VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 72193

Last change on this file since 72193 was 72181, checked in by vboxsync, 7 years ago

IEM: Allow 32-bit code in real mode like real CPUs do; fixed real mode far call with 32-bit operand size. See bugref:5653
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 284.5 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 72181 2018-05-09 18:26:28Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18#ifdef VBOX_WITH_NESTED_HWVIRT
19# include "IEMAllCImplSvmInstr.cpp.h"
20#endif
21
22/** @name Misc Helpers
23 * @{
24 */
25
26
27/**
28 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
29 *
30 * @returns Strict VBox status code.
31 *
32 * @param pVCpu The cross context virtual CPU structure of the calling thread.
33 * @param pCtx The register context.
34 * @param u16Port The port number.
35 * @param cbOperand The operand size.
36 */
37static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
38{
39 /* The TSS bits we're interested in are the same on 386 and AMD64. */
40 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
41 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
42 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
43 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
44
45 /*
46 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
47 */
48 Assert(!pCtx->tr.Attr.n.u1DescType);
49 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
50 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
51 {
52 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
53 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
54 return iemRaiseGeneralProtectionFault0(pVCpu);
55 }
56
57 /*
58 * Read the bitmap offset (may #PF).
59 */
60 uint16_t offBitmap;
61 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
62 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
63 if (rcStrict != VINF_SUCCESS)
64 {
65 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
66 return rcStrict;
67 }
68
69 /*
70 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
71 * describes the CPU actually reading two bytes regardless of whether the
72 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
73 */
74 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
75 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
76 * for instance sizeof(X86TSS32). */
77 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
78 {
79 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
80 offFirstBit, pCtx->tr.u32Limit));
81 return iemRaiseGeneralProtectionFault0(pVCpu);
82 }
83
84 /*
85 * Read the necessary bits.
86 */
87 /** @todo Test the assertion in the intel manual that the CPU reads two
88 * bytes. The question is how this works wrt to #PF and #GP on the
89 * 2nd byte when it's not required. */
90 uint16_t bmBytes = UINT16_MAX;
91 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
92 if (rcStrict != VINF_SUCCESS)
93 {
94 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
95 return rcStrict;
96 }
97
98 /*
99 * Perform the check.
100 */
101 uint16_t fPortMask = (1 << cbOperand) - 1;
102 bmBytes >>= (u16Port & 7);
103 if (bmBytes & fPortMask)
104 {
105 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
106 u16Port, cbOperand, bmBytes, fPortMask));
107 return iemRaiseGeneralProtectionFault0(pVCpu);
108 }
109
110 return VINF_SUCCESS;
111}
112
113
114/**
115 * Checks if we are allowed to access the given I/O port, raising the
116 * appropriate exceptions if we aren't (or if the I/O bitmap is not
117 * accessible).
118 *
119 * @returns Strict VBox status code.
120 *
121 * @param pVCpu The cross context virtual CPU structure of the calling thread.
122 * @param pCtx The register context.
123 * @param u16Port The port number.
124 * @param cbOperand The operand size.
125 */
126DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
127{
128 X86EFLAGS Efl;
129 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
130 if ( (pCtx->cr0 & X86_CR0_PE)
131 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
132 || Efl.Bits.u1VM) )
133 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
134 return VINF_SUCCESS;
135}
136
137
138#if 0
139/**
140 * Calculates the parity bit.
141 *
142 * @returns true if the bit is set, false if not.
143 * @param u8Result The least significant byte of the result.
144 */
145static bool iemHlpCalcParityFlag(uint8_t u8Result)
146{
147 /*
148 * Parity is set if the number of bits in the least significant byte of
149 * the result is even.
150 */
151 uint8_t cBits;
152 cBits = u8Result & 1; /* 0 */
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1;
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1; /* 4 */
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 u8Result >>= 1;
164 cBits += u8Result & 1;
165 u8Result >>= 1;
166 cBits += u8Result & 1;
167 return !(cBits & 1);
168}
169#endif /* not used */
170
171
172/**
173 * Updates the specified flags according to a 8-bit result.
174 *
175 * @param pVCpu The cross context virtual CPU structure of the calling thread.
176 * @param u8Result The result to set the flags according to.
177 * @param fToUpdate The flags to update.
178 * @param fUndefined The flags that are specified as undefined.
179 */
180static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
181{
182 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
183
184 uint32_t fEFlags = pCtx->eflags.u;
185 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
186 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
187 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
188#ifdef IEM_VERIFICATION_MODE_FULL
189 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
190#endif
191}
192
193
194/**
195 * Updates the specified flags according to a 16-bit result.
196 *
197 * @param pVCpu The cross context virtual CPU structure of the calling thread.
198 * @param u16Result The result to set the flags according to.
199 * @param fToUpdate The flags to update.
200 * @param fUndefined The flags that are specified as undefined.
201 */
202static void iemHlpUpdateArithEFlagsU16(PVMCPU pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
203{
204 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
205
206 uint32_t fEFlags = pCtx->eflags.u;
207 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
208 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
209 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
210#ifdef IEM_VERIFICATION_MODE_FULL
211 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
212#endif
213}
214
215
216/**
217 * Helper used by iret.
218 *
219 * @param pVCpu The cross context virtual CPU structure of the calling thread.
220 * @param uCpl The new CPL.
221 * @param pSReg Pointer to the segment register.
222 */
223static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
224{
225#ifdef VBOX_WITH_RAW_MODE_NOT_R0
226 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
227 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
228#else
229 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
230#endif
231
232 if ( uCpl > pSReg->Attr.n.u2Dpl
233 && pSReg->Attr.n.u1DescType /* code or data, not system */
234 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
235 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
236 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
237}
238
239
240/**
241 * Indicates that we have modified the FPU state.
242 *
243 * @param pVCpu The cross context virtual CPU structure of the calling thread.
244 */
245DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
246{
247 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
248}
249
250/** @} */
251
252/** @name C Implementations
253 * @{
254 */
255
256/**
257 * Implements a 16-bit popa.
258 */
259IEM_CIMPL_DEF_0(iemCImpl_popa_16)
260{
261 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
262 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
263 RTGCPTR GCPtrLast = GCPtrStart + 15;
264 VBOXSTRICTRC rcStrict;
265
266 /*
267 * The docs are a bit hard to comprehend here, but it looks like we wrap
268 * around in real mode as long as none of the individual "popa" crosses the
269 * end of the stack segment. In protected mode we check the whole access
270 * in one go. For efficiency, only do the word-by-word thing if we're in
271 * danger of wrapping around.
272 */
273 /** @todo do popa boundary / wrap-around checks. */
274 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
275 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
276 {
277 /* word-by-word */
278 RTUINT64U TmpRsp;
279 TmpRsp.u = pCtx->rsp;
280 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
281 if (rcStrict == VINF_SUCCESS)
282 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
283 if (rcStrict == VINF_SUCCESS)
284 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
285 if (rcStrict == VINF_SUCCESS)
286 {
287 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
288 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
289 }
290 if (rcStrict == VINF_SUCCESS)
291 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
292 if (rcStrict == VINF_SUCCESS)
293 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
294 if (rcStrict == VINF_SUCCESS)
295 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
296 if (rcStrict == VINF_SUCCESS)
297 {
298 pCtx->rsp = TmpRsp.u;
299 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
300 }
301 }
302 else
303 {
304 uint16_t const *pa16Mem = NULL;
305 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
306 if (rcStrict == VINF_SUCCESS)
307 {
308 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
309 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
310 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
311 /* skip sp */
312 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
313 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
314 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
315 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
316 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
317 if (rcStrict == VINF_SUCCESS)
318 {
319 iemRegAddToRsp(pVCpu, pCtx, 16);
320 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
321 }
322 }
323 }
324 return rcStrict;
325}
326
327
328/**
329 * Implements a 32-bit popa.
330 */
331IEM_CIMPL_DEF_0(iemCImpl_popa_32)
332{
333 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
334 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
335 RTGCPTR GCPtrLast = GCPtrStart + 31;
336 VBOXSTRICTRC rcStrict;
337
338 /*
339 * The docs are a bit hard to comprehend here, but it looks like we wrap
340 * around in real mode as long as none of the individual "popa" crosses the
341 * end of the stack segment. In protected mode we check the whole access
342 * in one go. For efficiency, only do the word-by-word thing if we're in
343 * danger of wrapping around.
344 */
345 /** @todo do popa boundary / wrap-around checks. */
346 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
347 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
348 {
349 /* word-by-word */
350 RTUINT64U TmpRsp;
351 TmpRsp.u = pCtx->rsp;
352 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
353 if (rcStrict == VINF_SUCCESS)
354 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
355 if (rcStrict == VINF_SUCCESS)
356 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
357 if (rcStrict == VINF_SUCCESS)
358 {
359 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
360 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
361 }
362 if (rcStrict == VINF_SUCCESS)
363 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
364 if (rcStrict == VINF_SUCCESS)
365 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
366 if (rcStrict == VINF_SUCCESS)
367 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
368 if (rcStrict == VINF_SUCCESS)
369 {
370#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
371 pCtx->rdi &= UINT32_MAX;
372 pCtx->rsi &= UINT32_MAX;
373 pCtx->rbp &= UINT32_MAX;
374 pCtx->rbx &= UINT32_MAX;
375 pCtx->rdx &= UINT32_MAX;
376 pCtx->rcx &= UINT32_MAX;
377 pCtx->rax &= UINT32_MAX;
378#endif
379 pCtx->rsp = TmpRsp.u;
380 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
381 }
382 }
383 else
384 {
385 uint32_t const *pa32Mem;
386 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
387 if (rcStrict == VINF_SUCCESS)
388 {
389 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
390 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
391 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
392 /* skip esp */
393 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
394 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
395 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
396 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
397 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
398 if (rcStrict == VINF_SUCCESS)
399 {
400 iemRegAddToRsp(pVCpu, pCtx, 32);
401 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
402 }
403 }
404 }
405 return rcStrict;
406}
407
408
409/**
410 * Implements a 16-bit pusha.
411 */
412IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
413{
414 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
415 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
416 RTGCPTR GCPtrBottom = GCPtrTop - 15;
417 VBOXSTRICTRC rcStrict;
418
419 /*
420 * The docs are a bit hard to comprehend here, but it looks like we wrap
421 * around in real mode as long as none of the individual "pushd" crosses the
422 * end of the stack segment. In protected mode we check the whole access
423 * in one go. For efficiency, only do the word-by-word thing if we're in
424 * danger of wrapping around.
425 */
426 /** @todo do pusha boundary / wrap-around checks. */
427 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
428 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
429 {
430 /* word-by-word */
431 RTUINT64U TmpRsp;
432 TmpRsp.u = pCtx->rsp;
433 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
434 if (rcStrict == VINF_SUCCESS)
435 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
436 if (rcStrict == VINF_SUCCESS)
437 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
438 if (rcStrict == VINF_SUCCESS)
439 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
440 if (rcStrict == VINF_SUCCESS)
441 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
442 if (rcStrict == VINF_SUCCESS)
443 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
444 if (rcStrict == VINF_SUCCESS)
445 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
446 if (rcStrict == VINF_SUCCESS)
447 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
448 if (rcStrict == VINF_SUCCESS)
449 {
450 pCtx->rsp = TmpRsp.u;
451 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
452 }
453 }
454 else
455 {
456 GCPtrBottom--;
457 uint16_t *pa16Mem = NULL;
458 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
459 if (rcStrict == VINF_SUCCESS)
460 {
461 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
462 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
463 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
464 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
465 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
466 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
467 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
468 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
469 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
470 if (rcStrict == VINF_SUCCESS)
471 {
472 iemRegSubFromRsp(pVCpu, pCtx, 16);
473 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
474 }
475 }
476 }
477 return rcStrict;
478}
479
480
481/**
482 * Implements a 32-bit pusha.
483 */
484IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
485{
486 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
487 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
488 RTGCPTR GCPtrBottom = GCPtrTop - 31;
489 VBOXSTRICTRC rcStrict;
490
491 /*
492 * The docs are a bit hard to comprehend here, but it looks like we wrap
493 * around in real mode as long as none of the individual "pusha" crosses the
494 * end of the stack segment. In protected mode we check the whole access
495 * in one go. For efficiency, only do the word-by-word thing if we're in
496 * danger of wrapping around.
497 */
498 /** @todo do pusha boundary / wrap-around checks. */
499 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
500 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
501 {
502 /* word-by-word */
503 RTUINT64U TmpRsp;
504 TmpRsp.u = pCtx->rsp;
505 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
506 if (rcStrict == VINF_SUCCESS)
507 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
508 if (rcStrict == VINF_SUCCESS)
509 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
510 if (rcStrict == VINF_SUCCESS)
511 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
512 if (rcStrict == VINF_SUCCESS)
513 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
514 if (rcStrict == VINF_SUCCESS)
515 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
516 if (rcStrict == VINF_SUCCESS)
517 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
518 if (rcStrict == VINF_SUCCESS)
519 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
520 if (rcStrict == VINF_SUCCESS)
521 {
522 pCtx->rsp = TmpRsp.u;
523 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
524 }
525 }
526 else
527 {
528 GCPtrBottom--;
529 uint32_t *pa32Mem;
530 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
531 if (rcStrict == VINF_SUCCESS)
532 {
533 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
534 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
535 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
536 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
537 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
538 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
539 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
540 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
541 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
542 if (rcStrict == VINF_SUCCESS)
543 {
544 iemRegSubFromRsp(pVCpu, pCtx, 32);
545 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
546 }
547 }
548 }
549 return rcStrict;
550}
551
552
553/**
554 * Implements pushf.
555 *
556 *
557 * @param enmEffOpSize The effective operand size.
558 */
559IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
560{
561 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
562 VBOXSTRICTRC rcStrict;
563
564 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
565 {
566 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
567 IEM_SVM_UPDATE_NRIP(pVCpu);
568 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
569 }
570
571 /*
572 * If we're in V8086 mode some care is required (which is why we're in
573 * doing this in a C implementation).
574 */
575 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
576 if ( (fEfl & X86_EFL_VM)
577 && X86_EFL_GET_IOPL(fEfl) != 3 )
578 {
579 Assert(pCtx->cr0 & X86_CR0_PE);
580 if ( enmEffOpSize != IEMMODE_16BIT
581 || !(pCtx->cr4 & X86_CR4_VME))
582 return iemRaiseGeneralProtectionFault0(pVCpu);
583 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
584 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
585 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
586 }
587 else
588 {
589
590 /*
591 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
592 */
593 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
594
595 switch (enmEffOpSize)
596 {
597 case IEMMODE_16BIT:
598 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
599 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
600 fEfl |= UINT16_C(0xf000);
601 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
602 break;
603 case IEMMODE_32BIT:
604 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
605 break;
606 case IEMMODE_64BIT:
607 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
608 break;
609 IEM_NOT_REACHED_DEFAULT_CASE_RET();
610 }
611 }
612 if (rcStrict != VINF_SUCCESS)
613 return rcStrict;
614
615 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
616 return VINF_SUCCESS;
617}
618
619
620/**
621 * Implements popf.
622 *
623 * @param enmEffOpSize The effective operand size.
624 */
625IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
626{
627 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
628 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
629 VBOXSTRICTRC rcStrict;
630 uint32_t fEflNew;
631
632 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
633 {
634 Log2(("popf: Guest intercept -> #VMEXIT\n"));
635 IEM_SVM_UPDATE_NRIP(pVCpu);
636 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
637 }
638
639 /*
640 * V8086 is special as usual.
641 */
642 if (fEflOld & X86_EFL_VM)
643 {
644 /*
645 * Almost anything goes if IOPL is 3.
646 */
647 if (X86_EFL_GET_IOPL(fEflOld) == 3)
648 {
649 switch (enmEffOpSize)
650 {
651 case IEMMODE_16BIT:
652 {
653 uint16_t u16Value;
654 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
655 if (rcStrict != VINF_SUCCESS)
656 return rcStrict;
657 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
658 break;
659 }
660 case IEMMODE_32BIT:
661 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
662 if (rcStrict != VINF_SUCCESS)
663 return rcStrict;
664 break;
665 IEM_NOT_REACHED_DEFAULT_CASE_RET();
666 }
667
668 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
669 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
670 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
671 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
672 }
673 /*
674 * Interrupt flag virtualization with CR4.VME=1.
675 */
676 else if ( enmEffOpSize == IEMMODE_16BIT
677 && (pCtx->cr4 & X86_CR4_VME) )
678 {
679 uint16_t u16Value;
680 RTUINT64U TmpRsp;
681 TmpRsp.u = pCtx->rsp;
682 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
683 if (rcStrict != VINF_SUCCESS)
684 return rcStrict;
685
686 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
687 * or before? */
688 if ( ( (u16Value & X86_EFL_IF)
689 && (fEflOld & X86_EFL_VIP))
690 || (u16Value & X86_EFL_TF) )
691 return iemRaiseGeneralProtectionFault0(pVCpu);
692
693 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
694 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
695 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
696 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
697
698 pCtx->rsp = TmpRsp.u;
699 }
700 else
701 return iemRaiseGeneralProtectionFault0(pVCpu);
702
703 }
704 /*
705 * Not in V8086 mode.
706 */
707 else
708 {
709 /* Pop the flags. */
710 switch (enmEffOpSize)
711 {
712 case IEMMODE_16BIT:
713 {
714 uint16_t u16Value;
715 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
716 if (rcStrict != VINF_SUCCESS)
717 return rcStrict;
718 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
719
720 /*
721 * Ancient CPU adjustments:
722 * - 8086, 80186, V20/30:
723 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
724 * practical reasons (masking below). We add them when pushing flags.
725 * - 80286:
726 * The NT and IOPL flags cannot be popped from real mode and are
727 * therefore always zero (since a 286 can never exit from PM and
728 * their initial value is zero). This changed on a 386 and can
729 * therefore be used to detect 286 or 386 CPU in real mode.
730 */
731 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
732 && !(pCtx->cr0 & X86_CR0_PE) )
733 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
734 break;
735 }
736 case IEMMODE_32BIT:
737 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
738 if (rcStrict != VINF_SUCCESS)
739 return rcStrict;
740 break;
741 case IEMMODE_64BIT:
742 {
743 uint64_t u64Value;
744 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
745 if (rcStrict != VINF_SUCCESS)
746 return rcStrict;
747 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
748 break;
749 }
750 IEM_NOT_REACHED_DEFAULT_CASE_RET();
751 }
752
753 /* Merge them with the current flags. */
754 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
755 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
756 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
757 || pVCpu->iem.s.uCpl == 0)
758 {
759 fEflNew &= fPopfBits;
760 fEflNew |= ~fPopfBits & fEflOld;
761 }
762 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
763 {
764 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
765 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
766 }
767 else
768 {
769 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
770 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
771 }
772 }
773
774 /*
775 * Commit the flags.
776 */
777 Assert(fEflNew & RT_BIT_32(1));
778 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
779 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
780
781 return VINF_SUCCESS;
782}
783
784
785/**
786 * Implements an indirect call.
787 *
788 * @param uNewPC The new program counter (RIP) value (loaded from the
789 * operand).
790 * @param enmEffOpSize The effective operand size.
791 */
792IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
793{
794 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
795 uint16_t uOldPC = pCtx->ip + cbInstr;
796 if (uNewPC > pCtx->cs.u32Limit)
797 return iemRaiseGeneralProtectionFault0(pVCpu);
798
799 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
800 if (rcStrict != VINF_SUCCESS)
801 return rcStrict;
802
803 pCtx->rip = uNewPC;
804 pCtx->eflags.Bits.u1RF = 0;
805
806#ifndef IEM_WITH_CODE_TLB
807 /* Flush the prefetch buffer. */
808 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
809#endif
810 return VINF_SUCCESS;
811}
812
813
814/**
815 * Implements a 16-bit relative call.
816 *
817 * @param offDisp The displacment offset.
818 */
819IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
820{
821 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
822 uint16_t uOldPC = pCtx->ip + cbInstr;
823 uint16_t uNewPC = uOldPC + offDisp;
824 if (uNewPC > pCtx->cs.u32Limit)
825 return iemRaiseGeneralProtectionFault0(pVCpu);
826
827 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
828 if (rcStrict != VINF_SUCCESS)
829 return rcStrict;
830
831 pCtx->rip = uNewPC;
832 pCtx->eflags.Bits.u1RF = 0;
833
834#ifndef IEM_WITH_CODE_TLB
835 /* Flush the prefetch buffer. */
836 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
837#endif
838 return VINF_SUCCESS;
839}
840
841
842/**
843 * Implements a 32-bit indirect call.
844 *
845 * @param uNewPC The new program counter (RIP) value (loaded from the
846 * operand).
847 * @param enmEffOpSize The effective operand size.
848 */
849IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
850{
851 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
852 uint32_t uOldPC = pCtx->eip + cbInstr;
853 if (uNewPC > pCtx->cs.u32Limit)
854 return iemRaiseGeneralProtectionFault0(pVCpu);
855
856 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
857 if (rcStrict != VINF_SUCCESS)
858 return rcStrict;
859
860#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
861 /*
862 * CASM hook for recording interesting indirect calls.
863 */
864 if ( !pCtx->eflags.Bits.u1IF
865 && (pCtx->cr0 & X86_CR0_PG)
866 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
867 && pVCpu->iem.s.uCpl == 0)
868 {
869 EMSTATE enmState = EMGetState(pVCpu);
870 if ( enmState == EMSTATE_IEM_THEN_REM
871 || enmState == EMSTATE_IEM
872 || enmState == EMSTATE_REM)
873 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
874 }
875#endif
876
877 pCtx->rip = uNewPC;
878 pCtx->eflags.Bits.u1RF = 0;
879
880#ifndef IEM_WITH_CODE_TLB
881 /* Flush the prefetch buffer. */
882 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
883#endif
884 return VINF_SUCCESS;
885}
886
887
888/**
889 * Implements a 32-bit relative call.
890 *
891 * @param offDisp The displacment offset.
892 */
893IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
894{
895 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
896 uint32_t uOldPC = pCtx->eip + cbInstr;
897 uint32_t uNewPC = uOldPC + offDisp;
898 if (uNewPC > pCtx->cs.u32Limit)
899 return iemRaiseGeneralProtectionFault0(pVCpu);
900
901 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
902 if (rcStrict != VINF_SUCCESS)
903 return rcStrict;
904
905 pCtx->rip = uNewPC;
906 pCtx->eflags.Bits.u1RF = 0;
907
908#ifndef IEM_WITH_CODE_TLB
909 /* Flush the prefetch buffer. */
910 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
911#endif
912 return VINF_SUCCESS;
913}
914
915
916/**
917 * Implements a 64-bit indirect call.
918 *
919 * @param uNewPC The new program counter (RIP) value (loaded from the
920 * operand).
921 * @param enmEffOpSize The effective operand size.
922 */
923IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
924{
925 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
926 uint64_t uOldPC = pCtx->rip + cbInstr;
927 if (!IEM_IS_CANONICAL(uNewPC))
928 return iemRaiseGeneralProtectionFault0(pVCpu);
929
930 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
931 if (rcStrict != VINF_SUCCESS)
932 return rcStrict;
933
934 pCtx->rip = uNewPC;
935 pCtx->eflags.Bits.u1RF = 0;
936
937#ifndef IEM_WITH_CODE_TLB
938 /* Flush the prefetch buffer. */
939 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
940#endif
941 return VINF_SUCCESS;
942}
943
944
945/**
946 * Implements a 64-bit relative call.
947 *
948 * @param offDisp The displacment offset.
949 */
950IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
951{
952 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
953 uint64_t uOldPC = pCtx->rip + cbInstr;
954 uint64_t uNewPC = uOldPC + offDisp;
955 if (!IEM_IS_CANONICAL(uNewPC))
956 return iemRaiseNotCanonical(pVCpu);
957
958 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
959 if (rcStrict != VINF_SUCCESS)
960 return rcStrict;
961
962 pCtx->rip = uNewPC;
963 pCtx->eflags.Bits.u1RF = 0;
964
965#ifndef IEM_WITH_CODE_TLB
966 /* Flush the prefetch buffer. */
967 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
968#endif
969
970 return VINF_SUCCESS;
971}
972
973
974/**
975 * Implements far jumps and calls thru task segments (TSS).
976 *
977 * @param uSel The selector.
978 * @param enmBranch The kind of branching we're performing.
979 * @param enmEffOpSize The effective operand size.
980 * @param pDesc The descriptor corresponding to @a uSel. The type is
981 * task gate.
982 */
983IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
984{
985#ifndef IEM_IMPLEMENTS_TASKSWITCH
986 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
987#else
988 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
989 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
990 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
991 RT_NOREF_PV(enmEffOpSize);
992
993 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
994 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
995 {
996 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
997 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
998 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
999 }
1000
1001 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1002 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1003 * checked here, need testcases. */
1004 if (!pDesc->Legacy.Gen.u1Present)
1005 {
1006 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1007 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1008 }
1009
1010 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1011 uint32_t uNextEip = pCtx->eip + cbInstr;
1012 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1013 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1014#endif
1015}
1016
1017
1018/**
1019 * Implements far jumps and calls thru task gates.
1020 *
1021 * @param uSel The selector.
1022 * @param enmBranch The kind of branching we're performing.
1023 * @param enmEffOpSize The effective operand size.
1024 * @param pDesc The descriptor corresponding to @a uSel. The type is
1025 * task gate.
1026 */
1027IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1028{
1029#ifndef IEM_IMPLEMENTS_TASKSWITCH
1030 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1031#else
1032 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1033 RT_NOREF_PV(enmEffOpSize);
1034
1035 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1036 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1037 {
1038 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1039 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1040 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1041 }
1042
1043 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1044 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1045 * checked here, need testcases. */
1046 if (!pDesc->Legacy.Gen.u1Present)
1047 {
1048 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1049 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1050 }
1051
1052 /*
1053 * Fetch the new TSS descriptor from the GDT.
1054 */
1055 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1056 if (uSelTss & X86_SEL_LDT)
1057 {
1058 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1059 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1060 }
1061
1062 IEMSELDESC TssDesc;
1063 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1064 if (rcStrict != VINF_SUCCESS)
1065 return rcStrict;
1066
1067 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1068 {
1069 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1070 TssDesc.Legacy.Gate.u4Type));
1071 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1072 }
1073
1074 if (!TssDesc.Legacy.Gate.u1Present)
1075 {
1076 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1077 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1078 }
1079
1080 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1081 uint32_t uNextEip = pCtx->eip + cbInstr;
1082 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1083 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1084#endif
1085}
1086
1087
1088/**
1089 * Implements far jumps and calls thru call gates.
1090 *
1091 * @param uSel The selector.
1092 * @param enmBranch The kind of branching we're performing.
1093 * @param enmEffOpSize The effective operand size.
1094 * @param pDesc The descriptor corresponding to @a uSel. The type is
1095 * call gate.
1096 */
1097IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1098{
1099#define IEM_IMPLEMENTS_CALLGATE
1100#ifndef IEM_IMPLEMENTS_CALLGATE
1101 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1102#else
1103 RT_NOREF_PV(enmEffOpSize);
1104
1105 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1106 * inter-privilege calls and are much more complex.
1107 *
1108 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1109 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1110 * must be 16-bit or 32-bit.
1111 */
1112 /** @todo: effective operand size is probably irrelevant here, only the
1113 * call gate bitness matters??
1114 */
1115 VBOXSTRICTRC rcStrict;
1116 RTPTRUNION uPtrRet;
1117 uint64_t uNewRsp;
1118 uint64_t uNewRip;
1119 uint64_t u64Base;
1120 uint32_t cbLimit;
1121 RTSEL uNewCS;
1122 IEMSELDESC DescCS;
1123
1124 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1125 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1126 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1127 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1128
1129 /* Determine the new instruction pointer from the gate descriptor. */
1130 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1131 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1132 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1133
1134 /* Perform DPL checks on the gate descriptor. */
1135 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1136 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1137 {
1138 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1139 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1140 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1141 }
1142
1143 /** @todo does this catch NULL selectors, too? */
1144 if (!pDesc->Legacy.Gen.u1Present)
1145 {
1146 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1147 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1148 }
1149
1150 /*
1151 * Fetch the target CS descriptor from the GDT or LDT.
1152 */
1153 uNewCS = pDesc->Legacy.Gate.u16Sel;
1154 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1155 if (rcStrict != VINF_SUCCESS)
1156 return rcStrict;
1157
1158 /* Target CS must be a code selector. */
1159 if ( !DescCS.Legacy.Gen.u1DescType
1160 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1161 {
1162 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1163 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1164 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1165 }
1166
1167 /* Privilege checks on target CS. */
1168 if (enmBranch == IEMBRANCH_JUMP)
1169 {
1170 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1171 {
1172 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1173 {
1174 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1175 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1176 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1177 }
1178 }
1179 else
1180 {
1181 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1182 {
1183 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1184 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1185 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1186 }
1187 }
1188 }
1189 else
1190 {
1191 Assert(enmBranch == IEMBRANCH_CALL);
1192 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1193 {
1194 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1195 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1196 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1197 }
1198 }
1199
1200 /* Additional long mode checks. */
1201 if (IEM_IS_LONG_MODE(pVCpu))
1202 {
1203 if (!DescCS.Legacy.Gen.u1Long)
1204 {
1205 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1206 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1207 }
1208
1209 /* L vs D. */
1210 if ( DescCS.Legacy.Gen.u1Long
1211 && DescCS.Legacy.Gen.u1DefBig)
1212 {
1213 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1214 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1215 }
1216 }
1217
1218 if (!DescCS.Legacy.Gate.u1Present)
1219 {
1220 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1221 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1222 }
1223
1224 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1225
1226 if (enmBranch == IEMBRANCH_JUMP)
1227 {
1228 /** @todo: This is very similar to regular far jumps; merge! */
1229 /* Jumps are fairly simple... */
1230
1231 /* Chop the high bits off if 16-bit gate (Intel says so). */
1232 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1233 uNewRip = (uint16_t)uNewRip;
1234
1235 /* Limit check for non-long segments. */
1236 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1237 if (DescCS.Legacy.Gen.u1Long)
1238 u64Base = 0;
1239 else
1240 {
1241 if (uNewRip > cbLimit)
1242 {
1243 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1244 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1245 }
1246 u64Base = X86DESC_BASE(&DescCS.Legacy);
1247 }
1248
1249 /* Canonical address check. */
1250 if (!IEM_IS_CANONICAL(uNewRip))
1251 {
1252 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1253 return iemRaiseNotCanonical(pVCpu);
1254 }
1255
1256 /*
1257 * Ok, everything checked out fine. Now set the accessed bit before
1258 * committing the result into CS, CSHID and RIP.
1259 */
1260 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1261 {
1262 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1263 if (rcStrict != VINF_SUCCESS)
1264 return rcStrict;
1265 /** @todo check what VT-x and AMD-V does. */
1266 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1267 }
1268
1269 /* commit */
1270 pCtx->rip = uNewRip;
1271 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1272 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1273 pCtx->cs.ValidSel = pCtx->cs.Sel;
1274 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1275 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1276 pCtx->cs.u32Limit = cbLimit;
1277 pCtx->cs.u64Base = u64Base;
1278 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1279 }
1280 else
1281 {
1282 Assert(enmBranch == IEMBRANCH_CALL);
1283 /* Calls are much more complicated. */
1284
1285 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1286 {
1287 uint16_t offNewStack; /* Offset of new stack in TSS. */
1288 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1289 uint8_t uNewCSDpl;
1290 uint8_t cbWords;
1291 RTSEL uNewSS;
1292 RTSEL uOldSS;
1293 uint64_t uOldRsp;
1294 IEMSELDESC DescSS;
1295 RTPTRUNION uPtrTSS;
1296 RTGCPTR GCPtrTSS;
1297 RTPTRUNION uPtrParmWds;
1298 RTGCPTR GCPtrParmWds;
1299
1300 /* More privilege. This is the fun part. */
1301 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1302
1303 /*
1304 * Determine new SS:rSP from the TSS.
1305 */
1306 Assert(!pCtx->tr.Attr.n.u1DescType);
1307
1308 /* Figure out where the new stack pointer is stored in the TSS. */
1309 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1310 if (!IEM_IS_LONG_MODE(pVCpu))
1311 {
1312 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1313 {
1314 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1315 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1316 }
1317 else
1318 {
1319 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1320 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1321 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1322 }
1323 }
1324 else
1325 {
1326 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1327 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1328 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1329 }
1330
1331 /* Check against TSS limit. */
1332 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1333 {
1334 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1335 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1336 }
1337
1338 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1339 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1340 if (rcStrict != VINF_SUCCESS)
1341 {
1342 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1343 return rcStrict;
1344 }
1345
1346 if (!IEM_IS_LONG_MODE(pVCpu))
1347 {
1348 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1349 {
1350 uNewRsp = uPtrTSS.pu32[0];
1351 uNewSS = uPtrTSS.pu16[2];
1352 }
1353 else
1354 {
1355 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1356 uNewRsp = uPtrTSS.pu16[0];
1357 uNewSS = uPtrTSS.pu16[1];
1358 }
1359 }
1360 else
1361 {
1362 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1363 /* SS will be a NULL selector, but that's valid. */
1364 uNewRsp = uPtrTSS.pu64[0];
1365 uNewSS = uNewCSDpl;
1366 }
1367
1368 /* Done with the TSS now. */
1369 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1370 if (rcStrict != VINF_SUCCESS)
1371 {
1372 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1373 return rcStrict;
1374 }
1375
1376 /* Only used outside of long mode. */
1377 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1378
1379 /* If EFER.LMA is 0, there's extra work to do. */
1380 if (!IEM_IS_LONG_MODE(pVCpu))
1381 {
1382 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1383 {
1384 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1385 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1386 }
1387
1388 /* Grab the new SS descriptor. */
1389 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1390 if (rcStrict != VINF_SUCCESS)
1391 return rcStrict;
1392
1393 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1394 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1395 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1396 {
1397 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1398 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1399 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1400 }
1401
1402 /* Ensure new SS is a writable data segment. */
1403 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1404 {
1405 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1406 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1407 }
1408
1409 if (!DescSS.Legacy.Gen.u1Present)
1410 {
1411 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1412 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1413 }
1414 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1415 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1416 else
1417 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1418 }
1419 else
1420 {
1421 /* Just grab the new (NULL) SS descriptor. */
1422 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1423 * like we do... */
1424 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1425 if (rcStrict != VINF_SUCCESS)
1426 return rcStrict;
1427
1428 cbNewStack = sizeof(uint64_t) * 4;
1429 }
1430
1431 /** @todo: According to Intel, new stack is checked for enough space first,
1432 * then switched. According to AMD, the stack is switched first and
1433 * then pushes might fault!
1434 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1435 * incoming stack #PF happens before actual stack switch. AMD is
1436 * either lying or implicitly assumes that new state is committed
1437 * only if and when an instruction doesn't fault.
1438 */
1439
1440 /** @todo: According to AMD, CS is loaded first, then SS.
1441 * According to Intel, it's the other way around!?
1442 */
1443
1444 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1445
1446 /* Set the accessed bit before committing new SS. */
1447 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1448 {
1449 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1450 if (rcStrict != VINF_SUCCESS)
1451 return rcStrict;
1452 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1453 }
1454
1455 /* Remember the old SS:rSP and their linear address. */
1456 uOldSS = pCtx->ss.Sel;
1457 uOldRsp = pCtx->ss.Attr.n.u1DefBig ? pCtx->rsp : pCtx->sp;
1458
1459 GCPtrParmWds = pCtx->ss.u64Base + uOldRsp;
1460
1461 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1462 or #PF, the former is not implemented in this workaround. */
1463 /** @todo Proper fix callgate target stack exceptions. */
1464 /** @todo testcase: Cover callgates with partially or fully inaccessible
1465 * target stacks. */
1466 void *pvNewFrame;
1467 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1468 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1469 if (rcStrict != VINF_SUCCESS)
1470 {
1471 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1472 return rcStrict;
1473 }
1474 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1475 if (rcStrict != VINF_SUCCESS)
1476 {
1477 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1478 return rcStrict;
1479 }
1480
1481 /* Commit new SS:rSP. */
1482 pCtx->ss.Sel = uNewSS;
1483 pCtx->ss.ValidSel = uNewSS;
1484 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1485 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1486 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1487 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1488 pCtx->rsp = uNewRsp;
1489 pVCpu->iem.s.uCpl = uNewCSDpl;
1490 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1491 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1492
1493 /* At this point the stack access must not fail because new state was already committed. */
1494 /** @todo this can still fail due to SS.LIMIT not check. */
1495 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1496 &uPtrRet.pv, &uNewRsp);
1497 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1498 VERR_INTERNAL_ERROR_5);
1499
1500 if (!IEM_IS_LONG_MODE(pVCpu))
1501 {
1502 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1503 {
1504 /* Push the old CS:rIP. */
1505 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1506 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1507
1508 if (cbWords)
1509 {
1510 /* Map the relevant chunk of the old stack. */
1511 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1512 if (rcStrict != VINF_SUCCESS)
1513 {
1514 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1515 return rcStrict;
1516 }
1517
1518 /* Copy the parameter (d)words. */
1519 for (int i = 0; i < cbWords; ++i)
1520 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1521
1522 /* Unmap the old stack. */
1523 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1524 if (rcStrict != VINF_SUCCESS)
1525 {
1526 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1527 return rcStrict;
1528 }
1529 }
1530
1531 /* Push the old SS:rSP. */
1532 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1533 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1534 }
1535 else
1536 {
1537 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1538
1539 /* Push the old CS:rIP. */
1540 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1541 uPtrRet.pu16[1] = pCtx->cs.Sel;
1542
1543 if (cbWords)
1544 {
1545 /* Map the relevant chunk of the old stack. */
1546 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1547 if (rcStrict != VINF_SUCCESS)
1548 {
1549 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1550 return rcStrict;
1551 }
1552
1553 /* Copy the parameter words. */
1554 for (int i = 0; i < cbWords; ++i)
1555 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1556
1557 /* Unmap the old stack. */
1558 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1559 if (rcStrict != VINF_SUCCESS)
1560 {
1561 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1562 return rcStrict;
1563 }
1564 }
1565
1566 /* Push the old SS:rSP. */
1567 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1568 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1569 }
1570 }
1571 else
1572 {
1573 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1574
1575 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1576 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1577 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1578 uPtrRet.pu64[2] = uOldRsp;
1579 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1580 }
1581
1582 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1583 if (rcStrict != VINF_SUCCESS)
1584 {
1585 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1586 return rcStrict;
1587 }
1588
1589 /* Chop the high bits off if 16-bit gate (Intel says so). */
1590 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1591 uNewRip = (uint16_t)uNewRip;
1592
1593 /* Limit / canonical check. */
1594 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1595 if (!IEM_IS_LONG_MODE(pVCpu))
1596 {
1597 if (uNewRip > cbLimit)
1598 {
1599 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1600 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1601 }
1602 u64Base = X86DESC_BASE(&DescCS.Legacy);
1603 }
1604 else
1605 {
1606 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1607 if (!IEM_IS_CANONICAL(uNewRip))
1608 {
1609 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1610 return iemRaiseNotCanonical(pVCpu);
1611 }
1612 u64Base = 0;
1613 }
1614
1615 /*
1616 * Now set the accessed bit before
1617 * writing the return address to the stack and committing the result into
1618 * CS, CSHID and RIP.
1619 */
1620 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1621 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1622 {
1623 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1624 if (rcStrict != VINF_SUCCESS)
1625 return rcStrict;
1626 /** @todo check what VT-x and AMD-V does. */
1627 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1628 }
1629
1630 /* Commit new CS:rIP. */
1631 pCtx->rip = uNewRip;
1632 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1633 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1634 pCtx->cs.ValidSel = pCtx->cs.Sel;
1635 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1636 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1637 pCtx->cs.u32Limit = cbLimit;
1638 pCtx->cs.u64Base = u64Base;
1639 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1640 }
1641 else
1642 {
1643 /* Same privilege. */
1644 /** @todo: This is very similar to regular far calls; merge! */
1645
1646 /* Check stack first - may #SS(0). */
1647 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1648 * 16-bit code cause a two or four byte CS to be pushed? */
1649 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1650 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1651 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1652 &uPtrRet.pv, &uNewRsp);
1653 if (rcStrict != VINF_SUCCESS)
1654 return rcStrict;
1655
1656 /* Chop the high bits off if 16-bit gate (Intel says so). */
1657 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1658 uNewRip = (uint16_t)uNewRip;
1659
1660 /* Limit / canonical check. */
1661 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1662 if (!IEM_IS_LONG_MODE(pVCpu))
1663 {
1664 if (uNewRip > cbLimit)
1665 {
1666 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1667 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1668 }
1669 u64Base = X86DESC_BASE(&DescCS.Legacy);
1670 }
1671 else
1672 {
1673 if (!IEM_IS_CANONICAL(uNewRip))
1674 {
1675 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1676 return iemRaiseNotCanonical(pVCpu);
1677 }
1678 u64Base = 0;
1679 }
1680
1681 /*
1682 * Now set the accessed bit before
1683 * writing the return address to the stack and committing the result into
1684 * CS, CSHID and RIP.
1685 */
1686 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1687 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1688 {
1689 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1690 if (rcStrict != VINF_SUCCESS)
1691 return rcStrict;
1692 /** @todo check what VT-x and AMD-V does. */
1693 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1694 }
1695
1696 /* stack */
1697 if (!IEM_IS_LONG_MODE(pVCpu))
1698 {
1699 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1700 {
1701 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1702 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1703 }
1704 else
1705 {
1706 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1707 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1708 uPtrRet.pu16[1] = pCtx->cs.Sel;
1709 }
1710 }
1711 else
1712 {
1713 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1714 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1715 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1716 }
1717
1718 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1719 if (rcStrict != VINF_SUCCESS)
1720 return rcStrict;
1721
1722 /* commit */
1723 pCtx->rip = uNewRip;
1724 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1725 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1726 pCtx->cs.ValidSel = pCtx->cs.Sel;
1727 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1728 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1729 pCtx->cs.u32Limit = cbLimit;
1730 pCtx->cs.u64Base = u64Base;
1731 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1732 }
1733 }
1734 pCtx->eflags.Bits.u1RF = 0;
1735
1736 /* Flush the prefetch buffer. */
1737# ifdef IEM_WITH_CODE_TLB
1738 pVCpu->iem.s.pbInstrBuf = NULL;
1739# else
1740 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1741# endif
1742 return VINF_SUCCESS;
1743#endif
1744}
1745
1746
1747/**
1748 * Implements far jumps and calls thru system selectors.
1749 *
1750 * @param uSel The selector.
1751 * @param enmBranch The kind of branching we're performing.
1752 * @param enmEffOpSize The effective operand size.
1753 * @param pDesc The descriptor corresponding to @a uSel.
1754 */
1755IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1756{
1757 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1758 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1759
1760 if (IEM_IS_LONG_MODE(pVCpu))
1761 switch (pDesc->Legacy.Gen.u4Type)
1762 {
1763 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1764 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1765
1766 default:
1767 case AMD64_SEL_TYPE_SYS_LDT:
1768 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1769 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1770 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1771 case AMD64_SEL_TYPE_SYS_INT_GATE:
1772 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1773 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1774 }
1775
1776 switch (pDesc->Legacy.Gen.u4Type)
1777 {
1778 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1779 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1780 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1781
1782 case X86_SEL_TYPE_SYS_TASK_GATE:
1783 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1784
1785 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1786 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1787 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1788
1789 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1790 Log(("branch %04x -> busy 286 TSS\n", uSel));
1791 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1792
1793 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1794 Log(("branch %04x -> busy 386 TSS\n", uSel));
1795 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1796
1797 default:
1798 case X86_SEL_TYPE_SYS_LDT:
1799 case X86_SEL_TYPE_SYS_286_INT_GATE:
1800 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1801 case X86_SEL_TYPE_SYS_386_INT_GATE:
1802 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1803 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1804 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1805 }
1806}
1807
1808
1809/**
1810 * Implements far jumps.
1811 *
1812 * @param uSel The selector.
1813 * @param offSeg The segment offset.
1814 * @param enmEffOpSize The effective operand size.
1815 */
1816IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1817{
1818 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1819 NOREF(cbInstr);
1820 Assert(offSeg <= UINT32_MAX);
1821
1822 /*
1823 * Real mode and V8086 mode are easy. The only snag seems to be that
1824 * CS.limit doesn't change and the limit check is done against the current
1825 * limit.
1826 */
1827 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1828 {
1829 if (offSeg > pCtx->cs.u32Limit)
1830 {
1831 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1832 return iemRaiseGeneralProtectionFault0(pVCpu);
1833 }
1834
1835 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1836 pCtx->rip = offSeg;
1837 else
1838 pCtx->rip = offSeg & UINT16_MAX;
1839 pCtx->cs.Sel = uSel;
1840 pCtx->cs.ValidSel = uSel;
1841 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1842 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1843 pCtx->eflags.Bits.u1RF = 0;
1844 return VINF_SUCCESS;
1845 }
1846
1847 /*
1848 * Protected mode. Need to parse the specified descriptor...
1849 */
1850 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1851 {
1852 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1853 return iemRaiseGeneralProtectionFault0(pVCpu);
1854 }
1855
1856 /* Fetch the descriptor. */
1857 IEMSELDESC Desc;
1858 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1859 if (rcStrict != VINF_SUCCESS)
1860 return rcStrict;
1861
1862 /* Is it there? */
1863 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1864 {
1865 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1866 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1867 }
1868
1869 /*
1870 * Deal with it according to its type. We do the standard code selectors
1871 * here and dispatch the system selectors to worker functions.
1872 */
1873 if (!Desc.Legacy.Gen.u1DescType)
1874 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1875
1876 /* Only code segments. */
1877 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1878 {
1879 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1880 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1881 }
1882
1883 /* L vs D. */
1884 if ( Desc.Legacy.Gen.u1Long
1885 && Desc.Legacy.Gen.u1DefBig
1886 && IEM_IS_LONG_MODE(pVCpu))
1887 {
1888 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1889 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1890 }
1891
1892 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1893 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1894 {
1895 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1896 {
1897 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1898 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1899 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1900 }
1901 }
1902 else
1903 {
1904 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1905 {
1906 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1907 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1908 }
1909 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1910 {
1911 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1912 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1913 }
1914 }
1915
1916 /* Chop the high bits if 16-bit (Intel says so). */
1917 if (enmEffOpSize == IEMMODE_16BIT)
1918 offSeg &= UINT16_MAX;
1919
1920 /* Limit check. (Should alternatively check for non-canonical addresses
1921 here, but that is ruled out by offSeg being 32-bit, right?) */
1922 uint64_t u64Base;
1923 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1924 if (Desc.Legacy.Gen.u1Long)
1925 u64Base = 0;
1926 else
1927 {
1928 if (offSeg > cbLimit)
1929 {
1930 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1931 /** @todo: Intel says this is #GP(0)! */
1932 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1933 }
1934 u64Base = X86DESC_BASE(&Desc.Legacy);
1935 }
1936
1937 /*
1938 * Ok, everything checked out fine. Now set the accessed bit before
1939 * committing the result into CS, CSHID and RIP.
1940 */
1941 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1942 {
1943 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1944 if (rcStrict != VINF_SUCCESS)
1945 return rcStrict;
1946 /** @todo check what VT-x and AMD-V does. */
1947 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1948 }
1949
1950 /* commit */
1951 pCtx->rip = offSeg;
1952 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1953 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1954 pCtx->cs.ValidSel = pCtx->cs.Sel;
1955 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1956 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1957 pCtx->cs.u32Limit = cbLimit;
1958 pCtx->cs.u64Base = u64Base;
1959 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1960 pCtx->eflags.Bits.u1RF = 0;
1961 /** @todo check if the hidden bits are loaded correctly for 64-bit
1962 * mode. */
1963
1964 /* Flush the prefetch buffer. */
1965#ifdef IEM_WITH_CODE_TLB
1966 pVCpu->iem.s.pbInstrBuf = NULL;
1967#else
1968 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1969#endif
1970
1971 return VINF_SUCCESS;
1972}
1973
1974
1975/**
1976 * Implements far calls.
1977 *
1978 * This very similar to iemCImpl_FarJmp.
1979 *
1980 * @param uSel The selector.
1981 * @param offSeg The segment offset.
1982 * @param enmEffOpSize The operand size (in case we need it).
1983 */
1984IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1985{
1986 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1987 VBOXSTRICTRC rcStrict;
1988 uint64_t uNewRsp;
1989 RTPTRUNION uPtrRet;
1990
1991 /*
1992 * Real mode and V8086 mode are easy. The only snag seems to be that
1993 * CS.limit doesn't change and the limit check is done against the current
1994 * limit.
1995 */
1996 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1997 {
1998 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1999
2000 /* Check stack first - may #SS(0). */
2001 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2002 &uPtrRet.pv, &uNewRsp);
2003 if (rcStrict != VINF_SUCCESS)
2004 return rcStrict;
2005
2006 /* Check the target address range. */
2007 if (offSeg > UINT32_MAX)
2008 return iemRaiseGeneralProtectionFault0(pVCpu);
2009
2010 /* Everything is fine, push the return address. */
2011 if (enmEffOpSize == IEMMODE_16BIT)
2012 {
2013 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2014 uPtrRet.pu16[1] = pCtx->cs.Sel;
2015 }
2016 else
2017 {
2018 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2019 uPtrRet.pu16[2] = pCtx->cs.Sel;
2020 }
2021 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2022 if (rcStrict != VINF_SUCCESS)
2023 return rcStrict;
2024
2025 /* Branch. */
2026 pCtx->rip = offSeg;
2027 pCtx->cs.Sel = uSel;
2028 pCtx->cs.ValidSel = uSel;
2029 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2030 pCtx->cs.u64Base = (uint32_t)uSel << 4;
2031 pCtx->eflags.Bits.u1RF = 0;
2032 return VINF_SUCCESS;
2033 }
2034
2035 /*
2036 * Protected mode. Need to parse the specified descriptor...
2037 */
2038 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2039 {
2040 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2041 return iemRaiseGeneralProtectionFault0(pVCpu);
2042 }
2043
2044 /* Fetch the descriptor. */
2045 IEMSELDESC Desc;
2046 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2047 if (rcStrict != VINF_SUCCESS)
2048 return rcStrict;
2049
2050 /*
2051 * Deal with it according to its type. We do the standard code selectors
2052 * here and dispatch the system selectors to worker functions.
2053 */
2054 if (!Desc.Legacy.Gen.u1DescType)
2055 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2056
2057 /* Only code segments. */
2058 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2059 {
2060 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2061 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2062 }
2063
2064 /* L vs D. */
2065 if ( Desc.Legacy.Gen.u1Long
2066 && Desc.Legacy.Gen.u1DefBig
2067 && IEM_IS_LONG_MODE(pVCpu))
2068 {
2069 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2070 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2071 }
2072
2073 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2074 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2075 {
2076 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2077 {
2078 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2079 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2080 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2081 }
2082 }
2083 else
2084 {
2085 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2086 {
2087 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2088 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2089 }
2090 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2091 {
2092 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2093 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2094 }
2095 }
2096
2097 /* Is it there? */
2098 if (!Desc.Legacy.Gen.u1Present)
2099 {
2100 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2101 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2102 }
2103
2104 /* Check stack first - may #SS(0). */
2105 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2106 * 16-bit code cause a two or four byte CS to be pushed? */
2107 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2108 enmEffOpSize == IEMMODE_64BIT ? 8+8
2109 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2110 &uPtrRet.pv, &uNewRsp);
2111 if (rcStrict != VINF_SUCCESS)
2112 return rcStrict;
2113
2114 /* Chop the high bits if 16-bit (Intel says so). */
2115 if (enmEffOpSize == IEMMODE_16BIT)
2116 offSeg &= UINT16_MAX;
2117
2118 /* Limit / canonical check. */
2119 uint64_t u64Base;
2120 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2121 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2122 {
2123 if (!IEM_IS_CANONICAL(offSeg))
2124 {
2125 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2126 return iemRaiseNotCanonical(pVCpu);
2127 }
2128 u64Base = 0;
2129 }
2130 else
2131 {
2132 if (offSeg > cbLimit)
2133 {
2134 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2135 /** @todo: Intel says this is #GP(0)! */
2136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2137 }
2138 u64Base = X86DESC_BASE(&Desc.Legacy);
2139 }
2140
2141 /*
2142 * Now set the accessed bit before
2143 * writing the return address to the stack and committing the result into
2144 * CS, CSHID and RIP.
2145 */
2146 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2147 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2148 {
2149 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2150 if (rcStrict != VINF_SUCCESS)
2151 return rcStrict;
2152 /** @todo check what VT-x and AMD-V does. */
2153 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2154 }
2155
2156 /* stack */
2157 if (enmEffOpSize == IEMMODE_16BIT)
2158 {
2159 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2160 uPtrRet.pu16[1] = pCtx->cs.Sel;
2161 }
2162 else if (enmEffOpSize == IEMMODE_32BIT)
2163 {
2164 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2165 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2166 }
2167 else
2168 {
2169 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2170 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2171 }
2172 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2173 if (rcStrict != VINF_SUCCESS)
2174 return rcStrict;
2175
2176 /* commit */
2177 pCtx->rip = offSeg;
2178 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2179 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2180 pCtx->cs.ValidSel = pCtx->cs.Sel;
2181 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2182 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2183 pCtx->cs.u32Limit = cbLimit;
2184 pCtx->cs.u64Base = u64Base;
2185 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2186 pCtx->eflags.Bits.u1RF = 0;
2187 /** @todo check if the hidden bits are loaded correctly for 64-bit
2188 * mode. */
2189
2190 /* Flush the prefetch buffer. */
2191#ifdef IEM_WITH_CODE_TLB
2192 pVCpu->iem.s.pbInstrBuf = NULL;
2193#else
2194 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2195#endif
2196 return VINF_SUCCESS;
2197}
2198
2199
2200/**
2201 * Implements retf.
2202 *
2203 * @param enmEffOpSize The effective operand size.
2204 * @param cbPop The amount of arguments to pop from the stack
2205 * (bytes).
2206 */
2207IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2208{
2209 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2210 VBOXSTRICTRC rcStrict;
2211 RTCPTRUNION uPtrFrame;
2212 uint64_t uNewRsp;
2213 uint64_t uNewRip;
2214 uint16_t uNewCs;
2215 NOREF(cbInstr);
2216
2217 /*
2218 * Read the stack values first.
2219 */
2220 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2221 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2222 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2223 if (rcStrict != VINF_SUCCESS)
2224 return rcStrict;
2225 if (enmEffOpSize == IEMMODE_16BIT)
2226 {
2227 uNewRip = uPtrFrame.pu16[0];
2228 uNewCs = uPtrFrame.pu16[1];
2229 }
2230 else if (enmEffOpSize == IEMMODE_32BIT)
2231 {
2232 uNewRip = uPtrFrame.pu32[0];
2233 uNewCs = uPtrFrame.pu16[2];
2234 }
2235 else
2236 {
2237 uNewRip = uPtrFrame.pu64[0];
2238 uNewCs = uPtrFrame.pu16[4];
2239 }
2240 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2241 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2242 { /* extremely likely */ }
2243 else
2244 return rcStrict;
2245
2246 /*
2247 * Real mode and V8086 mode are easy.
2248 */
2249 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2250 {
2251 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2252 /** @todo check how this is supposed to work if sp=0xfffe. */
2253
2254 /* Check the limit of the new EIP. */
2255 /** @todo Intel pseudo code only does the limit check for 16-bit
2256 * operands, AMD does not make any distinction. What is right? */
2257 if (uNewRip > pCtx->cs.u32Limit)
2258 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2259
2260 /* commit the operation. */
2261 pCtx->rsp = uNewRsp;
2262 pCtx->rip = uNewRip;
2263 pCtx->cs.Sel = uNewCs;
2264 pCtx->cs.ValidSel = uNewCs;
2265 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2266 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2267 pCtx->eflags.Bits.u1RF = 0;
2268 /** @todo do we load attribs and limit as well? */
2269 if (cbPop)
2270 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2271 return VINF_SUCCESS;
2272 }
2273
2274 /*
2275 * Protected mode is complicated, of course.
2276 */
2277 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2278 {
2279 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2280 return iemRaiseGeneralProtectionFault0(pVCpu);
2281 }
2282
2283 /* Fetch the descriptor. */
2284 IEMSELDESC DescCs;
2285 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2286 if (rcStrict != VINF_SUCCESS)
2287 return rcStrict;
2288
2289 /* Can only return to a code selector. */
2290 if ( !DescCs.Legacy.Gen.u1DescType
2291 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2292 {
2293 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2294 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2295 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2296 }
2297
2298 /* L vs D. */
2299 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2300 && DescCs.Legacy.Gen.u1DefBig
2301 && IEM_IS_LONG_MODE(pVCpu))
2302 {
2303 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2304 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2305 }
2306
2307 /* DPL/RPL/CPL checks. */
2308 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2309 {
2310 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2311 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2312 }
2313
2314 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2315 {
2316 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2317 {
2318 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2319 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2320 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2321 }
2322 }
2323 else
2324 {
2325 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2326 {
2327 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2328 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2329 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2330 }
2331 }
2332
2333 /* Is it there? */
2334 if (!DescCs.Legacy.Gen.u1Present)
2335 {
2336 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2337 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2338 }
2339
2340 /*
2341 * Return to outer privilege? (We'll typically have entered via a call gate.)
2342 */
2343 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2344 {
2345 /* Read the outer stack pointer stored *after* the parameters. */
2346 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2347 if (rcStrict != VINF_SUCCESS)
2348 return rcStrict;
2349
2350 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2351
2352 uint16_t uNewOuterSs;
2353 uint64_t uNewOuterRsp;
2354 if (enmEffOpSize == IEMMODE_16BIT)
2355 {
2356 uNewOuterRsp = uPtrFrame.pu16[0];
2357 uNewOuterSs = uPtrFrame.pu16[1];
2358 }
2359 else if (enmEffOpSize == IEMMODE_32BIT)
2360 {
2361 uNewOuterRsp = uPtrFrame.pu32[0];
2362 uNewOuterSs = uPtrFrame.pu16[2];
2363 }
2364 else
2365 {
2366 uNewOuterRsp = uPtrFrame.pu64[0];
2367 uNewOuterSs = uPtrFrame.pu16[4];
2368 }
2369 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2370 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2371 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2372 { /* extremely likely */ }
2373 else
2374 return rcStrict;
2375
2376 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2377 and read the selector. */
2378 IEMSELDESC DescSs;
2379 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2380 {
2381 if ( !DescCs.Legacy.Gen.u1Long
2382 || (uNewOuterSs & X86_SEL_RPL) == 3)
2383 {
2384 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2385 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2386 return iemRaiseGeneralProtectionFault0(pVCpu);
2387 }
2388 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2389 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2390 }
2391 else
2392 {
2393 /* Fetch the descriptor for the new stack segment. */
2394 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2395 if (rcStrict != VINF_SUCCESS)
2396 return rcStrict;
2397 }
2398
2399 /* Check that RPL of stack and code selectors match. */
2400 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2401 {
2402 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2403 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2404 }
2405
2406 /* Must be a writable data segment. */
2407 if ( !DescSs.Legacy.Gen.u1DescType
2408 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2409 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2410 {
2411 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2412 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2413 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2414 }
2415
2416 /* L vs D. (Not mentioned by intel.) */
2417 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2418 && DescSs.Legacy.Gen.u1DefBig
2419 && IEM_IS_LONG_MODE(pVCpu))
2420 {
2421 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2422 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2423 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2424 }
2425
2426 /* DPL/RPL/CPL checks. */
2427 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2428 {
2429 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2430 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2431 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2432 }
2433
2434 /* Is it there? */
2435 if (!DescSs.Legacy.Gen.u1Present)
2436 {
2437 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2438 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2439 }
2440
2441 /* Calc SS limit.*/
2442 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2443
2444 /* Is RIP canonical or within CS.limit? */
2445 uint64_t u64Base;
2446 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2447
2448 /** @todo Testcase: Is this correct? */
2449 if ( DescCs.Legacy.Gen.u1Long
2450 && IEM_IS_LONG_MODE(pVCpu) )
2451 {
2452 if (!IEM_IS_CANONICAL(uNewRip))
2453 {
2454 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2455 return iemRaiseNotCanonical(pVCpu);
2456 }
2457 u64Base = 0;
2458 }
2459 else
2460 {
2461 if (uNewRip > cbLimitCs)
2462 {
2463 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2464 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2465 /** @todo: Intel says this is #GP(0)! */
2466 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2467 }
2468 u64Base = X86DESC_BASE(&DescCs.Legacy);
2469 }
2470
2471 /*
2472 * Now set the accessed bit before
2473 * writing the return address to the stack and committing the result into
2474 * CS, CSHID and RIP.
2475 */
2476 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2477 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2478 {
2479 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2480 if (rcStrict != VINF_SUCCESS)
2481 return rcStrict;
2482 /** @todo check what VT-x and AMD-V does. */
2483 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2484 }
2485 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2486 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2487 {
2488 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2489 if (rcStrict != VINF_SUCCESS)
2490 return rcStrict;
2491 /** @todo check what VT-x and AMD-V does. */
2492 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2493 }
2494
2495 /* commit */
2496 if (enmEffOpSize == IEMMODE_16BIT)
2497 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2498 else
2499 pCtx->rip = uNewRip;
2500 pCtx->cs.Sel = uNewCs;
2501 pCtx->cs.ValidSel = uNewCs;
2502 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2503 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2504 pCtx->cs.u32Limit = cbLimitCs;
2505 pCtx->cs.u64Base = u64Base;
2506 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2507 pCtx->ss.Sel = uNewOuterSs;
2508 pCtx->ss.ValidSel = uNewOuterSs;
2509 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2510 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2511 pCtx->ss.u32Limit = cbLimitSs;
2512 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2513 pCtx->ss.u64Base = 0;
2514 else
2515 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2516 if (!pCtx->ss.Attr.n.u1DefBig)
2517 pCtx->sp = (uint16_t)uNewOuterRsp;
2518 else
2519 pCtx->rsp = uNewOuterRsp;
2520
2521 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2522 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2523 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2524 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2525 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2526
2527 /** @todo check if the hidden bits are loaded correctly for 64-bit
2528 * mode. */
2529
2530 if (cbPop)
2531 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2532 pCtx->eflags.Bits.u1RF = 0;
2533
2534 /* Done! */
2535 }
2536 /*
2537 * Return to the same privilege level
2538 */
2539 else
2540 {
2541 /* Limit / canonical check. */
2542 uint64_t u64Base;
2543 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2544
2545 /** @todo Testcase: Is this correct? */
2546 if ( DescCs.Legacy.Gen.u1Long
2547 && IEM_IS_LONG_MODE(pVCpu) )
2548 {
2549 if (!IEM_IS_CANONICAL(uNewRip))
2550 {
2551 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2552 return iemRaiseNotCanonical(pVCpu);
2553 }
2554 u64Base = 0;
2555 }
2556 else
2557 {
2558 if (uNewRip > cbLimitCs)
2559 {
2560 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2561 /** @todo: Intel says this is #GP(0)! */
2562 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2563 }
2564 u64Base = X86DESC_BASE(&DescCs.Legacy);
2565 }
2566
2567 /*
2568 * Now set the accessed bit before
2569 * writing the return address to the stack and committing the result into
2570 * CS, CSHID and RIP.
2571 */
2572 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2573 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2574 {
2575 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2576 if (rcStrict != VINF_SUCCESS)
2577 return rcStrict;
2578 /** @todo check what VT-x and AMD-V does. */
2579 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2580 }
2581
2582 /* commit */
2583 if (!pCtx->ss.Attr.n.u1DefBig)
2584 pCtx->sp = (uint16_t)uNewRsp;
2585 else
2586 pCtx->rsp = uNewRsp;
2587 if (enmEffOpSize == IEMMODE_16BIT)
2588 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2589 else
2590 pCtx->rip = uNewRip;
2591 pCtx->cs.Sel = uNewCs;
2592 pCtx->cs.ValidSel = uNewCs;
2593 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2594 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2595 pCtx->cs.u32Limit = cbLimitCs;
2596 pCtx->cs.u64Base = u64Base;
2597 /** @todo check if the hidden bits are loaded correctly for 64-bit
2598 * mode. */
2599 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2600 if (cbPop)
2601 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2602 pCtx->eflags.Bits.u1RF = 0;
2603 }
2604
2605 /* Flush the prefetch buffer. */
2606#ifdef IEM_WITH_CODE_TLB
2607 pVCpu->iem.s.pbInstrBuf = NULL;
2608#else
2609 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2610#endif
2611 return VINF_SUCCESS;
2612}
2613
2614
2615/**
2616 * Implements retn.
2617 *
2618 * We're doing this in C because of the \#GP that might be raised if the popped
2619 * program counter is out of bounds.
2620 *
2621 * @param enmEffOpSize The effective operand size.
2622 * @param cbPop The amount of arguments to pop from the stack
2623 * (bytes).
2624 */
2625IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2626{
2627 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2628 NOREF(cbInstr);
2629
2630 /* Fetch the RSP from the stack. */
2631 VBOXSTRICTRC rcStrict;
2632 RTUINT64U NewRip;
2633 RTUINT64U NewRsp;
2634 NewRsp.u = pCtx->rsp;
2635
2636 switch (enmEffOpSize)
2637 {
2638 case IEMMODE_16BIT:
2639 NewRip.u = 0;
2640 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2641 break;
2642 case IEMMODE_32BIT:
2643 NewRip.u = 0;
2644 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2645 break;
2646 case IEMMODE_64BIT:
2647 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2648 break;
2649 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2650 }
2651 if (rcStrict != VINF_SUCCESS)
2652 return rcStrict;
2653
2654 /* Check the new RSP before loading it. */
2655 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2656 * of it. The canonical test is performed here and for call. */
2657 if (enmEffOpSize != IEMMODE_64BIT)
2658 {
2659 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2660 {
2661 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2662 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2663 }
2664 }
2665 else
2666 {
2667 if (!IEM_IS_CANONICAL(NewRip.u))
2668 {
2669 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2670 return iemRaiseNotCanonical(pVCpu);
2671 }
2672 }
2673
2674 /* Apply cbPop */
2675 if (cbPop)
2676 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2677
2678 /* Commit it. */
2679 pCtx->rip = NewRip.u;
2680 pCtx->rsp = NewRsp.u;
2681 pCtx->eflags.Bits.u1RF = 0;
2682
2683 /* Flush the prefetch buffer. */
2684#ifndef IEM_WITH_CODE_TLB
2685 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2686#endif
2687
2688 return VINF_SUCCESS;
2689}
2690
2691
2692/**
2693 * Implements enter.
2694 *
2695 * We're doing this in C because the instruction is insane, even for the
2696 * u8NestingLevel=0 case dealing with the stack is tedious.
2697 *
2698 * @param enmEffOpSize The effective operand size.
2699 */
2700IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2701{
2702 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2703
2704 /* Push RBP, saving the old value in TmpRbp. */
2705 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2706 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2707 RTUINT64U NewRbp;
2708 VBOXSTRICTRC rcStrict;
2709 if (enmEffOpSize == IEMMODE_64BIT)
2710 {
2711 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2712 NewRbp = NewRsp;
2713 }
2714 else if (enmEffOpSize == IEMMODE_32BIT)
2715 {
2716 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2717 NewRbp = NewRsp;
2718 }
2719 else
2720 {
2721 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2722 NewRbp = TmpRbp;
2723 NewRbp.Words.w0 = NewRsp.Words.w0;
2724 }
2725 if (rcStrict != VINF_SUCCESS)
2726 return rcStrict;
2727
2728 /* Copy the parameters (aka nesting levels by Intel). */
2729 cParameters &= 0x1f;
2730 if (cParameters > 0)
2731 {
2732 switch (enmEffOpSize)
2733 {
2734 case IEMMODE_16BIT:
2735 if (pCtx->ss.Attr.n.u1DefBig)
2736 TmpRbp.DWords.dw0 -= 2;
2737 else
2738 TmpRbp.Words.w0 -= 2;
2739 do
2740 {
2741 uint16_t u16Tmp;
2742 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2743 if (rcStrict != VINF_SUCCESS)
2744 break;
2745 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2746 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2747 break;
2748
2749 case IEMMODE_32BIT:
2750 if (pCtx->ss.Attr.n.u1DefBig)
2751 TmpRbp.DWords.dw0 -= 4;
2752 else
2753 TmpRbp.Words.w0 -= 4;
2754 do
2755 {
2756 uint32_t u32Tmp;
2757 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2758 if (rcStrict != VINF_SUCCESS)
2759 break;
2760 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2761 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2762 break;
2763
2764 case IEMMODE_64BIT:
2765 TmpRbp.u -= 8;
2766 do
2767 {
2768 uint64_t u64Tmp;
2769 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2770 if (rcStrict != VINF_SUCCESS)
2771 break;
2772 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2773 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2774 break;
2775
2776 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2777 }
2778 if (rcStrict != VINF_SUCCESS)
2779 return VINF_SUCCESS;
2780
2781 /* Push the new RBP */
2782 if (enmEffOpSize == IEMMODE_64BIT)
2783 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2784 else if (enmEffOpSize == IEMMODE_32BIT)
2785 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2786 else
2787 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2788 if (rcStrict != VINF_SUCCESS)
2789 return rcStrict;
2790
2791 }
2792
2793 /* Recalc RSP. */
2794 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2795
2796 /** @todo Should probe write access at the new RSP according to AMD. */
2797
2798 /* Commit it. */
2799 pCtx->rbp = NewRbp.u;
2800 pCtx->rsp = NewRsp.u;
2801 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2802
2803 return VINF_SUCCESS;
2804}
2805
2806
2807
2808/**
2809 * Implements leave.
2810 *
2811 * We're doing this in C because messing with the stack registers is annoying
2812 * since they depends on SS attributes.
2813 *
2814 * @param enmEffOpSize The effective operand size.
2815 */
2816IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2817{
2818 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2819
2820 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2821 RTUINT64U NewRsp;
2822 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2823 NewRsp.u = pCtx->rbp;
2824 else if (pCtx->ss.Attr.n.u1DefBig)
2825 NewRsp.u = pCtx->ebp;
2826 else
2827 {
2828 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2829 NewRsp.u = pCtx->rsp;
2830 NewRsp.Words.w0 = pCtx->bp;
2831 }
2832
2833 /* Pop RBP according to the operand size. */
2834 VBOXSTRICTRC rcStrict;
2835 RTUINT64U NewRbp;
2836 switch (enmEffOpSize)
2837 {
2838 case IEMMODE_16BIT:
2839 NewRbp.u = pCtx->rbp;
2840 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2841 break;
2842 case IEMMODE_32BIT:
2843 NewRbp.u = 0;
2844 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2845 break;
2846 case IEMMODE_64BIT:
2847 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2848 break;
2849 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2850 }
2851 if (rcStrict != VINF_SUCCESS)
2852 return rcStrict;
2853
2854
2855 /* Commit it. */
2856 pCtx->rbp = NewRbp.u;
2857 pCtx->rsp = NewRsp.u;
2858 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2859
2860 return VINF_SUCCESS;
2861}
2862
2863
2864/**
2865 * Implements int3 and int XX.
2866 *
2867 * @param u8Int The interrupt vector number.
2868 * @param enmInt The int instruction type.
2869 */
2870IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2871{
2872 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2873 return iemRaiseXcptOrInt(pVCpu,
2874 cbInstr,
2875 u8Int,
2876 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2877 0,
2878 0);
2879}
2880
2881
2882/**
2883 * Implements iret for real mode and V8086 mode.
2884 *
2885 * @param enmEffOpSize The effective operand size.
2886 */
2887IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2888{
2889 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2890 X86EFLAGS Efl;
2891 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2892 NOREF(cbInstr);
2893
2894 /*
2895 * iret throws an exception if VME isn't enabled.
2896 */
2897 if ( Efl.Bits.u1VM
2898 && Efl.Bits.u2IOPL != 3
2899 && !(pCtx->cr4 & X86_CR4_VME))
2900 return iemRaiseGeneralProtectionFault0(pVCpu);
2901
2902 /*
2903 * Do the stack bits, but don't commit RSP before everything checks
2904 * out right.
2905 */
2906 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2907 VBOXSTRICTRC rcStrict;
2908 RTCPTRUNION uFrame;
2909 uint16_t uNewCs;
2910 uint32_t uNewEip;
2911 uint32_t uNewFlags;
2912 uint64_t uNewRsp;
2913 if (enmEffOpSize == IEMMODE_32BIT)
2914 {
2915 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2916 if (rcStrict != VINF_SUCCESS)
2917 return rcStrict;
2918 uNewEip = uFrame.pu32[0];
2919 if (uNewEip > UINT16_MAX)
2920 return iemRaiseGeneralProtectionFault0(pVCpu);
2921
2922 uNewCs = (uint16_t)uFrame.pu32[1];
2923 uNewFlags = uFrame.pu32[2];
2924 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2925 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2926 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2927 | X86_EFL_ID;
2928 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2929 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2930 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2931 }
2932 else
2933 {
2934 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2935 if (rcStrict != VINF_SUCCESS)
2936 return rcStrict;
2937 uNewEip = uFrame.pu16[0];
2938 uNewCs = uFrame.pu16[1];
2939 uNewFlags = uFrame.pu16[2];
2940 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2941 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2942 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2943 /** @todo The intel pseudo code does not indicate what happens to
2944 * reserved flags. We just ignore them. */
2945 /* Ancient CPU adjustments: See iemCImpl_popf. */
2946 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2947 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2948 }
2949 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2950 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2951 { /* extremely likely */ }
2952 else
2953 return rcStrict;
2954
2955 /** @todo Check how this is supposed to work if sp=0xfffe. */
2956 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2957 uNewCs, uNewEip, uNewFlags, uNewRsp));
2958
2959 /*
2960 * Check the limit of the new EIP.
2961 */
2962 /** @todo Only the AMD pseudo code check the limit here, what's
2963 * right? */
2964 if (uNewEip > pCtx->cs.u32Limit)
2965 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2966
2967 /*
2968 * V8086 checks and flag adjustments
2969 */
2970 if (Efl.Bits.u1VM)
2971 {
2972 if (Efl.Bits.u2IOPL == 3)
2973 {
2974 /* Preserve IOPL and clear RF. */
2975 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2976 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2977 }
2978 else if ( enmEffOpSize == IEMMODE_16BIT
2979 && ( !(uNewFlags & X86_EFL_IF)
2980 || !Efl.Bits.u1VIP )
2981 && !(uNewFlags & X86_EFL_TF) )
2982 {
2983 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2984 uNewFlags &= ~X86_EFL_VIF;
2985 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2986 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2987 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2988 }
2989 else
2990 return iemRaiseGeneralProtectionFault0(pVCpu);
2991 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2992 }
2993
2994 /*
2995 * Commit the operation.
2996 */
2997#ifdef DBGFTRACE_ENABLED
2998 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2999 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3000#endif
3001 pCtx->rsp = uNewRsp;
3002 pCtx->rip = uNewEip;
3003 pCtx->cs.Sel = uNewCs;
3004 pCtx->cs.ValidSel = uNewCs;
3005 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3006 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
3007 /** @todo do we load attribs and limit as well? */
3008 Assert(uNewFlags & X86_EFL_1);
3009 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3010
3011 /* Flush the prefetch buffer. */
3012#ifdef IEM_WITH_CODE_TLB
3013 pVCpu->iem.s.pbInstrBuf = NULL;
3014#else
3015 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3016#endif
3017
3018 return VINF_SUCCESS;
3019}
3020
3021
3022/**
3023 * Loads a segment register when entering V8086 mode.
3024 *
3025 * @param pSReg The segment register.
3026 * @param uSeg The segment to load.
3027 */
3028static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3029{
3030 pSReg->Sel = uSeg;
3031 pSReg->ValidSel = uSeg;
3032 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3033 pSReg->u64Base = (uint32_t)uSeg << 4;
3034 pSReg->u32Limit = 0xffff;
3035 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3036 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3037 * IRET'ing to V8086. */
3038}
3039
3040
3041/**
3042 * Implements iret for protected mode returning to V8086 mode.
3043 *
3044 * @param pCtx Pointer to the CPU context.
3045 * @param uNewEip The new EIP.
3046 * @param uNewCs The new CS.
3047 * @param uNewFlags The new EFLAGS.
3048 * @param uNewRsp The RSP after the initial IRET frame.
3049 *
3050 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3051 */
3052IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
3053 uint32_t, uNewFlags, uint64_t, uNewRsp)
3054{
3055 RT_NOREF_PV(cbInstr);
3056
3057 /*
3058 * Pop the V8086 specific frame bits off the stack.
3059 */
3060 VBOXSTRICTRC rcStrict;
3061 RTCPTRUNION uFrame;
3062 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3063 if (rcStrict != VINF_SUCCESS)
3064 return rcStrict;
3065 uint32_t uNewEsp = uFrame.pu32[0];
3066 uint16_t uNewSs = uFrame.pu32[1];
3067 uint16_t uNewEs = uFrame.pu32[2];
3068 uint16_t uNewDs = uFrame.pu32[3];
3069 uint16_t uNewFs = uFrame.pu32[4];
3070 uint16_t uNewGs = uFrame.pu32[5];
3071 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3072 if (rcStrict != VINF_SUCCESS)
3073 return rcStrict;
3074
3075 /*
3076 * Commit the operation.
3077 */
3078 uNewFlags &= X86_EFL_LIVE_MASK;
3079 uNewFlags |= X86_EFL_RA1_MASK;
3080#ifdef DBGFTRACE_ENABLED
3081 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3082 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3083#endif
3084 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3085
3086 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3087 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
3088 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
3089 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
3090 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
3091 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
3092 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
3093 pCtx->rip = (uint16_t)uNewEip;
3094 pCtx->rsp = uNewEsp; /** @todo check this out! */
3095 pVCpu->iem.s.uCpl = 3;
3096
3097 /* Flush the prefetch buffer. */
3098#ifdef IEM_WITH_CODE_TLB
3099 pVCpu->iem.s.pbInstrBuf = NULL;
3100#else
3101 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3102#endif
3103
3104 return VINF_SUCCESS;
3105}
3106
3107
3108/**
3109 * Implements iret for protected mode returning via a nested task.
3110 *
3111 * @param enmEffOpSize The effective operand size.
3112 */
3113IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3114{
3115 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3116#ifndef IEM_IMPLEMENTS_TASKSWITCH
3117 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3118#else
3119 RT_NOREF_PV(enmEffOpSize);
3120
3121 /*
3122 * Read the segment selector in the link-field of the current TSS.
3123 */
3124 RTSEL uSelRet;
3125 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3126 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
3127 if (rcStrict != VINF_SUCCESS)
3128 return rcStrict;
3129
3130 /*
3131 * Fetch the returning task's TSS descriptor from the GDT.
3132 */
3133 if (uSelRet & X86_SEL_LDT)
3134 {
3135 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3136 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3137 }
3138
3139 IEMSELDESC TssDesc;
3140 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3141 if (rcStrict != VINF_SUCCESS)
3142 return rcStrict;
3143
3144 if (TssDesc.Legacy.Gate.u1DescType)
3145 {
3146 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3147 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3148 }
3149
3150 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3151 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3152 {
3153 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3154 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3155 }
3156
3157 if (!TssDesc.Legacy.Gate.u1Present)
3158 {
3159 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3160 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3161 }
3162
3163 uint32_t uNextEip = pCtx->eip + cbInstr;
3164 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3165 0 /* uCr2 */, uSelRet, &TssDesc);
3166#endif
3167}
3168
3169
3170/**
3171 * Implements iret for protected mode
3172 *
3173 * @param enmEffOpSize The effective operand size.
3174 */
3175IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3176{
3177 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3178 NOREF(cbInstr);
3179 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3180
3181 /*
3182 * Nested task return.
3183 */
3184 if (pCtx->eflags.Bits.u1NT)
3185 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3186
3187 /*
3188 * Normal return.
3189 *
3190 * Do the stack bits, but don't commit RSP before everything checks
3191 * out right.
3192 */
3193 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3194 VBOXSTRICTRC rcStrict;
3195 RTCPTRUNION uFrame;
3196 uint16_t uNewCs;
3197 uint32_t uNewEip;
3198 uint32_t uNewFlags;
3199 uint64_t uNewRsp;
3200 if (enmEffOpSize == IEMMODE_32BIT)
3201 {
3202 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3203 if (rcStrict != VINF_SUCCESS)
3204 return rcStrict;
3205 uNewEip = uFrame.pu32[0];
3206 uNewCs = (uint16_t)uFrame.pu32[1];
3207 uNewFlags = uFrame.pu32[2];
3208 }
3209 else
3210 {
3211 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3212 if (rcStrict != VINF_SUCCESS)
3213 return rcStrict;
3214 uNewEip = uFrame.pu16[0];
3215 uNewCs = uFrame.pu16[1];
3216 uNewFlags = uFrame.pu16[2];
3217 }
3218 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3219 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3220 { /* extremely likely */ }
3221 else
3222 return rcStrict;
3223 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3224
3225 /*
3226 * We're hopefully not returning to V8086 mode...
3227 */
3228 if ( (uNewFlags & X86_EFL_VM)
3229 && pVCpu->iem.s.uCpl == 0)
3230 {
3231 Assert(enmEffOpSize == IEMMODE_32BIT);
3232 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3233 }
3234
3235 /*
3236 * Protected mode.
3237 */
3238 /* Read the CS descriptor. */
3239 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3240 {
3241 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3242 return iemRaiseGeneralProtectionFault0(pVCpu);
3243 }
3244
3245 IEMSELDESC DescCS;
3246 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3247 if (rcStrict != VINF_SUCCESS)
3248 {
3249 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3250 return rcStrict;
3251 }
3252
3253 /* Must be a code descriptor. */
3254 if (!DescCS.Legacy.Gen.u1DescType)
3255 {
3256 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3257 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3258 }
3259 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3260 {
3261 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3262 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3263 }
3264
3265#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3266 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3267 PVM pVM = pVCpu->CTX_SUFF(pVM);
3268 if (EMIsRawRing0Enabled(pVM) && VM_IS_RAW_MODE_ENABLED(pVM))
3269 {
3270 if ((uNewCs & X86_SEL_RPL) == 1)
3271 {
3272 if ( pVCpu->iem.s.uCpl == 0
3273 && ( !EMIsRawRing1Enabled(pVM)
3274 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3275 {
3276 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3277 uNewCs &= X86_SEL_MASK_OFF_RPL;
3278 }
3279# ifdef LOG_ENABLED
3280 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3281 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3282# endif
3283 }
3284 else if ( (uNewCs & X86_SEL_RPL) == 2
3285 && EMIsRawRing1Enabled(pVM)
3286 && pVCpu->iem.s.uCpl <= 1)
3287 {
3288 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3289 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3290 }
3291 }
3292#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3293
3294
3295 /* Privilege checks. */
3296 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3297 {
3298 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3299 {
3300 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3301 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3302 }
3303 }
3304 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3305 {
3306 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3307 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3308 }
3309 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3310 {
3311 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3312 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3313 }
3314
3315 /* Present? */
3316 if (!DescCS.Legacy.Gen.u1Present)
3317 {
3318 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3319 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3320 }
3321
3322 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3323
3324 /*
3325 * Return to outer level?
3326 */
3327 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3328 {
3329 uint16_t uNewSS;
3330 uint32_t uNewESP;
3331 if (enmEffOpSize == IEMMODE_32BIT)
3332 {
3333 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3334 if (rcStrict != VINF_SUCCESS)
3335 return rcStrict;
3336/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3337 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3338 * bit of the popped SS selector it turns out. */
3339 uNewESP = uFrame.pu32[0];
3340 uNewSS = (uint16_t)uFrame.pu32[1];
3341 }
3342 else
3343 {
3344 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3345 if (rcStrict != VINF_SUCCESS)
3346 return rcStrict;
3347 uNewESP = uFrame.pu16[0];
3348 uNewSS = uFrame.pu16[1];
3349 }
3350 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3351 if (rcStrict != VINF_SUCCESS)
3352 return rcStrict;
3353 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3354
3355 /* Read the SS descriptor. */
3356 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3357 {
3358 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3359 return iemRaiseGeneralProtectionFault0(pVCpu);
3360 }
3361
3362 IEMSELDESC DescSS;
3363 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3364 if (rcStrict != VINF_SUCCESS)
3365 {
3366 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3367 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3368 return rcStrict;
3369 }
3370
3371 /* Privilege checks. */
3372 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3373 {
3374 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3375 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3376 }
3377 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3378 {
3379 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3380 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3381 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3382 }
3383
3384 /* Must be a writeable data segment descriptor. */
3385 if (!DescSS.Legacy.Gen.u1DescType)
3386 {
3387 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3388 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3389 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3390 }
3391 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3392 {
3393 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3394 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3395 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3396 }
3397
3398 /* Present? */
3399 if (!DescSS.Legacy.Gen.u1Present)
3400 {
3401 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3402 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3403 }
3404
3405 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3406
3407 /* Check EIP. */
3408 if (uNewEip > cbLimitCS)
3409 {
3410 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3411 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3412 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3413 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3414 }
3415
3416 /*
3417 * Commit the changes, marking CS and SS accessed first since
3418 * that may fail.
3419 */
3420 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3421 {
3422 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3423 if (rcStrict != VINF_SUCCESS)
3424 return rcStrict;
3425 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3426 }
3427 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3428 {
3429 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3430 if (rcStrict != VINF_SUCCESS)
3431 return rcStrict;
3432 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3433 }
3434
3435 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3436 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3437 if (enmEffOpSize != IEMMODE_16BIT)
3438 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3439 if (pVCpu->iem.s.uCpl == 0)
3440 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3441 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3442 fEFlagsMask |= X86_EFL_IF;
3443 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3444 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3445 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3446 fEFlagsNew &= ~fEFlagsMask;
3447 fEFlagsNew |= uNewFlags & fEFlagsMask;
3448#ifdef DBGFTRACE_ENABLED
3449 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3450 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3451 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3452#endif
3453
3454 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3455 pCtx->rip = uNewEip;
3456 pCtx->cs.Sel = uNewCs;
3457 pCtx->cs.ValidSel = uNewCs;
3458 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3459 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3460 pCtx->cs.u32Limit = cbLimitCS;
3461 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3462 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3463
3464 pCtx->ss.Sel = uNewSS;
3465 pCtx->ss.ValidSel = uNewSS;
3466 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3467 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3468 pCtx->ss.u32Limit = cbLimitSs;
3469 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3470 if (!pCtx->ss.Attr.n.u1DefBig)
3471 pCtx->sp = (uint16_t)uNewESP;
3472 else
3473 pCtx->rsp = uNewESP;
3474
3475 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3476 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3477 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3478 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3479 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3480
3481 /* Done! */
3482
3483 }
3484 /*
3485 * Return to the same level.
3486 */
3487 else
3488 {
3489 /* Check EIP. */
3490 if (uNewEip > cbLimitCS)
3491 {
3492 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3493 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3494 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3495 }
3496
3497 /*
3498 * Commit the changes, marking CS first since it may fail.
3499 */
3500 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3501 {
3502 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3503 if (rcStrict != VINF_SUCCESS)
3504 return rcStrict;
3505 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3506 }
3507
3508 X86EFLAGS NewEfl;
3509 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3510 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3511 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3512 if (enmEffOpSize != IEMMODE_16BIT)
3513 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3514 if (pVCpu->iem.s.uCpl == 0)
3515 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3516 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3517 fEFlagsMask |= X86_EFL_IF;
3518 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3519 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3520 NewEfl.u &= ~fEFlagsMask;
3521 NewEfl.u |= fEFlagsMask & uNewFlags;
3522#ifdef DBGFTRACE_ENABLED
3523 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3524 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3525 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3526#endif
3527
3528 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3529 pCtx->rip = uNewEip;
3530 pCtx->cs.Sel = uNewCs;
3531 pCtx->cs.ValidSel = uNewCs;
3532 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3533 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3534 pCtx->cs.u32Limit = cbLimitCS;
3535 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3536 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3537 if (!pCtx->ss.Attr.n.u1DefBig)
3538 pCtx->sp = (uint16_t)uNewRsp;
3539 else
3540 pCtx->rsp = uNewRsp;
3541 /* Done! */
3542 }
3543
3544 /* Flush the prefetch buffer. */
3545#ifdef IEM_WITH_CODE_TLB
3546 pVCpu->iem.s.pbInstrBuf = NULL;
3547#else
3548 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3549#endif
3550
3551 return VINF_SUCCESS;
3552}
3553
3554
3555/**
3556 * Implements iret for long mode
3557 *
3558 * @param enmEffOpSize The effective operand size.
3559 */
3560IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3561{
3562 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3563 NOREF(cbInstr);
3564
3565 /*
3566 * Nested task return is not supported in long mode.
3567 */
3568 if (pCtx->eflags.Bits.u1NT)
3569 {
3570 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3571 return iemRaiseGeneralProtectionFault0(pVCpu);
3572 }
3573
3574 /*
3575 * Normal return.
3576 *
3577 * Do the stack bits, but don't commit RSP before everything checks
3578 * out right.
3579 */
3580 VBOXSTRICTRC rcStrict;
3581 RTCPTRUNION uFrame;
3582 uint64_t uNewRip;
3583 uint16_t uNewCs;
3584 uint16_t uNewSs;
3585 uint32_t uNewFlags;
3586 uint64_t uNewRsp;
3587 if (enmEffOpSize == IEMMODE_64BIT)
3588 {
3589 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3590 if (rcStrict != VINF_SUCCESS)
3591 return rcStrict;
3592 uNewRip = uFrame.pu64[0];
3593 uNewCs = (uint16_t)uFrame.pu64[1];
3594 uNewFlags = (uint32_t)uFrame.pu64[2];
3595 uNewRsp = uFrame.pu64[3];
3596 uNewSs = (uint16_t)uFrame.pu64[4];
3597 }
3598 else if (enmEffOpSize == IEMMODE_32BIT)
3599 {
3600 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3601 if (rcStrict != VINF_SUCCESS)
3602 return rcStrict;
3603 uNewRip = uFrame.pu32[0];
3604 uNewCs = (uint16_t)uFrame.pu32[1];
3605 uNewFlags = uFrame.pu32[2];
3606 uNewRsp = uFrame.pu32[3];
3607 uNewSs = (uint16_t)uFrame.pu32[4];
3608 }
3609 else
3610 {
3611 Assert(enmEffOpSize == IEMMODE_16BIT);
3612 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3613 if (rcStrict != VINF_SUCCESS)
3614 return rcStrict;
3615 uNewRip = uFrame.pu16[0];
3616 uNewCs = uFrame.pu16[1];
3617 uNewFlags = uFrame.pu16[2];
3618 uNewRsp = uFrame.pu16[3];
3619 uNewSs = uFrame.pu16[4];
3620 }
3621 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3622 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3623 { /* extremely like */ }
3624 else
3625 return rcStrict;
3626 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3627
3628 /*
3629 * Check stuff.
3630 */
3631 /* Read the CS descriptor. */
3632 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3633 {
3634 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3635 return iemRaiseGeneralProtectionFault0(pVCpu);
3636 }
3637
3638 IEMSELDESC DescCS;
3639 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3640 if (rcStrict != VINF_SUCCESS)
3641 {
3642 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3643 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3644 return rcStrict;
3645 }
3646
3647 /* Must be a code descriptor. */
3648 if ( !DescCS.Legacy.Gen.u1DescType
3649 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3650 {
3651 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3652 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3653 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3654 }
3655
3656 /* Privilege checks. */
3657 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3658 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3659 {
3660 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3661 {
3662 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3663 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3664 }
3665 }
3666 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3667 {
3668 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3669 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3670 }
3671 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3672 {
3673 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3674 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3675 }
3676
3677 /* Present? */
3678 if (!DescCS.Legacy.Gen.u1Present)
3679 {
3680 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3681 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3682 }
3683
3684 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3685
3686 /* Read the SS descriptor. */
3687 IEMSELDESC DescSS;
3688 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3689 {
3690 if ( !DescCS.Legacy.Gen.u1Long
3691 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3692 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3693 {
3694 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3695 return iemRaiseGeneralProtectionFault0(pVCpu);
3696 }
3697 DescSS.Legacy.u = 0;
3698 }
3699 else
3700 {
3701 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3702 if (rcStrict != VINF_SUCCESS)
3703 {
3704 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3705 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3706 return rcStrict;
3707 }
3708 }
3709
3710 /* Privilege checks. */
3711 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3712 {
3713 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3714 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3715 }
3716
3717 uint32_t cbLimitSs;
3718 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3719 cbLimitSs = UINT32_MAX;
3720 else
3721 {
3722 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3723 {
3724 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3725 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3726 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3727 }
3728
3729 /* Must be a writeable data segment descriptor. */
3730 if (!DescSS.Legacy.Gen.u1DescType)
3731 {
3732 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3733 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3734 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3735 }
3736 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3737 {
3738 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3739 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3740 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3741 }
3742
3743 /* Present? */
3744 if (!DescSS.Legacy.Gen.u1Present)
3745 {
3746 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3747 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3748 }
3749 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3750 }
3751
3752 /* Check EIP. */
3753 if (DescCS.Legacy.Gen.u1Long)
3754 {
3755 if (!IEM_IS_CANONICAL(uNewRip))
3756 {
3757 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3758 uNewCs, uNewRip, uNewSs, uNewRsp));
3759 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3760 }
3761 }
3762 else
3763 {
3764 if (uNewRip > cbLimitCS)
3765 {
3766 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3767 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3768 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3769 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3770 }
3771 }
3772
3773 /*
3774 * Commit the changes, marking CS and SS accessed first since
3775 * that may fail.
3776 */
3777 /** @todo where exactly are these actually marked accessed by a real CPU? */
3778 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3779 {
3780 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3781 if (rcStrict != VINF_SUCCESS)
3782 return rcStrict;
3783 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3784 }
3785 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3786 {
3787 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3788 if (rcStrict != VINF_SUCCESS)
3789 return rcStrict;
3790 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3791 }
3792
3793 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3794 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3795 if (enmEffOpSize != IEMMODE_16BIT)
3796 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3797 if (pVCpu->iem.s.uCpl == 0)
3798 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3799 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3800 fEFlagsMask |= X86_EFL_IF;
3801 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3802 fEFlagsNew &= ~fEFlagsMask;
3803 fEFlagsNew |= uNewFlags & fEFlagsMask;
3804#ifdef DBGFTRACE_ENABLED
3805 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3806 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3807#endif
3808
3809 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3810 pCtx->rip = uNewRip;
3811 pCtx->cs.Sel = uNewCs;
3812 pCtx->cs.ValidSel = uNewCs;
3813 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3814 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3815 pCtx->cs.u32Limit = cbLimitCS;
3816 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3817 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3818 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3819 pCtx->rsp = uNewRsp;
3820 else
3821 pCtx->sp = (uint16_t)uNewRsp;
3822 pCtx->ss.Sel = uNewSs;
3823 pCtx->ss.ValidSel = uNewSs;
3824 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3825 {
3826 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3827 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3828 pCtx->ss.u32Limit = UINT32_MAX;
3829 pCtx->ss.u64Base = 0;
3830 Log2(("iretq new SS: NULL\n"));
3831 }
3832 else
3833 {
3834 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3835 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3836 pCtx->ss.u32Limit = cbLimitSs;
3837 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3838 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3839 }
3840
3841 if (pVCpu->iem.s.uCpl != uNewCpl)
3842 {
3843 pVCpu->iem.s.uCpl = uNewCpl;
3844 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3845 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3846 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3847 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3848 }
3849
3850 /* Flush the prefetch buffer. */
3851#ifdef IEM_WITH_CODE_TLB
3852 pVCpu->iem.s.pbInstrBuf = NULL;
3853#else
3854 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3855#endif
3856
3857 return VINF_SUCCESS;
3858}
3859
3860
3861/**
3862 * Implements iret.
3863 *
3864 * @param enmEffOpSize The effective operand size.
3865 */
3866IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3867{
3868 /*
3869 * First, clear NMI blocking, if any, before causing any exceptions.
3870 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3871 */
3872 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3873
3874 /*
3875 * The SVM nested-guest intercept for iret takes priority over all exceptions,
3876 * see AMD spec. "15.9 Instruction Intercepts".
3877 */
3878 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3879 {
3880 Log(("iret: Guest intercept -> #VMEXIT\n"));
3881 IEM_SVM_UPDATE_NRIP(pVCpu);
3882 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3883 }
3884
3885 /*
3886 * Call a mode specific worker.
3887 */
3888 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3889 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3890 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3891 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3892 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3893}
3894
3895
3896/**
3897 * Implements SYSCALL (AMD and Intel64).
3898 *
3899 * @param enmEffOpSize The effective operand size.
3900 */
3901IEM_CIMPL_DEF_0(iemCImpl_syscall)
3902{
3903 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3904
3905 /*
3906 * Check preconditions.
3907 *
3908 * Note that CPUs described in the documentation may load a few odd values
3909 * into CS and SS than we allow here. This has yet to be checked on real
3910 * hardware.
3911 */
3912 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3913 {
3914 Log(("syscall: Not enabled in EFER -> #UD\n"));
3915 return iemRaiseUndefinedOpcode(pVCpu);
3916 }
3917 if (!(pCtx->cr0 & X86_CR0_PE))
3918 {
3919 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3920 return iemRaiseGeneralProtectionFault0(pVCpu);
3921 }
3922 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3923 {
3924 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3925 return iemRaiseUndefinedOpcode(pVCpu);
3926 }
3927
3928 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3929 /** @todo what about LDT selectors? Shouldn't matter, really. */
3930 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3931 uint16_t uNewSs = uNewCs + 8;
3932 if (uNewCs == 0 || uNewSs == 0)
3933 {
3934 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3935 return iemRaiseGeneralProtectionFault0(pVCpu);
3936 }
3937
3938 /* Long mode and legacy mode differs. */
3939 if (CPUMIsGuestInLongModeEx(pCtx))
3940 {
3941 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3942
3943 /* This test isn't in the docs, but I'm not trusting the guys writing
3944 the MSRs to have validated the values as canonical like they should. */
3945 if (!IEM_IS_CANONICAL(uNewRip))
3946 {
3947 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3948 return iemRaiseUndefinedOpcode(pVCpu);
3949 }
3950
3951 /*
3952 * Commit it.
3953 */
3954 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3955 pCtx->rcx = pCtx->rip + cbInstr;
3956 pCtx->rip = uNewRip;
3957
3958 pCtx->rflags.u &= ~X86_EFL_RF;
3959 pCtx->r11 = pCtx->rflags.u;
3960 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3961 pCtx->rflags.u |= X86_EFL_1;
3962
3963 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3964 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3965 }
3966 else
3967 {
3968 /*
3969 * Commit it.
3970 */
3971 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3972 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3973 pCtx->rcx = pCtx->eip + cbInstr;
3974 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3975 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3976
3977 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3978 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3979 }
3980 pCtx->cs.Sel = uNewCs;
3981 pCtx->cs.ValidSel = uNewCs;
3982 pCtx->cs.u64Base = 0;
3983 pCtx->cs.u32Limit = UINT32_MAX;
3984 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3985
3986 pCtx->ss.Sel = uNewSs;
3987 pCtx->ss.ValidSel = uNewSs;
3988 pCtx->ss.u64Base = 0;
3989 pCtx->ss.u32Limit = UINT32_MAX;
3990 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3991
3992 /* Flush the prefetch buffer. */
3993#ifdef IEM_WITH_CODE_TLB
3994 pVCpu->iem.s.pbInstrBuf = NULL;
3995#else
3996 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3997#endif
3998
3999 return VINF_SUCCESS;
4000}
4001
4002
4003/**
4004 * Implements SYSRET (AMD and Intel64).
4005 */
4006IEM_CIMPL_DEF_0(iemCImpl_sysret)
4007
4008{
4009 RT_NOREF_PV(cbInstr);
4010 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4011
4012 /*
4013 * Check preconditions.
4014 *
4015 * Note that CPUs described in the documentation may load a few odd values
4016 * into CS and SS than we allow here. This has yet to be checked on real
4017 * hardware.
4018 */
4019 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
4020 {
4021 Log(("sysret: Not enabled in EFER -> #UD\n"));
4022 return iemRaiseUndefinedOpcode(pVCpu);
4023 }
4024 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
4025 {
4026 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4027 return iemRaiseUndefinedOpcode(pVCpu);
4028 }
4029 if (!(pCtx->cr0 & X86_CR0_PE))
4030 {
4031 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4032 return iemRaiseGeneralProtectionFault0(pVCpu);
4033 }
4034 if (pVCpu->iem.s.uCpl != 0)
4035 {
4036 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4037 return iemRaiseGeneralProtectionFault0(pVCpu);
4038 }
4039
4040 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4041 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4042 uint16_t uNewSs = uNewCs + 8;
4043 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4044 uNewCs += 16;
4045 if (uNewCs == 0 || uNewSs == 0)
4046 {
4047 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4048 return iemRaiseGeneralProtectionFault0(pVCpu);
4049 }
4050
4051 /*
4052 * Commit it.
4053 */
4054 if (CPUMIsGuestInLongModeEx(pCtx))
4055 {
4056 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4057 {
4058 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4059 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
4060 /* Note! We disregard intel manual regarding the RCX cananonical
4061 check, ask intel+xen why AMD doesn't do it. */
4062 pCtx->rip = pCtx->rcx;
4063 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4064 | (3 << X86DESCATTR_DPL_SHIFT);
4065 }
4066 else
4067 {
4068 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4069 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
4070 pCtx->rip = pCtx->ecx;
4071 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4072 | (3 << X86DESCATTR_DPL_SHIFT);
4073 }
4074 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4075 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4076 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4077 pCtx->rflags.u |= X86_EFL_1;
4078 }
4079 else
4080 {
4081 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
4082 pCtx->rip = pCtx->rcx;
4083 pCtx->rflags.u |= X86_EFL_IF;
4084 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4085 | (3 << X86DESCATTR_DPL_SHIFT);
4086 }
4087 pCtx->cs.Sel = uNewCs | 3;
4088 pCtx->cs.ValidSel = uNewCs | 3;
4089 pCtx->cs.u64Base = 0;
4090 pCtx->cs.u32Limit = UINT32_MAX;
4091 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
4092
4093 pCtx->ss.Sel = uNewSs | 3;
4094 pCtx->ss.ValidSel = uNewSs | 3;
4095 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
4096 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4097 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4098 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4099 * on sysret. */
4100
4101 /* Flush the prefetch buffer. */
4102#ifdef IEM_WITH_CODE_TLB
4103 pVCpu->iem.s.pbInstrBuf = NULL;
4104#else
4105 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4106#endif
4107
4108 return VINF_SUCCESS;
4109}
4110
4111
4112/**
4113 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4114 *
4115 * @param iSegReg The segment register number (valid).
4116 * @param uSel The new selector value.
4117 */
4118IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4119{
4120 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4121 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4122 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4123
4124 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4125
4126 /*
4127 * Real mode and V8086 mode are easy.
4128 */
4129 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4130 {
4131 *pSel = uSel;
4132 pHid->u64Base = (uint32_t)uSel << 4;
4133 pHid->ValidSel = uSel;
4134 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4135#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4136 /** @todo Does the CPU actually load limits and attributes in the
4137 * real/V8086 mode segment load case? It doesn't for CS in far
4138 * jumps... Affects unreal mode. */
4139 pHid->u32Limit = 0xffff;
4140 pHid->Attr.u = 0;
4141 pHid->Attr.n.u1Present = 1;
4142 pHid->Attr.n.u1DescType = 1;
4143 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4144 ? X86_SEL_TYPE_RW
4145 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4146#endif
4147 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4148 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4149 return VINF_SUCCESS;
4150 }
4151
4152 /*
4153 * Protected mode.
4154 *
4155 * Check if it's a null segment selector value first, that's OK for DS, ES,
4156 * FS and GS. If not null, then we have to load and parse the descriptor.
4157 */
4158 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4159 {
4160 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4161 if (iSegReg == X86_SREG_SS)
4162 {
4163 /* In 64-bit kernel mode, the stack can be 0 because of the way
4164 interrupts are dispatched. AMD seems to have a slighly more
4165 relaxed relationship to SS.RPL than intel does. */
4166 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4167 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4168 || pVCpu->iem.s.uCpl > 2
4169 || ( uSel != pVCpu->iem.s.uCpl
4170 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4171 {
4172 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4173 return iemRaiseGeneralProtectionFault0(pVCpu);
4174 }
4175 }
4176
4177 *pSel = uSel; /* Not RPL, remember :-) */
4178 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4179 if (iSegReg == X86_SREG_SS)
4180 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4181
4182 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4183 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4184
4185 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4186 return VINF_SUCCESS;
4187 }
4188
4189 /* Fetch the descriptor. */
4190 IEMSELDESC Desc;
4191 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4192 if (rcStrict != VINF_SUCCESS)
4193 return rcStrict;
4194
4195 /* Check GPs first. */
4196 if (!Desc.Legacy.Gen.u1DescType)
4197 {
4198 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4199 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4200 }
4201 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4202 {
4203 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4204 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4205 {
4206 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4207 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4208 }
4209 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4210 {
4211 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4212 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4213 }
4214 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4215 {
4216 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4217 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4218 }
4219 }
4220 else
4221 {
4222 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4223 {
4224 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4225 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4226 }
4227 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4228 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4229 {
4230#if 0 /* this is what intel says. */
4231 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4232 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4233 {
4234 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4235 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4236 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4237 }
4238#else /* this is what makes more sense. */
4239 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4240 {
4241 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4242 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4243 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4244 }
4245 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4246 {
4247 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4248 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4249 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4250 }
4251#endif
4252 }
4253 }
4254
4255 /* Is it there? */
4256 if (!Desc.Legacy.Gen.u1Present)
4257 {
4258 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4259 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4260 }
4261
4262 /* The base and limit. */
4263 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4264 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4265
4266 /*
4267 * Ok, everything checked out fine. Now set the accessed bit before
4268 * committing the result into the registers.
4269 */
4270 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4271 {
4272 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4273 if (rcStrict != VINF_SUCCESS)
4274 return rcStrict;
4275 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4276 }
4277
4278 /* commit */
4279 *pSel = uSel;
4280 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4281 pHid->u32Limit = cbLimit;
4282 pHid->u64Base = u64Base;
4283 pHid->ValidSel = uSel;
4284 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4285
4286 /** @todo check if the hidden bits are loaded correctly for 64-bit
4287 * mode. */
4288 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4289
4290 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4291 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4292 return VINF_SUCCESS;
4293}
4294
4295
4296/**
4297 * Implements 'mov SReg, r/m'.
4298 *
4299 * @param iSegReg The segment register number (valid).
4300 * @param uSel The new selector value.
4301 */
4302IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4303{
4304 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4305 if (rcStrict == VINF_SUCCESS)
4306 {
4307 if (iSegReg == X86_SREG_SS)
4308 {
4309 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4310 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4311 }
4312 }
4313 return rcStrict;
4314}
4315
4316
4317/**
4318 * Implements 'pop SReg'.
4319 *
4320 * @param iSegReg The segment register number (valid).
4321 * @param enmEffOpSize The efficient operand size (valid).
4322 */
4323IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4324{
4325 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4326 VBOXSTRICTRC rcStrict;
4327
4328 /*
4329 * Read the selector off the stack and join paths with mov ss, reg.
4330 */
4331 RTUINT64U TmpRsp;
4332 TmpRsp.u = pCtx->rsp;
4333 switch (enmEffOpSize)
4334 {
4335 case IEMMODE_16BIT:
4336 {
4337 uint16_t uSel;
4338 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4339 if (rcStrict == VINF_SUCCESS)
4340 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4341 break;
4342 }
4343
4344 case IEMMODE_32BIT:
4345 {
4346 uint32_t u32Value;
4347 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4348 if (rcStrict == VINF_SUCCESS)
4349 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4350 break;
4351 }
4352
4353 case IEMMODE_64BIT:
4354 {
4355 uint64_t u64Value;
4356 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4357 if (rcStrict == VINF_SUCCESS)
4358 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4359 break;
4360 }
4361 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4362 }
4363
4364 /*
4365 * Commit the stack on success.
4366 */
4367 if (rcStrict == VINF_SUCCESS)
4368 {
4369 pCtx->rsp = TmpRsp.u;
4370 if (iSegReg == X86_SREG_SS)
4371 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4372 }
4373 return rcStrict;
4374}
4375
4376
4377/**
4378 * Implements lgs, lfs, les, lds & lss.
4379 */
4380IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4381 uint16_t, uSel,
4382 uint64_t, offSeg,
4383 uint8_t, iSegReg,
4384 uint8_t, iGReg,
4385 IEMMODE, enmEffOpSize)
4386{
4387 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4388 VBOXSTRICTRC rcStrict;
4389
4390 /*
4391 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4392 */
4393 /** @todo verify and test that mov, pop and lXs works the segment
4394 * register loading in the exact same way. */
4395 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4396 if (rcStrict == VINF_SUCCESS)
4397 {
4398 switch (enmEffOpSize)
4399 {
4400 case IEMMODE_16BIT:
4401 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4402 break;
4403 case IEMMODE_32BIT:
4404 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4405 break;
4406 case IEMMODE_64BIT:
4407 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4408 break;
4409 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4410 }
4411 }
4412
4413 return rcStrict;
4414}
4415
4416
4417/**
4418 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4419 *
4420 * @retval VINF_SUCCESS on success.
4421 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4422 * @retval iemMemFetchSysU64 return value.
4423 *
4424 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4425 * @param uSel The selector value.
4426 * @param fAllowSysDesc Whether system descriptors are OK or not.
4427 * @param pDesc Where to return the descriptor on success.
4428 */
4429static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4430{
4431 pDesc->Long.au64[0] = 0;
4432 pDesc->Long.au64[1] = 0;
4433
4434 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4435 return VINF_IEM_SELECTOR_NOT_OK;
4436
4437 /* Within the table limits? */
4438 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4439 RTGCPTR GCPtrBase;
4440 if (uSel & X86_SEL_LDT)
4441 {
4442 if ( !pCtx->ldtr.Attr.n.u1Present
4443 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4444 return VINF_IEM_SELECTOR_NOT_OK;
4445 GCPtrBase = pCtx->ldtr.u64Base;
4446 }
4447 else
4448 {
4449 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4450 return VINF_IEM_SELECTOR_NOT_OK;
4451 GCPtrBase = pCtx->gdtr.pGdt;
4452 }
4453
4454 /* Fetch the descriptor. */
4455 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4456 if (rcStrict != VINF_SUCCESS)
4457 return rcStrict;
4458 if (!pDesc->Legacy.Gen.u1DescType)
4459 {
4460 if (!fAllowSysDesc)
4461 return VINF_IEM_SELECTOR_NOT_OK;
4462 if (CPUMIsGuestInLongModeEx(pCtx))
4463 {
4464 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4465 if (rcStrict != VINF_SUCCESS)
4466 return rcStrict;
4467 }
4468
4469 }
4470
4471 return VINF_SUCCESS;
4472}
4473
4474
4475/**
4476 * Implements verr (fWrite = false) and verw (fWrite = true).
4477 */
4478IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4479{
4480 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4481
4482 /** @todo figure whether the accessed bit is set or not. */
4483
4484 bool fAccessible = true;
4485 IEMSELDESC Desc;
4486 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4487 if (rcStrict == VINF_SUCCESS)
4488 {
4489 /* Check the descriptor, order doesn't matter much here. */
4490 if ( !Desc.Legacy.Gen.u1DescType
4491 || !Desc.Legacy.Gen.u1Present)
4492 fAccessible = false;
4493 else
4494 {
4495 if ( fWrite
4496 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4497 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4498 fAccessible = false;
4499
4500 /** @todo testcase for the conforming behavior. */
4501 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4502 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4503 {
4504 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4505 fAccessible = false;
4506 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4507 fAccessible = false;
4508 }
4509 }
4510
4511 }
4512 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4513 fAccessible = false;
4514 else
4515 return rcStrict;
4516
4517 /* commit */
4518 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4519
4520 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4521 return VINF_SUCCESS;
4522}
4523
4524
4525/**
4526 * Implements LAR and LSL with 64-bit operand size.
4527 *
4528 * @returns VINF_SUCCESS.
4529 * @param pu16Dst Pointer to the destination register.
4530 * @param uSel The selector to load details for.
4531 * @param fIsLar true = LAR, false = LSL.
4532 */
4533IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4534{
4535 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4536
4537 /** @todo figure whether the accessed bit is set or not. */
4538
4539 bool fDescOk = true;
4540 IEMSELDESC Desc;
4541 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4542 if (rcStrict == VINF_SUCCESS)
4543 {
4544 /*
4545 * Check the descriptor type.
4546 */
4547 if (!Desc.Legacy.Gen.u1DescType)
4548 {
4549 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4550 {
4551 if (Desc.Long.Gen.u5Zeros)
4552 fDescOk = false;
4553 else
4554 switch (Desc.Long.Gen.u4Type)
4555 {
4556 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4557 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4558 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4559 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4560 break;
4561 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4562 fDescOk = fIsLar;
4563 break;
4564 default:
4565 fDescOk = false;
4566 break;
4567 }
4568 }
4569 else
4570 {
4571 switch (Desc.Long.Gen.u4Type)
4572 {
4573 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4574 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4575 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4576 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4577 case X86_SEL_TYPE_SYS_LDT:
4578 break;
4579 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4580 case X86_SEL_TYPE_SYS_TASK_GATE:
4581 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4582 fDescOk = fIsLar;
4583 break;
4584 default:
4585 fDescOk = false;
4586 break;
4587 }
4588 }
4589 }
4590 if (fDescOk)
4591 {
4592 /*
4593 * Check the RPL/DPL/CPL interaction..
4594 */
4595 /** @todo testcase for the conforming behavior. */
4596 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4597 || !Desc.Legacy.Gen.u1DescType)
4598 {
4599 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4600 fDescOk = false;
4601 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4602 fDescOk = false;
4603 }
4604 }
4605
4606 if (fDescOk)
4607 {
4608 /*
4609 * All fine, start committing the result.
4610 */
4611 if (fIsLar)
4612 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4613 else
4614 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4615 }
4616
4617 }
4618 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4619 fDescOk = false;
4620 else
4621 return rcStrict;
4622
4623 /* commit flags value and advance rip. */
4624 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4625 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4626
4627 return VINF_SUCCESS;
4628}
4629
4630
4631/**
4632 * Implements LAR and LSL with 16-bit operand size.
4633 *
4634 * @returns VINF_SUCCESS.
4635 * @param pu16Dst Pointer to the destination register.
4636 * @param u16Sel The selector to load details for.
4637 * @param fIsLar true = LAR, false = LSL.
4638 */
4639IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4640{
4641 uint64_t u64TmpDst = *pu16Dst;
4642 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4643 *pu16Dst = u64TmpDst;
4644 return VINF_SUCCESS;
4645}
4646
4647
4648/**
4649 * Implements lgdt.
4650 *
4651 * @param iEffSeg The segment of the new gdtr contents
4652 * @param GCPtrEffSrc The address of the new gdtr contents.
4653 * @param enmEffOpSize The effective operand size.
4654 */
4655IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4656{
4657 if (pVCpu->iem.s.uCpl != 0)
4658 return iemRaiseGeneralProtectionFault0(pVCpu);
4659 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4660
4661 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
4662 {
4663 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
4664 IEM_SVM_UPDATE_NRIP(pVCpu);
4665 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4666 }
4667
4668 /*
4669 * Fetch the limit and base address.
4670 */
4671 uint16_t cbLimit;
4672 RTGCPTR GCPtrBase;
4673 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4674 if (rcStrict == VINF_SUCCESS)
4675 {
4676 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4677 || X86_IS_CANONICAL(GCPtrBase))
4678 {
4679 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4680 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4681 else
4682 {
4683 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4684 pCtx->gdtr.cbGdt = cbLimit;
4685 pCtx->gdtr.pGdt = GCPtrBase;
4686 }
4687 if (rcStrict == VINF_SUCCESS)
4688 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4689 }
4690 else
4691 {
4692 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4693 return iemRaiseGeneralProtectionFault0(pVCpu);
4694 }
4695 }
4696 return rcStrict;
4697}
4698
4699
4700/**
4701 * Implements sgdt.
4702 *
4703 * @param iEffSeg The segment where to store the gdtr content.
4704 * @param GCPtrEffDst The address where to store the gdtr content.
4705 */
4706IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4707{
4708 /*
4709 * Join paths with sidt.
4710 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4711 * you really must know.
4712 */
4713 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
4714 {
4715 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
4716 IEM_SVM_UPDATE_NRIP(pVCpu);
4717 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4718 }
4719
4720 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4721 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4722 if (rcStrict == VINF_SUCCESS)
4723 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4724 return rcStrict;
4725}
4726
4727
4728/**
4729 * Implements lidt.
4730 *
4731 * @param iEffSeg The segment of the new idtr contents
4732 * @param GCPtrEffSrc The address of the new idtr contents.
4733 * @param enmEffOpSize The effective operand size.
4734 */
4735IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4736{
4737 if (pVCpu->iem.s.uCpl != 0)
4738 return iemRaiseGeneralProtectionFault0(pVCpu);
4739 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4740
4741 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
4742 {
4743 Log(("lidt: Guest intercept -> #VMEXIT\n"));
4744 IEM_SVM_UPDATE_NRIP(pVCpu);
4745 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4746 }
4747
4748 /*
4749 * Fetch the limit and base address.
4750 */
4751 uint16_t cbLimit;
4752 RTGCPTR GCPtrBase;
4753 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4754 if (rcStrict == VINF_SUCCESS)
4755 {
4756 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4757 || X86_IS_CANONICAL(GCPtrBase))
4758 {
4759 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4760 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4761 else
4762 {
4763 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4764 pCtx->idtr.cbIdt = cbLimit;
4765 pCtx->idtr.pIdt = GCPtrBase;
4766 }
4767 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4768 }
4769 else
4770 {
4771 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4772 return iemRaiseGeneralProtectionFault0(pVCpu);
4773 }
4774 }
4775 return rcStrict;
4776}
4777
4778
4779/**
4780 * Implements sidt.
4781 *
4782 * @param iEffSeg The segment where to store the idtr content.
4783 * @param GCPtrEffDst The address where to store the idtr content.
4784 */
4785IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4786{
4787 /*
4788 * Join paths with sgdt.
4789 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4790 * you really must know.
4791 */
4792 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
4793 {
4794 Log(("sidt: Guest intercept -> #VMEXIT\n"));
4795 IEM_SVM_UPDATE_NRIP(pVCpu);
4796 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4797 }
4798
4799 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4800 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4801 if (rcStrict == VINF_SUCCESS)
4802 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4803 return rcStrict;
4804}
4805
4806
4807/**
4808 * Implements lldt.
4809 *
4810 * @param uNewLdt The new LDT selector value.
4811 */
4812IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4813{
4814 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4815
4816 /*
4817 * Check preconditions.
4818 */
4819 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4820 {
4821 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4822 return iemRaiseUndefinedOpcode(pVCpu);
4823 }
4824 if (pVCpu->iem.s.uCpl != 0)
4825 {
4826 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4827 return iemRaiseGeneralProtectionFault0(pVCpu);
4828 }
4829 if (uNewLdt & X86_SEL_LDT)
4830 {
4831 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4832 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4833 }
4834
4835 /*
4836 * Now, loading a NULL selector is easy.
4837 */
4838 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4839 {
4840 /* Nested-guest SVM intercept. */
4841 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
4842 {
4843 Log(("lldt: Guest intercept -> #VMEXIT\n"));
4844 IEM_SVM_UPDATE_NRIP(pVCpu);
4845 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4846 }
4847
4848 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4849 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4850 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4851 else
4852 pCtx->ldtr.Sel = uNewLdt;
4853 pCtx->ldtr.ValidSel = uNewLdt;
4854 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4855 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4856 {
4857 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4858 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4859 }
4860 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4861 {
4862 /* AMD-V seems to leave the base and limit alone. */
4863 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4864 }
4865 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4866 {
4867 /* VT-x (Intel 3960x) seems to be doing the following. */
4868 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4869 pCtx->ldtr.u64Base = 0;
4870 pCtx->ldtr.u32Limit = UINT32_MAX;
4871 }
4872
4873 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4874 return VINF_SUCCESS;
4875 }
4876
4877 /*
4878 * Read the descriptor.
4879 */
4880 IEMSELDESC Desc;
4881 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4882 if (rcStrict != VINF_SUCCESS)
4883 return rcStrict;
4884
4885 /* Check GPs first. */
4886 if (Desc.Legacy.Gen.u1DescType)
4887 {
4888 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4889 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4890 }
4891 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4892 {
4893 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4894 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4895 }
4896 uint64_t u64Base;
4897 if (!IEM_IS_LONG_MODE(pVCpu))
4898 u64Base = X86DESC_BASE(&Desc.Legacy);
4899 else
4900 {
4901 if (Desc.Long.Gen.u5Zeros)
4902 {
4903 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4904 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4905 }
4906
4907 u64Base = X86DESC64_BASE(&Desc.Long);
4908 if (!IEM_IS_CANONICAL(u64Base))
4909 {
4910 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4911 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4912 }
4913 }
4914
4915 /* NP */
4916 if (!Desc.Legacy.Gen.u1Present)
4917 {
4918 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4919 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4920 }
4921
4922 /* Nested-guest SVM intercept. */
4923 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
4924 {
4925 Log(("lldt: Guest intercept -> #VMEXIT\n"));
4926 IEM_SVM_UPDATE_NRIP(pVCpu);
4927 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4928 }
4929
4930 /*
4931 * It checks out alright, update the registers.
4932 */
4933/** @todo check if the actual value is loaded or if the RPL is dropped */
4934 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4935 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4936 else
4937 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4938 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4939 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4940 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4941 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4942 pCtx->ldtr.u64Base = u64Base;
4943
4944 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4945 return VINF_SUCCESS;
4946}
4947
4948
4949/**
4950 * Implements lldt.
4951 *
4952 * @param uNewLdt The new LDT selector value.
4953 */
4954IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4955{
4956 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4957
4958 /*
4959 * Check preconditions.
4960 */
4961 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4962 {
4963 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4964 return iemRaiseUndefinedOpcode(pVCpu);
4965 }
4966 if (pVCpu->iem.s.uCpl != 0)
4967 {
4968 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4969 return iemRaiseGeneralProtectionFault0(pVCpu);
4970 }
4971 if (uNewTr & X86_SEL_LDT)
4972 {
4973 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4974 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4975 }
4976 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4977 {
4978 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4979 return iemRaiseGeneralProtectionFault0(pVCpu);
4980 }
4981 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
4982 {
4983 Log(("ltr: Guest intercept -> #VMEXIT\n"));
4984 IEM_SVM_UPDATE_NRIP(pVCpu);
4985 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4986 }
4987
4988 /*
4989 * Read the descriptor.
4990 */
4991 IEMSELDESC Desc;
4992 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4993 if (rcStrict != VINF_SUCCESS)
4994 return rcStrict;
4995
4996 /* Check GPs first. */
4997 if (Desc.Legacy.Gen.u1DescType)
4998 {
4999 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5000 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5001 }
5002 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5003 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5004 || IEM_IS_LONG_MODE(pVCpu)) )
5005 {
5006 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5007 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5008 }
5009 uint64_t u64Base;
5010 if (!IEM_IS_LONG_MODE(pVCpu))
5011 u64Base = X86DESC_BASE(&Desc.Legacy);
5012 else
5013 {
5014 if (Desc.Long.Gen.u5Zeros)
5015 {
5016 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5017 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5018 }
5019
5020 u64Base = X86DESC64_BASE(&Desc.Long);
5021 if (!IEM_IS_CANONICAL(u64Base))
5022 {
5023 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5024 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5025 }
5026 }
5027
5028 /* NP */
5029 if (!Desc.Legacy.Gen.u1Present)
5030 {
5031 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5032 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5033 }
5034
5035 /*
5036 * Set it busy.
5037 * Note! Intel says this should lock down the whole descriptor, but we'll
5038 * restrict our selves to 32-bit for now due to lack of inline
5039 * assembly and such.
5040 */
5041 void *pvDesc;
5042 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
5043 if (rcStrict != VINF_SUCCESS)
5044 return rcStrict;
5045 switch ((uintptr_t)pvDesc & 3)
5046 {
5047 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5048 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5049 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5050 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5051 }
5052 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5053 if (rcStrict != VINF_SUCCESS)
5054 return rcStrict;
5055 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5056
5057 /*
5058 * It checks out alright, update the registers.
5059 */
5060/** @todo check if the actual value is loaded or if the RPL is dropped */
5061 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5062 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5063 else
5064 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
5065 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5066 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
5067 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5068 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5069 pCtx->tr.u64Base = u64Base;
5070
5071 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5072 return VINF_SUCCESS;
5073}
5074
5075
5076/**
5077 * Implements mov GReg,CRx.
5078 *
5079 * @param iGReg The general register to store the CRx value in.
5080 * @param iCrReg The CRx register to read (valid).
5081 */
5082IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5083{
5084 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5085 if (pVCpu->iem.s.uCpl != 0)
5086 return iemRaiseGeneralProtectionFault0(pVCpu);
5087 Assert(!pCtx->eflags.Bits.u1VM);
5088
5089 if (IEM_IS_SVM_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5090 {
5091 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5092 IEM_SVM_UPDATE_NRIP(pVCpu);
5093 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5094 }
5095
5096 /* read it */
5097 uint64_t crX;
5098 switch (iCrReg)
5099 {
5100 case 0:
5101 crX = pCtx->cr0;
5102 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5103 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5104 break;
5105 case 2: crX = pCtx->cr2; break;
5106 case 3: crX = pCtx->cr3; break;
5107 case 4: crX = pCtx->cr4; break;
5108 case 8:
5109 {
5110#ifdef VBOX_WITH_NESTED_HWVIRT
5111 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5112 {
5113 PCSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5114 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, pCtx))
5115 {
5116 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5117 break;
5118 }
5119 }
5120#endif
5121 uint8_t uTpr;
5122 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5123 if (RT_SUCCESS(rc))
5124 crX = uTpr >> 4;
5125 else
5126 crX = 0;
5127 break;
5128 }
5129 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5130 }
5131
5132 /* store it */
5133 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5134 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5135 else
5136 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5137
5138 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5139 return VINF_SUCCESS;
5140}
5141
5142
5143/**
5144 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5145 *
5146 * @param iCrReg The CRx register to write (valid).
5147 * @param uNewCrX The new value.
5148 * @param enmAccessCrx The instruction that caused the CrX load.
5149 * @param iGReg The general register in case of a 'mov CRx,GReg'
5150 * instruction.
5151 */
5152IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5153{
5154 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5155 VBOXSTRICTRC rcStrict;
5156 int rc;
5157#ifndef VBOX_WITH_NESTED_HWVIRT
5158 RT_NOREF2(iGReg, enmAccessCrX);
5159#endif
5160
5161 /*
5162 * Try store it.
5163 * Unfortunately, CPUM only does a tiny bit of the work.
5164 */
5165 switch (iCrReg)
5166 {
5167 case 0:
5168 {
5169 /*
5170 * Perform checks.
5171 */
5172 uint64_t const uOldCrX = pCtx->cr0;
5173 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
5174 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
5175 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
5176
5177 /* ET is hardcoded on 486 and later. */
5178 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5179 uNewCrX |= X86_CR0_ET;
5180 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5181 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5182 {
5183 uNewCrX &= fValid;
5184 uNewCrX |= X86_CR0_ET;
5185 }
5186 else
5187 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5188
5189 /* Check for reserved bits. */
5190 if (uNewCrX & ~(uint64_t)fValid)
5191 {
5192 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5193 return iemRaiseGeneralProtectionFault0(pVCpu);
5194 }
5195
5196 /* Check for invalid combinations. */
5197 if ( (uNewCrX & X86_CR0_PG)
5198 && !(uNewCrX & X86_CR0_PE) )
5199 {
5200 Log(("Trying to set CR0.PG without CR0.PE\n"));
5201 return iemRaiseGeneralProtectionFault0(pVCpu);
5202 }
5203
5204 if ( !(uNewCrX & X86_CR0_CD)
5205 && (uNewCrX & X86_CR0_NW) )
5206 {
5207 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5208 return iemRaiseGeneralProtectionFault0(pVCpu);
5209 }
5210
5211 if ( !(uNewCrX & X86_CR0_PG)
5212 && (pCtx->cr4 & X86_CR4_PCIDE))
5213 {
5214 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5215 return iemRaiseGeneralProtectionFault0(pVCpu);
5216 }
5217
5218 /* Long mode consistency checks. */
5219 if ( (uNewCrX & X86_CR0_PG)
5220 && !(uOldCrX & X86_CR0_PG)
5221 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5222 {
5223 if (!(pCtx->cr4 & X86_CR4_PAE))
5224 {
5225 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5226 return iemRaiseGeneralProtectionFault0(pVCpu);
5227 }
5228 if (pCtx->cs.Attr.n.u1Long)
5229 {
5230 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5231 return iemRaiseGeneralProtectionFault0(pVCpu);
5232 }
5233 }
5234
5235 /** @todo check reserved PDPTR bits as AMD states. */
5236
5237 /*
5238 * SVM nested-guest CR0 write intercepts.
5239 */
5240 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5241 {
5242 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5243 IEM_SVM_UPDATE_NRIP(pVCpu);
5244 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5245 }
5246 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5247 {
5248 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5249 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5250 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5251 {
5252 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5253 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5254 IEM_SVM_UPDATE_NRIP(pVCpu);
5255 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5256 }
5257 }
5258
5259 /*
5260 * Change CR0.
5261 */
5262 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5263 CPUMSetGuestCR0(pVCpu, uNewCrX);
5264 else
5265 pCtx->cr0 = uNewCrX;
5266 Assert(pCtx->cr0 == uNewCrX);
5267
5268 /*
5269 * Change EFER.LMA if entering or leaving long mode.
5270 */
5271 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5272 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5273 {
5274 uint64_t NewEFER = pCtx->msrEFER;
5275 if (uNewCrX & X86_CR0_PG)
5276 NewEFER |= MSR_K6_EFER_LMA;
5277 else
5278 NewEFER &= ~MSR_K6_EFER_LMA;
5279
5280 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5281 CPUMSetGuestEFER(pVCpu, NewEFER);
5282 else
5283 pCtx->msrEFER = NewEFER;
5284 Assert(pCtx->msrEFER == NewEFER);
5285 }
5286
5287 /*
5288 * Inform PGM.
5289 */
5290 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5291 {
5292 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5293 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5294 {
5295 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5296 AssertRCReturn(rc, rc);
5297 /* ignore informational status codes */
5298 }
5299 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5300 }
5301 else
5302 rcStrict = VINF_SUCCESS;
5303
5304#ifdef IN_RC
5305 /* Return to ring-3 for rescheduling if WP or AM changes. */
5306 if ( rcStrict == VINF_SUCCESS
5307 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5308 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5309 rcStrict = VINF_EM_RESCHEDULE;
5310#endif
5311 break;
5312 }
5313
5314 /*
5315 * CR2 can be changed without any restrictions.
5316 */
5317 case 2:
5318 {
5319 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5320 {
5321 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5322 IEM_SVM_UPDATE_NRIP(pVCpu);
5323 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5324 }
5325 pCtx->cr2 = uNewCrX;
5326 rcStrict = VINF_SUCCESS;
5327 break;
5328 }
5329
5330 /*
5331 * CR3 is relatively simple, although AMD and Intel have different
5332 * accounts of how setting reserved bits are handled. We take intel's
5333 * word for the lower bits and AMD's for the high bits (63:52). The
5334 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5335 * on this.
5336 */
5337 /** @todo Testcase: Setting reserved bits in CR3, especially before
5338 * enabling paging. */
5339 case 3:
5340 {
5341 /* clear bit 63 from the source operand and indicate no invalidations are required. */
5342 if ( (pCtx->cr4 & X86_CR4_PCIDE)
5343 && (uNewCrX & RT_BIT_64(63)))
5344 {
5345 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5346 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5347 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5348 * Paging-Structure Caches". */
5349 uNewCrX &= ~RT_BIT_64(63);
5350 }
5351
5352 /* check / mask the value. */
5353 if (uNewCrX & UINT64_C(0xfff0000000000000))
5354 {
5355 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5356 return iemRaiseGeneralProtectionFault0(pVCpu);
5357 }
5358
5359 uint64_t fValid;
5360 if ( (pCtx->cr4 & X86_CR4_PAE)
5361 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5362 fValid = UINT64_C(0x000fffffffffffff);
5363 else
5364 fValid = UINT64_C(0xffffffff);
5365 if (uNewCrX & ~fValid)
5366 {
5367 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5368 uNewCrX, uNewCrX & ~fValid));
5369 uNewCrX &= fValid;
5370 }
5371
5372 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
5373 {
5374 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5375 IEM_SVM_UPDATE_NRIP(pVCpu);
5376 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
5377 }
5378
5379 /** @todo If we're in PAE mode we should check the PDPTRs for
5380 * invalid bits. */
5381
5382 /* Make the change. */
5383 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5384 {
5385 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5386 AssertRCSuccessReturn(rc, rc);
5387 }
5388 else
5389 pCtx->cr3 = uNewCrX;
5390
5391 /* Inform PGM. */
5392 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5393 {
5394 if (pCtx->cr0 & X86_CR0_PG)
5395 {
5396 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5397 AssertRCReturn(rc, rc);
5398 /* ignore informational status codes */
5399 }
5400 }
5401 rcStrict = VINF_SUCCESS;
5402 break;
5403 }
5404
5405 /*
5406 * CR4 is a bit more tedious as there are bits which cannot be cleared
5407 * under some circumstances and such.
5408 */
5409 case 4:
5410 {
5411 uint64_t const uOldCrX = pCtx->cr4;
5412
5413 /** @todo Shouldn't this look at the guest CPUID bits to determine
5414 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5415 * should #GP(0). */
5416 /* reserved bits */
5417 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5418 | X86_CR4_TSD | X86_CR4_DE
5419 | X86_CR4_PSE | X86_CR4_PAE
5420 | X86_CR4_MCE | X86_CR4_PGE
5421 | X86_CR4_PCE | X86_CR4_OSFXSR
5422 | X86_CR4_OSXMMEEXCPT;
5423 //if (xxx)
5424 // fValid |= X86_CR4_VMXE;
5425 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5426 fValid |= X86_CR4_OSXSAVE;
5427 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fPcid)
5428 fValid |= X86_CR4_PCIDE;
5429 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fFsGsBase)
5430 fValid |= X86_CR4_FSGSBASE;
5431 if (uNewCrX & ~(uint64_t)fValid)
5432 {
5433 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5434 return iemRaiseGeneralProtectionFault0(pVCpu);
5435 }
5436
5437 bool const fPcide = ((uNewCrX ^ uOldCrX) & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
5438 bool const fLongMode = CPUMIsGuestInLongModeEx(pCtx);
5439
5440 /* PCIDE check. */
5441 if ( fPcide
5442 && ( !fLongMode
5443 || (pCtx->cr3 & UINT64_C(0xfff))))
5444 {
5445 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pCtx->cr3 & UINT64_C(0xfff))));
5446 return iemRaiseGeneralProtectionFault0(pVCpu);
5447 }
5448
5449 /* PAE check. */
5450 if ( fLongMode
5451 && (uOldCrX & X86_CR4_PAE)
5452 && !(uNewCrX & X86_CR4_PAE))
5453 {
5454 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5455 return iemRaiseGeneralProtectionFault0(pVCpu);
5456 }
5457
5458 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
5459 {
5460 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5461 IEM_SVM_UPDATE_NRIP(pVCpu);
5462 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
5463 }
5464
5465 /*
5466 * Change it.
5467 */
5468 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5469 {
5470 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5471 AssertRCSuccessReturn(rc, rc);
5472 }
5473 else
5474 pCtx->cr4 = uNewCrX;
5475 Assert(pCtx->cr4 == uNewCrX);
5476
5477 /*
5478 * Notify SELM and PGM.
5479 */
5480 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5481 {
5482 /* SELM - VME may change things wrt to the TSS shadowing. */
5483 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5484 {
5485 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5486 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5487#ifdef VBOX_WITH_RAW_MODE
5488 if (VM_IS_RAW_MODE_ENABLED(pVCpu->CTX_SUFF(pVM)))
5489 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5490#endif
5491 }
5492
5493 /* PGM - flushing and mode. */
5494 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
5495 {
5496 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5497 AssertRCReturn(rc, rc);
5498 /* ignore informational status codes */
5499 }
5500 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5501 }
5502 else
5503 rcStrict = VINF_SUCCESS;
5504 break;
5505 }
5506
5507 /*
5508 * CR8 maps to the APIC TPR.
5509 */
5510 case 8:
5511 {
5512 if (uNewCrX & ~(uint64_t)0xf)
5513 {
5514 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5515 return iemRaiseGeneralProtectionFault0(pVCpu);
5516 }
5517
5518#ifdef VBOX_WITH_NESTED_HWVIRT
5519 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5520 {
5521 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
5522 {
5523 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5524 IEM_SVM_UPDATE_NRIP(pVCpu);
5525 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
5526 }
5527
5528 PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5529 pVmcbCtrl->IntCtrl.n.u8VTPR = uNewCrX;
5530 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, pCtx))
5531 {
5532 rcStrict = VINF_SUCCESS;
5533 break;
5534 }
5535 }
5536#endif
5537 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5538 {
5539 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
5540 APICSetTpr(pVCpu, u8Tpr);
5541 }
5542 rcStrict = VINF_SUCCESS;
5543 break;
5544 }
5545
5546 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5547 }
5548
5549 /*
5550 * Advance the RIP on success.
5551 */
5552 if (RT_SUCCESS(rcStrict))
5553 {
5554 if (rcStrict != VINF_SUCCESS)
5555 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5556 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5557 }
5558
5559 return rcStrict;
5560}
5561
5562
5563/**
5564 * Implements mov CRx,GReg.
5565 *
5566 * @param iCrReg The CRx register to write (valid).
5567 * @param iGReg The general register to load the DRx value from.
5568 */
5569IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5570{
5571 if (pVCpu->iem.s.uCpl != 0)
5572 return iemRaiseGeneralProtectionFault0(pVCpu);
5573 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5574
5575 /*
5576 * Read the new value from the source register and call common worker.
5577 */
5578 uint64_t uNewCrX;
5579 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5580 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5581 else
5582 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5583 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
5584}
5585
5586
5587/**
5588 * Implements 'LMSW r/m16'
5589 *
5590 * @param u16NewMsw The new value.
5591 */
5592IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5593{
5594 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5595
5596 if (pVCpu->iem.s.uCpl != 0)
5597 return iemRaiseGeneralProtectionFault0(pVCpu);
5598 Assert(!pCtx->eflags.Bits.u1VM);
5599
5600 /*
5601 * Compose the new CR0 value and call common worker.
5602 */
5603 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5604 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5605 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
5606}
5607
5608
5609/**
5610 * Implements 'CLTS'.
5611 */
5612IEM_CIMPL_DEF_0(iemCImpl_clts)
5613{
5614 if (pVCpu->iem.s.uCpl != 0)
5615 return iemRaiseGeneralProtectionFault0(pVCpu);
5616
5617 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5618 uint64_t uNewCr0 = pCtx->cr0;
5619 uNewCr0 &= ~X86_CR0_TS;
5620 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
5621}
5622
5623
5624/**
5625 * Implements mov GReg,DRx.
5626 *
5627 * @param iGReg The general register to store the DRx value in.
5628 * @param iDrReg The DRx register to read (0-7).
5629 */
5630IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5631{
5632 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5633
5634 /*
5635 * Check preconditions.
5636 */
5637
5638 /* Raise GPs. */
5639 if (pVCpu->iem.s.uCpl != 0)
5640 return iemRaiseGeneralProtectionFault0(pVCpu);
5641 Assert(!pCtx->eflags.Bits.u1VM);
5642
5643 if ( (iDrReg == 4 || iDrReg == 5)
5644 && (pCtx->cr4 & X86_CR4_DE) )
5645 {
5646 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5647 return iemRaiseGeneralProtectionFault0(pVCpu);
5648 }
5649
5650 /* Raise #DB if general access detect is enabled. */
5651 if (pCtx->dr[7] & X86_DR7_GD)
5652 {
5653 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5654 return iemRaiseDebugException(pVCpu);
5655 }
5656
5657 /*
5658 * Read the debug register and store it in the specified general register.
5659 */
5660 uint64_t drX;
5661 switch (iDrReg)
5662 {
5663 case 0: drX = pCtx->dr[0]; break;
5664 case 1: drX = pCtx->dr[1]; break;
5665 case 2: drX = pCtx->dr[2]; break;
5666 case 3: drX = pCtx->dr[3]; break;
5667 case 6:
5668 case 4:
5669 drX = pCtx->dr[6];
5670 drX |= X86_DR6_RA1_MASK;
5671 drX &= ~X86_DR6_RAZ_MASK;
5672 break;
5673 case 7:
5674 case 5:
5675 drX = pCtx->dr[7];
5676 drX |=X86_DR7_RA1_MASK;
5677 drX &= ~X86_DR7_RAZ_MASK;
5678 break;
5679 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5680 }
5681
5682 /** @todo SVM nested-guest intercept for DR8-DR15? */
5683 /*
5684 * Check for any SVM nested-guest intercepts for the DRx read.
5685 */
5686 if (IEM_IS_SVM_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
5687 {
5688 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
5689 IEM_SVM_UPDATE_NRIP(pVCpu);
5690 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
5691 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
5692 }
5693
5694 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5695 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5696 else
5697 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5698
5699 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5700 return VINF_SUCCESS;
5701}
5702
5703
5704/**
5705 * Implements mov DRx,GReg.
5706 *
5707 * @param iDrReg The DRx register to write (valid).
5708 * @param iGReg The general register to load the DRx value from.
5709 */
5710IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5711{
5712 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5713
5714 /*
5715 * Check preconditions.
5716 */
5717 if (pVCpu->iem.s.uCpl != 0)
5718 return iemRaiseGeneralProtectionFault0(pVCpu);
5719 Assert(!pCtx->eflags.Bits.u1VM);
5720
5721 if (iDrReg == 4 || iDrReg == 5)
5722 {
5723 if (pCtx->cr4 & X86_CR4_DE)
5724 {
5725 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5726 return iemRaiseGeneralProtectionFault0(pVCpu);
5727 }
5728 iDrReg += 2;
5729 }
5730
5731 /* Raise #DB if general access detect is enabled. */
5732 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5733 * \#GP? */
5734 if (pCtx->dr[7] & X86_DR7_GD)
5735 {
5736 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5737 return iemRaiseDebugException(pVCpu);
5738 }
5739
5740 /*
5741 * Read the new value from the source register.
5742 */
5743 uint64_t uNewDrX;
5744 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5745 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5746 else
5747 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5748
5749 /*
5750 * Adjust it.
5751 */
5752 switch (iDrReg)
5753 {
5754 case 0:
5755 case 1:
5756 case 2:
5757 case 3:
5758 /* nothing to adjust */
5759 break;
5760
5761 case 6:
5762 if (uNewDrX & X86_DR6_MBZ_MASK)
5763 {
5764 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5765 return iemRaiseGeneralProtectionFault0(pVCpu);
5766 }
5767 uNewDrX |= X86_DR6_RA1_MASK;
5768 uNewDrX &= ~X86_DR6_RAZ_MASK;
5769 break;
5770
5771 case 7:
5772 if (uNewDrX & X86_DR7_MBZ_MASK)
5773 {
5774 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5775 return iemRaiseGeneralProtectionFault0(pVCpu);
5776 }
5777 uNewDrX |= X86_DR7_RA1_MASK;
5778 uNewDrX &= ~X86_DR7_RAZ_MASK;
5779 break;
5780
5781 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5782 }
5783
5784 /** @todo SVM nested-guest intercept for DR8-DR15? */
5785 /*
5786 * Check for any SVM nested-guest intercepts for the DRx write.
5787 */
5788 if (IEM_IS_SVM_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
5789 {
5790 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
5791 IEM_SVM_UPDATE_NRIP(pVCpu);
5792 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
5793 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
5794 }
5795
5796 /*
5797 * Do the actual setting.
5798 */
5799 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5800 {
5801 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5802 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5803 }
5804 else
5805 pCtx->dr[iDrReg] = uNewDrX;
5806
5807 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5808 return VINF_SUCCESS;
5809}
5810
5811
5812/**
5813 * Implements 'INVLPG m'.
5814 *
5815 * @param GCPtrPage The effective address of the page to invalidate.
5816 * @remarks Updates the RIP.
5817 */
5818IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5819{
5820 /* ring-0 only. */
5821 if (pVCpu->iem.s.uCpl != 0)
5822 return iemRaiseGeneralProtectionFault0(pVCpu);
5823 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5824
5825 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
5826 {
5827 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
5828 IEM_SVM_UPDATE_NRIP(pVCpu);
5829 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPG,
5830 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
5831 }
5832
5833 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5834 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5835
5836 if (rc == VINF_SUCCESS)
5837 return VINF_SUCCESS;
5838 if (rc == VINF_PGM_SYNC_CR3)
5839 return iemSetPassUpStatus(pVCpu, rc);
5840
5841 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5842 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5843 return rc;
5844}
5845
5846
5847/**
5848 * Implements INVPCID.
5849 *
5850 * @param uInvpcidType The invalidation type.
5851 * @param GCPtrInvpcidDesc The effective address of invpcid descriptor.
5852 * @remarks Updates the RIP.
5853 */
5854IEM_CIMPL_DEF_2(iemCImpl_invpcid, uint64_t, uInvpcidType, RTGCPTR, GCPtrInvpcidDesc)
5855{
5856 /*
5857 * Check preconditions.
5858 */
5859 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
5860 return iemRaiseUndefinedOpcode(pVCpu);
5861 if (pVCpu->iem.s.uCpl != 0)
5862 {
5863 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
5864 return iemRaiseGeneralProtectionFault0(pVCpu);
5865 }
5866 if (IEM_IS_V86_MODE(pVCpu))
5867 {
5868 Log(("invpcid: v8086 mode -> #GP(0)\n"));
5869 return iemRaiseGeneralProtectionFault0(pVCpu);
5870 }
5871 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
5872 {
5873 Log(("invpcid: invalid/unrecognized invpcid type %#x -> #GP(0)\n", uInvpcidType));
5874 return iemRaiseGeneralProtectionFault0(pVCpu);
5875 }
5876
5877 /*
5878 * Fetch the invpcid descriptor from guest memory.
5879 */
5880 RTUINT128U uDesc;
5881 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, pVCpu->iem.s.iEffSeg, GCPtrInvpcidDesc);
5882 if (rcStrict == VINF_SUCCESS)
5883 {
5884 /*
5885 * Validate the descriptor.
5886 */
5887 if (uDesc.s.Lo > 0xfff)
5888 {
5889 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
5890 return iemRaiseGeneralProtectionFault0(pVCpu);
5891 }
5892
5893 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
5894 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
5895 uint32_t const uCr4 = IEM_GET_CTX(pVCpu)->cr4;
5896 uint64_t const uCr3 = IEM_GET_CTX(pVCpu)->cr3;
5897 switch (uInvpcidType)
5898 {
5899 case X86_INVPCID_TYPE_INDV_ADDR:
5900 {
5901 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
5902 {
5903 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
5904 return iemRaiseGeneralProtectionFault0(pVCpu);
5905 }
5906 if ( !(uCr4 & X86_CR4_PCIDE)
5907 && uPcid != 0)
5908 {
5909 Log(("invpcid: invalid pcid %#x\n", uPcid));
5910 return iemRaiseGeneralProtectionFault0(pVCpu);
5911 }
5912
5913 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
5914 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5915 break;
5916 }
5917
5918 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
5919 {
5920 if ( !(uCr4 & X86_CR4_PCIDE)
5921 && uPcid != 0)
5922 {
5923 Log(("invpcid: invalid pcid %#x\n", uPcid));
5924 return iemRaiseGeneralProtectionFault0(pVCpu);
5925 }
5926 /* Invalidate all mappings associated with PCID except global translations. */
5927 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5928 break;
5929 }
5930
5931 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
5932 {
5933 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
5934 break;
5935 }
5936
5937 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
5938 {
5939 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5940 break;
5941 }
5942 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5943 }
5944 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5945 }
5946 return rcStrict;
5947}
5948
5949
5950/**
5951 * Implements RDTSC.
5952 */
5953IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5954{
5955 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5956
5957 /*
5958 * Check preconditions.
5959 */
5960 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5961 return iemRaiseUndefinedOpcode(pVCpu);
5962
5963 if ( (pCtx->cr4 & X86_CR4_TSD)
5964 && pVCpu->iem.s.uCpl != 0)
5965 {
5966 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5967 return iemRaiseGeneralProtectionFault0(pVCpu);
5968 }
5969
5970 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
5971 {
5972 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
5973 IEM_SVM_UPDATE_NRIP(pVCpu);
5974 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5975 }
5976
5977 /*
5978 * Do the job.
5979 */
5980 uint64_t uTicks = TMCpuTickGet(pVCpu);
5981#ifdef VBOX_WITH_NESTED_HWVIRT
5982 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
5983#endif
5984 pCtx->rax = RT_LO_U32(uTicks);
5985 pCtx->rdx = RT_HI_U32(uTicks);
5986#ifdef IEM_VERIFICATION_MODE_FULL
5987 pVCpu->iem.s.fIgnoreRaxRdx = true;
5988#endif
5989
5990 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5991 return VINF_SUCCESS;
5992}
5993
5994
5995/**
5996 * Implements RDTSC.
5997 */
5998IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
5999{
6000 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6001
6002 /*
6003 * Check preconditions.
6004 */
6005 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6006 return iemRaiseUndefinedOpcode(pVCpu);
6007
6008 if ( (pCtx->cr4 & X86_CR4_TSD)
6009 && pVCpu->iem.s.uCpl != 0)
6010 {
6011 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6012 return iemRaiseGeneralProtectionFault0(pVCpu);
6013 }
6014
6015 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6016 {
6017 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6018 IEM_SVM_UPDATE_NRIP(pVCpu);
6019 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6020 }
6021
6022 /*
6023 * Do the job.
6024 * Query the MSR first in case of trips to ring-3.
6025 */
6026 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
6027 if (rcStrict == VINF_SUCCESS)
6028 {
6029 /* Low dword of the TSC_AUX msr only. */
6030 pCtx->rcx &= UINT32_C(0xffffffff);
6031
6032 uint64_t uTicks = TMCpuTickGet(pVCpu);
6033#ifdef VBOX_WITH_NESTED_HWVIRT
6034 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6035#endif
6036 pCtx->rax = RT_LO_U32(uTicks);
6037 pCtx->rdx = RT_HI_U32(uTicks);
6038#ifdef IEM_VERIFICATION_MODE_FULL
6039 pVCpu->iem.s.fIgnoreRaxRdx = true;
6040#endif
6041 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6042 }
6043 return rcStrict;
6044}
6045
6046
6047/**
6048 * Implements RDPMC.
6049 */
6050IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
6051{
6052 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6053 if ( pVCpu->iem.s.uCpl != 0
6054 && !(pCtx->cr4 & X86_CR4_PCE))
6055 return iemRaiseGeneralProtectionFault0(pVCpu);
6056
6057 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
6058 {
6059 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
6060 IEM_SVM_UPDATE_NRIP(pVCpu);
6061 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6062 }
6063
6064 /** @todo Implement RDPMC for the regular guest execution case (the above only
6065 * handles nested-guest intercepts). */
6066 RT_NOREF(cbInstr);
6067 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
6068}
6069
6070
6071/**
6072 * Implements RDMSR.
6073 */
6074IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
6075{
6076 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6077
6078 /*
6079 * Check preconditions.
6080 */
6081 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6082 return iemRaiseUndefinedOpcode(pVCpu);
6083 if (pVCpu->iem.s.uCpl != 0)
6084 return iemRaiseGeneralProtectionFault0(pVCpu);
6085
6086 /*
6087 * Do the job.
6088 */
6089 RTUINT64U uValue;
6090 VBOXSTRICTRC rcStrict;
6091#ifdef VBOX_WITH_NESTED_HWVIRT
6092 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6093 {
6094 rcStrict = iemSvmHandleMsrIntercept(pVCpu, pCtx, pCtx->ecx, false /* fWrite */);
6095 if (rcStrict == VINF_SVM_VMEXIT)
6096 return VINF_SUCCESS;
6097 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6098 {
6099 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pCtx->ecx, VBOXSTRICTRC_VAL(rcStrict)));
6100 return rcStrict;
6101 }
6102 }
6103#endif
6104
6105 rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
6106 if (rcStrict == VINF_SUCCESS)
6107 {
6108 pCtx->rax = uValue.s.Lo;
6109 pCtx->rdx = uValue.s.Hi;
6110
6111 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6112 return VINF_SUCCESS;
6113 }
6114
6115#ifndef IN_RING3
6116 /* Deferred to ring-3. */
6117 if (rcStrict == VINF_CPUM_R3_MSR_READ)
6118 {
6119 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
6120 return rcStrict;
6121 }
6122#else /* IN_RING3 */
6123 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6124 static uint32_t s_cTimes = 0;
6125 if (s_cTimes++ < 10)
6126 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
6127 else
6128#endif
6129 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
6130 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6131 return iemRaiseGeneralProtectionFault0(pVCpu);
6132}
6133
6134
6135/**
6136 * Implements WRMSR.
6137 */
6138IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
6139{
6140 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6141
6142 /*
6143 * Check preconditions.
6144 */
6145 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6146 return iemRaiseUndefinedOpcode(pVCpu);
6147 if (pVCpu->iem.s.uCpl != 0)
6148 return iemRaiseGeneralProtectionFault0(pVCpu);
6149
6150 /*
6151 * Do the job.
6152 */
6153 RTUINT64U uValue;
6154 uValue.s.Lo = pCtx->eax;
6155 uValue.s.Hi = pCtx->edx;
6156
6157 VBOXSTRICTRC rcStrict;
6158#ifdef VBOX_WITH_NESTED_HWVIRT
6159 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6160 {
6161 rcStrict = iemSvmHandleMsrIntercept(pVCpu, pCtx, pCtx->ecx, true /* fWrite */);
6162 if (rcStrict == VINF_SVM_VMEXIT)
6163 return VINF_SUCCESS;
6164 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6165 {
6166 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pCtx->ecx, VBOXSTRICTRC_VAL(rcStrict)));
6167 return rcStrict;
6168 }
6169 }
6170#endif
6171
6172 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6173 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
6174 else
6175 {
6176#ifdef IN_RING3
6177 CPUMCTX CtxTmp = *pCtx;
6178 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
6179 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
6180 *pCtx = *pCtx2;
6181 *pCtx2 = CtxTmp;
6182#else
6183 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
6184#endif
6185 }
6186 if (rcStrict == VINF_SUCCESS)
6187 {
6188 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6189 return VINF_SUCCESS;
6190 }
6191
6192#ifndef IN_RING3
6193 /* Deferred to ring-3. */
6194 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
6195 {
6196 Log(("IEM: wrmsr(%#x) -> ring-3\n", pCtx->ecx));
6197 return rcStrict;
6198 }
6199#else /* IN_RING3 */
6200 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6201 static uint32_t s_cTimes = 0;
6202 if (s_cTimes++ < 10)
6203 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
6204 else
6205#endif
6206 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
6207 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6208 return iemRaiseGeneralProtectionFault0(pVCpu);
6209}
6210
6211
6212/**
6213 * Implements 'IN eAX, port'.
6214 *
6215 * @param u16Port The source port.
6216 * @param cbReg The register size.
6217 */
6218IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
6219{
6220 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6221
6222 /*
6223 * CPL check
6224 */
6225 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
6226 if (rcStrict != VINF_SUCCESS)
6227 return rcStrict;
6228
6229 /*
6230 * Check SVM nested-guest IO intercept.
6231 */
6232#ifdef VBOX_WITH_NESTED_HWVIRT
6233 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6234 {
6235 uint8_t cAddrSizeBits;
6236 switch (pVCpu->iem.s.enmEffAddrMode)
6237 {
6238 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6239 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6240 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6241 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6242 }
6243 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6244 false /* fRep */, false /* fStrIo */, cbInstr);
6245 if (rcStrict == VINF_SVM_VMEXIT)
6246 return VINF_SUCCESS;
6247 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6248 {
6249 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6250 VBOXSTRICTRC_VAL(rcStrict)));
6251 return rcStrict;
6252 }
6253 }
6254#endif
6255
6256 /*
6257 * Perform the I/O.
6258 */
6259 uint32_t u32Value;
6260 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6261 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
6262 else
6263 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
6264 if (IOM_SUCCESS(rcStrict))
6265 {
6266 switch (cbReg)
6267 {
6268 case 1: pCtx->al = (uint8_t)u32Value; break;
6269 case 2: pCtx->ax = (uint16_t)u32Value; break;
6270 case 4: pCtx->rax = u32Value; break;
6271 default: AssertFailedReturn(VERR_IEM_IPE_3);
6272 }
6273 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6274 pVCpu->iem.s.cPotentialExits++;
6275 if (rcStrict != VINF_SUCCESS)
6276 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6277 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
6278
6279 /*
6280 * Check for I/O breakpoints.
6281 */
6282 uint32_t const uDr7 = pCtx->dr[7];
6283 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
6284 && X86_DR7_ANY_RW_IO(uDr7)
6285 && (pCtx->cr4 & X86_CR4_DE))
6286 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
6287 {
6288 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
6289 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
6290 rcStrict = iemRaiseDebugException(pVCpu);
6291 }
6292 }
6293
6294 return rcStrict;
6295}
6296
6297
6298/**
6299 * Implements 'IN eAX, DX'.
6300 *
6301 * @param cbReg The register size.
6302 */
6303IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
6304{
6305 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
6306}
6307
6308
6309/**
6310 * Implements 'OUT port, eAX'.
6311 *
6312 * @param u16Port The destination port.
6313 * @param cbReg The register size.
6314 */
6315IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
6316{
6317 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6318
6319 /*
6320 * CPL check
6321 */
6322 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
6323 if (rcStrict != VINF_SUCCESS)
6324 return rcStrict;
6325
6326 /*
6327 * Check SVM nested-guest IO intercept.
6328 */
6329#ifdef VBOX_WITH_NESTED_HWVIRT
6330 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6331 {
6332 uint8_t cAddrSizeBits;
6333 switch (pVCpu->iem.s.enmEffAddrMode)
6334 {
6335 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6336 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6337 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6338 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6339 }
6340 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6341 false /* fRep */, false /* fStrIo */, cbInstr);
6342 if (rcStrict == VINF_SVM_VMEXIT)
6343 return VINF_SUCCESS;
6344 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6345 {
6346 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6347 VBOXSTRICTRC_VAL(rcStrict)));
6348 return rcStrict;
6349 }
6350 }
6351#endif
6352
6353 /*
6354 * Perform the I/O.
6355 */
6356 uint32_t u32Value;
6357 switch (cbReg)
6358 {
6359 case 1: u32Value = pCtx->al; break;
6360 case 2: u32Value = pCtx->ax; break;
6361 case 4: u32Value = pCtx->eax; break;
6362 default: AssertFailedReturn(VERR_IEM_IPE_4);
6363 }
6364 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6365 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
6366 else
6367 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
6368 if (IOM_SUCCESS(rcStrict))
6369 {
6370 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6371 pVCpu->iem.s.cPotentialExits++;
6372 if (rcStrict != VINF_SUCCESS)
6373 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6374 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
6375
6376 /*
6377 * Check for I/O breakpoints.
6378 */
6379 uint32_t const uDr7 = pCtx->dr[7];
6380 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
6381 && X86_DR7_ANY_RW_IO(uDr7)
6382 && (pCtx->cr4 & X86_CR4_DE))
6383 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
6384 {
6385 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
6386 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
6387 rcStrict = iemRaiseDebugException(pVCpu);
6388 }
6389 }
6390 return rcStrict;
6391}
6392
6393
6394/**
6395 * Implements 'OUT DX, eAX'.
6396 *
6397 * @param cbReg The register size.
6398 */
6399IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
6400{
6401 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
6402}
6403
6404
6405/**
6406 * Implements 'CLI'.
6407 */
6408IEM_CIMPL_DEF_0(iemCImpl_cli)
6409{
6410 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6411 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6412 uint32_t const fEflOld = fEfl;
6413 if (pCtx->cr0 & X86_CR0_PE)
6414 {
6415 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6416 if (!(fEfl & X86_EFL_VM))
6417 {
6418 if (pVCpu->iem.s.uCpl <= uIopl)
6419 fEfl &= ~X86_EFL_IF;
6420 else if ( pVCpu->iem.s.uCpl == 3
6421 && (pCtx->cr4 & X86_CR4_PVI) )
6422 fEfl &= ~X86_EFL_VIF;
6423 else
6424 return iemRaiseGeneralProtectionFault0(pVCpu);
6425 }
6426 /* V8086 */
6427 else if (uIopl == 3)
6428 fEfl &= ~X86_EFL_IF;
6429 else if ( uIopl < 3
6430 && (pCtx->cr4 & X86_CR4_VME) )
6431 fEfl &= ~X86_EFL_VIF;
6432 else
6433 return iemRaiseGeneralProtectionFault0(pVCpu);
6434 }
6435 /* real mode */
6436 else
6437 fEfl &= ~X86_EFL_IF;
6438
6439 /* Commit. */
6440 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6441 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6442 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
6443 return VINF_SUCCESS;
6444}
6445
6446
6447/**
6448 * Implements 'STI'.
6449 */
6450IEM_CIMPL_DEF_0(iemCImpl_sti)
6451{
6452 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6453 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6454 uint32_t const fEflOld = fEfl;
6455
6456 if (pCtx->cr0 & X86_CR0_PE)
6457 {
6458 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6459 if (!(fEfl & X86_EFL_VM))
6460 {
6461 if (pVCpu->iem.s.uCpl <= uIopl)
6462 fEfl |= X86_EFL_IF;
6463 else if ( pVCpu->iem.s.uCpl == 3
6464 && (pCtx->cr4 & X86_CR4_PVI)
6465 && !(fEfl & X86_EFL_VIP) )
6466 fEfl |= X86_EFL_VIF;
6467 else
6468 return iemRaiseGeneralProtectionFault0(pVCpu);
6469 }
6470 /* V8086 */
6471 else if (uIopl == 3)
6472 fEfl |= X86_EFL_IF;
6473 else if ( uIopl < 3
6474 && (pCtx->cr4 & X86_CR4_VME)
6475 && !(fEfl & X86_EFL_VIP) )
6476 fEfl |= X86_EFL_VIF;
6477 else
6478 return iemRaiseGeneralProtectionFault0(pVCpu);
6479 }
6480 /* real mode */
6481 else
6482 fEfl |= X86_EFL_IF;
6483
6484 /* Commit. */
6485 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6486 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6487 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
6488 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
6489 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
6490 return VINF_SUCCESS;
6491}
6492
6493
6494/**
6495 * Implements 'HLT'.
6496 */
6497IEM_CIMPL_DEF_0(iemCImpl_hlt)
6498{
6499 if (pVCpu->iem.s.uCpl != 0)
6500 return iemRaiseGeneralProtectionFault0(pVCpu);
6501
6502 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
6503 {
6504 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
6505 IEM_SVM_UPDATE_NRIP(pVCpu);
6506 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6507 }
6508
6509 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6510 return VINF_EM_HALT;
6511}
6512
6513
6514/**
6515 * Implements 'MONITOR'.
6516 */
6517IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
6518{
6519 /*
6520 * Permission checks.
6521 */
6522 if (pVCpu->iem.s.uCpl != 0)
6523 {
6524 Log2(("monitor: CPL != 0\n"));
6525 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
6526 }
6527 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6528 {
6529 Log2(("monitor: Not in CPUID\n"));
6530 return iemRaiseUndefinedOpcode(pVCpu);
6531 }
6532
6533 /*
6534 * Gather the operands and validate them.
6535 */
6536 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6537 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6538 uint32_t uEcx = pCtx->ecx;
6539 uint32_t uEdx = pCtx->edx;
6540/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
6541 * \#GP first. */
6542 if (uEcx != 0)
6543 {
6544 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
6545 return iemRaiseGeneralProtectionFault0(pVCpu);
6546 }
6547
6548 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
6549 if (rcStrict != VINF_SUCCESS)
6550 return rcStrict;
6551
6552 RTGCPHYS GCPhysMem;
6553 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6554 if (rcStrict != VINF_SUCCESS)
6555 return rcStrict;
6556
6557 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
6558 {
6559 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
6560 IEM_SVM_UPDATE_NRIP(pVCpu);
6561 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6562 }
6563
6564 /*
6565 * Call EM to prepare the monitor/wait.
6566 */
6567 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
6568 Assert(rcStrict == VINF_SUCCESS);
6569
6570 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6571 return rcStrict;
6572}
6573
6574
6575/**
6576 * Implements 'MWAIT'.
6577 */
6578IEM_CIMPL_DEF_0(iemCImpl_mwait)
6579{
6580 /*
6581 * Permission checks.
6582 */
6583 if (pVCpu->iem.s.uCpl != 0)
6584 {
6585 Log2(("mwait: CPL != 0\n"));
6586 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
6587 * EFLAGS.VM then.) */
6588 return iemRaiseUndefinedOpcode(pVCpu);
6589 }
6590 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6591 {
6592 Log2(("mwait: Not in CPUID\n"));
6593 return iemRaiseUndefinedOpcode(pVCpu);
6594 }
6595
6596 /*
6597 * Gather the operands and validate them.
6598 */
6599 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6600 uint32_t uEax = pCtx->eax;
6601 uint32_t uEcx = pCtx->ecx;
6602 if (uEcx != 0)
6603 {
6604 /* Only supported extension is break on IRQ when IF=0. */
6605 if (uEcx > 1)
6606 {
6607 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
6608 return iemRaiseGeneralProtectionFault0(pVCpu);
6609 }
6610 uint32_t fMWaitFeatures = 0;
6611 uint32_t uIgnore = 0;
6612 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
6613 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6614 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6615 {
6616 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
6617 return iemRaiseGeneralProtectionFault0(pVCpu);
6618 }
6619 }
6620
6621 /*
6622 * Check SVM nested-guest mwait intercepts.
6623 */
6624 if ( IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
6625 && EMMonitorIsArmed(pVCpu))
6626 {
6627 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
6628 IEM_SVM_UPDATE_NRIP(pVCpu);
6629 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6630 }
6631 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
6632 {
6633 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
6634 IEM_SVM_UPDATE_NRIP(pVCpu);
6635 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6636 }
6637
6638 /*
6639 * Call EM to prepare the monitor/wait.
6640 */
6641 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
6642
6643 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6644 return rcStrict;
6645}
6646
6647
6648/**
6649 * Implements 'SWAPGS'.
6650 */
6651IEM_CIMPL_DEF_0(iemCImpl_swapgs)
6652{
6653 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
6654
6655 /*
6656 * Permission checks.
6657 */
6658 if (pVCpu->iem.s.uCpl != 0)
6659 {
6660 Log2(("swapgs: CPL != 0\n"));
6661 return iemRaiseUndefinedOpcode(pVCpu);
6662 }
6663
6664 /*
6665 * Do the job.
6666 */
6667 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6668 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
6669 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
6670 pCtx->gs.u64Base = uOtherGsBase;
6671
6672 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6673 return VINF_SUCCESS;
6674}
6675
6676
6677/**
6678 * Implements 'CPUID'.
6679 */
6680IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6681{
6682 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6683
6684 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
6685 {
6686 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
6687 IEM_SVM_UPDATE_NRIP(pVCpu);
6688 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6689 }
6690
6691 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6692 pCtx->rax &= UINT32_C(0xffffffff);
6693 pCtx->rbx &= UINT32_C(0xffffffff);
6694 pCtx->rcx &= UINT32_C(0xffffffff);
6695 pCtx->rdx &= UINT32_C(0xffffffff);
6696
6697 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6698 return VINF_SUCCESS;
6699}
6700
6701
6702/**
6703 * Implements 'AAD'.
6704 *
6705 * @param bImm The immediate operand.
6706 */
6707IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6708{
6709 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6710
6711 uint16_t const ax = pCtx->ax;
6712 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6713 pCtx->ax = al;
6714 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6715 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6716 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6717
6718 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6719 return VINF_SUCCESS;
6720}
6721
6722
6723/**
6724 * Implements 'AAM'.
6725 *
6726 * @param bImm The immediate operand. Cannot be 0.
6727 */
6728IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6729{
6730 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6731 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6732
6733 uint16_t const ax = pCtx->ax;
6734 uint8_t const al = (uint8_t)ax % bImm;
6735 uint8_t const ah = (uint8_t)ax / bImm;
6736 pCtx->ax = (ah << 8) + al;
6737 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6738 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6739 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6740
6741 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6742 return VINF_SUCCESS;
6743}
6744
6745
6746/**
6747 * Implements 'DAA'.
6748 */
6749IEM_CIMPL_DEF_0(iemCImpl_daa)
6750{
6751 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6752
6753 uint8_t const al = pCtx->al;
6754 bool const fCarry = pCtx->eflags.Bits.u1CF;
6755
6756 if ( pCtx->eflags.Bits.u1AF
6757 || (al & 0xf) >= 10)
6758 {
6759 pCtx->al = al + 6;
6760 pCtx->eflags.Bits.u1AF = 1;
6761 }
6762 else
6763 pCtx->eflags.Bits.u1AF = 0;
6764
6765 if (al >= 0x9a || fCarry)
6766 {
6767 pCtx->al += 0x60;
6768 pCtx->eflags.Bits.u1CF = 1;
6769 }
6770 else
6771 pCtx->eflags.Bits.u1CF = 0;
6772
6773 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6774 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6775 return VINF_SUCCESS;
6776}
6777
6778
6779/**
6780 * Implements 'DAS'.
6781 */
6782IEM_CIMPL_DEF_0(iemCImpl_das)
6783{
6784 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6785
6786 uint8_t const uInputAL = pCtx->al;
6787 bool const fCarry = pCtx->eflags.Bits.u1CF;
6788
6789 if ( pCtx->eflags.Bits.u1AF
6790 || (uInputAL & 0xf) >= 10)
6791 {
6792 pCtx->eflags.Bits.u1AF = 1;
6793 if (uInputAL < 6)
6794 pCtx->eflags.Bits.u1CF = 1;
6795 pCtx->al = uInputAL - 6;
6796 }
6797 else
6798 {
6799 pCtx->eflags.Bits.u1AF = 0;
6800 pCtx->eflags.Bits.u1CF = 0;
6801 }
6802
6803 if (uInputAL >= 0x9a || fCarry)
6804 {
6805 pCtx->al -= 0x60;
6806 pCtx->eflags.Bits.u1CF = 1;
6807 }
6808
6809 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6810 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6811 return VINF_SUCCESS;
6812}
6813
6814
6815/**
6816 * Implements 'AAA'.
6817 */
6818IEM_CIMPL_DEF_0(iemCImpl_aaa)
6819{
6820 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6821
6822 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
6823 {
6824 if ( pCtx->eflags.Bits.u1AF
6825 || (pCtx->ax & 0xf) >= 10)
6826 {
6827 iemAImpl_add_u16(&pCtx->ax, 0x106, &pCtx->eflags.u32);
6828 pCtx->eflags.Bits.u1AF = 1;
6829 pCtx->eflags.Bits.u1CF = 1;
6830#ifdef IEM_VERIFICATION_MODE_FULL
6831 pVCpu->iem.s.fUndefinedEFlags |= X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF;
6832#endif
6833 }
6834 else
6835 {
6836 iemHlpUpdateArithEFlagsU16(pVCpu, pCtx->ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6837 pCtx->eflags.Bits.u1AF = 0;
6838 pCtx->eflags.Bits.u1CF = 0;
6839 }
6840 pCtx->ax &= UINT16_C(0xff0f);
6841 }
6842 else
6843 {
6844 if ( pCtx->eflags.Bits.u1AF
6845 || (pCtx->ax & 0xf) >= 10)
6846 {
6847 pCtx->ax += UINT16_C(0x106);
6848 pCtx->eflags.Bits.u1AF = 1;
6849 pCtx->eflags.Bits.u1CF = 1;
6850 }
6851 else
6852 {
6853 pCtx->eflags.Bits.u1AF = 0;
6854 pCtx->eflags.Bits.u1CF = 0;
6855 }
6856 pCtx->ax &= UINT16_C(0xff0f);
6857 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6858 }
6859
6860 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6861 return VINF_SUCCESS;
6862}
6863
6864
6865/**
6866 * Implements 'AAS'.
6867 */
6868IEM_CIMPL_DEF_0(iemCImpl_aas)
6869{
6870 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6871
6872 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
6873 {
6874 if ( pCtx->eflags.Bits.u1AF
6875 || (pCtx->ax & 0xf) >= 10)
6876 {
6877 iemAImpl_sub_u16(&pCtx->ax, 0x106, &pCtx->eflags.u32);
6878 pCtx->eflags.Bits.u1AF = 1;
6879 pCtx->eflags.Bits.u1CF = 1;
6880#ifdef IEM_VERIFICATION_MODE_FULL
6881 pVCpu->iem.s.fUndefinedEFlags |= X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF;
6882#endif
6883 }
6884 else
6885 {
6886 iemHlpUpdateArithEFlagsU16(pVCpu, pCtx->ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6887 pCtx->eflags.Bits.u1AF = 0;
6888 pCtx->eflags.Bits.u1CF = 0;
6889 }
6890 pCtx->ax &= UINT16_C(0xff0f);
6891 }
6892 else
6893 {
6894 if ( pCtx->eflags.Bits.u1AF
6895 || (pCtx->ax & 0xf) >= 10)
6896 {
6897 pCtx->ax -= UINT16_C(0x106);
6898 pCtx->eflags.Bits.u1AF = 1;
6899 pCtx->eflags.Bits.u1CF = 1;
6900 }
6901 else
6902 {
6903 pCtx->eflags.Bits.u1AF = 0;
6904 pCtx->eflags.Bits.u1CF = 0;
6905 }
6906 pCtx->ax &= UINT16_C(0xff0f);
6907 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6908 }
6909
6910 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6911 return VINF_SUCCESS;
6912}
6913
6914
6915/**
6916 * Implements the 16-bit version of 'BOUND'.
6917 *
6918 * @note We have separate 16-bit and 32-bit variants of this function due to
6919 * the decoder using unsigned parameters, whereas we want signed one to
6920 * do the job. This is significant for a recompiler.
6921 */
6922IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
6923{
6924 /*
6925 * Check if the index is inside the bounds, otherwise raise #BR.
6926 */
6927 if ( idxArray >= idxLowerBound
6928 && idxArray <= idxUpperBound)
6929 {
6930 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6931 return VINF_SUCCESS;
6932 }
6933
6934 return iemRaiseBoundRangeExceeded(pVCpu);
6935}
6936
6937
6938/**
6939 * Implements the 32-bit version of 'BOUND'.
6940 */
6941IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
6942{
6943 /*
6944 * Check if the index is inside the bounds, otherwise raise #BR.
6945 */
6946 if ( idxArray >= idxLowerBound
6947 && idxArray <= idxUpperBound)
6948 {
6949 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6950 return VINF_SUCCESS;
6951 }
6952
6953 return iemRaiseBoundRangeExceeded(pVCpu);
6954}
6955
6956
6957
6958/*
6959 * Instantiate the various string operation combinations.
6960 */
6961#define OP_SIZE 8
6962#define ADDR_SIZE 16
6963#include "IEMAllCImplStrInstr.cpp.h"
6964#define OP_SIZE 8
6965#define ADDR_SIZE 32
6966#include "IEMAllCImplStrInstr.cpp.h"
6967#define OP_SIZE 8
6968#define ADDR_SIZE 64
6969#include "IEMAllCImplStrInstr.cpp.h"
6970
6971#define OP_SIZE 16
6972#define ADDR_SIZE 16
6973#include "IEMAllCImplStrInstr.cpp.h"
6974#define OP_SIZE 16
6975#define ADDR_SIZE 32
6976#include "IEMAllCImplStrInstr.cpp.h"
6977#define OP_SIZE 16
6978#define ADDR_SIZE 64
6979#include "IEMAllCImplStrInstr.cpp.h"
6980
6981#define OP_SIZE 32
6982#define ADDR_SIZE 16
6983#include "IEMAllCImplStrInstr.cpp.h"
6984#define OP_SIZE 32
6985#define ADDR_SIZE 32
6986#include "IEMAllCImplStrInstr.cpp.h"
6987#define OP_SIZE 32
6988#define ADDR_SIZE 64
6989#include "IEMAllCImplStrInstr.cpp.h"
6990
6991#define OP_SIZE 64
6992#define ADDR_SIZE 32
6993#include "IEMAllCImplStrInstr.cpp.h"
6994#define OP_SIZE 64
6995#define ADDR_SIZE 64
6996#include "IEMAllCImplStrInstr.cpp.h"
6997
6998
6999/**
7000 * Implements 'XGETBV'.
7001 */
7002IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
7003{
7004 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7005 if (pCtx->cr4 & X86_CR4_OSXSAVE)
7006 {
7007 uint32_t uEcx = pCtx->ecx;
7008 switch (uEcx)
7009 {
7010 case 0:
7011 break;
7012
7013 case 1: /** @todo Implement XCR1 support. */
7014 default:
7015 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
7016 return iemRaiseGeneralProtectionFault0(pVCpu);
7017
7018 }
7019 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
7020 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
7021
7022 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7023 return VINF_SUCCESS;
7024 }
7025 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
7026 return iemRaiseUndefinedOpcode(pVCpu);
7027}
7028
7029
7030/**
7031 * Implements 'XSETBV'.
7032 */
7033IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
7034{
7035 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7036 if (pCtx->cr4 & X86_CR4_OSXSAVE)
7037 {
7038 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
7039 {
7040 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
7041 IEM_SVM_UPDATE_NRIP(pVCpu);
7042 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7043 }
7044
7045 if (pVCpu->iem.s.uCpl == 0)
7046 {
7047 uint32_t uEcx = pCtx->ecx;
7048 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
7049 switch (uEcx)
7050 {
7051 case 0:
7052 {
7053 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
7054 if (rc == VINF_SUCCESS)
7055 break;
7056 Assert(rc == VERR_CPUM_RAISE_GP_0);
7057 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7058 return iemRaiseGeneralProtectionFault0(pVCpu);
7059 }
7060
7061 case 1: /** @todo Implement XCR1 support. */
7062 default:
7063 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7064 return iemRaiseGeneralProtectionFault0(pVCpu);
7065
7066 }
7067
7068 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7069 return VINF_SUCCESS;
7070 }
7071
7072 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
7073 return iemRaiseGeneralProtectionFault0(pVCpu);
7074 }
7075 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
7076 return iemRaiseUndefinedOpcode(pVCpu);
7077}
7078
7079#ifdef IN_RING3
7080
7081/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
7082struct IEMCIMPLCX16ARGS
7083{
7084 PRTUINT128U pu128Dst;
7085 PRTUINT128U pu128RaxRdx;
7086 PRTUINT128U pu128RbxRcx;
7087 uint32_t *pEFlags;
7088# ifdef VBOX_STRICT
7089 uint32_t cCalls;
7090# endif
7091};
7092
7093/**
7094 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
7095 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
7096 */
7097static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPU pVCpu, void *pvUser)
7098{
7099 RT_NOREF(pVM, pVCpu);
7100 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
7101# ifdef VBOX_STRICT
7102 Assert(pArgs->cCalls == 0);
7103 pArgs->cCalls++;
7104# endif
7105
7106 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
7107 return VINF_SUCCESS;
7108}
7109
7110#endif /* IN_RING3 */
7111
7112/**
7113 * Implements 'CMPXCHG16B' fallback using rendezvous.
7114 */
7115IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
7116 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
7117{
7118#ifdef IN_RING3
7119 struct IEMCIMPLCX16ARGS Args;
7120 Args.pu128Dst = pu128Dst;
7121 Args.pu128RaxRdx = pu128RaxRdx;
7122 Args.pu128RbxRcx = pu128RbxRcx;
7123 Args.pEFlags = pEFlags;
7124# ifdef VBOX_STRICT
7125 Args.cCalls = 0;
7126# endif
7127 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
7128 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
7129 Assert(Args.cCalls == 1);
7130 if (rcStrict == VINF_SUCCESS)
7131 {
7132 /* Duplicated tail code. */
7133 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
7134 if (rcStrict == VINF_SUCCESS)
7135 {
7136 PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
7137 pCtx->eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
7138 if (!(*pEFlags & X86_EFL_ZF))
7139 {
7140 pCtx->rax = pu128RaxRdx->s.Lo;
7141 pCtx->rdx = pu128RaxRdx->s.Hi;
7142 }
7143 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7144 }
7145 }
7146 return rcStrict;
7147#else
7148 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
7149 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
7150#endif
7151}
7152
7153
7154/**
7155 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
7156 *
7157 * This is implemented in C because it triggers a load like behviour without
7158 * actually reading anything. Since that's not so common, it's implemented
7159 * here.
7160 *
7161 * @param iEffSeg The effective segment.
7162 * @param GCPtrEff The address of the image.
7163 */
7164IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7165{
7166 /*
7167 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
7168 */
7169 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
7170 if (rcStrict == VINF_SUCCESS)
7171 {
7172 RTGCPHYS GCPhysMem;
7173 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7174 if (rcStrict == VINF_SUCCESS)
7175 {
7176 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7177 return VINF_SUCCESS;
7178 }
7179 }
7180
7181 return rcStrict;
7182}
7183
7184
7185/**
7186 * Implements 'FINIT' and 'FNINIT'.
7187 *
7188 * @param fCheckXcpts Whether to check for umasked pending exceptions or
7189 * not.
7190 */
7191IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
7192{
7193 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7194
7195 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
7196 return iemRaiseDeviceNotAvailable(pVCpu);
7197
7198 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
7199 if (fCheckXcpts && TODO )
7200 return iemRaiseMathFault(pVCpu);
7201 */
7202
7203 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
7204 pXState->x87.FCW = 0x37f;
7205 pXState->x87.FSW = 0;
7206 pXState->x87.FTW = 0x00; /* 0 - empty. */
7207 pXState->x87.FPUDP = 0;
7208 pXState->x87.DS = 0; //??
7209 pXState->x87.Rsrvd2= 0;
7210 pXState->x87.FPUIP = 0;
7211 pXState->x87.CS = 0; //??
7212 pXState->x87.Rsrvd1= 0;
7213 pXState->x87.FOP = 0;
7214
7215 iemHlpUsedFpu(pVCpu);
7216 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7217 return VINF_SUCCESS;
7218}
7219
7220
7221/**
7222 * Implements 'FXSAVE'.
7223 *
7224 * @param iEffSeg The effective segment.
7225 * @param GCPtrEff The address of the image.
7226 * @param enmEffOpSize The operand size (only REX.W really matters).
7227 */
7228IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7229{
7230 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7231
7232 /*
7233 * Raise exceptions.
7234 */
7235 if (pCtx->cr0 & X86_CR0_EM)
7236 return iemRaiseUndefinedOpcode(pVCpu);
7237 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
7238 return iemRaiseDeviceNotAvailable(pVCpu);
7239 if (GCPtrEff & 15)
7240 {
7241 /** @todo CPU/VM detection possible! \#AC might not be signal for
7242 * all/any misalignment sizes, intel says its an implementation detail. */
7243 if ( (pCtx->cr0 & X86_CR0_AM)
7244 && pCtx->eflags.Bits.u1AC
7245 && pVCpu->iem.s.uCpl == 3)
7246 return iemRaiseAlignmentCheckException(pVCpu);
7247 return iemRaiseGeneralProtectionFault0(pVCpu);
7248 }
7249
7250 /*
7251 * Access the memory.
7252 */
7253 void *pvMem512;
7254 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7255 if (rcStrict != VINF_SUCCESS)
7256 return rcStrict;
7257 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7258 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
7259
7260 /*
7261 * Store the registers.
7262 */
7263 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
7264 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
7265
7266 /* common for all formats */
7267 pDst->FCW = pSrc->FCW;
7268 pDst->FSW = pSrc->FSW;
7269 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7270 pDst->FOP = pSrc->FOP;
7271 pDst->MXCSR = pSrc->MXCSR;
7272 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7273 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7274 {
7275 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7276 * them for now... */
7277 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7278 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7279 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7280 pDst->aRegs[i].au32[3] = 0;
7281 }
7282
7283 /* FPU IP, CS, DP and DS. */
7284 pDst->FPUIP = pSrc->FPUIP;
7285 pDst->CS = pSrc->CS;
7286 pDst->FPUDP = pSrc->FPUDP;
7287 pDst->DS = pSrc->DS;
7288 if (enmEffOpSize == IEMMODE_64BIT)
7289 {
7290 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7291 pDst->Rsrvd1 = pSrc->Rsrvd1;
7292 pDst->Rsrvd2 = pSrc->Rsrvd2;
7293 pDst->au32RsrvdForSoftware[0] = 0;
7294 }
7295 else
7296 {
7297 pDst->Rsrvd1 = 0;
7298 pDst->Rsrvd2 = 0;
7299 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
7300 }
7301
7302 /* XMM registers. */
7303 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
7304 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
7305 || pVCpu->iem.s.uCpl != 0)
7306 {
7307 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7308 for (uint32_t i = 0; i < cXmmRegs; i++)
7309 pDst->aXMM[i] = pSrc->aXMM[i];
7310 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7311 * right? */
7312 }
7313
7314 /*
7315 * Commit the memory.
7316 */
7317 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7318 if (rcStrict != VINF_SUCCESS)
7319 return rcStrict;
7320
7321 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7322 return VINF_SUCCESS;
7323}
7324
7325
7326/**
7327 * Implements 'FXRSTOR'.
7328 *
7329 * @param GCPtrEff The address of the image.
7330 * @param enmEffOpSize The operand size (only REX.W really matters).
7331 */
7332IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7333{
7334 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7335
7336 /*
7337 * Raise exceptions.
7338 */
7339 if (pCtx->cr0 & X86_CR0_EM)
7340 return iemRaiseUndefinedOpcode(pVCpu);
7341 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
7342 return iemRaiseDeviceNotAvailable(pVCpu);
7343 if (GCPtrEff & 15)
7344 {
7345 /** @todo CPU/VM detection possible! \#AC might not be signal for
7346 * all/any misalignment sizes, intel says its an implementation detail. */
7347 if ( (pCtx->cr0 & X86_CR0_AM)
7348 && pCtx->eflags.Bits.u1AC
7349 && pVCpu->iem.s.uCpl == 3)
7350 return iemRaiseAlignmentCheckException(pVCpu);
7351 return iemRaiseGeneralProtectionFault0(pVCpu);
7352 }
7353
7354 /*
7355 * Access the memory.
7356 */
7357 void *pvMem512;
7358 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
7359 if (rcStrict != VINF_SUCCESS)
7360 return rcStrict;
7361 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
7362 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
7363
7364 /*
7365 * Check the state for stuff which will #GP(0).
7366 */
7367 uint32_t const fMXCSR = pSrc->MXCSR;
7368 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7369 if (fMXCSR & ~fMXCSR_MASK)
7370 {
7371 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
7372 return iemRaiseGeneralProtectionFault0(pVCpu);
7373 }
7374
7375 /*
7376 * Load the registers.
7377 */
7378 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
7379 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
7380
7381 /* common for all formats */
7382 pDst->FCW = pSrc->FCW;
7383 pDst->FSW = pSrc->FSW;
7384 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7385 pDst->FOP = pSrc->FOP;
7386 pDst->MXCSR = fMXCSR;
7387 /* (MXCSR_MASK is read-only) */
7388 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7389 {
7390 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7391 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7392 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7393 pDst->aRegs[i].au32[3] = 0;
7394 }
7395
7396 /* FPU IP, CS, DP and DS. */
7397 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
7398 {
7399 pDst->FPUIP = pSrc->FPUIP;
7400 pDst->CS = pSrc->CS;
7401 pDst->Rsrvd1 = pSrc->Rsrvd1;
7402 pDst->FPUDP = pSrc->FPUDP;
7403 pDst->DS = pSrc->DS;
7404 pDst->Rsrvd2 = pSrc->Rsrvd2;
7405 }
7406 else
7407 {
7408 pDst->FPUIP = pSrc->FPUIP;
7409 pDst->CS = pSrc->CS;
7410 pDst->Rsrvd1 = 0;
7411 pDst->FPUDP = pSrc->FPUDP;
7412 pDst->DS = pSrc->DS;
7413 pDst->Rsrvd2 = 0;
7414 }
7415
7416 /* XMM registers. */
7417 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
7418 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
7419 || pVCpu->iem.s.uCpl != 0)
7420 {
7421 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7422 for (uint32_t i = 0; i < cXmmRegs; i++)
7423 pDst->aXMM[i] = pSrc->aXMM[i];
7424 }
7425
7426 /*
7427 * Commit the memory.
7428 */
7429 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7430 if (rcStrict != VINF_SUCCESS)
7431 return rcStrict;
7432
7433 iemHlpUsedFpu(pVCpu);
7434 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7435 return VINF_SUCCESS;
7436}
7437
7438
7439/**
7440 * Implements 'XSAVE'.
7441 *
7442 * @param iEffSeg The effective segment.
7443 * @param GCPtrEff The address of the image.
7444 * @param enmEffOpSize The operand size (only REX.W really matters).
7445 */
7446IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7447{
7448 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7449
7450 /*
7451 * Raise exceptions.
7452 */
7453 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7454 return iemRaiseUndefinedOpcode(pVCpu);
7455 if (pCtx->cr0 & X86_CR0_TS)
7456 return iemRaiseDeviceNotAvailable(pVCpu);
7457 if (GCPtrEff & 63)
7458 {
7459 /** @todo CPU/VM detection possible! \#AC might not be signal for
7460 * all/any misalignment sizes, intel says its an implementation detail. */
7461 if ( (pCtx->cr0 & X86_CR0_AM)
7462 && pCtx->eflags.Bits.u1AC
7463 && pVCpu->iem.s.uCpl == 3)
7464 return iemRaiseAlignmentCheckException(pVCpu);
7465 return iemRaiseGeneralProtectionFault0(pVCpu);
7466 }
7467
7468 /*
7469 * Calc the requested mask
7470 */
7471 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7472 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7473 uint64_t const fXInUse = pCtx->aXcr[0];
7474
7475/** @todo figure out the exact protocol for the memory access. Currently we
7476 * just need this crap to work halfways to make it possible to test
7477 * AVX instructions. */
7478/** @todo figure out the XINUSE and XMODIFIED */
7479
7480 /*
7481 * Access the x87 memory state.
7482 */
7483 /* The x87+SSE state. */
7484 void *pvMem512;
7485 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7486 if (rcStrict != VINF_SUCCESS)
7487 return rcStrict;
7488 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7489 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
7490
7491 /* The header. */
7492 PX86XSAVEHDR pHdr;
7493 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW);
7494 if (rcStrict != VINF_SUCCESS)
7495 return rcStrict;
7496
7497 /*
7498 * Store the X87 state.
7499 */
7500 if (fReqComponents & XSAVE_C_X87)
7501 {
7502 /* common for all formats */
7503 pDst->FCW = pSrc->FCW;
7504 pDst->FSW = pSrc->FSW;
7505 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7506 pDst->FOP = pSrc->FOP;
7507 pDst->FPUIP = pSrc->FPUIP;
7508 pDst->CS = pSrc->CS;
7509 pDst->FPUDP = pSrc->FPUDP;
7510 pDst->DS = pSrc->DS;
7511 if (enmEffOpSize == IEMMODE_64BIT)
7512 {
7513 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7514 pDst->Rsrvd1 = pSrc->Rsrvd1;
7515 pDst->Rsrvd2 = pSrc->Rsrvd2;
7516 pDst->au32RsrvdForSoftware[0] = 0;
7517 }
7518 else
7519 {
7520 pDst->Rsrvd1 = 0;
7521 pDst->Rsrvd2 = 0;
7522 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
7523 }
7524 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7525 {
7526 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7527 * them for now... */
7528 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7529 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7530 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7531 pDst->aRegs[i].au32[3] = 0;
7532 }
7533
7534 }
7535
7536 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7537 {
7538 pDst->MXCSR = pSrc->MXCSR;
7539 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7540 }
7541
7542 if (fReqComponents & XSAVE_C_SSE)
7543 {
7544 /* XMM registers. */
7545 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7546 for (uint32_t i = 0; i < cXmmRegs; i++)
7547 pDst->aXMM[i] = pSrc->aXMM[i];
7548 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7549 * right? */
7550 }
7551
7552 /* Commit the x87 state bits. (probably wrong) */
7553 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7554 if (rcStrict != VINF_SUCCESS)
7555 return rcStrict;
7556
7557 /*
7558 * Store AVX state.
7559 */
7560 if (fReqComponents & XSAVE_C_YMM)
7561 {
7562 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7563 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7564 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
7565 PX86XSAVEYMMHI pCompDst;
7566 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT],
7567 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7568 if (rcStrict != VINF_SUCCESS)
7569 return rcStrict;
7570
7571 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7572 for (uint32_t i = 0; i < cXmmRegs; i++)
7573 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
7574
7575 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7576 if (rcStrict != VINF_SUCCESS)
7577 return rcStrict;
7578 }
7579
7580 /*
7581 * Update the header.
7582 */
7583 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
7584 | (fReqComponents & fXInUse);
7585
7586 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
7587 if (rcStrict != VINF_SUCCESS)
7588 return rcStrict;
7589
7590 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7591 return VINF_SUCCESS;
7592}
7593
7594
7595/**
7596 * Implements 'XRSTOR'.
7597 *
7598 * @param iEffSeg The effective segment.
7599 * @param GCPtrEff The address of the image.
7600 * @param enmEffOpSize The operand size (only REX.W really matters).
7601 */
7602IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7603{
7604 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7605
7606 /*
7607 * Raise exceptions.
7608 */
7609 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7610 return iemRaiseUndefinedOpcode(pVCpu);
7611 if (pCtx->cr0 & X86_CR0_TS)
7612 return iemRaiseDeviceNotAvailable(pVCpu);
7613 if (GCPtrEff & 63)
7614 {
7615 /** @todo CPU/VM detection possible! \#AC might not be signal for
7616 * all/any misalignment sizes, intel says its an implementation detail. */
7617 if ( (pCtx->cr0 & X86_CR0_AM)
7618 && pCtx->eflags.Bits.u1AC
7619 && pVCpu->iem.s.uCpl == 3)
7620 return iemRaiseAlignmentCheckException(pVCpu);
7621 return iemRaiseGeneralProtectionFault0(pVCpu);
7622 }
7623
7624/** @todo figure out the exact protocol for the memory access. Currently we
7625 * just need this crap to work halfways to make it possible to test
7626 * AVX instructions. */
7627/** @todo figure out the XINUSE and XMODIFIED */
7628
7629 /*
7630 * Access the x87 memory state.
7631 */
7632 /* The x87+SSE state. */
7633 void *pvMem512;
7634 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
7635 if (rcStrict != VINF_SUCCESS)
7636 return rcStrict;
7637 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
7638 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
7639
7640 /*
7641 * Calc the requested mask
7642 */
7643 PX86XSAVEHDR pHdrDst = &pCtx->CTX_SUFF(pXState)->Hdr;
7644 PCX86XSAVEHDR pHdrSrc;
7645 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_R);
7646 if (rcStrict != VINF_SUCCESS)
7647 return rcStrict;
7648
7649 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7650 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7651 //uint64_t const fXInUse = pCtx->aXcr[0];
7652 uint64_t const fRstorMask = pHdrSrc->bmXState;
7653 uint64_t const fCompMask = pHdrSrc->bmXComp;
7654
7655 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7656
7657 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7658
7659 /* We won't need this any longer. */
7660 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
7661 if (rcStrict != VINF_SUCCESS)
7662 return rcStrict;
7663
7664 /*
7665 * Store the X87 state.
7666 */
7667 if (fReqComponents & XSAVE_C_X87)
7668 {
7669 if (fRstorMask & XSAVE_C_X87)
7670 {
7671 pDst->FCW = pSrc->FCW;
7672 pDst->FSW = pSrc->FSW;
7673 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7674 pDst->FOP = pSrc->FOP;
7675 pDst->FPUIP = pSrc->FPUIP;
7676 pDst->CS = pSrc->CS;
7677 pDst->FPUDP = pSrc->FPUDP;
7678 pDst->DS = pSrc->DS;
7679 if (enmEffOpSize == IEMMODE_64BIT)
7680 {
7681 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7682 pDst->Rsrvd1 = pSrc->Rsrvd1;
7683 pDst->Rsrvd2 = pSrc->Rsrvd2;
7684 }
7685 else
7686 {
7687 pDst->Rsrvd1 = 0;
7688 pDst->Rsrvd2 = 0;
7689 }
7690 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7691 {
7692 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7693 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7694 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7695 pDst->aRegs[i].au32[3] = 0;
7696 }
7697 }
7698 else
7699 {
7700 pDst->FCW = 0x37f;
7701 pDst->FSW = 0;
7702 pDst->FTW = 0x00; /* 0 - empty. */
7703 pDst->FPUDP = 0;
7704 pDst->DS = 0; //??
7705 pDst->Rsrvd2= 0;
7706 pDst->FPUIP = 0;
7707 pDst->CS = 0; //??
7708 pDst->Rsrvd1= 0;
7709 pDst->FOP = 0;
7710 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7711 {
7712 pDst->aRegs[i].au32[0] = 0;
7713 pDst->aRegs[i].au32[1] = 0;
7714 pDst->aRegs[i].au32[2] = 0;
7715 pDst->aRegs[i].au32[3] = 0;
7716 }
7717 }
7718 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
7719 }
7720
7721 /* MXCSR */
7722 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7723 {
7724 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
7725 pDst->MXCSR = pSrc->MXCSR;
7726 else
7727 pDst->MXCSR = 0x1f80;
7728 }
7729
7730 /* XMM registers. */
7731 if (fReqComponents & XSAVE_C_SSE)
7732 {
7733 if (fRstorMask & XSAVE_C_SSE)
7734 {
7735 for (uint32_t i = 0; i < cXmmRegs; i++)
7736 pDst->aXMM[i] = pSrc->aXMM[i];
7737 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7738 * right? */
7739 }
7740 else
7741 {
7742 for (uint32_t i = 0; i < cXmmRegs; i++)
7743 {
7744 pDst->aXMM[i].au64[0] = 0;
7745 pDst->aXMM[i].au64[1] = 0;
7746 }
7747 }
7748 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
7749 }
7750
7751 /* Unmap the x87 state bits (so we've don't run out of mapping). */
7752 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7753 if (rcStrict != VINF_SUCCESS)
7754 return rcStrict;
7755
7756 /*
7757 * Restore AVX state.
7758 */
7759 if (fReqComponents & XSAVE_C_YMM)
7760 {
7761 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7762 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
7763
7764 if (fRstorMask & XSAVE_C_YMM)
7765 {
7766 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7767 PCX86XSAVEYMMHI pCompSrc;
7768 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
7769 iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT], IEM_ACCESS_DATA_R);
7770 if (rcStrict != VINF_SUCCESS)
7771 return rcStrict;
7772
7773 for (uint32_t i = 0; i < cXmmRegs; i++)
7774 {
7775 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
7776 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
7777 }
7778
7779 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
7780 if (rcStrict != VINF_SUCCESS)
7781 return rcStrict;
7782 }
7783 else
7784 {
7785 for (uint32_t i = 0; i < cXmmRegs; i++)
7786 {
7787 pCompDst->aYmmHi[i].au64[0] = 0;
7788 pCompDst->aYmmHi[i].au64[1] = 0;
7789 }
7790 }
7791 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
7792 }
7793
7794 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7795 return VINF_SUCCESS;
7796}
7797
7798
7799
7800
7801/**
7802 * Implements 'STMXCSR'.
7803 *
7804 * @param GCPtrEff The address of the image.
7805 */
7806IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7807{
7808 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7809
7810 /*
7811 * Raise exceptions.
7812 */
7813 if ( !(pCtx->cr0 & X86_CR0_EM)
7814 && (pCtx->cr4 & X86_CR4_OSFXSR))
7815 {
7816 if (!(pCtx->cr0 & X86_CR0_TS))
7817 {
7818 /*
7819 * Do the job.
7820 */
7821 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7822 if (rcStrict == VINF_SUCCESS)
7823 {
7824 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7825 return VINF_SUCCESS;
7826 }
7827 return rcStrict;
7828 }
7829 return iemRaiseDeviceNotAvailable(pVCpu);
7830 }
7831 return iemRaiseUndefinedOpcode(pVCpu);
7832}
7833
7834
7835/**
7836 * Implements 'VSTMXCSR'.
7837 *
7838 * @param GCPtrEff The address of the image.
7839 */
7840IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7841{
7842 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7843
7844 /*
7845 * Raise exceptions.
7846 */
7847 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
7848 ? (pCtx->aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
7849 : !(pCtx->cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
7850 && (pCtx->cr4 & X86_CR4_OSXSAVE))
7851 {
7852 if (!(pCtx->cr0 & X86_CR0_TS))
7853 {
7854 /*
7855 * Do the job.
7856 */
7857 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7858 if (rcStrict == VINF_SUCCESS)
7859 {
7860 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7861 return VINF_SUCCESS;
7862 }
7863 return rcStrict;
7864 }
7865 return iemRaiseDeviceNotAvailable(pVCpu);
7866 }
7867 return iemRaiseUndefinedOpcode(pVCpu);
7868}
7869
7870
7871/**
7872 * Implements 'LDMXCSR'.
7873 *
7874 * @param GCPtrEff The address of the image.
7875 */
7876IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7877{
7878 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7879
7880 /*
7881 * Raise exceptions.
7882 */
7883 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
7884 * happen after or before \#UD and \#EM? */
7885 if ( !(pCtx->cr0 & X86_CR0_EM)
7886 && (pCtx->cr4 & X86_CR4_OSFXSR))
7887 {
7888 if (!(pCtx->cr0 & X86_CR0_TS))
7889 {
7890 /*
7891 * Do the job.
7892 */
7893 uint32_t fNewMxCsr;
7894 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
7895 if (rcStrict == VINF_SUCCESS)
7896 {
7897 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7898 if (!(fNewMxCsr & ~fMxCsrMask))
7899 {
7900 pCtx->CTX_SUFF(pXState)->x87.MXCSR = fNewMxCsr;
7901 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7902 return VINF_SUCCESS;
7903 }
7904 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
7905 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
7906 return iemRaiseGeneralProtectionFault0(pVCpu);
7907 }
7908 return rcStrict;
7909 }
7910 return iemRaiseDeviceNotAvailable(pVCpu);
7911 }
7912 return iemRaiseUndefinedOpcode(pVCpu);
7913}
7914
7915
7916/**
7917 * Commmon routine for fnstenv and fnsave.
7918 *
7919 * @param uPtr Where to store the state.
7920 * @param pCtx The CPU context.
7921 */
7922static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
7923{
7924 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
7925 if (enmEffOpSize == IEMMODE_16BIT)
7926 {
7927 uPtr.pu16[0] = pSrcX87->FCW;
7928 uPtr.pu16[1] = pSrcX87->FSW;
7929 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
7930 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7931 {
7932 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
7933 * protected mode or long mode and we save it in real mode? And vice
7934 * versa? And with 32-bit operand size? I think CPU is storing the
7935 * effective address ((CS << 4) + IP) in the offset register and not
7936 * doing any address calculations here. */
7937 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
7938 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
7939 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
7940 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
7941 }
7942 else
7943 {
7944 uPtr.pu16[3] = pSrcX87->FPUIP;
7945 uPtr.pu16[4] = pSrcX87->CS;
7946 uPtr.pu16[5] = pSrcX87->FPUDP;
7947 uPtr.pu16[6] = pSrcX87->DS;
7948 }
7949 }
7950 else
7951 {
7952 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
7953 uPtr.pu16[0*2] = pSrcX87->FCW;
7954 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
7955 uPtr.pu16[1*2] = pSrcX87->FSW;
7956 uPtr.pu16[1*2+1] = 0xffff;
7957 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
7958 uPtr.pu16[2*2+1] = 0xffff;
7959 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7960 {
7961 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
7962 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
7963 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
7964 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
7965 }
7966 else
7967 {
7968 uPtr.pu32[3] = pSrcX87->FPUIP;
7969 uPtr.pu16[4*2] = pSrcX87->CS;
7970 uPtr.pu16[4*2+1] = pSrcX87->FOP;
7971 uPtr.pu32[5] = pSrcX87->FPUDP;
7972 uPtr.pu16[6*2] = pSrcX87->DS;
7973 uPtr.pu16[6*2+1] = 0xffff;
7974 }
7975 }
7976}
7977
7978
7979/**
7980 * Commmon routine for fldenv and frstor
7981 *
7982 * @param uPtr Where to store the state.
7983 * @param pCtx The CPU context.
7984 */
7985static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
7986{
7987 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
7988 if (enmEffOpSize == IEMMODE_16BIT)
7989 {
7990 pDstX87->FCW = uPtr.pu16[0];
7991 pDstX87->FSW = uPtr.pu16[1];
7992 pDstX87->FTW = uPtr.pu16[2];
7993 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7994 {
7995 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
7996 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
7997 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
7998 pDstX87->CS = 0;
7999 pDstX87->Rsrvd1= 0;
8000 pDstX87->DS = 0;
8001 pDstX87->Rsrvd2= 0;
8002 }
8003 else
8004 {
8005 pDstX87->FPUIP = uPtr.pu16[3];
8006 pDstX87->CS = uPtr.pu16[4];
8007 pDstX87->Rsrvd1= 0;
8008 pDstX87->FPUDP = uPtr.pu16[5];
8009 pDstX87->DS = uPtr.pu16[6];
8010 pDstX87->Rsrvd2= 0;
8011 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
8012 }
8013 }
8014 else
8015 {
8016 pDstX87->FCW = uPtr.pu16[0*2];
8017 pDstX87->FSW = uPtr.pu16[1*2];
8018 pDstX87->FTW = uPtr.pu16[2*2];
8019 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8020 {
8021 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
8022 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
8023 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
8024 pDstX87->CS = 0;
8025 pDstX87->Rsrvd1= 0;
8026 pDstX87->DS = 0;
8027 pDstX87->Rsrvd2= 0;
8028 }
8029 else
8030 {
8031 pDstX87->FPUIP = uPtr.pu32[3];
8032 pDstX87->CS = uPtr.pu16[4*2];
8033 pDstX87->Rsrvd1= 0;
8034 pDstX87->FOP = uPtr.pu16[4*2+1];
8035 pDstX87->FPUDP = uPtr.pu32[5];
8036 pDstX87->DS = uPtr.pu16[6*2];
8037 pDstX87->Rsrvd2= 0;
8038 }
8039 }
8040
8041 /* Make adjustments. */
8042 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
8043 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
8044 iemFpuRecalcExceptionStatus(pDstX87);
8045 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
8046 * exceptions are pending after loading the saved state? */
8047}
8048
8049
8050/**
8051 * Implements 'FNSTENV'.
8052 *
8053 * @param enmEffOpSize The operand size (only REX.W really matters).
8054 * @param iEffSeg The effective segment register for @a GCPtrEff.
8055 * @param GCPtrEffDst The address of the image.
8056 */
8057IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8058{
8059 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8060 RTPTRUNION uPtr;
8061 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8062 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8063 if (rcStrict != VINF_SUCCESS)
8064 return rcStrict;
8065
8066 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8067
8068 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8069 if (rcStrict != VINF_SUCCESS)
8070 return rcStrict;
8071
8072 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8073 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8074 return VINF_SUCCESS;
8075}
8076
8077
8078/**
8079 * Implements 'FNSAVE'.
8080 *
8081 * @param GCPtrEffDst The address of the image.
8082 * @param enmEffOpSize The operand size.
8083 */
8084IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8085{
8086 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8087 RTPTRUNION uPtr;
8088 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8089 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8090 if (rcStrict != VINF_SUCCESS)
8091 return rcStrict;
8092
8093 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8094 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8095 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8096 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8097 {
8098 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
8099 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
8100 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
8101 }
8102
8103 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8104 if (rcStrict != VINF_SUCCESS)
8105 return rcStrict;
8106
8107 /*
8108 * Re-initialize the FPU context.
8109 */
8110 pFpuCtx->FCW = 0x37f;
8111 pFpuCtx->FSW = 0;
8112 pFpuCtx->FTW = 0x00; /* 0 - empty */
8113 pFpuCtx->FPUDP = 0;
8114 pFpuCtx->DS = 0;
8115 pFpuCtx->Rsrvd2= 0;
8116 pFpuCtx->FPUIP = 0;
8117 pFpuCtx->CS = 0;
8118 pFpuCtx->Rsrvd1= 0;
8119 pFpuCtx->FOP = 0;
8120
8121 iemHlpUsedFpu(pVCpu);
8122 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8123 return VINF_SUCCESS;
8124}
8125
8126
8127
8128/**
8129 * Implements 'FLDENV'.
8130 *
8131 * @param enmEffOpSize The operand size (only REX.W really matters).
8132 * @param iEffSeg The effective segment register for @a GCPtrEff.
8133 * @param GCPtrEffSrc The address of the image.
8134 */
8135IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8136{
8137 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8138 RTCPTRUNION uPtr;
8139 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8140 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8141 if (rcStrict != VINF_SUCCESS)
8142 return rcStrict;
8143
8144 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8145
8146 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8147 if (rcStrict != VINF_SUCCESS)
8148 return rcStrict;
8149
8150 iemHlpUsedFpu(pVCpu);
8151 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8152 return VINF_SUCCESS;
8153}
8154
8155
8156/**
8157 * Implements 'FRSTOR'.
8158 *
8159 * @param GCPtrEffSrc The address of the image.
8160 * @param enmEffOpSize The operand size.
8161 */
8162IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8163{
8164 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8165 RTCPTRUNION uPtr;
8166 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8167 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8168 if (rcStrict != VINF_SUCCESS)
8169 return rcStrict;
8170
8171 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8172 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8173 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8174 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8175 {
8176 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
8177 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
8178 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
8179 pFpuCtx->aRegs[i].au32[3] = 0;
8180 }
8181
8182 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8183 if (rcStrict != VINF_SUCCESS)
8184 return rcStrict;
8185
8186 iemHlpUsedFpu(pVCpu);
8187 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8188 return VINF_SUCCESS;
8189}
8190
8191
8192/**
8193 * Implements 'FLDCW'.
8194 *
8195 * @param u16Fcw The new FCW.
8196 */
8197IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
8198{
8199 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8200
8201 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
8202 /** @todo Testcase: Try see what happens when trying to set undefined bits
8203 * (other than 6 and 7). Currently ignoring them. */
8204 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
8205 * according to FSW. (This is was is currently implemented.) */
8206 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8207 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
8208 iemFpuRecalcExceptionStatus(pFpuCtx);
8209
8210 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8211 iemHlpUsedFpu(pVCpu);
8212 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8213 return VINF_SUCCESS;
8214}
8215
8216
8217
8218/**
8219 * Implements the underflow case of fxch.
8220 *
8221 * @param iStReg The other stack register.
8222 */
8223IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
8224{
8225 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8226
8227 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8228 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
8229 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
8230 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
8231
8232 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
8233 * registers are read as QNaN and then exchanged. This could be
8234 * wrong... */
8235 if (pFpuCtx->FCW & X86_FCW_IM)
8236 {
8237 if (RT_BIT(iReg1) & pFpuCtx->FTW)
8238 {
8239 if (RT_BIT(iReg2) & pFpuCtx->FTW)
8240 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8241 else
8242 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
8243 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
8244 }
8245 else
8246 {
8247 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
8248 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8249 }
8250 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
8251 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
8252 }
8253 else
8254 {
8255 /* raise underflow exception, don't change anything. */
8256 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
8257 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
8258 }
8259
8260 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
8261 iemHlpUsedFpu(pVCpu);
8262 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8263 return VINF_SUCCESS;
8264}
8265
8266
8267/**
8268 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
8269 *
8270 * @param cToAdd 1 or 7.
8271 */
8272IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
8273{
8274 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8275 Assert(iStReg < 8);
8276
8277 /*
8278 * Raise exceptions.
8279 */
8280 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
8281 return iemRaiseDeviceNotAvailable(pVCpu);
8282
8283 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8284 uint16_t u16Fsw = pFpuCtx->FSW;
8285 if (u16Fsw & X86_FSW_ES)
8286 return iemRaiseMathFault(pVCpu);
8287
8288 /*
8289 * Check if any of the register accesses causes #SF + #IA.
8290 */
8291 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
8292 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
8293 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
8294 {
8295 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
8296 NOREF(u32Eflags);
8297
8298 pFpuCtx->FSW &= ~X86_FSW_C1;
8299 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
8300 if ( !(u16Fsw & X86_FSW_IE)
8301 || (pFpuCtx->FCW & X86_FCW_IM) )
8302 {
8303 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8304 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8305 }
8306 }
8307 else if (pFpuCtx->FCW & X86_FCW_IM)
8308 {
8309 /* Masked underflow. */
8310 pFpuCtx->FSW &= ~X86_FSW_C1;
8311 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
8312 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8313 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
8314 }
8315 else
8316 {
8317 /* Raise underflow - don't touch EFLAGS or TOP. */
8318 pFpuCtx->FSW &= ~X86_FSW_C1;
8319 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
8320 fPop = false;
8321 }
8322
8323 /*
8324 * Pop if necessary.
8325 */
8326 if (fPop)
8327 {
8328 pFpuCtx->FTW &= ~RT_BIT(iReg1);
8329 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
8330 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
8331 }
8332
8333 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
8334 iemHlpUsedFpu(pVCpu);
8335 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8336 return VINF_SUCCESS;
8337}
8338
8339/** @} */
8340
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette