VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 65504

Last change on this file since 65504 was 65501, checked in by vboxsync, 8 years ago

IEM: some cmpxchg16b notes.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 240.8 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 65501 2017-01-28 22:36:58Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/** @name Misc Helpers
19 * @{
20 */
21
22
23/**
24 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
25 *
26 * @returns Strict VBox status code.
27 *
28 * @param pVCpu The cross context virtual CPU structure of the calling thread.
29 * @param pCtx The register context.
30 * @param u16Port The port number.
31 * @param cbOperand The operand size.
32 */
33static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34{
35 /* The TSS bits we're interested in are the same on 386 and AMD64. */
36 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41 /*
42 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43 */
44 Assert(!pCtx->tr.Attr.n.u1DescType);
45 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47 {
48 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50 return iemRaiseGeneralProtectionFault0(pVCpu);
51 }
52
53 /*
54 * Read the bitmap offset (may #PF).
55 */
56 uint16_t offBitmap;
57 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
58 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59 if (rcStrict != VINF_SUCCESS)
60 {
61 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62 return rcStrict;
63 }
64
65 /*
66 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67 * describes the CPU actually reading two bytes regardless of whether the
68 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
69 */
70 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
72 * for instance sizeof(X86TSS32). */
73 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74 {
75 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76 offFirstBit, pCtx->tr.u32Limit));
77 return iemRaiseGeneralProtectionFault0(pVCpu);
78 }
79
80 /*
81 * Read the necessary bits.
82 */
83 /** @todo Test the assertion in the intel manual that the CPU reads two
84 * bytes. The question is how this works wrt to #PF and #GP on the
85 * 2nd byte when it's not required. */
86 uint16_t bmBytes = UINT16_MAX;
87 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88 if (rcStrict != VINF_SUCCESS)
89 {
90 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91 return rcStrict;
92 }
93
94 /*
95 * Perform the check.
96 */
97 uint16_t fPortMask = (1 << cbOperand) - 1;
98 bmBytes >>= (u16Port & 7);
99 if (bmBytes & fPortMask)
100 {
101 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102 u16Port, cbOperand, bmBytes, fPortMask));
103 return iemRaiseGeneralProtectionFault0(pVCpu);
104 }
105
106 return VINF_SUCCESS;
107}
108
109
110/**
111 * Checks if we are allowed to access the given I/O port, raising the
112 * appropriate exceptions if we aren't (or if the I/O bitmap is not
113 * accessible).
114 *
115 * @returns Strict VBox status code.
116 *
117 * @param pVCpu The cross context virtual CPU structure of the calling thread.
118 * @param pCtx The register context.
119 * @param u16Port The port number.
120 * @param cbOperand The operand size.
121 */
122DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123{
124 X86EFLAGS Efl;
125 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
126 if ( (pCtx->cr0 & X86_CR0_PE)
127 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
128 || Efl.Bits.u1VM) )
129 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
130 return VINF_SUCCESS;
131}
132
133
134#if 0
135/**
136 * Calculates the parity bit.
137 *
138 * @returns true if the bit is set, false if not.
139 * @param u8Result The least significant byte of the result.
140 */
141static bool iemHlpCalcParityFlag(uint8_t u8Result)
142{
143 /*
144 * Parity is set if the number of bits in the least significant byte of
145 * the result is even.
146 */
147 uint8_t cBits;
148 cBits = u8Result & 1; /* 0 */
149 u8Result >>= 1;
150 cBits += u8Result & 1;
151 u8Result >>= 1;
152 cBits += u8Result & 1;
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1; /* 4 */
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1;
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 return !(cBits & 1);
164}
165#endif /* not used */
166
167
168/**
169 * Updates the specified flags according to a 8-bit result.
170 *
171 * @param pVCpu The cross context virtual CPU structure of the calling thread.
172 * @param u8Result The result to set the flags according to.
173 * @param fToUpdate The flags to update.
174 * @param fUndefined The flags that are specified as undefined.
175 */
176static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177{
178 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
179
180 uint32_t fEFlags = pCtx->eflags.u;
181 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
183 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
184#ifdef IEM_VERIFICATION_MODE_FULL
185 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
186#endif
187}
188
189
190/**
191 * Helper used by iret.
192 *
193 * @param pVCpu The cross context virtual CPU structure of the calling thread.
194 * @param uCpl The new CPL.
195 * @param pSReg Pointer to the segment register.
196 */
197static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
198{
199#ifdef VBOX_WITH_RAW_MODE_NOT_R0
200 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
201 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
202#else
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
204#endif
205
206 if ( uCpl > pSReg->Attr.n.u2Dpl
207 && pSReg->Attr.n.u1DescType /* code or data, not system */
208 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
209 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
210 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
211}
212
213
214/**
215 * Indicates that we have modified the FPU state.
216 *
217 * @param pVCpu The cross context virtual CPU structure of the calling thread.
218 */
219DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
220{
221 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
222}
223
224/** @} */
225
226/** @name C Implementations
227 * @{
228 */
229
230/**
231 * Implements a 16-bit popa.
232 */
233IEM_CIMPL_DEF_0(iemCImpl_popa_16)
234{
235 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
236 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
237 RTGCPTR GCPtrLast = GCPtrStart + 15;
238 VBOXSTRICTRC rcStrict;
239
240 /*
241 * The docs are a bit hard to comprehend here, but it looks like we wrap
242 * around in real mode as long as none of the individual "popa" crosses the
243 * end of the stack segment. In protected mode we check the whole access
244 * in one go. For efficiency, only do the word-by-word thing if we're in
245 * danger of wrapping around.
246 */
247 /** @todo do popa boundary / wrap-around checks. */
248 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
249 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
250 {
251 /* word-by-word */
252 RTUINT64U TmpRsp;
253 TmpRsp.u = pCtx->rsp;
254 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
255 if (rcStrict == VINF_SUCCESS)
256 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
257 if (rcStrict == VINF_SUCCESS)
258 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
259 if (rcStrict == VINF_SUCCESS)
260 {
261 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
262 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
263 }
264 if (rcStrict == VINF_SUCCESS)
265 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
266 if (rcStrict == VINF_SUCCESS)
267 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 {
272 pCtx->rsp = TmpRsp.u;
273 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
274 }
275 }
276 else
277 {
278 uint16_t const *pa16Mem = NULL;
279 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
280 if (rcStrict == VINF_SUCCESS)
281 {
282 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
283 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
284 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
285 /* skip sp */
286 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
287 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
288 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
289 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
290 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
291 if (rcStrict == VINF_SUCCESS)
292 {
293 iemRegAddToRsp(pVCpu, pCtx, 16);
294 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
295 }
296 }
297 }
298 return rcStrict;
299}
300
301
302/**
303 * Implements a 32-bit popa.
304 */
305IEM_CIMPL_DEF_0(iemCImpl_popa_32)
306{
307 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
308 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
309 RTGCPTR GCPtrLast = GCPtrStart + 31;
310 VBOXSTRICTRC rcStrict;
311
312 /*
313 * The docs are a bit hard to comprehend here, but it looks like we wrap
314 * around in real mode as long as none of the individual "popa" crosses the
315 * end of the stack segment. In protected mode we check the whole access
316 * in one go. For efficiency, only do the word-by-word thing if we're in
317 * danger of wrapping around.
318 */
319 /** @todo do popa boundary / wrap-around checks. */
320 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
321 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
322 {
323 /* word-by-word */
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pCtx->rsp;
326 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
334 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
335 }
336 if (rcStrict == VINF_SUCCESS)
337 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
338 if (rcStrict == VINF_SUCCESS)
339 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
340 if (rcStrict == VINF_SUCCESS)
341 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 {
344#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
345 pCtx->rdi &= UINT32_MAX;
346 pCtx->rsi &= UINT32_MAX;
347 pCtx->rbp &= UINT32_MAX;
348 pCtx->rbx &= UINT32_MAX;
349 pCtx->rdx &= UINT32_MAX;
350 pCtx->rcx &= UINT32_MAX;
351 pCtx->rax &= UINT32_MAX;
352#endif
353 pCtx->rsp = TmpRsp.u;
354 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
355 }
356 }
357 else
358 {
359 uint32_t const *pa32Mem;
360 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
361 if (rcStrict == VINF_SUCCESS)
362 {
363 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
364 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
365 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
366 /* skip esp */
367 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
368 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
369 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
370 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
371 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
372 if (rcStrict == VINF_SUCCESS)
373 {
374 iemRegAddToRsp(pVCpu, pCtx, 32);
375 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
376 }
377 }
378 }
379 return rcStrict;
380}
381
382
383/**
384 * Implements a 16-bit pusha.
385 */
386IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
387{
388 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
389 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
390 RTGCPTR GCPtrBottom = GCPtrTop - 15;
391 VBOXSTRICTRC rcStrict;
392
393 /*
394 * The docs are a bit hard to comprehend here, but it looks like we wrap
395 * around in real mode as long as none of the individual "pushd" crosses the
396 * end of the stack segment. In protected mode we check the whole access
397 * in one go. For efficiency, only do the word-by-word thing if we're in
398 * danger of wrapping around.
399 */
400 /** @todo do pusha boundary / wrap-around checks. */
401 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
402 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
403 {
404 /* word-by-word */
405 RTUINT64U TmpRsp;
406 TmpRsp.u = pCtx->rsp;
407 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
408 if (rcStrict == VINF_SUCCESS)
409 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
410 if (rcStrict == VINF_SUCCESS)
411 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
416 if (rcStrict == VINF_SUCCESS)
417 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 {
424 pCtx->rsp = TmpRsp.u;
425 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
426 }
427 }
428 else
429 {
430 GCPtrBottom--;
431 uint16_t *pa16Mem = NULL;
432 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
433 if (rcStrict == VINF_SUCCESS)
434 {
435 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
436 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
437 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
438 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
439 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
440 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
441 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
442 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
443 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
444 if (rcStrict == VINF_SUCCESS)
445 {
446 iemRegSubFromRsp(pVCpu, pCtx, 16);
447 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
448 }
449 }
450 }
451 return rcStrict;
452}
453
454
455/**
456 * Implements a 32-bit pusha.
457 */
458IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
459{
460 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
461 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
462 RTGCPTR GCPtrBottom = GCPtrTop - 31;
463 VBOXSTRICTRC rcStrict;
464
465 /*
466 * The docs are a bit hard to comprehend here, but it looks like we wrap
467 * around in real mode as long as none of the individual "pusha" crosses the
468 * end of the stack segment. In protected mode we check the whole access
469 * in one go. For efficiency, only do the word-by-word thing if we're in
470 * danger of wrapping around.
471 */
472 /** @todo do pusha boundary / wrap-around checks. */
473 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
474 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
475 {
476 /* word-by-word */
477 RTUINT64U TmpRsp;
478 TmpRsp.u = pCtx->rsp;
479 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
480 if (rcStrict == VINF_SUCCESS)
481 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
490 if (rcStrict == VINF_SUCCESS)
491 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 {
496 pCtx->rsp = TmpRsp.u;
497 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
498 }
499 }
500 else
501 {
502 GCPtrBottom--;
503 uint32_t *pa32Mem;
504 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
505 if (rcStrict == VINF_SUCCESS)
506 {
507 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
508 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
509 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
510 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
511 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
512 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
513 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
514 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
515 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
516 if (rcStrict == VINF_SUCCESS)
517 {
518 iemRegSubFromRsp(pVCpu, pCtx, 32);
519 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
520 }
521 }
522 }
523 return rcStrict;
524}
525
526
527/**
528 * Implements pushf.
529 *
530 *
531 * @param enmEffOpSize The effective operand size.
532 */
533IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
534{
535 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
536 VBOXSTRICTRC rcStrict;
537
538 /*
539 * If we're in V8086 mode some care is required (which is why we're in
540 * doing this in a C implementation).
541 */
542 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
543 if ( (fEfl & X86_EFL_VM)
544 && X86_EFL_GET_IOPL(fEfl) != 3 )
545 {
546 Assert(pCtx->cr0 & X86_CR0_PE);
547 if ( enmEffOpSize != IEMMODE_16BIT
548 || !(pCtx->cr4 & X86_CR4_VME))
549 return iemRaiseGeneralProtectionFault0(pVCpu);
550 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
551 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
552 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
553 }
554 else
555 {
556
557 /*
558 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
559 */
560 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
561
562 switch (enmEffOpSize)
563 {
564 case IEMMODE_16BIT:
565 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
566 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
567 fEfl |= UINT16_C(0xf000);
568 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
569 break;
570 case IEMMODE_32BIT:
571 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
572 break;
573 case IEMMODE_64BIT:
574 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
575 break;
576 IEM_NOT_REACHED_DEFAULT_CASE_RET();
577 }
578 }
579 if (rcStrict != VINF_SUCCESS)
580 return rcStrict;
581
582 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
583 return VINF_SUCCESS;
584}
585
586
587/**
588 * Implements popf.
589 *
590 * @param enmEffOpSize The effective operand size.
591 */
592IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
593{
594 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
595 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
596 VBOXSTRICTRC rcStrict;
597 uint32_t fEflNew;
598
599 /*
600 * V8086 is special as usual.
601 */
602 if (fEflOld & X86_EFL_VM)
603 {
604 /*
605 * Almost anything goes if IOPL is 3.
606 */
607 if (X86_EFL_GET_IOPL(fEflOld) == 3)
608 {
609 switch (enmEffOpSize)
610 {
611 case IEMMODE_16BIT:
612 {
613 uint16_t u16Value;
614 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
615 if (rcStrict != VINF_SUCCESS)
616 return rcStrict;
617 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
618 break;
619 }
620 case IEMMODE_32BIT:
621 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
622 if (rcStrict != VINF_SUCCESS)
623 return rcStrict;
624 break;
625 IEM_NOT_REACHED_DEFAULT_CASE_RET();
626 }
627
628 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
629 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
630 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
631 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
632 }
633 /*
634 * Interrupt flag virtualization with CR4.VME=1.
635 */
636 else if ( enmEffOpSize == IEMMODE_16BIT
637 && (pCtx->cr4 & X86_CR4_VME) )
638 {
639 uint16_t u16Value;
640 RTUINT64U TmpRsp;
641 TmpRsp.u = pCtx->rsp;
642 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
643 if (rcStrict != VINF_SUCCESS)
644 return rcStrict;
645
646 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
647 * or before? */
648 if ( ( (u16Value & X86_EFL_IF)
649 && (fEflOld & X86_EFL_VIP))
650 || (u16Value & X86_EFL_TF) )
651 return iemRaiseGeneralProtectionFault0(pVCpu);
652
653 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
654 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
655 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
656 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
657
658 pCtx->rsp = TmpRsp.u;
659 }
660 else
661 return iemRaiseGeneralProtectionFault0(pVCpu);
662
663 }
664 /*
665 * Not in V8086 mode.
666 */
667 else
668 {
669 /* Pop the flags. */
670 switch (enmEffOpSize)
671 {
672 case IEMMODE_16BIT:
673 {
674 uint16_t u16Value;
675 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
676 if (rcStrict != VINF_SUCCESS)
677 return rcStrict;
678 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
679
680 /*
681 * Ancient CPU adjustments:
682 * - 8086, 80186, V20/30:
683 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
684 * practical reasons (masking below). We add them when pushing flags.
685 * - 80286:
686 * The NT and IOPL flags cannot be popped from real mode and are
687 * therefore always zero (since a 286 can never exit from PM and
688 * their initial value is zero). This changed on a 386 and can
689 * therefore be used to detect 286 or 386 CPU in real mode.
690 */
691 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
692 && !(pCtx->cr0 & X86_CR0_PE) )
693 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
694 break;
695 }
696 case IEMMODE_32BIT:
697 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
698 if (rcStrict != VINF_SUCCESS)
699 return rcStrict;
700 break;
701 case IEMMODE_64BIT:
702 {
703 uint64_t u64Value;
704 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
705 if (rcStrict != VINF_SUCCESS)
706 return rcStrict;
707 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
708 break;
709 }
710 IEM_NOT_REACHED_DEFAULT_CASE_RET();
711 }
712
713 /* Merge them with the current flags. */
714 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
715 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
716 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
717 || pVCpu->iem.s.uCpl == 0)
718 {
719 fEflNew &= fPopfBits;
720 fEflNew |= ~fPopfBits & fEflOld;
721 }
722 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
723 {
724 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
725 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
726 }
727 else
728 {
729 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
730 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
731 }
732 }
733
734 /*
735 * Commit the flags.
736 */
737 Assert(fEflNew & RT_BIT_32(1));
738 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
739 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
740
741 return VINF_SUCCESS;
742}
743
744
745/**
746 * Implements an indirect call.
747 *
748 * @param uNewPC The new program counter (RIP) value (loaded from the
749 * operand).
750 * @param enmEffOpSize The effective operand size.
751 */
752IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
753{
754 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
755 uint16_t uOldPC = pCtx->ip + cbInstr;
756 if (uNewPC > pCtx->cs.u32Limit)
757 return iemRaiseGeneralProtectionFault0(pVCpu);
758
759 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
760 if (rcStrict != VINF_SUCCESS)
761 return rcStrict;
762
763 pCtx->rip = uNewPC;
764 pCtx->eflags.Bits.u1RF = 0;
765
766#ifndef IEM_WITH_CODE_TLB
767 /* Flush the prefetch buffer. */
768 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
769#endif
770 return VINF_SUCCESS;
771}
772
773
774/**
775 * Implements a 16-bit relative call.
776 *
777 * @param offDisp The displacment offset.
778 */
779IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
780{
781 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
782 uint16_t uOldPC = pCtx->ip + cbInstr;
783 uint16_t uNewPC = uOldPC + offDisp;
784 if (uNewPC > pCtx->cs.u32Limit)
785 return iemRaiseGeneralProtectionFault0(pVCpu);
786
787 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
788 if (rcStrict != VINF_SUCCESS)
789 return rcStrict;
790
791 pCtx->rip = uNewPC;
792 pCtx->eflags.Bits.u1RF = 0;
793
794#ifndef IEM_WITH_CODE_TLB
795 /* Flush the prefetch buffer. */
796 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
797#endif
798 return VINF_SUCCESS;
799}
800
801
802/**
803 * Implements a 32-bit indirect call.
804 *
805 * @param uNewPC The new program counter (RIP) value (loaded from the
806 * operand).
807 * @param enmEffOpSize The effective operand size.
808 */
809IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
810{
811 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
812 uint32_t uOldPC = pCtx->eip + cbInstr;
813 if (uNewPC > pCtx->cs.u32Limit)
814 return iemRaiseGeneralProtectionFault0(pVCpu);
815
816 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
817 if (rcStrict != VINF_SUCCESS)
818 return rcStrict;
819
820#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
821 /*
822 * CASM hook for recording interesting indirect calls.
823 */
824 if ( !pCtx->eflags.Bits.u1IF
825 && (pCtx->cr0 & X86_CR0_PG)
826 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
827 && pVCpu->iem.s.uCpl == 0)
828 {
829 EMSTATE enmState = EMGetState(pVCpu);
830 if ( enmState == EMSTATE_IEM_THEN_REM
831 || enmState == EMSTATE_IEM
832 || enmState == EMSTATE_REM)
833 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
834 }
835#endif
836
837 pCtx->rip = uNewPC;
838 pCtx->eflags.Bits.u1RF = 0;
839
840#ifndef IEM_WITH_CODE_TLB
841 /* Flush the prefetch buffer. */
842 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
843#endif
844 return VINF_SUCCESS;
845}
846
847
848/**
849 * Implements a 32-bit relative call.
850 *
851 * @param offDisp The displacment offset.
852 */
853IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
854{
855 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
856 uint32_t uOldPC = pCtx->eip + cbInstr;
857 uint32_t uNewPC = uOldPC + offDisp;
858 if (uNewPC > pCtx->cs.u32Limit)
859 return iemRaiseGeneralProtectionFault0(pVCpu);
860
861 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
862 if (rcStrict != VINF_SUCCESS)
863 return rcStrict;
864
865 pCtx->rip = uNewPC;
866 pCtx->eflags.Bits.u1RF = 0;
867
868#ifndef IEM_WITH_CODE_TLB
869 /* Flush the prefetch buffer. */
870 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
871#endif
872 return VINF_SUCCESS;
873}
874
875
876/**
877 * Implements a 64-bit indirect call.
878 *
879 * @param uNewPC The new program counter (RIP) value (loaded from the
880 * operand).
881 * @param enmEffOpSize The effective operand size.
882 */
883IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
884{
885 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
886 uint64_t uOldPC = pCtx->rip + cbInstr;
887 if (!IEM_IS_CANONICAL(uNewPC))
888 return iemRaiseGeneralProtectionFault0(pVCpu);
889
890 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
891 if (rcStrict != VINF_SUCCESS)
892 return rcStrict;
893
894 pCtx->rip = uNewPC;
895 pCtx->eflags.Bits.u1RF = 0;
896
897#ifndef IEM_WITH_CODE_TLB
898 /* Flush the prefetch buffer. */
899 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
900#endif
901 return VINF_SUCCESS;
902}
903
904
905/**
906 * Implements a 64-bit relative call.
907 *
908 * @param offDisp The displacment offset.
909 */
910IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
911{
912 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
913 uint64_t uOldPC = pCtx->rip + cbInstr;
914 uint64_t uNewPC = uOldPC + offDisp;
915 if (!IEM_IS_CANONICAL(uNewPC))
916 return iemRaiseNotCanonical(pVCpu);
917
918 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
919 if (rcStrict != VINF_SUCCESS)
920 return rcStrict;
921
922 pCtx->rip = uNewPC;
923 pCtx->eflags.Bits.u1RF = 0;
924
925#ifndef IEM_WITH_CODE_TLB
926 /* Flush the prefetch buffer. */
927 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
928#endif
929
930 return VINF_SUCCESS;
931}
932
933
934/**
935 * Implements far jumps and calls thru task segments (TSS).
936 *
937 * @param uSel The selector.
938 * @param enmBranch The kind of branching we're performing.
939 * @param enmEffOpSize The effective operand size.
940 * @param pDesc The descriptor corresponding to @a uSel. The type is
941 * task gate.
942 */
943IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
944{
945#ifndef IEM_IMPLEMENTS_TASKSWITCH
946 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
947#else
948 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
949 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
950 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
951 RT_NOREF_PV(enmEffOpSize);
952
953 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
954 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
955 {
956 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
957 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
958 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
959 }
960
961 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
962 * far calls (see iemCImpl_callf). Most likely in both cases it should be
963 * checked here, need testcases. */
964 if (!pDesc->Legacy.Gen.u1Present)
965 {
966 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
967 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
968 }
969
970 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
971 uint32_t uNextEip = pCtx->eip + cbInstr;
972 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
973 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
974#endif
975}
976
977
978/**
979 * Implements far jumps and calls thru task gates.
980 *
981 * @param uSel The selector.
982 * @param enmBranch The kind of branching we're performing.
983 * @param enmEffOpSize The effective operand size.
984 * @param pDesc The descriptor corresponding to @a uSel. The type is
985 * task gate.
986 */
987IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
988{
989#ifndef IEM_IMPLEMENTS_TASKSWITCH
990 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
991#else
992 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
993 RT_NOREF_PV(enmEffOpSize);
994
995 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
996 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
997 {
998 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
999 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1000 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1001 }
1002
1003 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1004 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1005 * checked here, need testcases. */
1006 if (!pDesc->Legacy.Gen.u1Present)
1007 {
1008 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1009 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1010 }
1011
1012 /*
1013 * Fetch the new TSS descriptor from the GDT.
1014 */
1015 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1016 if (uSelTss & X86_SEL_LDT)
1017 {
1018 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1019 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1020 }
1021
1022 IEMSELDESC TssDesc;
1023 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1024 if (rcStrict != VINF_SUCCESS)
1025 return rcStrict;
1026
1027 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1028 {
1029 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1030 TssDesc.Legacy.Gate.u4Type));
1031 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1032 }
1033
1034 if (!TssDesc.Legacy.Gate.u1Present)
1035 {
1036 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1037 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1038 }
1039
1040 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1041 uint32_t uNextEip = pCtx->eip + cbInstr;
1042 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1043 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1044#endif
1045}
1046
1047
1048/**
1049 * Implements far jumps and calls thru call gates.
1050 *
1051 * @param uSel The selector.
1052 * @param enmBranch The kind of branching we're performing.
1053 * @param enmEffOpSize The effective operand size.
1054 * @param pDesc The descriptor corresponding to @a uSel. The type is
1055 * call gate.
1056 */
1057IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1058{
1059#define IEM_IMPLEMENTS_CALLGATE
1060#ifndef IEM_IMPLEMENTS_CALLGATE
1061 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1062#else
1063 RT_NOREF_PV(enmEffOpSize);
1064
1065 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1066 * inter-privilege calls and are much more complex.
1067 *
1068 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1069 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1070 * must be 16-bit or 32-bit.
1071 */
1072 /** @todo: effective operand size is probably irrelevant here, only the
1073 * call gate bitness matters??
1074 */
1075 VBOXSTRICTRC rcStrict;
1076 RTPTRUNION uPtrRet;
1077 uint64_t uNewRsp;
1078 uint64_t uNewRip;
1079 uint64_t u64Base;
1080 uint32_t cbLimit;
1081 RTSEL uNewCS;
1082 IEMSELDESC DescCS;
1083
1084 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1085 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1086 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1087 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1088
1089 /* Determine the new instruction pointer from the gate descriptor. */
1090 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1091 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1092 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1093
1094 /* Perform DPL checks on the gate descriptor. */
1095 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1096 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1097 {
1098 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1099 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1100 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1101 }
1102
1103 /** @todo does this catch NULL selectors, too? */
1104 if (!pDesc->Legacy.Gen.u1Present)
1105 {
1106 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1107 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1108 }
1109
1110 /*
1111 * Fetch the target CS descriptor from the GDT or LDT.
1112 */
1113 uNewCS = pDesc->Legacy.Gate.u16Sel;
1114 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1115 if (rcStrict != VINF_SUCCESS)
1116 return rcStrict;
1117
1118 /* Target CS must be a code selector. */
1119 if ( !DescCS.Legacy.Gen.u1DescType
1120 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1121 {
1122 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1123 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1124 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1125 }
1126
1127 /* Privilege checks on target CS. */
1128 if (enmBranch == IEMBRANCH_JUMP)
1129 {
1130 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1131 {
1132 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1133 {
1134 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1135 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1137 }
1138 }
1139 else
1140 {
1141 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1142 {
1143 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1144 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1145 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1146 }
1147 }
1148 }
1149 else
1150 {
1151 Assert(enmBranch == IEMBRANCH_CALL);
1152 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1153 {
1154 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1155 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1156 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1157 }
1158 }
1159
1160 /* Additional long mode checks. */
1161 if (IEM_IS_LONG_MODE(pVCpu))
1162 {
1163 if (!DescCS.Legacy.Gen.u1Long)
1164 {
1165 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1167 }
1168
1169 /* L vs D. */
1170 if ( DescCS.Legacy.Gen.u1Long
1171 && DescCS.Legacy.Gen.u1DefBig)
1172 {
1173 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1174 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1175 }
1176 }
1177
1178 if (!DescCS.Legacy.Gate.u1Present)
1179 {
1180 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1181 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1182 }
1183
1184 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1185
1186 if (enmBranch == IEMBRANCH_JUMP)
1187 {
1188 /** @todo: This is very similar to regular far jumps; merge! */
1189 /* Jumps are fairly simple... */
1190
1191 /* Chop the high bits off if 16-bit gate (Intel says so). */
1192 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1193 uNewRip = (uint16_t)uNewRip;
1194
1195 /* Limit check for non-long segments. */
1196 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1197 if (DescCS.Legacy.Gen.u1Long)
1198 u64Base = 0;
1199 else
1200 {
1201 if (uNewRip > cbLimit)
1202 {
1203 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1204 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1205 }
1206 u64Base = X86DESC_BASE(&DescCS.Legacy);
1207 }
1208
1209 /* Canonical address check. */
1210 if (!IEM_IS_CANONICAL(uNewRip))
1211 {
1212 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1213 return iemRaiseNotCanonical(pVCpu);
1214 }
1215
1216 /*
1217 * Ok, everything checked out fine. Now set the accessed bit before
1218 * committing the result into CS, CSHID and RIP.
1219 */
1220 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1221 {
1222 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1223 if (rcStrict != VINF_SUCCESS)
1224 return rcStrict;
1225 /** @todo check what VT-x and AMD-V does. */
1226 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1227 }
1228
1229 /* commit */
1230 pCtx->rip = uNewRip;
1231 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1232 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1233 pCtx->cs.ValidSel = pCtx->cs.Sel;
1234 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1235 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1236 pCtx->cs.u32Limit = cbLimit;
1237 pCtx->cs.u64Base = u64Base;
1238 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1239 }
1240 else
1241 {
1242 Assert(enmBranch == IEMBRANCH_CALL);
1243 /* Calls are much more complicated. */
1244
1245 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1246 {
1247 uint16_t offNewStack; /* Offset of new stack in TSS. */
1248 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1249 uint8_t uNewCSDpl;
1250 uint8_t cbWords;
1251 RTSEL uNewSS;
1252 RTSEL uOldSS;
1253 uint64_t uOldRsp;
1254 IEMSELDESC DescSS;
1255 RTPTRUNION uPtrTSS;
1256 RTGCPTR GCPtrTSS;
1257 RTPTRUNION uPtrParmWds;
1258 RTGCPTR GCPtrParmWds;
1259
1260 /* More privilege. This is the fun part. */
1261 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1262
1263 /*
1264 * Determine new SS:rSP from the TSS.
1265 */
1266 Assert(!pCtx->tr.Attr.n.u1DescType);
1267
1268 /* Figure out where the new stack pointer is stored in the TSS. */
1269 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1270 if (!IEM_IS_LONG_MODE(pVCpu))
1271 {
1272 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1273 {
1274 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1275 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1276 }
1277 else
1278 {
1279 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1280 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1281 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1282 }
1283 }
1284 else
1285 {
1286 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1287 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1288 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1289 }
1290
1291 /* Check against TSS limit. */
1292 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1293 {
1294 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1295 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1296 }
1297
1298 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1299 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1300 if (rcStrict != VINF_SUCCESS)
1301 {
1302 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1303 return rcStrict;
1304 }
1305
1306 if (!IEM_IS_LONG_MODE(pVCpu))
1307 {
1308 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1309 {
1310 uNewRsp = uPtrTSS.pu32[0];
1311 uNewSS = uPtrTSS.pu16[2];
1312 }
1313 else
1314 {
1315 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1316 uNewRsp = uPtrTSS.pu16[0];
1317 uNewSS = uPtrTSS.pu16[1];
1318 }
1319 }
1320 else
1321 {
1322 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1323 /* SS will be a NULL selector, but that's valid. */
1324 uNewRsp = uPtrTSS.pu64[0];
1325 uNewSS = uNewCSDpl;
1326 }
1327
1328 /* Done with the TSS now. */
1329 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1330 if (rcStrict != VINF_SUCCESS)
1331 {
1332 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1333 return rcStrict;
1334 }
1335
1336 /* Only used outside of long mode. */
1337 cbWords = pDesc->Legacy.Gate.u4ParmCount;
1338
1339 /* If EFER.LMA is 0, there's extra work to do. */
1340 if (!IEM_IS_LONG_MODE(pVCpu))
1341 {
1342 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1343 {
1344 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1345 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1346 }
1347
1348 /* Grab the new SS descriptor. */
1349 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1350 if (rcStrict != VINF_SUCCESS)
1351 return rcStrict;
1352
1353 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1354 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1355 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1356 {
1357 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1358 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1359 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1360 }
1361
1362 /* Ensure new SS is a writable data segment. */
1363 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1364 {
1365 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1366 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1367 }
1368
1369 if (!DescSS.Legacy.Gen.u1Present)
1370 {
1371 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1372 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1373 }
1374 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1375 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1376 else
1377 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1378 }
1379 else
1380 {
1381 /* Just grab the new (NULL) SS descriptor. */
1382 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1383 * like we do... */
1384 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1385 if (rcStrict != VINF_SUCCESS)
1386 return rcStrict;
1387
1388 cbNewStack = sizeof(uint64_t) * 4;
1389 }
1390
1391 /** @todo: According to Intel, new stack is checked for enough space first,
1392 * then switched. According to AMD, the stack is switched first and
1393 * then pushes might fault!
1394 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1395 * incoming stack #PF happens before actual stack switch. AMD is
1396 * either lying or implicitly assumes that new state is committed
1397 * only if and when an instruction doesn't fault.
1398 */
1399
1400 /** @todo: According to AMD, CS is loaded first, then SS.
1401 * According to Intel, it's the other way around!?
1402 */
1403
1404 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1405
1406 /* Set the accessed bit before committing new SS. */
1407 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1408 {
1409 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1410 if (rcStrict != VINF_SUCCESS)
1411 return rcStrict;
1412 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1413 }
1414
1415 /* Remember the old SS:rSP and their linear address. */
1416 uOldSS = pCtx->ss.Sel;
1417 uOldRsp = pCtx->ss.Attr.n.u1DefBig ? pCtx->rsp : pCtx->sp;
1418
1419 GCPtrParmWds = pCtx->ss.u64Base + uOldRsp;
1420
1421 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1422 or #PF, the former is not implemented in this workaround. */
1423 /** @todo Proper fix callgate target stack exceptions. */
1424 /** @todo testcase: Cover callgates with partially or fully inaccessible
1425 * target stacks. */
1426 void *pvNewFrame;
1427 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1428 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1429 if (rcStrict != VINF_SUCCESS)
1430 {
1431 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1432 return rcStrict;
1433 }
1434 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1435 if (rcStrict != VINF_SUCCESS)
1436 {
1437 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1438 return rcStrict;
1439 }
1440
1441 /* Commit new SS:rSP. */
1442 pCtx->ss.Sel = uNewSS;
1443 pCtx->ss.ValidSel = uNewSS;
1444 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1445 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1446 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1447 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1448 pCtx->rsp = uNewRsp;
1449 pVCpu->iem.s.uCpl = uNewCSDpl;
1450 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1451 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1452
1453 /* At this point the stack access must not fail because new state was already committed. */
1454 /** @todo this can still fail due to SS.LIMIT not check. */
1455 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1456 &uPtrRet.pv, &uNewRsp);
1457 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1458 VERR_INTERNAL_ERROR_5);
1459
1460 if (!IEM_IS_LONG_MODE(pVCpu))
1461 {
1462 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1463 {
1464 /* Push the old CS:rIP. */
1465 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1466 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1467
1468 if (cbWords)
1469 {
1470 /* Map the relevant chunk of the old stack. */
1471 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1472 if (rcStrict != VINF_SUCCESS)
1473 {
1474 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1475 return rcStrict;
1476 }
1477
1478 /* Copy the parameter (d)words. */
1479 for (int i = 0; i < cbWords; ++i)
1480 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1481
1482 /* Unmap the old stack. */
1483 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1484 if (rcStrict != VINF_SUCCESS)
1485 {
1486 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1487 return rcStrict;
1488 }
1489 }
1490
1491 /* Push the old SS:rSP. */
1492 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1493 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1494 }
1495 else
1496 {
1497 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1498
1499 /* Push the old CS:rIP. */
1500 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1501 uPtrRet.pu16[1] = pCtx->cs.Sel;
1502
1503 if (cbWords)
1504 {
1505 /* Map the relevant chunk of the old stack. */
1506 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1507 if (rcStrict != VINF_SUCCESS)
1508 {
1509 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1510 return rcStrict;
1511 }
1512
1513 /* Copy the parameter words. */
1514 for (int i = 0; i < cbWords; ++i)
1515 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1516
1517 /* Unmap the old stack. */
1518 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1519 if (rcStrict != VINF_SUCCESS)
1520 {
1521 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1522 return rcStrict;
1523 }
1524 }
1525
1526 /* Push the old SS:rSP. */
1527 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1528 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1529 }
1530 }
1531 else
1532 {
1533 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1534
1535 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1536 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1537 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1538 uPtrRet.pu64[2] = uOldRsp;
1539 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1540 }
1541
1542 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1543 if (rcStrict != VINF_SUCCESS)
1544 {
1545 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1546 return rcStrict;
1547 }
1548
1549 /* Chop the high bits off if 16-bit gate (Intel says so). */
1550 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1551 uNewRip = (uint16_t)uNewRip;
1552
1553 /* Limit / canonical check. */
1554 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1555 if (!IEM_IS_LONG_MODE(pVCpu))
1556 {
1557 if (uNewRip > cbLimit)
1558 {
1559 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1560 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1561 }
1562 u64Base = X86DESC_BASE(&DescCS.Legacy);
1563 }
1564 else
1565 {
1566 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1567 if (!IEM_IS_CANONICAL(uNewRip))
1568 {
1569 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1570 return iemRaiseNotCanonical(pVCpu);
1571 }
1572 u64Base = 0;
1573 }
1574
1575 /*
1576 * Now set the accessed bit before
1577 * writing the return address to the stack and committing the result into
1578 * CS, CSHID and RIP.
1579 */
1580 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1581 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1582 {
1583 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1584 if (rcStrict != VINF_SUCCESS)
1585 return rcStrict;
1586 /** @todo check what VT-x and AMD-V does. */
1587 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1588 }
1589
1590 /* Commit new CS:rIP. */
1591 pCtx->rip = uNewRip;
1592 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1593 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1594 pCtx->cs.ValidSel = pCtx->cs.Sel;
1595 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1596 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1597 pCtx->cs.u32Limit = cbLimit;
1598 pCtx->cs.u64Base = u64Base;
1599 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1600 }
1601 else
1602 {
1603 /* Same privilege. */
1604 /** @todo: This is very similar to regular far calls; merge! */
1605
1606 /* Check stack first - may #SS(0). */
1607 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1608 * 16-bit code cause a two or four byte CS to be pushed? */
1609 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1610 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1611 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1612 &uPtrRet.pv, &uNewRsp);
1613 if (rcStrict != VINF_SUCCESS)
1614 return rcStrict;
1615
1616 /* Chop the high bits off if 16-bit gate (Intel says so). */
1617 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1618 uNewRip = (uint16_t)uNewRip;
1619
1620 /* Limit / canonical check. */
1621 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1622 if (!IEM_IS_LONG_MODE(pVCpu))
1623 {
1624 if (uNewRip > cbLimit)
1625 {
1626 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1627 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1628 }
1629 u64Base = X86DESC_BASE(&DescCS.Legacy);
1630 }
1631 else
1632 {
1633 if (!IEM_IS_CANONICAL(uNewRip))
1634 {
1635 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1636 return iemRaiseNotCanonical(pVCpu);
1637 }
1638 u64Base = 0;
1639 }
1640
1641 /*
1642 * Now set the accessed bit before
1643 * writing the return address to the stack and committing the result into
1644 * CS, CSHID and RIP.
1645 */
1646 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1647 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1648 {
1649 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1650 if (rcStrict != VINF_SUCCESS)
1651 return rcStrict;
1652 /** @todo check what VT-x and AMD-V does. */
1653 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1654 }
1655
1656 /* stack */
1657 if (!IEM_IS_LONG_MODE(pVCpu))
1658 {
1659 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1660 {
1661 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1662 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1663 }
1664 else
1665 {
1666 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1667 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1668 uPtrRet.pu16[1] = pCtx->cs.Sel;
1669 }
1670 }
1671 else
1672 {
1673 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1674 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1675 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1676 }
1677
1678 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1679 if (rcStrict != VINF_SUCCESS)
1680 return rcStrict;
1681
1682 /* commit */
1683 pCtx->rip = uNewRip;
1684 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1685 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1686 pCtx->cs.ValidSel = pCtx->cs.Sel;
1687 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1688 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1689 pCtx->cs.u32Limit = cbLimit;
1690 pCtx->cs.u64Base = u64Base;
1691 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1692 }
1693 }
1694 pCtx->eflags.Bits.u1RF = 0;
1695
1696 /* Flush the prefetch buffer. */
1697# ifdef IEM_WITH_CODE_TLB
1698 pVCpu->iem.s.pbInstrBuf = NULL;
1699# else
1700 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1701# endif
1702 return VINF_SUCCESS;
1703#endif
1704}
1705
1706
1707/**
1708 * Implements far jumps and calls thru system selectors.
1709 *
1710 * @param uSel The selector.
1711 * @param enmBranch The kind of branching we're performing.
1712 * @param enmEffOpSize The effective operand size.
1713 * @param pDesc The descriptor corresponding to @a uSel.
1714 */
1715IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1716{
1717 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1718 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1719
1720 if (IEM_IS_LONG_MODE(pVCpu))
1721 switch (pDesc->Legacy.Gen.u4Type)
1722 {
1723 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1724 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1725
1726 default:
1727 case AMD64_SEL_TYPE_SYS_LDT:
1728 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1729 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1730 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1731 case AMD64_SEL_TYPE_SYS_INT_GATE:
1732 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1733 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1734 }
1735
1736 switch (pDesc->Legacy.Gen.u4Type)
1737 {
1738 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1739 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1740 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1741
1742 case X86_SEL_TYPE_SYS_TASK_GATE:
1743 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1744
1745 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1746 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1747 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1748
1749 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1750 Log(("branch %04x -> busy 286 TSS\n", uSel));
1751 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1752
1753 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1754 Log(("branch %04x -> busy 386 TSS\n", uSel));
1755 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1756
1757 default:
1758 case X86_SEL_TYPE_SYS_LDT:
1759 case X86_SEL_TYPE_SYS_286_INT_GATE:
1760 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1761 case X86_SEL_TYPE_SYS_386_INT_GATE:
1762 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1763 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1764 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1765 }
1766}
1767
1768
1769/**
1770 * Implements far jumps.
1771 *
1772 * @param uSel The selector.
1773 * @param offSeg The segment offset.
1774 * @param enmEffOpSize The effective operand size.
1775 */
1776IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1777{
1778 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1779 NOREF(cbInstr);
1780 Assert(offSeg <= UINT32_MAX);
1781
1782 /*
1783 * Real mode and V8086 mode are easy. The only snag seems to be that
1784 * CS.limit doesn't change and the limit check is done against the current
1785 * limit.
1786 */
1787 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1788 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1789 {
1790 if (offSeg > pCtx->cs.u32Limit)
1791 {
1792 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1793 return iemRaiseGeneralProtectionFault0(pVCpu);
1794 }
1795
1796 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1797 pCtx->rip = offSeg;
1798 else
1799 pCtx->rip = offSeg & UINT16_MAX;
1800 pCtx->cs.Sel = uSel;
1801 pCtx->cs.ValidSel = uSel;
1802 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1803 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1804 pCtx->eflags.Bits.u1RF = 0;
1805 return VINF_SUCCESS;
1806 }
1807
1808 /*
1809 * Protected mode. Need to parse the specified descriptor...
1810 */
1811 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1812 {
1813 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1814 return iemRaiseGeneralProtectionFault0(pVCpu);
1815 }
1816
1817 /* Fetch the descriptor. */
1818 IEMSELDESC Desc;
1819 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1820 if (rcStrict != VINF_SUCCESS)
1821 return rcStrict;
1822
1823 /* Is it there? */
1824 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1825 {
1826 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1827 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1828 }
1829
1830 /*
1831 * Deal with it according to its type. We do the standard code selectors
1832 * here and dispatch the system selectors to worker functions.
1833 */
1834 if (!Desc.Legacy.Gen.u1DescType)
1835 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1836
1837 /* Only code segments. */
1838 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1839 {
1840 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1842 }
1843
1844 /* L vs D. */
1845 if ( Desc.Legacy.Gen.u1Long
1846 && Desc.Legacy.Gen.u1DefBig
1847 && IEM_IS_LONG_MODE(pVCpu))
1848 {
1849 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1850 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1851 }
1852
1853 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1854 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1855 {
1856 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1857 {
1858 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1859 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1860 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1861 }
1862 }
1863 else
1864 {
1865 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1866 {
1867 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1868 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1869 }
1870 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1871 {
1872 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1873 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1874 }
1875 }
1876
1877 /* Chop the high bits if 16-bit (Intel says so). */
1878 if (enmEffOpSize == IEMMODE_16BIT)
1879 offSeg &= UINT16_MAX;
1880
1881 /* Limit check. (Should alternatively check for non-canonical addresses
1882 here, but that is ruled out by offSeg being 32-bit, right?) */
1883 uint64_t u64Base;
1884 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1885 if (Desc.Legacy.Gen.u1Long)
1886 u64Base = 0;
1887 else
1888 {
1889 if (offSeg > cbLimit)
1890 {
1891 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1892 /** @todo: Intel says this is #GP(0)! */
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895 u64Base = X86DESC_BASE(&Desc.Legacy);
1896 }
1897
1898 /*
1899 * Ok, everything checked out fine. Now set the accessed bit before
1900 * committing the result into CS, CSHID and RIP.
1901 */
1902 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1903 {
1904 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1905 if (rcStrict != VINF_SUCCESS)
1906 return rcStrict;
1907 /** @todo check what VT-x and AMD-V does. */
1908 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1909 }
1910
1911 /* commit */
1912 pCtx->rip = offSeg;
1913 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1914 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1915 pCtx->cs.ValidSel = pCtx->cs.Sel;
1916 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1917 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1918 pCtx->cs.u32Limit = cbLimit;
1919 pCtx->cs.u64Base = u64Base;
1920 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1921 pCtx->eflags.Bits.u1RF = 0;
1922 /** @todo check if the hidden bits are loaded correctly for 64-bit
1923 * mode. */
1924
1925 /* Flush the prefetch buffer. */
1926#ifdef IEM_WITH_CODE_TLB
1927 pVCpu->iem.s.pbInstrBuf = NULL;
1928#else
1929 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1930#endif
1931
1932 return VINF_SUCCESS;
1933}
1934
1935
1936/**
1937 * Implements far calls.
1938 *
1939 * This very similar to iemCImpl_FarJmp.
1940 *
1941 * @param uSel The selector.
1942 * @param offSeg The segment offset.
1943 * @param enmEffOpSize The operand size (in case we need it).
1944 */
1945IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1946{
1947 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1948 VBOXSTRICTRC rcStrict;
1949 uint64_t uNewRsp;
1950 RTPTRUNION uPtrRet;
1951
1952 /*
1953 * Real mode and V8086 mode are easy. The only snag seems to be that
1954 * CS.limit doesn't change and the limit check is done against the current
1955 * limit.
1956 */
1957 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1958 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1959 {
1960 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1961
1962 /* Check stack first - may #SS(0). */
1963 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1964 &uPtrRet.pv, &uNewRsp);
1965 if (rcStrict != VINF_SUCCESS)
1966 return rcStrict;
1967
1968 /* Check the target address range. */
1969 if (offSeg > UINT32_MAX)
1970 return iemRaiseGeneralProtectionFault0(pVCpu);
1971
1972 /* Everything is fine, push the return address. */
1973 if (enmEffOpSize == IEMMODE_16BIT)
1974 {
1975 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1976 uPtrRet.pu16[1] = pCtx->cs.Sel;
1977 }
1978 else
1979 {
1980 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1981 uPtrRet.pu16[3] = pCtx->cs.Sel;
1982 }
1983 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1984 if (rcStrict != VINF_SUCCESS)
1985 return rcStrict;
1986
1987 /* Branch. */
1988 pCtx->rip = offSeg;
1989 pCtx->cs.Sel = uSel;
1990 pCtx->cs.ValidSel = uSel;
1991 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1992 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1993 pCtx->eflags.Bits.u1RF = 0;
1994 return VINF_SUCCESS;
1995 }
1996
1997 /*
1998 * Protected mode. Need to parse the specified descriptor...
1999 */
2000 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2001 {
2002 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2003 return iemRaiseGeneralProtectionFault0(pVCpu);
2004 }
2005
2006 /* Fetch the descriptor. */
2007 IEMSELDESC Desc;
2008 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2009 if (rcStrict != VINF_SUCCESS)
2010 return rcStrict;
2011
2012 /*
2013 * Deal with it according to its type. We do the standard code selectors
2014 * here and dispatch the system selectors to worker functions.
2015 */
2016 if (!Desc.Legacy.Gen.u1DescType)
2017 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2018
2019 /* Only code segments. */
2020 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2021 {
2022 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2023 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2024 }
2025
2026 /* L vs D. */
2027 if ( Desc.Legacy.Gen.u1Long
2028 && Desc.Legacy.Gen.u1DefBig
2029 && IEM_IS_LONG_MODE(pVCpu))
2030 {
2031 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2032 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2033 }
2034
2035 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2036 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2037 {
2038 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2039 {
2040 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2041 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2042 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2043 }
2044 }
2045 else
2046 {
2047 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2048 {
2049 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2050 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2051 }
2052 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2053 {
2054 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2055 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2056 }
2057 }
2058
2059 /* Is it there? */
2060 if (!Desc.Legacy.Gen.u1Present)
2061 {
2062 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2063 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2064 }
2065
2066 /* Check stack first - may #SS(0). */
2067 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2068 * 16-bit code cause a two or four byte CS to be pushed? */
2069 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2070 enmEffOpSize == IEMMODE_64BIT ? 8+8
2071 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2072 &uPtrRet.pv, &uNewRsp);
2073 if (rcStrict != VINF_SUCCESS)
2074 return rcStrict;
2075
2076 /* Chop the high bits if 16-bit (Intel says so). */
2077 if (enmEffOpSize == IEMMODE_16BIT)
2078 offSeg &= UINT16_MAX;
2079
2080 /* Limit / canonical check. */
2081 uint64_t u64Base;
2082 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2083 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2084 {
2085 if (!IEM_IS_CANONICAL(offSeg))
2086 {
2087 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2088 return iemRaiseNotCanonical(pVCpu);
2089 }
2090 u64Base = 0;
2091 }
2092 else
2093 {
2094 if (offSeg > cbLimit)
2095 {
2096 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2097 /** @todo: Intel says this is #GP(0)! */
2098 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2099 }
2100 u64Base = X86DESC_BASE(&Desc.Legacy);
2101 }
2102
2103 /*
2104 * Now set the accessed bit before
2105 * writing the return address to the stack and committing the result into
2106 * CS, CSHID and RIP.
2107 */
2108 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2109 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2110 {
2111 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2112 if (rcStrict != VINF_SUCCESS)
2113 return rcStrict;
2114 /** @todo check what VT-x and AMD-V does. */
2115 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2116 }
2117
2118 /* stack */
2119 if (enmEffOpSize == IEMMODE_16BIT)
2120 {
2121 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2122 uPtrRet.pu16[1] = pCtx->cs.Sel;
2123 }
2124 else if (enmEffOpSize == IEMMODE_32BIT)
2125 {
2126 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2127 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2128 }
2129 else
2130 {
2131 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2132 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2133 }
2134 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2135 if (rcStrict != VINF_SUCCESS)
2136 return rcStrict;
2137
2138 /* commit */
2139 pCtx->rip = offSeg;
2140 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2141 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2142 pCtx->cs.ValidSel = pCtx->cs.Sel;
2143 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2144 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2145 pCtx->cs.u32Limit = cbLimit;
2146 pCtx->cs.u64Base = u64Base;
2147 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2148 pCtx->eflags.Bits.u1RF = 0;
2149 /** @todo check if the hidden bits are loaded correctly for 64-bit
2150 * mode. */
2151
2152 /* Flush the prefetch buffer. */
2153#ifdef IEM_WITH_CODE_TLB
2154 pVCpu->iem.s.pbInstrBuf = NULL;
2155#else
2156 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2157#endif
2158 return VINF_SUCCESS;
2159}
2160
2161
2162/**
2163 * Implements retf.
2164 *
2165 * @param enmEffOpSize The effective operand size.
2166 * @param cbPop The amount of arguments to pop from the stack
2167 * (bytes).
2168 */
2169IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2170{
2171 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2172 VBOXSTRICTRC rcStrict;
2173 RTCPTRUNION uPtrFrame;
2174 uint64_t uNewRsp;
2175 uint64_t uNewRip;
2176 uint16_t uNewCs;
2177 NOREF(cbInstr);
2178
2179 /*
2180 * Read the stack values first.
2181 */
2182 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2183 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2184 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2185 if (rcStrict != VINF_SUCCESS)
2186 return rcStrict;
2187 if (enmEffOpSize == IEMMODE_16BIT)
2188 {
2189 uNewRip = uPtrFrame.pu16[0];
2190 uNewCs = uPtrFrame.pu16[1];
2191 }
2192 else if (enmEffOpSize == IEMMODE_32BIT)
2193 {
2194 uNewRip = uPtrFrame.pu32[0];
2195 uNewCs = uPtrFrame.pu16[2];
2196 }
2197 else
2198 {
2199 uNewRip = uPtrFrame.pu64[0];
2200 uNewCs = uPtrFrame.pu16[4];
2201 }
2202 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2203 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2204 { /* extremely likely */ }
2205 else
2206 return rcStrict;
2207
2208 /*
2209 * Real mode and V8086 mode are easy.
2210 */
2211 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2212 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
2213 {
2214 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2215 /** @todo check how this is supposed to work if sp=0xfffe. */
2216
2217 /* Check the limit of the new EIP. */
2218 /** @todo Intel pseudo code only does the limit check for 16-bit
2219 * operands, AMD does not make any distinction. What is right? */
2220 if (uNewRip > pCtx->cs.u32Limit)
2221 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2222
2223 /* commit the operation. */
2224 pCtx->rsp = uNewRsp;
2225 pCtx->rip = uNewRip;
2226 pCtx->cs.Sel = uNewCs;
2227 pCtx->cs.ValidSel = uNewCs;
2228 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2229 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2230 pCtx->eflags.Bits.u1RF = 0;
2231 /** @todo do we load attribs and limit as well? */
2232 if (cbPop)
2233 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2234 return VINF_SUCCESS;
2235 }
2236
2237 /*
2238 * Protected mode is complicated, of course.
2239 */
2240 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2241 {
2242 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2243 return iemRaiseGeneralProtectionFault0(pVCpu);
2244 }
2245
2246 /* Fetch the descriptor. */
2247 IEMSELDESC DescCs;
2248 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2249 if (rcStrict != VINF_SUCCESS)
2250 return rcStrict;
2251
2252 /* Can only return to a code selector. */
2253 if ( !DescCs.Legacy.Gen.u1DescType
2254 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2255 {
2256 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2257 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2258 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2259 }
2260
2261 /* L vs D. */
2262 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2263 && DescCs.Legacy.Gen.u1DefBig
2264 && IEM_IS_LONG_MODE(pVCpu))
2265 {
2266 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2267 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2268 }
2269
2270 /* DPL/RPL/CPL checks. */
2271 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2272 {
2273 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2274 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2275 }
2276
2277 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2278 {
2279 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2280 {
2281 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2282 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2283 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2284 }
2285 }
2286 else
2287 {
2288 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2289 {
2290 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2291 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2292 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2293 }
2294 }
2295
2296 /* Is it there? */
2297 if (!DescCs.Legacy.Gen.u1Present)
2298 {
2299 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2300 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2301 }
2302
2303 /*
2304 * Return to outer privilege? (We'll typically have entered via a call gate.)
2305 */
2306 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2307 {
2308 /* Read the outer stack pointer stored *after* the parameters. */
2309 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2310 if (rcStrict != VINF_SUCCESS)
2311 return rcStrict;
2312
2313 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2314
2315 uint16_t uNewOuterSs;
2316 uint64_t uNewOuterRsp;
2317 if (enmEffOpSize == IEMMODE_16BIT)
2318 {
2319 uNewOuterRsp = uPtrFrame.pu16[0];
2320 uNewOuterSs = uPtrFrame.pu16[1];
2321 }
2322 else if (enmEffOpSize == IEMMODE_32BIT)
2323 {
2324 uNewOuterRsp = uPtrFrame.pu32[0];
2325 uNewOuterSs = uPtrFrame.pu16[2];
2326 }
2327 else
2328 {
2329 uNewOuterRsp = uPtrFrame.pu64[0];
2330 uNewOuterSs = uPtrFrame.pu16[4];
2331 }
2332 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2333 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2334 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2335 { /* extremely likely */ }
2336 else
2337 return rcStrict;
2338
2339 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2340 and read the selector. */
2341 IEMSELDESC DescSs;
2342 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2343 {
2344 if ( !DescCs.Legacy.Gen.u1Long
2345 || (uNewOuterSs & X86_SEL_RPL) == 3)
2346 {
2347 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2348 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2349 return iemRaiseGeneralProtectionFault0(pVCpu);
2350 }
2351 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2352 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2353 }
2354 else
2355 {
2356 /* Fetch the descriptor for the new stack segment. */
2357 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2358 if (rcStrict != VINF_SUCCESS)
2359 return rcStrict;
2360 }
2361
2362 /* Check that RPL of stack and code selectors match. */
2363 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2364 {
2365 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2366 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2367 }
2368
2369 /* Must be a writable data segment. */
2370 if ( !DescSs.Legacy.Gen.u1DescType
2371 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2372 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2373 {
2374 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2375 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2376 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2377 }
2378
2379 /* L vs D. (Not mentioned by intel.) */
2380 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2381 && DescSs.Legacy.Gen.u1DefBig
2382 && IEM_IS_LONG_MODE(pVCpu))
2383 {
2384 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2385 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2386 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2387 }
2388
2389 /* DPL/RPL/CPL checks. */
2390 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2391 {
2392 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2393 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2394 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2395 }
2396
2397 /* Is it there? */
2398 if (!DescSs.Legacy.Gen.u1Present)
2399 {
2400 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2401 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2402 }
2403
2404 /* Calc SS limit.*/
2405 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2406
2407 /* Is RIP canonical or within CS.limit? */
2408 uint64_t u64Base;
2409 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2410
2411 /** @todo Testcase: Is this correct? */
2412 if ( DescCs.Legacy.Gen.u1Long
2413 && IEM_IS_LONG_MODE(pVCpu) )
2414 {
2415 if (!IEM_IS_CANONICAL(uNewRip))
2416 {
2417 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2418 return iemRaiseNotCanonical(pVCpu);
2419 }
2420 u64Base = 0;
2421 }
2422 else
2423 {
2424 if (uNewRip > cbLimitCs)
2425 {
2426 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2427 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2428 /** @todo: Intel says this is #GP(0)! */
2429 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2430 }
2431 u64Base = X86DESC_BASE(&DescCs.Legacy);
2432 }
2433
2434 /*
2435 * Now set the accessed bit before
2436 * writing the return address to the stack and committing the result into
2437 * CS, CSHID and RIP.
2438 */
2439 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2440 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2441 {
2442 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2443 if (rcStrict != VINF_SUCCESS)
2444 return rcStrict;
2445 /** @todo check what VT-x and AMD-V does. */
2446 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2447 }
2448 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2449 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2450 {
2451 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2452 if (rcStrict != VINF_SUCCESS)
2453 return rcStrict;
2454 /** @todo check what VT-x and AMD-V does. */
2455 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2456 }
2457
2458 /* commit */
2459 if (enmEffOpSize == IEMMODE_16BIT)
2460 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2461 else
2462 pCtx->rip = uNewRip;
2463 pCtx->cs.Sel = uNewCs;
2464 pCtx->cs.ValidSel = uNewCs;
2465 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2466 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2467 pCtx->cs.u32Limit = cbLimitCs;
2468 pCtx->cs.u64Base = u64Base;
2469 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2470 pCtx->ss.Sel = uNewOuterSs;
2471 pCtx->ss.ValidSel = uNewOuterSs;
2472 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2473 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2474 pCtx->ss.u32Limit = cbLimitSs;
2475 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2476 pCtx->ss.u64Base = 0;
2477 else
2478 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2479 if (!pCtx->ss.Attr.n.u1DefBig)
2480 pCtx->sp = (uint16_t)uNewOuterRsp;
2481 else
2482 pCtx->rsp = uNewOuterRsp;
2483
2484 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2485 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2486 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2487 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2488 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2489
2490 /** @todo check if the hidden bits are loaded correctly for 64-bit
2491 * mode. */
2492
2493 if (cbPop)
2494 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2495 pCtx->eflags.Bits.u1RF = 0;
2496
2497 /* Done! */
2498 }
2499 /*
2500 * Return to the same privilege level
2501 */
2502 else
2503 {
2504 /* Limit / canonical check. */
2505 uint64_t u64Base;
2506 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2507
2508 /** @todo Testcase: Is this correct? */
2509 if ( DescCs.Legacy.Gen.u1Long
2510 && IEM_IS_LONG_MODE(pVCpu) )
2511 {
2512 if (!IEM_IS_CANONICAL(uNewRip))
2513 {
2514 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2515 return iemRaiseNotCanonical(pVCpu);
2516 }
2517 u64Base = 0;
2518 }
2519 else
2520 {
2521 if (uNewRip > cbLimitCs)
2522 {
2523 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2524 /** @todo: Intel says this is #GP(0)! */
2525 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2526 }
2527 u64Base = X86DESC_BASE(&DescCs.Legacy);
2528 }
2529
2530 /*
2531 * Now set the accessed bit before
2532 * writing the return address to the stack and committing the result into
2533 * CS, CSHID and RIP.
2534 */
2535 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2536 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2537 {
2538 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2539 if (rcStrict != VINF_SUCCESS)
2540 return rcStrict;
2541 /** @todo check what VT-x and AMD-V does. */
2542 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2543 }
2544
2545 /* commit */
2546 if (!pCtx->ss.Attr.n.u1DefBig)
2547 pCtx->sp = (uint16_t)uNewRsp;
2548 else
2549 pCtx->rsp = uNewRsp;
2550 if (enmEffOpSize == IEMMODE_16BIT)
2551 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2552 else
2553 pCtx->rip = uNewRip;
2554 pCtx->cs.Sel = uNewCs;
2555 pCtx->cs.ValidSel = uNewCs;
2556 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2557 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2558 pCtx->cs.u32Limit = cbLimitCs;
2559 pCtx->cs.u64Base = u64Base;
2560 /** @todo check if the hidden bits are loaded correctly for 64-bit
2561 * mode. */
2562 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2563 if (cbPop)
2564 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2565 pCtx->eflags.Bits.u1RF = 0;
2566 }
2567
2568 /* Flush the prefetch buffer. */
2569#ifdef IEM_WITH_CODE_TLB
2570 pVCpu->iem.s.pbInstrBuf = NULL;
2571#else
2572 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2573#endif
2574 return VINF_SUCCESS;
2575}
2576
2577
2578/**
2579 * Implements retn.
2580 *
2581 * We're doing this in C because of the \#GP that might be raised if the popped
2582 * program counter is out of bounds.
2583 *
2584 * @param enmEffOpSize The effective operand size.
2585 * @param cbPop The amount of arguments to pop from the stack
2586 * (bytes).
2587 */
2588IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2589{
2590 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2591 NOREF(cbInstr);
2592
2593 /* Fetch the RSP from the stack. */
2594 VBOXSTRICTRC rcStrict;
2595 RTUINT64U NewRip;
2596 RTUINT64U NewRsp;
2597 NewRsp.u = pCtx->rsp;
2598 switch (enmEffOpSize)
2599 {
2600 case IEMMODE_16BIT:
2601 NewRip.u = 0;
2602 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2603 break;
2604 case IEMMODE_32BIT:
2605 NewRip.u = 0;
2606 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2607 break;
2608 case IEMMODE_64BIT:
2609 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2610 break;
2611 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2612 }
2613 if (rcStrict != VINF_SUCCESS)
2614 return rcStrict;
2615
2616 /* Check the new RSP before loading it. */
2617 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2618 * of it. The canonical test is performed here and for call. */
2619 if (enmEffOpSize != IEMMODE_64BIT)
2620 {
2621 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2622 {
2623 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2624 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2625 }
2626 }
2627 else
2628 {
2629 if (!IEM_IS_CANONICAL(NewRip.u))
2630 {
2631 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2632 return iemRaiseNotCanonical(pVCpu);
2633 }
2634 }
2635
2636 /* Apply cbPop */
2637 if (cbPop)
2638 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2639
2640 /* Commit it. */
2641 pCtx->rip = NewRip.u;
2642 pCtx->rsp = NewRsp.u;
2643 pCtx->eflags.Bits.u1RF = 0;
2644
2645 /* Flush the prefetch buffer. */
2646#ifndef IEM_WITH_CODE_TLB
2647 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2648#endif
2649
2650 return VINF_SUCCESS;
2651}
2652
2653
2654/**
2655 * Implements enter.
2656 *
2657 * We're doing this in C because the instruction is insane, even for the
2658 * u8NestingLevel=0 case dealing with the stack is tedious.
2659 *
2660 * @param enmEffOpSize The effective operand size.
2661 */
2662IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2663{
2664 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2665
2666 /* Push RBP, saving the old value in TmpRbp. */
2667 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2668 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2669 RTUINT64U NewRbp;
2670 VBOXSTRICTRC rcStrict;
2671 if (enmEffOpSize == IEMMODE_64BIT)
2672 {
2673 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2674 NewRbp = NewRsp;
2675 }
2676 else if (enmEffOpSize == IEMMODE_32BIT)
2677 {
2678 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2679 NewRbp = NewRsp;
2680 }
2681 else
2682 {
2683 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2684 NewRbp = TmpRbp;
2685 NewRbp.Words.w0 = NewRsp.Words.w0;
2686 }
2687 if (rcStrict != VINF_SUCCESS)
2688 return rcStrict;
2689
2690 /* Copy the parameters (aka nesting levels by Intel). */
2691 cParameters &= 0x1f;
2692 if (cParameters > 0)
2693 {
2694 switch (enmEffOpSize)
2695 {
2696 case IEMMODE_16BIT:
2697 if (pCtx->ss.Attr.n.u1DefBig)
2698 TmpRbp.DWords.dw0 -= 2;
2699 else
2700 TmpRbp.Words.w0 -= 2;
2701 do
2702 {
2703 uint16_t u16Tmp;
2704 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2705 if (rcStrict != VINF_SUCCESS)
2706 break;
2707 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2708 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2709 break;
2710
2711 case IEMMODE_32BIT:
2712 if (pCtx->ss.Attr.n.u1DefBig)
2713 TmpRbp.DWords.dw0 -= 4;
2714 else
2715 TmpRbp.Words.w0 -= 4;
2716 do
2717 {
2718 uint32_t u32Tmp;
2719 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2720 if (rcStrict != VINF_SUCCESS)
2721 break;
2722 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2723 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2724 break;
2725
2726 case IEMMODE_64BIT:
2727 TmpRbp.u -= 8;
2728 do
2729 {
2730 uint64_t u64Tmp;
2731 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2732 if (rcStrict != VINF_SUCCESS)
2733 break;
2734 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2735 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2736 break;
2737
2738 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2739 }
2740 if (rcStrict != VINF_SUCCESS)
2741 return VINF_SUCCESS;
2742
2743 /* Push the new RBP */
2744 if (enmEffOpSize == IEMMODE_64BIT)
2745 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2746 else if (enmEffOpSize == IEMMODE_32BIT)
2747 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2748 else
2749 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2750 if (rcStrict != VINF_SUCCESS)
2751 return rcStrict;
2752
2753 }
2754
2755 /* Recalc RSP. */
2756 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2757
2758 /** @todo Should probe write access at the new RSP according to AMD. */
2759
2760 /* Commit it. */
2761 pCtx->rbp = NewRbp.u;
2762 pCtx->rsp = NewRsp.u;
2763 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2764
2765 return VINF_SUCCESS;
2766}
2767
2768
2769
2770/**
2771 * Implements leave.
2772 *
2773 * We're doing this in C because messing with the stack registers is annoying
2774 * since they depends on SS attributes.
2775 *
2776 * @param enmEffOpSize The effective operand size.
2777 */
2778IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2779{
2780 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2781
2782 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2783 RTUINT64U NewRsp;
2784 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2785 NewRsp.u = pCtx->rbp;
2786 else if (pCtx->ss.Attr.n.u1DefBig)
2787 NewRsp.u = pCtx->ebp;
2788 else
2789 {
2790 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2791 NewRsp.u = pCtx->rsp;
2792 NewRsp.Words.w0 = pCtx->bp;
2793 }
2794
2795 /* Pop RBP according to the operand size. */
2796 VBOXSTRICTRC rcStrict;
2797 RTUINT64U NewRbp;
2798 switch (enmEffOpSize)
2799 {
2800 case IEMMODE_16BIT:
2801 NewRbp.u = pCtx->rbp;
2802 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2803 break;
2804 case IEMMODE_32BIT:
2805 NewRbp.u = 0;
2806 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2807 break;
2808 case IEMMODE_64BIT:
2809 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2810 break;
2811 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2812 }
2813 if (rcStrict != VINF_SUCCESS)
2814 return rcStrict;
2815
2816
2817 /* Commit it. */
2818 pCtx->rbp = NewRbp.u;
2819 pCtx->rsp = NewRsp.u;
2820 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2821
2822 return VINF_SUCCESS;
2823}
2824
2825
2826/**
2827 * Implements int3 and int XX.
2828 *
2829 * @param u8Int The interrupt vector number.
2830 * @param fIsBpInstr Is it the breakpoint instruction.
2831 */
2832IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2833{
2834 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2835 return iemRaiseXcptOrInt(pVCpu,
2836 cbInstr,
2837 u8Int,
2838 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2839 0,
2840 0);
2841}
2842
2843
2844/**
2845 * Implements iret for real mode and V8086 mode.
2846 *
2847 * @param enmEffOpSize The effective operand size.
2848 */
2849IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2850{
2851 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2852 X86EFLAGS Efl;
2853 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2854 NOREF(cbInstr);
2855
2856 /*
2857 * iret throws an exception if VME isn't enabled.
2858 */
2859 if ( Efl.Bits.u1VM
2860 && Efl.Bits.u2IOPL != 3
2861 && !(pCtx->cr4 & X86_CR4_VME))
2862 return iemRaiseGeneralProtectionFault0(pVCpu);
2863
2864 /*
2865 * Do the stack bits, but don't commit RSP before everything checks
2866 * out right.
2867 */
2868 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2869 VBOXSTRICTRC rcStrict;
2870 RTCPTRUNION uFrame;
2871 uint16_t uNewCs;
2872 uint32_t uNewEip;
2873 uint32_t uNewFlags;
2874 uint64_t uNewRsp;
2875 if (enmEffOpSize == IEMMODE_32BIT)
2876 {
2877 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2878 if (rcStrict != VINF_SUCCESS)
2879 return rcStrict;
2880 uNewEip = uFrame.pu32[0];
2881 if (uNewEip > UINT16_MAX)
2882 return iemRaiseGeneralProtectionFault0(pVCpu);
2883
2884 uNewCs = (uint16_t)uFrame.pu32[1];
2885 uNewFlags = uFrame.pu32[2];
2886 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2887 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2888 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2889 | X86_EFL_ID;
2890 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2891 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2892 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2893 }
2894 else
2895 {
2896 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2897 if (rcStrict != VINF_SUCCESS)
2898 return rcStrict;
2899 uNewEip = uFrame.pu16[0];
2900 uNewCs = uFrame.pu16[1];
2901 uNewFlags = uFrame.pu16[2];
2902 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2903 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2904 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2905 /** @todo The intel pseudo code does not indicate what happens to
2906 * reserved flags. We just ignore them. */
2907 /* Ancient CPU adjustments: See iemCImpl_popf. */
2908 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2909 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2910 }
2911 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2912 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2913 { /* extremely likely */ }
2914 else
2915 return rcStrict;
2916
2917 /** @todo Check how this is supposed to work if sp=0xfffe. */
2918 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2919 uNewCs, uNewEip, uNewFlags, uNewRsp));
2920
2921 /*
2922 * Check the limit of the new EIP.
2923 */
2924 /** @todo Only the AMD pseudo code check the limit here, what's
2925 * right? */
2926 if (uNewEip > pCtx->cs.u32Limit)
2927 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2928
2929 /*
2930 * V8086 checks and flag adjustments
2931 */
2932 if (Efl.Bits.u1VM)
2933 {
2934 if (Efl.Bits.u2IOPL == 3)
2935 {
2936 /* Preserve IOPL and clear RF. */
2937 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2938 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2939 }
2940 else if ( enmEffOpSize == IEMMODE_16BIT
2941 && ( !(uNewFlags & X86_EFL_IF)
2942 || !Efl.Bits.u1VIP )
2943 && !(uNewFlags & X86_EFL_TF) )
2944 {
2945 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2946 uNewFlags &= ~X86_EFL_VIF;
2947 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2948 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2949 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2950 }
2951 else
2952 return iemRaiseGeneralProtectionFault0(pVCpu);
2953 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2954 }
2955
2956 /*
2957 * Commit the operation.
2958 */
2959#ifdef DBGFTRACE_ENABLED
2960 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2961 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2962#endif
2963 pCtx->rsp = uNewRsp;
2964 pCtx->rip = uNewEip;
2965 pCtx->cs.Sel = uNewCs;
2966 pCtx->cs.ValidSel = uNewCs;
2967 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2968 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2969 /** @todo do we load attribs and limit as well? */
2970 Assert(uNewFlags & X86_EFL_1);
2971 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2972
2973 /* Flush the prefetch buffer. */
2974#ifdef IEM_WITH_CODE_TLB
2975 pVCpu->iem.s.pbInstrBuf = NULL;
2976#else
2977 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2978#endif
2979
2980 return VINF_SUCCESS;
2981}
2982
2983
2984/**
2985 * Loads a segment register when entering V8086 mode.
2986 *
2987 * @param pSReg The segment register.
2988 * @param uSeg The segment to load.
2989 */
2990static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2991{
2992 pSReg->Sel = uSeg;
2993 pSReg->ValidSel = uSeg;
2994 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2995 pSReg->u64Base = (uint32_t)uSeg << 4;
2996 pSReg->u32Limit = 0xffff;
2997 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2998 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2999 * IRET'ing to V8086. */
3000}
3001
3002
3003/**
3004 * Implements iret for protected mode returning to V8086 mode.
3005 *
3006 * @param pCtx Pointer to the CPU context.
3007 * @param uNewEip The new EIP.
3008 * @param uNewCs The new CS.
3009 * @param uNewFlags The new EFLAGS.
3010 * @param uNewRsp The RSP after the initial IRET frame.
3011 *
3012 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3013 */
3014IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
3015 uint32_t, uNewFlags, uint64_t, uNewRsp)
3016{
3017 RT_NOREF_PV(cbInstr);
3018
3019 /*
3020 * Pop the V8086 specific frame bits off the stack.
3021 */
3022 VBOXSTRICTRC rcStrict;
3023 RTCPTRUNION uFrame;
3024 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3025 if (rcStrict != VINF_SUCCESS)
3026 return rcStrict;
3027 uint32_t uNewEsp = uFrame.pu32[0];
3028 uint16_t uNewSs = uFrame.pu32[1];
3029 uint16_t uNewEs = uFrame.pu32[2];
3030 uint16_t uNewDs = uFrame.pu32[3];
3031 uint16_t uNewFs = uFrame.pu32[4];
3032 uint16_t uNewGs = uFrame.pu32[5];
3033 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3034 if (rcStrict != VINF_SUCCESS)
3035 return rcStrict;
3036
3037 /*
3038 * Commit the operation.
3039 */
3040 uNewFlags &= X86_EFL_LIVE_MASK;
3041 uNewFlags |= X86_EFL_RA1_MASK;
3042#ifdef DBGFTRACE_ENABLED
3043 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3044 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3045#endif
3046
3047 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3048 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
3049 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
3050 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
3051 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
3052 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
3053 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
3054 pCtx->rip = (uint16_t)uNewEip;
3055 pCtx->rsp = uNewEsp; /** @todo check this out! */
3056 pVCpu->iem.s.uCpl = 3;
3057
3058 /* Flush the prefetch buffer. */
3059#ifdef IEM_WITH_CODE_TLB
3060 pVCpu->iem.s.pbInstrBuf = NULL;
3061#else
3062 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3063#endif
3064
3065 return VINF_SUCCESS;
3066}
3067
3068
3069/**
3070 * Implements iret for protected mode returning via a nested task.
3071 *
3072 * @param enmEffOpSize The effective operand size.
3073 */
3074IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3075{
3076 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3077#ifndef IEM_IMPLEMENTS_TASKSWITCH
3078 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3079#else
3080 RT_NOREF_PV(enmEffOpSize);
3081
3082 /*
3083 * Read the segment selector in the link-field of the current TSS.
3084 */
3085 RTSEL uSelRet;
3086 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3087 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
3088 if (rcStrict != VINF_SUCCESS)
3089 return rcStrict;
3090
3091 /*
3092 * Fetch the returning task's TSS descriptor from the GDT.
3093 */
3094 if (uSelRet & X86_SEL_LDT)
3095 {
3096 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3097 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3098 }
3099
3100 IEMSELDESC TssDesc;
3101 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3102 if (rcStrict != VINF_SUCCESS)
3103 return rcStrict;
3104
3105 if (TssDesc.Legacy.Gate.u1DescType)
3106 {
3107 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3108 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3109 }
3110
3111 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3112 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3113 {
3114 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3115 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3116 }
3117
3118 if (!TssDesc.Legacy.Gate.u1Present)
3119 {
3120 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3121 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3122 }
3123
3124 uint32_t uNextEip = pCtx->eip + cbInstr;
3125 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3126 0 /* uCr2 */, uSelRet, &TssDesc);
3127#endif
3128}
3129
3130
3131/**
3132 * Implements iret for protected mode
3133 *
3134 * @param enmEffOpSize The effective operand size.
3135 */
3136IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3137{
3138 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3139 NOREF(cbInstr);
3140 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3141
3142 /*
3143 * Nested task return.
3144 */
3145 if (pCtx->eflags.Bits.u1NT)
3146 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3147
3148 /*
3149 * Normal return.
3150 *
3151 * Do the stack bits, but don't commit RSP before everything checks
3152 * out right.
3153 */
3154 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3155 VBOXSTRICTRC rcStrict;
3156 RTCPTRUNION uFrame;
3157 uint16_t uNewCs;
3158 uint32_t uNewEip;
3159 uint32_t uNewFlags;
3160 uint64_t uNewRsp;
3161 if (enmEffOpSize == IEMMODE_32BIT)
3162 {
3163 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3164 if (rcStrict != VINF_SUCCESS)
3165 return rcStrict;
3166 uNewEip = uFrame.pu32[0];
3167 uNewCs = (uint16_t)uFrame.pu32[1];
3168 uNewFlags = uFrame.pu32[2];
3169 }
3170 else
3171 {
3172 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3173 if (rcStrict != VINF_SUCCESS)
3174 return rcStrict;
3175 uNewEip = uFrame.pu16[0];
3176 uNewCs = uFrame.pu16[1];
3177 uNewFlags = uFrame.pu16[2];
3178 }
3179 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3180 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3181 { /* extremely likely */ }
3182 else
3183 return rcStrict;
3184 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n", uNewCs, uNewEip, uNewFlags, uNewRsp));
3185
3186 /*
3187 * We're hopefully not returning to V8086 mode...
3188 */
3189 if ( (uNewFlags & X86_EFL_VM)
3190 && pVCpu->iem.s.uCpl == 0)
3191 {
3192 Assert(enmEffOpSize == IEMMODE_32BIT);
3193 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3194 }
3195
3196 /*
3197 * Protected mode.
3198 */
3199 /* Read the CS descriptor. */
3200 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3201 {
3202 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3203 return iemRaiseGeneralProtectionFault0(pVCpu);
3204 }
3205
3206 IEMSELDESC DescCS;
3207 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3208 if (rcStrict != VINF_SUCCESS)
3209 {
3210 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3211 return rcStrict;
3212 }
3213
3214 /* Must be a code descriptor. */
3215 if (!DescCS.Legacy.Gen.u1DescType)
3216 {
3217 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3218 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3219 }
3220 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3221 {
3222 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3223 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3224 }
3225
3226#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3227 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3228 PVM pVM = pVCpu->CTX_SUFF(pVM);
3229 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3230 {
3231 if ((uNewCs & X86_SEL_RPL) == 1)
3232 {
3233 if ( pVCpu->iem.s.uCpl == 0
3234 && ( !EMIsRawRing1Enabled(pVM)
3235 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3236 {
3237 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3238 uNewCs &= X86_SEL_MASK_OFF_RPL;
3239 }
3240# ifdef LOG_ENABLED
3241 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3242 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3243# endif
3244 }
3245 else if ( (uNewCs & X86_SEL_RPL) == 2
3246 && EMIsRawRing1Enabled(pVM)
3247 && pVCpu->iem.s.uCpl <= 1)
3248 {
3249 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3250 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3251 }
3252 }
3253#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3254
3255
3256 /* Privilege checks. */
3257 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3258 {
3259 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3260 {
3261 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3262 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3263 }
3264 }
3265 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3266 {
3267 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3268 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3269 }
3270 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3271 {
3272 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3273 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3274 }
3275
3276 /* Present? */
3277 if (!DescCS.Legacy.Gen.u1Present)
3278 {
3279 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3280 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3281 }
3282
3283 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3284
3285 /*
3286 * Return to outer level?
3287 */
3288 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3289 {
3290 uint16_t uNewSS;
3291 uint32_t uNewESP;
3292 if (enmEffOpSize == IEMMODE_32BIT)
3293 {
3294 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3295 if (rcStrict != VINF_SUCCESS)
3296 return rcStrict;
3297/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3298 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3299 * bit of the popped SS selector it turns out. */
3300 uNewESP = uFrame.pu32[0];
3301 uNewSS = (uint16_t)uFrame.pu32[1];
3302 }
3303 else
3304 {
3305 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3306 if (rcStrict != VINF_SUCCESS)
3307 return rcStrict;
3308 uNewESP = uFrame.pu16[0];
3309 uNewSS = uFrame.pu16[1];
3310 }
3311 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3312 if (rcStrict != VINF_SUCCESS)
3313 return rcStrict;
3314 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3315
3316 /* Read the SS descriptor. */
3317 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3318 {
3319 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3320 return iemRaiseGeneralProtectionFault0(pVCpu);
3321 }
3322
3323 IEMSELDESC DescSS;
3324 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3325 if (rcStrict != VINF_SUCCESS)
3326 {
3327 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3328 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3329 return rcStrict;
3330 }
3331
3332 /* Privilege checks. */
3333 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3334 {
3335 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3336 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3337 }
3338 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3339 {
3340 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3341 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3342 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3343 }
3344
3345 /* Must be a writeable data segment descriptor. */
3346 if (!DescSS.Legacy.Gen.u1DescType)
3347 {
3348 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3349 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3350 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3351 }
3352 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3353 {
3354 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3355 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3356 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3357 }
3358
3359 /* Present? */
3360 if (!DescSS.Legacy.Gen.u1Present)
3361 {
3362 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3363 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3364 }
3365
3366 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3367
3368 /* Check EIP. */
3369 if (uNewEip > cbLimitCS)
3370 {
3371 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3372 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3373 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3374 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3375 }
3376
3377 /*
3378 * Commit the changes, marking CS and SS accessed first since
3379 * that may fail.
3380 */
3381 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3382 {
3383 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3384 if (rcStrict != VINF_SUCCESS)
3385 return rcStrict;
3386 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3387 }
3388 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3389 {
3390 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3391 if (rcStrict != VINF_SUCCESS)
3392 return rcStrict;
3393 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3394 }
3395
3396 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3397 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3398 if (enmEffOpSize != IEMMODE_16BIT)
3399 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3400 if (pVCpu->iem.s.uCpl == 0)
3401 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3402 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3403 fEFlagsMask |= X86_EFL_IF;
3404 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3405 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3406 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3407 fEFlagsNew &= ~fEFlagsMask;
3408 fEFlagsNew |= uNewFlags & fEFlagsMask;
3409#ifdef DBGFTRACE_ENABLED
3410 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3411 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3412 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3413#endif
3414
3415 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3416 pCtx->rip = uNewEip;
3417 pCtx->cs.Sel = uNewCs;
3418 pCtx->cs.ValidSel = uNewCs;
3419 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3420 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3421 pCtx->cs.u32Limit = cbLimitCS;
3422 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3423 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3424
3425 pCtx->ss.Sel = uNewSS;
3426 pCtx->ss.ValidSel = uNewSS;
3427 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3428 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3429 pCtx->ss.u32Limit = cbLimitSs;
3430 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3431 if (!pCtx->ss.Attr.n.u1DefBig)
3432 pCtx->sp = (uint16_t)uNewESP;
3433 else
3434 pCtx->rsp = uNewESP;
3435
3436 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3437 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3438 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3439 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3440 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3441
3442 /* Done! */
3443
3444 }
3445 /*
3446 * Return to the same level.
3447 */
3448 else
3449 {
3450 /* Check EIP. */
3451 if (uNewEip > cbLimitCS)
3452 {
3453 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3454 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3455 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3456 }
3457
3458 /*
3459 * Commit the changes, marking CS first since it may fail.
3460 */
3461 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3462 {
3463 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3464 if (rcStrict != VINF_SUCCESS)
3465 return rcStrict;
3466 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3467 }
3468
3469 X86EFLAGS NewEfl;
3470 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3471 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3472 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3473 if (enmEffOpSize != IEMMODE_16BIT)
3474 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3475 if (pVCpu->iem.s.uCpl == 0)
3476 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3477 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3478 fEFlagsMask |= X86_EFL_IF;
3479 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3480 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3481 NewEfl.u &= ~fEFlagsMask;
3482 NewEfl.u |= fEFlagsMask & uNewFlags;
3483#ifdef DBGFTRACE_ENABLED
3484 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3485 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3486 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3487#endif
3488
3489 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3490 pCtx->rip = uNewEip;
3491 pCtx->cs.Sel = uNewCs;
3492 pCtx->cs.ValidSel = uNewCs;
3493 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3494 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3495 pCtx->cs.u32Limit = cbLimitCS;
3496 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3497 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3498 if (!pCtx->ss.Attr.n.u1DefBig)
3499 pCtx->sp = (uint16_t)uNewRsp;
3500 else
3501 pCtx->rsp = uNewRsp;
3502 /* Done! */
3503 }
3504
3505 /* Flush the prefetch buffer. */
3506#ifdef IEM_WITH_CODE_TLB
3507 pVCpu->iem.s.pbInstrBuf = NULL;
3508#else
3509 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3510#endif
3511
3512 return VINF_SUCCESS;
3513}
3514
3515
3516/**
3517 * Implements iret for long mode
3518 *
3519 * @param enmEffOpSize The effective operand size.
3520 */
3521IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3522{
3523 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3524 NOREF(cbInstr);
3525
3526 /*
3527 * Nested task return is not supported in long mode.
3528 */
3529 if (pCtx->eflags.Bits.u1NT)
3530 {
3531 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3532 return iemRaiseGeneralProtectionFault0(pVCpu);
3533 }
3534
3535 /*
3536 * Normal return.
3537 *
3538 * Do the stack bits, but don't commit RSP before everything checks
3539 * out right.
3540 */
3541 VBOXSTRICTRC rcStrict;
3542 RTCPTRUNION uFrame;
3543 uint64_t uNewRip;
3544 uint16_t uNewCs;
3545 uint16_t uNewSs;
3546 uint32_t uNewFlags;
3547 uint64_t uNewRsp;
3548 if (enmEffOpSize == IEMMODE_64BIT)
3549 {
3550 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3551 if (rcStrict != VINF_SUCCESS)
3552 return rcStrict;
3553 uNewRip = uFrame.pu64[0];
3554 uNewCs = (uint16_t)uFrame.pu64[1];
3555 uNewFlags = (uint32_t)uFrame.pu64[2];
3556 uNewRsp = uFrame.pu64[3];
3557 uNewSs = (uint16_t)uFrame.pu64[4];
3558 }
3559 else if (enmEffOpSize == IEMMODE_32BIT)
3560 {
3561 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3562 if (rcStrict != VINF_SUCCESS)
3563 return rcStrict;
3564 uNewRip = uFrame.pu32[0];
3565 uNewCs = (uint16_t)uFrame.pu32[1];
3566 uNewFlags = uFrame.pu32[2];
3567 uNewRsp = uFrame.pu32[3];
3568 uNewSs = (uint16_t)uFrame.pu32[4];
3569 }
3570 else
3571 {
3572 Assert(enmEffOpSize == IEMMODE_16BIT);
3573 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3574 if (rcStrict != VINF_SUCCESS)
3575 return rcStrict;
3576 uNewRip = uFrame.pu16[0];
3577 uNewCs = uFrame.pu16[1];
3578 uNewFlags = uFrame.pu16[2];
3579 uNewRsp = uFrame.pu16[3];
3580 uNewSs = uFrame.pu16[4];
3581 }
3582 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3583 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3584 { /* extremely like */ }
3585 else
3586 return rcStrict;
3587 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3588
3589 /*
3590 * Check stuff.
3591 */
3592 /* Read the CS descriptor. */
3593 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3594 {
3595 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3596 return iemRaiseGeneralProtectionFault0(pVCpu);
3597 }
3598
3599 IEMSELDESC DescCS;
3600 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3601 if (rcStrict != VINF_SUCCESS)
3602 {
3603 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3604 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3605 return rcStrict;
3606 }
3607
3608 /* Must be a code descriptor. */
3609 if ( !DescCS.Legacy.Gen.u1DescType
3610 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3611 {
3612 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3613 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3614 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3615 }
3616
3617 /* Privilege checks. */
3618 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3619 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3620 {
3621 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3622 {
3623 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3624 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3625 }
3626 }
3627 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3628 {
3629 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3630 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3631 }
3632 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3633 {
3634 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3635 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3636 }
3637
3638 /* Present? */
3639 if (!DescCS.Legacy.Gen.u1Present)
3640 {
3641 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3642 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3643 }
3644
3645 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3646
3647 /* Read the SS descriptor. */
3648 IEMSELDESC DescSS;
3649 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3650 {
3651 if ( !DescCS.Legacy.Gen.u1Long
3652 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3653 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3654 {
3655 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3656 return iemRaiseGeneralProtectionFault0(pVCpu);
3657 }
3658 DescSS.Legacy.u = 0;
3659 }
3660 else
3661 {
3662 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3663 if (rcStrict != VINF_SUCCESS)
3664 {
3665 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3666 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3667 return rcStrict;
3668 }
3669 }
3670
3671 /* Privilege checks. */
3672 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3673 {
3674 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3675 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3676 }
3677
3678 uint32_t cbLimitSs;
3679 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3680 cbLimitSs = UINT32_MAX;
3681 else
3682 {
3683 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3684 {
3685 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3686 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3687 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3688 }
3689
3690 /* Must be a writeable data segment descriptor. */
3691 if (!DescSS.Legacy.Gen.u1DescType)
3692 {
3693 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3694 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3695 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3696 }
3697 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3698 {
3699 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3700 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3701 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3702 }
3703
3704 /* Present? */
3705 if (!DescSS.Legacy.Gen.u1Present)
3706 {
3707 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3708 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3709 }
3710 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3711 }
3712
3713 /* Check EIP. */
3714 if (DescCS.Legacy.Gen.u1Long)
3715 {
3716 if (!IEM_IS_CANONICAL(uNewRip))
3717 {
3718 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3719 uNewCs, uNewRip, uNewSs, uNewRsp));
3720 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3721 }
3722 }
3723 else
3724 {
3725 if (uNewRip > cbLimitCS)
3726 {
3727 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3728 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3729 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3730 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3731 }
3732 }
3733
3734 /*
3735 * Commit the changes, marking CS and SS accessed first since
3736 * that may fail.
3737 */
3738 /** @todo where exactly are these actually marked accessed by a real CPU? */
3739 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3740 {
3741 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3742 if (rcStrict != VINF_SUCCESS)
3743 return rcStrict;
3744 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3745 }
3746 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3747 {
3748 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3749 if (rcStrict != VINF_SUCCESS)
3750 return rcStrict;
3751 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3752 }
3753
3754 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3755 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3756 if (enmEffOpSize != IEMMODE_16BIT)
3757 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3758 if (pVCpu->iem.s.uCpl == 0)
3759 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3760 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3761 fEFlagsMask |= X86_EFL_IF;
3762 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3763 fEFlagsNew &= ~fEFlagsMask;
3764 fEFlagsNew |= uNewFlags & fEFlagsMask;
3765#ifdef DBGFTRACE_ENABLED
3766 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3767 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3768#endif
3769
3770 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3771 pCtx->rip = uNewRip;
3772 pCtx->cs.Sel = uNewCs;
3773 pCtx->cs.ValidSel = uNewCs;
3774 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3775 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3776 pCtx->cs.u32Limit = cbLimitCS;
3777 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3778 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3779 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3780 pCtx->rsp = uNewRsp;
3781 else
3782 pCtx->sp = (uint16_t)uNewRsp;
3783 pCtx->ss.Sel = uNewSs;
3784 pCtx->ss.ValidSel = uNewSs;
3785 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3786 {
3787 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3788 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3789 pCtx->ss.u32Limit = UINT32_MAX;
3790 pCtx->ss.u64Base = 0;
3791 Log2(("iretq new SS: NULL\n"));
3792 }
3793 else
3794 {
3795 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3796 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3797 pCtx->ss.u32Limit = cbLimitSs;
3798 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3799 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3800 }
3801
3802 if (pVCpu->iem.s.uCpl != uNewCpl)
3803 {
3804 pVCpu->iem.s.uCpl = uNewCpl;
3805 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3806 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3807 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3808 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3809 }
3810
3811 /* Flush the prefetch buffer. */
3812#ifdef IEM_WITH_CODE_TLB
3813 pVCpu->iem.s.pbInstrBuf = NULL;
3814#else
3815 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3816#endif
3817
3818 return VINF_SUCCESS;
3819}
3820
3821
3822/**
3823 * Implements iret.
3824 *
3825 * @param enmEffOpSize The effective operand size.
3826 */
3827IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3828{
3829 /*
3830 * First, clear NMI blocking, if any, before causing any exceptions.
3831 */
3832 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3833
3834 /*
3835 * Call a mode specific worker.
3836 */
3837 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3838 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3839 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3840 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3841 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3842}
3843
3844
3845/**
3846 * Implements SYSCALL (AMD and Intel64).
3847 *
3848 * @param enmEffOpSize The effective operand size.
3849 */
3850IEM_CIMPL_DEF_0(iemCImpl_syscall)
3851{
3852 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3853
3854 /*
3855 * Check preconditions.
3856 *
3857 * Note that CPUs described in the documentation may load a few odd values
3858 * into CS and SS than we allow here. This has yet to be checked on real
3859 * hardware.
3860 */
3861 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3862 {
3863 Log(("syscall: Not enabled in EFER -> #UD\n"));
3864 return iemRaiseUndefinedOpcode(pVCpu);
3865 }
3866 if (!(pCtx->cr0 & X86_CR0_PE))
3867 {
3868 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3869 return iemRaiseGeneralProtectionFault0(pVCpu);
3870 }
3871 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3872 {
3873 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3874 return iemRaiseUndefinedOpcode(pVCpu);
3875 }
3876
3877 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3878 /** @todo what about LDT selectors? Shouldn't matter, really. */
3879 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3880 uint16_t uNewSs = uNewCs + 8;
3881 if (uNewCs == 0 || uNewSs == 0)
3882 {
3883 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3884 return iemRaiseGeneralProtectionFault0(pVCpu);
3885 }
3886
3887 /* Long mode and legacy mode differs. */
3888 if (CPUMIsGuestInLongModeEx(pCtx))
3889 {
3890 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3891
3892 /* This test isn't in the docs, but I'm not trusting the guys writing
3893 the MSRs to have validated the values as canonical like they should. */
3894 if (!IEM_IS_CANONICAL(uNewRip))
3895 {
3896 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3897 return iemRaiseUndefinedOpcode(pVCpu);
3898 }
3899
3900 /*
3901 * Commit it.
3902 */
3903 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3904 pCtx->rcx = pCtx->rip + cbInstr;
3905 pCtx->rip = uNewRip;
3906
3907 pCtx->rflags.u &= ~X86_EFL_RF;
3908 pCtx->r11 = pCtx->rflags.u;
3909 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3910 pCtx->rflags.u |= X86_EFL_1;
3911
3912 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3913 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3914 }
3915 else
3916 {
3917 /*
3918 * Commit it.
3919 */
3920 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3921 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3922 pCtx->rcx = pCtx->eip + cbInstr;
3923 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3924 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3925
3926 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3927 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3928 }
3929 pCtx->cs.Sel = uNewCs;
3930 pCtx->cs.ValidSel = uNewCs;
3931 pCtx->cs.u64Base = 0;
3932 pCtx->cs.u32Limit = UINT32_MAX;
3933 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3934
3935 pCtx->ss.Sel = uNewSs;
3936 pCtx->ss.ValidSel = uNewSs;
3937 pCtx->ss.u64Base = 0;
3938 pCtx->ss.u32Limit = UINT32_MAX;
3939 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3940
3941 /* Flush the prefetch buffer. */
3942#ifdef IEM_WITH_CODE_TLB
3943 pVCpu->iem.s.pbInstrBuf = NULL;
3944#else
3945 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3946#endif
3947
3948 return VINF_SUCCESS;
3949}
3950
3951
3952/**
3953 * Implements SYSRET (AMD and Intel64).
3954 */
3955IEM_CIMPL_DEF_0(iemCImpl_sysret)
3956
3957{
3958 RT_NOREF_PV(cbInstr);
3959 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3960
3961 /*
3962 * Check preconditions.
3963 *
3964 * Note that CPUs described in the documentation may load a few odd values
3965 * into CS and SS than we allow here. This has yet to be checked on real
3966 * hardware.
3967 */
3968 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3969 {
3970 Log(("sysret: Not enabled in EFER -> #UD\n"));
3971 return iemRaiseUndefinedOpcode(pVCpu);
3972 }
3973 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3974 {
3975 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3976 return iemRaiseUndefinedOpcode(pVCpu);
3977 }
3978 if (!(pCtx->cr0 & X86_CR0_PE))
3979 {
3980 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3981 return iemRaiseGeneralProtectionFault0(pVCpu);
3982 }
3983 if (pVCpu->iem.s.uCpl != 0)
3984 {
3985 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3986 return iemRaiseGeneralProtectionFault0(pVCpu);
3987 }
3988
3989 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3990 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3991 uint16_t uNewSs = uNewCs + 8;
3992 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3993 uNewCs += 16;
3994 if (uNewCs == 0 || uNewSs == 0)
3995 {
3996 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3997 return iemRaiseGeneralProtectionFault0(pVCpu);
3998 }
3999
4000 /*
4001 * Commit it.
4002 */
4003 if (CPUMIsGuestInLongModeEx(pCtx))
4004 {
4005 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4006 {
4007 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4008 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
4009 /* Note! We disregard intel manual regarding the RCX cananonical
4010 check, ask intel+xen why AMD doesn't do it. */
4011 pCtx->rip = pCtx->rcx;
4012 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4013 | (3 << X86DESCATTR_DPL_SHIFT);
4014 }
4015 else
4016 {
4017 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4018 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
4019 pCtx->rip = pCtx->ecx;
4020 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4021 | (3 << X86DESCATTR_DPL_SHIFT);
4022 }
4023 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4024 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4025 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4026 pCtx->rflags.u |= X86_EFL_1;
4027 }
4028 else
4029 {
4030 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
4031 pCtx->rip = pCtx->rcx;
4032 pCtx->rflags.u |= X86_EFL_IF;
4033 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4034 | (3 << X86DESCATTR_DPL_SHIFT);
4035 }
4036 pCtx->cs.Sel = uNewCs | 3;
4037 pCtx->cs.ValidSel = uNewCs | 3;
4038 pCtx->cs.u64Base = 0;
4039 pCtx->cs.u32Limit = UINT32_MAX;
4040 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
4041
4042 pCtx->ss.Sel = uNewSs | 3;
4043 pCtx->ss.ValidSel = uNewSs | 3;
4044 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
4045 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4046 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4047 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4048 * on sysret. */
4049
4050 /* Flush the prefetch buffer. */
4051#ifdef IEM_WITH_CODE_TLB
4052 pVCpu->iem.s.pbInstrBuf = NULL;
4053#else
4054 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4055#endif
4056
4057 return VINF_SUCCESS;
4058}
4059
4060
4061/**
4062 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4063 *
4064 * @param iSegReg The segment register number (valid).
4065 * @param uSel The new selector value.
4066 */
4067IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4068{
4069 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4070 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4071 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4072
4073 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4074
4075 /*
4076 * Real mode and V8086 mode are easy.
4077 */
4078 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
4079 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
4080 {
4081 *pSel = uSel;
4082 pHid->u64Base = (uint32_t)uSel << 4;
4083 pHid->ValidSel = uSel;
4084 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4085#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4086 /** @todo Does the CPU actually load limits and attributes in the
4087 * real/V8086 mode segment load case? It doesn't for CS in far
4088 * jumps... Affects unreal mode. */
4089 pHid->u32Limit = 0xffff;
4090 pHid->Attr.u = 0;
4091 pHid->Attr.n.u1Present = 1;
4092 pHid->Attr.n.u1DescType = 1;
4093 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4094 ? X86_SEL_TYPE_RW
4095 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4096#endif
4097 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4098 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4099 return VINF_SUCCESS;
4100 }
4101
4102 /*
4103 * Protected mode.
4104 *
4105 * Check if it's a null segment selector value first, that's OK for DS, ES,
4106 * FS and GS. If not null, then we have to load and parse the descriptor.
4107 */
4108 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4109 {
4110 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4111 if (iSegReg == X86_SREG_SS)
4112 {
4113 /* In 64-bit kernel mode, the stack can be 0 because of the way
4114 interrupts are dispatched. AMD seems to have a slighly more
4115 relaxed relationship to SS.RPL than intel does. */
4116 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4117 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4118 || pVCpu->iem.s.uCpl > 2
4119 || ( uSel != pVCpu->iem.s.uCpl
4120 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4121 {
4122 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4123 return iemRaiseGeneralProtectionFault0(pVCpu);
4124 }
4125 }
4126
4127 *pSel = uSel; /* Not RPL, remember :-) */
4128 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4129 if (iSegReg == X86_SREG_SS)
4130 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4131
4132 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4133 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4134
4135 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4136 return VINF_SUCCESS;
4137 }
4138
4139 /* Fetch the descriptor. */
4140 IEMSELDESC Desc;
4141 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4142 if (rcStrict != VINF_SUCCESS)
4143 return rcStrict;
4144
4145 /* Check GPs first. */
4146 if (!Desc.Legacy.Gen.u1DescType)
4147 {
4148 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4149 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4150 }
4151 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4152 {
4153 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4154 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4155 {
4156 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4157 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4158 }
4159 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4160 {
4161 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4162 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4163 }
4164 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4165 {
4166 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4167 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4168 }
4169 }
4170 else
4171 {
4172 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4173 {
4174 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4175 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4176 }
4177 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4178 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4179 {
4180#if 0 /* this is what intel says. */
4181 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4182 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4183 {
4184 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4185 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4186 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4187 }
4188#else /* this is what makes more sense. */
4189 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4190 {
4191 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4192 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4193 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4194 }
4195 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4196 {
4197 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4198 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4199 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4200 }
4201#endif
4202 }
4203 }
4204
4205 /* Is it there? */
4206 if (!Desc.Legacy.Gen.u1Present)
4207 {
4208 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4209 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4210 }
4211
4212 /* The base and limit. */
4213 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4214 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4215
4216 /*
4217 * Ok, everything checked out fine. Now set the accessed bit before
4218 * committing the result into the registers.
4219 */
4220 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4221 {
4222 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4223 if (rcStrict != VINF_SUCCESS)
4224 return rcStrict;
4225 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4226 }
4227
4228 /* commit */
4229 *pSel = uSel;
4230 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4231 pHid->u32Limit = cbLimit;
4232 pHid->u64Base = u64Base;
4233 pHid->ValidSel = uSel;
4234 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4235
4236 /** @todo check if the hidden bits are loaded correctly for 64-bit
4237 * mode. */
4238 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4239
4240 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4241 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4242 return VINF_SUCCESS;
4243}
4244
4245
4246/**
4247 * Implements 'mov SReg, r/m'.
4248 *
4249 * @param iSegReg The segment register number (valid).
4250 * @param uSel The new selector value.
4251 */
4252IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4253{
4254 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4255 if (rcStrict == VINF_SUCCESS)
4256 {
4257 if (iSegReg == X86_SREG_SS)
4258 {
4259 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4260 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4261 }
4262 }
4263 return rcStrict;
4264}
4265
4266
4267/**
4268 * Implements 'pop SReg'.
4269 *
4270 * @param iSegReg The segment register number (valid).
4271 * @param enmEffOpSize The efficient operand size (valid).
4272 */
4273IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4274{
4275 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4276 VBOXSTRICTRC rcStrict;
4277
4278 /*
4279 * Read the selector off the stack and join paths with mov ss, reg.
4280 */
4281 RTUINT64U TmpRsp;
4282 TmpRsp.u = pCtx->rsp;
4283 switch (enmEffOpSize)
4284 {
4285 case IEMMODE_16BIT:
4286 {
4287 uint16_t uSel;
4288 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4289 if (rcStrict == VINF_SUCCESS)
4290 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4291 break;
4292 }
4293
4294 case IEMMODE_32BIT:
4295 {
4296 uint32_t u32Value;
4297 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4298 if (rcStrict == VINF_SUCCESS)
4299 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4300 break;
4301 }
4302
4303 case IEMMODE_64BIT:
4304 {
4305 uint64_t u64Value;
4306 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4307 if (rcStrict == VINF_SUCCESS)
4308 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4309 break;
4310 }
4311 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4312 }
4313
4314 /*
4315 * Commit the stack on success.
4316 */
4317 if (rcStrict == VINF_SUCCESS)
4318 {
4319 pCtx->rsp = TmpRsp.u;
4320 if (iSegReg == X86_SREG_SS)
4321 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4322 }
4323 return rcStrict;
4324}
4325
4326
4327/**
4328 * Implements lgs, lfs, les, lds & lss.
4329 */
4330IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4331 uint16_t, uSel,
4332 uint64_t, offSeg,
4333 uint8_t, iSegReg,
4334 uint8_t, iGReg,
4335 IEMMODE, enmEffOpSize)
4336{
4337 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4338 VBOXSTRICTRC rcStrict;
4339
4340 /*
4341 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4342 */
4343 /** @todo verify and test that mov, pop and lXs works the segment
4344 * register loading in the exact same way. */
4345 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4346 if (rcStrict == VINF_SUCCESS)
4347 {
4348 switch (enmEffOpSize)
4349 {
4350 case IEMMODE_16BIT:
4351 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4352 break;
4353 case IEMMODE_32BIT:
4354 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4355 break;
4356 case IEMMODE_64BIT:
4357 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4358 break;
4359 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4360 }
4361 }
4362
4363 return rcStrict;
4364}
4365
4366
4367/**
4368 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4369 *
4370 * @retval VINF_SUCCESS on success.
4371 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4372 * @retval iemMemFetchSysU64 return value.
4373 *
4374 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4375 * @param uSel The selector value.
4376 * @param fAllowSysDesc Whether system descriptors are OK or not.
4377 * @param pDesc Where to return the descriptor on success.
4378 */
4379static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4380{
4381 pDesc->Long.au64[0] = 0;
4382 pDesc->Long.au64[1] = 0;
4383
4384 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4385 return VINF_IEM_SELECTOR_NOT_OK;
4386
4387 /* Within the table limits? */
4388 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4389 RTGCPTR GCPtrBase;
4390 if (uSel & X86_SEL_LDT)
4391 {
4392 if ( !pCtx->ldtr.Attr.n.u1Present
4393 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4394 return VINF_IEM_SELECTOR_NOT_OK;
4395 GCPtrBase = pCtx->ldtr.u64Base;
4396 }
4397 else
4398 {
4399 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4400 return VINF_IEM_SELECTOR_NOT_OK;
4401 GCPtrBase = pCtx->gdtr.pGdt;
4402 }
4403
4404 /* Fetch the descriptor. */
4405 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4406 if (rcStrict != VINF_SUCCESS)
4407 return rcStrict;
4408 if (!pDesc->Legacy.Gen.u1DescType)
4409 {
4410 if (!fAllowSysDesc)
4411 return VINF_IEM_SELECTOR_NOT_OK;
4412 if (CPUMIsGuestInLongModeEx(pCtx))
4413 {
4414 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4415 if (rcStrict != VINF_SUCCESS)
4416 return rcStrict;
4417 }
4418
4419 }
4420
4421 return VINF_SUCCESS;
4422}
4423
4424
4425/**
4426 * Implements verr (fWrite = false) and verw (fWrite = true).
4427 */
4428IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4429{
4430 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4431
4432 /** @todo figure whether the accessed bit is set or not. */
4433
4434 bool fAccessible = true;
4435 IEMSELDESC Desc;
4436 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4437 if (rcStrict == VINF_SUCCESS)
4438 {
4439 /* Check the descriptor, order doesn't matter much here. */
4440 if ( !Desc.Legacy.Gen.u1DescType
4441 || !Desc.Legacy.Gen.u1Present)
4442 fAccessible = false;
4443 else
4444 {
4445 if ( fWrite
4446 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4447 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4448 fAccessible = false;
4449
4450 /** @todo testcase for the conforming behavior. */
4451 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4452 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4453 {
4454 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4455 fAccessible = false;
4456 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4457 fAccessible = false;
4458 }
4459 }
4460
4461 }
4462 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4463 fAccessible = false;
4464 else
4465 return rcStrict;
4466
4467 /* commit */
4468 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4469
4470 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4471 return VINF_SUCCESS;
4472}
4473
4474
4475/**
4476 * Implements LAR and LSL with 64-bit operand size.
4477 *
4478 * @returns VINF_SUCCESS.
4479 * @param pu16Dst Pointer to the destination register.
4480 * @param uSel The selector to load details for.
4481 * @param fIsLar true = LAR, false = LSL.
4482 */
4483IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4484{
4485 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4486
4487 /** @todo figure whether the accessed bit is set or not. */
4488
4489 bool fDescOk = true;
4490 IEMSELDESC Desc;
4491 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4492 if (rcStrict == VINF_SUCCESS)
4493 {
4494 /*
4495 * Check the descriptor type.
4496 */
4497 if (!Desc.Legacy.Gen.u1DescType)
4498 {
4499 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4500 {
4501 if (Desc.Long.Gen.u5Zeros)
4502 fDescOk = false;
4503 else
4504 switch (Desc.Long.Gen.u4Type)
4505 {
4506 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4507 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4508 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4509 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4510 break;
4511 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4512 fDescOk = fIsLar;
4513 break;
4514 default:
4515 fDescOk = false;
4516 break;
4517 }
4518 }
4519 else
4520 {
4521 switch (Desc.Long.Gen.u4Type)
4522 {
4523 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4524 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4525 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4526 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4527 case X86_SEL_TYPE_SYS_LDT:
4528 break;
4529 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4530 case X86_SEL_TYPE_SYS_TASK_GATE:
4531 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4532 fDescOk = fIsLar;
4533 break;
4534 default:
4535 fDescOk = false;
4536 break;
4537 }
4538 }
4539 }
4540 if (fDescOk)
4541 {
4542 /*
4543 * Check the RPL/DPL/CPL interaction..
4544 */
4545 /** @todo testcase for the conforming behavior. */
4546 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4547 || !Desc.Legacy.Gen.u1DescType)
4548 {
4549 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4550 fDescOk = false;
4551 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4552 fDescOk = false;
4553 }
4554 }
4555
4556 if (fDescOk)
4557 {
4558 /*
4559 * All fine, start committing the result.
4560 */
4561 if (fIsLar)
4562 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4563 else
4564 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4565 }
4566
4567 }
4568 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4569 fDescOk = false;
4570 else
4571 return rcStrict;
4572
4573 /* commit flags value and advance rip. */
4574 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4575 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4576
4577 return VINF_SUCCESS;
4578}
4579
4580
4581/**
4582 * Implements LAR and LSL with 16-bit operand size.
4583 *
4584 * @returns VINF_SUCCESS.
4585 * @param pu16Dst Pointer to the destination register.
4586 * @param u16Sel The selector to load details for.
4587 * @param fIsLar true = LAR, false = LSL.
4588 */
4589IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4590{
4591 uint64_t u64TmpDst = *pu16Dst;
4592 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4593 *pu16Dst = u64TmpDst;
4594 return VINF_SUCCESS;
4595}
4596
4597
4598/**
4599 * Implements lgdt.
4600 *
4601 * @param iEffSeg The segment of the new gdtr contents
4602 * @param GCPtrEffSrc The address of the new gdtr contents.
4603 * @param enmEffOpSize The effective operand size.
4604 */
4605IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4606{
4607 if (pVCpu->iem.s.uCpl != 0)
4608 return iemRaiseGeneralProtectionFault0(pVCpu);
4609 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4610
4611 /*
4612 * Fetch the limit and base address.
4613 */
4614 uint16_t cbLimit;
4615 RTGCPTR GCPtrBase;
4616 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4617 if (rcStrict == VINF_SUCCESS)
4618 {
4619 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4620 || X86_IS_CANONICAL(GCPtrBase))
4621 {
4622 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4623 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4624 else
4625 {
4626 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4627 pCtx->gdtr.cbGdt = cbLimit;
4628 pCtx->gdtr.pGdt = GCPtrBase;
4629 }
4630 if (rcStrict == VINF_SUCCESS)
4631 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4632 }
4633 else
4634 {
4635 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4636 return iemRaiseGeneralProtectionFault0(pVCpu);
4637 }
4638 }
4639 return rcStrict;
4640}
4641
4642
4643/**
4644 * Implements sgdt.
4645 *
4646 * @param iEffSeg The segment where to store the gdtr content.
4647 * @param GCPtrEffDst The address where to store the gdtr content.
4648 */
4649IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4650{
4651 /*
4652 * Join paths with sidt.
4653 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4654 * you really must know.
4655 */
4656 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4657 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4658 if (rcStrict == VINF_SUCCESS)
4659 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4660 return rcStrict;
4661}
4662
4663
4664/**
4665 * Implements lidt.
4666 *
4667 * @param iEffSeg The segment of the new idtr contents
4668 * @param GCPtrEffSrc The address of the new idtr contents.
4669 * @param enmEffOpSize The effective operand size.
4670 */
4671IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4672{
4673 if (pVCpu->iem.s.uCpl != 0)
4674 return iemRaiseGeneralProtectionFault0(pVCpu);
4675 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4676
4677 /*
4678 * Fetch the limit and base address.
4679 */
4680 uint16_t cbLimit;
4681 RTGCPTR GCPtrBase;
4682 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4683 if (rcStrict == VINF_SUCCESS)
4684 {
4685 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4686 || X86_IS_CANONICAL(GCPtrBase))
4687 {
4688 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4689 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4690 else
4691 {
4692 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4693 pCtx->idtr.cbIdt = cbLimit;
4694 pCtx->idtr.pIdt = GCPtrBase;
4695 }
4696 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4697 }
4698 else
4699 {
4700 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4701 return iemRaiseGeneralProtectionFault0(pVCpu);
4702 }
4703 }
4704 return rcStrict;
4705}
4706
4707
4708/**
4709 * Implements sidt.
4710 *
4711 * @param iEffSeg The segment where to store the idtr content.
4712 * @param GCPtrEffDst The address where to store the idtr content.
4713 */
4714IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4715{
4716 /*
4717 * Join paths with sgdt.
4718 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4719 * you really must know.
4720 */
4721 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4722 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4723 if (rcStrict == VINF_SUCCESS)
4724 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4725 return rcStrict;
4726}
4727
4728
4729/**
4730 * Implements lldt.
4731 *
4732 * @param uNewLdt The new LDT selector value.
4733 */
4734IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4735{
4736 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4737
4738 /*
4739 * Check preconditions.
4740 */
4741 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4742 {
4743 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4744 return iemRaiseUndefinedOpcode(pVCpu);
4745 }
4746 if (pVCpu->iem.s.uCpl != 0)
4747 {
4748 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4749 return iemRaiseGeneralProtectionFault0(pVCpu);
4750 }
4751 if (uNewLdt & X86_SEL_LDT)
4752 {
4753 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4754 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4755 }
4756
4757 /*
4758 * Now, loading a NULL selector is easy.
4759 */
4760 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4761 {
4762 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4763 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4764 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4765 else
4766 pCtx->ldtr.Sel = uNewLdt;
4767 pCtx->ldtr.ValidSel = uNewLdt;
4768 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4769 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4770 {
4771 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4772 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4773 }
4774 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4775 {
4776 /* AMD-V seems to leave the base and limit alone. */
4777 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4778 }
4779 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4780 {
4781 /* VT-x (Intel 3960x) seems to be doing the following. */
4782 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4783 pCtx->ldtr.u64Base = 0;
4784 pCtx->ldtr.u32Limit = UINT32_MAX;
4785 }
4786
4787 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4788 return VINF_SUCCESS;
4789 }
4790
4791 /*
4792 * Read the descriptor.
4793 */
4794 IEMSELDESC Desc;
4795 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4796 if (rcStrict != VINF_SUCCESS)
4797 return rcStrict;
4798
4799 /* Check GPs first. */
4800 if (Desc.Legacy.Gen.u1DescType)
4801 {
4802 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4803 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4804 }
4805 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4806 {
4807 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4808 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4809 }
4810 uint64_t u64Base;
4811 if (!IEM_IS_LONG_MODE(pVCpu))
4812 u64Base = X86DESC_BASE(&Desc.Legacy);
4813 else
4814 {
4815 if (Desc.Long.Gen.u5Zeros)
4816 {
4817 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4818 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4819 }
4820
4821 u64Base = X86DESC64_BASE(&Desc.Long);
4822 if (!IEM_IS_CANONICAL(u64Base))
4823 {
4824 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4825 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4826 }
4827 }
4828
4829 /* NP */
4830 if (!Desc.Legacy.Gen.u1Present)
4831 {
4832 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4833 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4834 }
4835
4836 /*
4837 * It checks out alright, update the registers.
4838 */
4839/** @todo check if the actual value is loaded or if the RPL is dropped */
4840 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4841 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4842 else
4843 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4844 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4845 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4846 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4847 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4848 pCtx->ldtr.u64Base = u64Base;
4849
4850 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4851 return VINF_SUCCESS;
4852}
4853
4854
4855/**
4856 * Implements lldt.
4857 *
4858 * @param uNewLdt The new LDT selector value.
4859 */
4860IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4861{
4862 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4863
4864 /*
4865 * Check preconditions.
4866 */
4867 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4868 {
4869 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4870 return iemRaiseUndefinedOpcode(pVCpu);
4871 }
4872 if (pVCpu->iem.s.uCpl != 0)
4873 {
4874 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4875 return iemRaiseGeneralProtectionFault0(pVCpu);
4876 }
4877 if (uNewTr & X86_SEL_LDT)
4878 {
4879 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4880 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4881 }
4882 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4883 {
4884 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4885 return iemRaiseGeneralProtectionFault0(pVCpu);
4886 }
4887
4888 /*
4889 * Read the descriptor.
4890 */
4891 IEMSELDESC Desc;
4892 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4893 if (rcStrict != VINF_SUCCESS)
4894 return rcStrict;
4895
4896 /* Check GPs first. */
4897 if (Desc.Legacy.Gen.u1DescType)
4898 {
4899 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4900 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4901 }
4902 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4903 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4904 || IEM_IS_LONG_MODE(pVCpu)) )
4905 {
4906 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4907 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4908 }
4909 uint64_t u64Base;
4910 if (!IEM_IS_LONG_MODE(pVCpu))
4911 u64Base = X86DESC_BASE(&Desc.Legacy);
4912 else
4913 {
4914 if (Desc.Long.Gen.u5Zeros)
4915 {
4916 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4917 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4918 }
4919
4920 u64Base = X86DESC64_BASE(&Desc.Long);
4921 if (!IEM_IS_CANONICAL(u64Base))
4922 {
4923 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4924 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4925 }
4926 }
4927
4928 /* NP */
4929 if (!Desc.Legacy.Gen.u1Present)
4930 {
4931 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4932 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
4933 }
4934
4935 /*
4936 * Set it busy.
4937 * Note! Intel says this should lock down the whole descriptor, but we'll
4938 * restrict our selves to 32-bit for now due to lack of inline
4939 * assembly and such.
4940 */
4941 void *pvDesc;
4942 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4943 if (rcStrict != VINF_SUCCESS)
4944 return rcStrict;
4945 switch ((uintptr_t)pvDesc & 3)
4946 {
4947 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4948 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4949 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4950 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4951 }
4952 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
4953 if (rcStrict != VINF_SUCCESS)
4954 return rcStrict;
4955 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4956
4957 /*
4958 * It checks out alright, update the registers.
4959 */
4960/** @todo check if the actual value is loaded or if the RPL is dropped */
4961 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4962 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4963 else
4964 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4965 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4966 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4967 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4968 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4969 pCtx->tr.u64Base = u64Base;
4970
4971 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4972 return VINF_SUCCESS;
4973}
4974
4975
4976/**
4977 * Implements mov GReg,CRx.
4978 *
4979 * @param iGReg The general register to store the CRx value in.
4980 * @param iCrReg The CRx register to read (valid).
4981 */
4982IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4983{
4984 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4985 if (pVCpu->iem.s.uCpl != 0)
4986 return iemRaiseGeneralProtectionFault0(pVCpu);
4987 Assert(!pCtx->eflags.Bits.u1VM);
4988
4989 /* read it */
4990 uint64_t crX;
4991 switch (iCrReg)
4992 {
4993 case 0:
4994 crX = pCtx->cr0;
4995 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
4996 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4997 break;
4998 case 2: crX = pCtx->cr2; break;
4999 case 3: crX = pCtx->cr3; break;
5000 case 4: crX = pCtx->cr4; break;
5001 case 8:
5002 {
5003 uint8_t uTpr;
5004 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5005 if (RT_SUCCESS(rc))
5006 crX = uTpr >> 4;
5007 else
5008 crX = 0;
5009 break;
5010 }
5011 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5012 }
5013
5014 /* store it */
5015 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5016 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5017 else
5018 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5019
5020 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5021 return VINF_SUCCESS;
5022}
5023
5024
5025/**
5026 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5027 *
5028 * @param iCrReg The CRx register to write (valid).
5029 * @param uNewCrX The new value.
5030 */
5031IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
5032{
5033 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5034 VBOXSTRICTRC rcStrict;
5035 int rc;
5036
5037 /*
5038 * Try store it.
5039 * Unfortunately, CPUM only does a tiny bit of the work.
5040 */
5041 switch (iCrReg)
5042 {
5043 case 0:
5044 {
5045 /*
5046 * Perform checks.
5047 */
5048 uint64_t const uOldCrX = pCtx->cr0;
5049 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
5050 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
5051 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
5052
5053 /* ET is hardcoded on 486 and later. */
5054 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5055 uNewCrX |= X86_CR0_ET;
5056 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5057 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5058 {
5059 uNewCrX &= fValid;
5060 uNewCrX |= X86_CR0_ET;
5061 }
5062 else
5063 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5064
5065 /* Check for reserved bits. */
5066 if (uNewCrX & ~(uint64_t)fValid)
5067 {
5068 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5069 return iemRaiseGeneralProtectionFault0(pVCpu);
5070 }
5071
5072 /* Check for invalid combinations. */
5073 if ( (uNewCrX & X86_CR0_PG)
5074 && !(uNewCrX & X86_CR0_PE) )
5075 {
5076 Log(("Trying to set CR0.PG without CR0.PE\n"));
5077 return iemRaiseGeneralProtectionFault0(pVCpu);
5078 }
5079
5080 if ( !(uNewCrX & X86_CR0_CD)
5081 && (uNewCrX & X86_CR0_NW) )
5082 {
5083 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5084 return iemRaiseGeneralProtectionFault0(pVCpu);
5085 }
5086
5087 /* Long mode consistency checks. */
5088 if ( (uNewCrX & X86_CR0_PG)
5089 && !(uOldCrX & X86_CR0_PG)
5090 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5091 {
5092 if (!(pCtx->cr4 & X86_CR4_PAE))
5093 {
5094 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5095 return iemRaiseGeneralProtectionFault0(pVCpu);
5096 }
5097 if (pCtx->cs.Attr.n.u1Long)
5098 {
5099 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5100 return iemRaiseGeneralProtectionFault0(pVCpu);
5101 }
5102 }
5103
5104 /** @todo check reserved PDPTR bits as AMD states. */
5105
5106 /*
5107 * Change CR0.
5108 */
5109 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5110 CPUMSetGuestCR0(pVCpu, uNewCrX);
5111 else
5112 pCtx->cr0 = uNewCrX;
5113 Assert(pCtx->cr0 == uNewCrX);
5114
5115 /*
5116 * Change EFER.LMA if entering or leaving long mode.
5117 */
5118 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5119 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5120 {
5121 uint64_t NewEFER = pCtx->msrEFER;
5122 if (uNewCrX & X86_CR0_PG)
5123 NewEFER |= MSR_K6_EFER_LMA;
5124 else
5125 NewEFER &= ~MSR_K6_EFER_LMA;
5126
5127 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5128 CPUMSetGuestEFER(pVCpu, NewEFER);
5129 else
5130 pCtx->msrEFER = NewEFER;
5131 Assert(pCtx->msrEFER == NewEFER);
5132 }
5133
5134 /*
5135 * Inform PGM.
5136 */
5137 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5138 {
5139 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5140 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5141 {
5142 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5143 AssertRCReturn(rc, rc);
5144 /* ignore informational status codes */
5145 }
5146 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5147 }
5148 else
5149 rcStrict = VINF_SUCCESS;
5150
5151#ifdef IN_RC
5152 /* Return to ring-3 for rescheduling if WP or AM changes. */
5153 if ( rcStrict == VINF_SUCCESS
5154 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5155 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5156 rcStrict = VINF_EM_RESCHEDULE;
5157#endif
5158 break;
5159 }
5160
5161 /*
5162 * CR2 can be changed without any restrictions.
5163 */
5164 case 2:
5165 pCtx->cr2 = uNewCrX;
5166 rcStrict = VINF_SUCCESS;
5167 break;
5168
5169 /*
5170 * CR3 is relatively simple, although AMD and Intel have different
5171 * accounts of how setting reserved bits are handled. We take intel's
5172 * word for the lower bits and AMD's for the high bits (63:52). The
5173 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5174 * on this.
5175 */
5176 /** @todo Testcase: Setting reserved bits in CR3, especially before
5177 * enabling paging. */
5178 case 3:
5179 {
5180 /* check / mask the value. */
5181 if (uNewCrX & UINT64_C(0xfff0000000000000))
5182 {
5183 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5184 return iemRaiseGeneralProtectionFault0(pVCpu);
5185 }
5186
5187 uint64_t fValid;
5188 if ( (pCtx->cr4 & X86_CR4_PAE)
5189 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5190 fValid = UINT64_C(0x000fffffffffffff);
5191 else
5192 fValid = UINT64_C(0xffffffff);
5193 if (uNewCrX & ~fValid)
5194 {
5195 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5196 uNewCrX, uNewCrX & ~fValid));
5197 uNewCrX &= fValid;
5198 }
5199
5200 /** @todo If we're in PAE mode we should check the PDPTRs for
5201 * invalid bits. */
5202
5203 /* Make the change. */
5204 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5205 {
5206 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5207 AssertRCSuccessReturn(rc, rc);
5208 }
5209 else
5210 pCtx->cr3 = uNewCrX;
5211
5212 /* Inform PGM. */
5213 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5214 {
5215 if (pCtx->cr0 & X86_CR0_PG)
5216 {
5217 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5218 AssertRCReturn(rc, rc);
5219 /* ignore informational status codes */
5220 }
5221 }
5222 rcStrict = VINF_SUCCESS;
5223 break;
5224 }
5225
5226 /*
5227 * CR4 is a bit more tedious as there are bits which cannot be cleared
5228 * under some circumstances and such.
5229 */
5230 case 4:
5231 {
5232 uint64_t const uOldCrX = pCtx->cr4;
5233
5234 /** @todo Shouldn't this look at the guest CPUID bits to determine
5235 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5236 * should #GP(0). */
5237 /* reserved bits */
5238 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5239 | X86_CR4_TSD | X86_CR4_DE
5240 | X86_CR4_PSE | X86_CR4_PAE
5241 | X86_CR4_MCE | X86_CR4_PGE
5242 | X86_CR4_PCE | X86_CR4_OSFXSR
5243 | X86_CR4_OSXMMEEXCPT;
5244 //if (xxx)
5245 // fValid |= X86_CR4_VMXE;
5246 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5247 fValid |= X86_CR4_OSXSAVE;
5248 if (uNewCrX & ~(uint64_t)fValid)
5249 {
5250 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5251 return iemRaiseGeneralProtectionFault0(pVCpu);
5252 }
5253
5254 /* long mode checks. */
5255 if ( (uOldCrX & X86_CR4_PAE)
5256 && !(uNewCrX & X86_CR4_PAE)
5257 && CPUMIsGuestInLongModeEx(pCtx) )
5258 {
5259 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5260 return iemRaiseGeneralProtectionFault0(pVCpu);
5261 }
5262
5263
5264 /*
5265 * Change it.
5266 */
5267 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5268 {
5269 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5270 AssertRCSuccessReturn(rc, rc);
5271 }
5272 else
5273 pCtx->cr4 = uNewCrX;
5274 Assert(pCtx->cr4 == uNewCrX);
5275
5276 /*
5277 * Notify SELM and PGM.
5278 */
5279 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5280 {
5281 /* SELM - VME may change things wrt to the TSS shadowing. */
5282 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5283 {
5284 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5285 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5286#ifdef VBOX_WITH_RAW_MODE
5287 if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
5288 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5289#endif
5290 }
5291
5292 /* PGM - flushing and mode. */
5293 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
5294 {
5295 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5296 AssertRCReturn(rc, rc);
5297 /* ignore informational status codes */
5298 }
5299 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5300 }
5301 else
5302 rcStrict = VINF_SUCCESS;
5303 break;
5304 }
5305
5306 /*
5307 * CR8 maps to the APIC TPR.
5308 */
5309 case 8:
5310 if (uNewCrX & ~(uint64_t)0xf)
5311 {
5312 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5313 return iemRaiseGeneralProtectionFault0(pVCpu);
5314 }
5315
5316 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5317 APICSetTpr(pVCpu, (uint8_t)uNewCrX << 4);
5318 rcStrict = VINF_SUCCESS;
5319 break;
5320
5321 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5322 }
5323
5324 /*
5325 * Advance the RIP on success.
5326 */
5327 if (RT_SUCCESS(rcStrict))
5328 {
5329 if (rcStrict != VINF_SUCCESS)
5330 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5331 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5332 }
5333
5334 return rcStrict;
5335}
5336
5337
5338/**
5339 * Implements mov CRx,GReg.
5340 *
5341 * @param iCrReg The CRx register to write (valid).
5342 * @param iGReg The general register to load the DRx value from.
5343 */
5344IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5345{
5346 if (pVCpu->iem.s.uCpl != 0)
5347 return iemRaiseGeneralProtectionFault0(pVCpu);
5348 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5349
5350 /*
5351 * Read the new value from the source register and call common worker.
5352 */
5353 uint64_t uNewCrX;
5354 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5355 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5356 else
5357 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5358 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5359}
5360
5361
5362/**
5363 * Implements 'LMSW r/m16'
5364 *
5365 * @param u16NewMsw The new value.
5366 */
5367IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5368{
5369 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5370
5371 if (pVCpu->iem.s.uCpl != 0)
5372 return iemRaiseGeneralProtectionFault0(pVCpu);
5373 Assert(!pCtx->eflags.Bits.u1VM);
5374
5375 /*
5376 * Compose the new CR0 value and call common worker.
5377 */
5378 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5379 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5380 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5381}
5382
5383
5384/**
5385 * Implements 'CLTS'.
5386 */
5387IEM_CIMPL_DEF_0(iemCImpl_clts)
5388{
5389 if (pVCpu->iem.s.uCpl != 0)
5390 return iemRaiseGeneralProtectionFault0(pVCpu);
5391
5392 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5393 uint64_t uNewCr0 = pCtx->cr0;
5394 uNewCr0 &= ~X86_CR0_TS;
5395 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5396}
5397
5398
5399/**
5400 * Implements mov GReg,DRx.
5401 *
5402 * @param iGReg The general register to store the DRx value in.
5403 * @param iDrReg The DRx register to read (0-7).
5404 */
5405IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5406{
5407 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5408
5409 /*
5410 * Check preconditions.
5411 */
5412
5413 /* Raise GPs. */
5414 if (pVCpu->iem.s.uCpl != 0)
5415 return iemRaiseGeneralProtectionFault0(pVCpu);
5416 Assert(!pCtx->eflags.Bits.u1VM);
5417
5418 if ( (iDrReg == 4 || iDrReg == 5)
5419 && (pCtx->cr4 & X86_CR4_DE) )
5420 {
5421 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5422 return iemRaiseGeneralProtectionFault0(pVCpu);
5423 }
5424
5425 /* Raise #DB if general access detect is enabled. */
5426 if (pCtx->dr[7] & X86_DR7_GD)
5427 {
5428 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5429 return iemRaiseDebugException(pVCpu);
5430 }
5431
5432 /*
5433 * Read the debug register and store it in the specified general register.
5434 */
5435 uint64_t drX;
5436 switch (iDrReg)
5437 {
5438 case 0: drX = pCtx->dr[0]; break;
5439 case 1: drX = pCtx->dr[1]; break;
5440 case 2: drX = pCtx->dr[2]; break;
5441 case 3: drX = pCtx->dr[3]; break;
5442 case 6:
5443 case 4:
5444 drX = pCtx->dr[6];
5445 drX |= X86_DR6_RA1_MASK;
5446 drX &= ~X86_DR6_RAZ_MASK;
5447 break;
5448 case 7:
5449 case 5:
5450 drX = pCtx->dr[7];
5451 drX |=X86_DR7_RA1_MASK;
5452 drX &= ~X86_DR7_RAZ_MASK;
5453 break;
5454 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5455 }
5456
5457 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5458 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5459 else
5460 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5461
5462 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5463 return VINF_SUCCESS;
5464}
5465
5466
5467/**
5468 * Implements mov DRx,GReg.
5469 *
5470 * @param iDrReg The DRx register to write (valid).
5471 * @param iGReg The general register to load the DRx value from.
5472 */
5473IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5474{
5475 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5476
5477 /*
5478 * Check preconditions.
5479 */
5480 if (pVCpu->iem.s.uCpl != 0)
5481 return iemRaiseGeneralProtectionFault0(pVCpu);
5482 Assert(!pCtx->eflags.Bits.u1VM);
5483
5484 if (iDrReg == 4 || iDrReg == 5)
5485 {
5486 if (pCtx->cr4 & X86_CR4_DE)
5487 {
5488 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5489 return iemRaiseGeneralProtectionFault0(pVCpu);
5490 }
5491 iDrReg += 2;
5492 }
5493
5494 /* Raise #DB if general access detect is enabled. */
5495 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5496 * \#GP? */
5497 if (pCtx->dr[7] & X86_DR7_GD)
5498 {
5499 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5500 return iemRaiseDebugException(pVCpu);
5501 }
5502
5503 /*
5504 * Read the new value from the source register.
5505 */
5506 uint64_t uNewDrX;
5507 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5508 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5509 else
5510 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5511
5512 /*
5513 * Adjust it.
5514 */
5515 switch (iDrReg)
5516 {
5517 case 0:
5518 case 1:
5519 case 2:
5520 case 3:
5521 /* nothing to adjust */
5522 break;
5523
5524 case 6:
5525 if (uNewDrX & X86_DR6_MBZ_MASK)
5526 {
5527 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5528 return iemRaiseGeneralProtectionFault0(pVCpu);
5529 }
5530 uNewDrX |= X86_DR6_RA1_MASK;
5531 uNewDrX &= ~X86_DR6_RAZ_MASK;
5532 break;
5533
5534 case 7:
5535 if (uNewDrX & X86_DR7_MBZ_MASK)
5536 {
5537 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5538 return iemRaiseGeneralProtectionFault0(pVCpu);
5539 }
5540 uNewDrX |= X86_DR7_RA1_MASK;
5541 uNewDrX &= ~X86_DR7_RAZ_MASK;
5542 break;
5543
5544 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5545 }
5546
5547 /*
5548 * Do the actual setting.
5549 */
5550 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5551 {
5552 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5553 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5554 }
5555 else
5556 pCtx->dr[iDrReg] = uNewDrX;
5557
5558 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5559 return VINF_SUCCESS;
5560}
5561
5562
5563/**
5564 * Implements 'INVLPG m'.
5565 *
5566 * @param GCPtrPage The effective address of the page to invalidate.
5567 * @remarks Updates the RIP.
5568 */
5569IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5570{
5571 /* ring-0 only. */
5572 if (pVCpu->iem.s.uCpl != 0)
5573 return iemRaiseGeneralProtectionFault0(pVCpu);
5574 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5575
5576 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5577 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5578
5579 if (rc == VINF_SUCCESS)
5580 return VINF_SUCCESS;
5581 if (rc == VINF_PGM_SYNC_CR3)
5582 return iemSetPassUpStatus(pVCpu, rc);
5583
5584 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5585 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5586 return rc;
5587}
5588
5589
5590/**
5591 * Implements RDTSC.
5592 */
5593IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5594{
5595 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5596
5597 /*
5598 * Check preconditions.
5599 */
5600 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5601 return iemRaiseUndefinedOpcode(pVCpu);
5602
5603 if ( (pCtx->cr4 & X86_CR4_TSD)
5604 && pVCpu->iem.s.uCpl != 0)
5605 {
5606 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5607 return iemRaiseGeneralProtectionFault0(pVCpu);
5608 }
5609
5610 /*
5611 * Do the job.
5612 */
5613 uint64_t uTicks = TMCpuTickGet(pVCpu);
5614 pCtx->rax = (uint32_t)uTicks;
5615 pCtx->rdx = uTicks >> 32;
5616#ifdef IEM_VERIFICATION_MODE_FULL
5617 pVCpu->iem.s.fIgnoreRaxRdx = true;
5618#endif
5619
5620 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5621 return VINF_SUCCESS;
5622}
5623
5624
5625/**
5626 * Implements RDMSR.
5627 */
5628IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5629{
5630 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5631
5632 /*
5633 * Check preconditions.
5634 */
5635 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5636 return iemRaiseUndefinedOpcode(pVCpu);
5637 if (pVCpu->iem.s.uCpl != 0)
5638 return iemRaiseGeneralProtectionFault0(pVCpu);
5639
5640 /*
5641 * Do the job.
5642 */
5643 RTUINT64U uValue;
5644 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
5645 if (rcStrict == VINF_SUCCESS)
5646 {
5647 pCtx->rax = uValue.s.Lo;
5648 pCtx->rdx = uValue.s.Hi;
5649
5650 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5651 return VINF_SUCCESS;
5652 }
5653
5654#ifndef IN_RING3
5655 /* Deferred to ring-3. */
5656 if (rcStrict == VINF_CPUM_R3_MSR_READ)
5657 {
5658 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5659 return rcStrict;
5660 }
5661#else /* IN_RING3 */
5662 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5663 static uint32_t s_cTimes = 0;
5664 if (s_cTimes++ < 10)
5665 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5666 else
5667#endif
5668 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5669 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5670 return iemRaiseGeneralProtectionFault0(pVCpu);
5671}
5672
5673
5674/**
5675 * Implements WRMSR.
5676 */
5677IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5678{
5679 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5680
5681 /*
5682 * Check preconditions.
5683 */
5684 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5685 return iemRaiseUndefinedOpcode(pVCpu);
5686 if (pVCpu->iem.s.uCpl != 0)
5687 return iemRaiseGeneralProtectionFault0(pVCpu);
5688
5689 /*
5690 * Do the job.
5691 */
5692 RTUINT64U uValue;
5693 uValue.s.Lo = pCtx->eax;
5694 uValue.s.Hi = pCtx->edx;
5695
5696 VBOXSTRICTRC rcStrict;
5697 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5698 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5699 else
5700 {
5701#ifdef IN_RING3
5702 CPUMCTX CtxTmp = *pCtx;
5703 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5704 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
5705 *pCtx = *pCtx2;
5706 *pCtx2 = CtxTmp;
5707#else
5708 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5709#endif
5710 }
5711 if (rcStrict == VINF_SUCCESS)
5712 {
5713 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5714 return VINF_SUCCESS;
5715 }
5716
5717#ifndef IN_RING3
5718 /* Deferred to ring-3. */
5719 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5720 {
5721 Log(("IEM: wrmsr(%#x) -> ring-3\n", pCtx->ecx));
5722 return rcStrict;
5723 }
5724#else /* IN_RING3 */
5725 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5726 static uint32_t s_cTimes = 0;
5727 if (s_cTimes++ < 10)
5728 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5729 else
5730#endif
5731 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5732 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5733 return iemRaiseGeneralProtectionFault0(pVCpu);
5734}
5735
5736
5737/**
5738 * Implements 'IN eAX, port'.
5739 *
5740 * @param u16Port The source port.
5741 * @param cbReg The register size.
5742 */
5743IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5744{
5745 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5746
5747 /*
5748 * CPL check
5749 */
5750 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5751 if (rcStrict != VINF_SUCCESS)
5752 return rcStrict;
5753
5754 /*
5755 * Perform the I/O.
5756 */
5757 uint32_t u32Value;
5758 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5759 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
5760 else
5761 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
5762 if (IOM_SUCCESS(rcStrict))
5763 {
5764 switch (cbReg)
5765 {
5766 case 1: pCtx->al = (uint8_t)u32Value; break;
5767 case 2: pCtx->ax = (uint16_t)u32Value; break;
5768 case 4: pCtx->rax = u32Value; break;
5769 default: AssertFailedReturn(VERR_IEM_IPE_3);
5770 }
5771 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5772 pVCpu->iem.s.cPotentialExits++;
5773 if (rcStrict != VINF_SUCCESS)
5774 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5775 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5776
5777 /*
5778 * Check for I/O breakpoints.
5779 */
5780 uint32_t const uDr7 = pCtx->dr[7];
5781 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5782 && X86_DR7_ANY_RW_IO(uDr7)
5783 && (pCtx->cr4 & X86_CR4_DE))
5784 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5785 {
5786 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5787 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5788 rcStrict = iemRaiseDebugException(pVCpu);
5789 }
5790 }
5791
5792 return rcStrict;
5793}
5794
5795
5796/**
5797 * Implements 'IN eAX, DX'.
5798 *
5799 * @param cbReg The register size.
5800 */
5801IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5802{
5803 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
5804}
5805
5806
5807/**
5808 * Implements 'OUT port, eAX'.
5809 *
5810 * @param u16Port The destination port.
5811 * @param cbReg The register size.
5812 */
5813IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5814{
5815 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5816
5817 /*
5818 * CPL check
5819 */
5820 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5821 if (rcStrict != VINF_SUCCESS)
5822 return rcStrict;
5823
5824 /*
5825 * Perform the I/O.
5826 */
5827 uint32_t u32Value;
5828 switch (cbReg)
5829 {
5830 case 1: u32Value = pCtx->al; break;
5831 case 2: u32Value = pCtx->ax; break;
5832 case 4: u32Value = pCtx->eax; break;
5833 default: AssertFailedReturn(VERR_IEM_IPE_4);
5834 }
5835 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5836 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
5837 else
5838 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
5839 if (IOM_SUCCESS(rcStrict))
5840 {
5841 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5842 pVCpu->iem.s.cPotentialExits++;
5843 if (rcStrict != VINF_SUCCESS)
5844 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5845 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5846
5847 /*
5848 * Check for I/O breakpoints.
5849 */
5850 uint32_t const uDr7 = pCtx->dr[7];
5851 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5852 && X86_DR7_ANY_RW_IO(uDr7)
5853 && (pCtx->cr4 & X86_CR4_DE))
5854 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5855 {
5856 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5857 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5858 rcStrict = iemRaiseDebugException(pVCpu);
5859 }
5860 }
5861 return rcStrict;
5862}
5863
5864
5865/**
5866 * Implements 'OUT DX, eAX'.
5867 *
5868 * @param cbReg The register size.
5869 */
5870IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5871{
5872 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
5873}
5874
5875
5876/**
5877 * Implements 'CLI'.
5878 */
5879IEM_CIMPL_DEF_0(iemCImpl_cli)
5880{
5881 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5882 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5883 uint32_t const fEflOld = fEfl;
5884 if (pCtx->cr0 & X86_CR0_PE)
5885 {
5886 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5887 if (!(fEfl & X86_EFL_VM))
5888 {
5889 if (pVCpu->iem.s.uCpl <= uIopl)
5890 fEfl &= ~X86_EFL_IF;
5891 else if ( pVCpu->iem.s.uCpl == 3
5892 && (pCtx->cr4 & X86_CR4_PVI) )
5893 fEfl &= ~X86_EFL_VIF;
5894 else
5895 return iemRaiseGeneralProtectionFault0(pVCpu);
5896 }
5897 /* V8086 */
5898 else if (uIopl == 3)
5899 fEfl &= ~X86_EFL_IF;
5900 else if ( uIopl < 3
5901 && (pCtx->cr4 & X86_CR4_VME) )
5902 fEfl &= ~X86_EFL_VIF;
5903 else
5904 return iemRaiseGeneralProtectionFault0(pVCpu);
5905 }
5906 /* real mode */
5907 else
5908 fEfl &= ~X86_EFL_IF;
5909
5910 /* Commit. */
5911 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5912 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5913 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
5914 return VINF_SUCCESS;
5915}
5916
5917
5918/**
5919 * Implements 'STI'.
5920 */
5921IEM_CIMPL_DEF_0(iemCImpl_sti)
5922{
5923 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5924 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
5925 uint32_t const fEflOld = fEfl;
5926
5927 if (pCtx->cr0 & X86_CR0_PE)
5928 {
5929 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
5930 if (!(fEfl & X86_EFL_VM))
5931 {
5932 if (pVCpu->iem.s.uCpl <= uIopl)
5933 fEfl |= X86_EFL_IF;
5934 else if ( pVCpu->iem.s.uCpl == 3
5935 && (pCtx->cr4 & X86_CR4_PVI)
5936 && !(fEfl & X86_EFL_VIP) )
5937 fEfl |= X86_EFL_VIF;
5938 else
5939 return iemRaiseGeneralProtectionFault0(pVCpu);
5940 }
5941 /* V8086 */
5942 else if (uIopl == 3)
5943 fEfl |= X86_EFL_IF;
5944 else if ( uIopl < 3
5945 && (pCtx->cr4 & X86_CR4_VME)
5946 && !(fEfl & X86_EFL_VIP) )
5947 fEfl |= X86_EFL_VIF;
5948 else
5949 return iemRaiseGeneralProtectionFault0(pVCpu);
5950 }
5951 /* real mode */
5952 else
5953 fEfl |= X86_EFL_IF;
5954
5955 /* Commit. */
5956 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
5957 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5958 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
5959 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
5960 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
5961 return VINF_SUCCESS;
5962}
5963
5964
5965/**
5966 * Implements 'HLT'.
5967 */
5968IEM_CIMPL_DEF_0(iemCImpl_hlt)
5969{
5970 if (pVCpu->iem.s.uCpl != 0)
5971 return iemRaiseGeneralProtectionFault0(pVCpu);
5972 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5973 return VINF_EM_HALT;
5974}
5975
5976
5977/**
5978 * Implements 'MONITOR'.
5979 */
5980IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
5981{
5982 /*
5983 * Permission checks.
5984 */
5985 if (pVCpu->iem.s.uCpl != 0)
5986 {
5987 Log2(("monitor: CPL != 0\n"));
5988 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
5989 }
5990 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
5991 {
5992 Log2(("monitor: Not in CPUID\n"));
5993 return iemRaiseUndefinedOpcode(pVCpu);
5994 }
5995
5996 /*
5997 * Gather the operands and validate them.
5998 */
5999 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6000 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6001 uint32_t uEcx = pCtx->ecx;
6002 uint32_t uEdx = pCtx->edx;
6003/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
6004 * \#GP first. */
6005 if (uEcx != 0)
6006 {
6007 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
6008 return iemRaiseGeneralProtectionFault0(pVCpu);
6009 }
6010
6011 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
6012 if (rcStrict != VINF_SUCCESS)
6013 return rcStrict;
6014
6015 RTGCPHYS GCPhysMem;
6016 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6017 if (rcStrict != VINF_SUCCESS)
6018 return rcStrict;
6019
6020 /*
6021 * Call EM to prepare the monitor/wait.
6022 */
6023 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
6024 Assert(rcStrict == VINF_SUCCESS);
6025
6026 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6027 return rcStrict;
6028}
6029
6030
6031/**
6032 * Implements 'MWAIT'.
6033 */
6034IEM_CIMPL_DEF_0(iemCImpl_mwait)
6035{
6036 /*
6037 * Permission checks.
6038 */
6039 if (pVCpu->iem.s.uCpl != 0)
6040 {
6041 Log2(("mwait: CPL != 0\n"));
6042 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
6043 * EFLAGS.VM then.) */
6044 return iemRaiseUndefinedOpcode(pVCpu);
6045 }
6046 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6047 {
6048 Log2(("mwait: Not in CPUID\n"));
6049 return iemRaiseUndefinedOpcode(pVCpu);
6050 }
6051
6052 /*
6053 * Gather the operands and validate them.
6054 */
6055 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6056 uint32_t uEax = pCtx->eax;
6057 uint32_t uEcx = pCtx->ecx;
6058 if (uEcx != 0)
6059 {
6060 /* Only supported extension is break on IRQ when IF=0. */
6061 if (uEcx > 1)
6062 {
6063 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
6064 return iemRaiseGeneralProtectionFault0(pVCpu);
6065 }
6066 uint32_t fMWaitFeatures = 0;
6067 uint32_t uIgnore = 0;
6068 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
6069 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6070 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6071 {
6072 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
6073 return iemRaiseGeneralProtectionFault0(pVCpu);
6074 }
6075 }
6076
6077 /*
6078 * Call EM to prepare the monitor/wait.
6079 */
6080 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
6081
6082 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6083 return rcStrict;
6084}
6085
6086
6087/**
6088 * Implements 'SWAPGS'.
6089 */
6090IEM_CIMPL_DEF_0(iemCImpl_swapgs)
6091{
6092 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
6093
6094 /*
6095 * Permission checks.
6096 */
6097 if (pVCpu->iem.s.uCpl != 0)
6098 {
6099 Log2(("swapgs: CPL != 0\n"));
6100 return iemRaiseUndefinedOpcode(pVCpu);
6101 }
6102
6103 /*
6104 * Do the job.
6105 */
6106 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6107 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
6108 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
6109 pCtx->gs.u64Base = uOtherGsBase;
6110
6111 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6112 return VINF_SUCCESS;
6113}
6114
6115
6116/**
6117 * Implements 'CPUID'.
6118 */
6119IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6120{
6121 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6122
6123 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6124 pCtx->rax &= UINT32_C(0xffffffff);
6125 pCtx->rbx &= UINT32_C(0xffffffff);
6126 pCtx->rcx &= UINT32_C(0xffffffff);
6127 pCtx->rdx &= UINT32_C(0xffffffff);
6128
6129 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6130 return VINF_SUCCESS;
6131}
6132
6133
6134/**
6135 * Implements 'AAD'.
6136 *
6137 * @param bImm The immediate operand.
6138 */
6139IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6140{
6141 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6142
6143 uint16_t const ax = pCtx->ax;
6144 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6145 pCtx->ax = al;
6146 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6147 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6148 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6149
6150 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6151 return VINF_SUCCESS;
6152}
6153
6154
6155/**
6156 * Implements 'AAM'.
6157 *
6158 * @param bImm The immediate operand. Cannot be 0.
6159 */
6160IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6161{
6162 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6163 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6164
6165 uint16_t const ax = pCtx->ax;
6166 uint8_t const al = (uint8_t)ax % bImm;
6167 uint8_t const ah = (uint8_t)ax / bImm;
6168 pCtx->ax = (ah << 8) + al;
6169 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6170 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6171 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6172
6173 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6174 return VINF_SUCCESS;
6175}
6176
6177
6178/**
6179 * Implements 'DAA'.
6180 */
6181IEM_CIMPL_DEF_0(iemCImpl_daa)
6182{
6183 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6184
6185 uint8_t const al = pCtx->al;
6186 bool const fCarry = pCtx->eflags.Bits.u1CF;
6187
6188 if ( pCtx->eflags.Bits.u1AF
6189 || (al & 0xf) >= 10)
6190 {
6191 pCtx->al = al + 6;
6192 pCtx->eflags.Bits.u1AF = 1;
6193 }
6194 else
6195 pCtx->eflags.Bits.u1AF = 0;
6196
6197 if (al >= 0x9a || fCarry)
6198 {
6199 pCtx->al += 0x60;
6200 pCtx->eflags.Bits.u1CF = 1;
6201 }
6202 else
6203 pCtx->eflags.Bits.u1CF = 0;
6204
6205 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6206 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6207 return VINF_SUCCESS;
6208}
6209
6210
6211/**
6212 * Implements 'DAS'.
6213 */
6214IEM_CIMPL_DEF_0(iemCImpl_das)
6215{
6216 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6217
6218 uint8_t const uInputAL = pCtx->al;
6219 bool const fCarry = pCtx->eflags.Bits.u1CF;
6220
6221 if ( pCtx->eflags.Bits.u1AF
6222 || (uInputAL & 0xf) >= 10)
6223 {
6224 pCtx->eflags.Bits.u1AF = 1;
6225 if (uInputAL < 6)
6226 pCtx->eflags.Bits.u1CF = 1;
6227 pCtx->al = uInputAL - 6;
6228 }
6229 else
6230 {
6231 pCtx->eflags.Bits.u1AF = 0;
6232 pCtx->eflags.Bits.u1CF = 0;
6233 }
6234
6235 if (uInputAL >= 0x9a || fCarry)
6236 {
6237 pCtx->al -= 0x60;
6238 pCtx->eflags.Bits.u1CF = 1;
6239 }
6240
6241 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6242 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6243 return VINF_SUCCESS;
6244}
6245
6246
6247
6248
6249/*
6250 * Instantiate the various string operation combinations.
6251 */
6252#define OP_SIZE 8
6253#define ADDR_SIZE 16
6254#include "IEMAllCImplStrInstr.cpp.h"
6255#define OP_SIZE 8
6256#define ADDR_SIZE 32
6257#include "IEMAllCImplStrInstr.cpp.h"
6258#define OP_SIZE 8
6259#define ADDR_SIZE 64
6260#include "IEMAllCImplStrInstr.cpp.h"
6261
6262#define OP_SIZE 16
6263#define ADDR_SIZE 16
6264#include "IEMAllCImplStrInstr.cpp.h"
6265#define OP_SIZE 16
6266#define ADDR_SIZE 32
6267#include "IEMAllCImplStrInstr.cpp.h"
6268#define OP_SIZE 16
6269#define ADDR_SIZE 64
6270#include "IEMAllCImplStrInstr.cpp.h"
6271
6272#define OP_SIZE 32
6273#define ADDR_SIZE 16
6274#include "IEMAllCImplStrInstr.cpp.h"
6275#define OP_SIZE 32
6276#define ADDR_SIZE 32
6277#include "IEMAllCImplStrInstr.cpp.h"
6278#define OP_SIZE 32
6279#define ADDR_SIZE 64
6280#include "IEMAllCImplStrInstr.cpp.h"
6281
6282#define OP_SIZE 64
6283#define ADDR_SIZE 32
6284#include "IEMAllCImplStrInstr.cpp.h"
6285#define OP_SIZE 64
6286#define ADDR_SIZE 64
6287#include "IEMAllCImplStrInstr.cpp.h"
6288
6289
6290/**
6291 * Implements 'XGETBV'.
6292 */
6293IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6294{
6295 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6296 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6297 {
6298 uint32_t uEcx = pCtx->ecx;
6299 switch (uEcx)
6300 {
6301 case 0:
6302 break;
6303
6304 case 1: /** @todo Implement XCR1 support. */
6305 default:
6306 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6307 return iemRaiseGeneralProtectionFault0(pVCpu);
6308
6309 }
6310 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6311 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6312
6313 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6314 return VINF_SUCCESS;
6315 }
6316 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6317 return iemRaiseUndefinedOpcode(pVCpu);
6318}
6319
6320
6321/**
6322 * Implements 'XSETBV'.
6323 */
6324IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6325{
6326 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6327 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6328 {
6329 if (pVCpu->iem.s.uCpl == 0)
6330 {
6331 uint32_t uEcx = pCtx->ecx;
6332 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6333 switch (uEcx)
6334 {
6335 case 0:
6336 {
6337 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
6338 if (rc == VINF_SUCCESS)
6339 break;
6340 Assert(rc == VERR_CPUM_RAISE_GP_0);
6341 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6342 return iemRaiseGeneralProtectionFault0(pVCpu);
6343 }
6344
6345 case 1: /** @todo Implement XCR1 support. */
6346 default:
6347 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6348 return iemRaiseGeneralProtectionFault0(pVCpu);
6349
6350 }
6351
6352 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6353 return VINF_SUCCESS;
6354 }
6355
6356 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
6357 return iemRaiseGeneralProtectionFault0(pVCpu);
6358 }
6359 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6360 return iemRaiseUndefinedOpcode(pVCpu);
6361}
6362
6363
6364/**
6365 * Implements 'CMPXCHG16B' fallback using rendezvous.
6366 */
6367IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu64RaxRdx,
6368 PRTUINT128U, pu64RbxRcx, uint32_t *, pEFlags)
6369{
6370 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu64RaxRdx, pu64RbxRcx, pEFlags);
6371#ifdef IN_RING3
6372 /** @todo VMMR3EmtRendezvous() */
6373 return VERR_NOT_IMPLEMENTED;
6374#else
6375 return VINF_EM_RAW_EMULATE_INSTR;
6376#endif
6377}
6378
6379
6380/**
6381 * Implements 'FINIT' and 'FNINIT'.
6382 *
6383 * @param fCheckXcpts Whether to check for umasked pending exceptions or
6384 * not.
6385 */
6386IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6387{
6388 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6389
6390 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6391 return iemRaiseDeviceNotAvailable(pVCpu);
6392
6393 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6394 if (fCheckXcpts && TODO )
6395 return iemRaiseMathFault(pVCpu);
6396 */
6397
6398 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6399 pXState->x87.FCW = 0x37f;
6400 pXState->x87.FSW = 0;
6401 pXState->x87.FTW = 0x00; /* 0 - empty. */
6402 pXState->x87.FPUDP = 0;
6403 pXState->x87.DS = 0; //??
6404 pXState->x87.Rsrvd2= 0;
6405 pXState->x87.FPUIP = 0;
6406 pXState->x87.CS = 0; //??
6407 pXState->x87.Rsrvd1= 0;
6408 pXState->x87.FOP = 0;
6409
6410 iemHlpUsedFpu(pVCpu);
6411 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6412 return VINF_SUCCESS;
6413}
6414
6415
6416/**
6417 * Implements 'FXSAVE'.
6418 *
6419 * @param iEffSeg The effective segment.
6420 * @param GCPtrEff The address of the image.
6421 * @param enmEffOpSize The operand size (only REX.W really matters).
6422 */
6423IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6424{
6425 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6426
6427 /*
6428 * Raise exceptions.
6429 */
6430 if (pCtx->cr0 & X86_CR0_EM)
6431 return iemRaiseUndefinedOpcode(pVCpu);
6432 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6433 return iemRaiseDeviceNotAvailable(pVCpu);
6434 if (GCPtrEff & 15)
6435 {
6436 /** @todo CPU/VM detection possible! \#AC might not be signal for
6437 * all/any misalignment sizes, intel says its an implementation detail. */
6438 if ( (pCtx->cr0 & X86_CR0_AM)
6439 && pCtx->eflags.Bits.u1AC
6440 && pVCpu->iem.s.uCpl == 3)
6441 return iemRaiseAlignmentCheckException(pVCpu);
6442 return iemRaiseGeneralProtectionFault0(pVCpu);
6443 }
6444
6445 /*
6446 * Access the memory.
6447 */
6448 void *pvMem512;
6449 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6450 if (rcStrict != VINF_SUCCESS)
6451 return rcStrict;
6452 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6453 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6454
6455 /*
6456 * Store the registers.
6457 */
6458 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6459 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6460
6461 /* common for all formats */
6462 pDst->FCW = pSrc->FCW;
6463 pDst->FSW = pSrc->FSW;
6464 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6465 pDst->FOP = pSrc->FOP;
6466 pDst->MXCSR = pSrc->MXCSR;
6467 pDst->MXCSR_MASK = pSrc->MXCSR_MASK;
6468 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6469 {
6470 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6471 * them for now... */
6472 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6473 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6474 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6475 pDst->aRegs[i].au32[3] = 0;
6476 }
6477
6478 /* FPU IP, CS, DP and DS. */
6479 pDst->FPUIP = pSrc->FPUIP;
6480 pDst->CS = pSrc->CS;
6481 pDst->FPUDP = pSrc->FPUDP;
6482 pDst->DS = pSrc->DS;
6483 if (enmEffOpSize == IEMMODE_64BIT)
6484 {
6485 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6486 pDst->Rsrvd1 = pSrc->Rsrvd1;
6487 pDst->Rsrvd2 = pSrc->Rsrvd2;
6488 pDst->au32RsrvdForSoftware[0] = 0;
6489 }
6490 else
6491 {
6492 pDst->Rsrvd1 = 0;
6493 pDst->Rsrvd2 = 0;
6494 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6495 }
6496
6497 /* XMM registers. */
6498 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6499 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6500 || pVCpu->iem.s.uCpl != 0)
6501 {
6502 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6503 for (uint32_t i = 0; i < cXmmRegs; i++)
6504 pDst->aXMM[i] = pSrc->aXMM[i];
6505 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6506 * right? */
6507 }
6508
6509 /*
6510 * Commit the memory.
6511 */
6512 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6513 if (rcStrict != VINF_SUCCESS)
6514 return rcStrict;
6515
6516 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6517 return VINF_SUCCESS;
6518}
6519
6520
6521/**
6522 * Implements 'FXRSTOR'.
6523 *
6524 * @param GCPtrEff The address of the image.
6525 * @param enmEffOpSize The operand size (only REX.W really matters).
6526 */
6527IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6528{
6529 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6530
6531 /*
6532 * Raise exceptions.
6533 */
6534 if (pCtx->cr0 & X86_CR0_EM)
6535 return iemRaiseUndefinedOpcode(pVCpu);
6536 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6537 return iemRaiseDeviceNotAvailable(pVCpu);
6538 if (GCPtrEff & 15)
6539 {
6540 /** @todo CPU/VM detection possible! \#AC might not be signal for
6541 * all/any misalignment sizes, intel says its an implementation detail. */
6542 if ( (pCtx->cr0 & X86_CR0_AM)
6543 && pCtx->eflags.Bits.u1AC
6544 && pVCpu->iem.s.uCpl == 3)
6545 return iemRaiseAlignmentCheckException(pVCpu);
6546 return iemRaiseGeneralProtectionFault0(pVCpu);
6547 }
6548
6549 /*
6550 * Access the memory.
6551 */
6552 void *pvMem512;
6553 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6554 if (rcStrict != VINF_SUCCESS)
6555 return rcStrict;
6556 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6557 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6558
6559 /*
6560 * Check the state for stuff which will #GP(0).
6561 */
6562 uint32_t const fMXCSR = pSrc->MXCSR;
6563 uint32_t const fMXCSR_MASK = pDst->MXCSR_MASK ? pDst->MXCSR_MASK : UINT32_C(0xffbf);
6564 if (fMXCSR & ~fMXCSR_MASK)
6565 {
6566 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6567 return iemRaiseGeneralProtectionFault0(pVCpu);
6568 }
6569
6570 /*
6571 * Load the registers.
6572 */
6573 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6574 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6575
6576 /* common for all formats */
6577 pDst->FCW = pSrc->FCW;
6578 pDst->FSW = pSrc->FSW;
6579 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6580 pDst->FOP = pSrc->FOP;
6581 pDst->MXCSR = fMXCSR;
6582 /* (MXCSR_MASK is read-only) */
6583 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
6584 {
6585 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6586 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6587 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6588 pDst->aRegs[i].au32[3] = 0;
6589 }
6590
6591 /* FPU IP, CS, DP and DS. */
6592 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6593 {
6594 pDst->FPUIP = pSrc->FPUIP;
6595 pDst->CS = pSrc->CS;
6596 pDst->Rsrvd1 = pSrc->Rsrvd1;
6597 pDst->FPUDP = pSrc->FPUDP;
6598 pDst->DS = pSrc->DS;
6599 pDst->Rsrvd2 = pSrc->Rsrvd2;
6600 }
6601 else
6602 {
6603 pDst->FPUIP = pSrc->FPUIP;
6604 pDst->CS = pSrc->CS;
6605 pDst->Rsrvd1 = 0;
6606 pDst->FPUDP = pSrc->FPUDP;
6607 pDst->DS = pSrc->DS;
6608 pDst->Rsrvd2 = 0;
6609 }
6610
6611 /* XMM registers. */
6612 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6613 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6614 || pVCpu->iem.s.uCpl != 0)
6615 {
6616 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6617 for (uint32_t i = 0; i < cXmmRegs; i++)
6618 pDst->aXMM[i] = pSrc->aXMM[i];
6619 }
6620
6621 /*
6622 * Commit the memory.
6623 */
6624 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
6625 if (rcStrict != VINF_SUCCESS)
6626 return rcStrict;
6627
6628 iemHlpUsedFpu(pVCpu);
6629 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6630 return VINF_SUCCESS;
6631}
6632
6633
6634/**
6635 * Commmon routine for fnstenv and fnsave.
6636 *
6637 * @param uPtr Where to store the state.
6638 * @param pCtx The CPU context.
6639 */
6640static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
6641{
6642 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
6643 if (enmEffOpSize == IEMMODE_16BIT)
6644 {
6645 uPtr.pu16[0] = pSrcX87->FCW;
6646 uPtr.pu16[1] = pSrcX87->FSW;
6647 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
6648 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6649 {
6650 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
6651 * protected mode or long mode and we save it in real mode? And vice
6652 * versa? And with 32-bit operand size? I think CPU is storing the
6653 * effective address ((CS << 4) + IP) in the offset register and not
6654 * doing any address calculations here. */
6655 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
6656 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
6657 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
6658 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
6659 }
6660 else
6661 {
6662 uPtr.pu16[3] = pSrcX87->FPUIP;
6663 uPtr.pu16[4] = pSrcX87->CS;
6664 uPtr.pu16[5] = pSrcX87->FPUDP;
6665 uPtr.pu16[6] = pSrcX87->DS;
6666 }
6667 }
6668 else
6669 {
6670 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
6671 uPtr.pu16[0*2] = pSrcX87->FCW;
6672 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
6673 uPtr.pu16[1*2] = pSrcX87->FSW;
6674 uPtr.pu16[1*2+1] = 0xffff;
6675 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
6676 uPtr.pu16[2*2+1] = 0xffff;
6677 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6678 {
6679 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
6680 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
6681 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
6682 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
6683 }
6684 else
6685 {
6686 uPtr.pu32[3] = pSrcX87->FPUIP;
6687 uPtr.pu16[4*2] = pSrcX87->CS;
6688 uPtr.pu16[4*2+1] = pSrcX87->FOP;
6689 uPtr.pu32[5] = pSrcX87->FPUDP;
6690 uPtr.pu16[6*2] = pSrcX87->DS;
6691 uPtr.pu16[6*2+1] = 0xffff;
6692 }
6693 }
6694}
6695
6696
6697/**
6698 * Commmon routine for fldenv and frstor
6699 *
6700 * @param uPtr Where to store the state.
6701 * @param pCtx The CPU context.
6702 */
6703static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
6704{
6705 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
6706 if (enmEffOpSize == IEMMODE_16BIT)
6707 {
6708 pDstX87->FCW = uPtr.pu16[0];
6709 pDstX87->FSW = uPtr.pu16[1];
6710 pDstX87->FTW = uPtr.pu16[2];
6711 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6712 {
6713 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
6714 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
6715 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
6716 pDstX87->CS = 0;
6717 pDstX87->Rsrvd1= 0;
6718 pDstX87->DS = 0;
6719 pDstX87->Rsrvd2= 0;
6720 }
6721 else
6722 {
6723 pDstX87->FPUIP = uPtr.pu16[3];
6724 pDstX87->CS = uPtr.pu16[4];
6725 pDstX87->Rsrvd1= 0;
6726 pDstX87->FPUDP = uPtr.pu16[5];
6727 pDstX87->DS = uPtr.pu16[6];
6728 pDstX87->Rsrvd2= 0;
6729 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
6730 }
6731 }
6732 else
6733 {
6734 pDstX87->FCW = uPtr.pu16[0*2];
6735 pDstX87->FSW = uPtr.pu16[1*2];
6736 pDstX87->FTW = uPtr.pu16[2*2];
6737 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
6738 {
6739 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
6740 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
6741 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
6742 pDstX87->CS = 0;
6743 pDstX87->Rsrvd1= 0;
6744 pDstX87->DS = 0;
6745 pDstX87->Rsrvd2= 0;
6746 }
6747 else
6748 {
6749 pDstX87->FPUIP = uPtr.pu32[3];
6750 pDstX87->CS = uPtr.pu16[4*2];
6751 pDstX87->Rsrvd1= 0;
6752 pDstX87->FOP = uPtr.pu16[4*2+1];
6753 pDstX87->FPUDP = uPtr.pu32[5];
6754 pDstX87->DS = uPtr.pu16[6*2];
6755 pDstX87->Rsrvd2= 0;
6756 }
6757 }
6758
6759 /* Make adjustments. */
6760 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
6761 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
6762 iemFpuRecalcExceptionStatus(pDstX87);
6763 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
6764 * exceptions are pending after loading the saved state? */
6765}
6766
6767
6768/**
6769 * Implements 'FNSTENV'.
6770 *
6771 * @param enmEffOpSize The operand size (only REX.W really matters).
6772 * @param iEffSeg The effective segment register for @a GCPtrEff.
6773 * @param GCPtrEffDst The address of the image.
6774 */
6775IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6776{
6777 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6778 RTPTRUNION uPtr;
6779 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6780 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6781 if (rcStrict != VINF_SUCCESS)
6782 return rcStrict;
6783
6784 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6785
6786 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6787 if (rcStrict != VINF_SUCCESS)
6788 return rcStrict;
6789
6790 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6791 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6792 return VINF_SUCCESS;
6793}
6794
6795
6796/**
6797 * Implements 'FNSAVE'.
6798 *
6799 * @param GCPtrEffDst The address of the image.
6800 * @param enmEffOpSize The operand size.
6801 */
6802IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
6803{
6804 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6805 RTPTRUNION uPtr;
6806 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6807 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6808 if (rcStrict != VINF_SUCCESS)
6809 return rcStrict;
6810
6811 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6812 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6813 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6814 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6815 {
6816 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
6817 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
6818 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
6819 }
6820
6821 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6822 if (rcStrict != VINF_SUCCESS)
6823 return rcStrict;
6824
6825 /*
6826 * Re-initialize the FPU context.
6827 */
6828 pFpuCtx->FCW = 0x37f;
6829 pFpuCtx->FSW = 0;
6830 pFpuCtx->FTW = 0x00; /* 0 - empty */
6831 pFpuCtx->FPUDP = 0;
6832 pFpuCtx->DS = 0;
6833 pFpuCtx->Rsrvd2= 0;
6834 pFpuCtx->FPUIP = 0;
6835 pFpuCtx->CS = 0;
6836 pFpuCtx->Rsrvd1= 0;
6837 pFpuCtx->FOP = 0;
6838
6839 iemHlpUsedFpu(pVCpu);
6840 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6841 return VINF_SUCCESS;
6842}
6843
6844
6845
6846/**
6847 * Implements 'FLDENV'.
6848 *
6849 * @param enmEffOpSize The operand size (only REX.W really matters).
6850 * @param iEffSeg The effective segment register for @a GCPtrEff.
6851 * @param GCPtrEffSrc The address of the image.
6852 */
6853IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6854{
6855 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6856 RTCPTRUNION uPtr;
6857 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
6858 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6859 if (rcStrict != VINF_SUCCESS)
6860 return rcStrict;
6861
6862 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6863
6864 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6865 if (rcStrict != VINF_SUCCESS)
6866 return rcStrict;
6867
6868 iemHlpUsedFpu(pVCpu);
6869 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6870 return VINF_SUCCESS;
6871}
6872
6873
6874/**
6875 * Implements 'FRSTOR'.
6876 *
6877 * @param GCPtrEffSrc The address of the image.
6878 * @param enmEffOpSize The operand size.
6879 */
6880IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
6881{
6882 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6883 RTCPTRUNION uPtr;
6884 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
6885 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
6886 if (rcStrict != VINF_SUCCESS)
6887 return rcStrict;
6888
6889 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6890 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
6891 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
6892 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
6893 {
6894 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
6895 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
6896 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
6897 pFpuCtx->aRegs[i].au32[3] = 0;
6898 }
6899
6900 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
6901 if (rcStrict != VINF_SUCCESS)
6902 return rcStrict;
6903
6904 iemHlpUsedFpu(pVCpu);
6905 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6906 return VINF_SUCCESS;
6907}
6908
6909
6910/**
6911 * Implements 'FLDCW'.
6912 *
6913 * @param u16Fcw The new FCW.
6914 */
6915IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
6916{
6917 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6918
6919 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
6920 /** @todo Testcase: Try see what happens when trying to set undefined bits
6921 * (other than 6 and 7). Currently ignoring them. */
6922 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
6923 * according to FSW. (This is was is currently implemented.) */
6924 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6925 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
6926 iemFpuRecalcExceptionStatus(pFpuCtx);
6927
6928 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
6929 iemHlpUsedFpu(pVCpu);
6930 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6931 return VINF_SUCCESS;
6932}
6933
6934
6935
6936/**
6937 * Implements the underflow case of fxch.
6938 *
6939 * @param iStReg The other stack register.
6940 */
6941IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
6942{
6943 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6944
6945 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
6946 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
6947 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
6948 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
6949
6950 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
6951 * registers are read as QNaN and then exchanged. This could be
6952 * wrong... */
6953 if (pFpuCtx->FCW & X86_FCW_IM)
6954 {
6955 if (RT_BIT(iReg1) & pFpuCtx->FTW)
6956 {
6957 if (RT_BIT(iReg2) & pFpuCtx->FTW)
6958 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6959 else
6960 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
6961 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
6962 }
6963 else
6964 {
6965 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
6966 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
6967 }
6968 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
6969 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
6970 }
6971 else
6972 {
6973 /* raise underflow exception, don't change anything. */
6974 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
6975 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
6976 }
6977
6978 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
6979 iemHlpUsedFpu(pVCpu);
6980 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6981 return VINF_SUCCESS;
6982}
6983
6984
6985/**
6986 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
6987 *
6988 * @param cToAdd 1 or 7.
6989 */
6990IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
6991{
6992 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6993 Assert(iStReg < 8);
6994
6995 /*
6996 * Raise exceptions.
6997 */
6998 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6999 return iemRaiseDeviceNotAvailable(pVCpu);
7000
7001 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7002 uint16_t u16Fsw = pFpuCtx->FSW;
7003 if (u16Fsw & X86_FSW_ES)
7004 return iemRaiseMathFault(pVCpu);
7005
7006 /*
7007 * Check if any of the register accesses causes #SF + #IA.
7008 */
7009 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
7010 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
7011 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
7012 {
7013 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
7014 NOREF(u32Eflags);
7015
7016 pFpuCtx->FSW &= ~X86_FSW_C1;
7017 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
7018 if ( !(u16Fsw & X86_FSW_IE)
7019 || (pFpuCtx->FCW & X86_FCW_IM) )
7020 {
7021 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7022 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7023 }
7024 }
7025 else if (pFpuCtx->FCW & X86_FCW_IM)
7026 {
7027 /* Masked underflow. */
7028 pFpuCtx->FSW &= ~X86_FSW_C1;
7029 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
7030 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7031 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
7032 }
7033 else
7034 {
7035 /* Raise underflow - don't touch EFLAGS or TOP. */
7036 pFpuCtx->FSW &= ~X86_FSW_C1;
7037 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
7038 fPop = false;
7039 }
7040
7041 /*
7042 * Pop if necessary.
7043 */
7044 if (fPop)
7045 {
7046 pFpuCtx->FTW &= ~RT_BIT(iReg1);
7047 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
7048 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
7049 }
7050
7051 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
7052 iemHlpUsedFpu(pVCpu);
7053 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7054 return VINF_SUCCESS;
7055}
7056
7057/** @} */
7058
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette