VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 66457

Last change on this file since 66457 was 66457, checked in by vboxsync, 8 years ago

IEM: Limited xsave and xrstor implemention. Implemented vstmxcsr.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 269.3 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 66457 2017-04-06 10:44:30Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2016 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18/** @name Misc Helpers
19 * @{
20 */
21
22
23/**
24 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
25 *
26 * @returns Strict VBox status code.
27 *
28 * @param pVCpu The cross context virtual CPU structure of the calling thread.
29 * @param pCtx The register context.
30 * @param u16Port The port number.
31 * @param cbOperand The operand size.
32 */
33static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
34{
35 /* The TSS bits we're interested in are the same on 386 and AMD64. */
36 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
37 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
38 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
39 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
40
41 /*
42 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
43 */
44 Assert(!pCtx->tr.Attr.n.u1DescType);
45 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
46 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
47 {
48 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
49 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
50 return iemRaiseGeneralProtectionFault0(pVCpu);
51 }
52
53 /*
54 * Read the bitmap offset (may #PF).
55 */
56 uint16_t offBitmap;
57 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
58 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
59 if (rcStrict != VINF_SUCCESS)
60 {
61 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
62 return rcStrict;
63 }
64
65 /*
66 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
67 * describes the CPU actually reading two bytes regardless of whether the
68 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
69 */
70 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
71 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
72 * for instance sizeof(X86TSS32). */
73 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
74 {
75 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
76 offFirstBit, pCtx->tr.u32Limit));
77 return iemRaiseGeneralProtectionFault0(pVCpu);
78 }
79
80 /*
81 * Read the necessary bits.
82 */
83 /** @todo Test the assertion in the intel manual that the CPU reads two
84 * bytes. The question is how this works wrt to #PF and #GP on the
85 * 2nd byte when it's not required. */
86 uint16_t bmBytes = UINT16_MAX;
87 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
88 if (rcStrict != VINF_SUCCESS)
89 {
90 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
91 return rcStrict;
92 }
93
94 /*
95 * Perform the check.
96 */
97 uint16_t fPortMask = (1 << cbOperand) - 1;
98 bmBytes >>= (u16Port & 7);
99 if (bmBytes & fPortMask)
100 {
101 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
102 u16Port, cbOperand, bmBytes, fPortMask));
103 return iemRaiseGeneralProtectionFault0(pVCpu);
104 }
105
106 return VINF_SUCCESS;
107}
108
109
110/**
111 * Checks if we are allowed to access the given I/O port, raising the
112 * appropriate exceptions if we aren't (or if the I/O bitmap is not
113 * accessible).
114 *
115 * @returns Strict VBox status code.
116 *
117 * @param pVCpu The cross context virtual CPU structure of the calling thread.
118 * @param pCtx The register context.
119 * @param u16Port The port number.
120 * @param cbOperand The operand size.
121 */
122DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
123{
124 X86EFLAGS Efl;
125 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
126 if ( (pCtx->cr0 & X86_CR0_PE)
127 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
128 || Efl.Bits.u1VM) )
129 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
130 return VINF_SUCCESS;
131}
132
133
134#if 0
135/**
136 * Calculates the parity bit.
137 *
138 * @returns true if the bit is set, false if not.
139 * @param u8Result The least significant byte of the result.
140 */
141static bool iemHlpCalcParityFlag(uint8_t u8Result)
142{
143 /*
144 * Parity is set if the number of bits in the least significant byte of
145 * the result is even.
146 */
147 uint8_t cBits;
148 cBits = u8Result & 1; /* 0 */
149 u8Result >>= 1;
150 cBits += u8Result & 1;
151 u8Result >>= 1;
152 cBits += u8Result & 1;
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1; /* 4 */
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1;
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 return !(cBits & 1);
164}
165#endif /* not used */
166
167
168/**
169 * Updates the specified flags according to a 8-bit result.
170 *
171 * @param pVCpu The cross context virtual CPU structure of the calling thread.
172 * @param u8Result The result to set the flags according to.
173 * @param fToUpdate The flags to update.
174 * @param fUndefined The flags that are specified as undefined.
175 */
176static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
177{
178 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
179
180 uint32_t fEFlags = pCtx->eflags.u;
181 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
182 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
183 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
184#ifdef IEM_VERIFICATION_MODE_FULL
185 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
186#endif
187}
188
189
190/**
191 * Helper used by iret.
192 *
193 * @param pVCpu The cross context virtual CPU structure of the calling thread.
194 * @param uCpl The new CPL.
195 * @param pSReg Pointer to the segment register.
196 */
197static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
198{
199#ifdef VBOX_WITH_RAW_MODE_NOT_R0
200 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
201 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
202#else
203 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
204#endif
205
206 if ( uCpl > pSReg->Attr.n.u2Dpl
207 && pSReg->Attr.n.u1DescType /* code or data, not system */
208 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
209 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
210 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
211}
212
213
214/**
215 * Indicates that we have modified the FPU state.
216 *
217 * @param pVCpu The cross context virtual CPU structure of the calling thread.
218 */
219DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
220{
221 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
222}
223
224/** @} */
225
226/** @name C Implementations
227 * @{
228 */
229
230/**
231 * Implements a 16-bit popa.
232 */
233IEM_CIMPL_DEF_0(iemCImpl_popa_16)
234{
235 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
236 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
237 RTGCPTR GCPtrLast = GCPtrStart + 15;
238 VBOXSTRICTRC rcStrict;
239
240 /*
241 * The docs are a bit hard to comprehend here, but it looks like we wrap
242 * around in real mode as long as none of the individual "popa" crosses the
243 * end of the stack segment. In protected mode we check the whole access
244 * in one go. For efficiency, only do the word-by-word thing if we're in
245 * danger of wrapping around.
246 */
247 /** @todo do popa boundary / wrap-around checks. */
248 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
249 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
250 {
251 /* word-by-word */
252 RTUINT64U TmpRsp;
253 TmpRsp.u = pCtx->rsp;
254 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
255 if (rcStrict == VINF_SUCCESS)
256 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
257 if (rcStrict == VINF_SUCCESS)
258 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
259 if (rcStrict == VINF_SUCCESS)
260 {
261 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
262 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
263 }
264 if (rcStrict == VINF_SUCCESS)
265 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
266 if (rcStrict == VINF_SUCCESS)
267 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
268 if (rcStrict == VINF_SUCCESS)
269 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
270 if (rcStrict == VINF_SUCCESS)
271 {
272 pCtx->rsp = TmpRsp.u;
273 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
274 }
275 }
276 else
277 {
278 uint16_t const *pa16Mem = NULL;
279 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
280 if (rcStrict == VINF_SUCCESS)
281 {
282 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
283 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
284 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
285 /* skip sp */
286 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
287 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
288 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
289 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
290 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
291 if (rcStrict == VINF_SUCCESS)
292 {
293 iemRegAddToRsp(pVCpu, pCtx, 16);
294 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
295 }
296 }
297 }
298 return rcStrict;
299}
300
301
302/**
303 * Implements a 32-bit popa.
304 */
305IEM_CIMPL_DEF_0(iemCImpl_popa_32)
306{
307 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
308 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
309 RTGCPTR GCPtrLast = GCPtrStart + 31;
310 VBOXSTRICTRC rcStrict;
311
312 /*
313 * The docs are a bit hard to comprehend here, but it looks like we wrap
314 * around in real mode as long as none of the individual "popa" crosses the
315 * end of the stack segment. In protected mode we check the whole access
316 * in one go. For efficiency, only do the word-by-word thing if we're in
317 * danger of wrapping around.
318 */
319 /** @todo do popa boundary / wrap-around checks. */
320 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
321 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
322 {
323 /* word-by-word */
324 RTUINT64U TmpRsp;
325 TmpRsp.u = pCtx->rsp;
326 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
327 if (rcStrict == VINF_SUCCESS)
328 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
329 if (rcStrict == VINF_SUCCESS)
330 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
331 if (rcStrict == VINF_SUCCESS)
332 {
333 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
334 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
335 }
336 if (rcStrict == VINF_SUCCESS)
337 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
338 if (rcStrict == VINF_SUCCESS)
339 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
340 if (rcStrict == VINF_SUCCESS)
341 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 {
344#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
345 pCtx->rdi &= UINT32_MAX;
346 pCtx->rsi &= UINT32_MAX;
347 pCtx->rbp &= UINT32_MAX;
348 pCtx->rbx &= UINT32_MAX;
349 pCtx->rdx &= UINT32_MAX;
350 pCtx->rcx &= UINT32_MAX;
351 pCtx->rax &= UINT32_MAX;
352#endif
353 pCtx->rsp = TmpRsp.u;
354 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
355 }
356 }
357 else
358 {
359 uint32_t const *pa32Mem;
360 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
361 if (rcStrict == VINF_SUCCESS)
362 {
363 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
364 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
365 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
366 /* skip esp */
367 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
368 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
369 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
370 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
371 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
372 if (rcStrict == VINF_SUCCESS)
373 {
374 iemRegAddToRsp(pVCpu, pCtx, 32);
375 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
376 }
377 }
378 }
379 return rcStrict;
380}
381
382
383/**
384 * Implements a 16-bit pusha.
385 */
386IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
387{
388 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
389 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
390 RTGCPTR GCPtrBottom = GCPtrTop - 15;
391 VBOXSTRICTRC rcStrict;
392
393 /*
394 * The docs are a bit hard to comprehend here, but it looks like we wrap
395 * around in real mode as long as none of the individual "pushd" crosses the
396 * end of the stack segment. In protected mode we check the whole access
397 * in one go. For efficiency, only do the word-by-word thing if we're in
398 * danger of wrapping around.
399 */
400 /** @todo do pusha boundary / wrap-around checks. */
401 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
402 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
403 {
404 /* word-by-word */
405 RTUINT64U TmpRsp;
406 TmpRsp.u = pCtx->rsp;
407 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
408 if (rcStrict == VINF_SUCCESS)
409 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
410 if (rcStrict == VINF_SUCCESS)
411 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
412 if (rcStrict == VINF_SUCCESS)
413 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
414 if (rcStrict == VINF_SUCCESS)
415 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
416 if (rcStrict == VINF_SUCCESS)
417 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
418 if (rcStrict == VINF_SUCCESS)
419 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
420 if (rcStrict == VINF_SUCCESS)
421 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 {
424 pCtx->rsp = TmpRsp.u;
425 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
426 }
427 }
428 else
429 {
430 GCPtrBottom--;
431 uint16_t *pa16Mem = NULL;
432 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
433 if (rcStrict == VINF_SUCCESS)
434 {
435 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
436 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
437 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
438 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
439 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
440 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
441 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
442 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
443 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
444 if (rcStrict == VINF_SUCCESS)
445 {
446 iemRegSubFromRsp(pVCpu, pCtx, 16);
447 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
448 }
449 }
450 }
451 return rcStrict;
452}
453
454
455/**
456 * Implements a 32-bit pusha.
457 */
458IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
459{
460 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
461 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
462 RTGCPTR GCPtrBottom = GCPtrTop - 31;
463 VBOXSTRICTRC rcStrict;
464
465 /*
466 * The docs are a bit hard to comprehend here, but it looks like we wrap
467 * around in real mode as long as none of the individual "pusha" crosses the
468 * end of the stack segment. In protected mode we check the whole access
469 * in one go. For efficiency, only do the word-by-word thing if we're in
470 * danger of wrapping around.
471 */
472 /** @todo do pusha boundary / wrap-around checks. */
473 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
474 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
475 {
476 /* word-by-word */
477 RTUINT64U TmpRsp;
478 TmpRsp.u = pCtx->rsp;
479 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
480 if (rcStrict == VINF_SUCCESS)
481 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
482 if (rcStrict == VINF_SUCCESS)
483 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
484 if (rcStrict == VINF_SUCCESS)
485 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
486 if (rcStrict == VINF_SUCCESS)
487 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
488 if (rcStrict == VINF_SUCCESS)
489 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
490 if (rcStrict == VINF_SUCCESS)
491 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
492 if (rcStrict == VINF_SUCCESS)
493 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
494 if (rcStrict == VINF_SUCCESS)
495 {
496 pCtx->rsp = TmpRsp.u;
497 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
498 }
499 }
500 else
501 {
502 GCPtrBottom--;
503 uint32_t *pa32Mem;
504 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
505 if (rcStrict == VINF_SUCCESS)
506 {
507 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
508 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
509 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
510 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
511 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
512 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
513 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
514 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
515 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
516 if (rcStrict == VINF_SUCCESS)
517 {
518 iemRegSubFromRsp(pVCpu, pCtx, 32);
519 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
520 }
521 }
522 }
523 return rcStrict;
524}
525
526
527/**
528 * Implements pushf.
529 *
530 *
531 * @param enmEffOpSize The effective operand size.
532 */
533IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
534{
535 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
536 VBOXSTRICTRC rcStrict;
537
538 /*
539 * If we're in V8086 mode some care is required (which is why we're in
540 * doing this in a C implementation).
541 */
542 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
543 if ( (fEfl & X86_EFL_VM)
544 && X86_EFL_GET_IOPL(fEfl) != 3 )
545 {
546 Assert(pCtx->cr0 & X86_CR0_PE);
547 if ( enmEffOpSize != IEMMODE_16BIT
548 || !(pCtx->cr4 & X86_CR4_VME))
549 return iemRaiseGeneralProtectionFault0(pVCpu);
550 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
551 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
552 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
553 }
554 else
555 {
556
557 /*
558 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
559 */
560 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
561
562 switch (enmEffOpSize)
563 {
564 case IEMMODE_16BIT:
565 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
566 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
567 fEfl |= UINT16_C(0xf000);
568 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
569 break;
570 case IEMMODE_32BIT:
571 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
572 break;
573 case IEMMODE_64BIT:
574 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
575 break;
576 IEM_NOT_REACHED_DEFAULT_CASE_RET();
577 }
578 }
579 if (rcStrict != VINF_SUCCESS)
580 return rcStrict;
581
582 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
583 return VINF_SUCCESS;
584}
585
586
587/**
588 * Implements popf.
589 *
590 * @param enmEffOpSize The effective operand size.
591 */
592IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
593{
594 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
595 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
596 VBOXSTRICTRC rcStrict;
597 uint32_t fEflNew;
598
599 /*
600 * V8086 is special as usual.
601 */
602 if (fEflOld & X86_EFL_VM)
603 {
604 /*
605 * Almost anything goes if IOPL is 3.
606 */
607 if (X86_EFL_GET_IOPL(fEflOld) == 3)
608 {
609 switch (enmEffOpSize)
610 {
611 case IEMMODE_16BIT:
612 {
613 uint16_t u16Value;
614 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
615 if (rcStrict != VINF_SUCCESS)
616 return rcStrict;
617 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
618 break;
619 }
620 case IEMMODE_32BIT:
621 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
622 if (rcStrict != VINF_SUCCESS)
623 return rcStrict;
624 break;
625 IEM_NOT_REACHED_DEFAULT_CASE_RET();
626 }
627
628 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
629 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
630 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
631 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
632 }
633 /*
634 * Interrupt flag virtualization with CR4.VME=1.
635 */
636 else if ( enmEffOpSize == IEMMODE_16BIT
637 && (pCtx->cr4 & X86_CR4_VME) )
638 {
639 uint16_t u16Value;
640 RTUINT64U TmpRsp;
641 TmpRsp.u = pCtx->rsp;
642 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
643 if (rcStrict != VINF_SUCCESS)
644 return rcStrict;
645
646 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
647 * or before? */
648 if ( ( (u16Value & X86_EFL_IF)
649 && (fEflOld & X86_EFL_VIP))
650 || (u16Value & X86_EFL_TF) )
651 return iemRaiseGeneralProtectionFault0(pVCpu);
652
653 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
654 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
655 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
656 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
657
658 pCtx->rsp = TmpRsp.u;
659 }
660 else
661 return iemRaiseGeneralProtectionFault0(pVCpu);
662
663 }
664 /*
665 * Not in V8086 mode.
666 */
667 else
668 {
669 /* Pop the flags. */
670 switch (enmEffOpSize)
671 {
672 case IEMMODE_16BIT:
673 {
674 uint16_t u16Value;
675 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
676 if (rcStrict != VINF_SUCCESS)
677 return rcStrict;
678 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
679
680 /*
681 * Ancient CPU adjustments:
682 * - 8086, 80186, V20/30:
683 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
684 * practical reasons (masking below). We add them when pushing flags.
685 * - 80286:
686 * The NT and IOPL flags cannot be popped from real mode and are
687 * therefore always zero (since a 286 can never exit from PM and
688 * their initial value is zero). This changed on a 386 and can
689 * therefore be used to detect 286 or 386 CPU in real mode.
690 */
691 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
692 && !(pCtx->cr0 & X86_CR0_PE) )
693 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
694 break;
695 }
696 case IEMMODE_32BIT:
697 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
698 if (rcStrict != VINF_SUCCESS)
699 return rcStrict;
700 break;
701 case IEMMODE_64BIT:
702 {
703 uint64_t u64Value;
704 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
705 if (rcStrict != VINF_SUCCESS)
706 return rcStrict;
707 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
708 break;
709 }
710 IEM_NOT_REACHED_DEFAULT_CASE_RET();
711 }
712
713 /* Merge them with the current flags. */
714 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
715 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
716 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
717 || pVCpu->iem.s.uCpl == 0)
718 {
719 fEflNew &= fPopfBits;
720 fEflNew |= ~fPopfBits & fEflOld;
721 }
722 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
723 {
724 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
725 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
726 }
727 else
728 {
729 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
730 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
731 }
732 }
733
734 /*
735 * Commit the flags.
736 */
737 Assert(fEflNew & RT_BIT_32(1));
738 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
739 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
740
741 return VINF_SUCCESS;
742}
743
744
745/**
746 * Implements an indirect call.
747 *
748 * @param uNewPC The new program counter (RIP) value (loaded from the
749 * operand).
750 * @param enmEffOpSize The effective operand size.
751 */
752IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
753{
754 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
755 uint16_t uOldPC = pCtx->ip + cbInstr;
756 if (uNewPC > pCtx->cs.u32Limit)
757 return iemRaiseGeneralProtectionFault0(pVCpu);
758
759 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
760 if (rcStrict != VINF_SUCCESS)
761 return rcStrict;
762
763 pCtx->rip = uNewPC;
764 pCtx->eflags.Bits.u1RF = 0;
765
766#ifndef IEM_WITH_CODE_TLB
767 /* Flush the prefetch buffer. */
768 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
769#endif
770 return VINF_SUCCESS;
771}
772
773
774/**
775 * Implements a 16-bit relative call.
776 *
777 * @param offDisp The displacment offset.
778 */
779IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
780{
781 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
782 uint16_t uOldPC = pCtx->ip + cbInstr;
783 uint16_t uNewPC = uOldPC + offDisp;
784 if (uNewPC > pCtx->cs.u32Limit)
785 return iemRaiseGeneralProtectionFault0(pVCpu);
786
787 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
788 if (rcStrict != VINF_SUCCESS)
789 return rcStrict;
790
791 pCtx->rip = uNewPC;
792 pCtx->eflags.Bits.u1RF = 0;
793
794#ifndef IEM_WITH_CODE_TLB
795 /* Flush the prefetch buffer. */
796 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
797#endif
798 return VINF_SUCCESS;
799}
800
801
802/**
803 * Implements a 32-bit indirect call.
804 *
805 * @param uNewPC The new program counter (RIP) value (loaded from the
806 * operand).
807 * @param enmEffOpSize The effective operand size.
808 */
809IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
810{
811 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
812 uint32_t uOldPC = pCtx->eip + cbInstr;
813 if (uNewPC > pCtx->cs.u32Limit)
814 return iemRaiseGeneralProtectionFault0(pVCpu);
815
816 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
817 if (rcStrict != VINF_SUCCESS)
818 return rcStrict;
819
820#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
821 /*
822 * CASM hook for recording interesting indirect calls.
823 */
824 if ( !pCtx->eflags.Bits.u1IF
825 && (pCtx->cr0 & X86_CR0_PG)
826 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
827 && pVCpu->iem.s.uCpl == 0)
828 {
829 EMSTATE enmState = EMGetState(pVCpu);
830 if ( enmState == EMSTATE_IEM_THEN_REM
831 || enmState == EMSTATE_IEM
832 || enmState == EMSTATE_REM)
833 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
834 }
835#endif
836
837 pCtx->rip = uNewPC;
838 pCtx->eflags.Bits.u1RF = 0;
839
840#ifndef IEM_WITH_CODE_TLB
841 /* Flush the prefetch buffer. */
842 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
843#endif
844 return VINF_SUCCESS;
845}
846
847
848/**
849 * Implements a 32-bit relative call.
850 *
851 * @param offDisp The displacment offset.
852 */
853IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
854{
855 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
856 uint32_t uOldPC = pCtx->eip + cbInstr;
857 uint32_t uNewPC = uOldPC + offDisp;
858 if (uNewPC > pCtx->cs.u32Limit)
859 return iemRaiseGeneralProtectionFault0(pVCpu);
860
861 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
862 if (rcStrict != VINF_SUCCESS)
863 return rcStrict;
864
865 pCtx->rip = uNewPC;
866 pCtx->eflags.Bits.u1RF = 0;
867
868#ifndef IEM_WITH_CODE_TLB
869 /* Flush the prefetch buffer. */
870 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
871#endif
872 return VINF_SUCCESS;
873}
874
875
876/**
877 * Implements a 64-bit indirect call.
878 *
879 * @param uNewPC The new program counter (RIP) value (loaded from the
880 * operand).
881 * @param enmEffOpSize The effective operand size.
882 */
883IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
884{
885 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
886 uint64_t uOldPC = pCtx->rip + cbInstr;
887 if (!IEM_IS_CANONICAL(uNewPC))
888 return iemRaiseGeneralProtectionFault0(pVCpu);
889
890 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
891 if (rcStrict != VINF_SUCCESS)
892 return rcStrict;
893
894 pCtx->rip = uNewPC;
895 pCtx->eflags.Bits.u1RF = 0;
896
897#ifndef IEM_WITH_CODE_TLB
898 /* Flush the prefetch buffer. */
899 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
900#endif
901 return VINF_SUCCESS;
902}
903
904
905/**
906 * Implements a 64-bit relative call.
907 *
908 * @param offDisp The displacment offset.
909 */
910IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
911{
912 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
913 uint64_t uOldPC = pCtx->rip + cbInstr;
914 uint64_t uNewPC = uOldPC + offDisp;
915 if (!IEM_IS_CANONICAL(uNewPC))
916 return iemRaiseNotCanonical(pVCpu);
917
918 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
919 if (rcStrict != VINF_SUCCESS)
920 return rcStrict;
921
922 pCtx->rip = uNewPC;
923 pCtx->eflags.Bits.u1RF = 0;
924
925#ifndef IEM_WITH_CODE_TLB
926 /* Flush the prefetch buffer. */
927 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
928#endif
929
930 return VINF_SUCCESS;
931}
932
933
934/**
935 * Implements far jumps and calls thru task segments (TSS).
936 *
937 * @param uSel The selector.
938 * @param enmBranch The kind of branching we're performing.
939 * @param enmEffOpSize The effective operand size.
940 * @param pDesc The descriptor corresponding to @a uSel. The type is
941 * task gate.
942 */
943IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
944{
945#ifndef IEM_IMPLEMENTS_TASKSWITCH
946 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
947#else
948 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
949 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
950 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
951 RT_NOREF_PV(enmEffOpSize);
952
953 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
954 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
955 {
956 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
957 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
958 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
959 }
960
961 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
962 * far calls (see iemCImpl_callf). Most likely in both cases it should be
963 * checked here, need testcases. */
964 if (!pDesc->Legacy.Gen.u1Present)
965 {
966 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
967 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
968 }
969
970 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
971 uint32_t uNextEip = pCtx->eip + cbInstr;
972 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
973 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
974#endif
975}
976
977
978/**
979 * Implements far jumps and calls thru task gates.
980 *
981 * @param uSel The selector.
982 * @param enmBranch The kind of branching we're performing.
983 * @param enmEffOpSize The effective operand size.
984 * @param pDesc The descriptor corresponding to @a uSel. The type is
985 * task gate.
986 */
987IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
988{
989#ifndef IEM_IMPLEMENTS_TASKSWITCH
990 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
991#else
992 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
993 RT_NOREF_PV(enmEffOpSize);
994
995 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
996 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
997 {
998 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
999 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1000 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1001 }
1002
1003 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1004 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1005 * checked here, need testcases. */
1006 if (!pDesc->Legacy.Gen.u1Present)
1007 {
1008 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1009 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1010 }
1011
1012 /*
1013 * Fetch the new TSS descriptor from the GDT.
1014 */
1015 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1016 if (uSelTss & X86_SEL_LDT)
1017 {
1018 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1019 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1020 }
1021
1022 IEMSELDESC TssDesc;
1023 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1024 if (rcStrict != VINF_SUCCESS)
1025 return rcStrict;
1026
1027 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1028 {
1029 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1030 TssDesc.Legacy.Gate.u4Type));
1031 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1032 }
1033
1034 if (!TssDesc.Legacy.Gate.u1Present)
1035 {
1036 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1037 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1038 }
1039
1040 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1041 uint32_t uNextEip = pCtx->eip + cbInstr;
1042 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1043 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1044#endif
1045}
1046
1047
1048/**
1049 * Implements far jumps and calls thru call gates.
1050 *
1051 * @param uSel The selector.
1052 * @param enmBranch The kind of branching we're performing.
1053 * @param enmEffOpSize The effective operand size.
1054 * @param pDesc The descriptor corresponding to @a uSel. The type is
1055 * call gate.
1056 */
1057IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1058{
1059#define IEM_IMPLEMENTS_CALLGATE
1060#ifndef IEM_IMPLEMENTS_CALLGATE
1061 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1062#else
1063 RT_NOREF_PV(enmEffOpSize);
1064
1065 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1066 * inter-privilege calls and are much more complex.
1067 *
1068 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1069 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1070 * must be 16-bit or 32-bit.
1071 */
1072 /** @todo: effective operand size is probably irrelevant here, only the
1073 * call gate bitness matters??
1074 */
1075 VBOXSTRICTRC rcStrict;
1076 RTPTRUNION uPtrRet;
1077 uint64_t uNewRsp;
1078 uint64_t uNewRip;
1079 uint64_t u64Base;
1080 uint32_t cbLimit;
1081 RTSEL uNewCS;
1082 IEMSELDESC DescCS;
1083
1084 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1085 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1086 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1087 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1088
1089 /* Determine the new instruction pointer from the gate descriptor. */
1090 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1091 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1092 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1093
1094 /* Perform DPL checks on the gate descriptor. */
1095 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1096 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1097 {
1098 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1099 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1100 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1101 }
1102
1103 /** @todo does this catch NULL selectors, too? */
1104 if (!pDesc->Legacy.Gen.u1Present)
1105 {
1106 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1107 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1108 }
1109
1110 /*
1111 * Fetch the target CS descriptor from the GDT or LDT.
1112 */
1113 uNewCS = pDesc->Legacy.Gate.u16Sel;
1114 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1115 if (rcStrict != VINF_SUCCESS)
1116 return rcStrict;
1117
1118 /* Target CS must be a code selector. */
1119 if ( !DescCS.Legacy.Gen.u1DescType
1120 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1121 {
1122 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1123 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1124 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1125 }
1126
1127 /* Privilege checks on target CS. */
1128 if (enmBranch == IEMBRANCH_JUMP)
1129 {
1130 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1131 {
1132 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1133 {
1134 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1135 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1137 }
1138 }
1139 else
1140 {
1141 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1142 {
1143 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1144 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1145 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1146 }
1147 }
1148 }
1149 else
1150 {
1151 Assert(enmBranch == IEMBRANCH_CALL);
1152 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1153 {
1154 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1155 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1156 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1157 }
1158 }
1159
1160 /* Additional long mode checks. */
1161 if (IEM_IS_LONG_MODE(pVCpu))
1162 {
1163 if (!DescCS.Legacy.Gen.u1Long)
1164 {
1165 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1166 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1167 }
1168
1169 /* L vs D. */
1170 if ( DescCS.Legacy.Gen.u1Long
1171 && DescCS.Legacy.Gen.u1DefBig)
1172 {
1173 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1174 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1175 }
1176 }
1177
1178 if (!DescCS.Legacy.Gate.u1Present)
1179 {
1180 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1181 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1182 }
1183
1184 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1185
1186 if (enmBranch == IEMBRANCH_JUMP)
1187 {
1188 /** @todo: This is very similar to regular far jumps; merge! */
1189 /* Jumps are fairly simple... */
1190
1191 /* Chop the high bits off if 16-bit gate (Intel says so). */
1192 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1193 uNewRip = (uint16_t)uNewRip;
1194
1195 /* Limit check for non-long segments. */
1196 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1197 if (DescCS.Legacy.Gen.u1Long)
1198 u64Base = 0;
1199 else
1200 {
1201 if (uNewRip > cbLimit)
1202 {
1203 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1204 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1205 }
1206 u64Base = X86DESC_BASE(&DescCS.Legacy);
1207 }
1208
1209 /* Canonical address check. */
1210 if (!IEM_IS_CANONICAL(uNewRip))
1211 {
1212 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1213 return iemRaiseNotCanonical(pVCpu);
1214 }
1215
1216 /*
1217 * Ok, everything checked out fine. Now set the accessed bit before
1218 * committing the result into CS, CSHID and RIP.
1219 */
1220 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1221 {
1222 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1223 if (rcStrict != VINF_SUCCESS)
1224 return rcStrict;
1225 /** @todo check what VT-x and AMD-V does. */
1226 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1227 }
1228
1229 /* commit */
1230 pCtx->rip = uNewRip;
1231 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1232 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1233 pCtx->cs.ValidSel = pCtx->cs.Sel;
1234 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1235 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1236 pCtx->cs.u32Limit = cbLimit;
1237 pCtx->cs.u64Base = u64Base;
1238 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1239 }
1240 else
1241 {
1242 Assert(enmBranch == IEMBRANCH_CALL);
1243 /* Calls are much more complicated. */
1244
1245 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1246 {
1247 uint16_t offNewStack; /* Offset of new stack in TSS. */
1248 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1249 uint8_t uNewCSDpl;
1250 uint8_t cbWords;
1251 RTSEL uNewSS;
1252 RTSEL uOldSS;
1253 uint64_t uOldRsp;
1254 IEMSELDESC DescSS;
1255 RTPTRUNION uPtrTSS;
1256 RTGCPTR GCPtrTSS;
1257 RTPTRUNION uPtrParmWds;
1258 RTGCPTR GCPtrParmWds;
1259
1260 /* More privilege. This is the fun part. */
1261 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1262
1263 /*
1264 * Determine new SS:rSP from the TSS.
1265 */
1266 Assert(!pCtx->tr.Attr.n.u1DescType);
1267
1268 /* Figure out where the new stack pointer is stored in the TSS. */
1269 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1270 if (!IEM_IS_LONG_MODE(pVCpu))
1271 {
1272 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1273 {
1274 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1275 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1276 }
1277 else
1278 {
1279 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1280 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1281 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1282 }
1283 }
1284 else
1285 {
1286 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1287 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1288 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1289 }
1290
1291 /* Check against TSS limit. */
1292 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1293 {
1294 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1295 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1296 }
1297
1298 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1299 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1300 if (rcStrict != VINF_SUCCESS)
1301 {
1302 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1303 return rcStrict;
1304 }
1305
1306 if (!IEM_IS_LONG_MODE(pVCpu))
1307 {
1308 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1309 {
1310 uNewRsp = uPtrTSS.pu32[0];
1311 uNewSS = uPtrTSS.pu16[2];
1312 }
1313 else
1314 {
1315 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1316 uNewRsp = uPtrTSS.pu16[0];
1317 uNewSS = uPtrTSS.pu16[1];
1318 }
1319 }
1320 else
1321 {
1322 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1323 /* SS will be a NULL selector, but that's valid. */
1324 uNewRsp = uPtrTSS.pu64[0];
1325 uNewSS = uNewCSDpl;
1326 }
1327
1328 /* Done with the TSS now. */
1329 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1330 if (rcStrict != VINF_SUCCESS)
1331 {
1332 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1333 return rcStrict;
1334 }
1335
1336 /* Only used outside of long mode. */
1337 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1338
1339 /* If EFER.LMA is 0, there's extra work to do. */
1340 if (!IEM_IS_LONG_MODE(pVCpu))
1341 {
1342 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1343 {
1344 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1345 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1346 }
1347
1348 /* Grab the new SS descriptor. */
1349 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1350 if (rcStrict != VINF_SUCCESS)
1351 return rcStrict;
1352
1353 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1354 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1355 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1356 {
1357 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1358 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1359 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1360 }
1361
1362 /* Ensure new SS is a writable data segment. */
1363 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1364 {
1365 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1366 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1367 }
1368
1369 if (!DescSS.Legacy.Gen.u1Present)
1370 {
1371 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1372 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1373 }
1374 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1375 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1376 else
1377 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1378 }
1379 else
1380 {
1381 /* Just grab the new (NULL) SS descriptor. */
1382 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1383 * like we do... */
1384 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1385 if (rcStrict != VINF_SUCCESS)
1386 return rcStrict;
1387
1388 cbNewStack = sizeof(uint64_t) * 4;
1389 }
1390
1391 /** @todo: According to Intel, new stack is checked for enough space first,
1392 * then switched. According to AMD, the stack is switched first and
1393 * then pushes might fault!
1394 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1395 * incoming stack #PF happens before actual stack switch. AMD is
1396 * either lying or implicitly assumes that new state is committed
1397 * only if and when an instruction doesn't fault.
1398 */
1399
1400 /** @todo: According to AMD, CS is loaded first, then SS.
1401 * According to Intel, it's the other way around!?
1402 */
1403
1404 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1405
1406 /* Set the accessed bit before committing new SS. */
1407 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1408 {
1409 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1410 if (rcStrict != VINF_SUCCESS)
1411 return rcStrict;
1412 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1413 }
1414
1415 /* Remember the old SS:rSP and their linear address. */
1416 uOldSS = pCtx->ss.Sel;
1417 uOldRsp = pCtx->ss.Attr.n.u1DefBig ? pCtx->rsp : pCtx->sp;
1418
1419 GCPtrParmWds = pCtx->ss.u64Base + uOldRsp;
1420
1421 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1422 or #PF, the former is not implemented in this workaround. */
1423 /** @todo Proper fix callgate target stack exceptions. */
1424 /** @todo testcase: Cover callgates with partially or fully inaccessible
1425 * target stacks. */
1426 void *pvNewFrame;
1427 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1428 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1429 if (rcStrict != VINF_SUCCESS)
1430 {
1431 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1432 return rcStrict;
1433 }
1434 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1435 if (rcStrict != VINF_SUCCESS)
1436 {
1437 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1438 return rcStrict;
1439 }
1440
1441 /* Commit new SS:rSP. */
1442 pCtx->ss.Sel = uNewSS;
1443 pCtx->ss.ValidSel = uNewSS;
1444 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1445 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1446 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1447 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1448 pCtx->rsp = uNewRsp;
1449 pVCpu->iem.s.uCpl = uNewCSDpl;
1450 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1451 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1452
1453 /* At this point the stack access must not fail because new state was already committed. */
1454 /** @todo this can still fail due to SS.LIMIT not check. */
1455 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1456 &uPtrRet.pv, &uNewRsp);
1457 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1458 VERR_INTERNAL_ERROR_5);
1459
1460 if (!IEM_IS_LONG_MODE(pVCpu))
1461 {
1462 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1463 {
1464 /* Push the old CS:rIP. */
1465 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1466 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1467
1468 if (cbWords)
1469 {
1470 /* Map the relevant chunk of the old stack. */
1471 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1472 if (rcStrict != VINF_SUCCESS)
1473 {
1474 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1475 return rcStrict;
1476 }
1477
1478 /* Copy the parameter (d)words. */
1479 for (int i = 0; i < cbWords; ++i)
1480 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1481
1482 /* Unmap the old stack. */
1483 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1484 if (rcStrict != VINF_SUCCESS)
1485 {
1486 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1487 return rcStrict;
1488 }
1489 }
1490
1491 /* Push the old SS:rSP. */
1492 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1493 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1494 }
1495 else
1496 {
1497 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1498
1499 /* Push the old CS:rIP. */
1500 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1501 uPtrRet.pu16[1] = pCtx->cs.Sel;
1502
1503 if (cbWords)
1504 {
1505 /* Map the relevant chunk of the old stack. */
1506 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1507 if (rcStrict != VINF_SUCCESS)
1508 {
1509 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1510 return rcStrict;
1511 }
1512
1513 /* Copy the parameter words. */
1514 for (int i = 0; i < cbWords; ++i)
1515 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1516
1517 /* Unmap the old stack. */
1518 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1519 if (rcStrict != VINF_SUCCESS)
1520 {
1521 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1522 return rcStrict;
1523 }
1524 }
1525
1526 /* Push the old SS:rSP. */
1527 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1528 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1529 }
1530 }
1531 else
1532 {
1533 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1534
1535 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1536 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1537 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1538 uPtrRet.pu64[2] = uOldRsp;
1539 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1540 }
1541
1542 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1543 if (rcStrict != VINF_SUCCESS)
1544 {
1545 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1546 return rcStrict;
1547 }
1548
1549 /* Chop the high bits off if 16-bit gate (Intel says so). */
1550 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1551 uNewRip = (uint16_t)uNewRip;
1552
1553 /* Limit / canonical check. */
1554 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1555 if (!IEM_IS_LONG_MODE(pVCpu))
1556 {
1557 if (uNewRip > cbLimit)
1558 {
1559 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1560 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1561 }
1562 u64Base = X86DESC_BASE(&DescCS.Legacy);
1563 }
1564 else
1565 {
1566 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1567 if (!IEM_IS_CANONICAL(uNewRip))
1568 {
1569 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1570 return iemRaiseNotCanonical(pVCpu);
1571 }
1572 u64Base = 0;
1573 }
1574
1575 /*
1576 * Now set the accessed bit before
1577 * writing the return address to the stack and committing the result into
1578 * CS, CSHID and RIP.
1579 */
1580 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1581 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1582 {
1583 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1584 if (rcStrict != VINF_SUCCESS)
1585 return rcStrict;
1586 /** @todo check what VT-x and AMD-V does. */
1587 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1588 }
1589
1590 /* Commit new CS:rIP. */
1591 pCtx->rip = uNewRip;
1592 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1593 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1594 pCtx->cs.ValidSel = pCtx->cs.Sel;
1595 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1596 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1597 pCtx->cs.u32Limit = cbLimit;
1598 pCtx->cs.u64Base = u64Base;
1599 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1600 }
1601 else
1602 {
1603 /* Same privilege. */
1604 /** @todo: This is very similar to regular far calls; merge! */
1605
1606 /* Check stack first - may #SS(0). */
1607 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1608 * 16-bit code cause a two or four byte CS to be pushed? */
1609 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1610 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1611 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1612 &uPtrRet.pv, &uNewRsp);
1613 if (rcStrict != VINF_SUCCESS)
1614 return rcStrict;
1615
1616 /* Chop the high bits off if 16-bit gate (Intel says so). */
1617 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1618 uNewRip = (uint16_t)uNewRip;
1619
1620 /* Limit / canonical check. */
1621 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1622 if (!IEM_IS_LONG_MODE(pVCpu))
1623 {
1624 if (uNewRip > cbLimit)
1625 {
1626 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1627 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1628 }
1629 u64Base = X86DESC_BASE(&DescCS.Legacy);
1630 }
1631 else
1632 {
1633 if (!IEM_IS_CANONICAL(uNewRip))
1634 {
1635 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1636 return iemRaiseNotCanonical(pVCpu);
1637 }
1638 u64Base = 0;
1639 }
1640
1641 /*
1642 * Now set the accessed bit before
1643 * writing the return address to the stack and committing the result into
1644 * CS, CSHID and RIP.
1645 */
1646 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1647 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1648 {
1649 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1650 if (rcStrict != VINF_SUCCESS)
1651 return rcStrict;
1652 /** @todo check what VT-x and AMD-V does. */
1653 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1654 }
1655
1656 /* stack */
1657 if (!IEM_IS_LONG_MODE(pVCpu))
1658 {
1659 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1660 {
1661 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1662 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1663 }
1664 else
1665 {
1666 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1667 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1668 uPtrRet.pu16[1] = pCtx->cs.Sel;
1669 }
1670 }
1671 else
1672 {
1673 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1674 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1675 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1676 }
1677
1678 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1679 if (rcStrict != VINF_SUCCESS)
1680 return rcStrict;
1681
1682 /* commit */
1683 pCtx->rip = uNewRip;
1684 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1685 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1686 pCtx->cs.ValidSel = pCtx->cs.Sel;
1687 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1688 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1689 pCtx->cs.u32Limit = cbLimit;
1690 pCtx->cs.u64Base = u64Base;
1691 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1692 }
1693 }
1694 pCtx->eflags.Bits.u1RF = 0;
1695
1696 /* Flush the prefetch buffer. */
1697# ifdef IEM_WITH_CODE_TLB
1698 pVCpu->iem.s.pbInstrBuf = NULL;
1699# else
1700 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1701# endif
1702 return VINF_SUCCESS;
1703#endif
1704}
1705
1706
1707/**
1708 * Implements far jumps and calls thru system selectors.
1709 *
1710 * @param uSel The selector.
1711 * @param enmBranch The kind of branching we're performing.
1712 * @param enmEffOpSize The effective operand size.
1713 * @param pDesc The descriptor corresponding to @a uSel.
1714 */
1715IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1716{
1717 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1718 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1719
1720 if (IEM_IS_LONG_MODE(pVCpu))
1721 switch (pDesc->Legacy.Gen.u4Type)
1722 {
1723 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1724 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1725
1726 default:
1727 case AMD64_SEL_TYPE_SYS_LDT:
1728 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1729 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1730 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1731 case AMD64_SEL_TYPE_SYS_INT_GATE:
1732 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1733 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1734 }
1735
1736 switch (pDesc->Legacy.Gen.u4Type)
1737 {
1738 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1739 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1740 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1741
1742 case X86_SEL_TYPE_SYS_TASK_GATE:
1743 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1744
1745 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1746 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1747 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1748
1749 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1750 Log(("branch %04x -> busy 286 TSS\n", uSel));
1751 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1752
1753 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1754 Log(("branch %04x -> busy 386 TSS\n", uSel));
1755 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1756
1757 default:
1758 case X86_SEL_TYPE_SYS_LDT:
1759 case X86_SEL_TYPE_SYS_286_INT_GATE:
1760 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1761 case X86_SEL_TYPE_SYS_386_INT_GATE:
1762 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1763 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1764 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1765 }
1766}
1767
1768
1769/**
1770 * Implements far jumps.
1771 *
1772 * @param uSel The selector.
1773 * @param offSeg The segment offset.
1774 * @param enmEffOpSize The effective operand size.
1775 */
1776IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1777{
1778 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1779 NOREF(cbInstr);
1780 Assert(offSeg <= UINT32_MAX);
1781
1782 /*
1783 * Real mode and V8086 mode are easy. The only snag seems to be that
1784 * CS.limit doesn't change and the limit check is done against the current
1785 * limit.
1786 */
1787 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1788 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1789 {
1790 if (offSeg > pCtx->cs.u32Limit)
1791 {
1792 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1793 return iemRaiseGeneralProtectionFault0(pVCpu);
1794 }
1795
1796 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1797 pCtx->rip = offSeg;
1798 else
1799 pCtx->rip = offSeg & UINT16_MAX;
1800 pCtx->cs.Sel = uSel;
1801 pCtx->cs.ValidSel = uSel;
1802 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1803 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1804 pCtx->eflags.Bits.u1RF = 0;
1805 return VINF_SUCCESS;
1806 }
1807
1808 /*
1809 * Protected mode. Need to parse the specified descriptor...
1810 */
1811 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1812 {
1813 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1814 return iemRaiseGeneralProtectionFault0(pVCpu);
1815 }
1816
1817 /* Fetch the descriptor. */
1818 IEMSELDESC Desc;
1819 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1820 if (rcStrict != VINF_SUCCESS)
1821 return rcStrict;
1822
1823 /* Is it there? */
1824 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1825 {
1826 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1827 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1828 }
1829
1830 /*
1831 * Deal with it according to its type. We do the standard code selectors
1832 * here and dispatch the system selectors to worker functions.
1833 */
1834 if (!Desc.Legacy.Gen.u1DescType)
1835 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1836
1837 /* Only code segments. */
1838 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1839 {
1840 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1841 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1842 }
1843
1844 /* L vs D. */
1845 if ( Desc.Legacy.Gen.u1Long
1846 && Desc.Legacy.Gen.u1DefBig
1847 && IEM_IS_LONG_MODE(pVCpu))
1848 {
1849 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1850 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1851 }
1852
1853 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1854 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1855 {
1856 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1857 {
1858 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1859 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1860 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1861 }
1862 }
1863 else
1864 {
1865 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1866 {
1867 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1868 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1869 }
1870 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1871 {
1872 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1873 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1874 }
1875 }
1876
1877 /* Chop the high bits if 16-bit (Intel says so). */
1878 if (enmEffOpSize == IEMMODE_16BIT)
1879 offSeg &= UINT16_MAX;
1880
1881 /* Limit check. (Should alternatively check for non-canonical addresses
1882 here, but that is ruled out by offSeg being 32-bit, right?) */
1883 uint64_t u64Base;
1884 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1885 if (Desc.Legacy.Gen.u1Long)
1886 u64Base = 0;
1887 else
1888 {
1889 if (offSeg > cbLimit)
1890 {
1891 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1892 /** @todo: Intel says this is #GP(0)! */
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895 u64Base = X86DESC_BASE(&Desc.Legacy);
1896 }
1897
1898 /*
1899 * Ok, everything checked out fine. Now set the accessed bit before
1900 * committing the result into CS, CSHID and RIP.
1901 */
1902 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1903 {
1904 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1905 if (rcStrict != VINF_SUCCESS)
1906 return rcStrict;
1907 /** @todo check what VT-x and AMD-V does. */
1908 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1909 }
1910
1911 /* commit */
1912 pCtx->rip = offSeg;
1913 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1914 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1915 pCtx->cs.ValidSel = pCtx->cs.Sel;
1916 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1917 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1918 pCtx->cs.u32Limit = cbLimit;
1919 pCtx->cs.u64Base = u64Base;
1920 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1921 pCtx->eflags.Bits.u1RF = 0;
1922 /** @todo check if the hidden bits are loaded correctly for 64-bit
1923 * mode. */
1924
1925 /* Flush the prefetch buffer. */
1926#ifdef IEM_WITH_CODE_TLB
1927 pVCpu->iem.s.pbInstrBuf = NULL;
1928#else
1929 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1930#endif
1931
1932 return VINF_SUCCESS;
1933}
1934
1935
1936/**
1937 * Implements far calls.
1938 *
1939 * This very similar to iemCImpl_FarJmp.
1940 *
1941 * @param uSel The selector.
1942 * @param offSeg The segment offset.
1943 * @param enmEffOpSize The operand size (in case we need it).
1944 */
1945IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1946{
1947 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1948 VBOXSTRICTRC rcStrict;
1949 uint64_t uNewRsp;
1950 RTPTRUNION uPtrRet;
1951
1952 /*
1953 * Real mode and V8086 mode are easy. The only snag seems to be that
1954 * CS.limit doesn't change and the limit check is done against the current
1955 * limit.
1956 */
1957 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1958 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1959 {
1960 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1961
1962 /* Check stack first - may #SS(0). */
1963 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
1964 &uPtrRet.pv, &uNewRsp);
1965 if (rcStrict != VINF_SUCCESS)
1966 return rcStrict;
1967
1968 /* Check the target address range. */
1969 if (offSeg > UINT32_MAX)
1970 return iemRaiseGeneralProtectionFault0(pVCpu);
1971
1972 /* Everything is fine, push the return address. */
1973 if (enmEffOpSize == IEMMODE_16BIT)
1974 {
1975 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1976 uPtrRet.pu16[1] = pCtx->cs.Sel;
1977 }
1978 else
1979 {
1980 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1981 uPtrRet.pu16[3] = pCtx->cs.Sel;
1982 }
1983 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1984 if (rcStrict != VINF_SUCCESS)
1985 return rcStrict;
1986
1987 /* Branch. */
1988 pCtx->rip = offSeg;
1989 pCtx->cs.Sel = uSel;
1990 pCtx->cs.ValidSel = uSel;
1991 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1992 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1993 pCtx->eflags.Bits.u1RF = 0;
1994 return VINF_SUCCESS;
1995 }
1996
1997 /*
1998 * Protected mode. Need to parse the specified descriptor...
1999 */
2000 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2001 {
2002 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2003 return iemRaiseGeneralProtectionFault0(pVCpu);
2004 }
2005
2006 /* Fetch the descriptor. */
2007 IEMSELDESC Desc;
2008 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2009 if (rcStrict != VINF_SUCCESS)
2010 return rcStrict;
2011
2012 /*
2013 * Deal with it according to its type. We do the standard code selectors
2014 * here and dispatch the system selectors to worker functions.
2015 */
2016 if (!Desc.Legacy.Gen.u1DescType)
2017 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2018
2019 /* Only code segments. */
2020 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2021 {
2022 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2023 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2024 }
2025
2026 /* L vs D. */
2027 if ( Desc.Legacy.Gen.u1Long
2028 && Desc.Legacy.Gen.u1DefBig
2029 && IEM_IS_LONG_MODE(pVCpu))
2030 {
2031 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2032 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2033 }
2034
2035 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2036 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2037 {
2038 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2039 {
2040 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2041 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2042 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2043 }
2044 }
2045 else
2046 {
2047 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2048 {
2049 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2050 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2051 }
2052 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2053 {
2054 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2055 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2056 }
2057 }
2058
2059 /* Is it there? */
2060 if (!Desc.Legacy.Gen.u1Present)
2061 {
2062 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2063 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2064 }
2065
2066 /* Check stack first - may #SS(0). */
2067 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2068 * 16-bit code cause a two or four byte CS to be pushed? */
2069 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2070 enmEffOpSize == IEMMODE_64BIT ? 8+8
2071 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2072 &uPtrRet.pv, &uNewRsp);
2073 if (rcStrict != VINF_SUCCESS)
2074 return rcStrict;
2075
2076 /* Chop the high bits if 16-bit (Intel says so). */
2077 if (enmEffOpSize == IEMMODE_16BIT)
2078 offSeg &= UINT16_MAX;
2079
2080 /* Limit / canonical check. */
2081 uint64_t u64Base;
2082 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2083 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2084 {
2085 if (!IEM_IS_CANONICAL(offSeg))
2086 {
2087 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2088 return iemRaiseNotCanonical(pVCpu);
2089 }
2090 u64Base = 0;
2091 }
2092 else
2093 {
2094 if (offSeg > cbLimit)
2095 {
2096 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2097 /** @todo: Intel says this is #GP(0)! */
2098 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2099 }
2100 u64Base = X86DESC_BASE(&Desc.Legacy);
2101 }
2102
2103 /*
2104 * Now set the accessed bit before
2105 * writing the return address to the stack and committing the result into
2106 * CS, CSHID and RIP.
2107 */
2108 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2109 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2110 {
2111 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2112 if (rcStrict != VINF_SUCCESS)
2113 return rcStrict;
2114 /** @todo check what VT-x and AMD-V does. */
2115 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2116 }
2117
2118 /* stack */
2119 if (enmEffOpSize == IEMMODE_16BIT)
2120 {
2121 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2122 uPtrRet.pu16[1] = pCtx->cs.Sel;
2123 }
2124 else if (enmEffOpSize == IEMMODE_32BIT)
2125 {
2126 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2127 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2128 }
2129 else
2130 {
2131 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2132 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2133 }
2134 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2135 if (rcStrict != VINF_SUCCESS)
2136 return rcStrict;
2137
2138 /* commit */
2139 pCtx->rip = offSeg;
2140 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2141 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2142 pCtx->cs.ValidSel = pCtx->cs.Sel;
2143 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2144 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2145 pCtx->cs.u32Limit = cbLimit;
2146 pCtx->cs.u64Base = u64Base;
2147 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2148 pCtx->eflags.Bits.u1RF = 0;
2149 /** @todo check if the hidden bits are loaded correctly for 64-bit
2150 * mode. */
2151
2152 /* Flush the prefetch buffer. */
2153#ifdef IEM_WITH_CODE_TLB
2154 pVCpu->iem.s.pbInstrBuf = NULL;
2155#else
2156 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2157#endif
2158 return VINF_SUCCESS;
2159}
2160
2161
2162/**
2163 * Implements retf.
2164 *
2165 * @param enmEffOpSize The effective operand size.
2166 * @param cbPop The amount of arguments to pop from the stack
2167 * (bytes).
2168 */
2169IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2170{
2171 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2172 VBOXSTRICTRC rcStrict;
2173 RTCPTRUNION uPtrFrame;
2174 uint64_t uNewRsp;
2175 uint64_t uNewRip;
2176 uint16_t uNewCs;
2177 NOREF(cbInstr);
2178
2179 /*
2180 * Read the stack values first.
2181 */
2182 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2183 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2184 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2185 if (rcStrict != VINF_SUCCESS)
2186 return rcStrict;
2187 if (enmEffOpSize == IEMMODE_16BIT)
2188 {
2189 uNewRip = uPtrFrame.pu16[0];
2190 uNewCs = uPtrFrame.pu16[1];
2191 }
2192 else if (enmEffOpSize == IEMMODE_32BIT)
2193 {
2194 uNewRip = uPtrFrame.pu32[0];
2195 uNewCs = uPtrFrame.pu16[2];
2196 }
2197 else
2198 {
2199 uNewRip = uPtrFrame.pu64[0];
2200 uNewCs = uPtrFrame.pu16[4];
2201 }
2202 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2203 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2204 { /* extremely likely */ }
2205 else
2206 return rcStrict;
2207
2208 /*
2209 * Real mode and V8086 mode are easy.
2210 */
2211 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2212 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
2213 {
2214 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2215 /** @todo check how this is supposed to work if sp=0xfffe. */
2216
2217 /* Check the limit of the new EIP. */
2218 /** @todo Intel pseudo code only does the limit check for 16-bit
2219 * operands, AMD does not make any distinction. What is right? */
2220 if (uNewRip > pCtx->cs.u32Limit)
2221 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2222
2223 /* commit the operation. */
2224 pCtx->rsp = uNewRsp;
2225 pCtx->rip = uNewRip;
2226 pCtx->cs.Sel = uNewCs;
2227 pCtx->cs.ValidSel = uNewCs;
2228 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2229 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2230 pCtx->eflags.Bits.u1RF = 0;
2231 /** @todo do we load attribs and limit as well? */
2232 if (cbPop)
2233 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2234 return VINF_SUCCESS;
2235 }
2236
2237 /*
2238 * Protected mode is complicated, of course.
2239 */
2240 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2241 {
2242 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2243 return iemRaiseGeneralProtectionFault0(pVCpu);
2244 }
2245
2246 /* Fetch the descriptor. */
2247 IEMSELDESC DescCs;
2248 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2249 if (rcStrict != VINF_SUCCESS)
2250 return rcStrict;
2251
2252 /* Can only return to a code selector. */
2253 if ( !DescCs.Legacy.Gen.u1DescType
2254 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2255 {
2256 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2257 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2258 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2259 }
2260
2261 /* L vs D. */
2262 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2263 && DescCs.Legacy.Gen.u1DefBig
2264 && IEM_IS_LONG_MODE(pVCpu))
2265 {
2266 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2267 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2268 }
2269
2270 /* DPL/RPL/CPL checks. */
2271 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2272 {
2273 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2274 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2275 }
2276
2277 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2278 {
2279 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2280 {
2281 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2282 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2283 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2284 }
2285 }
2286 else
2287 {
2288 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2289 {
2290 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2291 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2292 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2293 }
2294 }
2295
2296 /* Is it there? */
2297 if (!DescCs.Legacy.Gen.u1Present)
2298 {
2299 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2300 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2301 }
2302
2303 /*
2304 * Return to outer privilege? (We'll typically have entered via a call gate.)
2305 */
2306 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2307 {
2308 /* Read the outer stack pointer stored *after* the parameters. */
2309 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2310 if (rcStrict != VINF_SUCCESS)
2311 return rcStrict;
2312
2313 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2314
2315 uint16_t uNewOuterSs;
2316 uint64_t uNewOuterRsp;
2317 if (enmEffOpSize == IEMMODE_16BIT)
2318 {
2319 uNewOuterRsp = uPtrFrame.pu16[0];
2320 uNewOuterSs = uPtrFrame.pu16[1];
2321 }
2322 else if (enmEffOpSize == IEMMODE_32BIT)
2323 {
2324 uNewOuterRsp = uPtrFrame.pu32[0];
2325 uNewOuterSs = uPtrFrame.pu16[2];
2326 }
2327 else
2328 {
2329 uNewOuterRsp = uPtrFrame.pu64[0];
2330 uNewOuterSs = uPtrFrame.pu16[4];
2331 }
2332 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2333 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2334 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2335 { /* extremely likely */ }
2336 else
2337 return rcStrict;
2338
2339 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2340 and read the selector. */
2341 IEMSELDESC DescSs;
2342 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2343 {
2344 if ( !DescCs.Legacy.Gen.u1Long
2345 || (uNewOuterSs & X86_SEL_RPL) == 3)
2346 {
2347 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2348 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2349 return iemRaiseGeneralProtectionFault0(pVCpu);
2350 }
2351 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2352 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2353 }
2354 else
2355 {
2356 /* Fetch the descriptor for the new stack segment. */
2357 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2358 if (rcStrict != VINF_SUCCESS)
2359 return rcStrict;
2360 }
2361
2362 /* Check that RPL of stack and code selectors match. */
2363 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2364 {
2365 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2366 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2367 }
2368
2369 /* Must be a writable data segment. */
2370 if ( !DescSs.Legacy.Gen.u1DescType
2371 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2372 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2373 {
2374 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2375 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2376 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2377 }
2378
2379 /* L vs D. (Not mentioned by intel.) */
2380 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2381 && DescSs.Legacy.Gen.u1DefBig
2382 && IEM_IS_LONG_MODE(pVCpu))
2383 {
2384 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2385 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2386 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2387 }
2388
2389 /* DPL/RPL/CPL checks. */
2390 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2391 {
2392 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2393 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2394 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2395 }
2396
2397 /* Is it there? */
2398 if (!DescSs.Legacy.Gen.u1Present)
2399 {
2400 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2401 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2402 }
2403
2404 /* Calc SS limit.*/
2405 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2406
2407 /* Is RIP canonical or within CS.limit? */
2408 uint64_t u64Base;
2409 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2410
2411 /** @todo Testcase: Is this correct? */
2412 if ( DescCs.Legacy.Gen.u1Long
2413 && IEM_IS_LONG_MODE(pVCpu) )
2414 {
2415 if (!IEM_IS_CANONICAL(uNewRip))
2416 {
2417 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2418 return iemRaiseNotCanonical(pVCpu);
2419 }
2420 u64Base = 0;
2421 }
2422 else
2423 {
2424 if (uNewRip > cbLimitCs)
2425 {
2426 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2427 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2428 /** @todo: Intel says this is #GP(0)! */
2429 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2430 }
2431 u64Base = X86DESC_BASE(&DescCs.Legacy);
2432 }
2433
2434 /*
2435 * Now set the accessed bit before
2436 * writing the return address to the stack and committing the result into
2437 * CS, CSHID and RIP.
2438 */
2439 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2440 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2441 {
2442 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2443 if (rcStrict != VINF_SUCCESS)
2444 return rcStrict;
2445 /** @todo check what VT-x and AMD-V does. */
2446 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2447 }
2448 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2449 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2450 {
2451 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2452 if (rcStrict != VINF_SUCCESS)
2453 return rcStrict;
2454 /** @todo check what VT-x and AMD-V does. */
2455 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2456 }
2457
2458 /* commit */
2459 if (enmEffOpSize == IEMMODE_16BIT)
2460 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2461 else
2462 pCtx->rip = uNewRip;
2463 pCtx->cs.Sel = uNewCs;
2464 pCtx->cs.ValidSel = uNewCs;
2465 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2466 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2467 pCtx->cs.u32Limit = cbLimitCs;
2468 pCtx->cs.u64Base = u64Base;
2469 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2470 pCtx->ss.Sel = uNewOuterSs;
2471 pCtx->ss.ValidSel = uNewOuterSs;
2472 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2473 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2474 pCtx->ss.u32Limit = cbLimitSs;
2475 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2476 pCtx->ss.u64Base = 0;
2477 else
2478 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2479 if (!pCtx->ss.Attr.n.u1DefBig)
2480 pCtx->sp = (uint16_t)uNewOuterRsp;
2481 else
2482 pCtx->rsp = uNewOuterRsp;
2483
2484 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2485 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2486 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2487 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2488 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2489
2490 /** @todo check if the hidden bits are loaded correctly for 64-bit
2491 * mode. */
2492
2493 if (cbPop)
2494 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2495 pCtx->eflags.Bits.u1RF = 0;
2496
2497 /* Done! */
2498 }
2499 /*
2500 * Return to the same privilege level
2501 */
2502 else
2503 {
2504 /* Limit / canonical check. */
2505 uint64_t u64Base;
2506 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2507
2508 /** @todo Testcase: Is this correct? */
2509 if ( DescCs.Legacy.Gen.u1Long
2510 && IEM_IS_LONG_MODE(pVCpu) )
2511 {
2512 if (!IEM_IS_CANONICAL(uNewRip))
2513 {
2514 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2515 return iemRaiseNotCanonical(pVCpu);
2516 }
2517 u64Base = 0;
2518 }
2519 else
2520 {
2521 if (uNewRip > cbLimitCs)
2522 {
2523 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2524 /** @todo: Intel says this is #GP(0)! */
2525 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2526 }
2527 u64Base = X86DESC_BASE(&DescCs.Legacy);
2528 }
2529
2530 /*
2531 * Now set the accessed bit before
2532 * writing the return address to the stack and committing the result into
2533 * CS, CSHID and RIP.
2534 */
2535 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2536 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2537 {
2538 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2539 if (rcStrict != VINF_SUCCESS)
2540 return rcStrict;
2541 /** @todo check what VT-x and AMD-V does. */
2542 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2543 }
2544
2545 /* commit */
2546 if (!pCtx->ss.Attr.n.u1DefBig)
2547 pCtx->sp = (uint16_t)uNewRsp;
2548 else
2549 pCtx->rsp = uNewRsp;
2550 if (enmEffOpSize == IEMMODE_16BIT)
2551 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2552 else
2553 pCtx->rip = uNewRip;
2554 pCtx->cs.Sel = uNewCs;
2555 pCtx->cs.ValidSel = uNewCs;
2556 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2557 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2558 pCtx->cs.u32Limit = cbLimitCs;
2559 pCtx->cs.u64Base = u64Base;
2560 /** @todo check if the hidden bits are loaded correctly for 64-bit
2561 * mode. */
2562 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2563 if (cbPop)
2564 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2565 pCtx->eflags.Bits.u1RF = 0;
2566 }
2567
2568 /* Flush the prefetch buffer. */
2569#ifdef IEM_WITH_CODE_TLB
2570 pVCpu->iem.s.pbInstrBuf = NULL;
2571#else
2572 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2573#endif
2574 return VINF_SUCCESS;
2575}
2576
2577
2578/**
2579 * Implements retn.
2580 *
2581 * We're doing this in C because of the \#GP that might be raised if the popped
2582 * program counter is out of bounds.
2583 *
2584 * @param enmEffOpSize The effective operand size.
2585 * @param cbPop The amount of arguments to pop from the stack
2586 * (bytes).
2587 */
2588IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2589{
2590 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2591 NOREF(cbInstr);
2592
2593 /* Fetch the RSP from the stack. */
2594 VBOXSTRICTRC rcStrict;
2595 RTUINT64U NewRip;
2596 RTUINT64U NewRsp;
2597 NewRsp.u = pCtx->rsp;
2598 switch (enmEffOpSize)
2599 {
2600 case IEMMODE_16BIT:
2601 NewRip.u = 0;
2602 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2603 break;
2604 case IEMMODE_32BIT:
2605 NewRip.u = 0;
2606 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2607 break;
2608 case IEMMODE_64BIT:
2609 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2610 break;
2611 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2612 }
2613 if (rcStrict != VINF_SUCCESS)
2614 return rcStrict;
2615
2616 /* Check the new RSP before loading it. */
2617 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2618 * of it. The canonical test is performed here and for call. */
2619 if (enmEffOpSize != IEMMODE_64BIT)
2620 {
2621 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2622 {
2623 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2624 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2625 }
2626 }
2627 else
2628 {
2629 if (!IEM_IS_CANONICAL(NewRip.u))
2630 {
2631 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2632 return iemRaiseNotCanonical(pVCpu);
2633 }
2634 }
2635
2636 /* Apply cbPop */
2637 if (cbPop)
2638 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2639
2640 /* Commit it. */
2641 pCtx->rip = NewRip.u;
2642 pCtx->rsp = NewRsp.u;
2643 pCtx->eflags.Bits.u1RF = 0;
2644
2645 /* Flush the prefetch buffer. */
2646#ifndef IEM_WITH_CODE_TLB
2647 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2648#endif
2649
2650 return VINF_SUCCESS;
2651}
2652
2653
2654/**
2655 * Implements enter.
2656 *
2657 * We're doing this in C because the instruction is insane, even for the
2658 * u8NestingLevel=0 case dealing with the stack is tedious.
2659 *
2660 * @param enmEffOpSize The effective operand size.
2661 */
2662IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2663{
2664 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2665
2666 /* Push RBP, saving the old value in TmpRbp. */
2667 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2668 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2669 RTUINT64U NewRbp;
2670 VBOXSTRICTRC rcStrict;
2671 if (enmEffOpSize == IEMMODE_64BIT)
2672 {
2673 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2674 NewRbp = NewRsp;
2675 }
2676 else if (enmEffOpSize == IEMMODE_32BIT)
2677 {
2678 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2679 NewRbp = NewRsp;
2680 }
2681 else
2682 {
2683 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2684 NewRbp = TmpRbp;
2685 NewRbp.Words.w0 = NewRsp.Words.w0;
2686 }
2687 if (rcStrict != VINF_SUCCESS)
2688 return rcStrict;
2689
2690 /* Copy the parameters (aka nesting levels by Intel). */
2691 cParameters &= 0x1f;
2692 if (cParameters > 0)
2693 {
2694 switch (enmEffOpSize)
2695 {
2696 case IEMMODE_16BIT:
2697 if (pCtx->ss.Attr.n.u1DefBig)
2698 TmpRbp.DWords.dw0 -= 2;
2699 else
2700 TmpRbp.Words.w0 -= 2;
2701 do
2702 {
2703 uint16_t u16Tmp;
2704 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2705 if (rcStrict != VINF_SUCCESS)
2706 break;
2707 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2708 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2709 break;
2710
2711 case IEMMODE_32BIT:
2712 if (pCtx->ss.Attr.n.u1DefBig)
2713 TmpRbp.DWords.dw0 -= 4;
2714 else
2715 TmpRbp.Words.w0 -= 4;
2716 do
2717 {
2718 uint32_t u32Tmp;
2719 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2720 if (rcStrict != VINF_SUCCESS)
2721 break;
2722 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2723 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2724 break;
2725
2726 case IEMMODE_64BIT:
2727 TmpRbp.u -= 8;
2728 do
2729 {
2730 uint64_t u64Tmp;
2731 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2732 if (rcStrict != VINF_SUCCESS)
2733 break;
2734 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2735 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2736 break;
2737
2738 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2739 }
2740 if (rcStrict != VINF_SUCCESS)
2741 return VINF_SUCCESS;
2742
2743 /* Push the new RBP */
2744 if (enmEffOpSize == IEMMODE_64BIT)
2745 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2746 else if (enmEffOpSize == IEMMODE_32BIT)
2747 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2748 else
2749 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2750 if (rcStrict != VINF_SUCCESS)
2751 return rcStrict;
2752
2753 }
2754
2755 /* Recalc RSP. */
2756 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2757
2758 /** @todo Should probe write access at the new RSP according to AMD. */
2759
2760 /* Commit it. */
2761 pCtx->rbp = NewRbp.u;
2762 pCtx->rsp = NewRsp.u;
2763 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2764
2765 return VINF_SUCCESS;
2766}
2767
2768
2769
2770/**
2771 * Implements leave.
2772 *
2773 * We're doing this in C because messing with the stack registers is annoying
2774 * since they depends on SS attributes.
2775 *
2776 * @param enmEffOpSize The effective operand size.
2777 */
2778IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2779{
2780 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2781
2782 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2783 RTUINT64U NewRsp;
2784 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2785 NewRsp.u = pCtx->rbp;
2786 else if (pCtx->ss.Attr.n.u1DefBig)
2787 NewRsp.u = pCtx->ebp;
2788 else
2789 {
2790 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2791 NewRsp.u = pCtx->rsp;
2792 NewRsp.Words.w0 = pCtx->bp;
2793 }
2794
2795 /* Pop RBP according to the operand size. */
2796 VBOXSTRICTRC rcStrict;
2797 RTUINT64U NewRbp;
2798 switch (enmEffOpSize)
2799 {
2800 case IEMMODE_16BIT:
2801 NewRbp.u = pCtx->rbp;
2802 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2803 break;
2804 case IEMMODE_32BIT:
2805 NewRbp.u = 0;
2806 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2807 break;
2808 case IEMMODE_64BIT:
2809 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2810 break;
2811 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2812 }
2813 if (rcStrict != VINF_SUCCESS)
2814 return rcStrict;
2815
2816
2817 /* Commit it. */
2818 pCtx->rbp = NewRbp.u;
2819 pCtx->rsp = NewRsp.u;
2820 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2821
2822 return VINF_SUCCESS;
2823}
2824
2825
2826/**
2827 * Implements int3 and int XX.
2828 *
2829 * @param u8Int The interrupt vector number.
2830 * @param fIsBpInstr Is it the breakpoint instruction.
2831 */
2832IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
2833{
2834 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2835 return iemRaiseXcptOrInt(pVCpu,
2836 cbInstr,
2837 u8Int,
2838 (fIsBpInstr ? IEM_XCPT_FLAGS_BP_INSTR : 0) | IEM_XCPT_FLAGS_T_SOFT_INT,
2839 0,
2840 0);
2841}
2842
2843
2844/**
2845 * Implements iret for real mode and V8086 mode.
2846 *
2847 * @param enmEffOpSize The effective operand size.
2848 */
2849IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2850{
2851 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2852 X86EFLAGS Efl;
2853 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2854 NOREF(cbInstr);
2855
2856 /*
2857 * iret throws an exception if VME isn't enabled.
2858 */
2859 if ( Efl.Bits.u1VM
2860 && Efl.Bits.u2IOPL != 3
2861 && !(pCtx->cr4 & X86_CR4_VME))
2862 return iemRaiseGeneralProtectionFault0(pVCpu);
2863
2864 /*
2865 * Do the stack bits, but don't commit RSP before everything checks
2866 * out right.
2867 */
2868 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2869 VBOXSTRICTRC rcStrict;
2870 RTCPTRUNION uFrame;
2871 uint16_t uNewCs;
2872 uint32_t uNewEip;
2873 uint32_t uNewFlags;
2874 uint64_t uNewRsp;
2875 if (enmEffOpSize == IEMMODE_32BIT)
2876 {
2877 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2878 if (rcStrict != VINF_SUCCESS)
2879 return rcStrict;
2880 uNewEip = uFrame.pu32[0];
2881 if (uNewEip > UINT16_MAX)
2882 return iemRaiseGeneralProtectionFault0(pVCpu);
2883
2884 uNewCs = (uint16_t)uFrame.pu32[1];
2885 uNewFlags = uFrame.pu32[2];
2886 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2887 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2888 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2889 | X86_EFL_ID;
2890 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2891 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2892 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2893 }
2894 else
2895 {
2896 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2897 if (rcStrict != VINF_SUCCESS)
2898 return rcStrict;
2899 uNewEip = uFrame.pu16[0];
2900 uNewCs = uFrame.pu16[1];
2901 uNewFlags = uFrame.pu16[2];
2902 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2903 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2904 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2905 /** @todo The intel pseudo code does not indicate what happens to
2906 * reserved flags. We just ignore them. */
2907 /* Ancient CPU adjustments: See iemCImpl_popf. */
2908 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2909 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2910 }
2911 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2912 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2913 { /* extremely likely */ }
2914 else
2915 return rcStrict;
2916
2917 /** @todo Check how this is supposed to work if sp=0xfffe. */
2918 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2919 uNewCs, uNewEip, uNewFlags, uNewRsp));
2920
2921 /*
2922 * Check the limit of the new EIP.
2923 */
2924 /** @todo Only the AMD pseudo code check the limit here, what's
2925 * right? */
2926 if (uNewEip > pCtx->cs.u32Limit)
2927 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2928
2929 /*
2930 * V8086 checks and flag adjustments
2931 */
2932 if (Efl.Bits.u1VM)
2933 {
2934 if (Efl.Bits.u2IOPL == 3)
2935 {
2936 /* Preserve IOPL and clear RF. */
2937 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2938 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2939 }
2940 else if ( enmEffOpSize == IEMMODE_16BIT
2941 && ( !(uNewFlags & X86_EFL_IF)
2942 || !Efl.Bits.u1VIP )
2943 && !(uNewFlags & X86_EFL_TF) )
2944 {
2945 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2946 uNewFlags &= ~X86_EFL_VIF;
2947 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2948 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2949 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2950 }
2951 else
2952 return iemRaiseGeneralProtectionFault0(pVCpu);
2953 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2954 }
2955
2956 /*
2957 * Commit the operation.
2958 */
2959#ifdef DBGFTRACE_ENABLED
2960 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2961 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2962#endif
2963 pCtx->rsp = uNewRsp;
2964 pCtx->rip = uNewEip;
2965 pCtx->cs.Sel = uNewCs;
2966 pCtx->cs.ValidSel = uNewCs;
2967 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2968 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2969 /** @todo do we load attribs and limit as well? */
2970 Assert(uNewFlags & X86_EFL_1);
2971 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
2972
2973 /* Flush the prefetch buffer. */
2974#ifdef IEM_WITH_CODE_TLB
2975 pVCpu->iem.s.pbInstrBuf = NULL;
2976#else
2977 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2978#endif
2979
2980 return VINF_SUCCESS;
2981}
2982
2983
2984/**
2985 * Loads a segment register when entering V8086 mode.
2986 *
2987 * @param pSReg The segment register.
2988 * @param uSeg The segment to load.
2989 */
2990static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
2991{
2992 pSReg->Sel = uSeg;
2993 pSReg->ValidSel = uSeg;
2994 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
2995 pSReg->u64Base = (uint32_t)uSeg << 4;
2996 pSReg->u32Limit = 0xffff;
2997 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
2998 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
2999 * IRET'ing to V8086. */
3000}
3001
3002
3003/**
3004 * Implements iret for protected mode returning to V8086 mode.
3005 *
3006 * @param pCtx Pointer to the CPU context.
3007 * @param uNewEip The new EIP.
3008 * @param uNewCs The new CS.
3009 * @param uNewFlags The new EFLAGS.
3010 * @param uNewRsp The RSP after the initial IRET frame.
3011 *
3012 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3013 */
3014IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
3015 uint32_t, uNewFlags, uint64_t, uNewRsp)
3016{
3017 RT_NOREF_PV(cbInstr);
3018
3019 /*
3020 * Pop the V8086 specific frame bits off the stack.
3021 */
3022 VBOXSTRICTRC rcStrict;
3023 RTCPTRUNION uFrame;
3024 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3025 if (rcStrict != VINF_SUCCESS)
3026 return rcStrict;
3027 uint32_t uNewEsp = uFrame.pu32[0];
3028 uint16_t uNewSs = uFrame.pu32[1];
3029 uint16_t uNewEs = uFrame.pu32[2];
3030 uint16_t uNewDs = uFrame.pu32[3];
3031 uint16_t uNewFs = uFrame.pu32[4];
3032 uint16_t uNewGs = uFrame.pu32[5];
3033 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3034 if (rcStrict != VINF_SUCCESS)
3035 return rcStrict;
3036
3037 /*
3038 * Commit the operation.
3039 */
3040 uNewFlags &= X86_EFL_LIVE_MASK;
3041 uNewFlags |= X86_EFL_RA1_MASK;
3042#ifdef DBGFTRACE_ENABLED
3043 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3044 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3045#endif
3046 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3047
3048 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3049 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
3050 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
3051 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
3052 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
3053 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
3054 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
3055 pCtx->rip = (uint16_t)uNewEip;
3056 pCtx->rsp = uNewEsp; /** @todo check this out! */
3057 pVCpu->iem.s.uCpl = 3;
3058
3059 /* Flush the prefetch buffer. */
3060#ifdef IEM_WITH_CODE_TLB
3061 pVCpu->iem.s.pbInstrBuf = NULL;
3062#else
3063 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3064#endif
3065
3066 return VINF_SUCCESS;
3067}
3068
3069
3070/**
3071 * Implements iret for protected mode returning via a nested task.
3072 *
3073 * @param enmEffOpSize The effective operand size.
3074 */
3075IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3076{
3077 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3078#ifndef IEM_IMPLEMENTS_TASKSWITCH
3079 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3080#else
3081 RT_NOREF_PV(enmEffOpSize);
3082
3083 /*
3084 * Read the segment selector in the link-field of the current TSS.
3085 */
3086 RTSEL uSelRet;
3087 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3088 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
3089 if (rcStrict != VINF_SUCCESS)
3090 return rcStrict;
3091
3092 /*
3093 * Fetch the returning task's TSS descriptor from the GDT.
3094 */
3095 if (uSelRet & X86_SEL_LDT)
3096 {
3097 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3098 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3099 }
3100
3101 IEMSELDESC TssDesc;
3102 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3103 if (rcStrict != VINF_SUCCESS)
3104 return rcStrict;
3105
3106 if (TssDesc.Legacy.Gate.u1DescType)
3107 {
3108 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3109 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3110 }
3111
3112 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3113 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3114 {
3115 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3116 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3117 }
3118
3119 if (!TssDesc.Legacy.Gate.u1Present)
3120 {
3121 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3122 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3123 }
3124
3125 uint32_t uNextEip = pCtx->eip + cbInstr;
3126 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3127 0 /* uCr2 */, uSelRet, &TssDesc);
3128#endif
3129}
3130
3131
3132/**
3133 * Implements iret for protected mode
3134 *
3135 * @param enmEffOpSize The effective operand size.
3136 */
3137IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3138{
3139 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3140 NOREF(cbInstr);
3141 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3142
3143 /*
3144 * Nested task return.
3145 */
3146 if (pCtx->eflags.Bits.u1NT)
3147 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3148
3149 /*
3150 * Normal return.
3151 *
3152 * Do the stack bits, but don't commit RSP before everything checks
3153 * out right.
3154 */
3155 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3156 VBOXSTRICTRC rcStrict;
3157 RTCPTRUNION uFrame;
3158 uint16_t uNewCs;
3159 uint32_t uNewEip;
3160 uint32_t uNewFlags;
3161 uint64_t uNewRsp;
3162 if (enmEffOpSize == IEMMODE_32BIT)
3163 {
3164 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3165 if (rcStrict != VINF_SUCCESS)
3166 return rcStrict;
3167 uNewEip = uFrame.pu32[0];
3168 uNewCs = (uint16_t)uFrame.pu32[1];
3169 uNewFlags = uFrame.pu32[2];
3170 }
3171 else
3172 {
3173 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3174 if (rcStrict != VINF_SUCCESS)
3175 return rcStrict;
3176 uNewEip = uFrame.pu16[0];
3177 uNewCs = uFrame.pu16[1];
3178 uNewFlags = uFrame.pu16[2];
3179 }
3180 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3181 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3182 { /* extremely likely */ }
3183 else
3184 return rcStrict;
3185 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3186
3187 /*
3188 * We're hopefully not returning to V8086 mode...
3189 */
3190 if ( (uNewFlags & X86_EFL_VM)
3191 && pVCpu->iem.s.uCpl == 0)
3192 {
3193 Assert(enmEffOpSize == IEMMODE_32BIT);
3194 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3195 }
3196
3197 /*
3198 * Protected mode.
3199 */
3200 /* Read the CS descriptor. */
3201 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3202 {
3203 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3204 return iemRaiseGeneralProtectionFault0(pVCpu);
3205 }
3206
3207 IEMSELDESC DescCS;
3208 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3209 if (rcStrict != VINF_SUCCESS)
3210 {
3211 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3212 return rcStrict;
3213 }
3214
3215 /* Must be a code descriptor. */
3216 if (!DescCS.Legacy.Gen.u1DescType)
3217 {
3218 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3219 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3220 }
3221 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3222 {
3223 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3224 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3225 }
3226
3227#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3228 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3229 PVM pVM = pVCpu->CTX_SUFF(pVM);
3230 if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
3231 {
3232 if ((uNewCs & X86_SEL_RPL) == 1)
3233 {
3234 if ( pVCpu->iem.s.uCpl == 0
3235 && ( !EMIsRawRing1Enabled(pVM)
3236 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3237 {
3238 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3239 uNewCs &= X86_SEL_MASK_OFF_RPL;
3240 }
3241# ifdef LOG_ENABLED
3242 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3243 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3244# endif
3245 }
3246 else if ( (uNewCs & X86_SEL_RPL) == 2
3247 && EMIsRawRing1Enabled(pVM)
3248 && pVCpu->iem.s.uCpl <= 1)
3249 {
3250 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3251 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3252 }
3253 }
3254#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3255
3256
3257 /* Privilege checks. */
3258 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3259 {
3260 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3261 {
3262 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3263 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3264 }
3265 }
3266 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3267 {
3268 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3269 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3270 }
3271 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3272 {
3273 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3274 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3275 }
3276
3277 /* Present? */
3278 if (!DescCS.Legacy.Gen.u1Present)
3279 {
3280 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3281 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3282 }
3283
3284 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3285
3286 /*
3287 * Return to outer level?
3288 */
3289 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3290 {
3291 uint16_t uNewSS;
3292 uint32_t uNewESP;
3293 if (enmEffOpSize == IEMMODE_32BIT)
3294 {
3295 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3296 if (rcStrict != VINF_SUCCESS)
3297 return rcStrict;
3298/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3299 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3300 * bit of the popped SS selector it turns out. */
3301 uNewESP = uFrame.pu32[0];
3302 uNewSS = (uint16_t)uFrame.pu32[1];
3303 }
3304 else
3305 {
3306 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3307 if (rcStrict != VINF_SUCCESS)
3308 return rcStrict;
3309 uNewESP = uFrame.pu16[0];
3310 uNewSS = uFrame.pu16[1];
3311 }
3312 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3313 if (rcStrict != VINF_SUCCESS)
3314 return rcStrict;
3315 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3316
3317 /* Read the SS descriptor. */
3318 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3319 {
3320 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3321 return iemRaiseGeneralProtectionFault0(pVCpu);
3322 }
3323
3324 IEMSELDESC DescSS;
3325 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3326 if (rcStrict != VINF_SUCCESS)
3327 {
3328 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3329 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3330 return rcStrict;
3331 }
3332
3333 /* Privilege checks. */
3334 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3335 {
3336 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3337 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3338 }
3339 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3340 {
3341 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3342 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3343 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3344 }
3345
3346 /* Must be a writeable data segment descriptor. */
3347 if (!DescSS.Legacy.Gen.u1DescType)
3348 {
3349 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3350 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3351 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3352 }
3353 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3354 {
3355 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3356 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3357 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3358 }
3359
3360 /* Present? */
3361 if (!DescSS.Legacy.Gen.u1Present)
3362 {
3363 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3364 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3365 }
3366
3367 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3368
3369 /* Check EIP. */
3370 if (uNewEip > cbLimitCS)
3371 {
3372 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3373 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3374 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3375 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3376 }
3377
3378 /*
3379 * Commit the changes, marking CS and SS accessed first since
3380 * that may fail.
3381 */
3382 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3383 {
3384 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3385 if (rcStrict != VINF_SUCCESS)
3386 return rcStrict;
3387 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3388 }
3389 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3390 {
3391 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3392 if (rcStrict != VINF_SUCCESS)
3393 return rcStrict;
3394 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3395 }
3396
3397 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3398 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3399 if (enmEffOpSize != IEMMODE_16BIT)
3400 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3401 if (pVCpu->iem.s.uCpl == 0)
3402 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3403 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3404 fEFlagsMask |= X86_EFL_IF;
3405 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3406 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3407 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3408 fEFlagsNew &= ~fEFlagsMask;
3409 fEFlagsNew |= uNewFlags & fEFlagsMask;
3410#ifdef DBGFTRACE_ENABLED
3411 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3412 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3413 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3414#endif
3415
3416 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3417 pCtx->rip = uNewEip;
3418 pCtx->cs.Sel = uNewCs;
3419 pCtx->cs.ValidSel = uNewCs;
3420 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3421 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3422 pCtx->cs.u32Limit = cbLimitCS;
3423 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3424 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3425
3426 pCtx->ss.Sel = uNewSS;
3427 pCtx->ss.ValidSel = uNewSS;
3428 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3429 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3430 pCtx->ss.u32Limit = cbLimitSs;
3431 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3432 if (!pCtx->ss.Attr.n.u1DefBig)
3433 pCtx->sp = (uint16_t)uNewESP;
3434 else
3435 pCtx->rsp = uNewESP;
3436
3437 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3438 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3439 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3440 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3441 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3442
3443 /* Done! */
3444
3445 }
3446 /*
3447 * Return to the same level.
3448 */
3449 else
3450 {
3451 /* Check EIP. */
3452 if (uNewEip > cbLimitCS)
3453 {
3454 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3455 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3456 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3457 }
3458
3459 /*
3460 * Commit the changes, marking CS first since it may fail.
3461 */
3462 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3463 {
3464 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3465 if (rcStrict != VINF_SUCCESS)
3466 return rcStrict;
3467 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3468 }
3469
3470 X86EFLAGS NewEfl;
3471 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3472 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3473 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3474 if (enmEffOpSize != IEMMODE_16BIT)
3475 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3476 if (pVCpu->iem.s.uCpl == 0)
3477 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3478 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3479 fEFlagsMask |= X86_EFL_IF;
3480 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3481 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3482 NewEfl.u &= ~fEFlagsMask;
3483 NewEfl.u |= fEFlagsMask & uNewFlags;
3484#ifdef DBGFTRACE_ENABLED
3485 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3486 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3487 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3488#endif
3489
3490 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3491 pCtx->rip = uNewEip;
3492 pCtx->cs.Sel = uNewCs;
3493 pCtx->cs.ValidSel = uNewCs;
3494 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3495 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3496 pCtx->cs.u32Limit = cbLimitCS;
3497 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3498 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3499 if (!pCtx->ss.Attr.n.u1DefBig)
3500 pCtx->sp = (uint16_t)uNewRsp;
3501 else
3502 pCtx->rsp = uNewRsp;
3503 /* Done! */
3504 }
3505
3506 /* Flush the prefetch buffer. */
3507#ifdef IEM_WITH_CODE_TLB
3508 pVCpu->iem.s.pbInstrBuf = NULL;
3509#else
3510 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3511#endif
3512
3513 return VINF_SUCCESS;
3514}
3515
3516
3517/**
3518 * Implements iret for long mode
3519 *
3520 * @param enmEffOpSize The effective operand size.
3521 */
3522IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3523{
3524 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3525 NOREF(cbInstr);
3526
3527 /*
3528 * Nested task return is not supported in long mode.
3529 */
3530 if (pCtx->eflags.Bits.u1NT)
3531 {
3532 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3533 return iemRaiseGeneralProtectionFault0(pVCpu);
3534 }
3535
3536 /*
3537 * Normal return.
3538 *
3539 * Do the stack bits, but don't commit RSP before everything checks
3540 * out right.
3541 */
3542 VBOXSTRICTRC rcStrict;
3543 RTCPTRUNION uFrame;
3544 uint64_t uNewRip;
3545 uint16_t uNewCs;
3546 uint16_t uNewSs;
3547 uint32_t uNewFlags;
3548 uint64_t uNewRsp;
3549 if (enmEffOpSize == IEMMODE_64BIT)
3550 {
3551 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3552 if (rcStrict != VINF_SUCCESS)
3553 return rcStrict;
3554 uNewRip = uFrame.pu64[0];
3555 uNewCs = (uint16_t)uFrame.pu64[1];
3556 uNewFlags = (uint32_t)uFrame.pu64[2];
3557 uNewRsp = uFrame.pu64[3];
3558 uNewSs = (uint16_t)uFrame.pu64[4];
3559 }
3560 else if (enmEffOpSize == IEMMODE_32BIT)
3561 {
3562 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3563 if (rcStrict != VINF_SUCCESS)
3564 return rcStrict;
3565 uNewRip = uFrame.pu32[0];
3566 uNewCs = (uint16_t)uFrame.pu32[1];
3567 uNewFlags = uFrame.pu32[2];
3568 uNewRsp = uFrame.pu32[3];
3569 uNewSs = (uint16_t)uFrame.pu32[4];
3570 }
3571 else
3572 {
3573 Assert(enmEffOpSize == IEMMODE_16BIT);
3574 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3575 if (rcStrict != VINF_SUCCESS)
3576 return rcStrict;
3577 uNewRip = uFrame.pu16[0];
3578 uNewCs = uFrame.pu16[1];
3579 uNewFlags = uFrame.pu16[2];
3580 uNewRsp = uFrame.pu16[3];
3581 uNewSs = uFrame.pu16[4];
3582 }
3583 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3584 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3585 { /* extremely like */ }
3586 else
3587 return rcStrict;
3588 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3589
3590 /*
3591 * Check stuff.
3592 */
3593 /* Read the CS descriptor. */
3594 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3595 {
3596 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3597 return iemRaiseGeneralProtectionFault0(pVCpu);
3598 }
3599
3600 IEMSELDESC DescCS;
3601 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3602 if (rcStrict != VINF_SUCCESS)
3603 {
3604 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3605 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3606 return rcStrict;
3607 }
3608
3609 /* Must be a code descriptor. */
3610 if ( !DescCS.Legacy.Gen.u1DescType
3611 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3612 {
3613 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3614 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3615 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3616 }
3617
3618 /* Privilege checks. */
3619 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3620 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3621 {
3622 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3623 {
3624 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3625 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3626 }
3627 }
3628 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3629 {
3630 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3631 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3632 }
3633 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3634 {
3635 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3636 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3637 }
3638
3639 /* Present? */
3640 if (!DescCS.Legacy.Gen.u1Present)
3641 {
3642 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3643 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3644 }
3645
3646 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3647
3648 /* Read the SS descriptor. */
3649 IEMSELDESC DescSS;
3650 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3651 {
3652 if ( !DescCS.Legacy.Gen.u1Long
3653 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3654 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3655 {
3656 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3657 return iemRaiseGeneralProtectionFault0(pVCpu);
3658 }
3659 DescSS.Legacy.u = 0;
3660 }
3661 else
3662 {
3663 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3664 if (rcStrict != VINF_SUCCESS)
3665 {
3666 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3667 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3668 return rcStrict;
3669 }
3670 }
3671
3672 /* Privilege checks. */
3673 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3674 {
3675 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3676 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3677 }
3678
3679 uint32_t cbLimitSs;
3680 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3681 cbLimitSs = UINT32_MAX;
3682 else
3683 {
3684 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3685 {
3686 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3687 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3688 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3689 }
3690
3691 /* Must be a writeable data segment descriptor. */
3692 if (!DescSS.Legacy.Gen.u1DescType)
3693 {
3694 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3695 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3696 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3697 }
3698 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3699 {
3700 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3701 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3702 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3703 }
3704
3705 /* Present? */
3706 if (!DescSS.Legacy.Gen.u1Present)
3707 {
3708 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3709 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3710 }
3711 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3712 }
3713
3714 /* Check EIP. */
3715 if (DescCS.Legacy.Gen.u1Long)
3716 {
3717 if (!IEM_IS_CANONICAL(uNewRip))
3718 {
3719 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3720 uNewCs, uNewRip, uNewSs, uNewRsp));
3721 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3722 }
3723 }
3724 else
3725 {
3726 if (uNewRip > cbLimitCS)
3727 {
3728 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3729 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3730 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3731 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3732 }
3733 }
3734
3735 /*
3736 * Commit the changes, marking CS and SS accessed first since
3737 * that may fail.
3738 */
3739 /** @todo where exactly are these actually marked accessed by a real CPU? */
3740 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3741 {
3742 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3743 if (rcStrict != VINF_SUCCESS)
3744 return rcStrict;
3745 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3746 }
3747 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3748 {
3749 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3750 if (rcStrict != VINF_SUCCESS)
3751 return rcStrict;
3752 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3753 }
3754
3755 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3756 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3757 if (enmEffOpSize != IEMMODE_16BIT)
3758 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3759 if (pVCpu->iem.s.uCpl == 0)
3760 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3761 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3762 fEFlagsMask |= X86_EFL_IF;
3763 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3764 fEFlagsNew &= ~fEFlagsMask;
3765 fEFlagsNew |= uNewFlags & fEFlagsMask;
3766#ifdef DBGFTRACE_ENABLED
3767 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3768 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3769#endif
3770
3771 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3772 pCtx->rip = uNewRip;
3773 pCtx->cs.Sel = uNewCs;
3774 pCtx->cs.ValidSel = uNewCs;
3775 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3776 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3777 pCtx->cs.u32Limit = cbLimitCS;
3778 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3779 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3780 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3781 pCtx->rsp = uNewRsp;
3782 else
3783 pCtx->sp = (uint16_t)uNewRsp;
3784 pCtx->ss.Sel = uNewSs;
3785 pCtx->ss.ValidSel = uNewSs;
3786 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3787 {
3788 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3789 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3790 pCtx->ss.u32Limit = UINT32_MAX;
3791 pCtx->ss.u64Base = 0;
3792 Log2(("iretq new SS: NULL\n"));
3793 }
3794 else
3795 {
3796 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3797 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3798 pCtx->ss.u32Limit = cbLimitSs;
3799 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3800 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3801 }
3802
3803 if (pVCpu->iem.s.uCpl != uNewCpl)
3804 {
3805 pVCpu->iem.s.uCpl = uNewCpl;
3806 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3807 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3808 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3809 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3810 }
3811
3812 /* Flush the prefetch buffer. */
3813#ifdef IEM_WITH_CODE_TLB
3814 pVCpu->iem.s.pbInstrBuf = NULL;
3815#else
3816 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3817#endif
3818
3819 return VINF_SUCCESS;
3820}
3821
3822
3823/**
3824 * Implements iret.
3825 *
3826 * @param enmEffOpSize The effective operand size.
3827 */
3828IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3829{
3830 /*
3831 * First, clear NMI blocking, if any, before causing any exceptions.
3832 */
3833 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3834
3835 /*
3836 * Call a mode specific worker.
3837 */
3838 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3839 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3840 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3841 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3842 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3843}
3844
3845
3846/**
3847 * Implements SYSCALL (AMD and Intel64).
3848 *
3849 * @param enmEffOpSize The effective operand size.
3850 */
3851IEM_CIMPL_DEF_0(iemCImpl_syscall)
3852{
3853 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3854
3855 /*
3856 * Check preconditions.
3857 *
3858 * Note that CPUs described in the documentation may load a few odd values
3859 * into CS and SS than we allow here. This has yet to be checked on real
3860 * hardware.
3861 */
3862 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3863 {
3864 Log(("syscall: Not enabled in EFER -> #UD\n"));
3865 return iemRaiseUndefinedOpcode(pVCpu);
3866 }
3867 if (!(pCtx->cr0 & X86_CR0_PE))
3868 {
3869 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3870 return iemRaiseGeneralProtectionFault0(pVCpu);
3871 }
3872 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3873 {
3874 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3875 return iemRaiseUndefinedOpcode(pVCpu);
3876 }
3877
3878 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3879 /** @todo what about LDT selectors? Shouldn't matter, really. */
3880 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3881 uint16_t uNewSs = uNewCs + 8;
3882 if (uNewCs == 0 || uNewSs == 0)
3883 {
3884 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3885 return iemRaiseGeneralProtectionFault0(pVCpu);
3886 }
3887
3888 /* Long mode and legacy mode differs. */
3889 if (CPUMIsGuestInLongModeEx(pCtx))
3890 {
3891 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3892
3893 /* This test isn't in the docs, but I'm not trusting the guys writing
3894 the MSRs to have validated the values as canonical like they should. */
3895 if (!IEM_IS_CANONICAL(uNewRip))
3896 {
3897 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3898 return iemRaiseUndefinedOpcode(pVCpu);
3899 }
3900
3901 /*
3902 * Commit it.
3903 */
3904 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3905 pCtx->rcx = pCtx->rip + cbInstr;
3906 pCtx->rip = uNewRip;
3907
3908 pCtx->rflags.u &= ~X86_EFL_RF;
3909 pCtx->r11 = pCtx->rflags.u;
3910 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3911 pCtx->rflags.u |= X86_EFL_1;
3912
3913 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3914 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3915 }
3916 else
3917 {
3918 /*
3919 * Commit it.
3920 */
3921 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3922 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3923 pCtx->rcx = pCtx->eip + cbInstr;
3924 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3925 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3926
3927 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3928 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3929 }
3930 pCtx->cs.Sel = uNewCs;
3931 pCtx->cs.ValidSel = uNewCs;
3932 pCtx->cs.u64Base = 0;
3933 pCtx->cs.u32Limit = UINT32_MAX;
3934 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3935
3936 pCtx->ss.Sel = uNewSs;
3937 pCtx->ss.ValidSel = uNewSs;
3938 pCtx->ss.u64Base = 0;
3939 pCtx->ss.u32Limit = UINT32_MAX;
3940 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3941
3942 /* Flush the prefetch buffer. */
3943#ifdef IEM_WITH_CODE_TLB
3944 pVCpu->iem.s.pbInstrBuf = NULL;
3945#else
3946 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3947#endif
3948
3949 return VINF_SUCCESS;
3950}
3951
3952
3953/**
3954 * Implements SYSRET (AMD and Intel64).
3955 */
3956IEM_CIMPL_DEF_0(iemCImpl_sysret)
3957
3958{
3959 RT_NOREF_PV(cbInstr);
3960 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3961
3962 /*
3963 * Check preconditions.
3964 *
3965 * Note that CPUs described in the documentation may load a few odd values
3966 * into CS and SS than we allow here. This has yet to be checked on real
3967 * hardware.
3968 */
3969 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3970 {
3971 Log(("sysret: Not enabled in EFER -> #UD\n"));
3972 return iemRaiseUndefinedOpcode(pVCpu);
3973 }
3974 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3975 {
3976 Log(("sysret: Only available in long mode on intel -> #UD\n"));
3977 return iemRaiseUndefinedOpcode(pVCpu);
3978 }
3979 if (!(pCtx->cr0 & X86_CR0_PE))
3980 {
3981 Log(("sysret: Protected mode is required -> #GP(0)\n"));
3982 return iemRaiseGeneralProtectionFault0(pVCpu);
3983 }
3984 if (pVCpu->iem.s.uCpl != 0)
3985 {
3986 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3987 return iemRaiseGeneralProtectionFault0(pVCpu);
3988 }
3989
3990 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
3991 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3992 uint16_t uNewSs = uNewCs + 8;
3993 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
3994 uNewCs += 16;
3995 if (uNewCs == 0 || uNewSs == 0)
3996 {
3997 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3998 return iemRaiseGeneralProtectionFault0(pVCpu);
3999 }
4000
4001 /*
4002 * Commit it.
4003 */
4004 if (CPUMIsGuestInLongModeEx(pCtx))
4005 {
4006 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4007 {
4008 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4009 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
4010 /* Note! We disregard intel manual regarding the RCX cananonical
4011 check, ask intel+xen why AMD doesn't do it. */
4012 pCtx->rip = pCtx->rcx;
4013 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4014 | (3 << X86DESCATTR_DPL_SHIFT);
4015 }
4016 else
4017 {
4018 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4019 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
4020 pCtx->rip = pCtx->ecx;
4021 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4022 | (3 << X86DESCATTR_DPL_SHIFT);
4023 }
4024 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4025 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4026 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4027 pCtx->rflags.u |= X86_EFL_1;
4028 }
4029 else
4030 {
4031 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
4032 pCtx->rip = pCtx->rcx;
4033 pCtx->rflags.u |= X86_EFL_IF;
4034 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4035 | (3 << X86DESCATTR_DPL_SHIFT);
4036 }
4037 pCtx->cs.Sel = uNewCs | 3;
4038 pCtx->cs.ValidSel = uNewCs | 3;
4039 pCtx->cs.u64Base = 0;
4040 pCtx->cs.u32Limit = UINT32_MAX;
4041 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
4042
4043 pCtx->ss.Sel = uNewSs | 3;
4044 pCtx->ss.ValidSel = uNewSs | 3;
4045 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
4046 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4047 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4048 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4049 * on sysret. */
4050
4051 /* Flush the prefetch buffer. */
4052#ifdef IEM_WITH_CODE_TLB
4053 pVCpu->iem.s.pbInstrBuf = NULL;
4054#else
4055 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4056#endif
4057
4058 return VINF_SUCCESS;
4059}
4060
4061
4062/**
4063 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4064 *
4065 * @param iSegReg The segment register number (valid).
4066 * @param uSel The new selector value.
4067 */
4068IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4069{
4070 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4071 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4072 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4073
4074 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4075
4076 /*
4077 * Real mode and V8086 mode are easy.
4078 */
4079 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
4080 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
4081 {
4082 *pSel = uSel;
4083 pHid->u64Base = (uint32_t)uSel << 4;
4084 pHid->ValidSel = uSel;
4085 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4086#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4087 /** @todo Does the CPU actually load limits and attributes in the
4088 * real/V8086 mode segment load case? It doesn't for CS in far
4089 * jumps... Affects unreal mode. */
4090 pHid->u32Limit = 0xffff;
4091 pHid->Attr.u = 0;
4092 pHid->Attr.n.u1Present = 1;
4093 pHid->Attr.n.u1DescType = 1;
4094 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4095 ? X86_SEL_TYPE_RW
4096 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4097#endif
4098 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4099 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4100 return VINF_SUCCESS;
4101 }
4102
4103 /*
4104 * Protected mode.
4105 *
4106 * Check if it's a null segment selector value first, that's OK for DS, ES,
4107 * FS and GS. If not null, then we have to load and parse the descriptor.
4108 */
4109 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4110 {
4111 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4112 if (iSegReg == X86_SREG_SS)
4113 {
4114 /* In 64-bit kernel mode, the stack can be 0 because of the way
4115 interrupts are dispatched. AMD seems to have a slighly more
4116 relaxed relationship to SS.RPL than intel does. */
4117 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4118 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4119 || pVCpu->iem.s.uCpl > 2
4120 || ( uSel != pVCpu->iem.s.uCpl
4121 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4122 {
4123 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4124 return iemRaiseGeneralProtectionFault0(pVCpu);
4125 }
4126 }
4127
4128 *pSel = uSel; /* Not RPL, remember :-) */
4129 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4130 if (iSegReg == X86_SREG_SS)
4131 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4132
4133 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4134 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4135
4136 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4137 return VINF_SUCCESS;
4138 }
4139
4140 /* Fetch the descriptor. */
4141 IEMSELDESC Desc;
4142 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4143 if (rcStrict != VINF_SUCCESS)
4144 return rcStrict;
4145
4146 /* Check GPs first. */
4147 if (!Desc.Legacy.Gen.u1DescType)
4148 {
4149 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4150 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4151 }
4152 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4153 {
4154 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4155 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4156 {
4157 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4158 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4159 }
4160 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4161 {
4162 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4163 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4164 }
4165 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4166 {
4167 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4168 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4169 }
4170 }
4171 else
4172 {
4173 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4174 {
4175 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4176 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4177 }
4178 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4179 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4180 {
4181#if 0 /* this is what intel says. */
4182 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4183 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4184 {
4185 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4186 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4187 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4188 }
4189#else /* this is what makes more sense. */
4190 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4191 {
4192 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4193 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4194 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4195 }
4196 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4197 {
4198 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4199 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4200 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4201 }
4202#endif
4203 }
4204 }
4205
4206 /* Is it there? */
4207 if (!Desc.Legacy.Gen.u1Present)
4208 {
4209 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4210 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4211 }
4212
4213 /* The base and limit. */
4214 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4215 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4216
4217 /*
4218 * Ok, everything checked out fine. Now set the accessed bit before
4219 * committing the result into the registers.
4220 */
4221 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4222 {
4223 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4224 if (rcStrict != VINF_SUCCESS)
4225 return rcStrict;
4226 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4227 }
4228
4229 /* commit */
4230 *pSel = uSel;
4231 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4232 pHid->u32Limit = cbLimit;
4233 pHid->u64Base = u64Base;
4234 pHid->ValidSel = uSel;
4235 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4236
4237 /** @todo check if the hidden bits are loaded correctly for 64-bit
4238 * mode. */
4239 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4240
4241 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4242 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4243 return VINF_SUCCESS;
4244}
4245
4246
4247/**
4248 * Implements 'mov SReg, r/m'.
4249 *
4250 * @param iSegReg The segment register number (valid).
4251 * @param uSel The new selector value.
4252 */
4253IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4254{
4255 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4256 if (rcStrict == VINF_SUCCESS)
4257 {
4258 if (iSegReg == X86_SREG_SS)
4259 {
4260 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4261 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4262 }
4263 }
4264 return rcStrict;
4265}
4266
4267
4268/**
4269 * Implements 'pop SReg'.
4270 *
4271 * @param iSegReg The segment register number (valid).
4272 * @param enmEffOpSize The efficient operand size (valid).
4273 */
4274IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4275{
4276 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4277 VBOXSTRICTRC rcStrict;
4278
4279 /*
4280 * Read the selector off the stack and join paths with mov ss, reg.
4281 */
4282 RTUINT64U TmpRsp;
4283 TmpRsp.u = pCtx->rsp;
4284 switch (enmEffOpSize)
4285 {
4286 case IEMMODE_16BIT:
4287 {
4288 uint16_t uSel;
4289 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4290 if (rcStrict == VINF_SUCCESS)
4291 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4292 break;
4293 }
4294
4295 case IEMMODE_32BIT:
4296 {
4297 uint32_t u32Value;
4298 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4299 if (rcStrict == VINF_SUCCESS)
4300 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4301 break;
4302 }
4303
4304 case IEMMODE_64BIT:
4305 {
4306 uint64_t u64Value;
4307 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4308 if (rcStrict == VINF_SUCCESS)
4309 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4310 break;
4311 }
4312 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4313 }
4314
4315 /*
4316 * Commit the stack on success.
4317 */
4318 if (rcStrict == VINF_SUCCESS)
4319 {
4320 pCtx->rsp = TmpRsp.u;
4321 if (iSegReg == X86_SREG_SS)
4322 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4323 }
4324 return rcStrict;
4325}
4326
4327
4328/**
4329 * Implements lgs, lfs, les, lds & lss.
4330 */
4331IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4332 uint16_t, uSel,
4333 uint64_t, offSeg,
4334 uint8_t, iSegReg,
4335 uint8_t, iGReg,
4336 IEMMODE, enmEffOpSize)
4337{
4338 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4339 VBOXSTRICTRC rcStrict;
4340
4341 /*
4342 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4343 */
4344 /** @todo verify and test that mov, pop and lXs works the segment
4345 * register loading in the exact same way. */
4346 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4347 if (rcStrict == VINF_SUCCESS)
4348 {
4349 switch (enmEffOpSize)
4350 {
4351 case IEMMODE_16BIT:
4352 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4353 break;
4354 case IEMMODE_32BIT:
4355 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4356 break;
4357 case IEMMODE_64BIT:
4358 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4359 break;
4360 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4361 }
4362 }
4363
4364 return rcStrict;
4365}
4366
4367
4368/**
4369 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4370 *
4371 * @retval VINF_SUCCESS on success.
4372 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4373 * @retval iemMemFetchSysU64 return value.
4374 *
4375 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4376 * @param uSel The selector value.
4377 * @param fAllowSysDesc Whether system descriptors are OK or not.
4378 * @param pDesc Where to return the descriptor on success.
4379 */
4380static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4381{
4382 pDesc->Long.au64[0] = 0;
4383 pDesc->Long.au64[1] = 0;
4384
4385 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4386 return VINF_IEM_SELECTOR_NOT_OK;
4387
4388 /* Within the table limits? */
4389 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4390 RTGCPTR GCPtrBase;
4391 if (uSel & X86_SEL_LDT)
4392 {
4393 if ( !pCtx->ldtr.Attr.n.u1Present
4394 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4395 return VINF_IEM_SELECTOR_NOT_OK;
4396 GCPtrBase = pCtx->ldtr.u64Base;
4397 }
4398 else
4399 {
4400 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4401 return VINF_IEM_SELECTOR_NOT_OK;
4402 GCPtrBase = pCtx->gdtr.pGdt;
4403 }
4404
4405 /* Fetch the descriptor. */
4406 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4407 if (rcStrict != VINF_SUCCESS)
4408 return rcStrict;
4409 if (!pDesc->Legacy.Gen.u1DescType)
4410 {
4411 if (!fAllowSysDesc)
4412 return VINF_IEM_SELECTOR_NOT_OK;
4413 if (CPUMIsGuestInLongModeEx(pCtx))
4414 {
4415 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4416 if (rcStrict != VINF_SUCCESS)
4417 return rcStrict;
4418 }
4419
4420 }
4421
4422 return VINF_SUCCESS;
4423}
4424
4425
4426/**
4427 * Implements verr (fWrite = false) and verw (fWrite = true).
4428 */
4429IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4430{
4431 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4432
4433 /** @todo figure whether the accessed bit is set or not. */
4434
4435 bool fAccessible = true;
4436 IEMSELDESC Desc;
4437 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4438 if (rcStrict == VINF_SUCCESS)
4439 {
4440 /* Check the descriptor, order doesn't matter much here. */
4441 if ( !Desc.Legacy.Gen.u1DescType
4442 || !Desc.Legacy.Gen.u1Present)
4443 fAccessible = false;
4444 else
4445 {
4446 if ( fWrite
4447 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4448 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4449 fAccessible = false;
4450
4451 /** @todo testcase for the conforming behavior. */
4452 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4453 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4454 {
4455 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4456 fAccessible = false;
4457 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4458 fAccessible = false;
4459 }
4460 }
4461
4462 }
4463 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4464 fAccessible = false;
4465 else
4466 return rcStrict;
4467
4468 /* commit */
4469 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4470
4471 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4472 return VINF_SUCCESS;
4473}
4474
4475
4476/**
4477 * Implements LAR and LSL with 64-bit operand size.
4478 *
4479 * @returns VINF_SUCCESS.
4480 * @param pu16Dst Pointer to the destination register.
4481 * @param uSel The selector to load details for.
4482 * @param fIsLar true = LAR, false = LSL.
4483 */
4484IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4485{
4486 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4487
4488 /** @todo figure whether the accessed bit is set or not. */
4489
4490 bool fDescOk = true;
4491 IEMSELDESC Desc;
4492 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4493 if (rcStrict == VINF_SUCCESS)
4494 {
4495 /*
4496 * Check the descriptor type.
4497 */
4498 if (!Desc.Legacy.Gen.u1DescType)
4499 {
4500 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4501 {
4502 if (Desc.Long.Gen.u5Zeros)
4503 fDescOk = false;
4504 else
4505 switch (Desc.Long.Gen.u4Type)
4506 {
4507 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4508 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4509 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4510 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4511 break;
4512 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4513 fDescOk = fIsLar;
4514 break;
4515 default:
4516 fDescOk = false;
4517 break;
4518 }
4519 }
4520 else
4521 {
4522 switch (Desc.Long.Gen.u4Type)
4523 {
4524 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4525 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4526 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4527 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4528 case X86_SEL_TYPE_SYS_LDT:
4529 break;
4530 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4531 case X86_SEL_TYPE_SYS_TASK_GATE:
4532 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4533 fDescOk = fIsLar;
4534 break;
4535 default:
4536 fDescOk = false;
4537 break;
4538 }
4539 }
4540 }
4541 if (fDescOk)
4542 {
4543 /*
4544 * Check the RPL/DPL/CPL interaction..
4545 */
4546 /** @todo testcase for the conforming behavior. */
4547 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4548 || !Desc.Legacy.Gen.u1DescType)
4549 {
4550 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4551 fDescOk = false;
4552 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4553 fDescOk = false;
4554 }
4555 }
4556
4557 if (fDescOk)
4558 {
4559 /*
4560 * All fine, start committing the result.
4561 */
4562 if (fIsLar)
4563 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4564 else
4565 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4566 }
4567
4568 }
4569 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4570 fDescOk = false;
4571 else
4572 return rcStrict;
4573
4574 /* commit flags value and advance rip. */
4575 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4576 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4577
4578 return VINF_SUCCESS;
4579}
4580
4581
4582/**
4583 * Implements LAR and LSL with 16-bit operand size.
4584 *
4585 * @returns VINF_SUCCESS.
4586 * @param pu16Dst Pointer to the destination register.
4587 * @param u16Sel The selector to load details for.
4588 * @param fIsLar true = LAR, false = LSL.
4589 */
4590IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4591{
4592 uint64_t u64TmpDst = *pu16Dst;
4593 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4594 *pu16Dst = u64TmpDst;
4595 return VINF_SUCCESS;
4596}
4597
4598
4599/**
4600 * Implements lgdt.
4601 *
4602 * @param iEffSeg The segment of the new gdtr contents
4603 * @param GCPtrEffSrc The address of the new gdtr contents.
4604 * @param enmEffOpSize The effective operand size.
4605 */
4606IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4607{
4608 if (pVCpu->iem.s.uCpl != 0)
4609 return iemRaiseGeneralProtectionFault0(pVCpu);
4610 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4611
4612 /*
4613 * Fetch the limit and base address.
4614 */
4615 uint16_t cbLimit;
4616 RTGCPTR GCPtrBase;
4617 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4618 if (rcStrict == VINF_SUCCESS)
4619 {
4620 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4621 || X86_IS_CANONICAL(GCPtrBase))
4622 {
4623 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4624 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4625 else
4626 {
4627 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4628 pCtx->gdtr.cbGdt = cbLimit;
4629 pCtx->gdtr.pGdt = GCPtrBase;
4630 }
4631 if (rcStrict == VINF_SUCCESS)
4632 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4633 }
4634 else
4635 {
4636 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4637 return iemRaiseGeneralProtectionFault0(pVCpu);
4638 }
4639 }
4640 return rcStrict;
4641}
4642
4643
4644/**
4645 * Implements sgdt.
4646 *
4647 * @param iEffSeg The segment where to store the gdtr content.
4648 * @param GCPtrEffDst The address where to store the gdtr content.
4649 */
4650IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4651{
4652 /*
4653 * Join paths with sidt.
4654 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4655 * you really must know.
4656 */
4657 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4658 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4659 if (rcStrict == VINF_SUCCESS)
4660 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4661 return rcStrict;
4662}
4663
4664
4665/**
4666 * Implements lidt.
4667 *
4668 * @param iEffSeg The segment of the new idtr contents
4669 * @param GCPtrEffSrc The address of the new idtr contents.
4670 * @param enmEffOpSize The effective operand size.
4671 */
4672IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4673{
4674 if (pVCpu->iem.s.uCpl != 0)
4675 return iemRaiseGeneralProtectionFault0(pVCpu);
4676 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4677
4678 /*
4679 * Fetch the limit and base address.
4680 */
4681 uint16_t cbLimit;
4682 RTGCPTR GCPtrBase;
4683 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4684 if (rcStrict == VINF_SUCCESS)
4685 {
4686 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4687 || X86_IS_CANONICAL(GCPtrBase))
4688 {
4689 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4690 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4691 else
4692 {
4693 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4694 pCtx->idtr.cbIdt = cbLimit;
4695 pCtx->idtr.pIdt = GCPtrBase;
4696 }
4697 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4698 }
4699 else
4700 {
4701 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4702 return iemRaiseGeneralProtectionFault0(pVCpu);
4703 }
4704 }
4705 return rcStrict;
4706}
4707
4708
4709/**
4710 * Implements sidt.
4711 *
4712 * @param iEffSeg The segment where to store the idtr content.
4713 * @param GCPtrEffDst The address where to store the idtr content.
4714 */
4715IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4716{
4717 /*
4718 * Join paths with sgdt.
4719 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4720 * you really must know.
4721 */
4722 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4723 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4724 if (rcStrict == VINF_SUCCESS)
4725 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4726 return rcStrict;
4727}
4728
4729
4730/**
4731 * Implements lldt.
4732 *
4733 * @param uNewLdt The new LDT selector value.
4734 */
4735IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4736{
4737 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4738
4739 /*
4740 * Check preconditions.
4741 */
4742 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4743 {
4744 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4745 return iemRaiseUndefinedOpcode(pVCpu);
4746 }
4747 if (pVCpu->iem.s.uCpl != 0)
4748 {
4749 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4750 return iemRaiseGeneralProtectionFault0(pVCpu);
4751 }
4752 if (uNewLdt & X86_SEL_LDT)
4753 {
4754 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4755 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4756 }
4757
4758 /*
4759 * Now, loading a NULL selector is easy.
4760 */
4761 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4762 {
4763 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4764 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4765 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4766 else
4767 pCtx->ldtr.Sel = uNewLdt;
4768 pCtx->ldtr.ValidSel = uNewLdt;
4769 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4770 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4771 {
4772 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4773 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4774 }
4775 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4776 {
4777 /* AMD-V seems to leave the base and limit alone. */
4778 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4779 }
4780 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4781 {
4782 /* VT-x (Intel 3960x) seems to be doing the following. */
4783 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4784 pCtx->ldtr.u64Base = 0;
4785 pCtx->ldtr.u32Limit = UINT32_MAX;
4786 }
4787
4788 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4789 return VINF_SUCCESS;
4790 }
4791
4792 /*
4793 * Read the descriptor.
4794 */
4795 IEMSELDESC Desc;
4796 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4797 if (rcStrict != VINF_SUCCESS)
4798 return rcStrict;
4799
4800 /* Check GPs first. */
4801 if (Desc.Legacy.Gen.u1DescType)
4802 {
4803 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4804 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4805 }
4806 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4807 {
4808 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4809 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4810 }
4811 uint64_t u64Base;
4812 if (!IEM_IS_LONG_MODE(pVCpu))
4813 u64Base = X86DESC_BASE(&Desc.Legacy);
4814 else
4815 {
4816 if (Desc.Long.Gen.u5Zeros)
4817 {
4818 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4819 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4820 }
4821
4822 u64Base = X86DESC64_BASE(&Desc.Long);
4823 if (!IEM_IS_CANONICAL(u64Base))
4824 {
4825 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4826 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4827 }
4828 }
4829
4830 /* NP */
4831 if (!Desc.Legacy.Gen.u1Present)
4832 {
4833 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4834 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4835 }
4836
4837 /*
4838 * It checks out alright, update the registers.
4839 */
4840/** @todo check if the actual value is loaded or if the RPL is dropped */
4841 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4842 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4843 else
4844 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4845 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4846 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4847 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4848 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4849 pCtx->ldtr.u64Base = u64Base;
4850
4851 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4852 return VINF_SUCCESS;
4853}
4854
4855
4856/**
4857 * Implements lldt.
4858 *
4859 * @param uNewLdt The new LDT selector value.
4860 */
4861IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4862{
4863 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4864
4865 /*
4866 * Check preconditions.
4867 */
4868 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4869 {
4870 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4871 return iemRaiseUndefinedOpcode(pVCpu);
4872 }
4873 if (pVCpu->iem.s.uCpl != 0)
4874 {
4875 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4876 return iemRaiseGeneralProtectionFault0(pVCpu);
4877 }
4878 if (uNewTr & X86_SEL_LDT)
4879 {
4880 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4881 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4882 }
4883 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4884 {
4885 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4886 return iemRaiseGeneralProtectionFault0(pVCpu);
4887 }
4888
4889 /*
4890 * Read the descriptor.
4891 */
4892 IEMSELDESC Desc;
4893 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4894 if (rcStrict != VINF_SUCCESS)
4895 return rcStrict;
4896
4897 /* Check GPs first. */
4898 if (Desc.Legacy.Gen.u1DescType)
4899 {
4900 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4901 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4902 }
4903 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4904 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4905 || IEM_IS_LONG_MODE(pVCpu)) )
4906 {
4907 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4908 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4909 }
4910 uint64_t u64Base;
4911 if (!IEM_IS_LONG_MODE(pVCpu))
4912 u64Base = X86DESC_BASE(&Desc.Legacy);
4913 else
4914 {
4915 if (Desc.Long.Gen.u5Zeros)
4916 {
4917 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
4918 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4919 }
4920
4921 u64Base = X86DESC64_BASE(&Desc.Long);
4922 if (!IEM_IS_CANONICAL(u64Base))
4923 {
4924 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
4925 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4926 }
4927 }
4928
4929 /* NP */
4930 if (!Desc.Legacy.Gen.u1Present)
4931 {
4932 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
4933 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
4934 }
4935
4936 /*
4937 * Set it busy.
4938 * Note! Intel says this should lock down the whole descriptor, but we'll
4939 * restrict our selves to 32-bit for now due to lack of inline
4940 * assembly and such.
4941 */
4942 void *pvDesc;
4943 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
4944 if (rcStrict != VINF_SUCCESS)
4945 return rcStrict;
4946 switch ((uintptr_t)pvDesc & 3)
4947 {
4948 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
4949 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
4950 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
4951 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
4952 }
4953 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
4954 if (rcStrict != VINF_SUCCESS)
4955 return rcStrict;
4956 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
4957
4958 /*
4959 * It checks out alright, update the registers.
4960 */
4961/** @todo check if the actual value is loaded or if the RPL is dropped */
4962 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4963 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4964 else
4965 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
4966 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
4967 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
4968 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4969 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4970 pCtx->tr.u64Base = u64Base;
4971
4972 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4973 return VINF_SUCCESS;
4974}
4975
4976
4977/**
4978 * Implements mov GReg,CRx.
4979 *
4980 * @param iGReg The general register to store the CRx value in.
4981 * @param iCrReg The CRx register to read (valid).
4982 */
4983IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
4984{
4985 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4986 if (pVCpu->iem.s.uCpl != 0)
4987 return iemRaiseGeneralProtectionFault0(pVCpu);
4988 Assert(!pCtx->eflags.Bits.u1VM);
4989
4990 /* read it */
4991 uint64_t crX;
4992 switch (iCrReg)
4993 {
4994 case 0:
4995 crX = pCtx->cr0;
4996 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
4997 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
4998 break;
4999 case 2: crX = pCtx->cr2; break;
5000 case 3: crX = pCtx->cr3; break;
5001 case 4: crX = pCtx->cr4; break;
5002 case 8:
5003 {
5004 uint8_t uTpr;
5005 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5006 if (RT_SUCCESS(rc))
5007 crX = uTpr >> 4;
5008 else
5009 crX = 0;
5010 break;
5011 }
5012 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5013 }
5014
5015 /* store it */
5016 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5017 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5018 else
5019 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5020
5021 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5022 return VINF_SUCCESS;
5023}
5024
5025
5026/**
5027 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5028 *
5029 * @param iCrReg The CRx register to write (valid).
5030 * @param uNewCrX The new value.
5031 */
5032IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
5033{
5034 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5035 VBOXSTRICTRC rcStrict;
5036 int rc;
5037
5038 /*
5039 * Try store it.
5040 * Unfortunately, CPUM only does a tiny bit of the work.
5041 */
5042 switch (iCrReg)
5043 {
5044 case 0:
5045 {
5046 /*
5047 * Perform checks.
5048 */
5049 uint64_t const uOldCrX = pCtx->cr0;
5050 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
5051 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
5052 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
5053
5054 /* ET is hardcoded on 486 and later. */
5055 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5056 uNewCrX |= X86_CR0_ET;
5057 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5058 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5059 {
5060 uNewCrX &= fValid;
5061 uNewCrX |= X86_CR0_ET;
5062 }
5063 else
5064 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5065
5066 /* Check for reserved bits. */
5067 if (uNewCrX & ~(uint64_t)fValid)
5068 {
5069 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5070 return iemRaiseGeneralProtectionFault0(pVCpu);
5071 }
5072
5073 /* Check for invalid combinations. */
5074 if ( (uNewCrX & X86_CR0_PG)
5075 && !(uNewCrX & X86_CR0_PE) )
5076 {
5077 Log(("Trying to set CR0.PG without CR0.PE\n"));
5078 return iemRaiseGeneralProtectionFault0(pVCpu);
5079 }
5080
5081 if ( !(uNewCrX & X86_CR0_CD)
5082 && (uNewCrX & X86_CR0_NW) )
5083 {
5084 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5085 return iemRaiseGeneralProtectionFault0(pVCpu);
5086 }
5087
5088 /* Long mode consistency checks. */
5089 if ( (uNewCrX & X86_CR0_PG)
5090 && !(uOldCrX & X86_CR0_PG)
5091 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5092 {
5093 if (!(pCtx->cr4 & X86_CR4_PAE))
5094 {
5095 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5096 return iemRaiseGeneralProtectionFault0(pVCpu);
5097 }
5098 if (pCtx->cs.Attr.n.u1Long)
5099 {
5100 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5101 return iemRaiseGeneralProtectionFault0(pVCpu);
5102 }
5103 }
5104
5105 /** @todo check reserved PDPTR bits as AMD states. */
5106
5107 /*
5108 * Change CR0.
5109 */
5110 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5111 CPUMSetGuestCR0(pVCpu, uNewCrX);
5112 else
5113 pCtx->cr0 = uNewCrX;
5114 Assert(pCtx->cr0 == uNewCrX);
5115
5116 /*
5117 * Change EFER.LMA if entering or leaving long mode.
5118 */
5119 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5120 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5121 {
5122 uint64_t NewEFER = pCtx->msrEFER;
5123 if (uNewCrX & X86_CR0_PG)
5124 NewEFER |= MSR_K6_EFER_LMA;
5125 else
5126 NewEFER &= ~MSR_K6_EFER_LMA;
5127
5128 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5129 CPUMSetGuestEFER(pVCpu, NewEFER);
5130 else
5131 pCtx->msrEFER = NewEFER;
5132 Assert(pCtx->msrEFER == NewEFER);
5133 }
5134
5135 /*
5136 * Inform PGM.
5137 */
5138 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5139 {
5140 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5141 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5142 {
5143 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5144 AssertRCReturn(rc, rc);
5145 /* ignore informational status codes */
5146 }
5147 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5148 }
5149 else
5150 rcStrict = VINF_SUCCESS;
5151
5152#ifdef IN_RC
5153 /* Return to ring-3 for rescheduling if WP or AM changes. */
5154 if ( rcStrict == VINF_SUCCESS
5155 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5156 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5157 rcStrict = VINF_EM_RESCHEDULE;
5158#endif
5159 break;
5160 }
5161
5162 /*
5163 * CR2 can be changed without any restrictions.
5164 */
5165 case 2:
5166 pCtx->cr2 = uNewCrX;
5167 rcStrict = VINF_SUCCESS;
5168 break;
5169
5170 /*
5171 * CR3 is relatively simple, although AMD and Intel have different
5172 * accounts of how setting reserved bits are handled. We take intel's
5173 * word for the lower bits and AMD's for the high bits (63:52). The
5174 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5175 * on this.
5176 */
5177 /** @todo Testcase: Setting reserved bits in CR3, especially before
5178 * enabling paging. */
5179 case 3:
5180 {
5181 /* check / mask the value. */
5182 if (uNewCrX & UINT64_C(0xfff0000000000000))
5183 {
5184 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5185 return iemRaiseGeneralProtectionFault0(pVCpu);
5186 }
5187
5188 uint64_t fValid;
5189 if ( (pCtx->cr4 & X86_CR4_PAE)
5190 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5191 fValid = UINT64_C(0x000fffffffffffff);
5192 else
5193 fValid = UINT64_C(0xffffffff);
5194 if (uNewCrX & ~fValid)
5195 {
5196 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5197 uNewCrX, uNewCrX & ~fValid));
5198 uNewCrX &= fValid;
5199 }
5200
5201 /** @todo If we're in PAE mode we should check the PDPTRs for
5202 * invalid bits. */
5203
5204 /* Make the change. */
5205 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5206 {
5207 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5208 AssertRCSuccessReturn(rc, rc);
5209 }
5210 else
5211 pCtx->cr3 = uNewCrX;
5212
5213 /* Inform PGM. */
5214 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5215 {
5216 if (pCtx->cr0 & X86_CR0_PG)
5217 {
5218 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5219 AssertRCReturn(rc, rc);
5220 /* ignore informational status codes */
5221 }
5222 }
5223 rcStrict = VINF_SUCCESS;
5224 break;
5225 }
5226
5227 /*
5228 * CR4 is a bit more tedious as there are bits which cannot be cleared
5229 * under some circumstances and such.
5230 */
5231 case 4:
5232 {
5233 uint64_t const uOldCrX = pCtx->cr4;
5234
5235 /** @todo Shouldn't this look at the guest CPUID bits to determine
5236 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5237 * should #GP(0). */
5238 /* reserved bits */
5239 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5240 | X86_CR4_TSD | X86_CR4_DE
5241 | X86_CR4_PSE | X86_CR4_PAE
5242 | X86_CR4_MCE | X86_CR4_PGE
5243 | X86_CR4_PCE | X86_CR4_OSFXSR
5244 | X86_CR4_OSXMMEEXCPT;
5245 //if (xxx)
5246 // fValid |= X86_CR4_VMXE;
5247 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5248 fValid |= X86_CR4_OSXSAVE;
5249 if (uNewCrX & ~(uint64_t)fValid)
5250 {
5251 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5252 return iemRaiseGeneralProtectionFault0(pVCpu);
5253 }
5254
5255 /* long mode checks. */
5256 if ( (uOldCrX & X86_CR4_PAE)
5257 && !(uNewCrX & X86_CR4_PAE)
5258 && CPUMIsGuestInLongModeEx(pCtx) )
5259 {
5260 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5261 return iemRaiseGeneralProtectionFault0(pVCpu);
5262 }
5263
5264
5265 /*
5266 * Change it.
5267 */
5268 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5269 {
5270 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5271 AssertRCSuccessReturn(rc, rc);
5272 }
5273 else
5274 pCtx->cr4 = uNewCrX;
5275 Assert(pCtx->cr4 == uNewCrX);
5276
5277 /*
5278 * Notify SELM and PGM.
5279 */
5280 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5281 {
5282 /* SELM - VME may change things wrt to the TSS shadowing. */
5283 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5284 {
5285 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5286 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5287#ifdef VBOX_WITH_RAW_MODE
5288 if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
5289 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5290#endif
5291 }
5292
5293 /* PGM - flushing and mode. */
5294 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE))
5295 {
5296 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5297 AssertRCReturn(rc, rc);
5298 /* ignore informational status codes */
5299 }
5300 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5301 }
5302 else
5303 rcStrict = VINF_SUCCESS;
5304 break;
5305 }
5306
5307 /*
5308 * CR8 maps to the APIC TPR.
5309 */
5310 case 8:
5311 if (uNewCrX & ~(uint64_t)0xf)
5312 {
5313 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5314 return iemRaiseGeneralProtectionFault0(pVCpu);
5315 }
5316
5317 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5318 APICSetTpr(pVCpu, (uint8_t)uNewCrX << 4);
5319 rcStrict = VINF_SUCCESS;
5320 break;
5321
5322 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5323 }
5324
5325 /*
5326 * Advance the RIP on success.
5327 */
5328 if (RT_SUCCESS(rcStrict))
5329 {
5330 if (rcStrict != VINF_SUCCESS)
5331 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5332 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5333 }
5334
5335 return rcStrict;
5336}
5337
5338
5339/**
5340 * Implements mov CRx,GReg.
5341 *
5342 * @param iCrReg The CRx register to write (valid).
5343 * @param iGReg The general register to load the DRx value from.
5344 */
5345IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5346{
5347 if (pVCpu->iem.s.uCpl != 0)
5348 return iemRaiseGeneralProtectionFault0(pVCpu);
5349 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5350
5351 /*
5352 * Read the new value from the source register and call common worker.
5353 */
5354 uint64_t uNewCrX;
5355 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5356 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5357 else
5358 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5359 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
5360}
5361
5362
5363/**
5364 * Implements 'LMSW r/m16'
5365 *
5366 * @param u16NewMsw The new value.
5367 */
5368IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5369{
5370 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5371
5372 if (pVCpu->iem.s.uCpl != 0)
5373 return iemRaiseGeneralProtectionFault0(pVCpu);
5374 Assert(!pCtx->eflags.Bits.u1VM);
5375
5376 /*
5377 * Compose the new CR0 value and call common worker.
5378 */
5379 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5380 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5381 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5382}
5383
5384
5385/**
5386 * Implements 'CLTS'.
5387 */
5388IEM_CIMPL_DEF_0(iemCImpl_clts)
5389{
5390 if (pVCpu->iem.s.uCpl != 0)
5391 return iemRaiseGeneralProtectionFault0(pVCpu);
5392
5393 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5394 uint64_t uNewCr0 = pCtx->cr0;
5395 uNewCr0 &= ~X86_CR0_TS;
5396 return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0);
5397}
5398
5399
5400/**
5401 * Implements mov GReg,DRx.
5402 *
5403 * @param iGReg The general register to store the DRx value in.
5404 * @param iDrReg The DRx register to read (0-7).
5405 */
5406IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5407{
5408 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5409
5410 /*
5411 * Check preconditions.
5412 */
5413
5414 /* Raise GPs. */
5415 if (pVCpu->iem.s.uCpl != 0)
5416 return iemRaiseGeneralProtectionFault0(pVCpu);
5417 Assert(!pCtx->eflags.Bits.u1VM);
5418
5419 if ( (iDrReg == 4 || iDrReg == 5)
5420 && (pCtx->cr4 & X86_CR4_DE) )
5421 {
5422 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5423 return iemRaiseGeneralProtectionFault0(pVCpu);
5424 }
5425
5426 /* Raise #DB if general access detect is enabled. */
5427 if (pCtx->dr[7] & X86_DR7_GD)
5428 {
5429 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5430 return iemRaiseDebugException(pVCpu);
5431 }
5432
5433 /*
5434 * Read the debug register and store it in the specified general register.
5435 */
5436 uint64_t drX;
5437 switch (iDrReg)
5438 {
5439 case 0: drX = pCtx->dr[0]; break;
5440 case 1: drX = pCtx->dr[1]; break;
5441 case 2: drX = pCtx->dr[2]; break;
5442 case 3: drX = pCtx->dr[3]; break;
5443 case 6:
5444 case 4:
5445 drX = pCtx->dr[6];
5446 drX |= X86_DR6_RA1_MASK;
5447 drX &= ~X86_DR6_RAZ_MASK;
5448 break;
5449 case 7:
5450 case 5:
5451 drX = pCtx->dr[7];
5452 drX |=X86_DR7_RA1_MASK;
5453 drX &= ~X86_DR7_RAZ_MASK;
5454 break;
5455 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5456 }
5457
5458 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5459 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5460 else
5461 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5462
5463 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5464 return VINF_SUCCESS;
5465}
5466
5467
5468/**
5469 * Implements mov DRx,GReg.
5470 *
5471 * @param iDrReg The DRx register to write (valid).
5472 * @param iGReg The general register to load the DRx value from.
5473 */
5474IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5475{
5476 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5477
5478 /*
5479 * Check preconditions.
5480 */
5481 if (pVCpu->iem.s.uCpl != 0)
5482 return iemRaiseGeneralProtectionFault0(pVCpu);
5483 Assert(!pCtx->eflags.Bits.u1VM);
5484
5485 if (iDrReg == 4 || iDrReg == 5)
5486 {
5487 if (pCtx->cr4 & X86_CR4_DE)
5488 {
5489 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5490 return iemRaiseGeneralProtectionFault0(pVCpu);
5491 }
5492 iDrReg += 2;
5493 }
5494
5495 /* Raise #DB if general access detect is enabled. */
5496 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5497 * \#GP? */
5498 if (pCtx->dr[7] & X86_DR7_GD)
5499 {
5500 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5501 return iemRaiseDebugException(pVCpu);
5502 }
5503
5504 /*
5505 * Read the new value from the source register.
5506 */
5507 uint64_t uNewDrX;
5508 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5509 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5510 else
5511 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5512
5513 /*
5514 * Adjust it.
5515 */
5516 switch (iDrReg)
5517 {
5518 case 0:
5519 case 1:
5520 case 2:
5521 case 3:
5522 /* nothing to adjust */
5523 break;
5524
5525 case 6:
5526 if (uNewDrX & X86_DR6_MBZ_MASK)
5527 {
5528 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5529 return iemRaiseGeneralProtectionFault0(pVCpu);
5530 }
5531 uNewDrX |= X86_DR6_RA1_MASK;
5532 uNewDrX &= ~X86_DR6_RAZ_MASK;
5533 break;
5534
5535 case 7:
5536 if (uNewDrX & X86_DR7_MBZ_MASK)
5537 {
5538 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5539 return iemRaiseGeneralProtectionFault0(pVCpu);
5540 }
5541 uNewDrX |= X86_DR7_RA1_MASK;
5542 uNewDrX &= ~X86_DR7_RAZ_MASK;
5543 break;
5544
5545 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5546 }
5547
5548 /*
5549 * Do the actual setting.
5550 */
5551 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5552 {
5553 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5554 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5555 }
5556 else
5557 pCtx->dr[iDrReg] = uNewDrX;
5558
5559 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5560 return VINF_SUCCESS;
5561}
5562
5563
5564/**
5565 * Implements 'INVLPG m'.
5566 *
5567 * @param GCPtrPage The effective address of the page to invalidate.
5568 * @remarks Updates the RIP.
5569 */
5570IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5571{
5572 /* ring-0 only. */
5573 if (pVCpu->iem.s.uCpl != 0)
5574 return iemRaiseGeneralProtectionFault0(pVCpu);
5575 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5576
5577 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5578 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5579
5580 if (rc == VINF_SUCCESS)
5581 return VINF_SUCCESS;
5582 if (rc == VINF_PGM_SYNC_CR3)
5583 return iemSetPassUpStatus(pVCpu, rc);
5584
5585 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5586 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5587 return rc;
5588}
5589
5590
5591/**
5592 * Implements RDTSC.
5593 */
5594IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5595{
5596 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5597
5598 /*
5599 * Check preconditions.
5600 */
5601 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5602 return iemRaiseUndefinedOpcode(pVCpu);
5603
5604 if ( (pCtx->cr4 & X86_CR4_TSD)
5605 && pVCpu->iem.s.uCpl != 0)
5606 {
5607 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5608 return iemRaiseGeneralProtectionFault0(pVCpu);
5609 }
5610
5611 /*
5612 * Do the job.
5613 */
5614 uint64_t uTicks = TMCpuTickGet(pVCpu);
5615 pCtx->rax = (uint32_t)uTicks;
5616 pCtx->rdx = uTicks >> 32;
5617#ifdef IEM_VERIFICATION_MODE_FULL
5618 pVCpu->iem.s.fIgnoreRaxRdx = true;
5619#endif
5620
5621 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5622 return VINF_SUCCESS;
5623}
5624
5625
5626/**
5627 * Implements RDMSR.
5628 */
5629IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
5630{
5631 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5632
5633 /*
5634 * Check preconditions.
5635 */
5636 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5637 return iemRaiseUndefinedOpcode(pVCpu);
5638 if (pVCpu->iem.s.uCpl != 0)
5639 return iemRaiseGeneralProtectionFault0(pVCpu);
5640
5641 /*
5642 * Do the job.
5643 */
5644 RTUINT64U uValue;
5645 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
5646 if (rcStrict == VINF_SUCCESS)
5647 {
5648 pCtx->rax = uValue.s.Lo;
5649 pCtx->rdx = uValue.s.Hi;
5650
5651 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5652 return VINF_SUCCESS;
5653 }
5654
5655#ifndef IN_RING3
5656 /* Deferred to ring-3. */
5657 if (rcStrict == VINF_CPUM_R3_MSR_READ)
5658 {
5659 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
5660 return rcStrict;
5661 }
5662#else /* IN_RING3 */
5663 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5664 static uint32_t s_cTimes = 0;
5665 if (s_cTimes++ < 10)
5666 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5667 else
5668#endif
5669 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
5670 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5671 return iemRaiseGeneralProtectionFault0(pVCpu);
5672}
5673
5674
5675/**
5676 * Implements WRMSR.
5677 */
5678IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
5679{
5680 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5681
5682 /*
5683 * Check preconditions.
5684 */
5685 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
5686 return iemRaiseUndefinedOpcode(pVCpu);
5687 if (pVCpu->iem.s.uCpl != 0)
5688 return iemRaiseGeneralProtectionFault0(pVCpu);
5689
5690 /*
5691 * Do the job.
5692 */
5693 RTUINT64U uValue;
5694 uValue.s.Lo = pCtx->eax;
5695 uValue.s.Hi = pCtx->edx;
5696
5697 VBOXSTRICTRC rcStrict;
5698 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5699 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5700 else
5701 {
5702#ifdef IN_RING3
5703 CPUMCTX CtxTmp = *pCtx;
5704 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
5705 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
5706 *pCtx = *pCtx2;
5707 *pCtx2 = CtxTmp;
5708#else
5709 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
5710#endif
5711 }
5712 if (rcStrict == VINF_SUCCESS)
5713 {
5714 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5715 return VINF_SUCCESS;
5716 }
5717
5718#ifndef IN_RING3
5719 /* Deferred to ring-3. */
5720 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
5721 {
5722 Log(("IEM: wrmsr(%#x) -> ring-3\n", pCtx->ecx));
5723 return rcStrict;
5724 }
5725#else /* IN_RING3 */
5726 /* Often a unimplemented MSR or MSR bit, so worth logging. */
5727 static uint32_t s_cTimes = 0;
5728 if (s_cTimes++ < 10)
5729 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5730 else
5731#endif
5732 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
5733 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
5734 return iemRaiseGeneralProtectionFault0(pVCpu);
5735}
5736
5737
5738/**
5739 * Implements 'IN eAX, port'.
5740 *
5741 * @param u16Port The source port.
5742 * @param cbReg The register size.
5743 */
5744IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
5745{
5746 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5747
5748 /*
5749 * CPL check
5750 */
5751 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5752 if (rcStrict != VINF_SUCCESS)
5753 return rcStrict;
5754
5755 /*
5756 * Perform the I/O.
5757 */
5758 uint32_t u32Value;
5759 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5760 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
5761 else
5762 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
5763 if (IOM_SUCCESS(rcStrict))
5764 {
5765 switch (cbReg)
5766 {
5767 case 1: pCtx->al = (uint8_t)u32Value; break;
5768 case 2: pCtx->ax = (uint16_t)u32Value; break;
5769 case 4: pCtx->rax = u32Value; break;
5770 default: AssertFailedReturn(VERR_IEM_IPE_3);
5771 }
5772 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5773 pVCpu->iem.s.cPotentialExits++;
5774 if (rcStrict != VINF_SUCCESS)
5775 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5776 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5777
5778 /*
5779 * Check for I/O breakpoints.
5780 */
5781 uint32_t const uDr7 = pCtx->dr[7];
5782 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5783 && X86_DR7_ANY_RW_IO(uDr7)
5784 && (pCtx->cr4 & X86_CR4_DE))
5785 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5786 {
5787 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5788 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5789 rcStrict = iemRaiseDebugException(pVCpu);
5790 }
5791 }
5792
5793 return rcStrict;
5794}
5795
5796
5797/**
5798 * Implements 'IN eAX, DX'.
5799 *
5800 * @param cbReg The register size.
5801 */
5802IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
5803{
5804 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
5805}
5806
5807
5808/**
5809 * Implements 'OUT port, eAX'.
5810 *
5811 * @param u16Port The destination port.
5812 * @param cbReg The register size.
5813 */
5814IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
5815{
5816 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5817
5818 /*
5819 * CPL check
5820 */
5821 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
5822 if (rcStrict != VINF_SUCCESS)
5823 return rcStrict;
5824
5825 /*
5826 * Perform the I/O.
5827 */
5828 uint32_t u32Value;
5829 switch (cbReg)
5830 {
5831 case 1: u32Value = pCtx->al; break;
5832 case 2: u32Value = pCtx->ax; break;
5833 case 4: u32Value = pCtx->eax; break;
5834 default: AssertFailedReturn(VERR_IEM_IPE_4);
5835 }
5836 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5837 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
5838 else
5839 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
5840 if (IOM_SUCCESS(rcStrict))
5841 {
5842 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5843 pVCpu->iem.s.cPotentialExits++;
5844 if (rcStrict != VINF_SUCCESS)
5845 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5846 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
5847
5848 /*
5849 * Check for I/O breakpoints.
5850 */
5851 uint32_t const uDr7 = pCtx->dr[7];
5852 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
5853 && X86_DR7_ANY_RW_IO(uDr7)
5854 && (pCtx->cr4 & X86_CR4_DE))
5855 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
5856 {
5857 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
5858 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
5859 rcStrict = iemRaiseDebugException(pVCpu);
5860 }
5861 }
5862 return rcStrict;
5863}
5864
5865
5866/**
5867 * Implements 'OUT DX, eAX'.
5868 *
5869 * @param cbReg The register size.
5870 */
5871IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
5872{
5873 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
5874}
5875
5876
5877#ifdef VBOX_WITH_NESTED_HWVIRT
5878/**
5879 * Implements 'VMRUN'.
5880 */
5881IEM_CIMPL_DEF_0(iemCImpl_vmrun)
5882{
5883 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5884 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
5885
5886 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5887 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
5888 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
5889 {
5890 Log(("vmrun: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
5891 return iemRaiseGeneralProtectionFault0(pVCpu);
5892 }
5893
5894#ifndef IN_RC
5895 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMRUN))
5896 {
5897 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
5898 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_VMRUN, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5899 }
5900#endif
5901
5902 VBOXSTRICTRC rcStrict = HMSvmVmrun(pVCpu, pCtx, GCPhysVmcb);
5903 /* If VMRUN execution causes a #VMEXIT, we continue executing the instruction following the VMRUN. */
5904 if (rcStrict == VINF_SVM_VMEXIT)
5905 {
5906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5907 rcStrict = VINF_SUCCESS;
5908 }
5909 else if (rcStrict == VERR_SVM_VMEXIT_FAILED)
5910 rcStrict = iemInitiateCpuShutdown(pVCpu);
5911 return rcStrict;
5912}
5913
5914
5915/**
5916 * Implements 'VMMCALL'.
5917 */
5918IEM_CIMPL_DEF_0(iemCImpl_vmmcall)
5919{
5920 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5921#ifndef IN_RC
5922 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMMCALL))
5923 {
5924 Log(("vmrun: Guest intercept -> #VMEXIT\n"));
5925 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_VMMCALL, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5926 }
5927#endif
5928
5929 bool fUpdatedRipAndRF;
5930 VBOXSTRICTRC rcStrict = HMSvmVmmcall(pVCpu, pCtx, &fUpdatedRipAndRF);
5931 if (RT_SUCCESS(rcStrict))
5932 {
5933 if (!fUpdatedRipAndRF)
5934 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5935 return rcStrict;
5936 }
5937
5938 return iemRaiseUndefinedOpcode(pVCpu);
5939}
5940
5941
5942/**
5943 * Implements 'VMLOAD'.
5944 */
5945IEM_CIMPL_DEF_0(iemCImpl_vmload)
5946{
5947 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5948 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmload);
5949#ifndef IN_RC
5950 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMLOAD))
5951 {
5952 Log(("vmload: Guest intercept -> #VMEXIT\n"));
5953 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_VMLOAD, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5954 }
5955#endif
5956
5957 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
5958 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
5959 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
5960 {
5961 Log(("vmload: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
5962 return iemRaiseGeneralProtectionFault0(pVCpu);
5963 }
5964
5965 void *pvVmcb;
5966 PGMPAGEMAPLOCK PgLockVmcb;
5967 VBOXSTRICTRC rcStrict = iemMemPageMap(pVCpu, GCPhysVmcb, IEM_ACCESS_DATA_R, &pvVmcb, &PgLockVmcb);
5968 if (rcStrict == VINF_SUCCESS)
5969 {
5970 PCSVMVMCB pVmcb = (PCSVMVMCB)pvVmcb;
5971 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &pVmcb->guest, FS, fs);
5972 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &pVmcb->guest, GS, gs);
5973 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &pVmcb->guest, TR, tr);
5974 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, &pVmcb->guest, LDTR, ldtr);
5975
5976 pCtx->msrKERNELGSBASE = pVmcb->guest.u64KernelGSBase;
5977 pCtx->msrSTAR = pVmcb->guest.u64STAR;
5978 pCtx->msrLSTAR = pVmcb->guest.u64LSTAR;
5979 pCtx->msrCSTAR = pVmcb->guest.u64CSTAR;
5980 pCtx->msrSFMASK = pVmcb->guest.u64SFMASK;
5981
5982 pCtx->SysEnter.cs = pVmcb->guest.u64SysEnterCS;
5983 pCtx->SysEnter.esp = pVmcb->guest.u64SysEnterESP;
5984 pCtx->SysEnter.eip = pVmcb->guest.u64SysEnterEIP;
5985
5986 iemMemPageUnmap(pVCpu, GCPhysVmcb, IEM_ACCESS_DATA_R, pvVmcb, &PgLockVmcb);
5987 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5988 }
5989 return rcStrict;
5990}
5991
5992
5993/**
5994 * Implements 'VMSAVE'.
5995 */
5996IEM_CIMPL_DEF_0(iemCImpl_vmsave)
5997{
5998 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5999 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, vmsave);
6000#ifndef IN_RC
6001 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_VMSAVE))
6002 {
6003 Log(("vmsave: Guest intercept -> #VMEXIT\n"));
6004 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_VMSAVE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6005 }
6006#endif
6007
6008 RTGCPHYS const GCPhysVmcb = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6009 if ( (GCPhysVmcb & X86_PAGE_4K_OFFSET_MASK)
6010 || !PGMPhysIsGCPhysNormal(pVCpu->CTX_SUFF(pVM), GCPhysVmcb))
6011 {
6012 Log(("vmsave: VMCB physaddr (%#RGp) not valid -> #GP(0)\n", GCPhysVmcb));
6013 return iemRaiseGeneralProtectionFault0(pVCpu);
6014 }
6015
6016 void *pvVmcb;
6017 PGMPAGEMAPLOCK PgLockVmcb;
6018 VBOXSTRICTRC rcStrict = iemMemPageMap(pVCpu, GCPhysVmcb, IEM_ACCESS_DATA_RW, &pvVmcb, &PgLockVmcb);
6019 if (rcStrict == VINF_SUCCESS)
6020 {
6021 PSVMVMCB pVmcb = (PSVMVMCB)pvVmcb;
6022 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, FS, fs);
6023 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, GS, gs);
6024 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, TR, tr);
6025 HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, LDTR, ldtr);
6026
6027 pVmcb->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE;
6028 pVmcb->guest.u64STAR = pCtx->msrSTAR;
6029 pVmcb->guest.u64LSTAR = pCtx->msrLSTAR;
6030 pVmcb->guest.u64CSTAR = pCtx->msrCSTAR;
6031 pVmcb->guest.u64SFMASK = pCtx->msrSFMASK;
6032
6033 pVmcb->guest.u64SysEnterCS = pCtx->SysEnter.cs;
6034 pVmcb->guest.u64SysEnterESP = pCtx->SysEnter.esp;
6035 pVmcb->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
6036
6037 iemMemPageUnmap(pVCpu, GCPhysVmcb, IEM_ACCESS_DATA_R, pvVmcb, &PgLockVmcb);
6038 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6039 }
6040 return rcStrict;
6041}
6042
6043
6044/**
6045 * Implements 'CLGI'.
6046 */
6047IEM_CIMPL_DEF_0(iemCImpl_clgi)
6048{
6049 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6050 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, clgi);
6051#ifndef IN_RC
6052 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CLGI))
6053 {
6054 Log(("clgi: Guest intercept -> #VMEXIT\n"));
6055 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_CLGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6056 }
6057#endif
6058
6059 pCtx->hwvirt.svm.fGif = 0;
6060 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6061 return VINF_SUCCESS;
6062}
6063
6064
6065/**
6066 * Implements 'STGI'.
6067 */
6068IEM_CIMPL_DEF_0(iemCImpl_stgi)
6069{
6070 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6071 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, stgi);
6072#ifndef IN_RC
6073 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_STGI))
6074 {
6075 Log2(("stgi: Guest intercept -> #VMEXIT\n"));
6076 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_STGI, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6077 }
6078#endif
6079
6080 pCtx->hwvirt.svm.fGif = 1;
6081 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6082 return VINF_SUCCESS;
6083}
6084
6085
6086/**
6087 * Implements 'INVLPGA'.
6088 */
6089IEM_CIMPL_DEF_0(iemCImpl_invlpga)
6090{
6091 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6092 IEM_SVM_INSTR_COMMON_CHECKS(pVCpu, invlpga);
6093#ifndef IN_RC
6094 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPGA))
6095 {
6096 Log2(("invlpga: Guest intercept -> #VMEXIT\n"));
6097 return HMSvmNstGstVmExit(pVCpu, pCtx, SVM_EXIT_INVLPGA, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6098 }
6099#endif
6100
6101 RTGCPTR const GCPtrPage = pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6102 /** @todo PGM needs virtual ASID support. */
6103#if 0
6104 uint32_t const uAsid = pCtx->ecx;
6105#endif
6106 PGMInvalidatePage(pVCpu, GCPtrPage);
6107 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6108 return VINF_SUCCESS;
6109}
6110#endif /* VBOX_WITH_NESTED_HWVIRT */
6111
6112/**
6113 * Implements 'CLI'.
6114 */
6115IEM_CIMPL_DEF_0(iemCImpl_cli)
6116{
6117 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6118 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6119 uint32_t const fEflOld = fEfl;
6120 if (pCtx->cr0 & X86_CR0_PE)
6121 {
6122 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6123 if (!(fEfl & X86_EFL_VM))
6124 {
6125 if (pVCpu->iem.s.uCpl <= uIopl)
6126 fEfl &= ~X86_EFL_IF;
6127 else if ( pVCpu->iem.s.uCpl == 3
6128 && (pCtx->cr4 & X86_CR4_PVI) )
6129 fEfl &= ~X86_EFL_VIF;
6130 else
6131 return iemRaiseGeneralProtectionFault0(pVCpu);
6132 }
6133 /* V8086 */
6134 else if (uIopl == 3)
6135 fEfl &= ~X86_EFL_IF;
6136 else if ( uIopl < 3
6137 && (pCtx->cr4 & X86_CR4_VME) )
6138 fEfl &= ~X86_EFL_VIF;
6139 else
6140 return iemRaiseGeneralProtectionFault0(pVCpu);
6141 }
6142 /* real mode */
6143 else
6144 fEfl &= ~X86_EFL_IF;
6145
6146 /* Commit. */
6147 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6148 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6149 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
6150 return VINF_SUCCESS;
6151}
6152
6153
6154/**
6155 * Implements 'STI'.
6156 */
6157IEM_CIMPL_DEF_0(iemCImpl_sti)
6158{
6159 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6160 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6161 uint32_t const fEflOld = fEfl;
6162
6163 if (pCtx->cr0 & X86_CR0_PE)
6164 {
6165 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6166 if (!(fEfl & X86_EFL_VM))
6167 {
6168 if (pVCpu->iem.s.uCpl <= uIopl)
6169 fEfl |= X86_EFL_IF;
6170 else if ( pVCpu->iem.s.uCpl == 3
6171 && (pCtx->cr4 & X86_CR4_PVI)
6172 && !(fEfl & X86_EFL_VIP) )
6173 fEfl |= X86_EFL_VIF;
6174 else
6175 return iemRaiseGeneralProtectionFault0(pVCpu);
6176 }
6177 /* V8086 */
6178 else if (uIopl == 3)
6179 fEfl |= X86_EFL_IF;
6180 else if ( uIopl < 3
6181 && (pCtx->cr4 & X86_CR4_VME)
6182 && !(fEfl & X86_EFL_VIP) )
6183 fEfl |= X86_EFL_VIF;
6184 else
6185 return iemRaiseGeneralProtectionFault0(pVCpu);
6186 }
6187 /* real mode */
6188 else
6189 fEfl |= X86_EFL_IF;
6190
6191 /* Commit. */
6192 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6193 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6194 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
6195 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
6196 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
6197 return VINF_SUCCESS;
6198}
6199
6200
6201/**
6202 * Implements 'HLT'.
6203 */
6204IEM_CIMPL_DEF_0(iemCImpl_hlt)
6205{
6206 if (pVCpu->iem.s.uCpl != 0)
6207 return iemRaiseGeneralProtectionFault0(pVCpu);
6208 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6209 return VINF_EM_HALT;
6210}
6211
6212
6213/**
6214 * Implements 'MONITOR'.
6215 */
6216IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
6217{
6218 /*
6219 * Permission checks.
6220 */
6221 if (pVCpu->iem.s.uCpl != 0)
6222 {
6223 Log2(("monitor: CPL != 0\n"));
6224 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
6225 }
6226 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6227 {
6228 Log2(("monitor: Not in CPUID\n"));
6229 return iemRaiseUndefinedOpcode(pVCpu);
6230 }
6231
6232 /*
6233 * Gather the operands and validate them.
6234 */
6235 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6236 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6237 uint32_t uEcx = pCtx->ecx;
6238 uint32_t uEdx = pCtx->edx;
6239/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
6240 * \#GP first. */
6241 if (uEcx != 0)
6242 {
6243 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
6244 return iemRaiseGeneralProtectionFault0(pVCpu);
6245 }
6246
6247 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
6248 if (rcStrict != VINF_SUCCESS)
6249 return rcStrict;
6250
6251 RTGCPHYS GCPhysMem;
6252 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6253 if (rcStrict != VINF_SUCCESS)
6254 return rcStrict;
6255
6256 /*
6257 * Call EM to prepare the monitor/wait.
6258 */
6259 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
6260 Assert(rcStrict == VINF_SUCCESS);
6261
6262 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6263 return rcStrict;
6264}
6265
6266
6267/**
6268 * Implements 'MWAIT'.
6269 */
6270IEM_CIMPL_DEF_0(iemCImpl_mwait)
6271{
6272 /*
6273 * Permission checks.
6274 */
6275 if (pVCpu->iem.s.uCpl != 0)
6276 {
6277 Log2(("mwait: CPL != 0\n"));
6278 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
6279 * EFLAGS.VM then.) */
6280 return iemRaiseUndefinedOpcode(pVCpu);
6281 }
6282 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6283 {
6284 Log2(("mwait: Not in CPUID\n"));
6285 return iemRaiseUndefinedOpcode(pVCpu);
6286 }
6287
6288 /*
6289 * Gather the operands and validate them.
6290 */
6291 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6292 uint32_t uEax = pCtx->eax;
6293 uint32_t uEcx = pCtx->ecx;
6294 if (uEcx != 0)
6295 {
6296 /* Only supported extension is break on IRQ when IF=0. */
6297 if (uEcx > 1)
6298 {
6299 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
6300 return iemRaiseGeneralProtectionFault0(pVCpu);
6301 }
6302 uint32_t fMWaitFeatures = 0;
6303 uint32_t uIgnore = 0;
6304 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
6305 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6306 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6307 {
6308 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
6309 return iemRaiseGeneralProtectionFault0(pVCpu);
6310 }
6311 }
6312
6313 /*
6314 * Call EM to prepare the monitor/wait.
6315 */
6316 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
6317
6318 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6319 return rcStrict;
6320}
6321
6322
6323/**
6324 * Implements 'SWAPGS'.
6325 */
6326IEM_CIMPL_DEF_0(iemCImpl_swapgs)
6327{
6328 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
6329
6330 /*
6331 * Permission checks.
6332 */
6333 if (pVCpu->iem.s.uCpl != 0)
6334 {
6335 Log2(("swapgs: CPL != 0\n"));
6336 return iemRaiseUndefinedOpcode(pVCpu);
6337 }
6338
6339 /*
6340 * Do the job.
6341 */
6342 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6343 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
6344 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
6345 pCtx->gs.u64Base = uOtherGsBase;
6346
6347 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6348 return VINF_SUCCESS;
6349}
6350
6351
6352/**
6353 * Implements 'CPUID'.
6354 */
6355IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6356{
6357 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6358
6359 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6360 pCtx->rax &= UINT32_C(0xffffffff);
6361 pCtx->rbx &= UINT32_C(0xffffffff);
6362 pCtx->rcx &= UINT32_C(0xffffffff);
6363 pCtx->rdx &= UINT32_C(0xffffffff);
6364
6365 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6366 return VINF_SUCCESS;
6367}
6368
6369
6370/**
6371 * Implements 'AAD'.
6372 *
6373 * @param bImm The immediate operand.
6374 */
6375IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6376{
6377 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6378
6379 uint16_t const ax = pCtx->ax;
6380 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6381 pCtx->ax = al;
6382 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6383 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6384 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6385
6386 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6387 return VINF_SUCCESS;
6388}
6389
6390
6391/**
6392 * Implements 'AAM'.
6393 *
6394 * @param bImm The immediate operand. Cannot be 0.
6395 */
6396IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6397{
6398 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6399 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6400
6401 uint16_t const ax = pCtx->ax;
6402 uint8_t const al = (uint8_t)ax % bImm;
6403 uint8_t const ah = (uint8_t)ax / bImm;
6404 pCtx->ax = (ah << 8) + al;
6405 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6406 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6407 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6408
6409 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6410 return VINF_SUCCESS;
6411}
6412
6413
6414/**
6415 * Implements 'DAA'.
6416 */
6417IEM_CIMPL_DEF_0(iemCImpl_daa)
6418{
6419 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6420
6421 uint8_t const al = pCtx->al;
6422 bool const fCarry = pCtx->eflags.Bits.u1CF;
6423
6424 if ( pCtx->eflags.Bits.u1AF
6425 || (al & 0xf) >= 10)
6426 {
6427 pCtx->al = al + 6;
6428 pCtx->eflags.Bits.u1AF = 1;
6429 }
6430 else
6431 pCtx->eflags.Bits.u1AF = 0;
6432
6433 if (al >= 0x9a || fCarry)
6434 {
6435 pCtx->al += 0x60;
6436 pCtx->eflags.Bits.u1CF = 1;
6437 }
6438 else
6439 pCtx->eflags.Bits.u1CF = 0;
6440
6441 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6442 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6443 return VINF_SUCCESS;
6444}
6445
6446
6447/**
6448 * Implements 'DAS'.
6449 */
6450IEM_CIMPL_DEF_0(iemCImpl_das)
6451{
6452 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6453
6454 uint8_t const uInputAL = pCtx->al;
6455 bool const fCarry = pCtx->eflags.Bits.u1CF;
6456
6457 if ( pCtx->eflags.Bits.u1AF
6458 || (uInputAL & 0xf) >= 10)
6459 {
6460 pCtx->eflags.Bits.u1AF = 1;
6461 if (uInputAL < 6)
6462 pCtx->eflags.Bits.u1CF = 1;
6463 pCtx->al = uInputAL - 6;
6464 }
6465 else
6466 {
6467 pCtx->eflags.Bits.u1AF = 0;
6468 pCtx->eflags.Bits.u1CF = 0;
6469 }
6470
6471 if (uInputAL >= 0x9a || fCarry)
6472 {
6473 pCtx->al -= 0x60;
6474 pCtx->eflags.Bits.u1CF = 1;
6475 }
6476
6477 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6478 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6479 return VINF_SUCCESS;
6480}
6481
6482
6483/**
6484 * Implements 'AAA'.
6485 */
6486IEM_CIMPL_DEF_0(iemCImpl_aaa)
6487{
6488 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6489
6490 uint8_t const uMaskedAl = pCtx->al & 0xf;
6491 if ( pCtx->eflags.Bits.u1AF
6492 || uMaskedAl >= 10)
6493 {
6494 pCtx->ax = (pCtx->ax + UINT16_C(0x106)) & UINT16_C(0xff0f);
6495 pCtx->eflags.Bits.u1AF = 1;
6496 pCtx->eflags.Bits.u1CF = 1;
6497 }
6498 else
6499 {
6500 pCtx->al = uMaskedAl;
6501 pCtx->eflags.Bits.u1AF = 0;
6502 pCtx->eflags.Bits.u1CF = 0;
6503 }
6504
6505 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6506 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6507 return VINF_SUCCESS;
6508}
6509
6510
6511/**
6512 * Implements 'AAS'.
6513 */
6514IEM_CIMPL_DEF_0(iemCImpl_aas)
6515{
6516 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6517
6518 uint8_t const uMaskedAl = pCtx->al & 0xf;
6519 if ( pCtx->eflags.Bits.u1AF
6520 || uMaskedAl >= 10)
6521 {
6522 pCtx->ax = (pCtx->ax - 6) & UINT16_C(0xff0f);
6523 pCtx->ah -= 1;
6524 pCtx->eflags.Bits.u1AF = 1;
6525 pCtx->eflags.Bits.u1CF = 1;
6526 }
6527 else
6528 {
6529 pCtx->al = uMaskedAl;
6530 pCtx->eflags.Bits.u1AF = 0;
6531 pCtx->eflags.Bits.u1CF = 0;
6532 }
6533
6534 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6535 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6536 return VINF_SUCCESS;
6537}
6538
6539
6540/**
6541 * Implements the 16-bit version of 'BOUND'.
6542 *
6543 * @note We have separate 16-bit and 32-bit variants of this function due to
6544 * the decoder using unsigned parameters, whereas we want signed one to
6545 * do the job. This is significant for a recompiler.
6546 */
6547IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
6548{
6549 /*
6550 * Check if the index is inside the bounds, otherwise raise #BR.
6551 */
6552 if ( idxArray >= idxLowerBound
6553 && idxArray <= idxUpperBound)
6554 {
6555 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6556 return VINF_SUCCESS;
6557 }
6558
6559 return iemRaiseBoundRangeExceeded(pVCpu);
6560}
6561
6562
6563/**
6564 * Implements the 32-bit version of 'BOUND'.
6565 */
6566IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
6567{
6568 /*
6569 * Check if the index is inside the bounds, otherwise raise #BR.
6570 */
6571 if ( idxArray >= idxLowerBound
6572 && idxArray <= idxUpperBound)
6573 {
6574 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6575 return VINF_SUCCESS;
6576 }
6577
6578 return iemRaiseBoundRangeExceeded(pVCpu);
6579}
6580
6581
6582
6583/*
6584 * Instantiate the various string operation combinations.
6585 */
6586#define OP_SIZE 8
6587#define ADDR_SIZE 16
6588#include "IEMAllCImplStrInstr.cpp.h"
6589#define OP_SIZE 8
6590#define ADDR_SIZE 32
6591#include "IEMAllCImplStrInstr.cpp.h"
6592#define OP_SIZE 8
6593#define ADDR_SIZE 64
6594#include "IEMAllCImplStrInstr.cpp.h"
6595
6596#define OP_SIZE 16
6597#define ADDR_SIZE 16
6598#include "IEMAllCImplStrInstr.cpp.h"
6599#define OP_SIZE 16
6600#define ADDR_SIZE 32
6601#include "IEMAllCImplStrInstr.cpp.h"
6602#define OP_SIZE 16
6603#define ADDR_SIZE 64
6604#include "IEMAllCImplStrInstr.cpp.h"
6605
6606#define OP_SIZE 32
6607#define ADDR_SIZE 16
6608#include "IEMAllCImplStrInstr.cpp.h"
6609#define OP_SIZE 32
6610#define ADDR_SIZE 32
6611#include "IEMAllCImplStrInstr.cpp.h"
6612#define OP_SIZE 32
6613#define ADDR_SIZE 64
6614#include "IEMAllCImplStrInstr.cpp.h"
6615
6616#define OP_SIZE 64
6617#define ADDR_SIZE 32
6618#include "IEMAllCImplStrInstr.cpp.h"
6619#define OP_SIZE 64
6620#define ADDR_SIZE 64
6621#include "IEMAllCImplStrInstr.cpp.h"
6622
6623
6624/**
6625 * Implements 'XGETBV'.
6626 */
6627IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6628{
6629 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6630 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6631 {
6632 uint32_t uEcx = pCtx->ecx;
6633 switch (uEcx)
6634 {
6635 case 0:
6636 break;
6637
6638 case 1: /** @todo Implement XCR1 support. */
6639 default:
6640 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6641 return iemRaiseGeneralProtectionFault0(pVCpu);
6642
6643 }
6644 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6645 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6646
6647 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6648 return VINF_SUCCESS;
6649 }
6650 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
6651 return iemRaiseUndefinedOpcode(pVCpu);
6652}
6653
6654
6655/**
6656 * Implements 'XSETBV'.
6657 */
6658IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
6659{
6660 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6661 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6662 {
6663 if (pVCpu->iem.s.uCpl == 0)
6664 {
6665 uint32_t uEcx = pCtx->ecx;
6666 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
6667 switch (uEcx)
6668 {
6669 case 0:
6670 {
6671 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
6672 if (rc == VINF_SUCCESS)
6673 break;
6674 Assert(rc == VERR_CPUM_RAISE_GP_0);
6675 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6676 return iemRaiseGeneralProtectionFault0(pVCpu);
6677 }
6678
6679 case 1: /** @todo Implement XCR1 support. */
6680 default:
6681 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
6682 return iemRaiseGeneralProtectionFault0(pVCpu);
6683
6684 }
6685
6686 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6687 return VINF_SUCCESS;
6688 }
6689
6690 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
6691 return iemRaiseGeneralProtectionFault0(pVCpu);
6692 }
6693 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
6694 return iemRaiseUndefinedOpcode(pVCpu);
6695}
6696
6697#ifdef IN_RING3
6698
6699/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
6700struct IEMCIMPLCX16ARGS
6701{
6702 PRTUINT128U pu128Dst;
6703 PRTUINT128U pu128RaxRdx;
6704 PRTUINT128U pu128RbxRcx;
6705 uint32_t *pEFlags;
6706# ifdef VBOX_STRICT
6707 uint32_t cCalls;
6708# endif
6709};
6710
6711/**
6712 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
6713 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
6714 */
6715static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPU pVCpu, void *pvUser)
6716{
6717 RT_NOREF(pVM, pVCpu);
6718 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
6719# ifdef VBOX_STRICT
6720 Assert(pArgs->cCalls == 0);
6721 pArgs->cCalls++;
6722# endif
6723
6724 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
6725 return VINF_SUCCESS;
6726}
6727
6728#endif /* IN_RING3 */
6729
6730/**
6731 * Implements 'CMPXCHG16B' fallback using rendezvous.
6732 */
6733IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
6734 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
6735{
6736#ifdef IN_RING3
6737 struct IEMCIMPLCX16ARGS Args;
6738 Args.pu128Dst = pu128Dst;
6739 Args.pu128RaxRdx = pu128RaxRdx;
6740 Args.pu128RbxRcx = pu128RbxRcx;
6741 Args.pEFlags = pEFlags;
6742# ifdef VBOX_STRICT
6743 Args.cCalls = 0;
6744# endif
6745 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
6746 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
6747 Assert(Args.cCalls == 1);
6748 if (rcStrict == VINF_SUCCESS)
6749 {
6750 /* Duplicated tail code. */
6751 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
6752 if (rcStrict == VINF_SUCCESS)
6753 {
6754 PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
6755 pCtx->eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
6756 if (!(*pEFlags & X86_EFL_ZF))
6757 {
6758 pCtx->rax = pu128RaxRdx->s.Lo;
6759 pCtx->rdx = pu128RaxRdx->s.Hi;
6760 }
6761 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6762 }
6763 }
6764 return rcStrict;
6765#else
6766 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
6767 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
6768#endif
6769}
6770
6771
6772/**
6773 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
6774 *
6775 * This is implemented in C because it triggers a load like behviour without
6776 * actually reading anything. Since that's not so common, it's implemented
6777 * here.
6778 *
6779 * @param iEffSeg The effective segment.
6780 * @param GCPtrEff The address of the image.
6781 */
6782IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
6783{
6784 /*
6785 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
6786 */
6787 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
6788 if (rcStrict == VINF_SUCCESS)
6789 {
6790 RTGCPHYS GCPhysMem;
6791 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6792 if (rcStrict == VINF_SUCCESS)
6793 {
6794 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6795 return VINF_SUCCESS;
6796 }
6797 }
6798
6799 return rcStrict;
6800}
6801
6802
6803/**
6804 * Implements 'FINIT' and 'FNINIT'.
6805 *
6806 * @param fCheckXcpts Whether to check for umasked pending exceptions or
6807 * not.
6808 */
6809IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
6810{
6811 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6812
6813 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
6814 return iemRaiseDeviceNotAvailable(pVCpu);
6815
6816 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
6817 if (fCheckXcpts && TODO )
6818 return iemRaiseMathFault(pVCpu);
6819 */
6820
6821 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
6822 pXState->x87.FCW = 0x37f;
6823 pXState->x87.FSW = 0;
6824 pXState->x87.FTW = 0x00; /* 0 - empty. */
6825 pXState->x87.FPUDP = 0;
6826 pXState->x87.DS = 0; //??
6827 pXState->x87.Rsrvd2= 0;
6828 pXState->x87.FPUIP = 0;
6829 pXState->x87.CS = 0; //??
6830 pXState->x87.Rsrvd1= 0;
6831 pXState->x87.FOP = 0;
6832
6833 iemHlpUsedFpu(pVCpu);
6834 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6835 return VINF_SUCCESS;
6836}
6837
6838
6839/**
6840 * Implements 'FXSAVE'.
6841 *
6842 * @param iEffSeg The effective segment.
6843 * @param GCPtrEff The address of the image.
6844 * @param enmEffOpSize The operand size (only REX.W really matters).
6845 */
6846IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6847{
6848 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6849
6850 /*
6851 * Raise exceptions.
6852 */
6853 if (pCtx->cr0 & X86_CR0_EM)
6854 return iemRaiseUndefinedOpcode(pVCpu);
6855 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6856 return iemRaiseDeviceNotAvailable(pVCpu);
6857 if (GCPtrEff & 15)
6858 {
6859 /** @todo CPU/VM detection possible! \#AC might not be signal for
6860 * all/any misalignment sizes, intel says its an implementation detail. */
6861 if ( (pCtx->cr0 & X86_CR0_AM)
6862 && pCtx->eflags.Bits.u1AC
6863 && pVCpu->iem.s.uCpl == 3)
6864 return iemRaiseAlignmentCheckException(pVCpu);
6865 return iemRaiseGeneralProtectionFault0(pVCpu);
6866 }
6867
6868 /*
6869 * Access the memory.
6870 */
6871 void *pvMem512;
6872 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6873 if (rcStrict != VINF_SUCCESS)
6874 return rcStrict;
6875 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
6876 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
6877
6878 /*
6879 * Store the registers.
6880 */
6881 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6882 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
6883
6884 /* common for all formats */
6885 pDst->FCW = pSrc->FCW;
6886 pDst->FSW = pSrc->FSW;
6887 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
6888 pDst->FOP = pSrc->FOP;
6889 pDst->MXCSR = pSrc->MXCSR;
6890 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
6891 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
6892 {
6893 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
6894 * them for now... */
6895 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
6896 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
6897 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
6898 pDst->aRegs[i].au32[3] = 0;
6899 }
6900
6901 /* FPU IP, CS, DP and DS. */
6902 pDst->FPUIP = pSrc->FPUIP;
6903 pDst->CS = pSrc->CS;
6904 pDst->FPUDP = pSrc->FPUDP;
6905 pDst->DS = pSrc->DS;
6906 if (enmEffOpSize == IEMMODE_64BIT)
6907 {
6908 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
6909 pDst->Rsrvd1 = pSrc->Rsrvd1;
6910 pDst->Rsrvd2 = pSrc->Rsrvd2;
6911 pDst->au32RsrvdForSoftware[0] = 0;
6912 }
6913 else
6914 {
6915 pDst->Rsrvd1 = 0;
6916 pDst->Rsrvd2 = 0;
6917 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
6918 }
6919
6920 /* XMM registers. */
6921 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
6922 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
6923 || pVCpu->iem.s.uCpl != 0)
6924 {
6925 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
6926 for (uint32_t i = 0; i < cXmmRegs; i++)
6927 pDst->aXMM[i] = pSrc->aXMM[i];
6928 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
6929 * right? */
6930 }
6931
6932 /*
6933 * Commit the memory.
6934 */
6935 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
6936 if (rcStrict != VINF_SUCCESS)
6937 return rcStrict;
6938
6939 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6940 return VINF_SUCCESS;
6941}
6942
6943
6944/**
6945 * Implements 'FXRSTOR'.
6946 *
6947 * @param GCPtrEff The address of the image.
6948 * @param enmEffOpSize The operand size (only REX.W really matters).
6949 */
6950IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
6951{
6952 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6953
6954 /*
6955 * Raise exceptions.
6956 */
6957 if (pCtx->cr0 & X86_CR0_EM)
6958 return iemRaiseUndefinedOpcode(pVCpu);
6959 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
6960 return iemRaiseDeviceNotAvailable(pVCpu);
6961 if (GCPtrEff & 15)
6962 {
6963 /** @todo CPU/VM detection possible! \#AC might not be signal for
6964 * all/any misalignment sizes, intel says its an implementation detail. */
6965 if ( (pCtx->cr0 & X86_CR0_AM)
6966 && pCtx->eflags.Bits.u1AC
6967 && pVCpu->iem.s.uCpl == 3)
6968 return iemRaiseAlignmentCheckException(pVCpu);
6969 return iemRaiseGeneralProtectionFault0(pVCpu);
6970 }
6971
6972 /*
6973 * Access the memory.
6974 */
6975 void *pvMem512;
6976 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
6977 if (rcStrict != VINF_SUCCESS)
6978 return rcStrict;
6979 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
6980 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
6981
6982 /*
6983 * Check the state for stuff which will #GP(0).
6984 */
6985 uint32_t const fMXCSR = pSrc->MXCSR;
6986 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
6987 if (fMXCSR & ~fMXCSR_MASK)
6988 {
6989 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
6990 return iemRaiseGeneralProtectionFault0(pVCpu);
6991 }
6992
6993 /*
6994 * Load the registers.
6995 */
6996 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
6997 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
6998
6999 /* common for all formats */
7000 pDst->FCW = pSrc->FCW;
7001 pDst->FSW = pSrc->FSW;
7002 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7003 pDst->FOP = pSrc->FOP;
7004 pDst->MXCSR = fMXCSR;
7005 /* (MXCSR_MASK is read-only) */
7006 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7007 {
7008 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7009 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7010 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7011 pDst->aRegs[i].au32[3] = 0;
7012 }
7013
7014 /* FPU IP, CS, DP and DS. */
7015 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
7016 {
7017 pDst->FPUIP = pSrc->FPUIP;
7018 pDst->CS = pSrc->CS;
7019 pDst->Rsrvd1 = pSrc->Rsrvd1;
7020 pDst->FPUDP = pSrc->FPUDP;
7021 pDst->DS = pSrc->DS;
7022 pDst->Rsrvd2 = pSrc->Rsrvd2;
7023 }
7024 else
7025 {
7026 pDst->FPUIP = pSrc->FPUIP;
7027 pDst->CS = pSrc->CS;
7028 pDst->Rsrvd1 = 0;
7029 pDst->FPUDP = pSrc->FPUDP;
7030 pDst->DS = pSrc->DS;
7031 pDst->Rsrvd2 = 0;
7032 }
7033
7034 /* XMM registers. */
7035 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
7036 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
7037 || pVCpu->iem.s.uCpl != 0)
7038 {
7039 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7040 for (uint32_t i = 0; i < cXmmRegs; i++)
7041 pDst->aXMM[i] = pSrc->aXMM[i];
7042 }
7043
7044 /*
7045 * Commit the memory.
7046 */
7047 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7048 if (rcStrict != VINF_SUCCESS)
7049 return rcStrict;
7050
7051 iemHlpUsedFpu(pVCpu);
7052 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7053 return VINF_SUCCESS;
7054}
7055
7056
7057/**
7058 * Implements 'XSAVE'.
7059 *
7060 * @param iEffSeg The effective segment.
7061 * @param GCPtrEff The address of the image.
7062 * @param enmEffOpSize The operand size (only REX.W really matters).
7063 */
7064IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7065{
7066 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7067
7068 /*
7069 * Raise exceptions.
7070 */
7071 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7072 return iemRaiseUndefinedOpcode(pVCpu);
7073 if (pCtx->cr0 & X86_CR0_TS)
7074 return iemRaiseDeviceNotAvailable(pVCpu);
7075 if (GCPtrEff & 63)
7076 {
7077 /** @todo CPU/VM detection possible! \#AC might not be signal for
7078 * all/any misalignment sizes, intel says its an implementation detail. */
7079 if ( (pCtx->cr0 & X86_CR0_AM)
7080 && pCtx->eflags.Bits.u1AC
7081 && pVCpu->iem.s.uCpl == 3)
7082 return iemRaiseAlignmentCheckException(pVCpu);
7083 return iemRaiseGeneralProtectionFault0(pVCpu);
7084 }
7085
7086 /*
7087 * Calc the requested mask
7088 */
7089 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7090 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7091 uint64_t const fXInUse = pCtx->aXcr[0];
7092
7093/** @todo figure out the exact protocol for the memory access. Currently we
7094 * just need this crap to work halfways to make it possible to test
7095 * AVX instructions. */
7096/** @todo figure out the XINUSE and XMODIFIED */
7097
7098 /*
7099 * Access the x87 memory state.
7100 */
7101 /* The x87+SSE state. */
7102 void *pvMem512;
7103 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7104 if (rcStrict != VINF_SUCCESS)
7105 return rcStrict;
7106 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7107 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
7108
7109 /* The header. */
7110 PX86XSAVEHDR pHdr;
7111 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW);
7112 if (rcStrict != VINF_SUCCESS)
7113 return rcStrict;
7114
7115 /*
7116 * Store the X87 state.
7117 */
7118 if (fReqComponents & XSAVE_C_X87)
7119 {
7120 /* common for all formats */
7121 pDst->FCW = pSrc->FCW;
7122 pDst->FSW = pSrc->FSW;
7123 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7124 pDst->FOP = pSrc->FOP;
7125 pDst->FPUIP = pSrc->FPUIP;
7126 pDst->CS = pSrc->CS;
7127 pDst->FPUDP = pSrc->FPUDP;
7128 pDst->DS = pSrc->DS;
7129 if (enmEffOpSize == IEMMODE_64BIT)
7130 {
7131 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7132 pDst->Rsrvd1 = pSrc->Rsrvd1;
7133 pDst->Rsrvd2 = pSrc->Rsrvd2;
7134 pDst->au32RsrvdForSoftware[0] = 0;
7135 }
7136 else
7137 {
7138 pDst->Rsrvd1 = 0;
7139 pDst->Rsrvd2 = 0;
7140 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
7141 }
7142 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7143 {
7144 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7145 * them for now... */
7146 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7147 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7148 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7149 pDst->aRegs[i].au32[3] = 0;
7150 }
7151
7152 }
7153
7154 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7155 {
7156 pDst->MXCSR = pSrc->MXCSR;
7157 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7158 }
7159
7160 if (fReqComponents & XSAVE_C_SSE)
7161 {
7162 /* XMM registers. */
7163 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7164 for (uint32_t i = 0; i < cXmmRegs; i++)
7165 pDst->aXMM[i] = pSrc->aXMM[i];
7166 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7167 * right? */
7168 }
7169
7170 /* Commit the x87 state bits. (probably wrong) */
7171 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7172 if (rcStrict != VINF_SUCCESS)
7173 return rcStrict;
7174
7175 /*
7176 * Store AVX state.
7177 */
7178 if (fReqComponents & XSAVE_C_YMM)
7179 {
7180 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7181 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7182 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
7183 PX86XSAVEYMMHI pCompDst;
7184 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT],
7185 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7186 if (rcStrict != VINF_SUCCESS)
7187 return rcStrict;
7188
7189 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7190 for (uint32_t i = 0; i < cXmmRegs; i++)
7191 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
7192
7193 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7194 if (rcStrict != VINF_SUCCESS)
7195 return rcStrict;
7196 }
7197
7198 /*
7199 * Update the header.
7200 */
7201 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
7202 | (fReqComponents & fXInUse);
7203
7204 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
7205 if (rcStrict != VINF_SUCCESS)
7206 return rcStrict;
7207
7208 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7209 return VINF_SUCCESS;
7210}
7211
7212
7213/**
7214 * Implements 'XRSTOR'.
7215 *
7216 * @param iEffSeg The effective segment.
7217 * @param GCPtrEff The address of the image.
7218 * @param enmEffOpSize The operand size (only REX.W really matters).
7219 */
7220IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7221{
7222 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7223
7224 /*
7225 * Raise exceptions.
7226 */
7227 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7228 return iemRaiseUndefinedOpcode(pVCpu);
7229 if (pCtx->cr0 & X86_CR0_TS)
7230 return iemRaiseDeviceNotAvailable(pVCpu);
7231 if (GCPtrEff & 63)
7232 {
7233 /** @todo CPU/VM detection possible! \#AC might not be signal for
7234 * all/any misalignment sizes, intel says its an implementation detail. */
7235 if ( (pCtx->cr0 & X86_CR0_AM)
7236 && pCtx->eflags.Bits.u1AC
7237 && pVCpu->iem.s.uCpl == 3)
7238 return iemRaiseAlignmentCheckException(pVCpu);
7239 return iemRaiseGeneralProtectionFault0(pVCpu);
7240 }
7241
7242/** @todo figure out the exact protocol for the memory access. Currently we
7243 * just need this crap to work halfways to make it possible to test
7244 * AVX instructions. */
7245/** @todo figure out the XINUSE and XMODIFIED */
7246
7247 /*
7248 * Access the x87 memory state.
7249 */
7250 /* The x87+SSE state. */
7251 void *pvMem512;
7252 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
7253 if (rcStrict != VINF_SUCCESS)
7254 return rcStrict;
7255 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
7256 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
7257
7258 /*
7259 * Calc the requested mask
7260 */
7261 PX86XSAVEHDR pHdrDst = &pCtx->CTX_SUFF(pXState)->Hdr;
7262 PCX86XSAVEHDR pHdrSrc;
7263 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_R);
7264 if (rcStrict != VINF_SUCCESS)
7265 return rcStrict;
7266
7267 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7268 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7269 //uint64_t const fXInUse = pCtx->aXcr[0];
7270 uint64_t const fRstorMask = pHdrSrc->bmXState;
7271 uint64_t const fCompMask = pHdrSrc->bmXComp;
7272
7273 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7274
7275 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7276
7277 /* We won't need this any longer. */
7278 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
7279 if (rcStrict != VINF_SUCCESS)
7280 return rcStrict;
7281
7282 /*
7283 * Store the X87 state.
7284 */
7285 if (fReqComponents & XSAVE_C_X87)
7286 {
7287 if (fRstorMask & XSAVE_C_X87)
7288 {
7289 pDst->FCW = pSrc->FCW;
7290 pDst->FSW = pSrc->FSW;
7291 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7292 pDst->FOP = pSrc->FOP;
7293 pDst->FPUIP = pSrc->FPUIP;
7294 pDst->CS = pSrc->CS;
7295 pDst->FPUDP = pSrc->FPUDP;
7296 pDst->DS = pSrc->DS;
7297 if (enmEffOpSize == IEMMODE_64BIT)
7298 {
7299 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7300 pDst->Rsrvd1 = pSrc->Rsrvd1;
7301 pDst->Rsrvd2 = pSrc->Rsrvd2;
7302 }
7303 else
7304 {
7305 pDst->Rsrvd1 = 0;
7306 pDst->Rsrvd2 = 0;
7307 }
7308 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7309 {
7310 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7311 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7312 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7313 pDst->aRegs[i].au32[3] = 0;
7314 }
7315 }
7316 else
7317 {
7318 pDst->FCW = 0x37f;
7319 pDst->FSW = 0;
7320 pDst->FTW = 0x00; /* 0 - empty. */
7321 pDst->FPUDP = 0;
7322 pDst->DS = 0; //??
7323 pDst->Rsrvd2= 0;
7324 pDst->FPUIP = 0;
7325 pDst->CS = 0; //??
7326 pDst->Rsrvd1= 0;
7327 pDst->FOP = 0;
7328 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7329 {
7330 pDst->aRegs[i].au32[0] = 0;
7331 pDst->aRegs[i].au32[1] = 0;
7332 pDst->aRegs[i].au32[2] = 0;
7333 pDst->aRegs[i].au32[3] = 0;
7334 }
7335 }
7336 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
7337 }
7338
7339 /* MXCSR */
7340 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7341 {
7342 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
7343 pDst->MXCSR = pSrc->MXCSR;
7344 else
7345 pDst->MXCSR = 0x1f80;
7346 }
7347
7348 /* XMM registers. */
7349 if (fReqComponents & XSAVE_C_SSE)
7350 {
7351 if (fRstorMask & XSAVE_C_SSE)
7352 {
7353 for (uint32_t i = 0; i < cXmmRegs; i++)
7354 pDst->aXMM[i] = pSrc->aXMM[i];
7355 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7356 * right? */
7357 }
7358 else
7359 {
7360 for (uint32_t i = 0; i < cXmmRegs; i++)
7361 {
7362 pDst->aXMM[i].au64[0] = 0;
7363 pDst->aXMM[i].au64[1] = 0;
7364 }
7365 }
7366 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
7367 }
7368
7369 /* Unmap the x87 state bits (so we've don't run out of mapping). */
7370 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7371 if (rcStrict != VINF_SUCCESS)
7372 return rcStrict;
7373
7374 /*
7375 * Restore AVX state.
7376 */
7377 if (fReqComponents & XSAVE_C_YMM)
7378 {
7379 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7380 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
7381
7382 if (fRstorMask & XSAVE_C_YMM)
7383 {
7384 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7385 PCX86XSAVEYMMHI pCompSrc;
7386 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
7387 iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT], IEM_ACCESS_DATA_R);
7388 if (rcStrict != VINF_SUCCESS)
7389 return rcStrict;
7390
7391 for (uint32_t i = 0; i < cXmmRegs; i++)
7392 {
7393 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
7394 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
7395 }
7396
7397 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
7398 if (rcStrict != VINF_SUCCESS)
7399 return rcStrict;
7400 }
7401 else
7402 {
7403 for (uint32_t i = 0; i < cXmmRegs; i++)
7404 {
7405 pCompDst->aYmmHi[i].au64[0] = 0;
7406 pCompDst->aYmmHi[i].au64[1] = 0;
7407 }
7408 }
7409 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
7410 }
7411
7412 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7413 return VINF_SUCCESS;
7414}
7415
7416
7417
7418
7419/**
7420 * Implements 'STMXCSR'.
7421 *
7422 * @param GCPtrEff The address of the image.
7423 */
7424IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7425{
7426 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7427
7428 /*
7429 * Raise exceptions.
7430 */
7431 if ( !(pCtx->cr0 & X86_CR0_EM)
7432 && (pCtx->cr4 & X86_CR4_OSFXSR))
7433 {
7434 if (!(pCtx->cr0 & X86_CR0_TS))
7435 {
7436 /*
7437 * Do the job.
7438 */
7439 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7440 if (rcStrict == VINF_SUCCESS)
7441 {
7442 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7443 return VINF_SUCCESS;
7444 }
7445 return rcStrict;
7446 }
7447 return iemRaiseDeviceNotAvailable(pVCpu);
7448 }
7449 return iemRaiseUndefinedOpcode(pVCpu);
7450}
7451
7452
7453/**
7454 * Implements 'VSTMXCSR'.
7455 *
7456 * @param GCPtrEff The address of the image.
7457 */
7458IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7459{
7460 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7461
7462 /*
7463 * Raise exceptions.
7464 */
7465 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
7466 ? (pCtx->aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
7467 : !(pCtx->cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
7468 && (pCtx->cr4 & X86_CR4_OSXSAVE))
7469 {
7470 if (!(pCtx->cr0 & X86_CR0_TS))
7471 {
7472 /*
7473 * Do the job.
7474 */
7475 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7476 if (rcStrict == VINF_SUCCESS)
7477 {
7478 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7479 return VINF_SUCCESS;
7480 }
7481 return rcStrict;
7482 }
7483 return iemRaiseDeviceNotAvailable(pVCpu);
7484 }
7485 return iemRaiseUndefinedOpcode(pVCpu);
7486}
7487
7488
7489/**
7490 * Implements 'LDMXCSR'.
7491 *
7492 * @param GCPtrEff The address of the image.
7493 */
7494IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7495{
7496 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7497
7498 /*
7499 * Raise exceptions.
7500 */
7501 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
7502 * happen after or before \#UD and \#EM? */
7503 if ( !(pCtx->cr0 & X86_CR0_EM)
7504 && (pCtx->cr4 & X86_CR4_OSFXSR))
7505 {
7506 if (!(pCtx->cr0 & X86_CR0_TS))
7507 {
7508 /*
7509 * Do the job.
7510 */
7511 uint32_t fNewMxCsr;
7512 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
7513 if (rcStrict == VINF_SUCCESS)
7514 {
7515 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7516 if (!(fNewMxCsr & ~fMxCsrMask))
7517 {
7518 pCtx->CTX_SUFF(pXState)->x87.MXCSR = fNewMxCsr;
7519 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7520 return VINF_SUCCESS;
7521 }
7522 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
7523 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
7524 return iemRaiseGeneralProtectionFault0(pVCpu);
7525 }
7526 return rcStrict;
7527 }
7528 return iemRaiseDeviceNotAvailable(pVCpu);
7529 }
7530 return iemRaiseUndefinedOpcode(pVCpu);
7531}
7532
7533
7534/**
7535 * Commmon routine for fnstenv and fnsave.
7536 *
7537 * @param uPtr Where to store the state.
7538 * @param pCtx The CPU context.
7539 */
7540static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
7541{
7542 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
7543 if (enmEffOpSize == IEMMODE_16BIT)
7544 {
7545 uPtr.pu16[0] = pSrcX87->FCW;
7546 uPtr.pu16[1] = pSrcX87->FSW;
7547 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
7548 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7549 {
7550 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
7551 * protected mode or long mode and we save it in real mode? And vice
7552 * versa? And with 32-bit operand size? I think CPU is storing the
7553 * effective address ((CS << 4) + IP) in the offset register and not
7554 * doing any address calculations here. */
7555 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
7556 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
7557 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
7558 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
7559 }
7560 else
7561 {
7562 uPtr.pu16[3] = pSrcX87->FPUIP;
7563 uPtr.pu16[4] = pSrcX87->CS;
7564 uPtr.pu16[5] = pSrcX87->FPUDP;
7565 uPtr.pu16[6] = pSrcX87->DS;
7566 }
7567 }
7568 else
7569 {
7570 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
7571 uPtr.pu16[0*2] = pSrcX87->FCW;
7572 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
7573 uPtr.pu16[1*2] = pSrcX87->FSW;
7574 uPtr.pu16[1*2+1] = 0xffff;
7575 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
7576 uPtr.pu16[2*2+1] = 0xffff;
7577 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7578 {
7579 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
7580 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
7581 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
7582 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
7583 }
7584 else
7585 {
7586 uPtr.pu32[3] = pSrcX87->FPUIP;
7587 uPtr.pu16[4*2] = pSrcX87->CS;
7588 uPtr.pu16[4*2+1] = pSrcX87->FOP;
7589 uPtr.pu32[5] = pSrcX87->FPUDP;
7590 uPtr.pu16[6*2] = pSrcX87->DS;
7591 uPtr.pu16[6*2+1] = 0xffff;
7592 }
7593 }
7594}
7595
7596
7597/**
7598 * Commmon routine for fldenv and frstor
7599 *
7600 * @param uPtr Where to store the state.
7601 * @param pCtx The CPU context.
7602 */
7603static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
7604{
7605 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
7606 if (enmEffOpSize == IEMMODE_16BIT)
7607 {
7608 pDstX87->FCW = uPtr.pu16[0];
7609 pDstX87->FSW = uPtr.pu16[1];
7610 pDstX87->FTW = uPtr.pu16[2];
7611 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7612 {
7613 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
7614 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
7615 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
7616 pDstX87->CS = 0;
7617 pDstX87->Rsrvd1= 0;
7618 pDstX87->DS = 0;
7619 pDstX87->Rsrvd2= 0;
7620 }
7621 else
7622 {
7623 pDstX87->FPUIP = uPtr.pu16[3];
7624 pDstX87->CS = uPtr.pu16[4];
7625 pDstX87->Rsrvd1= 0;
7626 pDstX87->FPUDP = uPtr.pu16[5];
7627 pDstX87->DS = uPtr.pu16[6];
7628 pDstX87->Rsrvd2= 0;
7629 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
7630 }
7631 }
7632 else
7633 {
7634 pDstX87->FCW = uPtr.pu16[0*2];
7635 pDstX87->FSW = uPtr.pu16[1*2];
7636 pDstX87->FTW = uPtr.pu16[2*2];
7637 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7638 {
7639 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
7640 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
7641 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
7642 pDstX87->CS = 0;
7643 pDstX87->Rsrvd1= 0;
7644 pDstX87->DS = 0;
7645 pDstX87->Rsrvd2= 0;
7646 }
7647 else
7648 {
7649 pDstX87->FPUIP = uPtr.pu32[3];
7650 pDstX87->CS = uPtr.pu16[4*2];
7651 pDstX87->Rsrvd1= 0;
7652 pDstX87->FOP = uPtr.pu16[4*2+1];
7653 pDstX87->FPUDP = uPtr.pu32[5];
7654 pDstX87->DS = uPtr.pu16[6*2];
7655 pDstX87->Rsrvd2= 0;
7656 }
7657 }
7658
7659 /* Make adjustments. */
7660 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
7661 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
7662 iemFpuRecalcExceptionStatus(pDstX87);
7663 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
7664 * exceptions are pending after loading the saved state? */
7665}
7666
7667
7668/**
7669 * Implements 'FNSTENV'.
7670 *
7671 * @param enmEffOpSize The operand size (only REX.W really matters).
7672 * @param iEffSeg The effective segment register for @a GCPtrEff.
7673 * @param GCPtrEffDst The address of the image.
7674 */
7675IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
7676{
7677 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7678 RTPTRUNION uPtr;
7679 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
7680 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7681 if (rcStrict != VINF_SUCCESS)
7682 return rcStrict;
7683
7684 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
7685
7686 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7687 if (rcStrict != VINF_SUCCESS)
7688 return rcStrict;
7689
7690 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
7691 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7692 return VINF_SUCCESS;
7693}
7694
7695
7696/**
7697 * Implements 'FNSAVE'.
7698 *
7699 * @param GCPtrEffDst The address of the image.
7700 * @param enmEffOpSize The operand size.
7701 */
7702IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
7703{
7704 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7705 RTPTRUNION uPtr;
7706 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
7707 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7708 if (rcStrict != VINF_SUCCESS)
7709 return rcStrict;
7710
7711 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7712 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
7713 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
7714 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
7715 {
7716 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
7717 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
7718 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
7719 }
7720
7721 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7722 if (rcStrict != VINF_SUCCESS)
7723 return rcStrict;
7724
7725 /*
7726 * Re-initialize the FPU context.
7727 */
7728 pFpuCtx->FCW = 0x37f;
7729 pFpuCtx->FSW = 0;
7730 pFpuCtx->FTW = 0x00; /* 0 - empty */
7731 pFpuCtx->FPUDP = 0;
7732 pFpuCtx->DS = 0;
7733 pFpuCtx->Rsrvd2= 0;
7734 pFpuCtx->FPUIP = 0;
7735 pFpuCtx->CS = 0;
7736 pFpuCtx->Rsrvd1= 0;
7737 pFpuCtx->FOP = 0;
7738
7739 iemHlpUsedFpu(pVCpu);
7740 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7741 return VINF_SUCCESS;
7742}
7743
7744
7745
7746/**
7747 * Implements 'FLDENV'.
7748 *
7749 * @param enmEffOpSize The operand size (only REX.W really matters).
7750 * @param iEffSeg The effective segment register for @a GCPtrEff.
7751 * @param GCPtrEffSrc The address of the image.
7752 */
7753IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
7754{
7755 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7756 RTCPTRUNION uPtr;
7757 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
7758 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
7759 if (rcStrict != VINF_SUCCESS)
7760 return rcStrict;
7761
7762 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
7763
7764 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
7765 if (rcStrict != VINF_SUCCESS)
7766 return rcStrict;
7767
7768 iemHlpUsedFpu(pVCpu);
7769 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7770 return VINF_SUCCESS;
7771}
7772
7773
7774/**
7775 * Implements 'FRSTOR'.
7776 *
7777 * @param GCPtrEffSrc The address of the image.
7778 * @param enmEffOpSize The operand size.
7779 */
7780IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
7781{
7782 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7783 RTCPTRUNION uPtr;
7784 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
7785 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
7786 if (rcStrict != VINF_SUCCESS)
7787 return rcStrict;
7788
7789 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7790 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
7791 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
7792 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
7793 {
7794 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
7795 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
7796 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
7797 pFpuCtx->aRegs[i].au32[3] = 0;
7798 }
7799
7800 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
7801 if (rcStrict != VINF_SUCCESS)
7802 return rcStrict;
7803
7804 iemHlpUsedFpu(pVCpu);
7805 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7806 return VINF_SUCCESS;
7807}
7808
7809
7810/**
7811 * Implements 'FLDCW'.
7812 *
7813 * @param u16Fcw The new FCW.
7814 */
7815IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
7816{
7817 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7818
7819 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
7820 /** @todo Testcase: Try see what happens when trying to set undefined bits
7821 * (other than 6 and 7). Currently ignoring them. */
7822 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
7823 * according to FSW. (This is was is currently implemented.) */
7824 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7825 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
7826 iemFpuRecalcExceptionStatus(pFpuCtx);
7827
7828 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
7829 iemHlpUsedFpu(pVCpu);
7830 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7831 return VINF_SUCCESS;
7832}
7833
7834
7835
7836/**
7837 * Implements the underflow case of fxch.
7838 *
7839 * @param iStReg The other stack register.
7840 */
7841IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
7842{
7843 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7844
7845 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7846 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
7847 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
7848 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
7849
7850 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
7851 * registers are read as QNaN and then exchanged. This could be
7852 * wrong... */
7853 if (pFpuCtx->FCW & X86_FCW_IM)
7854 {
7855 if (RT_BIT(iReg1) & pFpuCtx->FTW)
7856 {
7857 if (RT_BIT(iReg2) & pFpuCtx->FTW)
7858 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
7859 else
7860 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
7861 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
7862 }
7863 else
7864 {
7865 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
7866 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
7867 }
7868 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
7869 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
7870 }
7871 else
7872 {
7873 /* raise underflow exception, don't change anything. */
7874 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
7875 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
7876 }
7877
7878 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
7879 iemHlpUsedFpu(pVCpu);
7880 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7881 return VINF_SUCCESS;
7882}
7883
7884
7885/**
7886 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
7887 *
7888 * @param cToAdd 1 or 7.
7889 */
7890IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
7891{
7892 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7893 Assert(iStReg < 8);
7894
7895 /*
7896 * Raise exceptions.
7897 */
7898 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
7899 return iemRaiseDeviceNotAvailable(pVCpu);
7900
7901 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
7902 uint16_t u16Fsw = pFpuCtx->FSW;
7903 if (u16Fsw & X86_FSW_ES)
7904 return iemRaiseMathFault(pVCpu);
7905
7906 /*
7907 * Check if any of the register accesses causes #SF + #IA.
7908 */
7909 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
7910 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
7911 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
7912 {
7913 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
7914 NOREF(u32Eflags);
7915
7916 pFpuCtx->FSW &= ~X86_FSW_C1;
7917 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
7918 if ( !(u16Fsw & X86_FSW_IE)
7919 || (pFpuCtx->FCW & X86_FCW_IM) )
7920 {
7921 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7922 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7923 }
7924 }
7925 else if (pFpuCtx->FCW & X86_FCW_IM)
7926 {
7927 /* Masked underflow. */
7928 pFpuCtx->FSW &= ~X86_FSW_C1;
7929 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
7930 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
7931 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
7932 }
7933 else
7934 {
7935 /* Raise underflow - don't touch EFLAGS or TOP. */
7936 pFpuCtx->FSW &= ~X86_FSW_C1;
7937 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
7938 fPop = false;
7939 }
7940
7941 /*
7942 * Pop if necessary.
7943 */
7944 if (fPop)
7945 {
7946 pFpuCtx->FTW &= ~RT_BIT(iReg1);
7947 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
7948 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
7949 }
7950
7951 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
7952 iemHlpUsedFpu(pVCpu);
7953 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7954 return VINF_SUCCESS;
7955}
7956
7957/** @} */
7958
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette