IEMAllCImplVmxInstr-x86.cpp

Last change on this file was 108409, checked in by vboxsync, 7 weeks ago
VMM/IEM: Made IEMAll.cpp build targeting arm. jiraref:VBP-1531
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 413.1 KB

Line
1	/* $Id: IEMAllCImplVmxInstr-x86.cpp 108409 2025-02-27 10:35:39Z vboxsync $ */
2	/** @file
3	* IEM - VT-x instruction implementation (x86 target).
4	*/
5
6	/*
7	* Copyright (C) 2011-2024 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/*********************************************************************************************************************************
30	* Header Files *
31	*********************************************************************************************************************************/
32	#define LOG_GROUP LOG_GROUP_IEM_VMX
33	#define VMCPU_INCL_CPUM_GST_CTX
34	#ifdef IN_RING0
35	# define VBOX_VMM_TARGET_X86
36	#endif
37	#include <VBox/vmm/iem.h>
38	#include <VBox/vmm/cpum.h>
39	#include <VBox/vmm/dbgf.h>
40	#include <VBox/vmm/em.h>
41	#include <VBox/vmm/gim.h>
42	#include <VBox/vmm/hm.h>
43	#include <VBox/vmm/pgm.h>
44	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
45	# include <VBox/vmm/hmvmxinline.h>
46	#endif
47	#include <VBox/vmm/tm.h>
48	#include "IEMInternal.h"
49	#include <VBox/vmm/vmcc.h>
50	#include <VBox/log.h>
51	#include <VBox/err.h>
52	#include <VBox/param.h>
53	#include <VBox/apic.h>
54	#include <VBox/disopcode-x86-amd64.h>
55	#include <iprt/asm-math.h>
56	#include <iprt/assert.h>
57	#include <iprt/string.h>
58	#include <iprt/x86.h>
59
60	#include "IEMInline.h"
61	#include "IEMInline-x86.h"
62	#include "IEMInlineExec.h"
63	#include "IEMInlineExec-x86.h"
64
65
66	/*********************************************************************************************************************************
67	* Defined Constants And Macros *
68	*********************************************************************************************************************************/
69	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
70	/**
71	* Gets the ModR/M, SIB and displacement byte(s) from decoded opcodes given their
72	* relative offsets.
73	*/
74	# ifdef IEM_WITH_CODE_TLB /** @todo IEM TLB */
75	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) do { a_bModRm = 0; RT_NOREF(a_offModRm); } while (0)
76	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) do { a_bSib = 0; RT_NOREF(a_offSib); } while (0)
77	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
78	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) do { a_u16Disp = 0; RT_NOREF(a_offDisp); } while (0)
79	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
80	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) do { a_u32Disp = 0; RT_NOREF(a_offDisp); } while (0)
81	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
82	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) do { a_u64Disp = 0; RT_NOREF(a_offDisp); } while (0)
83	# if 0
84	# error "Implement me: Getting ModR/M, SIB, displacement needs to work even when instruction crosses a page boundary."
85	# endif
86	# else /* !IEM_WITH_CODE_TLB */
87	# define IEM_MODRM_GET_U8(a_pVCpu, a_bModRm, a_offModRm) \
88	do \
89	{ \
90	Assert((a_offModRm) < (a_pVCpu)->iem.s.cbOpcode); \
91	(a_bModRm) = (a_pVCpu)->iem.s.abOpcode[(a_offModRm)]; \
92	} while (0)
93
94	# define IEM_SIB_GET_U8(a_pVCpu, a_bSib, a_offSib) IEM_MODRM_GET_U8(a_pVCpu, a_bSib, a_offSib)
95
96	# define IEM_DISP_GET_U16(a_pVCpu, a_u16Disp, a_offDisp) \
97	do \
98	{ \
99	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
100	uint8_t const bTmpLo = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
101	uint8_t const bTmpHi = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
102	(a_u16Disp) = RT_MAKE_U16(bTmpLo, bTmpHi); \
103	} while (0)
104
105	# define IEM_DISP_GET_S8_SX_U16(a_pVCpu, a_u16Disp, a_offDisp) \
106	do \
107	{ \
108	Assert((a_offDisp) < (a_pVCpu)->iem.s.cbOpcode); \
109	(a_u16Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
110	} while (0)
111
112	# define IEM_DISP_GET_U32(a_pVCpu, a_u32Disp, a_offDisp) \
113	do \
114	{ \
115	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
116	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
117	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
118	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
119	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
120	(a_u32Disp) = RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
121	} while (0)
122
123	# define IEM_DISP_GET_S8_SX_U32(a_pVCpu, a_u32Disp, a_offDisp) \
124	do \
125	{ \
126	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
127	(a_u32Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
128	} while (0)
129
130	# define IEM_DISP_GET_S8_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
131	do \
132	{ \
133	Assert((a_offDisp) + 1 < (a_pVCpu)->iem.s.cbOpcode); \
134	(a_u64Disp) = (int8_t)((a_pVCpu)->iem.s.abOpcode[(a_offDisp)]); \
135	} while (0)
136
137	# define IEM_DISP_GET_S32_SX_U64(a_pVCpu, a_u64Disp, a_offDisp) \
138	do \
139	{ \
140	Assert((a_offDisp) + 3 < (a_pVCpu)->iem.s.cbOpcode); \
141	uint8_t const bTmp0 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp)]; \
142	uint8_t const bTmp1 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 1]; \
143	uint8_t const bTmp2 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 2]; \
144	uint8_t const bTmp3 = (a_pVCpu)->iem.s.abOpcode[(a_offDisp) + 3]; \
145	(a_u64Disp) = (int32_t)RT_MAKE_U32_FROM_U8(bTmp0, bTmp1, bTmp2, bTmp3); \
146	} while (0)
147	# endif /* !IEM_WITH_CODE_TLB */
148
149	/** Check for VMX instructions requiring to be in VMX operation.
150	* @note Any changes here, check if IEMOP_HLP_IN_VMX_OPERATION needs updating. */
151	# define IEM_VMX_IN_VMX_OPERATION(a_pVCpu, a_szInstr, a_InsDiagPrefix) \
152	do \
153	{ \
154	if (IEM_VMX_IS_ROOT_MODE(a_pVCpu)) \
155	{ /* likely */ } \
156	else \
157	{ \
158	Log((a_szInstr ": Not in VMX operation (root mode) -> #UD\n")); \
159	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = a_InsDiagPrefix##_VmxRoot; \
160	return iemRaiseUndefinedOpcode(a_pVCpu); \
161	} \
162	} while (0)
163
164	/** Marks a VM-entry failure with a diagnostic reason, logs and returns. */
165	# define IEM_VMX_VMENTRY_FAILED_RET(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag) \
166	do \
167	{ \
168	LogRel(("%s: VM-entry failed! enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_VmxDiag), \
169	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
170	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
171	return VERR_VMX_VMENTRY_FAILED; \
172	} while (0)
173
174	/** Marks a VM-entry failure with an return code, diagnostic reason, logs and
175	* returns. */
176	# define IEM_VMX_VMENTRY_FAILED_RET_2(a_pVCpu, a_pszInstr, a_pszFailure, a_VmxDiag, a_rc) \
177	do \
178	{ \
179	LogRel(("%s: VM-entry failed! rc=%Rrc enmDiag=%u (%s) -> %s\n", (a_pszInstr), (a_rc), (a_VmxDiag), \
180	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
181	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
182	return VERR_VMX_VMENTRY_FAILED; \
183	} while (0)
184
185	/** Marks a VM-exit failure with a diagnostic reason and logs. */
186	# define IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
187	do \
188	{ \
189	LogRel(("VM-exit failed! uExitReason=%u enmDiag=%u (%s) -> %s\n", (a_uExitReason), (a_VmxDiag), \
190	HMGetVmxDiagDesc(a_VmxDiag), (a_pszFailure))); \
191	(a_pVCpu)->cpum.GstCtx.hwvirt.vmx.enmDiag = (a_VmxDiag); \
192	} while (0)
193
194	/** Marks a VM-exit failure with a diagnostic reason, logs and returns. */
195	# define IEM_VMX_VMEXIT_FAILED_RET(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag) \
196	do \
197	{ \
198	IEM_VMX_VMEXIT_FAILED(a_pVCpu, a_uExitReason, a_pszFailure, a_VmxDiag); \
199	return VERR_VMX_VMEXIT_FAILED; \
200	} while (0)
201
202
203	/*********************************************************************************************************************************
204	* Global Variables *
205	*********************************************************************************************************************************/
206	/** @todo NSTVMX: The following VM-exit intercepts are pending:
207	* VMX_EXIT_IO_SMI
208	* VMX_EXIT_SMI
209	* VMX_EXIT_GETSEC
210	* VMX_EXIT_RSM
211	* VMX_EXIT_MONITOR (APIC access VM-exit caused by MONITOR pending)
212	* VMX_EXIT_ERR_MACHINE_CHECK (we never need to raise this?)
213	* VMX_EXIT_VMFUNC
214	* VMX_EXIT_ENCLS
215	* VMX_EXIT_PML_FULL
216	* VMX_EXIT_XSAVES
217	* VMX_EXIT_XRSTORS
218	*/
219	/**
220	* Map of VMCS field encodings to their virtual-VMCS structure offsets.
221	*
222	* The first array dimension is VMCS field encoding of Width OR'ed with Type and the
223	* second dimension is the Index, see VMXVMCSFIELD.
224	*/
225	uint16_t const g_aoffVmcsMap[16][VMX_V_VMCS_MAX_INDEX + 1] =
226	{
227	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
228	{
229	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u16Vpid),
230	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u16PostIntNotifyVector),
231	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u16EptpIndex),
232	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u16HlatPrefixSize),
233	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
234	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
235	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
236	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
237	},
238	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
239	{
240	/* 0-7 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
241	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
242	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
243	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
244	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
245	},
246	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
247	{
248	/* 0 */ RT_UOFFSETOF(VMXVVMCS, GuestEs),
249	/* 1 */ RT_UOFFSETOF(VMXVVMCS, GuestCs),
250	/* 2 */ RT_UOFFSETOF(VMXVVMCS, GuestSs),
251	/* 3 */ RT_UOFFSETOF(VMXVVMCS, GuestDs),
252	/* 4 */ RT_UOFFSETOF(VMXVVMCS, GuestFs),
253	/* 5 */ RT_UOFFSETOF(VMXVVMCS, GuestGs),
254	/* 6 */ RT_UOFFSETOF(VMXVVMCS, GuestLdtr),
255	/* 7 */ RT_UOFFSETOF(VMXVVMCS, GuestTr),
256	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u16GuestIntStatus),
257	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u16PmlIndex),
258	/* 10-17 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
259	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
260	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
261	/* 34 */ UINT16_MAX
262	},
263	/* VMX_VMCSFIELD_WIDTH_16BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
264	{
265	/* 0 */ RT_UOFFSETOF(VMXVVMCS, HostEs),
266	/* 1 */ RT_UOFFSETOF(VMXVVMCS, HostCs),
267	/* 2 */ RT_UOFFSETOF(VMXVVMCS, HostSs),
268	/* 3 */ RT_UOFFSETOF(VMXVVMCS, HostDs),
269	/* 4 */ RT_UOFFSETOF(VMXVVMCS, HostFs),
270	/* 5 */ RT_UOFFSETOF(VMXVVMCS, HostGs),
271	/* 6 */ RT_UOFFSETOF(VMXVVMCS, HostTr),
272	/* 7-14 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
273	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
274	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
275	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
276	},
277	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
278	{
279	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapA),
280	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64AddrIoBitmapB),
281	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64AddrMsrBitmap),
282	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrStore),
283	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64AddrExitMsrLoad),
284	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEntryMsrLoad),
285	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64ExecVmcsPtr),
286	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPml),
287	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64TscOffset),
288	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVirtApic),
289	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64AddrApicAccess),
290	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64AddrPostedIntDesc),
291	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64VmFuncCtls),
292	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64EptPtr),
293	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap0),
294	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap1),
295	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap2),
296	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64EoiExitBitmap3),
297	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64AddrEptpList),
298	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmreadBitmap),
299	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64AddrVmwriteBitmap),
300	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64AddrXcptVeInfo),
301	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64XssExitBitmap),
302	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u64EnclsExitBitmap),
303	/* 24 */ RT_UOFFSETOF(VMXVVMCS, u64SppTablePtr),
304	/* 25 */ RT_UOFFSETOF(VMXVVMCS, u64TscMultiplier),
305	/* 26 */ RT_UOFFSETOF(VMXVVMCS, u64ProcCtls3),
306	/* 27 */ RT_UOFFSETOF(VMXVVMCS, u64EnclvExitBitmap),
307	/* 28 */ UINT16_MAX,
308	/* 29 */ UINT16_MAX,
309	/* 30 */ UINT16_MAX,
310	/* 31 */ RT_UOFFSETOF(VMXVVMCS, u64PconfigExitBitmap),
311	/* 32 */ RT_UOFFSETOF(VMXVVMCS, u64HlatPtr),
312	/* 33 */ UINT16_MAX,
313	/* 34 */ RT_UOFFSETOF(VMXVVMCS, u64ExitCtls2)
314	},
315	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
316	{
317	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestPhysAddr),
318	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
319	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
320	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
321	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
322	/* 33-34*/ UINT16_MAX, UINT16_MAX
323	},
324	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
325	{
326	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64VmcsLinkPtr),
327	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDebugCtlMsr),
328	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPatMsr),
329	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEferMsr),
330	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPerfGlobalCtlMsr),
331	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte0),
332	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte1),
333	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte2),
334	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPdpte3),
335	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestBndcfgsMsr),
336	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRtitCtlMsr),
337	/* 11 */ UINT16_MAX,
338	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPkrsMsr),
339	/* 13-20 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
340	/* 21-28 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
341	/* 29-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
342	},
343	/* VMX_VMCSFIELD_WIDTH_64BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
344	{
345	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostPatMsr),
346	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostEferMsr),
347	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostPerfGlobalCtlMsr),
348	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostPkrsMsr),
349	/* 4-11 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
350	/* 12-19 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
351	/* 20-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
352	/* 28-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
353	},
354	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_CONTROL: */
355	{
356	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32PinCtls),
357	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls),
358	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32XcptBitmap),
359	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMask),
360	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32XcptPFMatch),
361	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32Cr3TargetCount),
362	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32ExitCtls),
363	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrStoreCount),
364	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32ExitMsrLoadCount),
365	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32EntryCtls),
366	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32EntryMsrLoadCount),
367	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32EntryIntInfo),
368	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32EntryXcptErrCode),
369	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32EntryInstrLen),
370	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32TprThreshold),
371	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32ProcCtls2),
372	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32PleGap),
373	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32PleWindow),
374	/* 18-25 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
375	/* 26-33 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
376	/* 34 */ UINT16_MAX
377	},
378	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
379	{
380	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32RoVmInstrError),
381	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitReason),
382	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntInfo),
383	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitIntErrCode),
384	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringInfo),
385	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32RoIdtVectoringErrCode),
386	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrLen),
387	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32RoExitInstrInfo),
388	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
389	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
390	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
391	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
392	},
393	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
394	{
395	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsLimit),
396	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsLimit),
397	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsLimit),
398	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsLimit),
399	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsLimit),
400	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsLimit),
401	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrLimit),
402	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrLimit),
403	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGdtrLimit),
404	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIdtrLimit),
405	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u32GuestEsAttr),
406	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u32GuestCsAttr),
407	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSsAttr),
408	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u32GuestDsAttr),
409	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u32GuestFsAttr),
410	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u32GuestGsAttr),
411	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u32GuestLdtrAttr),
412	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u32GuestTrAttr),
413	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u32GuestIntrState),
414	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u32GuestActivityState),
415	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSmBase),
416	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u32GuestSysenterCS),
417	/* 22 */ UINT16_MAX,
418	/* 23 */ RT_UOFFSETOF(VMXVVMCS, u32PreemptTimer),
419	/* 24-31 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
420	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
421	},
422	/* VMX_VMCSFIELD_WIDTH_32BIT \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
423	{
424	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u32HostSysenterCs),
425	/* 1-8 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
426	/* 9-16 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
427	/* 17-24 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
428	/* 25-32 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
429	/* 33-34 */ UINT16_MAX, UINT16_MAX
430	},
431	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_CONTROL: */
432	{
433	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0Mask),
434	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4Mask),
435	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64Cr0ReadShadow),
436	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64Cr4ReadShadow),
437	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target0),
438	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target1),
439	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target2),
440	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64Cr3Target3),
441	/* 8-15 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
442	/* 16-23 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
443	/* 24-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
444	/* 32-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX
445	},
446	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_VMEXIT_INFO: */
447	{
448	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64RoExitQual),
449	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRcx),
450	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRsi),
451	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRdi),
452	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64RoIoRip),
453	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64RoGuestLinearAddr),
454	/* 6-13 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
455	/* 14-21 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
456	/* 22-29 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
457	/* 30-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
458	},
459	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_GUEST_STATE: */
460	{
461	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr0),
462	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr3),
463	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCr4),
464	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64GuestEsBase),
465	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64GuestCsBase),
466	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsBase),
467	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDsBase),
468	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64GuestFsBase),
469	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGsBase),
470	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64GuestLdtrBase),
471	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64GuestTrBase),
472	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64GuestGdtrBase),
473	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIdtrBase),
474	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64GuestDr7),
475	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRsp),
476	/* 15 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRip),
477	/* 16 */ RT_UOFFSETOF(VMXVVMCS, u64GuestRFlags),
478	/* 17 */ RT_UOFFSETOF(VMXVVMCS, u64GuestPendingDbgXcpts),
479	/* 18 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEsp),
480	/* 19 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSysenterEip),
481	/* 20 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSCetMsr),
482	/* 21 */ RT_UOFFSETOF(VMXVVMCS, u64GuestSsp),
483	/* 22 */ RT_UOFFSETOF(VMXVVMCS, u64GuestIntrSspTableAddrMsr),
484	/* 23-27 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
485	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
486	},
487	/* VMX_VMCSFIELD_WIDTH_NATURAL \| VMX_VMCSFIELD_TYPE_HOST_STATE: */
488	{
489	/* 0 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr0),
490	/* 1 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr3),
491	/* 2 */ RT_UOFFSETOF(VMXVVMCS, u64HostCr4),
492	/* 3 */ RT_UOFFSETOF(VMXVVMCS, u64HostFsBase),
493	/* 4 */ RT_UOFFSETOF(VMXVVMCS, u64HostGsBase),
494	/* 5 */ RT_UOFFSETOF(VMXVVMCS, u64HostTrBase),
495	/* 6 */ RT_UOFFSETOF(VMXVVMCS, u64HostGdtrBase),
496	/* 7 */ RT_UOFFSETOF(VMXVVMCS, u64HostIdtrBase),
497	/* 8 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEsp),
498	/* 9 */ RT_UOFFSETOF(VMXVVMCS, u64HostSysenterEip),
499	/* 10 */ RT_UOFFSETOF(VMXVVMCS, u64HostRsp),
500	/* 11 */ RT_UOFFSETOF(VMXVVMCS, u64HostRip),
501	/* 12 */ RT_UOFFSETOF(VMXVVMCS, u64HostSCetMsr),
502	/* 13 */ RT_UOFFSETOF(VMXVVMCS, u64HostSsp),
503	/* 14 */ RT_UOFFSETOF(VMXVVMCS, u64HostIntrSspTableAddrMsr),
504	/* 15-22 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
505	/* 23-30 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX,
506	/* 31-34 */ UINT16_MAX, UINT16_MAX, UINT16_MAX, UINT16_MAX
507	}
508	};
509
510
511	/**
512	* Gets a host selector from the VMCS.
513	*
514	* @param pVmcs Pointer to the virtual VMCS.
515	* @param iSelReg The index of the segment register (X86_SREG_XXX).
516	*/
517	DECLINLINE(RTSEL) iemVmxVmcsGetHostSelReg(PCVMXVVMCS pVmcs, uint8_t iSegReg)
518	{
519	Assert(iSegReg < X86_SREG_COUNT);
520	RTSEL HostSel;
521	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
522	uint8_t const uType = VMX_VMCSFIELD_TYPE_HOST_STATE;
523	uint8_t const uWidthType = (uWidth << 2) \| uType;
524	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_HOST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
525	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
526	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
527	uint8_t const pbVmcs = (uint8_t )pVmcs;
528	uint8_t const *pbField = pbVmcs + offField;
529	HostSel = (uint16_t )pbField;
530	return HostSel;
531	}
532
533
534	/**
535	* Sets a guest segment register in the VMCS.
536	*
537	* @param pVmcs Pointer to the virtual VMCS.
538	* @param iSegReg The index of the segment register (X86_SREG_XXX).
539	* @param pSelReg Pointer to the segment register.
540	*/
541	static void iemVmxVmcsSetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCCPUMSELREG pSelReg) RT_NOEXCEPT
542	{
543	Assert(pSelReg);
544	Assert(iSegReg < X86_SREG_COUNT);
545
546	/* Selector. */
547	{
548	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
549	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
550	uint8_t const uWidthType = (uWidth << 2) \| uType;
551	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
552	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
553	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
554	uint8_t pbVmcs = (uint8_t )pVmcs;
555	uint8_t *pbField = pbVmcs + offField;
556	(uint16_t )pbField = pSelReg->Sel;
557	}
558
559	/* Limit. */
560	{
561	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
562	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
563	uint8_t const uWidthType = (uWidth << 2) \| uType;
564	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
565	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
566	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
567	uint8_t pbVmcs = (uint8_t )pVmcs;
568	uint8_t *pbField = pbVmcs + offField;
569	(uint32_t )pbField = pSelReg->u32Limit;
570	}
571
572	/* Base. */
573	{
574	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
575	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
576	uint8_t const uWidthType = (uWidth << 2) \| uType;
577	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
578	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
579	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
580	uint8_t const pbVmcs = (uint8_t )pVmcs;
581	uint8_t const *pbField = pbVmcs + offField;
582	(uint64_t )pbField = pSelReg->u64Base;
583	}
584
585	/* Attributes. */
586	{
587	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
588	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
589	\| X86DESCATTR_UNUSABLE;
590	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
591	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
592	uint8_t const uWidthType = (uWidth << 2) \| uType;
593	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
594	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
595	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
596	uint8_t pbVmcs = (uint8_t )pVmcs;
597	uint8_t *pbField = pbVmcs + offField;
598	(uint32_t )pbField = pSelReg->Attr.u & fValidAttrMask;
599	}
600	}
601
602
603	/**
604	* Gets a guest segment register from the VMCS.
605	*
606	* @returns VBox status code.
607	* @param pVmcs Pointer to the virtual VMCS.
608	* @param iSegReg The index of the segment register (X86_SREG_XXX).
609	* @param pSelReg Where to store the segment register (only updated when
610	* VINF_SUCCESS is returned).
611	*
612	* @remarks Warning! This does not validate the contents of the retrieved segment
613	* register.
614	*/
615	static int iemVmxVmcsGetGuestSegReg(PCVMXVVMCS pVmcs, uint8_t iSegReg, PCPUMSELREG pSelReg) RT_NOEXCEPT
616	{
617	Assert(pSelReg);
618	Assert(iSegReg < X86_SREG_COUNT);
619
620	/* Selector. */
621	uint16_t u16Sel;
622	{
623	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_16BIT;
624	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
625	uint8_t const uWidthType = (uWidth << 2) \| uType;
626	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS16_GUEST_ES_SEL, VMX_BF_VMCSFIELD_INDEX);
627	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
628	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
629	uint8_t const pbVmcs = (uint8_t )pVmcs;
630	uint8_t const *pbField = pbVmcs + offField;
631	u16Sel = (uint16_t )pbField;
632	}
633
634	/* Limit. */
635	uint32_t u32Limit;
636	{
637	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
638	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
639	uint8_t const uWidthType = (uWidth << 2) \| uType;
640	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_LIMIT, VMX_BF_VMCSFIELD_INDEX);
641	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
642	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
643	uint8_t const pbVmcs = (uint8_t )pVmcs;
644	uint8_t const *pbField = pbVmcs + offField;
645	u32Limit = (uint32_t )pbField;
646	}
647
648	/* Base. */
649	uint64_t u64Base;
650	{
651	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_NATURAL;
652	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
653	uint8_t const uWidthType = (uWidth << 2) \| uType;
654	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS_GUEST_ES_BASE, VMX_BF_VMCSFIELD_INDEX);
655	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
656	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
657	uint8_t const pbVmcs = (uint8_t )pVmcs;
658	uint8_t const *pbField = pbVmcs + offField;
659	u64Base = (uint64_t )pbField;
660	/** @todo NSTVMX: Should we zero out high bits here for 32-bit virtual CPUs? */
661	}
662
663	/* Attributes. */
664	uint32_t u32Attr;
665	{
666	uint8_t const uWidth = VMX_VMCSFIELD_WIDTH_32BIT;
667	uint8_t const uType = VMX_VMCSFIELD_TYPE_GUEST_STATE;
668	uint8_t const uWidthType = (uWidth << 2) \| uType;
669	uint8_t const uIndex = iSegReg + RT_BF_GET(VMX_VMCS32_GUEST_ES_ACCESS_RIGHTS, VMX_BF_VMCSFIELD_INDEX);
670	AssertReturn(uIndex <= VMX_V_VMCS_MAX_INDEX, VERR_IEM_IPE_3);
671	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
672	uint8_t const pbVmcs = (uint8_t )pVmcs;
673	uint8_t const *pbField = pbVmcs + offField;
674	u32Attr = (uint32_t )pbField;
675	}
676
677	pSelReg->Sel = u16Sel;
678	pSelReg->ValidSel = u16Sel;
679	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
680	pSelReg->u32Limit = u32Limit;
681	pSelReg->u64Base = u64Base;
682	pSelReg->Attr.u = u32Attr;
683	return VINF_SUCCESS;
684	}
685
686
687	/**
688	* Converts an IEM exception event type to a VMX event type.
689	*
690	* @returns The VMX event type.
691	* @param uVector The interrupt / exception vector.
692	* @param fFlags The IEM event flag (see IEM_XCPT_FLAGS_XXX).
693	*/
694	DECLINLINE(uint8_t) iemVmxGetEventType(uint32_t uVector, uint32_t fFlags)
695	{
696	/* Paranoia (callers may use these interchangeably). */
697	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_IDT_VECTORING_INFO_TYPE_NMI);
698	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT);
699	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT);
700	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT);
701	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_IDT_VECTORING_INFO_TYPE_SW_INT);
702	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_IDT_VECTORING_INFO_TYPE_PRIV_SW_XCPT);
703	AssertCompile(VMX_EXIT_INT_INFO_TYPE_NMI == VMX_ENTRY_INT_INFO_TYPE_NMI);
704	AssertCompile(VMX_EXIT_INT_INFO_TYPE_HW_XCPT == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT);
705	AssertCompile(VMX_EXIT_INT_INFO_TYPE_EXT_INT == VMX_ENTRY_INT_INFO_TYPE_EXT_INT);
706	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT);
707	AssertCompile(VMX_EXIT_INT_INFO_TYPE_SW_INT == VMX_ENTRY_INT_INFO_TYPE_SW_INT);
708	AssertCompile(VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT);
709
710	if (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
711	{
712	if (uVector == X86_XCPT_NMI)
713	return VMX_EXIT_INT_INFO_TYPE_NMI;
714	return VMX_EXIT_INT_INFO_TYPE_HW_XCPT;
715	}
716
717	if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
718	{
719	if (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR))
720	return VMX_EXIT_INT_INFO_TYPE_SW_XCPT;
721	if (fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)
722	return VMX_EXIT_INT_INFO_TYPE_PRIV_SW_XCPT;
723	return VMX_EXIT_INT_INFO_TYPE_SW_INT;
724	}
725
726	Assert(fFlags & IEM_XCPT_FLAGS_T_EXT_INT);
727	return VMX_EXIT_INT_INFO_TYPE_EXT_INT;
728	}
729
730
731	/**
732	* Determines whether the guest is using PAE paging given the VMCS.
733	*
734	* @returns @c true if PAE paging mode is used, @c false otherwise.
735	* @param pVmcs Pointer to the virtual VMCS.
736	*
737	* @warning Only use this prior to switching the guest-CPU state with the
738	* nested-guest CPU state!
739	*/
740	DECL_FORCE_INLINE(bool) iemVmxVmcsIsGuestPaePagingEnabled(PCVMXVVMCS pVmcs)
741	{
742	return ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST)
743	&& (pVmcs->u64GuestCr4.u & X86_CR4_PAE)
744	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG));
745	}
746
747
748	/**
749	* Sets the Exit qualification VMCS field.
750	*
751	* @param pVCpu The cross context virtual CPU structure.
752	* @param u64ExitQual The Exit qualification.
753	*/
754	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitQual(PVMCPUCC pVCpu, uint64_t u64ExitQual)
755	{
756	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoExitQual.u = u64ExitQual;
757	}
758
759
760	/**
761	* Sets the VM-exit interruption information field.
762	*
763	* @param pVCpu The cross context virtual CPU structure.
764	* @param uExitIntInfo The VM-exit interruption information.
765	*/
766	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntInfo(PVMCPUCC pVCpu, uint32_t uExitIntInfo)
767	{
768	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntInfo = uExitIntInfo;
769	}
770
771
772	/**
773	* Sets the VM-exit interruption error code.
774	*
775	* @param pVCpu The cross context virtual CPU structure.
776	* @param uErrCode The error code.
777	*/
778	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitIntErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
779	{
780	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitIntErrCode = uErrCode;
781	}
782
783
784	/**
785	* Sets the IDT-vectoring information field.
786	*
787	* @param pVCpu The cross context virtual CPU structure.
788	* @param uIdtVectorInfo The IDT-vectoring information.
789	*/
790	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringInfo(PVMCPUCC pVCpu, uint32_t uIdtVectorInfo)
791	{
792	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo = uIdtVectorInfo;
793	}
794
795
796	/**
797	* Sets the IDT-vectoring error code field.
798	*
799	* @param pVCpu The cross context virtual CPU structure.
800	* @param uErrCode The error code.
801	*/
802	DECL_FORCE_INLINE(void) iemVmxVmcsSetIdtVectoringErrCode(PVMCPUCC pVCpu, uint32_t uErrCode)
803	{
804	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringErrCode = uErrCode;
805	}
806
807
808	/**
809	* Sets the VM-exit guest-linear address VMCS field.
810	*
811	* @param pVCpu The cross context virtual CPU structure.
812	* @param uGuestLinearAddr The VM-exit guest-linear address.
813	*/
814	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestLinearAddr(PVMCPUCC pVCpu, uint64_t uGuestLinearAddr)
815	{
816	/* Bits 63:32 of guest-linear address MBZ if the guest isn't in long mode prior to the VM-exit. */
817	Assert(CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)) \|\| !(uGuestLinearAddr & UINT64_C(0xffffffff00000000)));
818	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestLinearAddr.u = uGuestLinearAddr;
819	}
820
821
822	/**
823	* Sets the VM-exit guest-physical address VMCS field.
824	*
825	* @param pVCpu The cross context virtual CPU structure.
826	* @param uGuestPhysAddr The VM-exit guest-physical address.
827	*/
828	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitGuestPhysAddr(PVMCPUCC pVCpu, uint64_t uGuestPhysAddr)
829	{
830	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64RoGuestPhysAddr.u = uGuestPhysAddr;
831	}
832
833
834	/**
835	* Sets the VM-exit instruction length VMCS field.
836	*
837	* @param pVCpu The cross context virtual CPU structure.
838	* @param cbInstr The VM-exit instruction length in bytes.
839	*
840	* @remarks Callers may clear this field to 0. Hence, this function does not check
841	* the validity of the instruction length.
842	*/
843	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrLen(PVMCPUCC pVCpu, uint32_t cbInstr)
844	{
845	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrLen = cbInstr;
846	}
847
848
849	/**
850	* Sets the VM-exit instruction info. VMCS field.
851	*
852	* @param pVCpu The cross context virtual CPU structure.
853	* @param uExitInstrInfo The VM-exit instruction information.
854	*/
855	DECL_FORCE_INLINE(void) iemVmxVmcsSetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitInstrInfo)
856	{
857	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoExitInstrInfo = uExitInstrInfo;
858	}
859
860
861	/**
862	* Sets the guest pending-debug exceptions field.
863	*
864	* @param pVCpu The cross context virtual CPU structure.
865	* @param uGuestPendingDbgXcpts The guest pending-debug exceptions.
866	*/
867	DECL_FORCE_INLINE(void) iemVmxVmcsSetGuestPendingDbgXcpts(PVMCPUCC pVCpu, uint64_t uGuestPendingDbgXcpts)
868	{
869	Assert(!(uGuestPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK));
870	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestPendingDbgXcpts.u = uGuestPendingDbgXcpts;
871	}
872
873
874	/**
875	* Implements VMSucceed for VMX instruction success.
876	*
877	* @param pVCpu The cross context virtual CPU structure.
878	*/
879	DECL_FORCE_INLINE(void) iemVmxVmSucceed(PVMCPUCC pVCpu)
880	{
881	return CPUMSetGuestVmxVmSucceed(&pVCpu->cpum.GstCtx);
882	}
883
884
885	/**
886	* Implements VMFailInvalid for VMX instruction failure.
887	*
888	* @param pVCpu The cross context virtual CPU structure.
889	*/
890	DECL_FORCE_INLINE(void) iemVmxVmFailInvalid(PVMCPUCC pVCpu)
891	{
892	return CPUMSetGuestVmxVmFailInvalid(&pVCpu->cpum.GstCtx);
893	}
894
895
896	/**
897	* Implements VMFail for VMX instruction failure.
898	*
899	* @param pVCpu The cross context virtual CPU structure.
900	* @param enmInsErr The VM instruction error.
901	*/
902	DECL_FORCE_INLINE(void) iemVmxVmFail(PVMCPUCC pVCpu, VMXINSTRERR enmInsErr)
903	{
904	return CPUMSetGuestVmxVmFail(&pVCpu->cpum.GstCtx, enmInsErr);
905	}
906
907
908	/**
909	* Checks if the given auto-load/store MSR area count is valid for the
910	* implementation.
911	*
912	* @returns @c true if it's within the valid limit, @c false otherwise.
913	* @param pVCpu The cross context virtual CPU structure.
914	* @param uMsrCount The MSR area count to check.
915	*/
916	DECL_FORCE_INLINE(bool) iemVmxIsAutoMsrCountValid(PCVMCPU pVCpu, uint32_t uMsrCount)
917	{
918	uint64_t const u64VmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
919	uint32_t const cMaxSupportedMsrs = VMX_MISC_MAX_MSRS(u64VmxMiscMsr);
920	Assert(cMaxSupportedMsrs <= VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
921	if (uMsrCount <= cMaxSupportedMsrs)
922	return true;
923	return false;
924	}
925
926
927	/**
928	* Flushes the current VMCS contents back to guest memory.
929	*
930	* @returns VBox status code.
931	* @param pVCpu The cross context virtual CPU structure.
932	*/
933	DECL_FORCE_INLINE(int) iemVmxWriteCurrentVmcsToGstMem(PVMCPUCC pVCpu)
934	{
935	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
936	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), IEM_VMX_GET_CURRENT_VMCS(pVCpu),
937	&pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
938	return rc;
939	}
940
941
942	/**
943	* Populates the current VMCS contents from guest memory.
944	*
945	* @returns VBox status code.
946	* @param pVCpu The cross context virtual CPU structure.
947	*/
948	DECL_FORCE_INLINE(int) iemVmxReadCurrentVmcsFromGstMem(PVMCPUCC pVCpu)
949	{
950	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
951	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs,
952	IEM_VMX_GET_CURRENT_VMCS(pVCpu), sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs));
953	return rc;
954	}
955
956
957	/**
958	* Gets the instruction diagnostic for segment base checks during VM-entry of a
959	* nested-guest.
960	*
961	* @param iSegReg The segment index (X86_SREG_XXX).
962	*/
963	static VMXVDIAG iemVmxGetDiagVmentrySegBase(unsigned iSegReg) RT_NOEXCEPT
964	{
965	switch (iSegReg)
966	{
967	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseCs;
968	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseDs;
969	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseEs;
970	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseFs;
971	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseGs;
972	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseSs;
973	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_1);
974	}
975	}
976
977
978	/**
979	* Gets the instruction diagnostic for segment base checks during VM-entry of a
980	* nested-guest that is in Virtual-8086 mode.
981	*
982	* @param iSegReg The segment index (X86_SREG_XXX).
983	*/
984	static VMXVDIAG iemVmxGetDiagVmentrySegBaseV86(unsigned iSegReg) RT_NOEXCEPT
985	{
986	switch (iSegReg)
987	{
988	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegBaseV86Cs;
989	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ds;
990	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegBaseV86Es;
991	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegBaseV86Fs;
992	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegBaseV86Gs;
993	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegBaseV86Ss;
994	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_2);
995	}
996	}
997
998
999	/**
1000	* Gets the instruction diagnostic for segment limit checks during VM-entry of a
1001	* nested-guest that is in Virtual-8086 mode.
1002	*
1003	* @param iSegReg The segment index (X86_SREG_XXX).
1004	*/
1005	static VMXVDIAG iemVmxGetDiagVmentrySegLimitV86(unsigned iSegReg) RT_NOEXCEPT
1006	{
1007	switch (iSegReg)
1008	{
1009	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegLimitV86Cs;
1010	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ds;
1011	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegLimitV86Es;
1012	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegLimitV86Fs;
1013	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegLimitV86Gs;
1014	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegLimitV86Ss;
1015	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_3);
1016	}
1017	}
1018
1019
1020	/**
1021	* Gets the instruction diagnostic for segment attribute checks during VM-entry of a
1022	* nested-guest that is in Virtual-8086 mode.
1023	*
1024	* @param iSegReg The segment index (X86_SREG_XXX).
1025	*/
1026	static VMXVDIAG iemVmxGetDiagVmentrySegAttrV86(unsigned iSegReg) RT_NOEXCEPT
1027	{
1028	switch (iSegReg)
1029	{
1030	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrV86Cs;
1031	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ds;
1032	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrV86Es;
1033	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrV86Fs;
1034	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrV86Gs;
1035	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrV86Ss;
1036	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_4);
1037	}
1038	}
1039
1040
1041	/**
1042	* Gets the instruction diagnostic for segment attributes reserved bits failure
1043	* during VM-entry of a nested-guest.
1044	*
1045	* @param iSegReg The segment index (X86_SREG_XXX).
1046	*/
1047	static VMXVDIAG iemVmxGetDiagVmentrySegAttrRsvd(unsigned iSegReg) RT_NOEXCEPT
1048	{
1049	switch (iSegReg)
1050	{
1051	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdCs;
1052	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdDs;
1053	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrRsvdEs;
1054	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdFs;
1055	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdGs;
1056	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrRsvdSs;
1057	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_5);
1058	}
1059	}
1060
1061
1062	/**
1063	* Gets the instruction diagnostic for segment attributes descriptor-type
1064	* (code/segment or system) failure during VM-entry of a nested-guest.
1065	*
1066	* @param iSegReg The segment index (X86_SREG_XXX).
1067	*/
1068	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDescType(unsigned iSegReg) RT_NOEXCEPT
1069	{
1070	switch (iSegReg)
1071	{
1072	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeCs;
1073	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeDs;
1074	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeEs;
1075	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeFs;
1076	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeGs;
1077	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDescTypeSs;
1078	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_6);
1079	}
1080	}
1081
1082
1083	/**
1084	* Gets the instruction diagnostic for segment attributes descriptor-type
1085	* (code/segment or system) failure during VM-entry of a nested-guest.
1086	*
1087	* @param iSegReg The segment index (X86_SREG_XXX).
1088	*/
1089	static VMXVDIAG iemVmxGetDiagVmentrySegAttrPresent(unsigned iSegReg) RT_NOEXCEPT
1090	{
1091	switch (iSegReg)
1092	{
1093	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrPresentCs;
1094	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrPresentDs;
1095	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrPresentEs;
1096	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrPresentFs;
1097	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrPresentGs;
1098	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrPresentSs;
1099	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_7);
1100	}
1101	}
1102
1103
1104	/**
1105	* Gets the instruction diagnostic for segment attribute granularity failure during
1106	* VM-entry of a nested-guest.
1107	*
1108	* @param iSegReg The segment index (X86_SREG_XXX).
1109	*/
1110	static VMXVDIAG iemVmxGetDiagVmentrySegAttrGran(unsigned iSegReg) RT_NOEXCEPT
1111	{
1112	switch (iSegReg)
1113	{
1114	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrGranCs;
1115	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrGranDs;
1116	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrGranEs;
1117	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrGranFs;
1118	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrGranGs;
1119	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrGranSs;
1120	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_8);
1121	}
1122	}
1123
1124	/**
1125	* Gets the instruction diagnostic for segment attribute DPL/RPL failure during
1126	* VM-entry of a nested-guest.
1127	*
1128	* @param iSegReg The segment index (X86_SREG_XXX).
1129	*/
1130	static VMXVDIAG iemVmxGetDiagVmentrySegAttrDplRpl(unsigned iSegReg) RT_NOEXCEPT
1131	{
1132	switch (iSegReg)
1133	{
1134	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplCs;
1135	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplDs;
1136	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrDplRplEs;
1137	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplFs;
1138	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplGs;
1139	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrDplRplSs;
1140	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_9);
1141	}
1142	}
1143
1144
1145	/**
1146	* Gets the instruction diagnostic for segment attribute type accessed failure
1147	* during VM-entry of a nested-guest.
1148	*
1149	* @param iSegReg The segment index (X86_SREG_XXX).
1150	*/
1151	static VMXVDIAG iemVmxGetDiagVmentrySegAttrTypeAcc(unsigned iSegReg) RT_NOEXCEPT
1152	{
1153	switch (iSegReg)
1154	{
1155	case X86_SREG_CS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccCs;
1156	case X86_SREG_DS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccDs;
1157	case X86_SREG_ES: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccEs;
1158	case X86_SREG_FS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccFs;
1159	case X86_SREG_GS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccGs;
1160	case X86_SREG_SS: return kVmxVDiag_Vmentry_GuestSegAttrTypeAccSs;
1161	IEM_NOT_REACHED_DEFAULT_CASE_RET2(kVmxVDiag_Ipe_10);
1162	}
1163	}
1164
1165
1166	/**
1167	* Saves the guest control registers, debug registers and some MSRs are part of
1168	* VM-exit.
1169	*
1170	* @param pVCpu The cross context virtual CPU structure.
1171	*/
1172	static void iemVmxVmexitSaveGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1173	{
1174	/*
1175	* Saves the guest control registers, debug registers and some MSRs.
1176	* See Intel spec. 27.3.1 "Saving Control Registers, Debug Registers and MSRs".
1177	*/
1178	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1179
1180	/* Save control registers. */
1181	pVmcs->u64GuestCr0.u = pVCpu->cpum.GstCtx.cr0;
1182	pVmcs->u64GuestCr3.u = pVCpu->cpum.GstCtx.cr3;
1183	pVmcs->u64GuestCr4.u = pVCpu->cpum.GstCtx.cr4;
1184
1185	/* Save SYSENTER CS, ESP, EIP. */
1186	pVmcs->u32GuestSysenterCS = pVCpu->cpum.GstCtx.SysEnter.cs;
1187	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1188	{
1189	pVmcs->u64GuestSysenterEsp.u = pVCpu->cpum.GstCtx.SysEnter.esp;
1190	pVmcs->u64GuestSysenterEip.u = pVCpu->cpum.GstCtx.SysEnter.eip;
1191	}
1192	else
1193	{
1194	pVmcs->u64GuestSysenterEsp.s.Lo = pVCpu->cpum.GstCtx.SysEnter.esp;
1195	pVmcs->u64GuestSysenterEip.s.Lo = pVCpu->cpum.GstCtx.SysEnter.eip;
1196	}
1197
1198	/* Save debug registers (DR7 and IA32_DEBUGCTL MSR). */
1199	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_DEBUG)
1200	{
1201	pVmcs->u64GuestDr7.u = pVCpu->cpum.GstCtx.dr[7];
1202	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1203	}
1204
1205	/* Save PAT MSR. */
1206	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PAT_MSR)
1207	pVmcs->u64GuestPatMsr.u = pVCpu->cpum.GstCtx.msrPAT;
1208
1209	/* Save EFER MSR. */
1210	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_EFER_MSR)
1211	pVmcs->u64GuestEferMsr.u = pVCpu->cpum.GstCtx.msrEFER;
1212
1213	/* We don't support clearing IA32_BNDCFGS MSR yet. */
1214	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_CLEAR_BNDCFGS_MSR));
1215
1216	/* Nothing to do for SMBASE register - We don't support SMM yet. */
1217	}
1218
1219
1220	/**
1221	* Saves the guest force-flags in preparation of entering the nested-guest.
1222	*
1223	* @param pVCpu The cross context virtual CPU structure.
1224	*/
1225	static void iemVmxVmentrySaveNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1226	{
1227	/* We shouldn't be called multiple times during VM-entry. */
1228	Assert(pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit == 0);
1229
1230	/* MTF should not be set outside VMX non-root mode. */
1231	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
1232
1233	/*
1234	* Preserve the required force-flags.
1235	*
1236	* We cache and clear force-flags that would affect the execution of the
1237	* nested-guest. Cached flags are then restored while returning to the guest
1238	* if necessary.
1239	*
1240	* - VMCPU_FF_INHIBIT_INTERRUPTS need not be cached as it only affects
1241	* interrupts until the completion of the current VMLAUNCH/VMRESUME
1242	* instruction. Interrupt inhibition for any nested-guest instruction
1243	* is supplied by the guest-interruptibility state VMCS field and will
1244	* be set up as part of loading the guest state. Technically
1245	* blocking-by-STI is possible with VMLAUNCH/VMRESUME but we currently
1246	* disallow it since we can't distinguish it from blocking-by-MovSS
1247	* and no nested-hypervisor we care about uses STI immediately
1248	* followed by VMLAUNCH/VMRESUME.
1249	*
1250	* - VMCPU_FF_BLOCK_NMIS needs to be cached as VM-exits caused before
1251	* successful VM-entry (due to invalid guest-state) need to continue
1252	* blocking NMIs if it was in effect before VM-entry.
1253	*
1254	* - MTF need not be preserved as it's used only in VMX non-root mode and
1255	* is supplied through the VM-execution controls.
1256	*
1257	* The remaining FFs (e.g. timers, APIC updates) can stay in place so that
1258	* we will be able to generate interrupts that may cause VM-exits for
1259	* the nested-guest.
1260	*/
1261	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = pVCpu->cpum.GstCtx.eflags.uBoth & CPUMCTX_INHIBIT_NMI;
1262	}
1263
1264
1265	/**
1266	* Restores the guest force-flags in preparation of exiting the nested-guest.
1267	*
1268	* @param pVCpu The cross context virtual CPU structure.
1269	*/
1270	static void iemVmxVmexitRestoreNmiBlockingFF(PVMCPUCC pVCpu) RT_NOEXCEPT
1271	{
1272	/** @todo r=bird: why aren't we clearing the nested guest flags first here?
1273	* If there is some other code doing that already, it would be great
1274	* to point to it here... */
1275	pVCpu->cpum.GstCtx.eflags.uBoth \|= pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit;
1276	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit = 0;
1277	}
1278
1279
1280	/**
1281	* Performs the VMX transition to/from VMX non-root mode.
1282	*
1283	* @param pVCpu The cross context virtual CPU structure.
1284	* @param cbInstr The length of the current instruction.
1285	*/
1286	static int iemVmxTransition(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
1287	{
1288	/*
1289	* Inform PGM about paging mode changes.
1290	* We include X86_CR0_PE because PGM doesn't handle paged-real mode yet,
1291	* see comment in iemMemPageTranslateAndCheckAccess().
1292	*/
1293	int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 \| X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
1294	true /* fForce */);
1295	if (RT_SUCCESS(rc))
1296	{ /* likely */ }
1297	else
1298	return rc;
1299
1300	/* Invalidate IEM TLBs now that we've forced a PGM mode change. */
1301	IEMTlbInvalidateAllGlobal(pVCpu);
1302
1303	/* Inform CPUM (recompiler), can later be removed. */
1304	CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_ALL);
1305
1306	/* Re-initialize IEM cache/state after the drastic mode switch. */
1307	iemReInitExec(pVCpu, cbInstr);
1308	return rc;
1309	}
1310
1311
1312	/**
1313	* Calculates the current VMX-preemption timer value.
1314	*
1315	* @returns The current VMX-preemption timer value.
1316	* @param pVCpu The cross context virtual CPU structure.
1317	*/
1318	static uint32_t iemVmxCalcPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
1319	{
1320	/*
1321	* Assume the following:
1322	* PreemptTimerShift = 5
1323	* VmcsPreemptTimer = 2 (i.e. need to decrement by 1 every 2 * RT_BIT(5) = 20000 TSC ticks)
1324	* EntryTick = 50000 (TSC at time of VM-entry)
1325	*
1326	* CurTick Delta PreemptTimerVal
1327	* ----------------------------------
1328	* 60000 10000 2
1329	* 80000 30000 1
1330	* 90000 40000 0 -> VM-exit.
1331	*
1332	* If Delta >= VmcsPreemptTimer * RT_BIT(PreemptTimerShift) cause a VMX-preemption timer VM-exit.
1333	* The saved VMX-preemption timer value is calculated as follows:
1334	* PreemptTimerVal = VmcsPreemptTimer - (Delta / (VmcsPreemptTimer * RT_BIT(PreemptTimerShift)))
1335	* E.g.:
1336	* Delta = 10000
1337	* Tmp = 10000 / (2 * 10000) = 0.5
1338	* NewPt = 2 - 0.5 = 2
1339	* Delta = 30000
1340	* Tmp = 30000 / (2 * 10000) = 1.5
1341	* NewPt = 2 - 1.5 = 1
1342	* Delta = 40000
1343	* Tmp = 40000 / 20000 = 2
1344	* NewPt = 2 - 2 = 0
1345	*/
1346	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
1347	uint32_t const uVmcsPreemptVal = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer;
1348	if (uVmcsPreemptVal > 0)
1349	{
1350	uint64_t const uCurTick = TMCpuTickGetNoCheck(pVCpu);
1351	uint64_t const uEntryTick = pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick;
1352	uint64_t const uDelta = uCurTick - uEntryTick;
1353	uint32_t const uPreemptTimer = uVmcsPreemptVal
1354	- ASMDivU64ByU32RetU32(uDelta, uVmcsPreemptVal * RT_BIT(VMX_V_PREEMPT_TIMER_SHIFT));
1355	return uPreemptTimer;
1356	}
1357	return 0;
1358	}
1359
1360
1361	/**
1362	* Saves guest segment registers, GDTR, IDTR, LDTR, TR as part of VM-exit.
1363	*
1364	* @param pVCpu The cross context virtual CPU structure.
1365	*/
1366	static void iemVmxVmexitSaveGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1367	{
1368	/*
1369	* Save guest segment registers, GDTR, IDTR, LDTR, TR.
1370	* See Intel spec 27.3.2 "Saving Segment Registers and Descriptor-Table Registers".
1371	*/
1372	/* CS, SS, ES, DS, FS, GS. */
1373	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1374	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1375	{
1376	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1377	if (!pSelReg->Attr.n.u1Unusable)
1378	iemVmxVmcsSetGuestSegReg(pVmcs, iSegReg, pSelReg);
1379	else
1380	{
1381	/*
1382	* For unusable segments the attributes are undefined except for CS and SS.
1383	* For the rest we don't bother preserving anything but the unusable bit.
1384	*/
1385	switch (iSegReg)
1386	{
1387	case X86_SREG_CS:
1388	pVmcs->GuestCs = pSelReg->Sel;
1389	pVmcs->u64GuestCsBase.u = pSelReg->u64Base;
1390	pVmcs->u32GuestCsLimit = pSelReg->u32Limit;
1391	pVmcs->u32GuestCsAttr = pSelReg->Attr.u & ( X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1392	\| X86DESCATTR_UNUSABLE);
1393	break;
1394
1395	case X86_SREG_SS:
1396	pVmcs->GuestSs = pSelReg->Sel;
1397	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1398	pVmcs->u64GuestSsBase.u &= UINT32_C(0xffffffff);
1399	pVmcs->u32GuestSsAttr = pSelReg->Attr.u & (X86DESCATTR_DPL \| X86DESCATTR_UNUSABLE);
1400	break;
1401
1402	case X86_SREG_DS:
1403	pVmcs->GuestDs = pSelReg->Sel;
1404	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1405	pVmcs->u64GuestDsBase.u &= UINT32_C(0xffffffff);
1406	pVmcs->u32GuestDsAttr = X86DESCATTR_UNUSABLE;
1407	break;
1408
1409	case X86_SREG_ES:
1410	pVmcs->GuestEs = pSelReg->Sel;
1411	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1412	pVmcs->u64GuestEsBase.u &= UINT32_C(0xffffffff);
1413	pVmcs->u32GuestEsAttr = X86DESCATTR_UNUSABLE;
1414	break;
1415
1416	case X86_SREG_FS:
1417	pVmcs->GuestFs = pSelReg->Sel;
1418	pVmcs->u64GuestFsBase.u = pSelReg->u64Base;
1419	pVmcs->u32GuestFsAttr = X86DESCATTR_UNUSABLE;
1420	break;
1421
1422	case X86_SREG_GS:
1423	pVmcs->GuestGs = pSelReg->Sel;
1424	pVmcs->u64GuestGsBase.u = pSelReg->u64Base;
1425	pVmcs->u32GuestGsAttr = X86DESCATTR_UNUSABLE;
1426	break;
1427	}
1428	}
1429	}
1430
1431	/* Segment attribute bits 31:17 and 11:8 MBZ. */
1432	uint32_t const fValidAttrMask = X86DESCATTR_TYPE \| X86DESCATTR_DT \| X86DESCATTR_DPL \| X86DESCATTR_P
1433	\| X86DESCATTR_AVL \| X86DESCATTR_L \| X86DESCATTR_D \| X86DESCATTR_G
1434	\| X86DESCATTR_UNUSABLE;
1435	/* LDTR. */
1436	{
1437	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.ldtr;
1438	pVmcs->GuestLdtr = pSelReg->Sel;
1439	pVmcs->u64GuestLdtrBase.u = pSelReg->u64Base;
1440	Assert(X86_IS_CANONICAL(pSelReg->u64Base));
1441	pVmcs->u32GuestLdtrLimit = pSelReg->u32Limit;
1442	pVmcs->u32GuestLdtrAttr = pSelReg->Attr.u & fValidAttrMask;
1443	}
1444
1445	/* TR. */
1446	{
1447	PCCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.tr;
1448	pVmcs->GuestTr = pSelReg->Sel;
1449	pVmcs->u64GuestTrBase.u = pSelReg->u64Base;
1450	pVmcs->u32GuestTrLimit = pSelReg->u32Limit;
1451	pVmcs->u32GuestTrAttr = pSelReg->Attr.u & fValidAttrMask;
1452	}
1453
1454	/* GDTR. */
1455	pVmcs->u64GuestGdtrBase.u = pVCpu->cpum.GstCtx.gdtr.pGdt;
1456	pVmcs->u32GuestGdtrLimit = pVCpu->cpum.GstCtx.gdtr.cbGdt;
1457
1458	/* IDTR. */
1459	pVmcs->u64GuestIdtrBase.u = pVCpu->cpum.GstCtx.idtr.pIdt;
1460	pVmcs->u32GuestIdtrLimit = pVCpu->cpum.GstCtx.idtr.cbIdt;
1461	}
1462
1463
1464	/**
1465	* Saves guest non-register state as part of VM-exit.
1466	*
1467	* @param pVCpu The cross context virtual CPU structure.
1468	* @param uExitReason The VM-exit reason.
1469	*/
1470	static void iemVmxVmexitSaveGuestNonRegState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1471	{
1472	/*
1473	* Save guest non-register state.
1474	* See Intel spec. 27.3.4 "Saving Non-Register State".
1475	*/
1476	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1477
1478	/*
1479	* Activity state.
1480	* Most VM-exits will occur in the active state. However, if the first instruction
1481	* following the VM-entry is a HLT instruction, and the MTF VM-execution control is set,
1482	* the VM-exit will be from the HLT activity state.
1483	*
1484	* See Intel spec. 25.5.2 "Monitor Trap Flag".
1485	*/
1486	/** @todo NSTVMX: Does triple-fault VM-exit reflect a shutdown activity state or
1487	* not? */
1488	EMSTATE const enmActivityState = EMGetState(pVCpu);
1489	switch (enmActivityState)
1490	{
1491	case EMSTATE_HALTED: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_HLT; break;
1492	default: pVmcs->u32GuestActivityState = VMX_VMCS_GUEST_ACTIVITY_ACTIVE; break;
1493	}
1494
1495	/*
1496	* Interruptibility-state.
1497	*/
1498	/* NMI. */
1499	pVmcs->u32GuestIntrState = 0;
1500	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
1501	{
1502	if (pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking)
1503	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1504	}
1505	else
1506	{
1507	if (CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx))
1508	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI;
1509	}
1510
1511	/* Blocking-by-STI or blocking-by-MovSS. */
1512	uint32_t fInhibitShw;
1513	if (!CPUMIsInInterruptShadowWithUpdateEx(&pVCpu->cpum.GstCtx, &fInhibitShw))
1514	{ /* probable */}
1515	else
1516	{
1517	if (pVCpu->cpum.GstCtx.rip == pVCpu->cpum.GstCtx.uRipInhibitInt)
1518	{
1519	/*
1520	* We must ensure only one of these bits is set.
1521	* Our emulation can have both set (perhaps because AMD doesn't distinguish
1522	* between the two?). Hence, the 'else' with blocking-by-MovSS taking priority
1523	* since it blocks more. Nested Ubuntu 22.04.2 running inside a Hyper-V enabled
1524	* Windows Server 2008 R2 guest runs into this issue.
1525	*
1526	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
1527	*/
1528	if (fInhibitShw & CPUMCTX_INHIBIT_SHADOW_SS)
1529	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS;
1530	else
1531	{
1532	Assert(fInhibitShw & CPUMCTX_INHIBIT_SHADOW_STI);
1533	pVmcs->u32GuestIntrState \|= VMX_VMCS_GUEST_INT_STATE_BLOCK_STI;
1534	}
1535	}
1536	}
1537	/* Nothing to do for SMI/enclave. We don't support enclaves or SMM yet. */
1538
1539	/*
1540	* Pending debug exceptions.
1541	*
1542	* For VM-exits where it is not applicable, we can safely zero out the field.
1543	* For VM-exits where it is applicable, it's expected to be updated by the caller already.
1544	*/
1545	if ( uExitReason != VMX_EXIT_INIT_SIGNAL
1546	&& uExitReason != VMX_EXIT_SMI
1547	&& uExitReason != VMX_EXIT_ERR_MACHINE_CHECK
1548	&& !VMXIsVmexitTrapLike(uExitReason))
1549	{
1550	/** @todo NSTVMX: also must exclude VM-exits caused by debug exceptions when
1551	* block-by-MovSS is in effect. */
1552	pVmcs->u64GuestPendingDbgXcpts.u = 0;
1553	}
1554
1555	/*
1556	* Save the VMX-preemption timer value back into the VMCS if the feature is enabled.
1557	*
1558	* For VMX-preemption timer VM-exits, we should have already written back 0 if the
1559	* feature is supported back into the VMCS, and thus there is nothing further to do here.
1560	*/
1561	if ( uExitReason != VMX_EXIT_PREEMPT_TIMER
1562	&& (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
1563	pVmcs->u32PreemptTimer = iemVmxCalcPreemptTimer(pVCpu);
1564
1565	/*
1566	* Save the guest PAE PDPTEs.
1567	*/
1568	if ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
1569	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
1570	{
1571	/*
1572	* Without EPT or when the nested-guest is not using PAE paging, the values saved
1573	* in the VMCS during VM-exit are undefined. We zero them here for consistency.
1574	*/
1575	pVmcs->u64GuestPdpte0.u = 0;
1576	pVmcs->u64GuestPdpte1.u = 0;
1577	pVmcs->u64GuestPdpte2.u = 0;
1578	pVmcs->u64GuestPdpte3.u = 0;
1579	}
1580	else
1581	{
1582	/*
1583	* With EPT and when the nested-guest is using PAE paging, we update the PDPTEs from
1584	* the nested-guest CPU context. Both IEM (Mov CRx) and hardware-assisted execution
1585	* of the nested-guest is expected to have updated them.
1586	*/
1587	pVmcs->u64GuestPdpte0.u = pVCpu->cpum.GstCtx.aPaePdpes[0].u;
1588	pVmcs->u64GuestPdpte1.u = pVCpu->cpum.GstCtx.aPaePdpes[1].u;
1589	pVmcs->u64GuestPdpte2.u = pVCpu->cpum.GstCtx.aPaePdpes[2].u;
1590	pVmcs->u64GuestPdpte3.u = pVCpu->cpum.GstCtx.aPaePdpes[3].u;
1591	}
1592
1593	/* Clear PGM's copy of the EPT pointer for added safety. */
1594	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
1595	PGMSetGuestEptPtr(pVCpu, 0 /* uEptPtr */);
1596	}
1597
1598
1599	/**
1600	* Saves the guest-state as part of VM-exit.
1601	*
1602	* @returns VBox status code.
1603	* @param pVCpu The cross context virtual CPU structure.
1604	* @param uExitReason The VM-exit reason.
1605	*/
1606	static void iemVmxVmexitSaveGuestState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1607	{
1608	iemVmxVmexitSaveGuestControlRegsMsrs(pVCpu);
1609	iemVmxVmexitSaveGuestSegRegs(pVCpu);
1610
1611	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRip.u = pVCpu->cpum.GstCtx.rip;
1612	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRsp.u = pVCpu->cpum.GstCtx.rsp;
1613	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64GuestRFlags.u = pVCpu->cpum.GstCtx.rflags.u; /** @todo NSTVMX: Check RFLAGS.RF handling. */
1614
1615	iemVmxVmexitSaveGuestNonRegState(pVCpu, uExitReason);
1616	}
1617
1618
1619	/**
1620	* Saves the guest MSRs into the VM-exit MSR-store area as part of VM-exit.
1621	*
1622	* @returns VBox status code.
1623	* @param pVCpu The cross context virtual CPU structure.
1624	* @param uExitReason The VM-exit reason (for diagnostic purposes).
1625	*/
1626	static int iemVmxVmexitSaveGuestAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1627	{
1628	/*
1629	* Save guest MSRs.
1630	* See Intel spec. 27.4 "Saving MSRs".
1631	*/
1632	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1633	const char * const pszFailure = "VMX-abort";
1634
1635	/*
1636	* The VM-exit MSR-store area address need not be a valid guest-physical address if the
1637	* VM-exit MSR-store count is 0. If this is the case, bail early without reading it.
1638	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1639	*/
1640	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrStoreCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea));
1641	if (!cMsrs)
1642	return VINF_SUCCESS;
1643
1644	/*
1645	* Verify the MSR auto-store count. Physical CPUs can behave unpredictably if the count
1646	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1647	* implementation causes a VMX-abort followed by a triple-fault.
1648	*/
1649	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1650	if (fIsMsrCountValid)
1651	{ /* likely */ }
1652	else
1653	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreCount);
1654
1655	/*
1656	* Optimization if the nested hypervisor is using the same guest-physical page for both
1657	* the VM-entry MSR-load area as well as the VM-exit MSR store area.
1658	*/
1659	PVMXAUTOMSR pMsrArea;
1660	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
1661	RTGCPHYS const GCPhysVmExitMsrStoreArea = pVmcs->u64AddrExitMsrStore.u;
1662	if (GCPhysVmEntryMsrLoadArea == GCPhysVmExitMsrStoreArea)
1663	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea;
1664	else
1665	{
1666	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea[0],
1667	GCPhysVmExitMsrStoreArea, cMsrs * sizeof(VMXAUTOMSR));
1668	if (RT_SUCCESS(rc))
1669	pMsrArea = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrStoreArea;
1670	else
1671	{
1672	AssertMsgFailed(("VM-exit: Failed to read MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1673	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrReadPhys);
1674	}
1675	}
1676
1677	/*
1678	* Update VM-exit MSR store area.
1679	*/
1680	PVMXAUTOMSR pMsr = pMsrArea;
1681	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1682	{
1683	if ( !pMsr->u32Reserved
1684	&& pMsr->u32Msr != MSR_IA32_SMBASE
1685	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
1686	{
1687	VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pMsr->u32Msr, &pMsr->u64Value);
1688	if (rcStrict == VINF_SUCCESS)
1689	continue;
1690
1691	/*
1692	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
1693	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
1694	* recording the MSR index in the auxiliary info. field and indicated further by our
1695	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
1696	* if possible, or come up with a better, generic solution.
1697	*/
1698	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1699	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_READ
1700	? kVmxVDiag_Vmexit_MsrStoreRing3
1701	: kVmxVDiag_Vmexit_MsrStore;
1702	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
1703	}
1704	else
1705	{
1706	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
1707	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStoreRsvd);
1708	}
1709	}
1710
1711	/*
1712	* Commit the VM-exit MSR store are to guest memory.
1713	*/
1714	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmExitMsrStoreArea, pMsrArea, cMsrs * sizeof(VMXAUTOMSR));
1715	if (RT_SUCCESS(rc))
1716	return VINF_SUCCESS;
1717
1718	NOREF(uExitReason);
1719	NOREF(pszFailure);
1720
1721	AssertMsgFailed(("VM-exit: Failed to write MSR auto-store area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrStoreArea, rc));
1722	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrStorePtrWritePhys);
1723	}
1724
1725
1726	/**
1727	* Performs a VMX abort (due to an fatal error during VM-exit).
1728	*
1729	* @returns Strict VBox status code.
1730	* @param pVCpu The cross context virtual CPU structure.
1731	* @param enmAbort The VMX abort reason.
1732	*/
1733	static VBOXSTRICTRC iemVmxAbort(PVMCPUCC pVCpu, VMXABORT enmAbort) RT_NOEXCEPT
1734	{
1735	/*
1736	* Perform the VMX abort.
1737	* See Intel spec. 27.7 "VMX Aborts".
1738	*/
1739	LogFunc(("enmAbort=%u (%s) -> RESET\n", enmAbort, VMXGetAbortDesc(enmAbort)));
1740
1741	/* We don't support SMX yet. */
1742	pVCpu->cpum.GstCtx.hwvirt.vmx.enmAbort = enmAbort;
1743	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
1744	{
1745	RTGCPHYS const GCPhysVmcs = IEM_VMX_GET_CURRENT_VMCS(pVCpu);
1746	uint32_t const offVmxAbort = RT_UOFFSETOF(VMXVVMCS, enmVmxAbort);
1747	PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + offVmxAbort, &enmAbort, sizeof(enmAbort));
1748	}
1749
1750	return VINF_EM_TRIPLE_FAULT;
1751	}
1752
1753
1754	/**
1755	* Loads host control registers, debug registers and MSRs as part of VM-exit.
1756	*
1757	* @param pVCpu The cross context virtual CPU structure.
1758	*/
1759	static void iemVmxVmexitLoadHostControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
1760	{
1761	/*
1762	* Load host control registers, debug registers and MSRs.
1763	* See Intel spec. 27.5.1 "Loading Host Control Registers, Debug Registers, MSRs".
1764	*/
1765	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1766	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1767
1768	/* CR0. */
1769	{
1770	/* Bits 63:32, 28:19, 17, 15:6, ET, CD, NW and CR0 fixed bits are not modified. */
1771	uint64_t const fCr0IgnMask = VMX_EXIT_HOST_CR0_IGNORE_MASK;
1772	uint64_t const uHostCr0 = pVmcs->u64HostCr0.u;
1773	uint64_t const uGuestCr0 = pVCpu->cpum.GstCtx.cr0;
1774	uint64_t const uValidHostCr0 = (uHostCr0 & ~fCr0IgnMask) \| (uGuestCr0 & fCr0IgnMask);
1775
1776	/* Verify we have not modified CR0 fixed bits in VMX operation. */
1777	#ifdef VBOX_STRICT
1778	uint64_t const uCr0Mb1 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
1779	bool const fUx = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
1780	AssertMsg( (uValidHostCr0 & uCr0Mb1) == uCr0Mb1
1781	&& (uValidHostCr0 & ~VMX_V_CR0_FIXED1) == 0,
1782	("host=%#RX64 guest=%#RX64 mb1=%#RX64 valid_host_cr0=%#RX64 fUx=%RTbool\n",
1783	uHostCr0, uGuestCr0, uCr0Mb1, uValidHostCr0, fUx));
1784	#endif
1785	Assert(!(uValidHostCr0 >> 32));
1786	CPUMSetGuestCR0(pVCpu, uValidHostCr0);
1787	}
1788
1789	/* CR4. */
1790	{
1791	/* CR4 fixed bits are not modified. */
1792	uint64_t const uCr4Mb1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
1793	uint64_t const uCr4Mb0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
1794	uint64_t const uHostCr4 = pVmcs->u64HostCr4.u;
1795	uint64_t uValidHostCr4 = (uHostCr4 & uCr4Mb0) \| uCr4Mb1;
1796	if (fHostInLongMode)
1797	uValidHostCr4 \|= X86_CR4_PAE;
1798	else
1799	uValidHostCr4 &= ~(uint64_t)X86_CR4_PCIDE;
1800
1801	/* Verify we have not modified CR4 fixed bits in VMX non-root operation. */
1802	AssertMsg( (uValidHostCr4 & uCr4Mb1) == uCr4Mb1
1803	&& (uValidHostCr4 & ~uCr4Mb0) == 0,
1804	("host=%#RX64 guest=%#RX64, uCr4Mb1=%#RX64 uCr4Mb0=%#RX64 valid_host_cr4=%#RX64\n",
1805	uHostCr4, pVCpu->cpum.GstCtx.cr4, uCr4Mb1, uCr4Mb0, uValidHostCr4));
1806	CPUMSetGuestCR4(pVCpu, uValidHostCr4);
1807	}
1808
1809	/* CR3 (host value validated while checking host-state during VM-entry). */
1810	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64HostCr3.u;
1811
1812	/* DR7. */
1813	pVCpu->cpum.GstCtx.dr[7] = X86_DR7_INIT_VAL;
1814
1815	/** @todo NSTVMX: Support IA32_DEBUGCTL MSR */
1816
1817	/* Save SYSENTER CS, ESP, EIP (host value validated while checking host-state during VM-entry). */
1818	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64HostSysenterEip.u;
1819	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64HostSysenterEsp.u;
1820	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32HostSysenterCs;
1821
1822	/* FS, GS bases are loaded later while we load host segment registers. */
1823
1824	/* EFER MSR (host value validated while checking host-state during VM-entry). */
1825	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
1826	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64HostEferMsr.u;
1827	else if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
1828	{
1829	if (fHostInLongMode)
1830	pVCpu->cpum.GstCtx.msrEFER \|= (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1831	else
1832	pVCpu->cpum.GstCtx.msrEFER &= ~(MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
1833	}
1834
1835	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
1836
1837	/* PAT MSR (host value is validated while checking host-state during VM-entry). */
1838	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
1839	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64HostPatMsr.u;
1840
1841	/* We don't support IA32_BNDCFGS MSR yet. */
1842	}
1843
1844
1845	/**
1846	* Loads host segment registers, GDTR, IDTR, LDTR and TR as part of VM-exit.
1847	*
1848	* @param pVCpu The cross context virtual CPU structure.
1849	*/
1850	static void iemVmxVmexitLoadHostSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
1851	{
1852	/*
1853	* Load host segment registers, GDTR, IDTR, LDTR and TR.
1854	* See Intel spec. 27.5.2 "Loading Host Segment and Descriptor-Table Registers".
1855	*
1856	* Warning! Be careful to not touch fields that are reserved by VT-x,
1857	* e.g. segment limit high bits stored in segment attributes (in bits 11:8).
1858	*/
1859	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1860	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
1861
1862	/* CS, SS, ES, DS, FS, GS. */
1863	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
1864	{
1865	RTSEL const HostSel = iemVmxVmcsGetHostSelReg(pVmcs, iSegReg);
1866	bool const fUnusable = RT_BOOL(HostSel == 0);
1867	PCPUMSELREG pSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
1868
1869	/* Selector. */
1870	pSelReg->Sel = HostSel;
1871	pSelReg->ValidSel = HostSel;
1872	pSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
1873
1874	/* Limit. */
1875	pSelReg->u32Limit = 0xffffffff;
1876
1877	/* Base. */
1878	pSelReg->u64Base = 0;
1879
1880	/* Attributes. */
1881	if (iSegReg == X86_SREG_CS)
1882	{
1883	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED;
1884	pSelReg->Attr.n.u1DescType = 1;
1885	pSelReg->Attr.n.u2Dpl = 0;
1886	pSelReg->Attr.n.u1Present = 1;
1887	pSelReg->Attr.n.u1Long = fHostInLongMode;
1888	pSelReg->Attr.n.u1DefBig = !fHostInLongMode;
1889	pSelReg->Attr.n.u1Granularity = 1;
1890	Assert(!pSelReg->Attr.n.u1Unusable);
1891	Assert(!fUnusable);
1892	}
1893	else
1894	{
1895	pSelReg->Attr.n.u4Type = X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED;
1896	pSelReg->Attr.n.u1DescType = 1;
1897	pSelReg->Attr.n.u2Dpl = 0;
1898	pSelReg->Attr.n.u1Present = 1;
1899	pSelReg->Attr.n.u1DefBig = 1;
1900	pSelReg->Attr.n.u1Granularity = 1;
1901	pSelReg->Attr.n.u1Unusable = fUnusable;
1902	}
1903	}
1904
1905	/* FS base. */
1906	if ( !pVCpu->cpum.GstCtx.fs.Attr.n.u1Unusable
1907	\|\| fHostInLongMode)
1908	{
1909	Assert(X86_IS_CANONICAL(pVmcs->u64HostFsBase.u));
1910	pVCpu->cpum.GstCtx.fs.u64Base = pVmcs->u64HostFsBase.u;
1911	}
1912
1913	/* GS base. */
1914	if ( !pVCpu->cpum.GstCtx.gs.Attr.n.u1Unusable
1915	\|\| fHostInLongMode)
1916	{
1917	Assert(X86_IS_CANONICAL(pVmcs->u64HostGsBase.u));
1918	pVCpu->cpum.GstCtx.gs.u64Base = pVmcs->u64HostGsBase.u;
1919	}
1920
1921	/* TR. */
1922	Assert(X86_IS_CANONICAL(pVmcs->u64HostTrBase.u));
1923	Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1Unusable);
1924	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->HostTr;
1925	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->HostTr;
1926	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
1927	pVCpu->cpum.GstCtx.tr.u32Limit = X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN;
1928	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64HostTrBase.u;
1929	pVCpu->cpum.GstCtx.tr.Attr.n.u4Type = X86_SEL_TYPE_SYS_386_TSS_BUSY;
1930	pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType = 0;
1931	pVCpu->cpum.GstCtx.tr.Attr.n.u2Dpl = 0;
1932	pVCpu->cpum.GstCtx.tr.Attr.n.u1Present = 1;
1933	pVCpu->cpum.GstCtx.tr.Attr.n.u1DefBig = 0;
1934	pVCpu->cpum.GstCtx.tr.Attr.n.u1Granularity = 0;
1935
1936	/* LDTR (Warning! do not touch the base and limits here). */
1937	pVCpu->cpum.GstCtx.ldtr.Sel = 0;
1938	pVCpu->cpum.GstCtx.ldtr.ValidSel = 0;
1939	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
1940	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
1941
1942	/* GDTR. */
1943	Assert(X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u));
1944	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64HostGdtrBase.u;
1945	pVCpu->cpum.GstCtx.gdtr.cbGdt = 0xffff;
1946
1947	/* IDTR.*/
1948	Assert(X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u));
1949	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64HostIdtrBase.u;
1950	pVCpu->cpum.GstCtx.idtr.cbIdt = 0xffff;
1951	}
1952
1953
1954	/**
1955	* Loads the host MSRs from the VM-exit MSR-load area as part of VM-exit.
1956	*
1957	* @returns VBox status code.
1958	* @param pVCpu The cross context virtual CPU structure.
1959	* @param uExitReason The VMX instruction name (for logging purposes).
1960	*/
1961	static int iemVmxVmexitLoadHostAutoMsrs(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
1962	{
1963	/*
1964	* Load host MSRs.
1965	* See Intel spec. 27.6 "Loading MSRs".
1966	*/
1967	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
1968	const char * const pszFailure = "VMX-abort";
1969
1970	/*
1971	* The VM-exit MSR-load area address need not be a valid guest-physical address if the
1972	* VM-exit MSR load count is 0. If this is the case, bail early without reading it.
1973	* See Intel spec. 24.7.2 "VM-Exit Controls for MSRs".
1974	*/
1975	uint32_t const cMsrs = RT_MIN(pVmcs->u32ExitMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea));
1976	if (!cMsrs)
1977	return VINF_SUCCESS;
1978
1979	/*
1980	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count
1981	* is exceeded including possibly raising #MC exceptions during VMX transition. Our
1982	* implementation causes a VMX-abort followed by a triple-fault.
1983	*/
1984	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
1985	if (fIsMsrCountValid)
1986	{ /* likely */ }
1987	else
1988	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadCount);
1989
1990	RTGCPHYS const GCPhysVmExitMsrLoadArea = pVmcs->u64AddrExitMsrLoad.u;
1991	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea[0],
1992	GCPhysVmExitMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
1993	if (RT_SUCCESS(rc))
1994	{
1995	PCVMXAUTOMSR pMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.aExitMsrLoadArea;
1996	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
1997	{
1998	if ( !pMsr->u32Reserved
1999	&& pMsr->u32Msr != MSR_K8_FS_BASE
2000	&& pMsr->u32Msr != MSR_K8_GS_BASE
2001	&& pMsr->u32Msr != MSR_K6_EFER
2002	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
2003	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
2004	{
2005	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
2006	if (rcStrict == VINF_SUCCESS)
2007	continue;
2008
2009	/*
2010	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-exit.
2011	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VMX-abort
2012	* recording the MSR index in the auxiliary info. field and indicated further by our
2013	* own, specific diagnostic code. Later, we can try implement handling of the MSR in ring-0
2014	* if possible, or come up with a better, generic solution.
2015	*/
2016	pVCpu->cpum.GstCtx.hwvirt.vmx.uAbortAux = pMsr->u32Msr;
2017	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
2018	? kVmxVDiag_Vmexit_MsrLoadRing3
2019	: kVmxVDiag_Vmexit_MsrLoad;
2020	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, enmDiag);
2021	}
2022	else
2023	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadRsvd);
2024	}
2025	}
2026	else
2027	{
2028	AssertMsgFailed(("VM-exit: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", GCPhysVmExitMsrLoadArea, rc));
2029	IEM_VMX_VMEXIT_FAILED_RET(pVCpu, uExitReason, pszFailure, kVmxVDiag_Vmexit_MsrLoadPtrReadPhys);
2030	}
2031
2032	NOREF(uExitReason);
2033	NOREF(pszFailure);
2034	return VINF_SUCCESS;
2035	}
2036
2037
2038	/**
2039	* Loads the host state as part of VM-exit.
2040	*
2041	* @returns Strict VBox status code.
2042	* @param pVCpu The cross context virtual CPU structure.
2043	* @param uExitReason The VM-exit reason (for logging purposes).
2044	*/
2045	static VBOXSTRICTRC iemVmxVmexitLoadHostState(PVMCPUCC pVCpu, uint32_t uExitReason) RT_NOEXCEPT
2046	{
2047	/*
2048	* Load host state.
2049	* See Intel spec. 27.5 "Loading Host State".
2050	*/
2051	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2052	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
2053
2054	/* We cannot return from a long-mode guest to a host that is not in long mode. */
2055	if ( CPUMIsGuestInLongMode(pVCpu)
2056	&& !fHostInLongMode)
2057	{
2058	Log(("VM-exit from long-mode guest to host not in long-mode -> VMX-Abort\n"));
2059	return iemVmxAbort(pVCpu, VMXABORT_HOST_NOT_IN_LONG_MODE);
2060	}
2061
2062	/*
2063	* Check host PAE PDPTEs prior to loading the host state.
2064	* See Intel spec. 26.5.4 "Checking and Loading Host Page-Directory-Pointer-Table Entries".
2065	*/
2066	if ( (pVmcs->u64HostCr4.u & X86_CR4_PAE)
2067	&& !fHostInLongMode
2068	&& ( !CPUMIsGuestInPAEModeEx(&pVCpu->cpum.GstCtx)
2069	\|\| pVmcs->u64HostCr3.u != pVCpu->cpum.GstCtx.cr3))
2070	{
2071	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64HostCr3.u);
2072	if (RT_SUCCESS(rc))
2073	{ /* likely*/ }
2074	else
2075	{
2076	IEM_VMX_VMEXIT_FAILED(pVCpu, uExitReason, "VMX-abort", kVmxVDiag_Vmexit_HostPdpte);
2077	return iemVmxAbort(pVCpu, VMXBOART_HOST_PDPTE);
2078	}
2079	}
2080
2081	iemVmxVmexitLoadHostControlRegsMsrs(pVCpu);
2082	iemVmxVmexitLoadHostSegRegs(pVCpu);
2083
2084	/*
2085	* Load host RIP, RSP and RFLAGS.
2086	* See Intel spec. 27.5.3 "Loading Host RIP, RSP and RFLAGS"
2087	*/
2088	pVCpu->cpum.GstCtx.rip = pVmcs->u64HostRip.u;
2089	pVCpu->cpum.GstCtx.rsp = pVmcs->u64HostRsp.u;
2090	pVCpu->cpum.GstCtx.rflags.u = X86_EFL_1;
2091
2092	/* Clear address range monitoring. */
2093	EMMonitorWaitClear(pVCpu);
2094
2095	/* Perform the VMX transition (PGM updates). */
2096	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu, 0 /cbInstr - whatever/);
2097	if (rcStrict == VINF_SUCCESS)
2098	{ /* likely */ }
2099	else if (RT_SUCCESS(rcStrict))
2100	{
2101	Log3(("VM-exit: iemVmxTransition returns %Rrc (uExitReason=%u) -> Setting passup status\n", VBOXSTRICTRC_VAL(rcStrict),
2102	uExitReason));
2103	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
2104	}
2105	else
2106	{
2107	Log3(("VM-exit: iemVmxTransition failed! rc=%Rrc (uExitReason=%u)\n", VBOXSTRICTRC_VAL(rcStrict), uExitReason));
2108	return VBOXSTRICTRC_VAL(rcStrict);
2109	}
2110
2111	Assert(rcStrict == VINF_SUCCESS);
2112
2113	/* Load MSRs from the VM-exit auto-load MSR area. */
2114	int rc = iemVmxVmexitLoadHostAutoMsrs(pVCpu, uExitReason);
2115	if (RT_FAILURE(rc))
2116	{
2117	Log(("VM-exit failed while loading host MSRs -> VMX-Abort\n"));
2118	return iemVmxAbort(pVCpu, VMXABORT_LOAD_HOST_MSR);
2119	}
2120	return VINF_SUCCESS;
2121	}
2122
2123
2124	/**
2125	* Gets VM-exit instruction information along with any displacement for an
2126	* instruction VM-exit.
2127	*
2128	* @returns The VM-exit instruction information.
2129	* @param pVCpu The cross context virtual CPU structure.
2130	* @param uExitReason The VM-exit reason.
2131	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_XXX).
2132	* @param pGCPtrDisp Where to store the displacement field. Optional, can be
2133	* NULL.
2134	*/
2135	static uint32_t iemVmxGetExitInstrInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, PRTGCPTR pGCPtrDisp) RT_NOEXCEPT
2136	{
2137	RTGCPTR GCPtrDisp;
2138	VMXEXITINSTRINFO ExitInstrInfo;
2139	ExitInstrInfo.u = 0;
2140
2141	/*
2142	* Get and parse the ModR/M byte from our decoded opcodes.
2143	*/
2144	uint8_t bRm;
2145	uint8_t const offModRm = pVCpu->iem.s.offModRm;
2146	IEM_MODRM_GET_U8(pVCpu, bRm, offModRm);
2147	if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
2148	{
2149	/*
2150	* ModR/M indicates register addressing.
2151	*
2152	* The primary/secondary register operands are reported in the iReg1 or iReg2
2153	* fields depending on whether it is a read/write form.
2154	*/
2155	uint8_t idxReg1;
2156	uint8_t idxReg2;
2157	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2158	{
2159	idxReg1 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2160	idxReg2 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2161	}
2162	else
2163	{
2164	idxReg1 = (bRm & X86_MODRM_RM_MASK) \| pVCpu->iem.s.uRexB;
2165	idxReg2 = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) \| pVCpu->iem.s.uRexReg;
2166	}
2167	ExitInstrInfo.All.u2Scaling = 0;
2168	ExitInstrInfo.All.iReg1 = idxReg1;
2169	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2170	ExitInstrInfo.All.fIsRegOperand = 1;
2171	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2172	ExitInstrInfo.All.iSegReg = 0;
2173	ExitInstrInfo.All.iIdxReg = 0;
2174	ExitInstrInfo.All.fIdxRegInvalid = 1;
2175	ExitInstrInfo.All.iBaseReg = 0;
2176	ExitInstrInfo.All.fBaseRegInvalid = 1;
2177	ExitInstrInfo.All.iReg2 = idxReg2;
2178
2179	/* Displacement not applicable for register addressing. */
2180	GCPtrDisp = 0;
2181	}
2182	else
2183	{
2184	/*
2185	* ModR/M indicates memory addressing.
2186	*/
2187	uint8_t uScale = 0;
2188	bool fBaseRegValid = false;
2189	bool fIdxRegValid = false;
2190	uint8_t iBaseReg = 0;
2191	uint8_t iIdxReg = 0;
2192	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
2193	{
2194	/*
2195	* Parse the ModR/M, displacement for 16-bit addressing mode.
2196	* See Intel instruction spec. Table 2-1. "16-Bit Addressing Forms with the ModR/M Byte".
2197	*/
2198	uint16_t u16Disp = 0;
2199	uint8_t const offDisp = offModRm + sizeof(bRm);
2200	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 6)
2201	{
2202	/* Displacement without any registers. */
2203	IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp);
2204	}
2205	else
2206	{
2207	/* Register (index and base). */
2208	switch (bRm & X86_MODRM_RM_MASK)
2209	{
2210	case 0: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2211	case 1: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2212	case 2: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2213	case 3: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2214	case 4: fIdxRegValid = true; iIdxReg = X86_GREG_xSI; break;
2215	case 5: fIdxRegValid = true; iIdxReg = X86_GREG_xDI; break;
2216	case 6: fBaseRegValid = true; iBaseReg = X86_GREG_xBP; break;
2217	case 7: fBaseRegValid = true; iBaseReg = X86_GREG_xBX; break;
2218	}
2219
2220	/* Register + displacement. */
2221	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2222	{
2223	case 0: break;
2224	case 1: IEM_DISP_GET_S8_SX_U16(pVCpu, u16Disp, offDisp); break;
2225	case 2: IEM_DISP_GET_U16(pVCpu, u16Disp, offDisp); break;
2226	default:
2227	{
2228	/* Register addressing, handled at the beginning. */
2229	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2230	break;
2231	}
2232	}
2233	}
2234
2235	Assert(!uScale); /* There's no scaling/SIB byte for 16-bit addressing. */
2236	GCPtrDisp = (int16_t)u16Disp; /* Sign-extend the displacement. */
2237	}
2238	else if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
2239	{
2240	/*
2241	* Parse the ModR/M, SIB, displacement for 32-bit addressing mode.
2242	* See Intel instruction spec. Table 2-2. "32-Bit Addressing Forms with the ModR/M Byte".
2243	*/
2244	uint32_t u32Disp = 0;
2245	if ((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5)
2246	{
2247	/* Displacement without any registers. */
2248	uint8_t const offDisp = offModRm + sizeof(bRm);
2249	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2250	}
2251	else
2252	{
2253	/* Register (and perhaps scale, index and base). */
2254	uint8_t offDisp = offModRm + sizeof(bRm);
2255	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2256	if (iBaseReg == 4)
2257	{
2258	/* An SIB byte follows the ModR/M byte, parse it. */
2259	uint8_t bSib;
2260	uint8_t const offSib = offModRm + sizeof(bRm);
2261	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2262
2263	/* A displacement may follow SIB, update its offset. */
2264	offDisp += sizeof(bSib);
2265
2266	/* Get the scale. */
2267	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2268
2269	/* Get the index register. */
2270	iIdxReg = (bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK;
2271	fIdxRegValid = RT_BOOL(iIdxReg != 4);
2272
2273	/* Get the base register. */
2274	iBaseReg = bSib & X86_SIB_BASE_MASK;
2275	fBaseRegValid = true;
2276	if (iBaseReg == 5)
2277	{
2278	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2279	{
2280	/* Mod is 0 implies a 32-bit displacement with no base. */
2281	fBaseRegValid = false;
2282	IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp);
2283	}
2284	else
2285	{
2286	/* Mod is not 0 implies an 8-bit/32-bit displacement (handled below) with an EBP base. */
2287	iBaseReg = X86_GREG_xBP;
2288	}
2289	}
2290	}
2291
2292	/* Register + displacement. */
2293	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2294	{
2295	case 0: /* Handled above */ break;
2296	case 1: IEM_DISP_GET_S8_SX_U32(pVCpu, u32Disp, offDisp); break;
2297	case 2: IEM_DISP_GET_U32(pVCpu, u32Disp, offDisp); break;
2298	default:
2299	{
2300	/* Register addressing, handled at the beginning. */
2301	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2302	break;
2303	}
2304	}
2305	}
2306
2307	GCPtrDisp = (int32_t)u32Disp; /* Sign-extend the displacement. */
2308	}
2309	else
2310	{
2311	Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT);
2312
2313	/*
2314	* Parse the ModR/M, SIB, displacement for 64-bit addressing mode.
2315	* See Intel instruction spec. 2.2 "IA-32e Mode".
2316	*/
2317	uint64_t u64Disp = 0;
2318	bool const fRipRelativeAddr = RT_BOOL((bRm & (X86_MODRM_MOD_MASK \| X86_MODRM_RM_MASK)) == 5);
2319	if (fRipRelativeAddr)
2320	{
2321	/*
2322	* RIP-relative addressing mode.
2323	*
2324	* The displacement is 32-bit signed implying an offset range of +/-2G.
2325	* See Intel instruction spec. 2.2.1.6 "RIP-Relative Addressing".
2326	*/
2327	uint8_t const offDisp = offModRm + sizeof(bRm);
2328	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2329	}
2330	else
2331	{
2332	uint8_t offDisp = offModRm + sizeof(bRm);
2333
2334	/*
2335	* Register (and perhaps scale, index and base).
2336	*
2337	* REX.B extends the most-significant bit of the base register. However, REX.B
2338	* is ignored while determining whether an SIB follows the opcode. Hence, we
2339	* shall OR any REX.B bit -after- inspecting for an SIB byte below.
2340	*
2341	* See Intel instruction spec. Table 2-5. "Special Cases of REX Encodings".
2342	*/
2343	iBaseReg = (bRm & X86_MODRM_RM_MASK);
2344	if (iBaseReg == 4)
2345	{
2346	/* An SIB byte follows the ModR/M byte, parse it. Displacement (if any) follows SIB. */
2347	uint8_t bSib;
2348	uint8_t const offSib = offModRm + sizeof(bRm);
2349	IEM_SIB_GET_U8(pVCpu, bSib, offSib);
2350
2351	/* Displacement may follow SIB, update its offset. */
2352	offDisp += sizeof(bSib);
2353
2354	/* Get the scale. */
2355	uScale = (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
2356
2357	/* Get the index. */
2358	iIdxReg = ((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) \| pVCpu->iem.s.uRexIndex;
2359	fIdxRegValid = RT_BOOL(iIdxReg != 4); /* R12 -can- be used as an index register. */
2360
2361	/* Get the base. */
2362	iBaseReg = (bSib & X86_SIB_BASE_MASK);
2363	fBaseRegValid = true;
2364	if (iBaseReg == 5)
2365	{
2366	if ((bRm & X86_MODRM_MOD_MASK) == 0)
2367	{
2368	/* Mod is 0 implies a signed 32-bit displacement with no base. */
2369	IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp);
2370	}
2371	else
2372	{
2373	/* Mod is non-zero implies an 8-bit/32-bit displacement (handled below) with RBP or R13 as base. */
2374	iBaseReg = pVCpu->iem.s.uRexB ? X86_GREG_x13 : X86_GREG_xBP;
2375	}
2376	}
2377	}
2378	iBaseReg \|= pVCpu->iem.s.uRexB;
2379
2380	/* Register + displacement. */
2381	switch ((bRm >> X86_MODRM_MOD_SHIFT) & X86_MODRM_MOD_SMASK)
2382	{
2383	case 0: /* Handled above */ break;
2384	case 1: IEM_DISP_GET_S8_SX_U64(pVCpu, u64Disp, offDisp); break;
2385	case 2: IEM_DISP_GET_S32_SX_U64(pVCpu, u64Disp, offDisp); break;
2386	default:
2387	{
2388	/* Register addressing, handled at the beginning. */
2389	AssertMsgFailed(("ModR/M %#x implies register addressing, memory addressing expected!", bRm));
2390	break;
2391	}
2392	}
2393	}
2394
2395	GCPtrDisp = fRipRelativeAddr ? pVCpu->cpum.GstCtx.rip + u64Disp : u64Disp;
2396	}
2397
2398	/*
2399	* The primary or secondary register operand is reported in iReg2 depending
2400	* on whether the primary operand is in read/write form.
2401	*/
2402	uint8_t idxReg2;
2403	if (!VMXINSTRID_IS_MODRM_PRIMARY_OP_W(uInstrId))
2404	{
2405	idxReg2 = bRm & X86_MODRM_RM_MASK;
2406	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2407	idxReg2 \|= pVCpu->iem.s.uRexB;
2408	}
2409	else
2410	{
2411	idxReg2 = (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK;
2412	if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
2413	idxReg2 \|= pVCpu->iem.s.uRexReg;
2414	}
2415	ExitInstrInfo.All.u2Scaling = uScale;
2416	ExitInstrInfo.All.iReg1 = 0; /* Not applicable for memory addressing. */
2417	ExitInstrInfo.All.u3AddrSize = pVCpu->iem.s.enmEffAddrMode;
2418	ExitInstrInfo.All.fIsRegOperand = 0;
2419	ExitInstrInfo.All.uOperandSize = pVCpu->iem.s.enmEffOpSize;
2420	ExitInstrInfo.All.iSegReg = pVCpu->iem.s.iEffSeg;
2421	ExitInstrInfo.All.iIdxReg = iIdxReg;
2422	ExitInstrInfo.All.fIdxRegInvalid = !fIdxRegValid;
2423	ExitInstrInfo.All.iBaseReg = iBaseReg;
2424	ExitInstrInfo.All.iIdxReg = !fBaseRegValid;
2425	ExitInstrInfo.All.iReg2 = idxReg2;
2426	}
2427
2428	/*
2429	* Handle exceptions to the norm for certain instructions.
2430	* (e.g. some instructions convey an instruction identity in place of iReg2).
2431	*/
2432	switch (uExitReason)
2433	{
2434	case VMX_EXIT_GDTR_IDTR_ACCESS:
2435	{
2436	Assert(VMXINSTRID_IS_VALID(uInstrId));
2437	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2438	ExitInstrInfo.GdtIdt.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2439	ExitInstrInfo.GdtIdt.u2Undef0 = 0;
2440	break;
2441	}
2442
2443	case VMX_EXIT_LDTR_TR_ACCESS:
2444	{
2445	Assert(VMXINSTRID_IS_VALID(uInstrId));
2446	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2447	ExitInstrInfo.LdtTr.u2InstrId = VMXINSTRID_GET_ID(uInstrId);
2448	ExitInstrInfo.LdtTr.u2Undef0 = 0;
2449	break;
2450	}
2451
2452	case VMX_EXIT_RDRAND:
2453	case VMX_EXIT_RDSEED:
2454	{
2455	Assert(VMXINSTRID_IS_VALID(uInstrId));
2456	Assert(VMXINSTRID_GET_ID(uInstrId) == (uInstrId & 0x3));
2457	Assert(GCPtrDisp == 0);
2458	Assert(ExitInstrInfo.RdrandRdseed.u2OperandSize != 3);
2459	ExitInstrInfo.RdrandRdseed.u3Undef0 = 0;
2460	ExitInstrInfo.RdrandRdseed.u4Undef0 = 0;
2461	ExitInstrInfo.RdrandRdseed.u19Undef0 = 0;
2462	break;
2463	}
2464	}
2465
2466	/* Update displacement and return the constructed VM-exit instruction information field. */
2467	if (pGCPtrDisp)
2468	*pGCPtrDisp = GCPtrDisp;
2469
2470	return ExitInstrInfo.u;
2471	}
2472
2473
2474	/**
2475	* VMX VM-exit handler.
2476	*
2477	* @returns Strict VBox status code.
2478	* @retval VINF_VMX_VMEXIT when the VM-exit is successful.
2479	* @retval VINF_EM_TRIPLE_FAULT when VM-exit is unsuccessful and leads to a
2480	* triple-fault.
2481	*
2482	* @param pVCpu The cross context virtual CPU structure.
2483	* @param uExitReason The VM-exit reason.
2484	* @param u64ExitQual The Exit qualification.
2485	*
2486	* @remarks We need not necessarily have completed VM-entry before a VM-exit is
2487	* called. Failures during VM-entry can cause VM-exits as well, so we
2488	* -cannot- assert we're in VMX non-root mode here.
2489	*/
2490	VBOXSTRICTRC iemVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual) RT_NOEXCEPT
2491	{
2492	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
2493	RT_NOREF3(pVCpu, uExitReason, u64ExitQual);
2494	AssertMsgFailed(("VM-exit should only be invoked from ring-3 when nested-guest executes only in ring-3!\n"));
2495	return VERR_IEM_IPE_7;
2496	# else
2497	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
2498
2499	/* Just count this as an exit and be done with that. */
2500	pVCpu->iem.s.cPotentialExits++;
2501
2502	/*
2503	* Import all the guest-CPU state.
2504	*
2505	* HM on returning to guest execution would have to reset up a whole lot of state
2506	* anyway, (e.g., VM-entry/VM-exit controls) and we do not ever import a part of
2507	* the state and flag reloading the entire state on re-entry. So import the entire
2508	* state here, see HMNotifyVmxNstGstVmexit() for more comments.
2509	*/
2510	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL);
2511
2512	/*
2513	* Ensure VM-entry interruption information valid bit is cleared.
2514	*
2515	* We do it here on every VM-exit so that even premature VM-exits (e.g. those caused
2516	* by invalid-guest state or machine-check exceptions) also clear this bit.
2517	*
2518	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry control fields".
2519	*/
2520	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
2521	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
2522
2523	/*
2524	* Update the VM-exit reason and Exit qualification.
2525	* Other VMCS read-only data fields are expected to be updated by the caller already.
2526	*/
2527	pVmcs->u32RoExitReason = uExitReason;
2528	pVmcs->u64RoExitQual.u = u64ExitQual;
2529
2530	Log2(("vmexit: reason=%u qual=%#RX64 cs:rip=%04x:%08RX64 cr0=%#RX64 cr3=%#RX64 cr4=%#RX64 eflags=%#RX32\n", uExitReason,
2531	pVmcs->u64RoExitQual.u, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
2532	pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.eflags.u));
2533
2534	/*
2535	* Update the IDT-vectoring information fields if the VM-exit is triggered during delivery of an event.
2536	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2537	*/
2538	{
2539	uint8_t uVector;
2540	uint32_t fFlags;
2541	uint32_t uErrCode;
2542	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, &uVector, &fFlags, &uErrCode, NULL /* puCr2 */);
2543	if (fInEventDelivery)
2544	{
2545	/*
2546	* A VM-exit is not considered to occur during event delivery when the VM-exit is
2547	* caused by a triple-fault or the original event results in a double-fault that
2548	* causes the VM exit directly (exception bitmap). Therefore, we must not set the
2549	* original event information into the IDT-vectoring information fields.
2550	*
2551	* See Intel spec. 27.2.4 "Information for VM Exits During Event Delivery".
2552	*/
2553	if ( uExitReason != VMX_EXIT_TRIPLE_FAULT
2554	&& ( uExitReason != VMX_EXIT_XCPT_OR_NMI
2555	\|\| !VMX_EXIT_INT_INFO_IS_XCPT_DF(pVmcs->u32RoExitIntInfo)))
2556	{
2557	uint8_t const uIdtVectoringType = iemVmxGetEventType(uVector, fFlags);
2558	uint8_t const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
2559	uint32_t const uIdtVectoringInfo = RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VECTOR, uVector)
2560	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_TYPE, uIdtVectoringType)
2561	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_ERR_CODE_VALID, fErrCodeValid)
2562	\| RT_BF_MAKE(VMX_BF_IDT_VECTORING_INFO_VALID, 1);
2563	iemVmxVmcsSetIdtVectoringInfo(pVCpu, uIdtVectoringInfo);
2564	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, uErrCode);
2565	Log2(("vmexit: idt_info=%#RX32 idt_err_code=%#RX32 cr2=%#RX64\n", uIdtVectoringInfo, uErrCode,
2566	pVCpu->cpum.GstCtx.cr2));
2567	}
2568	}
2569	}
2570
2571	/* The following VMCS fields should always be zero since we don't support injecting SMIs into a guest. */
2572	Assert(pVmcs->u64RoIoRcx.u == 0);
2573	Assert(pVmcs->u64RoIoRsi.u == 0);
2574	Assert(pVmcs->u64RoIoRdi.u == 0);
2575	Assert(pVmcs->u64RoIoRip.u == 0);
2576
2577	/*
2578	* Save the guest state back into the VMCS.
2579	* We only need to save the state when the VM-entry was successful.
2580	*/
2581	bool const fVmentryFailed = VMX_EXIT_REASON_HAS_ENTRY_FAILED(uExitReason);
2582	if (!fVmentryFailed)
2583	{
2584	/* We should not cause an NMI-window/interrupt-window VM-exit when injecting events as part of VM-entry. */
2585	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
2586	{
2587	Assert(uExitReason != VMX_EXIT_NMI_WINDOW);
2588	Assert(uExitReason != VMX_EXIT_INT_WINDOW);
2589	}
2590
2591	/* For exception or NMI VM-exits, the VM-exit interruption info. field must be valid. */
2592	Assert(uExitReason != VMX_EXIT_XCPT_OR_NMI \|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2593
2594	/* For external interrupts that occur while "acknowledge interrupt on exit" VM-exit is set,
2595	the VM-exit interruption info. field must be valid. */
2596	Assert( uExitReason != VMX_EXIT_EXT_INT
2597	\|\| !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
2598	\|\| VMX_EXIT_INT_INFO_IS_VALID(pVmcs->u32RoExitIntInfo));
2599
2600	/*
2601	* If we support storing EFER.LMA into IA32e-mode guest field on VM-exit, we need to do that now.
2602	* See Intel spec. 27.2 "Recording VM-exit Information And Updating VM-entry Control".
2603	*
2604	* It is not clear from the Intel spec. if this is done only when VM-entry succeeds.
2605	* If a VM-exit happens before loading guest EFER, we risk restoring the host EFER.LMA
2606	* as guest-CPU state would not been modified. Hence for now, we do this only when
2607	* the VM-entry succeeded.
2608	*/
2609	/** @todo r=ramshankar: Figure out if this bit gets set to host EFER.LMA on real
2610	* hardware when VM-exit fails during VM-entry (e.g. VERR_VMX_INVALID_GUEST_STATE). */
2611	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxExitSaveEferLma)
2612	{
2613	if (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LMA)
2614	pVmcs->u32EntryCtls \|= VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2615	else
2616	pVmcs->u32EntryCtls &= ~VMX_ENTRY_CTLS_IA32E_MODE_GUEST;
2617	}
2618
2619	/*
2620	* The rest of the high bits of the VM-exit reason are only relevant when the VM-exit
2621	* occurs in enclave mode/SMM which we don't support yet.
2622	*
2623	* If we ever add support for it, we can pass just the lower bits to the functions
2624	* below, till then an assert should suffice.
2625	*/
2626	Assert(!RT_HI_U16(uExitReason));
2627
2628	/* Save the guest state into the VMCS and restore guest MSRs from the auto-store guest MSR area. */
2629	iemVmxVmexitSaveGuestState(pVCpu, uExitReason);
2630	int rc = iemVmxVmexitSaveGuestAutoMsrs(pVCpu, uExitReason);
2631	if (RT_SUCCESS(rc))
2632	{ /* likely */ }
2633	else
2634	return iemVmxAbort(pVCpu, VMXABORT_SAVE_GUEST_MSRS);
2635
2636	/* Clear any saved NMI-blocking state so we don't assert on next VM-entry (if it was in effect on the previous one). */
2637	pVCpu->cpum.GstCtx.hwvirt.fSavedInhibit &= ~CPUMCTX_INHIBIT_NMI;
2638	}
2639	else
2640	{
2641	/* Restore the NMI-blocking state if VM-entry failed due to invalid guest state or while loading MSRs. */
2642	uint32_t const uExitReasonBasic = VMX_EXIT_REASON_BASIC(uExitReason);
2643	if ( uExitReasonBasic == VMX_EXIT_ERR_INVALID_GUEST_STATE
2644	\|\| uExitReasonBasic == VMX_EXIT_ERR_MSR_LOAD)
2645	iemVmxVmexitRestoreNmiBlockingFF(pVCpu);
2646	}
2647
2648	/*
2649	* Stop any running VMX-preemption timer if necessary.
2650	*/
2651	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
2652	CPUMStopGuestVmxPremptTimer(pVCpu);
2653
2654	/*
2655	* Clear the state of "NMI unblocked due to IRET" as otherwise we risk
2656	* reporting a stale state on a subsequent VM-exit. This state will be
2657	* re-established while emulating IRET in VMX non-root mode.
2658	*/
2659	pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = false;
2660
2661	/*
2662	* Clear any pending VMX nested-guest force-flags.
2663	* These force-flags have no effect on (outer) guest execution and will
2664	* be re-evaluated and setup on the next nested-guest VM-entry.
2665	*/
2666	VMCPU_FF_CLEAR_MASK(pVCpu, VMCPU_FF_VMX_ALL_MASK);
2667
2668	/*
2669	* We're no longer in nested-guest execution mode.
2670	*
2671	* It is important to do this prior to loading the host state because
2672	* PGM looks at fInVmxNonRootMode to determine if it needs to perform
2673	* second-level address translation while switching to host CR3.
2674	*/
2675	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = false;
2676
2677	/* Restore the host (outer guest) state. */
2678	VBOXSTRICTRC rcStrict = iemVmxVmexitLoadHostState(pVCpu, uExitReason);
2679	if (RT_SUCCESS(rcStrict))
2680	{
2681	Assert(rcStrict == VINF_SUCCESS);
2682	rcStrict = VINF_VMX_VMEXIT;
2683	}
2684	else
2685	Log(("vmexit: Loading host-state failed. uExitReason=%u rc=%Rrc\n", uExitReason, VBOXSTRICTRC_VAL(rcStrict)));
2686
2687	/*
2688	* Restore non-zero Secondary-processor based VM-execution controls
2689	* when the "activate secondary controls" bit was not set.
2690	*/
2691	if (pVmcs->u32RestoreProcCtls2)
2692	{
2693	Assert(!(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS));
2694	pVmcs->u32ProcCtls2 = pVmcs->u32RestoreProcCtls2;
2695	pVmcs->u32RestoreProcCtls2 = 0;
2696	}
2697
2698	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
2699	{
2700	/* Notify HM that the current VMCS fields have been modified. */
2701	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
2702
2703	/* Notify HM that we've completed the VM-exit. */
2704	HMNotifyVmxNstGstVmexit(pVCpu);
2705	}
2706
2707	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
2708	/* Revert any IEM-only nested-guest execution policy, otherwise return rcStrict. */
2709	Log(("vmexit: Disabling IEM-only EM execution policy!\n"));
2710	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, false);
2711	if (rcSched != VINF_SUCCESS)
2712	iemSetPassUpStatus(pVCpu, rcSched);
2713	# endif
2714	return rcStrict;
2715	# endif
2716	}
2717
2718
2719	/**
2720	* VMX VM-exit handler for VM-exits due to instruction execution.
2721	*
2722	* This is intended for instructions where the caller provides all the relevant
2723	* VM-exit information.
2724	*
2725	* @returns Strict VBox status code.
2726	* @param pVCpu The cross context virtual CPU structure.
2727	* @param pExitInfo Pointer to the VM-exit information.
2728	*/
2729	static VBOXSTRICTRC iemVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
2730	{
2731	/*
2732	* For instructions where any of the following fields are not applicable:
2733	* - Exit qualification must be cleared.
2734	* - VM-exit instruction info. is undefined.
2735	* - Guest-linear address is undefined.
2736	* - Guest-physical address is undefined.
2737	*
2738	* The VM-exit instruction length is mandatory for all VM-exits that are caused by
2739	* instruction execution. For VM-exits that are not due to instruction execution this
2740	* field is undefined.
2741	*
2742	* In our implementation in IEM, all undefined fields are generally cleared. However,
2743	* if the caller supplies information (from say the physical CPU directly) it is
2744	* then possible that the undefined fields are not cleared.
2745	*
2746	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2747	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
2748	*/
2749	Assert(pExitInfo);
2750	AssertMsg(pExitInfo->uReason <= VMX_EXIT_MAX, ("uReason=%u\n", pExitInfo->uReason));
2751	AssertMsg(pExitInfo->cbInstr >= 1 && pExitInfo->cbInstr <= 15,
2752	("uReason=%u cbInstr=%u\n", pExitInfo->uReason, pExitInfo->cbInstr));
2753
2754	/* Update all the relevant fields from the VM-exit instruction information struct. */
2755	iemVmxVmcsSetExitInstrInfo(pVCpu, pExitInfo->InstrInfo.u);
2756	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
2757	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
2758	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
2759
2760	/* Perform the VM-exit. */
2761	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
2762	}
2763
2764
2765	/**
2766	* VMX VM-exit handler for VM-exits due to instruction execution.
2767	*
2768	* This is intended for instructions that only provide the VM-exit instruction
2769	* length.
2770	*
2771	* @param pVCpu The cross context virtual CPU structure.
2772	* @param uExitReason The VM-exit reason.
2773	* @param cbInstr The instruction length in bytes.
2774	*/
2775	VBOXSTRICTRC iemVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr) RT_NOEXCEPT
2776	{
2777	#ifdef VBOX_STRICT
2778	/*
2779	* To prevent us from shooting ourselves in the foot.
2780	* The follow instructions should convey more than just the instruction length.
2781	*/
2782	switch (uExitReason)
2783	{
2784	case VMX_EXIT_INVEPT:
2785	case VMX_EXIT_INVPCID:
2786	case VMX_EXIT_INVVPID:
2787	case VMX_EXIT_LDTR_TR_ACCESS:
2788	case VMX_EXIT_GDTR_IDTR_ACCESS:
2789	case VMX_EXIT_VMCLEAR:
2790	case VMX_EXIT_VMPTRLD:
2791	case VMX_EXIT_VMPTRST:
2792	case VMX_EXIT_VMREAD:
2793	case VMX_EXIT_VMWRITE:
2794	case VMX_EXIT_VMXON:
2795	case VMX_EXIT_XRSTORS:
2796	case VMX_EXIT_XSAVES:
2797	case VMX_EXIT_RDRAND:
2798	case VMX_EXIT_RDSEED:
2799	case VMX_EXIT_IO_INSTR:
2800	AssertMsgFailedReturn(("Use iemVmxVmexitInstrNeedsInfo for uExitReason=%u\n", uExitReason), VERR_IEM_IPE_5);
2801	break;
2802	}
2803	#endif
2804
2805	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_INSTR_LEN(uExitReason, cbInstr);
2806	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2807	}
2808
2809
2810	/**
2811	* Interface for HM and EM to emulate VM-exit due to a triple-fault.
2812	*
2813	* @returns Strict VBox status code.
2814	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2815	* @thread EMT(pVCpu)
2816	*/
2817	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTripleFault(PVMCPUCC pVCpu)
2818	{
2819	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_TRIPLE_FAULT, 0 /* u64ExitQual */);
2820	Assert(!pVCpu->iem.s.cActiveMappings);
2821	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2822	}
2823
2824
2825	/**
2826	* Interface for HM and EM to emulate VM-exit due to startup-IPI (SIPI).
2827	*
2828	* @returns Strict VBox status code.
2829	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2830	* @param uVector The SIPI vector.
2831	* @thread EMT(pVCpu)
2832	*/
2833	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitStartupIpi(PVMCPUCC pVCpu, uint8_t uVector)
2834	{
2835	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_SIPI, uVector);
2836	Assert(!pVCpu->iem.s.cActiveMappings);
2837	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2838	}
2839
2840
2841	/**
2842	* Interface for HM and EM to emulate a VM-exit.
2843	*
2844	* If a specialized version of a VM-exit handler exists, that must be used instead.
2845	*
2846	* @returns Strict VBox status code.
2847	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2848	* @param uExitReason The VM-exit reason.
2849	* @param u64ExitQual The Exit qualification.
2850	* @thread EMT(pVCpu)
2851	*/
2852	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexit(PVMCPUCC pVCpu, uint32_t uExitReason, uint64_t u64ExitQual)
2853	{
2854	VBOXSTRICTRC rcStrict = iemVmxVmexit(pVCpu, uExitReason, u64ExitQual);
2855	Assert(!pVCpu->iem.s.cActiveMappings);
2856	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2857	}
2858
2859
2860	/**
2861	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2862	*
2863	* This is meant to be used for those instructions that VMX provides additional
2864	* decoding information beyond just the instruction length!
2865	*
2866	* @returns Strict VBox status code.
2867	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2868	* @param pExitInfo Pointer to the VM-exit information.
2869	* @thread EMT(pVCpu)
2870	*/
2871	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstrWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
2872	{
2873	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
2874	Assert(!pVCpu->iem.s.cActiveMappings);
2875	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2876	}
2877
2878
2879	/**
2880	* Interface for HM and EM to emulate a VM-exit due to an instruction.
2881	*
2882	* This is meant to be used for those instructions that VMX provides only the
2883	* instruction length.
2884	*
2885	* @returns Strict VBox status code.
2886	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
2887	* @param pExitInfo Pointer to the VM-exit information.
2888	* @param cbInstr The instruction length in bytes.
2889	* @thread EMT(pVCpu)
2890	*/
2891	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitInstr(PVMCPUCC pVCpu, uint32_t uExitReason, uint8_t cbInstr)
2892	{
2893	VBOXSTRICTRC rcStrict = iemVmxVmexitInstr(pVCpu, uExitReason, cbInstr);
2894	Assert(!pVCpu->iem.s.cActiveMappings);
2895	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
2896	}
2897
2898
2899	/**
2900	* VMX VM-exit handler for VM-exits due to instruction execution.
2901	*
2902	* This is intended for instructions that have a ModR/M byte and update the VM-exit
2903	* instruction information and Exit qualification fields.
2904	*
2905	* @param pVCpu The cross context virtual CPU structure.
2906	* @param uExitReason The VM-exit reason.
2907	* @param uInstrid The instruction identity (VMXINSTRID_XXX).
2908	* @param cbInstr The instruction length in bytes.
2909	*
2910	* @remarks Do not use this for INS/OUTS instruction.
2911	*/
2912	VBOXSTRICTRC iemVmxVmexitInstrNeedsInfo(PVMCPUCC pVCpu, uint32_t uExitReason, VMXINSTRID uInstrId, uint8_t cbInstr) RT_NOEXCEPT
2913	{
2914	#ifdef VBOX_STRICT
2915	/*
2916	* To prevent us from shooting ourselves in the foot.
2917	* The follow instructions convey specific info that require using their respective handlers.
2918	*/
2919	switch (uExitReason)
2920	{
2921	case VMX_EXIT_INVEPT:
2922	case VMX_EXIT_INVPCID:
2923	case VMX_EXIT_INVVPID:
2924	case VMX_EXIT_LDTR_TR_ACCESS:
2925	case VMX_EXIT_GDTR_IDTR_ACCESS:
2926	case VMX_EXIT_VMCLEAR:
2927	case VMX_EXIT_VMPTRLD:
2928	case VMX_EXIT_VMPTRST:
2929	case VMX_EXIT_VMREAD:
2930	case VMX_EXIT_VMWRITE:
2931	case VMX_EXIT_VMXON:
2932	case VMX_EXIT_XRSTORS:
2933	case VMX_EXIT_XSAVES:
2934	case VMX_EXIT_RDRAND:
2935	case VMX_EXIT_RDSEED:
2936	break;
2937	default:
2938	AssertMsgFailedReturn(("Use instruction-specific handler\n"), VERR_IEM_IPE_5);
2939	break;
2940	}
2941	#endif
2942
2943	/*
2944	* Update the Exit qualification field with displacement bytes.
2945	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
2946	*/
2947	/* Construct the VM-exit instruction information. */
2948	RTGCPTR GCPtrDisp;
2949	uint32_t const uInstrInfo = iemVmxGetExitInstrInfo(pVCpu, uExitReason, uInstrId, &GCPtrDisp);
2950
2951	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO(uExitReason, GCPtrDisp, uInstrInfo, cbInstr);
2952	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2953	}
2954
2955
2956	/**
2957	* VMX VM-exit handler for VM-exits due to INVLPG.
2958	*
2959	* @returns Strict VBox status code.
2960	* @param pVCpu The cross context virtual CPU structure.
2961	* @param GCPtrPage The guest-linear address of the page being invalidated.
2962	* @param cbInstr The instruction length in bytes.
2963	*/
2964	VBOXSTRICTRC iemVmxVmexitInstrInvlpg(PVMCPUCC pVCpu, RTGCPTR GCPtrPage, uint8_t cbInstr) RT_NOEXCEPT
2965	{
2966	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_INVLPG, GCPtrPage, cbInstr);
2967	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(ExitInfo.u64Qual));
2968	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
2969	}
2970
2971
2972	/**
2973	* VMX VM-exit handler for VM-exits due to LMSW.
2974	*
2975	* @returns Strict VBox status code.
2976	* @param pVCpu The cross context virtual CPU structure.
2977	* @param uGuestCr0 The current guest CR0.
2978	* @param pu16NewMsw The machine-status word specified in LMSW's source
2979	* operand. This will be updated depending on the VMX
2980	* guest/host CR0 mask if LMSW is not intercepted.
2981	* @param GCPtrEffDst The guest-linear address of the source operand in case
2982	* of a memory operand. For register operand, pass
2983	* NIL_RTGCPTR.
2984	* @param cbInstr The instruction length in bytes.
2985	*/
2986	VBOXSTRICTRC iemVmxVmexitInstrLmsw(PVMCPUCC pVCpu, uint32_t uGuestCr0, uint16_t *pu16NewMsw,
2987	RTGCPTR GCPtrEffDst, uint8_t cbInstr) RT_NOEXCEPT
2988	{
2989	Assert(pu16NewMsw);
2990
2991	uint16_t const uNewMsw = *pu16NewMsw;
2992	if (CPUMIsGuestVmxLmswInterceptSet(&pVCpu->cpum.GstCtx, uNewMsw))
2993	{
2994	Log2(("lmsw: Guest intercept -> VM-exit\n"));
2995	bool const fMemOperand = RT_BOOL(GCPtrEffDst != NIL_RTGCPTR);
2996	VMXVEXITINFO ExitInfo
2997	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
2998	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
2999	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_OP, fMemOperand)
3000	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_LMSW_DATA, uNewMsw)
3001	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_LMSW),
3002	cbInstr);
3003	if (fMemOperand)
3004	{
3005	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode \|\| !RT_HI_U32(GCPtrEffDst));
3006	ExitInfo.u64GuestLinearAddr = GCPtrEffDst;
3007	}
3008	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3009	}
3010
3011	/*
3012	* If LMSW did not cause a VM-exit, any CR0 bits in the range 0:3 that is set in the
3013	* CR0 guest/host mask must be left unmodified.
3014	*
3015	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3016	*/
3017	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3018	uint32_t const fGstHostLmswMask = fGstHostMask & (X86_CR0_PE \| X86_CR0_MP \| X86_CR0_EM \| X86_CR0_TS);
3019	*pu16NewMsw = (uGuestCr0 & fGstHostLmswMask) \| (uNewMsw & ~fGstHostLmswMask);
3020
3021	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3022	}
3023
3024
3025	/**
3026	* VMX VM-exit handler for VM-exits due to CLTS.
3027	*
3028	* @returns Strict VBox status code.
3029	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the CLTS instruction did not cause a
3030	* VM-exit but must not modify the guest CR0.TS bit.
3031	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the CLTS instruction did not cause a
3032	* VM-exit and modification to the guest CR0.TS bit is allowed (subject to
3033	* CR0 fixed bits in VMX operation).
3034	* @param pVCpu The cross context virtual CPU structure.
3035	* @param cbInstr The instruction length in bytes.
3036	*/
3037	VBOXSTRICTRC iemVmxVmexitInstrClts(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3038	{
3039	/*
3040	* If CR0.TS is owned by the host:
3041	* - If CR0.TS is set in the read-shadow, we must cause a VM-exit.
3042	* - If CR0.TS is cleared in the read-shadow, no VM-exit is caused and the
3043	* CLTS instruction completes without clearing CR0.TS.
3044	*
3045	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3046	*/
3047	uint32_t const fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3048	if (fGstHostMask & X86_CR0_TS)
3049	{
3050	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0ReadShadow.u & X86_CR0_TS)
3051	{
3052	Log2(("clts: Guest intercept -> VM-exit\n"));
3053	VMXVEXITINFO const ExitInfo
3054	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3055	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 0) /* CR0 */
3056	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3057	VMX_EXIT_QUAL_CRX_ACCESS_CLTS),
3058	cbInstr);
3059	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3060	}
3061	return VINF_VMX_MODIFIES_BEHAVIOR;
3062	}
3063
3064	/*
3065	* If CR0.TS is not owned by the host, the CLTS instructions operates normally
3066	* and may modify CR0.TS (subject to CR0 fixed bits in VMX operation).
3067	*/
3068	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3069	}
3070
3071
3072	/**
3073	* VMX VM-exit handler for VM-exits due to 'Mov CR0,GReg' and 'Mov CR4,GReg'
3074	* (CR0/CR4 write).
3075	*
3076	* @returns Strict VBox status code.
3077	* @param pVCpu The cross context virtual CPU structure.
3078	* @param iCrReg The control register (either CR0 or CR4).
3079	* @param uGuestCrX The current guest CR0/CR4.
3080	* @param puNewCrX Pointer to the new CR0/CR4 value. Will be updated if no
3081	* VM-exit is caused.
3082	* @param iGReg The general register from which the CR0/CR4 value is being
3083	* loaded.
3084	* @param cbInstr The instruction length in bytes.
3085	*/
3086	VBOXSTRICTRC iemVmxVmexitInstrMovToCr0Cr4(PVMCPUCC pVCpu, uint8_t iCrReg, uint64_t *puNewCrX,
3087	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3088	{
3089	Assert(puNewCrX);
3090	Assert(iCrReg == 0 \|\| iCrReg == 4);
3091	Assert(iGReg < X86_GREG_COUNT);
3092
3093	uint64_t const uNewCrX = *puNewCrX;
3094	if (CPUMIsGuestVmxMovToCr0Cr4InterceptSet(&pVCpu->cpum.GstCtx, iCrReg, uNewCrX))
3095	{
3096	Log2(("mov_Cr_Rd: (CR%u) Guest intercept -> VM-exit\n", iCrReg));
3097	VMXVEXITINFO const ExitInfo
3098	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3099	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, iCrReg)
3100	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3101	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3102	cbInstr);
3103	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3104	}
3105
3106	/*
3107	* If the Mov-to-CR0/CR4 did not cause a VM-exit, any bits owned by the host
3108	* must not be modified the instruction.
3109	*
3110	* See Intel Spec. 25.3 "Changes To Instruction Behavior In VMX Non-root Operation".
3111	*/
3112	uint64_t uGuestCrX;
3113	uint64_t fGstHostMask;
3114	if (iCrReg == 0)
3115	{
3116	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
3117	uGuestCrX = pVCpu->cpum.GstCtx.cr0;
3118	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr0Mask.u;
3119	}
3120	else
3121	{
3122	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
3123	uGuestCrX = pVCpu->cpum.GstCtx.cr4;
3124	fGstHostMask = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64Cr4Mask.u;
3125	}
3126
3127	puNewCrX = (uGuestCrX & fGstHostMask) \| (puNewCrX & ~fGstHostMask);
3128	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3129	}
3130
3131
3132	/**
3133	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR3' (CR3 read).
3134	*
3135	* @returns VBox strict status code.
3136	* @param pVCpu The cross context virtual CPU structure.
3137	* @param iGReg The general register to which the CR3 value is being stored.
3138	* @param cbInstr The instruction length in bytes.
3139	*/
3140	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr3(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3141	{
3142	Assert(iGReg < X86_GREG_COUNT);
3143	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
3144
3145	/*
3146	* If the CR3-store exiting control is set, we must cause a VM-exit.
3147	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3148	*/
3149	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR3_STORE_EXIT)
3150	{
3151	Log2(("mov_Rd_Cr: (CR3) Guest intercept -> VM-exit\n"));
3152	VMXVEXITINFO const ExitInfo
3153	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3154	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3155	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3156	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3157	cbInstr);
3158	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3159	}
3160	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3161	}
3162
3163
3164	/**
3165	* VMX VM-exit handler for VM-exits due to 'Mov CR3,GReg' (CR3 write).
3166	*
3167	* @returns VBox strict status code.
3168	* @param pVCpu The cross context virtual CPU structure.
3169	* @param uNewCr3 The new CR3 value.
3170	* @param iGReg The general register from which the CR3 value is being
3171	* loaded.
3172	* @param cbInstr The instruction length in bytes.
3173	*/
3174	VBOXSTRICTRC iemVmxVmexitInstrMovToCr3(PVMCPUCC pVCpu, uint64_t uNewCr3, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3175	{
3176	Assert(iGReg < X86_GREG_COUNT);
3177
3178	/*
3179	* If the CR3-load exiting control is set and the new CR3 value does not
3180	* match any of the CR3-target values in the VMCS, we must cause a VM-exit.
3181	*
3182	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3183	*/
3184	if (CPUMIsGuestVmxMovToCr3InterceptSet(pVCpu, uNewCr3))
3185	{
3186	Log2(("mov_Cr_Rd: (CR3) Guest intercept -> VM-exit\n"));
3187	VMXVEXITINFO const ExitInfo
3188	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3189	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 3) /* CR3 */
3190	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3191	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS,
3192	VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3193	cbInstr);
3194	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3195	}
3196	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3197	}
3198
3199
3200	/**
3201	* VMX VM-exit handler for VM-exits due to 'Mov GReg,CR8' (CR8 read).
3202	*
3203	* @returns VBox strict status code.
3204	* @param pVCpu The cross context virtual CPU structure.
3205	* @param iGReg The general register to which the CR8 value is being stored.
3206	* @param cbInstr The instruction length in bytes.
3207	*/
3208	VBOXSTRICTRC iemVmxVmexitInstrMovFromCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3209	{
3210	Assert(iGReg < X86_GREG_COUNT);
3211
3212	/*
3213	* If the CR8-store exiting control is set, we must cause a VM-exit.
3214	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3215	*/
3216	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_STORE_EXIT)
3217	{
3218	Log2(("mov_Rd_Cr: (CR8) Guest intercept -> VM-exit\n"));
3219	VMXVEXITINFO const ExitInfo
3220	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3221	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3222	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3223	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_READ),
3224	cbInstr);
3225	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3226	}
3227	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3228	}
3229
3230
3231	/**
3232	* VMX VM-exit handler for VM-exits due to 'Mov CR8,GReg' (CR8 write).
3233	*
3234	* @returns VBox strict status code.
3235	* @param pVCpu The cross context virtual CPU structure.
3236	* @param iGReg The general register from which the CR8 value is being
3237	* loaded.
3238	* @param cbInstr The instruction length in bytes.
3239	*/
3240	VBOXSTRICTRC iemVmxVmexitInstrMovToCr8(PVMCPUCC pVCpu, uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3241	{
3242	Assert(iGReg < X86_GREG_COUNT);
3243
3244	/*
3245	* If the CR8-load exiting control is set, we must cause a VM-exit.
3246	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3247	*/
3248	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_CR8_LOAD_EXIT)
3249	{
3250	Log2(("mov_Cr_Rd: (CR8) Guest intercept -> VM-exit\n"));
3251	VMXVEXITINFO const ExitInfo
3252	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_CRX,
3253	RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_REGISTER, 8) /* CR8 */
3254	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_GENREG, iGReg)
3255	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_CRX_ACCESS, VMX_EXIT_QUAL_CRX_ACCESS_WRITE),
3256	cbInstr);
3257	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3258	}
3259	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3260	}
3261
3262
3263	/**
3264	* VMX VM-exit handler for VM-exits due to 'Mov DRx,GReg' (DRx write) and 'Mov
3265	* GReg,DRx' (DRx read).
3266	*
3267	* @returns VBox strict status code.
3268	* @param pVCpu The cross context virtual CPU structure.
3269	* @param uInstrid The instruction identity (VMXINSTRID_MOV_TO_DRX or
3270	* VMXINSTRID_MOV_FROM_DRX).
3271	* @param iDrReg The debug register being accessed.
3272	* @param iGReg The general register to/from which the DRx value is being
3273	* store/loaded.
3274	* @param cbInstr The instruction length in bytes.
3275	*/
3276	VBOXSTRICTRC iemVmxVmexitInstrMovDrX(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint8_t iDrReg,
3277	uint8_t iGReg, uint8_t cbInstr) RT_NOEXCEPT
3278	{
3279	Assert(iDrReg <= 7);
3280	Assert(uInstrId == VMXINSTRID_MOV_TO_DRX \|\| uInstrId == VMXINSTRID_MOV_FROM_DRX);
3281	Assert(iGReg < X86_GREG_COUNT);
3282
3283	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_MOV_DR_EXIT)
3284	{
3285	VMXVEXITINFO const ExitInfo
3286	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MOV_DRX,
3287	RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_REGISTER, iDrReg)
3288	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_GENREG, iGReg)
3289	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_DRX_DIRECTION,
3290	uInstrId == VMXINSTRID_MOV_TO_DRX
3291	? VMX_EXIT_QUAL_DRX_DIRECTION_WRITE
3292	: VMX_EXIT_QUAL_DRX_DIRECTION_READ),
3293	cbInstr);
3294	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3295	}
3296
3297	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3298	}
3299
3300
3301	/**
3302	* VMX VM-exit handler for VM-exits due to I/O instructions (IN and OUT).
3303	*
3304	* @returns VBox strict status code.
3305	* @param pVCpu The cross context virtual CPU structure.
3306	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_IN or
3307	* VMXINSTRID_IO_OUT).
3308	* @param u16Port The I/O port being accessed.
3309	* @param fImm Whether the I/O port was encoded using an immediate operand
3310	* or the implicit DX register.
3311	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3312	* @param cbInstr The instruction length in bytes.
3313	*/
3314	VBOXSTRICTRC iemVmxVmexitInstrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port,
3315	bool fImm, uint8_t cbAccess, uint8_t cbInstr) RT_NOEXCEPT
3316	{
3317	Assert(uInstrId == VMXINSTRID_IO_IN \|\| uInstrId == VMXINSTRID_IO_OUT);
3318	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3319
3320	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3321	{
3322	VMXVEXITINFO const ExitInfo
3323	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_IO_INSTR,
3324	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3325	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING, fImm)
3326	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port)
3327	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION,
3328	uInstrId == VMXINSTRID_IO_IN
3329	? VMX_EXIT_QUAL_IO_DIRECTION_IN
3330	: VMX_EXIT_QUAL_IO_DIRECTION_OUT),
3331	cbInstr);
3332	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3333	}
3334	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3335	}
3336
3337
3338	/**
3339	* VMX VM-exit handler for VM-exits due to string I/O instructions (INS and OUTS).
3340	*
3341	* @returns VBox strict status code.
3342	* @param pVCpu The cross context virtual CPU structure.
3343	* @param uInstrId The VM-exit instruction identity (VMXINSTRID_IO_INS or
3344	* VMXINSTRID_IO_OUTS).
3345	* @param u16Port The I/O port being accessed.
3346	* @param cbAccess The size of the I/O access in bytes (1, 2 or 4 bytes).
3347	* @param fRep Whether the instruction has a REP prefix or not.
3348	* @param ExitInstrInfo The VM-exit instruction info. field.
3349	* @param cbInstr The instruction length in bytes.
3350	*/
3351	VBOXSTRICTRC iemVmxVmexitInstrStrIo(PVMCPUCC pVCpu, VMXINSTRID uInstrId, uint16_t u16Port, uint8_t cbAccess,
3352	bool fRep, VMXEXITINSTRINFO ExitInstrInfo, uint8_t cbInstr) RT_NOEXCEPT
3353	{
3354	Assert(uInstrId == VMXINSTRID_IO_INS \|\| uInstrId == VMXINSTRID_IO_OUTS);
3355	Assert(cbAccess == 1 \|\| cbAccess == 2 \|\| cbAccess == 4);
3356	Assert(ExitInstrInfo.StrIo.iSegReg < X86_SREG_COUNT);
3357	Assert(ExitInstrInfo.StrIo.u3AddrSize == 0 \|\| ExitInstrInfo.StrIo.u3AddrSize == 1 \|\| ExitInstrInfo.StrIo.u3AddrSize == 2);
3358	Assert(uInstrId != VMXINSTRID_IO_INS \|\| ExitInstrInfo.StrIo.iSegReg == X86_SREG_ES);
3359
3360	if (CPUMIsGuestVmxIoInterceptSet(pVCpu, u16Port, cbAccess))
3361	{
3362	/*
3363	* Figure out the guest-linear address and the direction bit (INS/OUTS).
3364	*/
3365	/** @todo r=ramshankar: Is there something in IEM that already does this? */
3366	static uint64_t const s_auAddrSizeMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_C(0xffffffffffffffff) };
3367	uint8_t const iSegReg = ExitInstrInfo.StrIo.iSegReg;
3368	uint8_t const uAddrSize = ExitInstrInfo.StrIo.u3AddrSize;
3369	uint64_t const uAddrSizeMask = s_auAddrSizeMasks[uAddrSize];
3370
3371	uint32_t uDirection;
3372	uint64_t uGuestLinearAddr;
3373	if (uInstrId == VMXINSTRID_IO_INS)
3374	{
3375	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_IN;
3376	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rdi & uAddrSizeMask);
3377	}
3378	else
3379	{
3380	uDirection = VMX_EXIT_QUAL_IO_DIRECTION_OUT;
3381	uGuestLinearAddr = pVCpu->cpum.GstCtx.aSRegs[iSegReg].u64Base + (pVCpu->cpum.GstCtx.rsi & uAddrSizeMask);
3382	}
3383
3384	/*
3385	* If the segment is unusable, the guest-linear address in undefined.
3386	* We shall clear it for consistency.
3387	*
3388	* See Intel spec. 27.2.1 "Basic VM-Exit Information".
3389	*/
3390	if (pVCpu->cpum.GstCtx.aSRegs[iSegReg].Attr.n.u1Unusable)
3391	uGuestLinearAddr = 0;
3392
3393	VMXVEXITINFO const ExitInfo
3394	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_INFO_AND_LIN_ADDR(VMX_EXIT_IO_INSTR,
3395	RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_WIDTH, cbAccess - 1)
3396	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_DIRECTION, uDirection)
3397	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_STRING, 1)
3398	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_IS_REP, fRep)
3399	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_ENCODING,
3400	VMX_EXIT_QUAL_IO_ENCODING_DX)
3401	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_IO_PORT, u16Port),
3402	IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxInsOutInfo
3403	? ExitInstrInfo.u : 0,
3404	cbInstr,
3405	uGuestLinearAddr);
3406	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3407	}
3408
3409	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3410	}
3411
3412
3413	/**
3414	* VMX VM-exit handler for VM-exits due to MWAIT.
3415	*
3416	* @returns VBox strict status code.
3417	* @param pVCpu The cross context virtual CPU structure.
3418	* @param fMonitorHwArmed Whether the address-range monitor hardware is armed.
3419	* @param cbInstr The instruction length in bytes.
3420	*/
3421	VBOXSTRICTRC iemVmxVmexitInstrMwait(PVMCPUCC pVCpu, bool fMonitorHwArmed, uint8_t cbInstr) RT_NOEXCEPT
3422	{
3423	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_MWAIT, fMonitorHwArmed, cbInstr);
3424	return iemVmxVmexitInstrWithInfo(pVCpu, &ExitInfo);
3425	}
3426
3427
3428	/**
3429	* VMX VM-exit handler for VM-exits due to PAUSE.
3430	*
3431	* @returns VBox strict status code.
3432	* @param pVCpu The cross context virtual CPU structure.
3433	* @param cbInstr The instruction length in bytes.
3434	*/
3435	static VBOXSTRICTRC iemVmxVmexitInstrPause(PVMCPUCC pVCpu, uint8_t cbInstr) RT_NOEXCEPT
3436	{
3437	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
3438
3439	/*
3440	* The PAUSE VM-exit is controlled by the "PAUSE exiting" control and the
3441	* "PAUSE-loop exiting" control.
3442	*
3443	* The PLE-Gap is the maximum number of TSC ticks between two successive executions of
3444	* the PAUSE instruction before we cause a VM-exit. The PLE-Window is the maximum amount
3445	* of TSC ticks the guest is allowed to execute in a pause loop before we must cause
3446	* a VM-exit.
3447	*
3448	* See Intel spec. 24.6.13 "Controls for PAUSE-Loop Exiting".
3449	* See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
3450	*/
3451	bool fIntercept = false;
3452	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_PAUSE_EXIT)
3453	fIntercept = true;
3454	else if ( (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PAUSE_LOOP_EXIT)
3455	&& IEM_GET_CPL(pVCpu) == 0)
3456	{
3457	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3458
3459	/*
3460	* A previous-PAUSE-tick value of 0 is used to identify the first time
3461	* execution of a PAUSE instruction after VM-entry at CPL 0. We must
3462	* consider this to be the first execution of PAUSE in a loop according
3463	* to the Intel.
3464	*
3465	* All subsequent records for the previous-PAUSE-tick we ensure that it
3466	* cannot be zero by OR'ing 1 to rule out the TSC wrap-around cases at 0.
3467	*/
3468	uint64_t *puFirstPauseLoopTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick;
3469	uint64_t *puPrevPauseTick = &pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick;
3470	uint64_t const uTick = TMCpuTickGet(pVCpu);
3471	uint32_t const uPleGap = pVmcs->u32PleGap;
3472	uint32_t const uPleWindow = pVmcs->u32PleWindow;
3473	if ( *puPrevPauseTick == 0
3474	\|\| uTick - *puPrevPauseTick > uPleGap)
3475	*puFirstPauseLoopTick = uTick;
3476	else if (uTick - *puFirstPauseLoopTick > uPleWindow)
3477	fIntercept = true;
3478
3479	*puPrevPauseTick = uTick \| 1;
3480	}
3481
3482	if (fIntercept)
3483	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_PAUSE, cbInstr);
3484
3485	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3486	}
3487
3488
3489	/**
3490	* VMX VM-exit handler for VM-exits due to task switches.
3491	*
3492	* @returns VBox strict status code.
3493	* @param pVCpu The cross context virtual CPU structure.
3494	* @param enmTaskSwitch The cause of the task switch.
3495	* @param SelNewTss The selector of the new TSS.
3496	* @param cbInstr The instruction length in bytes.
3497	*/
3498	VBOXSTRICTRC iemVmxVmexitTaskSwitch(PVMCPUCC pVCpu, IEMTASKSWITCH enmTaskSwitch, RTSEL SelNewTss, uint8_t cbInstr) RT_NOEXCEPT
3499	{
3500	/*
3501	* Task-switch VM-exits are unconditional and provide the Exit qualification.
3502	*
3503	* If the cause of the task switch is due to execution of CALL, IRET or the JMP
3504	* instruction or delivery of the exception generated by one of these instructions
3505	* lead to a task switch through a task gate in the IDT, we need to provide the
3506	* VM-exit instruction length. Any other means of invoking a task switch VM-exit
3507	* leaves the VM-exit instruction length field undefined.
3508	*
3509	* See Intel spec. 25.2 "Other Causes Of VM Exits".
3510	* See Intel spec. 27.2.4 "Information for VM Exits Due to Instruction Execution".
3511	*/
3512	Assert(cbInstr <= 15);
3513
3514	uint8_t uType;
3515	switch (enmTaskSwitch)
3516	{
3517	case IEMTASKSWITCH_CALL: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_CALL; break;
3518	case IEMTASKSWITCH_IRET: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IRET; break;
3519	case IEMTASKSWITCH_JUMP: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_JMP; break;
3520	case IEMTASKSWITCH_INT_XCPT: uType = VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IDT; break;
3521	IEM_NOT_REACHED_DEFAULT_CASE_RET();
3522	}
3523
3524	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_NEW_TSS, SelNewTss)
3525	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_TASK_SWITCH_SOURCE, uType);
3526	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3527	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, u64ExitQual);
3528	}
3529
3530
3531	/**
3532	* VMX VM-exit handler for trap-like VM-exits.
3533	*
3534	* @returns VBox strict status code.
3535	* @param pVCpu The cross context virtual CPU structure.
3536	* @param pExitInfo Pointer to the VM-exit information.
3537	* @param pExitEventInfo Pointer to the VM-exit event information.
3538	*/
3539	static VBOXSTRICTRC iemVmxVmexitTrapLikeWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
3540	{
3541	Assert(VMXIsVmexitTrapLike(pExitInfo->uReason));
3542	iemVmxVmcsSetGuestPendingDbgXcpts(pVCpu, pExitInfo->u64GuestPendingDbgXcpts);
3543	return iemVmxVmexit(pVCpu, pExitInfo->uReason, pExitInfo->u64Qual);
3544	}
3545
3546
3547	/**
3548	* Interface for HM and EM to emulate a trap-like VM-exit (MTF, APIC-write,
3549	* Virtualized-EOI, TPR-below threshold).
3550	*
3551	* @returns Strict VBox status code.
3552	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3553	* @param pExitInfo Pointer to the VM-exit information.
3554	* @thread EMT(pVCpu)
3555	*/
3556	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTrapLike(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
3557	{
3558	Assert(pExitInfo);
3559	VBOXSTRICTRC rcStrict = iemVmxVmexitTrapLikeWithInfo(pVCpu, pExitInfo);
3560	Assert(!pVCpu->iem.s.cActiveMappings);
3561	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3562	}
3563
3564
3565	/**
3566	* VMX VM-exit handler for VM-exits due to task switches.
3567	*
3568	* This is intended for task switches where the caller provides all the relevant
3569	* VM-exit information.
3570	*
3571	* @returns VBox strict status code.
3572	* @param pVCpu The cross context virtual CPU structure.
3573	* @param pExitInfo Pointer to the VM-exit information.
3574	* @param pExitEventInfo Pointer to the VM-exit event information.
3575	*/
3576	static VBOXSTRICTRC iemVmxVmexitTaskSwitchWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
3577	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3578	{
3579	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3580	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3581	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3582	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3583	return iemVmxVmexit(pVCpu, VMX_EXIT_TASK_SWITCH, pExitInfo->u64Qual);
3584	}
3585
3586
3587	/**
3588	* Interface for HM and EM to emulate a VM-exit due to a task switch.
3589	*
3590	* @returns Strict VBox status code.
3591	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3592	* @param pExitInfo Pointer to the VM-exit information.
3593	* @param pExitEventInfo Pointer to the VM-exit event information.
3594	* @thread EMT(pVCpu)
3595	*/
3596	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitTaskSwitch(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3597	{
3598	Assert(pExitInfo);
3599	Assert(pExitEventInfo);
3600	Assert(pExitInfo->uReason == VMX_EXIT_TASK_SWITCH);
3601	VBOXSTRICTRC rcStrict = iemVmxVmexitTaskSwitchWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3602	Assert(!pVCpu->iem.s.cActiveMappings);
3603	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3604	}
3605
3606
3607	/**
3608	* VMX VM-exit handler for VM-exits due to expiring of the preemption timer.
3609	*
3610	* @returns VBox strict status code.
3611	* @param pVCpu The cross context virtual CPU structure.
3612	*/
3613	VBOXSTRICTRC iemVmxVmexitPreemptTimer(PVMCPUCC pVCpu) RT_NOEXCEPT
3614	{
3615	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
3616	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER);
3617
3618	/* Import the hardware virtualization state (for nested-guest VM-entry TSC-tick). */
3619	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
3620
3621	/* Save the VMX-preemption timer value (of 0) back in to the VMCS if the CPU supports this feature. */
3622	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER)
3623	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PreemptTimer = 0;
3624
3625	/* Cause the VMX-preemption timer VM-exit. The Exit qualification MBZ. */
3626	return iemVmxVmexit(pVCpu, VMX_EXIT_PREEMPT_TIMER, 0 /* u64ExitQual */);
3627	}
3628
3629
3630	/**
3631	* Interface for HM and EM to emulate VM-exit due to expiry of the preemption timer.
3632	*
3633	* @returns Strict VBox status code.
3634	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3635	* @thread EMT(pVCpu)
3636	*/
3637	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitPreemptTimer(PVMCPUCC pVCpu)
3638	{
3639	VBOXSTRICTRC rcStrict = iemVmxVmexitPreemptTimer(pVCpu);
3640	Assert(!pVCpu->iem.s.cActiveMappings);
3641	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3642	}
3643
3644
3645	/**
3646	* VMX VM-exit handler for VM-exits due to external interrupts.
3647	*
3648	* @returns VBox strict status code.
3649	* @param pVCpu The cross context virtual CPU structure.
3650	* @param uVector The external interrupt vector (pass 0 if the interrupt
3651	* is still pending since we typically won't know the
3652	* vector).
3653	* @param fIntPending Whether the external interrupt is pending or
3654	* acknowledged in the interrupt controller.
3655	*/
3656	static VBOXSTRICTRC iemVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending) RT_NOEXCEPT
3657	{
3658	Assert(!fIntPending \|\| uVector == 0);
3659
3660	/* The VM-exit is subject to "External interrupt exiting" being set. */
3661	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT)
3662	{
3663	if (fIntPending)
3664	{
3665	/*
3666	* If the interrupt is pending and we don't need to acknowledge the
3667	* interrupt on VM-exit, cause the VM-exit immediately.
3668	*
3669	* See Intel spec 25.2 "Other Causes Of VM Exits".
3670	*/
3671	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT))
3672	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3673
3674	/*
3675	* If the interrupt is pending and we -do- need to acknowledge the interrupt
3676	* on VM-exit, postpone VM-exit till after the interrupt controller has been
3677	* acknowledged that the interrupt has been consumed. Callers would have to call
3678	* us again after getting the vector (and ofc, with fIntPending with false).
3679	*/
3680	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3681	}
3682
3683	/*
3684	* If the interrupt is no longer pending (i.e. it has been acknowledged) and the
3685	* "External interrupt exiting" and "Acknowledge interrupt on VM-exit" controls are
3686	* all set, we need to record the vector of the external interrupt in the
3687	* VM-exit interruption information field. Otherwise, mark this field as invalid.
3688	*
3689	* See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3690	*/
3691	uint32_t uExitIntInfo;
3692	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ExitCtls & VMX_EXIT_CTLS_ACK_EXT_INT)
3693	{
3694	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3695	uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3696	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_EXT_INT)
3697	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3698	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3699	}
3700	else
3701	uExitIntInfo = 0;
3702	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3703
3704	/*
3705	* Cause the VM-exit whether or not the vector has been stored
3706	* in the VM-exit interruption-information field.
3707	*/
3708	return iemVmxVmexit(pVCpu, VMX_EXIT_EXT_INT, 0 /* u64ExitQual */);
3709	}
3710
3711	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3712	}
3713
3714
3715	/**
3716	* Interface for HM and EM to emulate VM-exit due to external interrupts.
3717	*
3718	* @returns Strict VBox status code.
3719	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3720	* @param uVector The external interrupt vector (pass 0 if the external
3721	* interrupt is still pending).
3722	* @param fIntPending Whether the external interrupt is pending or
3723	* acknowledged in the interrupt controller.
3724	* @thread EMT(pVCpu)
3725	*/
3726	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitExtInt(PVMCPUCC pVCpu, uint8_t uVector, bool fIntPending)
3727	{
3728	VBOXSTRICTRC rcStrict = iemVmxVmexitExtInt(pVCpu, uVector, fIntPending);
3729	Assert(!pVCpu->iem.s.cActiveMappings);
3730	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3731	}
3732
3733
3734	/**
3735	* VMX VM-exit handler for VM-exits due to a double fault caused during delivery of
3736	* an event.
3737	*
3738	* @returns VBox strict status code.
3739	* @param pVCpu The cross context virtual CPU structure.
3740	*/
3741	VBOXSTRICTRC iemVmxVmexitEventDoubleFault(PVMCPUCC pVCpu) RT_NOEXCEPT
3742	{
3743	uint32_t const fXcptBitmap = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32XcptBitmap;
3744	if (fXcptBitmap & RT_BIT(X86_XCPT_DF))
3745	{
3746	/*
3747	* The NMI-unblocking due to IRET field need not be set for double faults.
3748	* See Intel spec. 31.7.1.2 "Resuming Guest Software After Handling An Exception".
3749	*/
3750	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, X86_XCPT_DF)
3751	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, VMX_EXIT_INT_INFO_TYPE_HW_XCPT)
3752	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, 1)
3753	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, 0)
3754	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3755	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3756	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, 0 /* u64ExitQual */);
3757	}
3758
3759	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3760	}
3761
3762
3763	/**
3764	* VMX VM-exit handler for VM-exit due to delivery of an events.
3765	*
3766	* This is intended for VM-exit due to exceptions or NMIs where the caller provides
3767	* all the relevant VM-exit information.
3768	*
3769	* @returns VBox strict status code.
3770	* @param pVCpu The cross context virtual CPU structure.
3771	* @param pExitInfo Pointer to the VM-exit information.
3772	* @param pExitEventInfo Pointer to the VM-exit event information.
3773	*/
3774	static VBOXSTRICTRC iemVmxVmexitEventWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3775	{
3776	Assert(pExitInfo);
3777	Assert(pExitEventInfo);
3778	Assert(pExitInfo->uReason == VMX_EXIT_XCPT_OR_NMI);
3779	Assert(VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3780
3781	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
3782	iemVmxVmcsSetExitIntInfo(pVCpu, pExitEventInfo->uExitIntInfo);
3783	iemVmxVmcsSetExitIntErrCode(pVCpu, pExitEventInfo->uExitIntErrCode);
3784	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3785	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3786	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, pExitInfo->u64Qual);
3787	}
3788
3789
3790	/**
3791	* Interface for HM and EM to emulate VM-exit due to NMIs.
3792	*
3793	* @returns Strict VBox status code.
3794	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3795	* @thread EMT(pVCpu)
3796	*/
3797	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcptNmi(PVMCPUCC pVCpu)
3798	{
3799	VMXVEXITINFO const ExitInfo = VMXVEXITINFO_INIT_ONLY_REASON(VMX_EXIT_XCPT_OR_NMI);
3800	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_INT( RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1)
3801	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE,
3802	VMX_EXIT_INT_INFO_TYPE_NMI)
3803	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR,
3804	X86_XCPT_NMI),
3805	0);
3806	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
3807	Assert(!pVCpu->iem.s.cActiveMappings);
3808	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3809	}
3810
3811
3812	/**
3813	* Interface for HM and EM to emulate VM-exit due to exceptions.
3814	*
3815	* Exception includes NMIs, software exceptions (those generated by INT3 or
3816	* INTO) and privileged software exceptions (those generated by INT1/ICEBP).
3817	*
3818	* @returns Strict VBox status code.
3819	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3820	* @param pExitInfo Pointer to the VM-exit information.
3821	* @param pExitEventInfo Pointer to the VM-exit event information.
3822	* @thread EMT(pVCpu)
3823	*/
3824	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitXcpt(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
3825	{
3826	Assert(pExitInfo);
3827	Assert(pExitEventInfo);
3828	VBOXSTRICTRC rcStrict = iemVmxVmexitEventWithInfo(pVCpu, pExitInfo, pExitEventInfo);
3829	Assert(!pVCpu->iem.s.cActiveMappings);
3830	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
3831	}
3832
3833
3834	/**
3835	* VMX VM-exit handler for VM-exits due to delivery of an event.
3836	*
3837	* @returns VBox strict status code.
3838	* @param pVCpu The cross context virtual CPU structure.
3839	* @param uVector The interrupt / exception vector.
3840	* @param fFlags The flags (see IEM_XCPT_FLAGS_XXX).
3841	* @param uErrCode The error code associated with the event.
3842	* @param uCr2 The CR2 value in case of a \#PF exception.
3843	* @param cbInstr The instruction length in bytes.
3844	*/
3845	VBOXSTRICTRC iemVmxVmexitEvent(PVMCPUCC pVCpu, uint8_t uVector, uint32_t fFlags, uint32_t uErrCode,
3846	uint64_t uCr2, uint8_t cbInstr) RT_NOEXCEPT
3847	{
3848	/*
3849	* If the event is being injected as part of VM-entry, it is -not- subject to event
3850	* intercepts in the nested-guest. However, secondary exceptions that occur during
3851	* injection of any event -are- subject to event interception.
3852	*
3853	* See Intel spec. 26.5.1.2 "VM Exits During Event Injection".
3854	*/
3855	if (!CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx))
3856	{
3857	/*
3858	* If the event is a virtual-NMI (which is an NMI being inject during VM-entry)
3859	* virtual-NMI blocking must be set in effect rather than physical NMI blocking.
3860	*
3861	* See Intel spec. 24.6.1 "Pin-Based VM-Execution Controls".
3862	*/
3863	if ( uVector == X86_XCPT_NMI
3864	&& (fFlags & IEM_XCPT_FLAGS_T_CPU_XCPT)
3865	&& (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
3866	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
3867	else
3868	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking);
3869
3870	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, true);
3871	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3872	}
3873
3874	/*
3875	* We are injecting an external interrupt, check if we need to cause a VM-exit now.
3876	* If not, the caller will continue delivery of the external interrupt as it would
3877	* normally. The interrupt is no longer pending in the interrupt controller at this
3878	* point.
3879	*/
3880	if (fFlags & IEM_XCPT_FLAGS_T_EXT_INT)
3881	{
3882	Assert(!VMX_IDT_VECTORING_INFO_IS_VALID(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32RoIdtVectoringInfo));
3883	return iemVmxVmexitExtInt(pVCpu, uVector, false /* fIntPending */);
3884	}
3885
3886	/*
3887	* Evaluate intercepts for hardware exceptions, software exceptions (#BP, #OF),
3888	* and privileged software exceptions (#DB generated by INT1/ICEBP) and software
3889	* interrupts.
3890	*/
3891	Assert(fFlags & (IEM_XCPT_FLAGS_T_CPU_XCPT \| IEM_XCPT_FLAGS_T_SOFT_INT));
3892	bool fIntercept;
3893	if ( !(fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3894	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3895	fIntercept = CPUMIsGuestVmxXcptInterceptSet(&pVCpu->cpum.GstCtx, uVector, uErrCode);
3896	else
3897	{
3898	/* Software interrupts cannot be intercepted and therefore do not cause a VM-exit. */
3899	fIntercept = false;
3900	}
3901
3902	/*
3903	* Now that we've determined whether the event causes a VM-exit, we need to construct the
3904	* relevant VM-exit information and cause the VM-exit.
3905	*/
3906	if (fIntercept)
3907	{
3908	Assert(!(fFlags & IEM_XCPT_FLAGS_T_EXT_INT));
3909
3910	/* Construct the rest of the event related information fields and cause the VM-exit. */
3911	uint64_t u64ExitQual;
3912	if (uVector == X86_XCPT_PF)
3913	{
3914	Assert(fFlags & IEM_XCPT_FLAGS_CR2);
3915	u64ExitQual = uCr2;
3916	}
3917	else if (uVector == X86_XCPT_DB)
3918	{
3919	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
3920	u64ExitQual = pVCpu->cpum.GstCtx.dr[6] & VMX_VMCS_EXIT_QUAL_VALID_MASK;
3921	}
3922	else
3923	u64ExitQual = 0;
3924
3925	uint8_t const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
3926	bool const fErrCodeValid = RT_BOOL(fFlags & IEM_XCPT_FLAGS_ERR);
3927	uint8_t const uIntInfoType = iemVmxGetEventType(uVector, fFlags);
3928	uint32_t const uExitIntInfo = RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VECTOR, uVector)
3929	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_TYPE, uIntInfoType)
3930	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_ERR_CODE_VALID, fErrCodeValid)
3931	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_NMI_UNBLOCK_IRET, fNmiUnblocking)
3932	\| RT_BF_MAKE(VMX_BF_EXIT_INT_INFO_VALID, 1);
3933	iemVmxVmcsSetExitIntInfo(pVCpu, uExitIntInfo);
3934	iemVmxVmcsSetExitIntErrCode(pVCpu, uErrCode);
3935
3936	/*
3937	* For VM-exits due to software exceptions (those generated by INT3 or INTO) or privileged
3938	* software exceptions (those generated by INT1/ICEBP) we need to supply the VM-exit instruction
3939	* length.
3940	*/
3941	if ( (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
3942	\|\| (fFlags & (IEM_XCPT_FLAGS_BP_INSTR \| IEM_XCPT_FLAGS_OF_INSTR \| IEM_XCPT_FLAGS_ICEBP_INSTR)))
3943	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
3944	else
3945	iemVmxVmcsSetExitInstrLen(pVCpu, 0);
3946
3947	return iemVmxVmexit(pVCpu, VMX_EXIT_XCPT_OR_NMI, u64ExitQual);
3948	}
3949
3950	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
3951	}
3952
3953
3954	/**
3955	* VMX VM-exit handler for EPT misconfiguration.
3956	*
3957	* @param pVCpu The cross context virtual CPU structure.
3958	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3959	* This need not be page aligned (e.g. nested-guest in real
3960	* mode).
3961	*/
3962	static VBOXSTRICTRC iemVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr) RT_NOEXCEPT
3963	{
3964	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3965	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3966	}
3967
3968
3969	/**
3970	* VMX VM-exit handler for EPT misconfiguration.
3971	*
3972	* This is intended for EPT misconfigurations where the caller provides all the
3973	* relevant VM-exit information.
3974	*
3975	* @param pVCpu The cross context virtual CPU structure.
3976	* @param GCPhysAddr The physical address causing the EPT misconfiguration.
3977	* This need not be page aligned (e.g. nested-guest in real
3978	* mode).
3979	* @param pExitEventInfo Pointer to the VM-exit event information.
3980	*/
3981	static VBOXSTRICTRC iemVmxVmexitEptMisconfigWithInfo(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
3982	{
3983	Assert(pExitEventInfo);
3984	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
3985	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
3986	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
3987	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
3988	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_MISCONFIG, 0 /* u64ExitQual */);
3989	}
3990
3991
3992	/**
3993	* Interface for HM and EM to emulate a VM-exit due to an EPT misconfiguration.
3994	*
3995	* @returns Strict VBox status code.
3996	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
3997	* @param GCPhysAddr The nested-guest physical address causing the EPT
3998	* misconfiguration.
3999	* @param pExitEventInfo Pointer to the VM-exit event information.
4000	* @thread EMT(pVCpu)
4001	*/
4002	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptMisconfig(PVMCPUCC pVCpu, RTGCPHYS GCPhysAddr, PCVMXVEXITEVENTINFO pExitEventInfo)
4003	{
4004	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
4005
4006	iemInitExec(pVCpu, 0 /fExecOpts/);
4007	VBOXSTRICTRC rcStrict = iemVmxVmexitEptMisconfigWithInfo(pVCpu, GCPhysAddr, pExitEventInfo);
4008	Assert(!pVCpu->iem.s.cActiveMappings);
4009	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
4010	}
4011
4012
4013	/**
4014	* VMX VM-exit handler for EPT violation.
4015	*
4016	* @param pVCpu The cross context virtual CPU structure.
4017	* @param fAccess The access causing the EPT violation, IEM_ACCESS_XXX.
4018	* @param fSlatFail The SLAT failure info, IEM_SLAT_FAIL_XXX.
4019	* @param fEptAccess The EPT paging structure bits.
4020	* @param GCPhysAddr The physical address causing the EPT violation. This
4021	* need not be page aligned (e.g. nested-guest in real
4022	* mode).
4023	* @param fIsLinearAddrValid Whether translation of a linear address caused this
4024	* EPT violation. If @c false, GCPtrAddr must be 0.
4025	* @param GCPtrAddr The linear address causing the EPT violation.
4026	* @param cbInstr The VM-exit instruction length.
4027	*/
4028	static VBOXSTRICTRC iemVmxVmexitEptViolation(PVMCPUCC pVCpu, uint32_t fAccess, uint32_t fSlatFail,
4029	uint64_t fEptAccess, RTGCPHYS GCPhysAddr, bool fIsLinearAddrValid,
4030	uint64_t GCPtrAddr, uint8_t cbInstr) RT_NOEXCEPT
4031	{
4032	/*
4033	* If the linear address isn't valid (can happen when loading PDPTEs
4034	* as part of MOV CR execution) the linear address field is undefined.
4035	* While we can leave it this way, it's preferable to zero it for consistency.
4036	*/
4037	Assert(fIsLinearAddrValid \|\| GCPtrAddr == 0);
4038
4039	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
4040	bool const fSupportsAccessDirty = RT_BOOL(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ACCESS_DIRTY);
4041
4042	uint32_t const fDataRdMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_READ;
4043	uint32_t const fDataWrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_WRITE;
4044	uint32_t const fInstrMask = IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_EXEC;
4045	bool const fDataRead = ((fAccess & fDataRdMask) == IEM_ACCESS_DATA_R) \| fSupportsAccessDirty;
4046	bool const fDataWrite = ((fAccess & fDataWrMask) == IEM_ACCESS_DATA_W) \| fSupportsAccessDirty;
4047	bool const fInstrFetch = ((fAccess & fInstrMask) == IEM_ACCESS_INSTRUCTION);
4048	bool const fEptRead = RT_BOOL(fEptAccess & EPT_E_READ);
4049	bool const fEptWrite = RT_BOOL(fEptAccess & EPT_E_WRITE);
4050	bool const fEptExec = RT_BOOL(fEptAccess & EPT_E_EXECUTE);
4051	bool const fNmiUnblocking = pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret;
4052	bool const fIsLinearToPhysAddr = fIsLinearAddrValid & RT_BOOL(fSlatFail & IEM_SLAT_FAIL_LINEAR_TO_PHYS_ADDR);
4053
4054	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_READ, fDataRead)
4055	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_WRITE, fDataWrite)
4056	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ACCESS_INSTR_FETCH, fInstrFetch)
4057	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_READ, fEptRead)
4058	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_WRITE, fEptWrite)
4059	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_ENTRY_EXECUTE, fEptExec)
4060	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID, fIsLinearAddrValid)
4061	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_LINEAR_TO_PHYS_ADDR, fIsLinearToPhysAddr)
4062	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_EPT_NMI_UNBLOCK_IRET, fNmiUnblocking);
4063
4064	#ifdef VBOX_STRICT
4065	uint64_t const fMiscCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
4066	uint32_t const fProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2;
4067	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_ADVEXITINFO_EPT_VIOLATION)); /* Advanced VM-exit info. not supported */
4068	Assert(!(fCaps & MSR_IA32_VMX_EPT_VPID_CAP_SUPER_SHW_STACK)); /* Supervisor shadow stack control not supported. */
4069	Assert(!(RT_BF_GET(fMiscCaps, VMX_BF_MISC_INTEL_PT))); /* Intel PT not supported. */
4070	Assert(!(fProcCtls2 & VMX_PROC_CTLS2_MODE_BASED_EPT_PERM)); /* Mode-based execute control not supported. */
4071	#endif
4072
4073	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, GCPhysAddr);
4074	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, GCPtrAddr);
4075	iemVmxVmcsSetExitInstrLen(pVCpu, cbInstr);
4076
4077	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, u64ExitQual);
4078	}
4079
4080
4081	/**
4082	* VMX VM-exit handler for EPT violation.
4083	*
4084	* This is intended for EPT violations where the caller provides all the
4085	* relevant VM-exit information.
4086	*
4087	* @returns VBox strict status code.
4088	* @param pVCpu The cross context virtual CPU structure.
4089	* @param pExitInfo Pointer to the VM-exit information.
4090	* @param pExitEventInfo Pointer to the VM-exit event information.
4091	*/
4092	static VBOXSTRICTRC iemVmxVmexitEptViolationWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4093	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4094	{
4095	Assert(pExitInfo);
4096	Assert(pExitEventInfo);
4097	Assert(pExitInfo->uReason == VMX_EXIT_EPT_VIOLATION);
4098	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4099
4100	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4101	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4102
4103	iemVmxVmcsSetExitGuestPhysAddr(pVCpu, pExitInfo->u64GuestPhysAddr);
4104	if (pExitInfo->u64Qual & VMX_BF_EXIT_QUAL_EPT_LINEAR_ADDR_VALID_MASK)
4105	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, pExitInfo->u64GuestLinearAddr);
4106	else
4107	iemVmxVmcsSetExitGuestLinearAddr(pVCpu, 0);
4108	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4109	return iemVmxVmexit(pVCpu, VMX_EXIT_EPT_VIOLATION, pExitInfo->u64Qual);
4110	}
4111
4112
4113	/**
4114	* Interface for HM and EM to emulate a VM-exit due to an EPT violation.
4115	*
4116	* @returns Strict VBox status code.
4117	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4118	* @param pExitInfo Pointer to the VM-exit information.
4119	* @param pExitEventInfo Pointer to the VM-exit event information.
4120	* @thread EMT(pVCpu)
4121	*/
4122	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitEptViolation(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4123	PCVMXVEXITEVENTINFO pExitEventInfo)
4124	{
4125	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
4126
4127	iemInitExec(pVCpu, 0 /fExecOpts/);
4128	VBOXSTRICTRC rcStrict = iemVmxVmexitEptViolationWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4129	Assert(!pVCpu->iem.s.cActiveMappings);
4130	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
4131	}
4132
4133
4134	/**
4135	* VMX VM-exit handler for EPT-induced VM-exits.
4136	*
4137	* @param pVCpu The cross context virtual CPU structure.
4138	* @param pWalk The page walk info.
4139	* @param fAccess The access causing the EPT event, IEM_ACCESS_XXX.
4140	* @param fSlatFail Additional SLAT info, IEM_SLAT_FAIL_XXX.
4141	* @param cbInstr The VM-exit instruction length if applicable. Pass 0 if not
4142	* applicable.
4143	*/
4144	VBOXSTRICTRC iemVmxVmexitEpt(PVMCPUCC pVCpu, PPGMPTWALKFAST pWalk, uint32_t fAccess, uint32_t fSlatFail, uint8_t cbInstr) RT_NOEXCEPT
4145	{
4146	Assert(pWalk->fInfo & PGM_WALKINFO_IS_SLAT);
4147	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT);
4148	Assert(!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEptXcptVe); /* #VE exceptions not supported. */
4149	Assert(!(pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION_CONVERTIBLE)); /* Without #VE, convertible violations not possible. */
4150
4151	if (pWalk->fFailed & PGM_WALKFAIL_EPT_VIOLATION)
4152	{
4153	LogFlow(("EptViolation: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4154	uint64_t const fEptAccess = (pWalk->fEffective & PGM_PTATTRS_EPT_MASK) >> PGM_PTATTRS_EPT_SHIFT;
4155	return iemVmxVmexitEptViolation(pVCpu, fAccess, fSlatFail, fEptAccess, pWalk->GCPhysNested,
4156	RT_BOOL(pWalk->fInfo & PGM_WALKINFO_IS_LINEAR_ADDR_VALID),
4157	pWalk->GCPtr, cbInstr);
4158	}
4159
4160	LogFlow(("EptMisconfig: cs:rip=%04x:%08RX64 fAccess=%#RX32\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, fAccess));
4161	Assert(pWalk->fFailed & PGM_WALKFAIL_EPT_MISCONFIG);
4162	return iemVmxVmexitEptMisconfig(pVCpu, pWalk->GCPhysNested);
4163	}
4164
4165
4166	/**
4167	* VMX VM-exit handler for APIC accesses.
4168	*
4169	* @param pVCpu The cross context virtual CPU structure.
4170	* @param offAccess The offset of the register being accessed.
4171	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4172	*/
4173	static VBOXSTRICTRC iemVmxVmexitApicAccess(PVMCPUCC pVCpu, uint16_t offAccess, uint32_t fAccess) RT_NOEXCEPT
4174	{
4175	VMXAPICACCESS enmAccess;
4176	bool const fInEventDelivery = IEMGetCurrentXcpt(pVCpu, NULL, NULL, NULL, NULL);
4177	if (fInEventDelivery)
4178	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
4179	else if ((fAccess & (IEM_ACCESS_WHAT_MASK \| IEM_ACCESS_TYPE_MASK)) == IEM_ACCESS_INSTRUCTION)
4180	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
4181	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
4182	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
4183	else
4184	enmAccess = VMXAPICACCESS_LINEAR_READ;
4185
4186	uint64_t const u64ExitQual = RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
4187	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess);
4188	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, u64ExitQual);
4189	}
4190
4191
4192	/**
4193	* VMX VM-exit handler for APIC accesses.
4194	*
4195	* This is intended for APIC accesses where the caller provides all the
4196	* relevant VM-exit information.
4197	*
4198	* @returns VBox strict status code.
4199	* @param pVCpu The cross context virtual CPU structure.
4200	* @param pExitInfo Pointer to the VM-exit information.
4201	* @param pExitEventInfo Pointer to the VM-exit event information.
4202	*/
4203	static VBOXSTRICTRC iemVmxVmexitApicAccessWithInfo(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo,
4204	PCVMXVEXITEVENTINFO pExitEventInfo) RT_NOEXCEPT
4205	{
4206	/* VM-exit interruption information should not be valid for APIC-access VM-exits. */
4207	Assert(!VMX_EXIT_INT_INFO_IS_VALID(pExitEventInfo->uExitIntInfo));
4208	Assert(pExitInfo->uReason == VMX_EXIT_APIC_ACCESS);
4209	iemVmxVmcsSetExitIntInfo(pVCpu, 0);
4210	iemVmxVmcsSetExitIntErrCode(pVCpu, 0);
4211	iemVmxVmcsSetExitInstrLen(pVCpu, pExitInfo->cbInstr);
4212	iemVmxVmcsSetIdtVectoringInfo(pVCpu, pExitEventInfo->uIdtVectoringInfo);
4213	iemVmxVmcsSetIdtVectoringErrCode(pVCpu, pExitEventInfo->uIdtVectoringErrCode);
4214	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_ACCESS, pExitInfo->u64Qual);
4215	}
4216
4217
4218	/**
4219	* Interface for HM and EM to virtualize memory-mapped APIC accesses.
4220	*
4221	* @returns Strict VBox status code.
4222	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the memory access was virtualized.
4223	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4224	*
4225	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4226	* @param pExitInfo Pointer to the VM-exit information.
4227	* @param pExitEventInfo Pointer to the VM-exit event information.
4228	* @thread EMT(pVCpu)
4229	*/
4230	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicAccess(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo, PCVMXVEXITEVENTINFO pExitEventInfo)
4231	{
4232	Assert(pExitInfo);
4233	Assert(pExitEventInfo);
4234	VBOXSTRICTRC rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, pExitInfo, pExitEventInfo);
4235	Assert(!pVCpu->iem.s.cActiveMappings);
4236	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4237	}
4238
4239
4240	/**
4241	* VMX VM-exit handler for APIC-write VM-exits.
4242	*
4243	* @param pVCpu The cross context virtual CPU structure.
4244	* @param offApic The write to the virtual-APIC page offset that caused this
4245	* VM-exit.
4246	*/
4247	static VBOXSTRICTRC iemVmxVmexitApicWrite(PVMCPUCC pVCpu, uint16_t offApic) RT_NOEXCEPT
4248	{
4249	Assert(offApic < XAPIC_OFF_END + 4);
4250	/* Write only bits 11:0 of the APIC offset into the Exit qualification field. */
4251	offApic &= UINT16_C(0xfff);
4252	return iemVmxVmexit(pVCpu, VMX_EXIT_APIC_WRITE, offApic);
4253	}
4254
4255
4256	/**
4257	* Clears any pending virtual-APIC write emulation.
4258	*
4259	* @returns The virtual-APIC offset that was written before clearing it.
4260	* @param pVCpu The cross context virtual CPU structure.
4261	*/
4262	DECLINLINE(uint16_t) iemVmxVirtApicClearPendingWrite(PVMCPUCC pVCpu)
4263	{
4264	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_HWVIRT);
4265	uint16_t const offVirtApicWrite = pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite;
4266	pVCpu->cpum.GstCtx.hwvirt.vmx.offVirtApicWrite = 0;
4267	Assert(VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
4268	VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_VMX_APIC_WRITE);
4269	return offVirtApicWrite;
4270	}
4271
4272
4273	/**
4274	* Reads a 32-bit register from the virtual-APIC page at the given offset.
4275	*
4276	* @returns The register from the virtual-APIC page.
4277	* @param pVCpu The cross context virtual CPU structure.
4278	* @param offReg The offset of the register being read.
4279	*/
4280	uint32_t iemVmxVirtApicReadRaw32(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4281	{
4282	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4283
4284	uint32_t uReg = 0;
4285	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4286	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4287	AssertMsgStmt(RT_SUCCESS(rc),
4288	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4289	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4290	uReg = 0);
4291	return uReg;
4292	}
4293
4294
4295	/**
4296	* Reads a 64-bit register from the virtual-APIC page at the given offset.
4297	*
4298	* @returns The register from the virtual-APIC page.
4299	* @param pVCpu The cross context virtual CPU structure.
4300	* @param offReg The offset of the register being read.
4301	*/
4302	static uint64_t iemVmxVirtApicReadRaw64(PVMCPUCC pVCpu, uint16_t offReg) RT_NOEXCEPT
4303	{
4304	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4305
4306	uint64_t uReg = 0;
4307	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4308	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg, sizeof(uReg));
4309	AssertMsgStmt(RT_SUCCESS(rc),
4310	("Failed to read %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4311	sizeof(uReg), offReg, GCPhysVirtApic, rc),
4312	uReg = 0);
4313	return uReg;
4314	}
4315
4316
4317	/**
4318	* Writes a 32-bit register to the virtual-APIC page at the given offset.
4319	*
4320	* @param pVCpu The cross context virtual CPU structure.
4321	* @param offReg The offset of the register being written.
4322	* @param uReg The register value to write.
4323	*/
4324	void iemVmxVirtApicWriteRaw32(PVMCPUCC pVCpu, uint16_t offReg, uint32_t uReg) RT_NOEXCEPT
4325	{
4326	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint32_t));
4327
4328	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4329	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4330	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4331	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4332	}
4333
4334
4335	/**
4336	* Writes a 64-bit register to the virtual-APIC page at the given offset.
4337	*
4338	* @param pVCpu The cross context virtual CPU structure.
4339	* @param offReg The offset of the register being written.
4340	* @param uReg The register value to write.
4341	*/
4342	static void iemVmxVirtApicWriteRaw64(PVMCPUCC pVCpu, uint16_t offReg, uint64_t uReg) RT_NOEXCEPT
4343	{
4344	Assert(offReg <= VMX_V_VIRT_APIC_SIZE - sizeof(uint64_t));
4345
4346	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4347	int rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg, &uReg, sizeof(uReg));
4348	AssertMsgRC(rc, ("Failed to write %u bytes at offset %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4349	sizeof(uReg), offReg, GCPhysVirtApic, rc));
4350	}
4351
4352
4353	/**
4354	* Sets the vector in a virtual-APIC 256-bit sparse register.
4355	*
4356	* @param pVCpu The cross context virtual CPU structure.
4357	* @param offReg The offset of the 256-bit spare register.
4358	* @param uVector The vector to set.
4359	*
4360	* @remarks This is based on our APIC device code.
4361	*/
4362	static void iemVmxVirtApicSetVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4363	{
4364	/* Determine the vector offset within the chunk. */
4365	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4366
4367	/* Read the chunk at the offset. */
4368	uint32_t uReg;
4369	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4370	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4371	if (RT_SUCCESS(rc))
4372	{
4373	/* Modify the chunk. */
4374	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4375	uReg \|= RT_BIT(idxVectorBit);
4376
4377	/* Write the chunk. */
4378	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4379	AssertMsgRC(rc, ("Failed to set vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4380	uVector, offReg, GCPhysVirtApic, rc));
4381	}
4382	else
4383	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4384	uVector, offReg, GCPhysVirtApic, rc));
4385	}
4386
4387
4388	/**
4389	* Clears the vector in a virtual-APIC 256-bit sparse register.
4390	*
4391	* @param pVCpu The cross context virtual CPU structure.
4392	* @param offReg The offset of the 256-bit spare register.
4393	* @param uVector The vector to clear.
4394	*
4395	* @remarks This is based on our APIC device code.
4396	*/
4397	static void iemVmxVirtApicClearVectorInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t uVector) RT_NOEXCEPT
4398	{
4399	/* Determine the vector offset within the chunk. */
4400	uint16_t const offVector = (uVector & UINT32_C(0xe0)) >> 1;
4401
4402	/* Read the chunk at the offset. */
4403	uint32_t uReg;
4404	RTGCPHYS const GCPhysVirtApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrVirtApic.u;
4405	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &uReg, GCPhysVirtApic + offReg + offVector, sizeof(uReg));
4406	if (RT_SUCCESS(rc))
4407	{
4408	/* Modify the chunk. */
4409	uint16_t const idxVectorBit = uVector & UINT32_C(0x1f);
4410	uReg &= ~RT_BIT(idxVectorBit);
4411
4412	/* Write the chunk. */
4413	rc = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic + offReg + offVector, &uReg, sizeof(uReg));
4414	AssertMsgRC(rc, ("Failed to clear vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4415	uVector, offReg, GCPhysVirtApic, rc));
4416	}
4417	else
4418	AssertMsgFailed(("Failed to get vector %#x in 256-bit register at %#x of the virtual-APIC page at %#RGp: %Rrc\n",
4419	uVector, offReg, GCPhysVirtApic, rc));
4420	}
4421
4422
4423	/**
4424	* Checks if a memory access to the APIC-access page must causes an APIC-access
4425	* VM-exit.
4426	*
4427	* @param pVCpu The cross context virtual CPU structure.
4428	* @param offAccess The offset of the register being accessed.
4429	* @param cbAccess The size of the access in bytes.
4430	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4431	*
4432	* @remarks This must not be used for MSR-based APIC-access page accesses!
4433	* @sa iemVmxVirtApicAccessMsrWrite, iemVmxVirtApicAccessMsrRead.
4434	*/
4435	static bool iemVmxVirtApicIsMemAccessIntercepted(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4436	{
4437	Assert(cbAccess > 0);
4438	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4439
4440	/*
4441	* We must cause a VM-exit if any of the following are true:
4442	* - TPR shadowing isn't active.
4443	* - The access size exceeds 32-bits.
4444	* - The access is not contained within low 4 bytes of a 16-byte aligned offset.
4445	*
4446	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4447	* See Intel spec. 29.4.3.1 "Determining Whether a Write Access is Virtualized".
4448	*/
4449	if ( !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
4450	\|\| cbAccess > sizeof(uint32_t)
4451	\|\| ((offAccess + cbAccess - 1) & 0xc)
4452	\|\| offAccess >= XAPIC_OFF_END + 4)
4453	return true;
4454
4455	/*
4456	* If the access is part of an operation where we have already
4457	* virtualized a virtual-APIC write, we must cause a VM-exit.
4458	*/
4459	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
4460	return true;
4461
4462	/*
4463	* Check write accesses to the APIC-access page that cause VM-exits.
4464	*/
4465	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4466	{
4467	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4468	{
4469	/*
4470	* With APIC-register virtualization, a write access to any of the
4471	* following registers are virtualized. Accessing any other register
4472	* causes a VM-exit.
4473	*/
4474	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4475	switch (offAlignedAccess)
4476	{
4477	case XAPIC_OFF_ID:
4478	case XAPIC_OFF_TPR:
4479	case XAPIC_OFF_EOI:
4480	case XAPIC_OFF_LDR:
4481	case XAPIC_OFF_DFR:
4482	case XAPIC_OFF_SVR:
4483	case XAPIC_OFF_ESR:
4484	case XAPIC_OFF_ICR_LO:
4485	case XAPIC_OFF_ICR_HI:
4486	case XAPIC_OFF_LVT_TIMER:
4487	case XAPIC_OFF_LVT_THERMAL:
4488	case XAPIC_OFF_LVT_PERF:
4489	case XAPIC_OFF_LVT_LINT0:
4490	case XAPIC_OFF_LVT_LINT1:
4491	case XAPIC_OFF_LVT_ERROR:
4492	case XAPIC_OFF_TIMER_ICR:
4493	case XAPIC_OFF_TIMER_DCR:
4494	break;
4495	default:
4496	return true;
4497	}
4498	}
4499	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4500	{
4501	/*
4502	* With virtual-interrupt delivery, a write access to any of the
4503	* following registers are virtualized. Accessing any other register
4504	* causes a VM-exit.
4505	*
4506	* Note! The specification does not allow writing to offsets in-between
4507	* these registers (e.g. TPR + 1 byte) unlike read accesses.
4508	*/
4509	switch (offAccess)
4510	{
4511	case XAPIC_OFF_TPR:
4512	case XAPIC_OFF_EOI:
4513	case XAPIC_OFF_ICR_LO:
4514	break;
4515	default:
4516	return true;
4517	}
4518	}
4519	else
4520	{
4521	/*
4522	* Without APIC-register virtualization or virtual-interrupt delivery,
4523	* only TPR accesses are virtualized.
4524	*/
4525	if (offAccess == XAPIC_OFF_TPR)
4526	{ /* likely */ }
4527	else
4528	return true;
4529	}
4530	}
4531	else
4532	{
4533	/*
4534	* Check read accesses to the APIC-access page that cause VM-exits.
4535	*/
4536	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4537	{
4538	/*
4539	* With APIC-register virtualization, a read access to any of the
4540	* following registers are virtualized. Accessing any other register
4541	* causes a VM-exit.
4542	*/
4543	uint16_t const offAlignedAccess = offAccess & 0xfffc;
4544	switch (offAlignedAccess)
4545	{
4546	/** @todo r=ramshankar: What about XAPIC_OFF_LVT_CMCI? */
4547	case XAPIC_OFF_ID:
4548	case XAPIC_OFF_VERSION:
4549	case XAPIC_OFF_TPR:
4550	case XAPIC_OFF_EOI:
4551	case XAPIC_OFF_LDR:
4552	case XAPIC_OFF_DFR:
4553	case XAPIC_OFF_SVR:
4554	case XAPIC_OFF_ISR0: case XAPIC_OFF_ISR1: case XAPIC_OFF_ISR2: case XAPIC_OFF_ISR3:
4555	case XAPIC_OFF_ISR4: case XAPIC_OFF_ISR5: case XAPIC_OFF_ISR6: case XAPIC_OFF_ISR7:
4556	case XAPIC_OFF_TMR0: case XAPIC_OFF_TMR1: case XAPIC_OFF_TMR2: case XAPIC_OFF_TMR3:
4557	case XAPIC_OFF_TMR4: case XAPIC_OFF_TMR5: case XAPIC_OFF_TMR6: case XAPIC_OFF_TMR7:
4558	case XAPIC_OFF_IRR0: case XAPIC_OFF_IRR1: case XAPIC_OFF_IRR2: case XAPIC_OFF_IRR3:
4559	case XAPIC_OFF_IRR4: case XAPIC_OFF_IRR5: case XAPIC_OFF_IRR6: case XAPIC_OFF_IRR7:
4560	case XAPIC_OFF_ESR:
4561	case XAPIC_OFF_ICR_LO:
4562	case XAPIC_OFF_ICR_HI:
4563	case XAPIC_OFF_LVT_TIMER:
4564	case XAPIC_OFF_LVT_THERMAL:
4565	case XAPIC_OFF_LVT_PERF:
4566	case XAPIC_OFF_LVT_LINT0:
4567	case XAPIC_OFF_LVT_LINT1:
4568	case XAPIC_OFF_LVT_ERROR:
4569	case XAPIC_OFF_TIMER_ICR:
4570	case XAPIC_OFF_TIMER_DCR:
4571	break;
4572	default:
4573	return true;
4574	}
4575	}
4576	else
4577	{
4578	/* Without APIC-register virtualization, only TPR accesses are virtualized. */
4579	if (offAccess == XAPIC_OFF_TPR)
4580	{ /* likely */ }
4581	else
4582	return true;
4583	}
4584	}
4585
4586	/* The APIC access is virtualized, does not cause a VM-exit. */
4587	return false;
4588	}
4589
4590
4591	/**
4592	* Virtualizes a memory-based APIC access by certain instructions even though they
4593	* do not use the address to access memory.
4594	*
4595	* This is for instructions like MONITOR, CLFLUSH, CLFLUSHOPT, ENTER which may cause
4596	* page-faults but do not use the address to access memory.
4597	*
4598	* @param pVCpu The cross context virtual CPU structure.
4599	* @param pGCPhysAccess Pointer to the guest-physical address accessed.
4600	* @param cbAccess The size of the access in bytes.
4601	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4602	*/
4603	VBOXSTRICTRC iemVmxVirtApicAccessUnused(PVMCPUCC pVCpu, PRTGCPHYS pGCPhysAccess, size_t cbAccess, uint32_t fAccess) RT_NOEXCEPT
4604	{
4605	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4606	Assert(pGCPhysAccess);
4607
4608	RTGCPHYS const GCPhysAccess = *pGCPhysAccess & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
4609	RTGCPHYS const GCPhysApic = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u64AddrApicAccess.u;
4610	Assert(!(GCPhysApic & GUEST_PAGE_OFFSET_MASK));
4611
4612	if (GCPhysAccess == GCPhysApic)
4613	{
4614	uint16_t const offAccess = *pGCPhysAccess & GUEST_PAGE_OFFSET_MASK;
4615	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4616	if (fIntercept)
4617	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4618
4619	*pGCPhysAccess = GCPhysApic \| offAccess;
4620	return VINF_VMX_MODIFIES_BEHAVIOR;
4621	}
4622
4623	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4624	}
4625
4626
4627	/**
4628	* Virtualizes a memory-based APIC access.
4629	*
4630	* @returns VBox strict status code.
4631	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the access was virtualized.
4632	* @retval VINF_VMX_VMEXIT if the access causes a VM-exit.
4633	*
4634	* @param pVCpu The cross context virtual CPU structure.
4635	* @param offAccess The offset of the register being accessed (within the
4636	* APIC-access page).
4637	* @param cbAccess The size of the access in bytes.
4638	* @param pvData Pointer to the data being written or where to store the data
4639	* being read.
4640	* @param fAccess The type of access, see IEM_ACCESS_XXX.
4641	*/
4642	static VBOXSTRICTRC iemVmxVirtApicAccessMem(PVMCPUCC pVCpu, uint16_t offAccess, size_t cbAccess,
4643	void *pvData, uint32_t fAccess) RT_NOEXCEPT
4644	{
4645	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS);
4646	Assert(pvData);
4647
4648	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, cbAccess, fAccess);
4649	if (fIntercept)
4650	return iemVmxVmexitApicAccess(pVCpu, offAccess, fAccess);
4651
4652	if (fAccess & IEM_ACCESS_TYPE_WRITE)
4653	{
4654	/*
4655	* A write access to the APIC-access page that is virtualized (rather than
4656	* causing a VM-exit) writes data to the virtual-APIC page.
4657	*/
4658	uint32_t const u32Data = (uint32_t )pvData;
4659	iemVmxVirtApicWriteRaw32(pVCpu, offAccess, u32Data);
4660
4661	/*
4662	* Record the currently updated APIC offset, as we need this later for figuring
4663	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4664	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4665	*
4666	* After completion of the current operation, we need to perform TPR virtualization,
4667	* EOI virtualization or APIC-write VM-exit depending on which register was written.
4668	*
4669	* The current operation may be a REP-prefixed string instruction, execution of any
4670	* other instruction, or delivery of an event through the IDT.
4671	*
4672	* Thus things like clearing bytes 3:1 of the VTPR, clearing VEOI are not to be
4673	* performed now but later after completion of the current operation.
4674	*
4675	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
4676	*/
4677	iemVmxVirtApicSetPendingWrite(pVCpu, offAccess);
4678
4679	LogFlowFunc(("Write access at offset %#x not intercepted -> Wrote %#RX32\n", offAccess, u32Data));
4680	}
4681	else
4682	{
4683	/*
4684	* A read access from the APIC-access page that is virtualized (rather than
4685	* causing a VM-exit) returns data from the virtual-APIC page.
4686	*
4687	* See Intel spec. 29.4.2 "Virtualizing Reads from the APIC-Access Page".
4688	*/
4689	Assert(fAccess & IEM_ACCESS_TYPE_READ);
4690
4691	Assert(cbAccess <= 4);
4692	Assert(offAccess < XAPIC_OFF_END + 4);
4693	static uint32_t const s_auAccessSizeMasks[] = { 0, 0xff, 0xffff, 0xffffff, 0xffffffff };
4694
4695	uint32_t u32Data = iemVmxVirtApicReadRaw32(pVCpu, offAccess);
4696	u32Data &= s_auAccessSizeMasks[cbAccess];
4697	(uint32_t )pvData = u32Data;
4698
4699	LogFlowFunc(("Read access at offset %#x not intercepted -> Read %#RX32\n", offAccess, u32Data));
4700	}
4701
4702	return VINF_VMX_MODIFIES_BEHAVIOR;
4703	}
4704
4705
4706	/**
4707	* Virtualizes an MSR-based APIC read access.
4708	*
4709	* @returns VBox strict status code.
4710	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR read was virtualized.
4711	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR read access must be
4712	* handled by the x2APIC device.
4713	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4714	* not within the range of valid MSRs, caller must raise \#GP(0).
4715	* @param pVCpu The cross context virtual CPU structure.
4716	* @param idMsr The x2APIC MSR being read.
4717	* @param pu64Value Where to store the read x2APIC MSR value (only valid when
4718	* VINF_VMX_MODIFIES_BEHAVIOR is returned).
4719	*/
4720	static VBOXSTRICTRC iemVmxVirtApicAccessMsrRead(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value) RT_NOEXCEPT
4721	{
4722	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE);
4723	Assert(pu64Value);
4724
4725	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
4726	{
4727	if ( idMsr >= MSR_IA32_X2APIC_START
4728	&& idMsr <= MSR_IA32_X2APIC_END)
4729	{
4730	uint16_t const offReg = (idMsr & 0xff) << 4;
4731	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4732	*pu64Value = u64Value;
4733	return VINF_VMX_MODIFIES_BEHAVIOR;
4734	}
4735	return VERR_OUT_OF_RANGE;
4736	}
4737
4738	if (idMsr == MSR_IA32_X2APIC_TPR)
4739	{
4740	uint16_t const offReg = (idMsr & 0xff) << 4;
4741	uint64_t const u64Value = iemVmxVirtApicReadRaw64(pVCpu, offReg);
4742	*pu64Value = u64Value;
4743	return VINF_VMX_MODIFIES_BEHAVIOR;
4744	}
4745
4746	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4747	}
4748
4749
4750	/**
4751	* Virtualizes an MSR-based APIC write access.
4752	*
4753	* @returns VBox strict status code.
4754	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR write was virtualized.
4755	* @retval VERR_OUT_RANGE if the MSR read was supposed to be virtualized but was
4756	* not within the range of valid MSRs, caller must raise \#GP(0).
4757	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR must be written normally.
4758	*
4759	* @param pVCpu The cross context virtual CPU structure.
4760	* @param idMsr The x2APIC MSR being written.
4761	* @param u64Value The value of the x2APIC MSR being written.
4762	*/
4763	static VBOXSTRICTRC iemVmxVirtApicAccessMsrWrite(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t u64Value) RT_NOEXCEPT
4764	{
4765	/*
4766	* Check if the access is to be virtualized.
4767	* See Intel spec. 29.5 "Virtualizing MSR-based APIC Accesses".
4768	*/
4769	if ( idMsr == MSR_IA32_X2APIC_TPR
4770	\|\| ( (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
4771	&& ( idMsr == MSR_IA32_X2APIC_EOI
4772	\|\| idMsr == MSR_IA32_X2APIC_SELF_IPI)))
4773	{
4774	/* Validate the MSR write depending on the register. */
4775	switch (idMsr)
4776	{
4777	case MSR_IA32_X2APIC_TPR:
4778	case MSR_IA32_X2APIC_SELF_IPI:
4779	{
4780	if (u64Value & UINT64_C(0xffffffffffffff00))
4781	return VERR_OUT_OF_RANGE;
4782	break;
4783	}
4784	case MSR_IA32_X2APIC_EOI:
4785	{
4786	if (u64Value != 0)
4787	return VERR_OUT_OF_RANGE;
4788	break;
4789	}
4790	}
4791
4792	/* Write the MSR to the virtual-APIC page. */
4793	uint16_t const offReg = (idMsr & 0xff) << 4;
4794	iemVmxVirtApicWriteRaw64(pVCpu, offReg, u64Value);
4795
4796	/*
4797	* Record the currently updated APIC offset, as we need this later for figuring
4798	* out whether to perform TPR, EOI or self-IPI virtualization as well as well
4799	* as for supplying the exit qualification when causing an APIC-write VM-exit.
4800	*/
4801	iemVmxVirtApicSetPendingWrite(pVCpu, offReg);
4802
4803	return VINF_VMX_MODIFIES_BEHAVIOR;
4804	}
4805
4806	return VINF_VMX_INTERCEPT_NOT_ACTIVE;
4807	}
4808
4809
4810	/**
4811	* Interface for HM and EM to virtualize x2APIC MSR accesses.
4812	*
4813	* @returns Strict VBox status code.
4814	* @retval VINF_VMX_MODIFIES_BEHAVIOR if the MSR access was virtualized.
4815	* @retval VINF_VMX_INTERCEPT_NOT_ACTIVE if the MSR access must be handled by
4816	* the x2APIC device.
4817	* @retval VERR_OUT_RANGE if the caller must raise \#GP(0).
4818	*
4819	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
4820	* @param idMsr The MSR being read.
4821	* @param pu64Value Pointer to the value being written or where to store the
4822	* value being read.
4823	* @param fWrite Whether this is an MSR write or read access.
4824	* @thread EMT(pVCpu)
4825	*/
4826	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVirtApicAccessMsr(PVMCPUCC pVCpu, uint32_t idMsr, uint64_t *pu64Value, bool fWrite)
4827	{
4828	Assert(pu64Value);
4829
4830	VBOXSTRICTRC rcStrict;
4831	if (fWrite)
4832	rcStrict = iemVmxVirtApicAccessMsrWrite(pVCpu, idMsr, *pu64Value);
4833	else
4834	rcStrict = iemVmxVirtApicAccessMsrRead(pVCpu, idMsr, pu64Value);
4835	Assert(!pVCpu->iem.s.cActiveMappings);
4836	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
4837
4838	}
4839
4840
4841	/**
4842	* Finds the most significant set bit in a virtual-APIC 256-bit sparse register.
4843	*
4844	* @returns VBox status code.
4845	* @retval VINF_SUCCESS when the highest set bit is found.
4846	* @retval VERR_NOT_FOUND when no bit is set.
4847	*
4848	* @param pVCpu The cross context virtual CPU structure.
4849	* @param offReg The offset of the APIC 256-bit sparse register.
4850	* @param pidxHighestBit Where to store the highest bit (most significant bit)
4851	* set in the register. Only valid when VINF_SUCCESS is
4852	* returned.
4853	*
4854	* @remarks The format of the 256-bit sparse register here mirrors that found in
4855	* real APIC hardware.
4856	*/
4857	static int iemVmxVirtApicGetHighestSetBitInReg(PVMCPUCC pVCpu, uint16_t offReg, uint8_t *pidxHighestBit)
4858	{
4859	Assert(offReg < XAPIC_OFF_END + 4);
4860	Assert(pidxHighestBit);
4861
4862	/*
4863	* There are 8 contiguous fragments (of 16-bytes each) in the sparse register.
4864	* However, in each fragment only the first 4 bytes are used.
4865	*/
4866	uint8_t const cFrags = 8;
4867	for (int8_t iFrag = cFrags; iFrag >= 0; iFrag--)
4868	{
4869	uint16_t const offFrag = iFrag * 16;
4870	uint32_t const u32Frag = iemVmxVirtApicReadRaw32(pVCpu, offReg + offFrag);
4871	if (!u32Frag)
4872	continue;
4873
4874	unsigned idxHighestBit = ASMBitLastSetU32(u32Frag);
4875	Assert(idxHighestBit > 0);
4876	--idxHighestBit;
4877	Assert(idxHighestBit <= UINT8_MAX);
4878	*pidxHighestBit = idxHighestBit;
4879	return VINF_SUCCESS;
4880	}
4881	return VERR_NOT_FOUND;
4882	}
4883
4884
4885	/**
4886	* Evaluates pending virtual interrupts.
4887	*
4888	* @param pVCpu The cross context virtual CPU structure.
4889	*/
4890	static void iemVmxEvalPendingVirtIntrs(PVMCPUCC pVCpu) RT_NOEXCEPT
4891	{
4892	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4893
4894	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT))
4895	{
4896	uint8_t const uRvi = RT_LO_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus);
4897	uint8_t const uPpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_PPR);
4898
4899	if ((uRvi >> 4) > (uPpr >> 4))
4900	{
4901	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Signalling pending interrupt\n", uRvi, uPpr));
4902	VMCPU_FF_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST);
4903	}
4904	else
4905	Log2(("eval_virt_intrs: uRvi=%#x uPpr=%#x - Nothing to do\n", uRvi, uPpr));
4906	}
4907	}
4908
4909
4910	/**
4911	* Performs PPR virtualization.
4912	*
4913	* @returns VBox strict status code.
4914	* @param pVCpu The cross context virtual CPU structure.
4915	*/
4916	static void iemVmxPprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4917	{
4918	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4919	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4920
4921	/*
4922	* PPR virtualization is caused in response to a VM-entry, TPR-virtualization,
4923	* or EOI-virtualization.
4924	*
4925	* See Intel spec. 29.1.3 "PPR Virtualization".
4926	*/
4927	uint8_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4928	uint8_t const uSvi = RT_HI_U8(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u16GuestIntStatus) & 0xf0;
4929
4930	uint32_t uPpr;
4931	if ((uTpr & 0xf0) >= uSvi)
4932	uPpr = uTpr;
4933	else
4934	uPpr = uSvi;
4935
4936	Log2(("ppr_virt: uTpr=%#x uSvi=%#x uPpr=%#x\n", uTpr, uSvi, uPpr));
4937	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_PPR, uPpr);
4938	}
4939
4940
4941	/**
4942	* Performs VMX TPR virtualization.
4943	*
4944	* @returns VBox strict status code.
4945	* @param pVCpu The cross context virtual CPU structure.
4946	*/
4947	static VBOXSTRICTRC iemVmxTprVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
4948	{
4949	Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
4950
4951	/*
4952	* We should have already performed the virtual-APIC write to the TPR offset
4953	* in the virtual-APIC page. We now perform TPR virtualization.
4954	*
4955	* See Intel spec. 29.1.2 "TPR Virtualization".
4956	*/
4957	if (!(pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
4958	{
4959	uint32_t const uTprThreshold = pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.u32TprThreshold;
4960	uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
4961
4962	/*
4963	* If the VTPR falls below the TPR threshold, we must cause a VM-exit.
4964	* See Intel spec. 29.1.2 "TPR Virtualization".
4965	*/
4966	if (((uTpr >> 4) & 0xf) < uTprThreshold)
4967	{
4968	Log2(("tpr_virt: uTpr=%u uTprThreshold=%u -> VM-exit\n", uTpr, uTprThreshold));
4969	return iemVmxVmexit(pVCpu, VMX_EXIT_TPR_BELOW_THRESHOLD, 0 /* u64ExitQual */);
4970	}
4971	}
4972	else
4973	{
4974	iemVmxPprVirtualization(pVCpu);
4975	iemVmxEvalPendingVirtIntrs(pVCpu);
4976	}
4977
4978	return VINF_SUCCESS;
4979	}
4980
4981
4982	/**
4983	* Checks whether an EOI write for the given interrupt vector causes a VM-exit or
4984	* not.
4985	*
4986	* @returns @c true if the EOI write is intercepted, @c false otherwise.
4987	* @param pVCpu The cross context virtual CPU structure.
4988	* @param uVector The interrupt that was acknowledged using an EOI.
4989	*/
4990	static bool iemVmxIsEoiInterceptSet(PCVMCPU pVCpu, uint8_t uVector) RT_NOEXCEPT
4991	{
4992	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
4993	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
4994
4995	if (uVector < 64)
4996	return RT_BOOL(pVmcs->u64EoiExitBitmap0.u & RT_BIT_64(uVector));
4997	if (uVector < 128)
4998	return RT_BOOL(pVmcs->u64EoiExitBitmap1.u & RT_BIT_64(uVector));
4999	if (uVector < 192)
5000	return RT_BOOL(pVmcs->u64EoiExitBitmap2.u & RT_BIT_64(uVector));
5001	return RT_BOOL(pVmcs->u64EoiExitBitmap3.u & RT_BIT_64(uVector));
5002	}
5003
5004
5005	/**
5006	* Performs EOI virtualization.
5007	*
5008	* @returns VBox strict status code.
5009	* @param pVCpu The cross context virtual CPU structure.
5010	*/
5011	static VBOXSTRICTRC iemVmxEoiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5012	{
5013	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5014	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
5015
5016	/*
5017	* Clear the interrupt guest-interrupt as no longer in-service (ISR)
5018	* and get the next guest-interrupt that's in-service (if any).
5019	*
5020	* See Intel spec. 29.1.4 "EOI Virtualization".
5021	*/
5022	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5023	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5024	Log2(("eoi_virt: uRvi=%#x uSvi=%#x\n", uRvi, uSvi));
5025
5026	uint8_t uVector = uSvi;
5027	iemVmxVirtApicClearVectorInReg(pVCpu, XAPIC_OFF_ISR0, uVector);
5028
5029	uVector = 0;
5030	iemVmxVirtApicGetHighestSetBitInReg(pVCpu, XAPIC_OFF_ISR0, &uVector);
5031
5032	if (uVector)
5033	Log2(("eoi_virt: next interrupt %#x\n", uVector));
5034	else
5035	Log2(("eoi_virt: no interrupt pending in ISR\n"));
5036
5037	/* Update guest-interrupt status SVI (leave RVI portion as it is) in the VMCS. */
5038	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uRvi, uVector);
5039
5040	iemVmxPprVirtualization(pVCpu);
5041	if (iemVmxIsEoiInterceptSet(pVCpu, uVector))
5042	return iemVmxVmexit(pVCpu, VMX_EXIT_VIRTUALIZED_EOI, uVector);
5043	iemVmxEvalPendingVirtIntrs(pVCpu);
5044	return VINF_SUCCESS;
5045	}
5046
5047
5048	/**
5049	* Performs self-IPI virtualization.
5050	*
5051	* @returns VBox strict status code.
5052	* @param pVCpu The cross context virtual CPU structure.
5053	*/
5054	static VBOXSTRICTRC iemVmxSelfIpiVirtualization(PVMCPUCC pVCpu) RT_NOEXCEPT
5055	{
5056	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5057	Assert(pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW);
5058
5059	/*
5060	* We should have already performed the virtual-APIC write to the self-IPI offset
5061	* in the virtual-APIC page. We now perform self-IPI virtualization.
5062	*
5063	* See Intel spec. 29.1.5 "Self-IPI Virtualization".
5064	*/
5065	uint8_t const uVector = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_LO);
5066	Log2(("self_ipi_virt: uVector=%#x\n", uVector));
5067	iemVmxVirtApicSetVectorInReg(pVCpu, XAPIC_OFF_IRR0, uVector);
5068	uint8_t const uRvi = RT_LO_U8(pVmcs->u16GuestIntStatus);
5069	uint8_t const uSvi = RT_HI_U8(pVmcs->u16GuestIntStatus);
5070	if (uVector > uRvi)
5071	pVmcs->u16GuestIntStatus = RT_MAKE_U16(uVector, uSvi);
5072	iemVmxEvalPendingVirtIntrs(pVCpu);
5073	return VINF_SUCCESS;
5074	}
5075
5076
5077	/**
5078	* Performs VMX APIC-write emulation.
5079	*
5080	* @returns VBox strict status code.
5081	* @param pVCpu The cross context virtual CPU structure.
5082	*/
5083	VBOXSTRICTRC iemVmxApicWriteEmulation(PVMCPUCC pVCpu) RT_NOEXCEPT
5084	{
5085	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5086
5087	/* Import the virtual-APIC write offset (part of the hardware-virtualization state). */
5088	IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_HWVIRT);
5089
5090	/*
5091	* Perform APIC-write emulation based on the virtual-APIC register written.
5092	* See Intel spec. 29.4.3.2 "APIC-Write Emulation".
5093	*/
5094	uint16_t const offApicWrite = iemVmxVirtApicClearPendingWrite(pVCpu);
5095	VBOXSTRICTRC rcStrict;
5096	switch (offApicWrite)
5097	{
5098	case XAPIC_OFF_TPR:
5099	{
5100	/* Clear bytes 3:1 of the VTPR and perform TPR virtualization. */
5101	uint32_t uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5102	uTpr &= UINT32_C(0x000000ff);
5103	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
5104	Log2(("iemVmxApicWriteEmulation: TPR write %#x\n", uTpr));
5105	rcStrict = iemVmxTprVirtualization(pVCpu);
5106	break;
5107	}
5108
5109	case XAPIC_OFF_EOI:
5110	{
5111	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5112	{
5113	/* Clear VEOI and perform EOI virtualization. */
5114	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_EOI, 0);
5115	Log2(("iemVmxApicWriteEmulation: EOI write\n"));
5116	rcStrict = iemVmxEoiVirtualization(pVCpu);
5117	}
5118	else
5119	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5120	break;
5121	}
5122
5123	case XAPIC_OFF_ICR_LO:
5124	{
5125	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
5126	{
5127	/* If the ICR_LO is valid, write it and perform self-IPI virtualization. */
5128	uint32_t const uIcrLo = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5129	uint32_t const fIcrLoMb0 = UINT32_C(0xfffbb700);
5130	uint32_t const fIcrLoMb1 = UINT32_C(0x000000f0);
5131	if ( !(uIcrLo & fIcrLoMb0)
5132	&& (uIcrLo & fIcrLoMb1))
5133	{
5134	Log2(("iemVmxApicWriteEmulation: Self-IPI virtualization with vector %#x\n", (uIcrLo & 0xff)));
5135	rcStrict = iemVmxSelfIpiVirtualization(pVCpu);
5136	}
5137	else
5138	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5139	}
5140	else
5141	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5142	break;
5143	}
5144
5145	case XAPIC_OFF_ICR_HI:
5146	{
5147	/* Clear bytes 2:0 of VICR_HI. No other virtualization or VM-exit must occur. */
5148	uint32_t uIcrHi = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_ICR_HI);
5149	uIcrHi &= UINT32_C(0xff000000);
5150	iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_ICR_HI, uIcrHi);
5151	rcStrict = VINF_SUCCESS;
5152	break;
5153	}
5154
5155	default:
5156	{
5157	/* Writes to any other virtual-APIC register causes an APIC-write VM-exit. */
5158	rcStrict = iemVmxVmexitApicWrite(pVCpu, offApicWrite);
5159	break;
5160	}
5161	}
5162
5163	return rcStrict;
5164	}
5165
5166
5167	/**
5168	* Interface for HM and EM to perform an APIC-write emulation which may cause a
5169	* VM-exit.
5170	*
5171	* @returns Strict VBox status code.
5172	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
5173	* @thread EMT(pVCpu)
5174	*/
5175	VMM_INT_DECL(VBOXSTRICTRC) IEMExecVmxVmexitApicWrite(PVMCPUCC pVCpu)
5176	{
5177	VBOXSTRICTRC rcStrict = iemVmxApicWriteEmulation(pVCpu);
5178	Assert(!pVCpu->iem.s.cActiveMappings);
5179	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
5180	}
5181
5182
5183	/**
5184	* Checks guest control registers, debug registers and MSRs as part of VM-entry.
5185	*
5186	* @param pVCpu The cross context virtual CPU structure.
5187	* @param pszInstr The VMX instruction name (for logging purposes).
5188	*/
5189	DECLINLINE(int) iemVmxVmentryCheckGuestControlRegsMsrs(PVMCPUCC pVCpu, const char *pszInstr)
5190	{
5191	/*
5192	* Guest Control Registers, Debug Registers, and MSRs.
5193	* See Intel spec. 26.3.1.1 "Checks on Guest Control Registers, Debug Registers, and MSRs".
5194	*/
5195	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5196	const char * const pszFailure = "VM-exit";
5197	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5198
5199	/* CR0 reserved bits. */
5200	{
5201	/* CR0 MB1 bits. */
5202	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
5203	if ((pVmcs->u64GuestCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
5204	{ /* likely */ }
5205	else
5206	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed0);
5207
5208	/* CR0 MBZ bits. */
5209	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5210	if (!(pVmcs->u64GuestCr0.u & ~u64Cr0Fixed1))
5211	{ /* likely */ }
5212	else
5213	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0Fixed1);
5214
5215	/* Without unrestricted guest support, VT-x supports does not support unpaged protected mode. */
5216	if ( !fUnrestrictedGuest
5217	&& (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5218	&& !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5219	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr0PgPe);
5220	}
5221
5222	/* CR4 reserved bits. */
5223	{
5224	/* CR4 MB1 bits. */
5225	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
5226	if ((pVmcs->u64GuestCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
5227	{ /* likely */ }
5228	else
5229	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed0);
5230
5231	/* CR4 MBZ bits. */
5232	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
5233	if (!(pVmcs->u64GuestCr4.u & ~u64Cr4Fixed1))
5234	{ /* likely */ }
5235	else
5236	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr4Fixed1);
5237	}
5238
5239	/* DEBUGCTL MSR. */
5240	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5241	\|\| !(pVmcs->u64GuestDebugCtlMsr.u & ~MSR_IA32_DEBUGCTL_VALID_MASK_INTEL))
5242	{ /* likely */ }
5243	else
5244	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDebugCtl);
5245
5246	/* 64-bit CPU checks. */
5247	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5248	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5249	{
5250	if (fGstInLongMode)
5251	{
5252	/* PAE must be set. */
5253	if ( (pVmcs->u64GuestCr0.u & X86_CR0_PG)
5254	&& (pVmcs->u64GuestCr0.u & X86_CR4_PAE))
5255	{ /* likely */ }
5256	else
5257	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPae);
5258	}
5259	else
5260	{
5261	/* PCIDE should not be set. */
5262	if (!(pVmcs->u64GuestCr4.u & X86_CR4_PCIDE))
5263	{ /* likely */ }
5264	else
5265	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPcide);
5266	}
5267
5268	/* CR3. */
5269	if (!(pVmcs->u64GuestCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
5270	{ /* likely */ }
5271	else
5272	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestCr3);
5273
5274	/* DR7. */
5275	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
5276	\|\| !(pVmcs->u64GuestDr7.u & X86_DR7_MBZ_MASK))
5277	{ /* likely */ }
5278	else
5279	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestDr7);
5280
5281	/* SYSENTER ESP and SYSENTER EIP. */
5282	if ( X86_IS_CANONICAL(pVmcs->u64GuestSysenterEsp.u)
5283	&& X86_IS_CANONICAL(pVmcs->u64GuestSysenterEip.u))
5284	{ /* likely */ }
5285	else
5286	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSysenterEspEip);
5287	}
5288
5289	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
5290	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
5291
5292	/* PAT MSR. */
5293	if ( !(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
5294	\|\| CPUMIsPatMsrValid(pVmcs->u64GuestPatMsr.u))
5295	{ /* likely */ }
5296	else
5297	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPatMsr);
5298
5299	/* EFER MSR. */
5300	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
5301	{
5302	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
5303	if (!(pVmcs->u64GuestEferMsr.u & ~uValidEferMask))
5304	{ /* likely */ }
5305	else
5306	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsrRsvd);
5307
5308	bool const fGstLma = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LMA);
5309	bool const fGstLme = RT_BOOL(pVmcs->u64GuestEferMsr.u & MSR_K6_EFER_LME);
5310	if ( fGstLma == fGstInLongMode
5311	&& ( !(pVmcs->u64GuestCr0.u & X86_CR0_PG)
5312	\|\| fGstLma == fGstLme))
5313	{ /* likely */ }
5314	else
5315	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestEferMsr);
5316	}
5317
5318	/* We don't support IA32_BNDCFGS MSR yet. */
5319	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
5320
5321	NOREF(pszInstr);
5322	NOREF(pszFailure);
5323	return VINF_SUCCESS;
5324	}
5325
5326
5327	/**
5328	* Checks guest segment registers, LDTR and TR as part of VM-entry.
5329	*
5330	* @param pVCpu The cross context virtual CPU structure.
5331	* @param pszInstr The VMX instruction name (for logging purposes).
5332	*/
5333	DECLINLINE(int) iemVmxVmentryCheckGuestSegRegs(PVMCPUCC pVCpu, const char *pszInstr)
5334	{
5335	/*
5336	* Segment registers.
5337	* See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers".
5338	*/
5339	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5340	const char * const pszFailure = "VM-exit";
5341	bool const fGstInV86Mode = RT_BOOL(pVmcs->u64GuestRFlags.u & X86_EFL_VM);
5342	bool const fUnrestrictedGuest = RT_BOOL(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST);
5343	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5344
5345	/* Selectors. */
5346	if ( !fGstInV86Mode
5347	&& !fUnrestrictedGuest
5348	&& (pVmcs->GuestSs & X86_SEL_RPL) != (pVmcs->GuestCs & X86_SEL_RPL))
5349	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelCsSsRpl);
5350
5351	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
5352	{
5353	CPUMSELREG SelReg;
5354	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &SelReg);
5355	if (RT_LIKELY(rc == VINF_SUCCESS))
5356	{ /* likely */ }
5357	else
5358	return rc;
5359
5360	/*
5361	* Virtual-8086 mode checks.
5362	*/
5363	if (fGstInV86Mode)
5364	{
5365	/* Base address. */
5366	if (SelReg.u64Base == (uint64_t)SelReg.Sel << 4)
5367	{ /* likely */ }
5368	else
5369	{
5370	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBaseV86(iSegReg);
5371	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5372	}
5373
5374	/* Limit. */
5375	if (SelReg.u32Limit == 0xffff)
5376	{ /* likely */ }
5377	else
5378	{
5379	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegLimitV86(iSegReg);
5380	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5381	}
5382
5383	/* Attribute. */
5384	if (SelReg.Attr.u == 0xf3)
5385	{ /* likely */ }
5386	else
5387	{
5388	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrV86(iSegReg);
5389	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5390	}
5391
5392	/* We're done; move to checking the next segment. */
5393	continue;
5394	}
5395
5396	/* Checks done by 64-bit CPUs. */
5397	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5398	{
5399	/* Base address. */
5400	if ( iSegReg == X86_SREG_FS
5401	\|\| iSegReg == X86_SREG_GS)
5402	{
5403	if (X86_IS_CANONICAL(SelReg.u64Base))
5404	{ /* likely */ }
5405	else
5406	{
5407	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5408	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5409	}
5410	}
5411	else if (iSegReg == X86_SREG_CS)
5412	{
5413	if (!RT_HI_U32(SelReg.u64Base))
5414	{ /* likely */ }
5415	else
5416	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseCs);
5417	}
5418	else
5419	{
5420	if ( SelReg.Attr.n.u1Unusable
5421	\|\| !RT_HI_U32(SelReg.u64Base))
5422	{ /* likely */ }
5423	else
5424	{
5425	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegBase(iSegReg);
5426	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5427	}
5428	}
5429	}
5430
5431	/*
5432	* Checks outside Virtual-8086 mode.
5433	*/
5434	uint8_t const uSegType = SelReg.Attr.n.u4Type;
5435	uint8_t const fCodeDataSeg = SelReg.Attr.n.u1DescType;
5436	uint8_t const fUsable = !SelReg.Attr.n.u1Unusable;
5437	uint8_t const uDpl = SelReg.Attr.n.u2Dpl;
5438	uint8_t const fPresent = SelReg.Attr.n.u1Present;
5439	uint8_t const uGranularity = SelReg.Attr.n.u1Granularity;
5440	uint8_t const uDefBig = SelReg.Attr.n.u1DefBig;
5441	uint8_t const fSegLong = SelReg.Attr.n.u1Long;
5442
5443	/* Code or usable segment. */
5444	if ( iSegReg == X86_SREG_CS
5445	\|\| fUsable)
5446	{
5447	/* Reserved bits (bits 31:17 and bits 11:8). */
5448	if (!(SelReg.Attr.u & 0xfffe0f00))
5449	{ /* likely */ }
5450	else
5451	{
5452	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrRsvd(iSegReg);
5453	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5454	}
5455
5456	/* Descriptor type. */
5457	if (fCodeDataSeg)
5458	{ /* likely */ }
5459	else
5460	{
5461	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDescType(iSegReg);
5462	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5463	}
5464
5465	/* Present. */
5466	if (fPresent)
5467	{ /* likely */ }
5468	else
5469	{
5470	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrPresent(iSegReg);
5471	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5472	}
5473
5474	/* Granularity. */
5475	if ( ((SelReg.u32Limit & 0x00000fff) == 0x00000fff \|\| !uGranularity)
5476	&& ((SelReg.u32Limit & 0xfff00000) == 0x00000000 \|\| uGranularity))
5477	{ /* likely */ }
5478	else
5479	{
5480	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrGran(iSegReg);
5481	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5482	}
5483	}
5484
5485	if (iSegReg == X86_SREG_CS)
5486	{
5487	/* Segment Type and DPL. */
5488	if ( uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5489	&& fUnrestrictedGuest)
5490	{
5491	if (uDpl == 0)
5492	{ /* likely */ }
5493	else
5494	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplZero);
5495	}
5496	else if ( uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_ACCESSED)
5497	\|\| uSegType == (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5498	{
5499	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5500	if (uDpl == AttrSs.n.u2Dpl)
5501	{ /* likely */ }
5502	else
5503	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplEqSs);
5504	}
5505	else if ((uSegType & (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5506	== (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_CONF \| X86_SEL_TYPE_ACCESSED))
5507	{
5508	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5509	if (uDpl <= AttrSs.n.u2Dpl)
5510	{ /* likely */ }
5511	else
5512	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDplLtSs);
5513	}
5514	else
5515	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsType);
5516
5517	/* Def/Big. */
5518	if ( fGstInLongMode
5519	&& fSegLong)
5520	{
5521	if (uDefBig == 0)
5522	{ /* likely */ }
5523	else
5524	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsDefBig);
5525	}
5526	}
5527	else if (iSegReg == X86_SREG_SS)
5528	{
5529	/* Segment Type. */
5530	if ( !fUsable
5531	\|\| uSegType == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5532	\|\| uSegType == (X86_SEL_TYPE_DOWN \| X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED))
5533	{ /* likely */ }
5534	else
5535	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsType);
5536
5537	/* DPL. */
5538	if (!fUnrestrictedGuest)
5539	{
5540	if (uDpl == (SelReg.Sel & X86_SEL_RPL))
5541	{ /* likely */ }
5542	else
5543	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplEqRpl);
5544	}
5545	X86DESCATTR AttrCs; AttrCs.u = pVmcs->u32GuestCsAttr;
5546	if ( AttrCs.n.u4Type == (X86_SEL_TYPE_RW \| X86_SEL_TYPE_ACCESSED)
5547	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5548	{
5549	if (uDpl == 0)
5550	{ /* likely */ }
5551	else
5552	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrSsDplZero);
5553	}
5554	}
5555	else
5556	{
5557	/* DS, ES, FS, GS. */
5558	if (fUsable)
5559	{
5560	/* Segment type. */
5561	if (uSegType & X86_SEL_TYPE_ACCESSED)
5562	{ /* likely */ }
5563	else
5564	{
5565	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrTypeAcc(iSegReg);
5566	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5567	}
5568
5569	if ( !(uSegType & X86_SEL_TYPE_CODE)
5570	\|\| (uSegType & X86_SEL_TYPE_READ))
5571	{ /* likely */ }
5572	else
5573	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrCsTypeRead);
5574
5575	/* DPL. */
5576	if ( !fUnrestrictedGuest
5577	&& uSegType <= (X86_SEL_TYPE_CODE \| X86_SEL_TYPE_READ \| X86_SEL_TYPE_ACCESSED))
5578	{
5579	if (uDpl >= (SelReg.Sel & X86_SEL_RPL))
5580	{ /* likely */ }
5581	else
5582	{
5583	VMXVDIAG const enmDiag = iemVmxGetDiagVmentrySegAttrDplRpl(iSegReg);
5584	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
5585	}
5586	}
5587	}
5588	}
5589	}
5590
5591	/*
5592	* LDTR.
5593	*/
5594	{
5595	CPUMSELREG Ldtr;
5596	Ldtr.Sel = pVmcs->GuestLdtr;
5597	Ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
5598	Ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
5599	Ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
5600
5601	if (!Ldtr.Attr.n.u1Unusable)
5602	{
5603	/* Selector. */
5604	if (!(Ldtr.Sel & X86_SEL_LDT))
5605	{ /* likely */ }
5606	else
5607	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelLdtr);
5608
5609	/* Base. */
5610	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5611	{
5612	if (X86_IS_CANONICAL(Ldtr.u64Base))
5613	{ /* likely */ }
5614	else
5615	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseLdtr);
5616	}
5617
5618	/* Attributes. */
5619	/* Reserved bits (bits 31:17 and bits 11:8). */
5620	if (!(Ldtr.Attr.u & 0xfffe0f00))
5621	{ /* likely */ }
5622	else
5623	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrRsvd);
5624
5625	if (Ldtr.Attr.n.u4Type == X86_SEL_TYPE_SYS_LDT)
5626	{ /* likely */ }
5627	else
5628	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrType);
5629
5630	if (!Ldtr.Attr.n.u1DescType)
5631	{ /* likely */ }
5632	else
5633	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrDescType);
5634
5635	if (Ldtr.Attr.n.u1Present)
5636	{ /* likely */ }
5637	else
5638	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrPresent);
5639
5640	if ( ((Ldtr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Ldtr.Attr.n.u1Granularity)
5641	&& ((Ldtr.u32Limit & 0xfff00000) == 0x00000000 \|\| Ldtr.Attr.n.u1Granularity))
5642	{ /* likely */ }
5643	else
5644	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrLdtrGran);
5645	}
5646	}
5647
5648	/*
5649	* TR.
5650	*/
5651	{
5652	CPUMSELREG Tr;
5653	Tr.Sel = pVmcs->GuestTr;
5654	Tr.u32Limit = pVmcs->u32GuestTrLimit;
5655	Tr.u64Base = pVmcs->u64GuestTrBase.u;
5656	Tr.Attr.u = pVmcs->u32GuestTrAttr;
5657
5658	/* Selector. */
5659	if (!(Tr.Sel & X86_SEL_LDT))
5660	{ /* likely */ }
5661	else
5662	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegSelTr);
5663
5664	/* Base. */
5665	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5666	{
5667	if (X86_IS_CANONICAL(Tr.u64Base))
5668	{ /* likely */ }
5669	else
5670	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegBaseTr);
5671	}
5672
5673	/* Attributes. */
5674	/* Reserved bits (bits 31:17 and bits 11:8). */
5675	if (!(Tr.Attr.u & 0xfffe0f00))
5676	{ /* likely */ }
5677	else
5678	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrRsvd);
5679
5680	if (!Tr.Attr.n.u1Unusable)
5681	{ /* likely */ }
5682	else
5683	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrUnusable);
5684
5685	if ( Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY
5686	\|\| ( !fGstInLongMode
5687	&& Tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY))
5688	{ /* likely */ }
5689	else
5690	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrType);
5691
5692	if (!Tr.Attr.n.u1DescType)
5693	{ /* likely */ }
5694	else
5695	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrDescType);
5696
5697	if (Tr.Attr.n.u1Present)
5698	{ /* likely */ }
5699	else
5700	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrPresent);
5701
5702	if ( ((Tr.u32Limit & 0x00000fff) == 0x00000fff \|\| !Tr.Attr.n.u1Granularity)
5703	&& ((Tr.u32Limit & 0xfff00000) == 0x00000000 \|\| Tr.Attr.n.u1Granularity))
5704	{ /* likely */ }
5705	else
5706	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestSegAttrTrGran);
5707	}
5708
5709	NOREF(pszInstr);
5710	NOREF(pszFailure);
5711	return VINF_SUCCESS;
5712	}
5713
5714
5715	/**
5716	* Checks guest GDTR and IDTR as part of VM-entry.
5717	*
5718	* @param pVCpu The cross context virtual CPU structure.
5719	* @param pszInstr The VMX instruction name (for logging purposes).
5720	*/
5721	DECLINLINE(int) iemVmxVmentryCheckGuestGdtrIdtr(PVMCPUCC pVCpu, const char *pszInstr)
5722	{
5723	/*
5724	* GDTR and IDTR.
5725	* See Intel spec. 26.3.1.3 "Checks on Guest Descriptor-Table Registers".
5726	*/
5727	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5728	const char *const pszFailure = "VM-exit";
5729
5730	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5731	{
5732	/* Base. */
5733	if (X86_IS_CANONICAL(pVmcs->u64GuestGdtrBase.u))
5734	{ /* likely */ }
5735	else
5736	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrBase);
5737
5738	if (X86_IS_CANONICAL(pVmcs->u64GuestIdtrBase.u))
5739	{ /* likely */ }
5740	else
5741	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrBase);
5742	}
5743
5744	/* Limit. */
5745	if (!RT_HI_U16(pVmcs->u32GuestGdtrLimit))
5746	{ /* likely */ }
5747	else
5748	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestGdtrLimit);
5749
5750	if (!RT_HI_U16(pVmcs->u32GuestIdtrLimit))
5751	{ /* likely */ }
5752	else
5753	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIdtrLimit);
5754
5755	NOREF(pszInstr);
5756	NOREF(pszFailure);
5757	return VINF_SUCCESS;
5758	}
5759
5760
5761	/**
5762	* Checks guest RIP and RFLAGS as part of VM-entry.
5763	*
5764	* @param pVCpu The cross context virtual CPU structure.
5765	* @param pszInstr The VMX instruction name (for logging purposes).
5766	*/
5767	DECLINLINE(int) iemVmxVmentryCheckGuestRipRFlags(PVMCPUCC pVCpu, const char *pszInstr)
5768	{
5769	/*
5770	* RIP and RFLAGS.
5771	* See Intel spec. 26.3.1.4 "Checks on Guest RIP and RFLAGS".
5772	*/
5773	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5774	const char *const pszFailure = "VM-exit";
5775	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
5776
5777	/* RIP. */
5778	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
5779	{
5780	X86DESCATTR AttrCs;
5781	AttrCs.u = pVmcs->u32GuestCsAttr;
5782	if ( !fGstInLongMode
5783	\|\| !AttrCs.n.u1Long)
5784	{
5785	if (!RT_HI_U32(pVmcs->u64GuestRip.u))
5786	{ /* likely */ }
5787	else
5788	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRipRsvd);
5789	}
5790
5791	if ( fGstInLongMode
5792	&& AttrCs.n.u1Long)
5793	{
5794	Assert(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth == 48); /* Canonical. */
5795	if ( IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxLinearAddrWidth < 64
5796	&& X86_IS_CANONICAL(pVmcs->u64GuestRip.u))
5797	{ /* likely */ }
5798	else
5799	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRip);
5800	}
5801	}
5802
5803	/* RFLAGS (bits 63:22 (or 31:22), bits 15, 5, 3 are reserved, bit 1 MB1). */
5804	uint64_t const uGuestRFlags = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode ? pVmcs->u64GuestRFlags.u
5805	: pVmcs->u64GuestRFlags.s.Lo;
5806	if ( !(uGuestRFlags & ~(X86_EFL_LIVE_MASK \| X86_EFL_RA1_MASK))
5807	&& (uGuestRFlags & X86_EFL_RA1_MASK) == X86_EFL_RA1_MASK)
5808	{ /* likely */ }
5809	else
5810	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsRsvd);
5811
5812	if (!(uGuestRFlags & X86_EFL_VM))
5813	{ /* likely */ }
5814	else
5815	{
5816	if ( fGstInLongMode
5817	\|\| !(pVmcs->u64GuestCr0.u & X86_CR0_PE))
5818	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsVm);
5819	}
5820
5821	if (VMX_ENTRY_INT_INFO_IS_EXT_INT(pVmcs->u32EntryIntInfo))
5822	{
5823	if (uGuestRFlags & X86_EFL_IF)
5824	{ /* likely */ }
5825	else
5826	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestRFlagsIf);
5827	}
5828
5829	NOREF(pszInstr);
5830	NOREF(pszFailure);
5831	return VINF_SUCCESS;
5832	}
5833
5834
5835	/**
5836	* Checks guest non-register state as part of VM-entry.
5837	*
5838	* @param pVCpu The cross context virtual CPU structure.
5839	* @param pszInstr The VMX instruction name (for logging purposes).
5840	*/
5841	DECLINLINE(int) iemVmxVmentryCheckGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr)
5842	{
5843	/*
5844	* Guest non-register state.
5845	* See Intel spec. 26.3.1.5 "Checks on Guest Non-Register State".
5846	*/
5847	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
5848	const char *const pszFailure = "VM-exit";
5849
5850	/*
5851	* Activity state.
5852	*/
5853	uint64_t const u64GuestVmxMiscMsr = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Misc;
5854	uint32_t const fActivityStateMask = RT_BF_GET(u64GuestVmxMiscMsr, VMX_BF_MISC_ACTIVITY_STATES);
5855	if (!(pVmcs->u32GuestActivityState & fActivityStateMask))
5856	{ /* likely */ }
5857	else
5858	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateRsvd);
5859
5860	X86DESCATTR AttrSs; AttrSs.u = pVmcs->u32GuestSsAttr;
5861	if ( !AttrSs.n.u2Dpl
5862	\|\| pVmcs->u32GuestActivityState != VMX_VMCS_GUEST_ACTIVITY_HLT)
5863	{ /* likely */ }
5864	else
5865	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateSsDpl);
5866
5867	if ( pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_STI
5868	\|\| pVmcs->u32GuestIntrState == VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
5869	{
5870	if (pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_ACTIVE)
5871	{ /* likely */ }
5872	else
5873	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateStiMovSs);
5874	}
5875
5876	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5877	{
5878	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5879	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
5880	AssertCompile(VMX_V_GUEST_ACTIVITY_STATE_MASK == (VMX_VMCS_GUEST_ACTIVITY_HLT \| VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN));
5881	switch (pVmcs->u32GuestActivityState)
5882	{
5883	case VMX_VMCS_GUEST_ACTIVITY_HLT:
5884	{
5885	if ( uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT
5886	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5887	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5888	&& ( uVector == X86_XCPT_DB
5889	\|\| uVector == X86_XCPT_MC))
5890	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT
5891	&& uVector == VMX_ENTRY_INT_INFO_VECTOR_MTF))
5892	{ /* likely */ }
5893	else
5894	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateHlt);
5895	break;
5896	}
5897
5898	case VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN:
5899	{
5900	if ( uType == VMX_ENTRY_INT_INFO_TYPE_NMI
5901	\|\| ( uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT
5902	&& uVector == X86_XCPT_MC))
5903	{ /* likely */ }
5904	else
5905	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestActStateShutdown);
5906	break;
5907	}
5908
5909	case VMX_VMCS_GUEST_ACTIVITY_ACTIVE:
5910	default:
5911	break;
5912	}
5913	}
5914
5915	/*
5916	* Interruptibility state.
5917	*/
5918	if (!(pVmcs->u32GuestIntrState & ~VMX_VMCS_GUEST_INT_STATE_MASK))
5919	{ /* likely */ }
5920	else
5921	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRsvd);
5922
5923	if ((pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5924	!= (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5925	{ /* likely */ }
5926	else
5927	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateStiMovSs);
5928
5929	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_IF)
5930	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5931	{ /* likely */ }
5932	else
5933	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateRFlagsSti);
5934
5935	if (VMX_ENTRY_INT_INFO_IS_VALID(pVmcs->u32EntryIntInfo))
5936	{
5937	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(pVmcs->u32EntryIntInfo);
5938	if (uType == VMX_ENTRY_INT_INFO_TYPE_EXT_INT)
5939	{
5940	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5941	{ /* likely */ }
5942	else
5943	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateExtInt);
5944	}
5945	else if (uType == VMX_ENTRY_INT_INFO_TYPE_NMI)
5946	{
5947	if (!(pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI)))
5948	{ /* likely */ }
5949	else
5950	{
5951	/*
5952	* We don't support injecting NMIs when blocking-by-STI would be in effect.
5953	* We update the Exit qualification only when blocking-by-STI is set
5954	* without blocking-by-MovSS being set. Although in practise it does not
5955	* make much difference since the order of checks are implementation defined.
5956	*/
5957	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
5958	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_NMI_INJECT);
5959	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateNmi);
5960	}
5961
5962	if ( !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
5963	\|\| !(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI))
5964	{ /* likely */ }
5965	else
5966	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateVirtNmi);
5967	}
5968	}
5969
5970	/* We don't support SMM yet. So blocking-by-SMIs must not be set. */
5971	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_SMI))
5972	{ /* likely */ }
5973	else
5974	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateSmi);
5975
5976	/* We don't support SGX yet. So enclave-interruption must not be set. */
5977	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_ENCLAVE))
5978	{ /* likely */ }
5979	else
5980	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestIntStateEnclave);
5981
5982	/*
5983	* Pending debug exceptions.
5984	*/
5985	uint64_t const uPendingDbgXcpts = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode
5986	? pVmcs->u64GuestPendingDbgXcpts.u
5987	: pVmcs->u64GuestPendingDbgXcpts.s.Lo;
5988	if (!(uPendingDbgXcpts & ~VMX_VMCS_GUEST_PENDING_DEBUG_VALID_MASK))
5989	{ /* likely */ }
5990	else
5991	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRsvd);
5992
5993	if ( (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS \| VMX_VMCS_GUEST_INT_STATE_BLOCK_STI))
5994	\|\| pVmcs->u32GuestActivityState == VMX_VMCS_GUEST_ACTIVITY_HLT)
5995	{
5996	if ( (pVmcs->u64GuestRFlags.u & X86_EFL_TF)
5997	&& !(pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF)
5998	&& !(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
5999	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsTf);
6000
6001	if ( ( !(pVmcs->u64GuestRFlags.u & X86_EFL_TF)
6002	\|\| (pVmcs->u64GuestDebugCtlMsr.u & MSR_IA32_DEBUGCTL_BTF))
6003	&& (uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS))
6004	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptBsNoTf);
6005	}
6006
6007	/* We don't support RTM (Real-time Transactional Memory) yet. */
6008	if (!(uPendingDbgXcpts & VMX_VMCS_GUEST_PENDING_DEBUG_RTM))
6009	{ /* likely */ }
6010	else
6011	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPndDbgXcptRtm);
6012
6013	/*
6014	* VMCS link pointer.
6015	*/
6016	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
6017	{
6018	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
6019	/* We don't support SMM yet (so VMCS link pointer cannot be the current VMCS). */
6020	if (GCPhysShadowVmcs != IEM_VMX_GET_CURRENT_VMCS(pVCpu))
6021	{ /* likely */ }
6022	else
6023	{
6024	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6025	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrCurVmcs);
6026	}
6027
6028	/* Validate the address. */
6029	if ( !(GCPhysShadowVmcs & X86_PAGE_4K_OFFSET_MASK)
6030	&& !(GCPhysShadowVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6031	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysShadowVmcs))
6032	{ /* likely */ }
6033	else
6034	{
6035	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
6036	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmcsLinkPtr);
6037	}
6038	}
6039
6040	NOREF(pszInstr);
6041	NOREF(pszFailure);
6042	return VINF_SUCCESS;
6043	}
6044
6045
6046	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6047	/**
6048	* Checks guest PDPTEs as part of VM-entry.
6049	*
6050	* @param pVCpu The cross context virtual CPU structure.
6051	* @param pszInstr The VMX instruction name (for logging purposes).
6052	*/
6053	static int iemVmxVmentryCheckGuestPdptes(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6054	{
6055	/*
6056	* Guest PDPTEs.
6057	* See Intel spec. 26.3.1.5 "Checks on Guest Page-Directory-Pointer-Table Entries".
6058	*/
6059	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6060	const char * const pszFailure = "VM-exit";
6061
6062	/*
6063	* When EPT is used, we need to validate the PAE PDPTEs provided in the VMCS.
6064	* Otherwise, we load any PAE PDPTEs referenced by CR3 at a later point.
6065	*/
6066	if ( iemVmxVmcsIsGuestPaePagingEnabled(pVmcs)
6067	&& (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT))
6068	{
6069	/* Get PDPTEs from the VMCS. */
6070	X86PDPE aPaePdptes[X86_PG_PAE_PDPE_ENTRIES];
6071	aPaePdptes[0].u = pVmcs->u64GuestPdpte0.u;
6072	aPaePdptes[1].u = pVmcs->u64GuestPdpte1.u;
6073	aPaePdptes[2].u = pVmcs->u64GuestPdpte2.u;
6074	aPaePdptes[3].u = pVmcs->u64GuestPdpte3.u;
6075
6076	/* Check validity of the PDPTEs. */
6077	if (PGMGstArePaePdpesValid(pVCpu, &aPaePdptes[0]))
6078	{ /* likely */ }
6079	else
6080	{
6081	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
6082	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte);
6083	}
6084	}
6085
6086	NOREF(pszFailure);
6087	NOREF(pszInstr);
6088	return VINF_SUCCESS;
6089	}
6090	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
6091
6092
6093	/**
6094	* Checks guest-state as part of VM-entry.
6095	*
6096	* @returns VBox status code.
6097	* @param pVCpu The cross context virtual CPU structure.
6098	* @param pszInstr The VMX instruction name (for logging purposes).
6099	*/
6100	static int iemVmxVmentryCheckGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6101	{
6102	int rc = iemVmxVmentryCheckGuestControlRegsMsrs(pVCpu, pszInstr);
6103	if (RT_SUCCESS(rc))
6104	{
6105	rc = iemVmxVmentryCheckGuestSegRegs(pVCpu, pszInstr);
6106	if (RT_SUCCESS(rc))
6107	{
6108	rc = iemVmxVmentryCheckGuestGdtrIdtr(pVCpu, pszInstr);
6109	if (RT_SUCCESS(rc))
6110	{
6111	rc = iemVmxVmentryCheckGuestRipRFlags(pVCpu, pszInstr);
6112	if (RT_SUCCESS(rc))
6113	{
6114	rc = iemVmxVmentryCheckGuestNonRegState(pVCpu, pszInstr);
6115	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6116	if (RT_SUCCESS(rc))
6117	rc = iemVmxVmentryCheckGuestPdptes(pVCpu, pszInstr);
6118	#endif
6119	}
6120	}
6121	}
6122	}
6123	return rc;
6124	}
6125
6126
6127	/**
6128	* Checks host-state as part of VM-entry.
6129	*
6130	* @returns VBox status code.
6131	* @param pVCpu The cross context virtual CPU structure.
6132	* @param pszInstr The VMX instruction name (for logging purposes).
6133	*/
6134	static int iemVmxVmentryCheckHostState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6135	{
6136	/*
6137	* Host Control Registers and MSRs.
6138	* See Intel spec. 26.2.2 "Checks on Host Control Registers and MSRs".
6139	*/
6140	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6141	const char * const pszFailure = "VMFail";
6142
6143	/* CR0 reserved bits. */
6144	{
6145	/* CR0 MB1 bits. */
6146	uint64_t const u64Cr0Fixed0 = iemVmxGetCr0Fixed0(pVCpu, true /* fVmxNonRootMode */);
6147	if ((pVmcs->u64HostCr0.u & u64Cr0Fixed0) == u64Cr0Fixed0)
6148	{ /* likely */ }
6149	else
6150	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed0);
6151
6152	/* CR0 MBZ bits. */
6153	uint64_t const u64Cr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
6154	if (!(pVmcs->u64HostCr0.u & ~u64Cr0Fixed1))
6155	{ /* likely */ }
6156	else
6157	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr0Fixed1);
6158	}
6159
6160	/* CR4 reserved bits. */
6161	{
6162	/* CR4 MB1 bits. */
6163	uint64_t const u64Cr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
6164	if ((pVmcs->u64HostCr4.u & u64Cr4Fixed0) == u64Cr4Fixed0)
6165	{ /* likely */ }
6166	else
6167	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed0);
6168
6169	/* CR4 MBZ bits. */
6170	uint64_t const u64Cr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
6171	if (!(pVmcs->u64HostCr4.u & ~u64Cr4Fixed1))
6172	{ /* likely */ }
6173	else
6174	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Fixed1);
6175	}
6176
6177	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6178	{
6179	/* CR3 reserved bits. */
6180	if (!(pVmcs->u64HostCr3.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth))
6181	{ /* likely */ }
6182	else
6183	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr3);
6184
6185	/* SYSENTER ESP and SYSENTER EIP. */
6186	if ( X86_IS_CANONICAL(pVmcs->u64HostSysenterEsp.u)
6187	&& X86_IS_CANONICAL(pVmcs->u64HostSysenterEip.u))
6188	{ /* likely */ }
6189	else
6190	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSysenterEspEip);
6191	}
6192
6193	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6194	Assert(!(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PERF_MSR));
6195
6196	/* PAT MSR. */
6197	if ( !(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_PAT_MSR)
6198	\|\| CPUMIsPatMsrValid(pVmcs->u64HostPatMsr.u))
6199	{ /* likely */ }
6200	else
6201	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostPatMsr);
6202
6203	/* EFER MSR. */
6204	bool const fHostInLongMode = RT_BOOL(pVmcs->u32ExitCtls & VMX_EXIT_CTLS_HOST_ADDR_SPACE_SIZE);
6205	uint64_t const uValidEferMask = CPUMGetGuestEferMsrValidMask(pVCpu->CTX_SUFF(pVM));
6206	if (pVmcs->u32ExitCtls & VMX_EXIT_CTLS_LOAD_EFER_MSR)
6207	{
6208	if (!(pVmcs->u64HostEferMsr.u & ~uValidEferMask))
6209	{ /* likely */ }
6210	else
6211	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsrRsvd);
6212
6213	bool const fHostLma = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LMA);
6214	bool const fHostLme = RT_BOOL(pVmcs->u64HostEferMsr.u & MSR_K6_EFER_LME);
6215	if ( fHostInLongMode == fHostLma
6216	&& fHostInLongMode == fHostLme)
6217	{ /* likely */ }
6218	else
6219	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostEferMsr);
6220	}
6221
6222	/*
6223	* Host Segment and Descriptor-Table Registers.
6224	* See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
6225	*/
6226	/* Selector RPL and TI. */
6227	if ( !(pVmcs->HostCs & (X86_SEL_RPL \| X86_SEL_LDT))
6228	&& !(pVmcs->HostSs & (X86_SEL_RPL \| X86_SEL_LDT))
6229	&& !(pVmcs->HostDs & (X86_SEL_RPL \| X86_SEL_LDT))
6230	&& !(pVmcs->HostEs & (X86_SEL_RPL \| X86_SEL_LDT))
6231	&& !(pVmcs->HostFs & (X86_SEL_RPL \| X86_SEL_LDT))
6232	&& !(pVmcs->HostGs & (X86_SEL_RPL \| X86_SEL_LDT))
6233	&& !(pVmcs->HostTr & (X86_SEL_RPL \| X86_SEL_LDT)))
6234	{ /* likely */ }
6235	else
6236	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSel);
6237
6238	/* CS and TR selectors cannot be 0. */
6239	if ( pVmcs->HostCs
6240	&& pVmcs->HostTr)
6241	{ /* likely */ }
6242	else
6243	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCsTr);
6244
6245	/* SS cannot be 0 if 32-bit host. */
6246	if ( fHostInLongMode
6247	\|\| pVmcs->HostSs)
6248	{ /* likely */ }
6249	else
6250	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSs);
6251
6252	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6253	{
6254	/* FS, GS, GDTR, IDTR, TR base address. */
6255	if ( X86_IS_CANONICAL(pVmcs->u64HostFsBase.u)
6256	&& X86_IS_CANONICAL(pVmcs->u64HostGsBase.u)
6257	&& X86_IS_CANONICAL(pVmcs->u64HostGdtrBase.u)
6258	&& X86_IS_CANONICAL(pVmcs->u64HostIdtrBase.u)
6259	&& X86_IS_CANONICAL(pVmcs->u64HostTrBase.u))
6260	{ /* likely */ }
6261	else
6262	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostSegBase);
6263	}
6264
6265	/*
6266	* Host address-space size for 64-bit CPUs.
6267	* See Intel spec. 26.2.4 "Checks Related to Address-Space Size".
6268	*/
6269	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6270	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6271	{
6272	bool const fCpuInLongMode = CPUMIsGuestInLongMode(pVCpu);
6273
6274	/* Logical processor in IA-32e mode. */
6275	if (fCpuInLongMode)
6276	{
6277	if (fHostInLongMode)
6278	{
6279	/* PAE must be set. */
6280	if (pVmcs->u64HostCr4.u & X86_CR4_PAE)
6281	{ /* likely */ }
6282	else
6283	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pae);
6284
6285	/* RIP must be canonical. */
6286	if (X86_IS_CANONICAL(pVmcs->u64HostRip.u))
6287	{ /* likely */ }
6288	else
6289	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRip);
6290	}
6291	else
6292	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostLongMode);
6293	}
6294	else
6295	{
6296	/* Logical processor is outside IA-32e mode. */
6297	if ( !fGstInLongMode
6298	&& !fHostInLongMode)
6299	{
6300	/* PCIDE should not be set. */
6301	if (!(pVmcs->u64HostCr4.u & X86_CR4_PCIDE))
6302	{ /* likely */ }
6303	else
6304	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostCr4Pcide);
6305
6306	/* The high 32-bits of RIP MBZ. */
6307	if (!pVmcs->u64HostRip.s.Hi)
6308	{ /* likely */ }
6309	else
6310	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostRipRsvd);
6311	}
6312	else
6313	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongMode);
6314	}
6315	}
6316	else
6317	{
6318	/* Host address-space size for 32-bit CPUs. */
6319	if ( !fGstInLongMode
6320	&& !fHostInLongMode)
6321	{ /* likely */ }
6322	else
6323	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_HostGuestLongModeNoCpu);
6324	}
6325
6326	NOREF(pszInstr);
6327	NOREF(pszFailure);
6328	return VINF_SUCCESS;
6329	}
6330
6331
6332	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6333	/**
6334	* Checks the EPT pointer VMCS field as part of VM-entry.
6335	*
6336	* @returns VBox status code.
6337	* @param pVCpu The cross context virtual CPU structure.
6338	* @param uEptPtr The EPT pointer to check.
6339	* @param penmVmxDiag Where to store the diagnostic reason on failure (not
6340	* updated on success). Optional, can be NULL.
6341	*/
6342	static int iemVmxVmentryCheckEptPtr(PVMCPUCC pVCpu, uint64_t uEptPtr, VMXVDIAG *penmVmxDiag) RT_NOEXCEPT
6343	{
6344	VMXVDIAG enmVmxDiag;
6345
6346	/* Reserved bits. */
6347	uint8_t const cMaxPhysAddrWidth = IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cMaxPhysAddrWidth;
6348	uint64_t const fValidMask = VMX_EPTP_VALID_MASK & ~(UINT64_MAX << cMaxPhysAddrWidth);
6349	if (uEptPtr & fValidMask)
6350	{
6351	/* Memory Type. */
6352	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
6353	uint8_t const fMemType = RT_BF_GET(uEptPtr, VMX_BF_EPTP_MEMTYPE);
6354	if ( ( fMemType == VMX_EPTP_MEMTYPE_WB
6355	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_WB))
6356	\|\| ( fMemType == VMX_EPTP_MEMTYPE_UC
6357	&& RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_MEMTYPE_UC)))
6358	{
6359	/*
6360	* Page walk length (PML4).
6361	* Intel used to specify bit 7 of IA32_VMX_EPT_VPID_CAP as page walk length
6362	* of 5 but that seems to be removed from the latest specs. leaving only PML4
6363	* as the maximum supported page-walk level hence we hardcode it as 3 (1 less than 4)
6364	*/
6365	Assert(RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_PAGE_WALK_LENGTH_4));
6366	if (RT_BF_GET(uEptPtr, VMX_BF_EPTP_PAGE_WALK_LENGTH) == 3)
6367	{
6368	/* Access and dirty bits support in EPT structures. */
6369	if ( !RT_BF_GET(uEptPtr, VMX_BF_EPTP_ACCESS_DIRTY)
6370	\|\| RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_ACCESS_DIRTY))
6371	return VINF_SUCCESS;
6372
6373	enmVmxDiag = kVmxVDiag_Vmentry_EptpAccessDirty;
6374	}
6375	else
6376	enmVmxDiag = kVmxVDiag_Vmentry_EptpPageWalkLength;
6377	}
6378	else
6379	enmVmxDiag = kVmxVDiag_Vmentry_EptpMemType;
6380	}
6381	else
6382	enmVmxDiag = kVmxVDiag_Vmentry_EptpRsvd;
6383
6384	if (penmVmxDiag)
6385	*penmVmxDiag = enmVmxDiag;
6386	return VERR_VMX_VMENTRY_FAILED;
6387	}
6388	#endif
6389
6390
6391	/**
6392	* Checks VMCS controls fields as part of VM-entry.
6393	*
6394	* @returns VBox status code.
6395	* @param pVCpu The cross context virtual CPU structure.
6396	* @param pszInstr The VMX instruction name (for logging purposes).
6397	*
6398	* @remarks This may update secondary-processor based VM-execution control fields
6399	* in the current VMCS if necessary.
6400	*/
6401	static int iemVmxVmentryCheckCtls(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6402	{
6403	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6404	const char * const pszFailure = "VMFail";
6405	bool const fVmxTrueMsrs = RT_BOOL(pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Basic & VMX_BF_BASIC_TRUE_CTLS_MASK);
6406
6407	/*
6408	* VM-execution controls.
6409	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6410	*/
6411	{
6412	/* Pin-based VM-execution controls. */
6413	{
6414	VMXCTLSMSR const PinCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TruePinCtls
6415	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.PinCtls;
6416	if (!(~pVmcs->u32PinCtls & PinCtls.n.allowed0))
6417	{ /* likely */ }
6418	else
6419	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsDisallowed0);
6420
6421	if (!(pVmcs->u32PinCtls & ~PinCtls.n.allowed1))
6422	{ /* likely */ }
6423	else
6424	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_PinCtlsAllowed1);
6425	}
6426
6427	/* Processor-based VM-execution controls. */
6428	{
6429	VMXCTLSMSR const ProcCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueProcCtls
6430	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls;
6431	if (!(~pVmcs->u32ProcCtls & ProcCtls.n.allowed0))
6432	{ /* likely */ }
6433	else
6434	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsDisallowed0);
6435
6436	if (!(pVmcs->u32ProcCtls & ~ProcCtls.n.allowed1))
6437	{ /* likely */ }
6438	else
6439	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtlsAllowed1);
6440	}
6441
6442	/* Secondary processor-based VM-execution controls. */
6443	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_SECONDARY_CTLS)
6444	{
6445	VMXCTLSMSR const ProcCtls2 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ProcCtls2;
6446	if (!(~pVmcs->u32ProcCtls2 & ProcCtls2.n.allowed0))
6447	{ /* likely */ }
6448	else
6449	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Disallowed0);
6450
6451	if (!(pVmcs->u32ProcCtls2 & ~ProcCtls2.n.allowed1))
6452	{ /* likely */ }
6453	else
6454	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ProcCtls2Allowed1);
6455	}
6456	else if (pVmcs->u32ProcCtls2)
6457	{
6458	/*
6459	* If the "activate secondary controls" is clear, then the secondary processor-based VM-execution controls
6460	* is treated as 0.
6461	*
6462	* See Intel spec. 26.2.1.1 "VM-Execution Control Fields".
6463	*
6464	* Since this is a rather rare occurrence (only observed for a few VM-entries with Microsoft Hyper-V
6465	* enabled Windows Server 2008 R2 guest), it's not worth changing every place that reads this control to
6466	* also check the "activate secondary controls" bit. Instead, we temporarily save the guest programmed
6467	* control here, zero out the value the rest of our code uses and restore the guest programmed value
6468	* on VM-exit.
6469	*/
6470	pVmcs->u32RestoreProcCtls2 = pVmcs->u32ProcCtls2;
6471	pVmcs->u32ProcCtls2 = 0;
6472	}
6473
6474	/* CR3-target count. */
6475	if (pVmcs->u32Cr3TargetCount <= VMX_V_CR3_TARGET_COUNT)
6476	{ /* likely */ }
6477	else
6478	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Cr3TargetCount);
6479
6480	/* I/O bitmaps physical addresses. */
6481	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
6482	{
6483	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
6484	if ( !(GCPhysIoBitmapA & X86_PAGE_4K_OFFSET_MASK)
6485	&& !(GCPhysIoBitmapA >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6486	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapA))
6487	{ /* likely */ }
6488	else
6489	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapA);
6490
6491	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
6492	if ( !(GCPhysIoBitmapB & X86_PAGE_4K_OFFSET_MASK)
6493	&& !(GCPhysIoBitmapB >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6494	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysIoBitmapB))
6495	{ /* likely */ }
6496	else
6497	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrIoBitmapB);
6498	}
6499
6500	/* MSR bitmap physical address. */
6501	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
6502	{
6503	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
6504	if ( !(GCPhysMsrBitmap & X86_PAGE_4K_OFFSET_MASK)
6505	&& !(GCPhysMsrBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6506	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysMsrBitmap))
6507	{ /* likely */ }
6508	else
6509	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrMsrBitmap);
6510	}
6511
6512	/* TPR shadow related controls. */
6513	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6514	{
6515	/* Virtual-APIC page physical address. */
6516	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6517	if ( !(GCPhysVirtApic & X86_PAGE_4K_OFFSET_MASK)
6518	&& !(GCPhysVirtApic >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6519	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVirtApic))
6520	{ /* likely */ }
6521	else
6522	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVirtApicPage);
6523
6524	/* TPR threshold bits 31:4 MBZ without virtual-interrupt delivery. */
6525	if ( !(pVmcs->u32TprThreshold & ~VMX_TPR_THRESHOLD_MASK)
6526	\|\| (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6527	{ /* likely */ }
6528	else
6529	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdRsvd);
6530
6531	/* The rest done XXX document */
6532	}
6533	else
6534	{
6535	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6536	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6537	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
6538	{ /* likely */ }
6539	else
6540	{
6541	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6542	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicTprShadow);
6543	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_APIC_REG_VIRT)
6544	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ApicRegVirt);
6545	Assert(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY);
6546	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtIntDelivery);
6547	}
6548	}
6549
6550	/* NMI exiting and virtual-NMIs. */
6551	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_NMI_EXIT)
6552	\|\| !(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI))
6553	{ /* likely */ }
6554	else
6555	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtNmi);
6556
6557	/* Virtual-NMIs and NMI-window exiting. */
6558	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
6559	\|\| !(pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT))
6560	{ /* likely */ }
6561	else
6562	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_NmiWindowExit);
6563
6564	/* Virtualize APIC accesses. */
6565	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
6566	{
6567	/* APIC-access physical address. */
6568	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
6569	if ( !(GCPhysApicAccess & X86_PAGE_4K_OFFSET_MASK)
6570	&& !(GCPhysApicAccess >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6571	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysApicAccess))
6572	{ /* likely */ }
6573	else
6574	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccess);
6575
6576	/*
6577	* Disallow APIC-access page and virtual-APIC page from being the same address.
6578	* Note! This is not an Intel requirement, but one imposed by our implementation.
6579	* This is done primarily to simplify recursion scenarios while redirecting accesses
6580	* between the APIC-access page and the virtual-APIC page. If any nested hypervisor
6581	* requires this, we can implement it later
6582	*/
6583	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
6584	{
6585	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
6586	if (GCPhysVirtApic != GCPhysApicAccess)
6587	{ /* likely */ }
6588	else
6589	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessEqVirtApic);
6590	}
6591	}
6592
6593	/* Virtualize-x2APIC mode is mutually exclusive with virtualize-APIC accesses. */
6594	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_X2APIC_MODE)
6595	\|\| !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
6596	{ /* likely */ }
6597	else
6598	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6599
6600	/* Virtual-interrupt delivery requires external interrupt exiting. */
6601	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY)
6602	\|\| (pVmcs->u32PinCtls & VMX_PIN_CTLS_EXT_INT_EXIT))
6603	{ /* likely */ }
6604	else
6605	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtX2ApicVirtApic);
6606
6607	/* VPID. */
6608	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VPID)
6609	\|\| pVmcs->u16Vpid != 0)
6610	{ /* likely */ }
6611	else
6612	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_Vpid);
6613
6614	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
6615	/* Extended-Page-Table Pointer (EPTP). */
6616	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
6617	{
6618	VMXVDIAG enmVmxDiag;
6619	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, pVmcs->u64EptPtr.u, &enmVmxDiag);
6620	if (RT_SUCCESS(rc))
6621	{ /* likely */ }
6622	else
6623	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, enmVmxDiag, rc);
6624	}
6625	#else
6626	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT));
6627	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST));
6628	#endif
6629	Assert(!(pVmcs->u32PinCtls & VMX_PIN_CTLS_POSTED_INT)); /* We don't support posted interrupts yet. */
6630	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_PML)); /* We don't support PML yet. */
6631	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMFUNC)); /* We don't support VM functions yet. */
6632	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT_XCPT_VE)); /* We don't support EPT-violation #VE yet. */
6633	Assert(!(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_TSC_SCALING)); /* We don't support TSC-scaling yet. */
6634
6635	/* VMCS shadowing. */
6636	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
6637	{
6638	/* VMREAD-bitmap physical address. */
6639	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
6640	if ( !(GCPhysVmreadBitmap & X86_PAGE_4K_OFFSET_MASK)
6641	&& !(GCPhysVmreadBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6642	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmreadBitmap))
6643	{ /* likely */ }
6644	else
6645	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmreadBitmap);
6646
6647	/* VMWRITE-bitmap physical address. */
6648	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmreadBitmap.u;
6649	if ( !(GCPhysVmwriteBitmap & X86_PAGE_4K_OFFSET_MASK)
6650	&& !(GCPhysVmwriteBitmap >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6651	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmwriteBitmap))
6652	{ /* likely */ }
6653	else
6654	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrVmwriteBitmap);
6655	}
6656	}
6657
6658	/*
6659	* VM-exit controls.
6660	* See Intel spec. 26.2.1.2 "VM-Exit Control Fields".
6661	*/
6662	{
6663	VMXCTLSMSR const ExitCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueExitCtls
6664	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.ExitCtls;
6665	if (!(~pVmcs->u32ExitCtls & ExitCtls.n.allowed0))
6666	{ /* likely */ }
6667	else
6668	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsDisallowed0);
6669
6670	if (!(pVmcs->u32ExitCtls & ~ExitCtls.n.allowed1))
6671	{ /* likely */ }
6672	else
6673	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_ExitCtlsAllowed1);
6674
6675	/* Save preemption timer without activating it. */
6676	if ( (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
6677	\|\| !(pVmcs->u32ProcCtls & VMX_EXIT_CTLS_SAVE_PREEMPT_TIMER))
6678	{ /* likely */ }
6679	else
6680	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_SavePreemptTimer);
6681
6682	/* VM-exit MSR-store count and VM-exit MSR-store area address. */
6683	if (pVmcs->u32ExitMsrStoreCount)
6684	{
6685	if ( !(pVmcs->u64AddrExitMsrStore.u & VMX_AUTOMSR_OFFSET_MASK)
6686	&& !(pVmcs->u64AddrExitMsrStore.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6687	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrStore.u))
6688	{ /* likely */ }
6689	else
6690	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrStore);
6691	}
6692
6693	/* VM-exit MSR-load count and VM-exit MSR-load area address. */
6694	if (pVmcs->u32ExitMsrLoadCount)
6695	{
6696	if ( !(pVmcs->u64AddrExitMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6697	&& !(pVmcs->u64AddrExitMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6698	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrExitMsrLoad.u))
6699	{ /* likely */ }
6700	else
6701	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrExitMsrLoad);
6702	}
6703	}
6704
6705	/*
6706	* VM-entry controls.
6707	* See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
6708	*/
6709	{
6710	VMXCTLSMSR const EntryCtls = fVmxTrueMsrs ? pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.TrueEntryCtls
6711	: pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.EntryCtls;
6712	if (!(~pVmcs->u32EntryCtls & EntryCtls.n.allowed0))
6713	{ /* likely */ }
6714	else
6715	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsDisallowed0);
6716
6717	if (!(pVmcs->u32EntryCtls & ~EntryCtls.n.allowed1))
6718	{ /* likely */ }
6719	else
6720	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryCtlsAllowed1);
6721
6722	/* Event injection. */
6723	uint32_t const uIntInfo = pVmcs->u32EntryIntInfo;
6724	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VALID))
6725	{
6726	/* Type and vector. */
6727	uint8_t const uType = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_TYPE);
6728	uint8_t const uVector = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_VECTOR);
6729	uint8_t const uRsvd = RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_RSVD_12_30);
6730	if ( !uRsvd
6731	&& VMXIsEntryIntInfoTypeValid(IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxMonitorTrapFlag, uType)
6732	&& VMXIsEntryIntInfoVectorValid(uVector, uType))
6733	{ /* likely */ }
6734	else
6735	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoTypeVecRsvd);
6736
6737	/* Exception error code. */
6738	if (RT_BF_GET(uIntInfo, VMX_BF_ENTRY_INT_INFO_ERR_CODE_VALID))
6739	{
6740	/* Delivery possible only in Unrestricted-guest mode when CR0.PE is set. */
6741	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_UNRESTRICTED_GUEST)
6742	\|\| (pVmcs->u64GuestCr0.s.Lo & X86_CR0_PE))
6743	{ /* likely */ }
6744	else
6745	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodePe);
6746
6747	/* Exceptions that provide an error code. */
6748	if (uType == VMX_ENTRY_INT_INFO_TYPE_HW_XCPT)
6749	{
6750	if ( uVector == X86_XCPT_DF
6751	\|\| uVector == X86_XCPT_TS
6752	\|\| uVector == X86_XCPT_NP
6753	\|\| uVector == X86_XCPT_SS
6754	\|\| uVector == X86_XCPT_GP
6755	\|\| uVector == X86_XCPT_PF
6756	\|\| uVector == X86_XCPT_AC)
6757	{ /* likely */ }
6758	else
6759	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryIntInfoErrCodeVec);
6760	}
6761
6762	/* Exception error-code reserved bits. */
6763	if (!(pVmcs->u32EntryXcptErrCode & ~VMX_ENTRY_INT_XCPT_ERR_CODE_VALID_MASK))
6764	{ /* likely */ }
6765	else
6766	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryXcptErrCodeRsvd);
6767
6768	/* Injecting a software interrupt, software exception or privileged software exception. */
6769	if ( uType == VMX_ENTRY_INT_INFO_TYPE_SW_INT
6770	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_SW_XCPT
6771	\|\| uType == VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT)
6772	{
6773	/* Instruction length must be in the range 0-15. */
6774	if (pVmcs->u32EntryInstrLen <= VMX_ENTRY_INSTR_LEN_MAX)
6775	{ /* likely */ }
6776	else
6777	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLen);
6778
6779	/* However, instruction length of 0 is allowed only when its CPU feature is present. */
6780	if ( pVmcs->u32EntryInstrLen != 0
6781	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEntryInjectSoftInt)
6782	{ /* likely */ }
6783	else
6784	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_EntryInstrLenZero);
6785	}
6786	}
6787	}
6788
6789	/* VM-entry MSR-load count and VM-entry MSR-load area address. */
6790	if (pVmcs->u32EntryMsrLoadCount)
6791	{
6792	if ( !(pVmcs->u64AddrEntryMsrLoad.u & VMX_AUTOMSR_OFFSET_MASK)
6793	&& !(pVmcs->u64AddrEntryMsrLoad.u >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth)
6794	&& PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), pVmcs->u64AddrEntryMsrLoad.u))
6795	{ /* likely */ }
6796	else
6797	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrEntryMsrLoad);
6798	}
6799
6800	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_ENTRY_TO_SMM)); /* We don't support SMM yet. */
6801	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_DEACTIVATE_DUAL_MON)); /* We don't support dual-monitor treatment yet. */
6802	}
6803
6804	NOREF(pszInstr);
6805	NOREF(pszFailure);
6806	return VINF_SUCCESS;
6807	}
6808
6809
6810	/**
6811	* Loads the guest control registers, debug register and some MSRs as part of
6812	* VM-entry.
6813	*
6814	* @param pVCpu The cross context virtual CPU structure.
6815	*/
6816	static void iemVmxVmentryLoadGuestControlRegsMsrs(PVMCPUCC pVCpu) RT_NOEXCEPT
6817	{
6818	/*
6819	* Load guest control registers, debug registers and MSRs.
6820	* See Intel spec. 26.3.2.1 "Loading Guest Control Registers, Debug Registers and MSRs".
6821	*/
6822	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6823
6824	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6825	uint64_t const uGstCr0 = (pVmcs->u64GuestCr0.u & ~VMX_ENTRY_GUEST_CR0_IGNORE_MASK)
6826	\| (pVCpu->cpum.GstCtx.cr0 & VMX_ENTRY_GUEST_CR0_IGNORE_MASK);
6827	pVCpu->cpum.GstCtx.cr0 = uGstCr0;
6828	pVCpu->cpum.GstCtx.cr4 = pVmcs->u64GuestCr4.u;
6829	pVCpu->cpum.GstCtx.cr3 = pVmcs->u64GuestCr3.u;
6830
6831	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_DEBUG)
6832	pVCpu->cpum.GstCtx.dr[7] = (pVmcs->u64GuestDr7.u & ~VMX_ENTRY_GUEST_DR7_MBZ_MASK) \| VMX_ENTRY_GUEST_DR7_MB1_MASK;
6833
6834	pVCpu->cpum.GstCtx.SysEnter.eip = pVmcs->u64GuestSysenterEip.s.Lo;
6835	pVCpu->cpum.GstCtx.SysEnter.esp = pVmcs->u64GuestSysenterEsp.s.Lo;
6836	pVCpu->cpum.GstCtx.SysEnter.cs = pVmcs->u32GuestSysenterCS;
6837
6838	if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLongMode)
6839	{
6840	/* FS base and GS base are loaded while loading the rest of the guest segment registers. */
6841
6842	/* EFER MSR. */
6843	if (!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR))
6844	{
6845	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_EFER);
6846	uint64_t const uHostEfer = pVCpu->cpum.GstCtx.msrEFER;
6847	bool const fGstInLongMode = RT_BOOL(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_IA32E_MODE_GUEST);
6848	bool const fGstPaging = RT_BOOL(uGstCr0 & X86_CR0_PG);
6849	if (fGstInLongMode)
6850	{
6851	/* If the nested-guest is in long mode, LMA and LME are both set. */
6852	Assert(fGstPaging);
6853	pVCpu->cpum.GstCtx.msrEFER = uHostEfer \| (MSR_K6_EFER_LMA \| MSR_K6_EFER_LME);
6854	}
6855	else
6856	{
6857	/*
6858	* If the nested-guest is outside long mode:
6859	* - With paging: LMA is cleared, LME is cleared.
6860	* - Without paging: LMA is cleared, LME is left unmodified.
6861	*/
6862	uint64_t const fLmaLmeMask = MSR_K6_EFER_LMA \| (fGstPaging ? MSR_K6_EFER_LME : 0);
6863	pVCpu->cpum.GstCtx.msrEFER = uHostEfer & ~fLmaLmeMask;
6864	}
6865	}
6866	/* else: see below. */
6867	}
6868
6869	/* PAT MSR. */
6870	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PAT_MSR)
6871	pVCpu->cpum.GstCtx.msrPAT = pVmcs->u64GuestPatMsr.u;
6872
6873	/* EFER MSR. */
6874	if (pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_EFER_MSR)
6875	pVCpu->cpum.GstCtx.msrEFER = pVmcs->u64GuestEferMsr.u;
6876
6877	/* We don't support IA32_PERF_GLOBAL_CTRL MSR yet. */
6878	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_PERF_MSR));
6879
6880	/* We don't support IA32_BNDCFGS MSR yet. */
6881	Assert(!(pVmcs->u32EntryCtls & VMX_ENTRY_CTLS_LOAD_BNDCFGS_MSR));
6882
6883	/* Nothing to do for SMBASE register - We don't support SMM yet. */
6884	}
6885
6886
6887	/**
6888	* Loads the guest segment registers, GDTR, IDTR, LDTR and TR as part of VM-entry.
6889	*
6890	* @param pVCpu The cross context virtual CPU structure.
6891	*/
6892	static void iemVmxVmentryLoadGuestSegRegs(PVMCPUCC pVCpu) RT_NOEXCEPT
6893	{
6894	/*
6895	* Load guest segment registers, GDTR, IDTR, LDTR and TR.
6896	* See Intel spec. 26.3.2.2 "Loading Guest Segment Registers and Descriptor-Table Registers".
6897	*/
6898	/* CS, SS, ES, DS, FS, GS. */
6899	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
6900	for (unsigned iSegReg = 0; iSegReg < X86_SREG_COUNT; iSegReg++)
6901	{
6902	PCPUMSELREG pGstSelReg = &pVCpu->cpum.GstCtx.aSRegs[iSegReg];
6903	CPUMSELREG VmcsSelReg;
6904	int rc = iemVmxVmcsGetGuestSegReg(pVmcs, iSegReg, &VmcsSelReg);
6905	AssertRC(rc); NOREF(rc);
6906	if (!(VmcsSelReg.Attr.u & X86DESCATTR_UNUSABLE))
6907	{
6908	pGstSelReg->Sel = VmcsSelReg.Sel;
6909	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6910	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6911	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6912	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6913	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6914	}
6915	else
6916	{
6917	pGstSelReg->Sel = VmcsSelReg.Sel;
6918	pGstSelReg->ValidSel = VmcsSelReg.Sel;
6919	pGstSelReg->fFlags = CPUMSELREG_FLAGS_VALID;
6920	switch (iSegReg)
6921	{
6922	case X86_SREG_CS:
6923	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6924	pGstSelReg->u32Limit = VmcsSelReg.u32Limit;
6925	pGstSelReg->Attr.u = VmcsSelReg.Attr.u;
6926	break;
6927
6928	case X86_SREG_SS:
6929	pGstSelReg->u64Base = VmcsSelReg.u64Base & UINT32_C(0xfffffff0);
6930	pGstSelReg->u32Limit = 0;
6931	pGstSelReg->Attr.u = (VmcsSelReg.Attr.u & X86DESCATTR_DPL) \| X86DESCATTR_D \| X86DESCATTR_UNUSABLE;
6932	break;
6933
6934	case X86_SREG_ES:
6935	case X86_SREG_DS:
6936	pGstSelReg->u64Base = 0;
6937	pGstSelReg->u32Limit = 0;
6938	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6939	break;
6940
6941	case X86_SREG_FS:
6942	case X86_SREG_GS:
6943	pGstSelReg->u64Base = VmcsSelReg.u64Base;
6944	pGstSelReg->u32Limit = 0;
6945	pGstSelReg->Attr.u = X86DESCATTR_UNUSABLE;
6946	break;
6947	}
6948	Assert(pGstSelReg->Attr.n.u1Unusable);
6949	}
6950	}
6951
6952	/* LDTR. */
6953	pVCpu->cpum.GstCtx.ldtr.Sel = pVmcs->GuestLdtr;
6954	pVCpu->cpum.GstCtx.ldtr.ValidSel = pVmcs->GuestLdtr;
6955	pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
6956	if (!(pVmcs->u32GuestLdtrAttr & X86DESCATTR_UNUSABLE))
6957	{
6958	pVCpu->cpum.GstCtx.ldtr.u64Base = pVmcs->u64GuestLdtrBase.u;
6959	pVCpu->cpum.GstCtx.ldtr.u32Limit = pVmcs->u32GuestLdtrLimit;
6960	pVCpu->cpum.GstCtx.ldtr.Attr.u = pVmcs->u32GuestLdtrAttr;
6961	}
6962	else
6963	{
6964	pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
6965	pVCpu->cpum.GstCtx.ldtr.u32Limit = 0;
6966	pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
6967	}
6968
6969	/* TR. */
6970	Assert(!(pVmcs->u32GuestTrAttr & X86DESCATTR_UNUSABLE));
6971	pVCpu->cpum.GstCtx.tr.Sel = pVmcs->GuestTr;
6972	pVCpu->cpum.GstCtx.tr.ValidSel = pVmcs->GuestTr;
6973	pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
6974	pVCpu->cpum.GstCtx.tr.u64Base = pVmcs->u64GuestTrBase.u;
6975	pVCpu->cpum.GstCtx.tr.u32Limit = pVmcs->u32GuestTrLimit;
6976	pVCpu->cpum.GstCtx.tr.Attr.u = pVmcs->u32GuestTrAttr;
6977
6978	/* GDTR. */
6979	pVCpu->cpum.GstCtx.gdtr.cbGdt = pVmcs->u32GuestGdtrLimit;
6980	pVCpu->cpum.GstCtx.gdtr.pGdt = pVmcs->u64GuestGdtrBase.u;
6981
6982	/* IDTR. */
6983	pVCpu->cpum.GstCtx.idtr.cbIdt = pVmcs->u32GuestIdtrLimit;
6984	pVCpu->cpum.GstCtx.idtr.pIdt = pVmcs->u64GuestIdtrBase.u;
6985	}
6986
6987
6988	/**
6989	* Loads the guest MSRs from the VM-entry MSR-load area as part of VM-entry.
6990	*
6991	* @returns VBox status code.
6992	* @param pVCpu The cross context virtual CPU structure.
6993	* @param pszInstr The VMX instruction name (for logging purposes).
6994	*/
6995	static int iemVmxVmentryLoadGuestAutoMsrs(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
6996	{
6997	/*
6998	* Load guest MSRs.
6999	* See Intel spec. 26.4 "Loading MSRs".
7000	*/
7001	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7002	const char *const pszFailure = "VM-exit";
7003
7004	/*
7005	* The VM-entry MSR-load area address need not be a valid guest-physical address if the
7006	* VM-entry MSR load count is 0. If this is the case, bail early without reading it.
7007	* See Intel spec. 24.8.2 "VM-Entry Controls for MSRs".
7008	*/
7009	uint32_t const cMsrs = RT_MIN(pVmcs->u32EntryMsrLoadCount, RT_ELEMENTS(pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea));
7010	if (!cMsrs)
7011	return VINF_SUCCESS;
7012
7013	/*
7014	* Verify the MSR auto-load count. Physical CPUs can behave unpredictably if the count is
7015	* exceeded including possibly raising #MC exceptions during VMX transition. Our
7016	* implementation shall fail VM-entry with an VMX_EXIT_ERR_MSR_LOAD VM-exit.
7017	*/
7018	bool const fIsMsrCountValid = iemVmxIsAutoMsrCountValid(pVCpu, cMsrs);
7019	if (fIsMsrCountValid)
7020	{ /* likely */ }
7021	else
7022	{
7023	iemVmxVmcsSetExitQual(pVCpu, VMX_V_AUTOMSR_AREA_SIZE / sizeof(VMXAUTOMSR));
7024	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadCount);
7025	}
7026
7027	RTGCPHYS const GCPhysVmEntryMsrLoadArea = pVmcs->u64AddrEntryMsrLoad.u;
7028	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0],
7029	GCPhysVmEntryMsrLoadArea, cMsrs * sizeof(VMXAUTOMSR));
7030	if (RT_SUCCESS(rc))
7031	{
7032	PCVMXAUTOMSR pMsr = &pVCpu->cpum.GstCtx.hwvirt.vmx.aEntryMsrLoadArea[0];
7033	for (uint32_t idxMsr = 0; idxMsr < cMsrs; idxMsr++, pMsr++)
7034	{
7035	if ( !pMsr->u32Reserved
7036	&& pMsr->u32Msr != MSR_K8_FS_BASE
7037	&& pMsr->u32Msr != MSR_K8_GS_BASE
7038	&& pMsr->u32Msr != MSR_K6_EFER
7039	&& pMsr->u32Msr != MSR_IA32_SMM_MONITOR_CTL
7040	&& pMsr->u32Msr >> 8 != MSR_IA32_X2APIC_START >> 8)
7041	{
7042	VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, pMsr->u32Msr, pMsr->u64Value);
7043	if (rcStrict == VINF_SUCCESS)
7044	continue;
7045
7046	/*
7047	* If we're in ring-0, we cannot handle returns to ring-3 at this point and continue VM-entry.
7048	* If any nested hypervisor loads MSRs that require ring-3 handling, we cause a VM-entry failure
7049	* recording the MSR index in the Exit qualification (as per the Intel spec.) and indicated
7050	* further by our own, specific diagnostic code. Later, we can try implement handling of the
7051	* MSR in ring-0 if possible, or come up with a better, generic solution.
7052	*/
7053	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7054	VMXVDIAG const enmDiag = rcStrict == VINF_CPUM_R3_MSR_WRITE
7055	? kVmxVDiag_Vmentry_MsrLoadRing3
7056	: kVmxVDiag_Vmentry_MsrLoad;
7057	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, enmDiag);
7058	}
7059	else
7060	{
7061	iemVmxVmcsSetExitQual(pVCpu, idxMsr);
7062	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadRsvd);
7063	}
7064	}
7065	}
7066	else
7067	{
7068	AssertMsgFailed(("%s: Failed to read MSR auto-load area at %#RGp, rc=%Rrc\n", pszInstr, GCPhysVmEntryMsrLoadArea, rc));
7069	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrLoadPtrReadPhys, rc);
7070	}
7071
7072	NOREF(pszInstr);
7073	NOREF(pszFailure);
7074	return VINF_SUCCESS;
7075	}
7076
7077
7078	/**
7079	* Loads the guest-state non-register state as part of VM-entry.
7080	*
7081	* @returns VBox status code.
7082	* @param pVCpu The cross context virtual CPU structure.
7083	* @param pszInstr The VMX instruction name (for logging purposes).
7084	*
7085	* @remarks This must be called only after loading the nested-guest register state
7086	* (especially nested-guest RIP).
7087	*/
7088	static int iemVmxVmentryLoadGuestNonRegState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7089	{
7090	/*
7091	* Load guest non-register state.
7092	* See Intel spec. 26.6 "Special Features of VM Entry"
7093	*/
7094	const char *const pszFailure = "VM-exit";
7095	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7096
7097	/*
7098	* If VM-entry is not vectoring, block-by-STI and block-by-MovSS state must be loaded.
7099	* If VM-entry is vectoring, there is no block-by-STI or block-by-MovSS.
7100	*
7101	* See Intel spec. 26.6.1 "Interruptibility State".
7102	*/
7103	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, NULL /* puEntryIntInfoType */);
7104	if ( !fEntryVectoring
7105	&& (pVmcs->u32GuestIntrState & (VMX_VMCS_GUEST_INT_STATE_BLOCK_STI \| VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)))
7106	CPUMSetInInterruptShadowEx(&pVCpu->cpum.GstCtx, pVmcs->u64GuestRip.u);
7107	else
7108	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
7109
7110	/* NMI blocking. */
7111	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_NMI)
7112	{
7113	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI)
7114	{
7115	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = true;
7116	Assert(!CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx));
7117	}
7118	else
7119	{
7120	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7121	CPUMSetInterruptInhibitingByNmi(&pVCpu->cpum.GstCtx);
7122	}
7123	}
7124	else
7125	{
7126	pVCpu->cpum.GstCtx.hwvirt.vmx.fVirtNmiBlocking = false;
7127	Assert(!CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx));
7128	}
7129
7130	/* SMI blocking is irrelevant. We don't support SMIs yet. */
7131
7132	/*
7133	* Set PGM's copy of the EPT pointer.
7134	* The EPTP has already been validated while checking guest state.
7135	*
7136	* It is important to do this prior to mapping PAE PDPTEs (below).
7137	*/
7138	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7139	PGMSetGuestEptPtr(pVCpu, pVmcs->u64EptPtr.u);
7140
7141	/*
7142	* Load the guest's PAE PDPTEs.
7143	*/
7144	if (!iemVmxVmcsIsGuestPaePagingEnabled(pVmcs))
7145	{
7146	/*
7147	* When PAE paging is not used we clear the PAE PDPTEs for safety
7148	* in case we might be switching from a PAE host to a non-PAE guest.
7149	*/
7150	pVCpu->cpum.GstCtx.aPaePdpes[0].u = 0;
7151	pVCpu->cpum.GstCtx.aPaePdpes[1].u = 0;
7152	pVCpu->cpum.GstCtx.aPaePdpes[2].u = 0;
7153	pVCpu->cpum.GstCtx.aPaePdpes[3].u = 0;
7154	}
7155	else if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_EPT)
7156	{
7157	/*
7158	* With EPT and the nested-guest using PAE paging, we've already validated the PAE PDPTEs
7159	* while checking the guest state. We can load them into the nested-guest CPU state now.
7160	* They'll later be used while mapping CR3 and the PAE PDPTEs.
7161	*/
7162	pVCpu->cpum.GstCtx.aPaePdpes[0].u = pVmcs->u64GuestPdpte0.u;
7163	pVCpu->cpum.GstCtx.aPaePdpes[1].u = pVmcs->u64GuestPdpte1.u;
7164	pVCpu->cpum.GstCtx.aPaePdpes[2].u = pVmcs->u64GuestPdpte2.u;
7165	pVCpu->cpum.GstCtx.aPaePdpes[3].u = pVmcs->u64GuestPdpte3.u;
7166	}
7167	else
7168	{
7169	/*
7170	* Without EPT and the nested-guest using PAE paging, we must load the PAE PDPTEs
7171	* referenced by CR3. This involves loading (and mapping) CR3 and validating them now.
7172	*/
7173	int const rc = PGMGstMapPaePdpesAtCr3(pVCpu, pVmcs->u64GuestCr3.u);
7174	if (RT_SUCCESS(rc))
7175	{ /* likely */ }
7176	else
7177	{
7178	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_PDPTE);
7179	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_GuestPdpte, rc);
7180	}
7181	}
7182
7183	/* VPID is irrelevant. We don't support VPID yet. */
7184
7185	/* Clear address-range monitoring. */
7186	EMMonitorWaitClear(pVCpu);
7187
7188	return VINF_SUCCESS;
7189	}
7190
7191
7192	/**
7193	* Loads the guest VMCS referenced state (such as MSR bitmaps, I/O bitmaps etc).
7194	*
7195	* @param pVCpu The cross context virtual CPU structure.
7196	* @param pszInstr The VMX instruction name (for logging purposes).
7197	*
7198	* @remarks This assumes various VMCS related data structure pointers have already
7199	* been verified prior to calling this function.
7200	*/
7201	static int iemVmxVmentryLoadGuestVmcsRefState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7202	{
7203	const char *const pszFailure = "VM-exit";
7204	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7205
7206	/*
7207	* Virtualize APIC accesses.
7208	*/
7209	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7210	{
7211	/* APIC-access physical address. */
7212	RTGCPHYS const GCPhysApicAccess = pVmcs->u64AddrApicAccess.u;
7213
7214	/*
7215	* Register the handler for the APIC-access page.
7216	*
7217	* We don't deregister the APIC-access page handler during the VM-exit as a different
7218	* nested-VCPU might be using the same guest-physical address for its APIC-access page.
7219	*
7220	* We leave the page registered until the first access that happens outside VMX non-root
7221	* mode. Guest software is allowed to access structures such as the APIC-access page
7222	* only when no logical processor with a current VMCS references it in VMX non-root mode,
7223	* otherwise it can lead to unpredictable behavior including guest triple-faults.
7224	*
7225	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7226	*/
7227	/** @todo r=bird: The lazy deregistration of the page is potentially slightly
7228	* problematic, as the guest may cause us to create lots of access
7229	* handler entries. However, any slowdown or similar effects should
7230	* only ever affect the guest itself, so not a big issue. Though, I
7231	* wish there was most recently used approach or something to tracking
7232	* these... */
7233	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
7234	int rc = PGMHandlerPhysicalRegisterVmxApicAccessPage(pVM, GCPhysApicAccess, pVM->iem.s.hVmxApicAccessPage);
7235	if (RT_SUCCESS(rc))
7236	{ /* likely */ }
7237	else
7238	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_AddrApicAccessHandlerReg, rc);
7239	}
7240
7241	/*
7242	* VMCS shadowing.
7243	*/
7244	if (pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7245	{
7246	/* Read the VMREAD-bitmap. */
7247	RTGCPHYS const GCPhysVmreadBitmap = pVmcs->u64AddrVmreadBitmap.u;
7248	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap[0],
7249	GCPhysVmreadBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmreadBitmap));
7250	if (RT_SUCCESS(rc))
7251	{ /* likely */ }
7252	else
7253	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmreadBitmapPtrReadPhys, rc);
7254
7255	/* Read the VMWRITE-bitmap. */
7256	RTGCPHYS const GCPhysVmwriteBitmap = pVmcs->u64AddrVmwriteBitmap.u;
7257	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap[0],
7258	GCPhysVmwriteBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abVmwriteBitmap));
7259	if (RT_SUCCESS(rc))
7260	{ /* likely */ }
7261	else
7262	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmwriteBitmapPtrReadPhys, rc);
7263	}
7264
7265	/*
7266	* I/O bitmaps.
7267	*/
7268	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_IO_BITMAPS)
7269	{
7270	/* Read the IO bitmap A. */
7271	RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
7272	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[0],
7273	GCPhysIoBitmapA, VMX_V_IO_BITMAP_A_SIZE);
7274	if (RT_SUCCESS(rc))
7275	{ /* likely */ }
7276	else
7277	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapAPtrReadPhys, rc);
7278
7279	/* Read the IO bitmap B. */
7280	RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
7281	rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[VMX_V_IO_BITMAP_A_SIZE],
7282	GCPhysIoBitmapB, VMX_V_IO_BITMAP_B_SIZE);
7283	if (RT_SUCCESS(rc))
7284	{ /* likely */ }
7285	else
7286	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_IoBitmapBPtrReadPhys, rc);
7287	}
7288
7289	/*
7290	* TPR shadow and Virtual-APIC page.
7291	*/
7292	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
7293	{
7294	/* Verify TPR threshold and VTPR when both virtualize-APIC accesses and virtual-interrupt delivery aren't used. */
7295	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_APIC_ACCESS)
7296	&& !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VIRT_INT_DELIVERY))
7297	{
7298	/* Read the VTPR from the virtual-APIC page. */
7299	RTGCPHYS const GCPhysVirtApic = pVmcs->u64AddrVirtApic.u;
7300	uint8_t u8VTpr;
7301	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &u8VTpr, GCPhysVirtApic + XAPIC_OFF_TPR, sizeof(u8VTpr));
7302	if (RT_SUCCESS(rc))
7303	{ /* likely */ }
7304	else
7305	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VirtApicPagePtrReadPhys, rc);
7306
7307	/* Bits 3:0 of the TPR-threshold must not be greater than bits 7:4 of VTPR. */
7308	if ((uint8_t)RT_BF_GET(pVmcs->u32TprThreshold, VMX_BF_TPR_THRESHOLD_TPR) <= (u8VTpr & 0xf0))
7309	{ /* likely */ }
7310	else
7311	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_TprThresholdVTpr);
7312	}
7313	}
7314
7315	/*
7316	* VMCS link pointer.
7317	*/
7318	if (pVmcs->u64VmcsLinkPtr.u != UINT64_C(0xffffffffffffffff))
7319	{
7320	/* Read the VMCS-link pointer from guest memory. */
7321	RTGCPHYS const GCPhysShadowVmcs = pVmcs->u64VmcsLinkPtr.u;
7322	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs,
7323	GCPhysShadowVmcs, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs));
7324	if (RT_SUCCESS(rc))
7325	{ /* likely */ }
7326	else
7327	{
7328	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7329	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrReadPhys, rc);
7330	}
7331
7332	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
7333	if (pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID)
7334	{ /* likely */ }
7335	else
7336	{
7337	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7338	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrRevId);
7339	}
7340
7341	/* Verify the shadow bit is set if VMCS shadowing is enabled . */
7342	if ( !(pVmcs->u32ProcCtls2 & VMX_PROC_CTLS2_VMCS_SHADOWING)
7343	\|\| pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs.u32VmcsRevId.n.fIsShadowVmcs)
7344	{ /* likely */ }
7345	else
7346	{
7347	iemVmxVmcsSetExitQual(pVCpu, VMX_ENTRY_FAIL_QUAL_VMCS_LINK_PTR);
7348	IEM_VMX_VMENTRY_FAILED_RET(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_VmcsLinkPtrShadow);
7349	}
7350
7351	/* Update our cache of the guest physical address of the shadow VMCS. */
7352	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysShadowVmcs = GCPhysShadowVmcs;
7353	}
7354
7355	/*
7356	* MSR bitmap.
7357	*/
7358	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
7359	{
7360	/* Read the MSR bitmap. */
7361	RTGCPHYS const GCPhysMsrBitmap = pVmcs->u64AddrMsrBitmap.u;
7362	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap[0],
7363	GCPhysMsrBitmap, sizeof(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap));
7364	if (RT_SUCCESS(rc))
7365	{ /* likely */ }
7366	else
7367	IEM_VMX_VMENTRY_FAILED_RET_2(pVCpu, pszInstr, pszFailure, kVmxVDiag_Vmentry_MsrBitmapPtrReadPhys, rc);
7368	}
7369
7370	NOREF(pszFailure);
7371	NOREF(pszInstr);
7372	return VINF_SUCCESS;
7373	}
7374
7375
7376	/**
7377	* Loads the guest-state as part of VM-entry.
7378	*
7379	* @returns VBox status code.
7380	* @param pVCpu The cross context virtual CPU structure.
7381	* @param pszInstr The VMX instruction name (for logging purposes).
7382	*
7383	* @remarks This must be done after all the necessary steps prior to loading of
7384	* guest-state (e.g. checking various VMCS state).
7385	*/
7386	static int iemVmxVmentryLoadGuestState(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7387	{
7388	/* Load guest control registers, MSRs (that are directly part of the VMCS). */
7389	iemVmxVmentryLoadGuestControlRegsMsrs(pVCpu);
7390
7391	/* Load guest segment registers. */
7392	iemVmxVmentryLoadGuestSegRegs(pVCpu);
7393
7394	/*
7395	* Load guest RIP, RSP and RFLAGS.
7396	* See Intel spec. 26.3.2.3 "Loading Guest RIP, RSP and RFLAGS".
7397	*/
7398	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7399	pVCpu->cpum.GstCtx.rsp = pVmcs->u64GuestRsp.u;
7400	pVCpu->cpum.GstCtx.rip = pVmcs->u64GuestRip.u;
7401	pVCpu->cpum.GstCtx.rflags.u = pVmcs->u64GuestRFlags.u;
7402
7403	/* Initialize the PAUSE-loop controls as part of VM-entry. */
7404	pVCpu->cpum.GstCtx.hwvirt.vmx.uFirstPauseLoopTick = 0;
7405	pVCpu->cpum.GstCtx.hwvirt.vmx.uPrevPauseTick = 0;
7406
7407	/* Load guest non-register state (such as interrupt shadows, NMI blocking etc). */
7408	int rc = iemVmxVmentryLoadGuestNonRegState(pVCpu, pszInstr);
7409	if (rc == VINF_SUCCESS)
7410	{ /* likely */ }
7411	else
7412	return rc;
7413
7414	/* Load VMX related structures and state referenced by the VMCS. */
7415	rc = iemVmxVmentryLoadGuestVmcsRefState(pVCpu, pszInstr);
7416	if (rc == VINF_SUCCESS)
7417	{ /* likely */ }
7418	else
7419	return rc;
7420
7421	NOREF(pszInstr);
7422	return VINF_SUCCESS;
7423	}
7424
7425
7426	/**
7427	* Returns whether there are is a pending debug exception on VM-entry.
7428	*
7429	* @param pVCpu The cross context virtual CPU structure.
7430	* @param pszInstr The VMX instruction name (for logging purposes).
7431	*/
7432	static bool iemVmxVmentryIsPendingDebugXcpt(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7433	{
7434	/*
7435	* Pending debug exceptions.
7436	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7437	*/
7438	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7439	Assert(pVmcs);
7440
7441	bool fPendingDbgXcpt = RT_BOOL(pVmcs->u64GuestPendingDbgXcpts.u & ( VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_BS
7442	\| VMX_VMCS_GUEST_PENDING_DEBUG_XCPT_EN_BP));
7443	if (fPendingDbgXcpt)
7444	{
7445	uint8_t uEntryIntInfoType;
7446	bool const fEntryVectoring = VMXIsVmentryVectoring(pVmcs->u32EntryIntInfo, &uEntryIntInfoType);
7447	if (fEntryVectoring)
7448	{
7449	switch (uEntryIntInfoType)
7450	{
7451	case VMX_ENTRY_INT_INFO_TYPE_EXT_INT:
7452	case VMX_ENTRY_INT_INFO_TYPE_NMI:
7453	case VMX_ENTRY_INT_INFO_TYPE_HW_XCPT:
7454	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7455	fPendingDbgXcpt = false;
7456	break;
7457
7458	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7459	{
7460	/*
7461	* Whether the pending debug exception for software exceptions other than
7462	* #BP and #OF is delivered after injecting the exception or is discard
7463	* is CPU implementation specific. We will discard them (easier).
7464	*/
7465	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(pVmcs->u32EntryIntInfo);
7466	if ( uVector != X86_XCPT_BP
7467	&& uVector != X86_XCPT_OF)
7468	fPendingDbgXcpt = false;
7469	RT_FALL_THRU();
7470	}
7471	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7472	{
7473	if (!(pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS))
7474	fPendingDbgXcpt = false;
7475	break;
7476	}
7477	}
7478	}
7479	else
7480	{
7481	/*
7482	* When the VM-entry is not vectoring but there is blocking-by-MovSS, whether the
7483	* pending debug exception is held pending or is discarded is CPU implementation
7484	* specific. We will discard them (easier).
7485	*/
7486	if (pVmcs->u32GuestIntrState & VMX_VMCS_GUEST_INT_STATE_BLOCK_MOVSS)
7487	fPendingDbgXcpt = false;
7488
7489	/* There's no pending debug exception in the shutdown or wait-for-SIPI state. */
7490	if (pVmcs->u32GuestActivityState & (VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN \| VMX_VMCS_GUEST_ACTIVITY_SIPI_WAIT))
7491	fPendingDbgXcpt = false;
7492	}
7493	}
7494
7495	NOREF(pszInstr);
7496	return fPendingDbgXcpt;
7497	}
7498
7499
7500	/**
7501	* Set up the monitor-trap flag (MTF).
7502	*
7503	* @param pVCpu The cross context virtual CPU structure.
7504	* @param pszInstr The VMX instruction name (for logging purposes).
7505	*/
7506	static void iemVmxVmentrySetupMtf(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7507	{
7508	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7509	Assert(pVmcs);
7510	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_MONITOR_TRAP_FLAG)
7511	{
7512	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7513	Log(("%s: Monitor-trap flag set on VM-entry\n", pszInstr));
7514	}
7515	else
7516	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
7517	NOREF(pszInstr);
7518	}
7519
7520
7521	/**
7522	* Sets up NMI-window exiting.
7523	*
7524	* @param pVCpu The cross context virtual CPU structure.
7525	* @param pszInstr The VMX instruction name (for logging purposes).
7526	*/
7527	static void iemVmxVmentrySetupNmiWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7528	{
7529	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7530	Assert(pVmcs);
7531	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_NMI_WINDOW_EXIT)
7532	{
7533	Assert(pVmcs->u32PinCtls & VMX_PIN_CTLS_VIRT_NMI);
7534	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW);
7535	Log(("%s: NMI-window set on VM-entry\n", pszInstr));
7536	}
7537	else
7538	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW));
7539	NOREF(pszInstr);
7540	}
7541
7542
7543	/**
7544	* Sets up interrupt-window exiting.
7545	*
7546	* @param pVCpu The cross context virtual CPU structure.
7547	* @param pszInstr The VMX instruction name (for logging purposes).
7548	*/
7549	static void iemVmxVmentrySetupIntWindow(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7550	{
7551	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7552	Assert(pVmcs);
7553	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_INT_WINDOW_EXIT)
7554	{
7555	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW);
7556	Log(("%s: Interrupt-window set on VM-entry\n", pszInstr));
7557	}
7558	else
7559	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW));
7560	NOREF(pszInstr);
7561	}
7562
7563
7564	/**
7565	* Set up the VMX-preemption timer.
7566	*
7567	* @param pVCpu The cross context virtual CPU structure.
7568	* @param pszInstr The VMX instruction name (for logging purposes).
7569	*/
7570	static void iemVmxVmentrySetupPreemptTimer(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7571	{
7572	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7573	Assert(pVmcs);
7574	if (pVmcs->u32PinCtls & VMX_PIN_CTLS_PREEMPT_TIMER)
7575	{
7576	/*
7577	* If the timer is 0, we must cause a VM-exit before executing the first
7578	* nested-guest instruction. So we can flag as though the timer has already
7579	* expired and we will check and cause a VM-exit at the right priority elsewhere
7580	* in the code.
7581	*/
7582	uint64_t uEntryTick;
7583	uint32_t const uPreemptTimer = pVmcs->u32PreemptTimer;
7584	if (uPreemptTimer)
7585	{
7586	int rc = CPUMStartGuestVmxPremptTimer(pVCpu, uPreemptTimer, VMX_V_PREEMPT_TIMER_SHIFT, &uEntryTick);
7587	AssertRC(rc);
7588	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64\n", pszInstr, uEntryTick));
7589	}
7590	else
7591	{
7592	uEntryTick = TMCpuTickGetNoCheck(pVCpu);
7593	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER);
7594	Log(("%s: VM-entry set up VMX-preemption timer at %#RX64 to expire immediately!\n", pszInstr, uEntryTick));
7595	}
7596
7597	pVCpu->cpum.GstCtx.hwvirt.vmx.uEntryTick = uEntryTick;
7598	}
7599	else
7600	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
7601
7602	NOREF(pszInstr);
7603	}
7604
7605
7606	/**
7607	* Injects an event using TRPM given a VM-entry interruption info and related
7608	* fields.
7609	*
7610	* @param pVCpu The cross context virtual CPU structure.
7611	* @param pszInstr The VMX instruction name (for logging purposes).
7612	* @param uEntryIntInfo The VM-entry interruption info.
7613	* @param uErrCode The error code associated with the event if any.
7614	* @param cbInstr The VM-entry instruction length (for software
7615	* interrupts and software exceptions). Pass 0
7616	* otherwise.
7617	* @param GCPtrFaultAddress The guest CR2 if this is a \#PF event.
7618	*/
7619	static void iemVmxVmentryInjectTrpmEvent(PVMCPUCC pVCpu, const char *pszInstr, uint32_t uEntryIntInfo, uint32_t uErrCode,
7620	uint32_t cbInstr, RTGCUINTPTR GCPtrFaultAddress) RT_NOEXCEPT
7621	{
7622	Assert(VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo));
7623
7624	uint8_t const uType = VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo);
7625	uint8_t const uVector = VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo);
7626	TRPMEVENT const enmTrpmEvent = HMVmxEventTypeToTrpmEventType(uEntryIntInfo);
7627
7628	Assert(uType != VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT);
7629
7630	int rc = TRPMAssertTrap(pVCpu, uVector, enmTrpmEvent);
7631	AssertRC(rc);
7632	Log(("%s: Injecting: vector=%#x type=%#x (%s)\n", pszInstr, uVector, uType, VMXGetEntryIntInfoTypeDesc(uType)));
7633
7634	if (VMX_ENTRY_INT_INFO_IS_ERROR_CODE_VALID(uEntryIntInfo))
7635	{
7636	TRPMSetErrorCode(pVCpu, uErrCode);
7637	Log(("%s: Injecting: err_code=%#x\n", pszInstr, uErrCode));
7638	}
7639
7640	if (VMX_ENTRY_INT_INFO_IS_XCPT_PF(uEntryIntInfo))
7641	{
7642	TRPMSetFaultAddress(pVCpu, GCPtrFaultAddress);
7643	Log(("%s: Injecting: fault_addr=%RGp\n", pszInstr, GCPtrFaultAddress));
7644	}
7645	else
7646	{
7647	switch (uType)
7648	{
7649	case VMX_ENTRY_INT_INFO_TYPE_PRIV_SW_XCPT:
7650	TRPMSetTrapDueToIcebp(pVCpu);
7651	Log(("%s: Injecting: icebp\n", pszInstr));
7652	RT_FALL_THRU();
7653	case VMX_ENTRY_INT_INFO_TYPE_SW_INT:
7654	case VMX_ENTRY_INT_INFO_TYPE_SW_XCPT:
7655	TRPMSetInstrLength(pVCpu, cbInstr);
7656	Log(("%s: Injecting: instr_len=%u\n", pszInstr, cbInstr));
7657	break;
7658	}
7659	}
7660
7661	NOREF(pszInstr);
7662	}
7663
7664
7665	/**
7666	* Performs event injection (if any) as part of VM-entry.
7667	*
7668	* @param pVCpu The cross context virtual CPU structure.
7669	* @param pszInstr The VMX instruction name (for logging purposes).
7670	*/
7671	static void iemVmxVmentryInjectEvent(PVMCPUCC pVCpu, const char *pszInstr) RT_NOEXCEPT
7672	{
7673	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7674
7675	/*
7676	* Inject events.
7677	* The event that is going to be made pending for injection is not subject to VMX intercepts,
7678	* thus we flag ignoring of intercepts. However, recursive exceptions if any during delivery
7679	* of the current event -are- subject to intercepts, hence this flag will be flipped during
7680	* the actually delivery of this event.
7681	*
7682	* See Intel spec. 26.5 "Event Injection".
7683	*/
7684	uint32_t const uEntryIntInfo = pVmcs->u32EntryIntInfo;
7685	bool const fEntryIntInfoValid = VMX_ENTRY_INT_INFO_IS_VALID(uEntryIntInfo);
7686
7687	CPUMSetGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx, !fEntryIntInfoValid);
7688	if (fEntryIntInfoValid)
7689	{
7690	if (VMX_ENTRY_INT_INFO_TYPE(uEntryIntInfo) != VMX_ENTRY_INT_INFO_TYPE_OTHER_EVENT)
7691	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uEntryIntInfo, pVmcs->u32EntryXcptErrCode, pVmcs->u32EntryInstrLen,
7692	pVCpu->cpum.GstCtx.cr2);
7693	else
7694	{
7695	Assert(VMX_ENTRY_INT_INFO_VECTOR(uEntryIntInfo) == VMX_ENTRY_INT_INFO_VECTOR_MTF);
7696	VMCPU_FF_SET(pVCpu, VMCPU_FF_VMX_MTF);
7697	}
7698
7699	/*
7700	* We need to clear the VM-entry interruption information field's valid bit on VM-exit.
7701	*
7702	* However, we do it here on VM-entry as well because while it isn't visible to guest
7703	* software until VM-exit, when and if HM looks at the VMCS to continue nested-guest
7704	* execution using hardware-assisted VMX, it will not try to inject the event again.
7705	*
7706	* See Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
7707	*/
7708	pVmcs->u32EntryIntInfo &= ~VMX_ENTRY_INT_INFO_VALID;
7709	}
7710	else
7711	{
7712	/*
7713	* Inject any pending guest debug exception.
7714	* Unlike injecting events, this #DB injection on VM-entry is subject to #DB VMX intercept.
7715	* See Intel spec. 26.6.3 "Delivery of Pending Debug Exceptions after VM Entry".
7716	*/
7717	bool const fPendingDbgXcpt = iemVmxVmentryIsPendingDebugXcpt(pVCpu, pszInstr);
7718	if (fPendingDbgXcpt)
7719	{
7720	uint32_t const uDbgXcptInfo = RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VECTOR, X86_XCPT_DB)
7721	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_TYPE, VMX_ENTRY_INT_INFO_TYPE_HW_XCPT)
7722	\| RT_BF_MAKE(VMX_BF_ENTRY_INT_INFO_VALID, 1);
7723	iemVmxVmentryInjectTrpmEvent(pVCpu, pszInstr, uDbgXcptInfo, 0 /* uErrCode */, pVmcs->u32EntryInstrLen,
7724	0 /* GCPtrFaultAddress */);
7725	}
7726	}
7727
7728	NOREF(pszInstr);
7729	}
7730
7731
7732	/**
7733	* Initializes all read-only VMCS fields as part of VM-entry.
7734	*
7735	* @param pVCpu The cross context virtual CPU structure.
7736	*/
7737	static void iemVmxVmentryInitReadOnlyFields(PVMCPUCC pVCpu) RT_NOEXCEPT
7738	{
7739	/*
7740	* Any VMCS field which we do not establish on every VM-exit but may potentially
7741	* be used on the VM-exit path of a nested hypervisor -and- is not explicitly
7742	* specified to be undefined, needs to be initialized here.
7743	*
7744	* Thus, it is especially important to clear the Exit qualification field
7745	* since it must be zero for VM-exits where it is not used. Similarly, the
7746	* VM-exit interruption information field's valid bit needs to be cleared for
7747	* the same reasons.
7748	*/
7749	PVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7750	Assert(pVmcs);
7751
7752	/* 16-bit (none currently). */
7753	/* 32-bit. */
7754	pVmcs->u32RoVmInstrError = 0;
7755	pVmcs->u32RoExitReason = 0;
7756	pVmcs->u32RoExitIntInfo = 0;
7757	pVmcs->u32RoExitIntErrCode = 0;
7758	pVmcs->u32RoIdtVectoringInfo = 0;
7759	pVmcs->u32RoIdtVectoringErrCode = 0;
7760	pVmcs->u32RoExitInstrLen = 0;
7761	pVmcs->u32RoExitInstrInfo = 0;
7762
7763	/* 64-bit. */
7764	pVmcs->u64RoGuestPhysAddr.u = 0;
7765
7766	/* Natural-width. */
7767	pVmcs->u64RoExitQual.u = 0;
7768	pVmcs->u64RoIoRcx.u = 0;
7769	pVmcs->u64RoIoRsi.u = 0;
7770	pVmcs->u64RoIoRdi.u = 0;
7771	pVmcs->u64RoIoRip.u = 0;
7772	pVmcs->u64RoGuestLinearAddr.u = 0;
7773	}
7774
7775
7776	/**
7777	* VMLAUNCH/VMRESUME instruction execution worker.
7778	*
7779	* @returns Strict VBox status code.
7780	* @param pVCpu The cross context virtual CPU structure.
7781	* @param cbInstr The instruction length in bytes.
7782	* @param uInstrId The instruction identity (VMXINSTRID_VMLAUNCH or
7783	* VMXINSTRID_VMRESUME).
7784	*
7785	* @remarks Common VMX instruction checks are already expected to by the caller,
7786	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
7787	*/
7788	static VBOXSTRICTRC iemVmxVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId) RT_NOEXCEPT
7789	{
7790	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && !defined(IN_RING3)
7791	RT_NOREF3(pVCpu, cbInstr, uInstrId);
7792	return VINF_EM_RAW_EMULATE_INSTR;
7793	# else
7794	Assert( uInstrId == VMXINSTRID_VMLAUNCH
7795	\|\| uInstrId == VMXINSTRID_VMRESUME);
7796	const char * const pszInstr = uInstrId == VMXINSTRID_VMRESUME ? "vmresume" : "vmlaunch";
7797
7798	/* Nested-guest intercept. */
7799	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7800	return iemVmxVmexitInstr(pVCpu, uInstrId == VMXINSTRID_VMRESUME ? VMX_EXIT_VMRESUME : VMX_EXIT_VMLAUNCH, cbInstr);
7801
7802	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
7803
7804	/*
7805	* Basic VM-entry checks.
7806	* The order of the CPL, current and shadow VMCS and block-by-MovSS are important.
7807	* The checks following that do not have to follow a specific order.
7808	*
7809	* See Intel spec. 26.1 "Basic VM-entry Checks".
7810	*/
7811
7812	/* CPL. */
7813	if (IEM_GET_CPL(pVCpu) == 0)
7814	{ /* likely */ }
7815	else
7816	{
7817	Log(("%s: CPL %u -> #GP(0)\n", pszInstr, IEM_GET_CPL(pVCpu)));
7818	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_Cpl;
7819	return iemRaiseGeneralProtectionFault0(pVCpu);
7820	}
7821
7822	/* Current VMCS valid. */
7823	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
7824	{ /* likely */ }
7825	else
7826	{
7827	Log(("%s: VMCS pointer %#RGp invalid -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7828	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrInvalid;
7829	iemVmxVmFailInvalid(pVCpu);
7830	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7831	}
7832
7833	/* Current VMCS is not a shadow VMCS. */
7834	PVMXVVMCS pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
7835	if (!pVmcs->u32VmcsRevId.n.fIsShadowVmcs)
7836	{ /* likely */ }
7837	else
7838	{
7839	Log(("%s: VMCS pointer %#RGp is a shadow VMCS -> VMFailInvalid\n", pszInstr, IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
7840	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_PtrShadowVmcs;
7841	iemVmxVmFailInvalid(pVCpu);
7842	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7843	}
7844
7845	/** @todo Distinguish block-by-MovSS from block-by-STI. Currently we
7846	* use block-by-STI here which is not quite correct. */
7847	if (!CPUMIsInInterruptShadowWithUpdate(&pVCpu->cpum.GstCtx))
7848	{ /* likely */ }
7849	else
7850	{
7851	Log(("%s: VM entry with events blocked by MOV SS -> VMFail\n", pszInstr));
7852	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_BlocKMovSS;
7853	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_BLOCK_MOVSS);
7854	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7855	}
7856
7857	if (uInstrId == VMXINSTRID_VMLAUNCH)
7858	{
7859	/* VMLAUNCH with non-clear VMCS. */
7860	if (pVmcs->fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR)
7861	{ /* likely */ }
7862	else if (pVmcs->fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR_LEGACY)
7863	{
7864	/* Convert legacy launch-state value to current value, see @bugref{10318#c114} for reasons.*/
7865	pVmcs->fVmcsState = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
7866	Log(("vmlaunch: Updated legacy 'VMCLEAR' VMCS launch-state bit to current\n"));
7867	}
7868	else
7869	{
7870	Log(("vmlaunch: VMLAUNCH with non-clear VMCS %RGp -> VMFail\n", pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmcs));
7871	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsClear;
7872	iemVmxVmFail(pVCpu, VMXINSTRERR_VMLAUNCH_NON_CLEAR_VMCS);
7873	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7874	}
7875	}
7876	else
7877	{
7878	/* VMRESUME with non-launched VMCS. */
7879	if (pVmcs->fVmcsState == VMX_V_VMCS_LAUNCH_STATE_LAUNCHED)
7880	{ /* likely */ }
7881	else
7882	{
7883	Log(("vmresume: VMRESUME with non-launched VMCS -> VMFail\n"));
7884	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmentry_VmcsLaunch;
7885	iemVmxVmFail(pVCpu, VMXINSTRERR_VMRESUME_NON_LAUNCHED_VMCS);
7886	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
7887	}
7888	}
7889
7890	/*
7891	* We are allowed to cache VMCS related data structures (such as I/O bitmaps, MSR bitmaps)
7892	* while entering VMX non-root mode. We do some of this while checking VM-execution
7893	* controls. The nested hypervisor should not make assumptions and cannot expect
7894	* predictable behavior if changes to these structures are made in guest memory while
7895	* executing in VMX non-root mode. As far as VirtualBox is concerned, the guest cannot
7896	* modify them anyway as we cache them in host memory.
7897	*
7898	* See Intel spec. 24.11.4 "Software Access to Related Structures".
7899	*/
7900	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
7901
7902	int rc = iemVmxVmentryCheckCtls(pVCpu, pszInstr);
7903	if (RT_SUCCESS(rc))
7904	{
7905	rc = iemVmxVmentryCheckHostState(pVCpu, pszInstr);
7906	if (RT_SUCCESS(rc))
7907	{
7908	/*
7909	* Initialize read-only VMCS fields before VM-entry since we don't update all of them
7910	* for every VM-exit. This needs to be done before invoking a VM-exit (even those
7911	* ones that may occur during VM-entry below).
7912	*/
7913	iemVmxVmentryInitReadOnlyFields(pVCpu);
7914
7915	/*
7916	* Blocking of NMIs need to be restored if VM-entry fails due to invalid-guest state.
7917	* So we save the VMCPU_FF_BLOCK_NMI force-flag here so we can restore it on
7918	* VM-exit when required.
7919	* See Intel spec. 26.7 "VM-entry Failures During or After Loading Guest State"
7920	*/
7921	iemVmxVmentrySaveNmiBlockingFF(pVCpu);
7922
7923	rc = iemVmxVmentryCheckGuestState(pVCpu, pszInstr);
7924	if (RT_SUCCESS(rc))
7925	{
7926	/*
7927	* We've now entered nested-guest execution.
7928	*
7929	* It is important do this prior to loading the guest state because
7930	* as part of loading the guest state, PGM (and perhaps other components
7931	* in the future) relies on detecting whether VMX non-root mode has been
7932	* entered.
7933	*/
7934	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode = true;
7935
7936	rc = iemVmxVmentryLoadGuestState(pVCpu, pszInstr);
7937	if (RT_SUCCESS(rc))
7938	{
7939	rc = iemVmxVmentryLoadGuestAutoMsrs(pVCpu, pszInstr);
7940	if (RT_SUCCESS(rc))
7941	{
7942	Assert(rc != VINF_CPUM_R3_MSR_WRITE);
7943
7944	/* VMLAUNCH instruction must update the VMCS launch state. */
7945	if (uInstrId == VMXINSTRID_VMLAUNCH)
7946	pVmcs->fVmcsState = VMX_V_VMCS_LAUNCH_STATE_LAUNCHED;
7947
7948	/* Perform the VMX transition (PGM updates). */
7949	VBOXSTRICTRC rcStrict = iemVmxTransition(pVCpu, cbInstr);
7950	if (rcStrict == VINF_SUCCESS)
7951	{ /* likely */ }
7952	else if (RT_SUCCESS(rcStrict))
7953	{
7954	Log3(("%s: iemVmxTransition returns %Rrc -> Setting passup status\n", pszInstr,
7955	VBOXSTRICTRC_VAL(rcStrict)));
7956	rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7957	}
7958	else
7959	{
7960	Log3(("%s: iemVmxTransition failed! rc=%Rrc\n", pszInstr, VBOXSTRICTRC_VAL(rcStrict)));
7961	return rcStrict;
7962	}
7963
7964	/* Paranoia. */
7965	Assert(rcStrict == VINF_SUCCESS);
7966
7967	/*
7968	* The priority of potential VM-exits during VM-entry is important.
7969	* The priorities of VM-exits and events are listed from highest
7970	* to lowest as follows:
7971	*
7972	* 1. Event injection.
7973	* 2. Trap on task-switch (T flag set in TSS).
7974	* 3. TPR below threshold / APIC-write.
7975	* 4. SMI, INIT.
7976	* 5. MTF exit.
7977	* 6. Debug-trap exceptions (EFLAGS.TF), pending debug exceptions.
7978	* 7. VMX-preemption timer.
7979	* 9. NMI-window exit.
7980	* 10. NMI injection.
7981	* 11. Interrupt-window exit.
7982	* 12. Virtual-interrupt injection.
7983	* 13. Interrupt injection.
7984	* 14. Process next instruction (fetch, decode, execute).
7985	*/
7986
7987	/* Setup VMX-preemption timer. */
7988	iemVmxVmentrySetupPreemptTimer(pVCpu, pszInstr);
7989
7990	/* Setup monitor-trap flag. */
7991	iemVmxVmentrySetupMtf(pVCpu, pszInstr);
7992
7993	/* Setup NMI-window exiting. */
7994	iemVmxVmentrySetupNmiWindow(pVCpu, pszInstr);
7995
7996	/* Setup interrupt-window exiting. */
7997	iemVmxVmentrySetupIntWindow(pVCpu, pszInstr);
7998
7999	/*
8000	* Inject any event that the nested hypervisor wants to inject.
8001	* Note! We cannot immediately perform the event injection here as we may have
8002	* pending PGM operations to perform due to switching page tables and/or
8003	* mode.
8004	*/
8005	iemVmxVmentryInjectEvent(pVCpu, pszInstr);
8006
8007	# if defined(VBOX_WITH_NESTED_HWVIRT_ONLY_IN_IEM) && defined(IN_RING3)
8008	/* Reschedule to IEM-only execution of the nested-guest. */
8009	LogFlow(("%s: Enabling IEM-only EM execution policy!\n", pszInstr));
8010	int rcSched = EMR3SetExecutionPolicy(pVCpu->CTX_SUFF(pVM)->pUVM, EMEXECPOLICY_IEM_ALL, true);
8011	if (rcSched != VINF_SUCCESS)
8012	iemSetPassUpStatus(pVCpu, rcSched);
8013	# endif
8014
8015	/* Finally, done. */
8016	Log2(("vmentry: %s: cs:rip=%04x:%08RX64 cr0=%#RX64 (%#RX64) cr4=%#RX64 (%#RX64) efer=%#RX64 (%#RX64)\n",
8017	pszInstr, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.cr0,
8018	pVmcs->u64Cr0ReadShadow.u, pVCpu->cpum.GstCtx.cr4, pVmcs->u64Cr4ReadShadow.u,
8019	pVCpu->cpum.GstCtx.msrEFER, pVmcs->u64GuestEferMsr.u));
8020	return VINF_SUCCESS;
8021	}
8022	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_MSR_LOAD \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
8023	}
8024	}
8025	return iemVmxVmexit(pVCpu, VMX_EXIT_ERR_INVALID_GUEST_STATE \| VMX_EXIT_REASON_ENTRY_FAILED, pVmcs->u64RoExitQual.u);
8026	}
8027
8028	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_HOST_STATE);
8029	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8030	}
8031
8032	iemVmxVmFail(pVCpu, VMXINSTRERR_VMENTRY_INVALID_CTLS);
8033	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8034	# endif
8035	}
8036
8037
8038	/**
8039	* Interface for HM and EM to emulate the VMLAUNCH/VMRESUME instruction.
8040	*
8041	* @returns Strict VBox status code.
8042	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8043	* @param cbInstr The instruction length in bytes.
8044	* @param uInstrId The instruction ID (VMXINSTRID_VMLAUNCH or
8045	* VMXINSTRID_VMRESUME).
8046	* @thread EMT(pVCpu)
8047	*/
8048	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmlaunchVmresume(PVMCPUCC pVCpu, uint8_t cbInstr, VMXINSTRID uInstrId)
8049	{
8050	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
8051	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_VMX_VMENTRY_MASK);
8052
8053	iemInitExec(pVCpu, 0 /fExecOpts/);
8054	VBOXSTRICTRC rcStrict = iemVmxVmlaunchVmresume(pVCpu, cbInstr, uInstrId);
8055	Assert(!pVCpu->iem.s.cActiveMappings);
8056	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8057	}
8058
8059
8060	/**
8061	* Checks whether an RDMSR or WRMSR instruction for the given MSR is intercepted
8062	* (causes a VM-exit) or not.
8063	*
8064	* @returns @c true if the instruction is intercepted, @c false otherwise.
8065	* @param pVCpu The cross context virtual CPU structure.
8066	* @param uExitReason The VM-exit reason (VMX_EXIT_RDMSR or
8067	* VMX_EXIT_WRMSR).
8068	* @param idMsr The MSR.
8069	*/
8070	bool iemVmxIsRdmsrWrmsrInterceptSet(PCVMCPU pVCpu, uint32_t uExitReason, uint32_t idMsr) RT_NOEXCEPT
8071	{
8072	Assert(IEM_VMX_IS_NON_ROOT_MODE(pVCpu));
8073	Assert( uExitReason == VMX_EXIT_RDMSR
8074	\|\| uExitReason == VMX_EXIT_WRMSR);
8075
8076	/* Consult the MSR bitmap if the feature is supported. */
8077	PCVMXVVMCS const pVmcs = &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs;
8078	Assert(pVmcs);
8079	if (pVmcs->u32ProcCtls & VMX_PROC_CTLS_USE_MSR_BITMAPS)
8080	{
8081	uint32_t const fMsrpm = CPUMGetVmxMsrPermission(pVCpu->cpum.GstCtx.hwvirt.vmx.abMsrBitmap, idMsr);
8082	if (uExitReason == VMX_EXIT_RDMSR)
8083	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_RD);
8084	return RT_BOOL(fMsrpm & VMXMSRPM_EXIT_WR);
8085	}
8086
8087	/* Without MSR bitmaps, all MSR accesses are intercepted. */
8088	return true;
8089	}
8090
8091
8092	/**
8093	* VMREAD instruction execution worker that does not perform any validation checks.
8094	*
8095	* Callers are expected to have performed the necessary checks and to ensure the
8096	* VMREAD will succeed.
8097	*
8098	* @param pVmcs Pointer to the virtual VMCS.
8099	* @param pu64Dst Where to write the VMCS value.
8100	* @param u64VmcsField The VMCS field.
8101	*
8102	* @remarks May be called with interrupts disabled.
8103	*/
8104	static void iemVmxVmreadNoCheck(PCVMXVVMCS pVmcs, uint64_t *pu64Dst, uint64_t u64VmcsField) RT_NOEXCEPT
8105	{
8106	VMXVMCSFIELD VmcsField;
8107	VmcsField.u = u64VmcsField;
8108	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8109	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8110	uint8_t const uWidthType = (uWidth << 2) \| uType;
8111	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8112	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8113	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8114	AssertMsg(offField < VMX_V_VMCS_SIZE, ("off=%u field=%#RX64 width=%#x type=%#x index=%#x (%u)\n", offField, u64VmcsField,
8115	uWidth, uType, uIndex, uIndex));
8116	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8117
8118	/*
8119	* Read the VMCS component based on the field's effective width.
8120	*
8121	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8122	* indicates high bits (little endian).
8123	*
8124	* Note! The caller is responsible to trim the result and update registers
8125	* or memory locations are required. Here we just zero-extend to the largest
8126	* type (i.e. 64-bits).
8127	*/
8128	uint8_t const pbVmcs = (uint8_t const )pVmcs;
8129	uint8_t const *pbField = pbVmcs + offField;
8130	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8131	switch (uEffWidth)
8132	{
8133	case VMX_VMCSFIELD_WIDTH_64BIT:
8134	case VMX_VMCSFIELD_WIDTH_NATURAL: pu64Dst = (uint64_t const *)pbField; break;
8135	case VMX_VMCSFIELD_WIDTH_32BIT: pu64Dst = (uint32_t const *)pbField; break;
8136	case VMX_VMCSFIELD_WIDTH_16BIT: pu64Dst = (uint16_t const *)pbField; break;
8137	}
8138	}
8139
8140
8141	/**
8142	* Interface for HM and EM to read a VMCS field from the nested-guest VMCS.
8143	*
8144	* It is ASSUMED the caller knows what they're doing. No VMREAD instruction checks
8145	* are performed. Bounds checks are strict builds only.
8146	*
8147	* @param pVmcs Pointer to the virtual VMCS.
8148	* @param u64VmcsField The VMCS field.
8149	* @param pu64Dst Where to store the VMCS value.
8150	*
8151	* @remarks May be called with interrupts disabled.
8152	* @todo This should probably be moved to CPUM someday.
8153	*/
8154	VMM_INT_DECL(void) IEMReadVmxVmcsField(PCVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t *pu64Dst)
8155	{
8156	AssertPtr(pVmcs);
8157	AssertPtr(pu64Dst);
8158	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8159	}
8160
8161
8162	/**
8163	* VMREAD common (memory/register) instruction execution worker.
8164	*
8165	* @returns Strict VBox status code.
8166	* @param pVCpu The cross context virtual CPU structure.
8167	* @param cbInstr The instruction length in bytes.
8168	* @param pu64Dst Where to write the VMCS value (only updated when
8169	* VINF_SUCCESS is returned).
8170	* @param u64VmcsField The VMCS field.
8171	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8172	* NULL.
8173	*/
8174	static VBOXSTRICTRC iemVmxVmreadCommon(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8175	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8176	{
8177	/* Nested-guest intercept. */
8178	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8179	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMREAD, u64VmcsField))
8180	{
8181	if (pExitInfo)
8182	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8183	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMREAD, VMXINSTRID_VMREAD, cbInstr);
8184	}
8185
8186	/* CPL. */
8187	if (IEM_GET_CPL(pVCpu) == 0)
8188	{ /* likely */ }
8189	else
8190	{
8191	Log(("vmread: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8192	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_Cpl;
8193	return iemRaiseGeneralProtectionFault0(pVCpu);
8194	}
8195
8196	pVCpu->iem.s.cPotentialExits++;
8197
8198	/* VMCS pointer in root mode. */
8199	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8200	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8201	{ /* likely */ }
8202	else
8203	{
8204	Log(("vmread: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8205	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrInvalid;
8206	iemVmxVmFailInvalid(pVCpu);
8207	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8208	}
8209
8210	/* VMCS-link pointer in non-root mode. */
8211	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8212	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8213	{ /* likely */ }
8214	else
8215	{
8216	Log(("vmread: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8217	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_LinkPtrInvalid;
8218	iemVmxVmFailInvalid(pVCpu);
8219	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8220	}
8221
8222	/* Supported VMCS field. */
8223	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8224	{ /* likely */ }
8225	else
8226	{
8227	Log(("vmread: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8228	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_FieldInvalid;
8229	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8230	iemVmxVmFail(pVCpu, VMXINSTRERR_VMREAD_INVALID_COMPONENT);
8231	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8232	}
8233
8234	/*
8235	* Reading from the current or shadow VMCS.
8236	*/
8237	PCVMXVVMCS pVmcs = !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8238	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8239	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8240	iemVmxVmreadNoCheck(pVmcs, pu64Dst, u64VmcsField);
8241	Log4(("vmread %#RX64 => %#RX64\n", u64VmcsField, *pu64Dst));
8242	return VINF_SUCCESS;
8243	}
8244
8245
8246	/**
8247	* VMREAD (64-bit register) instruction execution worker.
8248	*
8249	* @returns Strict VBox status code.
8250	* @param pVCpu The cross context virtual CPU structure.
8251	* @param cbInstr The instruction length in bytes.
8252	* @param pu64Dst Where to store the VMCS field's value.
8253	* @param u64VmcsField The VMCS field.
8254	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8255	* NULL.
8256	*/
8257	static VBOXSTRICTRC iemVmxVmreadReg64(PVMCPUCC pVCpu, uint8_t cbInstr, uint64_t *pu64Dst,
8258	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8259	{
8260	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, pu64Dst, u64VmcsField, pExitInfo);
8261	if (rcStrict == VINF_SUCCESS)
8262	{
8263	iemVmxVmSucceed(pVCpu);
8264	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8265	}
8266
8267	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8268	return rcStrict;
8269	}
8270
8271
8272	/**
8273	* VMREAD (32-bit register) instruction execution worker.
8274	*
8275	* @returns Strict VBox status code.
8276	* @param pVCpu The cross context virtual CPU structure.
8277	* @param cbInstr The instruction length in bytes.
8278	* @param pu32Dst Where to store the VMCS field's value.
8279	* @param u32VmcsField The VMCS field.
8280	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8281	* NULL.
8282	*/
8283	static VBOXSTRICTRC iemVmxVmreadReg32(PVMCPUCC pVCpu, uint8_t cbInstr, uint32_t *pu32Dst,
8284	uint64_t u32VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8285	{
8286	uint64_t u64Dst;
8287	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u32VmcsField, pExitInfo);
8288	if (rcStrict == VINF_SUCCESS)
8289	{
8290	*pu32Dst = u64Dst;
8291	iemVmxVmSucceed(pVCpu);
8292	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8293	}
8294
8295	Log(("vmread/reg: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8296	return rcStrict;
8297	}
8298
8299
8300	/**
8301	* VMREAD (memory) instruction execution worker.
8302	*
8303	* @returns Strict VBox status code.
8304	* @param pVCpu The cross context virtual CPU structure.
8305	* @param cbInstr The instruction length in bytes.
8306	* @param iEffSeg The effective segment register to use with @a u64Val.
8307	* Pass UINT8_MAX if it is a register access.
8308	* @param GCPtrDst The guest linear address to store the VMCS field's
8309	* value.
8310	* @param u64VmcsField The VMCS field.
8311	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8312	* NULL.
8313	*/
8314	static VBOXSTRICTRC iemVmxVmreadMem(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrDst,
8315	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8316	{
8317	uint64_t u64Dst;
8318	VBOXSTRICTRC rcStrict = iemVmxVmreadCommon(pVCpu, cbInstr, &u64Dst, u64VmcsField, pExitInfo);
8319	if (rcStrict == VINF_SUCCESS)
8320	{
8321	/*
8322	* Write the VMCS field's value to the location specified in guest-memory.
8323	*/
8324	if (IEM_IS_64BIT_CODE(pVCpu))
8325	rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8326	else
8327	rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrDst, u64Dst);
8328	if (rcStrict == VINF_SUCCESS)
8329	{
8330	iemVmxVmSucceed(pVCpu);
8331	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8332	}
8333
8334	Log(("vmread/mem: Failed to write to memory operand at %#RGv, rc=%Rrc\n", GCPtrDst, VBOXSTRICTRC_VAL(rcStrict)));
8335	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmread_PtrMap;
8336	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrDst;
8337	return rcStrict;
8338	}
8339
8340	Log(("vmread/mem: iemVmxVmreadCommon failed rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8341	return rcStrict;
8342	}
8343
8344
8345	/**
8346	* Interface for HM and EM to emulate the VMREAD instruction.
8347	*
8348	* @returns Strict VBox status code.
8349	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8350	* @param pExitInfo Pointer to the VM-exit information.
8351	* @thread EMT(pVCpu)
8352	*/
8353	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmread(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8354	{
8355	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8356	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8357	Assert(pExitInfo);
8358
8359	iemInitExec(pVCpu, 0 /fExecOpts/);
8360
8361	VBOXSTRICTRC rcStrict;
8362	uint8_t const cbInstr = pExitInfo->cbInstr;
8363	bool const fIs64BitMode = RT_BOOL(IEM_IS_64BIT_CODE(pVCpu));
8364	uint64_t const u64FieldEnc = fIs64BitMode
8365	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8366	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8367	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8368	{
8369	if (fIs64BitMode)
8370	{
8371	uint64_t *pu64Dst = iemGRegRefU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8372	rcStrict = iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64FieldEnc, pExitInfo);
8373	}
8374	else
8375	{
8376	uint32_t *pu32Dst = iemGRegRefU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8377	rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, pu32Dst, u64FieldEnc, pExitInfo);
8378	}
8379	}
8380	else
8381	{
8382	RTGCPTR const GCPtrDst = pExitInfo->GCPtrEffAddr;
8383	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8384	rcStrict = iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64FieldEnc, pExitInfo);
8385	}
8386	Assert(!pVCpu->iem.s.cActiveMappings);
8387	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8388	}
8389
8390
8391	/**
8392	* VMWRITE instruction execution worker that does not perform any validation
8393	* checks.
8394	*
8395	* Callers are expected to have performed the necessary checks and to ensure the
8396	* VMWRITE will succeed.
8397	*
8398	* @param pVmcs Pointer to the virtual VMCS.
8399	* @param u64Val The value to write.
8400	* @param u64VmcsField The VMCS field.
8401	*
8402	* @remarks May be called with interrupts disabled.
8403	*/
8404	static void iemVmxVmwriteNoCheck(PVMXVVMCS pVmcs, uint64_t u64Val, uint64_t u64VmcsField) RT_NOEXCEPT
8405	{
8406	VMXVMCSFIELD VmcsField;
8407	VmcsField.u = u64VmcsField;
8408	uint8_t const uWidth = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_WIDTH);
8409	uint8_t const uType = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_TYPE);
8410	uint8_t const uWidthType = (uWidth << 2) \| uType;
8411	uint8_t const uIndex = RT_BF_GET(VmcsField.u, VMX_BF_VMCSFIELD_INDEX);
8412	Assert(uIndex <= VMX_V_VMCS_MAX_INDEX);
8413	uint16_t const offField = g_aoffVmcsMap[uWidthType][uIndex];
8414	Assert(offField < VMX_V_VMCS_SIZE);
8415	AssertCompile(VMX_V_SHADOW_VMCS_SIZE == VMX_V_VMCS_SIZE);
8416
8417	/*
8418	* Write the VMCS component based on the field's effective width.
8419	*
8420	* The effective width is 64-bit fields adjusted to 32-bits if the access-type
8421	* indicates high bits (little endian).
8422	*/
8423	uint8_t pbVmcs = (uint8_t )pVmcs;
8424	uint8_t *pbField = pbVmcs + offField;
8425	uint8_t const uEffWidth = VMXGetVmcsFieldWidthEff(VmcsField.u);
8426	switch (uEffWidth)
8427	{
8428	case VMX_VMCSFIELD_WIDTH_64BIT:
8429	case VMX_VMCSFIELD_WIDTH_NATURAL: (uint64_t )pbField = u64Val; break;
8430	case VMX_VMCSFIELD_WIDTH_32BIT: (uint32_t )pbField = u64Val; break;
8431	case VMX_VMCSFIELD_WIDTH_16BIT: (uint16_t )pbField = u64Val; break;
8432	}
8433	}
8434
8435
8436	/**
8437	* Interface for HM and EM to write a VMCS field in the nested-guest VMCS.
8438	*
8439	* It is ASSUMED the caller knows what they're doing. No VMWRITE instruction checks
8440	* are performed. Bounds checks are strict builds only.
8441	*
8442	* @param pVmcs Pointer to the virtual VMCS.
8443	* @param u64VmcsField The VMCS field.
8444	* @param u64Val The value to write.
8445	*
8446	* @remarks May be called with interrupts disabled.
8447	* @todo This should probably be moved to CPUM someday.
8448	*/
8449	VMM_INT_DECL(void) IEMWriteVmxVmcsField(PVMXVVMCS pVmcs, uint64_t u64VmcsField, uint64_t u64Val)
8450	{
8451	AssertPtr(pVmcs);
8452	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8453	}
8454
8455
8456	/**
8457	* VMWRITE instruction execution worker.
8458	*
8459	* @returns Strict VBox status code.
8460	* @param pVCpu The cross context virtual CPU structure.
8461	* @param cbInstr The instruction length in bytes.
8462	* @param iEffSeg The effective segment register to use with @a u64Val.
8463	* Pass UINT8_MAX if it is a register access.
8464	* @param u64Val The value to write (or guest linear address to the
8465	* value), @a iEffSeg will indicate if it's a memory
8466	* operand.
8467	* @param u64VmcsField The VMCS field.
8468	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
8469	* NULL.
8470	*/
8471	static VBOXSTRICTRC iemVmxVmwrite(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, uint64_t u64Val,
8472	uint64_t u64VmcsField, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8473	{
8474	/* Nested-guest intercept. */
8475	if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8476	&& CPUMIsGuestVmxVmreadVmwriteInterceptSet(pVCpu, VMX_EXIT_VMWRITE, u64VmcsField))
8477	{
8478	if (pExitInfo)
8479	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8480	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMWRITE, VMXINSTRID_VMWRITE, cbInstr);
8481	}
8482
8483	/* CPL. */
8484	if (IEM_GET_CPL(pVCpu) == 0)
8485	{ /* likely */ }
8486	else
8487	{
8488	Log(("vmwrite: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8489	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_Cpl;
8490	return iemRaiseGeneralProtectionFault0(pVCpu);
8491	}
8492
8493	pVCpu->iem.s.cPotentialExits++;
8494
8495	/* VMCS pointer in root mode. */
8496	if ( !IEM_VMX_IS_ROOT_MODE(pVCpu)
8497	\|\| IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
8498	{ /* likely */ }
8499	else
8500	{
8501	Log(("vmwrite: VMCS pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_CURRENT_VMCS(pVCpu)));
8502	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrInvalid;
8503	iemVmxVmFailInvalid(pVCpu);
8504	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8505	}
8506
8507	/* VMCS-link pointer in non-root mode. */
8508	if ( !IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8509	\|\| IEM_VMX_HAS_SHADOW_VMCS(pVCpu))
8510	{ /* likely */ }
8511	else
8512	{
8513	Log(("vmwrite: VMCS-link pointer %#RGp invalid -> VMFailInvalid\n", IEM_VMX_GET_SHADOW_VMCS(pVCpu)));
8514	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_LinkPtrInvalid;
8515	iemVmxVmFailInvalid(pVCpu);
8516	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8517	}
8518
8519	/* If the VMWRITE instruction references memory, access the specified memory operand. */
8520	bool const fIsRegOperand = iEffSeg == UINT8_MAX;
8521	if (!fIsRegOperand)
8522	{
8523	/* Read the value from the specified guest memory location. */
8524	VBOXSTRICTRC rcStrict;
8525	RTGCPTR const GCPtrVal = u64Val;
8526	if (IEM_IS_64BIT_CODE(pVCpu))
8527	rcStrict = iemMemFetchDataU64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8528	else
8529	rcStrict = iemMemFetchDataU32_ZX_U64(pVCpu, &u64Val, iEffSeg, GCPtrVal);
8530	if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
8531	{
8532	Log(("vmwrite: Failed to read value from memory operand at %#RGv, rc=%Rrc\n", GCPtrVal, VBOXSTRICTRC_VAL(rcStrict)));
8533	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_PtrMap;
8534	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVal;
8535	return rcStrict;
8536	}
8537	}
8538	else
8539	Assert(!pExitInfo \|\| pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand);
8540
8541	/* Supported VMCS field. */
8542	if (CPUMIsGuestVmxVmcsFieldValid(pVCpu->CTX_SUFF(pVM), u64VmcsField))
8543	{ /* likely */ }
8544	else
8545	{
8546	Log(("vmwrite: VMCS field %#RX64 invalid -> VMFail\n", u64VmcsField));
8547	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldInvalid;
8548	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8549	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_INVALID_COMPONENT);
8550	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8551	}
8552
8553	/* Read-only VMCS field. */
8554	bool const fIsFieldReadOnly = VMXIsVmcsFieldReadOnly(u64VmcsField);
8555	if ( !fIsFieldReadOnly
8556	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmwriteAll)
8557	{ /* likely */ }
8558	else
8559	{
8560	Log(("vmwrite: Write to read-only VMCS component %#RX64 -> VMFail\n", u64VmcsField));
8561	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmwrite_FieldRo;
8562	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64VmcsField;
8563	iemVmxVmFail(pVCpu, VMXINSTRERR_VMWRITE_RO_COMPONENT);
8564	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8565	}
8566
8567	/*
8568	* Write to the current or shadow VMCS.
8569	*/
8570	bool const fInVmxNonRootMode = IEM_VMX_IS_NON_ROOT_MODE(pVCpu);
8571	PVMXVVMCS pVmcs = !fInVmxNonRootMode
8572	? &pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs
8573	: &pVCpu->cpum.GstCtx.hwvirt.vmx.ShadowVmcs;
8574	iemVmxVmwriteNoCheck(pVmcs, u64Val, u64VmcsField);
8575	Log4(("vmwrite %#RX64 <= %#RX64\n", u64VmcsField, u64Val));
8576
8577	if ( !fInVmxNonRootMode
8578	&& VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
8579	{
8580	/* Notify HM that the VMCS content might have changed. */
8581	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
8582	}
8583
8584	iemVmxVmSucceed(pVCpu);
8585	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8586	}
8587
8588
8589	/**
8590	* Interface for HM and EM to emulate the VMWRITE instruction.
8591	*
8592	* @returns Strict VBox status code.
8593	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8594	* @param pExitInfo Pointer to the VM-exit information.
8595	* @thread EMT(pVCpu)
8596	*/
8597	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmwrite(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8598	{
8599	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8600	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8601	Assert(pExitInfo);
8602
8603	iemInitExec(pVCpu, 0 /fExecOpts/);
8604
8605	uint64_t u64Val;
8606	uint8_t iEffSeg;
8607	if (pExitInfo->InstrInfo.VmreadVmwrite.fIsRegOperand)
8608	{
8609	u64Val = iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg1);
8610	iEffSeg = UINT8_MAX;
8611	}
8612	else
8613	{
8614	u64Val = pExitInfo->GCPtrEffAddr;
8615	iEffSeg = pExitInfo->InstrInfo.VmreadVmwrite.iSegReg;
8616	}
8617	uint8_t const cbInstr = pExitInfo->cbInstr;
8618	uint64_t const u64FieldEnc = IEM_IS_64BIT_CODE(pVCpu)
8619	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2)
8620	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.VmreadVmwrite.iReg2);
8621	VBOXSTRICTRC rcStrict = iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, u64Val, u64FieldEnc, pExitInfo);
8622	Assert(!pVCpu->iem.s.cActiveMappings);
8623	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8624	}
8625
8626
8627	/**
8628	* VMCLEAR instruction execution worker.
8629	*
8630	* @returns Strict VBox status code.
8631	* @param pVCpu The cross context virtual CPU structure.
8632	* @param cbInstr The instruction length in bytes.
8633	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8634	* @param GCPtrVmcs The linear address of the VMCS pointer.
8635	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8636	*
8637	* @remarks Common VMX instruction checks are already expected to by the caller,
8638	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8639	*/
8640	static VBOXSTRICTRC iemVmxVmclear(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8641	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8642	{
8643	/* Nested-guest intercept. */
8644	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8645	{
8646	if (pExitInfo)
8647	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8648	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMCLEAR, VMXINSTRID_NONE, cbInstr);
8649	}
8650
8651	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8652
8653	/* CPL. */
8654	if (IEM_GET_CPL(pVCpu) == 0)
8655	{ /* likely */ }
8656	else
8657	{
8658	Log(("vmclear: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8659	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_Cpl;
8660	return iemRaiseGeneralProtectionFault0(pVCpu);
8661	}
8662
8663	/* Get the VMCS pointer from the location specified by the source memory operand. */
8664	RTGCPHYS GCPhysVmcs;
8665	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8666	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8667	{ /* likely */ }
8668	else
8669	{
8670	Log(("vmclear: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8671	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrMap;
8672	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8673	return rcStrict;
8674	}
8675
8676	/* VMCS pointer alignment. */
8677	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8678	{ /* likely */ }
8679	else
8680	{
8681	Log(("vmclear: VMCS pointer not page-aligned -> VMFail()\n"));
8682	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAlign;
8683	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8684	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8685	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8686	}
8687
8688	/* VMCS physical-address width limits. */
8689	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8690	{ /* likely */ }
8691	else
8692	{
8693	Log(("vmclear: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8694	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrWidth;
8695	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8696	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8697	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8698	}
8699
8700	/* VMCS is not the VMXON region. */
8701	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8702	{ /* likely */ }
8703	else
8704	{
8705	Log(("vmclear: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8706	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrVmxon;
8707	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8708	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_VMXON_PTR);
8709	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8710	}
8711
8712	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8713	restriction imposed by our implementation. */
8714	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8715	{ /* likely */ }
8716	else
8717	{
8718	Log(("vmclear: VMCS not normal memory -> VMFail()\n"));
8719	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmclear_PtrAbnormal;
8720	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8721	iemVmxVmFail(pVCpu, VMXINSTRERR_VMCLEAR_INVALID_PHYSADDR);
8722	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8723	}
8724
8725	/*
8726	* VMCLEAR allows committing and clearing any valid VMCS pointer.
8727	*
8728	* If the current VMCS is the one being cleared, set its state to 'clear' and commit
8729	* to guest memory. Otherwise, set the state of the VMCS referenced in guest memory
8730	* to 'clear'.
8731	*/
8732	uint8_t const fVmcsLaunchStateClear = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
8733	if ( IEM_VMX_HAS_CURRENT_VMCS(pVCpu)
8734	&& IEM_VMX_GET_CURRENT_VMCS(pVCpu) == GCPhysVmcs)
8735	{
8736	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState = fVmcsLaunchStateClear;
8737	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
8738	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
8739	}
8740	else
8741	{
8742	AssertCompileMemberSize(VMXVVMCS, fVmcsState, sizeof(fVmcsLaunchStateClear));
8743	rcStrict = PGMPhysSimpleWriteGCPhys(pVCpu->CTX_SUFF(pVM), GCPhysVmcs + RT_UOFFSETOF(VMXVVMCS, fVmcsState),
8744	(const void *)&fVmcsLaunchStateClear, sizeof(fVmcsLaunchStateClear));
8745	if (RT_FAILURE(rcStrict))
8746	return rcStrict;
8747	}
8748
8749	iemVmxVmSucceed(pVCpu);
8750	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8751	}
8752
8753
8754	/**
8755	* Interface for HM and EM to emulate the VMCLEAR instruction.
8756	*
8757	* @returns Strict VBox status code.
8758	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8759	* @param pExitInfo Pointer to the VM-exit information.
8760	* @thread EMT(pVCpu)
8761	*/
8762	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmclear(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8763	{
8764	Assert(pExitInfo);
8765	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8766	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8767
8768	iemInitExec(pVCpu, 0 /fExecOpts/);
8769
8770	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8771	uint8_t const cbInstr = pExitInfo->cbInstr;
8772	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8773	VBOXSTRICTRC rcStrict = iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8774	Assert(!pVCpu->iem.s.cActiveMappings);
8775	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8776	}
8777
8778
8779	/**
8780	* VMPTRST instruction execution worker.
8781	*
8782	* @returns Strict VBox status code.
8783	* @param pVCpu The cross context virtual CPU structure.
8784	* @param cbInstr The instruction length in bytes.
8785	* @param iEffSeg The effective segment register to use with @a GCPtrVmcs.
8786	* @param GCPtrVmcs The linear address of where to store the current VMCS
8787	* pointer.
8788	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8789	*
8790	* @remarks Common VMX instruction checks are already expected to by the caller,
8791	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8792	*/
8793	static VBOXSTRICTRC iemVmxVmptrst(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8794	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8795	{
8796	/* Nested-guest intercept. */
8797	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8798	{
8799	if (pExitInfo)
8800	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8801	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRST, VMXINSTRID_NONE, cbInstr);
8802	}
8803
8804	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8805
8806	/* CPL. */
8807	if (IEM_GET_CPL(pVCpu) == 0)
8808	{ /* likely */ }
8809	else
8810	{
8811	Log(("vmptrst: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8812	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_Cpl;
8813	return iemRaiseGeneralProtectionFault0(pVCpu);
8814	}
8815
8816	/* Set the VMCS pointer to the location specified by the destination memory operand. */
8817	AssertCompile(NIL_RTGCPHYS == ~(RTGCPHYS)0U);
8818	VBOXSTRICTRC rcStrict = iemMemStoreDataU64(pVCpu, iEffSeg, GCPtrVmcs, IEM_VMX_GET_CURRENT_VMCS(pVCpu));
8819	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8820	{
8821	iemVmxVmSucceed(pVCpu);
8822	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8823	}
8824
8825	Log(("vmptrst: Failed to store VMCS pointer to memory at destination operand %#Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
8826	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrst_PtrMap;
8827	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8828	return rcStrict;
8829	}
8830
8831
8832	/**
8833	* Interface for HM and EM to emulate the VMPTRST instruction.
8834	*
8835	* @returns Strict VBox status code.
8836	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
8837	* @param pExitInfo Pointer to the VM-exit information.
8838	* @thread EMT(pVCpu)
8839	*/
8840	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrst(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
8841	{
8842	Assert(pExitInfo);
8843	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
8844	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
8845
8846	iemInitExec(pVCpu, 0 /fExecOpts/);
8847
8848	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
8849	uint8_t const cbInstr = pExitInfo->cbInstr;
8850	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
8851	VBOXSTRICTRC rcStrict = iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
8852	Assert(!pVCpu->iem.s.cActiveMappings);
8853	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
8854	}
8855
8856
8857	/**
8858	* VMPTRLD instruction execution worker.
8859	*
8860	* @returns Strict VBox status code.
8861	* @param pVCpu The cross context virtual CPU structure.
8862	* @param cbInstr The instruction length in bytes.
8863	* @param GCPtrVmcs The linear address of the current VMCS pointer.
8864	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
8865	*
8866	* @remarks Common VMX instruction checks are already expected to by the caller,
8867	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
8868	*/
8869	static VBOXSTRICTRC iemVmxVmptrld(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
8870	RTGCPHYS GCPtrVmcs, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
8871	{
8872	/* Nested-guest intercept. */
8873	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
8874	{
8875	if (pExitInfo)
8876	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
8877	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMPTRLD, VMXINSTRID_NONE, cbInstr);
8878	}
8879
8880	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
8881
8882	/* CPL. */
8883	if (IEM_GET_CPL(pVCpu) == 0)
8884	{ /* likely */ }
8885	else
8886	{
8887	Log(("vmptrld: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
8888	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_Cpl;
8889	return iemRaiseGeneralProtectionFault0(pVCpu);
8890	}
8891
8892	/* Get the VMCS pointer from the location specified by the source memory operand. */
8893	RTGCPHYS GCPhysVmcs;
8894	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmcs, iEffSeg, GCPtrVmcs);
8895	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
8896	{ /* likely */ }
8897	else
8898	{
8899	Log(("vmptrld: Failed to read VMCS physaddr from %#RGv, rc=%Rrc\n", GCPtrVmcs, VBOXSTRICTRC_VAL(rcStrict)));
8900	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrMap;
8901	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmcs;
8902	return rcStrict;
8903	}
8904
8905	/* VMCS pointer alignment. */
8906	if (!(GCPhysVmcs & X86_PAGE_4K_OFFSET_MASK))
8907	{ /* likely */ }
8908	else
8909	{
8910	Log(("vmptrld: VMCS pointer not page-aligned -> VMFail()\n"));
8911	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAlign;
8912	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8913	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8914	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8915	}
8916
8917	/* VMCS physical-address width limits. */
8918	if (!(GCPhysVmcs >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
8919	{ /* likely */ }
8920	else
8921	{
8922	Log(("vmptrld: VMCS pointer extends beyond physical-address width -> VMFail()\n"));
8923	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrWidth;
8924	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8925	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8926	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8927	}
8928
8929	/* VMCS is not the VMXON region. */
8930	if (GCPhysVmcs != pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon)
8931	{ /* likely */ }
8932	else
8933	{
8934	Log(("vmptrld: VMCS pointer cannot be identical to VMXON region pointer -> VMFail()\n"));
8935	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrVmxon;
8936	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8937	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_VMXON_PTR);
8938	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8939	}
8940
8941	/* Ensure VMCS is not MMIO, ROM etc. This is not an Intel requirement but a
8942	restriction imposed by our implementation. */
8943	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcs))
8944	{ /* likely */ }
8945	else
8946	{
8947	Log(("vmptrld: VMCS not normal memory -> VMFail()\n"));
8948	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrAbnormal;
8949	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8950	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INVALID_PHYSADDR);
8951	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8952	}
8953
8954	/* Read just the VMCS revision from the VMCS. */
8955	VMXVMCSREVID VmcsRevId;
8956	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmcs, sizeof(VmcsRevId));
8957	if (RT_SUCCESS(rc))
8958	{ /* likely */ }
8959	else
8960	{
8961	Log(("vmptrld: Failed to read revision identifier from VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
8962	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_RevPtrReadPhys;
8963	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
8964	return rc;
8965	}
8966
8967	/*
8968	* Verify the VMCS revision specified by the guest matches what we reported to the guest.
8969	* Verify the VMCS is not a shadow VMCS, if the VMCS shadowing feature is supported.
8970	*/
8971	if ( VmcsRevId.n.u31RevisionId == VMX_V_VMCS_REVISION_ID
8972	&& ( !VmcsRevId.n.fIsShadowVmcs
8973	\|\| IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVmcsShadowing))
8974	{ /* likely */ }
8975	else
8976	{
8977	if (VmcsRevId.n.u31RevisionId != VMX_V_VMCS_REVISION_ID)
8978	{
8979	Log(("vmptrld: VMCS revision mismatch, expected %#RX32 got %#RX32, GCPtrVmcs=%#RGv GCPhysVmcs=%#RGp -> VMFail()\n",
8980	VMX_V_VMCS_REVISION_ID, VmcsRevId.n.u31RevisionId, GCPtrVmcs, GCPhysVmcs));
8981	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_VmcsRevId;
8982	}
8983	else
8984	{
8985	Log(("vmptrld: Shadow VMCS -> VMFail()\n"));
8986	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_ShadowVmcs;
8987	}
8988	iemVmxVmFail(pVCpu, VMXINSTRERR_VMPTRLD_INCORRECT_VMCS_REV);
8989	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
8990	}
8991
8992	/*
8993	* We cache only the current VMCS in CPUMCTX. Therefore, VMPTRLD should always flush
8994	* the cache of an existing, current VMCS back to guest memory before loading a new,
8995	* different current VMCS.
8996	*/
8997	if (IEM_VMX_GET_CURRENT_VMCS(pVCpu) != GCPhysVmcs)
8998	{
8999	if (IEM_VMX_HAS_CURRENT_VMCS(pVCpu))
9000	{
9001	iemVmxWriteCurrentVmcsToGstMem(pVCpu);
9002	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
9003	}
9004
9005	/* Set the new VMCS as the current VMCS and read it from guest memory. */
9006	IEM_VMX_SET_CURRENT_VMCS(pVCpu, GCPhysVmcs);
9007	rc = iemVmxReadCurrentVmcsFromGstMem(pVCpu);
9008	if (RT_SUCCESS(rc))
9009	{
9010	/* Notify HM that a new, current VMCS is loaded. */
9011	if (VM_IS_HM_ENABLED(pVCpu->CTX_SUFF(pVM)))
9012	HMNotifyVmxNstGstCurrentVmcsChanged(pVCpu);
9013
9014	/* Convert legacy launch-state value to current value, see @bugref{10318#c114} for reasons.*/
9015	if (pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR_LEGACY)
9016	{
9017	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
9018	Log(("vmptrld: Updated legacy 'VMCLEAR' VMCS launch-state bit to current\n"));
9019	}
9020	}
9021	else
9022	{
9023	Log(("vmptrld: Failed to read VMCS at %#RGp, rc=%Rrc\n", GCPhysVmcs, rc));
9024	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmptrld_PtrReadPhys;
9025	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmcs;
9026	return rc;
9027	}
9028	}
9029	else if ( IEM_VMX_HAS_CURRENT_VMCS(pVCpu)
9030	&& pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState == VMX_V_VMCS_LAUNCH_STATE_CLEAR_LEGACY)
9031	{
9032	/* Convert legacy launch-state value to current value, see @bugref{10318#c114} for reasons.*/
9033	pVCpu->cpum.GstCtx.hwvirt.vmx.Vmcs.fVmcsState = VMX_V_VMCS_LAUNCH_STATE_CLEAR;
9034	Log(("vmptrld: Updated legacy VMCLEAR launch-state bit to current\n"));
9035	}
9036
9037	Assert(IEM_VMX_HAS_CURRENT_VMCS(pVCpu));
9038	iemVmxVmSucceed(pVCpu);
9039	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9040	}
9041
9042
9043	/**
9044	* Interface for HM and EM to emulate the VMPTRLD instruction.
9045	*
9046	* @returns Strict VBox status code.
9047	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9048	* @param pExitInfo Pointer to the VM-exit information.
9049	* @thread EMT(pVCpu)
9050	*/
9051	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmptrld(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9052	{
9053	Assert(pExitInfo);
9054	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9055	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9056
9057	iemInitExec(pVCpu, 0 /fExecOpts/);
9058
9059	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9060	uint8_t const cbInstr = pExitInfo->cbInstr;
9061	RTGCPTR const GCPtrVmcs = pExitInfo->GCPtrEffAddr;
9062	VBOXSTRICTRC rcStrict = iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, pExitInfo);
9063	Assert(!pVCpu->iem.s.cActiveMappings);
9064	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9065	}
9066
9067
9068	/**
9069	* INVVPID instruction execution worker.
9070	*
9071	* @returns Strict VBox status code.
9072	* @param pVCpu The cross context virtual CPU structure.
9073	* @param cbInstr The instruction length in bytes.
9074	* @param iEffSeg The segment of the invvpid descriptor.
9075	* @param GCPtrInvvpidDesc The address of invvpid descriptor.
9076	* @param u64InvvpidType The invalidation type.
9077	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9078	* NULL.
9079	*
9080	* @remarks Common VMX instruction checks are already expected to by the caller,
9081	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9082	*/
9083	VBOXSTRICTRC iemVmxInvvpid(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInvvpidDesc,
9084	uint64_t u64InvvpidType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9085	{
9086	/* Check if INVVPID instruction is supported, otherwise raise #UD. */
9087	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxVpid)
9088	return iemRaiseUndefinedOpcode(pVCpu);
9089
9090	/* Nested-guest intercept. */
9091	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9092	{
9093	if (pExitInfo)
9094	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9095	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVVPID, VMXINSTRID_NONE, cbInstr);
9096	}
9097
9098	/* CPL. */
9099	if (IEM_GET_CPL(pVCpu) != 0)
9100	{
9101	Log(("invvpid: CPL != 0 -> #GP(0)\n"));
9102	return iemRaiseGeneralProtectionFault0(pVCpu);
9103	}
9104
9105	/*
9106	* Validate INVVPID invalidation type.
9107	*
9108	* The instruction specifies exactly ONE of the supported invalidation types.
9109	*
9110	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9111	* supported. In theory, it's possible for a CPU to not support flushing individual
9112	* addresses but all the other types or any other combination. We do not take any
9113	* shortcuts here by assuming the types we currently expose to the guest.
9114	*/
9115	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9116	bool const fInvvpidSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID);
9117	bool const fTypeIndivAddr = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_INDIV_ADDR);
9118	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX);
9119	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_ALL_CTX);
9120	bool const fTypeSingleCtxRetainGlobals = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVVPID_SINGLE_CTX_RETAIN_GLOBALS);
9121
9122	bool afSupportedTypes[4];
9123	afSupportedTypes[0] = fTypeIndivAddr;
9124	afSupportedTypes[1] = fTypeSingleCtx;
9125	afSupportedTypes[2] = fTypeAllCtx;
9126	afSupportedTypes[3] = fTypeSingleCtxRetainGlobals;
9127
9128	if ( fInvvpidSupported
9129	&& !(u64InvvpidType & ~(uint64_t)VMX_INVVPID_VALID_MASK)
9130	&& afSupportedTypes[u64InvvpidType & 3])
9131	{ /* likely */ }
9132	else
9133	{
9134	Log(("invvpid: invalid/unsupported invvpid type %#x -> VMFail\n", u64InvvpidType));
9135	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_TypeInvalid;
9136	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9137	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9138	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9139	}
9140
9141	/*
9142	* Fetch the invvpid descriptor from guest memory.
9143	*/
9144	RTUINT128U uDesc;
9145	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvvpidDesc);
9146	if (rcStrict == VINF_SUCCESS)
9147	{
9148	/*
9149	* Validate the descriptor.
9150	*/
9151	if (uDesc.s.Lo <= 0xffff)
9152	{ /* likely */ }
9153	else
9154	{
9155	Log(("invvpid: reserved bits set in invvpid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
9156	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_DescRsvd;
9157	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Lo;
9158	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9159	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9160	}
9161
9162	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9163	RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
9164	uint16_t const uVpid = uDesc.Words.w0;
9165	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9166	switch (u64InvvpidType)
9167	{
9168	case VMXTLBFLUSHVPID_INDIV_ADDR:
9169	{
9170	if (uVpid != 0)
9171	{
9172	if (IEM_IS_CANONICAL(GCPtrInvAddr))
9173	{
9174	/* Invalidate mappings for the linear address tagged with VPID. */
9175	/** @todo PGM support for VPID? Currently just flush everything. */
9176	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9177	iemVmxVmSucceed(pVCpu);
9178	}
9179	else
9180	{
9181	Log(("invvpid: invalidation address %#RGP is not canonical -> VMFail\n", GCPtrInvAddr));
9182	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidAddr;
9183	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrInvAddr;
9184	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9185	}
9186	}
9187	else
9188	{
9189	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9190	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type0InvalidVpid;
9191	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9192	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9193	}
9194	break;
9195	}
9196
9197	case VMXTLBFLUSHVPID_SINGLE_CONTEXT:
9198	{
9199	if (uVpid != 0)
9200	{
9201	/* Invalidate all mappings with VPID. */
9202	/** @todo PGM support for VPID? Currently just flush everything. */
9203	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9204	iemVmxVmSucceed(pVCpu);
9205	}
9206	else
9207	{
9208	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9209	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type1InvalidVpid;
9210	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InvvpidType;
9211	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9212	}
9213	break;
9214	}
9215
9216	case VMXTLBFLUSHVPID_ALL_CONTEXTS:
9217	{
9218	/* Invalidate all mappings with non-zero VPIDs. */
9219	/** @todo PGM support for VPID? Currently just flush everything. */
9220	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9221	iemVmxVmSucceed(pVCpu);
9222	break;
9223	}
9224
9225	case VMXTLBFLUSHVPID_SINGLE_CONTEXT_RETAIN_GLOBALS:
9226	{
9227	if (uVpid != 0)
9228	{
9229	/* Invalidate all mappings with VPID except global translations. */
9230	/** @todo PGM support for VPID? Currently just flush everything. */
9231	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9232	iemVmxVmSucceed(pVCpu);
9233	}
9234	else
9235	{
9236	Log(("invvpid: invalid VPID %#x for invalidation type %u -> VMFail\n", uVpid, u64InvvpidType));
9237	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invvpid_Type3InvalidVpid;
9238	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uVpid;
9239	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9240	}
9241	break;
9242	}
9243	IEM_NOT_REACHED_DEFAULT_CASE_RET();
9244	}
9245	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9246	}
9247	return rcStrict;
9248	}
9249
9250
9251	/**
9252	* Interface for HM and EM to emulate the INVVPID instruction.
9253	*
9254	* @returns Strict VBox status code.
9255	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9256	* @param pExitInfo Pointer to the VM-exit information.
9257	* @thread EMT(pVCpu)
9258	*/
9259	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvvpid(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9260	{
9261	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9262	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9263	Assert(pExitInfo);
9264
9265	iemInitExec(pVCpu, 0 /fExecOpts/);
9266
9267	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9268	uint8_t const cbInstr = pExitInfo->cbInstr;
9269	RTGCPTR const GCPtrInvvpidDesc = pExitInfo->GCPtrEffAddr;
9270	uint64_t const u64InvvpidType = IEM_IS_64BIT_CODE(pVCpu)
9271	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9272	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9273	VBOXSTRICTRC rcStrict = iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, u64InvvpidType, pExitInfo);
9274	Assert(!pVCpu->iem.s.cActiveMappings);
9275	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9276	}
9277
9278	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9279
9280	/**
9281	* INVEPT instruction execution worker.
9282	*
9283	* @returns Strict VBox status code.
9284	* @param pVCpu The cross context virtual CPU structure.
9285	* @param cbInstr The instruction length in bytes.
9286	* @param iEffSeg The segment of the invept descriptor.
9287	* @param GCPtrInveptDesc The address of invept descriptor.
9288	* @param u64InveptType The invalidation type.
9289	* @param pExitInfo Pointer to the VM-exit information. Optional, can be
9290	* NULL.
9291	*
9292	* @remarks Common VMX instruction checks are already expected to by the caller,
9293	* i.e. VMX operation, CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9294	*/
9295	static VBOXSTRICTRC iemVmxInvept(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg, RTGCPTR GCPtrInveptDesc,
9296	uint64_t u64InveptType, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9297	{
9298	/* Check if EPT is supported, otherwise raise #UD. */
9299	if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fVmxEpt)
9300	return iemRaiseUndefinedOpcode(pVCpu);
9301
9302	/* Nested-guest intercept. */
9303	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9304	{
9305	if (pExitInfo)
9306	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9307	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_INVEPT, VMXINSTRID_NONE, cbInstr);
9308	}
9309
9310	/* CPL. */
9311	if (IEM_GET_CPL(pVCpu) != 0)
9312	{
9313	Log(("invept: CPL != 0 -> #GP(0)\n"));
9314	return iemRaiseGeneralProtectionFault0(pVCpu);
9315	}
9316
9317	/*
9318	* Validate INVEPT invalidation type.
9319	*
9320	* The instruction specifies exactly ONE of the supported invalidation types.
9321	*
9322	* Each of the types has a bit in IA32_VMX_EPT_VPID_CAP MSR specifying if it is
9323	* supported. In theory, it's possible for a CPU to not support flushing individual
9324	* addresses but all the other types or any other combination. We do not take any
9325	* shortcuts here by assuming the types we currently expose to the guest.
9326	*/
9327	uint64_t const fCaps = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64EptVpidCaps;
9328	bool const fInveptSupported = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT);
9329	bool const fTypeSingleCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_SINGLE_CTX);
9330	bool const fTypeAllCtx = RT_BF_GET(fCaps, VMX_BF_EPT_VPID_CAP_INVEPT_ALL_CTX);
9331
9332	bool afSupportedTypes[4];
9333	afSupportedTypes[0] = false;
9334	afSupportedTypes[1] = fTypeSingleCtx;
9335	afSupportedTypes[2] = fTypeAllCtx;
9336	afSupportedTypes[3] = false;
9337
9338	if ( fInveptSupported
9339	&& !(u64InveptType & ~(uint64_t)VMX_INVEPT_VALID_MASK)
9340	&& afSupportedTypes[u64InveptType & 3])
9341	{ /* likely */ }
9342	else
9343	{
9344	Log(("invept: invalid/unsupported invvpid type %#x -> VMFail\n", u64InveptType));
9345	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_TypeInvalid;
9346	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = u64InveptType;
9347	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9348	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9349	}
9350
9351	/*
9352	* Fetch the invept descriptor from guest memory.
9353	*/
9354	RTUINT128U uDesc;
9355	VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInveptDesc);
9356	if (rcStrict == VINF_SUCCESS)
9357	{
9358	/*
9359	* Validate the descriptor.
9360	*
9361	* The Intel spec. does not explicit say the INVEPT instruction fails when reserved
9362	* bits in the descriptor are set, but it -does- for INVVPID. Until we test on real
9363	* hardware, it's assumed INVEPT behaves the same as INVVPID in this regard. It's
9364	* better to be strict in our emulation until proven otherwise.
9365	*
9366	* UPDATE: Hyper-V enabled Windows 10 Pro guests do NOT clear the reserved bits in
9367	* the descriptor. Hence, I've disabled this check for now, see @bugref{10318#c122}.
9368	*/
9369	#if 0
9370	if (uDesc.s.Hi)
9371	{
9372	Log(("invept: reserved bits set in invept descriptor %#RX64 -> VMFail\n", uDesc.s.Hi));
9373	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_DescRsvd;
9374	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = uDesc.s.Hi;
9375	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9376	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9377	}
9378	#endif
9379
9380	/*
9381	* Flush TLB mappings based on the EPT type.
9382	*/
9383	if (u64InveptType == VMXTLBFLUSHEPT_SINGLE_CONTEXT)
9384	{
9385	uint64_t const GCPhysEptPtr = uDesc.s.Lo;
9386	int const rc = iemVmxVmentryCheckEptPtr(pVCpu, GCPhysEptPtr, NULL /* enmDiag */);
9387	if (RT_SUCCESS(rc))
9388	{ /* likely */ }
9389	else
9390	{
9391	Log(("invept: EPTP invalid %#RX64 -> VMFail\n", GCPhysEptPtr));
9392	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Invept_EptpInvalid;
9393	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysEptPtr;
9394	iemVmxVmFail(pVCpu, VMXINSTRERR_INVEPT_INVVPID_INVALID_OPERAND);
9395	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9396	}
9397	}
9398
9399	/** @todo PGM support for EPT tags? Currently just flush everything. */
9400	IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
9401	uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
9402	PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
9403
9404	iemVmxVmSucceed(pVCpu);
9405	rcStrict = iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9406	}
9407
9408	return rcStrict;
9409	}
9410
9411
9412	/**
9413	* Interface for HM and EM to emulate the INVEPT instruction.
9414	*
9415	* @returns Strict VBox status code.
9416	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9417	* @param pExitInfo Pointer to the VM-exit information.
9418	* @thread EMT(pVCpu)
9419	*/
9420	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedInvept(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9421	{
9422	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 4);
9423	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9424	Assert(pExitInfo);
9425
9426	iemInitExec(pVCpu, 0 /fExecOpts/);
9427
9428	uint8_t const iEffSeg = pExitInfo->InstrInfo.Inv.iSegReg;
9429	uint8_t const cbInstr = pExitInfo->cbInstr;
9430	RTGCPTR const GCPtrInveptDesc = pExitInfo->GCPtrEffAddr;
9431	uint64_t const u64InveptType = IEM_IS_64BIT_CODE(pVCpu)
9432	? iemGRegFetchU64(pVCpu, pExitInfo->InstrInfo.Inv.iReg2)
9433	: iemGRegFetchU32(pVCpu, pExitInfo->InstrInfo.Inv.iReg2);
9434	VBOXSTRICTRC rcStrict = iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, u64InveptType, pExitInfo);
9435	Assert(!pVCpu->iem.s.cActiveMappings);
9436	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9437	}
9438
9439	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX_EPT */
9440
9441	/**
9442	* VMXON instruction execution worker.
9443	*
9444	* @returns Strict VBox status code.
9445	* @param pVCpu The cross context virtual CPU structure.
9446	* @param cbInstr The instruction length in bytes.
9447	* @param iEffSeg The effective segment register to use with @a
9448	* GCPtrVmxon.
9449	* @param GCPtrVmxon The linear address of the VMXON pointer.
9450	* @param pExitInfo Pointer to the VM-exit information. Optional, can be NULL.
9451	*
9452	* @remarks Common VMX instruction checks are already expected to by the caller,
9453	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9454	*/
9455	static VBOXSTRICTRC iemVmxVmxon(PVMCPUCC pVCpu, uint8_t cbInstr, uint8_t iEffSeg,
9456	RTGCPHYS GCPtrVmxon, PCVMXVEXITINFO pExitInfo) RT_NOEXCEPT
9457	{
9458	if (!IEM_VMX_IS_ROOT_MODE(pVCpu))
9459	{
9460	/* CPL. */
9461	if (IEM_GET_CPL(pVCpu) == 0)
9462	{ /* likely */ }
9463	else
9464	{
9465	Log(("vmxon: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9466	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cpl;
9467	return iemRaiseGeneralProtectionFault0(pVCpu);
9468	}
9469
9470	/* A20M (A20 Masked) mode. */
9471	if (PGMPhysIsA20Enabled(pVCpu))
9472	{ /* likely */ }
9473	else
9474	{
9475	Log(("vmxon: A20M mode -> #GP(0)\n"));
9476	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_A20M;
9477	return iemRaiseGeneralProtectionFault0(pVCpu);
9478	}
9479
9480	/* CR0. */
9481	{
9482	/*
9483	* CR0 MB1 bits.
9484	*
9485	* We use VMX_V_CR0_FIXED0 below to ensure CR0.PE and CR0.PG are always set
9486	* while executing VMXON. CR0.PE and CR0.PG are only allowed to be clear
9487	* when the guest running in VMX non-root mode with unrestricted-guest control
9488	* enabled in the VMCS.
9489	*/
9490	uint64_t const uCr0Fixed0 = VMX_V_CR0_FIXED0;
9491	if ((pVCpu->cpum.GstCtx.cr0 & uCr0Fixed0) == uCr0Fixed0)
9492	{ /* likely */ }
9493	else
9494	{
9495	Log(("vmxon: CR0 fixed0 bits cleared -> #GP(0)\n"));
9496	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed0;
9497	return iemRaiseGeneralProtectionFault0(pVCpu);
9498	}
9499
9500	/* CR0 MBZ bits. */
9501	uint64_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
9502	if (!(pVCpu->cpum.GstCtx.cr0 & ~uCr0Fixed1))
9503	{ /* likely */ }
9504	else
9505	{
9506	Log(("vmxon: CR0 fixed1 bits set -> #GP(0)\n"));
9507	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr0Fixed1;
9508	return iemRaiseGeneralProtectionFault0(pVCpu);
9509	}
9510	}
9511
9512	/* CR4. */
9513	{
9514	/* CR4 MB1 bits. */
9515	uint64_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
9516	if ((pVCpu->cpum.GstCtx.cr4 & uCr4Fixed0) == uCr4Fixed0)
9517	{ /* likely */ }
9518	else
9519	{
9520	Log(("vmxon: CR4 fixed0 bits cleared -> #GP(0)\n"));
9521	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed0;
9522	return iemRaiseGeneralProtectionFault0(pVCpu);
9523	}
9524
9525	/* CR4 MBZ bits. */
9526	uint64_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
9527	if (!(pVCpu->cpum.GstCtx.cr4 & ~uCr4Fixed1))
9528	{ /* likely */ }
9529	else
9530	{
9531	Log(("vmxon: CR4 fixed1 bits set -> #GP(0)\n"));
9532	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_Cr4Fixed1;
9533	return iemRaiseGeneralProtectionFault0(pVCpu);
9534	}
9535	}
9536
9537	/* Feature control MSR's LOCK and VMXON bits. */
9538	uint64_t const uMsrFeatCtl = CPUMGetGuestIa32FeatCtrl(pVCpu);
9539	if ((uMsrFeatCtl & (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9540	== (MSR_IA32_FEATURE_CONTROL_LOCK \| MSR_IA32_FEATURE_CONTROL_VMXON))
9541	{ /* likely */ }
9542	else
9543	{
9544	Log(("vmxon: Feature control lock bit or VMXON bit cleared -> #GP(0)\n"));
9545	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_MsrFeatCtl;
9546	return iemRaiseGeneralProtectionFault0(pVCpu);
9547	}
9548
9549	/* Get the VMXON pointer from the location specified by the source memory operand. */
9550	RTGCPHYS GCPhysVmxon;
9551	VBOXSTRICTRC rcStrict = iemMemFetchDataU64(pVCpu, &GCPhysVmxon, iEffSeg, GCPtrVmxon);
9552	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
9553	{ /* likely */ }
9554	else
9555	{
9556	Log(("vmxon: Failed to read VMXON region physaddr from %#RGv, rc=%Rrc\n", GCPtrVmxon, VBOXSTRICTRC_VAL(rcStrict)));
9557	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrMap;
9558	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPtrVmxon;
9559	return rcStrict;
9560	}
9561
9562	/* VMXON region pointer alignment. */
9563	if (!(GCPhysVmxon & X86_PAGE_4K_OFFSET_MASK))
9564	{ /* likely */ }
9565	else
9566	{
9567	Log(("vmxon: VMXON region pointer not page-aligned -> VMFailInvalid\n"));
9568	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAlign;
9569	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9570	iemVmxVmFailInvalid(pVCpu);
9571	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9572	}
9573
9574	/* VMXON physical-address width limits. */
9575	if (!(GCPhysVmxon >> IEM_GET_GUEST_CPU_FEATURES(pVCpu)->cVmxMaxPhysAddrWidth))
9576	{ /* likely */ }
9577	else
9578	{
9579	Log(("vmxon: VMXON region pointer extends beyond physical-address width -> VMFailInvalid\n"));
9580	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrWidth;
9581	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9582	iemVmxVmFailInvalid(pVCpu);
9583	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9584	}
9585
9586	/* Ensure VMXON region is not MMIO, ROM etc. This is not an Intel requirement but a
9587	restriction imposed by our implementation. */
9588	if (PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmxon))
9589	{ /* likely */ }
9590	else
9591	{
9592	Log(("vmxon: VMXON region not normal memory -> VMFailInvalid\n"));
9593	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrAbnormal;
9594	pVCpu->cpum.GstCtx.hwvirt.vmx.uDiagAux = GCPhysVmxon;
9595	iemVmxVmFailInvalid(pVCpu);
9596	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9597	}
9598
9599	/* Read the VMCS revision ID from the VMXON region. */
9600	VMXVMCSREVID VmcsRevId;
9601	int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &VmcsRevId, GCPhysVmxon, sizeof(VmcsRevId));
9602	if (RT_SUCCESS(rc))
9603	{ /* likely */ }
9604	else
9605	{
9606	Log(("vmxon: Failed to read VMXON region at %#RGp, rc=%Rrc\n", GCPhysVmxon, rc));
9607	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_PtrReadPhys;
9608	return rc;
9609	}
9610
9611	/* Verify the VMCS revision specified by the guest matches what we reported to the guest. */
9612	if (RT_LIKELY(VmcsRevId.u == VMX_V_VMCS_REVISION_ID))
9613	{ /* likely */ }
9614	else
9615	{
9616	/* Revision ID mismatch. */
9617	if (!VmcsRevId.n.fIsShadowVmcs)
9618	{
9619	Log(("vmxon: VMCS revision mismatch, expected %#RX32 got %#RX32 -> VMFailInvalid\n", VMX_V_VMCS_REVISION_ID,
9620	VmcsRevId.n.u31RevisionId));
9621	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmcsRevId;
9622	iemVmxVmFailInvalid(pVCpu);
9623	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9624	}
9625
9626	/* Shadow VMCS disallowed. */
9627	Log(("vmxon: Shadow VMCS -> VMFailInvalid\n"));
9628	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_ShadowVmcs;
9629	iemVmxVmFailInvalid(pVCpu);
9630	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9631	}
9632
9633	/*
9634	* Record that we're in VMX operation, block INIT, block and disable A20M.
9635	*/
9636	pVCpu->cpum.GstCtx.hwvirt.vmx.GCPhysVmxon = GCPhysVmxon;
9637	IEM_VMX_CLEAR_CURRENT_VMCS(pVCpu);
9638	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = true;
9639
9640	/* Clear address-range monitoring. */
9641	EMMonitorWaitClear(pVCpu);
9642	/** @todo NSTVMX: Intel PT. */
9643
9644	iemVmxVmSucceed(pVCpu);
9645	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9646	}
9647	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9648	{
9649	/* Nested-guest intercept. */
9650	if (pExitInfo)
9651	return iemVmxVmexitInstrWithInfo(pVCpu, pExitInfo);
9652	return iemVmxVmexitInstrNeedsInfo(pVCpu, VMX_EXIT_VMXON, VMXINSTRID_NONE, cbInstr);
9653	}
9654
9655	Assert(IEM_VMX_IS_ROOT_MODE(pVCpu));
9656
9657	/* CPL. */
9658	if (IEM_GET_CPL(pVCpu) > 0)
9659	{
9660	Log(("vmxon: In VMX root mode: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9661	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxRootCpl;
9662	return iemRaiseGeneralProtectionFault0(pVCpu);
9663	}
9664
9665	/* VMXON when already in VMX root mode. */
9666	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXON_IN_VMXROOTMODE);
9667	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxon_VmxAlreadyRoot;
9668	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9669	}
9670
9671
9672	/**
9673	* Interface for HM and EM to emulate the VMXON instruction.
9674	*
9675	* @returns Strict VBox status code.
9676	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9677	* @param pExitInfo Pointer to the VM-exit information.
9678	* @thread EMT(pVCpu)
9679	*/
9680	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxon(PVMCPUCC pVCpu, PCVMXVEXITINFO pExitInfo)
9681	{
9682	Assert(pExitInfo);
9683	IEMEXEC_ASSERT_INSTR_LEN_RETURN(pExitInfo->cbInstr, 3);
9684	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9685
9686	iemInitExec(pVCpu, 0 /fExecOpts/);
9687
9688	uint8_t const iEffSeg = pExitInfo->InstrInfo.VmxXsave.iSegReg;
9689	uint8_t const cbInstr = pExitInfo->cbInstr;
9690	RTGCPTR const GCPtrVmxon = pExitInfo->GCPtrEffAddr;
9691	VBOXSTRICTRC rcStrict = iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, pExitInfo);
9692	Assert(!pVCpu->iem.s.cActiveMappings);
9693	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9694	}
9695
9696
9697	/**
9698	* Implements 'VMXOFF'.
9699	*
9700	* @remarks Common VMX instruction checks are already expected to by the caller,
9701	* i.e. CR4.VMXE, Real/V86 mode, EFER/CS.L checks.
9702	*/
9703	IEM_CIMPL_DEF_0(iemCImpl_vmxoff)
9704	{
9705	/* Nested-guest intercept. */
9706	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9707	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMXOFF, cbInstr);
9708
9709	/* CPL. */
9710	if (IEM_GET_CPL(pVCpu) == 0)
9711	{ /* likely */ }
9712	else
9713	{
9714	Log(("vmxoff: CPL %u -> #GP(0)\n", IEM_GET_CPL(pVCpu)));
9715	pVCpu->cpum.GstCtx.hwvirt.vmx.enmDiag = kVmxVDiag_Vmxoff_Cpl;
9716	return iemRaiseGeneralProtectionFault0(pVCpu);
9717	}
9718
9719	/* Dual monitor treatment of SMIs and SMM. */
9720	uint64_t const fSmmMonitorCtl = CPUMGetGuestIa32SmmMonitorCtl(pVCpu);
9721	if (!(fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VALID))
9722	{ /* likely */ }
9723	else
9724	{
9725	iemVmxVmFail(pVCpu, VMXINSTRERR_VMXOFF_DUAL_MON);
9726	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9727	}
9728
9729	/* Record that we're no longer in VMX root operation, block INIT, block and disable A20M. */
9730	pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxRootMode = false;
9731	Assert(!pVCpu->cpum.GstCtx.hwvirt.vmx.fInVmxNonRootMode);
9732
9733	if (fSmmMonitorCtl & MSR_IA32_SMM_MONITOR_VMXOFF_UNBLOCK_SMI)
9734	{ /** @todo NSTVMX: Unblock SMI. */ }
9735
9736	EMMonitorWaitClear(pVCpu);
9737	/** @todo NSTVMX: Unblock and enable A20M. */
9738
9739	iemVmxVmSucceed(pVCpu);
9740	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9741	}
9742
9743
9744	/**
9745	* Interface for HM and EM to emulate the VMXOFF instruction.
9746	*
9747	* @returns Strict VBox status code.
9748	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
9749	* @param cbInstr The instruction length in bytes.
9750	* @thread EMT(pVCpu)
9751	*/
9752	VMM_INT_DECL(VBOXSTRICTRC) IEMExecDecodedVmxoff(PVMCPUCC pVCpu, uint8_t cbInstr)
9753	{
9754	IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
9755	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_EXEC_DECODED_NO_MEM_MASK \| CPUMCTX_EXTRN_INHIBIT_INT \| CPUMCTX_EXTRN_INHIBIT_NMI);
9756
9757	iemInitExec(pVCpu, 0 /fExecOpts/);
9758	VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_vmxoff);
9759	Assert(!pVCpu->iem.s.cActiveMappings);
9760	return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
9761	}
9762
9763
9764	/**
9765	* Implements 'VMXON'.
9766	*/
9767	IEM_CIMPL_DEF_2(iemCImpl_vmxon, uint8_t, iEffSeg, RTGCPTR, GCPtrVmxon)
9768	{
9769	return iemVmxVmxon(pVCpu, cbInstr, iEffSeg, GCPtrVmxon, NULL /* pExitInfo */);
9770	}
9771
9772
9773	/**
9774	* Implements 'VMLAUNCH'.
9775	*/
9776	IEM_CIMPL_DEF_0(iemCImpl_vmlaunch)
9777	{
9778	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMLAUNCH);
9779	}
9780
9781
9782	/**
9783	* Implements 'VMRESUME'.
9784	*/
9785	IEM_CIMPL_DEF_0(iemCImpl_vmresume)
9786	{
9787	return iemVmxVmlaunchVmresume(pVCpu, cbInstr, VMXINSTRID_VMRESUME);
9788	}
9789
9790
9791	/**
9792	* Implements 'VMPTRLD'.
9793	*/
9794	IEM_CIMPL_DEF_2(iemCImpl_vmptrld, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9795	{
9796	return iemVmxVmptrld(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9797	}
9798
9799
9800	/**
9801	* Implements 'VMPTRST'.
9802	*/
9803	IEM_CIMPL_DEF_2(iemCImpl_vmptrst, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9804	{
9805	return iemVmxVmptrst(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9806	}
9807
9808
9809	/**
9810	* Implements 'VMCLEAR'.
9811	*/
9812	IEM_CIMPL_DEF_2(iemCImpl_vmclear, uint8_t, iEffSeg, RTGCPTR, GCPtrVmcs)
9813	{
9814	return iemVmxVmclear(pVCpu, cbInstr, iEffSeg, GCPtrVmcs, NULL /* pExitInfo */);
9815	}
9816
9817
9818	/**
9819	* Implements 'VMWRITE' register.
9820	*/
9821	IEM_CIMPL_DEF_2(iemCImpl_vmwrite_reg, uint64_t, u64Val, uint64_t, u64VmcsField)
9822	{
9823	return iemVmxVmwrite(pVCpu, cbInstr, UINT8_MAX /* iEffSeg /, u64Val, u64VmcsField, NULL / pExitInfo */);
9824	}
9825
9826
9827	/**
9828	* Implements 'VMWRITE' memory.
9829	*/
9830	IEM_CIMPL_DEF_3(iemCImpl_vmwrite_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrVal, uint32_t, u64VmcsField)
9831	{
9832	return iemVmxVmwrite(pVCpu, cbInstr, iEffSeg, GCPtrVal, u64VmcsField, NULL /* pExitInfo */);
9833	}
9834
9835
9836	/**
9837	* Implements 'VMREAD' register (64-bit).
9838	*/
9839	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg64, uint64_t *, pu64Dst, uint64_t, u64VmcsField)
9840	{
9841	return iemVmxVmreadReg64(pVCpu, cbInstr, pu64Dst, u64VmcsField, NULL /* pExitInfo */);
9842	}
9843
9844
9845	/**
9846	* Implements 'VMREAD' register (32-bit).
9847	*/
9848	IEM_CIMPL_DEF_2(iemCImpl_vmread_reg32, uint64_t *, pu64Dst, uint32_t, u32VmcsField)
9849	{
9850	VBOXSTRICTRC const rcStrict = iemVmxVmreadReg32(pVCpu, cbInstr, (uint32_t )pu64Dst, u32VmcsField, NULL / pExitInfo */);
9851	/* Zero the high part of the register on success. */
9852	if (rcStrict == VINF_SUCCESS)
9853	pu64Dst = (uint32_t)pu64Dst;
9854	return rcStrict;
9855	}
9856
9857
9858	/**
9859	* Implements 'VMREAD' memory, 64-bit register.
9860	*/
9861	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg64, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u64VmcsField)
9862	{
9863	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u64VmcsField, NULL /* pExitInfo */);
9864	}
9865
9866
9867	/**
9868	* Implements 'VMREAD' memory, 32-bit register.
9869	*/
9870	IEM_CIMPL_DEF_3(iemCImpl_vmread_mem_reg32, uint8_t, iEffSeg, RTGCPTR, GCPtrDst, uint32_t, u32VmcsField)
9871	{
9872	return iemVmxVmreadMem(pVCpu, cbInstr, iEffSeg, GCPtrDst, u32VmcsField, NULL /* pExitInfo */);
9873	}
9874
9875
9876	/**
9877	* Implements 'INVVPID'.
9878	*/
9879	IEM_CIMPL_DEF_3(iemCImpl_invvpid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvvpidDesc, uint64_t, uInvvpidType)
9880	{
9881	return iemVmxInvvpid(pVCpu, cbInstr, iEffSeg, GCPtrInvvpidDesc, uInvvpidType, NULL /* pExitInfo */);
9882	}
9883
9884
9885	#if defined(VBOX_WITH_NESTED_HWVIRT_VMX_EPT) \|\| defined(VBOX_WITH_IEM_RECOMPILER) /* HACK ALERT: Linking trick. */
9886	/**
9887	* Implements 'INVEPT'.
9888	*/
9889	IEM_CIMPL_DEF_3(iemCImpl_invept, uint8_t, iEffSeg, RTGCPTR, GCPtrInveptDesc, uint64_t, uInveptType)
9890	{
9891	# ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
9892	return iemVmxInvept(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, uInveptType, NULL /* pExitInfo */);
9893	# else
9894	RT_NOREF(pVCpu, cbInstr, iEffSeg, GCPtrInveptDesc, uInveptType);
9895	AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
9896	# endif
9897	}
9898	#endif
9899
9900
9901	/**
9902	* Implements VMX's implementation of PAUSE.
9903	*/
9904	IEM_CIMPL_DEF_0(iemCImpl_vmx_pause)
9905	{
9906	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
9907	{
9908	VBOXSTRICTRC rcStrict = iemVmxVmexitInstrPause(pVCpu, cbInstr);
9909	if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
9910	return rcStrict;
9911	}
9912
9913	/*
9914	* Outside VMX non-root operation or if the PAUSE instruction does not cause
9915	* a VM-exit, the instruction operates normally.
9916	*/
9917	return iemRegAddToRipAndFinishingClearingRF(pVCpu, cbInstr);
9918	}
9919
9920
9921	/**
9922	* @callback_method_impl{FNPGMPHYSHANDLER, VMX APIC-access page accesses}
9923	*
9924	* @remarks The @a uUser argument is currently unused.
9925	*/
9926	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPageHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCPHYS GCPhysFault, void *pvPhys,
9927	void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType,
9928	PGMACCESSORIGIN enmOrigin, uint64_t uUser)
9929	{
9930	RT_NOREF3(pvPhys, enmOrigin, uUser);
9931
9932	RTGCPHYS const GCPhysAccessBase = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9933	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9934	{
9935	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9936	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysAccessBase);
9937
9938	uint32_t const fAccess = enmAccessType == PGMACCESSTYPE_WRITE ? IEM_ACCESS_DATA_W : IEM_ACCESS_DATA_R;
9939	uint16_t const offAccess = GCPhysFault & GUEST_PAGE_OFFSET_MASK;
9940
9941	LogFlowFunc(("Fault at %#RGp (cbBuf=%u fAccess=%#x)\n", GCPhysFault, cbBuf, fAccess));
9942	VBOXSTRICTRC rcStrict = iemVmxVirtApicAccessMem(pVCpu, offAccess, cbBuf, pvBuf, fAccess);
9943	if (RT_FAILURE(rcStrict))
9944	return rcStrict;
9945
9946	/* Any access on this APIC-access page has been handled, caller should not carry out the access. */
9947	return VINF_SUCCESS;
9948	}
9949
9950	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysAccessBase));
9951	int rc = PGMHandlerPhysicalDeregister(pVM, GCPhysAccessBase);
9952	if (RT_FAILURE(rc))
9953	return rc;
9954
9955	/* Instruct the caller of this handler to perform the read/write as normal memory. */
9956	return VINF_PGM_HANDLER_DO_DEFAULT;
9957	}
9958
9959
9960	# ifndef IN_RING3
9961	/**
9962	* @callback_method_impl{FNPGMRZPHYSPFHANDLER,
9963	* \#PF access handler callback for guest VMX APIC-access page.}
9964	*/
9965	DECLCALLBACK(VBOXSTRICTRC) iemVmxApicAccessPagePfHandler(PVMCC pVM, PVMCPUCC pVCpu, RTGCUINT uErr, PCPUMCTX pCtx,
9966	RTGCPTR pvFault, RTGCPHYS GCPhysFault, uint64_t uUser)
9967
9968	{
9969	RT_NOREF3(pVM, pCtx, uUser);
9970
9971	/*
9972	* Handle the VMX APIC-access page only when the guest is in VMX non-root mode.
9973	* Otherwise we must deregister the page and allow regular RAM access.
9974	* Failing to do so lands us with endless EPT VM-exits.
9975	*/
9976	RTGCPHYS const GCPhysPage = GCPhysFault & ~(RTGCPHYS)GUEST_PAGE_OFFSET_MASK;
9977	if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
9978	{
9979	Assert(CPUMIsGuestVmxProcCtls2Set(IEM_GET_CTX(pVCpu), VMX_PROC_CTLS2_VIRT_APIC_ACCESS));
9980	Assert(CPUMGetGuestVmxApicAccessPageAddrEx(IEM_GET_CTX(pVCpu)) == GCPhysPage);
9981
9982	/*
9983	* Check if the access causes an APIC-access VM-exit.
9984	*/
9985	uint32_t fAccess;
9986	if (uErr & X86_TRAP_PF_ID)
9987	fAccess = IEM_ACCESS_INSTRUCTION;
9988	else if (uErr & X86_TRAP_PF_RW)
9989	fAccess = IEM_ACCESS_DATA_W;
9990	else
9991	fAccess = IEM_ACCESS_DATA_R;
9992
9993	RTGCPHYS const GCPhysNestedFault = (RTGCPHYS)pvFault;
9994	uint16_t const offAccess = GCPhysNestedFault & GUEST_PAGE_OFFSET_MASK;
9995	bool const fIntercept = iemVmxVirtApicIsMemAccessIntercepted(pVCpu, offAccess, 1 /* cbAccess */, fAccess);
9996	LogFlowFunc(("#PF at %#RGp (GCPhysNestedFault=%#RGp offAccess=%#x)\n", GCPhysFault, GCPhysNestedFault, offAccess));
9997	if (fIntercept)
9998	{
9999	/*
10000	* Query the source VM-exit (from the execution engine) that caused this access
10001	* within the APIC-access page. Currently only HM is supported.
10002	*/
10003	AssertMsg(VM_IS_HM_ENABLED(pVM),
10004	("VM-exit auxiliary info. fetching not supported for execution engine %d\n", pVM->bMainExecutionEngine));
10005
10006	HMEXITAUX HmExitAux;
10007	RT_ZERO(HmExitAux);
10008	int const rc = HMR0GetExitAuxInfo(pVCpu, &HmExitAux, HMVMX_READ_EXIT_INSTR_LEN
10009	\| HMVMX_READ_EXIT_QUALIFICATION
10010	\| HMVMX_READ_IDT_VECTORING_INFO
10011	\| HMVMX_READ_IDT_VECTORING_ERROR_CODE);
10012	AssertRC(rc);
10013
10014	/*
10015	* Verify the VM-exit reason must be an EPT violation.
10016	* Other accesses should go through the other handler (iemVmxApicAccessPageHandler).
10017	* Refer to @bugref{10092#c33s} for a more detailed explanation.
10018	*/
10019	AssertMsgReturn(HmExitAux.Vmx.uReason == VMX_EXIT_EPT_VIOLATION,
10020	("Unexpected call to APIC-access page #PF handler for %#RGp offAcesss=%u uErr=%#RGx uReason=%u\n",
10021	GCPhysPage, offAccess, uErr, HmExitAux.Vmx.uReason), VERR_IEM_IPE_7);
10022
10023	/*
10024	* Construct the virtual APIC-access VM-exit.
10025	*/
10026	VMXAPICACCESS enmAccess;
10027	if (HmExitAux.Vmx.u64Qual & VMX_EXIT_QUAL_EPT_LINEAR_ADDR_VALID)
10028	{
10029	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10030	enmAccess = VMXAPICACCESS_LINEAR_EVENT_DELIVERY;
10031	else if (fAccess == IEM_ACCESS_INSTRUCTION)
10032	enmAccess = VMXAPICACCESS_LINEAR_INSTR_FETCH;
10033	else if (fAccess & IEM_ACCESS_TYPE_WRITE)
10034	enmAccess = VMXAPICACCESS_LINEAR_WRITE;
10035	else
10036	enmAccess = VMXAPICACCESS_LINEAR_READ;
10037
10038	/* For linear-address accesss the instruction length must be valid. */
10039	AssertMsg(HmExitAux.Vmx.cbInstr > 0,
10040	("Invalid APIC-access VM-exit instruction length. cbInstr=%u\n", HmExitAux.Vmx.cbInstr));
10041	}
10042	else
10043	{
10044	if (VMX_IDT_VECTORING_INFO_IS_VALID(HmExitAux.Vmx.uIdtVectoringInfo))
10045	enmAccess = VMXAPICACCESS_PHYSICAL_EVENT_DELIVERY;
10046	else
10047	{
10048	/** @todo How to distinguish between monitoring/trace vs other instructions
10049	* here? */
10050	enmAccess = VMXAPICACCESS_PHYSICAL_INSTR;
10051	}
10052
10053	/* For physical accesses the instruction length is undefined, we zero it for safety and consistency. */
10054	HmExitAux.Vmx.cbInstr = 0;
10055	}
10056
10057	/*
10058	* Raise the APIC-access VM-exit.
10059	*/
10060	LogFlowFunc(("Raising APIC-access VM-exit from #PF handler at offset %#x\n", offAccess));
10061	VMXVEXITINFO const ExitInfo
10062	= VMXVEXITINFO_INIT_WITH_QUAL_AND_INSTR_LEN(VMX_EXIT_APIC_ACCESS,
10063	RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_OFFSET, offAccess)
10064	\| RT_BF_MAKE(VMX_BF_EXIT_QUAL_APIC_ACCESS_TYPE, enmAccess),
10065	HmExitAux.Vmx.cbInstr);
10066	VMXVEXITEVENTINFO const ExitEventInfo = VMXVEXITEVENTINFO_INIT_ONLY_IDT(HmExitAux.Vmx.uIdtVectoringInfo,
10067	HmExitAux.Vmx.uIdtVectoringErrCode);
10068	VBOXSTRICTRC const rcStrict = iemVmxVmexitApicAccessWithInfo(pVCpu, &ExitInfo, &ExitEventInfo);
10069	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
10070	}
10071
10072	/*
10073	* The access isn't intercepted, which means it needs to be virtualized.
10074	*
10075	* This requires emulating the instruction because we need the bytes being
10076	* read/written by the instruction not just the offset being accessed within
10077	* the APIC-access page (which we derive from the faulting address).
10078	*/
10079	LogFlowFunc(("Access at offset %#x not intercepted -> VINF_EM_RAW_EMULATE_INSTR\n", offAccess));
10080	return VINF_EM_RAW_EMULATE_INSTR;
10081	}
10082
10083	/** @todo This isn't ideal but works for now as nested-hypervisors generally play
10084	* nice because the spec states that this page should be modified only when
10085	* no CPU refers to it VMX non-root mode. Nonetheless, we could use an atomic
10086	* reference counter to ensure the aforementioned condition before
10087	* de-registering the page. */
10088	LogFunc(("Accessed outside VMX non-root mode, deregistering page handler for %#RGp\n", GCPhysPage));
10089	int const rc = PGMHandlerPhysicalDeregister(pVM, GCPhysPage);
10090	if (RT_FAILURE(rc))
10091	return rc;
10092
10093	return VINF_SUCCESS;
10094	}
10095	# endif /* !IN_RING3 */
10096
10097	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
10098
10099
10100	/**
10101	* Implements 'VMCALL'.
10102	*/
10103	IEM_CIMPL_DEF_0(iemCImpl_vmcall)
10104	{
10105	pVCpu->iem.s.cPotentialExits++;
10106
10107	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
10108	/* Nested-guest intercept. */
10109	if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
10110	return iemVmxVmexitInstr(pVCpu, VMX_EXIT_VMCALL, cbInstr);
10111	#endif
10112
10113	/* Join forces with vmmcall. */
10114	return IEM_CIMPL_CALL_1(iemCImpl_Hypercall, OP_VMCALL);
10115	}
10116

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/target-x86/IEMAllCImplVmxInstr-x86.cpp

Download in other formats: