VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 40162

Last change on this file since 40162 was 40162, checked in by vboxsync, 13 years ago

fmul st0,m64r
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 112.9 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 40162 2012-02-16 19:28:18Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2012 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/** @name Misc Helpers
20 * @{
21 */
22
23/**
24 * Checks if we are allowed to access the given I/O port, raising the
25 * appropriate exceptions if we aren't (or if the I/O bitmap is not
26 * accessible).
27 *
28 * @returns Strict VBox status code.
29 *
30 * @param pIemCpu The IEM per CPU data.
31 * @param pCtx The register context.
32 * @param u16Port The port number.
33 * @param cbOperand The operand size.
34 */
35DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
36{
37 if ( (pCtx->cr0 & X86_CR0_PE)
38 && ( pIemCpu->uCpl > pCtx->eflags.Bits.u2IOPL
39 || pCtx->eflags.Bits.u1VM) )
40 {
41 NOREF(u16Port); NOREF(cbOperand); /** @todo I/O port permission bitmap check */
42 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
43 }
44 return VINF_SUCCESS;
45}
46
47
48#if 0
49/**
50 * Calculates the parity bit.
51 *
52 * @returns true if the bit is set, false if not.
53 * @param u8Result The least significant byte of the result.
54 */
55static bool iemHlpCalcParityFlag(uint8_t u8Result)
56{
57 /*
58 * Parity is set if the number of bits in the least significant byte of
59 * the result is even.
60 */
61 uint8_t cBits;
62 cBits = u8Result & 1; /* 0 */
63 u8Result >>= 1;
64 cBits += u8Result & 1;
65 u8Result >>= 1;
66 cBits += u8Result & 1;
67 u8Result >>= 1;
68 cBits += u8Result & 1;
69 u8Result >>= 1;
70 cBits += u8Result & 1; /* 4 */
71 u8Result >>= 1;
72 cBits += u8Result & 1;
73 u8Result >>= 1;
74 cBits += u8Result & 1;
75 u8Result >>= 1;
76 cBits += u8Result & 1;
77 return !(cBits & 1);
78}
79#endif /* not used */
80
81
82/**
83 * Updates the specified flags according to a 8-bit result.
84 *
85 * @param pIemCpu The.
86 * @param u8Result The result to set the flags according to.
87 * @param fToUpdate The flags to update.
88 * @param fUndefined The flags that are specified as undefined.
89 */
90static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
91{
92 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
93
94 uint32_t fEFlags = pCtx->eflags.u;
95 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
96 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
97 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
98}
99
100
101/**
102 * Loads a NULL data selector into a selector register, both the hidden and
103 * visible parts, in protected mode.
104 *
105 * @param puSel The selector register.
106 * @param pHid The hidden register part.
107 */
108static void iemHlpLoadNullDataSelectorProt(PRTSEL puSel, PCPUMSELREGHID pHid)
109{
110 /** @todo write a testcase checking what happends when loading a NULL data
111 * selector in protected mode. */
112 pHid->u64Base = 0;
113 pHid->u32Limit = 0;
114 pHid->Attr.u = 0;
115 *puSel = 0;
116}
117
118
119/**
120 * Helper used by iret.
121 *
122 * @param uCpl The new CPL.
123 * @param puSel The selector register.
124 * @param pHid The corresponding hidden register.
125 */
126static void iemHlpAdjustSelectorForNewCpl(uint8_t uCpl, PRTSEL puSel, PCPUMSELREGHID pHid)
127{
128 if ( uCpl > pHid->Attr.n.u2Dpl
129 && pHid->Attr.n.u1DescType /* code or data, not system */
130 && (pHid->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
131 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
132 iemHlpLoadNullDataSelectorProt(puSel, pHid);
133}
134
135
136/** @} */
137
138/** @name C Implementations
139 * @{
140 */
141
142/**
143 * Implements a 16-bit popa.
144 */
145IEM_CIMPL_DEF_0(iemCImpl_popa_16)
146{
147 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
148 RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
149 RTGCPTR GCPtrLast = GCPtrStart + 15;
150 VBOXSTRICTRC rcStrict;
151
152 /*
153 * The docs are a bit hard to comprehend here, but it looks like we wrap
154 * around in real mode as long as none of the individual "popa" crosses the
155 * end of the stack segment. In protected mode we check the whole access
156 * in one go. For efficiency, only do the word-by-word thing if we're in
157 * danger of wrapping around.
158 */
159 /** @todo do popa boundary / wrap-around checks. */
160 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
161 && (pCtx->csHid.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
162 {
163 /* word-by-word */
164 RTUINT64U TmpRsp;
165 TmpRsp.u = pCtx->rsp;
166 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
167 if (rcStrict == VINF_SUCCESS)
168 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
169 if (rcStrict == VINF_SUCCESS)
170 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
171 if (rcStrict == VINF_SUCCESS)
172 {
173 iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
174 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
175 }
176 if (rcStrict == VINF_SUCCESS)
177 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
178 if (rcStrict == VINF_SUCCESS)
179 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
180 if (rcStrict == VINF_SUCCESS)
181 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
182 if (rcStrict == VINF_SUCCESS)
183 {
184 pCtx->rsp = TmpRsp.u;
185 iemRegAddToRip(pIemCpu, cbInstr);
186 }
187 }
188 else
189 {
190 uint16_t const *pa16Mem = NULL;
191 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
192 if (rcStrict == VINF_SUCCESS)
193 {
194 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
195 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
196 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
197 /* skip sp */
198 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
199 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
200 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
201 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
202 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
203 if (rcStrict == VINF_SUCCESS)
204 {
205 iemRegAddToRsp(pCtx, 16);
206 iemRegAddToRip(pIemCpu, cbInstr);
207 }
208 }
209 }
210 return rcStrict;
211}
212
213
214/**
215 * Implements a 32-bit popa.
216 */
217IEM_CIMPL_DEF_0(iemCImpl_popa_32)
218{
219 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
220 RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
221 RTGCPTR GCPtrLast = GCPtrStart + 31;
222 VBOXSTRICTRC rcStrict;
223
224 /*
225 * The docs are a bit hard to comprehend here, but it looks like we wrap
226 * around in real mode as long as none of the individual "popa" crosses the
227 * end of the stack segment. In protected mode we check the whole access
228 * in one go. For efficiency, only do the word-by-word thing if we're in
229 * danger of wrapping around.
230 */
231 /** @todo do popa boundary / wrap-around checks. */
232 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
233 && (pCtx->csHid.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
234 {
235 /* word-by-word */
236 RTUINT64U TmpRsp;
237 TmpRsp.u = pCtx->rsp;
238 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
239 if (rcStrict == VINF_SUCCESS)
240 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
241 if (rcStrict == VINF_SUCCESS)
242 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
243 if (rcStrict == VINF_SUCCESS)
244 {
245 iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
246 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
247 }
248 if (rcStrict == VINF_SUCCESS)
249 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
250 if (rcStrict == VINF_SUCCESS)
251 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
252 if (rcStrict == VINF_SUCCESS)
253 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
254 if (rcStrict == VINF_SUCCESS)
255 {
256#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
257 pCtx->rdi &= UINT32_MAX;
258 pCtx->rsi &= UINT32_MAX;
259 pCtx->rbp &= UINT32_MAX;
260 pCtx->rbx &= UINT32_MAX;
261 pCtx->rdx &= UINT32_MAX;
262 pCtx->rcx &= UINT32_MAX;
263 pCtx->rax &= UINT32_MAX;
264#endif
265 pCtx->rsp = TmpRsp.u;
266 iemRegAddToRip(pIemCpu, cbInstr);
267 }
268 }
269 else
270 {
271 uint32_t const *pa32Mem;
272 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
273 if (rcStrict == VINF_SUCCESS)
274 {
275 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
276 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
277 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
278 /* skip esp */
279 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
280 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
281 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
282 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
283 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
284 if (rcStrict == VINF_SUCCESS)
285 {
286 iemRegAddToRsp(pCtx, 32);
287 iemRegAddToRip(pIemCpu, cbInstr);
288 }
289 }
290 }
291 return rcStrict;
292}
293
294
295/**
296 * Implements a 16-bit pusha.
297 */
298IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
299{
300 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
301 RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
302 RTGCPTR GCPtrBottom = GCPtrTop - 15;
303 VBOXSTRICTRC rcStrict;
304
305 /*
306 * The docs are a bit hard to comprehend here, but it looks like we wrap
307 * around in real mode as long as none of the individual "pushd" crosses the
308 * end of the stack segment. In protected mode we check the whole access
309 * in one go. For efficiency, only do the word-by-word thing if we're in
310 * danger of wrapping around.
311 */
312 /** @todo do pusha boundary / wrap-around checks. */
313 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
314 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
315 {
316 /* word-by-word */
317 RTUINT64U TmpRsp;
318 TmpRsp.u = pCtx->rsp;
319 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
320 if (rcStrict == VINF_SUCCESS)
321 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
322 if (rcStrict == VINF_SUCCESS)
323 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
324 if (rcStrict == VINF_SUCCESS)
325 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
326 if (rcStrict == VINF_SUCCESS)
327 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
328 if (rcStrict == VINF_SUCCESS)
329 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
330 if (rcStrict == VINF_SUCCESS)
331 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
332 if (rcStrict == VINF_SUCCESS)
333 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
334 if (rcStrict == VINF_SUCCESS)
335 {
336 pCtx->rsp = TmpRsp.u;
337 iemRegAddToRip(pIemCpu, cbInstr);
338 }
339 }
340 else
341 {
342 GCPtrBottom--;
343 uint16_t *pa16Mem = NULL;
344 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
345 if (rcStrict == VINF_SUCCESS)
346 {
347 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
348 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
349 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
350 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
351 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
352 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
353 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
354 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
355 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
356 if (rcStrict == VINF_SUCCESS)
357 {
358 iemRegSubFromRsp(pCtx, 16);
359 iemRegAddToRip(pIemCpu, cbInstr);
360 }
361 }
362 }
363 return rcStrict;
364}
365
366
367/**
368 * Implements a 32-bit pusha.
369 */
370IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
371{
372 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
373 RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
374 RTGCPTR GCPtrBottom = GCPtrTop - 31;
375 VBOXSTRICTRC rcStrict;
376
377 /*
378 * The docs are a bit hard to comprehend here, but it looks like we wrap
379 * around in real mode as long as none of the individual "pusha" crosses the
380 * end of the stack segment. In protected mode we check the whole access
381 * in one go. For efficiency, only do the word-by-word thing if we're in
382 * danger of wrapping around.
383 */
384 /** @todo do pusha boundary / wrap-around checks. */
385 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
386 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
387 {
388 /* word-by-word */
389 RTUINT64U TmpRsp;
390 TmpRsp.u = pCtx->rsp;
391 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
392 if (rcStrict == VINF_SUCCESS)
393 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
394 if (rcStrict == VINF_SUCCESS)
395 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
396 if (rcStrict == VINF_SUCCESS)
397 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
398 if (rcStrict == VINF_SUCCESS)
399 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
400 if (rcStrict == VINF_SUCCESS)
401 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
402 if (rcStrict == VINF_SUCCESS)
403 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
404 if (rcStrict == VINF_SUCCESS)
405 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
406 if (rcStrict == VINF_SUCCESS)
407 {
408 pCtx->rsp = TmpRsp.u;
409 iemRegAddToRip(pIemCpu, cbInstr);
410 }
411 }
412 else
413 {
414 GCPtrBottom--;
415 uint32_t *pa32Mem;
416 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
417 if (rcStrict == VINF_SUCCESS)
418 {
419 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
420 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
421 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
422 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
423 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
424 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
425 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
426 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
427 rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
428 if (rcStrict == VINF_SUCCESS)
429 {
430 iemRegSubFromRsp(pCtx, 32);
431 iemRegAddToRip(pIemCpu, cbInstr);
432 }
433 }
434 }
435 return rcStrict;
436}
437
438
439/**
440 * Implements pushf.
441 *
442 *
443 * @param enmEffOpSize The effective operand size.
444 */
445IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
446{
447 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
448
449 /*
450 * If we're in V8086 mode some care is required (which is why we're in
451 * doing this in a C implementation).
452 */
453 uint32_t fEfl = pCtx->eflags.u;
454 if ( (fEfl & X86_EFL_VM)
455 && X86_EFL_GET_IOPL(fEfl) != 3 )
456 {
457 Assert(pCtx->cr0 & X86_CR0_PE);
458 if ( enmEffOpSize != IEMMODE_16BIT
459 || !(pCtx->cr4 & X86_CR4_VME))
460 return iemRaiseGeneralProtectionFault0(pIemCpu);
461 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
462 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
463 return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
464 }
465
466 /*
467 * Ok, clear RF and VM and push the flags.
468 */
469 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
470
471 VBOXSTRICTRC rcStrict;
472 switch (enmEffOpSize)
473 {
474 case IEMMODE_16BIT:
475 rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
476 break;
477 case IEMMODE_32BIT:
478 rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
479 break;
480 case IEMMODE_64BIT:
481 rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
482 break;
483 IEM_NOT_REACHED_DEFAULT_CASE_RET();
484 }
485 if (rcStrict != VINF_SUCCESS)
486 return rcStrict;
487
488 iemRegAddToRip(pIemCpu, cbInstr);
489 return VINF_SUCCESS;
490}
491
492
493/**
494 * Implements popf.
495 *
496 * @param enmEffOpSize The effective operand size.
497 */
498IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
499{
500 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
501 uint32_t const fEflOld = pCtx->eflags.u;
502 VBOXSTRICTRC rcStrict;
503 uint32_t fEflNew;
504
505 /*
506 * V8086 is special as usual.
507 */
508 if (fEflOld & X86_EFL_VM)
509 {
510 /*
511 * Almost anything goes if IOPL is 3.
512 */
513 if (X86_EFL_GET_IOPL(fEflOld) == 3)
514 {
515 switch (enmEffOpSize)
516 {
517 case IEMMODE_16BIT:
518 {
519 uint16_t u16Value;
520 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
521 if (rcStrict != VINF_SUCCESS)
522 return rcStrict;
523 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
524 break;
525 }
526 case IEMMODE_32BIT:
527 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
528 if (rcStrict != VINF_SUCCESS)
529 return rcStrict;
530 break;
531 IEM_NOT_REACHED_DEFAULT_CASE_RET();
532 }
533
534 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
535 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
536 }
537 /*
538 * Interrupt flag virtualization with CR4.VME=1.
539 */
540 else if ( enmEffOpSize == IEMMODE_16BIT
541 && (pCtx->cr4 & X86_CR4_VME) )
542 {
543 uint16_t u16Value;
544 RTUINT64U TmpRsp;
545 TmpRsp.u = pCtx->rsp;
546 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
547 if (rcStrict != VINF_SUCCESS)
548 return rcStrict;
549
550 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
551 * or before? */
552 if ( ( (u16Value & X86_EFL_IF)
553 && (fEflOld & X86_EFL_VIP))
554 || (u16Value & X86_EFL_TF) )
555 return iemRaiseGeneralProtectionFault0(pIemCpu);
556
557 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
558 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
559 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
560 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
561
562 pCtx->rsp = TmpRsp.u;
563 }
564 else
565 return iemRaiseGeneralProtectionFault0(pIemCpu);
566
567 }
568 /*
569 * Not in V8086 mode.
570 */
571 else
572 {
573 /* Pop the flags. */
574 switch (enmEffOpSize)
575 {
576 case IEMMODE_16BIT:
577 {
578 uint16_t u16Value;
579 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
580 if (rcStrict != VINF_SUCCESS)
581 return rcStrict;
582 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
583 break;
584 }
585 case IEMMODE_32BIT:
586 case IEMMODE_64BIT:
587 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
588 if (rcStrict != VINF_SUCCESS)
589 return rcStrict;
590 break;
591 IEM_NOT_REACHED_DEFAULT_CASE_RET();
592 }
593
594 /* Merge them with the current flags. */
595 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
596 || pIemCpu->uCpl == 0)
597 {
598 fEflNew &= X86_EFL_POPF_BITS;
599 fEflNew |= ~X86_EFL_POPF_BITS & fEflOld;
600 }
601 else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
602 {
603 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
604 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
605 }
606 else
607 {
608 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
609 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
610 }
611 }
612
613 /*
614 * Commit the flags.
615 */
616 Assert(fEflNew & RT_BIT_32(1));
617 pCtx->eflags.u = fEflNew;
618 iemRegAddToRip(pIemCpu, cbInstr);
619
620 return VINF_SUCCESS;
621}
622
623
624/**
625 * Implements an indirect call.
626 *
627 * @param uNewPC The new program counter (RIP) value (loaded from the
628 * operand).
629 * @param enmEffOpSize The effective operand size.
630 */
631IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
632{
633 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
634 uint16_t uOldPC = pCtx->ip + cbInstr;
635 if (uNewPC > pCtx->csHid.u32Limit)
636 return iemRaiseGeneralProtectionFault0(pIemCpu);
637
638 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
639 if (rcStrict != VINF_SUCCESS)
640 return rcStrict;
641
642 pCtx->rip = uNewPC;
643 return VINF_SUCCESS;
644
645}
646
647
648/**
649 * Implements a 16-bit relative call.
650 *
651 * @param offDisp The displacment offset.
652 */
653IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
654{
655 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
656 uint16_t uOldPC = pCtx->ip + cbInstr;
657 uint16_t uNewPC = uOldPC + offDisp;
658 if (uNewPC > pCtx->csHid.u32Limit)
659 return iemRaiseGeneralProtectionFault0(pIemCpu);
660
661 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
662 if (rcStrict != VINF_SUCCESS)
663 return rcStrict;
664
665 pCtx->rip = uNewPC;
666 return VINF_SUCCESS;
667}
668
669
670/**
671 * Implements a 32-bit indirect call.
672 *
673 * @param uNewPC The new program counter (RIP) value (loaded from the
674 * operand).
675 * @param enmEffOpSize The effective operand size.
676 */
677IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
678{
679 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
680 uint32_t uOldPC = pCtx->eip + cbInstr;
681 if (uNewPC > pCtx->csHid.u32Limit)
682 return iemRaiseGeneralProtectionFault0(pIemCpu);
683
684 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
685 if (rcStrict != VINF_SUCCESS)
686 return rcStrict;
687
688 pCtx->rip = uNewPC;
689 return VINF_SUCCESS;
690
691}
692
693
694/**
695 * Implements a 32-bit relative call.
696 *
697 * @param offDisp The displacment offset.
698 */
699IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
700{
701 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
702 uint32_t uOldPC = pCtx->eip + cbInstr;
703 uint32_t uNewPC = uOldPC + offDisp;
704 if (uNewPC > pCtx->csHid.u32Limit)
705 return iemRaiseGeneralProtectionFault0(pIemCpu);
706
707 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
708 if (rcStrict != VINF_SUCCESS)
709 return rcStrict;
710
711 pCtx->rip = uNewPC;
712 return VINF_SUCCESS;
713}
714
715
716/**
717 * Implements a 64-bit indirect call.
718 *
719 * @param uNewPC The new program counter (RIP) value (loaded from the
720 * operand).
721 * @param enmEffOpSize The effective operand size.
722 */
723IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
724{
725 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
726 uint64_t uOldPC = pCtx->rip + cbInstr;
727 if (!IEM_IS_CANONICAL(uNewPC))
728 return iemRaiseGeneralProtectionFault0(pIemCpu);
729
730 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
731 if (rcStrict != VINF_SUCCESS)
732 return rcStrict;
733
734 pCtx->rip = uNewPC;
735 return VINF_SUCCESS;
736
737}
738
739
740/**
741 * Implements a 64-bit relative call.
742 *
743 * @param offDisp The displacment offset.
744 */
745IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
746{
747 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
748 uint64_t uOldPC = pCtx->rip + cbInstr;
749 uint64_t uNewPC = uOldPC + offDisp;
750 if (!IEM_IS_CANONICAL(uNewPC))
751 return iemRaiseNotCanonical(pIemCpu);
752
753 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
754 if (rcStrict != VINF_SUCCESS)
755 return rcStrict;
756
757 pCtx->rip = uNewPC;
758 return VINF_SUCCESS;
759}
760
761
762/**
763 * Implements far jumps.
764 *
765 * @param uSel The selector.
766 * @param offSeg The segment offset.
767 * @param enmEffOpSize The effective operand size.
768 */
769IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint32_t, offSeg, IEMMODE, enmEffOpSize)
770{
771 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
772 NOREF(cbInstr);
773
774 /*
775 * Real mode and V8086 mode are easy. The only snag seems to be that
776 * CS.limit doesn't change and the limit check is done against the current
777 * limit.
778 */
779 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
780 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
781 {
782 if (offSeg > pCtx->csHid.u32Limit)
783 return iemRaiseGeneralProtectionFault0(pIemCpu);
784
785 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
786 pCtx->rip = offSeg;
787 else
788 pCtx->rip = offSeg & UINT16_MAX;
789 pCtx->cs = uSel;
790 pCtx->csHid.u64Base = (uint32_t)uSel << 4;
791 /** @todo REM reset the accessed bit (see on jmp far16 after disabling
792 * PE. Check with VT-x and AMD-V. */
793#ifdef IEM_VERIFICATION_MODE
794 pCtx->csHid.Attr.u &= ~X86_SEL_TYPE_ACCESSED;
795#endif
796 return VINF_SUCCESS;
797 }
798
799 /*
800 * Protected mode. Need to parse the specified descriptor...
801 */
802 if (!(uSel & (X86_SEL_MASK | X86_SEL_LDT)))
803 {
804 Log(("jmpf %04x:%08x -> invalid selector, #GP(0)\n", uSel, offSeg));
805 return iemRaiseGeneralProtectionFault0(pIemCpu);
806 }
807
808 /* Fetch the descriptor. */
809 IEMSELDESC Desc;
810 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
811 if (rcStrict != VINF_SUCCESS)
812 return rcStrict;
813
814 /* Is it there? */
815 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
816 {
817 Log(("jmpf %04x:%08x -> segment not present\n", uSel, offSeg));
818 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
819 }
820
821 /*
822 * Deal with it according to its type.
823 */
824 if (Desc.Legacy.Gen.u1DescType)
825 {
826 /* Only code segments. */
827 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
828 {
829 Log(("jmpf %04x:%08x -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
830 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
831 }
832
833 /* L vs D. */
834 if ( Desc.Legacy.Gen.u1Long
835 && Desc.Legacy.Gen.u1DefBig
836 && IEM_IS_LONG_MODE(pIemCpu))
837 {
838 Log(("jmpf %04x:%08x -> both L and D are set.\n", uSel, offSeg));
839 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
840 }
841
842 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
843 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
844 {
845 if (Desc.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
846 {
847 Log(("jmpf %04x:%08x -> DPL violation (conforming); DPL=%d CPL=%u\n",
848 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
849 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
850 }
851 }
852 else
853 {
854 if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
855 {
856 Log(("jmpf %04x:%08x -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
857 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
858 }
859 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
860 {
861 Log(("jmpf %04x:%08x -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
862 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
863 }
864 }
865
866 /* Limit check. (Should alternatively check for non-canonical addresses
867 here, but that is ruled out by offSeg being 32-bit, right?) */
868 uint64_t u64Base;
869 uint32_t cbLimit = X86DESC_LIMIT(Desc.Legacy);
870 if (Desc.Legacy.Gen.u1Granularity)
871 cbLimit = (cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
872 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
873 u64Base = 0;
874 else
875 {
876 if (offSeg > cbLimit)
877 {
878 Log(("jmpf %04x:%08x -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
879 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
880 }
881 u64Base = X86DESC_BASE(Desc.Legacy);
882 }
883
884 /*
885 * Ok, everything checked out fine. Now set the accessed bit before
886 * committing the result into CS, CSHID and RIP.
887 */
888 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
889 {
890 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
891 if (rcStrict != VINF_SUCCESS)
892 return rcStrict;
893#ifdef IEM_VERIFICATION_MODE /** @todo check what VT-x and AMD-V does. */
894 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
895#endif
896 }
897
898 /* commit */
899 pCtx->rip = offSeg;
900 pCtx->cs = uSel & (X86_SEL_MASK | X86_SEL_LDT);
901 pCtx->cs |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
902 pCtx->csHid.Attr.u = (Desc.Legacy.u >> (16+16+8)) & UINT32_C(0xf0ff);
903 pCtx->csHid.u32Limit = cbLimit;
904 pCtx->csHid.u64Base = u64Base;
905 /** @todo check if the hidden bits are loaded correctly for 64-bit
906 * mode. */
907 return VINF_SUCCESS;
908 }
909
910 /*
911 * System selector.
912 */
913 if (IEM_IS_LONG_MODE(pIemCpu))
914 switch (Desc.Legacy.Gen.u4Type)
915 {
916 case AMD64_SEL_TYPE_SYS_LDT:
917 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
918 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
919 case AMD64_SEL_TYPE_SYS_CALL_GATE:
920 case AMD64_SEL_TYPE_SYS_INT_GATE:
921 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
922 /* Call various functions to do the work. */
923 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
924 default:
925 Log(("jmpf %04x:%08x -> wrong sys selector (64-bit): %d\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
926 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
927
928 }
929 switch (Desc.Legacy.Gen.u4Type)
930 {
931 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
932 case X86_SEL_TYPE_SYS_LDT:
933 case X86_SEL_TYPE_SYS_286_CALL_GATE:
934 case X86_SEL_TYPE_SYS_TASK_GATE:
935 case X86_SEL_TYPE_SYS_286_INT_GATE:
936 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
937 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
938 case X86_SEL_TYPE_SYS_386_CALL_GATE:
939 case X86_SEL_TYPE_SYS_386_INT_GATE:
940 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
941 /* Call various functions to do the work. */
942 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
943
944 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
945 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
946 /* Call various functions to do the work. */
947 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
948
949 default:
950 Log(("jmpf %04x:%08x -> wrong sys selector (32-bit): %d\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
951 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
952 }
953}
954
955
956/**
957 * Implements far calls.
958 *
959 * @param uSel The selector.
960 * @param offSeg The segment offset.
961 * @param enmOpSize The operand size (in case we need it).
962 */
963IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmOpSize)
964{
965 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
966 VBOXSTRICTRC rcStrict;
967 uint64_t uNewRsp;
968 void *pvRet;
969
970 /*
971 * Real mode and V8086 mode are easy. The only snag seems to be that
972 * CS.limit doesn't change and the limit check is done against the current
973 * limit.
974 */
975 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
976 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
977 {
978 Assert(enmOpSize == IEMMODE_16BIT || enmOpSize == IEMMODE_32BIT);
979
980 /* Check stack first - may #SS(0). */
981 rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmOpSize == IEMMODE_32BIT ? 6 : 4,
982 &pvRet, &uNewRsp);
983 if (rcStrict != VINF_SUCCESS)
984 return rcStrict;
985
986 /* Check the target address range. */
987 if (offSeg > UINT32_MAX)
988 return iemRaiseGeneralProtectionFault0(pIemCpu);
989
990 /* Everything is fine, push the return address. */
991 if (enmOpSize == IEMMODE_16BIT)
992 {
993 ((uint16_t *)pvRet)[0] = pCtx->ip + cbInstr;
994 ((uint16_t *)pvRet)[1] = pCtx->cs;
995 }
996 else
997 {
998 ((uint32_t *)pvRet)[0] = pCtx->eip + cbInstr;
999 ((uint16_t *)pvRet)[3] = pCtx->cs;
1000 }
1001 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, pvRet, uNewRsp);
1002 if (rcStrict != VINF_SUCCESS)
1003 return rcStrict;
1004
1005 /* Branch. */
1006 pCtx->rip = offSeg;
1007 pCtx->cs = uSel;
1008 pCtx->csHid.u64Base = (uint32_t)uSel << 4;
1009 /** @todo Does REM reset the accessed bit here to? (See on jmp far16
1010 * after disabling PE.) Check with VT-x and AMD-V. */
1011#ifdef IEM_VERIFICATION_MODE
1012 pCtx->csHid.Attr.u &= ~X86_SEL_TYPE_ACCESSED;
1013#endif
1014 return VINF_SUCCESS;
1015 }
1016
1017 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1018}
1019
1020
1021/**
1022 * Implements retf.
1023 *
1024 * @param enmEffOpSize The effective operand size.
1025 * @param cbPop The amount of arguments to pop from the stack
1026 * (bytes).
1027 */
1028IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1029{
1030 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1031 VBOXSTRICTRC rcStrict;
1032 uint64_t uNewRsp;
1033 NOREF(cbInstr);
1034
1035 /*
1036 * Real mode and V8086 mode are easy.
1037 */
1038 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1039 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1040 {
1041 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1042 uint16_t const *pu16Frame;
1043 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 8 : 4,
1044 (void const **)&pu16Frame, &uNewRsp);
1045 if (rcStrict != VINF_SUCCESS)
1046 return rcStrict;
1047 uint32_t uNewEip;
1048 uint16_t uNewCS;
1049 if (enmEffOpSize == IEMMODE_32BIT)
1050 {
1051 uNewCS = pu16Frame[2];
1052 uNewEip = RT_MAKE_U32(pu16Frame[0], pu16Frame[1]);
1053 }
1054 else
1055 {
1056 uNewCS = pu16Frame[1];
1057 uNewEip = pu16Frame[0];
1058 }
1059 /** @todo check how this is supposed to work if sp=0xfffe. */
1060
1061 /* Check the limit of the new EIP. */
1062 /** @todo Intel pseudo code only does the limit check for 16-bit
1063 * operands, AMD does not make any distinction. What is right? */
1064 if (uNewEip > pCtx->csHid.u32Limit)
1065 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1066
1067 /* commit the operation. */
1068 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, pu16Frame, uNewRsp);
1069 if (rcStrict != VINF_SUCCESS)
1070 return rcStrict;
1071 pCtx->rip = uNewEip;
1072 pCtx->cs = uNewCS;
1073 pCtx->csHid.u64Base = (uint32_t)uNewCS << 4;
1074 /** @todo do we load attribs and limit as well? */
1075 if (cbPop)
1076 iemRegAddToRsp(pCtx, cbPop);
1077 return VINF_SUCCESS;
1078 }
1079
1080 AssertFailed();
1081 return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1082}
1083
1084
1085/**
1086 * Implements retn.
1087 *
1088 * We're doing this in C because of the \#GP that might be raised if the popped
1089 * program counter is out of bounds.
1090 *
1091 * @param enmEffOpSize The effective operand size.
1092 * @param cbPop The amount of arguments to pop from the stack
1093 * (bytes).
1094 */
1095IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1096{
1097 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1098 NOREF(cbInstr);
1099
1100 /* Fetch the RSP from the stack. */
1101 VBOXSTRICTRC rcStrict;
1102 RTUINT64U NewRip;
1103 RTUINT64U NewRsp;
1104 NewRsp.u = pCtx->rsp;
1105 switch (enmEffOpSize)
1106 {
1107 case IEMMODE_16BIT:
1108 NewRip.u = 0;
1109 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1110 break;
1111 case IEMMODE_32BIT:
1112 NewRip.u = 0;
1113 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1114 break;
1115 case IEMMODE_64BIT:
1116 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1117 break;
1118 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1119 }
1120 if (rcStrict != VINF_SUCCESS)
1121 return rcStrict;
1122
1123 /* Check the new RSP before loading it. */
1124 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
1125 * of it. The canonical test is performed here and for call. */
1126 if (enmEffOpSize != IEMMODE_64BIT)
1127 {
1128 if (NewRip.DWords.dw0 > pCtx->csHid.u32Limit)
1129 {
1130 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->csHid.u32Limit));
1131 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1132 }
1133 }
1134 else
1135 {
1136 if (!IEM_IS_CANONICAL(NewRip.u))
1137 {
1138 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1139 return iemRaiseNotCanonical(pIemCpu);
1140 }
1141 }
1142
1143 /* Commit it. */
1144 pCtx->rip = NewRip.u;
1145 pCtx->rsp = NewRsp.u;
1146 if (cbPop)
1147 iemRegAddToRsp(pCtx, cbPop);
1148
1149 return VINF_SUCCESS;
1150}
1151
1152
1153/**
1154 * Implements leave.
1155 *
1156 * We're doing this in C because messing with the stack registers is annoying
1157 * since they depends on SS attributes.
1158 *
1159 * @param enmEffOpSize The effective operand size.
1160 */
1161IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1162{
1163 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1164
1165 /* Calculate the intermediate RSP from RBP and the stack attributes. */
1166 RTUINT64U NewRsp;
1167 if (pCtx->ssHid.Attr.n.u1Long)
1168 {
1169 /** @todo Check that LEAVE actually preserve the high EBP bits. */
1170 NewRsp.u = pCtx->rsp;
1171 NewRsp.Words.w0 = pCtx->bp;
1172 }
1173 else if (pCtx->ssHid.Attr.n.u1DefBig)
1174 NewRsp.u = pCtx->ebp;
1175 else
1176 NewRsp.u = pCtx->rbp;
1177
1178 /* Pop RBP according to the operand size. */
1179 VBOXSTRICTRC rcStrict;
1180 RTUINT64U NewRbp;
1181 switch (enmEffOpSize)
1182 {
1183 case IEMMODE_16BIT:
1184 NewRbp.u = pCtx->rbp;
1185 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1186 break;
1187 case IEMMODE_32BIT:
1188 NewRbp.u = 0;
1189 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1190 break;
1191 case IEMMODE_64BIT:
1192 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1193 break;
1194 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1195 }
1196 if (rcStrict != VINF_SUCCESS)
1197 return rcStrict;
1198
1199
1200 /* Commit it. */
1201 pCtx->rbp = NewRbp.u;
1202 pCtx->rsp = NewRsp.u;
1203 iemRegAddToRip(pIemCpu, cbInstr);
1204
1205 return VINF_SUCCESS;
1206}
1207
1208
1209/**
1210 * Implements int3 and int XX.
1211 *
1212 * @param u8Int The interrupt vector number.
1213 * @param fIsBpInstr Is it the breakpoint instruction.
1214 */
1215IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1216{
1217 Assert(pIemCpu->cXcptRecursions == 0);
1218 return iemRaiseXcptOrInt(pIemCpu,
1219 cbInstr,
1220 u8Int,
1221 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
1222 0,
1223 0);
1224}
1225
1226
1227/**
1228 * Implements iret for real mode and V8086 mode.
1229 *
1230 * @param enmEffOpSize The effective operand size.
1231 */
1232IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
1233{
1234 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1235 NOREF(cbInstr);
1236
1237 /*
1238 * iret throws an exception if VME isn't enabled.
1239 */
1240 if ( pCtx->eflags.Bits.u1VM
1241 && !(pCtx->cr4 & X86_CR4_VME))
1242 return iemRaiseGeneralProtectionFault0(pIemCpu);
1243
1244 /*
1245 * Do the stack bits, but don't commit RSP before everything checks
1246 * out right.
1247 */
1248 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1249 VBOXSTRICTRC rcStrict;
1250 RTCPTRUNION uFrame;
1251 uint16_t uNewCS;
1252 uint32_t uNewEip;
1253 uint32_t uNewFlags;
1254 uint64_t uNewRsp;
1255 if (enmEffOpSize == IEMMODE_32BIT)
1256 {
1257 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1258 if (rcStrict != VINF_SUCCESS)
1259 return rcStrict;
1260 uNewEip = uFrame.pu32[0];
1261 uNewCS = (uint16_t)uFrame.pu32[1];
1262 uNewFlags = uFrame.pu32[2];
1263 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1264 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
1265 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
1266 | X86_EFL_ID;
1267 uNewFlags |= pCtx->eflags.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
1268 }
1269 else
1270 {
1271 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1272 if (rcStrict != VINF_SUCCESS)
1273 return rcStrict;
1274 uNewEip = uFrame.pu16[0];
1275 uNewCS = uFrame.pu16[1];
1276 uNewFlags = uFrame.pu16[2];
1277 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1278 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
1279 uNewFlags |= pCtx->eflags.u & (UINT32_C(0xffff0000) | X86_EFL_1);
1280 /** @todo The intel pseudo code does not indicate what happens to
1281 * reserved flags. We just ignore them. */
1282 }
1283 /** @todo Check how this is supposed to work if sp=0xfffe. */
1284
1285 /*
1286 * Check the limit of the new EIP.
1287 */
1288 /** @todo Only the AMD pseudo code check the limit here, what's
1289 * right? */
1290 if (uNewEip > pCtx->csHid.u32Limit)
1291 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1292
1293 /*
1294 * V8086 checks and flag adjustments
1295 */
1296 if (pCtx->eflags.Bits.u1VM)
1297 {
1298 if (pCtx->eflags.Bits.u2IOPL == 3)
1299 {
1300 /* Preserve IOPL and clear RF. */
1301 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
1302 uNewFlags |= pCtx->eflags.u & (X86_EFL_IOPL);
1303 }
1304 else if ( enmEffOpSize == IEMMODE_16BIT
1305 && ( !(uNewFlags & X86_EFL_IF)
1306 || !pCtx->eflags.Bits.u1VIP )
1307 && !(uNewFlags & X86_EFL_TF) )
1308 {
1309 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
1310 uNewFlags &= ~X86_EFL_VIF;
1311 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
1312 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
1313 uNewFlags |= pCtx->eflags.u & (X86_EFL_IF | X86_EFL_IOPL);
1314 }
1315 else
1316 return iemRaiseGeneralProtectionFault0(pIemCpu);
1317 }
1318
1319 /*
1320 * Commit the operation.
1321 */
1322 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
1323 if (rcStrict != VINF_SUCCESS)
1324 return rcStrict;
1325 pCtx->rip = uNewEip;
1326 pCtx->cs = uNewCS;
1327 pCtx->csHid.u64Base = (uint32_t)uNewCS << 4;
1328 /** @todo do we load attribs and limit as well? */
1329 Assert(uNewFlags & X86_EFL_1);
1330 pCtx->eflags.u = uNewFlags;
1331
1332 return VINF_SUCCESS;
1333}
1334
1335
1336/**
1337 * Implements iret for protected mode
1338 *
1339 * @param enmEffOpSize The effective operand size.
1340 */
1341IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
1342{
1343 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1344 NOREF(cbInstr);
1345
1346 /*
1347 * Nested task return.
1348 */
1349 if (pCtx->eflags.Bits.u1NT)
1350 {
1351 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1352 }
1353 /*
1354 * Normal return.
1355 */
1356 else
1357 {
1358 /*
1359 * Do the stack bits, but don't commit RSP before everything checks
1360 * out right.
1361 */
1362 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1363 VBOXSTRICTRC rcStrict;
1364 RTCPTRUNION uFrame;
1365 uint16_t uNewCS;
1366 uint32_t uNewEip;
1367 uint32_t uNewFlags;
1368 uint64_t uNewRsp;
1369 if (enmEffOpSize == IEMMODE_32BIT)
1370 {
1371 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1372 if (rcStrict != VINF_SUCCESS)
1373 return rcStrict;
1374 uNewEip = uFrame.pu32[0];
1375 uNewCS = (uint16_t)uFrame.pu32[1];
1376 uNewFlags = uFrame.pu32[2];
1377 }
1378 else
1379 {
1380 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1381 if (rcStrict != VINF_SUCCESS)
1382 return rcStrict;
1383 uNewEip = uFrame.pu16[0];
1384 uNewCS = uFrame.pu16[1];
1385 uNewFlags = uFrame.pu16[2];
1386 }
1387 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
1388 if (rcStrict != VINF_SUCCESS)
1389 return rcStrict;
1390
1391 /*
1392 * What are we returning to?
1393 */
1394 if ( (uNewFlags & X86_EFL_VM)
1395 && pIemCpu->uCpl == 0)
1396 {
1397 /* V8086 mode! */
1398 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
1399 }
1400 else
1401 {
1402 /*
1403 * Protected mode.
1404 */
1405 /* Read the CS descriptor. */
1406 if (!(uNewCS & (X86_SEL_MASK | X86_SEL_LDT)))
1407 {
1408 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCS, uNewEip));
1409 return iemRaiseGeneralProtectionFault0(pIemCpu);
1410 }
1411
1412 IEMSELDESC DescCS;
1413 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS);
1414 if (rcStrict != VINF_SUCCESS)
1415 {
1416 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCS, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
1417 return rcStrict;
1418 }
1419
1420 /* Must be a code descriptor. */
1421 if (!DescCS.Legacy.Gen.u1DescType)
1422 {
1423 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u4Type));
1424 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1425 }
1426 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1427 {
1428 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u4Type));
1429 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1430 }
1431
1432 /* Privilege checks. */
1433 if ((uNewCS & X86_SEL_RPL) < pIemCpu->uCpl)
1434 {
1435 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCS, uNewEip, pIemCpu->uCpl));
1436 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1437 }
1438 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1439 && (uNewCS & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
1440 {
1441 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCS, uNewEip, DescCS.Legacy.Gen.u2Dpl));
1442 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
1443 }
1444
1445 /* Present? */
1446 if (!DescCS.Legacy.Gen.u1Present)
1447 {
1448 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCS, uNewEip));
1449 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCS);
1450 }
1451
1452 uint32_t cbLimitCS = X86DESC_LIMIT(DescCS.Legacy);
1453 if (DescCS.Legacy.Gen.u1Granularity)
1454 cbLimitCS = (cbLimitCS << PAGE_SHIFT) | PAGE_OFFSET_MASK;
1455
1456 /*
1457 * Return to outer level?
1458 */
1459 if ((uNewCS & X86_SEL_RPL) != pIemCpu->uCpl)
1460 {
1461 uint16_t uNewSS;
1462 uint32_t uNewESP;
1463 if (enmEffOpSize == IEMMODE_32BIT)
1464 {
1465 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
1466 if (rcStrict != VINF_SUCCESS)
1467 return rcStrict;
1468 uNewESP = uFrame.pu32[0];
1469 uNewSS = (uint16_t)uFrame.pu32[1];
1470 }
1471 else
1472 {
1473 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
1474 if (rcStrict != VINF_SUCCESS)
1475 return rcStrict;
1476 uNewESP = uFrame.pu16[0];
1477 uNewSS = uFrame.pu16[1];
1478 }
1479 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
1480 if (rcStrict != VINF_SUCCESS)
1481 return rcStrict;
1482
1483 /* Read the SS descriptor. */
1484 if (!(uNewSS & (X86_SEL_MASK | X86_SEL_LDT)))
1485 {
1486 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCS, uNewEip, uNewSS, uNewESP));
1487 return iemRaiseGeneralProtectionFault0(pIemCpu);
1488 }
1489
1490 IEMSELDESC DescSS;
1491 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS);
1492 if (rcStrict != VINF_SUCCESS)
1493 {
1494 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
1495 uNewCS, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
1496 return rcStrict;
1497 }
1498
1499 /* Privilege checks. */
1500 if ((uNewSS & X86_SEL_RPL) != (uNewCS & X86_SEL_RPL))
1501 {
1502 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCS, uNewEip, uNewSS, uNewESP));
1503 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1504 }
1505 if (DescSS.Legacy.Gen.u2Dpl != (uNewCS & X86_SEL_RPL))
1506 {
1507 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
1508 uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
1509 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1510 }
1511
1512 /* Must be a writeable data segment descriptor. */
1513 if (!DescSS.Legacy.Gen.u1DescType)
1514 {
1515 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
1516 uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
1517 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1518 }
1519 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1520 {
1521 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
1522 uNewCS, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
1523 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
1524 }
1525
1526 /* Present? */
1527 if (!DescSS.Legacy.Gen.u1Present)
1528 {
1529 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCS, uNewEip, uNewSS, uNewESP));
1530 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
1531 }
1532
1533 uint32_t cbLimitSS = X86DESC_LIMIT(DescSS.Legacy);
1534 if (DescSS.Legacy.Gen.u1Granularity)
1535 cbLimitSS = (cbLimitSS << PAGE_SHIFT) | PAGE_OFFSET_MASK;
1536
1537 /* Check EIP. */
1538 if (uNewEip > cbLimitCS)
1539 {
1540 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
1541 uNewCS, uNewEip, uNewSS, uNewESP, cbLimitCS));
1542 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCS);
1543 }
1544
1545 /*
1546 * Commit the changes, marking CS and SS accessed first since
1547 * that may fail.
1548 */
1549 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1550 {
1551 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1552 if (rcStrict != VINF_SUCCESS)
1553 return rcStrict;
1554 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1555 }
1556 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1557 {
1558 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
1559 if (rcStrict != VINF_SUCCESS)
1560 return rcStrict;
1561 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1562 }
1563
1564 pCtx->rip = uNewEip;
1565 pCtx->cs = uNewCS;
1566 pCtx->csHid.Attr.u = X86DESC_GET_HID_ATTR(DescCS.Legacy);
1567 pCtx->csHid.u32Limit = cbLimitCS;
1568 pCtx->csHid.u64Base = X86DESC_BASE(DescCS.Legacy);
1569 pCtx->rsp = uNewESP;
1570 pCtx->ss = uNewSS;
1571 pCtx->ssHid.Attr.u = X86DESC_GET_HID_ATTR(DescSS.Legacy);
1572 pCtx->ssHid.u32Limit = cbLimitSS;
1573 pCtx->ssHid.u64Base = X86DESC_BASE(DescSS.Legacy);
1574
1575 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1576 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
1577 if (enmEffOpSize != IEMMODE_16BIT)
1578 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
1579 if (pIemCpu->uCpl == 0)
1580 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
1581 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
1582 fEFlagsMask |= X86_EFL_IF;
1583 pCtx->eflags.u &= ~fEFlagsMask;
1584 pCtx->eflags.u |= fEFlagsMask & uNewFlags;
1585
1586 pIemCpu->uCpl = uNewCS & X86_SEL_RPL;
1587 iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->ds, &pCtx->dsHid);
1588 iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->es, &pCtx->esHid);
1589 iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->fs, &pCtx->fsHid);
1590 iemHlpAdjustSelectorForNewCpl(uNewCS & X86_SEL_RPL, &pCtx->gs, &pCtx->gsHid);
1591
1592 /* Done! */
1593
1594 }
1595 /*
1596 * Return to the same level.
1597 */
1598 else
1599 {
1600 /* Check EIP. */
1601 if (uNewEip > cbLimitCS)
1602 {
1603 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewEip, cbLimitCS));
1604 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCS);
1605 }
1606
1607 /*
1608 * Commit the changes, marking CS first since it may fail.
1609 */
1610 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1611 {
1612 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
1613 if (rcStrict != VINF_SUCCESS)
1614 return rcStrict;
1615 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1616 }
1617
1618 pCtx->rip = uNewEip;
1619 pCtx->cs = uNewCS;
1620 pCtx->csHid.Attr.u = X86DESC_GET_HID_ATTR(DescCS.Legacy);
1621 pCtx->csHid.u32Limit = cbLimitCS;
1622 pCtx->csHid.u64Base = X86DESC_BASE(DescCS.Legacy);
1623 pCtx->rsp = uNewRsp;
1624
1625 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1626 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
1627 if (enmEffOpSize != IEMMODE_16BIT)
1628 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
1629 if (pIemCpu->uCpl == 0)
1630 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
1631 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
1632 fEFlagsMask |= X86_EFL_IF;
1633 pCtx->eflags.u &= ~fEFlagsMask;
1634 pCtx->eflags.u |= fEFlagsMask & uNewFlags;
1635 /* Done! */
1636 }
1637 }
1638 }
1639
1640 return VINF_SUCCESS;
1641}
1642
1643
1644/**
1645 * Implements iret for long mode
1646 *
1647 * @param enmEffOpSize The effective operand size.
1648 */
1649IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
1650{
1651 //PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1652 //VBOXSTRICTRC rcStrict;
1653 //uint64_t uNewRsp;
1654
1655 NOREF(pIemCpu); NOREF(cbInstr); NOREF(enmEffOpSize);
1656 return VERR_IEM_ASPECT_NOT_IMPLEMENTED;
1657}
1658
1659
1660/**
1661 * Implements iret.
1662 *
1663 * @param enmEffOpSize The effective operand size.
1664 */
1665IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
1666{
1667 /*
1668 * Call a mode specific worker.
1669 */
1670 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1671 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1672 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
1673 if (IEM_IS_LONG_MODE(pIemCpu))
1674 return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
1675
1676 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
1677}
1678
1679
1680/**
1681 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
1682 *
1683 * @param iSegReg The segment register number (valid).
1684 * @param uSel The new selector value.
1685 */
1686IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
1687{
1688 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
1689 uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
1690 PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
1691
1692 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
1693
1694 /*
1695 * Real mode and V8086 mode are easy.
1696 */
1697 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1698 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1699 {
1700 *pSel = uSel;
1701 pHid->u64Base = (uint32_t)uSel << 4;
1702 /** @todo Does the CPU actually load limits and attributes in the
1703 * real/V8086 mode segment load case? It doesn't for CS in far
1704 * jumps... Affects unreal mode. */
1705 pHid->u32Limit = 0xffff;
1706 pHid->Attr.u = 0;
1707 pHid->Attr.n.u1Present = 1;
1708 pHid->Attr.n.u1DescType = 1;
1709 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
1710 ? X86_SEL_TYPE_RW
1711 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
1712
1713 iemRegAddToRip(pIemCpu, cbInstr);
1714 return VINF_SUCCESS;
1715 }
1716
1717 /*
1718 * Protected mode.
1719 *
1720 * Check if it's a null segment selector value first, that's OK for DS, ES,
1721 * FS and GS. If not null, then we have to load and parse the descriptor.
1722 */
1723 if (!(uSel & (X86_SEL_MASK | X86_SEL_LDT)))
1724 {
1725 if (iSegReg == X86_SREG_SS)
1726 {
1727 if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
1728 || pIemCpu->uCpl != 0
1729 || uSel != 0) /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? */
1730 {
1731 Log(("load sreg -> invalid stack selector, #GP(0)\n", uSel));
1732 return iemRaiseGeneralProtectionFault0(pIemCpu);
1733 }
1734
1735 /* In 64-bit kernel mode, the stack can be 0 because of the way
1736 interrupts are dispatched when in kernel ctx. Just load the
1737 selector value into the register and leave the hidden bits
1738 as is. */
1739 *pSel = uSel;
1740 iemRegAddToRip(pIemCpu, cbInstr);
1741 return VINF_SUCCESS;
1742 }
1743
1744 *pSel = uSel; /* Not RPL, remember :-) */
1745 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
1746 && iSegReg != X86_SREG_FS
1747 && iSegReg != X86_SREG_GS)
1748 {
1749 /** @todo figure out what this actually does, it works. Needs
1750 * testcase! */
1751 pHid->Attr.u = 0;
1752 pHid->Attr.n.u1Present = 1;
1753 pHid->Attr.n.u1Long = 1;
1754 pHid->Attr.n.u4Type = X86_SEL_TYPE_RW;
1755 pHid->Attr.n.u2Dpl = 3;
1756 pHid->u32Limit = 0;
1757 pHid->u64Base = 0;
1758 }
1759 else
1760 {
1761 pHid->Attr.u = 0;
1762 pHid->u32Limit = 0;
1763 pHid->u64Base = 0;
1764 }
1765 iemRegAddToRip(pIemCpu, cbInstr);
1766 return VINF_SUCCESS;
1767 }
1768
1769 /* Fetch the descriptor. */
1770 IEMSELDESC Desc;
1771 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
1772 if (rcStrict != VINF_SUCCESS)
1773 return rcStrict;
1774
1775 /* Check GPs first. */
1776 if (!Desc.Legacy.Gen.u1DescType)
1777 {
1778 Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
1779 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1780 }
1781 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
1782 {
1783 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1784 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1785 {
1786 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
1787 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1788 }
1789 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1790 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1791 {
1792 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
1793 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1794 }
1795 if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
1796 {
1797 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
1798 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1799 }
1800 if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
1801 {
1802 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1803 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1804 }
1805 }
1806 else
1807 {
1808 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
1809 {
1810 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
1811 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1812 }
1813 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
1814 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
1815 {
1816#if 0 /* this is what intel says. */
1817 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
1818 && pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
1819 {
1820 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
1821 iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
1822 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1823 }
1824#else /* this is what makes more sense. */
1825 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
1826 {
1827 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
1828 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
1829 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1830 }
1831 if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
1832 {
1833 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
1834 iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
1835 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1836 }
1837#endif
1838 }
1839 }
1840
1841 /* Is it there? */
1842 if (!Desc.Legacy.Gen.u1Present)
1843 {
1844 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
1845 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1846 }
1847
1848 /* The the base and limit. */
1849 uint64_t u64Base;
1850 uint32_t cbLimit = X86DESC_LIMIT(Desc.Legacy);
1851 if (Desc.Legacy.Gen.u1Granularity)
1852 cbLimit = (cbLimit << PAGE_SHIFT) | PAGE_OFFSET_MASK;
1853
1854 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
1855 && iSegReg < X86_SREG_FS)
1856 u64Base = 0;
1857 else
1858 u64Base = X86DESC_BASE(Desc.Legacy);
1859
1860 /*
1861 * Ok, everything checked out fine. Now set the accessed bit before
1862 * committing the result into the registers.
1863 */
1864 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1865 {
1866 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1867 if (rcStrict != VINF_SUCCESS)
1868 return rcStrict;
1869 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1870 }
1871
1872 /* commit */
1873 *pSel = uSel;
1874 pHid->Attr.u = (Desc.Legacy.u >> (16+16+8)) & UINT32_C(0xf0ff); /** @todo do we have a define for 0xf0ff? */
1875 pHid->u32Limit = cbLimit;
1876 pHid->u64Base = u64Base;
1877
1878 /** @todo check if the hidden bits are loaded correctly for 64-bit
1879 * mode. */
1880
1881 iemRegAddToRip(pIemCpu, cbInstr);
1882 return VINF_SUCCESS;
1883}
1884
1885
1886/**
1887 * Implements 'mov SReg, r/m'.
1888 *
1889 * @param iSegReg The segment register number (valid).
1890 * @param uSel The new selector value.
1891 */
1892IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
1893{
1894 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1895 if (rcStrict == VINF_SUCCESS)
1896 {
1897 if (iSegReg == X86_SREG_SS)
1898 {
1899 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1900 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
1901 }
1902 }
1903 return rcStrict;
1904}
1905
1906
1907/**
1908 * Implements 'pop SReg'.
1909 *
1910 * @param iSegReg The segment register number (valid).
1911 * @param enmEffOpSize The efficient operand size (valid).
1912 */
1913IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
1914{
1915 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1916 VBOXSTRICTRC rcStrict;
1917
1918 /*
1919 * Read the selector off the stack and join paths with mov ss, reg.
1920 */
1921 RTUINT64U TmpRsp;
1922 TmpRsp.u = pCtx->rsp;
1923 switch (enmEffOpSize)
1924 {
1925 case IEMMODE_16BIT:
1926 {
1927 uint16_t uSel;
1928 rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
1929 if (rcStrict == VINF_SUCCESS)
1930 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1931 break;
1932 }
1933
1934 case IEMMODE_32BIT:
1935 {
1936 uint32_t u32Value;
1937 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
1938 if (rcStrict == VINF_SUCCESS)
1939 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
1940 break;
1941 }
1942
1943 case IEMMODE_64BIT:
1944 {
1945 uint64_t u64Value;
1946 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
1947 if (rcStrict == VINF_SUCCESS)
1948 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
1949 break;
1950 }
1951 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1952 }
1953
1954 /*
1955 * Commit the stack on success.
1956 */
1957 if (rcStrict == VINF_SUCCESS)
1958 {
1959 pCtx->rsp = TmpRsp.u;
1960 if (iSegReg == X86_SREG_SS)
1961 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
1962 }
1963 return rcStrict;
1964}
1965
1966
1967/**
1968 * Implements lgs, lfs, les, lds & lss.
1969 */
1970IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
1971 uint16_t, uSel,
1972 uint64_t, offSeg,
1973 uint8_t, iSegReg,
1974 uint8_t, iGReg,
1975 IEMMODE, enmEffOpSize)
1976{
1977 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
1978 VBOXSTRICTRC rcStrict;
1979
1980 /*
1981 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
1982 */
1983 /** @todo verify and test that mov, pop and lXs works the segment
1984 * register loading in the exact same way. */
1985 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
1986 if (rcStrict == VINF_SUCCESS)
1987 {
1988 switch (enmEffOpSize)
1989 {
1990 case IEMMODE_16BIT:
1991 *(uint16_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
1992 break;
1993 case IEMMODE_32BIT:
1994 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
1995 break;
1996 case IEMMODE_64BIT:
1997 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
1998 break;
1999 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2000 }
2001 }
2002
2003 return rcStrict;
2004}
2005
2006
2007/**
2008 * Implements lgdt.
2009 *
2010 * @param iEffSeg The segment of the new ldtr contents
2011 * @param GCPtrEffSrc The address of the new ldtr contents.
2012 * @param enmEffOpSize The effective operand size.
2013 */
2014IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2015{
2016 if (pIemCpu->uCpl != 0)
2017 return iemRaiseGeneralProtectionFault0(pIemCpu);
2018 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2019
2020 /*
2021 * Fetch the limit and base address.
2022 */
2023 uint16_t cbLimit;
2024 RTGCPTR GCPtrBase;
2025 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2026 if (rcStrict == VINF_SUCCESS)
2027 {
2028 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2029 rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2030 else
2031 {
2032 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2033 pCtx->gdtr.cbGdt = cbLimit;
2034 pCtx->gdtr.pGdt = GCPtrBase;
2035 }
2036 if (rcStrict == VINF_SUCCESS)
2037 iemRegAddToRip(pIemCpu, cbInstr);
2038 }
2039 return rcStrict;
2040}
2041
2042
2043/**
2044 * Implements lidt.
2045 *
2046 * @param iEffSeg The segment of the new ldtr contents
2047 * @param GCPtrEffSrc The address of the new ldtr contents.
2048 * @param enmEffOpSize The effective operand size.
2049 */
2050IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2051{
2052 if (pIemCpu->uCpl != 0)
2053 return iemRaiseGeneralProtectionFault0(pIemCpu);
2054 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2055
2056 /*
2057 * Fetch the limit and base address.
2058 */
2059 uint16_t cbLimit;
2060 RTGCPTR GCPtrBase;
2061 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2062 if (rcStrict == VINF_SUCCESS)
2063 {
2064 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2065 rcStrict = CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2066 else
2067 {
2068 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2069 pCtx->idtr.cbIdt = cbLimit;
2070 pCtx->idtr.pIdt = GCPtrBase;
2071 }
2072 if (rcStrict == VINF_SUCCESS)
2073 iemRegAddToRip(pIemCpu, cbInstr);
2074 }
2075 return rcStrict;
2076}
2077
2078
2079/**
2080 * Implements lldt.
2081 *
2082 * @param uNewLdt The new LDT selector value.
2083 */
2084IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
2085{
2086 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2087
2088 /*
2089 * Check preconditions.
2090 */
2091 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2092 {
2093 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
2094 return iemRaiseUndefinedOpcode(pIemCpu);
2095 }
2096 if (pIemCpu->uCpl != 0)
2097 {
2098 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
2099 return iemRaiseGeneralProtectionFault0(pIemCpu);
2100 }
2101 if (uNewLdt & X86_SEL_LDT)
2102 {
2103 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
2104 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
2105 }
2106
2107 /*
2108 * Now, loading a NULL selector is easy.
2109 */
2110 if ((uNewLdt & X86_SEL_MASK) == 0)
2111 {
2112 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
2113 /** @todo check if the actual value is loaded or if it's always 0. */
2114 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2115 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), 0);
2116 else
2117 pCtx->ldtr = 0;
2118 pCtx->ldtrHid.Attr.u = 0;
2119 pCtx->ldtrHid.u64Base = 0;
2120 pCtx->ldtrHid.u32Limit = 0;
2121
2122 iemRegAddToRip(pIemCpu, cbInstr);
2123 return VINF_SUCCESS;
2124 }
2125
2126 /*
2127 * Read the descriptor.
2128 */
2129 IEMSELDESC Desc;
2130 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt);
2131 if (rcStrict != VINF_SUCCESS)
2132 return rcStrict;
2133
2134 /* Check GPs first. */
2135 if (Desc.Legacy.Gen.u1DescType)
2136 {
2137 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2138 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2139 }
2140 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
2141 {
2142 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2143 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2144 }
2145 uint64_t u64Base;
2146 if (!IEM_IS_LONG_MODE(pIemCpu))
2147 u64Base = X86DESC_BASE(Desc.Legacy);
2148 else
2149 {
2150 if (Desc.Long.Gen.u5Zeros)
2151 {
2152 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
2153 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2154 }
2155
2156 u64Base = X86DESC64_BASE(Desc.Long);
2157 if (!IEM_IS_CANONICAL(u64Base))
2158 {
2159 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
2160 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK);
2161 }
2162 }
2163
2164 /* NP */
2165 if (!Desc.Legacy.Gen.u1Present)
2166 {
2167 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
2168 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
2169 }
2170
2171 /*
2172 * It checks out alright, update the registers.
2173 */
2174/** @todo check if the actual value is loaded or if the RPL is dropped */
2175 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2176 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK);
2177 else
2178 pCtx->ldtr = uNewLdt & X86_SEL_MASK;
2179 pCtx->ldtrHid.Attr.u = X86DESC_GET_HID_ATTR(Desc.Legacy);
2180 pCtx->ldtrHid.u32Limit = X86DESC_LIMIT(Desc.Legacy);
2181 pCtx->ldtrHid.u64Base = u64Base;
2182
2183 iemRegAddToRip(pIemCpu, cbInstr);
2184 return VINF_SUCCESS;
2185}
2186
2187
2188/**
2189 * Implements lldt.
2190 *
2191 * @param uNewLdt The new LDT selector value.
2192 */
2193IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
2194{
2195 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2196
2197 /*
2198 * Check preconditions.
2199 */
2200 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2201 {
2202 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
2203 return iemRaiseUndefinedOpcode(pIemCpu);
2204 }
2205 if (pIemCpu->uCpl != 0)
2206 {
2207 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
2208 return iemRaiseGeneralProtectionFault0(pIemCpu);
2209 }
2210 if (uNewTr & X86_SEL_LDT)
2211 {
2212 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
2213 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
2214 }
2215 if ((uNewTr & X86_SEL_MASK) == 0)
2216 {
2217 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
2218 return iemRaiseGeneralProtectionFault0(pIemCpu);
2219 }
2220
2221 /*
2222 * Read the descriptor.
2223 */
2224 IEMSELDESC Desc;
2225 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr);
2226 if (rcStrict != VINF_SUCCESS)
2227 return rcStrict;
2228
2229 /* Check GPs first. */
2230 if (Desc.Legacy.Gen.u1DescType)
2231 {
2232 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
2233 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2234 }
2235 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
2236 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
2237 || IEM_IS_LONG_MODE(pIemCpu)) )
2238 {
2239 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
2240 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2241 }
2242 uint64_t u64Base;
2243 if (!IEM_IS_LONG_MODE(pIemCpu))
2244 u64Base = X86DESC_BASE(Desc.Legacy);
2245 else
2246 {
2247 if (Desc.Long.Gen.u5Zeros)
2248 {
2249 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
2250 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2251 }
2252
2253 u64Base = X86DESC64_BASE(Desc.Long);
2254 if (!IEM_IS_CANONICAL(u64Base))
2255 {
2256 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
2257 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK);
2258 }
2259 }
2260
2261 /* NP */
2262 if (!Desc.Legacy.Gen.u1Present)
2263 {
2264 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
2265 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
2266 }
2267
2268 /*
2269 * Set it busy.
2270 * Note! Intel says this should lock down the whole descriptor, but we'll
2271 * restrict our selves to 32-bit for now due to lack of inline
2272 * assembly and such.
2273 */
2274 void *pvDesc;
2275 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
2276 if (rcStrict != VINF_SUCCESS)
2277 return rcStrict;
2278 switch ((uintptr_t)pvDesc & 3)
2279 {
2280 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
2281 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
2282 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 16); break;
2283 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 8); break;
2284 }
2285 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
2286 if (rcStrict != VINF_SUCCESS)
2287 return rcStrict;
2288 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
2289
2290 /*
2291 * It checks out alright, update the registers.
2292 */
2293/** @todo check if the actual value is loaded or if the RPL is dropped */
2294 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2295 CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK);
2296 else
2297 pCtx->tr = uNewTr & X86_SEL_MASK;
2298 pCtx->trHid.Attr.u = X86DESC_GET_HID_ATTR(Desc.Legacy);
2299 pCtx->trHid.u32Limit = X86DESC_LIMIT(Desc.Legacy);
2300 pCtx->trHid.u64Base = u64Base;
2301
2302 iemRegAddToRip(pIemCpu, cbInstr);
2303 return VINF_SUCCESS;
2304}
2305
2306
2307/**
2308 * Implements mov GReg,CRx.
2309 *
2310 * @param iGReg The general register to store the CRx value in.
2311 * @param iCrReg The CRx register to read (valid).
2312 */
2313IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
2314{
2315 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2316 if (pIemCpu->uCpl != 0)
2317 return iemRaiseGeneralProtectionFault0(pIemCpu);
2318 Assert(!pCtx->eflags.Bits.u1VM);
2319
2320 /* read it */
2321 uint64_t crX;
2322 switch (iCrReg)
2323 {
2324 case 0: crX = pCtx->cr0; break;
2325 case 2: crX = pCtx->cr2; break;
2326 case 3: crX = pCtx->cr3; break;
2327 case 4: crX = pCtx->cr4; break;
2328 case 8:
2329 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2330 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED); /** @todo implement CR8 reading and writing. */
2331 else
2332 crX = 0xff;
2333 break;
2334 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2335 }
2336
2337 /* store it */
2338 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2339 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = crX;
2340 else
2341 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
2342
2343 iemRegAddToRip(pIemCpu, cbInstr);
2344 return VINF_SUCCESS;
2345}
2346
2347
2348/**
2349 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
2350 *
2351 * @param iCrReg The CRx register to write (valid).
2352 * @param uNewCrX The new value.
2353 */
2354IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
2355{
2356 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2357 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
2358 VBOXSTRICTRC rcStrict;
2359 int rc;
2360
2361 /*
2362 * Try store it.
2363 * Unfortunately, CPUM only does a tiny bit of the work.
2364 */
2365 switch (iCrReg)
2366 {
2367 case 0:
2368 {
2369 /*
2370 * Perform checks.
2371 */
2372 uint64_t const uOldCrX = pCtx->cr0;
2373 uNewCrX |= X86_CR0_ET; /* hardcoded */
2374
2375 /* Check for reserved bits. */
2376 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
2377 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
2378 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
2379 if (uNewCrX & ~(uint64_t)fValid)
2380 {
2381 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
2382 return iemRaiseGeneralProtectionFault0(pIemCpu);
2383 }
2384
2385 /* Check for invalid combinations. */
2386 if ( (uNewCrX & X86_CR0_PG)
2387 && !(uNewCrX & X86_CR0_PE) )
2388 {
2389 Log(("Trying to set CR0.PG without CR0.PE\n"));
2390 return iemRaiseGeneralProtectionFault0(pIemCpu);
2391 }
2392
2393 if ( !(uNewCrX & X86_CR0_CD)
2394 && (uNewCrX & X86_CR0_NW) )
2395 {
2396 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
2397 return iemRaiseGeneralProtectionFault0(pIemCpu);
2398 }
2399
2400 /* Long mode consistency checks. */
2401 if ( (uNewCrX & X86_CR0_PG)
2402 && !(uOldCrX & X86_CR0_PG)
2403 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
2404 {
2405 if (!(pCtx->cr4 & X86_CR4_PAE))
2406 {
2407 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
2408 return iemRaiseGeneralProtectionFault0(pIemCpu);
2409 }
2410 if (pCtx->csHid.Attr.n.u1Long)
2411 {
2412 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
2413 return iemRaiseGeneralProtectionFault0(pIemCpu);
2414 }
2415 }
2416
2417 /** @todo check reserved PDPTR bits as AMD states. */
2418
2419 /*
2420 * Change CR0.
2421 */
2422 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2423 {
2424 rc = CPUMSetGuestCR0(pVCpu, uNewCrX);
2425 AssertRCSuccessReturn(rc, RT_FAILURE_NP(rc) ? rc : VERR_INTERNAL_ERROR_3);
2426 }
2427 else
2428 pCtx->cr0 = uNewCrX;
2429 Assert(pCtx->cr0 == uNewCrX);
2430
2431 /*
2432 * Change EFER.LMA if entering or leaving long mode.
2433 */
2434 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
2435 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
2436 {
2437 uint64_t NewEFER = pCtx->msrEFER;
2438 if (uNewCrX & X86_CR0_PG)
2439 NewEFER |= MSR_K6_EFER_LME;
2440 else
2441 NewEFER &= ~MSR_K6_EFER_LME;
2442
2443 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2444 CPUMSetGuestEFER(pVCpu, NewEFER);
2445 else
2446 pCtx->msrEFER = NewEFER;
2447 Assert(pCtx->msrEFER == NewEFER);
2448 }
2449
2450 /*
2451 * Inform PGM.
2452 */
2453 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2454 {
2455 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
2456 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
2457 {
2458 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
2459 AssertRCReturn(rc, rc);
2460 /* ignore informational status codes */
2461 }
2462 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
2463 /** @todo Status code management. */
2464 }
2465 else
2466 rcStrict = VINF_SUCCESS;
2467 break;
2468 }
2469
2470 /*
2471 * CR2 can be changed without any restrictions.
2472 */
2473 case 2:
2474 pCtx->cr2 = uNewCrX;
2475 rcStrict = VINF_SUCCESS;
2476 break;
2477
2478 /*
2479 * CR3 is relatively simple, although AMD and Intel have different
2480 * accounts of how setting reserved bits are handled. We take intel's
2481 * word for the lower bits and AMD's for the high bits (63:52).
2482 */
2483 /** @todo Testcase: Setting reserved bits in CR3, especially before
2484 * enabling paging. */
2485 case 3:
2486 {
2487 /* check / mask the value. */
2488 if (uNewCrX & UINT64_C(0xfff0000000000000))
2489 {
2490 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
2491 return iemRaiseGeneralProtectionFault0(pIemCpu);
2492 }
2493
2494 uint64_t fValid;
2495 if ( (pCtx->cr4 & X86_CR4_PAE)
2496 && (pCtx->msrEFER & MSR_K6_EFER_LME))
2497 fValid = UINT64_C(0x000ffffffffff014);
2498 else if (pCtx->cr4 & X86_CR4_PAE)
2499 fValid = UINT64_C(0xfffffff4);
2500 else
2501 fValid = UINT64_C(0xfffff014);
2502 if (uNewCrX & ~fValid)
2503 {
2504 Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
2505 uNewCrX, uNewCrX & ~fValid));
2506 uNewCrX &= fValid;
2507 }
2508
2509 /** @todo If we're in PAE mode we should check the PDPTRs for
2510 * invalid bits. */
2511
2512 /* Make the change. */
2513 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2514 {
2515 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
2516 AssertRCSuccessReturn(rc, rc);
2517 }
2518 else
2519 pCtx->cr3 = uNewCrX;
2520
2521 /* Inform PGM. */
2522 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2523 {
2524 if (pCtx->cr0 & X86_CR0_PG)
2525 {
2526 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr3 & X86_CR4_PGE));
2527 AssertRCReturn(rc, rc);
2528 /* ignore informational status codes */
2529 /** @todo status code management */
2530 }
2531 }
2532 rcStrict = VINF_SUCCESS;
2533 break;
2534 }
2535
2536 /*
2537 * CR4 is a bit more tedious as there are bits which cannot be cleared
2538 * under some circumstances and such.
2539 */
2540 case 4:
2541 {
2542 uint64_t const uOldCrX = pCtx->cr0;
2543
2544 /* reserved bits */
2545 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
2546 | X86_CR4_TSD | X86_CR4_DE
2547 | X86_CR4_PSE | X86_CR4_PAE
2548 | X86_CR4_MCE | X86_CR4_PGE
2549 | X86_CR4_PCE | X86_CR4_OSFSXR
2550 | X86_CR4_OSXMMEEXCPT;
2551 //if (xxx)
2552 // fValid |= X86_CR4_VMXE;
2553 //if (xxx)
2554 // fValid |= X86_CR4_OSXSAVE;
2555 if (uNewCrX & ~(uint64_t)fValid)
2556 {
2557 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
2558 return iemRaiseGeneralProtectionFault0(pIemCpu);
2559 }
2560
2561 /* long mode checks. */
2562 if ( (uOldCrX & X86_CR4_PAE)
2563 && !(uNewCrX & X86_CR4_PAE)
2564 && (pCtx->msrEFER & MSR_K6_EFER_LMA) )
2565 {
2566 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
2567 return iemRaiseGeneralProtectionFault0(pIemCpu);
2568 }
2569
2570
2571 /*
2572 * Change it.
2573 */
2574 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2575 {
2576 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
2577 AssertRCSuccessReturn(rc, rc);
2578 }
2579 else
2580 pCtx->cr4 = uNewCrX;
2581 Assert(pCtx->cr4 == uNewCrX);
2582
2583 /*
2584 * Notify SELM and PGM.
2585 */
2586 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2587 {
2588 /* SELM - VME may change things wrt to the TSS shadowing. */
2589 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
2590 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
2591
2592 /* PGM - flushing and mode. */
2593 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
2594 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
2595 {
2596 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
2597 AssertRCReturn(rc, rc);
2598 /* ignore informational status codes */
2599 }
2600 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
2601 /** @todo Status code management. */
2602 }
2603 else
2604 rcStrict = VINF_SUCCESS;
2605 break;
2606 }
2607
2608 /*
2609 * CR8 maps to the APIC TPR.
2610 */
2611 case 8:
2612 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2613 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED); /** @todo implement CR8 reading and writing. */
2614 else
2615 rcStrict = VINF_SUCCESS;
2616 break;
2617
2618 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2619 }
2620
2621 /*
2622 * Advance the RIP on success.
2623 */
2624 /** @todo Status code management. */
2625 if (rcStrict == VINF_SUCCESS)
2626 iemRegAddToRip(pIemCpu, cbInstr);
2627 return rcStrict;
2628
2629}
2630
2631
2632/**
2633 * Implements mov CRx,GReg.
2634 *
2635 * @param iCrReg The CRx register to write (valid).
2636 * @param iGReg The general register to load the DRx value from.
2637 */
2638IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
2639{
2640 if (pIemCpu->uCpl != 0)
2641 return iemRaiseGeneralProtectionFault0(pIemCpu);
2642 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2643
2644 /*
2645 * Read the new value from the source register and call common worker.
2646 */
2647 uint64_t uNewCrX;
2648 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2649 uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
2650 else
2651 uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
2652 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
2653}
2654
2655
2656/**
2657 * Implements 'LMSW r/m16'
2658 *
2659 * @param u16NewMsw The new value.
2660 */
2661IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
2662{
2663 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2664
2665 if (pIemCpu->uCpl != 0)
2666 return iemRaiseGeneralProtectionFault0(pIemCpu);
2667 Assert(!pCtx->eflags.Bits.u1VM);
2668
2669 /*
2670 * Compose the new CR0 value and call common worker.
2671 */
2672 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
2673 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
2674 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
2675}
2676
2677
2678/**
2679 * Implements 'CLTS'.
2680 */
2681IEM_CIMPL_DEF_0(iemCImpl_clts)
2682{
2683 if (pIemCpu->uCpl != 0)
2684 return iemRaiseGeneralProtectionFault0(pIemCpu);
2685
2686 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2687 uint64_t uNewCr0 = pCtx->cr0;
2688 uNewCr0 &= ~X86_CR0_TS;
2689 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
2690}
2691
2692
2693/**
2694 * Implements mov GReg,DRx.
2695 *
2696 * @param iGReg The general register to store the DRx value in.
2697 * @param iDrReg The DRx register to read (0-7).
2698 */
2699IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
2700{
2701 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2702
2703 /*
2704 * Check preconditions.
2705 */
2706
2707 /* Raise GPs. */
2708 if (pIemCpu->uCpl != 0)
2709 return iemRaiseGeneralProtectionFault0(pIemCpu);
2710 Assert(!pCtx->eflags.Bits.u1VM);
2711
2712 if ( (iDrReg == 4 || iDrReg == 5)
2713 && (pCtx->cr4 & X86_CR4_DE) )
2714 {
2715 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
2716 return iemRaiseGeneralProtectionFault0(pIemCpu);
2717 }
2718
2719 /* Raise #DB if general access detect is enabled. */
2720 if (pCtx->dr[7] & X86_DR7_GD)
2721 {
2722 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
2723 return iemRaiseDebugException(pIemCpu);
2724 }
2725
2726 /*
2727 * Read the debug register and store it in the specified general register.
2728 */
2729 uint64_t drX;
2730 switch (iDrReg)
2731 {
2732 case 0: drX = pCtx->dr[0]; break;
2733 case 1: drX = pCtx->dr[1]; break;
2734 case 2: drX = pCtx->dr[2]; break;
2735 case 3: drX = pCtx->dr[3]; break;
2736 case 6:
2737 case 4:
2738 drX = pCtx->dr[6];
2739 drX &= ~RT_BIT_32(12);
2740 drX |= UINT32_C(0xffff0ff0);
2741 break;
2742 case 7:
2743 case 5:
2744 drX = pCtx->dr[7];
2745 drX &= ~(RT_BIT_32(11) | RT_BIT_32(12) | RT_BIT_32(14) | RT_BIT_32(15));
2746 drX |= RT_BIT_32(10);
2747 break;
2748 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
2749 }
2750
2751 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2752 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = drX;
2753 else
2754 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
2755
2756 iemRegAddToRip(pIemCpu, cbInstr);
2757 return VINF_SUCCESS;
2758}
2759
2760
2761/**
2762 * Implements mov DRx,GReg.
2763 *
2764 * @param iDrReg The DRx register to write (valid).
2765 * @param iGReg The general register to load the DRx value from.
2766 */
2767IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
2768{
2769 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2770
2771 /*
2772 * Check preconditions.
2773 */
2774 if (pIemCpu->uCpl != 0)
2775 return iemRaiseGeneralProtectionFault0(pIemCpu);
2776 Assert(!pCtx->eflags.Bits.u1VM);
2777
2778 if ( (iDrReg == 4 || iDrReg == 5)
2779 && (pCtx->cr4 & X86_CR4_DE) )
2780 {
2781 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
2782 return iemRaiseGeneralProtectionFault0(pIemCpu);
2783 }
2784
2785 /* Raise #DB if general access detect is enabled. */
2786 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
2787 * \#GP? */
2788 if (pCtx->dr[7] & X86_DR7_GD)
2789 {
2790 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
2791 return iemRaiseDebugException(pIemCpu);
2792 }
2793
2794 /*
2795 * Read the new value from the source register.
2796 */
2797 uint64_t uNewDrX;
2798 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
2799 uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
2800 else
2801 uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
2802
2803 /*
2804 * Adjust it.
2805 */
2806 switch (iDrReg)
2807 {
2808 case 0:
2809 case 1:
2810 case 2:
2811 case 3:
2812 /* nothing to adjust */
2813 break;
2814
2815 case 6:
2816 case 4:
2817 if (uNewDrX & UINT64_C(0xffffffff00000000))
2818 {
2819 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
2820 return iemRaiseGeneralProtectionFault0(pIemCpu);
2821 }
2822 uNewDrX &= ~RT_BIT_32(12);
2823 uNewDrX |= UINT32_C(0xffff0ff0);
2824 break;
2825
2826 case 7:
2827 case 5:
2828 if (uNewDrX & UINT64_C(0xffffffff00000000))
2829 {
2830 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
2831 return iemRaiseGeneralProtectionFault0(pIemCpu);
2832 }
2833 uNewDrX &= ~(RT_BIT_32(11) | RT_BIT_32(12) | RT_BIT_32(14) | RT_BIT_32(15));
2834 uNewDrX |= RT_BIT_32(10);
2835 break;
2836
2837 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2838 }
2839
2840 /*
2841 * Do the actual setting.
2842 */
2843 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2844 {
2845 int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
2846 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
2847 }
2848 else
2849 pCtx->dr[iDrReg] = uNewDrX;
2850
2851 iemRegAddToRip(pIemCpu, cbInstr);
2852 return VINF_SUCCESS;
2853}
2854
2855
2856/**
2857 * Implements 'INVLPG m'.
2858 *
2859 * @param GCPtrPage The effective address of the page to invalidate.
2860 * @remarks Updates the RIP.
2861 */
2862IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
2863{
2864 /* ring-0 only. */
2865 if (pIemCpu->uCpl != 0)
2866 return iemRaiseGeneralProtectionFault0(pIemCpu);
2867 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2868
2869 int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
2870 iemRegAddToRip(pIemCpu, cbInstr);
2871
2872 if ( rc == VINF_SUCCESS
2873 || rc == VINF_PGM_SYNC_CR3)
2874 return VINF_SUCCESS;
2875 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
2876 return rc;
2877}
2878
2879
2880/**
2881 * Implements RDTSC.
2882 */
2883IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
2884{
2885 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2886
2887 /*
2888 * Check preconditions.
2889 */
2890 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
2891 return iemRaiseUndefinedOpcode(pIemCpu);
2892
2893 if ( (pCtx->cr4 & X86_CR4_TSD)
2894 && pIemCpu->uCpl != 0)
2895 {
2896 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
2897 return iemRaiseGeneralProtectionFault0(pIemCpu);
2898 }
2899
2900 /*
2901 * Do the job.
2902 */
2903 uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
2904 pCtx->rax = (uint32_t)uTicks;
2905 pCtx->rdx = uTicks >> 32;
2906#ifdef IEM_VERIFICATION_MODE
2907 pIemCpu->fIgnoreRaxRdx = true;
2908#endif
2909
2910 iemRegAddToRip(pIemCpu, cbInstr);
2911 return VINF_SUCCESS;
2912}
2913
2914
2915/**
2916 * Implements RDMSR.
2917 */
2918IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
2919{
2920 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2921
2922 /*
2923 * Check preconditions.
2924 */
2925 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
2926 return iemRaiseUndefinedOpcode(pIemCpu);
2927 if (pIemCpu->uCpl != 0)
2928 return iemRaiseGeneralProtectionFault0(pIemCpu);
2929
2930 /*
2931 * Do the job.
2932 */
2933 RTUINT64U uValue;
2934 int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
2935 if (rc != VINF_SUCCESS)
2936 {
2937 AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
2938 return iemRaiseGeneralProtectionFault0(pIemCpu);
2939 }
2940
2941 pCtx->rax = uValue.au32[0];
2942 pCtx->rdx = uValue.au32[1];
2943
2944 iemRegAddToRip(pIemCpu, cbInstr);
2945 return VINF_SUCCESS;
2946}
2947
2948
2949/**
2950 * Implements 'IN eAX, port'.
2951 *
2952 * @param u16Port The source port.
2953 * @param cbReg The register size.
2954 */
2955IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
2956{
2957 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2958
2959 /*
2960 * CPL check
2961 */
2962 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
2963 if (rcStrict != VINF_SUCCESS)
2964 return rcStrict;
2965
2966 /*
2967 * Perform the I/O.
2968 */
2969 uint32_t u32Value;
2970 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
2971 rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), u16Port, &u32Value, cbReg);
2972 else
2973 rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
2974 if (IOM_SUCCESS(rcStrict))
2975 {
2976 switch (cbReg)
2977 {
2978 case 1: pCtx->al = (uint8_t)u32Value; break;
2979 case 2: pCtx->ax = (uint16_t)u32Value; break;
2980 case 4: pCtx->rax = u32Value; break;
2981 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
2982 }
2983 iemRegAddToRip(pIemCpu, cbInstr);
2984 pIemCpu->cPotentialExits++;
2985 }
2986 /** @todo massage rcStrict. */
2987 return rcStrict;
2988}
2989
2990
2991/**
2992 * Implements 'IN eAX, DX'.
2993 *
2994 * @param cbReg The register size.
2995 */
2996IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
2997{
2998 return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
2999}
3000
3001
3002/**
3003 * Implements 'OUT port, eAX'.
3004 *
3005 * @param u16Port The destination port.
3006 * @param cbReg The register size.
3007 */
3008IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
3009{
3010 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3011
3012 /*
3013 * CPL check
3014 */
3015 if ( (pCtx->cr0 & X86_CR0_PE)
3016 && ( pIemCpu->uCpl > pCtx->eflags.Bits.u2IOPL
3017 || pCtx->eflags.Bits.u1VM) )
3018 {
3019 /** @todo I/O port permission bitmap check */
3020 AssertFailedReturn(VERR_IEM_ASPECT_NOT_IMPLEMENTED);
3021 }
3022
3023 /*
3024 * Perform the I/O.
3025 */
3026 uint32_t u32Value;
3027 switch (cbReg)
3028 {
3029 case 1: u32Value = pCtx->al; break;
3030 case 2: u32Value = pCtx->ax; break;
3031 case 4: u32Value = pCtx->eax; break;
3032 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3033 }
3034 VBOXSTRICTRC rc;
3035 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3036 rc = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), u16Port, u32Value, cbReg);
3037 else
3038 rc = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
3039 if (IOM_SUCCESS(rc))
3040 {
3041 iemRegAddToRip(pIemCpu, cbInstr);
3042 pIemCpu->cPotentialExits++;
3043 /** @todo massage rc. */
3044 }
3045 return rc;
3046}
3047
3048
3049/**
3050 * Implements 'OUT DX, eAX'.
3051 *
3052 * @param cbReg The register size.
3053 */
3054IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
3055{
3056 return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3057}
3058
3059
3060/**
3061 * Implements 'CLI'.
3062 */
3063IEM_CIMPL_DEF_0(iemCImpl_cli)
3064{
3065 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3066
3067 if (pCtx->cr0 & X86_CR0_PE)
3068 {
3069 uint8_t const uIopl = pCtx->eflags.Bits.u2IOPL;
3070 if (!pCtx->eflags.Bits.u1VM)
3071 {
3072 if (pIemCpu->uCpl <= uIopl)
3073 pCtx->eflags.Bits.u1IF = 0;
3074 else if ( pIemCpu->uCpl == 3
3075 && (pCtx->cr4 & X86_CR4_PVI) )
3076 pCtx->eflags.Bits.u1VIF = 0;
3077 else
3078 return iemRaiseGeneralProtectionFault0(pIemCpu);
3079 }
3080 /* V8086 */
3081 else if (uIopl == 3)
3082 pCtx->eflags.Bits.u1IF = 0;
3083 else if ( uIopl < 3
3084 && (pCtx->cr4 & X86_CR4_VME) )
3085 pCtx->eflags.Bits.u1VIF = 0;
3086 else
3087 return iemRaiseGeneralProtectionFault0(pIemCpu);
3088 }
3089 /* real mode */
3090 else
3091 pCtx->eflags.Bits.u1IF = 0;
3092 iemRegAddToRip(pIemCpu, cbInstr);
3093 return VINF_SUCCESS;
3094}
3095
3096
3097/**
3098 * Implements 'STI'.
3099 */
3100IEM_CIMPL_DEF_0(iemCImpl_sti)
3101{
3102 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3103
3104 if (pCtx->cr0 & X86_CR0_PE)
3105 {
3106 uint8_t const uIopl = pCtx->eflags.Bits.u2IOPL;
3107 if (!pCtx->eflags.Bits.u1VM)
3108 {
3109 if (pIemCpu->uCpl <= uIopl)
3110 pCtx->eflags.Bits.u1IF = 1;
3111 else if ( pIemCpu->uCpl == 3
3112 && (pCtx->cr4 & X86_CR4_PVI)
3113 && !pCtx->eflags.Bits.u1VIP )
3114 pCtx->eflags.Bits.u1VIF = 1;
3115 else
3116 return iemRaiseGeneralProtectionFault0(pIemCpu);
3117 }
3118 /* V8086 */
3119 else if (uIopl == 3)
3120 pCtx->eflags.Bits.u1IF = 1;
3121 else if ( uIopl < 3
3122 && (pCtx->cr4 & X86_CR4_VME)
3123 && !pCtx->eflags.Bits.u1VIP )
3124 pCtx->eflags.Bits.u1VIF = 1;
3125 else
3126 return iemRaiseGeneralProtectionFault0(pIemCpu);
3127 }
3128 /* real mode */
3129 else
3130 pCtx->eflags.Bits.u1IF = 1;
3131
3132 iemRegAddToRip(pIemCpu, cbInstr);
3133 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
3134 return VINF_SUCCESS;
3135}
3136
3137
3138/**
3139 * Implements 'HLT'.
3140 */
3141IEM_CIMPL_DEF_0(iemCImpl_hlt)
3142{
3143 if (pIemCpu->uCpl != 0)
3144 return iemRaiseGeneralProtectionFault0(pIemCpu);
3145 iemRegAddToRip(pIemCpu, cbInstr);
3146 return VINF_EM_HALT;
3147}
3148
3149
3150/**
3151 * Implements 'CPUID'.
3152 */
3153IEM_CIMPL_DEF_0(iemCImpl_cpuid)
3154{
3155 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3156
3157 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
3158 pCtx->rax &= UINT32_C(0xffffffff);
3159 pCtx->rbx &= UINT32_C(0xffffffff);
3160 pCtx->rcx &= UINT32_C(0xffffffff);
3161 pCtx->rdx &= UINT32_C(0xffffffff);
3162
3163 iemRegAddToRip(pIemCpu, cbInstr);
3164 return VINF_SUCCESS;
3165}
3166
3167
3168/**
3169 * Implements 'AAD'.
3170 *
3171 * @param enmEffOpSize The effective operand size.
3172 */
3173IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
3174{
3175 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3176
3177 uint16_t const ax = pCtx->ax;
3178 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
3179 pCtx->ax = al;
3180 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
3181 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
3182 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
3183
3184 iemRegAddToRip(pIemCpu, cbInstr);
3185 return VINF_SUCCESS;
3186}
3187
3188
3189/**
3190 * Implements 'AAM'.
3191 *
3192 * @param bImm The immediate operand. Cannot be 0.
3193 */
3194IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
3195{
3196 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3197 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
3198
3199 uint16_t const ax = pCtx->ax;
3200 uint8_t const al = (uint8_t)ax % bImm;
3201 uint8_t const ah = (uint8_t)ax / bImm;
3202 pCtx->ax = (ah << 8) + al;
3203 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
3204 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
3205 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
3206
3207 iemRegAddToRip(pIemCpu, cbInstr);
3208 return VINF_SUCCESS;
3209}
3210
3211
3212
3213
3214/*
3215 * Instantiate the various string operation combinations.
3216 */
3217#define OP_SIZE 8
3218#define ADDR_SIZE 16
3219#include "IEMAllCImplStrInstr.cpp.h"
3220#define OP_SIZE 8
3221#define ADDR_SIZE 32
3222#include "IEMAllCImplStrInstr.cpp.h"
3223#define OP_SIZE 8
3224#define ADDR_SIZE 64
3225#include "IEMAllCImplStrInstr.cpp.h"
3226
3227#define OP_SIZE 16
3228#define ADDR_SIZE 16
3229#include "IEMAllCImplStrInstr.cpp.h"
3230#define OP_SIZE 16
3231#define ADDR_SIZE 32
3232#include "IEMAllCImplStrInstr.cpp.h"
3233#define OP_SIZE 16
3234#define ADDR_SIZE 64
3235#include "IEMAllCImplStrInstr.cpp.h"
3236
3237#define OP_SIZE 32
3238#define ADDR_SIZE 16
3239#include "IEMAllCImplStrInstr.cpp.h"
3240#define OP_SIZE 32
3241#define ADDR_SIZE 32
3242#include "IEMAllCImplStrInstr.cpp.h"
3243#define OP_SIZE 32
3244#define ADDR_SIZE 64
3245#include "IEMAllCImplStrInstr.cpp.h"
3246
3247#define OP_SIZE 64
3248#define ADDR_SIZE 32
3249#include "IEMAllCImplStrInstr.cpp.h"
3250#define OP_SIZE 64
3251#define ADDR_SIZE 64
3252#include "IEMAllCImplStrInstr.cpp.h"
3253
3254
3255/**
3256 * Implements 'FINIT' and 'FNINIT'.
3257 *
3258 * @param fCheckXcpts Whether to check for umasked pending exceptions or
3259 * not.
3260 */
3261IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
3262{
3263 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3264
3265 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
3266 return iemRaiseDeviceNotAvailable(pIemCpu);
3267
3268 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
3269 if (fCheckXcpts && TODO )
3270 return iemRaiseMathFault(pIemCpu);
3271 */
3272
3273 if (iemFRegIsFxSaveFormat(pIemCpu))
3274 {
3275 pCtx->fpu.FCW = 0x37f;
3276 pCtx->fpu.FSW = 0;
3277 pCtx->fpu.FTW = 0x00; /* 0 - empty. */
3278 pCtx->fpu.FPUDP = 0;
3279 pCtx->fpu.DS = 0; //??
3280 pCtx->fpu.FPUIP = 0;
3281 pCtx->fpu.CS = 0; //??
3282 pCtx->fpu.FOP = 0;
3283 }
3284 else
3285 {
3286 PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
3287 pFpu->FCW = 0x37f;
3288 pFpu->FSW = 0;
3289 pFpu->FTW = 0xffff; /* 11 - empty */
3290 pFpu->FPUOO = 0; //??
3291 pFpu->FPUOS = 0; //??
3292 pFpu->FPUIP = 0;
3293 pFpu->CS = 0; //??
3294 pFpu->FOP = 0;
3295 }
3296
3297 iemRegAddToRip(pIemCpu, cbInstr);
3298 return VINF_SUCCESS;
3299}
3300
3301
3302/**
3303 * Implements 'FXSAVE'.
3304 *
3305 * @param iEffSeg The effective segment.
3306 * @param GCPtrEff The address of the image.
3307 * @param enmEffOpSize The operand size (only REX.W really matters).
3308 */
3309IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
3310{
3311 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3312
3313 /*
3314 * Raise exceptions.
3315 */
3316 if (pCtx->cr0 & X86_CR0_EM)
3317 return iemRaiseUndefinedOpcode(pIemCpu);
3318 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
3319 return iemRaiseDeviceNotAvailable(pIemCpu);
3320 if (GCPtrEff & 15)
3321 {
3322 /** @todo CPU/VM detection possible! \#AC might not be signal for
3323 * all/any misalignment sizes, intel says its an implementation detail. */
3324 if ( (pCtx->cr0 & X86_CR0_AM)
3325 && pCtx->eflags.Bits.u1AC
3326 && pIemCpu->uCpl == 3)
3327 return iemRaiseAlignmentCheckException(pIemCpu);
3328 return iemRaiseGeneralProtectionFault0(pIemCpu);
3329 }
3330 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
3331
3332 /*
3333 * Access the memory.
3334 */
3335 void *pvMem512;
3336 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W);
3337 if (rcStrict != VINF_SUCCESS)
3338 return rcStrict;
3339 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
3340
3341 /*
3342 * Store the registers.
3343 */
3344 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
3345 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
3346
3347 /* common for all formats */
3348 pDst->FCW = pCtx->fpu.FCW;
3349 pDst->FSW = pCtx->fpu.FSW;
3350 pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
3351 pDst->FOP = pCtx->fpu.FOP;
3352 pDst->MXCSR = pCtx->fpu.MXCSR;
3353 pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
3354 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
3355 {
3356 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
3357 * them for now... */
3358 pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
3359 pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
3360 pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
3361 pDst->aRegs[i].au32[3] = 0;
3362 }
3363
3364 /* FPU IP, CS, DP and DS. */
3365 /** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
3366 * state information. :-/
3367 * Storing zeros now to prevent any potential leakage of host info. */
3368 pDst->FPUIP = 0;
3369 pDst->CS = 0;
3370 pDst->Rsrvd1 = 0;
3371 pDst->FPUDP = 0;
3372 pDst->DS = 0;
3373 pDst->Rsrvd2 = 0;
3374
3375 /* XMM registers. */
3376 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
3377 || pIemCpu->enmCpuMode != IEMMODE_64BIT
3378 || pIemCpu->uCpl != 0)
3379 {
3380 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
3381 for (uint32_t i = 0; i < cXmmRegs; i++)
3382 pDst->aXMM[i] = pCtx->fpu.aXMM[i];
3383 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
3384 * right? */
3385 }
3386
3387 /*
3388 * Commit the memory.
3389 */
3390 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W);
3391 if (rcStrict != VINF_SUCCESS)
3392 return rcStrict;
3393
3394 iemRegAddToRip(pIemCpu, cbInstr);
3395 return VINF_SUCCESS;
3396}
3397
3398
3399/**
3400 * Implements 'FXRSTOR'.
3401 *
3402 * @param GCPtrEff The address of the image.
3403 * @param enmEffOpSize The operand size (only REX.W really matters).
3404 */
3405IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
3406{
3407 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3408
3409 /*
3410 * Raise exceptions.
3411 */
3412 if (pCtx->cr0 & X86_CR0_EM)
3413 return iemRaiseUndefinedOpcode(pIemCpu);
3414 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
3415 return iemRaiseDeviceNotAvailable(pIemCpu);
3416 if (GCPtrEff & 15)
3417 {
3418 /** @todo CPU/VM detection possible! \#AC might not be signal for
3419 * all/any misalignment sizes, intel says its an implementation detail. */
3420 if ( (pCtx->cr0 & X86_CR0_AM)
3421 && pCtx->eflags.Bits.u1AC
3422 && pIemCpu->uCpl == 3)
3423 return iemRaiseAlignmentCheckException(pIemCpu);
3424 return iemRaiseGeneralProtectionFault0(pIemCpu);
3425 }
3426 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
3427
3428 /*
3429 * Access the memory.
3430 */
3431 void *pvMem512;
3432 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
3433 if (rcStrict != VINF_SUCCESS)
3434 return rcStrict;
3435 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
3436
3437 /*
3438 * Check the state for stuff which will GP(0).
3439 */
3440 uint32_t const fMXCSR = pSrc->MXCSR;
3441 uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
3442 if (fMXCSR & ~fMXCSR_MASK)
3443 {
3444 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
3445 return iemRaiseGeneralProtectionFault0(pIemCpu);
3446 }
3447
3448 /*
3449 * Load the registers.
3450 */
3451 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
3452 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
3453
3454 /* common for all formats */
3455 pCtx->fpu.FCW = pSrc->FCW;
3456 pCtx->fpu.FSW = pSrc->FSW;
3457 pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
3458 pCtx->fpu.FOP = pSrc->FOP;
3459 pCtx->fpu.MXCSR = fMXCSR;
3460 /* (MXCSR_MASK is read-only) */
3461 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
3462 {
3463 pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
3464 pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
3465 pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
3466 pCtx->fpu.aRegs[i].au32[3] = 0;
3467 }
3468
3469 /* FPU IP, CS, DP and DS. */
3470 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3471 {
3472 pCtx->fpu.FPUIP = pSrc->FPUIP;
3473 pCtx->fpu.CS = pSrc->CS;
3474 pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
3475 pCtx->fpu.FPUDP = pSrc->FPUDP;
3476 pCtx->fpu.DS = pSrc->DS;
3477 pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
3478 }
3479 else
3480 {
3481 pCtx->fpu.FPUIP = pSrc->FPUIP;
3482 pCtx->fpu.CS = pSrc->CS;
3483 pCtx->fpu.Rsrvd1 = 0;
3484 pCtx->fpu.FPUDP = pSrc->FPUDP;
3485 pCtx->fpu.DS = pSrc->DS;
3486 pCtx->fpu.Rsrvd2 = 0;
3487 }
3488
3489 /* XMM registers. */
3490 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
3491 || pIemCpu->enmCpuMode != IEMMODE_64BIT
3492 || pIemCpu->uCpl != 0)
3493 {
3494 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
3495 for (uint32_t i = 0; i < cXmmRegs; i++)
3496 pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
3497 }
3498
3499 /*
3500 * Commit the memory.
3501 */
3502 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
3503 if (rcStrict != VINF_SUCCESS)
3504 return rcStrict;
3505
3506 iemRegAddToRip(pIemCpu, cbInstr);
3507 return VINF_SUCCESS;
3508}
3509
3510/** @} */
3511
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette