VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 47996

Last change on this file since 47996 was 47988, checked in by vboxsync, 11 years ago

Solaris reads MSR_RAPL_POWER_UNIT, give it some fake values.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 197.3 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 47988 2013-08-22 13:01:54Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2013 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/** @name Misc Helpers
20 * @{
21 */
22
23
24/**
25 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
26 *
27 * @returns Strict VBox status code.
28 *
29 * @param pIemCpu The IEM per CPU data.
30 * @param pCtx The register context.
31 * @param u16Port The port number.
32 * @param cbOperand The operand size.
33 */
34static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
35{
36 /* The TSS bits we're interested in are the same on 386 and AMD64. */
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
38 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
39 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
40 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
41
42 /*
43 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
44 */
45 Assert(!pCtx->tr.Attr.n.u1DescType);
46 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
47 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
48 {
49 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
50 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
51 return iemRaiseGeneralProtectionFault0(pIemCpu);
52 }
53
54 /*
55 * Read the bitmap offset (may #PF).
56 */
57 uint16_t offBitmap;
58 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
59 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
60 if (rcStrict != VINF_SUCCESS)
61 {
62 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
63 return rcStrict;
64 }
65
66 /*
67 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
68 * describes the CPU actually reading two bytes regardless of whether the
69 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
70 */
71 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
72 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
73 * for instance sizeof(X86TSS32). */
74 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
75 {
76 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
77 offFirstBit, pCtx->tr.u32Limit));
78 return iemRaiseGeneralProtectionFault0(pIemCpu);
79 }
80
81 /*
82 * Read the necessary bits.
83 */
84 /** @todo Test the assertion in the intel manual that the CPU reads two
85 * bytes. The question is how this works wrt to #PF and #GP on the
86 * 2nd byte when it's not required. */
87 uint16_t bmBytes = UINT16_MAX;
88 rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
89 if (rcStrict != VINF_SUCCESS)
90 {
91 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
92 return rcStrict;
93 }
94
95 /*
96 * Perform the check.
97 */
98 uint16_t fPortMask = (1 << cbOperand) - 1;
99 bmBytes >>= (u16Port & 7);
100 if (bmBytes & fPortMask)
101 {
102 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
103 u16Port, cbOperand, bmBytes, fPortMask));
104 return iemRaiseGeneralProtectionFault0(pIemCpu);
105 }
106
107 return VINF_SUCCESS;
108}
109
110
111/**
112 * Checks if we are allowed to access the given I/O port, raising the
113 * appropriate exceptions if we aren't (or if the I/O bitmap is not
114 * accessible).
115 *
116 * @returns Strict VBox status code.
117 *
118 * @param pIemCpu The IEM per CPU data.
119 * @param pCtx The register context.
120 * @param u16Port The port number.
121 * @param cbOperand The operand size.
122 */
123DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
124{
125 X86EFLAGS Efl;
126 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
127 if ( (pCtx->cr0 & X86_CR0_PE)
128 && ( pIemCpu->uCpl > Efl.Bits.u2IOPL
129 || Efl.Bits.u1VM) )
130 return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
131 return VINF_SUCCESS;
132}
133
134
135#if 0
136/**
137 * Calculates the parity bit.
138 *
139 * @returns true if the bit is set, false if not.
140 * @param u8Result The least significant byte of the result.
141 */
142static bool iemHlpCalcParityFlag(uint8_t u8Result)
143{
144 /*
145 * Parity is set if the number of bits in the least significant byte of
146 * the result is even.
147 */
148 uint8_t cBits;
149 cBits = u8Result & 1; /* 0 */
150 u8Result >>= 1;
151 cBits += u8Result & 1;
152 u8Result >>= 1;
153 cBits += u8Result & 1;
154 u8Result >>= 1;
155 cBits += u8Result & 1;
156 u8Result >>= 1;
157 cBits += u8Result & 1; /* 4 */
158 u8Result >>= 1;
159 cBits += u8Result & 1;
160 u8Result >>= 1;
161 cBits += u8Result & 1;
162 u8Result >>= 1;
163 cBits += u8Result & 1;
164 return !(cBits & 1);
165}
166#endif /* not used */
167
168
169/**
170 * Updates the specified flags according to a 8-bit result.
171 *
172 * @param pIemCpu The IEM state of the calling EMT.
173 * @param u8Result The result to set the flags according to.
174 * @param fToUpdate The flags to update.
175 * @param fUndefined The flags that are specified as undefined.
176 */
177static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
178{
179 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
180
181 uint32_t fEFlags = pCtx->eflags.u;
182 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
183 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
184 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
185#ifdef IEM_VERIFICATION_MODE_FULL
186 pIemCpu->fUndefinedEFlags |= fUndefined;
187#endif
188}
189
190
191/**
192 * Loads a NULL data selector into a selector register, both the hidden and
193 * visible parts, in protected mode.
194 *
195 * @param pIemCpu The IEM state of the calling EMT.
196 * @param pSReg Pointer to the segment register.
197 * @param uRpl The RPL.
198 */
199static void iemHlpLoadNullDataSelectorProt(PIEMCPU pIemCpu, PCPUMSELREG pSReg, RTSEL uRpl)
200{
201 /** @todo Testcase: write a testcase checking what happends when loading a NULL
202 * data selector in protected mode. */
203 pSReg->Sel = uRpl;
204 pSReg->ValidSel = uRpl;
205 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
206 if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
207 {
208 /* VT-x (Intel 3960x) observed doing something like this. */
209 pSReg->Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D | (pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT);
210 pSReg->u32Limit = UINT32_MAX;
211 pSReg->u64Base = 0;
212 }
213 else
214 {
215 pSReg->Attr.u = X86DESCATTR_UNUSABLE;
216 pSReg->u32Limit = 0;
217 pSReg->u64Base = 0;
218 }
219}
220
221
222/**
223 * Helper used by iret.
224 *
225 * @param uCpl The new CPL.
226 * @param pSReg Pointer to the segment register.
227 */
228static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
229{
230#ifdef VBOX_WITH_RAW_MODE_NOT_R0
231 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
232 CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
233#else
234 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
235#endif
236
237 if ( uCpl > pSReg->Attr.n.u2Dpl
238 && pSReg->Attr.n.u1DescType /* code or data, not system */
239 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
240 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
241 iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, 0);
242}
243
244
245/**
246 * Indicates that we have modified the FPU state.
247 *
248 * @param pIemCpu The IEM state of the calling EMT.
249 */
250DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
251{
252 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
253}
254
255/** @} */
256
257/** @name C Implementations
258 * @{
259 */
260
261/**
262 * Implements a 16-bit popa.
263 */
264IEM_CIMPL_DEF_0(iemCImpl_popa_16)
265{
266 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
267 RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
268 RTGCPTR GCPtrLast = GCPtrStart + 15;
269 VBOXSTRICTRC rcStrict;
270
271 /*
272 * The docs are a bit hard to comprehend here, but it looks like we wrap
273 * around in real mode as long as none of the individual "popa" crosses the
274 * end of the stack segment. In protected mode we check the whole access
275 * in one go. For efficiency, only do the word-by-word thing if we're in
276 * danger of wrapping around.
277 */
278 /** @todo do popa boundary / wrap-around checks. */
279 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
280 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
281 {
282 /* word-by-word */
283 RTUINT64U TmpRsp;
284 TmpRsp.u = pCtx->rsp;
285 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
286 if (rcStrict == VINF_SUCCESS)
287 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
288 if (rcStrict == VINF_SUCCESS)
289 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
290 if (rcStrict == VINF_SUCCESS)
291 {
292 iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
293 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
294 }
295 if (rcStrict == VINF_SUCCESS)
296 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
297 if (rcStrict == VINF_SUCCESS)
298 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
299 if (rcStrict == VINF_SUCCESS)
300 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
301 if (rcStrict == VINF_SUCCESS)
302 {
303 pCtx->rsp = TmpRsp.u;
304 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
305 }
306 }
307 else
308 {
309 uint16_t const *pa16Mem = NULL;
310 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
311 if (rcStrict == VINF_SUCCESS)
312 {
313 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
314 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
315 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
316 /* skip sp */
317 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
318 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
319 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
320 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
321 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
322 if (rcStrict == VINF_SUCCESS)
323 {
324 iemRegAddToRsp(pIemCpu, pCtx, 16);
325 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
326 }
327 }
328 }
329 return rcStrict;
330}
331
332
333/**
334 * Implements a 32-bit popa.
335 */
336IEM_CIMPL_DEF_0(iemCImpl_popa_32)
337{
338 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
339 RTGCPTR GCPtrStart = iemRegGetEffRsp(pIemCpu, pCtx);
340 RTGCPTR GCPtrLast = GCPtrStart + 31;
341 VBOXSTRICTRC rcStrict;
342
343 /*
344 * The docs are a bit hard to comprehend here, but it looks like we wrap
345 * around in real mode as long as none of the individual "popa" crosses the
346 * end of the stack segment. In protected mode we check the whole access
347 * in one go. For efficiency, only do the word-by-word thing if we're in
348 * danger of wrapping around.
349 */
350 /** @todo do popa boundary / wrap-around checks. */
351 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
352 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
353 {
354 /* word-by-word */
355 RTUINT64U TmpRsp;
356 TmpRsp.u = pCtx->rsp;
357 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
358 if (rcStrict == VINF_SUCCESS)
359 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
360 if (rcStrict == VINF_SUCCESS)
361 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
362 if (rcStrict == VINF_SUCCESS)
363 {
364 iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
365 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
366 }
367 if (rcStrict == VINF_SUCCESS)
368 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
369 if (rcStrict == VINF_SUCCESS)
370 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
371 if (rcStrict == VINF_SUCCESS)
372 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
373 if (rcStrict == VINF_SUCCESS)
374 {
375#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
376 pCtx->rdi &= UINT32_MAX;
377 pCtx->rsi &= UINT32_MAX;
378 pCtx->rbp &= UINT32_MAX;
379 pCtx->rbx &= UINT32_MAX;
380 pCtx->rdx &= UINT32_MAX;
381 pCtx->rcx &= UINT32_MAX;
382 pCtx->rax &= UINT32_MAX;
383#endif
384 pCtx->rsp = TmpRsp.u;
385 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
386 }
387 }
388 else
389 {
390 uint32_t const *pa32Mem;
391 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
392 if (rcStrict == VINF_SUCCESS)
393 {
394 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
395 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
396 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
397 /* skip esp */
398 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
399 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
400 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
401 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
402 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
403 if (rcStrict == VINF_SUCCESS)
404 {
405 iemRegAddToRsp(pIemCpu, pCtx, 32);
406 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
407 }
408 }
409 }
410 return rcStrict;
411}
412
413
414/**
415 * Implements a 16-bit pusha.
416 */
417IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
418{
419 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
420 RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
421 RTGCPTR GCPtrBottom = GCPtrTop - 15;
422 VBOXSTRICTRC rcStrict;
423
424 /*
425 * The docs are a bit hard to comprehend here, but it looks like we wrap
426 * around in real mode as long as none of the individual "pushd" crosses the
427 * end of the stack segment. In protected mode we check the whole access
428 * in one go. For efficiency, only do the word-by-word thing if we're in
429 * danger of wrapping around.
430 */
431 /** @todo do pusha boundary / wrap-around checks. */
432 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
433 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
434 {
435 /* word-by-word */
436 RTUINT64U TmpRsp;
437 TmpRsp.u = pCtx->rsp;
438 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
439 if (rcStrict == VINF_SUCCESS)
440 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
441 if (rcStrict == VINF_SUCCESS)
442 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
443 if (rcStrict == VINF_SUCCESS)
444 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
445 if (rcStrict == VINF_SUCCESS)
446 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
447 if (rcStrict == VINF_SUCCESS)
448 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
449 if (rcStrict == VINF_SUCCESS)
450 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
451 if (rcStrict == VINF_SUCCESS)
452 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
453 if (rcStrict == VINF_SUCCESS)
454 {
455 pCtx->rsp = TmpRsp.u;
456 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
457 }
458 }
459 else
460 {
461 GCPtrBottom--;
462 uint16_t *pa16Mem = NULL;
463 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
464 if (rcStrict == VINF_SUCCESS)
465 {
466 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
467 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
468 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
469 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
470 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
471 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
472 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
473 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
474 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
475 if (rcStrict == VINF_SUCCESS)
476 {
477 iemRegSubFromRsp(pIemCpu, pCtx, 16);
478 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
479 }
480 }
481 }
482 return rcStrict;
483}
484
485
486/**
487 * Implements a 32-bit pusha.
488 */
489IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
490{
491 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
492 RTGCPTR GCPtrTop = iemRegGetEffRsp(pIemCpu, pCtx);
493 RTGCPTR GCPtrBottom = GCPtrTop - 31;
494 VBOXSTRICTRC rcStrict;
495
496 /*
497 * The docs are a bit hard to comprehend here, but it looks like we wrap
498 * around in real mode as long as none of the individual "pusha" crosses the
499 * end of the stack segment. In protected mode we check the whole access
500 * in one go. For efficiency, only do the word-by-word thing if we're in
501 * danger of wrapping around.
502 */
503 /** @todo do pusha boundary / wrap-around checks. */
504 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
505 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
506 {
507 /* word-by-word */
508 RTUINT64U TmpRsp;
509 TmpRsp.u = pCtx->rsp;
510 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
511 if (rcStrict == VINF_SUCCESS)
512 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
513 if (rcStrict == VINF_SUCCESS)
514 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
515 if (rcStrict == VINF_SUCCESS)
516 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
517 if (rcStrict == VINF_SUCCESS)
518 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
519 if (rcStrict == VINF_SUCCESS)
520 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
521 if (rcStrict == VINF_SUCCESS)
522 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
523 if (rcStrict == VINF_SUCCESS)
524 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
525 if (rcStrict == VINF_SUCCESS)
526 {
527 pCtx->rsp = TmpRsp.u;
528 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
529 }
530 }
531 else
532 {
533 GCPtrBottom--;
534 uint32_t *pa32Mem;
535 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
536 if (rcStrict == VINF_SUCCESS)
537 {
538 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
539 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
540 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
541 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
542 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
543 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
544 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
545 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
546 rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
547 if (rcStrict == VINF_SUCCESS)
548 {
549 iemRegSubFromRsp(pIemCpu, pCtx, 32);
550 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
551 }
552 }
553 }
554 return rcStrict;
555}
556
557
558/**
559 * Implements pushf.
560 *
561 *
562 * @param enmEffOpSize The effective operand size.
563 */
564IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
565{
566 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
567
568 /*
569 * If we're in V8086 mode some care is required (which is why we're in
570 * doing this in a C implementation).
571 */
572 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
573 if ( (fEfl & X86_EFL_VM)
574 && X86_EFL_GET_IOPL(fEfl) != 3 )
575 {
576 Assert(pCtx->cr0 & X86_CR0_PE);
577 if ( enmEffOpSize != IEMMODE_16BIT
578 || !(pCtx->cr4 & X86_CR4_VME))
579 return iemRaiseGeneralProtectionFault0(pIemCpu);
580 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
581 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
582 return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
583 }
584
585 /*
586 * Ok, clear RF and VM and push the flags.
587 */
588 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
589
590 VBOXSTRICTRC rcStrict;
591 switch (enmEffOpSize)
592 {
593 case IEMMODE_16BIT:
594 rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
595 break;
596 case IEMMODE_32BIT:
597 rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
598 break;
599 case IEMMODE_64BIT:
600 rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
601 break;
602 IEM_NOT_REACHED_DEFAULT_CASE_RET();
603 }
604 if (rcStrict != VINF_SUCCESS)
605 return rcStrict;
606
607 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
608 return VINF_SUCCESS;
609}
610
611
612/**
613 * Implements popf.
614 *
615 * @param enmEffOpSize The effective operand size.
616 */
617IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
618{
619 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
620 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
621 uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
622 VBOXSTRICTRC rcStrict;
623 uint32_t fEflNew;
624
625 /*
626 * V8086 is special as usual.
627 */
628 if (fEflOld & X86_EFL_VM)
629 {
630 /*
631 * Almost anything goes if IOPL is 3.
632 */
633 if (X86_EFL_GET_IOPL(fEflOld) == 3)
634 {
635 switch (enmEffOpSize)
636 {
637 case IEMMODE_16BIT:
638 {
639 uint16_t u16Value;
640 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
641 if (rcStrict != VINF_SUCCESS)
642 return rcStrict;
643 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
644 break;
645 }
646 case IEMMODE_32BIT:
647 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
648 if (rcStrict != VINF_SUCCESS)
649 return rcStrict;
650 break;
651 IEM_NOT_REACHED_DEFAULT_CASE_RET();
652 }
653
654 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
655 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
656 }
657 /*
658 * Interrupt flag virtualization with CR4.VME=1.
659 */
660 else if ( enmEffOpSize == IEMMODE_16BIT
661 && (pCtx->cr4 & X86_CR4_VME) )
662 {
663 uint16_t u16Value;
664 RTUINT64U TmpRsp;
665 TmpRsp.u = pCtx->rsp;
666 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
667 if (rcStrict != VINF_SUCCESS)
668 return rcStrict;
669
670 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
671 * or before? */
672 if ( ( (u16Value & X86_EFL_IF)
673 && (fEflOld & X86_EFL_VIP))
674 || (u16Value & X86_EFL_TF) )
675 return iemRaiseGeneralProtectionFault0(pIemCpu);
676
677 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
678 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
679 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
680 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
681
682 pCtx->rsp = TmpRsp.u;
683 }
684 else
685 return iemRaiseGeneralProtectionFault0(pIemCpu);
686
687 }
688 /*
689 * Not in V8086 mode.
690 */
691 else
692 {
693 /* Pop the flags. */
694 switch (enmEffOpSize)
695 {
696 case IEMMODE_16BIT:
697 {
698 uint16_t u16Value;
699 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
700 if (rcStrict != VINF_SUCCESS)
701 return rcStrict;
702 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
703 break;
704 }
705 case IEMMODE_32BIT:
706 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
707 if (rcStrict != VINF_SUCCESS)
708 return rcStrict;
709 break;
710 case IEMMODE_64BIT:
711 {
712 uint64_t u64Value;
713 rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
714 if (rcStrict != VINF_SUCCESS)
715 return rcStrict;
716 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
717 break;
718 }
719 IEM_NOT_REACHED_DEFAULT_CASE_RET();
720 }
721
722 /* Merge them with the current flags. */
723 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
724 || pIemCpu->uCpl == 0)
725 {
726 fEflNew &= X86_EFL_POPF_BITS;
727 fEflNew |= ~X86_EFL_POPF_BITS & fEflOld;
728 }
729 else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
730 {
731 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
732 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
733 }
734 else
735 {
736 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
737 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
738 }
739 }
740
741 /*
742 * Commit the flags.
743 */
744 Assert(fEflNew & RT_BIT_32(1));
745 IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
746 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
747
748 return VINF_SUCCESS;
749}
750
751
752/**
753 * Implements an indirect call.
754 *
755 * @param uNewPC The new program counter (RIP) value (loaded from the
756 * operand).
757 * @param enmEffOpSize The effective operand size.
758 */
759IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
760{
761 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
762 uint16_t uOldPC = pCtx->ip + cbInstr;
763 if (uNewPC > pCtx->cs.u32Limit)
764 return iemRaiseGeneralProtectionFault0(pIemCpu);
765
766 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
767 if (rcStrict != VINF_SUCCESS)
768 return rcStrict;
769
770 pCtx->rip = uNewPC;
771 pCtx->eflags.Bits.u1RF = 0;
772 return VINF_SUCCESS;
773}
774
775
776/**
777 * Implements a 16-bit relative call.
778 *
779 * @param offDisp The displacment offset.
780 */
781IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
782{
783 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
784 uint16_t uOldPC = pCtx->ip + cbInstr;
785 uint16_t uNewPC = uOldPC + offDisp;
786 if (uNewPC > pCtx->cs.u32Limit)
787 return iemRaiseGeneralProtectionFault0(pIemCpu);
788
789 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
790 if (rcStrict != VINF_SUCCESS)
791 return rcStrict;
792
793 pCtx->rip = uNewPC;
794 pCtx->eflags.Bits.u1RF = 0;
795 return VINF_SUCCESS;
796}
797
798
799/**
800 * Implements a 32-bit indirect call.
801 *
802 * @param uNewPC The new program counter (RIP) value (loaded from the
803 * operand).
804 * @param enmEffOpSize The effective operand size.
805 */
806IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
807{
808 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
809 uint32_t uOldPC = pCtx->eip + cbInstr;
810 if (uNewPC > pCtx->cs.u32Limit)
811 return iemRaiseGeneralProtectionFault0(pIemCpu);
812
813 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
814 if (rcStrict != VINF_SUCCESS)
815 return rcStrict;
816
817#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
818 /*
819 * CASM hook for recording interesting indirect calls.
820 */
821 if ( !pCtx->eflags.Bits.u1IF
822 && (pCtx->cr0 & X86_CR0_PG)
823 && !CSAMIsEnabled(IEMCPU_TO_VM(pIemCpu))
824 && pIemCpu->uCpl == 0)
825 {
826 EMSTATE enmState = EMGetState(IEMCPU_TO_VMCPU(pIemCpu));
827 if ( enmState == EMSTATE_IEM_THEN_REM
828 || enmState == EMSTATE_IEM
829 || enmState == EMSTATE_REM)
830 CSAMR3RecordCallAddress(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
831 }
832#endif
833
834 pCtx->rip = uNewPC;
835 pCtx->eflags.Bits.u1RF = 0;
836 return VINF_SUCCESS;
837}
838
839
840/**
841 * Implements a 32-bit relative call.
842 *
843 * @param offDisp The displacment offset.
844 */
845IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
846{
847 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
848 uint32_t uOldPC = pCtx->eip + cbInstr;
849 uint32_t uNewPC = uOldPC + offDisp;
850 if (uNewPC > pCtx->cs.u32Limit)
851 return iemRaiseGeneralProtectionFault0(pIemCpu);
852
853 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
854 if (rcStrict != VINF_SUCCESS)
855 return rcStrict;
856
857 pCtx->rip = uNewPC;
858 pCtx->eflags.Bits.u1RF = 0;
859 return VINF_SUCCESS;
860}
861
862
863/**
864 * Implements a 64-bit indirect call.
865 *
866 * @param uNewPC The new program counter (RIP) value (loaded from the
867 * operand).
868 * @param enmEffOpSize The effective operand size.
869 */
870IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
871{
872 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
873 uint64_t uOldPC = pCtx->rip + cbInstr;
874 if (!IEM_IS_CANONICAL(uNewPC))
875 return iemRaiseGeneralProtectionFault0(pIemCpu);
876
877 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
878 if (rcStrict != VINF_SUCCESS)
879 return rcStrict;
880
881 pCtx->rip = uNewPC;
882 pCtx->eflags.Bits.u1RF = 0;
883 return VINF_SUCCESS;
884}
885
886
887/**
888 * Implements a 64-bit relative call.
889 *
890 * @param offDisp The displacment offset.
891 */
892IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
893{
894 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
895 uint64_t uOldPC = pCtx->rip + cbInstr;
896 uint64_t uNewPC = uOldPC + offDisp;
897 if (!IEM_IS_CANONICAL(uNewPC))
898 return iemRaiseNotCanonical(pIemCpu);
899
900 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
901 if (rcStrict != VINF_SUCCESS)
902 return rcStrict;
903
904 pCtx->rip = uNewPC;
905 pCtx->eflags.Bits.u1RF = 0;
906 return VINF_SUCCESS;
907}
908
909
910/**
911 * Implements far jumps and calls thru task segments (TSS).
912 *
913 * @param uSel The selector.
914 * @param enmBranch The kind of branching we're performing.
915 * @param enmEffOpSize The effective operand size.
916 * @param pDesc The descriptor corrsponding to @a uSel. The type is
917 * call gate.
918 */
919IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
920{
921 /* Call various functions to do the work. Clear RF? */
922 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
923}
924
925
926/**
927 * Implements far jumps and calls thru task gates.
928 *
929 * @param uSel The selector.
930 * @param enmBranch The kind of branching we're performing.
931 * @param enmEffOpSize The effective operand size.
932 * @param pDesc The descriptor corrsponding to @a uSel. The type is
933 * call gate.
934 */
935IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
936{
937 /* Call various functions to do the work. Don't clear RF */
938 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
939}
940
941
942/**
943 * Implements far jumps and calls thru call gates.
944 *
945 * @param uSel The selector.
946 * @param enmBranch The kind of branching we're performing.
947 * @param enmEffOpSize The effective operand size.
948 * @param pDesc The descriptor corrsponding to @a uSel. The type is
949 * call gate.
950 */
951IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
952{
953 /* Call various functions to do the work. Clear RF. */
954 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
955}
956
957
958/**
959 * Implements far jumps and calls thru system selectors.
960 *
961 * @param uSel The selector.
962 * @param enmBranch The kind of branching we're performing.
963 * @param enmEffOpSize The effective operand size.
964 * @param pDesc The descriptor corrsponding to @a uSel.
965 */
966IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
967{
968 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
969 Assert((uSel & X86_SEL_MASK_OFF_RPL));
970
971 if (IEM_IS_LONG_MODE(pIemCpu))
972 switch (pDesc->Legacy.Gen.u4Type)
973 {
974 case AMD64_SEL_TYPE_SYS_CALL_GATE:
975 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
976
977 default:
978 case AMD64_SEL_TYPE_SYS_LDT:
979 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
980 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
981 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
982 case AMD64_SEL_TYPE_SYS_INT_GATE:
983 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
984 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
985
986 }
987
988 switch (pDesc->Legacy.Gen.u4Type)
989 {
990 case X86_SEL_TYPE_SYS_286_CALL_GATE:
991 case X86_SEL_TYPE_SYS_386_CALL_GATE:
992 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
993
994 case X86_SEL_TYPE_SYS_TASK_GATE:
995 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
996
997 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
998 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
999 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1000
1001 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1002 Log(("branch %04x -> busy 286 TSS\n", uSel));
1003 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1004
1005 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1006 Log(("branch %04x -> busy 386 TSS\n", uSel));
1007 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1008
1009 default:
1010 case X86_SEL_TYPE_SYS_LDT:
1011 case X86_SEL_TYPE_SYS_286_INT_GATE:
1012 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1013 case X86_SEL_TYPE_SYS_386_INT_GATE:
1014 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1015 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1016 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1017 }
1018}
1019
1020
1021/**
1022 * Implements far jumps.
1023 *
1024 * @param uSel The selector.
1025 * @param offSeg The segment offset.
1026 * @param enmEffOpSize The effective operand size.
1027 */
1028IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1029{
1030 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1031 NOREF(cbInstr);
1032 Assert(offSeg <= UINT32_MAX);
1033
1034 /*
1035 * Real mode and V8086 mode are easy. The only snag seems to be that
1036 * CS.limit doesn't change and the limit check is done against the current
1037 * limit.
1038 */
1039 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1040 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1041 {
1042 if (offSeg > pCtx->cs.u32Limit)
1043 return iemRaiseGeneralProtectionFault0(pIemCpu);
1044
1045 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1046 pCtx->rip = offSeg;
1047 else
1048 pCtx->rip = offSeg & UINT16_MAX;
1049 pCtx->cs.Sel = uSel;
1050 pCtx->cs.ValidSel = uSel;
1051 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1052 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1053 pCtx->eflags.Bits.u1RF = 0;
1054 return VINF_SUCCESS;
1055 }
1056
1057 /*
1058 * Protected mode. Need to parse the specified descriptor...
1059 */
1060 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1061 {
1062 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1063 return iemRaiseGeneralProtectionFault0(pIemCpu);
1064 }
1065
1066 /* Fetch the descriptor. */
1067 IEMSELDESC Desc;
1068 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1069 if (rcStrict != VINF_SUCCESS)
1070 return rcStrict;
1071
1072 /* Is it there? */
1073 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1074 {
1075 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1076 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1077 }
1078
1079 /*
1080 * Deal with it according to its type. We do the standard code selectors
1081 * here and dispatch the system selectors to worker functions.
1082 */
1083 if (!Desc.Legacy.Gen.u1DescType)
1084 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1085
1086 /* Only code segments. */
1087 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1088 {
1089 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1090 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1091 }
1092
1093 /* L vs D. */
1094 if ( Desc.Legacy.Gen.u1Long
1095 && Desc.Legacy.Gen.u1DefBig
1096 && IEM_IS_LONG_MODE(pIemCpu))
1097 {
1098 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1099 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1100 }
1101
1102 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1103 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1104 {
1105 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1106 {
1107 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1108 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1109 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1110 }
1111 }
1112 else
1113 {
1114 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1115 {
1116 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1117 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1118 }
1119 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1120 {
1121 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1122 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1123 }
1124 }
1125
1126 /* Chop the high bits if 16-bit (Intel says so). */
1127 if (enmEffOpSize == IEMMODE_16BIT)
1128 offSeg &= UINT16_MAX;
1129
1130 /* Limit check. (Should alternatively check for non-canonical addresses
1131 here, but that is ruled out by offSeg being 32-bit, right?) */
1132 uint64_t u64Base;
1133 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1134 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1135 u64Base = 0;
1136 else
1137 {
1138 if (offSeg > cbLimit)
1139 {
1140 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1141 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1142 }
1143 u64Base = X86DESC_BASE(&Desc.Legacy);
1144 }
1145
1146 /*
1147 * Ok, everything checked out fine. Now set the accessed bit before
1148 * committing the result into CS, CSHID and RIP.
1149 */
1150 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1151 {
1152 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1153 if (rcStrict != VINF_SUCCESS)
1154 return rcStrict;
1155 /** @todo check what VT-x and AMD-V does. */
1156 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1157 }
1158
1159 /* commit */
1160 pCtx->rip = offSeg;
1161 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1162 pCtx->cs.Sel |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1163 pCtx->cs.ValidSel = pCtx->cs.Sel;
1164 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1165 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1166 pCtx->cs.u32Limit = cbLimit;
1167 pCtx->cs.u64Base = u64Base;
1168 pCtx->eflags.Bits.u1RF = 0;
1169 /** @todo check if the hidden bits are loaded correctly for 64-bit
1170 * mode. */
1171 return VINF_SUCCESS;
1172}
1173
1174
1175/**
1176 * Implements far calls.
1177 *
1178 * This very similar to iemCImpl_FarJmp.
1179 *
1180 * @param uSel The selector.
1181 * @param offSeg The segment offset.
1182 * @param enmEffOpSize The operand size (in case we need it).
1183 */
1184IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1185{
1186 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1187 VBOXSTRICTRC rcStrict;
1188 uint64_t uNewRsp;
1189 RTPTRUNION uPtrRet;
1190
1191 /*
1192 * Real mode and V8086 mode are easy. The only snag seems to be that
1193 * CS.limit doesn't change and the limit check is done against the current
1194 * limit.
1195 */
1196 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1197 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1198 {
1199 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1200
1201 /* Check stack first - may #SS(0). */
1202 rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1203 &uPtrRet.pv, &uNewRsp);
1204 if (rcStrict != VINF_SUCCESS)
1205 return rcStrict;
1206
1207 /* Check the target address range. */
1208 if (offSeg > UINT32_MAX)
1209 return iemRaiseGeneralProtectionFault0(pIemCpu);
1210
1211 /* Everything is fine, push the return address. */
1212 if (enmEffOpSize == IEMMODE_16BIT)
1213 {
1214 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1215 uPtrRet.pu16[1] = pCtx->cs.Sel;
1216 }
1217 else
1218 {
1219 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1220 uPtrRet.pu16[3] = pCtx->cs.Sel;
1221 }
1222 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1223 if (rcStrict != VINF_SUCCESS)
1224 return rcStrict;
1225
1226 /* Branch. */
1227 pCtx->rip = offSeg;
1228 pCtx->cs.Sel = uSel;
1229 pCtx->cs.ValidSel = uSel;
1230 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1231 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1232 pCtx->eflags.Bits.u1RF = 0;
1233 return VINF_SUCCESS;
1234 }
1235
1236 /*
1237 * Protected mode. Need to parse the specified descriptor...
1238 */
1239 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1240 {
1241 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1242 return iemRaiseGeneralProtectionFault0(pIemCpu);
1243 }
1244
1245 /* Fetch the descriptor. */
1246 IEMSELDESC Desc;
1247 rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
1248 if (rcStrict != VINF_SUCCESS)
1249 return rcStrict;
1250
1251 /*
1252 * Deal with it according to its type. We do the standard code selectors
1253 * here and dispatch the system selectors to worker functions.
1254 */
1255 if (!Desc.Legacy.Gen.u1DescType)
1256 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1257
1258 /* Only code segments. */
1259 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1260 {
1261 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1262 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1263 }
1264
1265 /* L vs D. */
1266 if ( Desc.Legacy.Gen.u1Long
1267 && Desc.Legacy.Gen.u1DefBig
1268 && IEM_IS_LONG_MODE(pIemCpu))
1269 {
1270 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1271 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1272 }
1273
1274 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1275 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1276 {
1277 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1278 {
1279 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1280 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1281 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1282 }
1283 }
1284 else
1285 {
1286 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1287 {
1288 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1289 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1290 }
1291 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1292 {
1293 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1294 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1295 }
1296 }
1297
1298 /* Is it there? */
1299 if (!Desc.Legacy.Gen.u1Present)
1300 {
1301 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1302 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1303 }
1304
1305 /* Check stack first - may #SS(0). */
1306 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1307 * 16-bit code cause a two or four byte CS to be pushed? */
1308 rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1309 enmEffOpSize == IEMMODE_64BIT ? 8+8
1310 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1311 &uPtrRet.pv, &uNewRsp);
1312 if (rcStrict != VINF_SUCCESS)
1313 return rcStrict;
1314
1315 /* Chop the high bits if 16-bit (Intel says so). */
1316 if (enmEffOpSize == IEMMODE_16BIT)
1317 offSeg &= UINT16_MAX;
1318
1319 /* Limit / canonical check. */
1320 uint64_t u64Base;
1321 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1322 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1323 {
1324 if (!IEM_IS_CANONICAL(offSeg))
1325 {
1326 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1327 return iemRaiseNotCanonical(pIemCpu);
1328 }
1329 u64Base = 0;
1330 }
1331 else
1332 {
1333 if (offSeg > cbLimit)
1334 {
1335 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1336 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1337 }
1338 u64Base = X86DESC_BASE(&Desc.Legacy);
1339 }
1340
1341 /*
1342 * Now set the accessed bit before
1343 * writing the return address to the stack and committing the result into
1344 * CS, CSHID and RIP.
1345 */
1346 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1347 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1348 {
1349 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1350 if (rcStrict != VINF_SUCCESS)
1351 return rcStrict;
1352 /** @todo check what VT-x and AMD-V does. */
1353 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1354 }
1355
1356 /* stack */
1357 if (enmEffOpSize == IEMMODE_16BIT)
1358 {
1359 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1360 uPtrRet.pu16[1] = pCtx->cs.Sel;
1361 }
1362 else if (enmEffOpSize == IEMMODE_32BIT)
1363 {
1364 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1365 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1366 }
1367 else
1368 {
1369 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1370 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1371 }
1372 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1373 if (rcStrict != VINF_SUCCESS)
1374 return rcStrict;
1375
1376 /* commit */
1377 pCtx->rip = offSeg;
1378 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1379 pCtx->cs.Sel |= pIemCpu->uCpl;
1380 pCtx->cs.ValidSel = pCtx->cs.Sel;
1381 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1382 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1383 pCtx->cs.u32Limit = cbLimit;
1384 pCtx->cs.u64Base = u64Base;
1385 pCtx->eflags.Bits.u1RF = 0;
1386 /** @todo check if the hidden bits are loaded correctly for 64-bit
1387 * mode. */
1388 return VINF_SUCCESS;
1389}
1390
1391
1392/**
1393 * Implements retf.
1394 *
1395 * @param enmEffOpSize The effective operand size.
1396 * @param cbPop The amount of arguments to pop from the stack
1397 * (bytes).
1398 */
1399IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1400{
1401 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1402 VBOXSTRICTRC rcStrict;
1403 RTCPTRUNION uPtrFrame;
1404 uint64_t uNewRsp;
1405 uint64_t uNewRip;
1406 uint16_t uNewCs;
1407 NOREF(cbInstr);
1408
1409 /*
1410 * Read the stack values first.
1411 */
1412 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1413 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1414 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1415 if (rcStrict != VINF_SUCCESS)
1416 return rcStrict;
1417 if (enmEffOpSize == IEMMODE_16BIT)
1418 {
1419 uNewRip = uPtrFrame.pu16[0];
1420 uNewCs = uPtrFrame.pu16[1];
1421 }
1422 else if (enmEffOpSize == IEMMODE_32BIT)
1423 {
1424 uNewRip = uPtrFrame.pu32[0];
1425 uNewCs = uPtrFrame.pu16[2];
1426 }
1427 else
1428 {
1429 uNewRip = uPtrFrame.pu64[0];
1430 uNewCs = uPtrFrame.pu16[4];
1431 }
1432
1433 /*
1434 * Real mode and V8086 mode are easy.
1435 */
1436 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1437 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1438 {
1439 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1440 /** @todo check how this is supposed to work if sp=0xfffe. */
1441
1442 /* Check the limit of the new EIP. */
1443 /** @todo Intel pseudo code only does the limit check for 16-bit
1444 * operands, AMD does not make any distinction. What is right? */
1445 if (uNewRip > pCtx->cs.u32Limit)
1446 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1447
1448 /* commit the operation. */
1449 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1450 if (rcStrict != VINF_SUCCESS)
1451 return rcStrict;
1452 pCtx->rip = uNewRip;
1453 pCtx->cs.Sel = uNewCs;
1454 pCtx->cs.ValidSel = uNewCs;
1455 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1456 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1457 pCtx->eflags.Bits.u1RF = 0;
1458 /** @todo do we load attribs and limit as well? */
1459 if (cbPop)
1460 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1461 return VINF_SUCCESS;
1462 }
1463
1464 /*
1465 * Protected mode is complicated, of course.
1466 */
1467 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1468 {
1469 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1470 return iemRaiseGeneralProtectionFault0(pIemCpu);
1471 }
1472
1473 /* Fetch the descriptor. */
1474 IEMSELDESC DescCs;
1475 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
1476 if (rcStrict != VINF_SUCCESS)
1477 return rcStrict;
1478
1479 /* Can only return to a code selector. */
1480 if ( !DescCs.Legacy.Gen.u1DescType
1481 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1482 {
1483 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1484 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1485 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1486 }
1487
1488 /* L vs D. */
1489 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1490 && DescCs.Legacy.Gen.u1DefBig
1491 && IEM_IS_LONG_MODE(pIemCpu))
1492 {
1493 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1494 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1495 }
1496
1497 /* DPL/RPL/CPL checks. */
1498 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1499 {
1500 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1501 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1502 }
1503
1504 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1505 {
1506 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1507 {
1508 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1509 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1510 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1511 }
1512 }
1513 else
1514 {
1515 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1516 {
1517 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1518 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1519 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1520 }
1521 }
1522
1523 /* Is it there? */
1524 if (!DescCs.Legacy.Gen.u1Present)
1525 {
1526 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1527 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1528 }
1529
1530 /*
1531 * Return to outer privilege? (We'll typically have entered via a call gate.)
1532 */
1533 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1534 {
1535 /* Read the return pointer, it comes before the parameters. */
1536 RTCPTRUNION uPtrStack;
1537 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1538 if (rcStrict != VINF_SUCCESS)
1539 return rcStrict;
1540 uint16_t uNewOuterSs;
1541 uint64_t uNewOuterRsp;
1542 if (enmEffOpSize == IEMMODE_16BIT)
1543 {
1544 uNewOuterRsp = uPtrFrame.pu16[0];
1545 uNewOuterSs = uPtrFrame.pu16[1];
1546 }
1547 else if (enmEffOpSize == IEMMODE_32BIT)
1548 {
1549 uNewOuterRsp = uPtrFrame.pu32[0];
1550 uNewOuterSs = uPtrFrame.pu16[2];
1551 }
1552 else
1553 {
1554 uNewOuterRsp = uPtrFrame.pu64[0];
1555 uNewOuterSs = uPtrFrame.pu16[4];
1556 }
1557
1558 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1559 and read the selector. */
1560 IEMSELDESC DescSs;
1561 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1562 {
1563 if ( !DescCs.Legacy.Gen.u1Long
1564 || (uNewOuterSs & X86_SEL_RPL) == 3)
1565 {
1566 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1567 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1568 return iemRaiseGeneralProtectionFault0(pIemCpu);
1569 }
1570 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1571 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1572 }
1573 else
1574 {
1575 /* Fetch the descriptor for the new stack segment. */
1576 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
1577 if (rcStrict != VINF_SUCCESS)
1578 return rcStrict;
1579 }
1580
1581 /* Check that RPL of stack and code selectors match. */
1582 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1583 {
1584 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1585 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1586 }
1587
1588 /* Must be a writable data segment. */
1589 if ( !DescSs.Legacy.Gen.u1DescType
1590 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1591 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1592 {
1593 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1594 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1595 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1596 }
1597
1598 /* L vs D. (Not mentioned by intel.) */
1599 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1600 && DescSs.Legacy.Gen.u1DefBig
1601 && IEM_IS_LONG_MODE(pIemCpu))
1602 {
1603 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1604 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1605 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1606 }
1607
1608 /* DPL/RPL/CPL checks. */
1609 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1610 {
1611 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1612 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1613 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1614 }
1615
1616 /* Is it there? */
1617 if (!DescSs.Legacy.Gen.u1Present)
1618 {
1619 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1620 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1621 }
1622
1623 /* Calc SS limit.*/
1624 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1625
1626 /* Is RIP canonical or within CS.limit? */
1627 uint64_t u64Base;
1628 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1629
1630 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1631 {
1632 if (!IEM_IS_CANONICAL(uNewRip))
1633 {
1634 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1635 return iemRaiseNotCanonical(pIemCpu);
1636 }
1637 u64Base = 0;
1638 }
1639 else
1640 {
1641 if (uNewRip > cbLimitCs)
1642 {
1643 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1644 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1645 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1646 }
1647 u64Base = X86DESC_BASE(&DescCs.Legacy);
1648 }
1649
1650 /*
1651 * Now set the accessed bit before
1652 * writing the return address to the stack and committing the result into
1653 * CS, CSHID and RIP.
1654 */
1655 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1656 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1657 {
1658 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1659 if (rcStrict != VINF_SUCCESS)
1660 return rcStrict;
1661 /** @todo check what VT-x and AMD-V does. */
1662 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1663 }
1664 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1665 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1666 {
1667 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1668 if (rcStrict != VINF_SUCCESS)
1669 return rcStrict;
1670 /** @todo check what VT-x and AMD-V does. */
1671 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1672 }
1673
1674 /* commit */
1675 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1676 if (rcStrict != VINF_SUCCESS)
1677 return rcStrict;
1678 if (enmEffOpSize == IEMMODE_16BIT)
1679 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1680 else
1681 pCtx->rip = uNewRip;
1682 pCtx->cs.Sel = uNewCs;
1683 pCtx->cs.ValidSel = uNewCs;
1684 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1685 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1686 pCtx->cs.u32Limit = cbLimitCs;
1687 pCtx->cs.u64Base = u64Base;
1688 pCtx->rsp = uNewRsp;
1689 pCtx->ss.Sel = uNewOuterSs;
1690 pCtx->ss.ValidSel = uNewOuterSs;
1691 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1692 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1693 pCtx->ss.u32Limit = cbLimitSs;
1694 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1695 pCtx->ss.u64Base = 0;
1696 else
1697 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1698
1699 pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1700 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1701 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1702 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1703 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1704
1705 /** @todo check if the hidden bits are loaded correctly for 64-bit
1706 * mode. */
1707
1708 if (cbPop)
1709 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1710 pCtx->eflags.Bits.u1RF = 0;
1711
1712 /* Done! */
1713 }
1714 /*
1715 * Return to the same privilege level
1716 */
1717 else
1718 {
1719 /* Limit / canonical check. */
1720 uint64_t u64Base;
1721 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1722
1723 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1724 {
1725 if (!IEM_IS_CANONICAL(uNewRip))
1726 {
1727 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1728 return iemRaiseNotCanonical(pIemCpu);
1729 }
1730 u64Base = 0;
1731 }
1732 else
1733 {
1734 if (uNewRip > cbLimitCs)
1735 {
1736 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1737 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1738 }
1739 u64Base = X86DESC_BASE(&DescCs.Legacy);
1740 }
1741
1742 /*
1743 * Now set the accessed bit before
1744 * writing the return address to the stack and committing the result into
1745 * CS, CSHID and RIP.
1746 */
1747 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1748 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1749 {
1750 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1751 if (rcStrict != VINF_SUCCESS)
1752 return rcStrict;
1753 /** @todo check what VT-x and AMD-V does. */
1754 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1755 }
1756
1757 /* commit */
1758 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1759 if (rcStrict != VINF_SUCCESS)
1760 return rcStrict;
1761 if (enmEffOpSize == IEMMODE_16BIT)
1762 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1763 else
1764 pCtx->rip = uNewRip;
1765 pCtx->cs.Sel = uNewCs;
1766 pCtx->cs.ValidSel = uNewCs;
1767 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1768 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1769 pCtx->cs.u32Limit = cbLimitCs;
1770 pCtx->cs.u64Base = u64Base;
1771 /** @todo check if the hidden bits are loaded correctly for 64-bit
1772 * mode. */
1773 if (cbPop)
1774 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1775 pCtx->eflags.Bits.u1RF = 0;
1776 }
1777 return VINF_SUCCESS;
1778}
1779
1780
1781/**
1782 * Implements retn.
1783 *
1784 * We're doing this in C because of the \#GP that might be raised if the popped
1785 * program counter is out of bounds.
1786 *
1787 * @param enmEffOpSize The effective operand size.
1788 * @param cbPop The amount of arguments to pop from the stack
1789 * (bytes).
1790 */
1791IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1792{
1793 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1794 NOREF(cbInstr);
1795
1796 /* Fetch the RSP from the stack. */
1797 VBOXSTRICTRC rcStrict;
1798 RTUINT64U NewRip;
1799 RTUINT64U NewRsp;
1800 NewRsp.u = pCtx->rsp;
1801 switch (enmEffOpSize)
1802 {
1803 case IEMMODE_16BIT:
1804 NewRip.u = 0;
1805 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1806 break;
1807 case IEMMODE_32BIT:
1808 NewRip.u = 0;
1809 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1810 break;
1811 case IEMMODE_64BIT:
1812 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1813 break;
1814 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1815 }
1816 if (rcStrict != VINF_SUCCESS)
1817 return rcStrict;
1818
1819 /* Check the new RSP before loading it. */
1820 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
1821 * of it. The canonical test is performed here and for call. */
1822 if (enmEffOpSize != IEMMODE_64BIT)
1823 {
1824 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1825 {
1826 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1827 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1828 }
1829 }
1830 else
1831 {
1832 if (!IEM_IS_CANONICAL(NewRip.u))
1833 {
1834 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1835 return iemRaiseNotCanonical(pIemCpu);
1836 }
1837 }
1838
1839 /* Commit it. */
1840 pCtx->rip = NewRip.u;
1841 pCtx->rsp = NewRsp.u;
1842 if (cbPop)
1843 iemRegAddToRsp(pIemCpu, pCtx, cbPop);
1844 pCtx->eflags.Bits.u1RF = 0;
1845
1846 return VINF_SUCCESS;
1847}
1848
1849
1850/**
1851 * Implements enter.
1852 *
1853 * We're doing this in C because the instruction is insane, even for the
1854 * u8NestingLevel=0 case dealing with the stack is tedious.
1855 *
1856 * @param enmEffOpSize The effective operand size.
1857 */
1858IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1859{
1860 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1861
1862 /* Push RBP, saving the old value in TmpRbp. */
1863 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1864 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1865 RTUINT64U NewRbp;
1866 VBOXSTRICTRC rcStrict;
1867 if (enmEffOpSize == IEMMODE_64BIT)
1868 {
1869 rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1870 NewRbp = NewRsp;
1871 }
1872 else if (pCtx->ss.Attr.n.u1DefBig)
1873 {
1874 rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1875 NewRbp = NewRsp;
1876 }
1877 else
1878 {
1879 rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1880 NewRbp = TmpRbp;
1881 NewRbp.Words.w0 = NewRsp.Words.w0;
1882 }
1883 if (rcStrict != VINF_SUCCESS)
1884 return rcStrict;
1885
1886 /* Copy the parameters (aka nesting levels by Intel). */
1887 cParameters &= 0x1f;
1888 if (cParameters > 0)
1889 {
1890 switch (enmEffOpSize)
1891 {
1892 case IEMMODE_16BIT:
1893 if (pCtx->ss.Attr.n.u1DefBig)
1894 TmpRbp.DWords.dw0 -= 2;
1895 else
1896 TmpRbp.Words.w0 -= 2;
1897 do
1898 {
1899 uint16_t u16Tmp;
1900 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1901 if (rcStrict != VINF_SUCCESS)
1902 break;
1903 rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1904 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1905 break;
1906
1907 case IEMMODE_32BIT:
1908 if (pCtx->ss.Attr.n.u1DefBig)
1909 TmpRbp.DWords.dw0 -= 4;
1910 else
1911 TmpRbp.Words.w0 -= 4;
1912 do
1913 {
1914 uint32_t u32Tmp;
1915 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1916 if (rcStrict != VINF_SUCCESS)
1917 break;
1918 rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1919 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1920 break;
1921
1922 case IEMMODE_64BIT:
1923 TmpRbp.u -= 8;
1924 do
1925 {
1926 uint64_t u64Tmp;
1927 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1928 if (rcStrict != VINF_SUCCESS)
1929 break;
1930 rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1931 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1932 break;
1933
1934 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1935 }
1936 if (rcStrict != VINF_SUCCESS)
1937 return VINF_SUCCESS;
1938
1939 /* Push the new RBP */
1940 if (enmEffOpSize == IEMMODE_64BIT)
1941 rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1942 else if (pCtx->ss.Attr.n.u1DefBig)
1943 rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1944 else
1945 rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1946 if (rcStrict != VINF_SUCCESS)
1947 return rcStrict;
1948
1949 }
1950
1951 /* Recalc RSP. */
1952 iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
1953
1954 /** @todo Should probe write access at the new RSP according to AMD. */
1955
1956 /* Commit it. */
1957 pCtx->rbp = NewRbp.u;
1958 pCtx->rsp = NewRsp.u;
1959 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
1960
1961 return VINF_SUCCESS;
1962}
1963
1964
1965
1966/**
1967 * Implements leave.
1968 *
1969 * We're doing this in C because messing with the stack registers is annoying
1970 * since they depends on SS attributes.
1971 *
1972 * @param enmEffOpSize The effective operand size.
1973 */
1974IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1975{
1976 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1977
1978 /* Calculate the intermediate RSP from RBP and the stack attributes. */
1979 RTUINT64U NewRsp;
1980 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1981 NewRsp.u = pCtx->rbp;
1982 else if (pCtx->ss.Attr.n.u1DefBig)
1983 NewRsp.u = pCtx->ebp;
1984 else
1985 {
1986 /** @todo Check that LEAVE actually preserve the high EBP bits. */
1987 NewRsp.u = pCtx->rsp;
1988 NewRsp.Words.w0 = pCtx->bp;
1989 }
1990
1991 /* Pop RBP according to the operand size. */
1992 VBOXSTRICTRC rcStrict;
1993 RTUINT64U NewRbp;
1994 switch (enmEffOpSize)
1995 {
1996 case IEMMODE_16BIT:
1997 NewRbp.u = pCtx->rbp;
1998 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1999 break;
2000 case IEMMODE_32BIT:
2001 NewRbp.u = 0;
2002 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
2003 break;
2004 case IEMMODE_64BIT:
2005 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
2006 break;
2007 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2008 }
2009 if (rcStrict != VINF_SUCCESS)
2010 return rcStrict;
2011
2012
2013 /* Commit it. */
2014 pCtx->rbp = NewRbp.u;
2015 pCtx->rsp = NewRsp.u;
2016 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
2017
2018 return VINF_SUCCESS;
2019}
2020
2021
2022/**
2023 * Implements int3 and int XX.
2024 *
2025 * @param u8Int The interrupt vector number.
2026 * @param fIsBpInstr Is it the breakpoint instruction.
2027 */
2028IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2029{
2030 Assert(pIemCpu->cXcptRecursions == 0);
2031 return iemRaiseXcptOrInt(pIemCpu,
2032 cbInstr,
2033 u8Int,
2034 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2035 0,
2036 0);
2037}
2038
2039
2040/**
2041 * Implements iret for real mode and V8086 mode.
2042 *
2043 * @param enmEffOpSize The effective operand size.
2044 */
2045IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2046{
2047 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2048 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2049 X86EFLAGS Efl;
2050 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2051 NOREF(cbInstr);
2052
2053 /*
2054 * iret throws an exception if VME isn't enabled.
2055 */
2056 if ( Efl.Bits.u1VM
2057 && Efl.Bits.u2IOPL != 3
2058 && !(pCtx->cr4 & X86_CR4_VME))
2059 return iemRaiseGeneralProtectionFault0(pIemCpu);
2060
2061 /*
2062 * Do the stack bits, but don't commit RSP before everything checks
2063 * out right.
2064 */
2065 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2066 VBOXSTRICTRC rcStrict;
2067 RTCPTRUNION uFrame;
2068 uint16_t uNewCs;
2069 uint32_t uNewEip;
2070 uint32_t uNewFlags;
2071 uint64_t uNewRsp;
2072 if (enmEffOpSize == IEMMODE_32BIT)
2073 {
2074 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2075 if (rcStrict != VINF_SUCCESS)
2076 return rcStrict;
2077 uNewEip = uFrame.pu32[0];
2078 if (uNewEip > UINT16_MAX)
2079 return iemRaiseGeneralProtectionFault0(pIemCpu);
2080
2081 uNewCs = (uint16_t)uFrame.pu32[1];
2082 uNewFlags = uFrame.pu32[2];
2083 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2084 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2085 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2086 | X86_EFL_ID;
2087 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2088 }
2089 else
2090 {
2091 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2092 if (rcStrict != VINF_SUCCESS)
2093 return rcStrict;
2094 uNewEip = uFrame.pu16[0];
2095 uNewCs = uFrame.pu16[1];
2096 uNewFlags = uFrame.pu16[2];
2097 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2098 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2099 uNewFlags |= Efl.u & (UINT32_C(0xffff0000) | X86_EFL_1);
2100 /** @todo The intel pseudo code does not indicate what happens to
2101 * reserved flags. We just ignore them. */
2102 }
2103 /** @todo Check how this is supposed to work if sp=0xfffe. */
2104
2105 /*
2106 * Check the limit of the new EIP.
2107 */
2108 /** @todo Only the AMD pseudo code check the limit here, what's
2109 * right? */
2110 if (uNewEip > pCtx->cs.u32Limit)
2111 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2112
2113 /*
2114 * V8086 checks and flag adjustments
2115 */
2116 if (Efl.Bits.u1VM)
2117 {
2118 if (Efl.Bits.u2IOPL == 3)
2119 {
2120 /* Preserve IOPL and clear RF. */
2121 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2122 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2123 }
2124 else if ( enmEffOpSize == IEMMODE_16BIT
2125 && ( !(uNewFlags & X86_EFL_IF)
2126 || !Efl.Bits.u1VIP )
2127 && !(uNewFlags & X86_EFL_TF) )
2128 {
2129 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2130 uNewFlags &= ~X86_EFL_VIF;
2131 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2132 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2133 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2134 }
2135 else
2136 return iemRaiseGeneralProtectionFault0(pIemCpu);
2137 }
2138
2139 /*
2140 * Commit the operation.
2141 */
2142 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2143 if (rcStrict != VINF_SUCCESS)
2144 return rcStrict;
2145#ifdef DBGFTRACE_ENABLED
2146 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2147 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2148#endif
2149
2150 pCtx->rip = uNewEip;
2151 pCtx->cs.Sel = uNewCs;
2152 pCtx->cs.ValidSel = uNewCs;
2153 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2154 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2155 /** @todo do we load attribs and limit as well? */
2156 Assert(uNewFlags & X86_EFL_1);
2157 IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2158
2159 return VINF_SUCCESS;
2160}
2161
2162
2163/**
2164 * Loads a segment register when entering V8086 mode.
2165 *
2166 * @param pSReg The segment register.
2167 * @param uSeg The segment to load.
2168 */
2169static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2170{
2171 pSReg->Sel = uSeg;
2172 pSReg->ValidSel = uSeg;
2173 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2174 pSReg->u64Base = (uint32_t)uSeg << 4;
2175 pSReg->u32Limit = 0xffff;
2176 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2177 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2178 * IRET'ing to V8086. */
2179}
2180
2181
2182/**
2183 * Implements iret for protected mode returning to V8086 mode.
2184 *
2185 * @param pCtx Pointer to the CPU context.
2186 * @param uNewEip The new EIP.
2187 * @param uNewCs The new CS.
2188 * @param uNewFlags The new EFLAGS.
2189 * @param uNewRsp The RSP after the initial IRET frame.
2190 *
2191 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
2192 */
2193IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2194 uint32_t, uNewFlags, uint64_t, uNewRsp)
2195{
2196 /*
2197 * Pop the V8086 specific frame bits off the stack.
2198 */
2199 VBOXSTRICTRC rcStrict;
2200 RTCPTRUNION uFrame;
2201 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2202 if (rcStrict != VINF_SUCCESS)
2203 return rcStrict;
2204 uint32_t uNewEsp = uFrame.pu32[0];
2205 uint16_t uNewSs = uFrame.pu32[1];
2206 uint16_t uNewEs = uFrame.pu32[2];
2207 uint16_t uNewDs = uFrame.pu32[3];
2208 uint16_t uNewFs = uFrame.pu32[4];
2209 uint16_t uNewGs = uFrame.pu32[5];
2210 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2211 if (rcStrict != VINF_SUCCESS)
2212 return rcStrict;
2213
2214 /*
2215 * Commit the operation.
2216 */
2217 uNewFlags &= X86_EFL_LIVE_MASK;
2218 uNewFlags |= X86_EFL_RA1_MASK;
2219#ifdef DBGFTRACE_ENABLED
2220 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
2221 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
2222#endif
2223
2224 IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2225 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2226 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2227 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2228 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2229 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2230 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2231 pCtx->rip = uNewEip;
2232 pCtx->rsp = uNewEsp;
2233 pIemCpu->uCpl = 3;
2234
2235 return VINF_SUCCESS;
2236}
2237
2238
2239/**
2240 * Implements iret for protected mode returning via a nested task.
2241 *
2242 * @param enmEffOpSize The effective operand size.
2243 */
2244IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2245{
2246 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2247}
2248
2249
2250/**
2251 * Implements iret for protected mode
2252 *
2253 * @param enmEffOpSize The effective operand size.
2254 */
2255IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2256{
2257 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2258 NOREF(cbInstr);
2259
2260 /*
2261 * Nested task return.
2262 */
2263 if (pCtx->eflags.Bits.u1NT)
2264 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2265
2266 /*
2267 * Normal return.
2268 *
2269 * Do the stack bits, but don't commit RSP before everything checks
2270 * out right.
2271 */
2272 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2273 VBOXSTRICTRC rcStrict;
2274 RTCPTRUNION uFrame;
2275 uint16_t uNewCs;
2276 uint32_t uNewEip;
2277 uint32_t uNewFlags;
2278 uint64_t uNewRsp;
2279 if (enmEffOpSize == IEMMODE_32BIT)
2280 {
2281 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2282 if (rcStrict != VINF_SUCCESS)
2283 return rcStrict;
2284 uNewEip = uFrame.pu32[0];
2285 uNewCs = (uint16_t)uFrame.pu32[1];
2286 uNewFlags = uFrame.pu32[2];
2287 }
2288 else
2289 {
2290 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2291 if (rcStrict != VINF_SUCCESS)
2292 return rcStrict;
2293 uNewEip = uFrame.pu16[0];
2294 uNewCs = uFrame.pu16[1];
2295 uNewFlags = uFrame.pu16[2];
2296 }
2297 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2298 if (rcStrict != VINF_SUCCESS)
2299 return rcStrict;
2300
2301 /*
2302 * We're hopefully not returning to V8086 mode...
2303 */
2304 if ( (uNewFlags & X86_EFL_VM)
2305 && pIemCpu->uCpl == 0)
2306 {
2307 Assert(enmEffOpSize == IEMMODE_32BIT);
2308 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2309 }
2310
2311 /*
2312 * Protected mode.
2313 */
2314 /* Read the CS descriptor. */
2315 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2316 {
2317 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2318 return iemRaiseGeneralProtectionFault0(pIemCpu);
2319 }
2320
2321 IEMSELDESC DescCS;
2322 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2323 if (rcStrict != VINF_SUCCESS)
2324 {
2325 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2326 return rcStrict;
2327 }
2328
2329 /* Must be a code descriptor. */
2330 if (!DescCS.Legacy.Gen.u1DescType)
2331 {
2332 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2333 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2334 }
2335 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2336 {
2337 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2338 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2339 }
2340
2341#ifdef VBOX_WITH_RAW_MODE_NOT_R0
2342 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
2343 PVM pVM = IEMCPU_TO_VM(pIemCpu);
2344 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
2345 {
2346 if ((uNewCs & X86_SEL_RPL) == 1)
2347 {
2348 if ( pIemCpu->uCpl == 0
2349 && ( !EMIsRawRing1Enabled(pVM)
2350 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
2351 {
2352 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
2353 uNewCs &= X86_SEL_MASK_OFF_RPL;
2354 }
2355# ifdef LOG_ENABLED
2356 else if (pIemCpu->uCpl <= 1 && EMIsRawRing1Enabled(pVM))
2357 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
2358# endif
2359 }
2360 else if ( (uNewCs & X86_SEL_RPL) == 2
2361 && EMIsRawRing1Enabled(pVM)
2362 && pIemCpu->uCpl <= 1)
2363 {
2364 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
2365 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
2366 }
2367 }
2368#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
2369
2370
2371 /* Privilege checks. */
2372 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2373 {
2374 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2375 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2376 }
2377 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2378 && (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2379 {
2380 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2381 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2382 }
2383
2384 /* Present? */
2385 if (!DescCS.Legacy.Gen.u1Present)
2386 {
2387 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2388 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2389 }
2390
2391 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2392
2393 /*
2394 * Return to outer level?
2395 */
2396 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2397 {
2398 uint16_t uNewSS;
2399 uint32_t uNewESP;
2400 if (enmEffOpSize == IEMMODE_32BIT)
2401 {
2402 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2403 if (rcStrict != VINF_SUCCESS)
2404 return rcStrict;
2405 uNewESP = uFrame.pu32[0];
2406 uNewSS = (uint16_t)uFrame.pu32[1];
2407 }
2408 else
2409 {
2410 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2411 if (rcStrict != VINF_SUCCESS)
2412 return rcStrict;
2413 uNewESP = uFrame.pu16[0];
2414 uNewSS = uFrame.pu16[1];
2415 }
2416 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2417 if (rcStrict != VINF_SUCCESS)
2418 return rcStrict;
2419
2420 /* Read the SS descriptor. */
2421 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2422 {
2423 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2424 return iemRaiseGeneralProtectionFault0(pIemCpu);
2425 }
2426
2427 IEMSELDESC DescSS;
2428 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
2429 if (rcStrict != VINF_SUCCESS)
2430 {
2431 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2432 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2433 return rcStrict;
2434 }
2435
2436 /* Privilege checks. */
2437 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2438 {
2439 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2440 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2441 }
2442 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2443 {
2444 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2445 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2446 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2447 }
2448
2449 /* Must be a writeable data segment descriptor. */
2450 if (!DescSS.Legacy.Gen.u1DescType)
2451 {
2452 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2453 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2454 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2455 }
2456 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2457 {
2458 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2459 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2460 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2461 }
2462
2463 /* Present? */
2464 if (!DescSS.Legacy.Gen.u1Present)
2465 {
2466 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2467 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2468 }
2469
2470 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2471
2472 /* Check EIP. */
2473 if (uNewEip > cbLimitCS)
2474 {
2475 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2476 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2477 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2478 }
2479
2480 /*
2481 * Commit the changes, marking CS and SS accessed first since
2482 * that may fail.
2483 */
2484 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2485 {
2486 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2487 if (rcStrict != VINF_SUCCESS)
2488 return rcStrict;
2489 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2490 }
2491 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2492 {
2493 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2494 if (rcStrict != VINF_SUCCESS)
2495 return rcStrict;
2496 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2497 }
2498
2499 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2500 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
2501 if (enmEffOpSize != IEMMODE_16BIT)
2502 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
2503 if (pIemCpu->uCpl == 0)
2504 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
2505 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2506 fEFlagsMask |= X86_EFL_IF;
2507 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2508 fEFlagsNew &= ~fEFlagsMask;
2509 fEFlagsNew |= uNewFlags & fEFlagsMask;
2510#ifdef DBGFTRACE_ENABLED
2511 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
2512 pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
2513 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
2514#endif
2515
2516 IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2517 pCtx->rip = uNewEip;
2518 pCtx->cs.Sel = uNewCs;
2519 pCtx->cs.ValidSel = uNewCs;
2520 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2521 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2522 pCtx->cs.u32Limit = cbLimitCS;
2523 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2524 if (!pCtx->cs.Attr.n.u1DefBig)
2525 pCtx->sp = (uint16_t)uNewESP;
2526 else
2527 pCtx->rsp = uNewESP;
2528 pCtx->ss.Sel = uNewSS;
2529 pCtx->ss.ValidSel = uNewSS;
2530 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2531 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2532 pCtx->ss.u32Limit = cbLimitSs;
2533 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2534
2535 pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2536 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2537 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2538 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2539 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2540
2541 /* Done! */
2542
2543 }
2544 /*
2545 * Return to the same level.
2546 */
2547 else
2548 {
2549 /* Check EIP. */
2550 if (uNewEip > cbLimitCS)
2551 {
2552 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2553 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2554 }
2555
2556 /*
2557 * Commit the changes, marking CS first since it may fail.
2558 */
2559 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2560 {
2561 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2562 if (rcStrict != VINF_SUCCESS)
2563 return rcStrict;
2564 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2565 }
2566
2567 X86EFLAGS NewEfl;
2568 NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2569 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2570 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
2571 if (enmEffOpSize != IEMMODE_16BIT)
2572 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
2573 if (pIemCpu->uCpl == 0)
2574 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
2575 else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2576 fEFlagsMask |= X86_EFL_IF;
2577 NewEfl.u &= ~fEFlagsMask;
2578 NewEfl.u |= fEFlagsMask & uNewFlags;
2579#ifdef DBGFTRACE_ENABLED
2580 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
2581 pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
2582 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
2583#endif
2584
2585 IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2586 pCtx->rip = uNewEip;
2587 pCtx->cs.Sel = uNewCs;
2588 pCtx->cs.ValidSel = uNewCs;
2589 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2590 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2591 pCtx->cs.u32Limit = cbLimitCS;
2592 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2593 pCtx->rsp = uNewRsp;
2594 /* Done! */
2595 }
2596 return VINF_SUCCESS;
2597}
2598
2599
2600/**
2601 * Implements iret for long mode
2602 *
2603 * @param enmEffOpSize The effective operand size.
2604 */
2605IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2606{
2607 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2608 NOREF(cbInstr);
2609
2610 /*
2611 * Nested task return is not supported in long mode.
2612 */
2613 if (pCtx->eflags.Bits.u1NT)
2614 {
2615 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
2616 return iemRaiseGeneralProtectionFault0(pIemCpu);
2617 }
2618
2619 /*
2620 * Normal return.
2621 *
2622 * Do the stack bits, but don't commit RSP before everything checks
2623 * out right.
2624 */
2625 VBOXSTRICTRC rcStrict;
2626 RTCPTRUNION uFrame;
2627 uint64_t uNewRip;
2628 uint16_t uNewCs;
2629 uint16_t uNewSs;
2630 uint32_t uNewFlags;
2631 uint64_t uNewRsp;
2632 if (enmEffOpSize == IEMMODE_64BIT)
2633 {
2634 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
2635 if (rcStrict != VINF_SUCCESS)
2636 return rcStrict;
2637 uNewRip = uFrame.pu64[0];
2638 uNewCs = (uint16_t)uFrame.pu64[1];
2639 uNewFlags = (uint32_t)uFrame.pu64[2];
2640 uNewRsp = uFrame.pu64[3];
2641 uNewSs = (uint16_t)uFrame.pu64[4];
2642 }
2643 else if (enmEffOpSize == IEMMODE_32BIT)
2644 {
2645 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
2646 if (rcStrict != VINF_SUCCESS)
2647 return rcStrict;
2648 uNewRip = uFrame.pu32[0];
2649 uNewCs = (uint16_t)uFrame.pu32[1];
2650 uNewFlags = uFrame.pu32[2];
2651 uNewRsp = uFrame.pu32[3];
2652 uNewSs = (uint16_t)uFrame.pu32[4];
2653 }
2654 else
2655 {
2656 Assert(enmEffOpSize == IEMMODE_16BIT);
2657 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
2658 if (rcStrict != VINF_SUCCESS)
2659 return rcStrict;
2660 uNewRip = uFrame.pu16[0];
2661 uNewCs = uFrame.pu16[1];
2662 uNewFlags = uFrame.pu16[2];
2663 uNewRsp = uFrame.pu16[3];
2664 uNewSs = uFrame.pu16[4];
2665 }
2666 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2667 if (rcStrict != VINF_SUCCESS)
2668 return rcStrict;
2669 Log2(("iretq stack: cs:rip=%04x:%016RX16 rflags=%016RX16 ss:rsp=%04x:%016RX16\n",
2670 uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
2671
2672 /*
2673 * Check stuff.
2674 */
2675 /* Read the CS descriptor. */
2676 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2677 {
2678 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2679 return iemRaiseGeneralProtectionFault0(pIemCpu);
2680 }
2681
2682 IEMSELDESC DescCS;
2683 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
2684 if (rcStrict != VINF_SUCCESS)
2685 {
2686 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
2687 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2688 return rcStrict;
2689 }
2690
2691 /* Must be a code descriptor. */
2692 if ( !DescCS.Legacy.Gen.u1DescType
2693 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2694 {
2695 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
2696 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
2697 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2698 }
2699
2700 /* Privilege checks. */
2701 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
2702 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2703 {
2704 Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp, pIemCpu->uCpl));
2705 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2706 }
2707 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2708 && (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2709 {
2710 Log(("iret %04x:%016RX64/%04x:%016RX64 - RPL < DPL (%d) -> #GP\n",
2711 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u2Dpl));
2712 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2713 }
2714
2715 /* Present? */
2716 if (!DescCS.Legacy.Gen.u1Present)
2717 {
2718 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2719 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2720 }
2721
2722 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2723
2724 /* Read the SS descriptor. */
2725 IEMSELDESC DescSS;
2726 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2727 {
2728 if ( !DescCS.Legacy.Gen.u1Long
2729 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
2730 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
2731 {
2732 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2733 return iemRaiseGeneralProtectionFault0(pIemCpu);
2734 }
2735 DescSS.Legacy.u = 0;
2736 }
2737 else
2738 {
2739 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
2740 if (rcStrict != VINF_SUCCESS)
2741 {
2742 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
2743 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
2744 return rcStrict;
2745 }
2746 }
2747
2748 /* Privilege checks. */
2749 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2750 {
2751 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2752 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2753 }
2754
2755 uint32_t cbLimitSs;
2756 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2757 cbLimitSs = UINT32_MAX;
2758 else
2759 {
2760 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2761 {
2762 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
2763 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
2764 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2765 }
2766
2767 /* Must be a writeable data segment descriptor. */
2768 if (!DescSS.Legacy.Gen.u1DescType)
2769 {
2770 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
2771 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2772 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2773 }
2774 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2775 {
2776 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
2777 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
2778 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
2779 }
2780
2781 /* Present? */
2782 if (!DescSS.Legacy.Gen.u1Present)
2783 {
2784 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
2785 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
2786 }
2787 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2788 }
2789
2790 /* Check EIP. */
2791 if (DescCS.Legacy.Gen.u1Long)
2792 {
2793 if (!IEM_IS_CANONICAL(uNewRip))
2794 {
2795 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
2796 uNewCs, uNewRip, uNewSs, uNewRsp));
2797 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2798 }
2799 }
2800 else
2801 {
2802 if (uNewRip > cbLimitCS)
2803 {
2804 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
2805 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
2806 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2807 }
2808 }
2809
2810 /*
2811 * Commit the changes, marking CS and SS accessed first since
2812 * that may fail.
2813 */
2814 /** @todo where exactly are these actually marked accessed by a real CPU? */
2815 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2816 {
2817 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2818 if (rcStrict != VINF_SUCCESS)
2819 return rcStrict;
2820 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2821 }
2822 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2823 {
2824 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
2825 if (rcStrict != VINF_SUCCESS)
2826 return rcStrict;
2827 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2828 }
2829
2830 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2831 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
2832 if (enmEffOpSize != IEMMODE_16BIT)
2833 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
2834 if (pIemCpu->uCpl == 0)
2835 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
2836 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2837 fEFlagsMask |= X86_EFL_IF;
2838 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2839 fEFlagsNew &= ~fEFlagsMask;
2840 fEFlagsNew |= uNewFlags & fEFlagsMask;
2841#ifdef DBGFTRACE_ENABLED
2842 RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
2843 pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
2844#endif
2845
2846 IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2847 pCtx->rip = uNewRip;
2848 pCtx->cs.Sel = uNewCs;
2849 pCtx->cs.ValidSel = uNewCs;
2850 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2851 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2852 pCtx->cs.u32Limit = cbLimitCS;
2853 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2854 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
2855 pCtx->rsp = uNewRsp;
2856 else
2857 pCtx->sp = (uint16_t)uNewRsp;
2858 pCtx->ss.Sel = uNewSs;
2859 pCtx->ss.ValidSel = uNewSs;
2860 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
2861 {
2862 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2863 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
2864 pCtx->ss.u32Limit = UINT32_MAX;
2865 pCtx->ss.u64Base = 0;
2866 Log2(("iretq new SS: NULL\n"));
2867 }
2868 else
2869 {
2870 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2871 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2872 pCtx->ss.u32Limit = cbLimitSs;
2873 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2874 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
2875 }
2876
2877 if (pIemCpu->uCpl != uNewCpl)
2878 {
2879 pIemCpu->uCpl = uNewCpl;
2880 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
2881 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
2882 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
2883 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
2884 }
2885
2886 return VINF_SUCCESS;
2887}
2888
2889
2890/**
2891 * Implements iret.
2892 *
2893 * @param enmEffOpSize The effective operand size.
2894 */
2895IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2896{
2897 /*
2898 * Call a mode specific worker.
2899 */
2900 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2901 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2902 if (IEM_IS_LONG_MODE(pIemCpu))
2903 return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2904
2905 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2906}
2907
2908
2909/**
2910 * Implements SYSCALL (AMD and Intel64).
2911 *
2912 * @param enmEffOpSize The effective operand size.
2913 */
2914IEM_CIMPL_DEF_0(iemCImpl_syscall)
2915{
2916 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2917
2918 /*
2919 * Check preconditions.
2920 *
2921 * Note that CPUs described in the documentation may load a few odd values
2922 * into CS and SS than we allow here. This has yet to be checked on real
2923 * hardware.
2924 */
2925 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
2926 {
2927 Log(("syscall: Not enabled in EFER -> #UD\n"));
2928 return iemRaiseUndefinedOpcode(pIemCpu);
2929 }
2930 if (!(pCtx->cr0 & X86_CR0_PE))
2931 {
2932 Log(("syscall: Protected mode is required -> #GP(0)\n"));
2933 return iemRaiseGeneralProtectionFault0(pIemCpu);
2934 }
2935 if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
2936 {
2937 Log(("syscall: Only available in long mode on intel -> #UD\n"));
2938 return iemRaiseUndefinedOpcode(pIemCpu);
2939 }
2940
2941 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
2942 /** @todo what about LDT selectors? Shouldn't matter, really. */
2943 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
2944 uint16_t uNewSs = uNewCs + 8;
2945 if (uNewCs == 0 || uNewSs == 0)
2946 {
2947 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
2948 return iemRaiseGeneralProtectionFault0(pIemCpu);
2949 }
2950
2951 /* Long mode and legacy mode differs. */
2952 if (CPUMIsGuestInLongModeEx(pCtx))
2953 {
2954 uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
2955
2956 /* This test isn't in the docs, but I'm not trusting the guys writing
2957 the MSRs to have validated the values as canonical like they should. */
2958 if (!IEM_IS_CANONICAL(uNewRip))
2959 {
2960 Log(("syscall: Only available in long mode on intel -> #UD\n"));
2961 return iemRaiseUndefinedOpcode(pIemCpu);
2962 }
2963
2964 /*
2965 * Commit it.
2966 */
2967 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
2968 pCtx->rcx = pCtx->rip + cbInstr;
2969 pCtx->rip = uNewRip;
2970
2971 pCtx->rflags.u &= ~X86_EFL_RF;
2972 pCtx->r11 = pCtx->rflags.u;
2973 pCtx->rflags.u &= ~pCtx->msrSFMASK;
2974 pCtx->rflags.u |= X86_EFL_1;
2975
2976 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
2977 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
2978 }
2979 else
2980 {
2981 /*
2982 * Commit it.
2983 */
2984 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
2985 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
2986 pCtx->rcx = pCtx->eip + cbInstr;
2987 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
2988 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
2989
2990 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
2991 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
2992 }
2993 pCtx->cs.Sel = uNewCs;
2994 pCtx->cs.ValidSel = uNewCs;
2995 pCtx->cs.u64Base = 0;
2996 pCtx->cs.u32Limit = UINT32_MAX;
2997 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2998
2999 pCtx->ss.Sel = uNewSs;
3000 pCtx->ss.ValidSel = uNewSs;
3001 pCtx->ss.u64Base = 0;
3002 pCtx->ss.u32Limit = UINT32_MAX;
3003 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3004
3005 return VINF_SUCCESS;
3006}
3007
3008
3009/**
3010 * Implements SYSRET (AMD and Intel64).
3011 */
3012IEM_CIMPL_DEF_0(iemCImpl_sysret)
3013
3014{
3015 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3016
3017 /*
3018 * Check preconditions.
3019 *
3020 * Note that CPUs described in the documentation may load a few odd values
3021 * into CS and SS than we allow here. This has yet to be checked on real
3022 * hardware.
3023 */
3024 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3025 {
3026 Log(("sysret: Not enabled in EFER -> #UD\n"));
3027 return iemRaiseUndefinedOpcode(pIemCpu);
3028 }
3029 if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3030 {
3031 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3032 return iemRaiseUndefinedOpcode(pIemCpu);
3033 }
3034 if (!(pCtx->cr0 & X86_CR0_PE))
3035 {
3036 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3037 return iemRaiseGeneralProtectionFault0(pIemCpu);
3038 }
3039 if (pIemCpu->uCpl != 0)
3040 {
3041 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
3042 return iemRaiseGeneralProtectionFault0(pIemCpu);
3043 }
3044
3045 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3046 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3047 uint16_t uNewSs = uNewCs + 8;
3048 if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3049 uNewCs += 16;
3050 if (uNewCs == 0 || uNewSs == 0)
3051 {
3052 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3053 return iemRaiseGeneralProtectionFault0(pIemCpu);
3054 }
3055
3056 /*
3057 * Commit it.
3058 */
3059 if (CPUMIsGuestInLongModeEx(pCtx))
3060 {
3061 if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
3062 {
3063 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3064 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
3065 /* Note! We disregard intel manual regarding the RCX cananonical
3066 check, ask intel+xen why AMD doesn't do it. */
3067 pCtx->rip = pCtx->rcx;
3068 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3069 | (3 << X86DESCATTR_DPL_SHIFT);
3070 }
3071 else
3072 {
3073 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
3074 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
3075 pCtx->rip = pCtx->ecx;
3076 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3077 | (3 << X86DESCATTR_DPL_SHIFT);
3078 }
3079 /** @todo testcase: See what kind of flags we can make SYSRET restore and
3080 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
3081 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
3082 pCtx->rflags.u |= X86_EFL_1;
3083 }
3084 else
3085 {
3086 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
3087 pCtx->rip = pCtx->rcx;
3088 pCtx->rflags.u |= X86_EFL_IF;
3089 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
3090 | (3 << X86DESCATTR_DPL_SHIFT);
3091 }
3092 pCtx->cs.Sel = uNewCs | 3;
3093 pCtx->cs.ValidSel = uNewCs | 3;
3094 pCtx->cs.u64Base = 0;
3095 pCtx->cs.u32Limit = UINT32_MAX;
3096 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3097
3098 pCtx->ss.Sel = uNewSs | 3;
3099 pCtx->ss.ValidSel = uNewSs | 3;
3100 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3101 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
3102 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
3103 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
3104 * on sysret. */
3105
3106 return VINF_SUCCESS;
3107}
3108
3109
3110/**
3111 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
3112 *
3113 * @param iSegReg The segment register number (valid).
3114 * @param uSel The new selector value.
3115 */
3116IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
3117{
3118 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
3119 uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
3120 PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
3121
3122 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
3123
3124 /*
3125 * Real mode and V8086 mode are easy.
3126 */
3127 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
3128 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3129 {
3130 *pSel = uSel;
3131 pHid->u64Base = (uint32_t)uSel << 4;
3132 pHid->ValidSel = uSel;
3133 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3134#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
3135 /** @todo Does the CPU actually load limits and attributes in the
3136 * real/V8086 mode segment load case? It doesn't for CS in far
3137 * jumps... Affects unreal mode. */
3138 pHid->u32Limit = 0xffff;
3139 pHid->Attr.u = 0;
3140 pHid->Attr.n.u1Present = 1;
3141 pHid->Attr.n.u1DescType = 1;
3142 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
3143 ? X86_SEL_TYPE_RW
3144 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
3145#endif
3146 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3147 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3148 return VINF_SUCCESS;
3149 }
3150
3151 /*
3152 * Protected mode.
3153 *
3154 * Check if it's a null segment selector value first, that's OK for DS, ES,
3155 * FS and GS. If not null, then we have to load and parse the descriptor.
3156 */
3157 if (!(uSel & X86_SEL_MASK_OFF_RPL))
3158 {
3159 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
3160 if (iSegReg == X86_SREG_SS)
3161 {
3162 /* In 64-bit kernel mode, the stack can be 0 because of the way
3163 interrupts are dispatched. AMD seems to have a slighly more
3164 relaxed relationship to SS.RPL than intel does. */
3165 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
3166 if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
3167 || pIemCpu->uCpl > 2
3168 || ( uSel != pIemCpu->uCpl
3169 && !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
3170 {
3171 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
3172 return iemRaiseGeneralProtectionFault0(pIemCpu);
3173 }
3174 }
3175
3176 *pSel = uSel; /* Not RPL, remember :-) */
3177 iemHlpLoadNullDataSelectorProt(pIemCpu, pHid, uSel);
3178 if (iSegReg == X86_SREG_SS)
3179 pHid->Attr.u |= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
3180
3181 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3182 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3183
3184 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3185 return VINF_SUCCESS;
3186 }
3187
3188 /* Fetch the descriptor. */
3189 IEMSELDESC Desc;
3190 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
3191 if (rcStrict != VINF_SUCCESS)
3192 return rcStrict;
3193
3194 /* Check GPs first. */
3195 if (!Desc.Legacy.Gen.u1DescType)
3196 {
3197 Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
3198 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3199 }
3200 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
3201 {
3202 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
3203 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
3204 {
3205 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
3206 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3207 }
3208 if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
3209 {
3210 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
3211 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3212 }
3213 if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
3214 {
3215 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
3216 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3217 }
3218 }
3219 else
3220 {
3221 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3222 {
3223 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
3224 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3225 }
3226 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3227 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3228 {
3229#if 0 /* this is what intel says. */
3230 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
3231 && pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3232 {
3233 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
3234 iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3235 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3236 }
3237#else /* this is what makes more sense. */
3238 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3239 {
3240 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
3241 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
3242 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3243 }
3244 if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3245 {
3246 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
3247 iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
3248 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
3249 }
3250#endif
3251 }
3252 }
3253
3254 /* Is it there? */
3255 if (!Desc.Legacy.Gen.u1Present)
3256 {
3257 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
3258 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
3259 }
3260
3261 /* The base and limit. */
3262 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
3263 uint64_t u64Base;
3264 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
3265 && iSegReg < X86_SREG_FS)
3266 u64Base = 0;
3267 else
3268 u64Base = X86DESC_BASE(&Desc.Legacy);
3269
3270 /*
3271 * Ok, everything checked out fine. Now set the accessed bit before
3272 * committing the result into the registers.
3273 */
3274 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3275 {
3276 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
3277 if (rcStrict != VINF_SUCCESS)
3278 return rcStrict;
3279 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3280 }
3281
3282 /* commit */
3283 *pSel = uSel;
3284 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3285 pHid->u32Limit = cbLimit;
3286 pHid->u64Base = u64Base;
3287 pHid->ValidSel = uSel;
3288 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3289
3290 /** @todo check if the hidden bits are loaded correctly for 64-bit
3291 * mode. */
3292 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
3293
3294 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
3295 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3296 return VINF_SUCCESS;
3297}
3298
3299
3300/**
3301 * Implements 'mov SReg, r/m'.
3302 *
3303 * @param iSegReg The segment register number (valid).
3304 * @param uSel The new selector value.
3305 */
3306IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
3307{
3308 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3309 if (rcStrict == VINF_SUCCESS)
3310 {
3311 if (iSegReg == X86_SREG_SS)
3312 {
3313 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3314 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3315 }
3316 }
3317 return rcStrict;
3318}
3319
3320
3321/**
3322 * Implements 'pop SReg'.
3323 *
3324 * @param iSegReg The segment register number (valid).
3325 * @param enmEffOpSize The efficient operand size (valid).
3326 */
3327IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
3328{
3329 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3330 VBOXSTRICTRC rcStrict;
3331
3332 /*
3333 * Read the selector off the stack and join paths with mov ss, reg.
3334 */
3335 RTUINT64U TmpRsp;
3336 TmpRsp.u = pCtx->rsp;
3337 switch (enmEffOpSize)
3338 {
3339 case IEMMODE_16BIT:
3340 {
3341 uint16_t uSel;
3342 rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
3343 if (rcStrict == VINF_SUCCESS)
3344 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3345 break;
3346 }
3347
3348 case IEMMODE_32BIT:
3349 {
3350 uint32_t u32Value;
3351 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
3352 if (rcStrict == VINF_SUCCESS)
3353 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
3354 break;
3355 }
3356
3357 case IEMMODE_64BIT:
3358 {
3359 uint64_t u64Value;
3360 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
3361 if (rcStrict == VINF_SUCCESS)
3362 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
3363 break;
3364 }
3365 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3366 }
3367
3368 /*
3369 * Commit the stack on success.
3370 */
3371 if (rcStrict == VINF_SUCCESS)
3372 {
3373 pCtx->rsp = TmpRsp.u;
3374 if (iSegReg == X86_SREG_SS)
3375 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3376 }
3377 return rcStrict;
3378}
3379
3380
3381/**
3382 * Implements lgs, lfs, les, lds & lss.
3383 */
3384IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
3385 uint16_t, uSel,
3386 uint64_t, offSeg,
3387 uint8_t, iSegReg,
3388 uint8_t, iGReg,
3389 IEMMODE, enmEffOpSize)
3390{
3391 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
3392 VBOXSTRICTRC rcStrict;
3393
3394 /*
3395 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
3396 */
3397 /** @todo verify and test that mov, pop and lXs works the segment
3398 * register loading in the exact same way. */
3399 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
3400 if (rcStrict == VINF_SUCCESS)
3401 {
3402 switch (enmEffOpSize)
3403 {
3404 case IEMMODE_16BIT:
3405 *(uint16_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
3406 break;
3407 case IEMMODE_32BIT:
3408 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
3409 break;
3410 case IEMMODE_64BIT:
3411 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
3412 break;
3413 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3414 }
3415 }
3416
3417 return rcStrict;
3418}
3419
3420
3421/**
3422 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
3423 *
3424 * @retval VINF_SUCCESS on success.
3425 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
3426 * @retval iemMemFetchSysU64 return value.
3427 *
3428 * @param pIemCpu The IEM state of the calling EMT.
3429 * @param uSel The selector value.
3430 * @param fAllowSysDesc Whether system descriptors are OK or not.
3431 * @param pDesc Where to return the descriptor on success.
3432 */
3433static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
3434{
3435 pDesc->Long.au64[0] = 0;
3436 pDesc->Long.au64[1] = 0;
3437
3438 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
3439 return VINF_IEM_SELECTOR_NOT_OK;
3440
3441 /* Within the table limits? */
3442 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3443 RTGCPTR GCPtrBase;
3444 if (uSel & X86_SEL_LDT)
3445 {
3446 if ( !pCtx->ldtr.Attr.n.u1Present
3447 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
3448 return VINF_IEM_SELECTOR_NOT_OK;
3449 GCPtrBase = pCtx->ldtr.u64Base;
3450 }
3451 else
3452 {
3453 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
3454 return VINF_IEM_SELECTOR_NOT_OK;
3455 GCPtrBase = pCtx->gdtr.pGdt;
3456 }
3457
3458 /* Fetch the descriptor. */
3459 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
3460 if (rcStrict != VINF_SUCCESS)
3461 return rcStrict;
3462 if (!pDesc->Legacy.Gen.u1DescType)
3463 {
3464 if (!fAllowSysDesc)
3465 return VINF_IEM_SELECTOR_NOT_OK;
3466 if (CPUMIsGuestInLongModeEx(pCtx))
3467 {
3468 rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
3469 if (rcStrict != VINF_SUCCESS)
3470 return rcStrict;
3471 }
3472
3473 }
3474
3475 return VINF_SUCCESS;
3476}
3477
3478
3479/**
3480 * Implements verr (fWrite = false) and verw (fWrite = true).
3481 */
3482IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
3483{
3484 Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3485
3486 /** @todo figure whether the accessed bit is set or not. */
3487
3488 bool fAccessible = true;
3489 IEMSELDESC Desc;
3490 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
3491 if (rcStrict == VINF_SUCCESS)
3492 {
3493 /* Check the descriptor, order doesn't matter much here. */
3494 if ( !Desc.Legacy.Gen.u1DescType
3495 || !Desc.Legacy.Gen.u1Present)
3496 fAccessible = false;
3497 else
3498 {
3499 if ( fWrite
3500 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
3501 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
3502 fAccessible = false;
3503
3504 /** @todo testcase for the conforming behavior. */
3505 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3506 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
3507 {
3508 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3509 fAccessible = false;
3510 else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3511 fAccessible = false;
3512 }
3513 }
3514
3515 }
3516 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3517 fAccessible = false;
3518 else
3519 return rcStrict;
3520
3521 /* commit */
3522 pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
3523
3524 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3525 return VINF_SUCCESS;
3526}
3527
3528
3529/**
3530 * Implements LAR and LSL with 64-bit operand size.
3531 *
3532 * @returns VINF_SUCCESS.
3533 * @param pu16Dst Pointer to the destination register.
3534 * @param uSel The selector to load details for.
3535 * @param pEFlags Pointer to the eflags register.
3536 * @param fIsLar true = LAR, false = LSL.
3537 */
3538IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
3539{
3540 Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
3541
3542 /** @todo figure whether the accessed bit is set or not. */
3543
3544 bool fDescOk = true;
3545 IEMSELDESC Desc;
3546 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
3547 if (rcStrict == VINF_SUCCESS)
3548 {
3549 /*
3550 * Check the descriptor type.
3551 */
3552 if (!Desc.Legacy.Gen.u1DescType)
3553 {
3554 if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
3555 {
3556 if (Desc.Long.Gen.u5Zeros)
3557 fDescOk = false;
3558 else
3559 switch (Desc.Long.Gen.u4Type)
3560 {
3561 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
3562 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
3563 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
3564 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
3565 break;
3566 case AMD64_SEL_TYPE_SYS_CALL_GATE:
3567 fDescOk = fIsLar;
3568 break;
3569 default:
3570 fDescOk = false;
3571 break;
3572 }
3573 }
3574 else
3575 {
3576 switch (Desc.Long.Gen.u4Type)
3577 {
3578 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
3579 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
3580 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
3581 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
3582 case X86_SEL_TYPE_SYS_LDT:
3583 break;
3584 case X86_SEL_TYPE_SYS_286_CALL_GATE:
3585 case X86_SEL_TYPE_SYS_TASK_GATE:
3586 case X86_SEL_TYPE_SYS_386_CALL_GATE:
3587 fDescOk = fIsLar;
3588 break;
3589 default:
3590 fDescOk = false;
3591 break;
3592 }
3593 }
3594 }
3595 if (fDescOk)
3596 {
3597 /*
3598 * Check the RPL/DPL/CPL interaction..
3599 */
3600 /** @todo testcase for the conforming behavior. */
3601 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
3602 || !Desc.Legacy.Gen.u1DescType)
3603 {
3604 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
3605 fDescOk = false;
3606 else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
3607 fDescOk = false;
3608 }
3609 }
3610
3611 if (fDescOk)
3612 {
3613 /*
3614 * All fine, start committing the result.
3615 */
3616 if (fIsLar)
3617 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
3618 else
3619 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
3620 }
3621
3622 }
3623 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
3624 fDescOk = false;
3625 else
3626 return rcStrict;
3627
3628 /* commit flags value and advance rip. */
3629 pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
3630 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3631
3632 return VINF_SUCCESS;
3633}
3634
3635
3636/**
3637 * Implements LAR and LSL with 16-bit operand size.
3638 *
3639 * @returns VINF_SUCCESS.
3640 * @param pu16Dst Pointer to the destination register.
3641 * @param u16Sel The selector to load details for.
3642 * @param pEFlags Pointer to the eflags register.
3643 * @param fIsLar true = LAR, false = LSL.
3644 */
3645IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
3646{
3647 uint64_t u64TmpDst = *pu16Dst;
3648 IEM_CIMPL_CALL_4(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, pEFlags, fIsLar);
3649 *pu16Dst = (uint16_t)u64TmpDst;
3650 return VINF_SUCCESS;
3651}
3652
3653
3654/**
3655 * Implements lgdt.
3656 *
3657 * @param iEffSeg The segment of the new gdtr contents
3658 * @param GCPtrEffSrc The address of the new gdtr contents.
3659 * @param enmEffOpSize The effective operand size.
3660 */
3661IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3662{
3663 if (pIemCpu->uCpl != 0)
3664 return iemRaiseGeneralProtectionFault0(pIemCpu);
3665 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3666
3667 /*
3668 * Fetch the limit and base address.
3669 */
3670 uint16_t cbLimit;
3671 RTGCPTR GCPtrBase;
3672 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3673 if (rcStrict == VINF_SUCCESS)
3674 {
3675 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3676 rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3677 else
3678 {
3679 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3680 pCtx->gdtr.cbGdt = cbLimit;
3681 pCtx->gdtr.pGdt = GCPtrBase;
3682 }
3683 if (rcStrict == VINF_SUCCESS)
3684 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3685 }
3686 return rcStrict;
3687}
3688
3689
3690/**
3691 * Implements sgdt.
3692 *
3693 * @param iEffSeg The segment where to store the gdtr content.
3694 * @param GCPtrEffDst The address where to store the gdtr content.
3695 * @param enmEffOpSize The effective operand size.
3696 */
3697IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3698{
3699 /*
3700 * Join paths with sidt.
3701 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3702 * you really must know.
3703 */
3704 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3705 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3706 if (rcStrict == VINF_SUCCESS)
3707 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3708 return rcStrict;
3709}
3710
3711
3712/**
3713 * Implements lidt.
3714 *
3715 * @param iEffSeg The segment of the new idtr contents
3716 * @param GCPtrEffSrc The address of the new idtr contents.
3717 * @param enmEffOpSize The effective operand size.
3718 */
3719IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
3720{
3721 if (pIemCpu->uCpl != 0)
3722 return iemRaiseGeneralProtectionFault0(pIemCpu);
3723 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3724
3725 /*
3726 * Fetch the limit and base address.
3727 */
3728 uint16_t cbLimit;
3729 RTGCPTR GCPtrBase;
3730 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
3731 if (rcStrict == VINF_SUCCESS)
3732 {
3733 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3734 CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
3735 else
3736 {
3737 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3738 pCtx->idtr.cbIdt = cbLimit;
3739 pCtx->idtr.pIdt = GCPtrBase;
3740 }
3741 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3742 }
3743 return rcStrict;
3744}
3745
3746
3747/**
3748 * Implements sidt.
3749 *
3750 * @param iEffSeg The segment where to store the idtr content.
3751 * @param GCPtrEffDst The address where to store the idtr content.
3752 * @param enmEffOpSize The effective operand size.
3753 */
3754IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
3755{
3756 /*
3757 * Join paths with sgdt.
3758 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
3759 * you really must know.
3760 */
3761 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3762 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
3763 if (rcStrict == VINF_SUCCESS)
3764 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3765 return rcStrict;
3766}
3767
3768
3769/**
3770 * Implements lldt.
3771 *
3772 * @param uNewLdt The new LDT selector value.
3773 */
3774IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
3775{
3776 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3777
3778 /*
3779 * Check preconditions.
3780 */
3781 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3782 {
3783 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
3784 return iemRaiseUndefinedOpcode(pIemCpu);
3785 }
3786 if (pIemCpu->uCpl != 0)
3787 {
3788 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
3789 return iemRaiseGeneralProtectionFault0(pIemCpu);
3790 }
3791 if (uNewLdt & X86_SEL_LDT)
3792 {
3793 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
3794 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
3795 }
3796
3797 /*
3798 * Now, loading a NULL selector is easy.
3799 */
3800 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
3801 {
3802 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
3803 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3804 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
3805 else
3806 pCtx->ldtr.Sel = uNewLdt;
3807 pCtx->ldtr.ValidSel = uNewLdt;
3808 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3809 if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
3810 {
3811 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3812 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
3813 }
3814 else if (IEM_IS_GUEST_CPU_AMD(pIemCpu))
3815 {
3816 /* AMD-V seems to leave the base and limit alone. */
3817 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
3818 }
3819 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
3820 {
3821 /* VT-x (Intel 3960x) seems to be doing the following. */
3822 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
3823 pCtx->ldtr.u64Base = 0;
3824 pCtx->ldtr.u32Limit = UINT32_MAX;
3825 }
3826
3827 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3828 return VINF_SUCCESS;
3829 }
3830
3831 /*
3832 * Read the descriptor.
3833 */
3834 IEMSELDESC Desc;
3835 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
3836 if (rcStrict != VINF_SUCCESS)
3837 return rcStrict;
3838
3839 /* Check GPs first. */
3840 if (Desc.Legacy.Gen.u1DescType)
3841 {
3842 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3843 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3844 }
3845 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
3846 {
3847 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
3848 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3849 }
3850 uint64_t u64Base;
3851 if (!IEM_IS_LONG_MODE(pIemCpu))
3852 u64Base = X86DESC_BASE(&Desc.Legacy);
3853 else
3854 {
3855 if (Desc.Long.Gen.u5Zeros)
3856 {
3857 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
3858 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3859 }
3860
3861 u64Base = X86DESC64_BASE(&Desc.Long);
3862 if (!IEM_IS_CANONICAL(u64Base))
3863 {
3864 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
3865 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
3866 }
3867 }
3868
3869 /* NP */
3870 if (!Desc.Legacy.Gen.u1Present)
3871 {
3872 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
3873 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
3874 }
3875
3876 /*
3877 * It checks out alright, update the registers.
3878 */
3879/** @todo check if the actual value is loaded or if the RPL is dropped */
3880 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3881 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
3882 else
3883 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3884 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
3885 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3886 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3887 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3888 pCtx->ldtr.u64Base = u64Base;
3889
3890 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
3891 return VINF_SUCCESS;
3892}
3893
3894
3895/**
3896 * Implements lldt.
3897 *
3898 * @param uNewLdt The new LDT selector value.
3899 */
3900IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3901{
3902 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3903
3904 /*
3905 * Check preconditions.
3906 */
3907 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3908 {
3909 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3910 return iemRaiseUndefinedOpcode(pIemCpu);
3911 }
3912 if (pIemCpu->uCpl != 0)
3913 {
3914 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3915 return iemRaiseGeneralProtectionFault0(pIemCpu);
3916 }
3917 if (uNewTr & X86_SEL_LDT)
3918 {
3919 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3920 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3921 }
3922 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3923 {
3924 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3925 return iemRaiseGeneralProtectionFault0(pIemCpu);
3926 }
3927
3928 /*
3929 * Read the descriptor.
3930 */
3931 IEMSELDESC Desc;
3932 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
3933 if (rcStrict != VINF_SUCCESS)
3934 return rcStrict;
3935
3936 /* Check GPs first. */
3937 if (Desc.Legacy.Gen.u1DescType)
3938 {
3939 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3940 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3941 }
3942 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3943 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3944 || IEM_IS_LONG_MODE(pIemCpu)) )
3945 {
3946 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3947 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3948 }
3949 uint64_t u64Base;
3950 if (!IEM_IS_LONG_MODE(pIemCpu))
3951 u64Base = X86DESC_BASE(&Desc.Legacy);
3952 else
3953 {
3954 if (Desc.Long.Gen.u5Zeros)
3955 {
3956 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3957 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3958 }
3959
3960 u64Base = X86DESC64_BASE(&Desc.Long);
3961 if (!IEM_IS_CANONICAL(u64Base))
3962 {
3963 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3964 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3965 }
3966 }
3967
3968 /* NP */
3969 if (!Desc.Legacy.Gen.u1Present)
3970 {
3971 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3972 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3973 }
3974
3975 /*
3976 * Set it busy.
3977 * Note! Intel says this should lock down the whole descriptor, but we'll
3978 * restrict our selves to 32-bit for now due to lack of inline
3979 * assembly and such.
3980 */
3981 void *pvDesc;
3982 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
3983 if (rcStrict != VINF_SUCCESS)
3984 return rcStrict;
3985 switch ((uintptr_t)pvDesc & 3)
3986 {
3987 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3988 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3989 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
3990 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
3991 }
3992 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
3993 if (rcStrict != VINF_SUCCESS)
3994 return rcStrict;
3995 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3996
3997 /*
3998 * It checks out alright, update the registers.
3999 */
4000/** @todo check if the actual value is loaded or if the RPL is dropped */
4001 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4002 CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
4003 else
4004 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4005 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4006 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4007 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4008 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4009 pCtx->tr.u64Base = u64Base;
4010
4011 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4012 return VINF_SUCCESS;
4013}
4014
4015
4016/**
4017 * Implements mov GReg,CRx.
4018 *
4019 * @param iGReg The general register to store the CRx value in.
4020 * @param iCrReg The CRx register to read (valid).
4021 */
4022IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4023{
4024 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4025 if (pIemCpu->uCpl != 0)
4026 return iemRaiseGeneralProtectionFault0(pIemCpu);
4027 Assert(!pCtx->eflags.Bits.u1VM);
4028
4029 /* read it */
4030 uint64_t crX;
4031 switch (iCrReg)
4032 {
4033 case 0: crX = pCtx->cr0; break;
4034 case 2: crX = pCtx->cr2; break;
4035 case 3: crX = pCtx->cr3; break;
4036 case 4: crX = pCtx->cr4; break;
4037 case 8:
4038 {
4039 uint8_t uTpr;
4040 int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
4041 if (RT_SUCCESS(rc))
4042 crX = uTpr >> 4;
4043 else
4044 crX = 0;
4045 break;
4046 }
4047 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4048 }
4049
4050 /* store it */
4051 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4052 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = crX;
4053 else
4054 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
4055
4056 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4057 return VINF_SUCCESS;
4058}
4059
4060
4061/**
4062 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
4063 *
4064 * @param iCrReg The CRx register to write (valid).
4065 * @param uNewCrX The new value.
4066 */
4067IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
4068{
4069 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4070 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4071 VBOXSTRICTRC rcStrict;
4072 int rc;
4073
4074 /*
4075 * Try store it.
4076 * Unfortunately, CPUM only does a tiny bit of the work.
4077 */
4078 switch (iCrReg)
4079 {
4080 case 0:
4081 {
4082 /*
4083 * Perform checks.
4084 */
4085 uint64_t const uOldCrX = pCtx->cr0;
4086 uNewCrX |= X86_CR0_ET; /* hardcoded */
4087
4088 /* Check for reserved bits. */
4089 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
4090 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
4091 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
4092 if (uNewCrX & ~(uint64_t)fValid)
4093 {
4094 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4095 return iemRaiseGeneralProtectionFault0(pIemCpu);
4096 }
4097
4098 /* Check for invalid combinations. */
4099 if ( (uNewCrX & X86_CR0_PG)
4100 && !(uNewCrX & X86_CR0_PE) )
4101 {
4102 Log(("Trying to set CR0.PG without CR0.PE\n"));
4103 return iemRaiseGeneralProtectionFault0(pIemCpu);
4104 }
4105
4106 if ( !(uNewCrX & X86_CR0_CD)
4107 && (uNewCrX & X86_CR0_NW) )
4108 {
4109 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
4110 return iemRaiseGeneralProtectionFault0(pIemCpu);
4111 }
4112
4113 /* Long mode consistency checks. */
4114 if ( (uNewCrX & X86_CR0_PG)
4115 && !(uOldCrX & X86_CR0_PG)
4116 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
4117 {
4118 if (!(pCtx->cr4 & X86_CR4_PAE))
4119 {
4120 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
4121 return iemRaiseGeneralProtectionFault0(pIemCpu);
4122 }
4123 if (pCtx->cs.Attr.n.u1Long)
4124 {
4125 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
4126 return iemRaiseGeneralProtectionFault0(pIemCpu);
4127 }
4128 }
4129
4130 /** @todo check reserved PDPTR bits as AMD states. */
4131
4132 /*
4133 * Change CR0.
4134 */
4135 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4136 CPUMSetGuestCR0(pVCpu, uNewCrX);
4137 else
4138 pCtx->cr0 = uNewCrX;
4139 Assert(pCtx->cr0 == uNewCrX);
4140
4141 /*
4142 * Change EFER.LMA if entering or leaving long mode.
4143 */
4144 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
4145 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
4146 {
4147 uint64_t NewEFER = pCtx->msrEFER;
4148 if (uNewCrX & X86_CR0_PG)
4149 NewEFER |= MSR_K6_EFER_LMA;
4150 else
4151 NewEFER &= ~MSR_K6_EFER_LMA;
4152
4153 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4154 CPUMSetGuestEFER(pVCpu, NewEFER);
4155 else
4156 pCtx->msrEFER = NewEFER;
4157 Assert(pCtx->msrEFER == NewEFER);
4158 }
4159
4160 /*
4161 * Inform PGM.
4162 */
4163 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4164 {
4165 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
4166 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
4167 {
4168 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4169 AssertRCReturn(rc, rc);
4170 /* ignore informational status codes */
4171 }
4172 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4173 }
4174 else
4175 rcStrict = VINF_SUCCESS;
4176
4177#ifdef IN_RC
4178 /* Return to ring-3 for rescheduling if WP or AM changes. */
4179 if ( rcStrict == VINF_SUCCESS
4180 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
4181 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
4182 rcStrict = VINF_EM_RESCHEDULE;
4183#endif
4184 break;
4185 }
4186
4187 /*
4188 * CR2 can be changed without any restrictions.
4189 */
4190 case 2:
4191 pCtx->cr2 = uNewCrX;
4192 rcStrict = VINF_SUCCESS;
4193 break;
4194
4195 /*
4196 * CR3 is relatively simple, although AMD and Intel have different
4197 * accounts of how setting reserved bits are handled. We take intel's
4198 * word for the lower bits and AMD's for the high bits (63:52).
4199 */
4200 /** @todo Testcase: Setting reserved bits in CR3, especially before
4201 * enabling paging. */
4202 case 3:
4203 {
4204 /* check / mask the value. */
4205 if (uNewCrX & UINT64_C(0xfff0000000000000))
4206 {
4207 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
4208 return iemRaiseGeneralProtectionFault0(pIemCpu);
4209 }
4210
4211 uint64_t fValid;
4212 if ( (pCtx->cr4 & X86_CR4_PAE)
4213 && (pCtx->msrEFER & MSR_K6_EFER_LME))
4214 fValid = UINT64_C(0x000ffffffffff014);
4215 else if (pCtx->cr4 & X86_CR4_PAE)
4216 fValid = UINT64_C(0xfffffff4);
4217 else
4218 fValid = UINT64_C(0xfffff014);
4219 if (uNewCrX & ~fValid)
4220 {
4221 Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
4222 uNewCrX, uNewCrX & ~fValid));
4223 uNewCrX &= fValid;
4224 }
4225
4226 /** @todo If we're in PAE mode we should check the PDPTRs for
4227 * invalid bits. */
4228
4229 /* Make the change. */
4230 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4231 {
4232 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
4233 AssertRCSuccessReturn(rc, rc);
4234 }
4235 else
4236 pCtx->cr3 = uNewCrX;
4237
4238 /* Inform PGM. */
4239 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4240 {
4241 if (pCtx->cr0 & X86_CR0_PG)
4242 {
4243 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
4244 AssertRCReturn(rc, rc);
4245 /* ignore informational status codes */
4246 }
4247 }
4248 rcStrict = VINF_SUCCESS;
4249 break;
4250 }
4251
4252 /*
4253 * CR4 is a bit more tedious as there are bits which cannot be cleared
4254 * under some circumstances and such.
4255 */
4256 case 4:
4257 {
4258 uint64_t const uOldCrX = pCtx->cr4;
4259
4260 /* reserved bits */
4261 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
4262 | X86_CR4_TSD | X86_CR4_DE
4263 | X86_CR4_PSE | X86_CR4_PAE
4264 | X86_CR4_MCE | X86_CR4_PGE
4265 | X86_CR4_PCE | X86_CR4_OSFSXR
4266 | X86_CR4_OSXMMEEXCPT;
4267 //if (xxx)
4268 // fValid |= X86_CR4_VMXE;
4269 //if (xxx)
4270 // fValid |= X86_CR4_OSXSAVE;
4271 if (uNewCrX & ~(uint64_t)fValid)
4272 {
4273 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
4274 return iemRaiseGeneralProtectionFault0(pIemCpu);
4275 }
4276
4277 /* long mode checks. */
4278 if ( (uOldCrX & X86_CR4_PAE)
4279 && !(uNewCrX & X86_CR4_PAE)
4280 && CPUMIsGuestInLongModeEx(pCtx) )
4281 {
4282 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
4283 return iemRaiseGeneralProtectionFault0(pIemCpu);
4284 }
4285
4286
4287 /*
4288 * Change it.
4289 */
4290 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4291 {
4292 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
4293 AssertRCSuccessReturn(rc, rc);
4294 }
4295 else
4296 pCtx->cr4 = uNewCrX;
4297 Assert(pCtx->cr4 == uNewCrX);
4298
4299 /*
4300 * Notify SELM and PGM.
4301 */
4302 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4303 {
4304 /* SELM - VME may change things wrt to the TSS shadowing. */
4305 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
4306 {
4307 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
4308 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
4309#ifdef VBOX_WITH_RAW_MODE
4310 if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
4311 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
4312#endif
4313 }
4314
4315 /* PGM - flushing and mode. */
4316 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
4317 {
4318 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
4319 AssertRCReturn(rc, rc);
4320 /* ignore informational status codes */
4321 }
4322 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
4323 }
4324 else
4325 rcStrict = VINF_SUCCESS;
4326 break;
4327 }
4328
4329 /*
4330 * CR8 maps to the APIC TPR.
4331 */
4332 case 8:
4333 if (uNewCrX & ~(uint64_t)0xf)
4334 {
4335 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
4336 return iemRaiseGeneralProtectionFault0(pIemCpu);
4337 }
4338
4339 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
4340 PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
4341 rcStrict = VINF_SUCCESS;
4342 break;
4343
4344 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4345 }
4346
4347 /*
4348 * Advance the RIP on success.
4349 */
4350 if (RT_SUCCESS(rcStrict))
4351 {
4352 if (rcStrict != VINF_SUCCESS)
4353 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4354 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4355 }
4356
4357 return rcStrict;
4358}
4359
4360
4361/**
4362 * Implements mov CRx,GReg.
4363 *
4364 * @param iCrReg The CRx register to write (valid).
4365 * @param iGReg The general register to load the DRx value from.
4366 */
4367IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
4368{
4369 if (pIemCpu->uCpl != 0)
4370 return iemRaiseGeneralProtectionFault0(pIemCpu);
4371 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4372
4373 /*
4374 * Read the new value from the source register and call common worker.
4375 */
4376 uint64_t uNewCrX;
4377 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4378 uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
4379 else
4380 uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
4381 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
4382}
4383
4384
4385/**
4386 * Implements 'LMSW r/m16'
4387 *
4388 * @param u16NewMsw The new value.
4389 */
4390IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
4391{
4392 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4393
4394 if (pIemCpu->uCpl != 0)
4395 return iemRaiseGeneralProtectionFault0(pIemCpu);
4396 Assert(!pCtx->eflags.Bits.u1VM);
4397
4398 /*
4399 * Compose the new CR0 value and call common worker.
4400 */
4401 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4402 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
4403 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
4404}
4405
4406
4407/**
4408 * Implements 'CLTS'.
4409 */
4410IEM_CIMPL_DEF_0(iemCImpl_clts)
4411{
4412 if (pIemCpu->uCpl != 0)
4413 return iemRaiseGeneralProtectionFault0(pIemCpu);
4414
4415 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4416 uint64_t uNewCr0 = pCtx->cr0;
4417 uNewCr0 &= ~X86_CR0_TS;
4418 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
4419}
4420
4421
4422/**
4423 * Implements mov GReg,DRx.
4424 *
4425 * @param iGReg The general register to store the DRx value in.
4426 * @param iDrReg The DRx register to read (0-7).
4427 */
4428IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
4429{
4430 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4431
4432 /*
4433 * Check preconditions.
4434 */
4435
4436 /* Raise GPs. */
4437 if (pIemCpu->uCpl != 0)
4438 return iemRaiseGeneralProtectionFault0(pIemCpu);
4439 Assert(!pCtx->eflags.Bits.u1VM);
4440
4441 if ( (iDrReg == 4 || iDrReg == 5)
4442 && (pCtx->cr4 & X86_CR4_DE) )
4443 {
4444 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
4445 return iemRaiseGeneralProtectionFault0(pIemCpu);
4446 }
4447
4448 /* Raise #DB if general access detect is enabled. */
4449 if (pCtx->dr[7] & X86_DR7_GD)
4450 {
4451 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
4452 return iemRaiseDebugException(pIemCpu);
4453 }
4454
4455 /*
4456 * Read the debug register and store it in the specified general register.
4457 */
4458 uint64_t drX;
4459 switch (iDrReg)
4460 {
4461 case 0: drX = pCtx->dr[0]; break;
4462 case 1: drX = pCtx->dr[1]; break;
4463 case 2: drX = pCtx->dr[2]; break;
4464 case 3: drX = pCtx->dr[3]; break;
4465 case 6:
4466 case 4:
4467 drX = pCtx->dr[6];
4468 drX |= X86_DR6_RA1_MASK;
4469 drX &= ~X86_DR6_RAZ_MASK;
4470 break;
4471 case 7:
4472 case 5:
4473 drX = pCtx->dr[7];
4474 drX |=X86_DR7_RA1_MASK;
4475 drX &= ~X86_DR7_RAZ_MASK;
4476 break;
4477 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
4478 }
4479
4480 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4481 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = drX;
4482 else
4483 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
4484
4485 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4486 return VINF_SUCCESS;
4487}
4488
4489
4490/**
4491 * Implements mov DRx,GReg.
4492 *
4493 * @param iDrReg The DRx register to write (valid).
4494 * @param iGReg The general register to load the DRx value from.
4495 */
4496IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
4497{
4498 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4499
4500 /*
4501 * Check preconditions.
4502 */
4503 if (pIemCpu->uCpl != 0)
4504 return iemRaiseGeneralProtectionFault0(pIemCpu);
4505 Assert(!pCtx->eflags.Bits.u1VM);
4506
4507 if (iDrReg == 4 || iDrReg == 5)
4508 {
4509 if (pCtx->cr4 & X86_CR4_DE)
4510 {
4511 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
4512 return iemRaiseGeneralProtectionFault0(pIemCpu);
4513 }
4514 iDrReg += 2;
4515 }
4516
4517 /* Raise #DB if general access detect is enabled. */
4518 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
4519 * \#GP? */
4520 if (pCtx->dr[7] & X86_DR7_GD)
4521 {
4522 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
4523 return iemRaiseDebugException(pIemCpu);
4524 }
4525
4526 /*
4527 * Read the new value from the source register.
4528 */
4529 uint64_t uNewDrX;
4530 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4531 uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
4532 else
4533 uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
4534
4535 /*
4536 * Adjust it.
4537 */
4538 switch (iDrReg)
4539 {
4540 case 0:
4541 case 1:
4542 case 2:
4543 case 3:
4544 /* nothing to adjust */
4545 break;
4546
4547 case 6:
4548 if (uNewDrX & X86_DR6_MBZ_MASK)
4549 {
4550 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4551 return iemRaiseGeneralProtectionFault0(pIemCpu);
4552 }
4553 uNewDrX |= X86_DR6_RA1_MASK;
4554 uNewDrX &= ~X86_DR6_RAZ_MASK;
4555 break;
4556
4557 case 7:
4558 if (uNewDrX & X86_DR7_MBZ_MASK)
4559 {
4560 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
4561 return iemRaiseGeneralProtectionFault0(pIemCpu);
4562 }
4563 uNewDrX |= X86_DR7_RA1_MASK;
4564 uNewDrX &= ~X86_DR7_RAZ_MASK;
4565 break;
4566
4567 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4568 }
4569
4570 /*
4571 * Do the actual setting.
4572 */
4573 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4574 {
4575 int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
4576 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
4577 }
4578 else
4579 pCtx->dr[iDrReg] = uNewDrX;
4580
4581 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4582 return VINF_SUCCESS;
4583}
4584
4585
4586/**
4587 * Implements 'INVLPG m'.
4588 *
4589 * @param GCPtrPage The effective address of the page to invalidate.
4590 * @remarks Updates the RIP.
4591 */
4592IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
4593{
4594 /* ring-0 only. */
4595 if (pIemCpu->uCpl != 0)
4596 return iemRaiseGeneralProtectionFault0(pIemCpu);
4597 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
4598
4599 int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
4600 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4601
4602 if (rc == VINF_SUCCESS)
4603 return VINF_SUCCESS;
4604 if (rc == VINF_PGM_SYNC_CR3)
4605 return iemSetPassUpStatus(pIemCpu, rc);
4606
4607 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
4608 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
4609 return rc;
4610}
4611
4612
4613/**
4614 * Implements RDTSC.
4615 */
4616IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
4617{
4618 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4619
4620 /*
4621 * Check preconditions.
4622 */
4623 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
4624 return iemRaiseUndefinedOpcode(pIemCpu);
4625
4626 if ( (pCtx->cr4 & X86_CR4_TSD)
4627 && pIemCpu->uCpl != 0)
4628 {
4629 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
4630 return iemRaiseGeneralProtectionFault0(pIemCpu);
4631 }
4632
4633 /*
4634 * Do the job.
4635 */
4636 uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
4637 pCtx->rax = (uint32_t)uTicks;
4638 pCtx->rdx = uTicks >> 32;
4639#ifdef IEM_VERIFICATION_MODE_FULL
4640 pIemCpu->fIgnoreRaxRdx = true;
4641#endif
4642
4643 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4644 return VINF_SUCCESS;
4645}
4646
4647
4648/**
4649 * Implements RDMSR.
4650 */
4651IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
4652{
4653 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4654
4655 /*
4656 * Check preconditions.
4657 */
4658 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4659 return iemRaiseUndefinedOpcode(pIemCpu);
4660 if (pIemCpu->uCpl != 0)
4661 return iemRaiseGeneralProtectionFault0(pIemCpu);
4662
4663 /*
4664 * Do the job.
4665 */
4666 RTUINT64U uValue;
4667 int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
4668 if (rc != VINF_SUCCESS)
4669 {
4670#ifdef IN_RING3
4671 static uint32_t s_cTimes = 0;
4672 if (s_cTimes++ < 10)
4673 LogRel(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
4674#endif
4675 Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
4676 AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4677 return iemRaiseGeneralProtectionFault0(pIemCpu);
4678 }
4679
4680 pCtx->rax = uValue.s.Lo;
4681 pCtx->rdx = uValue.s.Hi;
4682
4683 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4684 return VINF_SUCCESS;
4685}
4686
4687
4688/**
4689 * Implements WRMSR.
4690 */
4691IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
4692{
4693 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4694
4695 /*
4696 * Check preconditions.
4697 */
4698 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
4699 return iemRaiseUndefinedOpcode(pIemCpu);
4700 if (pIemCpu->uCpl != 0)
4701 return iemRaiseGeneralProtectionFault0(pIemCpu);
4702
4703 /*
4704 * Do the job.
4705 */
4706 RTUINT64U uValue;
4707 uValue.s.Lo = pCtx->eax;
4708 uValue.s.Hi = pCtx->edx;
4709
4710 int rc;
4711 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4712 rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4713 else
4714 {
4715 CPUMCTX CtxTmp = *pCtx;
4716 rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
4717 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
4718 *pCtx = *pCtx2;
4719 *pCtx2 = CtxTmp;
4720 }
4721 if (rc != VINF_SUCCESS)
4722 {
4723 Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
4724 AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
4725 return iemRaiseGeneralProtectionFault0(pIemCpu);
4726 }
4727
4728 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4729 return VINF_SUCCESS;
4730}
4731
4732
4733/**
4734 * Implements 'IN eAX, port'.
4735 *
4736 * @param u16Port The source port.
4737 * @param cbReg The register size.
4738 */
4739IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
4740{
4741 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4742
4743 /*
4744 * CPL check
4745 */
4746 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4747 if (rcStrict != VINF_SUCCESS)
4748 return rcStrict;
4749
4750 /*
4751 * Perform the I/O.
4752 */
4753 uint32_t u32Value;
4754 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4755 rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
4756 else
4757 rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
4758 if (IOM_SUCCESS(rcStrict))
4759 {
4760 switch (cbReg)
4761 {
4762 case 1: pCtx->al = (uint8_t)u32Value; break;
4763 case 2: pCtx->ax = (uint16_t)u32Value; break;
4764 case 4: pCtx->rax = u32Value; break;
4765 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4766 }
4767 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4768 pIemCpu->cPotentialExits++;
4769 if (rcStrict != VINF_SUCCESS)
4770 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4771 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
4772
4773 /*
4774 * Check for I/O breakpoints.
4775 */
4776 uint32_t const uDr7 = pCtx->dr[7];
4777 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
4778 && X86_DR7_ANY_RW_IO(uDr7)
4779 && (pCtx->cr4 & X86_CR4_DE))
4780 || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
4781 {
4782 rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
4783 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
4784 rcStrict = iemRaiseDebugException(pIemCpu);
4785 }
4786 }
4787
4788 return rcStrict;
4789}
4790
4791
4792/**
4793 * Implements 'IN eAX, DX'.
4794 *
4795 * @param cbReg The register size.
4796 */
4797IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
4798{
4799 return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4800}
4801
4802
4803/**
4804 * Implements 'OUT port, eAX'.
4805 *
4806 * @param u16Port The destination port.
4807 * @param cbReg The register size.
4808 */
4809IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
4810{
4811 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4812
4813 /*
4814 * CPL check
4815 */
4816 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
4817 if (rcStrict != VINF_SUCCESS)
4818 return rcStrict;
4819
4820 /*
4821 * Perform the I/O.
4822 */
4823 uint32_t u32Value;
4824 switch (cbReg)
4825 {
4826 case 1: u32Value = pCtx->al; break;
4827 case 2: u32Value = pCtx->ax; break;
4828 case 4: u32Value = pCtx->eax; break;
4829 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
4830 }
4831 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
4832 rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
4833 else
4834 rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
4835 if (IOM_SUCCESS(rcStrict))
4836 {
4837 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4838 pIemCpu->cPotentialExits++;
4839 if (rcStrict != VINF_SUCCESS)
4840 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
4841 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
4842
4843 /*
4844 * Check for I/O breakpoints.
4845 */
4846 uint32_t const uDr7 = pCtx->dr[7];
4847 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
4848 && X86_DR7_ANY_RW_IO(uDr7)
4849 && (pCtx->cr4 & X86_CR4_DE))
4850 || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
4851 {
4852 rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
4853 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
4854 rcStrict = iemRaiseDebugException(pIemCpu);
4855 }
4856 }
4857 return rcStrict;
4858}
4859
4860
4861/**
4862 * Implements 'OUT DX, eAX'.
4863 *
4864 * @param cbReg The register size.
4865 */
4866IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
4867{
4868 return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
4869}
4870
4871
4872/**
4873 * Implements 'CLI'.
4874 */
4875IEM_CIMPL_DEF_0(iemCImpl_cli)
4876{
4877 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4878 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4879 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4880 uint32_t const fEflOld = fEfl;
4881 if (pCtx->cr0 & X86_CR0_PE)
4882 {
4883 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4884 if (!(fEfl & X86_EFL_VM))
4885 {
4886 if (pIemCpu->uCpl <= uIopl)
4887 fEfl &= ~X86_EFL_IF;
4888 else if ( pIemCpu->uCpl == 3
4889 && (pCtx->cr4 & X86_CR4_PVI) )
4890 fEfl &= ~X86_EFL_VIF;
4891 else
4892 return iemRaiseGeneralProtectionFault0(pIemCpu);
4893 }
4894 /* V8086 */
4895 else if (uIopl == 3)
4896 fEfl &= ~X86_EFL_IF;
4897 else if ( uIopl < 3
4898 && (pCtx->cr4 & X86_CR4_VME) )
4899 fEfl &= ~X86_EFL_VIF;
4900 else
4901 return iemRaiseGeneralProtectionFault0(pIemCpu);
4902 }
4903 /* real mode */
4904 else
4905 fEfl &= ~X86_EFL_IF;
4906
4907 /* Commit. */
4908 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4909 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4910 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
4911 return VINF_SUCCESS;
4912}
4913
4914
4915/**
4916 * Implements 'STI'.
4917 */
4918IEM_CIMPL_DEF_0(iemCImpl_sti)
4919{
4920 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4921 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
4922 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
4923 uint32_t const fEflOld = fEfl;
4924
4925 if (pCtx->cr0 & X86_CR0_PE)
4926 {
4927 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
4928 if (!(fEfl & X86_EFL_VM))
4929 {
4930 if (pIemCpu->uCpl <= uIopl)
4931 fEfl |= X86_EFL_IF;
4932 else if ( pIemCpu->uCpl == 3
4933 && (pCtx->cr4 & X86_CR4_PVI)
4934 && !(fEfl & X86_EFL_VIP) )
4935 fEfl |= X86_EFL_VIF;
4936 else
4937 return iemRaiseGeneralProtectionFault0(pIemCpu);
4938 }
4939 /* V8086 */
4940 else if (uIopl == 3)
4941 fEfl |= X86_EFL_IF;
4942 else if ( uIopl < 3
4943 && (pCtx->cr4 & X86_CR4_VME)
4944 && !(fEfl & X86_EFL_VIP) )
4945 fEfl |= X86_EFL_VIF;
4946 else
4947 return iemRaiseGeneralProtectionFault0(pIemCpu);
4948 }
4949 /* real mode */
4950 else
4951 fEfl |= X86_EFL_IF;
4952
4953 /* Commit. */
4954 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4955 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4956 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
4957 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4958 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4959 return VINF_SUCCESS;
4960}
4961
4962
4963/**
4964 * Implements 'HLT'.
4965 */
4966IEM_CIMPL_DEF_0(iemCImpl_hlt)
4967{
4968 if (pIemCpu->uCpl != 0)
4969 return iemRaiseGeneralProtectionFault0(pIemCpu);
4970 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
4971 return VINF_EM_HALT;
4972}
4973
4974
4975/**
4976 * Implements 'MONITOR'.
4977 */
4978IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
4979{
4980 /*
4981 * Permission checks.
4982 */
4983 if (pIemCpu->uCpl != 0)
4984 {
4985 Log2(("monitor: CPL != 0\n"));
4986 return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
4987 }
4988 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
4989 {
4990 Log2(("monitor: Not in CPUID\n"));
4991 return iemRaiseUndefinedOpcode(pIemCpu);
4992 }
4993
4994 /*
4995 * Gather the operands and validate them.
4996 */
4997 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4998 RTGCPTR GCPtrMem = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
4999 uint32_t uEcx = pCtx->ecx;
5000 uint32_t uEdx = pCtx->edx;
5001/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5002 * \#GP first. */
5003 if (uEcx != 0)
5004 {
5005 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx));
5006 return iemRaiseGeneralProtectionFault0(pIemCpu);
5007 }
5008
5009 VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
5010 if (rcStrict != VINF_SUCCESS)
5011 return rcStrict;
5012
5013 RTGCPHYS GCPhysMem;
5014 rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
5015 if (rcStrict != VINF_SUCCESS)
5016 return rcStrict;
5017
5018 /*
5019 * Call EM to prepare the monitor/wait.
5020 */
5021 rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
5022 Assert(rcStrict == VINF_SUCCESS);
5023
5024 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5025 return rcStrict;
5026}
5027
5028
5029/**
5030 * Implements 'MWAIT'.
5031 */
5032IEM_CIMPL_DEF_0(iemCImpl_mwait)
5033{
5034 /*
5035 * Permission checks.
5036 */
5037 if (pIemCpu->uCpl != 0)
5038 {
5039 Log2(("mwait: CPL != 0\n"));
5040 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
5041 * EFLAGS.VM then.) */
5042 return iemRaiseUndefinedOpcode(pIemCpu);
5043 }
5044 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_ECX(X86_CPUID_FEATURE_ECX_MONITOR))
5045 {
5046 Log2(("mwait: Not in CPUID\n"));
5047 return iemRaiseUndefinedOpcode(pIemCpu);
5048 }
5049
5050 /*
5051 * Gather the operands and validate them.
5052 */
5053 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5054 uint32_t uEax = pCtx->eax;
5055 uint32_t uEcx = pCtx->ecx;
5056 if (uEcx != 0)
5057 {
5058 /* Only supported extension is break on IRQ when IF=0. */
5059 if (uEcx > 1)
5060 {
5061 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
5062 return iemRaiseGeneralProtectionFault0(pIemCpu);
5063 }
5064 uint32_t fMWaitFeatures = 0;
5065 uint32_t uIgnore = 0;
5066 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
5067 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5068 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
5069 {
5070 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
5071 return iemRaiseGeneralProtectionFault0(pIemCpu);
5072 }
5073 }
5074
5075 /*
5076 * Call EM to prepare the monitor/wait.
5077 */
5078 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
5079
5080 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5081 return rcStrict;
5082}
5083
5084
5085/**
5086 * Implements 'SWAPGS'.
5087 */
5088IEM_CIMPL_DEF_0(iemCImpl_swapgs)
5089{
5090 Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
5091
5092 /*
5093 * Permission checks.
5094 */
5095 if (pIemCpu->uCpl != 0)
5096 {
5097 Log2(("swapgs: CPL != 0\n"));
5098 return iemRaiseUndefinedOpcode(pIemCpu);
5099 }
5100
5101 /*
5102 * Do the job.
5103 */
5104 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5105 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
5106 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
5107 pCtx->gs.u64Base = uOtherGsBase;
5108
5109 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5110 return VINF_SUCCESS;
5111}
5112
5113
5114/**
5115 * Implements 'CPUID'.
5116 */
5117IEM_CIMPL_DEF_0(iemCImpl_cpuid)
5118{
5119 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5120
5121 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
5122 pCtx->rax &= UINT32_C(0xffffffff);
5123 pCtx->rbx &= UINT32_C(0xffffffff);
5124 pCtx->rcx &= UINT32_C(0xffffffff);
5125 pCtx->rdx &= UINT32_C(0xffffffff);
5126
5127 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5128 return VINF_SUCCESS;
5129}
5130
5131
5132/**
5133 * Implements 'AAD'.
5134 *
5135 * @param enmEffOpSize The effective operand size.
5136 */
5137IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
5138{
5139 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5140
5141 uint16_t const ax = pCtx->ax;
5142 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
5143 pCtx->ax = al;
5144 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5145 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
5146 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
5147
5148 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5149 return VINF_SUCCESS;
5150}
5151
5152
5153/**
5154 * Implements 'AAM'.
5155 *
5156 * @param bImm The immediate operand. Cannot be 0.
5157 */
5158IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
5159{
5160 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5161 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
5162
5163 uint16_t const ax = pCtx->ax;
5164 uint8_t const al = (uint8_t)ax % bImm;
5165 uint8_t const ah = (uint8_t)ax / bImm;
5166 pCtx->ax = (ah << 8) + al;
5167 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
5168 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
5169 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
5170
5171 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5172 return VINF_SUCCESS;
5173}
5174
5175
5176
5177
5178/*
5179 * Instantiate the various string operation combinations.
5180 */
5181#define OP_SIZE 8
5182#define ADDR_SIZE 16
5183#include "IEMAllCImplStrInstr.cpp.h"
5184#define OP_SIZE 8
5185#define ADDR_SIZE 32
5186#include "IEMAllCImplStrInstr.cpp.h"
5187#define OP_SIZE 8
5188#define ADDR_SIZE 64
5189#include "IEMAllCImplStrInstr.cpp.h"
5190
5191#define OP_SIZE 16
5192#define ADDR_SIZE 16
5193#include "IEMAllCImplStrInstr.cpp.h"
5194#define OP_SIZE 16
5195#define ADDR_SIZE 32
5196#include "IEMAllCImplStrInstr.cpp.h"
5197#define OP_SIZE 16
5198#define ADDR_SIZE 64
5199#include "IEMAllCImplStrInstr.cpp.h"
5200
5201#define OP_SIZE 32
5202#define ADDR_SIZE 16
5203#include "IEMAllCImplStrInstr.cpp.h"
5204#define OP_SIZE 32
5205#define ADDR_SIZE 32
5206#include "IEMAllCImplStrInstr.cpp.h"
5207#define OP_SIZE 32
5208#define ADDR_SIZE 64
5209#include "IEMAllCImplStrInstr.cpp.h"
5210
5211#define OP_SIZE 64
5212#define ADDR_SIZE 32
5213#include "IEMAllCImplStrInstr.cpp.h"
5214#define OP_SIZE 64
5215#define ADDR_SIZE 64
5216#include "IEMAllCImplStrInstr.cpp.h"
5217
5218
5219/**
5220 * Implements 'FINIT' and 'FNINIT'.
5221 *
5222 * @param fCheckXcpts Whether to check for umasked pending exceptions or
5223 * not.
5224 */
5225IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
5226{
5227 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5228
5229 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
5230 return iemRaiseDeviceNotAvailable(pIemCpu);
5231
5232 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
5233 if (fCheckXcpts && TODO )
5234 return iemRaiseMathFault(pIemCpu);
5235 */
5236
5237 if (iemFRegIsFxSaveFormat(pIemCpu))
5238 {
5239 pCtx->fpu.FCW = 0x37f;
5240 pCtx->fpu.FSW = 0;
5241 pCtx->fpu.FTW = 0x00; /* 0 - empty. */
5242 pCtx->fpu.FPUDP = 0;
5243 pCtx->fpu.DS = 0; //??
5244 pCtx->fpu.Rsrvd2= 0;
5245 pCtx->fpu.FPUIP = 0;
5246 pCtx->fpu.CS = 0; //??
5247 pCtx->fpu.Rsrvd1= 0;
5248 pCtx->fpu.FOP = 0;
5249 }
5250 else
5251 {
5252 PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
5253 pFpu->FCW = 0x37f;
5254 pFpu->FSW = 0;
5255 pFpu->FTW = 0xffff; /* 11 - empty */
5256 pFpu->FPUOO = 0; //??
5257 pFpu->FPUOS = 0; //??
5258 pFpu->FPUIP = 0;
5259 pFpu->CS = 0; //??
5260 pFpu->FOP = 0;
5261 }
5262
5263 iemHlpUsedFpu(pIemCpu);
5264 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5265 return VINF_SUCCESS;
5266}
5267
5268
5269/**
5270 * Implements 'FXSAVE'.
5271 *
5272 * @param iEffSeg The effective segment.
5273 * @param GCPtrEff The address of the image.
5274 * @param enmEffOpSize The operand size (only REX.W really matters).
5275 */
5276IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5277{
5278 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5279
5280 /*
5281 * Raise exceptions.
5282 */
5283 if (pCtx->cr0 & X86_CR0_EM)
5284 return iemRaiseUndefinedOpcode(pIemCpu);
5285 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
5286 return iemRaiseDeviceNotAvailable(pIemCpu);
5287 if (GCPtrEff & 15)
5288 {
5289 /** @todo CPU/VM detection possible! \#AC might not be signal for
5290 * all/any misalignment sizes, intel says its an implementation detail. */
5291 if ( (pCtx->cr0 & X86_CR0_AM)
5292 && pCtx->eflags.Bits.u1AC
5293 && pIemCpu->uCpl == 3)
5294 return iemRaiseAlignmentCheckException(pIemCpu);
5295 return iemRaiseGeneralProtectionFault0(pIemCpu);
5296 }
5297 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5298
5299 /*
5300 * Access the memory.
5301 */
5302 void *pvMem512;
5303 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5304 if (rcStrict != VINF_SUCCESS)
5305 return rcStrict;
5306 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
5307
5308 /*
5309 * Store the registers.
5310 */
5311 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5312 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
5313
5314 /* common for all formats */
5315 pDst->FCW = pCtx->fpu.FCW;
5316 pDst->FSW = pCtx->fpu.FSW;
5317 pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
5318 pDst->FOP = pCtx->fpu.FOP;
5319 pDst->MXCSR = pCtx->fpu.MXCSR;
5320 pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
5321 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
5322 {
5323 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
5324 * them for now... */
5325 pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5326 pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5327 pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
5328 pDst->aRegs[i].au32[3] = 0;
5329 }
5330
5331 /* FPU IP, CS, DP and DS. */
5332 /** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
5333 * state information. :-/
5334 * Storing zeros now to prevent any potential leakage of host info. */
5335 pDst->FPUIP = 0;
5336 pDst->CS = 0;
5337 pDst->Rsrvd1 = 0;
5338 pDst->FPUDP = 0;
5339 pDst->DS = 0;
5340 pDst->Rsrvd2 = 0;
5341
5342 /* XMM registers. */
5343 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5344 || pIemCpu->enmCpuMode != IEMMODE_64BIT
5345 || pIemCpu->uCpl != 0)
5346 {
5347 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5348 for (uint32_t i = 0; i < cXmmRegs; i++)
5349 pDst->aXMM[i] = pCtx->fpu.aXMM[i];
5350 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
5351 * right? */
5352 }
5353
5354 /*
5355 * Commit the memory.
5356 */
5357 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5358 if (rcStrict != VINF_SUCCESS)
5359 return rcStrict;
5360
5361 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5362 return VINF_SUCCESS;
5363}
5364
5365
5366/**
5367 * Implements 'FXRSTOR'.
5368 *
5369 * @param GCPtrEff The address of the image.
5370 * @param enmEffOpSize The operand size (only REX.W really matters).
5371 */
5372IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
5373{
5374 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5375
5376 /*
5377 * Raise exceptions.
5378 */
5379 if (pCtx->cr0 & X86_CR0_EM)
5380 return iemRaiseUndefinedOpcode(pIemCpu);
5381 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
5382 return iemRaiseDeviceNotAvailable(pIemCpu);
5383 if (GCPtrEff & 15)
5384 {
5385 /** @todo CPU/VM detection possible! \#AC might not be signal for
5386 * all/any misalignment sizes, intel says its an implementation detail. */
5387 if ( (pCtx->cr0 & X86_CR0_AM)
5388 && pCtx->eflags.Bits.u1AC
5389 && pIemCpu->uCpl == 3)
5390 return iemRaiseAlignmentCheckException(pIemCpu);
5391 return iemRaiseGeneralProtectionFault0(pIemCpu);
5392 }
5393 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
5394
5395 /*
5396 * Access the memory.
5397 */
5398 void *pvMem512;
5399 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
5400 if (rcStrict != VINF_SUCCESS)
5401 return rcStrict;
5402 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
5403
5404 /*
5405 * Check the state for stuff which will GP(0).
5406 */
5407 uint32_t const fMXCSR = pSrc->MXCSR;
5408 uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
5409 if (fMXCSR & ~fMXCSR_MASK)
5410 {
5411 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
5412 return iemRaiseGeneralProtectionFault0(pIemCpu);
5413 }
5414
5415 /*
5416 * Load the registers.
5417 */
5418 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
5419 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
5420
5421 /* common for all formats */
5422 pCtx->fpu.FCW = pSrc->FCW;
5423 pCtx->fpu.FSW = pSrc->FSW;
5424 pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
5425 pCtx->fpu.FOP = pSrc->FOP;
5426 pCtx->fpu.MXCSR = fMXCSR;
5427 /* (MXCSR_MASK is read-only) */
5428 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
5429 {
5430 pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
5431 pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
5432 pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
5433 pCtx->fpu.aRegs[i].au32[3] = 0;
5434 }
5435
5436 /* FPU IP, CS, DP and DS. */
5437 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
5438 {
5439 pCtx->fpu.FPUIP = pSrc->FPUIP;
5440 pCtx->fpu.CS = pSrc->CS;
5441 pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
5442 pCtx->fpu.FPUDP = pSrc->FPUDP;
5443 pCtx->fpu.DS = pSrc->DS;
5444 pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
5445 }
5446 else
5447 {
5448 pCtx->fpu.FPUIP = pSrc->FPUIP;
5449 pCtx->fpu.CS = pSrc->CS;
5450 pCtx->fpu.Rsrvd1 = 0;
5451 pCtx->fpu.FPUDP = pSrc->FPUDP;
5452 pCtx->fpu.DS = pSrc->DS;
5453 pCtx->fpu.Rsrvd2 = 0;
5454 }
5455
5456 /* XMM registers. */
5457 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
5458 || pIemCpu->enmCpuMode != IEMMODE_64BIT
5459 || pIemCpu->uCpl != 0)
5460 {
5461 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
5462 for (uint32_t i = 0; i < cXmmRegs; i++)
5463 pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
5464 }
5465
5466 /*
5467 * Commit the memory.
5468 */
5469 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
5470 if (rcStrict != VINF_SUCCESS)
5471 return rcStrict;
5472
5473 iemHlpUsedFpu(pIemCpu);
5474 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5475 return VINF_SUCCESS;
5476}
5477
5478
5479/**
5480 * Commmon routine for fnstenv and fnsave.
5481 *
5482 * @param uPtr Where to store the state.
5483 * @param pCtx The CPU context.
5484 */
5485static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
5486{
5487 if (enmEffOpSize == IEMMODE_16BIT)
5488 {
5489 uPtr.pu16[0] = pCtx->fpu.FCW;
5490 uPtr.pu16[1] = pCtx->fpu.FSW;
5491 uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
5492 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5493 {
5494 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
5495 * protected mode or long mode and we save it in real mode? And vice
5496 * versa? And with 32-bit operand size? I think CPU is storing the
5497 * effective address ((CS << 4) + IP) in the offset register and not
5498 * doing any address calculations here. */
5499 uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
5500 uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) | pCtx->fpu.FOP;
5501 uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
5502 uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
5503 }
5504 else
5505 {
5506 uPtr.pu16[3] = pCtx->fpu.FPUIP;
5507 uPtr.pu16[4] = pCtx->fpu.CS;
5508 uPtr.pu16[5] = pCtx->fpu.FPUDP;
5509 uPtr.pu16[6] = pCtx->fpu.DS;
5510 }
5511 }
5512 else
5513 {
5514 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
5515 uPtr.pu16[0*2] = pCtx->fpu.FCW;
5516 uPtr.pu16[1*2] = pCtx->fpu.FSW;
5517 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
5518 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5519 {
5520 uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
5521 uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) | pCtx->fpu.FOP;
5522 uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
5523 uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
5524 }
5525 else
5526 {
5527 uPtr.pu32[3] = pCtx->fpu.FPUIP;
5528 uPtr.pu16[4*2] = pCtx->fpu.CS;
5529 uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
5530 uPtr.pu32[5] = pCtx->fpu.FPUDP;
5531 uPtr.pu16[6*2] = pCtx->fpu.DS;
5532 }
5533 }
5534}
5535
5536
5537/**
5538 * Commmon routine for fldenv and frstor
5539 *
5540 * @param uPtr Where to store the state.
5541 * @param pCtx The CPU context.
5542 */
5543static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
5544{
5545 if (enmEffOpSize == IEMMODE_16BIT)
5546 {
5547 pCtx->fpu.FCW = uPtr.pu16[0];
5548 pCtx->fpu.FSW = uPtr.pu16[1];
5549 pCtx->fpu.FTW = uPtr.pu16[2];
5550 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5551 {
5552 pCtx->fpu.FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
5553 pCtx->fpu.FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
5554 pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
5555 pCtx->fpu.CS = 0;
5556 pCtx->fpu.Rsrvd1= 0;
5557 pCtx->fpu.DS = 0;
5558 pCtx->fpu.Rsrvd2= 0;
5559 }
5560 else
5561 {
5562 pCtx->fpu.FPUIP = uPtr.pu16[3];
5563 pCtx->fpu.CS = uPtr.pu16[4];
5564 pCtx->fpu.Rsrvd1= 0;
5565 pCtx->fpu.FPUDP = uPtr.pu16[5];
5566 pCtx->fpu.DS = uPtr.pu16[6];
5567 pCtx->fpu.Rsrvd2= 0;
5568 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
5569 }
5570 }
5571 else
5572 {
5573 pCtx->fpu.FCW = uPtr.pu16[0*2];
5574 pCtx->fpu.FSW = uPtr.pu16[1*2];
5575 pCtx->fpu.FTW = uPtr.pu16[2*2];
5576 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
5577 {
5578 pCtx->fpu.FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
5579 pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
5580 pCtx->fpu.FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
5581 pCtx->fpu.CS = 0;
5582 pCtx->fpu.Rsrvd1= 0;
5583 pCtx->fpu.DS = 0;
5584 pCtx->fpu.Rsrvd2= 0;
5585 }
5586 else
5587 {
5588 pCtx->fpu.FPUIP = uPtr.pu32[3];
5589 pCtx->fpu.CS = uPtr.pu16[4*2];
5590 pCtx->fpu.Rsrvd1= 0;
5591 pCtx->fpu.FOP = uPtr.pu16[4*2+1];
5592 pCtx->fpu.FPUDP = uPtr.pu32[5];
5593 pCtx->fpu.DS = uPtr.pu16[6*2];
5594 pCtx->fpu.Rsrvd2= 0;
5595 }
5596 }
5597
5598 /* Make adjustments. */
5599 pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
5600 pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
5601 iemFpuRecalcExceptionStatus(pCtx);
5602 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
5603 * exceptions are pending after loading the saved state? */
5604}
5605
5606
5607/**
5608 * Implements 'FNSTENV'.
5609 *
5610 * @param enmEffOpSize The operand size (only REX.W really matters).
5611 * @param iEffSeg The effective segment register for @a GCPtrEff.
5612 * @param GCPtrEffDst The address of the image.
5613 */
5614IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5615{
5616 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5617 RTPTRUNION uPtr;
5618 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5619 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5620 if (rcStrict != VINF_SUCCESS)
5621 return rcStrict;
5622
5623 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5624
5625 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5626 if (rcStrict != VINF_SUCCESS)
5627 return rcStrict;
5628
5629 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5630 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5631 return VINF_SUCCESS;
5632}
5633
5634
5635/**
5636 * Implements 'FNSAVE'.
5637 *
5638 * @param GCPtrEffDst The address of the image.
5639 * @param enmEffOpSize The operand size.
5640 */
5641IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5642{
5643 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5644 RTPTRUNION uPtr;
5645 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5646 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5647 if (rcStrict != VINF_SUCCESS)
5648 return rcStrict;
5649
5650 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5651 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5652 for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5653 {
5654 paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
5655 paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
5656 paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
5657 }
5658
5659 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
5660 if (rcStrict != VINF_SUCCESS)
5661 return rcStrict;
5662
5663 /*
5664 * Re-initialize the FPU.
5665 */
5666 pCtx->fpu.FCW = 0x37f;
5667 pCtx->fpu.FSW = 0;
5668 pCtx->fpu.FTW = 0x00; /* 0 - empty */
5669 pCtx->fpu.FPUDP = 0;
5670 pCtx->fpu.DS = 0;
5671 pCtx->fpu.Rsrvd2= 0;
5672 pCtx->fpu.FPUIP = 0;
5673 pCtx->fpu.CS = 0;
5674 pCtx->fpu.Rsrvd1= 0;
5675 pCtx->fpu.FOP = 0;
5676
5677 iemHlpUsedFpu(pIemCpu);
5678 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5679 return VINF_SUCCESS;
5680}
5681
5682
5683
5684/**
5685 * Implements 'FLDENV'.
5686 *
5687 * @param enmEffOpSize The operand size (only REX.W really matters).
5688 * @param iEffSeg The effective segment register for @a GCPtrEff.
5689 * @param GCPtrEffSrc The address of the image.
5690 */
5691IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5692{
5693 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5694 RTCPTRUNION uPtr;
5695 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
5696 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5697 if (rcStrict != VINF_SUCCESS)
5698 return rcStrict;
5699
5700 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5701
5702 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5703 if (rcStrict != VINF_SUCCESS)
5704 return rcStrict;
5705
5706 iemHlpUsedFpu(pIemCpu);
5707 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5708 return VINF_SUCCESS;
5709}
5710
5711
5712/**
5713 * Implements 'FRSTOR'.
5714 *
5715 * @param GCPtrEffSrc The address of the image.
5716 * @param enmEffOpSize The operand size.
5717 */
5718IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
5719{
5720 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5721 RTCPTRUNION uPtr;
5722 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
5723 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
5724 if (rcStrict != VINF_SUCCESS)
5725 return rcStrict;
5726
5727 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
5728 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
5729 for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
5730 {
5731 pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
5732 pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
5733 pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
5734 pCtx->fpu.aRegs[i].au32[3] = 0;
5735 }
5736
5737 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
5738 if (rcStrict != VINF_SUCCESS)
5739 return rcStrict;
5740
5741 iemHlpUsedFpu(pIemCpu);
5742 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5743 return VINF_SUCCESS;
5744}
5745
5746
5747/**
5748 * Implements 'FLDCW'.
5749 *
5750 * @param u16Fcw The new FCW.
5751 */
5752IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
5753{
5754 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5755
5756 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
5757 /** @todo Testcase: Try see what happens when trying to set undefined bits
5758 * (other than 6 and 7). Currently ignoring them. */
5759 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
5760 * according to FSW. (This is was is currently implemented.) */
5761 pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
5762 iemFpuRecalcExceptionStatus(pCtx);
5763
5764 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
5765 iemHlpUsedFpu(pIemCpu);
5766 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5767 return VINF_SUCCESS;
5768}
5769
5770
5771
5772/**
5773 * Implements the underflow case of fxch.
5774 *
5775 * @param iStReg The other stack register.
5776 */
5777IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
5778{
5779 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5780
5781 unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
5782 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5783 Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) || !(RT_BIT(iReg2) & pCtx->fpu.FTW));
5784
5785 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
5786 * registers are read as QNaN and then exchanged. This could be
5787 * wrong... */
5788 if (pCtx->fpu.FCW & X86_FCW_IM)
5789 {
5790 if (RT_BIT(iReg1) & pCtx->fpu.FTW)
5791 {
5792 if (RT_BIT(iReg2) & pCtx->fpu.FTW)
5793 iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5794 else
5795 pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
5796 iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
5797 }
5798 else
5799 {
5800 pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
5801 iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
5802 }
5803 pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
5804 pCtx->fpu.FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
5805 }
5806 else
5807 {
5808 /* raise underflow exception, don't change anything. */
5809 pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
5810 pCtx->fpu.FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
5811 }
5812
5813 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5814 iemHlpUsedFpu(pIemCpu);
5815 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5816 return VINF_SUCCESS;
5817}
5818
5819
5820/**
5821 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
5822 *
5823 * @param cToAdd 1 or 7.
5824 */
5825IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
5826{
5827 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
5828 Assert(iStReg < 8);
5829
5830 /*
5831 * Raise exceptions.
5832 */
5833 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
5834 return iemRaiseDeviceNotAvailable(pIemCpu);
5835 uint16_t u16Fsw = pCtx->fpu.FSW;
5836 if (u16Fsw & X86_FSW_ES)
5837 return iemRaiseMathFault(pIemCpu);
5838
5839 /*
5840 * Check if any of the register accesses causes #SF + #IA.
5841 */
5842 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
5843 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
5844 if ((pCtx->fpu.FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
5845 {
5846 uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
5847 pCtx->fpu.FSW &= ~X86_FSW_C1;
5848 pCtx->fpu.FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
5849 if ( !(u16Fsw & X86_FSW_IE)
5850 || (pCtx->fpu.FCW & X86_FCW_IM) )
5851 {
5852 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
5853 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
5854 }
5855 }
5856 else if (pCtx->fpu.FCW & X86_FCW_IM)
5857 {
5858 /* Masked underflow. */
5859 pCtx->fpu.FSW &= ~X86_FSW_C1;
5860 pCtx->fpu.FSW |= X86_FSW_IE | X86_FSW_SF;
5861 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
5862 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
5863 }
5864 else
5865 {
5866 /* Raise underflow - don't touch EFLAGS or TOP. */
5867 pCtx->fpu.FSW &= ~X86_FSW_C1;
5868 pCtx->fpu.FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
5869 fPop = false;
5870 }
5871
5872 /*
5873 * Pop if necessary.
5874 */
5875 if (fPop)
5876 {
5877 pCtx->fpu.FTW &= ~RT_BIT(iReg1);
5878 pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
5879 pCtx->fpu.FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
5880 }
5881
5882 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
5883 iemHlpUsedFpu(pIemCpu);
5884 iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
5885 return VINF_SUCCESS;
5886}
5887
5888/** @} */
5889
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette