VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 45733

Last change on this file since 45733 was 45701, checked in by vboxsync, 12 years ago

VMM: SELM and VMM early HM init changes.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 157.2 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 45701 2013-04-24 14:21:09Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2012 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18
19/** @name Misc Helpers
20 * @{
21 */
22
23/**
24 * Checks if we are allowed to access the given I/O port, raising the
25 * appropriate exceptions if we aren't (or if the I/O bitmap is not
26 * accessible).
27 *
28 * @returns Strict VBox status code.
29 *
30 * @param pIemCpu The IEM per CPU data.
31 * @param pCtx The register context.
32 * @param u16Port The port number.
33 * @param cbOperand The operand size.
34 */
35DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
36{
37 X86EFLAGS Efl;
38 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
39 if ( (pCtx->cr0 & X86_CR0_PE)
40 && ( pIemCpu->uCpl > Efl.Bits.u2IOPL
41 || Efl.Bits.u1VM) )
42 {
43 NOREF(u16Port); NOREF(cbOperand); /** @todo I/O port permission bitmap check */
44 IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement I/O permission bitmap\n"));
45 }
46 return VINF_SUCCESS;
47}
48
49
50#if 0
51/**
52 * Calculates the parity bit.
53 *
54 * @returns true if the bit is set, false if not.
55 * @param u8Result The least significant byte of the result.
56 */
57static bool iemHlpCalcParityFlag(uint8_t u8Result)
58{
59 /*
60 * Parity is set if the number of bits in the least significant byte of
61 * the result is even.
62 */
63 uint8_t cBits;
64 cBits = u8Result & 1; /* 0 */
65 u8Result >>= 1;
66 cBits += u8Result & 1;
67 u8Result >>= 1;
68 cBits += u8Result & 1;
69 u8Result >>= 1;
70 cBits += u8Result & 1;
71 u8Result >>= 1;
72 cBits += u8Result & 1; /* 4 */
73 u8Result >>= 1;
74 cBits += u8Result & 1;
75 u8Result >>= 1;
76 cBits += u8Result & 1;
77 u8Result >>= 1;
78 cBits += u8Result & 1;
79 return !(cBits & 1);
80}
81#endif /* not used */
82
83
84/**
85 * Updates the specified flags according to a 8-bit result.
86 *
87 * @param pIemCpu The IEM state of the calling EMT.
88 * @param u8Result The result to set the flags according to.
89 * @param fToUpdate The flags to update.
90 * @param fUndefined The flags that are specified as undefined.
91 */
92static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
93{
94 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
95
96 uint32_t fEFlags = pCtx->eflags.u;
97 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
98 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
99 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
100}
101
102
103/**
104 * Loads a NULL data selector into a selector register, both the hidden and
105 * visible parts, in protected mode.
106 *
107 * @param pSReg Pointer to the segment register.
108 * @param uRpl The RPL.
109 */
110static void iemHlpLoadNullDataSelectorProt(PCPUMSELREG pSReg, RTSEL uRpl)
111{
112 /** @todo Testcase: write a testcase checking what happends when loading a NULL
113 * data selector in protected mode. */
114 pSReg->Sel = uRpl;
115 pSReg->ValidSel = uRpl;
116 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
117 pSReg->u64Base = 0;
118 pSReg->u32Limit = 0;
119 pSReg->Attr.u = 0;
120}
121
122
123/**
124 * Helper used by iret.
125 *
126 * @param uCpl The new CPL.
127 * @param pSReg Pointer to the segment register.
128 */
129static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
130{
131#ifdef VBOX_WITH_RAW_MODE_NOT_R0
132 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
133 CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
134#else
135 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
136#endif
137
138 if ( uCpl > pSReg->Attr.n.u2Dpl
139 && pSReg->Attr.n.u1DescType /* code or data, not system */
140 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
141 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
142 iemHlpLoadNullDataSelectorProt(pSReg, 0);
143}
144
145
146/**
147 * Indicates that we have modified the FPU state.
148 *
149 * @param pIemCpu The IEM state of the calling EMT.
150 */
151DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
152{
153 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
154}
155
156/** @} */
157
158/** @name C Implementations
159 * @{
160 */
161
162/**
163 * Implements a 16-bit popa.
164 */
165IEM_CIMPL_DEF_0(iemCImpl_popa_16)
166{
167 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
168 RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
169 RTGCPTR GCPtrLast = GCPtrStart + 15;
170 VBOXSTRICTRC rcStrict;
171
172 /*
173 * The docs are a bit hard to comprehend here, but it looks like we wrap
174 * around in real mode as long as none of the individual "popa" crosses the
175 * end of the stack segment. In protected mode we check the whole access
176 * in one go. For efficiency, only do the word-by-word thing if we're in
177 * danger of wrapping around.
178 */
179 /** @todo do popa boundary / wrap-around checks. */
180 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
181 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
182 {
183 /* word-by-word */
184 RTUINT64U TmpRsp;
185 TmpRsp.u = pCtx->rsp;
186 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
187 if (rcStrict == VINF_SUCCESS)
188 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
189 if (rcStrict == VINF_SUCCESS)
190 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
191 if (rcStrict == VINF_SUCCESS)
192 {
193 iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
194 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
195 }
196 if (rcStrict == VINF_SUCCESS)
197 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
198 if (rcStrict == VINF_SUCCESS)
199 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
200 if (rcStrict == VINF_SUCCESS)
201 rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
202 if (rcStrict == VINF_SUCCESS)
203 {
204 pCtx->rsp = TmpRsp.u;
205 iemRegAddToRip(pIemCpu, cbInstr);
206 }
207 }
208 else
209 {
210 uint16_t const *pa16Mem = NULL;
211 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
212 if (rcStrict == VINF_SUCCESS)
213 {
214 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
215 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
216 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
217 /* skip sp */
218 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
219 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
220 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
221 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
222 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
223 if (rcStrict == VINF_SUCCESS)
224 {
225 iemRegAddToRsp(pCtx, 16);
226 iemRegAddToRip(pIemCpu, cbInstr);
227 }
228 }
229 }
230 return rcStrict;
231}
232
233
234/**
235 * Implements a 32-bit popa.
236 */
237IEM_CIMPL_DEF_0(iemCImpl_popa_32)
238{
239 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
240 RTGCPTR GCPtrStart = iemRegGetEffRsp(pCtx);
241 RTGCPTR GCPtrLast = GCPtrStart + 31;
242 VBOXSTRICTRC rcStrict;
243
244 /*
245 * The docs are a bit hard to comprehend here, but it looks like we wrap
246 * around in real mode as long as none of the individual "popa" crosses the
247 * end of the stack segment. In protected mode we check the whole access
248 * in one go. For efficiency, only do the word-by-word thing if we're in
249 * danger of wrapping around.
250 */
251 /** @todo do popa boundary / wrap-around checks. */
252 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pIemCpu)
253 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
254 {
255 /* word-by-word */
256 RTUINT64U TmpRsp;
257 TmpRsp.u = pCtx->rsp;
258 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
259 if (rcStrict == VINF_SUCCESS)
260 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
261 if (rcStrict == VINF_SUCCESS)
262 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
263 if (rcStrict == VINF_SUCCESS)
264 {
265 iemRegAddToRspEx(&TmpRsp, 2, pCtx); /* sp */
266 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
267 }
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
272 if (rcStrict == VINF_SUCCESS)
273 rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
274 if (rcStrict == VINF_SUCCESS)
275 {
276#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
277 pCtx->rdi &= UINT32_MAX;
278 pCtx->rsi &= UINT32_MAX;
279 pCtx->rbp &= UINT32_MAX;
280 pCtx->rbx &= UINT32_MAX;
281 pCtx->rdx &= UINT32_MAX;
282 pCtx->rcx &= UINT32_MAX;
283 pCtx->rax &= UINT32_MAX;
284#endif
285 pCtx->rsp = TmpRsp.u;
286 iemRegAddToRip(pIemCpu, cbInstr);
287 }
288 }
289 else
290 {
291 uint32_t const *pa32Mem;
292 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
293 if (rcStrict == VINF_SUCCESS)
294 {
295 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
296 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
297 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
298 /* skip esp */
299 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
300 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
301 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
302 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
303 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
304 if (rcStrict == VINF_SUCCESS)
305 {
306 iemRegAddToRsp(pCtx, 32);
307 iemRegAddToRip(pIemCpu, cbInstr);
308 }
309 }
310 }
311 return rcStrict;
312}
313
314
315/**
316 * Implements a 16-bit pusha.
317 */
318IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
319{
320 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
321 RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
322 RTGCPTR GCPtrBottom = GCPtrTop - 15;
323 VBOXSTRICTRC rcStrict;
324
325 /*
326 * The docs are a bit hard to comprehend here, but it looks like we wrap
327 * around in real mode as long as none of the individual "pushd" crosses the
328 * end of the stack segment. In protected mode we check the whole access
329 * in one go. For efficiency, only do the word-by-word thing if we're in
330 * danger of wrapping around.
331 */
332 /** @todo do pusha boundary / wrap-around checks. */
333 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
334 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
335 {
336 /* word-by-word */
337 RTUINT64U TmpRsp;
338 TmpRsp.u = pCtx->rsp;
339 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
340 if (rcStrict == VINF_SUCCESS)
341 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
344 if (rcStrict == VINF_SUCCESS)
345 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
346 if (rcStrict == VINF_SUCCESS)
347 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
348 if (rcStrict == VINF_SUCCESS)
349 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
350 if (rcStrict == VINF_SUCCESS)
351 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
352 if (rcStrict == VINF_SUCCESS)
353 rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
354 if (rcStrict == VINF_SUCCESS)
355 {
356 pCtx->rsp = TmpRsp.u;
357 iemRegAddToRip(pIemCpu, cbInstr);
358 }
359 }
360 else
361 {
362 GCPtrBottom--;
363 uint16_t *pa16Mem = NULL;
364 rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
365 if (rcStrict == VINF_SUCCESS)
366 {
367 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
368 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
369 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
370 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
371 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
372 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
373 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
374 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
375 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
376 if (rcStrict == VINF_SUCCESS)
377 {
378 iemRegSubFromRsp(pCtx, 16);
379 iemRegAddToRip(pIemCpu, cbInstr);
380 }
381 }
382 }
383 return rcStrict;
384}
385
386
387/**
388 * Implements a 32-bit pusha.
389 */
390IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
391{
392 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
393 RTGCPTR GCPtrTop = iemRegGetEffRsp(pCtx);
394 RTGCPTR GCPtrBottom = GCPtrTop - 31;
395 VBOXSTRICTRC rcStrict;
396
397 /*
398 * The docs are a bit hard to comprehend here, but it looks like we wrap
399 * around in real mode as long as none of the individual "pusha" crosses the
400 * end of the stack segment. In protected mode we check the whole access
401 * in one go. For efficiency, only do the word-by-word thing if we're in
402 * danger of wrapping around.
403 */
404 /** @todo do pusha boundary / wrap-around checks. */
405 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
406 && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
407 {
408 /* word-by-word */
409 RTUINT64U TmpRsp;
410 TmpRsp.u = pCtx->rsp;
411 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
416 if (rcStrict == VINF_SUCCESS)
417 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
426 if (rcStrict == VINF_SUCCESS)
427 {
428 pCtx->rsp = TmpRsp.u;
429 iemRegAddToRip(pIemCpu, cbInstr);
430 }
431 }
432 else
433 {
434 GCPtrBottom--;
435 uint32_t *pa32Mem;
436 rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
437 if (rcStrict == VINF_SUCCESS)
438 {
439 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
440 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
441 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
442 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
443 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
444 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
445 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
446 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
447 rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
448 if (rcStrict == VINF_SUCCESS)
449 {
450 iemRegSubFromRsp(pCtx, 32);
451 iemRegAddToRip(pIemCpu, cbInstr);
452 }
453 }
454 }
455 return rcStrict;
456}
457
458
459/**
460 * Implements pushf.
461 *
462 *
463 * @param enmEffOpSize The effective operand size.
464 */
465IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
466{
467 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
468
469 /*
470 * If we're in V8086 mode some care is required (which is why we're in
471 * doing this in a C implementation).
472 */
473 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
474 if ( (fEfl & X86_EFL_VM)
475 && X86_EFL_GET_IOPL(fEfl) != 3 )
476 {
477 Assert(pCtx->cr0 & X86_CR0_PE);
478 if ( enmEffOpSize != IEMMODE_16BIT
479 || !(pCtx->cr4 & X86_CR4_VME))
480 return iemRaiseGeneralProtectionFault0(pIemCpu);
481 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
482 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
483 return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
484 }
485
486 /*
487 * Ok, clear RF and VM and push the flags.
488 */
489 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
490
491 VBOXSTRICTRC rcStrict;
492 switch (enmEffOpSize)
493 {
494 case IEMMODE_16BIT:
495 rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
496 break;
497 case IEMMODE_32BIT:
498 rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
499 break;
500 case IEMMODE_64BIT:
501 rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
502 break;
503 IEM_NOT_REACHED_DEFAULT_CASE_RET();
504 }
505 if (rcStrict != VINF_SUCCESS)
506 return rcStrict;
507
508 iemRegAddToRip(pIemCpu, cbInstr);
509 return VINF_SUCCESS;
510}
511
512
513/**
514 * Implements popf.
515 *
516 * @param enmEffOpSize The effective operand size.
517 */
518IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
519{
520 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
521 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
522 uint32_t const fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
523 VBOXSTRICTRC rcStrict;
524 uint32_t fEflNew;
525
526 /*
527 * V8086 is special as usual.
528 */
529 if (fEflOld & X86_EFL_VM)
530 {
531 /*
532 * Almost anything goes if IOPL is 3.
533 */
534 if (X86_EFL_GET_IOPL(fEflOld) == 3)
535 {
536 switch (enmEffOpSize)
537 {
538 case IEMMODE_16BIT:
539 {
540 uint16_t u16Value;
541 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
542 if (rcStrict != VINF_SUCCESS)
543 return rcStrict;
544 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
545 break;
546 }
547 case IEMMODE_32BIT:
548 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
549 if (rcStrict != VINF_SUCCESS)
550 return rcStrict;
551 break;
552 IEM_NOT_REACHED_DEFAULT_CASE_RET();
553 }
554
555 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
556 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
557 }
558 /*
559 * Interrupt flag virtualization with CR4.VME=1.
560 */
561 else if ( enmEffOpSize == IEMMODE_16BIT
562 && (pCtx->cr4 & X86_CR4_VME) )
563 {
564 uint16_t u16Value;
565 RTUINT64U TmpRsp;
566 TmpRsp.u = pCtx->rsp;
567 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
568 if (rcStrict != VINF_SUCCESS)
569 return rcStrict;
570
571 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
572 * or before? */
573 if ( ( (u16Value & X86_EFL_IF)
574 && (fEflOld & X86_EFL_VIP))
575 || (u16Value & X86_EFL_TF) )
576 return iemRaiseGeneralProtectionFault0(pIemCpu);
577
578 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
579 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
580 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
581 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
582
583 pCtx->rsp = TmpRsp.u;
584 }
585 else
586 return iemRaiseGeneralProtectionFault0(pIemCpu);
587
588 }
589 /*
590 * Not in V8086 mode.
591 */
592 else
593 {
594 /* Pop the flags. */
595 switch (enmEffOpSize)
596 {
597 case IEMMODE_16BIT:
598 {
599 uint16_t u16Value;
600 rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
601 if (rcStrict != VINF_SUCCESS)
602 return rcStrict;
603 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
604 break;
605 }
606 case IEMMODE_32BIT:
607 case IEMMODE_64BIT:
608 rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
609 if (rcStrict != VINF_SUCCESS)
610 return rcStrict;
611 break;
612 IEM_NOT_REACHED_DEFAULT_CASE_RET();
613 }
614
615 /* Merge them with the current flags. */
616 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
617 || pIemCpu->uCpl == 0)
618 {
619 fEflNew &= X86_EFL_POPF_BITS;
620 fEflNew |= ~X86_EFL_POPF_BITS & fEflOld;
621 }
622 else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
623 {
624 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL);
625 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL)) & fEflOld;
626 }
627 else
628 {
629 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
630 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
631 }
632 }
633
634 /*
635 * Commit the flags.
636 */
637 Assert(fEflNew & RT_BIT_32(1));
638 IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
639 iemRegAddToRip(pIemCpu, cbInstr);
640
641 return VINF_SUCCESS;
642}
643
644
645/**
646 * Implements an indirect call.
647 *
648 * @param uNewPC The new program counter (RIP) value (loaded from the
649 * operand).
650 * @param enmEffOpSize The effective operand size.
651 */
652IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
653{
654 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
655 uint16_t uOldPC = pCtx->ip + cbInstr;
656 if (uNewPC > pCtx->cs.u32Limit)
657 return iemRaiseGeneralProtectionFault0(pIemCpu);
658
659 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
660 if (rcStrict != VINF_SUCCESS)
661 return rcStrict;
662
663 pCtx->rip = uNewPC;
664 return VINF_SUCCESS;
665
666}
667
668
669/**
670 * Implements a 16-bit relative call.
671 *
672 * @param offDisp The displacment offset.
673 */
674IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
675{
676 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
677 uint16_t uOldPC = pCtx->ip + cbInstr;
678 uint16_t uNewPC = uOldPC + offDisp;
679 if (uNewPC > pCtx->cs.u32Limit)
680 return iemRaiseGeneralProtectionFault0(pIemCpu);
681
682 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
683 if (rcStrict != VINF_SUCCESS)
684 return rcStrict;
685
686 pCtx->rip = uNewPC;
687 return VINF_SUCCESS;
688}
689
690
691/**
692 * Implements a 32-bit indirect call.
693 *
694 * @param uNewPC The new program counter (RIP) value (loaded from the
695 * operand).
696 * @param enmEffOpSize The effective operand size.
697 */
698IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
699{
700 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
701 uint32_t uOldPC = pCtx->eip + cbInstr;
702 if (uNewPC > pCtx->cs.u32Limit)
703 return iemRaiseGeneralProtectionFault0(pIemCpu);
704
705 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
706 if (rcStrict != VINF_SUCCESS)
707 return rcStrict;
708
709 pCtx->rip = uNewPC;
710 return VINF_SUCCESS;
711
712}
713
714
715/**
716 * Implements a 32-bit relative call.
717 *
718 * @param offDisp The displacment offset.
719 */
720IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
721{
722 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
723 uint32_t uOldPC = pCtx->eip + cbInstr;
724 uint32_t uNewPC = uOldPC + offDisp;
725 if (uNewPC > pCtx->cs.u32Limit)
726 return iemRaiseGeneralProtectionFault0(pIemCpu);
727
728 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
729 if (rcStrict != VINF_SUCCESS)
730 return rcStrict;
731
732 pCtx->rip = uNewPC;
733 return VINF_SUCCESS;
734}
735
736
737/**
738 * Implements a 64-bit indirect call.
739 *
740 * @param uNewPC The new program counter (RIP) value (loaded from the
741 * operand).
742 * @param enmEffOpSize The effective operand size.
743 */
744IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
745{
746 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
747 uint64_t uOldPC = pCtx->rip + cbInstr;
748 if (!IEM_IS_CANONICAL(uNewPC))
749 return iemRaiseGeneralProtectionFault0(pIemCpu);
750
751 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
752 if (rcStrict != VINF_SUCCESS)
753 return rcStrict;
754
755 pCtx->rip = uNewPC;
756 return VINF_SUCCESS;
757
758}
759
760
761/**
762 * Implements a 64-bit relative call.
763 *
764 * @param offDisp The displacment offset.
765 */
766IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
767{
768 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
769 uint64_t uOldPC = pCtx->rip + cbInstr;
770 uint64_t uNewPC = uOldPC + offDisp;
771 if (!IEM_IS_CANONICAL(uNewPC))
772 return iemRaiseNotCanonical(pIemCpu);
773
774 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
775 if (rcStrict != VINF_SUCCESS)
776 return rcStrict;
777
778 pCtx->rip = uNewPC;
779 return VINF_SUCCESS;
780}
781
782
783/**
784 * Implements far jumps and calls thru task segments (TSS).
785 *
786 * @param uSel The selector.
787 * @param enmBranch The kind of branching we're performing.
788 * @param enmEffOpSize The effective operand size.
789 * @param pDesc The descriptor corrsponding to @a uSel. The type is
790 * call gate.
791 */
792IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
793{
794 /* Call various functions to do the work. */
795 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
796}
797
798
799/**
800 * Implements far jumps and calls thru task gates.
801 *
802 * @param uSel The selector.
803 * @param enmBranch The kind of branching we're performing.
804 * @param enmEffOpSize The effective operand size.
805 * @param pDesc The descriptor corrsponding to @a uSel. The type is
806 * call gate.
807 */
808IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
809{
810 /* Call various functions to do the work. */
811 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
812}
813
814
815/**
816 * Implements far jumps and calls thru call gates.
817 *
818 * @param uSel The selector.
819 * @param enmBranch The kind of branching we're performing.
820 * @param enmEffOpSize The effective operand size.
821 * @param pDesc The descriptor corrsponding to @a uSel. The type is
822 * call gate.
823 */
824IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
825{
826 /* Call various functions to do the work. */
827 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
828}
829
830
831/**
832 * Implements far jumps and calls thru system selectors.
833 *
834 * @param uSel The selector.
835 * @param enmBranch The kind of branching we're performing.
836 * @param enmEffOpSize The effective operand size.
837 * @param pDesc The descriptor corrsponding to @a uSel.
838 */
839IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
840{
841 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
842 Assert((uSel & X86_SEL_MASK_OFF_RPL));
843
844 if (IEM_IS_LONG_MODE(pIemCpu))
845 switch (pDesc->Legacy.Gen.u4Type)
846 {
847 case AMD64_SEL_TYPE_SYS_CALL_GATE:
848 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
849
850 default:
851 case AMD64_SEL_TYPE_SYS_LDT:
852 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
853 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
854 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
855 case AMD64_SEL_TYPE_SYS_INT_GATE:
856 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
857 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
858
859 }
860
861 switch (pDesc->Legacy.Gen.u4Type)
862 {
863 case X86_SEL_TYPE_SYS_286_CALL_GATE:
864 case X86_SEL_TYPE_SYS_386_CALL_GATE:
865 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
866
867 case X86_SEL_TYPE_SYS_TASK_GATE:
868 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
869
870 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
871 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
872 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
873
874 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
875 Log(("branch %04x -> busy 286 TSS\n", uSel));
876 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
877
878 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
879 Log(("branch %04x -> busy 386 TSS\n", uSel));
880 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
881
882 default:
883 case X86_SEL_TYPE_SYS_LDT:
884 case X86_SEL_TYPE_SYS_286_INT_GATE:
885 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
886 case X86_SEL_TYPE_SYS_386_INT_GATE:
887 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
888 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
889 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
890 }
891}
892
893
894/**
895 * Implements far jumps.
896 *
897 * @param uSel The selector.
898 * @param offSeg The segment offset.
899 * @param enmEffOpSize The effective operand size.
900 */
901IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
902{
903 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
904 NOREF(cbInstr);
905 Assert(offSeg <= UINT32_MAX);
906
907 /*
908 * Real mode and V8086 mode are easy. The only snag seems to be that
909 * CS.limit doesn't change and the limit check is done against the current
910 * limit.
911 */
912 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
913 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
914 {
915 if (offSeg > pCtx->cs.u32Limit)
916 return iemRaiseGeneralProtectionFault0(pIemCpu);
917
918 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
919 pCtx->rip = offSeg;
920 else
921 pCtx->rip = offSeg & UINT16_MAX;
922 pCtx->cs.Sel = uSel;
923 pCtx->cs.ValidSel = uSel;
924 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
925 pCtx->cs.u64Base = (uint32_t)uSel << 4;
926 return VINF_SUCCESS;
927 }
928
929 /*
930 * Protected mode. Need to parse the specified descriptor...
931 */
932 if (!(uSel & X86_SEL_MASK_OFF_RPL))
933 {
934 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
935 return iemRaiseGeneralProtectionFault0(pIemCpu);
936 }
937
938 /* Fetch the descriptor. */
939 IEMSELDESC Desc;
940 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
941 if (rcStrict != VINF_SUCCESS)
942 return rcStrict;
943
944 /* Is it there? */
945 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
946 {
947 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
948 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
949 }
950
951 /*
952 * Deal with it according to its type. We do the standard code selectors
953 * here and dispatch the system selectors to worker functions.
954 */
955 if (!Desc.Legacy.Gen.u1DescType)
956 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
957
958 /* Only code segments. */
959 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
960 {
961 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
962 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
963 }
964
965 /* L vs D. */
966 if ( Desc.Legacy.Gen.u1Long
967 && Desc.Legacy.Gen.u1DefBig
968 && IEM_IS_LONG_MODE(pIemCpu))
969 {
970 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
971 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
972 }
973
974 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
975 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
976 {
977 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
978 {
979 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
980 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
981 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
982 }
983 }
984 else
985 {
986 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
987 {
988 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
989 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
990 }
991 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
992 {
993 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
994 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
995 }
996 }
997
998 /* Chop the high bits if 16-bit (Intel says so). */
999 if (enmEffOpSize == IEMMODE_16BIT)
1000 offSeg &= UINT16_MAX;
1001
1002 /* Limit check. (Should alternatively check for non-canonical addresses
1003 here, but that is ruled out by offSeg being 32-bit, right?) */
1004 uint64_t u64Base;
1005 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1006 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1007 u64Base = 0;
1008 else
1009 {
1010 if (offSeg > cbLimit)
1011 {
1012 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1013 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1014 }
1015 u64Base = X86DESC_BASE(&Desc.Legacy);
1016 }
1017
1018 /*
1019 * Ok, everything checked out fine. Now set the accessed bit before
1020 * committing the result into CS, CSHID and RIP.
1021 */
1022 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1023 {
1024 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1025 if (rcStrict != VINF_SUCCESS)
1026 return rcStrict;
1027 /** @todo check what VT-x and AMD-V does. */
1028 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1029 }
1030
1031 /* commit */
1032 pCtx->rip = offSeg;
1033 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1034 pCtx->cs.Sel |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
1035 pCtx->cs.ValidSel = pCtx->cs.Sel;
1036 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1037 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1038 pCtx->cs.u32Limit = cbLimit;
1039 pCtx->cs.u64Base = u64Base;
1040 /** @todo check if the hidden bits are loaded correctly for 64-bit
1041 * mode. */
1042 return VINF_SUCCESS;
1043}
1044
1045
1046/**
1047 * Implements far calls.
1048 *
1049 * This very similar to iemCImpl_FarJmp.
1050 *
1051 * @param uSel The selector.
1052 * @param offSeg The segment offset.
1053 * @param enmEffOpSize The operand size (in case we need it).
1054 */
1055IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1056{
1057 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1058 VBOXSTRICTRC rcStrict;
1059 uint64_t uNewRsp;
1060 RTPTRUNION uPtrRet;
1061
1062 /*
1063 * Real mode and V8086 mode are easy. The only snag seems to be that
1064 * CS.limit doesn't change and the limit check is done against the current
1065 * limit.
1066 */
1067 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1068 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1069 {
1070 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1071
1072 /* Check stack first - may #SS(0). */
1073 rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1074 &uPtrRet.pv, &uNewRsp);
1075 if (rcStrict != VINF_SUCCESS)
1076 return rcStrict;
1077
1078 /* Check the target address range. */
1079 if (offSeg > UINT32_MAX)
1080 return iemRaiseGeneralProtectionFault0(pIemCpu);
1081
1082 /* Everything is fine, push the return address. */
1083 if (enmEffOpSize == IEMMODE_16BIT)
1084 {
1085 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1086 uPtrRet.pu16[1] = pCtx->cs.Sel;
1087 }
1088 else
1089 {
1090 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1091 uPtrRet.pu16[3] = pCtx->cs.Sel;
1092 }
1093 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1094 if (rcStrict != VINF_SUCCESS)
1095 return rcStrict;
1096
1097 /* Branch. */
1098 pCtx->rip = offSeg;
1099 pCtx->cs.Sel = uSel;
1100 pCtx->cs.ValidSel = uSel;
1101 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1102 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1103 return VINF_SUCCESS;
1104 }
1105
1106 /*
1107 * Protected mode. Need to parse the specified descriptor...
1108 */
1109 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1110 {
1111 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1112 return iemRaiseGeneralProtectionFault0(pIemCpu);
1113 }
1114
1115 /* Fetch the descriptor. */
1116 IEMSELDESC Desc;
1117 rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
1118 if (rcStrict != VINF_SUCCESS)
1119 return rcStrict;
1120
1121 /*
1122 * Deal with it according to its type. We do the standard code selectors
1123 * here and dispatch the system selectors to worker functions.
1124 */
1125 if (!Desc.Legacy.Gen.u1DescType)
1126 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
1127
1128 /* Only code segments. */
1129 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1130 {
1131 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1132 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1133 }
1134
1135 /* L vs D. */
1136 if ( Desc.Legacy.Gen.u1Long
1137 && Desc.Legacy.Gen.u1DefBig
1138 && IEM_IS_LONG_MODE(pIemCpu))
1139 {
1140 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1141 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1142 }
1143
1144 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1145 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1146 {
1147 if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
1148 {
1149 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1150 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1151 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1152 }
1153 }
1154 else
1155 {
1156 if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
1157 {
1158 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
1159 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1160 }
1161 if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
1162 {
1163 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
1164 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1165 }
1166 }
1167
1168 /* Is it there? */
1169 if (!Desc.Legacy.Gen.u1Present)
1170 {
1171 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1172 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
1173 }
1174
1175 /* Check stack first - may #SS(0). */
1176 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
1177 * 16-bit code cause a two or four byte CS to be pushed? */
1178 rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
1179 enmEffOpSize == IEMMODE_64BIT ? 8+8
1180 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1181 &uPtrRet.pv, &uNewRsp);
1182 if (rcStrict != VINF_SUCCESS)
1183 return rcStrict;
1184
1185 /* Chop the high bits if 16-bit (Intel says so). */
1186 if (enmEffOpSize == IEMMODE_16BIT)
1187 offSeg &= UINT16_MAX;
1188
1189 /* Limit / canonical check. */
1190 uint64_t u64Base;
1191 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1192 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1193 {
1194 if (!IEM_IS_CANONICAL(offSeg))
1195 {
1196 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
1197 return iemRaiseNotCanonical(pIemCpu);
1198 }
1199 u64Base = 0;
1200 }
1201 else
1202 {
1203 if (offSeg > cbLimit)
1204 {
1205 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1206 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
1207 }
1208 u64Base = X86DESC_BASE(&Desc.Legacy);
1209 }
1210
1211 /*
1212 * Now set the accessed bit before
1213 * writing the return address to the stack and committing the result into
1214 * CS, CSHID and RIP.
1215 */
1216 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1217 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1218 {
1219 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
1220 if (rcStrict != VINF_SUCCESS)
1221 return rcStrict;
1222 /** @todo check what VT-x and AMD-V does. */
1223 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1224 }
1225
1226 /* stack */
1227 if (enmEffOpSize == IEMMODE_16BIT)
1228 {
1229 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1230 uPtrRet.pu16[1] = pCtx->cs.Sel;
1231 }
1232 else if (enmEffOpSize == IEMMODE_32BIT)
1233 {
1234 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1235 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
1236 }
1237 else
1238 {
1239 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1240 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
1241 }
1242 rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
1243 if (rcStrict != VINF_SUCCESS)
1244 return rcStrict;
1245
1246 /* commit */
1247 pCtx->rip = offSeg;
1248 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1249 pCtx->cs.Sel |= pIemCpu->uCpl;
1250 pCtx->cs.ValidSel = pCtx->cs.Sel;
1251 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1252 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1253 pCtx->cs.u32Limit = cbLimit;
1254 pCtx->cs.u64Base = u64Base;
1255 /** @todo check if the hidden bits are loaded correctly for 64-bit
1256 * mode. */
1257 return VINF_SUCCESS;
1258}
1259
1260
1261/**
1262 * Implements retf.
1263 *
1264 * @param enmEffOpSize The effective operand size.
1265 * @param cbPop The amount of arguments to pop from the stack
1266 * (bytes).
1267 */
1268IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1269{
1270 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1271 VBOXSTRICTRC rcStrict;
1272 RTCPTRUNION uPtrFrame;
1273 uint64_t uNewRsp;
1274 uint64_t uNewRip;
1275 uint16_t uNewCs;
1276 NOREF(cbInstr);
1277
1278 /*
1279 * Read the stack values first.
1280 */
1281 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
1282 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
1283 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
1284 if (rcStrict != VINF_SUCCESS)
1285 return rcStrict;
1286 if (enmEffOpSize == IEMMODE_16BIT)
1287 {
1288 uNewRip = uPtrFrame.pu16[0];
1289 uNewCs = uPtrFrame.pu16[1];
1290 }
1291 else if (enmEffOpSize == IEMMODE_32BIT)
1292 {
1293 uNewRip = uPtrFrame.pu32[0];
1294 uNewCs = uPtrFrame.pu16[2];
1295 }
1296 else
1297 {
1298 uNewRip = uPtrFrame.pu64[0];
1299 uNewCs = uPtrFrame.pu16[4];
1300 }
1301
1302 /*
1303 * Real mode and V8086 mode are easy.
1304 */
1305 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
1306 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
1307 {
1308 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1309 /** @todo check how this is supposed to work if sp=0xfffe. */
1310
1311 /* Check the limit of the new EIP. */
1312 /** @todo Intel pseudo code only does the limit check for 16-bit
1313 * operands, AMD does not make any distinction. What is right? */
1314 if (uNewRip > pCtx->cs.u32Limit)
1315 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1316
1317 /* commit the operation. */
1318 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1319 if (rcStrict != VINF_SUCCESS)
1320 return rcStrict;
1321 pCtx->rip = uNewRip;
1322 pCtx->cs.Sel = uNewCs;
1323 pCtx->cs.ValidSel = uNewCs;
1324 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1325 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
1326 /** @todo do we load attribs and limit as well? */
1327 if (cbPop)
1328 iemRegAddToRsp(pCtx, cbPop);
1329 return VINF_SUCCESS;
1330 }
1331
1332 /*
1333 * Protected mode is complicated, of course.
1334 */
1335 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
1336 {
1337 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
1338 return iemRaiseGeneralProtectionFault0(pIemCpu);
1339 }
1340
1341 /* Fetch the descriptor. */
1342 IEMSELDESC DescCs;
1343 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs);
1344 if (rcStrict != VINF_SUCCESS)
1345 return rcStrict;
1346
1347 /* Can only return to a code selector. */
1348 if ( !DescCs.Legacy.Gen.u1DescType
1349 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1350 {
1351 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1352 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
1353 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1354 }
1355
1356 /* L vs D. */
1357 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
1358 && DescCs.Legacy.Gen.u1DefBig
1359 && IEM_IS_LONG_MODE(pIemCpu))
1360 {
1361 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
1362 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1363 }
1364
1365 /* DPL/RPL/CPL checks. */
1366 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
1367 {
1368 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
1369 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1370 }
1371
1372 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1373 {
1374 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
1375 {
1376 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
1377 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1378 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1379 }
1380 }
1381 else
1382 {
1383 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
1384 {
1385 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
1386 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
1387 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1388 }
1389 }
1390
1391 /* Is it there? */
1392 if (!DescCs.Legacy.Gen.u1Present)
1393 {
1394 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
1395 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1396 }
1397
1398 /*
1399 * Return to outer privilege? (We'll typically have entered via a call gate.)
1400 */
1401 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
1402 {
1403 /* Read the return pointer, it comes before the parameters. */
1404 RTCPTRUNION uPtrStack;
1405 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
1406 if (rcStrict != VINF_SUCCESS)
1407 return rcStrict;
1408 uint16_t uNewOuterSs;
1409 uint64_t uNewOuterRsp;
1410 if (enmEffOpSize == IEMMODE_16BIT)
1411 {
1412 uNewOuterRsp = uPtrFrame.pu16[0];
1413 uNewOuterSs = uPtrFrame.pu16[1];
1414 }
1415 else if (enmEffOpSize == IEMMODE_32BIT)
1416 {
1417 uNewOuterRsp = uPtrFrame.pu32[0];
1418 uNewOuterSs = uPtrFrame.pu16[2];
1419 }
1420 else
1421 {
1422 uNewOuterRsp = uPtrFrame.pu64[0];
1423 uNewOuterSs = uPtrFrame.pu16[4];
1424 }
1425
1426 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
1427 and read the selector. */
1428 IEMSELDESC DescSs;
1429 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
1430 {
1431 if ( !DescCs.Legacy.Gen.u1Long
1432 || (uNewOuterSs & X86_SEL_RPL) == 3)
1433 {
1434 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
1435 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1436 return iemRaiseGeneralProtectionFault0(pIemCpu);
1437 }
1438 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
1439 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
1440 }
1441 else
1442 {
1443 /* Fetch the descriptor for the new stack segment. */
1444 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs);
1445 if (rcStrict != VINF_SUCCESS)
1446 return rcStrict;
1447 }
1448
1449 /* Check that RPL of stack and code selectors match. */
1450 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
1451 {
1452 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1453 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1454 }
1455
1456 /* Must be a writable data segment. */
1457 if ( !DescSs.Legacy.Gen.u1DescType
1458 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
1459 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
1460 {
1461 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
1462 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1463 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1464 }
1465
1466 /* L vs D. (Not mentioned by intel.) */
1467 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
1468 && DescSs.Legacy.Gen.u1DefBig
1469 && IEM_IS_LONG_MODE(pIemCpu))
1470 {
1471 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
1472 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
1473 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1474 }
1475
1476 /* DPL/RPL/CPL checks. */
1477 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
1478 {
1479 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
1480 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
1481 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
1482 }
1483
1484 /* Is it there? */
1485 if (!DescSs.Legacy.Gen.u1Present)
1486 {
1487 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1488 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
1489 }
1490
1491 /* Calc SS limit.*/
1492 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
1493
1494 /* Is RIP canonical or within CS.limit? */
1495 uint64_t u64Base;
1496 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1497
1498 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1499 {
1500 if (!IEM_IS_CANONICAL(uNewRip))
1501 {
1502 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
1503 return iemRaiseNotCanonical(pIemCpu);
1504 }
1505 u64Base = 0;
1506 }
1507 else
1508 {
1509 if (uNewRip > cbLimitCs)
1510 {
1511 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
1512 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
1513 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1514 }
1515 u64Base = X86DESC_BASE(&DescCs.Legacy);
1516 }
1517
1518 /*
1519 * Now set the accessed bit before
1520 * writing the return address to the stack and committing the result into
1521 * CS, CSHID and RIP.
1522 */
1523 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
1524 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1525 {
1526 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1527 if (rcStrict != VINF_SUCCESS)
1528 return rcStrict;
1529 /** @todo check what VT-x and AMD-V does. */
1530 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1531 }
1532 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
1533 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1534 {
1535 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
1536 if (rcStrict != VINF_SUCCESS)
1537 return rcStrict;
1538 /** @todo check what VT-x and AMD-V does. */
1539 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1540 }
1541
1542 /* commit */
1543 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1544 if (rcStrict != VINF_SUCCESS)
1545 return rcStrict;
1546 if (enmEffOpSize == IEMMODE_16BIT)
1547 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1548 else
1549 pCtx->rip = uNewRip;
1550 pCtx->cs.Sel = uNewCs;
1551 pCtx->cs.ValidSel = uNewCs;
1552 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1553 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1554 pCtx->cs.u32Limit = cbLimitCs;
1555 pCtx->cs.u64Base = u64Base;
1556 pCtx->rsp = uNewRsp;
1557 pCtx->ss.Sel = uNewOuterSs;
1558 pCtx->ss.ValidSel = uNewOuterSs;
1559 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1560 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
1561 pCtx->ss.u32Limit = cbLimitSs;
1562 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1563 pCtx->ss.u64Base = 0;
1564 else
1565 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
1566
1567 pIemCpu->uCpl = (uNewCs & X86_SEL_RPL);
1568 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
1569 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
1570 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
1571 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
1572
1573 /** @todo check if the hidden bits are loaded correctly for 64-bit
1574 * mode. */
1575
1576 if (cbPop)
1577 iemRegAddToRsp(pCtx, cbPop);
1578
1579 /* Done! */
1580 }
1581 /*
1582 * Return to the same privilege level
1583 */
1584 else
1585 {
1586 /* Limit / canonical check. */
1587 uint64_t u64Base;
1588 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
1589
1590 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
1591 {
1592 if (!IEM_IS_CANONICAL(uNewRip))
1593 {
1594 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
1595 return iemRaiseNotCanonical(pIemCpu);
1596 }
1597 u64Base = 0;
1598 }
1599 else
1600 {
1601 if (uNewRip > cbLimitCs)
1602 {
1603 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
1604 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
1605 }
1606 u64Base = X86DESC_BASE(&DescCs.Legacy);
1607 }
1608
1609 /*
1610 * Now set the accessed bit before
1611 * writing the return address to the stack and committing the result into
1612 * CS, CSHID and RIP.
1613 */
1614 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1615 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1616 {
1617 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
1618 if (rcStrict != VINF_SUCCESS)
1619 return rcStrict;
1620 /** @todo check what VT-x and AMD-V does. */
1621 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1622 }
1623
1624 /* commit */
1625 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
1626 if (rcStrict != VINF_SUCCESS)
1627 return rcStrict;
1628 if (enmEffOpSize == IEMMODE_16BIT)
1629 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
1630 else
1631 pCtx->rip = uNewRip;
1632 pCtx->cs.Sel = uNewCs;
1633 pCtx->cs.ValidSel = uNewCs;
1634 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1635 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
1636 pCtx->cs.u32Limit = cbLimitCs;
1637 pCtx->cs.u64Base = u64Base;
1638 /** @todo check if the hidden bits are loaded correctly for 64-bit
1639 * mode. */
1640 if (cbPop)
1641 iemRegAddToRsp(pCtx, cbPop);
1642 }
1643 return VINF_SUCCESS;
1644}
1645
1646
1647/**
1648 * Implements retn.
1649 *
1650 * We're doing this in C because of the \#GP that might be raised if the popped
1651 * program counter is out of bounds.
1652 *
1653 * @param enmEffOpSize The effective operand size.
1654 * @param cbPop The amount of arguments to pop from the stack
1655 * (bytes).
1656 */
1657IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
1658{
1659 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1660 NOREF(cbInstr);
1661
1662 /* Fetch the RSP from the stack. */
1663 VBOXSTRICTRC rcStrict;
1664 RTUINT64U NewRip;
1665 RTUINT64U NewRsp;
1666 NewRsp.u = pCtx->rsp;
1667 switch (enmEffOpSize)
1668 {
1669 case IEMMODE_16BIT:
1670 NewRip.u = 0;
1671 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
1672 break;
1673 case IEMMODE_32BIT:
1674 NewRip.u = 0;
1675 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
1676 break;
1677 case IEMMODE_64BIT:
1678 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
1679 break;
1680 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1681 }
1682 if (rcStrict != VINF_SUCCESS)
1683 return rcStrict;
1684
1685 /* Check the new RSP before loading it. */
1686 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
1687 * of it. The canonical test is performed here and for call. */
1688 if (enmEffOpSize != IEMMODE_64BIT)
1689 {
1690 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
1691 {
1692 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
1693 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1694 }
1695 }
1696 else
1697 {
1698 if (!IEM_IS_CANONICAL(NewRip.u))
1699 {
1700 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
1701 return iemRaiseNotCanonical(pIemCpu);
1702 }
1703 }
1704
1705 /* Commit it. */
1706 pCtx->rip = NewRip.u;
1707 pCtx->rsp = NewRsp.u;
1708 if (cbPop)
1709 iemRegAddToRsp(pCtx, cbPop);
1710
1711 return VINF_SUCCESS;
1712}
1713
1714
1715/**
1716 * Implements enter.
1717 *
1718 * We're doing this in C because the instruction is insane, even for the
1719 * u8NestingLevel=0 case dealing with the stack is tedious.
1720 *
1721 * @param enmEffOpSize The effective operand size.
1722 */
1723IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
1724{
1725 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1726
1727 /* Push RBP, saving the old value in TmpRbp. */
1728 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
1729 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
1730 RTUINT64U NewRbp;
1731 VBOXSTRICTRC rcStrict;
1732 if (enmEffOpSize == IEMMODE_64BIT)
1733 {
1734 rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
1735 NewRbp = NewRsp;
1736 }
1737 else if (pCtx->ss.Attr.n.u1DefBig)
1738 {
1739 rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
1740 NewRbp = NewRsp;
1741 }
1742 else
1743 {
1744 rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
1745 NewRbp = TmpRbp;
1746 NewRbp.Words.w0 = NewRsp.Words.w0;
1747 }
1748 if (rcStrict != VINF_SUCCESS)
1749 return rcStrict;
1750
1751 /* Copy the parameters (aka nesting levels by Intel). */
1752 cParameters &= 0x1f;
1753 if (cParameters > 0)
1754 {
1755 switch (enmEffOpSize)
1756 {
1757 case IEMMODE_16BIT:
1758 if (pCtx->ss.Attr.n.u1DefBig)
1759 TmpRbp.DWords.dw0 -= 2;
1760 else
1761 TmpRbp.Words.w0 -= 2;
1762 do
1763 {
1764 uint16_t u16Tmp;
1765 rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
1766 if (rcStrict != VINF_SUCCESS)
1767 break;
1768 rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
1769 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1770 break;
1771
1772 case IEMMODE_32BIT:
1773 if (pCtx->ss.Attr.n.u1DefBig)
1774 TmpRbp.DWords.dw0 -= 4;
1775 else
1776 TmpRbp.Words.w0 -= 4;
1777 do
1778 {
1779 uint32_t u32Tmp;
1780 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
1781 if (rcStrict != VINF_SUCCESS)
1782 break;
1783 rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
1784 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1785 break;
1786
1787 case IEMMODE_64BIT:
1788 TmpRbp.u -= 8;
1789 do
1790 {
1791 uint64_t u64Tmp;
1792 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
1793 if (rcStrict != VINF_SUCCESS)
1794 break;
1795 rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
1796 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
1797 break;
1798
1799 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1800 }
1801 if (rcStrict != VINF_SUCCESS)
1802 return VINF_SUCCESS;
1803
1804 /* Push the new RBP */
1805 if (enmEffOpSize == IEMMODE_64BIT)
1806 rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
1807 else if (pCtx->ss.Attr.n.u1DefBig)
1808 rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
1809 else
1810 rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
1811 if (rcStrict != VINF_SUCCESS)
1812 return rcStrict;
1813
1814 }
1815
1816 /* Recalc RSP. */
1817 iemRegSubFromRspEx(&NewRsp, cbFrame, pCtx);
1818
1819 /** @todo Should probe write access at the new RSP according to AMD. */
1820
1821 /* Commit it. */
1822 pCtx->rbp = NewRbp.u;
1823 pCtx->rsp = NewRsp.u;
1824 iemRegAddToRip(pIemCpu, cbInstr);
1825
1826 return VINF_SUCCESS;
1827}
1828
1829
1830
1831/**
1832 * Implements leave.
1833 *
1834 * We're doing this in C because messing with the stack registers is annoying
1835 * since they depends on SS attributes.
1836 *
1837 * @param enmEffOpSize The effective operand size.
1838 */
1839IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
1840{
1841 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1842
1843 /* Calculate the intermediate RSP from RBP and the stack attributes. */
1844 RTUINT64U NewRsp;
1845 if (pCtx->ss.Attr.n.u1Long)
1846 NewRsp.u = pCtx->rbp;
1847 else if (pCtx->ss.Attr.n.u1DefBig)
1848 NewRsp.u = pCtx->ebp;
1849 else
1850 {
1851 /** @todo Check that LEAVE actually preserve the high EBP bits. */
1852 NewRsp.u = pCtx->rsp;
1853 NewRsp.Words.w0 = pCtx->bp;
1854 }
1855
1856 /* Pop RBP according to the operand size. */
1857 VBOXSTRICTRC rcStrict;
1858 RTUINT64U NewRbp;
1859 switch (enmEffOpSize)
1860 {
1861 case IEMMODE_16BIT:
1862 NewRbp.u = pCtx->rbp;
1863 rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
1864 break;
1865 case IEMMODE_32BIT:
1866 NewRbp.u = 0;
1867 rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
1868 break;
1869 case IEMMODE_64BIT:
1870 rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
1871 break;
1872 IEM_NOT_REACHED_DEFAULT_CASE_RET();
1873 }
1874 if (rcStrict != VINF_SUCCESS)
1875 return rcStrict;
1876
1877
1878 /* Commit it. */
1879 pCtx->rbp = NewRbp.u;
1880 pCtx->rsp = NewRsp.u;
1881 iemRegAddToRip(pIemCpu, cbInstr);
1882
1883 return VINF_SUCCESS;
1884}
1885
1886
1887/**
1888 * Implements int3 and int XX.
1889 *
1890 * @param u8Int The interrupt vector number.
1891 * @param fIsBpInstr Is it the breakpoint instruction.
1892 */
1893IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
1894{
1895 Assert(pIemCpu->cXcptRecursions == 0);
1896 return iemRaiseXcptOrInt(pIemCpu,
1897 cbInstr,
1898 u8Int,
1899 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
1900 0,
1901 0);
1902}
1903
1904
1905/**
1906 * Implements iret for real mode and V8086 mode.
1907 *
1908 * @param enmEffOpSize The effective operand size.
1909 */
1910IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
1911{
1912 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
1913 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
1914 X86EFLAGS Efl;
1915 Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
1916 NOREF(cbInstr);
1917
1918 /*
1919 * iret throws an exception if VME isn't enabled.
1920 */
1921 if ( pCtx->eflags.Bits.u1VM
1922 && !(pCtx->cr4 & X86_CR4_VME))
1923 return iemRaiseGeneralProtectionFault0(pIemCpu);
1924
1925 /*
1926 * Do the stack bits, but don't commit RSP before everything checks
1927 * out right.
1928 */
1929 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
1930 VBOXSTRICTRC rcStrict;
1931 RTCPTRUNION uFrame;
1932 uint16_t uNewCs;
1933 uint32_t uNewEip;
1934 uint32_t uNewFlags;
1935 uint64_t uNewRsp;
1936 if (enmEffOpSize == IEMMODE_32BIT)
1937 {
1938 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
1939 if (rcStrict != VINF_SUCCESS)
1940 return rcStrict;
1941 uNewEip = uFrame.pu32[0];
1942 uNewCs = (uint16_t)uFrame.pu32[1];
1943 uNewFlags = uFrame.pu32[2];
1944 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1945 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
1946 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
1947 | X86_EFL_ID;
1948 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
1949 }
1950 else
1951 {
1952 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
1953 if (rcStrict != VINF_SUCCESS)
1954 return rcStrict;
1955 uNewEip = uFrame.pu16[0];
1956 uNewCs = uFrame.pu16[1];
1957 uNewFlags = uFrame.pu16[2];
1958 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
1959 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
1960 uNewFlags |= Efl.u & (UINT32_C(0xffff0000) | X86_EFL_1);
1961 /** @todo The intel pseudo code does not indicate what happens to
1962 * reserved flags. We just ignore them. */
1963 }
1964 /** @todo Check how this is supposed to work if sp=0xfffe. */
1965
1966 /*
1967 * Check the limit of the new EIP.
1968 */
1969 /** @todo Only the AMD pseudo code check the limit here, what's
1970 * right? */
1971 if (uNewEip > pCtx->cs.u32Limit)
1972 return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
1973
1974 /*
1975 * V8086 checks and flag adjustments
1976 */
1977 if (Efl.Bits.u1VM)
1978 {
1979 if (Efl.Bits.u2IOPL == 3)
1980 {
1981 /* Preserve IOPL and clear RF. */
1982 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
1983 uNewFlags |= Efl.u & (X86_EFL_IOPL);
1984 }
1985 else if ( enmEffOpSize == IEMMODE_16BIT
1986 && ( !(uNewFlags & X86_EFL_IF)
1987 || !Efl.Bits.u1VIP )
1988 && !(uNewFlags & X86_EFL_TF) )
1989 {
1990 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
1991 uNewFlags &= ~X86_EFL_VIF;
1992 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
1993 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
1994 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
1995 }
1996 else
1997 return iemRaiseGeneralProtectionFault0(pIemCpu);
1998 }
1999
2000 /*
2001 * Commit the operation.
2002 */
2003 rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
2004 if (rcStrict != VINF_SUCCESS)
2005 return rcStrict;
2006 pCtx->rip = uNewEip;
2007 pCtx->cs.Sel = uNewCs;
2008 pCtx->cs.ValidSel = uNewCs;
2009 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2010 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2011 /** @todo do we load attribs and limit as well? */
2012 Assert(uNewFlags & X86_EFL_1);
2013 IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
2014
2015 return VINF_SUCCESS;
2016}
2017
2018
2019/**
2020 * Loads a segment register when entering V8086 mode.
2021 *
2022 * @param pSReg The segment register.
2023 * @param uSeg The segment to load.
2024 */
2025static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2026{
2027 pSReg->Sel = uSeg;
2028 pSReg->ValidSel = uSeg;
2029 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2030 pSReg->u64Base = (uint32_t)uSeg << 4;
2031 pSReg->u32Limit = 0xffff;
2032 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2033 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2034 * IRET'ing to V8086. */
2035}
2036
2037
2038/**
2039 * Implements iret for protected mode returning to V8086 mode.
2040 *
2041 * @param pCtx Pointer to the CPU context.
2042 * @param uNewEip The new EIP.
2043 * @param uNewCs The new CS.
2044 * @param uNewFlags The new EFLAGS.
2045 * @param uNewRsp The RSP after the initial IRET frame.
2046 */
2047IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
2048 uint32_t, uNewFlags, uint64_t, uNewRsp)
2049{
2050#if 0
2051 if (!LogIs6Enabled())
2052 {
2053 RTLogGroupSettings(NULL, "iem.eo.l6.l2");
2054 RTLogFlags(NULL, "enabled");
2055 return VERR_IEM_RESTART_INSTRUCTION;
2056 }
2057#endif
2058
2059 /*
2060 * Pop the V8086 specific frame bits off the stack.
2061 */
2062 VBOXSTRICTRC rcStrict;
2063 RTCPTRUNION uFrame;
2064 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
2065 if (rcStrict != VINF_SUCCESS)
2066 return rcStrict;
2067 uint32_t uNewEsp = uFrame.pu32[0];
2068 uint16_t uNewSs = uFrame.pu32[1];
2069 uint16_t uNewEs = uFrame.pu32[2];
2070 uint16_t uNewDs = uFrame.pu32[3];
2071 uint16_t uNewFs = uFrame.pu32[4];
2072 uint16_t uNewGs = uFrame.pu32[5];
2073 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2074 if (rcStrict != VINF_SUCCESS)
2075 return rcStrict;
2076
2077 /*
2078 * Commit the operation.
2079 */
2080 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
2081 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
2082 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
2083 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
2084 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
2085 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
2086 pCtx->rip = uNewEip;
2087 pCtx->rsp = uNewEsp;
2088 pCtx->rflags.u = uNewFlags;
2089 pIemCpu->uCpl = 3;
2090
2091 return VINF_SUCCESS;
2092}
2093
2094
2095/**
2096 * Implements iret for protected mode returning via a nested task.
2097 *
2098 * @param enmEffOpSize The effective operand size.
2099 */
2100IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
2101{
2102 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2103}
2104
2105
2106/**
2107 * Implements iret for protected mode
2108 *
2109 * @param enmEffOpSize The effective operand size.
2110 */
2111IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
2112{
2113 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2114 NOREF(cbInstr);
2115
2116 /*
2117 * Nested task return.
2118 */
2119 if (pCtx->eflags.Bits.u1NT)
2120 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
2121
2122 /*
2123 * Normal return.
2124 *
2125 * Do the stack bits, but don't commit RSP before everything checks
2126 * out right.
2127 */
2128 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2129 VBOXSTRICTRC rcStrict;
2130 RTCPTRUNION uFrame;
2131 uint16_t uNewCs;
2132 uint32_t uNewEip;
2133 uint32_t uNewFlags;
2134 uint64_t uNewRsp;
2135 if (enmEffOpSize == IEMMODE_32BIT)
2136 {
2137 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
2138 if (rcStrict != VINF_SUCCESS)
2139 return rcStrict;
2140 uNewEip = uFrame.pu32[0];
2141 uNewCs = (uint16_t)uFrame.pu32[1];
2142 uNewFlags = uFrame.pu32[2];
2143 }
2144 else
2145 {
2146 rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
2147 if (rcStrict != VINF_SUCCESS)
2148 return rcStrict;
2149 uNewEip = uFrame.pu16[0];
2150 uNewCs = uFrame.pu16[1];
2151 uNewFlags = uFrame.pu16[2];
2152 }
2153 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
2154 if (rcStrict != VINF_SUCCESS)
2155 return rcStrict;
2156
2157 /*
2158 * We're hopefully not returning to V8086 mode...
2159 */
2160 if ( (uNewFlags & X86_EFL_VM)
2161 && pIemCpu->uCpl == 0)
2162 {
2163 Assert(enmEffOpSize == IEMMODE_32BIT);
2164 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
2165 }
2166
2167 /*
2168 * Protected mode.
2169 */
2170 /* Read the CS descriptor. */
2171 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2172 {
2173 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
2174 return iemRaiseGeneralProtectionFault0(pIemCpu);
2175 }
2176
2177 IEMSELDESC DescCS;
2178 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs);
2179 if (rcStrict != VINF_SUCCESS)
2180 {
2181 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
2182 return rcStrict;
2183 }
2184
2185 /* Must be a code descriptor. */
2186 if (!DescCS.Legacy.Gen.u1DescType)
2187 {
2188 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2189 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2190 }
2191 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2192 {
2193 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
2194 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2195 }
2196
2197 /* Privilege checks. */
2198 if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
2199 {
2200 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
2201 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2202 }
2203 if ( (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2204 && (uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
2205 {
2206 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
2207 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
2208 }
2209
2210 /* Present? */
2211 if (!DescCS.Legacy.Gen.u1Present)
2212 {
2213 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
2214 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
2215 }
2216
2217 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
2218
2219 /*
2220 * Return to outer level?
2221 */
2222 if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
2223 {
2224 uint16_t uNewSS;
2225 uint32_t uNewESP;
2226 if (enmEffOpSize == IEMMODE_32BIT)
2227 {
2228 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2229 if (rcStrict != VINF_SUCCESS)
2230 return rcStrict;
2231 uNewESP = uFrame.pu32[0];
2232 uNewSS = (uint16_t)uFrame.pu32[1];
2233 }
2234 else
2235 {
2236 rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
2237 if (rcStrict != VINF_SUCCESS)
2238 return rcStrict;
2239 uNewESP = uFrame.pu16[0];
2240 uNewSS = uFrame.pu16[1];
2241 }
2242 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
2243 if (rcStrict != VINF_SUCCESS)
2244 return rcStrict;
2245
2246 /* Read the SS descriptor. */
2247 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
2248 {
2249 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
2250 return iemRaiseGeneralProtectionFault0(pIemCpu);
2251 }
2252
2253 IEMSELDESC DescSS;
2254 rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS);
2255 if (rcStrict != VINF_SUCCESS)
2256 {
2257 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
2258 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
2259 return rcStrict;
2260 }
2261
2262 /* Privilege checks. */
2263 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
2264 {
2265 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
2266 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2267 }
2268 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2269 {
2270 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
2271 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
2272 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2273 }
2274
2275 /* Must be a writeable data segment descriptor. */
2276 if (!DescSS.Legacy.Gen.u1DescType)
2277 {
2278 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
2279 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2280 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2281 }
2282 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
2283 {
2284 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
2285 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
2286 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
2287 }
2288
2289 /* Present? */
2290 if (!DescSS.Legacy.Gen.u1Present)
2291 {
2292 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
2293 return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
2294 }
2295
2296 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
2297
2298 /* Check EIP. */
2299 if (uNewEip > cbLimitCS)
2300 {
2301 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
2302 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
2303 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2304 }
2305
2306 /*
2307 * Commit the changes, marking CS and SS accessed first since
2308 * that may fail.
2309 */
2310 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2311 {
2312 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2313 if (rcStrict != VINF_SUCCESS)
2314 return rcStrict;
2315 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2316 }
2317 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2318 {
2319 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
2320 if (rcStrict != VINF_SUCCESS)
2321 return rcStrict;
2322 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2323 }
2324
2325 pCtx->rip = uNewEip;
2326 pCtx->cs.Sel = uNewCs;
2327 pCtx->cs.ValidSel = uNewCs;
2328 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2329 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2330 pCtx->cs.u32Limit = cbLimitCS;
2331 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2332 pCtx->rsp = uNewESP;
2333 pCtx->ss.Sel = uNewSS;
2334 pCtx->ss.ValidSel = uNewSS;
2335 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2336 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
2337 pCtx->ss.u32Limit = cbLimitSs;
2338 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
2339
2340 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2341 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
2342 if (enmEffOpSize != IEMMODE_16BIT)
2343 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
2344 if (pIemCpu->uCpl == 0)
2345 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
2346 else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
2347 fEFlagsMask |= X86_EFL_IF;
2348 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
2349 fEFlagsNew &= ~fEFlagsMask;
2350 fEFlagsNew |= uNewFlags & fEFlagsMask;
2351 IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
2352
2353 pIemCpu->uCpl = uNewCs & X86_SEL_RPL;
2354 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2355 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2356 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2357 iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2358
2359 /* Done! */
2360
2361 }
2362 /*
2363 * Return to the same level.
2364 */
2365 else
2366 {
2367 /* Check EIP. */
2368 if (uNewEip > cbLimitCS)
2369 {
2370 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
2371 return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
2372 }
2373
2374 /*
2375 * Commit the changes, marking CS first since it may fail.
2376 */
2377 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2378 {
2379 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
2380 if (rcStrict != VINF_SUCCESS)
2381 return rcStrict;
2382 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2383 }
2384
2385 pCtx->rip = uNewEip;
2386 pCtx->cs.Sel = uNewCs;
2387 pCtx->cs.ValidSel = uNewCs;
2388 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2389 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
2390 pCtx->cs.u32Limit = cbLimitCS;
2391 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
2392 pCtx->rsp = uNewRsp;
2393
2394 X86EFLAGS NewEfl;
2395 NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
2396 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2397 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
2398 if (enmEffOpSize != IEMMODE_16BIT)
2399 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
2400 if (pIemCpu->uCpl == 0)
2401 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
2402 else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
2403 fEFlagsMask |= X86_EFL_IF;
2404 NewEfl.u &= ~fEFlagsMask;
2405 NewEfl.u |= fEFlagsMask & uNewFlags;
2406 IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
2407 /* Done! */
2408 }
2409 return VINF_SUCCESS;
2410}
2411
2412
2413/**
2414 * Implements iret for long mode
2415 *
2416 * @param enmEffOpSize The effective operand size.
2417 */
2418IEM_CIMPL_DEF_1(iemCImpl_iret_long, IEMMODE, enmEffOpSize)
2419{
2420 //PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2421 //VBOXSTRICTRC rcStrict;
2422 //uint64_t uNewRsp;
2423
2424 NOREF(pIemCpu); NOREF(cbInstr); NOREF(enmEffOpSize);
2425 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
2426}
2427
2428
2429/**
2430 * Implements iret.
2431 *
2432 * @param enmEffOpSize The effective operand size.
2433 */
2434IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
2435{
2436 /*
2437 * Call a mode specific worker.
2438 */
2439 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2440 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2441 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
2442 if (IEM_IS_LONG_MODE(pIemCpu))
2443 return IEM_CIMPL_CALL_1(iemCImpl_iret_long, enmEffOpSize);
2444
2445 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
2446}
2447
2448
2449/**
2450 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
2451 *
2452 * @param iSegReg The segment register number (valid).
2453 * @param uSel The new selector value.
2454 */
2455IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
2456{
2457 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
2458 uint16_t *pSel = iemSRegRef(pIemCpu, iSegReg);
2459 PCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iSegReg);
2460
2461 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
2462
2463 /*
2464 * Real mode and V8086 mode are easy.
2465 */
2466 if ( pIemCpu->enmCpuMode == IEMMODE_16BIT
2467 && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2468 {
2469 *pSel = uSel;
2470 pHid->u64Base = (uint32_t)uSel << 4;
2471 pHid->ValidSel = uSel;
2472 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2473#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
2474 /** @todo Does the CPU actually load limits and attributes in the
2475 * real/V8086 mode segment load case? It doesn't for CS in far
2476 * jumps... Affects unreal mode. */
2477 pHid->u32Limit = 0xffff;
2478 pHid->Attr.u = 0;
2479 pHid->Attr.n.u1Present = 1;
2480 pHid->Attr.n.u1DescType = 1;
2481 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
2482 ? X86_SEL_TYPE_RW
2483 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
2484#endif
2485 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2486 iemRegAddToRip(pIemCpu, cbInstr);
2487 return VINF_SUCCESS;
2488 }
2489
2490 /*
2491 * Protected mode.
2492 *
2493 * Check if it's a null segment selector value first, that's OK for DS, ES,
2494 * FS and GS. If not null, then we have to load and parse the descriptor.
2495 */
2496 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2497 {
2498 if (iSegReg == X86_SREG_SS)
2499 {
2500 if ( pIemCpu->enmCpuMode != IEMMODE_64BIT
2501 || pIemCpu->uCpl != 0
2502 || uSel != 0) /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? */
2503 {
2504 Log(("load sreg -> invalid stack selector, #GP(0)\n", uSel));
2505 return iemRaiseGeneralProtectionFault0(pIemCpu);
2506 }
2507
2508 /* In 64-bit kernel mode, the stack can be 0 because of the way
2509 interrupts are dispatched when in kernel ctx. Just load the
2510 selector value into the register and leave the hidden bits
2511 as is. */
2512 *pSel = uSel;
2513 pHid->ValidSel = uSel;
2514 iemRegAddToRip(pIemCpu, cbInstr);
2515 return VINF_SUCCESS;
2516 }
2517
2518 *pSel = uSel; /* Not RPL, remember :-) */
2519 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
2520 && iSegReg != X86_SREG_FS
2521 && iSegReg != X86_SREG_GS)
2522 {
2523 /** @todo figure out what this actually does, it works. Needs
2524 * testcase! */
2525 pHid->Attr.u = 0;
2526 pHid->Attr.n.u1Present = 1;
2527 pHid->Attr.n.u1Long = 1;
2528 pHid->Attr.n.u4Type = X86_SEL_TYPE_RW;
2529 pHid->Attr.n.u2Dpl = 3;
2530 pHid->u32Limit = 0;
2531 pHid->u64Base = 0;
2532 pHid->ValidSel = uSel;
2533 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2534 }
2535 else
2536 iemHlpLoadNullDataSelectorProt(pHid, uSel);
2537 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
2538 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2539
2540 iemRegAddToRip(pIemCpu, cbInstr);
2541 return VINF_SUCCESS;
2542 }
2543
2544 /* Fetch the descriptor. */
2545 IEMSELDESC Desc;
2546 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel);
2547 if (rcStrict != VINF_SUCCESS)
2548 return rcStrict;
2549
2550 /* Check GPs first. */
2551 if (!Desc.Legacy.Gen.u1DescType)
2552 {
2553 Log(("load sreg %d - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
2554 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2555 }
2556 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
2557 {
2558 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2559 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2560 {
2561 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
2562 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2563 }
2564 if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
2565 {
2566 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
2567 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2568 }
2569 if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
2570 {
2571 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
2572 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2573 }
2574 }
2575 else
2576 {
2577 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
2578 {
2579 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
2580 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2581 }
2582 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
2583 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
2584 {
2585#if 0 /* this is what intel says. */
2586 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
2587 && pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
2588 {
2589 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
2590 iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
2591 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2592 }
2593#else /* this is what makes more sense. */
2594 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
2595 {
2596 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
2597 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
2598 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2599 }
2600 if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
2601 {
2602 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
2603 iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
2604 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
2605 }
2606#endif
2607 }
2608 }
2609
2610 /* Is it there? */
2611 if (!Desc.Legacy.Gen.u1Present)
2612 {
2613 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
2614 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
2615 }
2616
2617 /* The base and limit. */
2618 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2619 uint64_t u64Base;
2620 if ( pIemCpu->enmCpuMode == IEMMODE_64BIT
2621 && iSegReg < X86_SREG_FS)
2622 u64Base = 0;
2623 else
2624 u64Base = X86DESC_BASE(&Desc.Legacy);
2625
2626 /*
2627 * Ok, everything checked out fine. Now set the accessed bit before
2628 * committing the result into the registers.
2629 */
2630 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2631 {
2632 rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
2633 if (rcStrict != VINF_SUCCESS)
2634 return rcStrict;
2635 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2636 }
2637
2638 /* commit */
2639 *pSel = uSel;
2640 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2641 pHid->u32Limit = cbLimit;
2642 pHid->u64Base = u64Base;
2643 pHid->ValidSel = uSel;
2644 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
2645
2646 /** @todo check if the hidden bits are loaded correctly for 64-bit
2647 * mode. */
2648 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
2649
2650 CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
2651 iemRegAddToRip(pIemCpu, cbInstr);
2652 return VINF_SUCCESS;
2653}
2654
2655
2656/**
2657 * Implements 'mov SReg, r/m'.
2658 *
2659 * @param iSegReg The segment register number (valid).
2660 * @param uSel The new selector value.
2661 */
2662IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
2663{
2664 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2665 if (rcStrict == VINF_SUCCESS)
2666 {
2667 if (iSegReg == X86_SREG_SS)
2668 {
2669 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2670 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
2671 }
2672 }
2673 return rcStrict;
2674}
2675
2676
2677/**
2678 * Implements 'pop SReg'.
2679 *
2680 * @param iSegReg The segment register number (valid).
2681 * @param enmEffOpSize The efficient operand size (valid).
2682 */
2683IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
2684{
2685 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2686 VBOXSTRICTRC rcStrict;
2687
2688 /*
2689 * Read the selector off the stack and join paths with mov ss, reg.
2690 */
2691 RTUINT64U TmpRsp;
2692 TmpRsp.u = pCtx->rsp;
2693 switch (enmEffOpSize)
2694 {
2695 case IEMMODE_16BIT:
2696 {
2697 uint16_t uSel;
2698 rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
2699 if (rcStrict == VINF_SUCCESS)
2700 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2701 break;
2702 }
2703
2704 case IEMMODE_32BIT:
2705 {
2706 uint32_t u32Value;
2707 rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
2708 if (rcStrict == VINF_SUCCESS)
2709 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
2710 break;
2711 }
2712
2713 case IEMMODE_64BIT:
2714 {
2715 uint64_t u64Value;
2716 rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
2717 if (rcStrict == VINF_SUCCESS)
2718 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
2719 break;
2720 }
2721 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2722 }
2723
2724 /*
2725 * Commit the stack on success.
2726 */
2727 if (rcStrict == VINF_SUCCESS)
2728 {
2729 pCtx->rsp = TmpRsp.u;
2730 if (iSegReg == X86_SREG_SS)
2731 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
2732 }
2733 return rcStrict;
2734}
2735
2736
2737/**
2738 * Implements lgs, lfs, les, lds & lss.
2739 */
2740IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
2741 uint16_t, uSel,
2742 uint64_t, offSeg,
2743 uint8_t, iSegReg,
2744 uint8_t, iGReg,
2745 IEMMODE, enmEffOpSize)
2746{
2747 /*PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);*/
2748 VBOXSTRICTRC rcStrict;
2749
2750 /*
2751 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
2752 */
2753 /** @todo verify and test that mov, pop and lXs works the segment
2754 * register loading in the exact same way. */
2755 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
2756 if (rcStrict == VINF_SUCCESS)
2757 {
2758 switch (enmEffOpSize)
2759 {
2760 case IEMMODE_16BIT:
2761 *(uint16_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
2762 break;
2763 case IEMMODE_32BIT:
2764 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
2765 break;
2766 case IEMMODE_64BIT:
2767 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
2768 break;
2769 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2770 }
2771 }
2772
2773 return rcStrict;
2774}
2775
2776
2777/**
2778 * Implements lgdt.
2779 *
2780 * @param iEffSeg The segment of the new ldtr contents
2781 * @param GCPtrEffSrc The address of the new ldtr contents.
2782 * @param enmEffOpSize The effective operand size.
2783 */
2784IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2785{
2786 if (pIemCpu->uCpl != 0)
2787 return iemRaiseGeneralProtectionFault0(pIemCpu);
2788 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2789
2790 /*
2791 * Fetch the limit and base address.
2792 */
2793 uint16_t cbLimit;
2794 RTGCPTR GCPtrBase;
2795 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2796 if (rcStrict == VINF_SUCCESS)
2797 {
2798 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
2799 rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2800 else
2801 {
2802 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2803 pCtx->gdtr.cbGdt = cbLimit;
2804 pCtx->gdtr.pGdt = GCPtrBase;
2805 }
2806 if (rcStrict == VINF_SUCCESS)
2807 iemRegAddToRip(pIemCpu, cbInstr);
2808 }
2809 return rcStrict;
2810}
2811
2812
2813/**
2814 * Implements sgdt.
2815 *
2816 * @param iEffSeg The segment where to store the gdtr content.
2817 * @param GCPtrEffDst The address where to store the gdtr content.
2818 * @param enmEffOpSize The effective operand size.
2819 */
2820IEM_CIMPL_DEF_3(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
2821{
2822 /*
2823 * Join paths with sidt.
2824 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
2825 * you really must know.
2826 */
2827 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2828 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
2829 if (rcStrict == VINF_SUCCESS)
2830 iemRegAddToRip(pIemCpu, cbInstr);
2831 return rcStrict;
2832}
2833
2834
2835/**
2836 * Implements lidt.
2837 *
2838 * @param iEffSeg The segment of the new ldtr contents
2839 * @param GCPtrEffSrc The address of the new ldtr contents.
2840 * @param enmEffOpSize The effective operand size.
2841 */
2842IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
2843{
2844 if (pIemCpu->uCpl != 0)
2845 return iemRaiseGeneralProtectionFault0(pIemCpu);
2846 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
2847
2848 /*
2849 * Fetch the limit and base address.
2850 */
2851 uint16_t cbLimit;
2852 RTGCPTR GCPtrBase;
2853 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
2854 if (rcStrict == VINF_SUCCESS)
2855 {
2856 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
2857 CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
2858 else
2859 {
2860 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2861 pCtx->idtr.cbIdt = cbLimit;
2862 pCtx->idtr.pIdt = GCPtrBase;
2863 }
2864 iemRegAddToRip(pIemCpu, cbInstr);
2865 }
2866 return rcStrict;
2867}
2868
2869
2870/**
2871 * Implements sidt.
2872 *
2873 * @param iEffSeg The segment where to store the idtr content.
2874 * @param GCPtrEffDst The address where to store the idtr content.
2875 * @param enmEffOpSize The effective operand size.
2876 */
2877IEM_CIMPL_DEF_3(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst, IEMMODE, enmEffOpSize)
2878{
2879 /*
2880 * Join paths with sgdt.
2881 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
2882 * you really must know.
2883 */
2884 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2885 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst, enmEffOpSize);
2886 if (rcStrict == VINF_SUCCESS)
2887 iemRegAddToRip(pIemCpu, cbInstr);
2888 return rcStrict;
2889}
2890
2891
2892/**
2893 * Implements lldt.
2894 *
2895 * @param uNewLdt The new LDT selector value.
2896 */
2897IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
2898{
2899 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
2900
2901 /*
2902 * Check preconditions.
2903 */
2904 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
2905 {
2906 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
2907 return iemRaiseUndefinedOpcode(pIemCpu);
2908 }
2909 if (pIemCpu->uCpl != 0)
2910 {
2911 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
2912 return iemRaiseGeneralProtectionFault0(pIemCpu);
2913 }
2914 if (uNewLdt & X86_SEL_LDT)
2915 {
2916 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
2917 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
2918 }
2919
2920 /*
2921 * Now, loading a NULL selector is easy.
2922 */
2923 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
2924 {
2925 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
2926 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
2927 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
2928 else
2929 pCtx->ldtr.Sel = uNewLdt;
2930 pCtx->ldtr.ValidSel = uNewLdt;
2931 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
2932 if (IEM_IS_GUEST_CPU_AMD(pIemCpu) && !IEM_VERIFICATION_ENABLED(pIemCpu))
2933 pCtx->ldtr.Attr.u = 0;
2934 else
2935 {
2936 pCtx->ldtr.u64Base = 0;
2937 pCtx->ldtr.u32Limit = 0;
2938 }
2939
2940 iemRegAddToRip(pIemCpu, cbInstr);
2941 return VINF_SUCCESS;
2942 }
2943
2944 /*
2945 * Read the descriptor.
2946 */
2947 IEMSELDESC Desc;
2948 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt);
2949 if (rcStrict != VINF_SUCCESS)
2950 return rcStrict;
2951
2952 /* Check GPs first. */
2953 if (Desc.Legacy.Gen.u1DescType)
2954 {
2955 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2956 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2957 }
2958 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
2959 {
2960 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
2961 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2962 }
2963 uint64_t u64Base;
2964 if (!IEM_IS_LONG_MODE(pIemCpu))
2965 u64Base = X86DESC_BASE(&Desc.Legacy);
2966 else
2967 {
2968 if (Desc.Long.Gen.u5Zeros)
2969 {
2970 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
2971 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2972 }
2973
2974 u64Base = X86DESC64_BASE(&Desc.Long);
2975 if (!IEM_IS_CANONICAL(u64Base))
2976 {
2977 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
2978 return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
2979 }
2980 }
2981
2982 /* NP */
2983 if (!Desc.Legacy.Gen.u1Present)
2984 {
2985 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
2986 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
2987 }
2988
2989 /*
2990 * It checks out alright, update the registers.
2991 */
2992/** @todo check if the actual value is loaded or if the RPL is dropped */
2993 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
2994 CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
2995 else
2996 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
2997 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
2998 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
2999 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3000 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3001 pCtx->ldtr.u64Base = u64Base;
3002
3003 iemRegAddToRip(pIemCpu, cbInstr);
3004 return VINF_SUCCESS;
3005}
3006
3007
3008/**
3009 * Implements lldt.
3010 *
3011 * @param uNewLdt The new LDT selector value.
3012 */
3013IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
3014{
3015 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3016
3017 /*
3018 * Check preconditions.
3019 */
3020 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
3021 {
3022 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
3023 return iemRaiseUndefinedOpcode(pIemCpu);
3024 }
3025 if (pIemCpu->uCpl != 0)
3026 {
3027 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
3028 return iemRaiseGeneralProtectionFault0(pIemCpu);
3029 }
3030 if (uNewTr & X86_SEL_LDT)
3031 {
3032 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
3033 return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
3034 }
3035 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
3036 {
3037 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
3038 return iemRaiseGeneralProtectionFault0(pIemCpu);
3039 }
3040
3041 /*
3042 * Read the descriptor.
3043 */
3044 IEMSELDESC Desc;
3045 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr);
3046 if (rcStrict != VINF_SUCCESS)
3047 return rcStrict;
3048
3049 /* Check GPs first. */
3050 if (Desc.Legacy.Gen.u1DescType)
3051 {
3052 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3053 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3054 }
3055 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
3056 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
3057 || IEM_IS_LONG_MODE(pIemCpu)) )
3058 {
3059 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
3060 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3061 }
3062 uint64_t u64Base;
3063 if (!IEM_IS_LONG_MODE(pIemCpu))
3064 u64Base = X86DESC_BASE(&Desc.Legacy);
3065 else
3066 {
3067 if (Desc.Long.Gen.u5Zeros)
3068 {
3069 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
3070 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3071 }
3072
3073 u64Base = X86DESC64_BASE(&Desc.Long);
3074 if (!IEM_IS_CANONICAL(u64Base))
3075 {
3076 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
3077 return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
3078 }
3079 }
3080
3081 /* NP */
3082 if (!Desc.Legacy.Gen.u1Present)
3083 {
3084 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
3085 return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
3086 }
3087
3088 /*
3089 * Set it busy.
3090 * Note! Intel says this should lock down the whole descriptor, but we'll
3091 * restrict our selves to 32-bit for now due to lack of inline
3092 * assembly and such.
3093 */
3094 void *pvDesc;
3095 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
3096 if (rcStrict != VINF_SUCCESS)
3097 return rcStrict;
3098 switch ((uintptr_t)pvDesc & 3)
3099 {
3100 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
3101 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
3102 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 16); break;
3103 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 8); break;
3104 }
3105 rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt, IEM_ACCESS_DATA_RW);
3106 if (rcStrict != VINF_SUCCESS)
3107 return rcStrict;
3108 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
3109
3110 /*
3111 * It checks out alright, update the registers.
3112 */
3113/** @todo check if the actual value is loaded or if the RPL is dropped */
3114 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3115 CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
3116 else
3117 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
3118 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
3119 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
3120 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
3121 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
3122 pCtx->tr.u64Base = u64Base;
3123
3124 iemRegAddToRip(pIemCpu, cbInstr);
3125 return VINF_SUCCESS;
3126}
3127
3128
3129/**
3130 * Implements mov GReg,CRx.
3131 *
3132 * @param iGReg The general register to store the CRx value in.
3133 * @param iCrReg The CRx register to read (valid).
3134 */
3135IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
3136{
3137 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3138 if (pIemCpu->uCpl != 0)
3139 return iemRaiseGeneralProtectionFault0(pIemCpu);
3140 Assert(!pCtx->eflags.Bits.u1VM);
3141
3142 /* read it */
3143 uint64_t crX;
3144 switch (iCrReg)
3145 {
3146 case 0: crX = pCtx->cr0; break;
3147 case 2: crX = pCtx->cr2; break;
3148 case 3: crX = pCtx->cr3; break;
3149 case 4: crX = pCtx->cr4; break;
3150 case 8:
3151 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3152 IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement CR8/TPR read\n")); /** @todo implement CR8 reading and writing. */
3153 else
3154 crX = 0xff;
3155 break;
3156 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3157 }
3158
3159 /* store it */
3160 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3161 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = crX;
3162 else
3163 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
3164
3165 iemRegAddToRip(pIemCpu, cbInstr);
3166 return VINF_SUCCESS;
3167}
3168
3169
3170/**
3171 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
3172 *
3173 * @param iCrReg The CRx register to write (valid).
3174 * @param uNewCrX The new value.
3175 */
3176IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
3177{
3178 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3179 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3180 VBOXSTRICTRC rcStrict;
3181 int rc;
3182
3183 /*
3184 * Try store it.
3185 * Unfortunately, CPUM only does a tiny bit of the work.
3186 */
3187 switch (iCrReg)
3188 {
3189 case 0:
3190 {
3191 /*
3192 * Perform checks.
3193 */
3194 uint64_t const uOldCrX = pCtx->cr0;
3195 uNewCrX |= X86_CR0_ET; /* hardcoded */
3196
3197 /* Check for reserved bits. */
3198 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
3199 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
3200 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
3201 if (uNewCrX & ~(uint64_t)fValid)
3202 {
3203 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
3204 return iemRaiseGeneralProtectionFault0(pIemCpu);
3205 }
3206
3207 /* Check for invalid combinations. */
3208 if ( (uNewCrX & X86_CR0_PG)
3209 && !(uNewCrX & X86_CR0_PE) )
3210 {
3211 Log(("Trying to set CR0.PG without CR0.PE\n"));
3212 return iemRaiseGeneralProtectionFault0(pIemCpu);
3213 }
3214
3215 if ( !(uNewCrX & X86_CR0_CD)
3216 && (uNewCrX & X86_CR0_NW) )
3217 {
3218 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
3219 return iemRaiseGeneralProtectionFault0(pIemCpu);
3220 }
3221
3222 /* Long mode consistency checks. */
3223 if ( (uNewCrX & X86_CR0_PG)
3224 && !(uOldCrX & X86_CR0_PG)
3225 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
3226 {
3227 if (!(pCtx->cr4 & X86_CR4_PAE))
3228 {
3229 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
3230 return iemRaiseGeneralProtectionFault0(pIemCpu);
3231 }
3232 if (pCtx->cs.Attr.n.u1Long)
3233 {
3234 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
3235 return iemRaiseGeneralProtectionFault0(pIemCpu);
3236 }
3237 }
3238
3239 /** @todo check reserved PDPTR bits as AMD states. */
3240
3241 /*
3242 * Change CR0.
3243 */
3244 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3245 CPUMSetGuestCR0(pVCpu, uNewCrX);
3246 else
3247 pCtx->cr0 = uNewCrX;
3248 Assert(pCtx->cr0 == uNewCrX);
3249
3250 /*
3251 * Change EFER.LMA if entering or leaving long mode.
3252 */
3253 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
3254 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
3255 {
3256 uint64_t NewEFER = pCtx->msrEFER;
3257 if (uNewCrX & X86_CR0_PG)
3258 NewEFER |= MSR_K6_EFER_LME;
3259 else
3260 NewEFER &= ~MSR_K6_EFER_LME;
3261
3262 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3263 CPUMSetGuestEFER(pVCpu, NewEFER);
3264 else
3265 pCtx->msrEFER = NewEFER;
3266 Assert(pCtx->msrEFER == NewEFER);
3267 }
3268
3269 /*
3270 * Inform PGM.
3271 */
3272 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3273 {
3274 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
3275 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
3276 {
3277 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
3278 AssertRCReturn(rc, rc);
3279 /* ignore informational status codes */
3280 }
3281 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
3282 }
3283 else
3284 rcStrict = VINF_SUCCESS;
3285
3286#ifdef IN_RC
3287 /* Return to ring-3 for rescheduling if WP or AM changes. */
3288 if ( rcStrict == VINF_SUCCESS
3289 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
3290 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
3291 rcStrict = VINF_EM_RESCHEDULE;
3292#endif
3293 break;
3294 }
3295
3296 /*
3297 * CR2 can be changed without any restrictions.
3298 */
3299 case 2:
3300 pCtx->cr2 = uNewCrX;
3301 rcStrict = VINF_SUCCESS;
3302 break;
3303
3304 /*
3305 * CR3 is relatively simple, although AMD and Intel have different
3306 * accounts of how setting reserved bits are handled. We take intel's
3307 * word for the lower bits and AMD's for the high bits (63:52).
3308 */
3309 /** @todo Testcase: Setting reserved bits in CR3, especially before
3310 * enabling paging. */
3311 case 3:
3312 {
3313 /* check / mask the value. */
3314 if (uNewCrX & UINT64_C(0xfff0000000000000))
3315 {
3316 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
3317 return iemRaiseGeneralProtectionFault0(pIemCpu);
3318 }
3319
3320 uint64_t fValid;
3321 if ( (pCtx->cr4 & X86_CR4_PAE)
3322 && (pCtx->msrEFER & MSR_K6_EFER_LME))
3323 fValid = UINT64_C(0x000ffffffffff014);
3324 else if (pCtx->cr4 & X86_CR4_PAE)
3325 fValid = UINT64_C(0xfffffff4);
3326 else
3327 fValid = UINT64_C(0xfffff014);
3328 if (uNewCrX & ~fValid)
3329 {
3330 Log(("Automatically clearing reserved bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
3331 uNewCrX, uNewCrX & ~fValid));
3332 uNewCrX &= fValid;
3333 }
3334
3335 /** @todo If we're in PAE mode we should check the PDPTRs for
3336 * invalid bits. */
3337
3338 /* Make the change. */
3339 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3340 {
3341 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
3342 AssertRCSuccessReturn(rc, rc);
3343 }
3344 else
3345 pCtx->cr3 = uNewCrX;
3346
3347 /* Inform PGM. */
3348 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3349 {
3350 if (pCtx->cr0 & X86_CR0_PG)
3351 {
3352 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
3353 AssertRCReturn(rc, rc);
3354 /* ignore informational status codes */
3355 }
3356 }
3357 rcStrict = VINF_SUCCESS;
3358 break;
3359 }
3360
3361 /*
3362 * CR4 is a bit more tedious as there are bits which cannot be cleared
3363 * under some circumstances and such.
3364 */
3365 case 4:
3366 {
3367 uint64_t const uOldCrX = pCtx->cr4;
3368
3369 /* reserved bits */
3370 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
3371 | X86_CR4_TSD | X86_CR4_DE
3372 | X86_CR4_PSE | X86_CR4_PAE
3373 | X86_CR4_MCE | X86_CR4_PGE
3374 | X86_CR4_PCE | X86_CR4_OSFSXR
3375 | X86_CR4_OSXMMEEXCPT;
3376 //if (xxx)
3377 // fValid |= X86_CR4_VMXE;
3378 //if (xxx)
3379 // fValid |= X86_CR4_OSXSAVE;
3380 if (uNewCrX & ~(uint64_t)fValid)
3381 {
3382 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
3383 return iemRaiseGeneralProtectionFault0(pIemCpu);
3384 }
3385
3386 /* long mode checks. */
3387 if ( (uOldCrX & X86_CR4_PAE)
3388 && !(uNewCrX & X86_CR4_PAE)
3389 && (pCtx->msrEFER & MSR_K6_EFER_LMA) )
3390 {
3391 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
3392 return iemRaiseGeneralProtectionFault0(pIemCpu);
3393 }
3394
3395
3396 /*
3397 * Change it.
3398 */
3399 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3400 {
3401 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
3402 AssertRCSuccessReturn(rc, rc);
3403 }
3404 else
3405 pCtx->cr4 = uNewCrX;
3406 Assert(pCtx->cr4 == uNewCrX);
3407
3408 /*
3409 * Notify SELM and PGM.
3410 */
3411 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3412 {
3413 /* SELM - VME may change things wrt to the TSS shadowing. */
3414 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
3415 {
3416 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
3417 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
3418#ifdef VBOX_WITH_RAW_MODE
3419 if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
3420 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
3421#endif
3422 }
3423
3424 /* PGM - flushing and mode. */
3425 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
3426 {
3427 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
3428 AssertRCReturn(rc, rc);
3429 /* ignore informational status codes */
3430 }
3431 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
3432 }
3433 else
3434 rcStrict = VINF_SUCCESS;
3435 break;
3436 }
3437
3438 /*
3439 * CR8 maps to the APIC TPR.
3440 */
3441 case 8:
3442 if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
3443 IEM_RETURN_ASPECT_NOT_IMPLEMENTED_LOG(("Implement CR8/TPR read\n")); /** @todo implement CR8 reading and writing. */
3444 else
3445 rcStrict = VINF_SUCCESS;
3446 break;
3447
3448 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3449 }
3450
3451 /*
3452 * Advance the RIP on success.
3453 */
3454 if (RT_SUCCESS(rcStrict))
3455 {
3456 if (rcStrict != VINF_SUCCESS)
3457 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3458 iemRegAddToRip(pIemCpu, cbInstr);
3459 }
3460
3461 return rcStrict;
3462}
3463
3464
3465/**
3466 * Implements mov CRx,GReg.
3467 *
3468 * @param iCrReg The CRx register to write (valid).
3469 * @param iGReg The general register to load the DRx value from.
3470 */
3471IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
3472{
3473 if (pIemCpu->uCpl != 0)
3474 return iemRaiseGeneralProtectionFault0(pIemCpu);
3475 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3476
3477 /*
3478 * Read the new value from the source register and call common worker.
3479 */
3480 uint64_t uNewCrX;
3481 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3482 uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
3483 else
3484 uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
3485 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
3486}
3487
3488
3489/**
3490 * Implements 'LMSW r/m16'
3491 *
3492 * @param u16NewMsw The new value.
3493 */
3494IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
3495{
3496 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3497
3498 if (pIemCpu->uCpl != 0)
3499 return iemRaiseGeneralProtectionFault0(pIemCpu);
3500 Assert(!pCtx->eflags.Bits.u1VM);
3501
3502 /*
3503 * Compose the new CR0 value and call common worker.
3504 */
3505 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3506 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3507 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
3508}
3509
3510
3511/**
3512 * Implements 'CLTS'.
3513 */
3514IEM_CIMPL_DEF_0(iemCImpl_clts)
3515{
3516 if (pIemCpu->uCpl != 0)
3517 return iemRaiseGeneralProtectionFault0(pIemCpu);
3518
3519 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3520 uint64_t uNewCr0 = pCtx->cr0;
3521 uNewCr0 &= ~X86_CR0_TS;
3522 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
3523}
3524
3525
3526/**
3527 * Implements mov GReg,DRx.
3528 *
3529 * @param iGReg The general register to store the DRx value in.
3530 * @param iDrReg The DRx register to read (0-7).
3531 */
3532IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
3533{
3534 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3535
3536 /*
3537 * Check preconditions.
3538 */
3539
3540 /* Raise GPs. */
3541 if (pIemCpu->uCpl != 0)
3542 return iemRaiseGeneralProtectionFault0(pIemCpu);
3543 Assert(!pCtx->eflags.Bits.u1VM);
3544
3545 if ( (iDrReg == 4 || iDrReg == 5)
3546 && (pCtx->cr4 & X86_CR4_DE) )
3547 {
3548 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
3549 return iemRaiseGeneralProtectionFault0(pIemCpu);
3550 }
3551
3552 /* Raise #DB if general access detect is enabled. */
3553 if (pCtx->dr[7] & X86_DR7_GD)
3554 {
3555 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
3556 return iemRaiseDebugException(pIemCpu);
3557 }
3558
3559 /*
3560 * Read the debug register and store it in the specified general register.
3561 */
3562 uint64_t drX;
3563 switch (iDrReg)
3564 {
3565 case 0: drX = pCtx->dr[0]; break;
3566 case 1: drX = pCtx->dr[1]; break;
3567 case 2: drX = pCtx->dr[2]; break;
3568 case 3: drX = pCtx->dr[3]; break;
3569 case 6:
3570 case 4:
3571 drX = pCtx->dr[6];
3572 drX &= ~RT_BIT_32(12);
3573 drX |= UINT32_C(0xffff0ff0);
3574 break;
3575 case 7:
3576 case 5:
3577 drX = pCtx->dr[7];
3578 drX &= ~(RT_BIT_32(11) | RT_BIT_32(12) | RT_BIT_32(14) | RT_BIT_32(15));
3579 drX |= RT_BIT_32(10);
3580 break;
3581 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
3582 }
3583
3584 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3585 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = drX;
3586 else
3587 *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
3588
3589 iemRegAddToRip(pIemCpu, cbInstr);
3590 return VINF_SUCCESS;
3591}
3592
3593
3594/**
3595 * Implements mov DRx,GReg.
3596 *
3597 * @param iDrReg The DRx register to write (valid).
3598 * @param iGReg The general register to load the DRx value from.
3599 */
3600IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
3601{
3602 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3603
3604 /*
3605 * Check preconditions.
3606 */
3607 if (pIemCpu->uCpl != 0)
3608 return iemRaiseGeneralProtectionFault0(pIemCpu);
3609 Assert(!pCtx->eflags.Bits.u1VM);
3610
3611 if ( (iDrReg == 4 || iDrReg == 5)
3612 && (pCtx->cr4 & X86_CR4_DE) )
3613 {
3614 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
3615 return iemRaiseGeneralProtectionFault0(pIemCpu);
3616 }
3617
3618 /* Raise #DB if general access detect is enabled. */
3619 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
3620 * \#GP? */
3621 if (pCtx->dr[7] & X86_DR7_GD)
3622 {
3623 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
3624 return iemRaiseDebugException(pIemCpu);
3625 }
3626
3627 /*
3628 * Read the new value from the source register.
3629 */
3630 uint64_t uNewDrX;
3631 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
3632 uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
3633 else
3634 uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
3635
3636 /*
3637 * Adjust it.
3638 */
3639 switch (iDrReg)
3640 {
3641 case 0:
3642 case 1:
3643 case 2:
3644 case 3:
3645 /* nothing to adjust */
3646 break;
3647
3648 case 6:
3649 case 4:
3650 if (uNewDrX & UINT64_C(0xffffffff00000000))
3651 {
3652 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
3653 return iemRaiseGeneralProtectionFault0(pIemCpu);
3654 }
3655 uNewDrX &= ~RT_BIT_32(12);
3656 uNewDrX |= UINT32_C(0xffff0ff0);
3657 break;
3658
3659 case 7:
3660 case 5:
3661 if (uNewDrX & UINT64_C(0xffffffff00000000))
3662 {
3663 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
3664 return iemRaiseGeneralProtectionFault0(pIemCpu);
3665 }
3666 uNewDrX &= ~(RT_BIT_32(11) | RT_BIT_32(12) | RT_BIT_32(14) | RT_BIT_32(15));
3667 uNewDrX |= RT_BIT_32(10);
3668 break;
3669
3670 IEM_NOT_REACHED_DEFAULT_CASE_RET();
3671 }
3672
3673 /*
3674 * Do the actual setting.
3675 */
3676 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3677 {
3678 int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
3679 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_INTERNAL_ERROR : rc);
3680 }
3681 else
3682 pCtx->dr[iDrReg] = uNewDrX;
3683
3684 iemRegAddToRip(pIemCpu, cbInstr);
3685 return VINF_SUCCESS;
3686}
3687
3688
3689/**
3690 * Implements 'INVLPG m'.
3691 *
3692 * @param GCPtrPage The effective address of the page to invalidate.
3693 * @remarks Updates the RIP.
3694 */
3695IEM_CIMPL_DEF_1(iemCImpl_invlpg, uint8_t, GCPtrPage)
3696{
3697 /* ring-0 only. */
3698 if (pIemCpu->uCpl != 0)
3699 return iemRaiseGeneralProtectionFault0(pIemCpu);
3700 Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
3701
3702 int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
3703 iemRegAddToRip(pIemCpu, cbInstr);
3704
3705 if (rc == VINF_SUCCESS)
3706 return VINF_SUCCESS;
3707 if (rc == VINF_PGM_SYNC_CR3)
3708 return iemSetPassUpStatus(pIemCpu, rc);
3709
3710 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
3711 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", rc));
3712 return rc;
3713}
3714
3715
3716/**
3717 * Implements RDTSC.
3718 */
3719IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
3720{
3721 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3722
3723 /*
3724 * Check preconditions.
3725 */
3726 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_TSC))
3727 return iemRaiseUndefinedOpcode(pIemCpu);
3728
3729 if ( (pCtx->cr4 & X86_CR4_TSD)
3730 && pIemCpu->uCpl != 0)
3731 {
3732 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
3733 return iemRaiseGeneralProtectionFault0(pIemCpu);
3734 }
3735
3736 /*
3737 * Do the job.
3738 */
3739 uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
3740 pCtx->rax = (uint32_t)uTicks;
3741 pCtx->rdx = uTicks >> 32;
3742#ifdef IEM_VERIFICATION_MODE_FULL
3743 pIemCpu->fIgnoreRaxRdx = true;
3744#endif
3745
3746 iemRegAddToRip(pIemCpu, cbInstr);
3747 return VINF_SUCCESS;
3748}
3749
3750
3751/**
3752 * Implements RDMSR.
3753 */
3754IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
3755{
3756 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3757
3758 /*
3759 * Check preconditions.
3760 */
3761 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
3762 return iemRaiseUndefinedOpcode(pIemCpu);
3763 if (pIemCpu->uCpl != 0)
3764 return iemRaiseGeneralProtectionFault0(pIemCpu);
3765
3766 /*
3767 * Do the job.
3768 */
3769 RTUINT64U uValue;
3770 int rc = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
3771 if (rc != VINF_SUCCESS)
3772 {
3773 Log(("IEM: rdmsr(%#x) -> GP(0)\n", pCtx->ecx));
3774 AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
3775 return iemRaiseGeneralProtectionFault0(pIemCpu);
3776 }
3777
3778 pCtx->rax = uValue.s.Lo;
3779 pCtx->rdx = uValue.s.Hi;
3780
3781 iemRegAddToRip(pIemCpu, cbInstr);
3782 return VINF_SUCCESS;
3783}
3784
3785
3786/**
3787 * Implements WRMSR.
3788 */
3789IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
3790{
3791 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3792
3793 /*
3794 * Check preconditions.
3795 */
3796 if (!IEM_IS_INTEL_CPUID_FEATURE_PRESENT_EDX(X86_CPUID_FEATURE_EDX_MSR))
3797 return iemRaiseUndefinedOpcode(pIemCpu);
3798 if (pIemCpu->uCpl != 0)
3799 return iemRaiseGeneralProtectionFault0(pIemCpu);
3800
3801 /*
3802 * Do the job.
3803 */
3804 RTUINT64U uValue;
3805 uValue.s.Lo = pCtx->eax;
3806 uValue.s.Hi = pCtx->edx;
3807
3808 int rc = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
3809 if (rc != VINF_SUCCESS)
3810 {
3811 Log(("IEM: wrmsr(%#x,%#x`%08x) -> GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
3812 AssertMsgReturn(rc == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", rc), VERR_IPE_UNEXPECTED_STATUS);
3813 return iemRaiseGeneralProtectionFault0(pIemCpu);
3814 }
3815
3816 iemRegAddToRip(pIemCpu, cbInstr);
3817 return VINF_SUCCESS;
3818}
3819
3820
3821/**
3822 * Implements 'IN eAX, port'.
3823 *
3824 * @param u16Port The source port.
3825 * @param cbReg The register size.
3826 */
3827IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
3828{
3829 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3830
3831 /*
3832 * CPL check
3833 */
3834 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
3835 if (rcStrict != VINF_SUCCESS)
3836 return rcStrict;
3837
3838 /*
3839 * Perform the I/O.
3840 */
3841 uint32_t u32Value;
3842 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3843 rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
3844 else
3845 rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
3846 if (IOM_SUCCESS(rcStrict))
3847 {
3848 switch (cbReg)
3849 {
3850 case 1: pCtx->al = (uint8_t)u32Value; break;
3851 case 2: pCtx->ax = (uint16_t)u32Value; break;
3852 case 4: pCtx->rax = u32Value; break;
3853 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3854 }
3855 iemRegAddToRip(pIemCpu, cbInstr);
3856 pIemCpu->cPotentialExits++;
3857 if (rcStrict != VINF_SUCCESS)
3858 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3859 }
3860
3861 return rcStrict;
3862}
3863
3864
3865/**
3866 * Implements 'IN eAX, DX'.
3867 *
3868 * @param cbReg The register size.
3869 */
3870IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
3871{
3872 return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3873}
3874
3875
3876/**
3877 * Implements 'OUT port, eAX'.
3878 *
3879 * @param u16Port The destination port.
3880 * @param cbReg The register size.
3881 */
3882IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
3883{
3884 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3885
3886 /*
3887 * CPL check
3888 */
3889 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
3890 if (rcStrict != VINF_SUCCESS)
3891 return rcStrict;
3892
3893 /*
3894 * Perform the I/O.
3895 */
3896 uint32_t u32Value;
3897 switch (cbReg)
3898 {
3899 case 1: u32Value = pCtx->al; break;
3900 case 2: u32Value = pCtx->ax; break;
3901 case 4: u32Value = pCtx->eax; break;
3902 default: AssertFailedReturn(VERR_INTERNAL_ERROR_3);
3903 }
3904 if (!IEM_VERIFICATION_ENABLED(pIemCpu))
3905 rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
3906 else
3907 rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
3908 if (IOM_SUCCESS(rcStrict))
3909 {
3910 iemRegAddToRip(pIemCpu, cbInstr);
3911 pIemCpu->cPotentialExits++;
3912 if (rcStrict != VINF_SUCCESS)
3913 rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
3914 }
3915 return rcStrict;
3916}
3917
3918
3919/**
3920 * Implements 'OUT DX, eAX'.
3921 *
3922 * @param cbReg The register size.
3923 */
3924IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
3925{
3926 return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
3927}
3928
3929
3930/**
3931 * Implements 'CLI'.
3932 */
3933IEM_CIMPL_DEF_0(iemCImpl_cli)
3934{
3935 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3936 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3937 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
3938 uint32_t const fEflOld = fEfl;
3939 if (pCtx->cr0 & X86_CR0_PE)
3940 {
3941 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
3942 if (!(fEfl & X86_EFL_VM))
3943 {
3944 if (pIemCpu->uCpl <= uIopl)
3945 fEfl &= ~X86_EFL_IF;
3946 else if ( pIemCpu->uCpl == 3
3947 && (pCtx->cr4 & X86_CR4_PVI) )
3948 fEfl &= ~X86_EFL_VIF;
3949 else
3950 return iemRaiseGeneralProtectionFault0(pIemCpu);
3951 }
3952 /* V8086 */
3953 else if (uIopl == 3)
3954 fEfl &= ~X86_EFL_IF;
3955 else if ( uIopl < 3
3956 && (pCtx->cr4 & X86_CR4_VME) )
3957 fEfl &= ~X86_EFL_VIF;
3958 else
3959 return iemRaiseGeneralProtectionFault0(pIemCpu);
3960 }
3961 /* real mode */
3962 else
3963 fEfl &= ~X86_EFL_IF;
3964
3965 /* Commit. */
3966 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
3967 iemRegAddToRip(pIemCpu, cbInstr);
3968 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
3969 return VINF_SUCCESS;
3970}
3971
3972
3973/**
3974 * Implements 'STI'.
3975 */
3976IEM_CIMPL_DEF_0(iemCImpl_sti)
3977{
3978 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
3979 PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
3980 uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
3981 uint32_t const fEflOld = fEfl;
3982
3983 if (pCtx->cr0 & X86_CR0_PE)
3984 {
3985 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
3986 if (!(fEfl & X86_EFL_VM))
3987 {
3988 if (pIemCpu->uCpl <= uIopl)
3989 fEfl |= X86_EFL_IF;
3990 else if ( pIemCpu->uCpl == 3
3991 && (pCtx->cr4 & X86_CR4_PVI)
3992 && !(fEfl & X86_EFL_VIP) )
3993 fEfl |= X86_EFL_VIF;
3994 else
3995 return iemRaiseGeneralProtectionFault0(pIemCpu);
3996 }
3997 /* V8086 */
3998 else if (uIopl == 3)
3999 fEfl |= X86_EFL_IF;
4000 else if ( uIopl < 3
4001 && (pCtx->cr4 & X86_CR4_VME)
4002 && !(fEfl & X86_EFL_VIP) )
4003 fEfl |= X86_EFL_VIF;
4004 else
4005 return iemRaiseGeneralProtectionFault0(pIemCpu);
4006 }
4007 /* real mode */
4008 else
4009 fEfl |= X86_EFL_IF;
4010
4011 /* Commit. */
4012 IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
4013 iemRegAddToRip(pIemCpu, cbInstr);
4014 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_VERIFICATION_ENABLED(pIemCpu))
4015 EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
4016 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
4017 return VINF_SUCCESS;
4018}
4019
4020
4021/**
4022 * Implements 'HLT'.
4023 */
4024IEM_CIMPL_DEF_0(iemCImpl_hlt)
4025{
4026 if (pIemCpu->uCpl != 0)
4027 return iemRaiseGeneralProtectionFault0(pIemCpu);
4028 iemRegAddToRip(pIemCpu, cbInstr);
4029 return VINF_EM_HALT;
4030}
4031
4032
4033/**
4034 * Implements 'CPUID'.
4035 */
4036IEM_CIMPL_DEF_0(iemCImpl_cpuid)
4037{
4038 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4039
4040 CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
4041 pCtx->rax &= UINT32_C(0xffffffff);
4042 pCtx->rbx &= UINT32_C(0xffffffff);
4043 pCtx->rcx &= UINT32_C(0xffffffff);
4044 pCtx->rdx &= UINT32_C(0xffffffff);
4045
4046 iemRegAddToRip(pIemCpu, cbInstr);
4047 return VINF_SUCCESS;
4048}
4049
4050
4051/**
4052 * Implements 'AAD'.
4053 *
4054 * @param enmEffOpSize The effective operand size.
4055 */
4056IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
4057{
4058 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4059
4060 uint16_t const ax = pCtx->ax;
4061 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
4062 pCtx->ax = al;
4063 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
4064 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
4065 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
4066
4067 iemRegAddToRip(pIemCpu, cbInstr);
4068 return VINF_SUCCESS;
4069}
4070
4071
4072/**
4073 * Implements 'AAM'.
4074 *
4075 * @param bImm The immediate operand. Cannot be 0.
4076 */
4077IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
4078{
4079 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4080 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
4081
4082 uint16_t const ax = pCtx->ax;
4083 uint8_t const al = (uint8_t)ax % bImm;
4084 uint8_t const ah = (uint8_t)ax / bImm;
4085 pCtx->ax = (ah << 8) + al;
4086 iemHlpUpdateArithEFlagsU8(pIemCpu, al,
4087 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
4088 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
4089
4090 iemRegAddToRip(pIemCpu, cbInstr);
4091 return VINF_SUCCESS;
4092}
4093
4094
4095
4096
4097/*
4098 * Instantiate the various string operation combinations.
4099 */
4100#define OP_SIZE 8
4101#define ADDR_SIZE 16
4102#include "IEMAllCImplStrInstr.cpp.h"
4103#define OP_SIZE 8
4104#define ADDR_SIZE 32
4105#include "IEMAllCImplStrInstr.cpp.h"
4106#define OP_SIZE 8
4107#define ADDR_SIZE 64
4108#include "IEMAllCImplStrInstr.cpp.h"
4109
4110#define OP_SIZE 16
4111#define ADDR_SIZE 16
4112#include "IEMAllCImplStrInstr.cpp.h"
4113#define OP_SIZE 16
4114#define ADDR_SIZE 32
4115#include "IEMAllCImplStrInstr.cpp.h"
4116#define OP_SIZE 16
4117#define ADDR_SIZE 64
4118#include "IEMAllCImplStrInstr.cpp.h"
4119
4120#define OP_SIZE 32
4121#define ADDR_SIZE 16
4122#include "IEMAllCImplStrInstr.cpp.h"
4123#define OP_SIZE 32
4124#define ADDR_SIZE 32
4125#include "IEMAllCImplStrInstr.cpp.h"
4126#define OP_SIZE 32
4127#define ADDR_SIZE 64
4128#include "IEMAllCImplStrInstr.cpp.h"
4129
4130#define OP_SIZE 64
4131#define ADDR_SIZE 32
4132#include "IEMAllCImplStrInstr.cpp.h"
4133#define OP_SIZE 64
4134#define ADDR_SIZE 64
4135#include "IEMAllCImplStrInstr.cpp.h"
4136
4137
4138/**
4139 * Implements 'FINIT' and 'FNINIT'.
4140 *
4141 * @param fCheckXcpts Whether to check for umasked pending exceptions or
4142 * not.
4143 */
4144IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
4145{
4146 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4147
4148 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
4149 return iemRaiseDeviceNotAvailable(pIemCpu);
4150
4151 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
4152 if (fCheckXcpts && TODO )
4153 return iemRaiseMathFault(pIemCpu);
4154 */
4155
4156 if (iemFRegIsFxSaveFormat(pIemCpu))
4157 {
4158 pCtx->fpu.FCW = 0x37f;
4159 pCtx->fpu.FSW = 0;
4160 pCtx->fpu.FTW = 0x00; /* 0 - empty. */
4161 pCtx->fpu.FPUDP = 0;
4162 pCtx->fpu.DS = 0; //??
4163 pCtx->fpu.Rsrvd2= 0;
4164 pCtx->fpu.FPUIP = 0;
4165 pCtx->fpu.CS = 0; //??
4166 pCtx->fpu.Rsrvd1= 0;
4167 pCtx->fpu.FOP = 0;
4168 }
4169 else
4170 {
4171 PX86FPUSTATE pFpu = (PX86FPUSTATE)&pCtx->fpu;
4172 pFpu->FCW = 0x37f;
4173 pFpu->FSW = 0;
4174 pFpu->FTW = 0xffff; /* 11 - empty */
4175 pFpu->FPUOO = 0; //??
4176 pFpu->FPUOS = 0; //??
4177 pFpu->FPUIP = 0;
4178 pFpu->CS = 0; //??
4179 pFpu->FOP = 0;
4180 }
4181
4182 iemHlpUsedFpu(pIemCpu);
4183 iemRegAddToRip(pIemCpu, cbInstr);
4184 return VINF_SUCCESS;
4185}
4186
4187
4188/**
4189 * Implements 'FXSAVE'.
4190 *
4191 * @param iEffSeg The effective segment.
4192 * @param GCPtrEff The address of the image.
4193 * @param enmEffOpSize The operand size (only REX.W really matters).
4194 */
4195IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
4196{
4197 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4198
4199 /*
4200 * Raise exceptions.
4201 */
4202 if (pCtx->cr0 & X86_CR0_EM)
4203 return iemRaiseUndefinedOpcode(pIemCpu);
4204 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
4205 return iemRaiseDeviceNotAvailable(pIemCpu);
4206 if (GCPtrEff & 15)
4207 {
4208 /** @todo CPU/VM detection possible! \#AC might not be signal for
4209 * all/any misalignment sizes, intel says its an implementation detail. */
4210 if ( (pCtx->cr0 & X86_CR0_AM)
4211 && pCtx->eflags.Bits.u1AC
4212 && pIemCpu->uCpl == 3)
4213 return iemRaiseAlignmentCheckException(pIemCpu);
4214 return iemRaiseGeneralProtectionFault0(pIemCpu);
4215 }
4216 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
4217
4218 /*
4219 * Access the memory.
4220 */
4221 void *pvMem512;
4222 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4223 if (rcStrict != VINF_SUCCESS)
4224 return rcStrict;
4225 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
4226
4227 /*
4228 * Store the registers.
4229 */
4230 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
4231 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
4232
4233 /* common for all formats */
4234 pDst->FCW = pCtx->fpu.FCW;
4235 pDst->FSW = pCtx->fpu.FSW;
4236 pDst->FTW = pCtx->fpu.FTW & UINT16_C(0xff);
4237 pDst->FOP = pCtx->fpu.FOP;
4238 pDst->MXCSR = pCtx->fpu.MXCSR;
4239 pDst->MXCSR_MASK = pCtx->fpu.MXCSR_MASK;
4240 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
4241 {
4242 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
4243 * them for now... */
4244 pDst->aRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
4245 pDst->aRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
4246 pDst->aRegs[i].au32[2] = pCtx->fpu.aRegs[i].au32[2] & UINT32_C(0xffff);
4247 pDst->aRegs[i].au32[3] = 0;
4248 }
4249
4250 /* FPU IP, CS, DP and DS. */
4251 /** @todo FPU IP, CS, DP and DS cannot be implemented correctly without extra
4252 * state information. :-/
4253 * Storing zeros now to prevent any potential leakage of host info. */
4254 pDst->FPUIP = 0;
4255 pDst->CS = 0;
4256 pDst->Rsrvd1 = 0;
4257 pDst->FPUDP = 0;
4258 pDst->DS = 0;
4259 pDst->Rsrvd2 = 0;
4260
4261 /* XMM registers. */
4262 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
4263 || pIemCpu->enmCpuMode != IEMMODE_64BIT
4264 || pIemCpu->uCpl != 0)
4265 {
4266 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
4267 for (uint32_t i = 0; i < cXmmRegs; i++)
4268 pDst->aXMM[i] = pCtx->fpu.aXMM[i];
4269 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
4270 * right? */
4271 }
4272
4273 /*
4274 * Commit the memory.
4275 */
4276 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4277 if (rcStrict != VINF_SUCCESS)
4278 return rcStrict;
4279
4280 iemRegAddToRip(pIemCpu, cbInstr);
4281 return VINF_SUCCESS;
4282}
4283
4284
4285/**
4286 * Implements 'FXRSTOR'.
4287 *
4288 * @param GCPtrEff The address of the image.
4289 * @param enmEffOpSize The operand size (only REX.W really matters).
4290 */
4291IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
4292{
4293 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4294
4295 /*
4296 * Raise exceptions.
4297 */
4298 if (pCtx->cr0 & X86_CR0_EM)
4299 return iemRaiseUndefinedOpcode(pIemCpu);
4300 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
4301 return iemRaiseDeviceNotAvailable(pIemCpu);
4302 if (GCPtrEff & 15)
4303 {
4304 /** @todo CPU/VM detection possible! \#AC might not be signal for
4305 * all/any misalignment sizes, intel says its an implementation detail. */
4306 if ( (pCtx->cr0 & X86_CR0_AM)
4307 && pCtx->eflags.Bits.u1AC
4308 && pIemCpu->uCpl == 3)
4309 return iemRaiseAlignmentCheckException(pIemCpu);
4310 return iemRaiseGeneralProtectionFault0(pIemCpu);
4311 }
4312 AssertReturn(iemFRegIsFxSaveFormat(pIemCpu), VERR_IEM_IPE_2);
4313
4314 /*
4315 * Access the memory.
4316 */
4317 void *pvMem512;
4318 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
4319 if (rcStrict != VINF_SUCCESS)
4320 return rcStrict;
4321 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
4322
4323 /*
4324 * Check the state for stuff which will GP(0).
4325 */
4326 uint32_t const fMXCSR = pSrc->MXCSR;
4327 uint32_t const fMXCSR_MASK = pCtx->fpu.MXCSR_MASK ? pCtx->fpu.MXCSR_MASK : UINT32_C(0xffbf);
4328 if (fMXCSR & ~fMXCSR_MASK)
4329 {
4330 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
4331 return iemRaiseGeneralProtectionFault0(pIemCpu);
4332 }
4333
4334 /*
4335 * Load the registers.
4336 */
4337 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
4338 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
4339
4340 /* common for all formats */
4341 pCtx->fpu.FCW = pSrc->FCW;
4342 pCtx->fpu.FSW = pSrc->FSW;
4343 pCtx->fpu.FTW = pSrc->FTW & UINT16_C(0xff);
4344 pCtx->fpu.FOP = pSrc->FOP;
4345 pCtx->fpu.MXCSR = fMXCSR;
4346 /* (MXCSR_MASK is read-only) */
4347 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
4348 {
4349 pCtx->fpu.aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
4350 pCtx->fpu.aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
4351 pCtx->fpu.aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
4352 pCtx->fpu.aRegs[i].au32[3] = 0;
4353 }
4354
4355 /* FPU IP, CS, DP and DS. */
4356 if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
4357 {
4358 pCtx->fpu.FPUIP = pSrc->FPUIP;
4359 pCtx->fpu.CS = pSrc->CS;
4360 pCtx->fpu.Rsrvd1 = pSrc->Rsrvd1;
4361 pCtx->fpu.FPUDP = pSrc->FPUDP;
4362 pCtx->fpu.DS = pSrc->DS;
4363 pCtx->fpu.Rsrvd2 = pSrc->Rsrvd2;
4364 }
4365 else
4366 {
4367 pCtx->fpu.FPUIP = pSrc->FPUIP;
4368 pCtx->fpu.CS = pSrc->CS;
4369 pCtx->fpu.Rsrvd1 = 0;
4370 pCtx->fpu.FPUDP = pSrc->FPUDP;
4371 pCtx->fpu.DS = pSrc->DS;
4372 pCtx->fpu.Rsrvd2 = 0;
4373 }
4374
4375 /* XMM registers. */
4376 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
4377 || pIemCpu->enmCpuMode != IEMMODE_64BIT
4378 || pIemCpu->uCpl != 0)
4379 {
4380 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
4381 for (uint32_t i = 0; i < cXmmRegs; i++)
4382 pCtx->fpu.aXMM[i] = pSrc->aXMM[i];
4383 }
4384
4385 /*
4386 * Commit the memory.
4387 */
4388 rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
4389 if (rcStrict != VINF_SUCCESS)
4390 return rcStrict;
4391
4392 iemHlpUsedFpu(pIemCpu);
4393 iemRegAddToRip(pIemCpu, cbInstr);
4394 return VINF_SUCCESS;
4395}
4396
4397
4398/**
4399 * Commmon routine for fnstenv and fnsave.
4400 *
4401 * @param uPtr Where to store the state.
4402 * @param pCtx The CPU context.
4403 */
4404static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
4405{
4406 if (enmEffOpSize == IEMMODE_16BIT)
4407 {
4408 uPtr.pu16[0] = pCtx->fpu.FCW;
4409 uPtr.pu16[1] = pCtx->fpu.FSW;
4410 uPtr.pu16[2] = iemFpuCalcFullFtw(pCtx);
4411 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4412 {
4413 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
4414 * protected mode or long mode and we save it in real mode? And vice
4415 * versa? And with 32-bit operand size? I think CPU is storing the
4416 * effective address ((CS << 4) + IP) in the offset register and not
4417 * doing any address calculations here. */
4418 uPtr.pu16[3] = (uint16_t)pCtx->fpu.FPUIP;
4419 uPtr.pu16[4] = ((pCtx->fpu.FPUIP >> 4) & UINT16_C(0xf000)) | pCtx->fpu.FOP;
4420 uPtr.pu16[5] = (uint16_t)pCtx->fpu.FPUDP;
4421 uPtr.pu16[6] = (pCtx->fpu.FPUDP >> 4) & UINT16_C(0xf000);
4422 }
4423 else
4424 {
4425 uPtr.pu16[3] = pCtx->fpu.FPUIP;
4426 uPtr.pu16[4] = pCtx->fpu.CS;
4427 uPtr.pu16[5] = pCtx->fpu.FPUDP;
4428 uPtr.pu16[6] = pCtx->fpu.DS;
4429 }
4430 }
4431 else
4432 {
4433 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
4434 uPtr.pu16[0*2] = pCtx->fpu.FCW;
4435 uPtr.pu16[1*2] = pCtx->fpu.FSW;
4436 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pCtx);
4437 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4438 {
4439 uPtr.pu16[3*2] = (uint16_t)pCtx->fpu.FPUIP;
4440 uPtr.pu32[4] = ((pCtx->fpu.FPUIP & UINT32_C(0xffff0000)) >> 4) | pCtx->fpu.FOP;
4441 uPtr.pu16[5*2] = (uint16_t)pCtx->fpu.FPUDP;
4442 uPtr.pu32[6] = (pCtx->fpu.FPUDP & UINT32_C(0xffff0000)) >> 4;
4443 }
4444 else
4445 {
4446 uPtr.pu32[3] = pCtx->fpu.FPUIP;
4447 uPtr.pu16[4*2] = pCtx->fpu.CS;
4448 uPtr.pu16[4*2+1]= pCtx->fpu.FOP;
4449 uPtr.pu32[5] = pCtx->fpu.FPUDP;
4450 uPtr.pu16[6*2] = pCtx->fpu.DS;
4451 }
4452 }
4453}
4454
4455
4456/**
4457 * Commmon routine for fldenv and frstor
4458 *
4459 * @param uPtr Where to store the state.
4460 * @param pCtx The CPU context.
4461 */
4462static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
4463{
4464 if (enmEffOpSize == IEMMODE_16BIT)
4465 {
4466 pCtx->fpu.FCW = uPtr.pu16[0];
4467 pCtx->fpu.FSW = uPtr.pu16[1];
4468 pCtx->fpu.FTW = uPtr.pu16[2];
4469 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4470 {
4471 pCtx->fpu.FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
4472 pCtx->fpu.FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
4473 pCtx->fpu.FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
4474 pCtx->fpu.CS = 0;
4475 pCtx->fpu.Rsrvd1= 0;
4476 pCtx->fpu.DS = 0;
4477 pCtx->fpu.Rsrvd2= 0;
4478 }
4479 else
4480 {
4481 pCtx->fpu.FPUIP = uPtr.pu16[3];
4482 pCtx->fpu.CS = uPtr.pu16[4];
4483 pCtx->fpu.Rsrvd1= 0;
4484 pCtx->fpu.FPUDP = uPtr.pu16[5];
4485 pCtx->fpu.DS = uPtr.pu16[6];
4486 pCtx->fpu.Rsrvd2= 0;
4487 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
4488 }
4489 }
4490 else
4491 {
4492 pCtx->fpu.FCW = uPtr.pu16[0*2];
4493 pCtx->fpu.FSW = uPtr.pu16[1*2];
4494 pCtx->fpu.FTW = uPtr.pu16[2*2];
4495 if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
4496 {
4497 pCtx->fpu.FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
4498 pCtx->fpu.FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
4499 pCtx->fpu.FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
4500 pCtx->fpu.CS = 0;
4501 pCtx->fpu.Rsrvd1= 0;
4502 pCtx->fpu.DS = 0;
4503 pCtx->fpu.Rsrvd2= 0;
4504 }
4505 else
4506 {
4507 pCtx->fpu.FPUIP = uPtr.pu32[3];
4508 pCtx->fpu.CS = uPtr.pu16[4*2];
4509 pCtx->fpu.Rsrvd1= 0;
4510 pCtx->fpu.FOP = uPtr.pu16[4*2+1];
4511 pCtx->fpu.FPUDP = uPtr.pu32[5];
4512 pCtx->fpu.DS = uPtr.pu16[6*2];
4513 pCtx->fpu.Rsrvd2= 0;
4514 }
4515 }
4516
4517 /* Make adjustments. */
4518 pCtx->fpu.FTW = iemFpuCompressFtw(pCtx->fpu.FTW);
4519 pCtx->fpu.FCW &= ~X86_FCW_ZERO_MASK;
4520 iemFpuRecalcExceptionStatus(pCtx);
4521 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
4522 * exceptions are pending after loading the saved state? */
4523}
4524
4525
4526/**
4527 * Implements 'FNSTENV'.
4528 *
4529 * @param enmEffOpSize The operand size (only REX.W really matters).
4530 * @param iEffSeg The effective segment register for @a GCPtrEff.
4531 * @param GCPtrEffDst The address of the image.
4532 */
4533IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4534{
4535 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4536 RTPTRUNION uPtr;
4537 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
4538 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4539 if (rcStrict != VINF_SUCCESS)
4540 return rcStrict;
4541
4542 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4543
4544 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4545 if (rcStrict != VINF_SUCCESS)
4546 return rcStrict;
4547
4548 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
4549 iemRegAddToRip(pIemCpu, cbInstr);
4550 return VINF_SUCCESS;
4551}
4552
4553
4554/**
4555 * Implements 'FNSAVE'.
4556 *
4557 * @param GCPtrEffDst The address of the image.
4558 * @param enmEffOpSize The operand size.
4559 */
4560IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4561{
4562 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4563 RTPTRUNION uPtr;
4564 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
4565 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4566 if (rcStrict != VINF_SUCCESS)
4567 return rcStrict;
4568
4569 iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4570 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
4571 for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
4572 {
4573 paRegs[i].au32[0] = pCtx->fpu.aRegs[i].au32[0];
4574 paRegs[i].au32[1] = pCtx->fpu.aRegs[i].au32[1];
4575 paRegs[i].au16[4] = pCtx->fpu.aRegs[i].au16[4];
4576 }
4577
4578 rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
4579 if (rcStrict != VINF_SUCCESS)
4580 return rcStrict;
4581
4582 /*
4583 * Re-initialize the FPU.
4584 */
4585 pCtx->fpu.FCW = 0x37f;
4586 pCtx->fpu.FSW = 0;
4587 pCtx->fpu.FTW = 0x00; /* 0 - empty */
4588 pCtx->fpu.FPUDP = 0;
4589 pCtx->fpu.DS = 0;
4590 pCtx->fpu.Rsrvd2= 0;
4591 pCtx->fpu.FPUIP = 0;
4592 pCtx->fpu.CS = 0;
4593 pCtx->fpu.Rsrvd1= 0;
4594 pCtx->fpu.FOP = 0;
4595
4596 iemHlpUsedFpu(pIemCpu);
4597 iemRegAddToRip(pIemCpu, cbInstr);
4598 return VINF_SUCCESS;
4599}
4600
4601
4602
4603/**
4604 * Implements 'FLDENV'.
4605 *
4606 * @param enmEffOpSize The operand size (only REX.W really matters).
4607 * @param iEffSeg The effective segment register for @a GCPtrEff.
4608 * @param GCPtrEffSrc The address of the image.
4609 */
4610IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
4611{
4612 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4613 RTCPTRUNION uPtr;
4614 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
4615 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
4616 if (rcStrict != VINF_SUCCESS)
4617 return rcStrict;
4618
4619 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4620
4621 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
4622 if (rcStrict != VINF_SUCCESS)
4623 return rcStrict;
4624
4625 iemHlpUsedFpu(pIemCpu);
4626 iemRegAddToRip(pIemCpu, cbInstr);
4627 return VINF_SUCCESS;
4628}
4629
4630
4631/**
4632 * Implements 'FRSTOR'.
4633 *
4634 * @param GCPtrEffSrc The address of the image.
4635 * @param enmEffOpSize The operand size.
4636 */
4637IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
4638{
4639 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4640 RTCPTRUNION uPtr;
4641 VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
4642 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
4643 if (rcStrict != VINF_SUCCESS)
4644 return rcStrict;
4645
4646 iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
4647 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
4648 for (uint32_t i = 0; i < RT_ELEMENTS(pCtx->fpu.aRegs); i++)
4649 {
4650 pCtx->fpu.aRegs[i].au32[0] = paRegs[i].au32[0];
4651 pCtx->fpu.aRegs[i].au32[1] = paRegs[i].au32[1];
4652 pCtx->fpu.aRegs[i].au32[2] = paRegs[i].au16[4];
4653 pCtx->fpu.aRegs[i].au32[3] = 0;
4654 }
4655
4656 rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
4657 if (rcStrict != VINF_SUCCESS)
4658 return rcStrict;
4659
4660 iemHlpUsedFpu(pIemCpu);
4661 iemRegAddToRip(pIemCpu, cbInstr);
4662 return VINF_SUCCESS;
4663}
4664
4665
4666/**
4667 * Implements 'FLDCW'.
4668 *
4669 * @param u16Fcw The new FCW.
4670 */
4671IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
4672{
4673 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4674
4675 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
4676 /** @todo Testcase: Try see what happens when trying to set undefined bits
4677 * (other than 6 and 7). Currently ignoring them. */
4678 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
4679 * according to FSW. (This is was is currently implemented.) */
4680 pCtx->fpu.FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
4681 iemFpuRecalcExceptionStatus(pCtx);
4682
4683 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
4684 iemHlpUsedFpu(pIemCpu);
4685 iemRegAddToRip(pIemCpu, cbInstr);
4686 return VINF_SUCCESS;
4687}
4688
4689
4690
4691/**
4692 * Implements the underflow case of fxch.
4693 *
4694 * @param iStReg The other stack register.
4695 */
4696IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
4697{
4698 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4699
4700 unsigned const iReg1 = X86_FSW_TOP_GET(pCtx->fpu.FSW);
4701 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
4702 Assert(!(RT_BIT(iReg1) & pCtx->fpu.FTW) || !(RT_BIT(iReg2) & pCtx->fpu.FTW));
4703
4704 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
4705 * registers are read as QNaN and then exchanged. This could be
4706 * wrong... */
4707 if (pCtx->fpu.FCW & X86_FCW_IM)
4708 {
4709 if (RT_BIT(iReg1) & pCtx->fpu.FTW)
4710 {
4711 if (RT_BIT(iReg2) & pCtx->fpu.FTW)
4712 iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
4713 else
4714 pCtx->fpu.aRegs[0].r80 = pCtx->fpu.aRegs[iStReg].r80;
4715 iemFpuStoreQNan(&pCtx->fpu.aRegs[iStReg].r80);
4716 }
4717 else
4718 {
4719 pCtx->fpu.aRegs[iStReg].r80 = pCtx->fpu.aRegs[0].r80;
4720 iemFpuStoreQNan(&pCtx->fpu.aRegs[0].r80);
4721 }
4722 pCtx->fpu.FSW &= ~X86_FSW_C_MASK;
4723 pCtx->fpu.FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
4724 }
4725 else
4726 {
4727 /* raise underflow exception, don't change anything. */
4728 pCtx->fpu.FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
4729 pCtx->fpu.FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
4730 }
4731
4732 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
4733 iemHlpUsedFpu(pIemCpu);
4734 iemRegAddToRip(pIemCpu, cbInstr);
4735 return VINF_SUCCESS;
4736}
4737
4738
4739/**
4740 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
4741 *
4742 * @param cToAdd 1 or 7.
4743 */
4744IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
4745{
4746 PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
4747 Assert(iStReg < 8);
4748
4749 /*
4750 * Raise exceptions.
4751 */
4752 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
4753 return iemRaiseDeviceNotAvailable(pIemCpu);
4754 uint16_t u16Fsw = pCtx->fpu.FSW;
4755 if (u16Fsw & X86_FSW_ES)
4756 return iemRaiseMathFault(pIemCpu);
4757
4758 /*
4759 * Check if any of the register accesses causes #SF + #IA.
4760 */
4761 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
4762 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
4763 if ((pCtx->fpu.FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
4764 {
4765 uint32_t u32Eflags = pfnAImpl(&pCtx->fpu, &u16Fsw, &pCtx->fpu.aRegs[0].r80, &pCtx->fpu.aRegs[iStReg].r80);
4766 pCtx->fpu.FSW &= ~X86_FSW_C1;
4767 pCtx->fpu.FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
4768 if ( !(u16Fsw & X86_FSW_IE)
4769 || (pCtx->fpu.FCW & X86_FCW_IM) )
4770 {
4771 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
4772 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
4773 }
4774 }
4775 else if (pCtx->fpu.FCW & X86_FCW_IM)
4776 {
4777 /* Masked underflow. */
4778 pCtx->fpu.FSW &= ~X86_FSW_C1;
4779 pCtx->fpu.FSW |= X86_FSW_IE | X86_FSW_SF;
4780 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
4781 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
4782 }
4783 else
4784 {
4785 /* Raise underflow - don't touch EFLAGS or TOP. */
4786 pCtx->fpu.FSW &= ~X86_FSW_C1;
4787 pCtx->fpu.FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
4788 fPop = false;
4789 }
4790
4791 /*
4792 * Pop if necessary.
4793 */
4794 if (fPop)
4795 {
4796 pCtx->fpu.FTW &= ~RT_BIT(iReg1);
4797 pCtx->fpu.FSW &= X86_FSW_TOP_MASK;
4798 pCtx->fpu.FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
4799 }
4800
4801 iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx);
4802 iemHlpUsedFpu(pIemCpu);
4803 iemRegAddToRip(pIemCpu, cbInstr);
4804 return VINF_SUCCESS;
4805}
4806
4807/** @} */
4808
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette