IEMAll.cpp@ 108702

Last change on this file since 108702 was 108702, checked in by vboxsync, 7 weeks ago
VMM/IEM: More ARM target work. jiraref:VBP-1598
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 51.6 KB

Line
1	/* $Id: IEMAll.cpp 108702 2025-03-21 23:27:14Z vboxsync $ */
2	/** @file
3	* IEM - Interpreted Execution Manager - All Contexts.
4	*/
5
6	/*
7	* Copyright (C) 2011-2024 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/** @page pg_iem IEM - Interpreted Execution Manager
30	*
31	* The interpreted exeuction manager (IEM) is for executing short guest code
32	* sequences that are causing too many exits / virtualization traps. It will
33	* also be used to interpret single instructions, thus replacing the selective
34	* interpreters in EM and IOM.
35	*
36	* Design goals:
37	* - Relatively small footprint, although we favour speed and correctness
38	* over size.
39	* - Reasonably fast.
40	* - Correctly handle lock prefixed instructions.
41	* - Complete instruction set - eventually.
42	* - Refactorable into a recompiler, maybe.
43	* - Replace EMInterpret*.
44	*
45	* Using the existing disassembler has been considered, however this is thought
46	* to conflict with speed as the disassembler chews things a bit too much while
47	* leaving us with a somewhat complicated state to interpret afterwards.
48	*
49	*
50	* The current code is very much work in progress. You've been warned!
51	*
52	*
53	* @section sec_iem_fpu_instr FPU Instructions
54	*
55	* On x86 and AMD64 hosts, the FPU instructions are implemented by executing the
56	* same or equivalent instructions on the host FPU. To make life easy, we also
57	* let the FPU prioritize the unmasked exceptions for us. This however, only
58	* works reliably when CR0.NE is set, i.e. when using \#MF instead the IRQ 13
59	* for FPU exception delivery, because with CR0.NE=0 there is a window where we
60	* can trigger spurious FPU exceptions.
61	*
62	* The guest FPU state is not loaded into the host CPU and kept there till we
63	* leave IEM because the calling conventions have declared an all year open
64	* season on much of the FPU state. For instance an innocent looking call to
65	* memcpy might end up using a whole bunch of XMM or MM registers if the
66	* particular implementation finds it worthwhile.
67	*
68	*
69	* @section sec_iem_logging Logging
70	*
71	* The IEM code uses the \"IEM\" log group for the main logging. The different
72	* logging levels/flags are generally used for the following purposes:
73	* - Level 1 (Log) : Errors, exceptions, interrupts and such major events.
74	* - Flow (LogFlow) : Basic enter/exit IEM state info.
75	* - Level 2 (Log2) : ?
76	* - Level 3 (Log3) : More detailed enter/exit IEM state info.
77	* - Level 4 (Log4) : Decoding mnemonics w/ EIP.
78	* - Level 5 (Log5) : Decoding details.
79	* - Level 6 (Log6) : Enables/disables the lockstep comparison with REM.
80	* - Level 7 (Log7) : iret++ execution logging.
81	* - Level 8 (Log8) :
82	* - Level 9 (Log9) :
83	* - Level 10 (Log10): TLBs.
84	* - Level 11 (Log11): Unmasked FPU exceptions.
85	*
86	* The \"IEM_MEM\" log group covers most of memory related details logging,
87	* except for errors and exceptions:
88	* - Level 1 (Log) : Reads.
89	* - Level 2 (Log2) : Read fallbacks.
90	* - Level 3 (Log3) : MemMap read.
91	* - Level 4 (Log4) : MemMap read fallbacks.
92	* - Level 5 (Log5) : Writes
93	* - Level 6 (Log6) : Write fallbacks.
94	* - Level 7 (Log7) : MemMap writes and read-writes.
95	* - Level 8 (Log8) : MemMap write and read-write fallbacks.
96	* - Level 9 (Log9) : Stack reads.
97	* - Level 10 (Log10): Stack read fallbacks.
98	* - Level 11 (Log11): Stack writes.
99	* - Level 12 (Log12): Stack write fallbacks.
100	* - Flow (LogFlow) :
101	*
102	* The SVM (AMD-V) and VMX (VT-x) code has the following assignments:
103	* - Level 1 (Log) : Errors and other major events.
104	* - Flow (LogFlow) : Misc flow stuff (cleanup?)
105	* - Level 2 (Log2) : VM exits.
106	*
107	* The syscall logging level assignments:
108	* - Level 1: DOS and BIOS.
109	* - Level 2: Windows 3.x
110	* - Level 3: Linux.
111	*/
112
113
114	/*********************************************************************************************************************************
115	* Header Files *
116	*********************************************************************************************************************************/
117	#define LOG_GROUP LOG_GROUP_IEM
118	#define VMCPU_INCL_CPUM_GST_CTX
119	#ifdef IN_RING0
120	# define VBOX_VMM_TARGET_X86
121	#endif
122	#include <VBox/vmm/iem.h>
123	#include <VBox/vmm/cpum.h>
124	#include <VBox/vmm/pdmapic.h>
125	#include <VBox/vmm/pdm.h>
126	#include <VBox/vmm/pgm.h>
127	#include <VBox/vmm/iom.h>
128	#include <VBox/vmm/em.h>
129	#include <VBox/vmm/hm.h>
130	#include <VBox/vmm/nem.h>
131	#include <VBox/vmm/gcm.h>
132	#include <VBox/vmm/gim.h>
133	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
134	# include <VBox/vmm/em.h>
135	# include <VBox/vmm/hm_svm.h>
136	#endif
137	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
138	# include <VBox/vmm/hmvmxinline.h>
139	#endif
140	#include <VBox/vmm/tm.h>
141	#include <VBox/vmm/dbgf.h>
142	#include <VBox/vmm/dbgftrace.h>
143	#include "IEMInternal.h"
144	#include <VBox/vmm/vmcc.h>
145	#include <VBox/log.h>
146	#include <VBox/err.h>
147	#include <VBox/param.h>
148	#include <VBox/dis.h>
149	#include <iprt/asm-math.h>
150	#if defined(RT_ARCH_AMD64) \|\| defined(RT_ARCH_X86)
151	# include <iprt/asm-amd64-x86.h>
152	#elif defined(RT_ARCH_ARM64) \|\| defined(RT_ARCH_ARM32)
153	# include <iprt/asm-arm.h>
154	#endif
155	#include <iprt/assert.h>
156	#include <iprt/string.h>
157	#include <iprt/x86.h>
158
159	#include "IEMInline.h"
160	#include "IEMInlineExec.h"
161	#ifdef VBOX_VMM_TARGET_X86
162	# include "target-x86/IEMInline-x86.h"
163	# include "target-x86/IEMInlineDecode-x86.h"
164	# include "target-x86/IEMInlineExec-x86.h"
165	#elif defined(VBOX_VMM_TARGET_ARMV8)
166	# include "target-armv8/IEMInline-armv8.h"
167	# include "target-armv8/IEMInlineExec-armv8.h"
168	#endif
169
170
171
172	/**
173	* Initializes the decoder state.
174	*
175	* iemReInitDecoder is mostly a copy of this function.
176	*
177	* @param pVCpu The cross context virtual CPU structure of the
178	* calling thread.
179	* @param fExecOpts Optional execution flags:
180	* - IEM_F_BYPASS_HANDLERS
181	* - IEM_F_X86_DISREGARD_LOCK
182	*/
183	DECLINLINE(void) iemInitDecoder(PVMCPUCC pVCpu, uint32_t fExecOpts)
184	{
185	IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
186	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
187	#ifdef VBOX_STRICT
188	iemInitDecoderStrictTarget(pVCpu);
189	#endif
190
191	/* Execution state: */
192	uint32_t fExec;
193	pVCpu->iem.s.fExec = fExec = iemCalcExecFlags(pVCpu) \| fExecOpts;
194
195	/* Decoder state: */
196	#ifdef VBOX_VMM_TARGET_X86
197	pVCpu->iem.s.enmDefAddrMode = fExec & IEM_F_MODE_X86_CPUMODE_MASK; /** @todo check if this is correct... */
198	pVCpu->iem.s.enmEffAddrMode = fExec & IEM_F_MODE_X86_CPUMODE_MASK;
199	if ((fExec & IEM_F_MODE_X86_CPUMODE_MASK) != IEMMODE_64BIT)
200	{
201	pVCpu->iem.s.enmDefOpSize = fExec & IEM_F_MODE_X86_CPUMODE_MASK; /** @todo check if this is correct... */
202	pVCpu->iem.s.enmEffOpSize = fExec & IEM_F_MODE_X86_CPUMODE_MASK;
203	}
204	else
205	{
206	pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
207	pVCpu->iem.s.enmEffOpSize = IEMMODE_32BIT;
208	}
209	pVCpu->iem.s.fPrefixes = 0;
210	pVCpu->iem.s.uRexReg = 0;
211	pVCpu->iem.s.uRexB = 0;
212	pVCpu->iem.s.uRexIndex = 0;
213	pVCpu->iem.s.idxPrefix = 0;
214	pVCpu->iem.s.uVex3rdReg = 0;
215	pVCpu->iem.s.uVexLength = 0;
216	pVCpu->iem.s.fEvexStuff = 0;
217	pVCpu->iem.s.iEffSeg = X86_SREG_DS;
218	pVCpu->iem.s.offModRm = 0;
219	#endif /* VBOX_VMM_TARGET_X86 */
220	#ifdef IEM_WITH_CODE_TLB
221	pVCpu->iem.s.pbInstrBuf = NULL;
222	pVCpu->iem.s.offInstrNextByte = 0;
223	# ifdef VBOX_VMM_TARGET_X86
224	pVCpu->iem.s.offCurInstrStart = 0;
225	# endif
226	# ifdef IEM_WITH_CODE_TLB_AND_OPCODE_BUF
227	pVCpu->iem.s.offOpcode = 0;
228	# endif
229	# ifdef VBOX_STRICT
230	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
231	# ifdef VBOX_VMM_TARGET_X86
232	pVCpu->iem.s.cbInstrBuf = UINT16_MAX;
233	# endif
234	pVCpu->iem.s.cbInstrBufTotal = UINT16_MAX;
235	pVCpu->iem.s.uInstrBufPc = UINT64_C(0xc0ffc0ffcff0c0ff);
236	# endif
237	#else /* !IEM_WITH_CODE_TLB */
238	pVCpu->iem.s.offOpcode = 0;
239	pVCpu->iem.s.cbOpcode = 0;
240	#endif /* !IEM_WITH_CODE_TLB */
241	pVCpu->iem.s.cActiveMappings = 0;
242	pVCpu->iem.s.iNextMapping = 0;
243	pVCpu->iem.s.rcPassUp = VINF_SUCCESS;
244
245	#ifdef DBGFTRACE_ENABLED
246	iemInitDecoderTraceTargetPc(pVCpu, fExec);
247	#endif
248	}
249
250
251	/**
252	* Reinitializes the decoder state 2nd+ loop of IEMExecLots.
253	*
254	* This is mostly a copy of iemInitDecoder.
255	*
256	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
257	*/
258	DECLINLINE(void) iemReInitDecoder(PVMCPUCC pVCpu)
259	{
260	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
261	#ifdef VBOX_STRICT
262	iemInitDecoderStrictTarget(pVCpu);
263	#endif
264
265	/* ASSUMES: Anyone changing CPU state affecting the fExec bits will update them! */
266	AssertMsg((pVCpu->iem.s.fExec & ~IEM_F_USER_OPTS) == iemCalcExecFlags(pVCpu),
267	("fExec=%#x iemCalcExecModeFlags=%#x\n", pVCpu->iem.s.fExec, iemCalcExecFlags(pVCpu)));
268
269	#ifdef VBOX_VMM_TARGET_X86
270	IEMMODE const enmMode = IEM_GET_CPU_MODE(pVCpu);
271	pVCpu->iem.s.enmDefAddrMode = enmMode; /** @todo check if this is correct... */
272	pVCpu->iem.s.enmEffAddrMode = enmMode;
273	if (enmMode != IEMMODE_64BIT)
274	{
275	pVCpu->iem.s.enmDefOpSize = enmMode; /** @todo check if this is correct... */
276	pVCpu->iem.s.enmEffOpSize = enmMode;
277	}
278	else
279	{
280	pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
281	pVCpu->iem.s.enmEffOpSize = IEMMODE_32BIT;
282	}
283	pVCpu->iem.s.fPrefixes = 0;
284	pVCpu->iem.s.uRexReg = 0;
285	pVCpu->iem.s.uRexB = 0;
286	pVCpu->iem.s.uRexIndex = 0;
287	pVCpu->iem.s.idxPrefix = 0;
288	pVCpu->iem.s.uVex3rdReg = 0;
289	pVCpu->iem.s.uVexLength = 0;
290	pVCpu->iem.s.fEvexStuff = 0;
291	pVCpu->iem.s.iEffSeg = X86_SREG_DS;
292	pVCpu->iem.s.offModRm = 0;
293	#endif
294	#ifdef IEM_WITH_CODE_TLB
295	if (pVCpu->iem.s.pbInstrBuf)
296	{
297	# ifdef VBOX_VMM_TARGET_X86
298	uint64_t off = (enmMode == IEMMODE_64BIT
299	? pVCpu->cpum.GstCtx.rip
300	: pVCpu->cpum.GstCtx.eip + (uint32_t)pVCpu->cpum.GstCtx.cs.u64Base)
301	- pVCpu->iem.s.uInstrBufPc;
302	if (off < pVCpu->iem.s.cbInstrBufTotal)
303	# elif defined(VBOX_VMM_TARGET_ARMV8)
304	uint64_t const off = pVCpu->cpum.GstCtx.Pc.u64 - pVCpu->iem.s.uInstrBufPc;
305	if (off + sizeof(uint32_t) <= pVCpu->iem.s.cbInstrBufTotal)
306	# endif
307	{
308	pVCpu->iem.s.offInstrNextByte = (uint32_t)off;
309	# ifdef VBOX_VMM_TARGET_X86
310	pVCpu->iem.s.offCurInstrStart = (uint16_t)off;
311	if ((uint16_t)off + 15 <= pVCpu->iem.s.cbInstrBufTotal)
312	pVCpu->iem.s.cbInstrBuf = (uint16_t)off + 15;
313	else
314	pVCpu->iem.s.cbInstrBuf = pVCpu->iem.s.cbInstrBufTotal;
315	# endif
316	}
317	else
318	{
319	pVCpu->iem.s.pbInstrBuf = NULL;
320	pVCpu->iem.s.offInstrNextByte = 0;
321	# ifdef VBOX_VMM_TARGET_X86
322	pVCpu->iem.s.offCurInstrStart = 0;
323	pVCpu->iem.s.cbInstrBuf = 0;
324	# endif
325	pVCpu->iem.s.cbInstrBufTotal = 0;
326	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
327	}
328	}
329	else
330	{
331	pVCpu->iem.s.offInstrNextByte = 0;
332	# ifdef VBOX_VMM_TARGET_X86
333	pVCpu->iem.s.offCurInstrStart = 0;
334	pVCpu->iem.s.cbInstrBuf = 0;
335	# endif
336	pVCpu->iem.s.cbInstrBufTotal = 0;
337	# ifdef VBOX_STRICT
338	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
339	# endif
340	}
341	# ifdef IEM_WITH_CODE_TLB_AND_OPCODE_BUF
342	pVCpu->iem.s.offOpcode = 0;
343	# endif
344	#else /* !IEM_WITH_CODE_TLB */
345	pVCpu->iem.s.cbOpcode = 0;
346	pVCpu->iem.s.offOpcode = 0;
347	#endif /* !IEM_WITH_CODE_TLB */
348	Assert(pVCpu->iem.s.cActiveMappings == 0);
349	pVCpu->iem.s.iNextMapping = 0;
350	Assert(pVCpu->iem.s.rcPassUp == VINF_SUCCESS);
351	Assert(!(pVCpu->iem.s.fExec & IEM_F_BYPASS_HANDLERS));
352
353	#ifdef DBGFTRACE_ENABLED
354	iemInitDecoderTraceTargetPc(pVCpu, pVCpu->iem.s.fExec);
355	#endif
356	}
357
358
359	/**
360	* Prefetch opcodes the first time when starting executing.
361	*
362	* @returns Strict VBox status code.
363	* @param pVCpu The cross context virtual CPU structure of the
364	* calling thread.
365	* @param fExecOpts Optional execution flags:
366	* - IEM_F_BYPASS_HANDLERS
367	* - IEM_F_X86_DISREGARD_LOCK
368	*/
369	DECLINLINE(VBOXSTRICTRC) iemInitDecoderAndPrefetchOpcodes(PVMCPUCC pVCpu, uint32_t fExecOpts) RT_NOEXCEPT
370	{
371	iemInitDecoder(pVCpu, fExecOpts);
372
373	#ifndef IEM_WITH_CODE_TLB
374	return iemOpcodeFetchPrefetch(pVCpu);
375	#else
376	return VINF_SUCCESS;
377	#endif
378	}
379
380
381	#ifdef LOG_ENABLED
382	/**
383	* Logs the current instruction.
384	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
385	* @param pszFunction The IEM function doing the execution.
386	*/
387	static void iemLogCurInstr(PVMCPUCC pVCpu, const char *pszFunction) RT_NOEXCEPT
388	{
389	# ifdef IN_RING3
390	if (LogIs2Enabled())
391	{
392	char szInstr[256];
393	uint32_t cbInstr = 0;
394	DBGFR3DisasInstrEx(pVCpu->pVMR3->pUVM, pVCpu->idCpu, 0, 0,
395	DBGF_DISAS_FLAGS_CURRENT_GUEST \| DBGF_DISAS_FLAGS_DEFAULT_MODE,
396	szInstr, sizeof(szInstr), &cbInstr);
397
398	# ifdef VBOX_VMM_TARGET_X86
399	PCX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.XState.x87;
400	Log2(("**** %s fExec=%x\n"
401	" eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x\n"
402	" eip=%08x esp=%08x ebp=%08x iopl=%d tr=%04x\n"
403	" cs=%04x ss=%04x ds=%04x es=%04x fs=%04x gs=%04x efl=%08x\n"
404	" fsw=%04x fcw=%04x ftw=%02x mxcsr=%04x/%04x\n"
405	" %s\n"
406	, pszFunction, pVCpu->iem.s.fExec,
407	pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ebx, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.edx, pVCpu->cpum.GstCtx.esi, pVCpu->cpum.GstCtx.edi,
408	pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.esp, pVCpu->cpum.GstCtx.ebp, pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL, pVCpu->cpum.GstCtx.tr.Sel,
409	pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.es.Sel,
410	pVCpu->cpum.GstCtx.fs.Sel, pVCpu->cpum.GstCtx.gs.Sel, pVCpu->cpum.GstCtx.eflags.u,
411	pFpuCtx->FSW, pFpuCtx->FCW, pFpuCtx->FTW, pFpuCtx->MXCSR, pFpuCtx->MXCSR_MASK,
412	szInstr));
413	# elif defined(VBOX_VMM_TARGET_ARMV8)
414	Log2(("**** %s fExec=%x\n"
415	" x0=%016RX64 x1=%016RX64 x2=%016RX64 x3=%016RX64\n"
416	" x4=%016RX64 x5=%016RX64 x6=%016RX64 x7=%016RX64\n"
417	" x8=%016RX64 x9=%016RX64 x10=%016RX64 x11=%016RX64\n"
418	" x12=%016RX64 x13=%016RX64 x14=%016RX64 x15=%016RX64\n"
419	" x16=%016RX64 x17=%016RX64 x18=%016RX64 x19=%016RX64\n"
420	" x20=%016RX64 x21=%016RX64 x22=%016RX64 x23=%016RX64\n"
421	" x24=%016RX64 x25=%016RX64 x26=%016RX64 x27=%016RX64\n"
422	" x28=%016RX64 bp=%016RX64 lr=%016RX64 sp=%016RX64\n"
423	" pc=%016RX64 psr=%08RX64 EL%u\n"
424	" %s\n"
425	, pszFunction, pVCpu->iem.s.fExec,
426	pVCpu->cpum.GstCtx.aGRegs[0], pVCpu->cpum.GstCtx.aGRegs[1], pVCpu->cpum.GstCtx.aGRegs[2], pVCpu->cpum.GstCtx.aGRegs[3],
427	pVCpu->cpum.GstCtx.aGRegs[4], pVCpu->cpum.GstCtx.aGRegs[5], pVCpu->cpum.GstCtx.aGRegs[6], pVCpu->cpum.GstCtx.aGRegs[7],
428	pVCpu->cpum.GstCtx.aGRegs[8], pVCpu->cpum.GstCtx.aGRegs[9], pVCpu->cpum.GstCtx.aGRegs[10], pVCpu->cpum.GstCtx.aGRegs[11],
429	pVCpu->cpum.GstCtx.aGRegs[12], pVCpu->cpum.GstCtx.aGRegs[13], pVCpu->cpum.GstCtx.aGRegs[14], pVCpu->cpum.GstCtx.aGRegs[15],
430	pVCpu->cpum.GstCtx.aGRegs[16], pVCpu->cpum.GstCtx.aGRegs[17], pVCpu->cpum.GstCtx.aGRegs[18], pVCpu->cpum.GstCtx.aGRegs[19],
431	pVCpu->cpum.GstCtx.aGRegs[20], pVCpu->cpum.GstCtx.aGRegs[21], pVCpu->cpum.GstCtx.aGRegs[22], pVCpu->cpum.GstCtx.aGRegs[23],
432	pVCpu->cpum.GstCtx.aGRegs[24], pVCpu->cpum.GstCtx.aGRegs[25], pVCpu->cpum.GstCtx.aGRegs[26], pVCpu->cpum.GstCtx.aGRegs[27],
433	pVCpu->cpum.GstCtx.aGRegs[28], pVCpu->cpum.GstCtx.aGRegs[29], pVCpu->cpum.GstCtx.aGRegs[30],
434	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0],
435	pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.fPState, IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec),
436	szInstr));
437	# else
438	# error "port me"
439	# endif
440
441	/* This stuff sucks atm. as it fills the log with MSRs. */
442	//if (LogIs3Enabled())
443	// DBGFR3InfoEx(pVCpu->pVMR3->pUVM, pVCpu->idCpu, "cpumguest", "verbose", NULL);
444	return;
445	}
446	# endif
447
448	# ifdef VBOX_VMM_TARGET_X86
449	LogFlow(("%s: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x\n",
450	pszFunction, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp,
451	pVCpu->cpum.GstCtx.eflags.u));
452	# define LOGFLOW_REG_STATE_EX(a_pszName, a_szExtraFmt, ...) \
453	LogFlow(("%s: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x" a_szExtraFmt "\n", \
454	(a_pszName), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.rsp, \
455	pVCpu->cpum.GstCtx.eflags.u, __VA_ARGS__))
456
457	# elif defined(VBOX_VMM_TARGET_ARMV8)
458	LogFlow(("%s: pc=%08RX64 lr=%08RX64 sp=%08RX64 psr=%08RX64 EL%u\n",
459	pszFunction, pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.aGRegs[ARMV8_A64_REG_LR],
460	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0], pVCpu->cpum.GstCtx.fPState,
461	IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) ));
462	# define LOGFLOW_REG_STATE_EX(a_pszName, a_szExtraFmt, ...) \
463	LogFlow(("%s: pc=%08RX64 lr=%08RX64 sp=%08RX64 psr=%08RX64 EL%u" a_szExtraFmt "\n", \
464	(a_pszName), pVCpu->cpum.GstCtx.Pc, pVCpu->cpum.GstCtx.aGRegs[ARMV8_A64_REG_LR], \
465	pVCpu->cpum.GstCtx.aSpReg[IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec) > 0], pVCpu->cpum.GstCtx.fPState, \
466	IEM_F_MODE_ARM_GET_EL(pVCpu->iem.s.fExec), __VA_ARGS__))
467	LOGFLOW_REG_STATE_EX(pszFunction, "",1);
468
469	# else
470	# error "port me"
471	# endif
472	RT_NOREF_PV(pVCpu);
473	}
474	#endif /* LOG_ENABLED */
475
476
477	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
478	/**
479	* Deals with VMCPU_FF_VMX_APIC_WRITE, VMCPU_FF_VMX_MTF, VMCPU_FF_VMX_NMI_WINDOW,
480	* VMCPU_FF_VMX_PREEMPT_TIMER and VMCPU_FF_VMX_INT_WINDOW.
481	*
482	* @returns Modified rcStrict.
483	* @param pVCpu The cross context virtual CPU structure of the calling thread.
484	* @param rcStrict The instruction execution status.
485	*/
486	static VBOXSTRICTRC iemHandleNestedInstructionBoundaryFFs(PVMCPUCC pVCpu, VBOXSTRICTRC rcStrict) RT_NOEXCEPT
487	{
488	Assert(CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)));
489	if (!VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF))
490	{
491	/* VMX preemption timer takes priority over NMI-window exits. */
492	if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER))
493	{
494	rcStrict = iemVmxVmexitPreemptTimer(pVCpu);
495	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_PREEMPT_TIMER));
496	}
497	/*
498	* Check remaining intercepts.
499	*
500	* NMI-window and Interrupt-window VM-exits.
501	* Interrupt shadow (block-by-STI and Mov SS) inhibits interrupts and may also block NMIs.
502	* Event injection during VM-entry takes priority over NMI-window and interrupt-window VM-exits.
503	*
504	* See Intel spec. 26.7.6 "NMI-Window Exiting".
505	* See Intel spec. 26.7.5 "Interrupt-Window Exiting and Virtual-Interrupt Delivery".
506	*/
507	else if ( VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW \| VMCPU_FF_VMX_INT_WINDOW)
508	&& !CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx)
509	&& !TRPMHasTrap(pVCpu))
510	{
511	Assert(CPUMIsGuestVmxInterceptEvents(&pVCpu->cpum.GstCtx));
512	if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW)
513	&& CPUMIsGuestVmxVirtNmiBlocking(&pVCpu->cpum.GstCtx))
514	{
515	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_NMI_WINDOW, 0 /* u64ExitQual */);
516	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_NMI_WINDOW));
517	}
518	else if ( VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW)
519	&& CPUMIsGuestVmxVirtIntrEnabled(&pVCpu->cpum.GstCtx))
520	{
521	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_INT_WINDOW, 0 /* u64ExitQual */);
522	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_INT_WINDOW));
523	}
524	}
525	}
526	/* TPR-below threshold/APIC write has the highest priority. */
527	else if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE))
528	{
529	rcStrict = iemVmxApicWriteEmulation(pVCpu);
530	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
531	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE));
532	}
533	/* MTF takes priority over VMX-preemption timer. */
534	else
535	{
536	rcStrict = iemVmxVmexit(pVCpu, VMX_EXIT_MTF, 0 /* u64ExitQual */);
537	Assert(!CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx));
538	Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_VMX_MTF));
539	}
540	return rcStrict;
541	}
542	#endif /* VBOX_WITH_NESTED_HWVIRT_VMX */
543
544
545	/**
546	* The actual code execution bits of IEMExecOne, IEMExecOneWithPrefetchedByPC,
547	* IEMExecOneBypass and friends.
548	*
549	* Similar code is found in IEMExecLots.
550	*
551	* @return Strict VBox status code.
552	* @param pVCpu The cross context virtual CPU structure of the
553	* calling EMT.
554	* @param pszFunction The calling function name.
555	* @tparam a_fExecuteInhibit X86: If set, execute the instruction following
556	* CLI, POP SS and MOV SS,GR.
557	*/
558	template<bool const a_fExecuteInhibit>
559	DECLINLINE(VBOXSTRICTRC) iemExecOneInner(PVMCPUCC pVCpu, const char *pszFunction)
560	{
561	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
562	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
563	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
564	RT_NOREF_PV(pszFunction);
565
566	VBOXSTRICTRC rcStrict;
567	IEM_TRY_SETJMP(pVCpu, rcStrict)
568	{
569	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
570	}
571	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
572	{
573	pVCpu->iem.s.cLongJumps++;
574	}
575	IEM_CATCH_LONGJMP_END(pVCpu);
576	if (rcStrict == VINF_SUCCESS)
577	pVCpu->iem.s.cInstructions++;
578	if (pVCpu->iem.s.cActiveMappings > 0)
579	{
580	Assert(rcStrict != VINF_SUCCESS);
581	iemMemRollback(pVCpu);
582	}
583	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
584	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
585	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
586
587	//#ifdef DEBUG
588	// AssertMsg(IEM_GET_INSTR_LEN(pVCpu) == cbInstr \|\| rcStrict != VINF_SUCCESS, ("%u %u\n", IEM_GET_INSTR_LEN(pVCpu), cbInstr));
589	//#endif
590
591	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
592	/*
593	* Perform any VMX nested-guest instruction boundary actions.
594	*
595	* If any of these causes a VM-exit, we must skip executing the next
596	* instruction (would run into stale page tables). A VM-exit makes sure
597	* there is no interrupt-inhibition, so that should ensure we don't go
598	* to try execute the next instruction. Clearing a_fExecuteInhibit is
599	* problematic because of the setjmp/longjmp clobbering above.
600	*/
601	if ( !VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
602	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)
603	\|\| rcStrict != VINF_SUCCESS)
604	{ /* likely */ }
605	else
606	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
607	#endif
608
609	#ifdef VBOX_VMM_TARGET_X86
610	/* Execute the next instruction as well if a cli, pop ss or
611	mov ss, Gr has just completed successfully. */
612	if RT_CONSTEXPR_IF(a_fExecuteInhibit)
613	{
614	if ( rcStrict == VINF_SUCCESS
615	&& CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx))
616	{
617	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu,
618	pVCpu->iem.s.fExec & (IEM_F_BYPASS_HANDLERS \| IEM_F_X86_DISREGARD_LOCK));
619	if (rcStrict == VINF_SUCCESS)
620	{
621	# ifdef LOG_ENABLED
622	iemLogCurInstr(pVCpu, pszFunction);
623	# endif
624	IEM_TRY_SETJMP_AGAIN(pVCpu, rcStrict)
625	{
626	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
627	}
628	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
629	{
630	pVCpu->iem.s.cLongJumps++;
631	}
632	IEM_CATCH_LONGJMP_END(pVCpu);
633	if (rcStrict == VINF_SUCCESS)
634	{
635	pVCpu->iem.s.cInstructions++;
636	# ifdef VBOX_WITH_NESTED_HWVIRT_VMX
637	if (!VMCPU_FF_IS_ANY_SET(pVCpu, VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
638	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW))
639	{ /* likely */ }
640	else
641	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
642	# endif
643	}
644	if (pVCpu->iem.s.cActiveMappings > 0)
645	{
646	Assert(rcStrict != VINF_SUCCESS);
647	iemMemRollback(pVCpu);
648	}
649	AssertMsg(pVCpu->iem.s.aMemMappings[0].fAccess == IEM_ACCESS_INVALID, ("0: %#x %RGp\n", pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemBbMappings[0].GCPhysFirst));
650	AssertMsg(pVCpu->iem.s.aMemMappings[1].fAccess == IEM_ACCESS_INVALID, ("1: %#x %RGp\n", pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemBbMappings[1].GCPhysFirst));
651	AssertMsg(pVCpu->iem.s.aMemMappings[2].fAccess == IEM_ACCESS_INVALID, ("2: %#x %RGp\n", pVCpu->iem.s.aMemMappings[2].fAccess, pVCpu->iem.s.aMemBbMappings[2].GCPhysFirst));
652	}
653	else if (pVCpu->iem.s.cActiveMappings > 0)
654	iemMemRollback(pVCpu);
655	/** @todo drop this after we bake this change into RIP advancing. */
656	CPUMClearInterruptShadow(&pVCpu->cpum.GstCtx); /* hope this is correct for all exceptional cases... */
657	}
658	}
659	#endif /* VBOX_VMM_TARGET_X86 */
660
661	/*
662	* Return value fiddling, statistics and sanity assertions.
663	*/
664	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
665
666	#ifdef VBOX_STRICT
667	iemInitExecTailStrictTarget(pVCpu);
668	#endif
669	return rcStrict;
670	}
671
672
673	/**
674	* Execute one instruction.
675	*
676	* @return Strict VBox status code.
677	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
678	*/
679	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOne(PVMCPUCC pVCpu)
680	{
681	AssertCompile(sizeof(pVCpu->iem.s) <= sizeof(pVCpu->iem.padding)); /* (tstVMStruct can't do it's job w/o instruction stats) */
682	#ifdef LOG_ENABLED
683	iemLogCurInstr(pVCpu, "IEMExecOne");
684	#endif
685
686	/*
687	* Do the decoding and emulation.
688	*/
689	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
690	if (rcStrict == VINF_SUCCESS)
691	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOne");
692	else if (pVCpu->iem.s.cActiveMappings > 0)
693	iemMemRollback(pVCpu);
694
695	#ifdef LOG_ENABLED
696	if (rcStrict != VINF_SUCCESS)
697	LOGFLOW_REG_STATE_EX("IEMExecOne", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
698	#endif
699	return rcStrict;
700	}
701
702
703	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneWithPrefetchedByPC(PVMCPUCC pVCpu, uint64_t OpcodeBytesPC,
704	const void *pvOpcodeBytes, size_t cbOpcodeBytes)
705	{
706	VBOXSTRICTRC rcStrict;
707	if ( cbOpcodeBytes
708	&& iemRegGetPC(pVCpu) == OpcodeBytesPC)
709	{
710	iemInitDecoder(pVCpu, 0 /fExecOpts/);
711	#ifdef IEM_WITH_CODE_TLB
712	pVCpu->iem.s.uInstrBufPc = OpcodeBytesPC;
713	pVCpu->iem.s.pbInstrBuf = (uint8_t const *)pvOpcodeBytes;
714	pVCpu->iem.s.cbInstrBufTotal = (uint16_t)RT_MIN(X86_PAGE_SIZE, cbOpcodeBytes);
715	# ifdef VBOX_VMM_TARGET_X86
716	pVCpu->iem.s.offCurInstrStart = 0;
717	pVCpu->iem.s.offInstrNextByte = 0;
718	# endif
719	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
720	#else
721	pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
722	memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
723	#endif
724	rcStrict = VINF_SUCCESS;
725	}
726	else
727	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
728	if (rcStrict == VINF_SUCCESS)
729	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOneWithPrefetchedByPC");
730	else if (pVCpu->iem.s.cActiveMappings > 0)
731	iemMemRollback(pVCpu);
732
733	return rcStrict;
734	}
735
736
737	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneBypass(PVMCPUCC pVCpu)
738	{
739	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_BYPASS_HANDLERS);
740	if (rcStrict == VINF_SUCCESS)
741	rcStrict = iemExecOneInner<false>(pVCpu, "IEMExecOneBypass");
742	else if (pVCpu->iem.s.cActiveMappings > 0)
743	iemMemRollback(pVCpu);
744
745	return rcStrict;
746	}
747
748
749	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneBypassWithPrefetchedByPC(PVMCPUCC pVCpu, uint64_t OpcodeBytesPC,
750	const void *pvOpcodeBytes, size_t cbOpcodeBytes)
751	{
752	VBOXSTRICTRC rcStrict;
753	if ( cbOpcodeBytes
754	&& iemRegGetPC(pVCpu) == OpcodeBytesPC)
755	{
756	iemInitDecoder(pVCpu, IEM_F_BYPASS_HANDLERS);
757	#ifdef IEM_WITH_CODE_TLB
758	pVCpu->iem.s.uInstrBufPc = OpcodeBytesPC;
759	pVCpu->iem.s.pbInstrBuf = (uint8_t const *)pvOpcodeBytes;
760	pVCpu->iem.s.cbInstrBufTotal = (uint16_t)RT_MIN(X86_PAGE_SIZE, cbOpcodeBytes);
761	# ifdef VBOX_VMM_TARGET_X86
762	pVCpu->iem.s.offCurInstrStart = 0;
763	pVCpu->iem.s.offInstrNextByte = 0;
764	# endif
765	pVCpu->iem.s.GCPhysInstrBuf = NIL_RTGCPHYS;
766	#else
767	pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
768	memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
769	#endif
770	rcStrict = VINF_SUCCESS;
771	}
772	else
773	rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_BYPASS_HANDLERS);
774	if (rcStrict == VINF_SUCCESS)
775	rcStrict = iemExecOneInner<false>(pVCpu, "IEMExecOneBypassWithPrefetchedByPC");
776	else if (pVCpu->iem.s.cActiveMappings > 0)
777	iemMemRollback(pVCpu);
778
779	return rcStrict;
780	}
781
782
783	/**
784	* For handling split cacheline lock operations when the host has split-lock
785	* detection enabled.
786	*
787	* This will cause the interpreter to disregard the lock prefix and implicit
788	* locking (xchg).
789	*
790	* @returns Strict VBox status code.
791	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
792	*/
793	VMM_INT_DECL(VBOXSTRICTRC) IEMExecOneIgnoreLock(PVMCPUCC pVCpu)
794	{
795	/*
796	* Do the decoding and emulation.
797	*/
798	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, IEM_F_X86_DISREGARD_LOCK);
799	if (rcStrict == VINF_SUCCESS)
800	rcStrict = iemExecOneInner<true>(pVCpu, "IEMExecOneIgnoreLock");
801	else if (pVCpu->iem.s.cActiveMappings > 0)
802	iemMemRollback(pVCpu);
803
804	#ifdef LOG_ENABLED
805	if (rcStrict != VINF_SUCCESS)
806	LOGFLOW_REG_STATE_EX("IEMExecOneIgnoreLock", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
807	#endif
808	return rcStrict;
809	}
810
811
812	/**
813	* Code common to IEMExecLots and IEMExecRecompilerThreaded that attempts to
814	* inject a pending TRPM trap.
815	*/
816	VBOXSTRICTRC iemExecInjectPendingTrap(PVMCPUCC pVCpu)
817	{
818	Assert(TRPMHasTrap(pVCpu));
819	#ifdef VBOX_VMM_TARGET_X86
820
821	if ( !CPUMIsInInterruptShadow(&pVCpu->cpum.GstCtx)
822	&& !CPUMAreInterruptsInhibitedByNmi(&pVCpu->cpum.GstCtx))
823	{
824	/** @todo Can we centralize this under CPUMCanInjectInterrupt()? */
825	# if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
826	bool fIntrEnabled = CPUMGetGuestGif(&pVCpu->cpum.GstCtx);
827	if (fIntrEnabled)
828	{
829	if (!CPUMIsGuestInNestedHwvirtMode(IEM_GET_CTX(pVCpu)))
830	fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
831	else if (CPUMIsGuestInVmxNonRootMode(IEM_GET_CTX(pVCpu)))
832	fIntrEnabled = CPUMIsGuestVmxPhysIntrEnabled(IEM_GET_CTX(pVCpu));
833	else
834	{
835	Assert(CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)));
836	fIntrEnabled = CPUMIsGuestSvmPhysIntrEnabled(pVCpu, IEM_GET_CTX(pVCpu));
837	}
838	}
839	# else
840	bool fIntrEnabled = pVCpu->cpum.GstCtx.eflags.Bits.u1IF;
841	# endif
842	if (fIntrEnabled)
843	{
844	uint8_t u8TrapNo;
845	TRPMEVENT enmType;
846	uint32_t uErrCode;
847	RTGCPTR uCr2;
848	int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /pu8InstLen/, NULL /fIcebp/);
849	AssertRC(rc2);
850	Assert(enmType == TRPM_HARDWARE_INT);
851	VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /cbInstr/);
852
853	TRPMResetTrap(pVCpu);
854
855	# if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
856	/* Injecting an event may cause a VM-exit. */
857	if ( rcStrict != VINF_SUCCESS
858	&& rcStrict != VINF_IEM_RAISED_XCPT)
859	return iemExecStatusCodeFiddling(pVCpu, rcStrict);
860	# else
861	NOREF(rcStrict);
862	# endif
863	}
864	}
865
866	return VINF_SUCCESS;
867
868	#else /* !VBOX_VMM_TARGET_X86 */
869	RT_NOREF(pVCpu);
870	AssertFailedReturn(VERR_NOT_IMPLEMENTED);
871	#endif /* !VBOX_VMM_TARGET_X86 */
872	}
873
874
875	VMM_INT_DECL(VBOXSTRICTRC) IEMExecLots(PVMCPUCC pVCpu, uint32_t cMaxInstructions, uint32_t cPollRate, uint32_t *pcInstructions)
876	{
877	uint32_t const cInstructionsAtStart = pVCpu->iem.s.cInstructions;
878	AssertMsg(RT_IS_POWER_OF_TWO(cPollRate + 1), ("%#x\n", cPollRate));
879	Assert(cMaxInstructions > 0);
880
881	/*
882	* See if there is an interrupt pending in TRPM, inject it if we can.
883	*/
884	/** @todo What if we are injecting an exception and not an interrupt? Is that
885	* possible here? For now we assert it is indeed only an interrupt. */
886	if (!TRPMHasTrap(pVCpu))
887	{ /* likely */ }
888	else
889	{
890	VBOXSTRICTRC rcStrict = iemExecInjectPendingTrap(pVCpu);
891	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
892	{ /likely / }
893	else
894	return rcStrict;
895	}
896
897	/*
898	* Initial decoder init w/ prefetch, then setup setjmp.
899	*/
900	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
901	if (rcStrict == VINF_SUCCESS)
902	{
903	pVCpu->iem.s.cActiveMappings = 0; /** @todo wtf? */
904	IEM_TRY_SETJMP(pVCpu, rcStrict)
905	{
906	/*
907	* The run loop. We limit ourselves to 4096 instructions right now.
908	*/
909	uint32_t cMaxInstructionsGccStupidity = cMaxInstructions;
910	PVMCC pVM = pVCpu->CTX_SUFF(pVM);
911	for (;;)
912	{
913	/*
914	* Log the state.
915	*/
916	#ifdef LOG_ENABLED
917	iemLogCurInstr(pVCpu, "IEMExecLots");
918	#endif
919
920	/*
921	* Do the decoding and emulation.
922	*/
923	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
924	#if defined(VBOX_STRICT) && defined(VBOX_VMM_TARGET_X86)
925	CPUMAssertGuestRFlagsCookie(pVM, pVCpu);
926	#endif
927	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
928	{
929	Assert(pVCpu->iem.s.cActiveMappings == 0);
930	pVCpu->iem.s.cInstructions++;
931
932	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
933	/* Perform any VMX nested-guest instruction boundary actions. */
934	uint64_t fCpu = pVCpu->fLocalForcedActions;
935	if (!(fCpu & ( VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
936	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)))
937	{ /* likely */ }
938	else
939	{
940	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
941	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
942	fCpu = pVCpu->fLocalForcedActions;
943	else
944	{
945	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
946	break;
947	}
948	}
949	#endif
950	if (RT_LIKELY(pVCpu->iem.s.rcPassUp == VINF_SUCCESS))
951	{
952	#ifndef VBOX_WITH_NESTED_HWVIRT_VMX
953	uint64_t fCpu = pVCpu->fLocalForcedActions;
954	#endif
955	fCpu &= VMCPU_FF_ALL_MASK & ~( VMCPU_FF_PGM_SYNC_CR3
956	\| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
957	\| VMCPU_FF_TLB_FLUSH
958	\| VMCPU_FF_UNHALT );
959
960	if (RT_LIKELY( iemExecLoopTargetCheckMaskedCpuFFs(pVCpu, fCpu)
961	&& !VM_FF_IS_ANY_SET(pVM, VM_FF_ALL_MASK) ))
962	{
963	if (--cMaxInstructionsGccStupidity > 0)
964	{
965	/* Poll timers every now an then according to the caller's specs. */
966	if ( (cMaxInstructionsGccStupidity & cPollRate) != 0
967	\|\| !TMTimerPollBool(pVM, pVCpu))
968	{
969	Assert(pVCpu->iem.s.cActiveMappings == 0);
970	iemReInitDecoder(pVCpu);
971	continue;
972	}
973	}
974	}
975	}
976	Assert(pVCpu->iem.s.cActiveMappings == 0);
977	}
978	else if (pVCpu->iem.s.cActiveMappings > 0)
979	iemMemRollback(pVCpu);
980	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
981	break;
982	}
983	}
984	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
985	{
986	if (pVCpu->iem.s.cActiveMappings > 0)
987	iemMemRollback(pVCpu);
988	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
989	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
990	#endif
991	pVCpu->iem.s.cLongJumps++;
992	}
993	IEM_CATCH_LONGJMP_END(pVCpu);
994
995	#ifdef VBOX_STRICT
996	iemInitExecTailStrictTarget(pVCpu);
997	#endif
998	}
999	else
1000	{
1001	if (pVCpu->iem.s.cActiveMappings > 0)
1002	iemMemRollback(pVCpu);
1003
1004	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
1005	/*
1006	* When a nested-guest causes an exception intercept (e.g. #PF) when fetching
1007	* code as part of instruction execution, we need this to fix-up VINF_SVM_VMEXIT.
1008	*/
1009	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1010	#endif
1011	}
1012
1013	/*
1014	* Maybe re-enter raw-mode and log.
1015	*/
1016	#ifdef LOG_ENABLED
1017	if (rcStrict != VINF_SUCCESS)
1018	LOGFLOW_REG_STATE_EX("IEMExecLots", " - rcStrict=%Rrc", VBOXSTRICTRC_VAL(rcStrict));
1019	#endif
1020	if (pcInstructions)
1021	*pcInstructions = pVCpu->iem.s.cInstructions - cInstructionsAtStart;
1022	return rcStrict;
1023	}
1024
1025
1026	/**
1027	* Interface used by EMExecuteExec, does exit statistics and limits.
1028	*
1029	* @returns Strict VBox status code.
1030	* @param pVCpu The cross context virtual CPU structure.
1031	* @param fWillExit To be defined.
1032	* @param cMinInstructions Minimum number of instructions to execute before checking for FFs.
1033	* @param cMaxInstructions Maximum number of instructions to execute.
1034	* @param cMaxInstructionsWithoutExits
1035	* The max number of instructions without exits.
1036	* @param pStats Where to return statistics.
1037	*/
1038	VMM_INT_DECL(VBOXSTRICTRC)
1039	IEMExecForExits(PVMCPUCC pVCpu, uint32_t fWillExit, uint32_t cMinInstructions, uint32_t cMaxInstructions,
1040	uint32_t cMaxInstructionsWithoutExits, PIEMEXECFOREXITSTATS pStats)
1041	{
1042	NOREF(fWillExit); /** @todo define flexible exit crits */
1043
1044	/*
1045	* Initialize return stats.
1046	*/
1047	pStats->cInstructions = 0;
1048	pStats->cExits = 0;
1049	pStats->cMaxExitDistance = 0;
1050	pStats->cReserved = 0;
1051
1052	/*
1053	* Initial decoder init w/ prefetch, then setup setjmp.
1054	*/
1055	VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, 0 /fExecOpts/);
1056	if (rcStrict == VINF_SUCCESS)
1057	{
1058	pVCpu->iem.s.cActiveMappings = 0; /** @todo wtf?!? */
1059	IEM_TRY_SETJMP(pVCpu, rcStrict)
1060	{
1061	#ifdef IN_RING0
1062	bool const fCheckPreemptionPending = !RTThreadPreemptIsPossible() \|\| !RTThreadPreemptIsEnabled(NIL_RTTHREAD);
1063	#endif
1064	uint32_t cInstructionSinceLastExit = 0;
1065
1066	/*
1067	* The run loop. We limit ourselves to 4096 instructions right now.
1068	*/
1069	PVM pVM = pVCpu->CTX_SUFF(pVM);
1070	for (;;)
1071	{
1072	/*
1073	* Log the state.
1074	*/
1075	#ifdef LOG_ENABLED
1076	iemLogCurInstr(pVCpu, "IEMExecForExits");
1077	#endif
1078
1079	/*
1080	* Do the decoding and emulation.
1081	*/
1082	uint32_t const cPotentialExits = pVCpu->iem.s.cPotentialExits;
1083
1084	rcStrict = iemExecDecodeAndInterpretTargetInstruction(pVCpu);
1085
1086	if ( cPotentialExits != pVCpu->iem.s.cPotentialExits
1087	&& cInstructionSinceLastExit > 0 /* don't count the first */ )
1088	{
1089	pStats->cExits += 1;
1090	if (cInstructionSinceLastExit > pStats->cMaxExitDistance)
1091	pStats->cMaxExitDistance = cInstructionSinceLastExit;
1092	cInstructionSinceLastExit = 0;
1093	}
1094
1095	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1096	{
1097	Assert(pVCpu->iem.s.cActiveMappings == 0);
1098	pVCpu->iem.s.cInstructions++;
1099	pStats->cInstructions++;
1100	cInstructionSinceLastExit++;
1101
1102	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1103	/* Perform any VMX nested-guest instruction boundary actions. */
1104	uint64_t fCpu = pVCpu->fLocalForcedActions;
1105	if (!(fCpu & ( VMCPU_FF_VMX_APIC_WRITE \| VMCPU_FF_VMX_MTF \| VMCPU_FF_VMX_PREEMPT_TIMER
1106	\| VMCPU_FF_VMX_INT_WINDOW \| VMCPU_FF_VMX_NMI_WINDOW)))
1107	{ /* likely */ }
1108	else
1109	{
1110	rcStrict = iemHandleNestedInstructionBoundaryFFs(pVCpu, rcStrict);
1111	if (RT_LIKELY(rcStrict == VINF_SUCCESS))
1112	fCpu = pVCpu->fLocalForcedActions;
1113	else
1114	{
1115	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1116	break;
1117	}
1118	}
1119	#endif
1120	if (RT_LIKELY(pVCpu->iem.s.rcPassUp == VINF_SUCCESS))
1121	{
1122	#ifndef VBOX_WITH_NESTED_HWVIRT_VMX
1123	uint64_t fCpu = pVCpu->fLocalForcedActions;
1124	#endif
1125	fCpu &= VMCPU_FF_ALL_MASK & ~( VMCPU_FF_PGM_SYNC_CR3
1126	\| VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL
1127	\| VMCPU_FF_TLB_FLUSH
1128	\| VMCPU_FF_UNHALT );
1129	if (RT_LIKELY( ( iemExecLoopTargetCheckMaskedCpuFFs(pVCpu, fCpu)
1130	&& !VM_FF_IS_ANY_SET(pVM, VM_FF_ALL_MASK) )
1131	\|\| pStats->cInstructions < cMinInstructions))
1132	{
1133	if (pStats->cInstructions < cMaxInstructions)
1134	{
1135	if (cInstructionSinceLastExit <= cMaxInstructionsWithoutExits)
1136	{
1137	#ifdef IN_RING0
1138	if ( !fCheckPreemptionPending
1139	\|\| !RTThreadPreemptIsPending(NIL_RTTHREAD))
1140	#endif
1141	{
1142	Assert(pVCpu->iem.s.cActiveMappings == 0);
1143	iemReInitDecoder(pVCpu);
1144	continue;
1145	}
1146	#ifdef IN_RING0
1147	rcStrict = VINF_EM_RAW_INTERRUPT;
1148	break;
1149	#endif
1150	}
1151	}
1152	}
1153	Assert(!(fCpu & VMCPU_FF_IEM));
1154	}
1155	Assert(pVCpu->iem.s.cActiveMappings == 0);
1156	}
1157	else if (pVCpu->iem.s.cActiveMappings > 0)
1158	iemMemRollback(pVCpu);
1159	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1160	break;
1161	}
1162	}
1163	IEM_CATCH_LONGJMP_BEGIN(pVCpu, rcStrict);
1164	{
1165	if (pVCpu->iem.s.cActiveMappings > 0)
1166	iemMemRollback(pVCpu);
1167	pVCpu->iem.s.cLongJumps++;
1168	}
1169	IEM_CATCH_LONGJMP_END(pVCpu);
1170
1171	#ifdef VBOX_STRICT
1172	iemInitExecTailStrictTarget(pVCpu);
1173	#endif
1174	}
1175	else
1176	{
1177	if (pVCpu->iem.s.cActiveMappings > 0)
1178	iemMemRollback(pVCpu);
1179
1180	#if defined(VBOX_WITH_NESTED_HWVIRT_SVM) \|\| defined(VBOX_WITH_NESTED_HWVIRT_VMX)
1181	/*
1182	* When a nested-guest causes an exception intercept (e.g. #PF) when fetching
1183	* code as part of instruction execution, we need this to fix-up VINF_SVM_VMEXIT.
1184	*/
1185	rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
1186	#endif
1187	}
1188
1189	/*
1190	* Maybe re-enter raw-mode and log.
1191	*/
1192	#ifdef LOG_ENABLED
1193	if (rcStrict != VINF_SUCCESS)
1194	LOGFLOW_REG_STATE_EX("IEMExecLots", " - rcStrict=%Rrc; ins=%u exits=%u maxdist=%u",
1195	VBOXSTRICTRC_VAL(rcStrict), pStats->cInstructions, pStats->cExits, pStats->cMaxExitDistance);
1196	#endif
1197	return rcStrict;
1198	}
1199
1200
1201	/**
1202	* Injects a trap, fault, abort, software interrupt or external interrupt.
1203	*
1204	* The parameter list matches TRPMQueryTrapAll pretty closely.
1205	*
1206	* @returns Strict VBox status code.
1207	* @param pVCpu The cross context virtual CPU structure of the calling EMT.
1208	* @param u8TrapNo The trap number.
1209	* @param enmType What type is it (trap/fault/abort), software
1210	* interrupt or hardware interrupt.
1211	* @param uErrCode The error code if applicable.
1212	* @param uCr2 The CR2 value if applicable.
1213	* @param cbInstr The instruction length (only relevant for
1214	* software interrupts).
1215	* @note x86 specific, but difficult to move due to iemInitDecoder dep.
1216	*/
1217	VMM_INT_DECL(VBOXSTRICTRC)
1218	IEMInjectTrap(PVMCPUCC pVCpu, uint8_t u8TrapNo, TRPMEVENT enmType, uint16_t uErrCode, RTGCPTR uCr2, uint8_t cbInstr)
1219	{
1220	#ifdef VBOX_VMM_TARGET_X86
1221	iemInitDecoder(pVCpu, 0 /fExecOpts/); /** @todo wrong init function! */
1222	# ifdef DBGFTRACE_ENABLED
1223	RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "IEMInjectTrap: %x %d %x %llx",
1224	u8TrapNo, enmType, uErrCode, uCr2);
1225	# endif
1226
1227	uint32_t fFlags;
1228	switch (enmType)
1229	{
1230	case TRPM_HARDWARE_INT:
1231	Log(("IEMInjectTrap: %#4x ext\n", u8TrapNo));
1232	fFlags = IEM_XCPT_FLAGS_T_EXT_INT;
1233	uErrCode = uCr2 = 0;
1234	break;
1235
1236	case TRPM_SOFTWARE_INT:
1237	Log(("IEMInjectTrap: %#4x soft\n", u8TrapNo));
1238	fFlags = IEM_XCPT_FLAGS_T_SOFT_INT;
1239	uErrCode = uCr2 = 0;
1240	break;
1241
1242	case TRPM_TRAP:
1243	case TRPM_NMI: /** @todo Distinguish NMI from exception 2. */
1244	Log(("IEMInjectTrap: %#4x trap err=%#x cr2=%#RGv\n", u8TrapNo, uErrCode, uCr2));
1245	fFlags = IEM_XCPT_FLAGS_T_CPU_XCPT;
1246	if (u8TrapNo == X86_XCPT_PF)
1247	fFlags \|= IEM_XCPT_FLAGS_CR2;
1248	switch (u8TrapNo)
1249	{
1250	case X86_XCPT_DF:
1251	case X86_XCPT_TS:
1252	case X86_XCPT_NP:
1253	case X86_XCPT_SS:
1254	case X86_XCPT_PF:
1255	case X86_XCPT_AC:
1256	case X86_XCPT_GP:
1257	fFlags \|= IEM_XCPT_FLAGS_ERR;
1258	break;
1259	}
1260	break;
1261
1262	IEM_NOT_REACHED_DEFAULT_CASE_RET();
1263	}
1264
1265	VBOXSTRICTRC rcStrict = iemRaiseXcptOrInt(pVCpu, cbInstr, u8TrapNo, fFlags, uErrCode, uCr2);
1266
1267	if (pVCpu->iem.s.cActiveMappings > 0)
1268	iemMemRollback(pVCpu);
1269
1270	return rcStrict;
1271
1272	#else /* !VBOX_VMM_TARGET_X86 */
1273	RT_NOREF(pVCpu, u8TrapNo, enmType, uErrCode, uCr2, cbInstr);
1274	AssertFailedReturn(VERR_NOT_IMPLEMENTED);
1275	#endif /* !VBOX_VMM_TARGET_X86 */
1276	}
1277
1278
1279	/**
1280	* Injects the active TRPM event.
1281	*
1282	* @returns Strict VBox status code.
1283	* @param pVCpu The cross context virtual CPU structure.
1284	*/
1285	VMM_INT_DECL(VBOXSTRICTRC) IEMInjectTrpmEvent(PVMCPUCC pVCpu)
1286	{
1287	#ifndef IEM_IMPLEMENTS_TASKSWITCH
1288	IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Event injection\n"));
1289	#else
1290	uint8_t u8TrapNo;
1291	TRPMEVENT enmType;
1292	uint32_t uErrCode;
1293	RTGCUINTPTR uCr2;
1294	uint8_t cbInstr;
1295	int rc = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, &cbInstr, NULL /* fIcebp */);
1296	if (RT_FAILURE(rc))
1297	return rc;
1298
1299	/** @todo r=ramshankar: Pass ICEBP info. to IEMInjectTrap() below and handle
1300	* ICEBP \#DB injection as a special case. */
1301	VBOXSTRICTRC rcStrict = IEMInjectTrap(pVCpu, u8TrapNo, enmType, uErrCode, uCr2, cbInstr);
1302	#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
1303	if (rcStrict == VINF_SVM_VMEXIT)
1304	rcStrict = VINF_SUCCESS;
1305	#endif
1306	#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
1307	if (rcStrict == VINF_VMX_VMEXIT)
1308	rcStrict = VINF_SUCCESS;
1309	#endif
1310	/** @todo Are there any other codes that imply the event was successfully
1311	* delivered to the guest? See @bugref{6607}. */
1312	if ( rcStrict == VINF_SUCCESS
1313	\|\| rcStrict == VINF_IEM_RAISED_XCPT)
1314	TRPMResetTrap(pVCpu);
1315
1316	return rcStrict;
1317	#endif
1318	}
1319
1320
1321	VMM_INT_DECL(int) IEMBreakpointSet(PVM pVM, RTGCPTR GCPtrBp)
1322	{
1323	RT_NOREF_PV(pVM); RT_NOREF_PV(GCPtrBp);
1324	return VERR_NOT_IMPLEMENTED;
1325	}
1326
1327
1328	VMM_INT_DECL(int) IEMBreakpointClear(PVM pVM, RTGCPTR GCPtrBp)
1329	{
1330	RT_NOREF_PV(pVM); RT_NOREF_PV(GCPtrBp);
1331	return VERR_NOT_IMPLEMENTED;
1332	}
1333

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAll.cpp@ 108702

Download in other formats: