupportedTypes[4];
9295	afSupportedTypes[0] = false;
9296	afSupportedTypes[1] = fTypeSingleCtx;
9297	afSupportedTypes[2] = fTypeAllCtx;
9298	afSupportedTypes[3] = false;
9299
9300	if ( fInveptSupported
9301	&& !(u64InveptType & ~(uint64_t)VMX_INVEPT_VALID_MASK)
9302	&& afSupportedTypes[u64InveptType & 3])
9303	{ /* likely */ }
9304	else
9305	{
9306	Log(("invept: invalid/unsupported invvpid type %#x -> VMFail\n", u64InveptType));
9307	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_TypeInvalid;
9308	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InveptType;
9309	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9310	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9311	}
9312
9313	/*
9314	* Fetch the invept descriptor from guest memory.
9315	*/
9316	RTUINT128U uDesc;
9317	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInveptDesc);
9318	if (rcStrict == VINF_SUCCESS)
9319	{
9320	/*
9321	* Validate the descriptor.
9322	*
9323	* The Intel spec. does not explicit say the INVEPT instruction fails when reserved
9324	* bits in the descriptor are set, but it -does- for INVVPID. Until we test on real
9325	* hardware, it's assumed INVEPT behaves the same as INVVPID in this regard. It's
9326	* better to be strict in our emulation until proven otherwise.
9327	*/
9328	if (uDesc.s.Hi)
9329	{
9330	Log(("invept: reserved bits set in invept descriptor %#RX64 -> VMFail\n", uDesc.s.Hi));
9331	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_DescRsvd;
9332	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Hi;
9333	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9334	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9335	}
9336
9337	/*
9338	* Flush TLB mappings based on the EPT type.
9339	*/
9340	if (u64InveptType == VMXTLBFLUSHEPT_SINGLE_CONTEXT)
9341	{
9342	uint64_t const GCPhysEptPtr = uDesc.s.Lo;
9343	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, GCPhysEptPtr, NULL /* enmDiag */);
9344	if (RT_SUCCESS(rc))
9345	{ /* likely */ }
9346	else
9347	{
9348	Log(("invept: EPTP invalid %#RX64 -> VMFail\n", GCPhysEptPtr));
9349	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_EptpInvalid;
9350	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysEptPtr;
9351	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9352	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9353	}
9354	}
9355
9356	/** @todo PGM support for EPT tags? Currently just flush everything. */
9357	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9358	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9359	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9360
9361	iemVmxVmSucceed(pVCpu);
9362	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9363	}
9364
9365	return rcStrict;
9366	}
9367
9368
9369	/**
9370	* Interface for HM and EM to emulate the INVEPT instruction.
9371	*
9372	* @returns Strict VBox status code.
9373	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9374	* @param pExitInfo Pointer to the VM-exit information.
9375	* @thread EMT(pVCpu)
9376	*/
9377	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvept(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9378	{
9379	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9380	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9381	Assert(pExitInfo);
9382
9383	iemInitExec(pVCpu, false /fBypassHandlers/);
9384
9385	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9386	uint8_t const cbInstr = pExitInfo->cbInstr;
9387	RTGCPTR const GCPtrInveptDesc = pExitInfo->GCPtrEffAddr;
9388	uint64_t const u64InveptType = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
9389	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9390	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9391	VBOXSTRICTRC rcStrict = iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, u64InveptType, pExitInfo);
9392	Assert(!pVCpu->iem.s.cActiveMappings);
9393	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9394	}
9395
9396	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
9397
9398	/**
9399	* VMXON instruction execution worker.
9400	*
9401	* @returns Strict VBox status code.
9402	* @param pVCpu The cross context virtual CPU structure.
9403	* @param cbInstr The instruction length in bytes.
9404	* @param iEffSeg The effective segment register to use with @a
9405	* GCPtrVmxon.
9406	* @param GCPtrVmxon The linear address of the VMXON pointer.
9407	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
9408	*
9409	* @remarks Common VMX instruction checks are already expected to by the caller,
9410	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9411	*/
9412	static VBOXSTRICTRC iemVmxVmxon(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
9413	RTGCPHYS GCPtrVmxon, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9414	{
9415	if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
9416	{
9417	/* CPL. */
9418	if (pVCpu->iem.s.uCpl == 0)
9419	{ /* likely */ }
9420	else
9421	{
9422	Log(("vmxon: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
9423	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cpl;
9424	return iemRaiseGeneralProtectionFault0(pVCpu);
9425	}
9426
9427	/* A20M (A20 Masked) mode. */
9428	if (PGMPhysIsA20Enabled(pVCpu))
9429	{ /* likely */ }
9430	else
9431	{
9432	Log(("vmxon: A20M mode -> #GP(0)\n"));
9433	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_A20M;
9434	return iemRaiseGeneralProtectionFault0(pVCpu);
9435	}
9436
9437	/* CR0. */
9438	{
9439	/*
9440	* CR0 MB1 bits.
9441	*
9442	* We use VMX_V_CR0_FIXED0 below to ensure CR0.PE and CR0.PG are always set
9443	* while executing VMXON. CR0.PE and CR0.PG are only allowed to be clear
9444	* when the guest running in VMX non-root mode with unrestricted-guest control
9445	* enabled in the VMCS.
9446	*/
9447	uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
9448	if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) == uCr0Fixed0)
9449	{ /* likely */ }
9450	else
9451	{
9452	Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
9453	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed0;
9454	return iemRaiseGeneralProtectionFault0(pVCpu);
9455	}
9456
9457	/* CR0 MBZ bits. */
9458	uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
9459	if (!(pVCpu->cpum.GstCtx.cr0 & ~uCr0Fixed1))
9460	{ /* likely */ }
9461	else
9462	{
9463	Log(("vmxon: CR0 fixed1 bits set -> #GP(0)\n"));
9464	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed1;
9465	return iemRaiseGeneralProtectionFault0(pVCpu);
9466	}
9467	}
9468
9469	/* CR4. */
9470	{
9471	/* CR4 MB1 bits. */
9472	uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
9473	if ((pVCpu->cpum.GstCtx.cr4 & uCr4Fixed0) == uCr4Fixed0)
9474	{ /* likely */ }
9475	else
9476	{
9477	Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
9478	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed0;
9479	return iemRaiseGeneralProtectionFault0(pVCpu);
9480	}
9481
9482	/* CR4 MBZ bits. */
9483	uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
9484	if (!(pVCpu->cpum.GstCtx.cr4 & ~uCr4Fixed1))
9485	{ /* likely */ }
9486	else
9487	{
9488	Log(("vmxon: CR4 fixed1 bits set -> #GP(0)\n"));
9489	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed1;
9490	return iemRaiseGeneralProtectionFault0(pVCpu);
9491	}
9492	}
9493
9494	/* Feature control MSR's LOCK and VMXON bits. */
9495	uint64_t const uMsrFeatCtl = CPUMGetGuestIa32FeatCtrl(pVCpu);
9496	if ((uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9497	== (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9498	{ /* likely */ }
9499	else
9500	{
9501	Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
9502	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_MsrFeatCtl;
9503	return iemRaiseGeneralProtectionFault0(pVCpu);
9504	}
9505
9506	/* Get the VMXON pointer from the location specified by the source memory operand. */
9507	RTGCPHYS GCPhysVmxon;
9508	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
9509	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
9510	{ /* likely */ }
9511	else
9512	{
9513	Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
9514	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrMap;
9515	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmxon;
9516	return rcStrict;
9517	}
9518
9519	/* VMXON region pointer alignment. */
9520	if (!(GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK))
9521	{ /* likely */ }
9522	else
9523	{
9524	Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
9525	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAlign;
9526	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9527	iemVmxVmFailInvalid(pVCpu);
9528	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9529	}
9530
9531	/* VMXON physical-address width limits. */
9532	if (!(GCPhysVmxon >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
9533	{ /* likely */ }
9534	else
9535	{
9536	Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
9537	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrWidth;
9538	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9539	iemVmxVmFailInvalid(pVCpu);
9540	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9541	}
9542
9543	/* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
9544	restriction imposed by our implementation. */
9545	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
9546	{ /* likely */ }
9547	else
9548	{
9549	Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
9550	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAbnormal;
9551	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9552	iemVmxVmFailInvalid(pVCpu);
9553	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9554	}
9555
9556	/* Read the VMCS revision ID from the VMXON region. */
9557	VMXVMCSREVID VmcsRevId;
9558	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
9559	if (RT_SUCCESS(rc))
9560	{ /* likely */ }
9561	else
9562	{
9563	Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
9564	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrReadPhys;
9565	return rc;
9566	}
9567
9568	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
9569	if (RT_LIKELY(VmcsRevId.u == VMX_V_VMCS_REVISION_ID))
9570	{ /* likely */ }
9571	else
9572	{
9573	/* Revision ID mismatch. */
9574	if (!VmcsRevId.n.fIsShadowVmcs)
9575	{
9576	Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
9577	VmcsRevId.n.u31RevisionId));
9578	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmcsRevId;
9579	iemVmxVmFailInvalid(pVCpu);
9580	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9581	}
9582
9583	/* Shadow VMCS disallowed. */
9584	Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
9585	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_ShadowVmcs;
9586	iemVmxVmFailInvalid(pVCpu);
9587	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9588	}
9589
9590	/*
9591	* Record that we're in VMX operation, block INIT, block and disable A20M.
9592	*/
9593	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
9594	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
9595	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
9596
9597	/* Clear address-range monitoring. */
9598	EMMonitorWaitClear(pVCpu);
9599	/** @todo NSTVMX: Intel PT. */
9600
9601	iemVmxVmSucceed(pVCpu);
9602	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9603	}
9604	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9605	{
9606	/* Nested-guest intercept. */
9607	if (pExitInfo)
9608	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9609	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMXON, VMXINSTRID_NONE, cbInstr);
9610	}
9611
9612	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
9613
9614	/* CPL. */
9615	if (pVCpu->iem.s.uCpl > 0)
9616	{
9617	Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
9618	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxRootCpl;
9619	return iemRaiseGeneralProtectionFault0(pVCpu);
9620	}
9621
9622	/* VMXON when already in VMX root mode. */
9623	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
9624	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxAlreadyRoot;
9625	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9626	}
9627
9628
9629	/**
9630	* Interface for HM and EM to emulate the VMXON instruction.
9631	*
9632	* @returns Strict VBox status code.
9633	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9634	* @param pExitInfo Pointer to the VM-exit information.
9635	* @thread EMT(pVCpu)
9636	*/
9637	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxon(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9638	{
9639	Assert(pExitInfo);
9640	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9641	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9642
9643	iemInitExec(pVCpu, false /fBypassHandlers/);
9644
9645	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9646	uint8_t const cbInstr = pExitInfo->cbInstr;
9647	RTGCPTR const GCPtrVmxon = pExitInfo->GCPtrEffAddr;
9648	VBOXSTRICTRC rcStrict = iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, pExitInfo);
9649	Assert(!pVCpu->iem.s.cActiveMappings);
9650	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9651	}
9652
9653
9654	/**
9655	* Implements 'VMXOFF'.
9656	*
9657	* @remarks Common VMX instruction checks are already expected to by the caller,
9658	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9659	*/
9660	IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
9661	{
9662	/* Nested-guest intercept. */
9663	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9664	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMXOFF, cbInstr);
9665
9666	/* CPL. */
9667	if (pVCpu->iem.s.uCpl == 0)
9668	{ /* likely */ }
9669	else
9670	{
9671	Log(("vmxoff: CPL %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
9672	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxoff_Cpl;
9673	return iemRaiseGeneralProtectionFault0(pVCpu);
9674	}
9675
9676	/* Dual monitor treatment of SMIs and SMM. */
9677	uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
9678	if (!(fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID))
9679	{ /* likely */ }
9680	else
9681	{
9682	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
9683	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9684	}
9685
9686	/* Record that we're no longer in VMX root operation, block INIT, block and disable A20M. */
9687	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
9688	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
9689
9690	if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
9691	{ /** @todo NSTVMX: Unblock SMI. */ }
9692
9693	EMMonitorWaitClear(pVCpu);
9694	/** @todo NSTVMX: Unblock and enable A20M. */
9695
9696	iemVmxVmSucceed(pVCpu);
9697	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9698	}
9699
9700
9701	/**
9702	* Interface for HM and EM to emulate the VMXOFF instruction.
9703	*
9704	* @returns Strict VBox status code.
9705	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9706	* @param cbInstr The instruction length in bytes.
9707	* @thread EMT(pVCpu)
9708	*/
9709	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxoff(PVMCPUCC pVCpu, uint8_t cbInstr)
9710	{
9711	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
9712	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_NO_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9713
9714	iemInitExec(pVCpu, false /fBypassHandlers/);
9715	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmxoff);
9716	Assert(!pVCpu->iem.s.cActiveMappings);
9717	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9718	}
9719
9720
9721	/**
9722	* Implements 'VMXON'.
9723	*/
9724	IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
9725	{
9726	return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
9727	}
9728
9729
9730	/**
9731	* Implements 'VMLAUNCH'.
9732	*/
9733	IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
9734	{
9735	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH);
9736	}
9737
9738
9739	/**
9740	* Implements 'VMRESUME'.
9741	*/
9742	IEM_CIMPL_DEF_0(iemCImpl_vmresume)
9743	{
9744	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME);
9745	}
9746
9747
9748	/**
9749	* Implements 'VMPTRLD'.
9750	*/
9751	IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9752	{
9753	return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9754	}
9755
9756
9757	/**
9758	* Implements 'VMPTRST'.
9759	*/
9760	IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9761	{
9762	return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9763	}
9764
9765
9766	/**
9767	* Implements 'VMCLEAR'.
9768	*/
9769	IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9770	{
9771	return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9772	}
9773
9774
9775	/**
9776	* Implements 'VMWRITE' register.
9777	*/
9778	IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64VmcsField)
9779	{
9780	return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg /, u64Val, u64VmcsField, NULL / pExitInfo */);
9781	}
9782
9783
9784	/**
9785	* Implements 'VMWRITE' memory.
9786	*/
9787	IEM_CIMPL_DEF_3(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrVal, uint32_t, u64VmcsField)
9788	{
9789	return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, GCPtrVal, u64VmcsField, NULL /* pExitInfo */);
9790	}
9791
9792
9793	/**
9794	* Implements 'VMREAD' register (64-bit).
9795	*/
9796	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg64, uint64_t *, pu64Dst, uint64_t, u64VmcsField)
9797	{
9798	return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64VmcsField, NULL /* pExitInfo */);
9799	}
9800
9801
9802	/**
9803	* Implements 'VMREAD' register (32-bit).
9804	*/
9805	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg32, uint64_t *, pu64Dst, uint32_t, u32VmcsField)
9806	{
9807	VBOXSTRICTRC const rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, (uint32_t )pu64Dst, u32VmcsField, NULL / pExitInfo */);
9808	/* Zero the high part of the register on success. */
9809	if (rcStrict == VINF_SUCCESS)
9810	pu64Dst = (uint32_t)pu64Dst;
9811	return rcStrict;
9812	}
9813
9814
9815	/**
9816	* Implements 'VMREAD' memory, 64-bit register.
9817	*/
9818	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg64, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u64VmcsField)
9819	{
9820	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64VmcsField, NULL /* pExitInfo */);
9821	}
9822
9823
9824	/**
9825	* Implements 'VMREAD' memory, 32-bit register.
9826	*/
9827	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg32, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u32VmcsField)
9828	{
9829	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u32VmcsField, NULL /* pExitInfo */);
9830	}
9831
9832
9833	/**
9834	* Implements 'INVVPID'.
9835	*/
9836	IEM_CIMPL_DEF_3(iemCImpl_invvpid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvvpidDesc, uint64_t, uInvvpidType)
9837	{
9838	return iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, uInvvpidType, NULL /* pExitInfo */);
9839	}
9840
9841
9842	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9843	/**
9844	* Implements 'INVEPT'.
9845	*/
9846	IEM_CIMPL_DEF_3(iemCImpl_invept, uint8_t, iEffSeg, RTGCPTR, GCPtrInveptDesc, uint64_t, uInveptType)
9847	{
9848	return iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, uInveptType, NULL /* pExitInfo */);
9849	}
9850	#endif
9851
9852
9853	/**
9854	* Implements VMX's implementation of PAUSE.
9855	*/
9856	IEM_CIMPL_DEF_0(iemCImpl_vmx_pause)
9857	{
9858	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9859	{
9860	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrPause(pVCpu, cbInstr);
9861	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
9862	return rcStrict;
9863	}
9864
9865	/*
9866	* Outside VMX non-root operation or if the PAUSE instruction does not cause
9867	* a VM-exit, the instruction operates normally.
9868	*/
9869	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9870	}
9871
9872	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
9873
9874
9875	/**
9876	* Implements 'VMCALL'.
9877	*/
9878	IEM_CIMPL_DEF_0(iemCImpl_vmcall)
9879	{
9880	pVCpu->iem.s.cPotentialExits++;
9881
9882	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9883	/* Nested-guest intercept. */
9884	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9885	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMCALL, cbInstr);
9886	#endif
9887
9888	/* Join forces with vmmcall. */
9889	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
9890	}
9891
9892
9893	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
9894
9895	/**
9896	* @callback_method_impl{FNPGMPHYSHANDLER, VMX APIC-access page accesses}
9897	*
9898	* @remarks The @a uUser argument is currently unused.
9899	*/
9900	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPageHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhysFault, void *pvPhys,
9901	void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType,
9902	PGMACCESSORIGIN enmOrigin, uint64_t uUser)
9903	{
9904	RT_NOREF3(pvPhys, enmOrigin, uUser);
9905
9906	RTGCPHYS const GCPhysAccessBase = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9907	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9908	{
9909	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9910	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysAccessBase);
9911
9912	uint32_t const fAccess = enmAccessType == PGMACCESSTYPE_WRITE ? IEM_ACCESS_DATA_W : IEM_ACCESS_DATA_R;
9913	uint16_t const offAccess = GCPhysFault & GUEST_PAGE_OFFSET_MASK;
9914
9915	LogFlowFunc(("Fault at %#RGp (cbBuf=%u fAccess=%#x)\n", GCPhysFault, cbBuf, fAccess));
9916	VBOXSTRICTRC rcStrict = iemVmxVirtApicAccessMem(pVCpu, offAccess, cbBuf, pvBuf, fAccess);
9917	if (RT_FAILURE(rcStrict))
9918	return rcStrict;
9919
9920	/* Any access on this APIC-access page has been handled, caller should not carry out the access. */
9921	return VINF_SUCCESS;
9922	}
9923
9924	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysAccessBase));
9925	int rc = PGMHandlerPhysicalDeregister(pVM, GCPhysAccessBase);
9926	if (RT_FAILURE(rc))
9927	return rc;
9928
9929	/* Instruct the caller of this handler to perform the read/write as normal memory. */
9930	return VINF_PGM_HANDLER_DO_DEFAULT;
9931	}
9932
9933
9934	# ifndef IN_RING3
9935	/**
9936	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
9937	* \#PF access handler callback for guest VMX APIC-access page.}
9938	*/
9939	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPagePfHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErr, PCPUMCTX pCtx,
9940	RTGCPTR pvFault, RTGCPHYS GCPhysFault, uint64_t uUser)
9941
9942	{
9943	RT_NOREF3(pVM, pCtx, uUser);
9944
9945	/*
9946	* Handle the VMX APIC-access page only when the guest is in VMX non-root mode.
9947	* Otherwise we must deregister the page and allow regular RAM access.
9948	* Failing to do so lands us with endless EPT VM-exits.
9949	*/
9950	RTGCPHYS const GCPhysPage = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9951	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9952	{
9953	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9954	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysPage);
9955
9956	/*
9957	* Check if the access causes an APIC-access VM-exit.
9958	*/
9959	uint32_t fAccess;
9960	if (uErr & X86_TRAP_PF_ID)
9961	fAccess = IEM_ACCESS_INSTRUCTION;
9962	else if (uErr & X86_TRAP_PF_RW)
9963	fAccess = IEM_ACCESS_DATA_W;
9964	else
9965	fAccess = IEM_ACCESS_DATA_R;
9966
9967	RTGCPHYS const GCPhysNestedFault = (RTGCPHYS)pvFault;
9968	uint16_t const offAccess = GCPhysNestedFault & GUEST_PAGE_OFFSET_MASK;
9969	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, 1 /* cbAccess */, fAccess);
9970	LogFlowFunc(("#PF at %#RGp (GCPhysNestedFault=%#RGp offAccess=%#x)\n", GCPhysFault, GCPhysNestedFault, offAccess));
9971	if (fIntercept)
9972	{
9973	/*
9974	* Query the source VM-exit (from the execution engine) that caused this access
9975	* within the APIC-access page. Currently only HM is supported.
9976	*/
9977	AssertMsg(VM_IS_HM_ENABLED(pVM),
9978	("VM-exit auxiliary info. fetching not supported for execution engine %d\n", pVM->bMainExecutionEngine));
9979
9980	HMEXITAUX HmExitAux;
9981	RT_ZERO(HmExitAux);
9982	int const rc = HMR0GetExitAuxInfo(pVCpu, &HmExitAux, HMVMX_READ_EXIT_INSTR_LEN
9983	\| HMVMX_READ_EXIT_QUALIFICATION
9984	\| HMVMX_READ_IDT_VECTORING_INFO
9985	\| HMVMX_READ_IDT_VECTORING_ERROR_CODE);
9986	AssertRC(rc);
9987
9988	/*
9989	* Verify the VM-exit reason must be an EPT violation.
9990	* Other accesses should go through the other handler (iemVmxApicAccessPageHandler).
9991	* Refer to @bugref{10092#c33s} for a more detailed explanation.
9992	*/
9993	AssertMsgReturn(HmExitAux.Vmx.uReason == VMX_EXIT_EPT_VIOLATION,
9994	("Unexpected call to APIC-access page #PF handler for %#RGp offAcesss=%u uErr=%#RGx uReason=%u\n",
9995	GCPhysPage, offAccess, uErr, HmExitAux.Vmx.uReason), VERR_IEM_IPE_7);
9996
9997	/*
9998	* Construct the virtual APIC-access VM-exit.
9999	*/
10000	VMXAPICACCESS enmAccess;
10001	if (HmExitAux.Vmx.u64Qual & VMX_EXIT_QUAL_EPT_LINEAR_ADDR_VALID)
10002	{
10003	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10004	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
10005	else if (fAccess == IEM_ACCESS_INSTRUCTION)
10006	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
10007	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
10008	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
10009	else
10010	enmAccess = VMXAPICACCESS_LINEAR_READ;
10011
10012	/* For linear-address accesss the instruction length must be valid. */
10013	AssertMsg(HmExitAux.Vmx.cbInstr > 0,
10014	("Invalid APIC-access VM-exit instruction length. cbInstr=%u\n", HmExitAux.Vmx.cbInstr));
10015	}
10016	else
10017	{
10018	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10019	enmAccess = VMXAPICACCESS_PHYSICAL_EVENT_DELIVERY;
10020	else
10021	{
10022	/** @todo How to distinguish between monitoring/trace vs other instructions
10023	* here? */
10024	enmAccess = VMXAPICACCESS_PHYSICAL_INSTR;
10025	}
10026
10027	/* For physical accesses the instruction length is undefined, we zero it for safety and consistency. */
10028	HmExitAux.Vmx.cbInstr = 0;
10029	}
10030
10031	/*
10032	* Raise the APIC-access VM-exit.
10033	*/
10034	LogFlowFunc(("Raising APIC-access VM-exit from #PF handler at offset %#x\n", offAccess));
10035	VMXVEXITINFO const ExitInfo
10036	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_APIC_ACCESS,
10037	RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
10038	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess),
10039	HmExitAux.Vmx.cbInstr);
10040	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_IDT(HmExitAux.Vmx.uIdtVectoringInfo,
10041	HmExitAux.Vmx.uIdtVectoringErrCode);
10042	VBOXSTRICTRC const rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
10043	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
10044	}
10045
10046	/*
10047	* The access isn't intercepted, which means it needs to be virtualized.
10048	*
10049	* This requires emulating the instruction because we need the bytes being
10050	* read/written by the instruction not just the offset being accessed within
10051	* the APIC-access page (which we derive from the faulting address).
10052	*/
10053	LogFlowFunc(("Access at offset %#x not intercepted -> VINF_EM_RAW_EMULATE_INSTR\n", offAccess));
10054	return VINF_EM_RAW_EMULATE_INSTR;
10055	}
10056
10057	/** @todo This isn't ideal but works for now as nested-hypervisors generally play
10058	* nice because the spec states that this page should be modified only when
10059	* no CPU refers to it VMX non-root mode. Nonetheless, we could use an atomic
10060	* reference counter to ensure the aforementioned condition before
10061	* de-registering the page. */
10062	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysPage));
10063	int const rc = PGMHandlerPhysicalDeregister(pVM, GCPhysPage);
10064	if (RT_FAILURE(rc))
10065	return rc;
10066
10067	return VINF_SUCCESS;
10068	}
10069	# endif /* !IN_RING3 */
10070
10071	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
10072

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp@ 99681

Download in other formats: