IEMAll.cpp@ 108427

Last change on this file since 108427 was 108409, checked in by vboxsync, 2 months ago
VMM/IEM: Made IEMAll.cpp build targeting arm. jiraref:VBP-1531
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 51.6 KB

Line
1	/* $Id: IEMAll.cpp 108409 2025-02-27 10:35:39Z vboxsync $ */
2	/** @file
3	* IEM - Interpreted Execution Manager - All Contexts.
4	*/
5
6	/*
7	* Copyright (C) 2011-2024 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/** @page pg_iem IEM - Interpreted Execution Manager
30	*
31	* The interpreted exeuction manager (IEM) is for executing short guest code
32	* sequences that are causing too many exits / virtualization traps. It will
33	* also be used to interpret single instructions, thus replacing the selective
34	* interpreters in EM and IOM.
35	*
36	* Design goals:
37	* - Relatively small footprint, although we favour speed and correctness
38	* over size.
39	* - Reasonably fast.
40	* - Correctly handle lock prefixed instructions.
41	* - Complete instruction set - eventually.
42	* - Refactorable into a recompiler, maybe.
43	* - Replace EMInterpret*.
44	*
45	* Using the existing disassembler has been considered, however this is thought
46	* to conflict with speed as the disassembler chews things a bit too much while
47	* leaving us with a somewhat complicated state to interpret afterwards.
48	*
49	*
50	* The current code is very much work in progress. You've been warned!
51	*
52	*
53	* @section sec_iem_fpu_instr FPU Instructions
54	*
55	* On x86 and AMD64 hosts, the FPU instructions are implemented by executing the
56	* same or equivalent instructions on the host FPU. To make life easy, we also
57	* let the FPU prioritize the unmasked exceptions for us. This however, only
58	* works reliably when CR0.NE is set, i.e. when using \#MF instead the IRQ 13
59	* for FPU exception delivery, because with CR0.NE=0 there is a window where we
60	* can trigger spurious FPU exceptions.
61	*
62	* The guest FPU state is not loaded into the host CPU and kept there till we
63	* leave IEM because the calling conventions have declared an all year open
64	* season on much of the FPU state. For instance an innocent looking call to
65	* memcpy might end up using a whole bunch of XMM or MM registers if the
66	* particular implementation finds it worthwhile.
67	*
68	*
69	* @section sec_iem_logging Logging
70	*
71	* The IEM code uses the \"IEM\" log group for the main logging. The different
72	* logging levels/flags are generally used for the following purposes:
73	* - Level 1 (Log) : Errors, exceptions, interrupts and such major events.
74	* - Flow (LogFlow) : Basic enter/exit IEM state info.
75	* - Level 2 (Log2) : ?
76	* - Level 3 (Log3) : More detailed enter/exit IEM state info.
77	* - Level 4 (Log4) : Decoding mnemonics w/ EIP.
78	* - Level 5 (Log5) : Decoding details.
79	* - Level 6 (Log6) : Enables/disables the lockstep comparison with REM.
80	* - Level 7 (Log7) : iret++ execution logging.
81	* - Level 8 (Log8) :
82	* - Level 9 (Log9) :
83	* - Level 10 (Log10): TLBs.
84	* - Level 11 (Log11): Unmasked FPU exceptions.
85	*
86	* The \"IEM_MEM\" log group covers most of memory related details logging,
87	* except for errors and exceptions:
88	* - Level 1 (Log) : Reads.
89	* - Level 2 (Log2) : Read fallbacks.
90	* - Level 3 (Log3) : MemMap read.
91	* - Level 4 (Log4) : MemMap read fallbacks.
92	* - Level 5 (Log5) : Writes
93	* - Level 6 (Log6) : Write fallbacks.
94	* - Level 7 (Log7) : MemMap writes and read-writes.
95	* - Level 8 (Log8) : MemMap write and read-write fallbacks.
96	* - Level 9 (Log9) : Stack reads.
97	* - Level 10 (Log10): Stack read fallbacks.
98	* - Level 11 (Log11): Stack writes.
99	* - Level 12 (Log12): Stack write fallbacks.
100	* - Flow (LogFlow) :
101	*
102	* The SVM (AMD-V) and VMX (VT-x) code has the following assignments:
103	* - Level 1 (Log) : Errors and other major events.
104	* - Flow (LogFlow) : Misc flow stuff (cleanup?)
105	* - Level 2 (Log2) : VM exits.
106	*
107	* The syscall logging level assignments:
108	* - Level 1: DOS and BIOS.
109	* - Level 2: Windows 3.x
110	* - Level 3: Linux.
111	*/
112
113
114	/*********************************************************************************************************************************
115	* Header Files *
116	*********************************************************************************************************************************/
117	#define LOG_GROUP LOG_GROUP_IEM
118	#define VMCPU_INCL_CPUM_GST_CTX
119	#ifdef IN_RING0
120	# define VBOX_VMM_TARGET_X86
121	#endif
122	#include <VBox/vmm/iem.h>
123	#include <VBox/vmm/cpum.h>
124	#include <VBox/vmm/pdmapic.h>
125	#include <VBox/vmm/pdm.h>
126	#include <VBox/vmm/pgm.h>
127	#include <VBox/vmm/iom.h>
128	#include <VBox/vmm/em.h>
129	#include <VBox/vmm/hm.h>
130	#include <VBox/vmm/nem.h>
131	#include <VBox/vmm/gcm.h>
132	#include <VBox/vmm/gim.h>
133	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
134	# include <VBox/vmm/em.h>
135	# include <VBox/vmm/hm_svm.h>
136	#endif
137	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
138	# include <VBox/vmm/hmvmxinline.h>
139	#endif
140	#include <VBox/vmm/tm.h>
141	#include <VBox/vmm/dbgf.h>
142	#include <VBox/vmm/dbgftrace.h>
143	#include "IEMInternal.h"
144	#include <VBox/vmm/vmcc.h>
145	#include <VBox/log.h>
146	#include <VBox/err.h>
147	#include <VBox/param.h>
148	#include <VBox/dis.h>
149	#include <iprt/asm-math.h>
150	#if defined(RT_ARCH_AMD64) \|\| defined(RT_ARCH_X86)
151	# include <iprt/asm-amd64-x86.h>
152	#elif defined(RT_ARCH_ARM64) \|\| defined(RT_ARCH_ARM32)
153	# include <iprt/asm-arm.h>
154	#endif
155	#include <iprt/assert.h>
156	#include <iprt/string.h>
157	#include <iprt/x86.h>
158
159	#include "IEMInline.h"
160	#include "IEMInlineExec.h"
161	#ifdef VBOX_VMM_TARGET_X86
162	# include "target-x86/IEMInline-x86.h"
163	# include "target-x86/IEMInlineDecode-x86.h"
164	# include "target-x86/IEMInlineExec-x86.h"
165	#elif defined(VBOX_VMM_TARGET_ARMV8)
166	# include "target-armv8/IEMInlineExec-armv8.h"
167	#endif
168
169
170
171	/**
172	* Initializes the decoder state.
173	*
174	* iemReInitDecoder is mostly a copy of this function.
175	*
176	* @param pVCpu The cross context virtual CPU structure of the
177	* calling thread.
178	* @param fExecOpts Optional execution flags:
179	* - IEM_F_BYPASS_HANDLERS
180	* - IEM_F_X86_DISREGARD_LOCK
181	*/
182	DECLINLINE(void) iemInitDecoder(PVMCPUCC pVCpu, uint32_t fExecOpts)
183	{
184	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
185	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
186	#ifdef VBOX_STRICT
187	iemInitDecoderStrictTarget(pVCpu);
188	#endif
189
190	/* Execution state: */
191	uint32_t fExec;
192	pVCpu->iem.s.fExec = fExec = iemCalcExecFlags(pVCpu) \| fExecOpts;
193
194	/* Decoder state: */
195	#ifdef VBOX_VMM_TARGET_X86
196	pVCpu->iem.s.enmDefAddrMode = fExec & IEM_F_MODE_X86_CPUMODE_MASK; /** @todo check if this is correct... */
197	pVCpu->iem.s.enmEffAddrMode = fExec & IEM_F_MODE_X86_CPUMODE_MASK;
198	if ((fExec & IEM_F_MODE_X86_CPUMODE_MASK) != IEMMODE_64BIT)
199	{
200	pVCpu->iem.s.enmDefOpSize = fExec & IEM_F_MODE_X86_CPUMODE_MASK; /** @todo check if this is correct... */
201	pVCpu->iem.s.enmEffOpSize = fExec & IEM_F_MODE_X86_CPUMODE_MASK;
202	}
203	else
204	{
205	pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
206	pVCpu->iem.s.enmEffOpSize = IEMMODE_32BIT;
207	}
208	pVCpu->iem.s.fPrefixes = 0;
209	pVCpu->iem.s.uRexReg = 0;
210	pVCpu->iem.s.uRexB = 0;
211	pVCpu->iem.s.uRexIndex = 0;
212	pVCpu->iem.s.idxPrefix = 0;
213	pVCpu->iem.s.uVex3rdReg = 0;
214	pVCpu->iem.s.uVexLength = 0;
215	pVCpu->iem.s.fEvexStuff = 0;
216	pVCpu->iem.s.iEffSeg = X86_SREG_DS;
217	pVCpu->iem.s.offModRm = 0;
218	#endif /* VBOX_VMM_TARGET_X86 */
219	#ifdef IEM_WITH_CODE_TLB
220	pVCpu->iem.s.pbInstrBuf = NULL;
221	pVCpu->iem.s.offInstrNextByte = 0;
222	# ifdef VBOX_VMM_TARGET_X86
223	pVCpu->iem.s.offCurInstrStart = 0;
224	# endif
225	# ifdef IEM_WITH_CODE_TLB_AND_OPCODE_BUF
226	pVCpu->iem.s.offOpcode = 0;
227	# endif
228	# ifdef VBOX_STRICT
229	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
230	# ifdef VBOX_VMM_TARGET_X86
231	pVCpu->iem.s.cbInstrBuf = UINT16_MAX;
232	# endif
233	pVCpu->iem.s.cbInstrBufTotal = UINT16_MAX;
234	pVCpu->iem.s.uInstrBufPc = UINT64_C(0xc0ffc0ffcff0c0ff);
235	# endif
236	#else /* !IEM_WITH_CODE_TLB */
237	pVCpu->iem.s.offOpcode = 0;
238	pVCpu->iem.s.cbOpcode = 0;
239	#endif /* !IEM_WITH_CODE_TLB */
240	pVCpu->iem.s.cActiveMappings = 0;
241	pVCpu->iem.s.iNextMapping = 0;
242	pVCpu->iem.s.rcPassUp = VINF_SUCCESS;
243
244	#ifdef DBGFTRACE_ENABLED
245	iemInitDecoderTraceTargetPc(pVCpu, fExec);
246	#endif
247	}
248
249
250	/**
251	* Reinitializes the decoder state 2nd+ loop of IEMExecLots.
252	*
253	* This is mostly a copy of iemInitDecoder.
254	*
255	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
256	*/
257	DECLINLINE(void) iemReInitDecoder(PVMCPUCC pVCpu)
258	{
259	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
260	#ifdef VBOX_STRICT
261	iemInitDecoderStrictTarget(pVCpu);
262	#endif
263
264	/* ASSUMES: Anyone changing CPU state affecting the fExec bits will update them! */
265	AssertMsg((pVCpu->iem.s.fExec & ~IEM_F_USER_OPTS) == iemCalcExecFlags(pVCpu),
266	("fExec=%#x iemCalcExecModeFlags=%#x\n", pVCpu->iem.s.fExec, iemCalcExecFlags(pVCpu)));
267
268	#ifdef VBOX_VMM_TARGET_X86
269	IEMMODE const enmMode = IEM_GET_CPU_MODE(pVCpu);
270	pVCpu->iem.s.enmDefAddrMode = enmMode; /** @todo check if this is correct... */
271	pVCpu->iem.s.enmEffAddrMode = enmMode;
272	if (enmMode != IEMMODE_64BIT)
273	{
274	pVCpu->iem.s.enmDefOpSize = enmMode; /** @todo check if this is correct... */
275	pVCpu->iem.s.enmEffOpSize = enmMode;
276	}
277	else
278	{
279	pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
280	pVCpu->iem.s.enmEffOpSize = IEMMODE_32BIT;
281	}
282	pVCpu->iem.s.fPrefixes = 0;
283	pVCpu->iem.s.uRexReg = 0;
284	pVCpu->iem.s.uRexB = 0;
285	pVCpu->iem.s.uRexIndex = 0;
286	pVCpu->iem.s.idxPrefix = 0;
287	pVCpu->iem.s.uVex3rdReg = 0;
288	pVCpu->iem.s.uVexLength = 0;
289	pVCpu->iem.s.fEvexStuff = 0;
290	pVCpu->iem.s.iEffSeg = X86_SREG_DS;
291	pVCpu->iem.s.offModRm = 0;
292	#endif
293	#ifdef IEM_WITH_CODE_TLB
294	if (pVCpu->iem.s.pbInstrBuf)
295	{
296	# ifdef VBOX_VMM_TARGET_X86
297	uint64_t off = (enmMode == IEMMODE_64BIT
298	? pVCpu->cpum.GstCtx.rip
299	: pVCpu->cpum.GstCtx.eip + (uint32_t)pVCpu->cpum.GstCtx.cs.u64Base)
300	- pVCpu->iem.s.uInstrBufPc;
301	if (off < pVCpu->iem.s.cbInstrBufTotal)
302	# elif defined(VBOX_VMM_TARGET_ARMV8)
303	uint64_t const off = pVCpu->cpum.GstCtx.Pc.u64 - pVCpu->iem.s.uInstrBufPc;
304	if (off + sizeof(uint32_t) <= pVCpu->iem.s.cbInstrBufTotal)
305	# endif
306	{
307	pVCpu->iem.s.offInstrNextByte = (uint32_t)off;
308	# ifdef VBOX_VMM_TARGET_X86
309	pVCpu->iem.s.offCurInstrStart = (uint16_t)off;
310	if ((uint16_t)off + 15 <= pVCpu->iem.s.cbInstrBufTotal)
311	pVCpu->iem.s.cbInstrBuf = (uint16_t)off + 15;
312	else
313	pVCpu->iem.s.cbInstrBuf = pVCpu->iem.s.cbInstrBufTotal;
314	# endif
315	}
316	else
317	{
318	pVCpu->iem.s.pbInstrBuf = NULL;
319	pVCpu->iem.s.offInstrNextByte = 0;
320	# ifdef VBOX_VMM_TARGET_X86
321	pVCpu->iem.s.offCurInstrStart = 0;
322	pVCpu->iem.s.cbInstrBuf = 0;
323	# endif
324	pVCpu->iem.s.cbInstrBufTotal = 0;
325	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
326	}
327	}
328	else
329	{
330	pVCpu->iem.s.offInstrNextByte = 0;
331	# ifdef VBOX_VMM_TARGET_X86
332	pVCpu->iem.s.offCurInstrStart = 0;
333	pVCpu->iem.s.cbInstrBuf = 0;
334	# endif
335	pVCpu->iem.s.cbInstrBufTotal = 0;
336	# ifdef VBOX_STRICT
337	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
338	# endif
339	}
340	# ifdef IEM_WITH_CODE_TLB_AND_OPCODE_BUF
341	pVCpu->iem.s.offOpcode = 0;
342	# endif
343	#else /* !IEM_WITH_CODE_TLB */
344	pVCpu->iem.s.cbOpcode = 0;
345	pVCpu->iem.s.offOpcode = 0;
346	#endif /* !IEM_WITH_CODE_TLB */
347	Assert(pVCpu->iem.s.cActiveMappings == 0);
348	pVCpu->iem.s.iNextMapping = 0;
349	Assert(pVCpu->iem.s.rcPassUp == VINF_SUCCESS);
350	Assert(!(pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS));
351
352	#ifdef DBGFTRACE_ENABLED
353	iemInitDecoderTraceTargetPc(pVCpu, pVCpu->iem.s.fExec);
354	#endif
355	}
356
357
358	/**
359	* Prefetch opcodes the first time when starting executing.
360	*
361	* @returns Strict VBox status code.
362	* @param pVCpu The cross context virtual CPU structure of the
363	* calling thread.
364	* @param fExecOpts Optional execution flags:
365	* - IEM_F_BYPASS_HANDLERS
366	* - IEM_F_X86_DISREGARD_LOCK
367	*/
368	DECLINLINE(VBOXSTRICTRC) iemInitDecoderAndPrefetchOpcodes(PVMCPUCC pVCpu, uint32_t fExecOpts) RT_NOEXCEPT
369	{
370	iemInitDecoder(pVCpu, fExecOpts);
371
372	#ifndef IEM_WITH_CODE_TLB
373	return iemOpcodeFetchPrefetch(pVCpu);
374	#else
375	return VINF_SUCCESS;
376	#endif
377	}
378
379
380	#ifdef LOG_ENABLED
381	/**
382	* Logs the current instruction.
383	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
384	* @param pszFunction The IEM function doing the execution.
385	*/
386	static void iemLogCurInstr(PVMCPUCC pVCpu, const char *pszFunction) RT_NOEXCEPT
387	{
388	# ifdef IN_RING3
389	if (LogIs2Enabled())
390	{
391	char szInstr[256];
392	uint32_t cbInstr = 0;
393	DBGFR3DisasInstrEx(pVCpu->pVMR3->pUVM, pVCpu->idCpu, 0, 0,
394	DBGF_DISAS_FLAGS_CURRENT_GUEST \| DBGF_DISAS_FLAGS_DEFAULT_MODE,
395	szInstr, sizeof(szInstr), &cbInstr);
396
397	# ifdef VBOX_VMM_TARGET_X86
398	PCX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
399	Log2(("**** %s fExec=%x\n"
400	" eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x\n"
401	" eip=%08x esp=%08x ebp=%08x iopl=%d tr=%04x\n"
402	" cs=%04x ss=%04x ds=%04x es=%04x fs=%04x gs=%04x efl=%08x\n"
403	" fsw=%04x fcw=%04x ftw=%02x mxcsr=%04x/%04x\n"
404	" %s\n"
405	, pszFunction, pVCpu->iem.s.fExec,
406	pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ebx, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.edx, pVCpu->cpum.GstCtx.esi, pVCpu->cpum.GstCtx.edi,
407	pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.esp, pVCpu->cpum.GstCtx.ebp, pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL, pVCpu->cpum.GstCtx.tr.Sel,
408	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.es.Sel,
409	pVCpu->cpum.GstCtx.fs.Sel, pVCpu->cpum.GstCtx.gs.Sel, pVCpu->cpum.GstCtx.eflags.u,
410	pFpuCtx->FSW, pFpuCtx->FCW, pFpuCtx->FTW, pFpuCtx->MXCSR, pFpuCtx->MXCSR_MASK,
411	szInstr));
412	# elif defined(VBOX_VMM_TARGET_ARMV8)
413	Log2(("**** %s fExec=%x\n"
414	" x0=%016RX64 x1=%016RX64 x2=%016RX64 x3=%016RX64\n"
415	" x4=%016RX64 x5=%016RX64 x6=%016RX64 x7=%016RX64\n"
416	" x8=%016RX64 x9=%016RX64 x10=%016RX64 x11=%016RX64\n"
417	" x12=%016RX64 x13=%016RX64 x14=%016RX64 x15=%016RX64\n"
418	" x16=%016RX64 x17=%016RX64 x18=%016RX64 x19=%016RX64\n"
419	" x20=%016RX64 x21=%016RX64 x22=%016RX64 x23=%016RX64\n"
420	" x24=%016RX64 x25=%016RX64 x26=%016RX64 x27=%016RX64\n"
421	" x28=%016RX64 bp=%016RX64 lr=%016RX64 sp=%016RX64\n"
422	" pc=%016RX64 psr=%08RX64 EL%u\n"
423	" %s\n"
424	, pszFunction, pVCpu->iem.s.fExec,
425	pVCpu->cpum.GstCtx.aGRegs[0], pVCpu->cpum.GstCtx.aGRegs[1], pVCpu->cpum.GstCtx.aGRegs[2], pVCpu->cpum.GstCtx.aGRegs[3],
426	pVCpu->cpum.GstCtx.aGRegs[4], pVCpu->cpum.GstCtx.aGRegs[5], pVCpu->cpum.GstCtx.aGRegs[6], pVCpu->cpum.GstCtx.aGRegs[7],
427	pVCpu->cpum.GstCtx.aGRegs[8], pVCpu->cpum.GstCtx.aGRegs[9], pVCpu->cpum.GstCtx.aGRegs[10], pVCpu->cpum.GstCtx.aGRegs[11],
428	pVCpu->cpum.GstCtx.aGRegs[12], pVCpu->cpum.GstCtx.aGRegs[13], pVCpu->cpum.GstCtx.aGRegs[14], pVCpu->cpum.GstCtx.aGRegs[15],
429	pVCpu->cpum.GstCtx.aGRegs[16], pVCpu->cpum.GstCtx.aGRegs[17], pVCpu->cpum.GstCtx.aGRegs[18], pVCpu->cpum.GstCtx.aGRegs[19],
430	pVCpu->cpum.GstCtx.aGRegs[20], pVCpu->cpum.GstCtx.aGRegs[21], pVCpu->cpum.GstCtx.aGRegs[22], pVCpu->cpum.GstCtx.aGRegs[23],
431	pVCpu->cpum.GstCtx.aGRegs[24], pVCpu->cpum.GstCtx.aGRegs[25], pVCpu->cpum.GstCtx.aGRegs[26], pVCpu->cpum.GstCtx.aGRegs[27],
432	pVCpu->cpum.GstCtx.aGRegs[28], pVCpu->cpum.GstCtx.aGRegs[29], pVCpu->cpum.GstCtx.aGRegs[30],
433	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0],
434	pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.fPState, IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec),
435	szInstr));
436	# else
437	# error "port me"
438	# endif
439
440	/* This stuff sucks atm. as it fills the log with MSRs. */
441	//if (LogIs3Enabled())
442	// DBGFR3InfoEx(pVCpu->pVMR3->pUVM, pVCpu->idCpu, "cpumguest", "verbose", NULL);
443	return;
444	}
445	# endif
446
447	# ifdef VBOX_VMM_TARGET_X86
448	LogFlow(("%s: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x\n",
449	pszFunction, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp,
450	pVCpu->cpum.GstCtx.eflags.u));
451	# define LOGFLOW_REG_STATE_EX(a_pszName, a_szExtraFmt, ...) \
452	LogFlow(("%s: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x" a_szExtraFmt "\n", \
453	(a_pszName), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, \
454	pVCpu->cpum.GstCtx.eflags.u, __VA_ARGS__))
455
456	# elif defined(VBOX_VMM_TARGET_ARMV8)
457	LogFlow(("%s: pc=%08RX64 lr=%08RX64 sp=%08RX64 psr=%08RX64 EL%u\n",
458	pszFunction, pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.aGRegs[ARMV8_A64_REG_LR],
459	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0], pVCpu->cpum.GstCtx.fPState,
460	IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) ));
461	# define LOGFLOW_REG_STATE_EX(a_pszName, a_szExtraFmt, ...) \
462	LogFlow(("%s: pc=%08RX64 lr=%08RX64 sp=%08RX64 psr=%08RX64 EL%u" a_szExtraFmt "\n", \
463	(a_pszName), pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.aGRegs[ARMV8_A64_REG_LR], \
464	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0], pVCpu->cpum.GstCtx.fPState, \
465	IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec), __VA_ARGS__))
466	LOGFLOW_REG_STATE_EX(pszFunction, "",1);
467
468	# else
469	# error "port me"
470	# endif
471	RT_NOREF_PV(pVCpu);
472	}
473	#endif /* LOG_ENABLED */
474
475
476	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
477	/**
478	* Deals with VMCPU_FF_VMX_APIC_WRITE, VMCPU_FF_VMX_MTF, VMCPU_FF_VMX_NMI_WINDOW,
479	* VMCPU_FF_VMX_PREEMPT_TIMER and VMCPU_FF_VMX_INT_WINDOW.
480	*
481	* @returns Modified rcStrict.
482	* @param pVCpu The cross context virtual CPU structure of the calling thread.
483	* @param rcStrict The instruction execution status.
484	*/
485	static VBOXSTRICTRC iemHandleNestedInstructionBoundaryFFs(PVMCPUCC pVCpu, VBOXSTRICTRC rcStrict) RT_NOEXCEPT
486	{
487	Assert(CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)));
488	if (!VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF))
489	{
490	/* VMX preemption timer takes priority over NMI-window exits. */
491	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER))
492	{
493	rcStrict = iemVmxVmexitPreemptTimer(pVCpu);
494	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
495	}
496	/*
497	* Check remaining intercepts.
498	*
499	* NMI-window and Interrupt-window VM-exits.
500	* Interrupt shadow (block-by-STI and Mov SS) inhibits interrupts and may also block NMIs.
501	* Event injection during VM-entry takes priority over NMI-window and interrupt-window VM-exits.
502	*
503	* See Intel spec. 26.7.6 "NMI-Window Exiting".
504	* See Intel spec. 26.7.5 "Interrupt-Window Exiting and Virtual-Interrupt Delivery".
505	*/
506	else if ( VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW \| VMCPU_FF_VMX_INT_WINDOW)
507	&& !CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx)
508	&& !TRPMHasTrap(pVCpu))
509	{
510	Assert(CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx));
511	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW)
512	&& CPUMIsGuestVmxVirtNmiBlocking(&pVCpu->cpum.GstCtx))
513	{
514	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_NMI_WINDOW, 0 /* u64ExitQual */);
515	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW));
516	}
517	else if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW)
518	&& CPUMIsGuestVmxVirtIntrEnabled(&pVCpu->cpum.GstCtx))
519	{
520	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_INT_WINDOW, 0 /* u64ExitQual */);
521	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW));
522	}
523	}
524	}
525	/* TPR-below threshold/APIC write has the highest priority. */
526	else if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
527	{
528	rcStrict = iemVmxApicWriteEmulation(pVCpu);
529	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
530	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
531	}
532	/* MTF takes priority over VMX-preemption timer. */
533	else
534	{
535	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_MTF, 0 /* u64ExitQual */);
536	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
537	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
538	}
539	return rcStrict;
540	}
541	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
542
543
544	/**
545	* The actual code execution bits of IEMExecOne, IEMExecOneWithPrefetchedByPC,
546	* IEMExecOneBypass and friends.
547	*
548	* Similar code is found in IEMExecLots.
549	*
550	* @return Strict VBox status code.
551	* @param pVCpu The cross context virtual CPU structure of the
552	* calling EMT.
553	* @param pszFunction The calling function name.
554	* @tparam a_fExecuteInhibit X86: If set, execute the instruction following
555	* CLI, POP SS and MOV SS,GR.
556	*/
557	template<bool const a_fExecuteInhibit>
558	DECLINLINE(VBOXSTRICTRC) iemExecOneInner(PVMCPUCC pVCpu, const char *pszFunction)
559	{
560	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
561	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
562	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
563	RT_NOREF_PV(pszFunction);
564
565	VBOXSTRICTRC rcStrict;
566	IEM_TRY_SETJMP(pVCpu, rcStrict)
567	{
568	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
569	}
570	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
571	{
572	pVCpu->iem.s.cLongJumps++;
573	}
574	IEM_CATCH_LONGJMP_END(pVCpu);
575	if (rcStrict == VINF_SUCCESS)
576	pVCpu->iem.s.cInstructions++;
577	if (pVCpu->iem.s.cActiveMappings > 0)
578	{
579	Assert(rcStrict != VINF_SUCCESS);
580	iemMemRollback(pVCpu);
581	}
582	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
583	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
584	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
585
586	//#ifdef DEBUG
587	// AssertMsg(IEM_GET_INSTR_LEN(pVCpu) == cbInstr \|\| rcStrict != VINF_SUCCESS, ("%u %u\n", IEM_GET_INSTR_LEN(pVCpu), cbInstr));
588	//#endif
589
590	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
591	/*
592	* Perform any VMX nested-guest instruction boundary actions.
593	*
594	* If any of these causes a VM-exit, we must skip executing the next
595	* instruction (would run into stale page tables). A VM-exit makes sure
596	* there is no interrupt-inhibition, so that should ensure we don't go
597	* to try execute the next instruction. Clearing a_fExecuteInhibit is
598	* problematic because of the setjmp/longjmp clobbering above.
599	*/
600	if ( !VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
601	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)
602	\|\| rcStrict != VINF_SUCCESS)
603	{ /* likely */ }
604	else
605	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
606	#endif
607
608	#ifdef VBOX_VMM_TARGET_X86
609	/* Execute the next instruction as well if a cli, pop ss or
610	mov ss, Gr has just completed successfully. */
611	if RT_CONSTEXPR_IF(a_fExecuteInhibit)
612	{
613	if ( rcStrict == VINF_SUCCESS
614	&& CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
615	{
616	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu,
617	pVCpu->iem.s.fExec & (IEM_F_BYPASS_HANDLERS \| IEM_F_X86_DISREGARD_LOCK));
618	if (rcStrict == VINF_SUCCESS)
619	{
620	# ifdef LOG_ENABLED
621	iemLogCurInstr(pVCpu, pszFunction);
622	# endif
623	IEM_TRY_SETJMP_AGAIN(pVCpu, rcStrict)
624	{
625	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
626	}
627	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
628	{
629	pVCpu->iem.s.cLongJumps++;
630	}
631	IEM_CATCH_LONGJMP_END(pVCpu);
632	if (rcStrict == VINF_SUCCESS)
633	{
634	pVCpu->iem.s.cInstructions++;
635	# ifdef VBOX_WITH_NESTED_HWVIRT_VMX
636	if (!VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
637	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW))
638	{ /* likely */ }
639	else
640	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
641	# endif
642	}
643	if (pVCpu->iem.s.cActiveMappings > 0)
644	{
645	Assert(rcStrict != VINF_SUCCESS);
646	iemMemRollback(pVCpu);
647	}
648	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
649	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
650	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
651	}
652	else if (pVCpu->iem.s.cActiveMappings > 0)
653	iemMemRollback(pVCpu);
654	/** @todo drop this after we bake this change into RIP advancing. */
655	CPUMClearInterruptShadow(&pVCpu->cpum.GstCtx); /* hope this is correct for all exceptional cases... */
656	}
657	}
658	#endif /* VBOX_VMM_TARGET_X86 */
659
660	/*
661	* Return value fiddling, statistics and sanity assertions.
662	*/
663	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
664
665	#ifdef VBOX_STRICT
666	iemInitExecTailStrictTarget(pVCpu);
667	#endif
668	return rcStrict;
669	}
670
671
672	/**
673	* Execute one instruction.
674	*
675	* @return Strict VBox status code.
676	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
677	*/
678	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOne(PVMCPUCC pVCpu)
679	{
680	AssertCompile(sizeof(pVCpu->iem.s) <= sizeof(pVCpu->iem.padding)); /* (tstVMStruct can't do it's job w/o instruction stats) */
681	#ifdef LOG_ENABLED
682	iemLogCurInstr(pVCpu, "IEMExecOne");
683	#endif
684
685	/*
686	* Do the decoding and emulation.
687	*/
688	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
689	if (rcStrict == VINF_SUCCESS)
690	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOne");
691	else if (pVCpu->iem.s.cActiveMappings > 0)
692	iemMemRollback(pVCpu);
693
694	#ifdef LOG_ENABLED
695	if (rcStrict != VINF_SUCCESS)
696	LOGFLOW_REG_STATE_EX("IEMExecOne", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
697	#endif
698	return rcStrict;
699	}
700
701
702	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneWithPrefetchedByPC(PVMCPUCC pVCpu, uint64_t OpcodeBytesPC,
703	const void *pvOpcodeBytes, size_t cbOpcodeBytes)
704	{
705	VBOXSTRICTRC rcStrict;
706	if ( cbOpcodeBytes
707	&& iemRegGetPC(pVCpu) == OpcodeBytesPC)
708	{
709	iemInitDecoder(pVCpu, 0 /fExecOpts/);
710	#ifdef IEM_WITH_CODE_TLB
711	pVCpu->iem.s.uInstrBufPc = OpcodeBytesPC;
712	pVCpu->iem.s.pbInstrBuf = (uint8_t const *)pvOpcodeBytes;
713	pVCpu->iem.s.cbInstrBufTotal = (uint16_t)RT_MIN(X86_PAGE_SIZE, cbOpcodeBytes);
714	# ifdef VBOX_VMM_TARGET_X86
715	pVCpu->iem.s.offCurInstrStart = 0;
716	pVCpu->iem.s.offInstrNextByte = 0;
717	# endif
718	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
719	#else
720	pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
721	memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
722	#endif
723	rcStrict = VINF_SUCCESS;
724	}
725	else
726	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
727	if (rcStrict == VINF_SUCCESS)
728	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOneWithPrefetchedByPC");
729	else if (pVCpu->iem.s.cActiveMappings > 0)
730	iemMemRollback(pVCpu);
731
732	return rcStrict;
733	}
734
735
736	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneBypass(PVMCPUCC pVCpu)
737	{
738	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_BYPASS_HANDLERS);
739	if (rcStrict == VINF_SUCCESS)
740	rcStrict = iemExecOneInner<false>(pVCpu, "IEMExecOneBypass");
741	else if (pVCpu->iem.s.cActiveMappings > 0)
742	iemMemRollback(pVCpu);
743
744	return rcStrict;
745	}
746
747
748	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneBypassWithPrefetchedByPC(PVMCPUCC pVCpu, uint64_t OpcodeBytesPC,
749	const void *pvOpcodeBytes, size_t cbOpcodeBytes)
750	{
751	VBOXSTRICTRC rcStrict;
752	if ( cbOpcodeBytes
753	&& iemRegGetPC(pVCpu) == OpcodeBytesPC)
754	{
755	iemInitDecoder(pVCpu, IEM_F_BYPASS_HANDLERS);
756	#ifdef IEM_WITH_CODE_TLB
757	pVCpu->iem.s.uInstrBufPc = OpcodeBytesPC;
758	pVCpu->iem.s.pbInstrBuf = (uint8_t const *)pvOpcodeBytes;
759	pVCpu->iem.s.cbInstrBufTotal = (uint16_t)RT_MIN(X86_PAGE_SIZE, cbOpcodeBytes);
760	# ifdef VBOX_VMM_TARGET_X86
761	pVCpu->iem.s.offCurInstrStart = 0;
762	pVCpu->iem.s.offInstrNextByte = 0;
763	# endif
764	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
765	#else
766	pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
767	memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
768	#endif
769	rcStrict = VINF_SUCCESS;
770	}
771	else
772	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_BYPASS_HANDLERS);
773	if (rcStrict == VINF_SUCCESS)
774	rcStrict = iemExecOneInner<false>(pVCpu, "IEMExecOneBypassWithPrefetchedByPC");
775	else if (pVCpu->iem.s.cActiveMappings > 0)
776	iemMemRollback(pVCpu);
777
778	return rcStrict;
779	}
780
781
782	/**
783	* For handling split cacheline lock operations when the host has split-lock
784	* detection enabled.
785	*
786	* This will cause the interpreter to disregard the lock prefix and implicit
787	* locking (xchg).
788	*
789	* @returns Strict VBox status code.
790	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
791	*/
792	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneIgnoreLock(PVMCPUCC pVCpu)
793	{
794	/*
795	* Do the decoding and emulation.
796	*/
797	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_X86_DISREGARD_LOCK);
798	if (rcStrict == VINF_SUCCESS)
799	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOneIgnoreLock");
800	else if (pVCpu->iem.s.cActiveMappings > 0)
801	iemMemRollback(pVCpu);
802
803	#ifdef LOG_ENABLED
804	if (rcStrict != VINF_SUCCESS)
805	LOGFLOW_REG_STATE_EX("IEMExecOneIgnoreLock", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
806	#endif
807	return rcStrict;
808	}
809
810
811	/**
812	* Code common to IEMExecLots and IEMExecRecompilerThreaded that attempts to
813	* inject a pending TRPM trap.
814	*/
815	VBOXSTRICTRC iemExecInjectPendingTrap(PVMCPUCC pVCpu)
816	{
817	Assert(TRPMHasTrap(pVCpu));
818	#ifdef VBOX_VMM_TARGET_X86
819
820	if ( !CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx)
821	&& !CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx))
822	{
823	/** @todo Can we centralize this under CPUMCanInjectInterrupt()? */
824	# if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
825	bool fIntrEnabled = CPUMGetGuestGif(&pVCpu->cpum.GstCtx);
826	if (fIntrEnabled)
827	{
828	if (!CPUMIsGuestInNestedHwvirtMode(IEM_GET_CTX(pVCpu)))
829	fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
830	else if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
831	fIntrEnabled = CPUMIsGuestVmxPhysIntrEnabled(IEM_GET_CTX(pVCpu));
832	else
833	{
834	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
835	fIntrEnabled = CPUMIsGuestSvmPhysIntrEnabled(pVCpu, IEM_GET_CTX(pVCpu));
836	}
837	}
838	# else
839	bool fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
840	# endif
841	if (fIntrEnabled)
842	{
843	uint8_t u8TrapNo;
844	TRPMEVENT enmType;
845	uint32_t uErrCode;
846	RTGCPTR uCr2;
847	int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /pu8InstLen/, NULL /fIcebp/);
848	AssertRC(rc2);
849	Assert(enmType == TRPM_HARDWARE_INT);
850	VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /cbInstr/);
851
852	TRPMResetTrap(pVCpu);
853
854	# if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
855	/* Injecting an event may cause a VM-exit. */
856	if ( rcStrict != VINF_SUCCESS
857	&& rcStrict != VINF_IEM_RAISED_XCPT)
858	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
859	# else
860	NOREF(rcStrict);
861	# endif
862	}
863	}
864
865	return VINF_SUCCESS;
866
867	#else /* !VBOX_VMM_TARGET_X86 */
868	RT_NOREF(pVCpu);
869	AssertFailedReturn(VERR_NOT_IMPLEMENTED);
870	#endif /* !VBOX_VMM_TARGET_X86 */
871	}
872
873
874	VMM_INT_DECL(VBOXSTRICTRC) IEMExecLots(PVMCPUCC pVCpu, uint32_t cMaxInstructions, uint32_t cPollRate, uint32_t *pcInstructions)
875	{
876	uint32_t const cInstructionsAtStart = pVCpu->iem.s.cInstructions;
877	AssertMsg(RT_IS_POWER_OF_TWO(cPollRate + 1), ("%#x\n", cPollRate));
878	Assert(cMaxInstructions > 0);
879
880	/*
881	* See if there is an interrupt pending in TRPM, inject it if we can.
882	*/
883	/** @todo What if we are injecting an exception and not an interrupt? Is that
884	* possible here? For now we assert it is indeed only an interrupt. */
885	if (!TRPMHasTrap(pVCpu))
886	{ /* likely */ }
887	else
888	{
889	VBOXSTRICTRC rcStrict = iemExecInjectPendingTrap(pVCpu);
890	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
891	{ /likely / }
892	else
893	return rcStrict;
894	}
895
896	/*
897	* Initial decoder init w/ prefetch, then setup setjmp.
898	*/
899	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
900	if (rcStrict == VINF_SUCCESS)
901	{
902	pVCpu->iem.s.cActiveMappings = 0; /** @todo wtf? */
903	IEM_TRY_SETJMP(pVCpu, rcStrict)
904	{
905	/*
906	* The run loop. We limit ourselves to 4096 instructions right now.
907	*/
908	uint32_t cMaxInstructionsGccStupidity = cMaxInstructions;
909	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
910	for (;;)
911	{
912	/*
913	* Log the state.
914	*/
915	#ifdef LOG_ENABLED
916	iemLogCurInstr(pVCpu, "IEMExecLots");
917	#endif
918
919	/*
920	* Do the decoding and emulation.
921	*/
922	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
923	#if defined(VBOX_STRICT) && defined(VBOX_VMM_TARGET_X86)
924	CPUMAssertGuestRFlagsCookie(pVM, pVCpu);
925	#endif
926	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
927	{
928	Assert(pVCpu->iem.s.cActiveMappings == 0);
929	pVCpu->iem.s.cInstructions++;
930
931	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
932	/* Perform any VMX nested-guest instruction boundary actions. */
933	uint64_t fCpu = pVCpu->fLocalForcedActions;
934	if (!(fCpu & ( VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
935	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)))
936	{ /* likely */ }
937	else
938	{
939	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
940	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
941	fCpu = pVCpu->fLocalForcedActions;
942	else
943	{
944	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
945	break;
946	}
947	}
948	#endif
949	if (RT_LIKELY(pVCpu->iem.s.rcPassUp == VINF_SUCCESS))
950	{
951	#ifndef VBOX_WITH_NESTED_HWVIRT_VMX
952	uint64_t fCpu = pVCpu->fLocalForcedActions;
953	#endif
954	fCpu &= VMCPU_FF_ALL_MASK & ~( VMCPU_FF_PGM_SYNC_CR3
955	\| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
956	\| VMCPU_FF_TLB_FLUSH
957	\| VMCPU_FF_UNHALT );
958
959	if (RT_LIKELY( iemExecLoopTargetCheckMaskedCpuFFs(pVCpu, fCpu)
960	&& !VM_FF_IS_ANY_SET(pVM, VM_FF_ALL_MASK) ))
961	{
962	if (--cMaxInstructionsGccStupidity > 0)
963	{
964	/* Poll timers every now an then according to the caller's specs. */
965	if ( (cMaxInstructionsGccStupidity & cPollRate) != 0
966	\|\| !TMTimerPollBool(pVM, pVCpu))
967	{
968	Assert(pVCpu->iem.s.cActiveMappings == 0);
969	iemReInitDecoder(pVCpu);
970	continue;
971	}
972	}
973	}
974	}
975	Assert(pVCpu->iem.s.cActiveMappings == 0);
976	}
977	else if (pVCpu->iem.s.cActiveMappings > 0)
978	iemMemRollback(pVCpu);
979	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
980	break;
981	}
982	}
983	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
984	{
985	if (pVCpu->iem.s.cActiveMappings > 0)
986	iemMemRollback(pVCpu);
987	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
988	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
989	#endif
990	pVCpu->iem.s.cLongJumps++;
991	}
992	IEM_CATCH_LONGJMP_END(pVCpu);
993
994	#ifdef VBOX_STRICT
995	iemInitExecTailStrictTarget(pVCpu);
996	#endif
997	}
998	else
999	{
1000	if (pVCpu->iem.s.cActiveMappings > 0)
1001	iemMemRollback(pVCpu);
1002
1003	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
1004	/*
1005	* When a nested-guest causes an exception intercept (e.g. #PF) when fetching
1006	* code as part of instruction execution, we need this to fix-up VINF_SVM_VMEXIT.
1007	*/
1008	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1009	#endif
1010	}
1011
1012	/*
1013	* Maybe re-enter raw-mode and log.
1014	*/
1015	#ifdef LOG_ENABLED
1016	if (rcStrict != VINF_SUCCESS)
1017	LOGFLOW_REG_STATE_EX("IEMExecLots", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
1018	#endif
1019	if (pcInstructions)
1020	*pcInstructions = pVCpu->iem.s.cInstructions - cInstructionsAtStart;
1021	return rcStrict;
1022	}
1023
1024
1025	/**
1026	* Interface used by EMExecuteExec, does exit statistics and limits.
1027	*
1028	* @returns Strict VBox status code.
1029	* @param pVCpu The cross context virtual CPU structure.
1030	* @param fWillExit To be defined.
1031	* @param cMinInstructions Minimum number of instructions to execute before checking for FFs.
1032	* @param cMaxInstructions Maximum number of instructions to execute.
1033	* @param cMaxInstructionsWithoutExits
1034	* The max number of instructions without exits.
1035	* @param pStats Where to return statistics.
1036	*/
1037	VMM_INT_DECL(VBOXSTRICTRC)
1038	IEMExecForExits(PVMCPUCC pVCpu, uint32_t fWillExit, uint32_t cMinInstructions, uint32_t cMaxInstructions,
1039	uint32_t cMaxInstructionsWithoutExits, PIEMEXECFOREXITSTATS pStats)
1040	{
1041	NOREF(fWillExit); /** @todo define flexible exit crits */
1042
1043	/*
1044	* Initialize return stats.
1045	*/
1046	pStats->cInstructions = 0;
1047	pStats->cExits = 0;
1048	pStats->cMaxExitDistance = 0;
1049	pStats->cReserved = 0;
1050
1051	/*
1052	* Initial decoder init w/ prefetch, then setup setjmp.
1053	*/
1054	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
1055	if (rcStrict == VINF_SUCCESS)
1056	{
1057	pVCpu->iem.s.cActiveMappings = 0; /** @todo wtf?!? */
1058	IEM_TRY_SETJMP(pVCpu, rcStrict)
1059	{
1060	#ifdef IN_RING0
1061	bool const fCheckPreemptionPending = !RTThreadPreemptIsPossible() \|\| !RTThreadPreemptIsEnabled(NIL_RTTHREAD);
1062	#endif
1063	uint32_t cInstructionSinceLastExit = 0;
1064
1065	/*
1066	* The run loop. We limit ourselves to 4096 instructions right now.
1067	*/
1068	PVM pVM = pVCpu->CTX_SUFF(pVM);
1069	for (;;)
1070	{
1071	/*
1072	* Log the state.
1073	*/
1074	#ifdef LOG_ENABLED
1075	iemLogCurInstr(pVCpu, "IEMExecForExits");
1076	#endif
1077
1078	/*
1079	* Do the decoding and emulation.
1080	*/
1081	uint32_t const cPotentialExits = pVCpu->iem.s.cPotentialExits;
1082
1083	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
1084
1085	if ( cPotentialExits != pVCpu->iem.s.cPotentialExits
1086	&& cInstructionSinceLastExit > 0 /* don't count the first */ )
1087	{
1088	pStats->cExits += 1;
1089	if (cInstructionSinceLastExit > pStats->cMaxExitDistance)
1090	pStats->cMaxExitDistance = cInstructionSinceLastExit;
1091	cInstructionSinceLastExit = 0;
1092	}
1093
1094	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1095	{
1096	Assert(pVCpu->iem.s.cActiveMappings == 0);
1097	pVCpu->iem.s.cInstructions++;
1098	pStats->cInstructions++;
1099	cInstructionSinceLastExit++;
1100
1101	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1102	/* Perform any VMX nested-guest instruction boundary actions. */
1103	uint64_t fCpu = pVCpu->fLocalForcedActions;
1104	if (!(fCpu & ( VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
1105	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)))
1106	{ /* likely */ }
1107	else
1108	{
1109	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
1110	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1111	fCpu = pVCpu->fLocalForcedActions;
1112	else
1113	{
1114	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1115	break;
1116	}
1117	}
1118	#endif
1119	if (RT_LIKELY(pVCpu->iem.s.rcPassUp == VINF_SUCCESS))
1120	{
1121	#ifndef VBOX_WITH_NESTED_HWVIRT_VMX
1122	uint64_t fCpu = pVCpu->fLocalForcedActions;
1123	#endif
1124	fCpu &= VMCPU_FF_ALL_MASK & ~( VMCPU_FF_PGM_SYNC_CR3
1125	\| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
1126	\| VMCPU_FF_TLB_FLUSH
1127	\| VMCPU_FF_UNHALT );
1128	if (RT_LIKELY( ( iemExecLoopTargetCheckMaskedCpuFFs(pVCpu, fCpu)
1129	&& !VM_FF_IS_ANY_SET(pVM, VM_FF_ALL_MASK) )
1130	\|\| pStats->cInstructions < cMinInstructions))
1131	{
1132	if (pStats->cInstructions < cMaxInstructions)
1133	{
1134	if (cInstructionSinceLastExit <= cMaxInstructionsWithoutExits)
1135	{
1136	#ifdef IN_RING0
1137	if ( !fCheckPreemptionPending
1138	\|\| !RTThreadPreemptIsPending(NIL_RTTHREAD))
1139	#endif
1140	{
1141	Assert(pVCpu->iem.s.cActiveMappings == 0);
1142	iemReInitDecoder(pVCpu);
1143	continue;
1144	}
1145	#ifdef IN_RING0
1146	rcStrict = VINF_EM_RAW_INTERRUPT;
1147	break;
1148	#endif
1149	}
1150	}
1151	}
1152	Assert(!(fCpu & VMCPU_FF_IEM));
1153	}
1154	Assert(pVCpu->iem.s.cActiveMappings == 0);
1155	}
1156	else if (pVCpu->iem.s.cActiveMappings > 0)
1157	iemMemRollback(pVCpu);
1158	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1159	break;
1160	}
1161	}
1162	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
1163	{
1164	if (pVCpu->iem.s.cActiveMappings > 0)
1165	iemMemRollback(pVCpu);
1166	pVCpu->iem.s.cLongJumps++;
1167	}
1168	IEM_CATCH_LONGJMP_END(pVCpu);
1169
1170	#ifdef VBOX_STRICT
1171	iemInitExecTailStrictTarget(pVCpu);
1172	#endif
1173	}
1174	else
1175	{
1176	if (pVCpu->iem.s.cActiveMappings > 0)
1177	iemMemRollback(pVCpu);
1178
1179	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
1180	/*
1181	* When a nested-guest causes an exception intercept (e.g. #PF) when fetching
1182	* code as part of instruction execution, we need this to fix-up VINF_SVM_VMEXIT.
1183	*/
1184	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1185	#endif
1186	}
1187
1188	/*
1189	* Maybe re-enter raw-mode and log.
1190	*/
1191	#ifdef LOG_ENABLED
1192	if (rcStrict != VINF_SUCCESS)
1193	LOGFLOW_REG_STATE_EX("IEMExecLots", " - rcStrict=%Rrc; ins=%u exits=%u maxdist=%u",
1194	VBOXSTRICTRC_VAL(rcStrict), pStats->cInstructions, pStats->cExits, pStats->cMaxExitDistance);
1195	#endif
1196	return rcStrict;
1197	}
1198
1199
1200	/**
1201	* Injects a trap, fault, abort, software interrupt or external interrupt.
1202	*
1203	* The parameter list matches TRPMQueryTrapAll pretty closely.
1204	*
1205	* @returns Strict VBox status code.
1206	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1207	* @param u8TrapNo The trap number.
1208	* @param enmType What type is it (trap/fault/abort), software
1209	* interrupt or hardware interrupt.
1210	* @param uErrCode The error code if applicable.
1211	* @param uCr2 The CR2 value if applicable.
1212	* @param cbInstr The instruction length (only relevant for
1213	* software interrupts).
1214	* @note x86 specific, but difficult to move due to iemInitDecoder dep.
1215	*/
1216	VMM_INT_DECL(VBOXSTRICTRC)
1217	IEMInjectTrap(PVMCPUCC pVCpu, uint8_t u8TrapNo, TRPMEVENT enmType, uint16_t uErrCode, RTGCPTR uCr2, uint8_t cbInstr)
1218	{
1219	#ifdef VBOX_VMM_TARGET_X86
1220	iemInitDecoder(pVCpu, 0 /fExecOpts/); /** @todo wrong init function! */
1221	# ifdef DBGFTRACE_ENABLED
1222	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "IEMInjectTrap: %x %d %x %llx",
1223	u8TrapNo, enmType, uErrCode, uCr2);
1224	# endif
1225
1226	uint32_t fFlags;
1227	switch (enmType)
1228	{
1229	case TRPM_HARDWARE_INT:
1230	Log(("IEMInjectTrap: %#4x ext\n", u8TrapNo));
1231	fFlags = IEM_XCPT_FLAGS_T_EXT_INT;
1232	uErrCode = uCr2 = 0;
1233	break;
1234
1235	case TRPM_SOFTWARE_INT:
1236	Log(("IEMInjectTrap: %#4x soft\n", u8TrapNo));
1237	fFlags = IEM_XCPT_FLAGS_T_SOFT_INT;
1238	uErrCode = uCr2 = 0;
1239	break;
1240
1241	case TRPM_TRAP:
1242	case TRPM_NMI: /** @todo Distinguish NMI from exception 2. */
1243	Log(("IEMInjectTrap: %#4x trap err=%#x cr2=%#RGv\n", u8TrapNo, uErrCode, uCr2));
1244	fFlags = IEM_XCPT_FLAGS_T_CPU_XCPT;
1245	if (u8TrapNo == X86_XCPT_PF)
1246	fFlags \|= IEM_XCPT_FLAGS_CR2;
1247	switch (u8TrapNo)
1248	{
1249	case X86_XCPT_DF:
1250	case X86_XCPT_TS:
1251	case X86_XCPT_NP:
1252	case X86_XCPT_SS:
1253	case X86_XCPT_PF:
1254	case X86_XCPT_AC:
1255	case X86_XCPT_GP:
1256	fFlags \|= IEM_XCPT_FLAGS_ERR;
1257	break;
1258	}
1259	break;
1260
1261	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1262	}
1263
1264	VBOXSTRICTRC rcStrict = iemRaiseXcptOrInt(pVCpu, cbInstr, u8TrapNo, fFlags, uErrCode, uCr2);
1265
1266	if (pVCpu->iem.s.cActiveMappings > 0)
1267	iemMemRollback(pVCpu);
1268
1269	return rcStrict;
1270
1271	#else /* !VBOX_VMM_TARGET_X86 */
1272	RT_NOREF(pVCpu, u8TrapNo, enmType, uErrCode, uCr2, cbInstr);
1273	AssertFailedReturn(VERR_NOT_IMPLEMENTED);
1274	#endif /* !VBOX_VMM_TARGET_X86 */
1275	}
1276
1277
1278	/**
1279	* Injects the active TRPM event.
1280	*
1281	* @returns Strict VBox status code.
1282	* @param pVCpu The cross context virtual CPU structure.
1283	*/
1284	VMM_INT_DECL(VBOXSTRICTRC) IEMInjectTrpmEvent(PVMCPUCC pVCpu)
1285	{
1286	#ifndef IEM_IMPLEMENTS_TASKSWITCH
1287	IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Event injection\n"));
1288	#else
1289	uint8_t u8TrapNo;
1290	TRPMEVENT enmType;
1291	uint32_t uErrCode;
1292	RTGCUINTPTR uCr2;
1293	uint8_t cbInstr;
1294	int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, &cbInstr, NULL /* fIcebp */);
1295	if (RT_FAILURE(rc))
1296	return rc;
1297
1298	/** @todo r=ramshankar: Pass ICEBP info. to IEMInjectTrap() below and handle
1299	* ICEBP \#DB injection as a special case. */
1300	VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, uErrCode, uCr2, cbInstr);
1301	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1302	if (rcStrict == VINF_SVM_VMEXIT)
1303	rcStrict = VINF_SUCCESS;
1304	#endif
1305	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1306	if (rcStrict == VINF_VMX_VMEXIT)
1307	rcStrict = VINF_SUCCESS;
1308	#endif
1309	/** @todo Are there any other codes that imply the event was successfully
1310	* delivered to the guest? See @bugref{6607}. */
1311	if ( rcStrict == VINF_SUCCESS
1312	\|\| rcStrict == VINF_IEM_RAISED_XCPT)
1313	TRPMResetTrap(pVCpu);
1314
1315	return rcStrict;
1316	#endif
1317	}
1318
1319
1320	VMM_INT_DECL(int) IEMBreakpointSet(PVM pVM, RTGCPTR GCPtrBp)
1321	{
1322	RT_NOREF_PV(pVM); RT_NOREF_PV(GCPtrBp);
1323	return VERR_NOT_IMPLEMENTED;
1324	}
1325
1326
1327	VMM_INT_DECL(int) IEMBreakpointClear(PVM pVM, RTGCPTR GCPtrBp)
1328	{
1329	RT_NOREF_PV(pVM); RT_NOREF_PV(GCPtrBp);
1330	return VERR_NOT_IMPLEMENTED;
1331	}
1332

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAll.cpp@ 108427

Download in other formats: