VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 65192

Last change on this file since 65192 was 65192, checked in by vboxsync, 8 years ago

IEM: PUSHF in V86 mode needs to increment rIP.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 239.9 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 65192 2017-01-07 22:46:49Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/** @name Misc Helpers
19 * @{
20 */
21
22
23/**
24 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
25 *
26 * @returns Strict VBox status code.
27 *
28 * @param pVCpu The cross context virtual CPU structure of the calling thread.
29 * @param pCtx The register context.
30 * @param u16Port The port number.
31 * @param cbOperand The operand size.
32 */
33static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34{
35 /* The TSS bits we're interested in are the same on 386 and AMD64. */
36 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41 /*
42 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43 */
44 Assert(!pCtx->tr.Attr.n.u1DescType);
45 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47 {
48 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50 return iemRaiseGeneralProtectionFault0(pVCpu);
51 }
52
53 /*
54 * Read the bitmap offset (may #PF).
55 */
56 uint16_t offBitmap;
57 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
58 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59 if (rcStrict != VINF_SUCCESS)
60 {
61 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62 return rcStrict;
63 }
64
65 /*
66 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67 * describes the CPU actually reading two bytes regardless of whether the
68 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
69 */
70 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
72 * for instance sizeof(X86TSS32). */
73 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74 {
75 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76 offFirstBit, pCtx->tr.u32Limit));
77 return iemRaiseGeneralProtectionFault0(pVCpu);
78 }
79
80 /*
81 * Read the necessary bits.
82 */
83 /** @todo Test the assertion in the intel manual that the CPU reads two
84 * bytes. The question is how this works wrt to #PF and #GP on the
85 * 2nd byte when it's not required. */
86 uint16_t bmBytes = UINT16_MAX;
87 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88 if (rcStrict != VINF_SUCCESS)
89 {
90 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91 return rcStrict;
92 }
93
94 /*
95 * Perform the check.
96 */
97 uint16_t fPortMask = (1 << cbOperand) - 1;
98 bmBytes >>= (u16Port & 7);
99 if (bmBytes & fPortMask)
100 {
101 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102 u16Port, cbOperand, bmBytes, fPortMask));
103 return iemRaiseGeneralProtectionFault0(pVCpu);
104 }
105
106 return VINF_SUCCESS;
107}
108
109
110/**
111 * Checks if we are allowed to access the given I/O port, raising the
112 * appropriate exceptions if we aren't (or if the I/O bitmap is not
113 * accessible).
114 *
115 * @returns Strict VBox status code.
116 *
117 * @param pVCpu The cross context virtual CPU structure of the calling thread.
118 * @param pCtx The register context.
119 * @param u16Port The port number.
120 * @param cbOperand The operand size.
121 */
122DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123{
124 X86EFLAGS Efl;
125 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
126 if ( (pCtx->cr0 & X86_CR0_PE)
127 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
128 || Efl.Bits.u1VM) )
129 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
130 return VINF_SUCCESS;
131}
132
133
134#if 0
135/**
136 * Calculates the parity bit.
137 *
138 * @returns true if the bit is set, false if not.
139 * @param u8Result The least significant byte of the result.
140 */
141static bool iemHlpCalcParityFlag(uint8_t u8Result)
142{
143 /*
144 * Parity is set if the number of bits in the least significant byte of
145 * the result is even.
146 */
147 uint8_t cBits;
148 cBits = u8Result & 1; /* 0 */
149 u8Result >>= 1;
150 cBits += u8Result & 1;
151 u8Result >>= 1;
152 cBits += u8Result & 1;
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1; /* 4 */
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1;
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 return !(cBits & 1);
164}
165#endif /* not used */
166
167
168/**
169 * Updates the specified flags according to a 8-bit result.
170 *
171 * @param pVCpu The cross context virtual CPU structure of the calling thread.
172 * @param u8Result The result to set the flags according to.
173 * @param fToUpdate The flags to update.
174 * @param fUndefined The flags that are specified as undefined.
175 */
176static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177{
178 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
179
180 uint32_t fEFlags = pCtx->eflags.u;
181 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
183 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
184#ifdef IEM_VERIFICATION_MODE_FULL
185 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
186#endif
187}
188
189
190/**
191 * Helper used by iret.
192 *
193 * @param pVCpu The cross context virtual CPU structure of the calling thread.
194 * @param uCpl The new CPL.
195 * @param pSReg Pointer to the segment register.
196 */
197static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
198{
199#ifdef VBOX_WITH_RAW_MODE_NOT_R0
200 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
201 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
202#else
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
204#endif
205
206 if ( uCpl > pSReg->Attr.n.u2Dpl
207 && pSReg->Attr.n.u1DescType /* code or data, not system */
208 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
209 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
210 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
211}
212
213
214/**
215 * Indicates that we have modified the FPU state.
216 *
217 * @param pVCpu The cross context virtual CPU structure of the calling thread.
218 */
219DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
220{
221 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
222}
223
224/** @} */
225
226/** @name C Implementations
227 * @{
228 */
229
230/**
231 * Implements a 16-bit popa.
232 */
233IEM_CIMPL_DEF_0(iemCImpl_popa_16)
234{
235 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
236 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
237 RTGCPTR GCPtrLast = GCPtrStart + 15;
238 VBOXSTRICTRC rcStrict;
239
240 /*
241 * The docs are a bit hard to comprehend here, but it looks like we wrap
242 * around in real mode as long as none of the individual "popa" crosses the
243 * end of the stack segment. In protected mode we check the whole access
244 * in one go. For efficiency, only do the word-by-word thing if we're in
245 * danger of wrapping around.
246 */
247 /** @todo do popa boundary / wrap-around checks. */
248 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
249 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
250 {
251 /* word-by-word */
252 RTUINT64U TmpRsp;
253 TmpRsp.u = pCtx->rsp;
254 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
255 if (rcStrict == VINF_SUCCESS)
256 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
257 if (rcStrict == VINF_SUCCESS)
258 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
259 if (rcStrict == VINF_SUCCESS)
260 {
261 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
262 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
263 }
264 if (rcStrict == VINF_SUCCESS)
265 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
266 if (rcStrict == VINF_SUCCESS)
267 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 {
272 pCtx->rsp = TmpRsp.u;
273 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
274 }
275 }
276 else
277 {
278 uint16_t const *pa16Mem = NULL;
279 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
280 if (rcStrict == VINF_SUCCESS)
281 {
282 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
283 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
284 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
285 /* skip sp */
286 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
287 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
288 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
289 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
290 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
291 if (rcStrict == VINF_SUCCESS)
292 {
293 iemRegAddToRsp(pVCpu, pCtx, 16);
294 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
295 }
296 }
297 }
298 return rcStrict;
299}
300
301
302/**
303 * Implements a 32-bit popa.
304 */
305IEM_CIMPL_DEF_0(iemCImpl_popa_32)
306{
307 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
308 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
309 RTGCPTR GCPtrLast = GCPtrStart + 31;
310 VBOXSTRICTRC rcStrict;
311
312 /*
313 * The docs are a bit hard to comprehend here, but it looks like we wrap
314 * around in real mode as long as none of the individual "popa" crosses the
315 * end of the stack segment. In protected mode we check the whole access
316 * in one go. For efficiency, only do the word-by-word thing if we're in
317 * danger of wrapping around.
318 */
319 /** @todo do popa boundary / wrap-around checks. */
320 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
321 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
322 {
323 /* word-by-word */
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pCtx->rsp;
326 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
334 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
335 }
336 if (rcStrict == VINF_SUCCESS)
337 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
338 if (rcStrict == VINF_SUCCESS)
339 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
340 if (rcStrict == VINF_SUCCESS)
341 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 {
344#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
345 pCtx->rdi &= UINT32_MAX;
346 pCtx->rsi &= UINT32_MAX;
347 pCtx->rbp &= UINT32_MAX;
348 pCtx->rbx &= UINT32_MAX;
349 pCtx->rdx &= UINT32_MAX;
350 pCtx->rcx &= UINT32_MAX;
351 pCtx->rax &= UINT32_MAX;
352#endif
353 pCtx->rsp = TmpRsp.u;
354 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
355 }
356 }
357 else
358 {
359 uint32_t const *pa32Mem;
360 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
361 if (rcStrict == VINF_SUCCESS)
362 {
363 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
364 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
365 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
366 /* skip esp */
367 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
368 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
369 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
370 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
371 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
372 if (rcStrict == VINF_SUCCESS)
373 {
374 iemRegAddToRsp(pVCpu, pCtx, 32);
375 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
376 }
377 }
378 }
379 return rcStrict;
380}
381
382
383/**
384 * Implements a 16-bit pusha.
385 */
386IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
387{
388 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
389 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
390 RTGCPTR GCPtrBottom = GCPtrTop - 15;
391 VBOXSTRICTRC rcStrict;
392
393 /*
394 * The docs are a bit hard to comprehend here, but it looks like we wrap
395 * around in real mode as long as none of the individual "pushd" crosses the
396 * end of the stack segment. In protected mode we check the whole access
397 * in one go. For efficiency, only do the word-by-word thing if we're in
398 * danger of wrapping around.
399 */
400 /** @todo do pusha boundary / wrap-around checks. */
401 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
402 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
403 {
404 /* word-by-word */
405 RTUINT64U TmpRsp;
406 TmpRsp.u = pCtx->rsp;
407 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
408 if (rcStrict == VINF_SUCCESS)
409 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
410 if (rcStrict == VINF_SUCCESS)
411 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
416 if (rcStrict == VINF_SUCCESS)
417 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 {
424 pCtx->rsp = TmpRsp.u;
425 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
426 }
427 }
428 else
429 {
430 GCPtrBottom--;
431 uint16_t *pa16Mem = NULL;
432 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
433 if (rcStrict == VINF_SUCCESS)
434 {
435 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
436 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
437 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
438 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
439 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
440 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
441 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
442 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
443 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
444 if (rcStrict == VINF_SUCCESS)
445 {
446 iemRegSubFromRsp(pVCpu, pCtx, 16);
447 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
448 }
449 }
450 }
451 return rcStrict;
452}
453
454
455/**
456 * Implements a 32-bit pusha.
457 */
458IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
459{
460 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
461 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
462 RTGCPTR GCPtrBottom = GCPtrTop - 31;
463 VBOXSTRICTRC rcStrict;
464
465 /*
466 * The docs are a bit hard to comprehend here, but it looks like we wrap
467 * around in real mode as long as none of the individual "pusha" crosses the
468 * end of the stack segment. In protected mode we check the whole access
469 * in one go. For efficiency, only do the word-by-word thing if we're in
470 * danger of wrapping around.
471 */
472 /** @todo do pusha boundary / wrap-around checks. */
473 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
474 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
475 {
476 /* word-by-word */
477 RTUINT64U TmpRsp;
478 TmpRsp.u = pCtx->rsp;
479 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
480 if (rcStrict == VINF_SUCCESS)
481 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
490 if (rcStrict == VINF_SUCCESS)
491 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 {
496 pCtx->rsp = TmpRsp.u;
497 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
498 }
499 }
500 else
501 {
502 GCPtrBottom--;
503 uint32_t *pa32Mem;
504 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
505 if (rcStrict == VINF_SUCCESS)
506 {
507 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
508 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
509 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
510 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
511 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
512 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
513 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
514 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
515 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
516 if (rcStrict == VINF_SUCCESS)
517 {
518 iemRegSubFromRsp(pVCpu, pCtx, 32);
519 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
520 }
521 }
522 }
523 return rcStrict;
524}
525
526
527/**
528 * Implements pushf.
529 *
530 *
531 * @param enmEffOpSize The effective operand size.
532 */
533IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
534{
535 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
536 VBOXSTRICTRC rcStrict;
537
538 /*
539 * If we're in V8086 mode some care is required (which is why we're in
540 * doing this in a C implementation).
541 */
542 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
543 if ( (fEfl & X86_EFL_VM)
544 && X86_EFL_GET_IOPL(fEfl) != 3 )
545 {
546 Assert(pCtx->cr0 & X86_CR0_PE);
547 if ( enmEffOpSize != IEMMODE_16BIT
548 || !(pCtx->cr4 & X86_CR4_VME))
549 return iemRaiseGeneralProtectionFault0(pVCpu);
550 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
551 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
552 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
553 }
554 else
555 {
556
557 /*
558 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
559 */
560 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
561
562 switch (enmEffOpSize)
563 {
564 case IEMMODE_16BIT:
565 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
566 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
567 fEfl |= UINT16_C(0xf000);
568 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
569 break;
570 case IEMMODE_32BIT:
571 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
572 break;
573 case IEMMODE_64BIT:
574 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
575 break;
576 IEM_NOT_REACHED_DEFAULT_CASE_RET();
577 }
578 }
579 if (rcStrict != VINF_SUCCESS)
580 return rcStrict;
581
582 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
583 return VINF_SUCCESS;
584}
585
586
587/**
588 * Implements popf.
589 *
590 * @param enmEffOpSize The effective operand size.
591 */
592IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
593{
594 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
595 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
596 VBOXSTRICTRC rcStrict;
597 uint32_t fEflNew;
598
599 /*
600 * V8086 is special as usual.
601 */
602 if (fEflOld & X86_EFL_VM)
603 {
604 /*
605 * Almost anything goes if IOPL is 3.
606 */
607 if (X86_EFL_GET_IOPL(fEflOld) == 3)
608 {
609 switch (enmEffOpSize)
610 {
611 case IEMMODE_16BIT:
612 {
613 uint16_t u16Value;
614 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
615 if (rcStrict != VINF_SUCCESS)
616 return rcStrict;
617 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
618 break;
619 }
620 case IEMMODE_32BIT:
621 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
622 if (rcStrict != VINF_SUCCESS)
623 return rcStrict;
624 break;
625 IEM_NOT_REACHED_DEFAULT_CASE_RET();
626 }
627
628 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
629 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
630 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
631 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
632 }
633 /*
634 * Interrupt flag virtualization with CR4.VME=1.
635 */
636 else if ( enmEffOpSize == IEMMODE_16BIT
637 && (pCtx->cr4 & X86_CR4_VME) )
638 {
639 uint16_t u16Value;
640 RTUINT64U TmpRsp;
641 TmpRsp.u = pCtx->rsp;
642 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
643 if (rcStrict != VINF_SUCCESS)
644 return rcStrict;
645
646 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
647 * or before? */
648 if ( ( (u16Value & X86_EFL_IF)
649 && (fEflOld & X86_EFL_VIP))
650 || (u16Value & X86_EFL_TF) )
651 return iemRaiseGeneralProtectionFault0(pVCpu);
652
653 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
654 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
655 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
656 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
657
658 pCtx->rsp = TmpRsp.u;
659 }
660 else
661 return iemRaiseGeneralProtectionFault0(pVCpu);
662
663 }
664 /*
665 * Not in V8086 mode.
666 */
667 else
668 {
669 /* Pop the flags. */
670 switch (enmEffOpSize)
671 {
672 case IEMMODE_16BIT:
673 {
674 uint16_t u16Value;
675 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
676 if (rcStrict != VINF_SUCCESS)
677 return rcStrict;
678 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
679
680 /*
681 * Ancient CPU adjustments:
682 * - 8086, 80186, V20/30:
683 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
684 * practical reasons (masking below). We add them when pushing flags.
685 * - 80286:
686 * The NT and IOPL flags cannot be popped from real mode and are
687 * therefore always zero (since a 286 can never exit from PM and
688 * their initial value is zero). This changed on a 386 and can
689 * therefore be used to detect 286 or 386 CPU in real mode.
690 */
691 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
692 && !(pCtx->cr0 & X86_CR0_PE) )
693 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
694 break;
695 }
696 case IEMMODE_32BIT:
697 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
698 if (rcStrict != VINF_SUCCESS)
699 return rcStrict;
700 break;
701 case IEMMODE_64BIT:
702 {
703 uint64_t u64Value;
704 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
705 if (rcStrict != VINF_SUCCESS)
706 return rcStrict;
707 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
708 break;
709 }
710 IEM_NOT_REACHED_DEFAULT_CASE_RET();
711 }
712
713 /* Merge them with the current flags. */
714 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
715 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
716 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
717 || pVCpu->iem.s.uCpl == 0)
718 {
719 fEflNew &= fPopfBits;
720 fEflNew |= ~fPopfBits & fEflOld;
721 }
722 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
723 {
724 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
725 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
726 }
727 else
728 {
729 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
730 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
731 }
732 }
733
734 /*
735 * Commit the flags.
736 */
737 Assert(fEflNew & RT_BIT_32(1));
738 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
739 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
740
741 return VINF_SUCCESS;
742}
743
744
745/**
746 * Implements an indirect call.
747 *
748 * @param uNewPC The new program counter (RIP) value (loaded from the
749 * operand).
750 * @param enmEffOpSize The effective operand size.
751 */
752IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
753{
754 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
755 uint16_t uOldPC = pCtx->ip + cbInstr;
756 if (uNewPC > pCtx->cs.u32Limit)
757 return iemRaiseGeneralProtectionFault0(pVCpu);
758
759 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
760 if (rcStrict != VINF_SUCCESS)
761 return rcStrict;
762
763 pCtx->rip = uNewPC;
764 pCtx->eflags.Bits.u1RF = 0;
765
766#ifndef IEM_WITH_CODE_TLB
767 /* Flush the prefetch buffer. */
768 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
769#endif
770 return VINF_SUCCESS;
771}
772
773
774/**
775 * Implements a 16-bit relative call.
776 *
777 * @param offDisp The displacment offset.
778 */
779IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
780{
781 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
782 uint16_t uOldPC = pCtx->ip + cbInstr;
783 uint16_t uNewPC = uOldPC + offDisp;
784 if (uNewPC > pCtx->cs.u32Limit)
785 return iemRaiseGeneralProtectionFault0(pVCpu);
786
787 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
788 if (rcStrict != VINF_SUCCESS)
789 return rcStrict;
790
791 pCtx->rip = uNewPC;
792 pCtx->eflags.Bits.u1RF = 0;
793
794#ifndef IEM_WITH_CODE_TLB
795 /* Flush the prefetch buffer. */
796 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
797#endif
798 return VINF_SUCCESS;
799}
800
801
802/**
803 * Implements a 32-bit indirect call.
804 *
805 * @param uNewPC The new program counter (RIP) value (loaded from the
806 * operand).
807 * @param enmEffOpSize The effective operand size.
808 */
809IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
810{
811 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
812 uint32_t uOldPC = pCtx->eip + cbInstr;
813 if (uNewPC > pCtx->cs.u32Limit)
814 return iemRaiseGeneralProtectionFault0(pVCpu);
815
816 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
817 if (rcStrict != VINF_SUCCESS)
818 return rcStrict;
819
820#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
821 /*
822 * CASM hook for recording interesting indirect calls.
823 */
824 if ( !pCtx->eflags.Bits.u1IF
825 && (pCtx->cr0 & X86_CR0_PG)
826 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
827 && pVCpu->iem.s.uCpl == 0)
828 {
829 EMSTATE enmState = EMGetState(pVCpu);
830 if ( enmState == EMSTATE_IEM_THEN_REM
831 || enmState == EMSTATE_IEM
832 || enmState == EMSTATE_REM)
833 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
834 }
835#endif
836
837 pCtx->rip = uNewPC;
838 pCtx->eflags.Bits.u1RF = 0;
839
840#ifndef IEM_WITH_CODE_TLB
841 /* Flush the prefetch buffer. */
842 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
843#endif
844 return VINF_SUCCESS;
845}
846
847
848/**
849 * Implements a 32-bit relative call.
850 *
851 * @param offDisp The displacment offset.
852 */
853IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
854{
855 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
856 uint32_t uOldPC = pCtx->eip + cbInstr;
857 uint32_t uNewPC = uOldPC + offDisp;
858 if (uNewPC > pCtx->cs.u32Limit)
859 return iemRaiseGeneralProtectionFault0(pVCpu);
860
861 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
862 if (rcStrict != VINF_SUCCESS)
863 return rcStrict;
864
865 pCtx->rip = uNewPC;
866 pCtx->eflags.Bits.u1RF = 0;
867
868#ifndef IEM_WITH_CODE_TLB
869 /* Flush the prefetch buffer. */
870 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
871#endif
872 return VINF_SUCCESS;
873}
874
875
876/**
877 * Implements a 64-bit indirect call.
878 *
879 * @param uNewPC The new program counter (RIP) value (loaded from the
880 * operand).
881 * @param enmEffOpSize The effective operand size.
882 */
883IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
884{
885 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
886 uint64_t uOldPC = pCtx->rip + cbInstr;
887 if (!IEM_IS_CANONICAL(uNewPC))
888 return iemRaiseGeneralProtectionFault0(pVCpu);
889
890 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
891 if (rcStrict != VINF_SUCCESS)
892 return rcStrict;
893
894 pCtx->rip = uNewPC;
895 pCtx->eflags.Bits.u1RF = 0;
896
897#ifndef IEM_WITH_CODE_TLB
898 /* Flush the prefetch buffer. */
899 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
900#endif
901 return VINF_SUCCESS;
902}
903
904
905/**
906 * Implements a 64-bit relative call.
907 *
908 * @param offDisp The displacment offset.
909 */
910IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
911{
912 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
913 uint64_t uOldPC = pCtx->rip + cbInstr;
914 uint64_t uNewPC = uOldPC + offDisp;
915 if (!IEM_IS_CANONICAL(uNewPC))
916 return iemRaiseNotCanonical(pVCpu);
917
918 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
919 if (rcStrict != VINF_SUCCESS)
920 return rcStrict;
921
922 pCtx->rip = uNewPC;
923 pCtx->eflags.Bits.u1RF = 0;
924
925#ifndef IEM_WITH_CODE_TLB
926 /* Flush the prefetch buffer. */
927 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
928#endif
929
930 return VINF_SUCCESS;
931}
932
933
934/**
935 * Implements far jumps and calls thru task segments (TSS).
936 *
937 * @param uSel The selector.
938 * @param enmBranch The kind of branching we're performing.
939 * @param enmEffOpSize The effective operand size.
940 * @param pDesc The descriptor corresponding to @a uSel. The type is
941 * task gate.
942 */
943IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
944{
945#ifndef IEM_IMPLEMENTS_TASKSWITCH
946 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
947#else
948 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
949 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
950 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
951 RT_NOREF_PV(enmEffOpSize);
952
953 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
954 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
955 {
956 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
957 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
958 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
959 }
960
961 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
962 * far calls (see iemCImpl_callf). Most likely in both cases it should be
963 * checked here, need testcases. */
964 if (!pDesc->Legacy.Gen.u1Present)
965 {
966 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
967 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
968 }
969
970 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
971 uint32_t uNextEip = pCtx->eip + cbInstr;
972 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
973 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
974#endif
975}
976
977
978/**
979 * Implements far jumps and calls thru task gates.
980 *
981 * @param uSel The selector.
982 * @param enmBranch The kind of branching we're performing.
983 * @param enmEffOpSize The effective operand size.
984 * @param pDesc The descriptor corresponding to @a uSel. The type is
985 * task gate.
986 */
987IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
988{
989#ifndef IEM_IMPLEMENTS_TASKSWITCH
990 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
991#else
992 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
993 RT_NOREF_PV(enmEffOpSize);
994
995 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
996 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
997 {
998 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
999 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1000 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1001 }
1002
1003 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1004 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1005 * checked here, need testcases. */
1006 if (!pDesc->Legacy.Gen.u1Present)
1007 {
1008 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1009 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1010 }
1011
1012 /*
1013 * Fetch the new TSS descriptor from the GDT.
1014 */
1015 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1016 if (uSelTss & X86_SEL_LDT)
1017 {
1018 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1019 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1020 }
1021
1022 IEMSELDESC TssDesc;
1023 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1024 if (rcStrict != VINF_SUCCESS)
1025 return rcStrict;
1026
1027 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1028 {
1029 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1030 TssDesc.Legacy.Gate.u4Type));
1031 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1032 }
1033
1034 if (!TssDesc.Legacy.Gate.u1Present)
1035 {
1036 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1037 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1038 }
1039
1040 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1041 uint32_t uNextEip = pCtx->eip + cbInstr;
1042 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1043 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1044#endif
1045}
1046
1047
1048/**
1049 * Implements far jumps and calls thru call gates.
1050 *
1051 * @param uSel The selector.
1052 * @param enmBranch The kind of branching we're performing.
1053 * @param enmEffOpSize The effective operand size.
1054 * @param pDesc The descriptor corresponding to @a uSel. The type is
1055 * call gate.
1056 */
1057IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1058{
1059#define IEM_IMPLEMENTS_CALLGATE
1060#ifndef IEM_IMPLEMENTS_CALLGATE
1061 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1062#else
1063 RT_NOREF_PV(enmEffOpSize);
1064
1065 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1066 * inter-privilege calls and are much more complex.
1067 *
1068 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1069 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1070 * must be 16-bit or 32-bit.
1071 */
1072 /** @todo: effective operand size is probably irrelevant here, only the
1073 * call gate bitness matters??
1074 */
1075 VBOXSTRICTRC rcStrict;
1076 RTPTRUNION uPtrRet;
1077 uint64_t uNewRsp;
1078 uint64_t uNewRip;
1079 uint64_t u64Base;
1080 uint32_t cbLimit;
1081 RTSEL uNewCS;
1082 IEMSELDESC DescCS;
1083
1084 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1085 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1086 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1087 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1088
1089 /* Determine the new instruction pointer from the gate descriptor. */
1090 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1091 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1092 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1093
1094 /* Perform DPL checks on the gate descriptor. */
1095 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1096 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1097 {
1098 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1099 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1100 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1101 }
1102
1103 /** @todo does this catch NULL selectors, too? */
1104 if (!pDesc->Legacy.Gen.u1Present)
1105 {
1106 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1107 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1108 }
1109
1110 /*
1111 * Fetch the target CS descriptor from the GDT or LDT.
1112 */
1113 uNewCS = pDesc->Legacy.Gate.u16Sel;
1114 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1115 if (rcStrict != VINF_SUCCESS)
1116 return rcStrict;
1117
1118 /* Target CS must be a code selector. */
1119 if ( !DescCS.Legacy.Gen.u1DescType
1120 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1121 {
1122 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1123 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1124 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1125 }
1126
1127 /* Privilege checks on target CS. */
1128 if (enmBranch == IEMBRANCH_JUMP)
1129 {
1130 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1131 {
1132 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1133 {
1134 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1135 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1137 }
1138 }
1139 else
1140 {
1141 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1142 {
1143 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1144 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1145 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1146 }
1147 }
1148 }
1149 else
1150 {
1151 Assert(enmBranch == IEMBRANCH_CALL);
1152 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1153 {
1154 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1155 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1156 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1157 }
1158 }
1159
1160 /* Additional long mode checks. */
1161 if (IEM_IS_LONG_MODE(pVCpu))
1162 {
1163 if (!DescCS.Legacy.Gen.u1Long)
1164 {
1165 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1167 }
1168
1169 /* L vs D. */
1170 if ( DescCS.Legacy.Gen.u1Long
1171 && DescCS.Legacy.Gen.u1DefBig)
1172 {
1173 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1174 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1175 }
1176 }
1177
1178 if (!DescCS.Legacy.Gate.u1Present)
1179 {
1180 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1181 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1182 }
1183
1184 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1185
1186 if (enmBranch == IEMBRANCH_JUMP)
1187 {
1188 /** @todo: This is very similar to regular far jumps; merge! */
1189 /* Jumps are fairly simple... */
1190
1191 /* Chop the high bits off if 16-bit gate (Intel says so). */
1192 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1193 uNewRip = (uint16_t)uNewRip;
1194
1195 /* Limit check for non-long segments. */
1196 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1197 if (DescCS.Legacy.Gen.u1Long)
1198 u64Base = 0;
1199 else
1200 {
1201 if (uNewRip > cbLimit)
1202 {
1203 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1204 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1205 }
1206 u64Base = X86DESC_BASE(&DescCS.Legacy);
1207 }
1208
1209 /* Canonical address check. */
1210 if (!IEM_IS_CANONICAL(uNewRip))
1211 {
1212 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1213 return iemRaiseNotCanonical(pVCpu);
1214 }
1215
1216 /*
1217 * Ok, everything checked out fine. Now set the accessed bit before
1218 * committing the result into CS, CSHID and RIP.
1219 */
1220 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1221 {
1222 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1223 if (rcStrict != VINF_SUCCESS)
1224 return rcStrict;
1225 /** @todo check what VT-x and AMD-V does. */
1226 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1227 }
1228
1229 /* commit */
1230 pCtx->rip = uNewRip;
1231 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1232 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1233 pCtx->cs.ValidSel = pCtx->cs.Sel;
1234 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1235 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1236 pCtx->cs.u32Limit = cbLimit;
1237 pCtx->cs.u64Base = u64Base;
1238 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1239 }
1240 else
1241 {
1242 Assert(enmBranch == IEMBRANCH_CALL);
1243 /* Calls are much more complicated. */
1244
1245 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1246 {
1247 uint16_t offNewStack; /* Offset of new stack in TSS. */
1248 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1249 uint8_t uNewCSDpl;
1250 uint8_t cbWords;
1251 RTSEL uNewSS;
1252 RTSEL uOldSS;
1253 uint64_t uOldRsp;
1254 IEMSELDESC DescSS;
1255 RTPTRUNION uPtrTSS;
1256 RTGCPTR GCPtrTSS;
1257 RTPTRUNION uPtrParmWds;
1258 RTGCPTR GCPtrParmWds;
1259
1260 /* More privilege. This is the fun part. */
1261 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1262
1263 /*
1264 * Determine new SS:rSP from the TSS.
1265 */
1266 Assert(!pCtx->tr.Attr.n.u1DescType);
1267
1268 /* Figure out where the new stack pointer is stored in the TSS. */
1269 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1270 if (!IEM_IS_LONG_MODE(pVCpu))
1271 {
1272 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1273 {
1274 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1275 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1276 }
1277 else
1278 {
1279 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1280 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1281 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1282 }
1283 }
1284 else
1285 {
1286 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1287 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1288 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1289 }
1290
1291 /* Check against TSS limit. */
1292 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1293 {
1294 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1295 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1296 }
1297
1298 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1299 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1300 if (rcStrict != VINF_SUCCESS)
1301 {
1302 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1303 return rcStrict;
1304 }
1305
1306 if (!IEM_IS_LONG_MODE(pVCpu))
1307 {
1308 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1309 {
1310 uNewRsp = uPtrTSS.pu32[0];
1311 uNewSS = uPtrTSS.pu16[2];
1312 }
1313 else
1314 {
1315 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1316 uNewRsp = uPtrTSS.pu16[0];
1317 uNewSS = uPtrTSS.pu16[1];
1318 }
1319 }
1320 else
1321 {
1322 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1323 /* SS will be a NULL selector, but that's valid. */
1324 uNewRsp = uPtrTSS.pu64[0];
1325 uNewSS = uNewCSDpl;
1326 }
1327
1328 /* Done with the TSS now. */
1329 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1330 if (rcStrict != VINF_SUCCESS)
1331 {
1332 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1333 return rcStrict;
1334 }
1335
1336 /* Only used outside of long mode. */
1337 cbWords = pDesc->Legacy.Gate.u4ParmCount;
1338
1339 /* If EFER.LMA is 0, there's extra work to do. */
1340 if (!IEM_IS_LONG_MODE(pVCpu))
1341 {
1342 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1343 {
1344 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1345 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1346 }
1347
1348 /* Grab the new SS descriptor. */
1349 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1350 if (rcStrict != VINF_SUCCESS)
1351 return rcStrict;
1352
1353 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1354 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1355 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1356 {
1357 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1358 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1359 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1360 }
1361
1362 /* Ensure new SS is a writable data segment. */
1363 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1364 {
1365 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1366 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1367 }
1368
1369 if (!DescSS.Legacy.Gen.u1Present)
1370 {
1371 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1372 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1373 }
1374 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1375 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1376 else
1377 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1378 }
1379 else
1380 {
1381 /* Just grab the new (NULL) SS descriptor. */
1382 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1383 if (rcStrict != VINF_SUCCESS)
1384 return rcStrict;
1385
1386 cbNewStack = sizeof(uint64_t) * 4;
1387 }
1388
1389 /** @todo: According to Intel, new stack is checked for enough space first,
1390 * then switched. According to AMD, the stack is switched first and
1391 * then pushes might fault!
1392 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1393 * incoming stack #PF happens before actual stack switch. AMD is
1394 * either lying or implicitly assumes that new state is committed
1395 * only if and when an instruction doesn't fault.
1396 */
1397
1398 /** @todo: According to AMD, CS is loaded first, then SS.
1399 * According to Intel, it's the other way around!?
1400 */
1401
1402 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1403
1404 /* Set the accessed bit before committing new SS. */
1405 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1406 {
1407 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1408 if (rcStrict != VINF_SUCCESS)
1409 return rcStrict;
1410 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1411 }
1412
1413 /* Remember the old SS:rSP and their linear address. */
1414 uOldSS = pCtx->ss.Sel;
1415 uOldRsp = pCtx->ss.Attr.n.u1DefBig ? pCtx->rsp : pCtx->sp;
1416
1417 GCPtrParmWds = pCtx->ss.u64Base + uOldRsp;
1418
1419 /* Probe if the write to the new stack will succeed. May #SS(NewSS) or #PF. */
1420 void *pvNewFrame;
1421 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1422 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1423 if (rcStrict != VINF_SUCCESS)
1424 {
1425 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1426 return rcStrict;
1427 }
1428 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1429 if (rcStrict != VINF_SUCCESS)
1430 {
1431 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1432 return rcStrict;
1433 }
1434
1435 /* Commit new SS:rSP. */
1436 pCtx->ss.Sel = uNewSS;
1437 pCtx->ss.ValidSel = uNewSS;
1438 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1439 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1440 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1441 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1442 pCtx->rsp = uNewRsp;
1443 pVCpu->iem.s.uCpl = uNewCSDpl;
1444 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1445 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1446
1447 /* At this point the stack access must not fail because new state was already committed. */
1448 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1449 &uPtrRet.pv, &uNewRsp);
1450 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1451 VERR_IPE_UNEXPECTED_STATUS);
1452
1453 if (!IEM_IS_LONG_MODE(pVCpu))
1454 {
1455 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1456 {
1457 /* Push the old CS:rIP. */
1458 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1459 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1460
1461 if (cbWords) {
1462 /* Map the relevant chunk of the old stack. */
1463 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1464 if (rcStrict != VINF_SUCCESS)
1465 {
1466 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1467 return rcStrict;
1468 }
1469
1470 /* Copy the parameter (d)words. */
1471 for (int i = 0; i < cbWords; ++i)
1472 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1473
1474 /* Unmap the old stack. */
1475 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1476 if (rcStrict != VINF_SUCCESS)
1477 {
1478 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1479 return rcStrict;
1480 }
1481 }
1482
1483 /* Push the old SS:rSP. */
1484 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1485 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1486 }
1487 else
1488 {
1489 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1490
1491 /* Push the old CS:rIP. */
1492 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1493 uPtrRet.pu16[1] = pCtx->cs.Sel;
1494
1495 if (cbWords) {
1496 /* Map the relevant chunk of the old stack. */
1497 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1498 if (rcStrict != VINF_SUCCESS)
1499 {
1500 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1501 return rcStrict;
1502 }
1503
1504 /* Copy the parameter words. */
1505 for (int i = 0; i < cbWords; ++i)
1506 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1507
1508 /* Unmap the old stack. */
1509 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1510 if (rcStrict != VINF_SUCCESS)
1511 {
1512 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1513 return rcStrict;
1514 }
1515 }
1516
1517 /* Push the old SS:rSP. */
1518 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1519 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1520 }
1521 }
1522 else
1523 {
1524 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1525
1526 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1527 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1528 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1529 uPtrRet.pu64[2] = uOldRsp;
1530 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1531 }
1532
1533 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1534 if (rcStrict != VINF_SUCCESS)
1535 {
1536 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1537 return rcStrict;
1538 }
1539
1540 /* Chop the high bits off if 16-bit gate (Intel says so). */
1541 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1542 uNewRip = (uint16_t)uNewRip;
1543
1544 /* Limit / canonical check. */
1545 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1546 if (!IEM_IS_LONG_MODE(pVCpu))
1547 {
1548 if (uNewRip > cbLimit)
1549 {
1550 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1551 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1552 }
1553 u64Base = X86DESC_BASE(&DescCS.Legacy);
1554 }
1555 else
1556 {
1557 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1558 if (!IEM_IS_CANONICAL(uNewRip))
1559 {
1560 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1561 return iemRaiseNotCanonical(pVCpu);
1562 }
1563 u64Base = 0;
1564 }
1565
1566 /*
1567 * Now set the accessed bit before
1568 * writing the return address to the stack and committing the result into
1569 * CS, CSHID and RIP.
1570 */
1571 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1572 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1573 {
1574 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1575 if (rcStrict != VINF_SUCCESS)
1576 return rcStrict;
1577 /** @todo check what VT-x and AMD-V does. */
1578 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1579 }
1580
1581 /* Commit new CS:rIP. */
1582 pCtx->rip = uNewRip;
1583 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1584 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1585 pCtx->cs.ValidSel = pCtx->cs.Sel;
1586 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1587 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1588 pCtx->cs.u32Limit = cbLimit;
1589 pCtx->cs.u64Base = u64Base;
1590 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1591 }
1592 else
1593 {
1594 /* Same privilege. */
1595 /** @todo: This is very similar to regular far calls; merge! */
1596
1597 /* Check stack first - may #SS(0). */
1598 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1599 * 16-bit code cause a two or four byte CS to be pushed? */
1600 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1601 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1602 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1603 &uPtrRet.pv, &uNewRsp);
1604 if (rcStrict != VINF_SUCCESS)
1605 return rcStrict;
1606
1607 /* Chop the high bits off if 16-bit gate (Intel says so). */
1608 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1609 uNewRip = (uint16_t)uNewRip;
1610
1611 /* Limit / canonical check. */
1612 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1613 if (!IEM_IS_LONG_MODE(pVCpu))
1614 {
1615 if (uNewRip > cbLimit)
1616 {
1617 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1618 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1619 }
1620 u64Base = X86DESC_BASE(&DescCS.Legacy);
1621 }
1622 else
1623 {
1624 if (!IEM_IS_CANONICAL(uNewRip))
1625 {
1626 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1627 return iemRaiseNotCanonical(pVCpu);
1628 }
1629 u64Base = 0;
1630 }
1631
1632 /*
1633 * Now set the accessed bit before
1634 * writing the return address to the stack and committing the result into
1635 * CS, CSHID and RIP.
1636 */
1637 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1638 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1639 {
1640 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1641 if (rcStrict != VINF_SUCCESS)
1642 return rcStrict;
1643 /** @todo check what VT-x and AMD-V does. */
1644 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1645 }
1646
1647 /* stack */
1648 if (!IEM_IS_LONG_MODE(pVCpu))
1649 {
1650 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1651 {
1652 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1653 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1654 }
1655 else
1656 {
1657 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1658 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1659 uPtrRet.pu16[1] = pCtx->cs.Sel;
1660 }
1661 }
1662 else
1663 {
1664 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1665 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1666 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1667 }
1668
1669 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1670 if (rcStrict != VINF_SUCCESS)
1671 return rcStrict;
1672
1673 /* commit */
1674 pCtx->rip = uNewRip;
1675 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1676 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1677 pCtx->cs.ValidSel = pCtx->cs.Sel;
1678 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1679 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1680 pCtx->cs.u32Limit = cbLimit;
1681 pCtx->cs.u64Base = u64Base;
1682 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1683 }
1684 }
1685 pCtx->eflags.Bits.u1RF = 0;
1686
1687 /* Flush the prefetch buffer. */
1688# ifdef IEM_WITH_CODE_TLB
1689 pVCpu->iem.s.pbInstrBuf = NULL;
1690# else
1691 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1692# endif
1693 return VINF_SUCCESS;
1694#endif
1695}
1696
1697
1698/**
1699 * Implements far jumps and calls thru system selectors.
1700 *
1701 * @param uSel The selector.
1702 * @param enmBranch The kind of branching we're performing.
1703 * @param enmEffOpSize The effective operand size.
1704 * @param pDesc The descriptor corresponding to @a uSel.
1705 */
1706IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1707{
1708 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1709 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1710
1711 if (IEM_IS_LONG_MODE(pVCpu))
1712 switch (pDesc->Legacy.Gen.u4Type)
1713 {
1714 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1715 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1716
1717 default:
1718 case AMD64_SEL_TYPE_SYS_LDT:
1719 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1720 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1721 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1722 case AMD64_SEL_TYPE_SYS_INT_GATE:
1723 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1724 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1725 }
1726
1727 switch (pDesc->Legacy.Gen.u4Type)
1728 {
1729 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1730 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1731 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1732
1733 case X86_SEL_TYPE_SYS_TASK_GATE:
1734 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1735
1736 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1737 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1738 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1739
1740 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1741 Log(("branch %04x -> busy 286 TSS\n", uSel));
1742 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1743
1744 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1745 Log(("branch %04x -> busy 386 TSS\n", uSel));
1746 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1747
1748 default:
1749 case X86_SEL_TYPE_SYS_LDT:
1750 case X86_SEL_TYPE_SYS_286_INT_GATE:
1751 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1752 case X86_SEL_TYPE_SYS_386_INT_GATE:
1753 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1754 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1755 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1756 }
1757}
1758
1759
1760/**
1761 * Implements far jumps.
1762 *
1763 * @param uSel The selector.
1764 * @param offSeg The segment offset.
1765 * @param enmEffOpSize The effective operand size.
1766 */
1767IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1768{
1769 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1770 NOREF(cbInstr);
1771 Assert(offSeg <= UINT32_MAX);
1772
1773 /*
1774 * Real mode and V8086 mode are easy. The only snag seems to be that
1775 * CS.limit doesn't change and the limit check is done against the current
1776 * limit.
1777 */
1778 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1779 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1780 {
1781 if (offSeg > pCtx->cs.u32Limit)
1782 {
1783 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1784 return iemRaiseGeneralProtectionFault0(pVCpu);
1785 }
1786
1787 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1788 pCtx->rip = offSeg;
1789 else
1790 pCtx->rip = offSeg & UINT16_MAX;
1791 pCtx->cs.Sel = uSel;
1792 pCtx->cs.ValidSel = uSel;
1793 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1794 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1795 pCtx->eflags.Bits.u1RF = 0;
1796 return VINF_SUCCESS;
1797 }
1798
1799 /*
1800 * Protected mode. Need to parse the specified descriptor...
1801 */
1802 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1803 {
1804 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1805 return iemRaiseGeneralProtectionFault0(pVCpu);
1806 }
1807
1808 /* Fetch the descriptor. */
1809 IEMSELDESC Desc;
1810 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1811 if (rcStrict != VINF_SUCCESS)
1812 return rcStrict;
1813
1814 /* Is it there? */
1815 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1816 {
1817 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1818 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1819 }
1820
1821 /*
1822 * Deal with it according to its type. We do the standard code selectors
1823 * here and dispatch the system selectors to worker functions.
1824 */
1825 if (!Desc.Legacy.Gen.u1DescType)
1826 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1827
1828 /* Only code segments. */
1829 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1830 {
1831 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1832 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1833 }
1834
1835 /* L vs D. */
1836 if ( Desc.Legacy.Gen.u1Long
1837 && Desc.Legacy.Gen.u1DefBig
1838 && IEM_IS_LONG_MODE(pVCpu))
1839 {
1840 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1842 }
1843
1844 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1845 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1846 {
1847 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1848 {
1849 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1850 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1851 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1852 }
1853 }
1854 else
1855 {
1856 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1857 {
1858 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1859 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1860 }
1861 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1862 {
1863 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1864 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1865 }
1866 }
1867
1868 /* Chop the high bits if 16-bit (Intel says so). */
1869 if (enmEffOpSize == IEMMODE_16BIT)
1870 offSeg &= UINT16_MAX;
1871
1872 /* Limit check. (Should alternatively check for non-canonical addresses
1873 here, but that is ruled out by offSeg being 32-bit, right?) */
1874 uint64_t u64Base;
1875 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1876 if (Desc.Legacy.Gen.u1Long)
1877 u64Base = 0;
1878 else
1879 {
1880 if (offSeg > cbLimit)
1881 {
1882 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1883 /** @todo: Intel says this is #GP(0)! */
1884 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1885 }
1886 u64Base = X86DESC_BASE(&Desc.Legacy);
1887 }
1888
1889 /*
1890 * Ok, everything checked out fine. Now set the accessed bit before
1891 * committing the result into CS, CSHID and RIP.
1892 */
1893 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1894 {
1895 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1896 if (rcStrict != VINF_SUCCESS)
1897 return rcStrict;
1898 /** @todo check what VT-x and AMD-V does. */
1899 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1900 }
1901
1902 /* commit */
1903 pCtx->rip = offSeg;
1904 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1905 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1906 pCtx->cs.ValidSel = pCtx->cs.Sel;
1907 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1908 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1909 pCtx->cs.u32Limit = cbLimit;
1910 pCtx->cs.u64Base = u64Base;
1911 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1912 pCtx->eflags.Bits.u1RF = 0;
1913 /** @todo check if the hidden bits are loaded correctly for 64-bit
1914 * mode. */
1915
1916 /* Flush the prefetch buffer. */
1917#ifdef IEM_WITH_CODE_TLB
1918 pVCpu->iem.s.pbInstrBuf = NULL;
1919#else
1920 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1921#endif
1922
1923 return VINF_SUCCESS;
1924}
1925
1926
1927/**
1928 * Implements far calls.
1929 *
1930 * This very similar to iemCImpl_FarJmp.
1931 *
1932 * @param uSel The selector.
1933 * @param offSeg The segment offset.
1934 * @param enmEffOpSize The operand size (in case we need it).
1935 */
1936IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1937{
1938 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1939 VBOXSTRICTRC rcStrict;
1940 uint64_t uNewRsp;
1941 RTPTRUNION uPtrRet;
1942
1943 /*
1944 * Real mode and V8086 mode are easy. The only snag seems to be that
1945 * CS.limit doesn't change and the limit check is done against the current
1946 * limit.
1947 */
1948 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1949 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1950 {
1951 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1952
1953 /* Check stack first - may #SS(0). */
1954 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1955 &uPtrRet.pv, &uNewRsp);
1956 if (rcStrict != VINF_SUCCESS)
1957 return rcStrict;
1958
1959 /* Check the target address range. */
1960 if (offSeg > UINT32_MAX)
1961 return iemRaiseGeneralProtectionFault0(pVCpu);
1962
1963 /* Everything is fine, push the return address. */
1964 if (enmEffOpSize == IEMMODE_16BIT)
1965 {
1966 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1967 uPtrRet.pu16[1] = pCtx->cs.Sel;
1968 }
1969 else
1970 {
1971 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1972 uPtrRet.pu16[3] = pCtx->cs.Sel;
1973 }
1974 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1975 if (rcStrict != VINF_SUCCESS)
1976 return rcStrict;
1977
1978 /* Branch. */
1979 pCtx->rip = offSeg;
1980 pCtx->cs.Sel = uSel;
1981 pCtx->cs.ValidSel = uSel;
1982 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1983 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1984 pCtx->eflags.Bits.u1RF = 0;
1985 return VINF_SUCCESS;
1986 }
1987
1988 /*
1989 * Protected mode. Need to parse the specified descriptor...
1990 */
1991 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1992 {
1993 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1994 return iemRaiseGeneralProtectionFault0(pVCpu);
1995 }
1996
1997 /* Fetch the descriptor. */
1998 IEMSELDESC Desc;
1999 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2000 if (rcStrict != VINF_SUCCESS)
2001 return rcStrict;
2002
2003 /*
2004 * Deal with it according to its type. We do the standard code selectors
2005 * here and dispatch the system selectors to worker functions.
2006 */
2007 if (!Desc.Legacy.Gen.u1DescType)
2008 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2009
2010 /* Only code segments. */
2011 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2012 {
2013 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2014 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2015 }
2016
2017 /* L vs D. */
2018 if ( Desc.Legacy.Gen.u1Long
2019 && Desc.Legacy.Gen.u1DefBig
2020 && IEM_IS_LONG_MODE(pVCpu))
2021 {
2022 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2023 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2024 }
2025
2026 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2027 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2028 {
2029 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2030 {
2031 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2032 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2033 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2034 }
2035 }
2036 else
2037 {
2038 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2039 {
2040 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2041 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2042 }
2043 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2044 {
2045 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2046 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2047 }
2048 }
2049
2050 /* Is it there? */
2051 if (!Desc.Legacy.Gen.u1Present)
2052 {
2053 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2054 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2055 }
2056
2057 /* Check stack first - may #SS(0). */
2058 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2059 * 16-bit code cause a two or four byte CS to be pushed? */
2060 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2061 enmEffOpSize == IEMMODE_64BIT ? 8+8
2062 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2063 &uPtrRet.pv, &uNewRsp);
2064 if (rcStrict != VINF_SUCCESS)
2065 return rcStrict;
2066
2067 /* Chop the high bits if 16-bit (Intel says so). */
2068 if (enmEffOpSize == IEMMODE_16BIT)
2069 offSeg &= UINT16_MAX;
2070
2071 /* Limit / canonical check. */
2072 uint64_t u64Base;
2073 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2074 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2075 {
2076 if (!IEM_IS_CANONICAL(offSeg))
2077 {
2078 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2079 return iemRaiseNotCanonical(pVCpu);
2080 }
2081 u64Base = 0;
2082 }
2083 else
2084 {
2085 if (offSeg > cbLimit)
2086 {
2087 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2088 /** @todo: Intel says this is #GP(0)! */
2089 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2090 }
2091 u64Base = X86DESC_BASE(&Desc.Legacy);
2092 }
2093
2094 /*
2095 * Now set the accessed bit before
2096 * writing the return address to the stack and committing the result into
2097 * CS, CSHID and RIP.
2098 */
2099 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2100 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2101 {
2102 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2103 if (rcStrict != VINF_SUCCESS)
2104 return rcStrict;
2105 /** @todo check what VT-x and AMD-V does. */
2106 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2107 }
2108
2109 /* stack */
2110 if (enmEffOpSize == IEMMODE_16BIT)
2111 {
2112 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2113 uPtrRet.pu16[1] = pCtx->cs.Sel;
2114 }
2115 else if (enmEffOpSize == IEMMODE_32BIT)
2116 {
2117 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2118 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2119 }
2120 else
2121 {
2122 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2123 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2124 }
2125 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2126 if (rcStrict != VINF_SUCCESS)
2127 return rcStrict;
2128
2129 /* commit */
2130 pCtx->rip = offSeg;
2131 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2132 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2133 pCtx->cs.ValidSel = pCtx->cs.Sel;
2134 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2135 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2136 pCtx->cs.u32Limit = cbLimit;
2137 pCtx->cs.u64Base = u64Base;
2138 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2139 pCtx->eflags.Bits.u1RF = 0;
2140 /** @todo check if the hidden bits are loaded correctly for 64-bit
2141 * mode. */
2142
2143 /* Flush the prefetch buffer. */
2144#ifdef IEM_WITH_CODE_TLB
2145 pVCpu->iem.s.pbInstrBuf = NULL;
2146#else
2147 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2148#endif
2149 return VINF_SUCCESS;
2150}
2151
2152
2153/**
2154 * Implements retf.
2155 *
2156 * @param enmEffOpSize The effective operand size.
2157 * @param cbPop The amount of arguments to pop from the stack
2158 * (bytes).
2159 */
2160IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2161{
2162 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2163 VBOXSTRICTRC rcStrict;
2164 RTCPTRUNION uPtrFrame;
2165 uint64_t uNewRsp;
2166 uint64_t uNewRip;
2167 uint16_t uNewCs;
2168 NOREF(cbInstr);
2169
2170 /*
2171 * Read the stack values first.
2172 */
2173 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2174 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2175 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2176 if (rcStrict != VINF_SUCCESS)
2177 return rcStrict;
2178 if (enmEffOpSize == IEMMODE_16BIT)
2179 {
2180 uNewRip = uPtrFrame.pu16[0];
2181 uNewCs = uPtrFrame.pu16[1];
2182 }
2183 else if (enmEffOpSize == IEMMODE_32BIT)
2184 {
2185 uNewRip = uPtrFrame.pu32[0];
2186 uNewCs = uPtrFrame.pu16[2];
2187 }
2188 else
2189 {
2190 uNewRip = uPtrFrame.pu64[0];
2191 uNewCs = uPtrFrame.pu16[4];
2192 }
2193 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2194 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2195 { /* extremely likely */ }
2196 else
2197 return rcStrict;
2198
2199 /*
2200 * Real mode and V8086 mode are easy.
2201 */
2202 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2203 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
2204 {
2205 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2206 /** @todo check how this is supposed to work if sp=0xfffe. */
2207
2208 /* Check the limit of the new EIP. */
2209 /** @todo Intel pseudo code only does the limit check for 16-bit
2210 * operands, AMD does not make any distinction. What is right? */
2211 if (uNewRip > pCtx->cs.u32Limit)
2212 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2213
2214 /* commit the operation. */
2215 pCtx->rsp = uNewRsp;
2216 pCtx->rip = uNewRip;
2217 pCtx->cs.Sel = uNewCs;
2218 pCtx->cs.ValidSel = uNewCs;
2219 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2220 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2221 pCtx->eflags.Bits.u1RF = 0;
2222 /** @todo do we load attribs and limit as well? */
2223 if (cbPop)
2224 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2225 return VINF_SUCCESS;
2226 }
2227
2228 /*
2229 * Protected mode is complicated, of course.
2230 */
2231 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2232 {
2233 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2234 return iemRaiseGeneralProtectionFault0(pVCpu);
2235 }
2236
2237 /* Fetch the descriptor. */
2238 IEMSELDESC DescCs;
2239 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2240 if (rcStrict != VINF_SUCCESS)
2241 return rcStrict;
2242
2243 /* Can only return to a code selector. */
2244 if ( !DescCs.Legacy.Gen.u1DescType
2245 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2246 {
2247 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2248 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2249 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2250 }
2251
2252 /* L vs D. */
2253 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2254 && DescCs.Legacy.Gen.u1DefBig
2255 && IEM_IS_LONG_MODE(pVCpu))
2256 {
2257 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2258 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2259 }
2260
2261 /* DPL/RPL/CPL checks. */
2262 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2263 {
2264 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2265 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2266 }
2267
2268 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2269 {
2270 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2271 {
2272 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2273 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2274 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2275 }
2276 }
2277 else
2278 {
2279 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2280 {
2281 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2282 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2283 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2284 }
2285 }
2286
2287 /* Is it there? */
2288 if (!DescCs.Legacy.Gen.u1Present)
2289 {
2290 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2291 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2292 }
2293
2294 /*
2295 * Return to outer privilege? (We'll typically have entered via a call gate.)
2296 */
2297 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2298 {
2299 /* Read the outer stack pointer stored *after* the parameters. */
2300 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2301 if (rcStrict != VINF_SUCCESS)
2302 return rcStrict;
2303
2304 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2305
2306 uint16_t uNewOuterSs;
2307 uint64_t uNewOuterRsp;
2308 if (enmEffOpSize == IEMMODE_16BIT)
2309 {
2310 uNewOuterRsp = uPtrFrame.pu16[0];
2311 uNewOuterSs = uPtrFrame.pu16[1];
2312 }
2313 else if (enmEffOpSize == IEMMODE_32BIT)
2314 {
2315 uNewOuterRsp = uPtrFrame.pu32[0];
2316 uNewOuterSs = uPtrFrame.pu16[2];
2317 }
2318 else
2319 {
2320 uNewOuterRsp = uPtrFrame.pu64[0];
2321 uNewOuterSs = uPtrFrame.pu16[4];
2322 }
2323 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2324 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2325 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2326 { /* extremely likely */ }
2327 else
2328 return rcStrict;
2329
2330 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2331 and read the selector. */
2332 IEMSELDESC DescSs;
2333 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2334 {
2335 if ( !DescCs.Legacy.Gen.u1Long
2336 || (uNewOuterSs & X86_SEL_RPL) == 3)
2337 {
2338 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2339 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2340 return iemRaiseGeneralProtectionFault0(pVCpu);
2341 }
2342 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2343 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2344 }
2345 else
2346 {
2347 /* Fetch the descriptor for the new stack segment. */
2348 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2349 if (rcStrict != VINF_SUCCESS)
2350 return rcStrict;
2351 }
2352
2353 /* Check that RPL of stack and code selectors match. */
2354 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2355 {
2356 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2357 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2358 }
2359
2360 /* Must be a writable data segment. */
2361 if ( !DescSs.Legacy.Gen.u1DescType
2362 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2363 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2364 {
2365 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2366 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2367 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2368 }
2369
2370 /* L vs D. (Not mentioned by intel.) */
2371 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2372 && DescSs.Legacy.Gen.u1DefBig
2373 && IEM_IS_LONG_MODE(pVCpu))
2374 {
2375 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2376 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2377 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2378 }
2379
2380 /* DPL/RPL/CPL checks. */
2381 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2382 {
2383 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2384 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2385 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2386 }
2387
2388 /* Is it there? */
2389 if (!DescSs.Legacy.Gen.u1Present)
2390 {
2391 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2392 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2393 }
2394
2395 /* Calc SS limit.*/
2396 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2397
2398 /* Is RIP canonical or within CS.limit? */
2399 uint64_t u64Base;
2400 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2401
2402 /** @todo Testcase: Is this correct? */
2403 if ( DescCs.Legacy.Gen.u1Long
2404 && IEM_IS_LONG_MODE(pVCpu) )
2405 {
2406 if (!IEM_IS_CANONICAL(uNewRip))
2407 {
2408 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2409 return iemRaiseNotCanonical(pVCpu);
2410 }
2411 u64Base = 0;
2412 }
2413 else
2414 {
2415 if (uNewRip > cbLimitCs)
2416 {
2417 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2418 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2419 /** @todo: Intel says this is #GP(0)! */
2420 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2421 }
2422 u64Base = X86DESC_BASE(&DescCs.Legacy);
2423 }
2424
2425 /*
2426 * Now set the accessed bit before
2427 * writing the return address to the stack and committing the result into
2428 * CS, CSHID and RIP.
2429 */
2430 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2431 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2432 {
2433 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2434 if (rcStrict != VINF_SUCCESS)
2435 return rcStrict;
2436 /** @todo check what VT-x and AMD-V does. */
2437 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2438 }
2439 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2440 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2441 {
2442 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2443 if (rcStrict != VINF_SUCCESS)
2444 return rcStrict;
2445 /** @todo check what VT-x and AMD-V does. */
2446 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2447 }
2448
2449 /* commit */
2450 if (enmEffOpSize == IEMMODE_16BIT)
2451 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2452 else
2453 pCtx->rip = uNewRip;
2454 pCtx->cs.Sel = uNewCs;
2455 pCtx->cs.ValidSel = uNewCs;
2456 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2457 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2458 pCtx->cs.u32Limit = cbLimitCs;
2459 pCtx->cs.u64Base = u64Base;
2460 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2461 pCtx->ss.Sel = uNewOuterSs;
2462 pCtx->ss.ValidSel = uNewOuterSs;
2463 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2464 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2465 pCtx->ss.u32Limit = cbLimitSs;
2466 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2467 pCtx->ss.u64Base = 0;
2468 else
2469 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2470 if (!pCtx->ss.Attr.n.u1DefBig)
2471 pCtx->sp = (uint16_t)uNewOuterRsp;
2472 else
2473 pCtx->rsp = uNewOuterRsp;
2474
2475 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2476 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2477 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2478 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2479 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2480
2481 /** @todo check if the hidden bits are loaded correctly for 64-bit
2482 * mode. */
2483
2484 if (cbPop)
2485 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2486 pCtx->eflags.Bits.u1RF = 0;
2487
2488 /* Done! */
2489 }
2490 /*
2491 * Return to the same privilege level
2492 */
2493 else
2494 {
2495 /* Limit / canonical check. */
2496 uint64_t u64Base;
2497 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2498
2499 /** @todo Testcase: Is this correct? */
2500 if ( DescCs.Legacy.Gen.u1Long
2501 && IEM_IS_LONG_MODE(pVCpu) )
2502 {
2503 if (!IEM_IS_CANONICAL(uNewRip))
2504 {
2505 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2506 return iemRaiseNotCanonical(pVCpu);
2507 }
2508 u64Base = 0;
2509 }
2510 else
2511 {
2512 if (uNewRip > cbLimitCs)
2513 {
2514 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2515 /** @todo: Intel says this is #GP(0)! */
2516 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2517 }
2518 u64Base = X86DESC_BASE(&DescCs.Legacy);
2519 }
2520
2521 /*
2522 * Now set the accessed bit before
2523 * writing the return address to the stack and committing the result into
2524 * CS, CSHID and RIP.
2525 */
2526 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2527 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2528 {
2529 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2530 if (rcStrict != VINF_SUCCESS)
2531 return rcStrict;
2532 /** @todo check what VT-x and AMD-V does. */
2533 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2534 }
2535
2536 /* commit */
2537 if (!pCtx->ss.Attr.n.u1DefBig)
2538 pCtx->sp = (uint16_t)uNewRsp;
2539 else
2540 pCtx->rsp = uNewRsp;
2541 if (enmEffOpSize == IEMMODE_16BIT)
2542 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2543 else
2544 pCtx->rip = uNewRip;
2545 pCtx->cs.Sel = uNewCs;
2546 pCtx->cs.ValidSel = uNewCs;
2547 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2548 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2549 pCtx->cs.u32Limit = cbLimitCs;
2550 pCtx->cs.u64Base = u64Base;
2551 /** @todo check if the hidden bits are loaded correctly for 64-bit
2552 * mode. */
2553 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2554 if (cbPop)
2555 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2556 pCtx->eflags.Bits.u1RF = 0;
2557 }
2558
2559 /* Flush the prefetch buffer. */
2560#ifdef IEM_WITH_CODE_TLB
2561 pVCpu->iem.s.pbInstrBuf = NULL;
2562#else
2563 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2564#endif
2565 return VINF_SUCCESS;
2566}
2567
2568
2569/**
2570 * Implements retn.
2571 *
2572 * We're doing this in C because of the \#GP that might be raised if the popped
2573 * program counter is out of bounds.
2574 *
2575 * @param enmEffOpSize The effective operand size.
2576 * @param cbPop The amount of arguments to pop from the stack
2577 * (bytes).
2578 */
2579IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2580{
2581 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2582 NOREF(cbInstr);
2583
2584 /* Fetch the RSP from the stack. */
2585 VBOXSTRICTRC rcStrict;
2586 RTUINT64U NewRip;
2587 RTUINT64U NewRsp;
2588 NewRsp.u = pCtx->rsp;
2589 switch (enmEffOpSize)
2590 {
2591 case IEMMODE_16BIT:
2592 NewRip.u = 0;
2593 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2594 break;
2595 case IEMMODE_32BIT:
2596 NewRip.u = 0;
2597 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2598 break;
2599 case IEMMODE_64BIT:
2600 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2601 break;
2602 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2603 }
2604 if (rcStrict != VINF_SUCCESS)
2605 return rcStrict;
2606
2607 /* Check the new RSP before loading it. */
2608 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2609 * of it. The canonical test is performed here and for call. */
2610 if (enmEffOpSize != IEMMODE_64BIT)
2611 {
2612 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2613 {
2614 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2615 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2616 }
2617 }
2618 else
2619 {
2620 if (!IEM_IS_CANONICAL(NewRip.u))
2621 {
2622 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2623 return iemRaiseNotCanonical(pVCpu);
2624 }
2625 }
2626
2627 /* Apply cbPop */
2628 if (cbPop)
2629 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2630
2631 /* Commit it. */
2632 pCtx->rip = NewRip.u;
2633 pCtx->rsp = NewRsp.u;
2634 pCtx->eflags.Bits.u1RF = 0;
2635
2636 /* Flush the prefetch buffer. */
2637#ifndef IEM_WITH_CODE_TLB
2638 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2639#endif
2640
2641 return VINF_SUCCESS;
2642}
2643
2644
2645/**
2646 * Implements enter.
2647 *
2648 * We're doing this in C because the instruction is insane, even for the
2649 * u8NestingLevel=0 case dealing with the stack is tedious.
2650 *
2651 * @param enmEffOpSize The effective operand size.
2652 */
2653IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2654{
2655 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2656
2657 /* Push RBP, saving the old value in TmpRbp. */
2658 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2659 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2660 RTUINT64U NewRbp;
2661 VBOXSTRICTRC rcStrict;
2662 if (enmEffOpSize == IEMMODE_64BIT)
2663 {
2664 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2665 NewRbp = NewRsp;
2666 }
2667 else if (enmEffOpSize == IEMMODE_32BIT)
2668 {
2669 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2670 NewRbp = NewRsp;
2671 }
2672 else
2673 {
2674 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2675 NewRbp = TmpRbp;
2676 NewRbp.Words.w0 = NewRsp.Words.w0;
2677 }
2678 if (rcStrict != VINF_SUCCESS)
2679 return rcStrict;
2680
2681 /* Copy the parameters (aka nesting levels by Intel). */
2682 cParameters &= 0x1f;
2683 if (cParameters > 0)
2684 {
2685 switch (enmEffOpSize)
2686 {
2687 case IEMMODE_16BIT:
2688 if (pCtx->ss.Attr.n.u1DefBig)
2689 TmpRbp.DWords.dw0 -= 2;
2690 else
2691 TmpRbp.Words.w0 -= 2;
2692 do
2693 {
2694 uint16_t u16Tmp;
2695 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2696 if (rcStrict != VINF_SUCCESS)
2697 break;
2698 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2699 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2700 break;
2701
2702 case IEMMODE_32BIT:
2703 if (pCtx->ss.Attr.n.u1DefBig)
2704 TmpRbp.DWords.dw0 -= 4;
2705 else
2706 TmpRbp.Words.w0 -= 4;
2707 do
2708 {
2709 uint32_t u32Tmp;
2710 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2711 if (rcStrict != VINF_SUCCESS)
2712 break;
2713 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2714 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2715 break;
2716
2717 case IEMMODE_64BIT:
2718 TmpRbp.u -= 8;
2719 do
2720 {
2721 uint64_t u64Tmp;
2722 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2723 if (rcStrict != VINF_SUCCESS)
2724 break;
2725 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2726 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2727 break;
2728
2729 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2730 }
2731 if (rcStrict != VINF_SUCCESS)
2732 return VINF_SUCCESS;
2733
2734 /* Push the new RBP */
2735 if (enmEffOpSize == IEMMODE_64BIT)
2736 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2737 else if (enmEffOpSize == IEMMODE_32BIT)
2738 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2739 else
2740 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2741 if (rcStrict != VINF_SUCCESS)
2742 return rcStrict;
2743
2744 }
2745
2746 /* Recalc RSP. */
2747 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2748
2749 /** @todo Should probe write access at the new RSP according to AMD. */
2750
2751 /* Commit it. */
2752 pCtx->rbp = NewRbp.u;
2753 pCtx->rsp = NewRsp.u;
2754 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2755
2756 return VINF_SUCCESS;
2757}
2758
2759
2760
2761/**
2762 * Implements leave.
2763 *
2764 * We're doing this in C because messing with the stack registers is annoying
2765 * since they depends on SS attributes.
2766 *
2767 * @param enmEffOpSize The effective operand size.
2768 */
2769IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2770{
2771 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2772
2773 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2774 RTUINT64U NewRsp;
2775 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2776 NewRsp.u = pCtx->rbp;
2777 else if (pCtx->ss.Attr.n.u1DefBig)
2778 NewRsp.u = pCtx->ebp;
2779 else
2780 {
2781 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2782 NewRsp.u = pCtx->rsp;
2783 NewRsp.Words.w0 = pCtx->bp;
2784 }
2785
2786 /* Pop RBP according to the operand size. */
2787 VBOXSTRICTRC rcStrict;
2788 RTUINT64U NewRbp;
2789 switch (enmEffOpSize)
2790 {
2791 case IEMMODE_16BIT:
2792 NewRbp.u = pCtx->rbp;
2793 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2794 break;
2795 case IEMMODE_32BIT:
2796 NewRbp.u = 0;
2797 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2798 break;
2799 case IEMMODE_64BIT:
2800 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2801 break;
2802 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2803 }
2804 if (rcStrict != VINF_SUCCESS)
2805 return rcStrict;
2806
2807
2808 /* Commit it. */
2809 pCtx->rbp = NewRbp.u;
2810 pCtx->rsp = NewRsp.u;
2811 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2812
2813 return VINF_SUCCESS;
2814}
2815
2816
2817/**
2818 * Implements int3 and int XX.
2819 *
2820 * @param u8Int The interrupt vector number.
2821 * @param fIsBpInstr Is it the breakpoint instruction.
2822 */
2823IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2824{
2825 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2826 return iemRaiseXcptOrInt(pVCpu,
2827 cbInstr,
2828 u8Int,
2829 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2830 0,
2831 0);
2832}
2833
2834
2835/**
2836 * Implements iret for real mode and V8086 mode.
2837 *
2838 * @param enmEffOpSize The effective operand size.
2839 */
2840IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2841{
2842 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2843 X86EFLAGS Efl;
2844 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2845 NOREF(cbInstr);
2846
2847 /*
2848 * iret throws an exception if VME isn't enabled.
2849 */
2850 if ( Efl.Bits.u1VM
2851 && Efl.Bits.u2IOPL != 3
2852 && !(pCtx->cr4 & X86_CR4_VME))
2853 return iemRaiseGeneralProtectionFault0(pVCpu);
2854
2855 /*
2856 * Do the stack bits, but don't commit RSP before everything checks
2857 * out right.
2858 */
2859 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2860 VBOXSTRICTRC rcStrict;
2861 RTCPTRUNION uFrame;
2862 uint16_t uNewCs;
2863 uint32_t uNewEip;
2864 uint32_t uNewFlags;
2865 uint64_t uNewRsp;
2866 if (enmEffOpSize == IEMMODE_32BIT)
2867 {
2868 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2869 if (rcStrict != VINF_SUCCESS)
2870 return rcStrict;
2871 uNewEip = uFrame.pu32[0];
2872 if (uNewEip > UINT16_MAX)
2873 return iemRaiseGeneralProtectionFault0(pVCpu);
2874
2875 uNewCs = (uint16_t)uFrame.pu32[1];
2876 uNewFlags = uFrame.pu32[2];
2877 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2878 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2879 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2880 | X86_EFL_ID;
2881 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2882 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2883 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2884 }
2885 else
2886 {
2887 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2888 if (rcStrict != VINF_SUCCESS)
2889 return rcStrict;
2890 uNewEip = uFrame.pu16[0];
2891 uNewCs = uFrame.pu16[1];
2892 uNewFlags = uFrame.pu16[2];
2893 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2894 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2895 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2896 /** @todo The intel pseudo code does not indicate what happens to
2897 * reserved flags. We just ignore them. */
2898 /* Ancient CPU adjustments: See iemCImpl_popf. */
2899 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2900 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2901 }
2902 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2903 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2904 { /* extremely likely */ }
2905 else
2906 return rcStrict;
2907
2908 /** @todo Check how this is supposed to work if sp=0xfffe. */
2909 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2910 uNewCs, uNewEip, uNewFlags, uNewRsp));
2911
2912 /*
2913 * Check the limit of the new EIP.
2914 */
2915 /** @todo Only the AMD pseudo code check the limit here, what's
2916 * right? */
2917 if (uNewEip > pCtx->cs.u32Limit)
2918 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2919
2920 /*
2921 * V8086 checks and flag adjustments
2922 */
2923 if (Efl.Bits.u1VM)
2924 {
2925 if (Efl.Bits.u2IOPL == 3)
2926 {
2927 /* Preserve IOPL and clear RF. */
2928 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2929 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2930 }
2931 else if ( enmEffOpSize == IEMMODE_16BIT
2932 && ( !(uNewFlags & X86_EFL_IF)
2933 || !Efl.Bits.u1VIP )
2934 && !(uNewFlags & X86_EFL_TF) )
2935 {
2936 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2937 uNewFlags &= ~X86_EFL_VIF;
2938 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2939 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2940 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2941 }
2942 else
2943 return iemRaiseGeneralProtectionFault0(pVCpu);
2944 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2945 }
2946
2947 /*
2948 * Commit the operation.
2949 */
2950#ifdef DBGFTRACE_ENABLED
2951 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2952 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2953#endif
2954 pCtx->rsp = uNewRsp;
2955 pCtx->rip = uNewEip;
2956 pCtx->cs.Sel = uNewCs;
2957 pCtx->cs.ValidSel = uNewCs;
2958 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2959 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2960 /** @todo do we load attribs and limit as well? */
2961 Assert(uNewFlags & X86_EFL_1);
2962 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2963
2964 /* Flush the prefetch buffer. */
2965#ifdef IEM_WITH_CODE_TLB
2966 pVCpu->iem.s.pbInstrBuf = NULL;
2967#else
2968 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2969#endif
2970
2971 return VINF_SUCCESS;
2972}
2973
2974
2975/**
2976 * Loads a segment register when entering V8086 mode.
2977 *
2978 * @param pSReg The segment register.
2979 * @param uSeg The segment to load.
2980 */
2981static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2982{
2983 pSReg->Sel = uSeg;
2984 pSReg->ValidSel = uSeg;
2985 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2986 pSReg->u64Base = (uint32_t)uSeg << 4;
2987 pSReg->u32Limit = 0xffff;
2988 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2989 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2990 * IRET'ing to V8086. */
2991}
2992
2993
2994/**
2995 * Implements iret for protected mode returning to V8086 mode.
2996 *
2997 * @param pCtx Pointer to the CPU context.
2998 * @param uNewEip The new EIP.
2999 * @param uNewCs The new CS.
3000 * @param uNewFlags The new EFLAGS.
3001 * @param uNewRsp The RSP after the initial IRET frame.
3002 *
3003 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3004 */
3005IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
3006 uint32_t, uNewFlags, uint64_t, uNewRsp)
3007{
3008 RT_NOREF_PV(cbInstr);
3009
3010 /*
3011 * Pop the V8086 specific frame bits off the stack.
3012 */
3013 VBOXSTRICTRC rcStrict;
3014 RTCPTRUNION uFrame;
3015 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3016 if (rcStrict != VINF_SUCCESS)
3017 return rcStrict;
3018 uint32_t uNewEsp = uFrame.pu32[0];
3019 uint16_t uNewSs = uFrame.pu32[1];
3020 uint16_t uNewEs = uFrame.pu32[2];
3021 uint16_t uNewDs = uFrame.pu32[3];
3022 uint16_t uNewFs = uFrame.pu32[4];
3023 uint16_t uNewGs = uFrame.pu32[5];
3024 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3025 if (rcStrict != VINF_SUCCESS)
3026 return rcStrict;
3027
3028 /*
3029 * Commit the operation.
3030 */
3031 uNewFlags &= X86_EFL_LIVE_MASK;
3032 uNewFlags |= X86_EFL_RA1_MASK;
3033#ifdef DBGFTRACE_ENABLED
3034 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3035 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3036#endif
3037
3038 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3039 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
3040 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
3041 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
3042 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
3043 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
3044 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
3045 pCtx->rip = (uint16_t)uNewEip;
3046 pCtx->rsp = uNewEsp; /** @todo check this out! */
3047 pVCpu->iem.s.uCpl = 3;
3048
3049 /* Flush the prefetch buffer. */
3050#ifdef IEM_WITH_CODE_TLB
3051 pVCpu->iem.s.pbInstrBuf = NULL;
3052#else
3053 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3054#endif
3055
3056 return VINF_SUCCESS;
3057}
3058
3059
3060/**
3061 * Implements iret for protected mode returning via a nested task.
3062 *
3063 * @param enmEffOpSize The effective operand size.
3064 */
3065IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3066{
3067 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3068#ifndef IEM_IMPLEMENTS_TASKSWITCH
3069 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3070#else
3071 RT_NOREF_PV(enmEffOpSize);
3072
3073 /*
3074 * Read the segment selector in the link-field of the current TSS.
3075 */
3076 RTSEL uSelRet;
3077 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3078 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
3079 if (rcStrict != VINF_SUCCESS)
3080 return rcStrict;
3081
3082 /*
3083 * Fetch the returning task's TSS descriptor from the GDT.
3084 */
3085 if (uSelRet & X86_SEL_LDT)
3086 {
3087 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3088 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3089 }
3090
3091 IEMSELDESC TssDesc;
3092 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3093 if (rcStrict != VINF_SUCCESS)
3094 return rcStrict;
3095
3096 if (TssDesc.Legacy.Gate.u1DescType)
3097 {
3098 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3099 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3100 }
3101
3102 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3103 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3104 {
3105 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3106 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3107 }
3108
3109 if (!TssDesc.Legacy.Gate.u1Present)
3110 {
3111 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3112 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3113 }
3114
3115 uint32_t uNextEip = pCtx->eip + cbInstr;
3116 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3117 0 /* uCr2 */, uSelRet, &TssDesc);
3118#endif
3119}
3120
3121
3122/**
3123 * Implements iret for protected mode
3124 *
3125 * @param enmEffOpSize The effective operand size.
3126 */
3127IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3128{
3129 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3130 NOREF(cbInstr);
3131 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3132
3133 /*
3134 * Nested task return.
3135 */
3136 if (pCtx->eflags.Bits.u1NT)
3137 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3138
3139 /*
3140 * Normal return.
3141 *
3142 * Do the stack bits, but don't commit RSP before everything checks
3143 * out right.
3144 */
3145 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3146 VBOXSTRICTRC rcStrict;
3147 RTCPTRUNION uFrame;
3148 uint16_t uNewCs;
3149 uint32_t uNewEip;
3150 uint32_t uNewFlags;
3151 uint64_t uNewRsp;
3152 if (enmEffOpSize == IEMMODE_32BIT)
3153 {
3154 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3155 if (rcStrict != VINF_SUCCESS)
3156 return rcStrict;
3157 uNewEip = uFrame.pu32[0];
3158 uNewCs = (uint16_t)uFrame.pu32[1];
3159 uNewFlags = uFrame.pu32[2];
3160 }
3161 else
3162 {
3163 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3164 if (rcStrict != VINF_SUCCESS)
3165 return rcStrict;
3166 uNewEip = uFrame.pu16[0];
3167 uNewCs = uFrame.pu16[1];
3168 uNewFlags = uFrame.pu16[2];
3169 }
3170 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3171 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3172 { /* extremely likely */ }
3173 else
3174 return rcStrict;
3175 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3176
3177 /*
3178 * We're hopefully not returning to V8086 mode...
3179 */
3180 if ( (uNewFlags & X86_EFL_VM)
3181 && pVCpu->iem.s.uCpl == 0)
3182 {
3183 Assert(enmEffOpSize == IEMMODE_32BIT);
3184 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3185 }
3186
3187 /*
3188 * Protected mode.
3189 */
3190 /* Read the CS descriptor. */
3191 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3192 {
3193 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3194 return iemRaiseGeneralProtectionFault0(pVCpu);
3195 }
3196
3197 IEMSELDESC DescCS;
3198 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3199 if (rcStrict != VINF_SUCCESS)
3200 {
3201 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3202 return rcStrict;
3203 }
3204
3205 /* Must be a code descriptor. */
3206 if (!DescCS.Legacy.Gen.u1DescType)
3207 {
3208 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3209 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3210 }
3211 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3212 {
3213 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3214 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3215 }
3216
3217#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3218 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3219 PVM pVM = pVCpu->CTX_SUFF(pVM);
3220 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3221 {
3222 if ((uNewCs & X86_SEL_RPL) == 1)
3223 {
3224 if ( pVCpu->iem.s.uCpl == 0
3225 && ( !EMIsRawRing1Enabled(pVM)
3226 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3227 {
3228 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3229 uNewCs &= X86_SEL_MASK_OFF_RPL;
3230 }
3231# ifdef LOG_ENABLED
3232 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3233 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3234# endif
3235 }
3236 else if ( (uNewCs & X86_SEL_RPL) == 2
3237 && EMIsRawRing1Enabled(pVM)
3238 && pVCpu->iem.s.uCpl <= 1)
3239 {
3240 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3241 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3242 }
3243 }
3244#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3245
3246
3247 /* Privilege checks. */
3248 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3249 {
3250 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3251 {
3252 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3253 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3254 }
3255 }
3256 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3257 {
3258 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3259 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3260 }
3261 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3262 {
3263 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3264 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3265 }
3266
3267 /* Present? */
3268 if (!DescCS.Legacy.Gen.u1Present)
3269 {
3270 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3271 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3272 }
3273
3274 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3275
3276 /*
3277 * Return to outer level?
3278 */
3279 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3280 {
3281 uint16_t uNewSS;
3282 uint32_t uNewESP;
3283 if (enmEffOpSize == IEMMODE_32BIT)
3284 {
3285 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3286 if (rcStrict != VINF_SUCCESS)
3287 return rcStrict;
3288/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3289 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3290 * bit of the popped SS selector it turns out. */
3291 uNewESP = uFrame.pu32[0];
3292 uNewSS = (uint16_t)uFrame.pu32[1];
3293 }
3294 else
3295 {
3296 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3297 if (rcStrict != VINF_SUCCESS)
3298 return rcStrict;
3299 uNewESP = uFrame.pu16[0];
3300 uNewSS = uFrame.pu16[1];
3301 }
3302 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3303 if (rcStrict != VINF_SUCCESS)
3304 return rcStrict;
3305 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3306
3307 /* Read the SS descriptor. */
3308 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3309 {
3310 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3311 return iemRaiseGeneralProtectionFault0(pVCpu);
3312 }
3313
3314 IEMSELDESC DescSS;
3315 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3316 if (rcStrict != VINF_SUCCESS)
3317 {
3318 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3319 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3320 return rcStrict;
3321 }
3322
3323 /* Privilege checks. */
3324 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3325 {
3326 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3327 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3328 }
3329 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3330 {
3331 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3332 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3333 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3334 }
3335
3336 /* Must be a writeable data segment descriptor. */
3337 if (!DescSS.Legacy.Gen.u1DescType)
3338 {
3339 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3340 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3341 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3342 }
3343 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3344 {
3345 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3346 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3347 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3348 }
3349
3350 /* Present? */
3351 if (!DescSS.Legacy.Gen.u1Present)
3352 {
3353 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3354 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3355 }
3356
3357 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3358
3359 /* Check EIP. */
3360 if (uNewEip > cbLimitCS)
3361 {
3362 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3363 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3364 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3365 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3366 }
3367
3368 /*
3369 * Commit the changes, marking CS and SS accessed first since
3370 * that may fail.
3371 */
3372 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3373 {
3374 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3375 if (rcStrict != VINF_SUCCESS)
3376 return rcStrict;
3377 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3378 }
3379 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3380 {
3381 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3382 if (rcStrict != VINF_SUCCESS)
3383 return rcStrict;
3384 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3385 }
3386
3387 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3388 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3389 if (enmEffOpSize != IEMMODE_16BIT)
3390 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3391 if (pVCpu->iem.s.uCpl == 0)
3392 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3393 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3394 fEFlagsMask |= X86_EFL_IF;
3395 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3396 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3397 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3398 fEFlagsNew &= ~fEFlagsMask;
3399 fEFlagsNew |= uNewFlags & fEFlagsMask;
3400#ifdef DBGFTRACE_ENABLED
3401 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3402 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3403 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3404#endif
3405
3406 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3407 pCtx->rip = uNewEip;
3408 pCtx->cs.Sel = uNewCs;
3409 pCtx->cs.ValidSel = uNewCs;
3410 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3411 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3412 pCtx->cs.u32Limit = cbLimitCS;
3413 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3414 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3415
3416 pCtx->ss.Sel = uNewSS;
3417 pCtx->ss.ValidSel = uNewSS;
3418 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3419 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3420 pCtx->ss.u32Limit = cbLimitSs;
3421 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3422 if (!pCtx->ss.Attr.n.u1DefBig)
3423 pCtx->sp = (uint16_t)uNewESP;
3424 else
3425 pCtx->rsp = uNewESP;
3426
3427 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3428 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3429 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3430 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3431 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3432
3433 /* Done! */
3434
3435 }
3436 /*
3437 * Return to the same level.
3438 */
3439 else
3440 {
3441 /* Check EIP. */
3442 if (uNewEip > cbLimitCS)
3443 {
3444 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3445 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3446 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3447 }
3448
3449 /*
3450 * Commit the changes, marking CS first since it may fail.
3451 */
3452 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3453 {
3454 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3455 if (rcStrict != VINF_SUCCESS)
3456 return rcStrict;
3457 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3458 }
3459
3460 X86EFLAGS NewEfl;
3461 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3462 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3463 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3464 if (enmEffOpSize != IEMMODE_16BIT)
3465 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3466 if (pVCpu->iem.s.uCpl == 0)
3467 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3468 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3469 fEFlagsMask |= X86_EFL_IF;
3470 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3471 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3472 NewEfl.u &= ~fEFlagsMask;
3473 NewEfl.u |= fEFlagsMask & uNewFlags;
3474#ifdef DBGFTRACE_ENABLED
3475 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3476 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3477 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3478#endif
3479
3480 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3481 pCtx->rip = uNewEip;
3482 pCtx->cs.Sel = uNewCs;
3483 pCtx->cs.ValidSel = uNewCs;
3484 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3485 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3486 pCtx->cs.u32Limit = cbLimitCS;
3487 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3488 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3489 if (!pCtx->ss.Attr.n.u1DefBig)
3490 pCtx->sp = (uint16_t)uNewRsp;
3491 else
3492 pCtx->rsp = uNewRsp;
3493 /* Done! */
3494 }
3495
3496 /* Flush the prefetch buffer. */
3497#ifdef IEM_WITH_CODE_TLB
3498 pVCpu->iem.s.pbInstrBuf = NULL;
3499#else
3500 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3501#endif
3502
3503 return VINF_SUCCESS;
3504}
3505
3506
3507/**
3508 * Implements iret for long mode
3509 *
3510 * @param enmEffOpSize The effective operand size.
3511 */
3512IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3513{
3514 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3515 NOREF(cbInstr);
3516
3517 /*
3518 * Nested task return is not supported in long mode.
3519 */
3520 if (pCtx->eflags.Bits.u1NT)
3521 {
3522 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3523 return iemRaiseGeneralProtectionFault0(pVCpu);
3524 }
3525
3526 /*
3527 * Normal return.
3528 *
3529 * Do the stack bits, but don't commit RSP before everything checks
3530 * out right.
3531 */
3532 VBOXSTRICTRC rcStrict;
3533 RTCPTRUNION uFrame;
3534 uint64_t uNewRip;
3535 uint16_t uNewCs;
3536 uint16_t uNewSs;
3537 uint32_t uNewFlags;
3538 uint64_t uNewRsp;
3539 if (enmEffOpSize == IEMMODE_64BIT)
3540 {
3541 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3542 if (rcStrict != VINF_SUCCESS)
3543 return rcStrict;
3544 uNewRip = uFrame.pu64[0];
3545 uNewCs = (uint16_t)uFrame.pu64[1];
3546 uNewFlags = (uint32_t)uFrame.pu64[2];
3547 uNewRsp = uFrame.pu64[3];
3548 uNewSs = (uint16_t)uFrame.pu64[4];
3549 }
3550 else if (enmEffOpSize == IEMMODE_32BIT)
3551 {
3552 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3553 if (rcStrict != VINF_SUCCESS)
3554 return rcStrict;
3555 uNewRip = uFrame.pu32[0];
3556 uNewCs = (uint16_t)uFrame.pu32[1];
3557 uNewFlags = uFrame.pu32[2];
3558 uNewRsp = uFrame.pu32[3];
3559 uNewSs = (uint16_t)uFrame.pu32[4];
3560 }
3561 else
3562 {
3563 Assert(enmEffOpSize == IEMMODE_16BIT);
3564 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3565 if (rcStrict != VINF_SUCCESS)
3566 return rcStrict;
3567 uNewRip = uFrame.pu16[0];
3568 uNewCs = uFrame.pu16[1];
3569 uNewFlags = uFrame.pu16[2];
3570 uNewRsp = uFrame.pu16[3];
3571 uNewSs = uFrame.pu16[4];
3572 }
3573 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3574 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3575 { /* extremely like */ }
3576 else
3577 return rcStrict;
3578 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3579
3580 /*
3581 * Check stuff.
3582 */
3583 /* Read the CS descriptor. */
3584 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3585 {
3586 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3587 return iemRaiseGeneralProtectionFault0(pVCpu);
3588 }
3589
3590 IEMSELDESC DescCS;
3591 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3592 if (rcStrict != VINF_SUCCESS)
3593 {
3594 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3595 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3596 return rcStrict;
3597 }
3598
3599 /* Must be a code descriptor. */
3600 if ( !DescCS.Legacy.Gen.u1DescType
3601 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3602 {
3603 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3604 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3605 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3606 }
3607
3608 /* Privilege checks. */
3609 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3610 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3611 {
3612 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3613 {
3614 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3615 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3616 }
3617 }
3618 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3619 {
3620 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3621 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3622 }
3623 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3624 {
3625 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3626 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3627 }
3628
3629 /* Present? */
3630 if (!DescCS.Legacy.Gen.u1Present)
3631 {
3632 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3633 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3634 }
3635
3636 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3637
3638 /* Read the SS descriptor. */
3639 IEMSELDESC DescSS;
3640 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3641 {
3642 if ( !DescCS.Legacy.Gen.u1Long
3643 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3644 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3645 {
3646 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3647 return iemRaiseGeneralProtectionFault0(pVCpu);
3648 }
3649 DescSS.Legacy.u = 0;
3650 }
3651 else
3652 {
3653 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3654 if (rcStrict != VINF_SUCCESS)
3655 {
3656 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3657 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3658 return rcStrict;
3659 }
3660 }
3661
3662 /* Privilege checks. */
3663 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3664 {
3665 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3666 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3667 }
3668
3669 uint32_t cbLimitSs;
3670 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3671 cbLimitSs = UINT32_MAX;
3672 else
3673 {
3674 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3675 {
3676 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3677 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3678 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3679 }
3680
3681 /* Must be a writeable data segment descriptor. */
3682 if (!DescSS.Legacy.Gen.u1DescType)
3683 {
3684 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3685 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3686 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3687 }
3688 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3689 {
3690 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3691 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3692 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3693 }
3694
3695 /* Present? */
3696 if (!DescSS.Legacy.Gen.u1Present)
3697 {
3698 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3699 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3700 }
3701 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3702 }
3703
3704 /* Check EIP. */
3705 if (DescCS.Legacy.Gen.u1Long)
3706 {
3707 if (!IEM_IS_CANONICAL(uNewRip))
3708 {
3709 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3710 uNewCs, uNewRip, uNewSs, uNewRsp));
3711 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3712 }
3713 }
3714 else
3715 {
3716 if (uNewRip > cbLimitCS)
3717 {
3718 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3719 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3720 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3721 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3722 }
3723 }
3724
3725 /*
3726 * Commit the changes, marking CS and SS accessed first since
3727 * that may fail.
3728 */
3729 /** @todo where exactly are these actually marked accessed by a real CPU? */
3730 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3731 {
3732 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3733 if (rcStrict != VINF_SUCCESS)
3734 return rcStrict;
3735 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3736 }
3737 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3738 {
3739 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3740 if (rcStrict != VINF_SUCCESS)
3741 return rcStrict;
3742 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3743 }
3744
3745 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3746 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3747 if (enmEffOpSize != IEMMODE_16BIT)
3748 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3749 if (pVCpu->iem.s.uCpl == 0)
3750 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3751 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3752 fEFlagsMask |= X86_EFL_IF;
3753 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3754 fEFlagsNew &= ~fEFlagsMask;
3755 fEFlagsNew |= uNewFlags & fEFlagsMask;
3756#ifdef DBGFTRACE_ENABLED
3757 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3758 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3759#endif
3760
3761 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3762 pCtx->rip = uNewRip;
3763 pCtx->cs.Sel = uNewCs;
3764 pCtx->cs.ValidSel = uNewCs;
3765 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3766 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3767 pCtx->cs.u32Limit = cbLimitCS;
3768 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3769 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3770 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3771 pCtx->rsp = uNewRsp;
3772 else
3773 pCtx->sp = (uint16_t)uNewRsp;
3774 pCtx->ss.Sel = uNewSs;
3775 pCtx->ss.ValidSel = uNewSs;
3776 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3777 {
3778 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3779 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3780 pCtx->ss.u32Limit = UINT32_MAX;
3781 pCtx->ss.u64Base = 0;
3782 Log2(("iretq new SS: NULL\n"));
3783 }
3784 else
3785 {
3786 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3787 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3788 pCtx->ss.u32Limit = cbLimitSs;
3789 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3790 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3791 }
3792
3793 if (pVCpu->iem.s.uCpl != uNewCpl)
3794 {
3795 pVCpu->iem.s.uCpl = uNewCpl;
3796 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3797 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3798 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3799 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3800 }
3801
3802 /* Flush the prefetch buffer. */
3803#ifdef IEM_WITH_CODE_TLB
3804 pVCpu->iem.s.pbInstrBuf = NULL;
3805#else
3806 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3807#endif
3808
3809 return VINF_SUCCESS;
3810}
3811
3812
3813/**
3814 * Implements iret.
3815 *
3816 * @param enmEffOpSize The effective operand size.
3817 */
3818IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3819{
3820 /*
3821 * First, clear NMI blocking, if any, before causing any exceptions.
3822 */
3823 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3824
3825 /*
3826 * Call a mode specific worker.
3827 */
3828 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3829 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3830 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3831 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3832 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3833}
3834
3835
3836/**
3837 * Implements SYSCALL (AMD and Intel64).
3838 *
3839 * @param enmEffOpSize The effective operand size.
3840 */
3841IEM_CIMPL_DEF_0(iemCImpl_syscall)
3842{
3843 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3844
3845 /*
3846 * Check preconditions.
3847 *
3848 * Note that CPUs described in the documentation may load a few odd values
3849 * into CS and SS than we allow here. This has yet to be checked on real
3850 * hardware.
3851 */
3852 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3853 {
3854 Log(("syscall: Not enabled in EFER -> #UD\n"));
3855 return iemRaiseUndefinedOpcode(pVCpu);
3856 }
3857 if (!(pCtx->cr0 & X86_CR0_PE))
3858 {
3859 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3860 return iemRaiseGeneralProtectionFault0(pVCpu);
3861 }
3862 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3863 {
3864 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3865 return iemRaiseUndefinedOpcode(pVCpu);
3866 }
3867
3868 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3869 /** @todo what about LDT selectors? Shouldn't matter, really. */
3870 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3871 uint16_t uNewSs = uNewCs + 8;
3872 if (uNewCs == 0 || uNewSs == 0)
3873 {
3874 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3875 return iemRaiseGeneralProtectionFault0(pVCpu);
3876 }
3877
3878 /* Long mode and legacy mode differs. */
3879 if (CPUMIsGuestInLongModeEx(pCtx))
3880 {
3881 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3882
3883 /* This test isn't in the docs, but I'm not trusting the guys writing
3884 the MSRs to have validated the values as canonical like they should. */
3885 if (!IEM_IS_CANONICAL(uNewRip))
3886 {
3887 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3888 return iemRaiseUndefinedOpcode(pVCpu);
3889 }
3890
3891 /*
3892 * Commit it.
3893 */
3894 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3895 pCtx->rcx = pCtx->rip + cbInstr;
3896 pCtx->rip = uNewRip;
3897
3898 pCtx->rflags.u &= ~X86_EFL_RF;
3899 pCtx->r11 = pCtx->rflags.u;
3900 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3901 pCtx->rflags.u |= X86_EFL_1;
3902
3903 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3904 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3905 }
3906 else
3907 {
3908 /*
3909 * Commit it.
3910 */
3911 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3912 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3913 pCtx->rcx = pCtx->eip + cbInstr;
3914 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3915 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3916
3917 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3918 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3919 }
3920 pCtx->cs.Sel = uNewCs;
3921 pCtx->cs.ValidSel = uNewCs;
3922 pCtx->cs.u64Base = 0;
3923 pCtx->cs.u32Limit = UINT32_MAX;
3924 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3925
3926 pCtx->ss.Sel = uNewSs;
3927 pCtx->ss.ValidSel = uNewSs;
3928 pCtx->ss.u64Base = 0;
3929 pCtx->ss.u32Limit = UINT32_MAX;
3930 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3931
3932 /* Flush the prefetch buffer. */
3933#ifdef IEM_WITH_CODE_TLB
3934 pVCpu->iem.s.pbInstrBuf = NULL;
3935#else
3936 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3937#endif
3938
3939 return VINF_SUCCESS;
3940}
3941
3942
3943/**
3944 * Implements SYSRET (AMD and Intel64).
3945 */
3946IEM_CIMPL_DEF_0(iemCImpl_sysret)
3947
3948{
3949 RT_NOREF_PV(cbInstr);
3950 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3951
3952 /*
3953 * Check preconditions.
3954 *
3955 * Note that CPUs described in the documentation may load a few odd values
3956 * into CS and SS than we allow here. This has yet to be checked on real
3957 * hardware.
3958 */
3959 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3960 {
3961 Log(("sysret: Not enabled in EFER -> #UD\n"));
3962 return iemRaiseUndefinedOpcode(pVCpu);
3963 }
3964 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3965 {
3966 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3967 return iemRaiseUndefinedOpcode(pVCpu);
3968 }
3969 if (!(pCtx->cr0 & X86_CR0_PE))
3970 {
3971 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3972 return iemRaiseGeneralProtectionFault0(pVCpu);
3973 }
3974 if (pVCpu->iem.s.uCpl != 0)
3975 {
3976 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3977 return iemRaiseGeneralProtectionFault0(pVCpu);
3978 }
3979
3980 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3981 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3982 uint16_t uNewSs = uNewCs + 8;
3983 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3984 uNewCs += 16;
3985 if (uNewCs == 0 || uNewSs == 0)
3986 {
3987 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3988 return iemRaiseGeneralProtectionFault0(pVCpu);
3989 }
3990
3991 /*
3992 * Commit it.
3993 */
3994 if (CPUMIsGuestInLongModeEx(pCtx))
3995 {
3996 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3997 {
3998 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
3999 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
4000 /* Note! We disregard intel manual regarding the RCX cananonical
4001 check, ask intel+xen why AMD doesn't do it. */
4002 pCtx->rip = pCtx->rcx;
4003 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4004 | (3 << X86DESCATTR_DPL_SHIFT);
4005 }
4006 else
4007 {
4008 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4009 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
4010 pCtx->rip = pCtx->ecx;
4011 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4012 | (3 << X86DESCATTR_DPL_SHIFT);
4013 }
4014 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4015 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4016 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4017 pCtx->rflags.u |= X86_EFL_1;
4018 }
4019 else
4020 {
4021 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
4022 pCtx->rip = pCtx->rcx;
4023 pCtx->rflags.u |= X86_EFL_IF;
4024 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4025 | (3 << X86DESCATTR_DPL_SHIFT);
4026 }
4027 pCtx->cs.Sel = uNewCs | 3;
4028 pCtx->cs.ValidSel = uNewCs | 3;
4029 pCtx->cs.u64Base = 0;
4030 pCtx->cs.u32Limit = UINT32_MAX;
4031 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
4032
4033 pCtx->ss.Sel = uNewSs | 3;
4034 pCtx->ss.ValidSel = uNewSs | 3;
4035 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
4036 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4037 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4038 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4039 * on sysret. */
4040
4041 /* Flush the prefetch buffer. */
4042#ifdef IEM_WITH_CODE_TLB
4043 pVCpu->iem.s.pbInstrBuf = NULL;
4044#else
4045 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4046#endif
4047
4048 return VINF_SUCCESS;
4049}
4050
4051
4052/**
4053 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4054 *
4055 * @param iSegReg The segment register number (valid).
4056 * @param uSel The new selector value.
4057 */
4058IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4059{
4060 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4061 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4062 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4063
4064 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4065
4066 /*
4067 * Real mode and V8086 mode are easy.
4068 */
4069 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
4070 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
4071 {
4072 *pSel = uSel;
4073 pHid->u64Base = (uint32_t)uSel << 4;
4074 pHid->ValidSel = uSel;
4075 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4076#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4077 /** @todo Does the CPU actually load limits and attributes in the
4078 * real/V8086 mode segment load case? It doesn't for CS in far
4079 * jumps... Affects unreal mode. */
4080 pHid->u32Limit = 0xffff;
4081 pHid->Attr.u = 0;
4082 pHid->Attr.n.u1Present = 1;
4083 pHid->Attr.n.u1DescType = 1;
4084 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4085 ? X86_SEL_TYPE_RW
4086 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4087#endif
4088 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4089 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4090 return VINF_SUCCESS;
4091 }
4092
4093 /*
4094 * Protected mode.
4095 *
4096 * Check if it's a null segment selector value first, that's OK for DS, ES,
4097 * FS and GS. If not null, then we have to load and parse the descriptor.
4098 */
4099 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4100 {
4101 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4102 if (iSegReg == X86_SREG_SS)
4103 {
4104 /* In 64-bit kernel mode, the stack can be 0 because of the way
4105 interrupts are dispatched. AMD seems to have a slighly more
4106 relaxed relationship to SS.RPL than intel does. */
4107 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4108 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4109 || pVCpu->iem.s.uCpl > 2
4110 || ( uSel != pVCpu->iem.s.uCpl
4111 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4112 {
4113 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4114 return iemRaiseGeneralProtectionFault0(pVCpu);
4115 }
4116 }
4117
4118 *pSel = uSel; /* Not RPL, remember :-) */
4119 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4120 if (iSegReg == X86_SREG_SS)
4121 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4122
4123 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4124 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4125
4126 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4127 return VINF_SUCCESS;
4128 }
4129
4130 /* Fetch the descriptor. */
4131 IEMSELDESC Desc;
4132 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4133 if (rcStrict != VINF_SUCCESS)
4134 return rcStrict;
4135
4136 /* Check GPs first. */
4137 if (!Desc.Legacy.Gen.u1DescType)
4138 {
4139 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4140 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4141 }
4142 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4143 {
4144 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4145 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4146 {
4147 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4148 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4149 }
4150 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4151 {
4152 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4153 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4154 }
4155 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4156 {
4157 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4158 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4159 }
4160 }
4161 else
4162 {
4163 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4164 {
4165 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4167 }
4168 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4169 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4170 {
4171#if 0 /* this is what intel says. */
4172 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4173 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4174 {
4175 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4176 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4177 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4178 }
4179#else /* this is what makes more sense. */
4180 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4181 {
4182 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4183 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4184 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4185 }
4186 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4187 {
4188 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4189 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4190 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4191 }
4192#endif
4193 }
4194 }
4195
4196 /* Is it there? */
4197 if (!Desc.Legacy.Gen.u1Present)
4198 {
4199 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4200 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4201 }
4202
4203 /* The base and limit. */
4204 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4205 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4206
4207 /*
4208 * Ok, everything checked out fine. Now set the accessed bit before
4209 * committing the result into the registers.
4210 */
4211 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4212 {
4213 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4214 if (rcStrict != VINF_SUCCESS)
4215 return rcStrict;
4216 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4217 }
4218
4219 /* commit */
4220 *pSel = uSel;
4221 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4222 pHid->u32Limit = cbLimit;
4223 pHid->u64Base = u64Base;
4224 pHid->ValidSel = uSel;
4225 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4226
4227 /** @todo check if the hidden bits are loaded correctly for 64-bit
4228 * mode. */
4229 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4230
4231 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4232 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4233 return VINF_SUCCESS;
4234}
4235
4236
4237/**
4238 * Implements 'mov SReg, r/m'.
4239 *
4240 * @param iSegReg The segment register number (valid).
4241 * @param uSel The new selector value.
4242 */
4243IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4244{
4245 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4246 if (rcStrict == VINF_SUCCESS)
4247 {
4248 if (iSegReg == X86_SREG_SS)
4249 {
4250 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4251 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4252 }
4253 }
4254 return rcStrict;
4255}
4256
4257
4258/**
4259 * Implements 'pop SReg'.
4260 *
4261 * @param iSegReg The segment register number (valid).
4262 * @param enmEffOpSize The efficient operand size (valid).
4263 */
4264IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4265{
4266 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4267 VBOXSTRICTRC rcStrict;
4268
4269 /*
4270 * Read the selector off the stack and join paths with mov ss, reg.
4271 */
4272 RTUINT64U TmpRsp;
4273 TmpRsp.u = pCtx->rsp;
4274 switch (enmEffOpSize)
4275 {
4276 case IEMMODE_16BIT:
4277 {
4278 uint16_t uSel;
4279 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4280 if (rcStrict == VINF_SUCCESS)
4281 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4282 break;
4283 }
4284
4285 case IEMMODE_32BIT:
4286 {
4287 uint32_t u32Value;
4288 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4289 if (rcStrict == VINF_SUCCESS)
4290 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4291 break;
4292 }
4293
4294 case IEMMODE_64BIT:
4295 {
4296 uint64_t u64Value;
4297 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4298 if (rcStrict == VINF_SUCCESS)
4299 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4300 break;
4301 }
4302 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4303 }
4304
4305 /*
4306 * Commit the stack on success.
4307 */
4308 if (rcStrict == VINF_SUCCESS)
4309 {
4310 pCtx->rsp = TmpRsp.u;
4311 if (iSegReg == X86_SREG_SS)
4312 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4313 }
4314 return rcStrict;
4315}
4316
4317
4318/**
4319 * Implements lgs, lfs, les, lds & lss.
4320 */
4321IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4322 uint16_t, uSel,
4323 uint64_t, offSeg,
4324 uint8_t, iSegReg,
4325 uint8_t, iGReg,
4326 IEMMODE, enmEffOpSize)
4327{
4328 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4329 VBOXSTRICTRC rcStrict;
4330
4331 /*
4332 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4333 */
4334 /** @todo verify and test that mov, pop and lXs works the segment
4335 * register loading in the exact same way. */
4336 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4337 if (rcStrict == VINF_SUCCESS)
4338 {
4339 switch (enmEffOpSize)
4340 {
4341 case IEMMODE_16BIT:
4342 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4343 break;
4344 case IEMMODE_32BIT:
4345 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4346 break;
4347 case IEMMODE_64BIT:
4348 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4349 break;
4350 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4351 }
4352 }
4353
4354 return rcStrict;
4355}
4356
4357
4358/**
4359 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4360 *
4361 * @retval VINF_SUCCESS on success.
4362 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4363 * @retval iemMemFetchSysU64 return value.
4364 *
4365 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4366 * @param uSel The selector value.
4367 * @param fAllowSysDesc Whether system descriptors are OK or not.
4368 * @param pDesc Where to return the descriptor on success.
4369 */
4370static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4371{
4372 pDesc->Long.au64[0] = 0;
4373 pDesc->Long.au64[1] = 0;
4374
4375 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4376 return VINF_IEM_SELECTOR_NOT_OK;
4377
4378 /* Within the table limits? */
4379 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4380 RTGCPTR GCPtrBase;
4381 if (uSel & X86_SEL_LDT)
4382 {
4383 if ( !pCtx->ldtr.Attr.n.u1Present
4384 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4385 return VINF_IEM_SELECTOR_NOT_OK;
4386 GCPtrBase = pCtx->ldtr.u64Base;
4387 }
4388 else
4389 {
4390 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4391 return VINF_IEM_SELECTOR_NOT_OK;
4392 GCPtrBase = pCtx->gdtr.pGdt;
4393 }
4394
4395 /* Fetch the descriptor. */
4396 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4397 if (rcStrict != VINF_SUCCESS)
4398 return rcStrict;
4399 if (!pDesc->Legacy.Gen.u1DescType)
4400 {
4401 if (!fAllowSysDesc)
4402 return VINF_IEM_SELECTOR_NOT_OK;
4403 if (CPUMIsGuestInLongModeEx(pCtx))
4404 {
4405 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4406 if (rcStrict != VINF_SUCCESS)
4407 return rcStrict;
4408 }
4409
4410 }
4411
4412 return VINF_SUCCESS;
4413}
4414
4415
4416/**
4417 * Implements verr (fWrite = false) and verw (fWrite = true).
4418 */
4419IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4420{
4421 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4422
4423 /** @todo figure whether the accessed bit is set or not. */
4424
4425 bool fAccessible = true;
4426 IEMSELDESC Desc;
4427 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4428 if (rcStrict == VINF_SUCCESS)
4429 {
4430 /* Check the descriptor, order doesn't matter much here. */
4431 if ( !Desc.Legacy.Gen.u1DescType
4432 || !Desc.Legacy.Gen.u1Present)
4433 fAccessible = false;
4434 else
4435 {
4436 if ( fWrite
4437 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4438 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4439 fAccessible = false;
4440
4441 /** @todo testcase for the conforming behavior. */
4442 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4443 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4444 {
4445 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4446 fAccessible = false;
4447 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4448 fAccessible = false;
4449 }
4450 }
4451
4452 }
4453 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4454 fAccessible = false;
4455 else
4456 return rcStrict;
4457
4458 /* commit */
4459 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4460
4461 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4462 return VINF_SUCCESS;
4463}
4464
4465
4466/**
4467 * Implements LAR and LSL with 64-bit operand size.
4468 *
4469 * @returns VINF_SUCCESS.
4470 * @param pu16Dst Pointer to the destination register.
4471 * @param uSel The selector to load details for.
4472 * @param fIsLar true = LAR, false = LSL.
4473 */
4474IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4475{
4476 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4477
4478 /** @todo figure whether the accessed bit is set or not. */
4479
4480 bool fDescOk = true;
4481 IEMSELDESC Desc;
4482 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4483 if (rcStrict == VINF_SUCCESS)
4484 {
4485 /*
4486 * Check the descriptor type.
4487 */
4488 if (!Desc.Legacy.Gen.u1DescType)
4489 {
4490 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4491 {
4492 if (Desc.Long.Gen.u5Zeros)
4493 fDescOk = false;
4494 else
4495 switch (Desc.Long.Gen.u4Type)
4496 {
4497 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4498 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4499 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4500 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4501 break;
4502 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4503 fDescOk = fIsLar;
4504 break;
4505 default:
4506 fDescOk = false;
4507 break;
4508 }
4509 }
4510 else
4511 {
4512 switch (Desc.Long.Gen.u4Type)
4513 {
4514 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4515 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4516 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4517 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4518 case X86_SEL_TYPE_SYS_LDT:
4519 break;
4520 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4521 case X86_SEL_TYPE_SYS_TASK_GATE:
4522 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4523 fDescOk = fIsLar;
4524 break;
4525 default:
4526 fDescOk = false;
4527 break;
4528 }
4529 }
4530 }
4531 if (fDescOk)
4532 {
4533 /*
4534 * Check the RPL/DPL/CPL interaction..
4535 */
4536 /** @todo testcase for the conforming behavior. */
4537 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4538 || !Desc.Legacy.Gen.u1DescType)
4539 {
4540 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4541 fDescOk = false;
4542 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4543 fDescOk = false;
4544 }
4545 }
4546
4547 if (fDescOk)
4548 {
4549 /*
4550 * All fine, start committing the result.
4551 */
4552 if (fIsLar)
4553 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4554 else
4555 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4556 }
4557
4558 }
4559 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4560 fDescOk = false;
4561 else
4562 return rcStrict;
4563
4564 /* commit flags value and advance rip. */
4565 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4566 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4567
4568 return VINF_SUCCESS;
4569}
4570
4571
4572/**
4573 * Implements LAR and LSL with 16-bit operand size.
4574 *
4575 * @returns VINF_SUCCESS.
4576 * @param pu16Dst Pointer to the destination register.
4577 * @param u16Sel The selector to load details for.
4578 * @param fIsLar true = LAR, false = LSL.
4579 */
4580IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4581{
4582 uint64_t u64TmpDst = *pu16Dst;
4583 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4584 *pu16Dst = u64TmpDst;
4585 return VINF_SUCCESS;
4586}
4587
4588
4589/**
4590 * Implements lgdt.
4591 *
4592 * @param iEffSeg The segment of the new gdtr contents
4593 * @param GCPtrEffSrc The address of the new gdtr contents.
4594 * @param enmEffOpSize The effective operand size.
4595 */
4596IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4597{
4598 if (pVCpu->iem.s.uCpl != 0)
4599 return iemRaiseGeneralProtectionFault0(pVCpu);
4600 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4601
4602 /*
4603 * Fetch the limit and base address.
4604 */
4605 uint16_t cbLimit;
4606 RTGCPTR GCPtrBase;
4607 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4608 if (rcStrict == VINF_SUCCESS)
4609 {
4610 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4611 || X86_IS_CANONICAL(GCPtrBase))
4612 {
4613 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4614 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4615 else
4616 {
4617 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4618 pCtx->gdtr.cbGdt = cbLimit;
4619 pCtx->gdtr.pGdt = GCPtrBase;
4620 }
4621 if (rcStrict == VINF_SUCCESS)
4622 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4623 }
4624 else
4625 {
4626 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4627 return iemRaiseGeneralProtectionFault0(pVCpu);
4628 }
4629 }
4630 return rcStrict;
4631}
4632
4633
4634/**
4635 * Implements sgdt.
4636 *
4637 * @param iEffSeg The segment where to store the gdtr content.
4638 * @param GCPtrEffDst The address where to store the gdtr content.
4639 */
4640IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4641{
4642 /*
4643 * Join paths with sidt.
4644 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4645 * you really must know.
4646 */
4647 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4648 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4649 if (rcStrict == VINF_SUCCESS)
4650 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4651 return rcStrict;
4652}
4653
4654
4655/**
4656 * Implements lidt.
4657 *
4658 * @param iEffSeg The segment of the new idtr contents
4659 * @param GCPtrEffSrc The address of the new idtr contents.
4660 * @param enmEffOpSize The effective operand size.
4661 */
4662IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4663{
4664 if (pVCpu->iem.s.uCpl != 0)
4665 return iemRaiseGeneralProtectionFault0(pVCpu);
4666 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4667
4668 /*
4669 * Fetch the limit and base address.
4670 */
4671 uint16_t cbLimit;
4672 RTGCPTR GCPtrBase;
4673 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4674 if (rcStrict == VINF_SUCCESS)
4675 {
4676 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4677 || X86_IS_CANONICAL(GCPtrBase))
4678 {
4679 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4680 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4681 else
4682 {
4683 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4684 pCtx->idtr.cbIdt = cbLimit;
4685 pCtx->idtr.pIdt = GCPtrBase;
4686 }
4687 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4688 }
4689 else
4690 {
4691 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4692 return iemRaiseGeneralProtectionFault0(pVCpu);
4693 }
4694 }
4695 return rcStrict;
4696}
4697
4698
4699/**
4700 * Implements sidt.
4701 *
4702 * @param iEffSeg The segment where to store the idtr content.
4703 * @param GCPtrEffDst The address where to store the idtr content.
4704 */
4705IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4706{
4707 /*
4708 * Join paths with sgdt.
4709 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4710 * you really must know.
4711 */
4712 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4713 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4714 if (rcStrict == VINF_SUCCESS)
4715 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4716 return rcStrict;
4717}
4718
4719
4720/**
4721 * Implements lldt.
4722 *
4723 * @param uNewLdt The new LDT selector value.
4724 */
4725IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4726{
4727 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4728
4729 /*
4730 * Check preconditions.
4731 */
4732 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4733 {
4734 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4735 return iemRaiseUndefinedOpcode(pVCpu);
4736 }
4737 if (pVCpu->iem.s.uCpl != 0)
4738 {
4739 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4740 return iemRaiseGeneralProtectionFault0(pVCpu);
4741 }
4742 if (uNewLdt & X86_SEL_LDT)
4743 {
4744 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4745 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4746 }
4747
4748 /*
4749 * Now, loading a NULL selector is easy.
4750 */
4751 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4752 {
4753 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4754 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4755 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4756 else
4757 pCtx->ldtr.Sel = uNewLdt;
4758 pCtx->ldtr.ValidSel = uNewLdt;
4759 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4760 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4761 {
4762 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4763 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4764 }
4765 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4766 {
4767 /* AMD-V seems to leave the base and limit alone. */
4768 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4769 }
4770 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4771 {
4772 /* VT-x (Intel 3960x) seems to be doing the following. */
4773 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4774 pCtx->ldtr.u64Base = 0;
4775 pCtx->ldtr.u32Limit = UINT32_MAX;
4776 }
4777
4778 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4779 return VINF_SUCCESS;
4780 }
4781
4782 /*
4783 * Read the descriptor.
4784 */
4785 IEMSELDESC Desc;
4786 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4787 if (rcStrict != VINF_SUCCESS)
4788 return rcStrict;
4789
4790 /* Check GPs first. */
4791 if (Desc.Legacy.Gen.u1DescType)
4792 {
4793 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4794 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4795 }
4796 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4797 {
4798 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4799 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4800 }
4801 uint64_t u64Base;
4802 if (!IEM_IS_LONG_MODE(pVCpu))
4803 u64Base = X86DESC_BASE(&Desc.Legacy);
4804 else
4805 {
4806 if (Desc.Long.Gen.u5Zeros)
4807 {
4808 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4809 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4810 }
4811
4812 u64Base = X86DESC64_BASE(&Desc.Long);
4813 if (!IEM_IS_CANONICAL(u64Base))
4814 {
4815 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4816 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4817 }
4818 }
4819
4820 /* NP */
4821 if (!Desc.Legacy.Gen.u1Present)
4822 {
4823 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4824 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4825 }
4826
4827 /*
4828 * It checks out alright, update the registers.
4829 */
4830/** @todo check if the actual value is loaded or if the RPL is dropped */
4831 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4832 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4833 else
4834 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4835 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4836 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4837 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4838 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4839 pCtx->ldtr.u64Base = u64Base;
4840
4841 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4842 return VINF_SUCCESS;
4843}
4844
4845
4846/**
4847 * Implements lldt.
4848 *
4849 * @param uNewLdt The new LDT selector value.
4850 */
4851IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4852{
4853 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4854
4855 /*
4856 * Check preconditions.
4857 */
4858 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4859 {
4860 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4861 return iemRaiseUndefinedOpcode(pVCpu);
4862 }
4863 if (pVCpu->iem.s.uCpl != 0)
4864 {
4865 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4866 return iemRaiseGeneralProtectionFault0(pVCpu);
4867 }
4868 if (uNewTr & X86_SEL_LDT)
4869 {
4870 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4871 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4872 }
4873 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4874 {
4875 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4876 return iemRaiseGeneralProtectionFault0(pVCpu);
4877 }
4878
4879 /*
4880 * Read the descriptor.
4881 */
4882 IEMSELDESC Desc;
4883 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4884 if (rcStrict != VINF_SUCCESS)
4885 return rcStrict;
4886
4887 /* Check GPs first. */
4888 if (Desc.Legacy.Gen.u1DescType)
4889 {
4890 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4891 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4892 }
4893 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4894 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4895 || IEM_IS_LONG_MODE(pVCpu)) )
4896 {
4897 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4898 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4899 }
4900 uint64_t u64Base;
4901 if (!IEM_IS_LONG_MODE(pVCpu))
4902 u64Base = X86DESC_BASE(&Desc.Legacy);
4903 else
4904 {
4905 if (Desc.Long.Gen.u5Zeros)
4906 {
4907 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4908 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4909 }
4910
4911 u64Base = X86DESC64_BASE(&Desc.Long);
4912 if (!IEM_IS_CANONICAL(u64Base))
4913 {
4914 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4915 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4916 }
4917 }
4918
4919 /* NP */
4920 if (!Desc.Legacy.Gen.u1Present)
4921 {
4922 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4923 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
4924 }
4925
4926 /*
4927 * Set it busy.
4928 * Note! Intel says this should lock down the whole descriptor, but we'll
4929 * restrict our selves to 32-bit for now due to lack of inline
4930 * assembly and such.
4931 */
4932 void *pvDesc;
4933 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4934 if (rcStrict != VINF_SUCCESS)
4935 return rcStrict;
4936 switch ((uintptr_t)pvDesc & 3)
4937 {
4938 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4939 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4940 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4941 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4942 }
4943 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
4944 if (rcStrict != VINF_SUCCESS)
4945 return rcStrict;
4946 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4947
4948 /*
4949 * It checks out alright, update the registers.
4950 */
4951/** @todo check if the actual value is loaded or if the RPL is dropped */
4952 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4953 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4954 else
4955 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4956 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4957 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4958 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4959 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4960 pCtx->tr.u64Base = u64Base;
4961
4962 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4963 return VINF_SUCCESS;
4964}
4965
4966
4967/**
4968 * Implements mov GReg,CRx.
4969 *
4970 * @param iGReg The general register to store the CRx value in.
4971 * @param iCrReg The CRx register to read (valid).
4972 */
4973IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4974{
4975 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4976 if (pVCpu->iem.s.uCpl != 0)
4977 return iemRaiseGeneralProtectionFault0(pVCpu);
4978 Assert(!pCtx->eflags.Bits.u1VM);
4979
4980 /* read it */
4981 uint64_t crX;
4982 switch (iCrReg)
4983 {
4984 case 0:
4985 crX = pCtx->cr0;
4986 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
4987 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4988 break;
4989 case 2: crX = pCtx->cr2; break;
4990 case 3: crX = pCtx->cr3; break;
4991 case 4: crX = pCtx->cr4; break;
4992 case 8:
4993 {
4994 uint8_t uTpr;
4995 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
4996 if (RT_SUCCESS(rc))
4997 crX = uTpr >> 4;
4998 else
4999 crX = 0;
5000 break;
5001 }
5002 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5003 }
5004
5005 /* store it */
5006 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5007 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5008 else
5009 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5010
5011 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5012 return VINF_SUCCESS;
5013}
5014
5015
5016/**
5017 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5018 *
5019 * @param iCrReg The CRx register to write (valid).
5020 * @param uNewCrX The new value.
5021 */
5022IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
5023{
5024 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5025 VBOXSTRICTRC rcStrict;
5026 int rc;
5027
5028 /*
5029 * Try store it.
5030 * Unfortunately, CPUM only does a tiny bit of the work.
5031 */
5032 switch (iCrReg)
5033 {
5034 case 0:
5035 {
5036 /*
5037 * Perform checks.
5038 */
5039 uint64_t const uOldCrX = pCtx->cr0;
5040 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
5041 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
5042 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
5043
5044 /* ET is hardcoded on 486 and later. */
5045 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5046 uNewCrX |= X86_CR0_ET;
5047 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5048 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5049 {
5050 uNewCrX &= fValid;
5051 uNewCrX |= X86_CR0_ET;
5052 }
5053 else
5054 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5055
5056 /* Check for reserved bits. */
5057 if (uNewCrX & ~(uint64_t)fValid)
5058 {
5059 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5060 return iemRaiseGeneralProtectionFault0(pVCpu);
5061 }
5062
5063 /* Check for invalid combinations. */
5064 if ( (uNewCrX & X86_CR0_PG)
5065 && !(uNewCrX & X86_CR0_PE) )
5066 {
5067 Log(("Trying to set CR0.PG without CR0.PE\n"));
5068 return iemRaiseGeneralProtectionFault0(pVCpu);
5069 }
5070
5071 if ( !(uNewCrX & X86_CR0_CD)
5072 && (uNewCrX & X86_CR0_NW) )
5073 {
5074 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5075 return iemRaiseGeneralProtectionFault0(pVCpu);
5076 }
5077
5078 /* Long mode consistency checks. */
5079 if ( (uNewCrX & X86_CR0_PG)
5080 && !(uOldCrX & X86_CR0_PG)
5081 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5082 {
5083 if (!(pCtx->cr4 & X86_CR4_PAE))
5084 {
5085 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5086 return iemRaiseGeneralProtectionFault0(pVCpu);
5087 }
5088 if (pCtx->cs.Attr.n.u1Long)
5089 {
5090 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5091 return iemRaiseGeneralProtectionFault0(pVCpu);
5092 }
5093 }
5094
5095 /** @todo check reserved PDPTR bits as AMD states. */
5096
5097 /*
5098 * Change CR0.
5099 */
5100 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5101 CPUMSetGuestCR0(pVCpu, uNewCrX);
5102 else
5103 pCtx->cr0 = uNewCrX;
5104 Assert(pCtx->cr0 == uNewCrX);
5105
5106 /*
5107 * Change EFER.LMA if entering or leaving long mode.
5108 */
5109 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5110 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5111 {
5112 uint64_t NewEFER = pCtx->msrEFER;
5113 if (uNewCrX & X86_CR0_PG)
5114 NewEFER |= MSR_K6_EFER_LMA;
5115 else
5116 NewEFER &= ~MSR_K6_EFER_LMA;
5117
5118 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5119 CPUMSetGuestEFER(pVCpu, NewEFER);
5120 else
5121 pCtx->msrEFER = NewEFER;
5122 Assert(pCtx->msrEFER == NewEFER);
5123 }
5124
5125 /*
5126 * Inform PGM.
5127 */
5128 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5129 {
5130 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5131 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5132 {
5133 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5134 AssertRCReturn(rc, rc);
5135 /* ignore informational status codes */
5136 }
5137 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5138 }
5139 else
5140 rcStrict = VINF_SUCCESS;
5141
5142#ifdef IN_RC
5143 /* Return to ring-3 for rescheduling if WP or AM changes. */
5144 if ( rcStrict == VINF_SUCCESS
5145 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5146 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5147 rcStrict = VINF_EM_RESCHEDULE;
5148#endif
5149 break;
5150 }
5151
5152 /*
5153 * CR2 can be changed without any restrictions.
5154 */
5155 case 2:
5156 pCtx->cr2 = uNewCrX;
5157 rcStrict = VINF_SUCCESS;
5158 break;
5159
5160 /*
5161 * CR3 is relatively simple, although AMD and Intel have different
5162 * accounts of how setting reserved bits are handled. We take intel's
5163 * word for the lower bits and AMD's for the high bits (63:52). The
5164 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5165 * on this.
5166 */
5167 /** @todo Testcase: Setting reserved bits in CR3, especially before
5168 * enabling paging. */
5169 case 3:
5170 {
5171 /* check / mask the value. */
5172 if (uNewCrX & UINT64_C(0xfff0000000000000))
5173 {
5174 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5175 return iemRaiseGeneralProtectionFault0(pVCpu);
5176 }
5177
5178 uint64_t fValid;
5179 if ( (pCtx->cr4 & X86_CR4_PAE)
5180 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5181 fValid = UINT64_C(0x000fffffffffffff);
5182 else
5183 fValid = UINT64_C(0xffffffff);
5184 if (uNewCrX & ~fValid)
5185 {
5186 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5187 uNewCrX, uNewCrX & ~fValid));
5188 uNewCrX &= fValid;
5189 }
5190
5191 /** @todo If we're in PAE mode we should check the PDPTRs for
5192 * invalid bits. */
5193
5194 /* Make the change. */
5195 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5196 {
5197 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5198 AssertRCSuccessReturn(rc, rc);
5199 }
5200 else
5201 pCtx->cr3 = uNewCrX;
5202
5203 /* Inform PGM. */
5204 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5205 {
5206 if (pCtx->cr0 & X86_CR0_PG)
5207 {
5208 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5209 AssertRCReturn(rc, rc);
5210 /* ignore informational status codes */
5211 }
5212 }
5213 rcStrict = VINF_SUCCESS;
5214 break;
5215 }
5216
5217 /*
5218 * CR4 is a bit more tedious as there are bits which cannot be cleared
5219 * under some circumstances and such.
5220 */
5221 case 4:
5222 {
5223 uint64_t const uOldCrX = pCtx->cr4;
5224
5225 /** @todo Shouldn't this look at the guest CPUID bits to determine
5226 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5227 * should #GP(0). */
5228 /* reserved bits */
5229 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5230 | X86_CR4_TSD | X86_CR4_DE
5231 | X86_CR4_PSE | X86_CR4_PAE
5232 | X86_CR4_MCE | X86_CR4_PGE
5233 | X86_CR4_PCE | X86_CR4_OSFXSR
5234 | X86_CR4_OSXMMEEXCPT;
5235 //if (xxx)
5236 // fValid |= X86_CR4_VMXE;
5237 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5238 fValid |= X86_CR4_OSXSAVE;
5239 if (uNewCrX & ~(uint64_t)fValid)
5240 {
5241 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5242 return iemRaiseGeneralProtectionFault0(pVCpu);
5243 }
5244
5245 /* long mode checks. */
5246 if ( (uOldCrX & X86_CR4_PAE)
5247 && !(uNewCrX & X86_CR4_PAE)
5248 && CPUMIsGuestInLongModeEx(pCtx) )
5249 {
5250 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5251 return iemRaiseGeneralProtectionFault0(pVCpu);
5252 }
5253
5254
5255 /*
5256 * Change it.
5257 */
5258 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5259 {
5260 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5261 AssertRCSuccessReturn(rc, rc);
5262 }
5263 else
5264 pCtx->cr4 = uNewCrX;
5265 Assert(pCtx->cr4 == uNewCrX);
5266
5267 /*
5268 * Notify SELM and PGM.
5269 */
5270 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5271 {
5272 /* SELM - VME may change things wrt to the TSS shadowing. */
5273 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5274 {
5275 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5276 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5277#ifdef VBOX_WITH_RAW_MODE
5278 if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
5279 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5280#endif
5281 }
5282
5283 /* PGM - flushing and mode. */
5284 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
5285 {
5286 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5287 AssertRCReturn(rc, rc);
5288 /* ignore informational status codes */
5289 }
5290 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5291 }
5292 else
5293 rcStrict = VINF_SUCCESS;
5294 break;
5295 }
5296
5297 /*
5298 * CR8 maps to the APIC TPR.
5299 */
5300 case 8:
5301 if (uNewCrX & ~(uint64_t)0xf)
5302 {
5303 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5304 return iemRaiseGeneralProtectionFault0(pVCpu);
5305 }
5306
5307 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5308 APICSetTpr(pVCpu, (uint8_t)uNewCrX << 4);
5309 rcStrict = VINF_SUCCESS;
5310 break;
5311
5312 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5313 }
5314
5315 /*
5316 * Advance the RIP on success.
5317 */
5318 if (RT_SUCCESS(rcStrict))
5319 {
5320 if (rcStrict != VINF_SUCCESS)
5321 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5322 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5323 }
5324
5325 return rcStrict;
5326}
5327
5328
5329/**
5330 * Implements mov CRx,GReg.
5331 *
5332 * @param iCrReg The CRx register to write (valid).
5333 * @param iGReg The general register to load the DRx value from.
5334 */
5335IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5336{
5337 if (pVCpu->iem.s.uCpl != 0)
5338 return iemRaiseGeneralProtectionFault0(pVCpu);
5339 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5340
5341 /*
5342 * Read the new value from the source register and call common worker.
5343 */
5344 uint64_t uNewCrX;
5345 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5346 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5347 else
5348 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5349 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5350}
5351
5352
5353/**
5354 * Implements 'LMSW r/m16'
5355 *
5356 * @param u16NewMsw The new value.
5357 */
5358IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5359{
5360 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5361
5362 if (pVCpu->iem.s.uCpl != 0)
5363 return iemRaiseGeneralProtectionFault0(pVCpu);
5364 Assert(!pCtx->eflags.Bits.u1VM);
5365
5366 /*
5367 * Compose the new CR0 value and call common worker.
5368 */
5369 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5370 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5371 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5372}
5373
5374
5375/**
5376 * Implements 'CLTS'.
5377 */
5378IEM_CIMPL_DEF_0(iemCImpl_clts)
5379{
5380 if (pVCpu->iem.s.uCpl != 0)
5381 return iemRaiseGeneralProtectionFault0(pVCpu);
5382
5383 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5384 uint64_t uNewCr0 = pCtx->cr0;
5385 uNewCr0 &= ~X86_CR0_TS;
5386 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5387}
5388
5389
5390/**
5391 * Implements mov GReg,DRx.
5392 *
5393 * @param iGReg The general register to store the DRx value in.
5394 * @param iDrReg The DRx register to read (0-7).
5395 */
5396IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5397{
5398 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5399
5400 /*
5401 * Check preconditions.
5402 */
5403
5404 /* Raise GPs. */
5405 if (pVCpu->iem.s.uCpl != 0)
5406 return iemRaiseGeneralProtectionFault0(pVCpu);
5407 Assert(!pCtx->eflags.Bits.u1VM);
5408
5409 if ( (iDrReg == 4 || iDrReg == 5)
5410 && (pCtx->cr4 & X86_CR4_DE) )
5411 {
5412 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5413 return iemRaiseGeneralProtectionFault0(pVCpu);
5414 }
5415
5416 /* Raise #DB if general access detect is enabled. */
5417 if (pCtx->dr[7] & X86_DR7_GD)
5418 {
5419 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5420 return iemRaiseDebugException(pVCpu);
5421 }
5422
5423 /*
5424 * Read the debug register and store it in the specified general register.
5425 */
5426 uint64_t drX;
5427 switch (iDrReg)
5428 {
5429 case 0: drX = pCtx->dr[0]; break;
5430 case 1: drX = pCtx->dr[1]; break;
5431 case 2: drX = pCtx->dr[2]; break;
5432 case 3: drX = pCtx->dr[3]; break;
5433 case 6:
5434 case 4:
5435 drX = pCtx->dr[6];
5436 drX |= X86_DR6_RA1_MASK;
5437 drX &= ~X86_DR6_RAZ_MASK;
5438 break;
5439 case 7:
5440 case 5:
5441 drX = pCtx->dr[7];
5442 drX |=X86_DR7_RA1_MASK;
5443 drX &= ~X86_DR7_RAZ_MASK;
5444 break;
5445 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5446 }
5447
5448 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5449 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5450 else
5451 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5452
5453 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5454 return VINF_SUCCESS;
5455}
5456
5457
5458/**
5459 * Implements mov DRx,GReg.
5460 *
5461 * @param iDrReg The DRx register to write (valid).
5462 * @param iGReg The general register to load the DRx value from.
5463 */
5464IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5465{
5466 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5467
5468 /*
5469 * Check preconditions.
5470 */
5471 if (pVCpu->iem.s.uCpl != 0)
5472 return iemRaiseGeneralProtectionFault0(pVCpu);
5473 Assert(!pCtx->eflags.Bits.u1VM);
5474
5475 if (iDrReg == 4 || iDrReg == 5)
5476 {
5477 if (pCtx->cr4 & X86_CR4_DE)
5478 {
5479 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5480 return iemRaiseGeneralProtectionFault0(pVCpu);
5481 }
5482 iDrReg += 2;
5483 }
5484
5485 /* Raise #DB if general access detect is enabled. */
5486 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5487 * \#GP? */
5488 if (pCtx->dr[7] & X86_DR7_GD)
5489 {
5490 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5491 return iemRaiseDebugException(pVCpu);
5492 }
5493
5494 /*
5495 * Read the new value from the source register.
5496 */
5497 uint64_t uNewDrX;
5498 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5499 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5500 else
5501 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5502
5503 /*
5504 * Adjust it.
5505 */
5506 switch (iDrReg)
5507 {
5508 case 0:
5509 case 1:
5510 case 2:
5511 case 3:
5512 /* nothing to adjust */
5513 break;
5514
5515 case 6:
5516 if (uNewDrX & X86_DR6_MBZ_MASK)
5517 {
5518 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5519 return iemRaiseGeneralProtectionFault0(pVCpu);
5520 }
5521 uNewDrX |= X86_DR6_RA1_MASK;
5522 uNewDrX &= ~X86_DR6_RAZ_MASK;
5523 break;
5524
5525 case 7:
5526 if (uNewDrX & X86_DR7_MBZ_MASK)
5527 {
5528 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5529 return iemRaiseGeneralProtectionFault0(pVCpu);
5530 }
5531 uNewDrX |= X86_DR7_RA1_MASK;
5532 uNewDrX &= ~X86_DR7_RAZ_MASK;
5533 break;
5534
5535 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5536 }
5537
5538 /*
5539 * Do the actual setting.
5540 */
5541 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5542 {
5543 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5544 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5545 }
5546 else
5547 pCtx->dr[iDrReg] = uNewDrX;
5548
5549 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5550 return VINF_SUCCESS;
5551}
5552
5553
5554/**
5555 * Implements 'INVLPG m'.
5556 *
5557 * @param GCPtrPage The effective address of the page to invalidate.
5558 * @remarks Updates the RIP.
5559 */
5560IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5561{
5562 /* ring-0 only. */
5563 if (pVCpu->iem.s.uCpl != 0)
5564 return iemRaiseGeneralProtectionFault0(pVCpu);
5565 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5566
5567 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5568 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5569
5570 if (rc == VINF_SUCCESS)
5571 return VINF_SUCCESS;
5572 if (rc == VINF_PGM_SYNC_CR3)
5573 return iemSetPassUpStatus(pVCpu, rc);
5574
5575 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5576 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5577 return rc;
5578}
5579
5580
5581/**
5582 * Implements RDTSC.
5583 */
5584IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5585{
5586 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5587
5588 /*
5589 * Check preconditions.
5590 */
5591 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5592 return iemRaiseUndefinedOpcode(pVCpu);
5593
5594 if ( (pCtx->cr4 & X86_CR4_TSD)
5595 && pVCpu->iem.s.uCpl != 0)
5596 {
5597 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5598 return iemRaiseGeneralProtectionFault0(pVCpu);
5599 }
5600
5601 /*
5602 * Do the job.
5603 */
5604 uint64_t uTicks = TMCpuTickGet(pVCpu);
5605 pCtx->rax = (uint32_t)uTicks;
5606 pCtx->rdx = uTicks >> 32;
5607#ifdef IEM_VERIFICATION_MODE_FULL
5608 pVCpu->iem.s.fIgnoreRaxRdx = true;
5609#endif
5610
5611 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5612 return VINF_SUCCESS;
5613}
5614
5615
5616/**
5617 * Implements RDMSR.
5618 */
5619IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5620{
5621 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5622
5623 /*
5624 * Check preconditions.
5625 */
5626 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5627 return iemRaiseUndefinedOpcode(pVCpu);
5628 if (pVCpu->iem.s.uCpl != 0)
5629 return iemRaiseGeneralProtectionFault0(pVCpu);
5630
5631 /*
5632 * Do the job.
5633 */
5634 RTUINT64U uValue;
5635 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
5636 if (rcStrict == VINF_SUCCESS)
5637 {
5638 pCtx->rax = uValue.s.Lo;
5639 pCtx->rdx = uValue.s.Hi;
5640
5641 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5642 return VINF_SUCCESS;
5643 }
5644
5645#ifndef IN_RING3
5646 /* Deferred to ring-3. */
5647 if (rcStrict == VINF_CPUM_R3_MSR_READ)
5648 {
5649 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5650 return rcStrict;
5651 }
5652#else /* IN_RING3 */
5653 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5654 static uint32_t s_cTimes = 0;
5655 if (s_cTimes++ < 10)
5656 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5657 else
5658#endif
5659 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5660 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5661 return iemRaiseGeneralProtectionFault0(pVCpu);
5662}
5663
5664
5665/**
5666 * Implements WRMSR.
5667 */
5668IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5669{
5670 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5671
5672 /*
5673 * Check preconditions.
5674 */
5675 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5676 return iemRaiseUndefinedOpcode(pVCpu);
5677 if (pVCpu->iem.s.uCpl != 0)
5678 return iemRaiseGeneralProtectionFault0(pVCpu);
5679
5680 /*
5681 * Do the job.
5682 */
5683 RTUINT64U uValue;
5684 uValue.s.Lo = pCtx->eax;
5685 uValue.s.Hi = pCtx->edx;
5686
5687 VBOXSTRICTRC rcStrict;
5688 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5689 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5690 else
5691 {
5692#ifdef IN_RING3
5693 CPUMCTX CtxTmp = *pCtx;
5694 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5695 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
5696 *pCtx = *pCtx2;
5697 *pCtx2 = CtxTmp;
5698#else
5699 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5700#endif
5701 }
5702 if (rcStrict == VINF_SUCCESS)
5703 {
5704 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5705 return VINF_SUCCESS;
5706 }
5707
5708#ifndef IN_RING3
5709 /* Deferred to ring-3. */
5710 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5711 {
5712 Log(("IEM: wrmsr(%#x) -> ring-3\n", pCtx->ecx));
5713 return rcStrict;
5714 }
5715#else /* IN_RING3 */
5716 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5717 static uint32_t s_cTimes = 0;
5718 if (s_cTimes++ < 10)
5719 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5720 else
5721#endif
5722 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5723 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5724 return iemRaiseGeneralProtectionFault0(pVCpu);
5725}
5726
5727
5728/**
5729 * Implements 'IN eAX, port'.
5730 *
5731 * @param u16Port The source port.
5732 * @param cbReg The register size.
5733 */
5734IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5735{
5736 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5737
5738 /*
5739 * CPL check
5740 */
5741 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5742 if (rcStrict != VINF_SUCCESS)
5743 return rcStrict;
5744
5745 /*
5746 * Perform the I/O.
5747 */
5748 uint32_t u32Value;
5749 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5750 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
5751 else
5752 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
5753 if (IOM_SUCCESS(rcStrict))
5754 {
5755 switch (cbReg)
5756 {
5757 case 1: pCtx->al = (uint8_t)u32Value; break;
5758 case 2: pCtx->ax = (uint16_t)u32Value; break;
5759 case 4: pCtx->rax = u32Value; break;
5760 default: AssertFailedReturn(VERR_IEM_IPE_3);
5761 }
5762 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5763 pVCpu->iem.s.cPotentialExits++;
5764 if (rcStrict != VINF_SUCCESS)
5765 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5766 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5767
5768 /*
5769 * Check for I/O breakpoints.
5770 */
5771 uint32_t const uDr7 = pCtx->dr[7];
5772 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5773 && X86_DR7_ANY_RW_IO(uDr7)
5774 && (pCtx->cr4 & X86_CR4_DE))
5775 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5776 {
5777 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5778 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5779 rcStrict = iemRaiseDebugException(pVCpu);
5780 }
5781 }
5782
5783 return rcStrict;
5784}
5785
5786
5787/**
5788 * Implements 'IN eAX, DX'.
5789 *
5790 * @param cbReg The register size.
5791 */
5792IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5793{
5794 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
5795}
5796
5797
5798/**
5799 * Implements 'OUT port, eAX'.
5800 *
5801 * @param u16Port The destination port.
5802 * @param cbReg The register size.
5803 */
5804IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5805{
5806 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5807
5808 /*
5809 * CPL check
5810 */
5811 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5812 if (rcStrict != VINF_SUCCESS)
5813 return rcStrict;
5814
5815 /*
5816 * Perform the I/O.
5817 */
5818 uint32_t u32Value;
5819 switch (cbReg)
5820 {
5821 case 1: u32Value = pCtx->al; break;
5822 case 2: u32Value = pCtx->ax; break;
5823 case 4: u32Value = pCtx->eax; break;
5824 default: AssertFailedReturn(VERR_IEM_IPE_4);
5825 }
5826 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5827 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
5828 else
5829 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
5830 if (IOM_SUCCESS(rcStrict))
5831 {
5832 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5833 pVCpu->iem.s.cPotentialExits++;
5834 if (rcStrict != VINF_SUCCESS)
5835 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5836 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5837
5838 /*
5839 * Check for I/O breakpoints.
5840 */
5841 uint32_t const uDr7 = pCtx->dr[7];
5842 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5843 && X86_DR7_ANY_RW_IO(uDr7)
5844 && (pCtx->cr4 & X86_CR4_DE))
5845 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5846 {
5847 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5848 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5849 rcStrict = iemRaiseDebugException(pVCpu);
5850 }
5851 }
5852 return rcStrict;
5853}
5854
5855
5856/**
5857 * Implements 'OUT DX, eAX'.
5858 *
5859 * @param cbReg The register size.
5860 */
5861IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5862{
5863 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
5864}
5865
5866
5867/**
5868 * Implements 'CLI'.
5869 */
5870IEM_CIMPL_DEF_0(iemCImpl_cli)
5871{
5872 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5873 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5874 uint32_t const fEflOld = fEfl;
5875 if (pCtx->cr0 & X86_CR0_PE)
5876 {
5877 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5878 if (!(fEfl & X86_EFL_VM))
5879 {
5880 if (pVCpu->iem.s.uCpl <= uIopl)
5881 fEfl &= ~X86_EFL_IF;
5882 else if ( pVCpu->iem.s.uCpl == 3
5883 && (pCtx->cr4 & X86_CR4_PVI) )
5884 fEfl &= ~X86_EFL_VIF;
5885 else
5886 return iemRaiseGeneralProtectionFault0(pVCpu);
5887 }
5888 /* V8086 */
5889 else if (uIopl == 3)
5890 fEfl &= ~X86_EFL_IF;
5891 else if ( uIopl < 3
5892 && (pCtx->cr4 & X86_CR4_VME) )
5893 fEfl &= ~X86_EFL_VIF;
5894 else
5895 return iemRaiseGeneralProtectionFault0(pVCpu);
5896 }
5897 /* real mode */
5898 else
5899 fEfl &= ~X86_EFL_IF;
5900
5901 /* Commit. */
5902 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5903 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5904 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5905 return VINF_SUCCESS;
5906}
5907
5908
5909/**
5910 * Implements 'STI'.
5911 */
5912IEM_CIMPL_DEF_0(iemCImpl_sti)
5913{
5914 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5915 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5916 uint32_t const fEflOld = fEfl;
5917
5918 if (pCtx->cr0 & X86_CR0_PE)
5919 {
5920 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5921 if (!(fEfl & X86_EFL_VM))
5922 {
5923 if (pVCpu->iem.s.uCpl <= uIopl)
5924 fEfl |= X86_EFL_IF;
5925 else if ( pVCpu->iem.s.uCpl == 3
5926 && (pCtx->cr4 & X86_CR4_PVI)
5927 && !(fEfl & X86_EFL_VIP) )
5928 fEfl |= X86_EFL_VIF;
5929 else
5930 return iemRaiseGeneralProtectionFault0(pVCpu);
5931 }
5932 /* V8086 */
5933 else if (uIopl == 3)
5934 fEfl |= X86_EFL_IF;
5935 else if ( uIopl < 3
5936 && (pCtx->cr4 & X86_CR4_VME)
5937 && !(fEfl & X86_EFL_VIP) )
5938 fEfl |= X86_EFL_VIF;
5939 else
5940 return iemRaiseGeneralProtectionFault0(pVCpu);
5941 }
5942 /* real mode */
5943 else
5944 fEfl |= X86_EFL_IF;
5945
5946 /* Commit. */
5947 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5948 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5949 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
5950 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
5951 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5952 return VINF_SUCCESS;
5953}
5954
5955
5956/**
5957 * Implements 'HLT'.
5958 */
5959IEM_CIMPL_DEF_0(iemCImpl_hlt)
5960{
5961 if (pVCpu->iem.s.uCpl != 0)
5962 return iemRaiseGeneralProtectionFault0(pVCpu);
5963 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5964 return VINF_EM_HALT;
5965}
5966
5967
5968/**
5969 * Implements 'MONITOR'.
5970 */
5971IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5972{
5973 /*
5974 * Permission checks.
5975 */
5976 if (pVCpu->iem.s.uCpl != 0)
5977 {
5978 Log2(("monitor: CPL != 0\n"));
5979 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5980 }
5981 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5982 {
5983 Log2(("monitor: Not in CPUID\n"));
5984 return iemRaiseUndefinedOpcode(pVCpu);
5985 }
5986
5987 /*
5988 * Gather the operands and validate them.
5989 */
5990 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5991 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5992 uint32_t uEcx = pCtx->ecx;
5993 uint32_t uEdx = pCtx->edx;
5994/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
5995 * \#GP first. */
5996 if (uEcx != 0)
5997 {
5998 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
5999 return iemRaiseGeneralProtectionFault0(pVCpu);
6000 }
6001
6002 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
6003 if (rcStrict != VINF_SUCCESS)
6004 return rcStrict;
6005
6006 RTGCPHYS GCPhysMem;
6007 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6008 if (rcStrict != VINF_SUCCESS)
6009 return rcStrict;
6010
6011 /*
6012 * Call EM to prepare the monitor/wait.
6013 */
6014 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
6015 Assert(rcStrict == VINF_SUCCESS);
6016
6017 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6018 return rcStrict;
6019}
6020
6021
6022/**
6023 * Implements 'MWAIT'.
6024 */
6025IEM_CIMPL_DEF_0(iemCImpl_mwait)
6026{
6027 /*
6028 * Permission checks.
6029 */
6030 if (pVCpu->iem.s.uCpl != 0)
6031 {
6032 Log2(("mwait: CPL != 0\n"));
6033 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
6034 * EFLAGS.VM then.) */
6035 return iemRaiseUndefinedOpcode(pVCpu);
6036 }
6037 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6038 {
6039 Log2(("mwait: Not in CPUID\n"));
6040 return iemRaiseUndefinedOpcode(pVCpu);
6041 }
6042
6043 /*
6044 * Gather the operands and validate them.
6045 */
6046 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6047 uint32_t uEax = pCtx->eax;
6048 uint32_t uEcx = pCtx->ecx;
6049 if (uEcx != 0)
6050 {
6051 /* Only supported extension is break on IRQ when IF=0. */
6052 if (uEcx > 1)
6053 {
6054 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
6055 return iemRaiseGeneralProtectionFault0(pVCpu);
6056 }
6057 uint32_t fMWaitFeatures = 0;
6058 uint32_t uIgnore = 0;
6059 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
6060 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6061 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6062 {
6063 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
6064 return iemRaiseGeneralProtectionFault0(pVCpu);
6065 }
6066 }
6067
6068 /*
6069 * Call EM to prepare the monitor/wait.
6070 */
6071 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
6072
6073 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6074 return rcStrict;
6075}
6076
6077
6078/**
6079 * Implements 'SWAPGS'.
6080 */
6081IEM_CIMPL_DEF_0(iemCImpl_swapgs)
6082{
6083 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
6084
6085 /*
6086 * Permission checks.
6087 */
6088 if (pVCpu->iem.s.uCpl != 0)
6089 {
6090 Log2(("swapgs: CPL != 0\n"));
6091 return iemRaiseUndefinedOpcode(pVCpu);
6092 }
6093
6094 /*
6095 * Do the job.
6096 */
6097 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6098 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
6099 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
6100 pCtx->gs.u64Base = uOtherGsBase;
6101
6102 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6103 return VINF_SUCCESS;
6104}
6105
6106
6107/**
6108 * Implements 'CPUID'.
6109 */
6110IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6111{
6112 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6113
6114 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6115 pCtx->rax &= UINT32_C(0xffffffff);
6116 pCtx->rbx &= UINT32_C(0xffffffff);
6117 pCtx->rcx &= UINT32_C(0xffffffff);
6118 pCtx->rdx &= UINT32_C(0xffffffff);
6119
6120 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6121 return VINF_SUCCESS;
6122}
6123
6124
6125/**
6126 * Implements 'AAD'.
6127 *
6128 * @param bImm The immediate operand.
6129 */
6130IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6131{
6132 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6133
6134 uint16_t const ax = pCtx->ax;
6135 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6136 pCtx->ax = al;
6137 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6138 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6139 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6140
6141 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6142 return VINF_SUCCESS;
6143}
6144
6145
6146/**
6147 * Implements 'AAM'.
6148 *
6149 * @param bImm The immediate operand. Cannot be 0.
6150 */
6151IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6152{
6153 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6154 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6155
6156 uint16_t const ax = pCtx->ax;
6157 uint8_t const al = (uint8_t)ax % bImm;
6158 uint8_t const ah = (uint8_t)ax / bImm;
6159 pCtx->ax = (ah << 8) + al;
6160 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6161 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6162 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6163
6164 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6165 return VINF_SUCCESS;
6166}
6167
6168
6169/**
6170 * Implements 'DAA'.
6171 */
6172IEM_CIMPL_DEF_0(iemCImpl_daa)
6173{
6174 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6175
6176 uint8_t const al = pCtx->al;
6177 bool const fCarry = pCtx->eflags.Bits.u1CF;
6178
6179 if ( pCtx->eflags.Bits.u1AF
6180 || (al & 0xf) >= 10)
6181 {
6182 pCtx->al = al + 6;
6183 pCtx->eflags.Bits.u1AF = 1;
6184 }
6185 else
6186 pCtx->eflags.Bits.u1AF = 0;
6187
6188 if (al >= 0x9a || fCarry)
6189 {
6190 pCtx->al += 0x60;
6191 pCtx->eflags.Bits.u1CF = 1;
6192 }
6193 else
6194 pCtx->eflags.Bits.u1CF = 0;
6195
6196 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6197 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6198 return VINF_SUCCESS;
6199}
6200
6201
6202/**
6203 * Implements 'DAS'.
6204 */
6205IEM_CIMPL_DEF_0(iemCImpl_das)
6206{
6207 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6208
6209 uint8_t const uInputAL = pCtx->al;
6210 bool const fCarry = pCtx->eflags.Bits.u1CF;
6211
6212 if ( pCtx->eflags.Bits.u1AF
6213 || (uInputAL & 0xf) >= 10)
6214 {
6215 pCtx->eflags.Bits.u1AF = 1;
6216 if (uInputAL < 6)
6217 pCtx->eflags.Bits.u1CF = 1;
6218 pCtx->al = uInputAL - 6;
6219 }
6220 else
6221 {
6222 pCtx->eflags.Bits.u1AF = 0;
6223 pCtx->eflags.Bits.u1CF = 0;
6224 }
6225
6226 if (uInputAL >= 0x9a || fCarry)
6227 {
6228 pCtx->al -= 0x60;
6229 pCtx->eflags.Bits.u1CF = 1;
6230 }
6231
6232 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6233 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6234 return VINF_SUCCESS;
6235}
6236
6237
6238
6239
6240/*
6241 * Instantiate the various string operation combinations.
6242 */
6243#define OP_SIZE 8
6244#define ADDR_SIZE 16
6245#include "IEMAllCImplStrInstr.cpp.h"
6246#define OP_SIZE 8
6247#define ADDR_SIZE 32
6248#include "IEMAllCImplStrInstr.cpp.h"
6249#define OP_SIZE 8
6250#define ADDR_SIZE 64
6251#include "IEMAllCImplStrInstr.cpp.h"
6252
6253#define OP_SIZE 16
6254#define ADDR_SIZE 16
6255#include "IEMAllCImplStrInstr.cpp.h"
6256#define OP_SIZE 16
6257#define ADDR_SIZE 32
6258#include "IEMAllCImplStrInstr.cpp.h"
6259#define OP_SIZE 16
6260#define ADDR_SIZE 64
6261#include "IEMAllCImplStrInstr.cpp.h"
6262
6263#define OP_SIZE 32
6264#define ADDR_SIZE 16
6265#include "IEMAllCImplStrInstr.cpp.h"
6266#define OP_SIZE 32
6267#define ADDR_SIZE 32
6268#include "IEMAllCImplStrInstr.cpp.h"
6269#define OP_SIZE 32
6270#define ADDR_SIZE 64
6271#include "IEMAllCImplStrInstr.cpp.h"
6272
6273#define OP_SIZE 64
6274#define ADDR_SIZE 32
6275#include "IEMAllCImplStrInstr.cpp.h"
6276#define OP_SIZE 64
6277#define ADDR_SIZE 64
6278#include "IEMAllCImplStrInstr.cpp.h"
6279
6280
6281/**
6282 * Implements 'XGETBV'.
6283 */
6284IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6285{
6286 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6287 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6288 {
6289 uint32_t uEcx = pCtx->ecx;
6290 switch (uEcx)
6291 {
6292 case 0:
6293 break;
6294
6295 case 1: /** @todo Implement XCR1 support. */
6296 default:
6297 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6298 return iemRaiseGeneralProtectionFault0(pVCpu);
6299
6300 }
6301 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6302 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6303
6304 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6305 return VINF_SUCCESS;
6306 }
6307 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6308 return iemRaiseUndefinedOpcode(pVCpu);
6309}
6310
6311
6312/**
6313 * Implements 'XSETBV'.
6314 */
6315IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6316{
6317 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6318 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6319 {
6320 if (pVCpu->iem.s.uCpl == 0)
6321 {
6322 uint32_t uEcx = pCtx->ecx;
6323 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6324 switch (uEcx)
6325 {
6326 case 0:
6327 {
6328 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
6329 if (rc == VINF_SUCCESS)
6330 break;
6331 Assert(rc == VERR_CPUM_RAISE_GP_0);
6332 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6333 return iemRaiseGeneralProtectionFault0(pVCpu);
6334 }
6335
6336 case 1: /** @todo Implement XCR1 support. */
6337 default:
6338 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6339 return iemRaiseGeneralProtectionFault0(pVCpu);
6340
6341 }
6342
6343 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6344 return VINF_SUCCESS;
6345 }
6346
6347 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
6348 return iemRaiseGeneralProtectionFault0(pVCpu);
6349 }
6350 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6351 return iemRaiseUndefinedOpcode(pVCpu);
6352}
6353
6354
6355
6356/**
6357 * Implements 'FINIT' and 'FNINIT'.
6358 *
6359 * @param fCheckXcpts Whether to check for umasked pending exceptions or
6360 * not.
6361 */
6362IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6363{
6364 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6365
6366 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6367 return iemRaiseDeviceNotAvailable(pVCpu);
6368
6369 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6370 if (fCheckXcpts && TODO )
6371 return iemRaiseMathFault(pVCpu);
6372 */
6373
6374 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6375 pXState->x87.FCW = 0x37f;
6376 pXState->x87.FSW = 0;
6377 pXState->x87.FTW = 0x00; /* 0 - empty. */
6378 pXState->x87.FPUDP = 0;
6379 pXState->x87.DS = 0; //??
6380 pXState->x87.Rsrvd2= 0;
6381 pXState->x87.FPUIP = 0;
6382 pXState->x87.CS = 0; //??
6383 pXState->x87.Rsrvd1= 0;
6384 pXState->x87.FOP = 0;
6385
6386 iemHlpUsedFpu(pVCpu);
6387 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6388 return VINF_SUCCESS;
6389}
6390
6391
6392/**
6393 * Implements 'FXSAVE'.
6394 *
6395 * @param iEffSeg The effective segment.
6396 * @param GCPtrEff The address of the image.
6397 * @param enmEffOpSize The operand size (only REX.W really matters).
6398 */
6399IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6400{
6401 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6402
6403 /*
6404 * Raise exceptions.
6405 */
6406 if (pCtx->cr0 & X86_CR0_EM)
6407 return iemRaiseUndefinedOpcode(pVCpu);
6408 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6409 return iemRaiseDeviceNotAvailable(pVCpu);
6410 if (GCPtrEff & 15)
6411 {
6412 /** @todo CPU/VM detection possible! \#AC might not be signal for
6413 * all/any misalignment sizes, intel says its an implementation detail. */
6414 if ( (pCtx->cr0 & X86_CR0_AM)
6415 && pCtx->eflags.Bits.u1AC
6416 && pVCpu->iem.s.uCpl == 3)
6417 return iemRaiseAlignmentCheckException(pVCpu);
6418 return iemRaiseGeneralProtectionFault0(pVCpu);
6419 }
6420
6421 /*
6422 * Access the memory.
6423 */
6424 void *pvMem512;
6425 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6426 if (rcStrict != VINF_SUCCESS)
6427 return rcStrict;
6428 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6429 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6430
6431 /*
6432 * Store the registers.
6433 */
6434 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6435 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6436
6437 /* common for all formats */
6438 pDst->FCW = pSrc->FCW;
6439 pDst->FSW = pSrc->FSW;
6440 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6441 pDst->FOP = pSrc->FOP;
6442 pDst->MXCSR = pSrc->MXCSR;
6443 pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6444 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6445 {
6446 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6447 * them for now... */
6448 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6449 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6450 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6451 pDst->aRegs[i].au32[3] = 0;
6452 }
6453
6454 /* FPU IP, CS, DP and DS. */
6455 pDst->FPUIP = pSrc->FPUIP;
6456 pDst->CS = pSrc->CS;
6457 pDst->FPUDP = pSrc->FPUDP;
6458 pDst->DS = pSrc->DS;
6459 if (enmEffOpSize == IEMMODE_64BIT)
6460 {
6461 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6462 pDst->Rsrvd1 = pSrc->Rsrvd1;
6463 pDst->Rsrvd2 = pSrc->Rsrvd2;
6464 pDst->au32RsrvdForSoftware[0] = 0;
6465 }
6466 else
6467 {
6468 pDst->Rsrvd1 = 0;
6469 pDst->Rsrvd2 = 0;
6470 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6471 }
6472
6473 /* XMM registers. */
6474 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6475 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6476 || pVCpu->iem.s.uCpl != 0)
6477 {
6478 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6479 for (uint32_t i = 0; i < cXmmRegs; i++)
6480 pDst->aXMM[i] = pSrc->aXMM[i];
6481 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6482 * right? */
6483 }
6484
6485 /*
6486 * Commit the memory.
6487 */
6488 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6489 if (rcStrict != VINF_SUCCESS)
6490 return rcStrict;
6491
6492 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6493 return VINF_SUCCESS;
6494}
6495
6496
6497/**
6498 * Implements 'FXRSTOR'.
6499 *
6500 * @param GCPtrEff The address of the image.
6501 * @param enmEffOpSize The operand size (only REX.W really matters).
6502 */
6503IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6504{
6505 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6506
6507 /*
6508 * Raise exceptions.
6509 */
6510 if (pCtx->cr0 & X86_CR0_EM)
6511 return iemRaiseUndefinedOpcode(pVCpu);
6512 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6513 return iemRaiseDeviceNotAvailable(pVCpu);
6514 if (GCPtrEff & 15)
6515 {
6516 /** @todo CPU/VM detection possible! \#AC might not be signal for
6517 * all/any misalignment sizes, intel says its an implementation detail. */
6518 if ( (pCtx->cr0 & X86_CR0_AM)
6519 && pCtx->eflags.Bits.u1AC
6520 && pVCpu->iem.s.uCpl == 3)
6521 return iemRaiseAlignmentCheckException(pVCpu);
6522 return iemRaiseGeneralProtectionFault0(pVCpu);
6523 }
6524
6525 /*
6526 * Access the memory.
6527 */
6528 void *pvMem512;
6529 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6530 if (rcStrict != VINF_SUCCESS)
6531 return rcStrict;
6532 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6533 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6534
6535 /*
6536 * Check the state for stuff which will #GP(0).
6537 */
6538 uint32_t const fMXCSR = pSrc->MXCSR;
6539 uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6540 if (fMXCSR & ~fMXCSR_MASK)
6541 {
6542 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6543 return iemRaiseGeneralProtectionFault0(pVCpu);
6544 }
6545
6546 /*
6547 * Load the registers.
6548 */
6549 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6550 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6551
6552 /* common for all formats */
6553 pDst->FCW = pSrc->FCW;
6554 pDst->FSW = pSrc->FSW;
6555 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6556 pDst->FOP = pSrc->FOP;
6557 pDst->MXCSR = fMXCSR;
6558 /* (MXCSR_MASK is read-only) */
6559 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6560 {
6561 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6562 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6563 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6564 pDst->aRegs[i].au32[3] = 0;
6565 }
6566
6567 /* FPU IP, CS, DP and DS. */
6568 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6569 {
6570 pDst->FPUIP = pSrc->FPUIP;
6571 pDst->CS = pSrc->CS;
6572 pDst->Rsrvd1 = pSrc->Rsrvd1;
6573 pDst->FPUDP = pSrc->FPUDP;
6574 pDst->DS = pSrc->DS;
6575 pDst->Rsrvd2 = pSrc->Rsrvd2;
6576 }
6577 else
6578 {
6579 pDst->FPUIP = pSrc->FPUIP;
6580 pDst->CS = pSrc->CS;
6581 pDst->Rsrvd1 = 0;
6582 pDst->FPUDP = pSrc->FPUDP;
6583 pDst->DS = pSrc->DS;
6584 pDst->Rsrvd2 = 0;
6585 }
6586
6587 /* XMM registers. */
6588 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6589 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6590 || pVCpu->iem.s.uCpl != 0)
6591 {
6592 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6593 for (uint32_t i = 0; i < cXmmRegs; i++)
6594 pDst->aXMM[i] = pSrc->aXMM[i];
6595 }
6596
6597 /*
6598 * Commit the memory.
6599 */
6600 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
6601 if (rcStrict != VINF_SUCCESS)
6602 return rcStrict;
6603
6604 iemHlpUsedFpu(pVCpu);
6605 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6606 return VINF_SUCCESS;
6607}
6608
6609
6610/**
6611 * Commmon routine for fnstenv and fnsave.
6612 *
6613 * @param uPtr Where to store the state.
6614 * @param pCtx The CPU context.
6615 */
6616static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6617{
6618 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6619 if (enmEffOpSize == IEMMODE_16BIT)
6620 {
6621 uPtr.pu16[0] = pSrcX87->FCW;
6622 uPtr.pu16[1] = pSrcX87->FSW;
6623 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6624 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6625 {
6626 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
6627 * protected mode or long mode and we save it in real mode? And vice
6628 * versa? And with 32-bit operand size? I think CPU is storing the
6629 * effective address ((CS << 4) + IP) in the offset register and not
6630 * doing any address calculations here. */
6631 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6632 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
6633 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6634 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6635 }
6636 else
6637 {
6638 uPtr.pu16[3] = pSrcX87->FPUIP;
6639 uPtr.pu16[4] = pSrcX87->CS;
6640 uPtr.pu16[5] = pSrcX87->FPUDP;
6641 uPtr.pu16[6] = pSrcX87->DS;
6642 }
6643 }
6644 else
6645 {
6646 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6647 uPtr.pu16[0*2] = pSrcX87->FCW;
6648 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
6649 uPtr.pu16[1*2] = pSrcX87->FSW;
6650 uPtr.pu16[1*2+1] = 0xffff;
6651 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6652 uPtr.pu16[2*2+1] = 0xffff;
6653 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6654 {
6655 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6656 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
6657 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6658 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6659 }
6660 else
6661 {
6662 uPtr.pu32[3] = pSrcX87->FPUIP;
6663 uPtr.pu16[4*2] = pSrcX87->CS;
6664 uPtr.pu16[4*2+1] = pSrcX87->FOP;
6665 uPtr.pu32[5] = pSrcX87->FPUDP;
6666 uPtr.pu16[6*2] = pSrcX87->DS;
6667 uPtr.pu16[6*2+1] = 0xffff;
6668 }
6669 }
6670}
6671
6672
6673/**
6674 * Commmon routine for fldenv and frstor
6675 *
6676 * @param uPtr Where to store the state.
6677 * @param pCtx The CPU context.
6678 */
6679static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6680{
6681 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6682 if (enmEffOpSize == IEMMODE_16BIT)
6683 {
6684 pDstX87->FCW = uPtr.pu16[0];
6685 pDstX87->FSW = uPtr.pu16[1];
6686 pDstX87->FTW = uPtr.pu16[2];
6687 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6688 {
6689 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6690 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6691 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6692 pDstX87->CS = 0;
6693 pDstX87->Rsrvd1= 0;
6694 pDstX87->DS = 0;
6695 pDstX87->Rsrvd2= 0;
6696 }
6697 else
6698 {
6699 pDstX87->FPUIP = uPtr.pu16[3];
6700 pDstX87->CS = uPtr.pu16[4];
6701 pDstX87->Rsrvd1= 0;
6702 pDstX87->FPUDP = uPtr.pu16[5];
6703 pDstX87->DS = uPtr.pu16[6];
6704 pDstX87->Rsrvd2= 0;
6705 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6706 }
6707 }
6708 else
6709 {
6710 pDstX87->FCW = uPtr.pu16[0*2];
6711 pDstX87->FSW = uPtr.pu16[1*2];
6712 pDstX87->FTW = uPtr.pu16[2*2];
6713 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6714 {
6715 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6716 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6717 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6718 pDstX87->CS = 0;
6719 pDstX87->Rsrvd1= 0;
6720 pDstX87->DS = 0;
6721 pDstX87->Rsrvd2= 0;
6722 }
6723 else
6724 {
6725 pDstX87->FPUIP = uPtr.pu32[3];
6726 pDstX87->CS = uPtr.pu16[4*2];
6727 pDstX87->Rsrvd1= 0;
6728 pDstX87->FOP = uPtr.pu16[4*2+1];
6729 pDstX87->FPUDP = uPtr.pu32[5];
6730 pDstX87->DS = uPtr.pu16[6*2];
6731 pDstX87->Rsrvd2= 0;
6732 }
6733 }
6734
6735 /* Make adjustments. */
6736 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6737 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6738 iemFpuRecalcExceptionStatus(pDstX87);
6739 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
6740 * exceptions are pending after loading the saved state? */
6741}
6742
6743
6744/**
6745 * Implements 'FNSTENV'.
6746 *
6747 * @param enmEffOpSize The operand size (only REX.W really matters).
6748 * @param iEffSeg The effective segment register for @a GCPtrEff.
6749 * @param GCPtrEffDst The address of the image.
6750 */
6751IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6752{
6753 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6754 RTPTRUNION uPtr;
6755 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6756 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6757 if (rcStrict != VINF_SUCCESS)
6758 return rcStrict;
6759
6760 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6761
6762 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6763 if (rcStrict != VINF_SUCCESS)
6764 return rcStrict;
6765
6766 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6767 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6768 return VINF_SUCCESS;
6769}
6770
6771
6772/**
6773 * Implements 'FNSAVE'.
6774 *
6775 * @param GCPtrEffDst The address of the image.
6776 * @param enmEffOpSize The operand size.
6777 */
6778IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6779{
6780 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6781 RTPTRUNION uPtr;
6782 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6783 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6784 if (rcStrict != VINF_SUCCESS)
6785 return rcStrict;
6786
6787 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6788 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6789 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6790 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6791 {
6792 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6793 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6794 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6795 }
6796
6797 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6798 if (rcStrict != VINF_SUCCESS)
6799 return rcStrict;
6800
6801 /*
6802 * Re-initialize the FPU context.
6803 */
6804 pFpuCtx->FCW = 0x37f;
6805 pFpuCtx->FSW = 0;
6806 pFpuCtx->FTW = 0x00; /* 0 - empty */
6807 pFpuCtx->FPUDP = 0;
6808 pFpuCtx->DS = 0;
6809 pFpuCtx->Rsrvd2= 0;
6810 pFpuCtx->FPUIP = 0;
6811 pFpuCtx->CS = 0;
6812 pFpuCtx->Rsrvd1= 0;
6813 pFpuCtx->FOP = 0;
6814
6815 iemHlpUsedFpu(pVCpu);
6816 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6817 return VINF_SUCCESS;
6818}
6819
6820
6821
6822/**
6823 * Implements 'FLDENV'.
6824 *
6825 * @param enmEffOpSize The operand size (only REX.W really matters).
6826 * @param iEffSeg The effective segment register for @a GCPtrEff.
6827 * @param GCPtrEffSrc The address of the image.
6828 */
6829IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6830{
6831 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6832 RTCPTRUNION uPtr;
6833 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6834 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6835 if (rcStrict != VINF_SUCCESS)
6836 return rcStrict;
6837
6838 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6839
6840 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6841 if (rcStrict != VINF_SUCCESS)
6842 return rcStrict;
6843
6844 iemHlpUsedFpu(pVCpu);
6845 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6846 return VINF_SUCCESS;
6847}
6848
6849
6850/**
6851 * Implements 'FRSTOR'.
6852 *
6853 * @param GCPtrEffSrc The address of the image.
6854 * @param enmEffOpSize The operand size.
6855 */
6856IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6857{
6858 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6859 RTCPTRUNION uPtr;
6860 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6861 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6862 if (rcStrict != VINF_SUCCESS)
6863 return rcStrict;
6864
6865 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6866 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6867 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6868 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6869 {
6870 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6871 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6872 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6873 pFpuCtx->aRegs[i].au32[3] = 0;
6874 }
6875
6876 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6877 if (rcStrict != VINF_SUCCESS)
6878 return rcStrict;
6879
6880 iemHlpUsedFpu(pVCpu);
6881 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6882 return VINF_SUCCESS;
6883}
6884
6885
6886/**
6887 * Implements 'FLDCW'.
6888 *
6889 * @param u16Fcw The new FCW.
6890 */
6891IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6892{
6893 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6894
6895 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6896 /** @todo Testcase: Try see what happens when trying to set undefined bits
6897 * (other than 6 and 7). Currently ignoring them. */
6898 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
6899 * according to FSW. (This is was is currently implemented.) */
6900 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6901 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6902 iemFpuRecalcExceptionStatus(pFpuCtx);
6903
6904 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6905 iemHlpUsedFpu(pVCpu);
6906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6907 return VINF_SUCCESS;
6908}
6909
6910
6911
6912/**
6913 * Implements the underflow case of fxch.
6914 *
6915 * @param iStReg The other stack register.
6916 */
6917IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6918{
6919 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6920
6921 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6922 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6923 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6924 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
6925
6926 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
6927 * registers are read as QNaN and then exchanged. This could be
6928 * wrong... */
6929 if (pFpuCtx->FCW & X86_FCW_IM)
6930 {
6931 if (RT_BIT(iReg1) & pFpuCtx->FTW)
6932 {
6933 if (RT_BIT(iReg2) & pFpuCtx->FTW)
6934 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6935 else
6936 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6937 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6938 }
6939 else
6940 {
6941 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6942 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6943 }
6944 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6945 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
6946 }
6947 else
6948 {
6949 /* raise underflow exception, don't change anything. */
6950 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
6951 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6952 }
6953
6954 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6955 iemHlpUsedFpu(pVCpu);
6956 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6957 return VINF_SUCCESS;
6958}
6959
6960
6961/**
6962 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6963 *
6964 * @param cToAdd 1 or 7.
6965 */
6966IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6967{
6968 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6969 Assert(iStReg < 8);
6970
6971 /*
6972 * Raise exceptions.
6973 */
6974 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6975 return iemRaiseDeviceNotAvailable(pVCpu);
6976
6977 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6978 uint16_t u16Fsw = pFpuCtx->FSW;
6979 if (u16Fsw & X86_FSW_ES)
6980 return iemRaiseMathFault(pVCpu);
6981
6982 /*
6983 * Check if any of the register accesses causes #SF + #IA.
6984 */
6985 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
6986 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6987 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
6988 {
6989 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
6990 NOREF(u32Eflags);
6991
6992 pFpuCtx->FSW &= ~X86_FSW_C1;
6993 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
6994 if ( !(u16Fsw & X86_FSW_IE)
6995 || (pFpuCtx->FCW & X86_FCW_IM) )
6996 {
6997 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6998 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
6999 }
7000 }
7001 else if (pFpuCtx->FCW & X86_FCW_IM)
7002 {
7003 /* Masked underflow. */
7004 pFpuCtx->FSW &= ~X86_FSW_C1;
7005 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
7006 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7007 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
7008 }
7009 else
7010 {
7011 /* Raise underflow - don't touch EFLAGS or TOP. */
7012 pFpuCtx->FSW &= ~X86_FSW_C1;
7013 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
7014 fPop = false;
7015 }
7016
7017 /*
7018 * Pop if necessary.
7019 */
7020 if (fPop)
7021 {
7022 pFpuCtx->FTW &= ~RT_BIT(iReg1);
7023 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
7024 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
7025 }
7026
7027 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
7028 iemHlpUsedFpu(pVCpu);
7029 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7030 return VINF_SUCCESS;
7031}
7032
7033/** @} */
7034
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette