VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 71088

Last change on this file since 71088 was 71077, checked in by vboxsync, 7 years ago

VMM/IEM: Nested Hw.virt: Fix GDTR, IDTR read intercepts. Previously it was combined incorrectly as GDTR read intercept.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 283.6 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 71077 2018-02-21 07:55:38Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18#ifdef VBOX_WITH_NESTED_HWVIRT
19# include "IEMAllCImplSvmInstr.cpp.h"
20#endif
21
22/** @name Misc Helpers
23 * @{
24 */
25
26
27/**
28 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
29 *
30 * @returns Strict VBox status code.
31 *
32 * @param pVCpu The cross context virtual CPU structure of the calling thread.
33 * @param pCtx The register context.
34 * @param u16Port The port number.
35 * @param cbOperand The operand size.
36 */
37static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
38{
39 /* The TSS bits we're interested in are the same on 386 and AMD64. */
40 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
41 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
42 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
43 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
44
45 /*
46 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
47 */
48 Assert(!pCtx->tr.Attr.n.u1DescType);
49 if (RT_UNLIKELY( pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
50 && pCtx->tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
51 {
52 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
53 u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
54 return iemRaiseGeneralProtectionFault0(pVCpu);
55 }
56
57 /*
58 * Read the bitmap offset (may #PF).
59 */
60 uint16_t offBitmap;
61 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
62 pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
63 if (rcStrict != VINF_SUCCESS)
64 {
65 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
66 return rcStrict;
67 }
68
69 /*
70 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
71 * describes the CPU actually reading two bytes regardless of whether the
72 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
73 */
74 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
75 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
76 * for instance sizeof(X86TSS32). */
77 if (offFirstBit + 1 > pCtx->tr.u32Limit) /* the limit is inclusive */
78 {
79 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
80 offFirstBit, pCtx->tr.u32Limit));
81 return iemRaiseGeneralProtectionFault0(pVCpu);
82 }
83
84 /*
85 * Read the necessary bits.
86 */
87 /** @todo Test the assertion in the intel manual that the CPU reads two
88 * bytes. The question is how this works wrt to #PF and #GP on the
89 * 2nd byte when it's not required. */
90 uint16_t bmBytes = UINT16_MAX;
91 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
92 if (rcStrict != VINF_SUCCESS)
93 {
94 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
95 return rcStrict;
96 }
97
98 /*
99 * Perform the check.
100 */
101 uint16_t fPortMask = (1 << cbOperand) - 1;
102 bmBytes >>= (u16Port & 7);
103 if (bmBytes & fPortMask)
104 {
105 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
106 u16Port, cbOperand, bmBytes, fPortMask));
107 return iemRaiseGeneralProtectionFault0(pVCpu);
108 }
109
110 return VINF_SUCCESS;
111}
112
113
114/**
115 * Checks if we are allowed to access the given I/O port, raising the
116 * appropriate exceptions if we aren't (or if the I/O bitmap is not
117 * accessible).
118 *
119 * @returns Strict VBox status code.
120 *
121 * @param pVCpu The cross context virtual CPU structure of the calling thread.
122 * @param pCtx The register context.
123 * @param u16Port The port number.
124 * @param cbOperand The operand size.
125 */
126DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
127{
128 X86EFLAGS Efl;
129 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
130 if ( (pCtx->cr0 & X86_CR0_PE)
131 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
132 || Efl.Bits.u1VM) )
133 return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
134 return VINF_SUCCESS;
135}
136
137
138#if 0
139/**
140 * Calculates the parity bit.
141 *
142 * @returns true if the bit is set, false if not.
143 * @param u8Result The least significant byte of the result.
144 */
145static bool iemHlpCalcParityFlag(uint8_t u8Result)
146{
147 /*
148 * Parity is set if the number of bits in the least significant byte of
149 * the result is even.
150 */
151 uint8_t cBits;
152 cBits = u8Result & 1; /* 0 */
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1;
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1; /* 4 */
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 u8Result >>= 1;
164 cBits += u8Result & 1;
165 u8Result >>= 1;
166 cBits += u8Result & 1;
167 return !(cBits & 1);
168}
169#endif /* not used */
170
171
172/**
173 * Updates the specified flags according to a 8-bit result.
174 *
175 * @param pVCpu The cross context virtual CPU structure of the calling thread.
176 * @param u8Result The result to set the flags according to.
177 * @param fToUpdate The flags to update.
178 * @param fUndefined The flags that are specified as undefined.
179 */
180static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
181{
182 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
183
184 uint32_t fEFlags = pCtx->eflags.u;
185 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
186 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
187 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
188#ifdef IEM_VERIFICATION_MODE_FULL
189 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
190#endif
191}
192
193
194/**
195 * Updates the specified flags according to a 16-bit result.
196 *
197 * @param pVCpu The cross context virtual CPU structure of the calling thread.
198 * @param u16Result The result to set the flags according to.
199 * @param fToUpdate The flags to update.
200 * @param fUndefined The flags that are specified as undefined.
201 */
202static void iemHlpUpdateArithEFlagsU16(PVMCPU pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
203{
204 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
205
206 uint32_t fEFlags = pCtx->eflags.u;
207 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
208 pCtx->eflags.u &= ~(fToUpdate | fUndefined);
209 pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
210#ifdef IEM_VERIFICATION_MODE_FULL
211 pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
212#endif
213}
214
215
216/**
217 * Helper used by iret.
218 *
219 * @param pVCpu The cross context virtual CPU structure of the calling thread.
220 * @param uCpl The new CPL.
221 * @param pSReg Pointer to the segment register.
222 */
223static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
224{
225#ifdef VBOX_WITH_RAW_MODE_NOT_R0
226 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
227 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
228#else
229 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
230#endif
231
232 if ( uCpl > pSReg->Attr.n.u2Dpl
233 && pSReg->Attr.n.u1DescType /* code or data, not system */
234 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
235 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
236 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
237}
238
239
240/**
241 * Indicates that we have modified the FPU state.
242 *
243 * @param pVCpu The cross context virtual CPU structure of the calling thread.
244 */
245DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
246{
247 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
248}
249
250/** @} */
251
252/** @name C Implementations
253 * @{
254 */
255
256/**
257 * Implements a 16-bit popa.
258 */
259IEM_CIMPL_DEF_0(iemCImpl_popa_16)
260{
261 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
262 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
263 RTGCPTR GCPtrLast = GCPtrStart + 15;
264 VBOXSTRICTRC rcStrict;
265
266 /*
267 * The docs are a bit hard to comprehend here, but it looks like we wrap
268 * around in real mode as long as none of the individual "popa" crosses the
269 * end of the stack segment. In protected mode we check the whole access
270 * in one go. For efficiency, only do the word-by-word thing if we're in
271 * danger of wrapping around.
272 */
273 /** @todo do popa boundary / wrap-around checks. */
274 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
275 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
276 {
277 /* word-by-word */
278 RTUINT64U TmpRsp;
279 TmpRsp.u = pCtx->rsp;
280 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
281 if (rcStrict == VINF_SUCCESS)
282 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
283 if (rcStrict == VINF_SUCCESS)
284 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
285 if (rcStrict == VINF_SUCCESS)
286 {
287 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
288 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
289 }
290 if (rcStrict == VINF_SUCCESS)
291 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
292 if (rcStrict == VINF_SUCCESS)
293 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
294 if (rcStrict == VINF_SUCCESS)
295 rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
296 if (rcStrict == VINF_SUCCESS)
297 {
298 pCtx->rsp = TmpRsp.u;
299 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
300 }
301 }
302 else
303 {
304 uint16_t const *pa16Mem = NULL;
305 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
306 if (rcStrict == VINF_SUCCESS)
307 {
308 pCtx->di = pa16Mem[7 - X86_GREG_xDI];
309 pCtx->si = pa16Mem[7 - X86_GREG_xSI];
310 pCtx->bp = pa16Mem[7 - X86_GREG_xBP];
311 /* skip sp */
312 pCtx->bx = pa16Mem[7 - X86_GREG_xBX];
313 pCtx->dx = pa16Mem[7 - X86_GREG_xDX];
314 pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
315 pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
316 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
317 if (rcStrict == VINF_SUCCESS)
318 {
319 iemRegAddToRsp(pVCpu, pCtx, 16);
320 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
321 }
322 }
323 }
324 return rcStrict;
325}
326
327
328/**
329 * Implements a 32-bit popa.
330 */
331IEM_CIMPL_DEF_0(iemCImpl_popa_32)
332{
333 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
334 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu, pCtx);
335 RTGCPTR GCPtrLast = GCPtrStart + 31;
336 VBOXSTRICTRC rcStrict;
337
338 /*
339 * The docs are a bit hard to comprehend here, but it looks like we wrap
340 * around in real mode as long as none of the individual "popa" crosses the
341 * end of the stack segment. In protected mode we check the whole access
342 * in one go. For efficiency, only do the word-by-word thing if we're in
343 * danger of wrapping around.
344 */
345 /** @todo do popa boundary / wrap-around checks. */
346 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
347 && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
348 {
349 /* word-by-word */
350 RTUINT64U TmpRsp;
351 TmpRsp.u = pCtx->rsp;
352 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
353 if (rcStrict == VINF_SUCCESS)
354 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
355 if (rcStrict == VINF_SUCCESS)
356 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
357 if (rcStrict == VINF_SUCCESS)
358 {
359 iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
360 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
361 }
362 if (rcStrict == VINF_SUCCESS)
363 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
364 if (rcStrict == VINF_SUCCESS)
365 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
366 if (rcStrict == VINF_SUCCESS)
367 rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
368 if (rcStrict == VINF_SUCCESS)
369 {
370#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
371 pCtx->rdi &= UINT32_MAX;
372 pCtx->rsi &= UINT32_MAX;
373 pCtx->rbp &= UINT32_MAX;
374 pCtx->rbx &= UINT32_MAX;
375 pCtx->rdx &= UINT32_MAX;
376 pCtx->rcx &= UINT32_MAX;
377 pCtx->rax &= UINT32_MAX;
378#endif
379 pCtx->rsp = TmpRsp.u;
380 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
381 }
382 }
383 else
384 {
385 uint32_t const *pa32Mem;
386 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
387 if (rcStrict == VINF_SUCCESS)
388 {
389 pCtx->rdi = pa32Mem[7 - X86_GREG_xDI];
390 pCtx->rsi = pa32Mem[7 - X86_GREG_xSI];
391 pCtx->rbp = pa32Mem[7 - X86_GREG_xBP];
392 /* skip esp */
393 pCtx->rbx = pa32Mem[7 - X86_GREG_xBX];
394 pCtx->rdx = pa32Mem[7 - X86_GREG_xDX];
395 pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
396 pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
397 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
398 if (rcStrict == VINF_SUCCESS)
399 {
400 iemRegAddToRsp(pVCpu, pCtx, 32);
401 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
402 }
403 }
404 }
405 return rcStrict;
406}
407
408
409/**
410 * Implements a 16-bit pusha.
411 */
412IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
413{
414 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
415 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
416 RTGCPTR GCPtrBottom = GCPtrTop - 15;
417 VBOXSTRICTRC rcStrict;
418
419 /*
420 * The docs are a bit hard to comprehend here, but it looks like we wrap
421 * around in real mode as long as none of the individual "pushd" crosses the
422 * end of the stack segment. In protected mode we check the whole access
423 * in one go. For efficiency, only do the word-by-word thing if we're in
424 * danger of wrapping around.
425 */
426 /** @todo do pusha boundary / wrap-around checks. */
427 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
428 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
429 {
430 /* word-by-word */
431 RTUINT64U TmpRsp;
432 TmpRsp.u = pCtx->rsp;
433 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
434 if (rcStrict == VINF_SUCCESS)
435 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
436 if (rcStrict == VINF_SUCCESS)
437 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
438 if (rcStrict == VINF_SUCCESS)
439 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
440 if (rcStrict == VINF_SUCCESS)
441 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
442 if (rcStrict == VINF_SUCCESS)
443 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
444 if (rcStrict == VINF_SUCCESS)
445 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
446 if (rcStrict == VINF_SUCCESS)
447 rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
448 if (rcStrict == VINF_SUCCESS)
449 {
450 pCtx->rsp = TmpRsp.u;
451 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
452 }
453 }
454 else
455 {
456 GCPtrBottom--;
457 uint16_t *pa16Mem = NULL;
458 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
459 if (rcStrict == VINF_SUCCESS)
460 {
461 pa16Mem[7 - X86_GREG_xDI] = pCtx->di;
462 pa16Mem[7 - X86_GREG_xSI] = pCtx->si;
463 pa16Mem[7 - X86_GREG_xBP] = pCtx->bp;
464 pa16Mem[7 - X86_GREG_xSP] = pCtx->sp;
465 pa16Mem[7 - X86_GREG_xBX] = pCtx->bx;
466 pa16Mem[7 - X86_GREG_xDX] = pCtx->dx;
467 pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
468 pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
469 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
470 if (rcStrict == VINF_SUCCESS)
471 {
472 iemRegSubFromRsp(pVCpu, pCtx, 16);
473 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
474 }
475 }
476 }
477 return rcStrict;
478}
479
480
481/**
482 * Implements a 32-bit pusha.
483 */
484IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
485{
486 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
487 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu, pCtx);
488 RTGCPTR GCPtrBottom = GCPtrTop - 31;
489 VBOXSTRICTRC rcStrict;
490
491 /*
492 * The docs are a bit hard to comprehend here, but it looks like we wrap
493 * around in real mode as long as none of the individual "pusha" crosses the
494 * end of the stack segment. In protected mode we check the whole access
495 * in one go. For efficiency, only do the word-by-word thing if we're in
496 * danger of wrapping around.
497 */
498 /** @todo do pusha boundary / wrap-around checks. */
499 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
500 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
501 {
502 /* word-by-word */
503 RTUINT64U TmpRsp;
504 TmpRsp.u = pCtx->rsp;
505 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
506 if (rcStrict == VINF_SUCCESS)
507 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
508 if (rcStrict == VINF_SUCCESS)
509 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
510 if (rcStrict == VINF_SUCCESS)
511 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
512 if (rcStrict == VINF_SUCCESS)
513 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
514 if (rcStrict == VINF_SUCCESS)
515 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
516 if (rcStrict == VINF_SUCCESS)
517 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
518 if (rcStrict == VINF_SUCCESS)
519 rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
520 if (rcStrict == VINF_SUCCESS)
521 {
522 pCtx->rsp = TmpRsp.u;
523 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
524 }
525 }
526 else
527 {
528 GCPtrBottom--;
529 uint32_t *pa32Mem;
530 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
531 if (rcStrict == VINF_SUCCESS)
532 {
533 pa32Mem[7 - X86_GREG_xDI] = pCtx->edi;
534 pa32Mem[7 - X86_GREG_xSI] = pCtx->esi;
535 pa32Mem[7 - X86_GREG_xBP] = pCtx->ebp;
536 pa32Mem[7 - X86_GREG_xSP] = pCtx->esp;
537 pa32Mem[7 - X86_GREG_xBX] = pCtx->ebx;
538 pa32Mem[7 - X86_GREG_xDX] = pCtx->edx;
539 pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
540 pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
541 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
542 if (rcStrict == VINF_SUCCESS)
543 {
544 iemRegSubFromRsp(pVCpu, pCtx, 32);
545 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
546 }
547 }
548 }
549 return rcStrict;
550}
551
552
553/**
554 * Implements pushf.
555 *
556 *
557 * @param enmEffOpSize The effective operand size.
558 */
559IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
560{
561 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
562 VBOXSTRICTRC rcStrict;
563
564 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
565 {
566 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
567 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
568 }
569
570 /*
571 * If we're in V8086 mode some care is required (which is why we're in
572 * doing this in a C implementation).
573 */
574 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
575 if ( (fEfl & X86_EFL_VM)
576 && X86_EFL_GET_IOPL(fEfl) != 3 )
577 {
578 Assert(pCtx->cr0 & X86_CR0_PE);
579 if ( enmEffOpSize != IEMMODE_16BIT
580 || !(pCtx->cr4 & X86_CR4_VME))
581 return iemRaiseGeneralProtectionFault0(pVCpu);
582 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
583 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
584 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
585 }
586 else
587 {
588
589 /*
590 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
591 */
592 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
593
594 switch (enmEffOpSize)
595 {
596 case IEMMODE_16BIT:
597 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
598 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
599 fEfl |= UINT16_C(0xf000);
600 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
601 break;
602 case IEMMODE_32BIT:
603 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
604 break;
605 case IEMMODE_64BIT:
606 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
607 break;
608 IEM_NOT_REACHED_DEFAULT_CASE_RET();
609 }
610 }
611 if (rcStrict != VINF_SUCCESS)
612 return rcStrict;
613
614 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
615 return VINF_SUCCESS;
616}
617
618
619/**
620 * Implements popf.
621 *
622 * @param enmEffOpSize The effective operand size.
623 */
624IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
625{
626 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
627 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
628 VBOXSTRICTRC rcStrict;
629 uint32_t fEflNew;
630
631 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
632 {
633 Log2(("popf: Guest intercept -> #VMEXIT\n"));
634 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
635 }
636
637 /*
638 * V8086 is special as usual.
639 */
640 if (fEflOld & X86_EFL_VM)
641 {
642 /*
643 * Almost anything goes if IOPL is 3.
644 */
645 if (X86_EFL_GET_IOPL(fEflOld) == 3)
646 {
647 switch (enmEffOpSize)
648 {
649 case IEMMODE_16BIT:
650 {
651 uint16_t u16Value;
652 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
653 if (rcStrict != VINF_SUCCESS)
654 return rcStrict;
655 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
656 break;
657 }
658 case IEMMODE_32BIT:
659 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
660 if (rcStrict != VINF_SUCCESS)
661 return rcStrict;
662 break;
663 IEM_NOT_REACHED_DEFAULT_CASE_RET();
664 }
665
666 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
667 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
668 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
669 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
670 }
671 /*
672 * Interrupt flag virtualization with CR4.VME=1.
673 */
674 else if ( enmEffOpSize == IEMMODE_16BIT
675 && (pCtx->cr4 & X86_CR4_VME) )
676 {
677 uint16_t u16Value;
678 RTUINT64U TmpRsp;
679 TmpRsp.u = pCtx->rsp;
680 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
681 if (rcStrict != VINF_SUCCESS)
682 return rcStrict;
683
684 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
685 * or before? */
686 if ( ( (u16Value & X86_EFL_IF)
687 && (fEflOld & X86_EFL_VIP))
688 || (u16Value & X86_EFL_TF) )
689 return iemRaiseGeneralProtectionFault0(pVCpu);
690
691 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
692 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
693 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
694 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
695
696 pCtx->rsp = TmpRsp.u;
697 }
698 else
699 return iemRaiseGeneralProtectionFault0(pVCpu);
700
701 }
702 /*
703 * Not in V8086 mode.
704 */
705 else
706 {
707 /* Pop the flags. */
708 switch (enmEffOpSize)
709 {
710 case IEMMODE_16BIT:
711 {
712 uint16_t u16Value;
713 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
714 if (rcStrict != VINF_SUCCESS)
715 return rcStrict;
716 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
717
718 /*
719 * Ancient CPU adjustments:
720 * - 8086, 80186, V20/30:
721 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
722 * practical reasons (masking below). We add them when pushing flags.
723 * - 80286:
724 * The NT and IOPL flags cannot be popped from real mode and are
725 * therefore always zero (since a 286 can never exit from PM and
726 * their initial value is zero). This changed on a 386 and can
727 * therefore be used to detect 286 or 386 CPU in real mode.
728 */
729 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
730 && !(pCtx->cr0 & X86_CR0_PE) )
731 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
732 break;
733 }
734 case IEMMODE_32BIT:
735 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
736 if (rcStrict != VINF_SUCCESS)
737 return rcStrict;
738 break;
739 case IEMMODE_64BIT:
740 {
741 uint64_t u64Value;
742 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
743 if (rcStrict != VINF_SUCCESS)
744 return rcStrict;
745 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
746 break;
747 }
748 IEM_NOT_REACHED_DEFAULT_CASE_RET();
749 }
750
751 /* Merge them with the current flags. */
752 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
753 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
754 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
755 || pVCpu->iem.s.uCpl == 0)
756 {
757 fEflNew &= fPopfBits;
758 fEflNew |= ~fPopfBits & fEflOld;
759 }
760 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
761 {
762 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
763 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
764 }
765 else
766 {
767 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
768 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
769 }
770 }
771
772 /*
773 * Commit the flags.
774 */
775 Assert(fEflNew & RT_BIT_32(1));
776 IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
777 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
778
779 return VINF_SUCCESS;
780}
781
782
783/**
784 * Implements an indirect call.
785 *
786 * @param uNewPC The new program counter (RIP) value (loaded from the
787 * operand).
788 * @param enmEffOpSize The effective operand size.
789 */
790IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
791{
792 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
793 uint16_t uOldPC = pCtx->ip + cbInstr;
794 if (uNewPC > pCtx->cs.u32Limit)
795 return iemRaiseGeneralProtectionFault0(pVCpu);
796
797 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
798 if (rcStrict != VINF_SUCCESS)
799 return rcStrict;
800
801 pCtx->rip = uNewPC;
802 pCtx->eflags.Bits.u1RF = 0;
803
804#ifndef IEM_WITH_CODE_TLB
805 /* Flush the prefetch buffer. */
806 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
807#endif
808 return VINF_SUCCESS;
809}
810
811
812/**
813 * Implements a 16-bit relative call.
814 *
815 * @param offDisp The displacment offset.
816 */
817IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
818{
819 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
820 uint16_t uOldPC = pCtx->ip + cbInstr;
821 uint16_t uNewPC = uOldPC + offDisp;
822 if (uNewPC > pCtx->cs.u32Limit)
823 return iemRaiseGeneralProtectionFault0(pVCpu);
824
825 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
826 if (rcStrict != VINF_SUCCESS)
827 return rcStrict;
828
829 pCtx->rip = uNewPC;
830 pCtx->eflags.Bits.u1RF = 0;
831
832#ifndef IEM_WITH_CODE_TLB
833 /* Flush the prefetch buffer. */
834 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
835#endif
836 return VINF_SUCCESS;
837}
838
839
840/**
841 * Implements a 32-bit indirect call.
842 *
843 * @param uNewPC The new program counter (RIP) value (loaded from the
844 * operand).
845 * @param enmEffOpSize The effective operand size.
846 */
847IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
848{
849 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
850 uint32_t uOldPC = pCtx->eip + cbInstr;
851 if (uNewPC > pCtx->cs.u32Limit)
852 return iemRaiseGeneralProtectionFault0(pVCpu);
853
854 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
855 if (rcStrict != VINF_SUCCESS)
856 return rcStrict;
857
858#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
859 /*
860 * CASM hook for recording interesting indirect calls.
861 */
862 if ( !pCtx->eflags.Bits.u1IF
863 && (pCtx->cr0 & X86_CR0_PG)
864 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
865 && pVCpu->iem.s.uCpl == 0)
866 {
867 EMSTATE enmState = EMGetState(pVCpu);
868 if ( enmState == EMSTATE_IEM_THEN_REM
869 || enmState == EMSTATE_IEM
870 || enmState == EMSTATE_REM)
871 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
872 }
873#endif
874
875 pCtx->rip = uNewPC;
876 pCtx->eflags.Bits.u1RF = 0;
877
878#ifndef IEM_WITH_CODE_TLB
879 /* Flush the prefetch buffer. */
880 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
881#endif
882 return VINF_SUCCESS;
883}
884
885
886/**
887 * Implements a 32-bit relative call.
888 *
889 * @param offDisp The displacment offset.
890 */
891IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
892{
893 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
894 uint32_t uOldPC = pCtx->eip + cbInstr;
895 uint32_t uNewPC = uOldPC + offDisp;
896 if (uNewPC > pCtx->cs.u32Limit)
897 return iemRaiseGeneralProtectionFault0(pVCpu);
898
899 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
900 if (rcStrict != VINF_SUCCESS)
901 return rcStrict;
902
903 pCtx->rip = uNewPC;
904 pCtx->eflags.Bits.u1RF = 0;
905
906#ifndef IEM_WITH_CODE_TLB
907 /* Flush the prefetch buffer. */
908 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
909#endif
910 return VINF_SUCCESS;
911}
912
913
914/**
915 * Implements a 64-bit indirect call.
916 *
917 * @param uNewPC The new program counter (RIP) value (loaded from the
918 * operand).
919 * @param enmEffOpSize The effective operand size.
920 */
921IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
922{
923 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
924 uint64_t uOldPC = pCtx->rip + cbInstr;
925 if (!IEM_IS_CANONICAL(uNewPC))
926 return iemRaiseGeneralProtectionFault0(pVCpu);
927
928 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
929 if (rcStrict != VINF_SUCCESS)
930 return rcStrict;
931
932 pCtx->rip = uNewPC;
933 pCtx->eflags.Bits.u1RF = 0;
934
935#ifndef IEM_WITH_CODE_TLB
936 /* Flush the prefetch buffer. */
937 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
938#endif
939 return VINF_SUCCESS;
940}
941
942
943/**
944 * Implements a 64-bit relative call.
945 *
946 * @param offDisp The displacment offset.
947 */
948IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
949{
950 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
951 uint64_t uOldPC = pCtx->rip + cbInstr;
952 uint64_t uNewPC = uOldPC + offDisp;
953 if (!IEM_IS_CANONICAL(uNewPC))
954 return iemRaiseNotCanonical(pVCpu);
955
956 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
957 if (rcStrict != VINF_SUCCESS)
958 return rcStrict;
959
960 pCtx->rip = uNewPC;
961 pCtx->eflags.Bits.u1RF = 0;
962
963#ifndef IEM_WITH_CODE_TLB
964 /* Flush the prefetch buffer. */
965 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
966#endif
967
968 return VINF_SUCCESS;
969}
970
971
972/**
973 * Implements far jumps and calls thru task segments (TSS).
974 *
975 * @param uSel The selector.
976 * @param enmBranch The kind of branching we're performing.
977 * @param enmEffOpSize The effective operand size.
978 * @param pDesc The descriptor corresponding to @a uSel. The type is
979 * task gate.
980 */
981IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
982{
983#ifndef IEM_IMPLEMENTS_TASKSWITCH
984 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
985#else
986 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
987 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
988 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
989 RT_NOREF_PV(enmEffOpSize);
990
991 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
992 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
993 {
994 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
995 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
996 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
997 }
998
999 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1000 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1001 * checked here, need testcases. */
1002 if (!pDesc->Legacy.Gen.u1Present)
1003 {
1004 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
1005 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1006 }
1007
1008 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1009 uint32_t uNextEip = pCtx->eip + cbInstr;
1010 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1011 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
1012#endif
1013}
1014
1015
1016/**
1017 * Implements far jumps and calls thru task gates.
1018 *
1019 * @param uSel The selector.
1020 * @param enmBranch The kind of branching we're performing.
1021 * @param enmEffOpSize The effective operand size.
1022 * @param pDesc The descriptor corresponding to @a uSel. The type is
1023 * task gate.
1024 */
1025IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1026{
1027#ifndef IEM_IMPLEMENTS_TASKSWITCH
1028 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1029#else
1030 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1031 RT_NOREF_PV(enmEffOpSize);
1032
1033 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1034 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1035 {
1036 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1037 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1038 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1039 }
1040
1041 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1042 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1043 * checked here, need testcases. */
1044 if (!pDesc->Legacy.Gen.u1Present)
1045 {
1046 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1047 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1048 }
1049
1050 /*
1051 * Fetch the new TSS descriptor from the GDT.
1052 */
1053 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1054 if (uSelTss & X86_SEL_LDT)
1055 {
1056 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1057 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1058 }
1059
1060 IEMSELDESC TssDesc;
1061 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1062 if (rcStrict != VINF_SUCCESS)
1063 return rcStrict;
1064
1065 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1066 {
1067 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1068 TssDesc.Legacy.Gate.u4Type));
1069 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1070 }
1071
1072 if (!TssDesc.Legacy.Gate.u1Present)
1073 {
1074 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1075 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1076 }
1077
1078 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1079 uint32_t uNextEip = pCtx->eip + cbInstr;
1080 return iemTaskSwitch(pVCpu, pCtx, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1081 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1082#endif
1083}
1084
1085
1086/**
1087 * Implements far jumps and calls thru call gates.
1088 *
1089 * @param uSel The selector.
1090 * @param enmBranch The kind of branching we're performing.
1091 * @param enmEffOpSize The effective operand size.
1092 * @param pDesc The descriptor corresponding to @a uSel. The type is
1093 * call gate.
1094 */
1095IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1096{
1097#define IEM_IMPLEMENTS_CALLGATE
1098#ifndef IEM_IMPLEMENTS_CALLGATE
1099 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1100#else
1101 RT_NOREF_PV(enmEffOpSize);
1102
1103 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1104 * inter-privilege calls and are much more complex.
1105 *
1106 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1107 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1108 * must be 16-bit or 32-bit.
1109 */
1110 /** @todo: effective operand size is probably irrelevant here, only the
1111 * call gate bitness matters??
1112 */
1113 VBOXSTRICTRC rcStrict;
1114 RTPTRUNION uPtrRet;
1115 uint64_t uNewRsp;
1116 uint64_t uNewRip;
1117 uint64_t u64Base;
1118 uint32_t cbLimit;
1119 RTSEL uNewCS;
1120 IEMSELDESC DescCS;
1121
1122 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1123 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1124 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1125 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1126
1127 /* Determine the new instruction pointer from the gate descriptor. */
1128 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1129 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1130 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1131
1132 /* Perform DPL checks on the gate descriptor. */
1133 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1134 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1135 {
1136 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1137 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1138 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1139 }
1140
1141 /** @todo does this catch NULL selectors, too? */
1142 if (!pDesc->Legacy.Gen.u1Present)
1143 {
1144 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1145 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1146 }
1147
1148 /*
1149 * Fetch the target CS descriptor from the GDT or LDT.
1150 */
1151 uNewCS = pDesc->Legacy.Gate.u16Sel;
1152 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1153 if (rcStrict != VINF_SUCCESS)
1154 return rcStrict;
1155
1156 /* Target CS must be a code selector. */
1157 if ( !DescCS.Legacy.Gen.u1DescType
1158 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1159 {
1160 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1161 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1162 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1163 }
1164
1165 /* Privilege checks on target CS. */
1166 if (enmBranch == IEMBRANCH_JUMP)
1167 {
1168 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1169 {
1170 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1171 {
1172 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1173 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1174 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1175 }
1176 }
1177 else
1178 {
1179 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1180 {
1181 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1182 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1183 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1184 }
1185 }
1186 }
1187 else
1188 {
1189 Assert(enmBranch == IEMBRANCH_CALL);
1190 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1191 {
1192 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1193 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1194 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1195 }
1196 }
1197
1198 /* Additional long mode checks. */
1199 if (IEM_IS_LONG_MODE(pVCpu))
1200 {
1201 if (!DescCS.Legacy.Gen.u1Long)
1202 {
1203 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1204 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1205 }
1206
1207 /* L vs D. */
1208 if ( DescCS.Legacy.Gen.u1Long
1209 && DescCS.Legacy.Gen.u1DefBig)
1210 {
1211 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1212 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1213 }
1214 }
1215
1216 if (!DescCS.Legacy.Gate.u1Present)
1217 {
1218 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1219 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1220 }
1221
1222 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1223
1224 if (enmBranch == IEMBRANCH_JUMP)
1225 {
1226 /** @todo: This is very similar to regular far jumps; merge! */
1227 /* Jumps are fairly simple... */
1228
1229 /* Chop the high bits off if 16-bit gate (Intel says so). */
1230 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1231 uNewRip = (uint16_t)uNewRip;
1232
1233 /* Limit check for non-long segments. */
1234 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1235 if (DescCS.Legacy.Gen.u1Long)
1236 u64Base = 0;
1237 else
1238 {
1239 if (uNewRip > cbLimit)
1240 {
1241 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1242 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1243 }
1244 u64Base = X86DESC_BASE(&DescCS.Legacy);
1245 }
1246
1247 /* Canonical address check. */
1248 if (!IEM_IS_CANONICAL(uNewRip))
1249 {
1250 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1251 return iemRaiseNotCanonical(pVCpu);
1252 }
1253
1254 /*
1255 * Ok, everything checked out fine. Now set the accessed bit before
1256 * committing the result into CS, CSHID and RIP.
1257 */
1258 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1259 {
1260 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1261 if (rcStrict != VINF_SUCCESS)
1262 return rcStrict;
1263 /** @todo check what VT-x and AMD-V does. */
1264 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1265 }
1266
1267 /* commit */
1268 pCtx->rip = uNewRip;
1269 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1270 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1271 pCtx->cs.ValidSel = pCtx->cs.Sel;
1272 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1273 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1274 pCtx->cs.u32Limit = cbLimit;
1275 pCtx->cs.u64Base = u64Base;
1276 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1277 }
1278 else
1279 {
1280 Assert(enmBranch == IEMBRANCH_CALL);
1281 /* Calls are much more complicated. */
1282
1283 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1284 {
1285 uint16_t offNewStack; /* Offset of new stack in TSS. */
1286 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1287 uint8_t uNewCSDpl;
1288 uint8_t cbWords;
1289 RTSEL uNewSS;
1290 RTSEL uOldSS;
1291 uint64_t uOldRsp;
1292 IEMSELDESC DescSS;
1293 RTPTRUNION uPtrTSS;
1294 RTGCPTR GCPtrTSS;
1295 RTPTRUNION uPtrParmWds;
1296 RTGCPTR GCPtrParmWds;
1297
1298 /* More privilege. This is the fun part. */
1299 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1300
1301 /*
1302 * Determine new SS:rSP from the TSS.
1303 */
1304 Assert(!pCtx->tr.Attr.n.u1DescType);
1305
1306 /* Figure out where the new stack pointer is stored in the TSS. */
1307 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1308 if (!IEM_IS_LONG_MODE(pVCpu))
1309 {
1310 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1311 {
1312 offNewStack = RT_OFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1313 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1314 }
1315 else
1316 {
1317 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1318 offNewStack = RT_OFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1319 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1320 }
1321 }
1322 else
1323 {
1324 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1325 offNewStack = RT_OFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1326 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1327 }
1328
1329 /* Check against TSS limit. */
1330 if ((uint16_t)(offNewStack + cbNewStack - 1) > pCtx->tr.u32Limit)
1331 {
1332 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
1333 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
1334 }
1335
1336 GCPtrTSS = pCtx->tr.u64Base + offNewStack;
1337 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1338 if (rcStrict != VINF_SUCCESS)
1339 {
1340 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1341 return rcStrict;
1342 }
1343
1344 if (!IEM_IS_LONG_MODE(pVCpu))
1345 {
1346 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1347 {
1348 uNewRsp = uPtrTSS.pu32[0];
1349 uNewSS = uPtrTSS.pu16[2];
1350 }
1351 else
1352 {
1353 Assert(pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1354 uNewRsp = uPtrTSS.pu16[0];
1355 uNewSS = uPtrTSS.pu16[1];
1356 }
1357 }
1358 else
1359 {
1360 Assert(pCtx->tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1361 /* SS will be a NULL selector, but that's valid. */
1362 uNewRsp = uPtrTSS.pu64[0];
1363 uNewSS = uNewCSDpl;
1364 }
1365
1366 /* Done with the TSS now. */
1367 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1368 if (rcStrict != VINF_SUCCESS)
1369 {
1370 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1371 return rcStrict;
1372 }
1373
1374 /* Only used outside of long mode. */
1375 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1376
1377 /* If EFER.LMA is 0, there's extra work to do. */
1378 if (!IEM_IS_LONG_MODE(pVCpu))
1379 {
1380 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1381 {
1382 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1383 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1384 }
1385
1386 /* Grab the new SS descriptor. */
1387 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1388 if (rcStrict != VINF_SUCCESS)
1389 return rcStrict;
1390
1391 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1392 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1393 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1394 {
1395 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1396 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1397 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1398 }
1399
1400 /* Ensure new SS is a writable data segment. */
1401 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1402 {
1403 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1404 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1405 }
1406
1407 if (!DescSS.Legacy.Gen.u1Present)
1408 {
1409 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1410 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1411 }
1412 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1413 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1414 else
1415 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1416 }
1417 else
1418 {
1419 /* Just grab the new (NULL) SS descriptor. */
1420 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1421 * like we do... */
1422 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1423 if (rcStrict != VINF_SUCCESS)
1424 return rcStrict;
1425
1426 cbNewStack = sizeof(uint64_t) * 4;
1427 }
1428
1429 /** @todo: According to Intel, new stack is checked for enough space first,
1430 * then switched. According to AMD, the stack is switched first and
1431 * then pushes might fault!
1432 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1433 * incoming stack #PF happens before actual stack switch. AMD is
1434 * either lying or implicitly assumes that new state is committed
1435 * only if and when an instruction doesn't fault.
1436 */
1437
1438 /** @todo: According to AMD, CS is loaded first, then SS.
1439 * According to Intel, it's the other way around!?
1440 */
1441
1442 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1443
1444 /* Set the accessed bit before committing new SS. */
1445 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1446 {
1447 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1448 if (rcStrict != VINF_SUCCESS)
1449 return rcStrict;
1450 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1451 }
1452
1453 /* Remember the old SS:rSP and their linear address. */
1454 uOldSS = pCtx->ss.Sel;
1455 uOldRsp = pCtx->ss.Attr.n.u1DefBig ? pCtx->rsp : pCtx->sp;
1456
1457 GCPtrParmWds = pCtx->ss.u64Base + uOldRsp;
1458
1459 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1460 or #PF, the former is not implemented in this workaround. */
1461 /** @todo Proper fix callgate target stack exceptions. */
1462 /** @todo testcase: Cover callgates with partially or fully inaccessible
1463 * target stacks. */
1464 void *pvNewFrame;
1465 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1466 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1467 if (rcStrict != VINF_SUCCESS)
1468 {
1469 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1470 return rcStrict;
1471 }
1472 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1473 if (rcStrict != VINF_SUCCESS)
1474 {
1475 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1476 return rcStrict;
1477 }
1478
1479 /* Commit new SS:rSP. */
1480 pCtx->ss.Sel = uNewSS;
1481 pCtx->ss.ValidSel = uNewSS;
1482 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1483 pCtx->ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1484 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1485 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
1486 pCtx->rsp = uNewRsp;
1487 pVCpu->iem.s.uCpl = uNewCSDpl;
1488 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
1489 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1490
1491 /* At this point the stack access must not fail because new state was already committed. */
1492 /** @todo this can still fail due to SS.LIMIT not check. */
1493 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1494 &uPtrRet.pv, &uNewRsp);
1495 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1496 VERR_INTERNAL_ERROR_5);
1497
1498 if (!IEM_IS_LONG_MODE(pVCpu))
1499 {
1500 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1501 {
1502 /* Push the old CS:rIP. */
1503 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1504 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1505
1506 if (cbWords)
1507 {
1508 /* Map the relevant chunk of the old stack. */
1509 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1510 if (rcStrict != VINF_SUCCESS)
1511 {
1512 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1513 return rcStrict;
1514 }
1515
1516 /* Copy the parameter (d)words. */
1517 for (int i = 0; i < cbWords; ++i)
1518 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1519
1520 /* Unmap the old stack. */
1521 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1522 if (rcStrict != VINF_SUCCESS)
1523 {
1524 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1525 return rcStrict;
1526 }
1527 }
1528
1529 /* Push the old SS:rSP. */
1530 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1531 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1532 }
1533 else
1534 {
1535 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1536
1537 /* Push the old CS:rIP. */
1538 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1539 uPtrRet.pu16[1] = pCtx->cs.Sel;
1540
1541 if (cbWords)
1542 {
1543 /* Map the relevant chunk of the old stack. */
1544 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1545 if (rcStrict != VINF_SUCCESS)
1546 {
1547 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1548 return rcStrict;
1549 }
1550
1551 /* Copy the parameter words. */
1552 for (int i = 0; i < cbWords; ++i)
1553 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1554
1555 /* Unmap the old stack. */
1556 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1557 if (rcStrict != VINF_SUCCESS)
1558 {
1559 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1560 return rcStrict;
1561 }
1562 }
1563
1564 /* Push the old SS:rSP. */
1565 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1566 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1567 }
1568 }
1569 else
1570 {
1571 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1572
1573 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1574 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1575 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1576 uPtrRet.pu64[2] = uOldRsp;
1577 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1578 }
1579
1580 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1581 if (rcStrict != VINF_SUCCESS)
1582 {
1583 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1584 return rcStrict;
1585 }
1586
1587 /* Chop the high bits off if 16-bit gate (Intel says so). */
1588 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1589 uNewRip = (uint16_t)uNewRip;
1590
1591 /* Limit / canonical check. */
1592 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1593 if (!IEM_IS_LONG_MODE(pVCpu))
1594 {
1595 if (uNewRip > cbLimit)
1596 {
1597 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1598 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1599 }
1600 u64Base = X86DESC_BASE(&DescCS.Legacy);
1601 }
1602 else
1603 {
1604 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1605 if (!IEM_IS_CANONICAL(uNewRip))
1606 {
1607 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1608 return iemRaiseNotCanonical(pVCpu);
1609 }
1610 u64Base = 0;
1611 }
1612
1613 /*
1614 * Now set the accessed bit before
1615 * writing the return address to the stack and committing the result into
1616 * CS, CSHID and RIP.
1617 */
1618 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1619 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1620 {
1621 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1622 if (rcStrict != VINF_SUCCESS)
1623 return rcStrict;
1624 /** @todo check what VT-x and AMD-V does. */
1625 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1626 }
1627
1628 /* Commit new CS:rIP. */
1629 pCtx->rip = uNewRip;
1630 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1631 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1632 pCtx->cs.ValidSel = pCtx->cs.Sel;
1633 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1634 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1635 pCtx->cs.u32Limit = cbLimit;
1636 pCtx->cs.u64Base = u64Base;
1637 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1638 }
1639 else
1640 {
1641 /* Same privilege. */
1642 /** @todo: This is very similar to regular far calls; merge! */
1643
1644 /* Check stack first - may #SS(0). */
1645 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1646 * 16-bit code cause a two or four byte CS to be pushed? */
1647 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1648 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1649 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1650 &uPtrRet.pv, &uNewRsp);
1651 if (rcStrict != VINF_SUCCESS)
1652 return rcStrict;
1653
1654 /* Chop the high bits off if 16-bit gate (Intel says so). */
1655 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1656 uNewRip = (uint16_t)uNewRip;
1657
1658 /* Limit / canonical check. */
1659 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1660 if (!IEM_IS_LONG_MODE(pVCpu))
1661 {
1662 if (uNewRip > cbLimit)
1663 {
1664 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1665 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1666 }
1667 u64Base = X86DESC_BASE(&DescCS.Legacy);
1668 }
1669 else
1670 {
1671 if (!IEM_IS_CANONICAL(uNewRip))
1672 {
1673 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1674 return iemRaiseNotCanonical(pVCpu);
1675 }
1676 u64Base = 0;
1677 }
1678
1679 /*
1680 * Now set the accessed bit before
1681 * writing the return address to the stack and committing the result into
1682 * CS, CSHID and RIP.
1683 */
1684 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1685 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1686 {
1687 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1688 if (rcStrict != VINF_SUCCESS)
1689 return rcStrict;
1690 /** @todo check what VT-x and AMD-V does. */
1691 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1692 }
1693
1694 /* stack */
1695 if (!IEM_IS_LONG_MODE(pVCpu))
1696 {
1697 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1698 {
1699 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
1700 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1701 }
1702 else
1703 {
1704 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1705 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
1706 uPtrRet.pu16[1] = pCtx->cs.Sel;
1707 }
1708 }
1709 else
1710 {
1711 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1712 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
1713 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1714 }
1715
1716 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1717 if (rcStrict != VINF_SUCCESS)
1718 return rcStrict;
1719
1720 /* commit */
1721 pCtx->rip = uNewRip;
1722 pCtx->cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1723 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
1724 pCtx->cs.ValidSel = pCtx->cs.Sel;
1725 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1726 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1727 pCtx->cs.u32Limit = cbLimit;
1728 pCtx->cs.u64Base = u64Base;
1729 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1730 }
1731 }
1732 pCtx->eflags.Bits.u1RF = 0;
1733
1734 /* Flush the prefetch buffer. */
1735# ifdef IEM_WITH_CODE_TLB
1736 pVCpu->iem.s.pbInstrBuf = NULL;
1737# else
1738 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1739# endif
1740 return VINF_SUCCESS;
1741#endif
1742}
1743
1744
1745/**
1746 * Implements far jumps and calls thru system selectors.
1747 *
1748 * @param uSel The selector.
1749 * @param enmBranch The kind of branching we're performing.
1750 * @param enmEffOpSize The effective operand size.
1751 * @param pDesc The descriptor corresponding to @a uSel.
1752 */
1753IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1754{
1755 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1756 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1757
1758 if (IEM_IS_LONG_MODE(pVCpu))
1759 switch (pDesc->Legacy.Gen.u4Type)
1760 {
1761 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1762 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1763
1764 default:
1765 case AMD64_SEL_TYPE_SYS_LDT:
1766 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1767 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1768 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1769 case AMD64_SEL_TYPE_SYS_INT_GATE:
1770 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1771 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1772 }
1773
1774 switch (pDesc->Legacy.Gen.u4Type)
1775 {
1776 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1777 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1778 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1779
1780 case X86_SEL_TYPE_SYS_TASK_GATE:
1781 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1782
1783 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1784 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1785 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1786
1787 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1788 Log(("branch %04x -> busy 286 TSS\n", uSel));
1789 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1790
1791 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1792 Log(("branch %04x -> busy 386 TSS\n", uSel));
1793 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1794
1795 default:
1796 case X86_SEL_TYPE_SYS_LDT:
1797 case X86_SEL_TYPE_SYS_286_INT_GATE:
1798 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1799 case X86_SEL_TYPE_SYS_386_INT_GATE:
1800 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1801 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1802 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1803 }
1804}
1805
1806
1807/**
1808 * Implements far jumps.
1809 *
1810 * @param uSel The selector.
1811 * @param offSeg The segment offset.
1812 * @param enmEffOpSize The effective operand size.
1813 */
1814IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1815{
1816 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1817 NOREF(cbInstr);
1818 Assert(offSeg <= UINT32_MAX);
1819
1820 /*
1821 * Real mode and V8086 mode are easy. The only snag seems to be that
1822 * CS.limit doesn't change and the limit check is done against the current
1823 * limit.
1824 */
1825 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1826 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1827 {
1828 if (offSeg > pCtx->cs.u32Limit)
1829 {
1830 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1831 return iemRaiseGeneralProtectionFault0(pVCpu);
1832 }
1833
1834 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1835 pCtx->rip = offSeg;
1836 else
1837 pCtx->rip = offSeg & UINT16_MAX;
1838 pCtx->cs.Sel = uSel;
1839 pCtx->cs.ValidSel = uSel;
1840 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1841 pCtx->cs.u64Base = (uint32_t)uSel << 4;
1842 pCtx->eflags.Bits.u1RF = 0;
1843 return VINF_SUCCESS;
1844 }
1845
1846 /*
1847 * Protected mode. Need to parse the specified descriptor...
1848 */
1849 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1850 {
1851 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1852 return iemRaiseGeneralProtectionFault0(pVCpu);
1853 }
1854
1855 /* Fetch the descriptor. */
1856 IEMSELDESC Desc;
1857 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1858 if (rcStrict != VINF_SUCCESS)
1859 return rcStrict;
1860
1861 /* Is it there? */
1862 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1863 {
1864 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1865 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1866 }
1867
1868 /*
1869 * Deal with it according to its type. We do the standard code selectors
1870 * here and dispatch the system selectors to worker functions.
1871 */
1872 if (!Desc.Legacy.Gen.u1DescType)
1873 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1874
1875 /* Only code segments. */
1876 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1877 {
1878 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1879 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1880 }
1881
1882 /* L vs D. */
1883 if ( Desc.Legacy.Gen.u1Long
1884 && Desc.Legacy.Gen.u1DefBig
1885 && IEM_IS_LONG_MODE(pVCpu))
1886 {
1887 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1888 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1889 }
1890
1891 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1892 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1893 {
1894 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1895 {
1896 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1897 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1898 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1899 }
1900 }
1901 else
1902 {
1903 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1904 {
1905 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1906 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1907 }
1908 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1909 {
1910 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1911 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1912 }
1913 }
1914
1915 /* Chop the high bits if 16-bit (Intel says so). */
1916 if (enmEffOpSize == IEMMODE_16BIT)
1917 offSeg &= UINT16_MAX;
1918
1919 /* Limit check. (Should alternatively check for non-canonical addresses
1920 here, but that is ruled out by offSeg being 32-bit, right?) */
1921 uint64_t u64Base;
1922 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1923 if (Desc.Legacy.Gen.u1Long)
1924 u64Base = 0;
1925 else
1926 {
1927 if (offSeg > cbLimit)
1928 {
1929 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1930 /** @todo: Intel says this is #GP(0)! */
1931 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1932 }
1933 u64Base = X86DESC_BASE(&Desc.Legacy);
1934 }
1935
1936 /*
1937 * Ok, everything checked out fine. Now set the accessed bit before
1938 * committing the result into CS, CSHID and RIP.
1939 */
1940 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1941 {
1942 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1943 if (rcStrict != VINF_SUCCESS)
1944 return rcStrict;
1945 /** @todo check what VT-x and AMD-V does. */
1946 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1947 }
1948
1949 /* commit */
1950 pCtx->rip = offSeg;
1951 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1952 pCtx->cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1953 pCtx->cs.ValidSel = pCtx->cs.Sel;
1954 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
1955 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1956 pCtx->cs.u32Limit = cbLimit;
1957 pCtx->cs.u64Base = u64Base;
1958 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
1959 pCtx->eflags.Bits.u1RF = 0;
1960 /** @todo check if the hidden bits are loaded correctly for 64-bit
1961 * mode. */
1962
1963 /* Flush the prefetch buffer. */
1964#ifdef IEM_WITH_CODE_TLB
1965 pVCpu->iem.s.pbInstrBuf = NULL;
1966#else
1967 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1968#endif
1969
1970 return VINF_SUCCESS;
1971}
1972
1973
1974/**
1975 * Implements far calls.
1976 *
1977 * This very similar to iemCImpl_FarJmp.
1978 *
1979 * @param uSel The selector.
1980 * @param offSeg The segment offset.
1981 * @param enmEffOpSize The operand size (in case we need it).
1982 */
1983IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1984{
1985 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
1986 VBOXSTRICTRC rcStrict;
1987 uint64_t uNewRsp;
1988 RTPTRUNION uPtrRet;
1989
1990 /*
1991 * Real mode and V8086 mode are easy. The only snag seems to be that
1992 * CS.limit doesn't change and the limit check is done against the current
1993 * limit.
1994 */
1995 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
1996 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
1997 {
1998 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1999
2000 /* Check stack first - may #SS(0). */
2001 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
2002 &uPtrRet.pv, &uNewRsp);
2003 if (rcStrict != VINF_SUCCESS)
2004 return rcStrict;
2005
2006 /* Check the target address range. */
2007 if (offSeg > UINT32_MAX)
2008 return iemRaiseGeneralProtectionFault0(pVCpu);
2009
2010 /* Everything is fine, push the return address. */
2011 if (enmEffOpSize == IEMMODE_16BIT)
2012 {
2013 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2014 uPtrRet.pu16[1] = pCtx->cs.Sel;
2015 }
2016 else
2017 {
2018 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2019 uPtrRet.pu16[3] = pCtx->cs.Sel;
2020 }
2021 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2022 if (rcStrict != VINF_SUCCESS)
2023 return rcStrict;
2024
2025 /* Branch. */
2026 pCtx->rip = offSeg;
2027 pCtx->cs.Sel = uSel;
2028 pCtx->cs.ValidSel = uSel;
2029 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2030 pCtx->cs.u64Base = (uint32_t)uSel << 4;
2031 pCtx->eflags.Bits.u1RF = 0;
2032 return VINF_SUCCESS;
2033 }
2034
2035 /*
2036 * Protected mode. Need to parse the specified descriptor...
2037 */
2038 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2039 {
2040 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2041 return iemRaiseGeneralProtectionFault0(pVCpu);
2042 }
2043
2044 /* Fetch the descriptor. */
2045 IEMSELDESC Desc;
2046 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2047 if (rcStrict != VINF_SUCCESS)
2048 return rcStrict;
2049
2050 /*
2051 * Deal with it according to its type. We do the standard code selectors
2052 * here and dispatch the system selectors to worker functions.
2053 */
2054 if (!Desc.Legacy.Gen.u1DescType)
2055 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2056
2057 /* Only code segments. */
2058 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2059 {
2060 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2061 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2062 }
2063
2064 /* L vs D. */
2065 if ( Desc.Legacy.Gen.u1Long
2066 && Desc.Legacy.Gen.u1DefBig
2067 && IEM_IS_LONG_MODE(pVCpu))
2068 {
2069 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2070 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2071 }
2072
2073 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2074 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2075 {
2076 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2077 {
2078 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2079 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2080 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2081 }
2082 }
2083 else
2084 {
2085 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2086 {
2087 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2088 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2089 }
2090 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2091 {
2092 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2093 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2094 }
2095 }
2096
2097 /* Is it there? */
2098 if (!Desc.Legacy.Gen.u1Present)
2099 {
2100 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2101 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2102 }
2103
2104 /* Check stack first - may #SS(0). */
2105 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2106 * 16-bit code cause a two or four byte CS to be pushed? */
2107 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2108 enmEffOpSize == IEMMODE_64BIT ? 8+8
2109 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2110 &uPtrRet.pv, &uNewRsp);
2111 if (rcStrict != VINF_SUCCESS)
2112 return rcStrict;
2113
2114 /* Chop the high bits if 16-bit (Intel says so). */
2115 if (enmEffOpSize == IEMMODE_16BIT)
2116 offSeg &= UINT16_MAX;
2117
2118 /* Limit / canonical check. */
2119 uint64_t u64Base;
2120 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2121 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2122 {
2123 if (!IEM_IS_CANONICAL(offSeg))
2124 {
2125 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2126 return iemRaiseNotCanonical(pVCpu);
2127 }
2128 u64Base = 0;
2129 }
2130 else
2131 {
2132 if (offSeg > cbLimit)
2133 {
2134 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2135 /** @todo: Intel says this is #GP(0)! */
2136 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2137 }
2138 u64Base = X86DESC_BASE(&Desc.Legacy);
2139 }
2140
2141 /*
2142 * Now set the accessed bit before
2143 * writing the return address to the stack and committing the result into
2144 * CS, CSHID and RIP.
2145 */
2146 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2147 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2148 {
2149 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2150 if (rcStrict != VINF_SUCCESS)
2151 return rcStrict;
2152 /** @todo check what VT-x and AMD-V does. */
2153 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2154 }
2155
2156 /* stack */
2157 if (enmEffOpSize == IEMMODE_16BIT)
2158 {
2159 uPtrRet.pu16[0] = pCtx->ip + cbInstr;
2160 uPtrRet.pu16[1] = pCtx->cs.Sel;
2161 }
2162 else if (enmEffOpSize == IEMMODE_32BIT)
2163 {
2164 uPtrRet.pu32[0] = pCtx->eip + cbInstr;
2165 uPtrRet.pu32[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2166 }
2167 else
2168 {
2169 uPtrRet.pu64[0] = pCtx->rip + cbInstr;
2170 uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2171 }
2172 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2173 if (rcStrict != VINF_SUCCESS)
2174 return rcStrict;
2175
2176 /* commit */
2177 pCtx->rip = offSeg;
2178 pCtx->cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2179 pCtx->cs.Sel |= pVCpu->iem.s.uCpl;
2180 pCtx->cs.ValidSel = pCtx->cs.Sel;
2181 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2182 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2183 pCtx->cs.u32Limit = cbLimit;
2184 pCtx->cs.u64Base = u64Base;
2185 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2186 pCtx->eflags.Bits.u1RF = 0;
2187 /** @todo check if the hidden bits are loaded correctly for 64-bit
2188 * mode. */
2189
2190 /* Flush the prefetch buffer. */
2191#ifdef IEM_WITH_CODE_TLB
2192 pVCpu->iem.s.pbInstrBuf = NULL;
2193#else
2194 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2195#endif
2196 return VINF_SUCCESS;
2197}
2198
2199
2200/**
2201 * Implements retf.
2202 *
2203 * @param enmEffOpSize The effective operand size.
2204 * @param cbPop The amount of arguments to pop from the stack
2205 * (bytes).
2206 */
2207IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2208{
2209 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2210 VBOXSTRICTRC rcStrict;
2211 RTCPTRUNION uPtrFrame;
2212 uint64_t uNewRsp;
2213 uint64_t uNewRip;
2214 uint16_t uNewCs;
2215 NOREF(cbInstr);
2216
2217 /*
2218 * Read the stack values first.
2219 */
2220 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2221 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2222 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2223 if (rcStrict != VINF_SUCCESS)
2224 return rcStrict;
2225 if (enmEffOpSize == IEMMODE_16BIT)
2226 {
2227 uNewRip = uPtrFrame.pu16[0];
2228 uNewCs = uPtrFrame.pu16[1];
2229 }
2230 else if (enmEffOpSize == IEMMODE_32BIT)
2231 {
2232 uNewRip = uPtrFrame.pu32[0];
2233 uNewCs = uPtrFrame.pu16[2];
2234 }
2235 else
2236 {
2237 uNewRip = uPtrFrame.pu64[0];
2238 uNewCs = uPtrFrame.pu16[4];
2239 }
2240 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2241 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2242 { /* extremely likely */ }
2243 else
2244 return rcStrict;
2245
2246 /*
2247 * Real mode and V8086 mode are easy.
2248 */
2249 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
2250 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
2251 {
2252 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2253 /** @todo check how this is supposed to work if sp=0xfffe. */
2254
2255 /* Check the limit of the new EIP. */
2256 /** @todo Intel pseudo code only does the limit check for 16-bit
2257 * operands, AMD does not make any distinction. What is right? */
2258 if (uNewRip > pCtx->cs.u32Limit)
2259 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2260
2261 /* commit the operation. */
2262 pCtx->rsp = uNewRsp;
2263 pCtx->rip = uNewRip;
2264 pCtx->cs.Sel = uNewCs;
2265 pCtx->cs.ValidSel = uNewCs;
2266 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2267 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
2268 pCtx->eflags.Bits.u1RF = 0;
2269 /** @todo do we load attribs and limit as well? */
2270 if (cbPop)
2271 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2272 return VINF_SUCCESS;
2273 }
2274
2275 /*
2276 * Protected mode is complicated, of course.
2277 */
2278 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2279 {
2280 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2281 return iemRaiseGeneralProtectionFault0(pVCpu);
2282 }
2283
2284 /* Fetch the descriptor. */
2285 IEMSELDESC DescCs;
2286 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2287 if (rcStrict != VINF_SUCCESS)
2288 return rcStrict;
2289
2290 /* Can only return to a code selector. */
2291 if ( !DescCs.Legacy.Gen.u1DescType
2292 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2293 {
2294 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2295 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2296 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2297 }
2298
2299 /* L vs D. */
2300 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2301 && DescCs.Legacy.Gen.u1DefBig
2302 && IEM_IS_LONG_MODE(pVCpu))
2303 {
2304 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2305 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2306 }
2307
2308 /* DPL/RPL/CPL checks. */
2309 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2310 {
2311 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2312 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2313 }
2314
2315 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2316 {
2317 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2318 {
2319 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2320 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2321 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2322 }
2323 }
2324 else
2325 {
2326 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2327 {
2328 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2329 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2330 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2331 }
2332 }
2333
2334 /* Is it there? */
2335 if (!DescCs.Legacy.Gen.u1Present)
2336 {
2337 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2338 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2339 }
2340
2341 /*
2342 * Return to outer privilege? (We'll typically have entered via a call gate.)
2343 */
2344 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2345 {
2346 /* Read the outer stack pointer stored *after* the parameters. */
2347 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2348 if (rcStrict != VINF_SUCCESS)
2349 return rcStrict;
2350
2351 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2352
2353 uint16_t uNewOuterSs;
2354 uint64_t uNewOuterRsp;
2355 if (enmEffOpSize == IEMMODE_16BIT)
2356 {
2357 uNewOuterRsp = uPtrFrame.pu16[0];
2358 uNewOuterSs = uPtrFrame.pu16[1];
2359 }
2360 else if (enmEffOpSize == IEMMODE_32BIT)
2361 {
2362 uNewOuterRsp = uPtrFrame.pu32[0];
2363 uNewOuterSs = uPtrFrame.pu16[2];
2364 }
2365 else
2366 {
2367 uNewOuterRsp = uPtrFrame.pu64[0];
2368 uNewOuterSs = uPtrFrame.pu16[4];
2369 }
2370 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2371 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2372 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2373 { /* extremely likely */ }
2374 else
2375 return rcStrict;
2376
2377 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2378 and read the selector. */
2379 IEMSELDESC DescSs;
2380 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2381 {
2382 if ( !DescCs.Legacy.Gen.u1Long
2383 || (uNewOuterSs & X86_SEL_RPL) == 3)
2384 {
2385 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2386 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2387 return iemRaiseGeneralProtectionFault0(pVCpu);
2388 }
2389 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2390 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2391 }
2392 else
2393 {
2394 /* Fetch the descriptor for the new stack segment. */
2395 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2396 if (rcStrict != VINF_SUCCESS)
2397 return rcStrict;
2398 }
2399
2400 /* Check that RPL of stack and code selectors match. */
2401 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2402 {
2403 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2404 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2405 }
2406
2407 /* Must be a writable data segment. */
2408 if ( !DescSs.Legacy.Gen.u1DescType
2409 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2410 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2411 {
2412 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2413 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2414 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2415 }
2416
2417 /* L vs D. (Not mentioned by intel.) */
2418 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2419 && DescSs.Legacy.Gen.u1DefBig
2420 && IEM_IS_LONG_MODE(pVCpu))
2421 {
2422 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2423 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2424 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2425 }
2426
2427 /* DPL/RPL/CPL checks. */
2428 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2429 {
2430 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2431 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2432 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2433 }
2434
2435 /* Is it there? */
2436 if (!DescSs.Legacy.Gen.u1Present)
2437 {
2438 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2439 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2440 }
2441
2442 /* Calc SS limit.*/
2443 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2444
2445 /* Is RIP canonical or within CS.limit? */
2446 uint64_t u64Base;
2447 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2448
2449 /** @todo Testcase: Is this correct? */
2450 if ( DescCs.Legacy.Gen.u1Long
2451 && IEM_IS_LONG_MODE(pVCpu) )
2452 {
2453 if (!IEM_IS_CANONICAL(uNewRip))
2454 {
2455 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2456 return iemRaiseNotCanonical(pVCpu);
2457 }
2458 u64Base = 0;
2459 }
2460 else
2461 {
2462 if (uNewRip > cbLimitCs)
2463 {
2464 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2465 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2466 /** @todo: Intel says this is #GP(0)! */
2467 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2468 }
2469 u64Base = X86DESC_BASE(&DescCs.Legacy);
2470 }
2471
2472 /*
2473 * Now set the accessed bit before
2474 * writing the return address to the stack and committing the result into
2475 * CS, CSHID and RIP.
2476 */
2477 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2478 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2479 {
2480 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2481 if (rcStrict != VINF_SUCCESS)
2482 return rcStrict;
2483 /** @todo check what VT-x and AMD-V does. */
2484 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2485 }
2486 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2487 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2488 {
2489 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2490 if (rcStrict != VINF_SUCCESS)
2491 return rcStrict;
2492 /** @todo check what VT-x and AMD-V does. */
2493 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2494 }
2495
2496 /* commit */
2497 if (enmEffOpSize == IEMMODE_16BIT)
2498 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2499 else
2500 pCtx->rip = uNewRip;
2501 pCtx->cs.Sel = uNewCs;
2502 pCtx->cs.ValidSel = uNewCs;
2503 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2504 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2505 pCtx->cs.u32Limit = cbLimitCs;
2506 pCtx->cs.u64Base = u64Base;
2507 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2508 pCtx->ss.Sel = uNewOuterSs;
2509 pCtx->ss.ValidSel = uNewOuterSs;
2510 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
2511 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2512 pCtx->ss.u32Limit = cbLimitSs;
2513 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2514 pCtx->ss.u64Base = 0;
2515 else
2516 pCtx->ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2517 if (!pCtx->ss.Attr.n.u1DefBig)
2518 pCtx->sp = (uint16_t)uNewOuterRsp;
2519 else
2520 pCtx->rsp = uNewOuterRsp;
2521
2522 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2523 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
2524 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
2525 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
2526 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
2527
2528 /** @todo check if the hidden bits are loaded correctly for 64-bit
2529 * mode. */
2530
2531 if (cbPop)
2532 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2533 pCtx->eflags.Bits.u1RF = 0;
2534
2535 /* Done! */
2536 }
2537 /*
2538 * Return to the same privilege level
2539 */
2540 else
2541 {
2542 /* Limit / canonical check. */
2543 uint64_t u64Base;
2544 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2545
2546 /** @todo Testcase: Is this correct? */
2547 if ( DescCs.Legacy.Gen.u1Long
2548 && IEM_IS_LONG_MODE(pVCpu) )
2549 {
2550 if (!IEM_IS_CANONICAL(uNewRip))
2551 {
2552 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2553 return iemRaiseNotCanonical(pVCpu);
2554 }
2555 u64Base = 0;
2556 }
2557 else
2558 {
2559 if (uNewRip > cbLimitCs)
2560 {
2561 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2562 /** @todo: Intel says this is #GP(0)! */
2563 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2564 }
2565 u64Base = X86DESC_BASE(&DescCs.Legacy);
2566 }
2567
2568 /*
2569 * Now set the accessed bit before
2570 * writing the return address to the stack and committing the result into
2571 * CS, CSHID and RIP.
2572 */
2573 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2574 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2575 {
2576 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2577 if (rcStrict != VINF_SUCCESS)
2578 return rcStrict;
2579 /** @todo check what VT-x and AMD-V does. */
2580 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2581 }
2582
2583 /* commit */
2584 if (!pCtx->ss.Attr.n.u1DefBig)
2585 pCtx->sp = (uint16_t)uNewRsp;
2586 else
2587 pCtx->rsp = uNewRsp;
2588 if (enmEffOpSize == IEMMODE_16BIT)
2589 pCtx->rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2590 else
2591 pCtx->rip = uNewRip;
2592 pCtx->cs.Sel = uNewCs;
2593 pCtx->cs.ValidSel = uNewCs;
2594 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
2595 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2596 pCtx->cs.u32Limit = cbLimitCs;
2597 pCtx->cs.u64Base = u64Base;
2598 /** @todo check if the hidden bits are loaded correctly for 64-bit
2599 * mode. */
2600 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
2601 if (cbPop)
2602 iemRegAddToRsp(pVCpu, pCtx, cbPop);
2603 pCtx->eflags.Bits.u1RF = 0;
2604 }
2605
2606 /* Flush the prefetch buffer. */
2607#ifdef IEM_WITH_CODE_TLB
2608 pVCpu->iem.s.pbInstrBuf = NULL;
2609#else
2610 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2611#endif
2612 return VINF_SUCCESS;
2613}
2614
2615
2616/**
2617 * Implements retn.
2618 *
2619 * We're doing this in C because of the \#GP that might be raised if the popped
2620 * program counter is out of bounds.
2621 *
2622 * @param enmEffOpSize The effective operand size.
2623 * @param cbPop The amount of arguments to pop from the stack
2624 * (bytes).
2625 */
2626IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2627{
2628 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2629 NOREF(cbInstr);
2630
2631 /* Fetch the RSP from the stack. */
2632 VBOXSTRICTRC rcStrict;
2633 RTUINT64U NewRip;
2634 RTUINT64U NewRsp;
2635 NewRsp.u = pCtx->rsp;
2636
2637 switch (enmEffOpSize)
2638 {
2639 case IEMMODE_16BIT:
2640 NewRip.u = 0;
2641 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2642 break;
2643 case IEMMODE_32BIT:
2644 NewRip.u = 0;
2645 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2646 break;
2647 case IEMMODE_64BIT:
2648 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2649 break;
2650 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2651 }
2652 if (rcStrict != VINF_SUCCESS)
2653 return rcStrict;
2654
2655 /* Check the new RSP before loading it. */
2656 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2657 * of it. The canonical test is performed here and for call. */
2658 if (enmEffOpSize != IEMMODE_64BIT)
2659 {
2660 if (NewRip.DWords.dw0 > pCtx->cs.u32Limit)
2661 {
2662 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
2663 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2664 }
2665 }
2666 else
2667 {
2668 if (!IEM_IS_CANONICAL(NewRip.u))
2669 {
2670 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2671 return iemRaiseNotCanonical(pVCpu);
2672 }
2673 }
2674
2675 /* Apply cbPop */
2676 if (cbPop)
2677 iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
2678
2679 /* Commit it. */
2680 pCtx->rip = NewRip.u;
2681 pCtx->rsp = NewRsp.u;
2682 pCtx->eflags.Bits.u1RF = 0;
2683
2684 /* Flush the prefetch buffer. */
2685#ifndef IEM_WITH_CODE_TLB
2686 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2687#endif
2688
2689 return VINF_SUCCESS;
2690}
2691
2692
2693/**
2694 * Implements enter.
2695 *
2696 * We're doing this in C because the instruction is insane, even for the
2697 * u8NestingLevel=0 case dealing with the stack is tedious.
2698 *
2699 * @param enmEffOpSize The effective operand size.
2700 */
2701IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2702{
2703 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2704
2705 /* Push RBP, saving the old value in TmpRbp. */
2706 RTUINT64U NewRsp; NewRsp.u = pCtx->rsp;
2707 RTUINT64U TmpRbp; TmpRbp.u = pCtx->rbp;
2708 RTUINT64U NewRbp;
2709 VBOXSTRICTRC rcStrict;
2710 if (enmEffOpSize == IEMMODE_64BIT)
2711 {
2712 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2713 NewRbp = NewRsp;
2714 }
2715 else if (enmEffOpSize == IEMMODE_32BIT)
2716 {
2717 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2718 NewRbp = NewRsp;
2719 }
2720 else
2721 {
2722 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2723 NewRbp = TmpRbp;
2724 NewRbp.Words.w0 = NewRsp.Words.w0;
2725 }
2726 if (rcStrict != VINF_SUCCESS)
2727 return rcStrict;
2728
2729 /* Copy the parameters (aka nesting levels by Intel). */
2730 cParameters &= 0x1f;
2731 if (cParameters > 0)
2732 {
2733 switch (enmEffOpSize)
2734 {
2735 case IEMMODE_16BIT:
2736 if (pCtx->ss.Attr.n.u1DefBig)
2737 TmpRbp.DWords.dw0 -= 2;
2738 else
2739 TmpRbp.Words.w0 -= 2;
2740 do
2741 {
2742 uint16_t u16Tmp;
2743 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2744 if (rcStrict != VINF_SUCCESS)
2745 break;
2746 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2747 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2748 break;
2749
2750 case IEMMODE_32BIT:
2751 if (pCtx->ss.Attr.n.u1DefBig)
2752 TmpRbp.DWords.dw0 -= 4;
2753 else
2754 TmpRbp.Words.w0 -= 4;
2755 do
2756 {
2757 uint32_t u32Tmp;
2758 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2759 if (rcStrict != VINF_SUCCESS)
2760 break;
2761 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2762 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2763 break;
2764
2765 case IEMMODE_64BIT:
2766 TmpRbp.u -= 8;
2767 do
2768 {
2769 uint64_t u64Tmp;
2770 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2771 if (rcStrict != VINF_SUCCESS)
2772 break;
2773 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2774 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2775 break;
2776
2777 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2778 }
2779 if (rcStrict != VINF_SUCCESS)
2780 return VINF_SUCCESS;
2781
2782 /* Push the new RBP */
2783 if (enmEffOpSize == IEMMODE_64BIT)
2784 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2785 else if (enmEffOpSize == IEMMODE_32BIT)
2786 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2787 else
2788 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2789 if (rcStrict != VINF_SUCCESS)
2790 return rcStrict;
2791
2792 }
2793
2794 /* Recalc RSP. */
2795 iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
2796
2797 /** @todo Should probe write access at the new RSP according to AMD. */
2798
2799 /* Commit it. */
2800 pCtx->rbp = NewRbp.u;
2801 pCtx->rsp = NewRsp.u;
2802 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2803
2804 return VINF_SUCCESS;
2805}
2806
2807
2808
2809/**
2810 * Implements leave.
2811 *
2812 * We're doing this in C because messing with the stack registers is annoying
2813 * since they depends on SS attributes.
2814 *
2815 * @param enmEffOpSize The effective operand size.
2816 */
2817IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2818{
2819 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2820
2821 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2822 RTUINT64U NewRsp;
2823 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2824 NewRsp.u = pCtx->rbp;
2825 else if (pCtx->ss.Attr.n.u1DefBig)
2826 NewRsp.u = pCtx->ebp;
2827 else
2828 {
2829 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2830 NewRsp.u = pCtx->rsp;
2831 NewRsp.Words.w0 = pCtx->bp;
2832 }
2833
2834 /* Pop RBP according to the operand size. */
2835 VBOXSTRICTRC rcStrict;
2836 RTUINT64U NewRbp;
2837 switch (enmEffOpSize)
2838 {
2839 case IEMMODE_16BIT:
2840 NewRbp.u = pCtx->rbp;
2841 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2842 break;
2843 case IEMMODE_32BIT:
2844 NewRbp.u = 0;
2845 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2846 break;
2847 case IEMMODE_64BIT:
2848 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2849 break;
2850 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2851 }
2852 if (rcStrict != VINF_SUCCESS)
2853 return rcStrict;
2854
2855
2856 /* Commit it. */
2857 pCtx->rbp = NewRbp.u;
2858 pCtx->rsp = NewRsp.u;
2859 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2860
2861 return VINF_SUCCESS;
2862}
2863
2864
2865/**
2866 * Implements int3 and int XX.
2867 *
2868 * @param u8Int The interrupt vector number.
2869 * @param enmInt The int instruction type.
2870 */
2871IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2872{
2873 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2874 return iemRaiseXcptOrInt(pVCpu,
2875 cbInstr,
2876 u8Int,
2877 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2878 0,
2879 0);
2880}
2881
2882
2883/**
2884 * Implements iret for real mode and V8086 mode.
2885 *
2886 * @param enmEffOpSize The effective operand size.
2887 */
2888IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2889{
2890 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
2891 X86EFLAGS Efl;
2892 Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
2893 NOREF(cbInstr);
2894
2895 /*
2896 * iret throws an exception if VME isn't enabled.
2897 */
2898 if ( Efl.Bits.u1VM
2899 && Efl.Bits.u2IOPL != 3
2900 && !(pCtx->cr4 & X86_CR4_VME))
2901 return iemRaiseGeneralProtectionFault0(pVCpu);
2902
2903 /*
2904 * Do the stack bits, but don't commit RSP before everything checks
2905 * out right.
2906 */
2907 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2908 VBOXSTRICTRC rcStrict;
2909 RTCPTRUNION uFrame;
2910 uint16_t uNewCs;
2911 uint32_t uNewEip;
2912 uint32_t uNewFlags;
2913 uint64_t uNewRsp;
2914 if (enmEffOpSize == IEMMODE_32BIT)
2915 {
2916 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2917 if (rcStrict != VINF_SUCCESS)
2918 return rcStrict;
2919 uNewEip = uFrame.pu32[0];
2920 if (uNewEip > UINT16_MAX)
2921 return iemRaiseGeneralProtectionFault0(pVCpu);
2922
2923 uNewCs = (uint16_t)uFrame.pu32[1];
2924 uNewFlags = uFrame.pu32[2];
2925 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2926 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2927 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2928 | X86_EFL_ID;
2929 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2930 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2931 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2932 }
2933 else
2934 {
2935 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2936 if (rcStrict != VINF_SUCCESS)
2937 return rcStrict;
2938 uNewEip = uFrame.pu16[0];
2939 uNewCs = uFrame.pu16[1];
2940 uNewFlags = uFrame.pu16[2];
2941 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2942 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2943 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2944 /** @todo The intel pseudo code does not indicate what happens to
2945 * reserved flags. We just ignore them. */
2946 /* Ancient CPU adjustments: See iemCImpl_popf. */
2947 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2948 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2949 }
2950 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2951 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2952 { /* extremely likely */ }
2953 else
2954 return rcStrict;
2955
2956 /** @todo Check how this is supposed to work if sp=0xfffe. */
2957 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2958 uNewCs, uNewEip, uNewFlags, uNewRsp));
2959
2960 /*
2961 * Check the limit of the new EIP.
2962 */
2963 /** @todo Only the AMD pseudo code check the limit here, what's
2964 * right? */
2965 if (uNewEip > pCtx->cs.u32Limit)
2966 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2967
2968 /*
2969 * V8086 checks and flag adjustments
2970 */
2971 if (Efl.Bits.u1VM)
2972 {
2973 if (Efl.Bits.u2IOPL == 3)
2974 {
2975 /* Preserve IOPL and clear RF. */
2976 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2977 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2978 }
2979 else if ( enmEffOpSize == IEMMODE_16BIT
2980 && ( !(uNewFlags & X86_EFL_IF)
2981 || !Efl.Bits.u1VIP )
2982 && !(uNewFlags & X86_EFL_TF) )
2983 {
2984 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2985 uNewFlags &= ~X86_EFL_VIF;
2986 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2987 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2988 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2989 }
2990 else
2991 return iemRaiseGeneralProtectionFault0(pVCpu);
2992 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2993 }
2994
2995 /*
2996 * Commit the operation.
2997 */
2998#ifdef DBGFTRACE_ENABLED
2999 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
3000 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
3001#endif
3002 pCtx->rsp = uNewRsp;
3003 pCtx->rip = uNewEip;
3004 pCtx->cs.Sel = uNewCs;
3005 pCtx->cs.ValidSel = uNewCs;
3006 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3007 pCtx->cs.u64Base = (uint32_t)uNewCs << 4;
3008 /** @todo do we load attribs and limit as well? */
3009 Assert(uNewFlags & X86_EFL_1);
3010 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3011
3012 /* Flush the prefetch buffer. */
3013#ifdef IEM_WITH_CODE_TLB
3014 pVCpu->iem.s.pbInstrBuf = NULL;
3015#else
3016 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3017#endif
3018
3019 return VINF_SUCCESS;
3020}
3021
3022
3023/**
3024 * Loads a segment register when entering V8086 mode.
3025 *
3026 * @param pSReg The segment register.
3027 * @param uSeg The segment to load.
3028 */
3029static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3030{
3031 pSReg->Sel = uSeg;
3032 pSReg->ValidSel = uSeg;
3033 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3034 pSReg->u64Base = (uint32_t)uSeg << 4;
3035 pSReg->u32Limit = 0xffff;
3036 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3037 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3038 * IRET'ing to V8086. */
3039}
3040
3041
3042/**
3043 * Implements iret for protected mode returning to V8086 mode.
3044 *
3045 * @param pCtx Pointer to the CPU context.
3046 * @param uNewEip The new EIP.
3047 * @param uNewCs The new CS.
3048 * @param uNewFlags The new EFLAGS.
3049 * @param uNewRsp The RSP after the initial IRET frame.
3050 *
3051 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3052 */
3053IEM_CIMPL_DEF_5(iemCImpl_iret_prot_v8086, PCPUMCTX, pCtx, uint32_t, uNewEip, uint16_t, uNewCs,
3054 uint32_t, uNewFlags, uint64_t, uNewRsp)
3055{
3056 RT_NOREF_PV(cbInstr);
3057
3058 /*
3059 * Pop the V8086 specific frame bits off the stack.
3060 */
3061 VBOXSTRICTRC rcStrict;
3062 RTCPTRUNION uFrame;
3063 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3064 if (rcStrict != VINF_SUCCESS)
3065 return rcStrict;
3066 uint32_t uNewEsp = uFrame.pu32[0];
3067 uint16_t uNewSs = uFrame.pu32[1];
3068 uint16_t uNewEs = uFrame.pu32[2];
3069 uint16_t uNewDs = uFrame.pu32[3];
3070 uint16_t uNewFs = uFrame.pu32[4];
3071 uint16_t uNewGs = uFrame.pu32[5];
3072 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3073 if (rcStrict != VINF_SUCCESS)
3074 return rcStrict;
3075
3076 /*
3077 * Commit the operation.
3078 */
3079 uNewFlags &= X86_EFL_LIVE_MASK;
3080 uNewFlags |= X86_EFL_RA1_MASK;
3081#ifdef DBGFTRACE_ENABLED
3082 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3083 pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3084#endif
3085 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3086
3087 IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
3088 iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
3089 iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
3090 iemCImplCommonV8086LoadSeg(&pCtx->es, uNewEs);
3091 iemCImplCommonV8086LoadSeg(&pCtx->ds, uNewDs);
3092 iemCImplCommonV8086LoadSeg(&pCtx->fs, uNewFs);
3093 iemCImplCommonV8086LoadSeg(&pCtx->gs, uNewGs);
3094 pCtx->rip = (uint16_t)uNewEip;
3095 pCtx->rsp = uNewEsp; /** @todo check this out! */
3096 pVCpu->iem.s.uCpl = 3;
3097
3098 /* Flush the prefetch buffer. */
3099#ifdef IEM_WITH_CODE_TLB
3100 pVCpu->iem.s.pbInstrBuf = NULL;
3101#else
3102 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3103#endif
3104
3105 return VINF_SUCCESS;
3106}
3107
3108
3109/**
3110 * Implements iret for protected mode returning via a nested task.
3111 *
3112 * @param enmEffOpSize The effective operand size.
3113 */
3114IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3115{
3116 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3117#ifndef IEM_IMPLEMENTS_TASKSWITCH
3118 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3119#else
3120 RT_NOREF_PV(enmEffOpSize);
3121
3122 /*
3123 * Read the segment selector in the link-field of the current TSS.
3124 */
3125 RTSEL uSelRet;
3126 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3127 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
3128 if (rcStrict != VINF_SUCCESS)
3129 return rcStrict;
3130
3131 /*
3132 * Fetch the returning task's TSS descriptor from the GDT.
3133 */
3134 if (uSelRet & X86_SEL_LDT)
3135 {
3136 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3137 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3138 }
3139
3140 IEMSELDESC TssDesc;
3141 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3142 if (rcStrict != VINF_SUCCESS)
3143 return rcStrict;
3144
3145 if (TssDesc.Legacy.Gate.u1DescType)
3146 {
3147 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3148 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3149 }
3150
3151 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3152 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3153 {
3154 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3155 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3156 }
3157
3158 if (!TssDesc.Legacy.Gate.u1Present)
3159 {
3160 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3161 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3162 }
3163
3164 uint32_t uNextEip = pCtx->eip + cbInstr;
3165 return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3166 0 /* uCr2 */, uSelRet, &TssDesc);
3167#endif
3168}
3169
3170
3171/**
3172 * Implements iret for protected mode
3173 *
3174 * @param enmEffOpSize The effective operand size.
3175 */
3176IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3177{
3178 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3179 NOREF(cbInstr);
3180 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3181
3182 /*
3183 * Nested task return.
3184 */
3185 if (pCtx->eflags.Bits.u1NT)
3186 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3187
3188 /*
3189 * Normal return.
3190 *
3191 * Do the stack bits, but don't commit RSP before everything checks
3192 * out right.
3193 */
3194 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3195 VBOXSTRICTRC rcStrict;
3196 RTCPTRUNION uFrame;
3197 uint16_t uNewCs;
3198 uint32_t uNewEip;
3199 uint32_t uNewFlags;
3200 uint64_t uNewRsp;
3201 if (enmEffOpSize == IEMMODE_32BIT)
3202 {
3203 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3204 if (rcStrict != VINF_SUCCESS)
3205 return rcStrict;
3206 uNewEip = uFrame.pu32[0];
3207 uNewCs = (uint16_t)uFrame.pu32[1];
3208 uNewFlags = uFrame.pu32[2];
3209 }
3210 else
3211 {
3212 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3213 if (rcStrict != VINF_SUCCESS)
3214 return rcStrict;
3215 uNewEip = uFrame.pu16[0];
3216 uNewCs = uFrame.pu16[1];
3217 uNewFlags = uFrame.pu16[2];
3218 }
3219 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3220 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3221 { /* extremely likely */ }
3222 else
3223 return rcStrict;
3224 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3225
3226 /*
3227 * We're hopefully not returning to V8086 mode...
3228 */
3229 if ( (uNewFlags & X86_EFL_VM)
3230 && pVCpu->iem.s.uCpl == 0)
3231 {
3232 Assert(enmEffOpSize == IEMMODE_32BIT);
3233 return IEM_CIMPL_CALL_5(iemCImpl_iret_prot_v8086, pCtx, uNewEip, uNewCs, uNewFlags, uNewRsp);
3234 }
3235
3236 /*
3237 * Protected mode.
3238 */
3239 /* Read the CS descriptor. */
3240 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3241 {
3242 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3243 return iemRaiseGeneralProtectionFault0(pVCpu);
3244 }
3245
3246 IEMSELDESC DescCS;
3247 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3248 if (rcStrict != VINF_SUCCESS)
3249 {
3250 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3251 return rcStrict;
3252 }
3253
3254 /* Must be a code descriptor. */
3255 if (!DescCS.Legacy.Gen.u1DescType)
3256 {
3257 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3258 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3259 }
3260 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3261 {
3262 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3263 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3264 }
3265
3266#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3267 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3268 PVM pVM = pVCpu->CTX_SUFF(pVM);
3269 if (EMIsRawRing0Enabled(pVM) && VM_IS_RAW_MODE_ENABLED(pVM))
3270 {
3271 if ((uNewCs & X86_SEL_RPL) == 1)
3272 {
3273 if ( pVCpu->iem.s.uCpl == 0
3274 && ( !EMIsRawRing1Enabled(pVM)
3275 || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3276 {
3277 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3278 uNewCs &= X86_SEL_MASK_OFF_RPL;
3279 }
3280# ifdef LOG_ENABLED
3281 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3282 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3283# endif
3284 }
3285 else if ( (uNewCs & X86_SEL_RPL) == 2
3286 && EMIsRawRing1Enabled(pVM)
3287 && pVCpu->iem.s.uCpl <= 1)
3288 {
3289 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3290 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3291 }
3292 }
3293#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3294
3295
3296 /* Privilege checks. */
3297 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3298 {
3299 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3300 {
3301 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3302 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3303 }
3304 }
3305 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3306 {
3307 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3308 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3309 }
3310 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3311 {
3312 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3313 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3314 }
3315
3316 /* Present? */
3317 if (!DescCS.Legacy.Gen.u1Present)
3318 {
3319 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3320 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3321 }
3322
3323 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3324
3325 /*
3326 * Return to outer level?
3327 */
3328 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3329 {
3330 uint16_t uNewSS;
3331 uint32_t uNewESP;
3332 if (enmEffOpSize == IEMMODE_32BIT)
3333 {
3334 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3335 if (rcStrict != VINF_SUCCESS)
3336 return rcStrict;
3337/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3338 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3339 * bit of the popped SS selector it turns out. */
3340 uNewESP = uFrame.pu32[0];
3341 uNewSS = (uint16_t)uFrame.pu32[1];
3342 }
3343 else
3344 {
3345 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3346 if (rcStrict != VINF_SUCCESS)
3347 return rcStrict;
3348 uNewESP = uFrame.pu16[0];
3349 uNewSS = uFrame.pu16[1];
3350 }
3351 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3352 if (rcStrict != VINF_SUCCESS)
3353 return rcStrict;
3354 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3355
3356 /* Read the SS descriptor. */
3357 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3358 {
3359 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3360 return iemRaiseGeneralProtectionFault0(pVCpu);
3361 }
3362
3363 IEMSELDESC DescSS;
3364 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3365 if (rcStrict != VINF_SUCCESS)
3366 {
3367 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3368 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3369 return rcStrict;
3370 }
3371
3372 /* Privilege checks. */
3373 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3374 {
3375 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3376 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3377 }
3378 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3379 {
3380 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3381 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3382 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3383 }
3384
3385 /* Must be a writeable data segment descriptor. */
3386 if (!DescSS.Legacy.Gen.u1DescType)
3387 {
3388 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3389 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3390 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3391 }
3392 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3393 {
3394 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3395 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3396 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3397 }
3398
3399 /* Present? */
3400 if (!DescSS.Legacy.Gen.u1Present)
3401 {
3402 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3403 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3404 }
3405
3406 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3407
3408 /* Check EIP. */
3409 if (uNewEip > cbLimitCS)
3410 {
3411 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3412 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3413 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3414 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3415 }
3416
3417 /*
3418 * Commit the changes, marking CS and SS accessed first since
3419 * that may fail.
3420 */
3421 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3422 {
3423 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3424 if (rcStrict != VINF_SUCCESS)
3425 return rcStrict;
3426 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3427 }
3428 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3429 {
3430 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3431 if (rcStrict != VINF_SUCCESS)
3432 return rcStrict;
3433 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3434 }
3435
3436 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3437 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3438 if (enmEffOpSize != IEMMODE_16BIT)
3439 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3440 if (pVCpu->iem.s.uCpl == 0)
3441 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3442 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3443 fEFlagsMask |= X86_EFL_IF;
3444 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3445 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3446 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3447 fEFlagsNew &= ~fEFlagsMask;
3448 fEFlagsNew |= uNewFlags & fEFlagsMask;
3449#ifdef DBGFTRACE_ENABLED
3450 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3451 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
3452 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3453#endif
3454
3455 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3456 pCtx->rip = uNewEip;
3457 pCtx->cs.Sel = uNewCs;
3458 pCtx->cs.ValidSel = uNewCs;
3459 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3460 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3461 pCtx->cs.u32Limit = cbLimitCS;
3462 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3463 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3464
3465 pCtx->ss.Sel = uNewSS;
3466 pCtx->ss.ValidSel = uNewSS;
3467 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3468 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3469 pCtx->ss.u32Limit = cbLimitSs;
3470 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3471 if (!pCtx->ss.Attr.n.u1DefBig)
3472 pCtx->sp = (uint16_t)uNewESP;
3473 else
3474 pCtx->rsp = uNewESP;
3475
3476 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3477 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
3478 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
3479 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
3480 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
3481
3482 /* Done! */
3483
3484 }
3485 /*
3486 * Return to the same level.
3487 */
3488 else
3489 {
3490 /* Check EIP. */
3491 if (uNewEip > cbLimitCS)
3492 {
3493 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3494 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3495 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3496 }
3497
3498 /*
3499 * Commit the changes, marking CS first since it may fail.
3500 */
3501 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3502 {
3503 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3504 if (rcStrict != VINF_SUCCESS)
3505 return rcStrict;
3506 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3507 }
3508
3509 X86EFLAGS NewEfl;
3510 NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
3511 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3512 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3513 if (enmEffOpSize != IEMMODE_16BIT)
3514 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3515 if (pVCpu->iem.s.uCpl == 0)
3516 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3517 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3518 fEFlagsMask |= X86_EFL_IF;
3519 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3520 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3521 NewEfl.u &= ~fEFlagsMask;
3522 NewEfl.u |= fEFlagsMask & uNewFlags;
3523#ifdef DBGFTRACE_ENABLED
3524 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3525 pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
3526 uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
3527#endif
3528
3529 IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
3530 pCtx->rip = uNewEip;
3531 pCtx->cs.Sel = uNewCs;
3532 pCtx->cs.ValidSel = uNewCs;
3533 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3534 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3535 pCtx->cs.u32Limit = cbLimitCS;
3536 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3537 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3538 if (!pCtx->ss.Attr.n.u1DefBig)
3539 pCtx->sp = (uint16_t)uNewRsp;
3540 else
3541 pCtx->rsp = uNewRsp;
3542 /* Done! */
3543 }
3544
3545 /* Flush the prefetch buffer. */
3546#ifdef IEM_WITH_CODE_TLB
3547 pVCpu->iem.s.pbInstrBuf = NULL;
3548#else
3549 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3550#endif
3551
3552 return VINF_SUCCESS;
3553}
3554
3555
3556/**
3557 * Implements iret for long mode
3558 *
3559 * @param enmEffOpSize The effective operand size.
3560 */
3561IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3562{
3563 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3564 NOREF(cbInstr);
3565
3566 /*
3567 * Nested task return is not supported in long mode.
3568 */
3569 if (pCtx->eflags.Bits.u1NT)
3570 {
3571 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
3572 return iemRaiseGeneralProtectionFault0(pVCpu);
3573 }
3574
3575 /*
3576 * Normal return.
3577 *
3578 * Do the stack bits, but don't commit RSP before everything checks
3579 * out right.
3580 */
3581 VBOXSTRICTRC rcStrict;
3582 RTCPTRUNION uFrame;
3583 uint64_t uNewRip;
3584 uint16_t uNewCs;
3585 uint16_t uNewSs;
3586 uint32_t uNewFlags;
3587 uint64_t uNewRsp;
3588 if (enmEffOpSize == IEMMODE_64BIT)
3589 {
3590 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3591 if (rcStrict != VINF_SUCCESS)
3592 return rcStrict;
3593 uNewRip = uFrame.pu64[0];
3594 uNewCs = (uint16_t)uFrame.pu64[1];
3595 uNewFlags = (uint32_t)uFrame.pu64[2];
3596 uNewRsp = uFrame.pu64[3];
3597 uNewSs = (uint16_t)uFrame.pu64[4];
3598 }
3599 else if (enmEffOpSize == IEMMODE_32BIT)
3600 {
3601 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3602 if (rcStrict != VINF_SUCCESS)
3603 return rcStrict;
3604 uNewRip = uFrame.pu32[0];
3605 uNewCs = (uint16_t)uFrame.pu32[1];
3606 uNewFlags = uFrame.pu32[2];
3607 uNewRsp = uFrame.pu32[3];
3608 uNewSs = (uint16_t)uFrame.pu32[4];
3609 }
3610 else
3611 {
3612 Assert(enmEffOpSize == IEMMODE_16BIT);
3613 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3614 if (rcStrict != VINF_SUCCESS)
3615 return rcStrict;
3616 uNewRip = uFrame.pu16[0];
3617 uNewCs = uFrame.pu16[1];
3618 uNewFlags = uFrame.pu16[2];
3619 uNewRsp = uFrame.pu16[3];
3620 uNewSs = uFrame.pu16[4];
3621 }
3622 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3623 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3624 { /* extremely like */ }
3625 else
3626 return rcStrict;
3627 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3628
3629 /*
3630 * Check stuff.
3631 */
3632 /* Read the CS descriptor. */
3633 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3634 {
3635 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3636 return iemRaiseGeneralProtectionFault0(pVCpu);
3637 }
3638
3639 IEMSELDESC DescCS;
3640 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3641 if (rcStrict != VINF_SUCCESS)
3642 {
3643 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3644 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3645 return rcStrict;
3646 }
3647
3648 /* Must be a code descriptor. */
3649 if ( !DescCS.Legacy.Gen.u1DescType
3650 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3651 {
3652 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3653 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3654 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3655 }
3656
3657 /* Privilege checks. */
3658 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3659 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3660 {
3661 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3662 {
3663 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3664 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3665 }
3666 }
3667 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3668 {
3669 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3670 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3671 }
3672 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3673 {
3674 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3675 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3676 }
3677
3678 /* Present? */
3679 if (!DescCS.Legacy.Gen.u1Present)
3680 {
3681 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3682 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3683 }
3684
3685 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3686
3687 /* Read the SS descriptor. */
3688 IEMSELDESC DescSS;
3689 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3690 {
3691 if ( !DescCS.Legacy.Gen.u1Long
3692 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3693 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3694 {
3695 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3696 return iemRaiseGeneralProtectionFault0(pVCpu);
3697 }
3698 DescSS.Legacy.u = 0;
3699 }
3700 else
3701 {
3702 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3703 if (rcStrict != VINF_SUCCESS)
3704 {
3705 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3706 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3707 return rcStrict;
3708 }
3709 }
3710
3711 /* Privilege checks. */
3712 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3713 {
3714 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3715 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3716 }
3717
3718 uint32_t cbLimitSs;
3719 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3720 cbLimitSs = UINT32_MAX;
3721 else
3722 {
3723 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3724 {
3725 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3726 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3727 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3728 }
3729
3730 /* Must be a writeable data segment descriptor. */
3731 if (!DescSS.Legacy.Gen.u1DescType)
3732 {
3733 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3734 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3735 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3736 }
3737 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3738 {
3739 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3740 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3741 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3742 }
3743
3744 /* Present? */
3745 if (!DescSS.Legacy.Gen.u1Present)
3746 {
3747 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3748 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3749 }
3750 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3751 }
3752
3753 /* Check EIP. */
3754 if (DescCS.Legacy.Gen.u1Long)
3755 {
3756 if (!IEM_IS_CANONICAL(uNewRip))
3757 {
3758 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3759 uNewCs, uNewRip, uNewSs, uNewRsp));
3760 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3761 }
3762 }
3763 else
3764 {
3765 if (uNewRip > cbLimitCS)
3766 {
3767 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3768 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3769 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3770 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3771 }
3772 }
3773
3774 /*
3775 * Commit the changes, marking CS and SS accessed first since
3776 * that may fail.
3777 */
3778 /** @todo where exactly are these actually marked accessed by a real CPU? */
3779 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3780 {
3781 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3782 if (rcStrict != VINF_SUCCESS)
3783 return rcStrict;
3784 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3785 }
3786 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3787 {
3788 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3789 if (rcStrict != VINF_SUCCESS)
3790 return rcStrict;
3791 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3792 }
3793
3794 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3795 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3796 if (enmEffOpSize != IEMMODE_16BIT)
3797 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3798 if (pVCpu->iem.s.uCpl == 0)
3799 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3800 else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
3801 fEFlagsMask |= X86_EFL_IF;
3802 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
3803 fEFlagsNew &= ~fEFlagsMask;
3804 fEFlagsNew |= uNewFlags & fEFlagsMask;
3805#ifdef DBGFTRACE_ENABLED
3806 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3807 pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3808#endif
3809
3810 IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
3811 pCtx->rip = uNewRip;
3812 pCtx->cs.Sel = uNewCs;
3813 pCtx->cs.ValidSel = uNewCs;
3814 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3815 pCtx->cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3816 pCtx->cs.u32Limit = cbLimitCS;
3817 pCtx->cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3818 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
3819 if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
3820 pCtx->rsp = uNewRsp;
3821 else
3822 pCtx->sp = (uint16_t)uNewRsp;
3823 pCtx->ss.Sel = uNewSs;
3824 pCtx->ss.ValidSel = uNewSs;
3825 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3826 {
3827 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3828 pCtx->ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3829 pCtx->ss.u32Limit = UINT32_MAX;
3830 pCtx->ss.u64Base = 0;
3831 Log2(("iretq new SS: NULL\n"));
3832 }
3833 else
3834 {
3835 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3836 pCtx->ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3837 pCtx->ss.u32Limit = cbLimitSs;
3838 pCtx->ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3839 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pCtx->ss.u64Base, pCtx->ss.u32Limit, pCtx->ss.Attr.u));
3840 }
3841
3842 if (pVCpu->iem.s.uCpl != uNewCpl)
3843 {
3844 pVCpu->iem.s.uCpl = uNewCpl;
3845 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
3846 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
3847 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
3848 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
3849 }
3850
3851 /* Flush the prefetch buffer. */
3852#ifdef IEM_WITH_CODE_TLB
3853 pVCpu->iem.s.pbInstrBuf = NULL;
3854#else
3855 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3856#endif
3857
3858 return VINF_SUCCESS;
3859}
3860
3861
3862/**
3863 * Implements iret.
3864 *
3865 * @param enmEffOpSize The effective operand size.
3866 */
3867IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3868{
3869 /*
3870 * First, clear NMI blocking, if any, before causing any exceptions.
3871 */
3872 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3873
3874 /*
3875 * The SVM nested-guest intercept for iret takes priority over all exceptions,
3876 * see AMD spec. "15.9 Instruction Intercepts".
3877 */
3878 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3879 {
3880 Log(("iret: Guest intercept -> #VMEXIT\n"));
3881 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3882 }
3883
3884 /*
3885 * Call a mode specific worker.
3886 */
3887 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3888 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3889 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3890 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3891 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3892}
3893
3894
3895/**
3896 * Implements SYSCALL (AMD and Intel64).
3897 *
3898 * @param enmEffOpSize The effective operand size.
3899 */
3900IEM_CIMPL_DEF_0(iemCImpl_syscall)
3901{
3902 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
3903
3904 /*
3905 * Check preconditions.
3906 *
3907 * Note that CPUs described in the documentation may load a few odd values
3908 * into CS and SS than we allow here. This has yet to be checked on real
3909 * hardware.
3910 */
3911 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
3912 {
3913 Log(("syscall: Not enabled in EFER -> #UD\n"));
3914 return iemRaiseUndefinedOpcode(pVCpu);
3915 }
3916 if (!(pCtx->cr0 & X86_CR0_PE))
3917 {
3918 Log(("syscall: Protected mode is required -> #GP(0)\n"));
3919 return iemRaiseGeneralProtectionFault0(pVCpu);
3920 }
3921 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
3922 {
3923 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3924 return iemRaiseUndefinedOpcode(pVCpu);
3925 }
3926
3927 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
3928 /** @todo what about LDT selectors? Shouldn't matter, really. */
3929 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
3930 uint16_t uNewSs = uNewCs + 8;
3931 if (uNewCs == 0 || uNewSs == 0)
3932 {
3933 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
3934 return iemRaiseGeneralProtectionFault0(pVCpu);
3935 }
3936
3937 /* Long mode and legacy mode differs. */
3938 if (CPUMIsGuestInLongModeEx(pCtx))
3939 {
3940 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
3941
3942 /* This test isn't in the docs, but I'm not trusting the guys writing
3943 the MSRs to have validated the values as canonical like they should. */
3944 if (!IEM_IS_CANONICAL(uNewRip))
3945 {
3946 Log(("syscall: Only available in long mode on intel -> #UD\n"));
3947 return iemRaiseUndefinedOpcode(pVCpu);
3948 }
3949
3950 /*
3951 * Commit it.
3952 */
3953 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, uNewRip));
3954 pCtx->rcx = pCtx->rip + cbInstr;
3955 pCtx->rip = uNewRip;
3956
3957 pCtx->rflags.u &= ~X86_EFL_RF;
3958 pCtx->r11 = pCtx->rflags.u;
3959 pCtx->rflags.u &= ~pCtx->msrSFMASK;
3960 pCtx->rflags.u |= X86_EFL_1;
3961
3962 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3963 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3964 }
3965 else
3966 {
3967 /*
3968 * Commit it.
3969 */
3970 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
3971 pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, (uint32_t)(pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
3972 pCtx->rcx = pCtx->eip + cbInstr;
3973 pCtx->rip = pCtx->msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
3974 pCtx->rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
3975
3976 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
3977 pCtx->ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
3978 }
3979 pCtx->cs.Sel = uNewCs;
3980 pCtx->cs.ValidSel = uNewCs;
3981 pCtx->cs.u64Base = 0;
3982 pCtx->cs.u32Limit = UINT32_MAX;
3983 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
3984
3985 pCtx->ss.Sel = uNewSs;
3986 pCtx->ss.ValidSel = uNewSs;
3987 pCtx->ss.u64Base = 0;
3988 pCtx->ss.u32Limit = UINT32_MAX;
3989 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
3990
3991 /* Flush the prefetch buffer. */
3992#ifdef IEM_WITH_CODE_TLB
3993 pVCpu->iem.s.pbInstrBuf = NULL;
3994#else
3995 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3996#endif
3997
3998 return VINF_SUCCESS;
3999}
4000
4001
4002/**
4003 * Implements SYSRET (AMD and Intel64).
4004 */
4005IEM_CIMPL_DEF_0(iemCImpl_sysret)
4006
4007{
4008 RT_NOREF_PV(cbInstr);
4009 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4010
4011 /*
4012 * Check preconditions.
4013 *
4014 * Note that CPUs described in the documentation may load a few odd values
4015 * into CS and SS than we allow here. This has yet to be checked on real
4016 * hardware.
4017 */
4018 if (!(pCtx->msrEFER & MSR_K6_EFER_SCE))
4019 {
4020 Log(("sysret: Not enabled in EFER -> #UD\n"));
4021 return iemRaiseUndefinedOpcode(pVCpu);
4022 }
4023 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
4024 {
4025 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4026 return iemRaiseUndefinedOpcode(pVCpu);
4027 }
4028 if (!(pCtx->cr0 & X86_CR0_PE))
4029 {
4030 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4031 return iemRaiseGeneralProtectionFault0(pVCpu);
4032 }
4033 if (pVCpu->iem.s.uCpl != 0)
4034 {
4035 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4036 return iemRaiseGeneralProtectionFault0(pVCpu);
4037 }
4038
4039 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4040 uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4041 uint16_t uNewSs = uNewCs + 8;
4042 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4043 uNewCs += 16;
4044 if (uNewCs == 0 || uNewSs == 0)
4045 {
4046 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4047 return iemRaiseGeneralProtectionFault0(pVCpu);
4048 }
4049
4050 /*
4051 * Commit it.
4052 */
4053 if (CPUMIsGuestInLongModeEx(pCtx))
4054 {
4055 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4056 {
4057 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4058 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->rcx, pCtx->r11));
4059 /* Note! We disregard intel manual regarding the RCX cananonical
4060 check, ask intel+xen why AMD doesn't do it. */
4061 pCtx->rip = pCtx->rcx;
4062 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4063 | (3 << X86DESCATTR_DPL_SHIFT);
4064 }
4065 else
4066 {
4067 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4068 pCtx->cs, pCtx->rip, pCtx->rflags.u, uNewCs, pCtx->ecx, pCtx->r11));
4069 pCtx->rip = pCtx->ecx;
4070 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4071 | (3 << X86DESCATTR_DPL_SHIFT);
4072 }
4073 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4074 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4075 pCtx->rflags.u = pCtx->r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4076 pCtx->rflags.u |= X86_EFL_1;
4077 }
4078 else
4079 {
4080 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pCtx->cs, pCtx->eip, pCtx->eflags.u, uNewCs, pCtx->ecx));
4081 pCtx->rip = pCtx->rcx;
4082 pCtx->rflags.u |= X86_EFL_IF;
4083 pCtx->cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4084 | (3 << X86DESCATTR_DPL_SHIFT);
4085 }
4086 pCtx->cs.Sel = uNewCs | 3;
4087 pCtx->cs.ValidSel = uNewCs | 3;
4088 pCtx->cs.u64Base = 0;
4089 pCtx->cs.u32Limit = UINT32_MAX;
4090 pCtx->cs.fFlags = CPUMSELREG_FLAGS_VALID;
4091
4092 pCtx->ss.Sel = uNewSs | 3;
4093 pCtx->ss.ValidSel = uNewSs | 3;
4094 pCtx->ss.fFlags = CPUMSELREG_FLAGS_VALID;
4095 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4096 pCtx->ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4097 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4098 * on sysret. */
4099
4100 /* Flush the prefetch buffer. */
4101#ifdef IEM_WITH_CODE_TLB
4102 pVCpu->iem.s.pbInstrBuf = NULL;
4103#else
4104 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4105#endif
4106
4107 return VINF_SUCCESS;
4108}
4109
4110
4111/**
4112 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4113 *
4114 * @param iSegReg The segment register number (valid).
4115 * @param uSel The new selector value.
4116 */
4117IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4118{
4119 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4120 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4121 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4122
4123 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4124
4125 /*
4126 * Real mode and V8086 mode are easy.
4127 */
4128 if ( pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
4129 && IEM_IS_REAL_OR_V86_MODE(pVCpu))
4130 {
4131 *pSel = uSel;
4132 pHid->u64Base = (uint32_t)uSel << 4;
4133 pHid->ValidSel = uSel;
4134 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4135#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4136 /** @todo Does the CPU actually load limits and attributes in the
4137 * real/V8086 mode segment load case? It doesn't for CS in far
4138 * jumps... Affects unreal mode. */
4139 pHid->u32Limit = 0xffff;
4140 pHid->Attr.u = 0;
4141 pHid->Attr.n.u1Present = 1;
4142 pHid->Attr.n.u1DescType = 1;
4143 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4144 ? X86_SEL_TYPE_RW
4145 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4146#endif
4147 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4148 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4149 return VINF_SUCCESS;
4150 }
4151
4152 /*
4153 * Protected mode.
4154 *
4155 * Check if it's a null segment selector value first, that's OK for DS, ES,
4156 * FS and GS. If not null, then we have to load and parse the descriptor.
4157 */
4158 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4159 {
4160 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4161 if (iSegReg == X86_SREG_SS)
4162 {
4163 /* In 64-bit kernel mode, the stack can be 0 because of the way
4164 interrupts are dispatched. AMD seems to have a slighly more
4165 relaxed relationship to SS.RPL than intel does. */
4166 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4167 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4168 || pVCpu->iem.s.uCpl > 2
4169 || ( uSel != pVCpu->iem.s.uCpl
4170 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4171 {
4172 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4173 return iemRaiseGeneralProtectionFault0(pVCpu);
4174 }
4175 }
4176
4177 *pSel = uSel; /* Not RPL, remember :-) */
4178 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4179 if (iSegReg == X86_SREG_SS)
4180 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4181
4182 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4183 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4184
4185 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4186 return VINF_SUCCESS;
4187 }
4188
4189 /* Fetch the descriptor. */
4190 IEMSELDESC Desc;
4191 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4192 if (rcStrict != VINF_SUCCESS)
4193 return rcStrict;
4194
4195 /* Check GPs first. */
4196 if (!Desc.Legacy.Gen.u1DescType)
4197 {
4198 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4199 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4200 }
4201 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4202 {
4203 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4204 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4205 {
4206 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4207 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4208 }
4209 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4210 {
4211 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4212 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4213 }
4214 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4215 {
4216 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4217 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4218 }
4219 }
4220 else
4221 {
4222 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4223 {
4224 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4225 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4226 }
4227 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4228 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4229 {
4230#if 0 /* this is what intel says. */
4231 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4232 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4233 {
4234 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4235 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4236 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4237 }
4238#else /* this is what makes more sense. */
4239 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4240 {
4241 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4242 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4243 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4244 }
4245 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4246 {
4247 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4248 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4249 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4250 }
4251#endif
4252 }
4253 }
4254
4255 /* Is it there? */
4256 if (!Desc.Legacy.Gen.u1Present)
4257 {
4258 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4259 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4260 }
4261
4262 /* The base and limit. */
4263 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4264 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4265
4266 /*
4267 * Ok, everything checked out fine. Now set the accessed bit before
4268 * committing the result into the registers.
4269 */
4270 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4271 {
4272 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4273 if (rcStrict != VINF_SUCCESS)
4274 return rcStrict;
4275 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4276 }
4277
4278 /* commit */
4279 *pSel = uSel;
4280 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4281 pHid->u32Limit = cbLimit;
4282 pHid->u64Base = u64Base;
4283 pHid->ValidSel = uSel;
4284 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4285
4286 /** @todo check if the hidden bits are loaded correctly for 64-bit
4287 * mode. */
4288 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4289
4290 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4291 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4292 return VINF_SUCCESS;
4293}
4294
4295
4296/**
4297 * Implements 'mov SReg, r/m'.
4298 *
4299 * @param iSegReg The segment register number (valid).
4300 * @param uSel The new selector value.
4301 */
4302IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4303{
4304 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4305 if (rcStrict == VINF_SUCCESS)
4306 {
4307 if (iSegReg == X86_SREG_SS)
4308 {
4309 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4310 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4311 }
4312 }
4313 return rcStrict;
4314}
4315
4316
4317/**
4318 * Implements 'pop SReg'.
4319 *
4320 * @param iSegReg The segment register number (valid).
4321 * @param enmEffOpSize The efficient operand size (valid).
4322 */
4323IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4324{
4325 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4326 VBOXSTRICTRC rcStrict;
4327
4328 /*
4329 * Read the selector off the stack and join paths with mov ss, reg.
4330 */
4331 RTUINT64U TmpRsp;
4332 TmpRsp.u = pCtx->rsp;
4333 switch (enmEffOpSize)
4334 {
4335 case IEMMODE_16BIT:
4336 {
4337 uint16_t uSel;
4338 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4339 if (rcStrict == VINF_SUCCESS)
4340 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4341 break;
4342 }
4343
4344 case IEMMODE_32BIT:
4345 {
4346 uint32_t u32Value;
4347 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4348 if (rcStrict == VINF_SUCCESS)
4349 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4350 break;
4351 }
4352
4353 case IEMMODE_64BIT:
4354 {
4355 uint64_t u64Value;
4356 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4357 if (rcStrict == VINF_SUCCESS)
4358 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4359 break;
4360 }
4361 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4362 }
4363
4364 /*
4365 * Commit the stack on success.
4366 */
4367 if (rcStrict == VINF_SUCCESS)
4368 {
4369 pCtx->rsp = TmpRsp.u;
4370 if (iSegReg == X86_SREG_SS)
4371 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
4372 }
4373 return rcStrict;
4374}
4375
4376
4377/**
4378 * Implements lgs, lfs, les, lds & lss.
4379 */
4380IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4381 uint16_t, uSel,
4382 uint64_t, offSeg,
4383 uint8_t, iSegReg,
4384 uint8_t, iGReg,
4385 IEMMODE, enmEffOpSize)
4386{
4387 /*PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);*/
4388 VBOXSTRICTRC rcStrict;
4389
4390 /*
4391 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4392 */
4393 /** @todo verify and test that mov, pop and lXs works the segment
4394 * register loading in the exact same way. */
4395 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4396 if (rcStrict == VINF_SUCCESS)
4397 {
4398 switch (enmEffOpSize)
4399 {
4400 case IEMMODE_16BIT:
4401 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4402 break;
4403 case IEMMODE_32BIT:
4404 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4405 break;
4406 case IEMMODE_64BIT:
4407 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4408 break;
4409 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4410 }
4411 }
4412
4413 return rcStrict;
4414}
4415
4416
4417/**
4418 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4419 *
4420 * @retval VINF_SUCCESS on success.
4421 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4422 * @retval iemMemFetchSysU64 return value.
4423 *
4424 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4425 * @param uSel The selector value.
4426 * @param fAllowSysDesc Whether system descriptors are OK or not.
4427 * @param pDesc Where to return the descriptor on success.
4428 */
4429static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4430{
4431 pDesc->Long.au64[0] = 0;
4432 pDesc->Long.au64[1] = 0;
4433
4434 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4435 return VINF_IEM_SELECTOR_NOT_OK;
4436
4437 /* Within the table limits? */
4438 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4439 RTGCPTR GCPtrBase;
4440 if (uSel & X86_SEL_LDT)
4441 {
4442 if ( !pCtx->ldtr.Attr.n.u1Present
4443 || (uSel | X86_SEL_RPL_LDT) > pCtx->ldtr.u32Limit )
4444 return VINF_IEM_SELECTOR_NOT_OK;
4445 GCPtrBase = pCtx->ldtr.u64Base;
4446 }
4447 else
4448 {
4449 if ((uSel | X86_SEL_RPL_LDT) > pCtx->gdtr.cbGdt)
4450 return VINF_IEM_SELECTOR_NOT_OK;
4451 GCPtrBase = pCtx->gdtr.pGdt;
4452 }
4453
4454 /* Fetch the descriptor. */
4455 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4456 if (rcStrict != VINF_SUCCESS)
4457 return rcStrict;
4458 if (!pDesc->Legacy.Gen.u1DescType)
4459 {
4460 if (!fAllowSysDesc)
4461 return VINF_IEM_SELECTOR_NOT_OK;
4462 if (CPUMIsGuestInLongModeEx(pCtx))
4463 {
4464 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4465 if (rcStrict != VINF_SUCCESS)
4466 return rcStrict;
4467 }
4468
4469 }
4470
4471 return VINF_SUCCESS;
4472}
4473
4474
4475/**
4476 * Implements verr (fWrite = false) and verw (fWrite = true).
4477 */
4478IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4479{
4480 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4481
4482 /** @todo figure whether the accessed bit is set or not. */
4483
4484 bool fAccessible = true;
4485 IEMSELDESC Desc;
4486 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4487 if (rcStrict == VINF_SUCCESS)
4488 {
4489 /* Check the descriptor, order doesn't matter much here. */
4490 if ( !Desc.Legacy.Gen.u1DescType
4491 || !Desc.Legacy.Gen.u1Present)
4492 fAccessible = false;
4493 else
4494 {
4495 if ( fWrite
4496 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4497 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4498 fAccessible = false;
4499
4500 /** @todo testcase for the conforming behavior. */
4501 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4502 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4503 {
4504 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4505 fAccessible = false;
4506 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4507 fAccessible = false;
4508 }
4509 }
4510
4511 }
4512 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4513 fAccessible = false;
4514 else
4515 return rcStrict;
4516
4517 /* commit */
4518 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fAccessible;
4519
4520 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4521 return VINF_SUCCESS;
4522}
4523
4524
4525/**
4526 * Implements LAR and LSL with 64-bit operand size.
4527 *
4528 * @returns VINF_SUCCESS.
4529 * @param pu16Dst Pointer to the destination register.
4530 * @param uSel The selector to load details for.
4531 * @param fIsLar true = LAR, false = LSL.
4532 */
4533IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4534{
4535 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4536
4537 /** @todo figure whether the accessed bit is set or not. */
4538
4539 bool fDescOk = true;
4540 IEMSELDESC Desc;
4541 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4542 if (rcStrict == VINF_SUCCESS)
4543 {
4544 /*
4545 * Check the descriptor type.
4546 */
4547 if (!Desc.Legacy.Gen.u1DescType)
4548 {
4549 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4550 {
4551 if (Desc.Long.Gen.u5Zeros)
4552 fDescOk = false;
4553 else
4554 switch (Desc.Long.Gen.u4Type)
4555 {
4556 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4557 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4558 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4559 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4560 break;
4561 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4562 fDescOk = fIsLar;
4563 break;
4564 default:
4565 fDescOk = false;
4566 break;
4567 }
4568 }
4569 else
4570 {
4571 switch (Desc.Long.Gen.u4Type)
4572 {
4573 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4574 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4575 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4576 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4577 case X86_SEL_TYPE_SYS_LDT:
4578 break;
4579 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4580 case X86_SEL_TYPE_SYS_TASK_GATE:
4581 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4582 fDescOk = fIsLar;
4583 break;
4584 default:
4585 fDescOk = false;
4586 break;
4587 }
4588 }
4589 }
4590 if (fDescOk)
4591 {
4592 /*
4593 * Check the RPL/DPL/CPL interaction..
4594 */
4595 /** @todo testcase for the conforming behavior. */
4596 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4597 || !Desc.Legacy.Gen.u1DescType)
4598 {
4599 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4600 fDescOk = false;
4601 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4602 fDescOk = false;
4603 }
4604 }
4605
4606 if (fDescOk)
4607 {
4608 /*
4609 * All fine, start committing the result.
4610 */
4611 if (fIsLar)
4612 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4613 else
4614 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4615 }
4616
4617 }
4618 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4619 fDescOk = false;
4620 else
4621 return rcStrict;
4622
4623 /* commit flags value and advance rip. */
4624 IEM_GET_CTX(pVCpu)->eflags.Bits.u1ZF = fDescOk;
4625 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4626
4627 return VINF_SUCCESS;
4628}
4629
4630
4631/**
4632 * Implements LAR and LSL with 16-bit operand size.
4633 *
4634 * @returns VINF_SUCCESS.
4635 * @param pu16Dst Pointer to the destination register.
4636 * @param u16Sel The selector to load details for.
4637 * @param fIsLar true = LAR, false = LSL.
4638 */
4639IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4640{
4641 uint64_t u64TmpDst = *pu16Dst;
4642 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4643 *pu16Dst = u64TmpDst;
4644 return VINF_SUCCESS;
4645}
4646
4647
4648/**
4649 * Implements lgdt.
4650 *
4651 * @param iEffSeg The segment of the new gdtr contents
4652 * @param GCPtrEffSrc The address of the new gdtr contents.
4653 * @param enmEffOpSize The effective operand size.
4654 */
4655IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4656{
4657 if (pVCpu->iem.s.uCpl != 0)
4658 return iemRaiseGeneralProtectionFault0(pVCpu);
4659 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4660
4661 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
4662 {
4663 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
4664 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4665 }
4666
4667 /*
4668 * Fetch the limit and base address.
4669 */
4670 uint16_t cbLimit;
4671 RTGCPTR GCPtrBase;
4672 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4673 if (rcStrict == VINF_SUCCESS)
4674 {
4675 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4676 || X86_IS_CANONICAL(GCPtrBase))
4677 {
4678 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4679 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4680 else
4681 {
4682 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4683 pCtx->gdtr.cbGdt = cbLimit;
4684 pCtx->gdtr.pGdt = GCPtrBase;
4685 }
4686 if (rcStrict == VINF_SUCCESS)
4687 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4688 }
4689 else
4690 {
4691 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4692 return iemRaiseGeneralProtectionFault0(pVCpu);
4693 }
4694 }
4695 return rcStrict;
4696}
4697
4698
4699/**
4700 * Implements sgdt.
4701 *
4702 * @param iEffSeg The segment where to store the gdtr content.
4703 * @param GCPtrEffDst The address where to store the gdtr content.
4704 */
4705IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4706{
4707 /*
4708 * Join paths with sidt.
4709 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4710 * you really must know.
4711 */
4712 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
4713 {
4714 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
4715 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4716 }
4717
4718 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4719 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
4720 if (rcStrict == VINF_SUCCESS)
4721 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4722 return rcStrict;
4723}
4724
4725
4726/**
4727 * Implements lidt.
4728 *
4729 * @param iEffSeg The segment of the new idtr contents
4730 * @param GCPtrEffSrc The address of the new idtr contents.
4731 * @param enmEffOpSize The effective operand size.
4732 */
4733IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4734{
4735 if (pVCpu->iem.s.uCpl != 0)
4736 return iemRaiseGeneralProtectionFault0(pVCpu);
4737 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
4738
4739 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
4740 {
4741 Log(("lidt: Guest intercept -> #VMEXIT\n"));
4742 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4743 }
4744
4745 /*
4746 * Fetch the limit and base address.
4747 */
4748 uint16_t cbLimit;
4749 RTGCPTR GCPtrBase;
4750 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4751 if (rcStrict == VINF_SUCCESS)
4752 {
4753 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4754 || X86_IS_CANONICAL(GCPtrBase))
4755 {
4756 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4757 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4758 else
4759 {
4760 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4761 pCtx->idtr.cbIdt = cbLimit;
4762 pCtx->idtr.pIdt = GCPtrBase;
4763 }
4764 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4765 }
4766 else
4767 {
4768 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4769 return iemRaiseGeneralProtectionFault0(pVCpu);
4770 }
4771 }
4772 return rcStrict;
4773}
4774
4775
4776/**
4777 * Implements sidt.
4778 *
4779 * @param iEffSeg The segment where to store the idtr content.
4780 * @param GCPtrEffDst The address where to store the idtr content.
4781 */
4782IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4783{
4784 /*
4785 * Join paths with sgdt.
4786 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4787 * you really must know.
4788 */
4789 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
4790 {
4791 Log(("sidt: Guest intercept -> #VMEXIT\n"));
4792 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4793 }
4794
4795 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4796 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
4797 if (rcStrict == VINF_SUCCESS)
4798 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4799 return rcStrict;
4800}
4801
4802
4803/**
4804 * Implements lldt.
4805 *
4806 * @param uNewLdt The new LDT selector value.
4807 */
4808IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4809{
4810 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4811
4812 /*
4813 * Check preconditions.
4814 */
4815 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4816 {
4817 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4818 return iemRaiseUndefinedOpcode(pVCpu);
4819 }
4820 if (pVCpu->iem.s.uCpl != 0)
4821 {
4822 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4823 return iemRaiseGeneralProtectionFault0(pVCpu);
4824 }
4825 if (uNewLdt & X86_SEL_LDT)
4826 {
4827 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4828 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4829 }
4830
4831 /*
4832 * Now, loading a NULL selector is easy.
4833 */
4834 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4835 {
4836 /* Nested-guest SVM intercept. */
4837 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
4838 {
4839 Log(("lldt: Guest intercept -> #VMEXIT\n"));
4840 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4841 }
4842
4843 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
4844 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4845 CPUMSetGuestLDTR(pVCpu, uNewLdt);
4846 else
4847 pCtx->ldtr.Sel = uNewLdt;
4848 pCtx->ldtr.ValidSel = uNewLdt;
4849 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4850 if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4851 {
4852 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4853 pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
4854 }
4855 else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
4856 {
4857 /* AMD-V seems to leave the base and limit alone. */
4858 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
4859 }
4860 else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
4861 {
4862 /* VT-x (Intel 3960x) seems to be doing the following. */
4863 pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
4864 pCtx->ldtr.u64Base = 0;
4865 pCtx->ldtr.u32Limit = UINT32_MAX;
4866 }
4867
4868 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4869 return VINF_SUCCESS;
4870 }
4871
4872 /*
4873 * Read the descriptor.
4874 */
4875 IEMSELDESC Desc;
4876 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
4877 if (rcStrict != VINF_SUCCESS)
4878 return rcStrict;
4879
4880 /* Check GPs first. */
4881 if (Desc.Legacy.Gen.u1DescType)
4882 {
4883 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4884 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4885 }
4886 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
4887 {
4888 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
4889 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4890 }
4891 uint64_t u64Base;
4892 if (!IEM_IS_LONG_MODE(pVCpu))
4893 u64Base = X86DESC_BASE(&Desc.Legacy);
4894 else
4895 {
4896 if (Desc.Long.Gen.u5Zeros)
4897 {
4898 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
4899 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4900 }
4901
4902 u64Base = X86DESC64_BASE(&Desc.Long);
4903 if (!IEM_IS_CANONICAL(u64Base))
4904 {
4905 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
4906 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4907 }
4908 }
4909
4910 /* NP */
4911 if (!Desc.Legacy.Gen.u1Present)
4912 {
4913 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
4914 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
4915 }
4916
4917 /* Nested-guest SVM intercept. */
4918 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
4919 {
4920 Log(("lldt: Guest intercept -> #VMEXIT\n"));
4921 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4922 }
4923
4924 /*
4925 * It checks out alright, update the registers.
4926 */
4927/** @todo check if the actual value is loaded or if the RPL is dropped */
4928 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
4929 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
4930 else
4931 pCtx->ldtr.Sel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4932 pCtx->ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
4933 pCtx->ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
4934 pCtx->ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4935 pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
4936 pCtx->ldtr.u64Base = u64Base;
4937
4938 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4939 return VINF_SUCCESS;
4940}
4941
4942
4943/**
4944 * Implements lldt.
4945 *
4946 * @param uNewLdt The new LDT selector value.
4947 */
4948IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
4949{
4950 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
4951
4952 /*
4953 * Check preconditions.
4954 */
4955 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4956 {
4957 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
4958 return iemRaiseUndefinedOpcode(pVCpu);
4959 }
4960 if (pVCpu->iem.s.uCpl != 0)
4961 {
4962 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
4963 return iemRaiseGeneralProtectionFault0(pVCpu);
4964 }
4965 if (uNewTr & X86_SEL_LDT)
4966 {
4967 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
4968 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
4969 }
4970 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
4971 {
4972 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
4973 return iemRaiseGeneralProtectionFault0(pVCpu);
4974 }
4975 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
4976 {
4977 Log(("ltr: Guest intercept -> #VMEXIT\n"));
4978 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4979 }
4980
4981 /*
4982 * Read the descriptor.
4983 */
4984 IEMSELDESC Desc;
4985 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
4986 if (rcStrict != VINF_SUCCESS)
4987 return rcStrict;
4988
4989 /* Check GPs first. */
4990 if (Desc.Legacy.Gen.u1DescType)
4991 {
4992 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
4993 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
4994 }
4995 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
4996 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
4997 || IEM_IS_LONG_MODE(pVCpu)) )
4998 {
4999 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5000 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5001 }
5002 uint64_t u64Base;
5003 if (!IEM_IS_LONG_MODE(pVCpu))
5004 u64Base = X86DESC_BASE(&Desc.Legacy);
5005 else
5006 {
5007 if (Desc.Long.Gen.u5Zeros)
5008 {
5009 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5010 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5011 }
5012
5013 u64Base = X86DESC64_BASE(&Desc.Long);
5014 if (!IEM_IS_CANONICAL(u64Base))
5015 {
5016 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5017 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5018 }
5019 }
5020
5021 /* NP */
5022 if (!Desc.Legacy.Gen.u1Present)
5023 {
5024 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5025 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5026 }
5027
5028 /*
5029 * Set it busy.
5030 * Note! Intel says this should lock down the whole descriptor, but we'll
5031 * restrict our selves to 32-bit for now due to lack of inline
5032 * assembly and such.
5033 */
5034 void *pvDesc;
5035 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
5036 if (rcStrict != VINF_SUCCESS)
5037 return rcStrict;
5038 switch ((uintptr_t)pvDesc & 3)
5039 {
5040 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5041 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5042 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5043 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5044 }
5045 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5046 if (rcStrict != VINF_SUCCESS)
5047 return rcStrict;
5048 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5049
5050 /*
5051 * It checks out alright, update the registers.
5052 */
5053/** @todo check if the actual value is loaded or if the RPL is dropped */
5054 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5055 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5056 else
5057 pCtx->tr.Sel = uNewTr & X86_SEL_MASK_OFF_RPL;
5058 pCtx->tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5059 pCtx->tr.fFlags = CPUMSELREG_FLAGS_VALID;
5060 pCtx->tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5061 pCtx->tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5062 pCtx->tr.u64Base = u64Base;
5063
5064 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5065 return VINF_SUCCESS;
5066}
5067
5068
5069/**
5070 * Implements mov GReg,CRx.
5071 *
5072 * @param iGReg The general register to store the CRx value in.
5073 * @param iCrReg The CRx register to read (valid).
5074 */
5075IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5076{
5077 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5078 if (pVCpu->iem.s.uCpl != 0)
5079 return iemRaiseGeneralProtectionFault0(pVCpu);
5080 Assert(!pCtx->eflags.Bits.u1VM);
5081
5082 if (IEM_IS_SVM_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5083 {
5084 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5085 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5086 }
5087
5088 /* read it */
5089 uint64_t crX;
5090 switch (iCrReg)
5091 {
5092 case 0:
5093 crX = pCtx->cr0;
5094 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5095 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5096 break;
5097 case 2: crX = pCtx->cr2; break;
5098 case 3: crX = pCtx->cr3; break;
5099 case 4: crX = pCtx->cr4; break;
5100 case 8:
5101 {
5102#ifdef VBOX_WITH_NESTED_HWVIRT
5103 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5104 {
5105 PCSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5106 if (pVmcbCtrl->IntCtrl.n.u1VIntrMasking)
5107 {
5108 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5109 break;
5110 }
5111 }
5112#endif
5113 uint8_t uTpr;
5114 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5115 if (RT_SUCCESS(rc))
5116 crX = uTpr >> 4;
5117 else
5118 crX = 0;
5119 break;
5120 }
5121 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5122 }
5123
5124 /* store it */
5125 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5126 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5127 else
5128 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5129
5130 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5131 return VINF_SUCCESS;
5132}
5133
5134
5135/**
5136 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5137 *
5138 * @param iCrReg The CRx register to write (valid).
5139 * @param uNewCrX The new value.
5140 * @param enmAccessCrx The instruction that caused the CrX load.
5141 * @param iGReg The general register in case of a 'mov CRx,GReg'
5142 * instruction.
5143 */
5144IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5145{
5146 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5147 VBOXSTRICTRC rcStrict;
5148 int rc;
5149#ifndef VBOX_WITH_NESTED_HWVIRT
5150 RT_NOREF2(iGReg, enmAccessCrX);
5151#endif
5152
5153 /*
5154 * Try store it.
5155 * Unfortunately, CPUM only does a tiny bit of the work.
5156 */
5157 switch (iCrReg)
5158 {
5159 case 0:
5160 {
5161 /*
5162 * Perform checks.
5163 */
5164 uint64_t const uOldCrX = pCtx->cr0;
5165 uint32_t const fValid = X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS
5166 | X86_CR0_ET | X86_CR0_NE | X86_CR0_WP | X86_CR0_AM
5167 | X86_CR0_NW | X86_CR0_CD | X86_CR0_PG;
5168
5169 /* ET is hardcoded on 486 and later. */
5170 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5171 uNewCrX |= X86_CR0_ET;
5172 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5173 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5174 {
5175 uNewCrX &= fValid;
5176 uNewCrX |= X86_CR0_ET;
5177 }
5178 else
5179 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5180
5181 /* Check for reserved bits. */
5182 if (uNewCrX & ~(uint64_t)fValid)
5183 {
5184 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5185 return iemRaiseGeneralProtectionFault0(pVCpu);
5186 }
5187
5188 /* Check for invalid combinations. */
5189 if ( (uNewCrX & X86_CR0_PG)
5190 && !(uNewCrX & X86_CR0_PE) )
5191 {
5192 Log(("Trying to set CR0.PG without CR0.PE\n"));
5193 return iemRaiseGeneralProtectionFault0(pVCpu);
5194 }
5195
5196 if ( !(uNewCrX & X86_CR0_CD)
5197 && (uNewCrX & X86_CR0_NW) )
5198 {
5199 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5200 return iemRaiseGeneralProtectionFault0(pVCpu);
5201 }
5202
5203 if ( !(uNewCrX & X86_CR0_PG)
5204 && (pCtx->cr4 & X86_CR4_PCIDE))
5205 {
5206 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5207 return iemRaiseGeneralProtectionFault0(pVCpu);
5208 }
5209
5210 /* Long mode consistency checks. */
5211 if ( (uNewCrX & X86_CR0_PG)
5212 && !(uOldCrX & X86_CR0_PG)
5213 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5214 {
5215 if (!(pCtx->cr4 & X86_CR4_PAE))
5216 {
5217 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5218 return iemRaiseGeneralProtectionFault0(pVCpu);
5219 }
5220 if (pCtx->cs.Attr.n.u1Long)
5221 {
5222 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5223 return iemRaiseGeneralProtectionFault0(pVCpu);
5224 }
5225 }
5226
5227 /** @todo check reserved PDPTR bits as AMD states. */
5228
5229 /*
5230 * SVM nested-guest CR0 write intercepts.
5231 */
5232 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5233 {
5234 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5235 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5236 }
5237 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITES))
5238 {
5239 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5240 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5241 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5242 {
5243 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5244 Log(("iemCImpl_load_Cr%#x: TS/MP bit changed or lmsw instr: Guest intercept -> #VMEXIT\n", iCrReg));
5245 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CR0_SEL_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5246 }
5247 }
5248
5249 /*
5250 * Change CR0.
5251 */
5252 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5253 CPUMSetGuestCR0(pVCpu, uNewCrX);
5254 else
5255 pCtx->cr0 = uNewCrX;
5256 Assert(pCtx->cr0 == uNewCrX);
5257
5258 /*
5259 * Change EFER.LMA if entering or leaving long mode.
5260 */
5261 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5262 && (pCtx->msrEFER & MSR_K6_EFER_LME) )
5263 {
5264 uint64_t NewEFER = pCtx->msrEFER;
5265 if (uNewCrX & X86_CR0_PG)
5266 NewEFER |= MSR_K6_EFER_LMA;
5267 else
5268 NewEFER &= ~MSR_K6_EFER_LMA;
5269
5270 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5271 CPUMSetGuestEFER(pVCpu, NewEFER);
5272 else
5273 pCtx->msrEFER = NewEFER;
5274 Assert(pCtx->msrEFER == NewEFER);
5275 }
5276
5277 /*
5278 * Inform PGM.
5279 */
5280 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5281 {
5282 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5283 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5284 {
5285 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5286 AssertRCReturn(rc, rc);
5287 /* ignore informational status codes */
5288 }
5289 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5290 }
5291 else
5292 rcStrict = VINF_SUCCESS;
5293
5294#ifdef IN_RC
5295 /* Return to ring-3 for rescheduling if WP or AM changes. */
5296 if ( rcStrict == VINF_SUCCESS
5297 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5298 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5299 rcStrict = VINF_EM_RESCHEDULE;
5300#endif
5301 break;
5302 }
5303
5304 /*
5305 * CR2 can be changed without any restrictions.
5306 */
5307 case 2:
5308 {
5309 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5310 {
5311 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5312 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5313 }
5314 pCtx->cr2 = uNewCrX;
5315 rcStrict = VINF_SUCCESS;
5316 break;
5317 }
5318
5319 /*
5320 * CR3 is relatively simple, although AMD and Intel have different
5321 * accounts of how setting reserved bits are handled. We take intel's
5322 * word for the lower bits and AMD's for the high bits (63:52). The
5323 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5324 * on this.
5325 */
5326 /** @todo Testcase: Setting reserved bits in CR3, especially before
5327 * enabling paging. */
5328 case 3:
5329 {
5330 /* clear bit 63 from the source operand and indicate no invalidations are required. */
5331 if ( (pCtx->cr4 & X86_CR4_PCIDE)
5332 && (uNewCrX & RT_BIT_64(63)))
5333 {
5334 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5335 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5336 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5337 * Paging-Structure Caches". */
5338 uNewCrX &= ~RT_BIT_64(63);
5339 }
5340
5341 /* check / mask the value. */
5342 if (uNewCrX & UINT64_C(0xfff0000000000000))
5343 {
5344 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5345 return iemRaiseGeneralProtectionFault0(pVCpu);
5346 }
5347
5348 uint64_t fValid;
5349 if ( (pCtx->cr4 & X86_CR4_PAE)
5350 && (pCtx->msrEFER & MSR_K6_EFER_LME))
5351 fValid = UINT64_C(0x000fffffffffffff);
5352 else
5353 fValid = UINT64_C(0xffffffff);
5354 if (uNewCrX & ~fValid)
5355 {
5356 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5357 uNewCrX, uNewCrX & ~fValid));
5358 uNewCrX &= fValid;
5359 }
5360
5361 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
5362 {
5363 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5364 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
5365 }
5366
5367 /** @todo If we're in PAE mode we should check the PDPTRs for
5368 * invalid bits. */
5369
5370 /* Make the change. */
5371 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5372 {
5373 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5374 AssertRCSuccessReturn(rc, rc);
5375 }
5376 else
5377 pCtx->cr3 = uNewCrX;
5378
5379 /* Inform PGM. */
5380 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5381 {
5382 if (pCtx->cr0 & X86_CR0_PG)
5383 {
5384 rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
5385 AssertRCReturn(rc, rc);
5386 /* ignore informational status codes */
5387 }
5388 }
5389 rcStrict = VINF_SUCCESS;
5390 break;
5391 }
5392
5393 /*
5394 * CR4 is a bit more tedious as there are bits which cannot be cleared
5395 * under some circumstances and such.
5396 */
5397 case 4:
5398 {
5399 uint64_t const uOldCrX = pCtx->cr4;
5400
5401 /** @todo Shouldn't this look at the guest CPUID bits to determine
5402 * valid bits? e.g. if guest CPUID doesn't allow X86_CR4_OSXMMEEXCPT, we
5403 * should #GP(0). */
5404 /* reserved bits */
5405 uint32_t fValid = X86_CR4_VME | X86_CR4_PVI
5406 | X86_CR4_TSD | X86_CR4_DE
5407 | X86_CR4_PSE | X86_CR4_PAE
5408 | X86_CR4_MCE | X86_CR4_PGE
5409 | X86_CR4_PCE | X86_CR4_OSFXSR
5410 | X86_CR4_OSXMMEEXCPT;
5411 //if (xxx)
5412 // fValid |= X86_CR4_VMXE;
5413 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
5414 fValid |= X86_CR4_OSXSAVE;
5415 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fPcid)
5416 fValid |= X86_CR4_PCIDE;
5417 if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fFsGsBase)
5418 fValid |= X86_CR4_FSGSBASE;
5419 if (uNewCrX & ~(uint64_t)fValid)
5420 {
5421 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5422 return iemRaiseGeneralProtectionFault0(pVCpu);
5423 }
5424
5425 bool const fPcide = ((uNewCrX ^ uOldCrX) & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
5426 bool const fLongMode = CPUMIsGuestInLongModeEx(pCtx);
5427
5428 /* PCIDE check. */
5429 if ( fPcide
5430 && ( !fLongMode
5431 || (pCtx->cr3 & UINT64_C(0xfff))))
5432 {
5433 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pCtx->cr3 & UINT64_C(0xfff))));
5434 return iemRaiseGeneralProtectionFault0(pVCpu);
5435 }
5436
5437 /* PAE check. */
5438 if ( fLongMode
5439 && (uOldCrX & X86_CR4_PAE)
5440 && !(uNewCrX & X86_CR4_PAE))
5441 {
5442 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5443 return iemRaiseGeneralProtectionFault0(pVCpu);
5444 }
5445
5446 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
5447 {
5448 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5449 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
5450 }
5451
5452 /*
5453 * Change it.
5454 */
5455 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5456 {
5457 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5458 AssertRCSuccessReturn(rc, rc);
5459 }
5460 else
5461 pCtx->cr4 = uNewCrX;
5462 Assert(pCtx->cr4 == uNewCrX);
5463
5464 /*
5465 * Notify SELM and PGM.
5466 */
5467 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5468 {
5469 /* SELM - VME may change things wrt to the TSS shadowing. */
5470 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5471 {
5472 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5473 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5474#ifdef VBOX_WITH_RAW_MODE
5475 if (VM_IS_RAW_MODE_ENABLED(pVCpu->CTX_SUFF(pVM)))
5476 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5477#endif
5478 }
5479
5480 /* PGM - flushing and mode. */
5481 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
5482 {
5483 rc = PGMFlushTLB(pVCpu, pCtx->cr3, true /* global */);
5484 AssertRCReturn(rc, rc);
5485 /* ignore informational status codes */
5486 }
5487 rcStrict = PGMChangeMode(pVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
5488 }
5489 else
5490 rcStrict = VINF_SUCCESS;
5491 break;
5492 }
5493
5494 /*
5495 * CR8 maps to the APIC TPR.
5496 */
5497 case 8:
5498 {
5499 if (uNewCrX & ~(uint64_t)0xf)
5500 {
5501 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5502 return iemRaiseGeneralProtectionFault0(pVCpu);
5503 }
5504
5505#ifdef VBOX_WITH_NESTED_HWVIRT
5506 if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
5507 {
5508 if (IEM_IS_SVM_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
5509 {
5510 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5511 IEM_RETURN_SVM_CRX_VMEXIT(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
5512 }
5513
5514 PSVMVMCBCTRL pVmcbCtrl = &pCtx->hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5515 pVmcbCtrl->IntCtrl.n.u8VTPR = uNewCrX;
5516 if (pVmcbCtrl->IntCtrl.n.u1VIntrMasking)
5517 {
5518 rcStrict = VINF_SUCCESS;
5519 break;
5520 }
5521 }
5522#endif
5523 if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
5524 {
5525 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
5526 APICSetTpr(pVCpu, u8Tpr);
5527 }
5528 rcStrict = VINF_SUCCESS;
5529 break;
5530 }
5531
5532 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5533 }
5534
5535 /*
5536 * Advance the RIP on success.
5537 */
5538 if (RT_SUCCESS(rcStrict))
5539 {
5540 if (rcStrict != VINF_SUCCESS)
5541 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5542 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5543 }
5544
5545 return rcStrict;
5546}
5547
5548
5549/**
5550 * Implements mov CRx,GReg.
5551 *
5552 * @param iCrReg The CRx register to write (valid).
5553 * @param iGReg The general register to load the DRx value from.
5554 */
5555IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5556{
5557 if (pVCpu->iem.s.uCpl != 0)
5558 return iemRaiseGeneralProtectionFault0(pVCpu);
5559 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5560
5561 /*
5562 * Read the new value from the source register and call common worker.
5563 */
5564 uint64_t uNewCrX;
5565 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5566 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5567 else
5568 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5569 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
5570}
5571
5572
5573/**
5574 * Implements 'LMSW r/m16'
5575 *
5576 * @param u16NewMsw The new value.
5577 */
5578IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
5579{
5580 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5581
5582 if (pVCpu->iem.s.uCpl != 0)
5583 return iemRaiseGeneralProtectionFault0(pVCpu);
5584 Assert(!pCtx->eflags.Bits.u1VM);
5585
5586 /*
5587 * Compose the new CR0 value and call common worker.
5588 */
5589 uint64_t uNewCr0 = pCtx->cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5590 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
5591 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
5592}
5593
5594
5595/**
5596 * Implements 'CLTS'.
5597 */
5598IEM_CIMPL_DEF_0(iemCImpl_clts)
5599{
5600 if (pVCpu->iem.s.uCpl != 0)
5601 return iemRaiseGeneralProtectionFault0(pVCpu);
5602
5603 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5604 uint64_t uNewCr0 = pCtx->cr0;
5605 uNewCr0 &= ~X86_CR0_TS;
5606 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
5607}
5608
5609
5610/**
5611 * Implements mov GReg,DRx.
5612 *
5613 * @param iGReg The general register to store the DRx value in.
5614 * @param iDrReg The DRx register to read (0-7).
5615 */
5616IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
5617{
5618 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5619
5620 /*
5621 * Check preconditions.
5622 */
5623
5624 /* Raise GPs. */
5625 if (pVCpu->iem.s.uCpl != 0)
5626 return iemRaiseGeneralProtectionFault0(pVCpu);
5627 Assert(!pCtx->eflags.Bits.u1VM);
5628
5629 if ( (iDrReg == 4 || iDrReg == 5)
5630 && (pCtx->cr4 & X86_CR4_DE) )
5631 {
5632 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
5633 return iemRaiseGeneralProtectionFault0(pVCpu);
5634 }
5635
5636 /* Raise #DB if general access detect is enabled. */
5637 if (pCtx->dr[7] & X86_DR7_GD)
5638 {
5639 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
5640 return iemRaiseDebugException(pVCpu);
5641 }
5642
5643 /*
5644 * Read the debug register and store it in the specified general register.
5645 */
5646 uint64_t drX;
5647 switch (iDrReg)
5648 {
5649 case 0: drX = pCtx->dr[0]; break;
5650 case 1: drX = pCtx->dr[1]; break;
5651 case 2: drX = pCtx->dr[2]; break;
5652 case 3: drX = pCtx->dr[3]; break;
5653 case 6:
5654 case 4:
5655 drX = pCtx->dr[6];
5656 drX |= X86_DR6_RA1_MASK;
5657 drX &= ~X86_DR6_RAZ_MASK;
5658 break;
5659 case 7:
5660 case 5:
5661 drX = pCtx->dr[7];
5662 drX |=X86_DR7_RA1_MASK;
5663 drX &= ~X86_DR7_RAZ_MASK;
5664 break;
5665 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5666 }
5667
5668 /** @todo SVM nested-guest intercept for DR8-DR15? */
5669 /*
5670 * Check for any SVM nested-guest intercepts for the DRx read.
5671 */
5672 if (IEM_IS_SVM_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
5673 {
5674 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
5675 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
5676 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
5677 }
5678
5679 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5680 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
5681 else
5682 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
5683
5684 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5685 return VINF_SUCCESS;
5686}
5687
5688
5689/**
5690 * Implements mov DRx,GReg.
5691 *
5692 * @param iDrReg The DRx register to write (valid).
5693 * @param iGReg The general register to load the DRx value from.
5694 */
5695IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
5696{
5697 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5698
5699 /*
5700 * Check preconditions.
5701 */
5702 if (pVCpu->iem.s.uCpl != 0)
5703 return iemRaiseGeneralProtectionFault0(pVCpu);
5704 Assert(!pCtx->eflags.Bits.u1VM);
5705
5706 if (iDrReg == 4 || iDrReg == 5)
5707 {
5708 if (pCtx->cr4 & X86_CR4_DE)
5709 {
5710 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
5711 return iemRaiseGeneralProtectionFault0(pVCpu);
5712 }
5713 iDrReg += 2;
5714 }
5715
5716 /* Raise #DB if general access detect is enabled. */
5717 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
5718 * \#GP? */
5719 if (pCtx->dr[7] & X86_DR7_GD)
5720 {
5721 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
5722 return iemRaiseDebugException(pVCpu);
5723 }
5724
5725 /*
5726 * Read the new value from the source register.
5727 */
5728 uint64_t uNewDrX;
5729 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5730 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
5731 else
5732 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
5733
5734 /*
5735 * Adjust it.
5736 */
5737 switch (iDrReg)
5738 {
5739 case 0:
5740 case 1:
5741 case 2:
5742 case 3:
5743 /* nothing to adjust */
5744 break;
5745
5746 case 6:
5747 if (uNewDrX & X86_DR6_MBZ_MASK)
5748 {
5749 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5750 return iemRaiseGeneralProtectionFault0(pVCpu);
5751 }
5752 uNewDrX |= X86_DR6_RA1_MASK;
5753 uNewDrX &= ~X86_DR6_RAZ_MASK;
5754 break;
5755
5756 case 7:
5757 if (uNewDrX & X86_DR7_MBZ_MASK)
5758 {
5759 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
5760 return iemRaiseGeneralProtectionFault0(pVCpu);
5761 }
5762 uNewDrX |= X86_DR7_RA1_MASK;
5763 uNewDrX &= ~X86_DR7_RAZ_MASK;
5764 break;
5765
5766 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5767 }
5768
5769 /** @todo SVM nested-guest intercept for DR8-DR15? */
5770 /*
5771 * Check for any SVM nested-guest intercepts for the DRx write.
5772 */
5773 if (IEM_IS_SVM_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
5774 {
5775 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
5776 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
5777 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
5778 }
5779
5780 /*
5781 * Do the actual setting.
5782 */
5783 if (!IEM_VERIFICATION_ENABLED(pVCpu))
5784 {
5785 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
5786 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
5787 }
5788 else
5789 pCtx->dr[iDrReg] = uNewDrX;
5790
5791 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5792 return VINF_SUCCESS;
5793}
5794
5795
5796/**
5797 * Implements 'INVLPG m'.
5798 *
5799 * @param GCPtrPage The effective address of the page to invalidate.
5800 * @remarks Updates the RIP.
5801 */
5802IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
5803{
5804 /* ring-0 only. */
5805 if (pVCpu->iem.s.uCpl != 0)
5806 return iemRaiseGeneralProtectionFault0(pVCpu);
5807 Assert(!IEM_GET_CTX(pVCpu)->eflags.Bits.u1VM);
5808
5809 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
5810 {
5811 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
5812 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_INVLPG,
5813 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
5814 }
5815
5816 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
5817 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5818
5819 if (rc == VINF_SUCCESS)
5820 return VINF_SUCCESS;
5821 if (rc == VINF_PGM_SYNC_CR3)
5822 return iemSetPassUpStatus(pVCpu, rc);
5823
5824 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
5825 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
5826 return rc;
5827}
5828
5829
5830/**
5831 * Implements INVPCID.
5832 *
5833 * @param uInvpcidType The invalidation type.
5834 * @param GCPtrInvpcidDesc The effective address of invpcid descriptor.
5835 * @remarks Updates the RIP.
5836 */
5837IEM_CIMPL_DEF_2(iemCImpl_invpcid, uint64_t, uInvpcidType, RTGCPTR, GCPtrInvpcidDesc)
5838{
5839 /*
5840 * Check preconditions.
5841 */
5842 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
5843 return iemRaiseUndefinedOpcode(pVCpu);
5844 if (pVCpu->iem.s.uCpl != 0)
5845 {
5846 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
5847 return iemRaiseGeneralProtectionFault0(pVCpu);
5848 }
5849 if (IEM_IS_V86_MODE(pVCpu))
5850 {
5851 Log(("invpcid: v8086 mode -> #GP(0)\n"));
5852 return iemRaiseGeneralProtectionFault0(pVCpu);
5853 }
5854 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
5855 {
5856 Log(("invpcid: invalid/unrecognized invpcid type %#x -> #GP(0)\n", uInvpcidType));
5857 return iemRaiseGeneralProtectionFault0(pVCpu);
5858 }
5859
5860 /*
5861 * Fetch the invpcid descriptor from guest memory.
5862 */
5863 RTUINT128U uDesc;
5864 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, pVCpu->iem.s.iEffSeg, GCPtrInvpcidDesc);
5865 if (rcStrict == VINF_SUCCESS)
5866 {
5867 /*
5868 * Validate the descriptor.
5869 */
5870 if (uDesc.s.Lo > 0xfff)
5871 {
5872 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
5873 return iemRaiseGeneralProtectionFault0(pVCpu);
5874 }
5875
5876 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
5877 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
5878 uint32_t const uCr4 = IEM_GET_CTX(pVCpu)->cr4;
5879 uint64_t const uCr3 = IEM_GET_CTX(pVCpu)->cr3;
5880 switch (uInvpcidType)
5881 {
5882 case X86_INVPCID_TYPE_INDV_ADDR:
5883 {
5884 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
5885 {
5886 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
5887 return iemRaiseGeneralProtectionFault0(pVCpu);
5888 }
5889 if ( !(uCr4 & X86_CR4_PCIDE)
5890 && uPcid != 0)
5891 {
5892 Log(("invpcid: invalid pcid %#x\n", uPcid));
5893 return iemRaiseGeneralProtectionFault0(pVCpu);
5894 }
5895
5896 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
5897 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5898 break;
5899 }
5900
5901 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
5902 {
5903 if ( !(uCr4 & X86_CR4_PCIDE)
5904 && uPcid != 0)
5905 {
5906 Log(("invpcid: invalid pcid %#x\n", uPcid));
5907 return iemRaiseGeneralProtectionFault0(pVCpu);
5908 }
5909 /* Invalidate all mappings associated with PCID except global translations. */
5910 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5911 break;
5912 }
5913
5914 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
5915 {
5916 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
5917 break;
5918 }
5919
5920 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
5921 {
5922 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
5923 break;
5924 }
5925 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5926 }
5927 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5928 }
5929 return rcStrict;
5930}
5931
5932
5933/**
5934 * Implements RDTSC.
5935 */
5936IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
5937{
5938 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5939
5940 /*
5941 * Check preconditions.
5942 */
5943 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
5944 return iemRaiseUndefinedOpcode(pVCpu);
5945
5946 if ( (pCtx->cr4 & X86_CR4_TSD)
5947 && pVCpu->iem.s.uCpl != 0)
5948 {
5949 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5950 return iemRaiseGeneralProtectionFault0(pVCpu);
5951 }
5952
5953 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
5954 {
5955 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
5956 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5957 }
5958
5959 /*
5960 * Do the job.
5961 */
5962 uint64_t uTicks = TMCpuTickGet(pVCpu);
5963#ifdef VBOX_WITH_NESTED_HWVIRT
5964 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
5965#endif
5966 pCtx->rax = RT_LO_U32(uTicks);
5967 pCtx->rdx = RT_HI_U32(uTicks);
5968#ifdef IEM_VERIFICATION_MODE_FULL
5969 pVCpu->iem.s.fIgnoreRaxRdx = true;
5970#endif
5971
5972 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5973 return VINF_SUCCESS;
5974}
5975
5976
5977/**
5978 * Implements RDTSC.
5979 */
5980IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
5981{
5982 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
5983
5984 /*
5985 * Check preconditions.
5986 */
5987 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
5988 return iemRaiseUndefinedOpcode(pVCpu);
5989
5990 if ( (pCtx->cr4 & X86_CR4_TSD)
5991 && pVCpu->iem.s.uCpl != 0)
5992 {
5993 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
5994 return iemRaiseGeneralProtectionFault0(pVCpu);
5995 }
5996
5997 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
5998 {
5999 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6000 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6001 }
6002
6003 /*
6004 * Do the job.
6005 * Query the MSR first in case of trips to ring-3.
6006 */
6007 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pCtx->rcx);
6008 if (rcStrict == VINF_SUCCESS)
6009 {
6010 /* Low dword of the TSC_AUX msr only. */
6011 pCtx->rcx &= UINT32_C(0xffffffff);
6012
6013 uint64_t uTicks = TMCpuTickGet(pVCpu);
6014#ifdef VBOX_WITH_NESTED_HWVIRT
6015 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6016#endif
6017 pCtx->rax = RT_LO_U32(uTicks);
6018 pCtx->rdx = RT_HI_U32(uTicks);
6019#ifdef IEM_VERIFICATION_MODE_FULL
6020 pVCpu->iem.s.fIgnoreRaxRdx = true;
6021#endif
6022 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6023 }
6024 return rcStrict;
6025}
6026
6027
6028/**
6029 * Implements RDPMC.
6030 */
6031IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
6032{
6033 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6034 if ( pVCpu->iem.s.uCpl != 0
6035 && !(pCtx->cr4 & X86_CR4_PCE))
6036 return iemRaiseGeneralProtectionFault0(pVCpu);
6037
6038 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
6039 {
6040 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
6041 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6042 }
6043
6044 /** @todo Implement RDPMC for the regular guest execution case (the above only
6045 * handles nested-guest intercepts). */
6046 RT_NOREF(cbInstr);
6047 return VERR_IEM_INSTR_NOT_IMPLEMENTED;
6048}
6049
6050
6051/**
6052 * Implements RDMSR.
6053 */
6054IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
6055{
6056 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6057
6058 /*
6059 * Check preconditions.
6060 */
6061 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6062 return iemRaiseUndefinedOpcode(pVCpu);
6063 if (pVCpu->iem.s.uCpl != 0)
6064 return iemRaiseGeneralProtectionFault0(pVCpu);
6065
6066 /*
6067 * Do the job.
6068 */
6069 RTUINT64U uValue;
6070 VBOXSTRICTRC rcStrict;
6071#ifdef VBOX_WITH_NESTED_HWVIRT
6072 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6073 {
6074 rcStrict = iemSvmHandleMsrIntercept(pVCpu, pCtx, pCtx->ecx, false /* fWrite */);
6075 if (rcStrict == VINF_SVM_VMEXIT)
6076 return VINF_SUCCESS;
6077 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6078 {
6079 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pCtx->ecx, VBOXSTRICTRC_VAL(rcStrict)));
6080 return rcStrict;
6081 }
6082 }
6083#endif
6084
6085 rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
6086 if (rcStrict == VINF_SUCCESS)
6087 {
6088 pCtx->rax = uValue.s.Lo;
6089 pCtx->rdx = uValue.s.Hi;
6090
6091 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6092 return VINF_SUCCESS;
6093 }
6094
6095#ifndef IN_RING3
6096 /* Deferred to ring-3. */
6097 if (rcStrict == VINF_CPUM_R3_MSR_READ)
6098 {
6099 Log(("IEM: rdmsr(%#x) -> ring-3\n", pCtx->ecx));
6100 return rcStrict;
6101 }
6102#else /* IN_RING3 */
6103 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6104 static uint32_t s_cTimes = 0;
6105 if (s_cTimes++ < 10)
6106 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
6107 else
6108#endif
6109 Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
6110 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6111 return iemRaiseGeneralProtectionFault0(pVCpu);
6112}
6113
6114
6115/**
6116 * Implements WRMSR.
6117 */
6118IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
6119{
6120 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6121
6122 /*
6123 * Check preconditions.
6124 */
6125 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6126 return iemRaiseUndefinedOpcode(pVCpu);
6127 if (pVCpu->iem.s.uCpl != 0)
6128 return iemRaiseGeneralProtectionFault0(pVCpu);
6129
6130 /*
6131 * Do the job.
6132 */
6133 RTUINT64U uValue;
6134 uValue.s.Lo = pCtx->eax;
6135 uValue.s.Hi = pCtx->edx;
6136
6137 VBOXSTRICTRC rcStrict;
6138#ifdef VBOX_WITH_NESTED_HWVIRT
6139 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6140 {
6141 rcStrict = iemSvmHandleMsrIntercept(pVCpu, pCtx, pCtx->ecx, true /* fWrite */);
6142 if (rcStrict == VINF_SVM_VMEXIT)
6143 return VINF_SUCCESS;
6144 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6145 {
6146 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pCtx->ecx, VBOXSTRICTRC_VAL(rcStrict)));
6147 return rcStrict;
6148 }
6149 }
6150#endif
6151
6152 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6153 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
6154 else
6155 {
6156#ifdef IN_RING3
6157 CPUMCTX CtxTmp = *pCtx;
6158 rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
6159 PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
6160 *pCtx = *pCtx2;
6161 *pCtx2 = CtxTmp;
6162#else
6163 AssertReleaseFailedReturn(VERR_IEM_IPE_2);
6164#endif
6165 }
6166 if (rcStrict == VINF_SUCCESS)
6167 {
6168 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6169 return VINF_SUCCESS;
6170 }
6171
6172#ifndef IN_RING3
6173 /* Deferred to ring-3. */
6174 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
6175 {
6176 Log(("IEM: wrmsr(%#x) -> ring-3\n", pCtx->ecx));
6177 return rcStrict;
6178 }
6179#else /* IN_RING3 */
6180 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6181 static uint32_t s_cTimes = 0;
6182 if (s_cTimes++ < 10)
6183 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
6184 else
6185#endif
6186 Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
6187 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6188 return iemRaiseGeneralProtectionFault0(pVCpu);
6189}
6190
6191
6192/**
6193 * Implements 'IN eAX, port'.
6194 *
6195 * @param u16Port The source port.
6196 * @param cbReg The register size.
6197 */
6198IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
6199{
6200 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6201
6202 /*
6203 * CPL check
6204 */
6205 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
6206 if (rcStrict != VINF_SUCCESS)
6207 return rcStrict;
6208
6209 /*
6210 * Check SVM nested-guest IO intercept.
6211 */
6212#ifdef VBOX_WITH_NESTED_HWVIRT
6213 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6214 {
6215 uint8_t cAddrSizeBits;
6216 switch (pVCpu->iem.s.enmEffAddrMode)
6217 {
6218 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6219 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6220 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6221 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6222 }
6223 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6224 false /* fRep */, false /* fStrIo */, cbInstr);
6225 if (rcStrict == VINF_SVM_VMEXIT)
6226 return VINF_SUCCESS;
6227 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6228 {
6229 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6230 VBOXSTRICTRC_VAL(rcStrict)));
6231 return rcStrict;
6232 }
6233 }
6234#endif
6235
6236 /*
6237 * Perform the I/O.
6238 */
6239 uint32_t u32Value;
6240 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6241 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
6242 else
6243 rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
6244 if (IOM_SUCCESS(rcStrict))
6245 {
6246 switch (cbReg)
6247 {
6248 case 1: pCtx->al = (uint8_t)u32Value; break;
6249 case 2: pCtx->ax = (uint16_t)u32Value; break;
6250 case 4: pCtx->rax = u32Value; break;
6251 default: AssertFailedReturn(VERR_IEM_IPE_3);
6252 }
6253 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6254 pVCpu->iem.s.cPotentialExits++;
6255 if (rcStrict != VINF_SUCCESS)
6256 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6257 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
6258
6259 /*
6260 * Check for I/O breakpoints.
6261 */
6262 uint32_t const uDr7 = pCtx->dr[7];
6263 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
6264 && X86_DR7_ANY_RW_IO(uDr7)
6265 && (pCtx->cr4 & X86_CR4_DE))
6266 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
6267 {
6268 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
6269 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
6270 rcStrict = iemRaiseDebugException(pVCpu);
6271 }
6272 }
6273
6274 return rcStrict;
6275}
6276
6277
6278/**
6279 * Implements 'IN eAX, DX'.
6280 *
6281 * @param cbReg The register size.
6282 */
6283IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
6284{
6285 return IEM_CIMPL_CALL_2(iemCImpl_in, IEM_GET_CTX(pVCpu)->dx, cbReg);
6286}
6287
6288
6289/**
6290 * Implements 'OUT port, eAX'.
6291 *
6292 * @param u16Port The destination port.
6293 * @param cbReg The register size.
6294 */
6295IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
6296{
6297 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6298
6299 /*
6300 * CPL check
6301 */
6302 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
6303 if (rcStrict != VINF_SUCCESS)
6304 return rcStrict;
6305
6306 /*
6307 * Check SVM nested-guest IO intercept.
6308 */
6309#ifdef VBOX_WITH_NESTED_HWVIRT
6310 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6311 {
6312 uint8_t cAddrSizeBits;
6313 switch (pVCpu->iem.s.enmEffAddrMode)
6314 {
6315 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6316 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6317 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6318 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6319 }
6320 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6321 false /* fRep */, false /* fStrIo */, cbInstr);
6322 if (rcStrict == VINF_SVM_VMEXIT)
6323 return VINF_SUCCESS;
6324 if (rcStrict != VINF_HM_INTERCEPT_NOT_ACTIVE)
6325 {
6326 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6327 VBOXSTRICTRC_VAL(rcStrict)));
6328 return rcStrict;
6329 }
6330 }
6331#endif
6332
6333 /*
6334 * Perform the I/O.
6335 */
6336 uint32_t u32Value;
6337 switch (cbReg)
6338 {
6339 case 1: u32Value = pCtx->al; break;
6340 case 2: u32Value = pCtx->ax; break;
6341 case 4: u32Value = pCtx->eax; break;
6342 default: AssertFailedReturn(VERR_IEM_IPE_4);
6343 }
6344 if (!IEM_VERIFICATION_ENABLED(pVCpu))
6345 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
6346 else
6347 rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
6348 if (IOM_SUCCESS(rcStrict))
6349 {
6350 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6351 pVCpu->iem.s.cPotentialExits++;
6352 if (rcStrict != VINF_SUCCESS)
6353 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6354 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
6355
6356 /*
6357 * Check for I/O breakpoints.
6358 */
6359 uint32_t const uDr7 = pCtx->dr[7];
6360 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
6361 && X86_DR7_ANY_RW_IO(uDr7)
6362 && (pCtx->cr4 & X86_CR4_DE))
6363 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
6364 {
6365 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
6366 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
6367 rcStrict = iemRaiseDebugException(pVCpu);
6368 }
6369 }
6370 return rcStrict;
6371}
6372
6373
6374/**
6375 * Implements 'OUT DX, eAX'.
6376 *
6377 * @param cbReg The register size.
6378 */
6379IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
6380{
6381 return IEM_CIMPL_CALL_2(iemCImpl_out, IEM_GET_CTX(pVCpu)->dx, cbReg);
6382}
6383
6384
6385/**
6386 * Implements 'CLI'.
6387 */
6388IEM_CIMPL_DEF_0(iemCImpl_cli)
6389{
6390 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6391 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6392 uint32_t const fEflOld = fEfl;
6393 if (pCtx->cr0 & X86_CR0_PE)
6394 {
6395 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6396 if (!(fEfl & X86_EFL_VM))
6397 {
6398 if (pVCpu->iem.s.uCpl <= uIopl)
6399 fEfl &= ~X86_EFL_IF;
6400 else if ( pVCpu->iem.s.uCpl == 3
6401 && (pCtx->cr4 & X86_CR4_PVI) )
6402 fEfl &= ~X86_EFL_VIF;
6403 else
6404 return iemRaiseGeneralProtectionFault0(pVCpu);
6405 }
6406 /* V8086 */
6407 else if (uIopl == 3)
6408 fEfl &= ~X86_EFL_IF;
6409 else if ( uIopl < 3
6410 && (pCtx->cr4 & X86_CR4_VME) )
6411 fEfl &= ~X86_EFL_VIF;
6412 else
6413 return iemRaiseGeneralProtectionFault0(pVCpu);
6414 }
6415 /* real mode */
6416 else
6417 fEfl &= ~X86_EFL_IF;
6418
6419 /* Commit. */
6420 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6421 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6422 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
6423 return VINF_SUCCESS;
6424}
6425
6426
6427/**
6428 * Implements 'STI'.
6429 */
6430IEM_CIMPL_DEF_0(iemCImpl_sti)
6431{
6432 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6433 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
6434 uint32_t const fEflOld = fEfl;
6435
6436 if (pCtx->cr0 & X86_CR0_PE)
6437 {
6438 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
6439 if (!(fEfl & X86_EFL_VM))
6440 {
6441 if (pVCpu->iem.s.uCpl <= uIopl)
6442 fEfl |= X86_EFL_IF;
6443 else if ( pVCpu->iem.s.uCpl == 3
6444 && (pCtx->cr4 & X86_CR4_PVI)
6445 && !(fEfl & X86_EFL_VIP) )
6446 fEfl |= X86_EFL_VIF;
6447 else
6448 return iemRaiseGeneralProtectionFault0(pVCpu);
6449 }
6450 /* V8086 */
6451 else if (uIopl == 3)
6452 fEfl |= X86_EFL_IF;
6453 else if ( uIopl < 3
6454 && (pCtx->cr4 & X86_CR4_VME)
6455 && !(fEfl & X86_EFL_VIP) )
6456 fEfl |= X86_EFL_VIF;
6457 else
6458 return iemRaiseGeneralProtectionFault0(pVCpu);
6459 }
6460 /* real mode */
6461 else
6462 fEfl |= X86_EFL_IF;
6463
6464 /* Commit. */
6465 IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
6466 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6467 if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
6468 EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
6469 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
6470 return VINF_SUCCESS;
6471}
6472
6473
6474/**
6475 * Implements 'HLT'.
6476 */
6477IEM_CIMPL_DEF_0(iemCImpl_hlt)
6478{
6479 if (pVCpu->iem.s.uCpl != 0)
6480 return iemRaiseGeneralProtectionFault0(pVCpu);
6481
6482 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
6483 {
6484 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
6485 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6486 }
6487
6488 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6489 return VINF_EM_HALT;
6490}
6491
6492
6493/**
6494 * Implements 'MONITOR'.
6495 */
6496IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
6497{
6498 /*
6499 * Permission checks.
6500 */
6501 if (pVCpu->iem.s.uCpl != 0)
6502 {
6503 Log2(("monitor: CPL != 0\n"));
6504 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
6505 }
6506 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6507 {
6508 Log2(("monitor: Not in CPUID\n"));
6509 return iemRaiseUndefinedOpcode(pVCpu);
6510 }
6511
6512 /*
6513 * Gather the operands and validate them.
6514 */
6515 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6516 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
6517 uint32_t uEcx = pCtx->ecx;
6518 uint32_t uEdx = pCtx->edx;
6519/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
6520 * \#GP first. */
6521 if (uEcx != 0)
6522 {
6523 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
6524 return iemRaiseGeneralProtectionFault0(pVCpu);
6525 }
6526
6527 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
6528 if (rcStrict != VINF_SUCCESS)
6529 return rcStrict;
6530
6531 RTGCPHYS GCPhysMem;
6532 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
6533 if (rcStrict != VINF_SUCCESS)
6534 return rcStrict;
6535
6536 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
6537 {
6538 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
6539 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6540 }
6541
6542 /*
6543 * Call EM to prepare the monitor/wait.
6544 */
6545 rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
6546 Assert(rcStrict == VINF_SUCCESS);
6547
6548 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6549 return rcStrict;
6550}
6551
6552
6553/**
6554 * Implements 'MWAIT'.
6555 */
6556IEM_CIMPL_DEF_0(iemCImpl_mwait)
6557{
6558 /*
6559 * Permission checks.
6560 */
6561 if (pVCpu->iem.s.uCpl != 0)
6562 {
6563 Log2(("mwait: CPL != 0\n"));
6564 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
6565 * EFLAGS.VM then.) */
6566 return iemRaiseUndefinedOpcode(pVCpu);
6567 }
6568 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
6569 {
6570 Log2(("mwait: Not in CPUID\n"));
6571 return iemRaiseUndefinedOpcode(pVCpu);
6572 }
6573
6574 /*
6575 * Gather the operands and validate them.
6576 */
6577 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6578 uint32_t uEax = pCtx->eax;
6579 uint32_t uEcx = pCtx->ecx;
6580 if (uEcx != 0)
6581 {
6582 /* Only supported extension is break on IRQ when IF=0. */
6583 if (uEcx > 1)
6584 {
6585 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
6586 return iemRaiseGeneralProtectionFault0(pVCpu);
6587 }
6588 uint32_t fMWaitFeatures = 0;
6589 uint32_t uIgnore = 0;
6590 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
6591 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6592 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
6593 {
6594 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
6595 return iemRaiseGeneralProtectionFault0(pVCpu);
6596 }
6597 }
6598
6599 /*
6600 * Check SVM nested-guest mwait intercepts.
6601 */
6602 if ( IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
6603 && EMMonitorIsArmed(pVCpu))
6604 {
6605 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
6606 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6607 }
6608 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
6609 {
6610 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
6611 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6612 }
6613
6614 /*
6615 * Call EM to prepare the monitor/wait.
6616 */
6617 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
6618
6619 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6620 return rcStrict;
6621}
6622
6623
6624/**
6625 * Implements 'SWAPGS'.
6626 */
6627IEM_CIMPL_DEF_0(iemCImpl_swapgs)
6628{
6629 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
6630
6631 /*
6632 * Permission checks.
6633 */
6634 if (pVCpu->iem.s.uCpl != 0)
6635 {
6636 Log2(("swapgs: CPL != 0\n"));
6637 return iemRaiseUndefinedOpcode(pVCpu);
6638 }
6639
6640 /*
6641 * Do the job.
6642 */
6643 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6644 uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
6645 pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
6646 pCtx->gs.u64Base = uOtherGsBase;
6647
6648 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6649 return VINF_SUCCESS;
6650}
6651
6652
6653/**
6654 * Implements 'CPUID'.
6655 */
6656IEM_CIMPL_DEF_0(iemCImpl_cpuid)
6657{
6658 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6659
6660 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
6661 {
6662 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
6663 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6664 }
6665
6666 CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
6667 pCtx->rax &= UINT32_C(0xffffffff);
6668 pCtx->rbx &= UINT32_C(0xffffffff);
6669 pCtx->rcx &= UINT32_C(0xffffffff);
6670 pCtx->rdx &= UINT32_C(0xffffffff);
6671
6672 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6673 return VINF_SUCCESS;
6674}
6675
6676
6677/**
6678 * Implements 'AAD'.
6679 *
6680 * @param bImm The immediate operand.
6681 */
6682IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
6683{
6684 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6685
6686 uint16_t const ax = pCtx->ax;
6687 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
6688 pCtx->ax = al;
6689 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6690 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6691 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6692
6693 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6694 return VINF_SUCCESS;
6695}
6696
6697
6698/**
6699 * Implements 'AAM'.
6700 *
6701 * @param bImm The immediate operand. Cannot be 0.
6702 */
6703IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
6704{
6705 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6706 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
6707
6708 uint16_t const ax = pCtx->ax;
6709 uint8_t const al = (uint8_t)ax % bImm;
6710 uint8_t const ah = (uint8_t)ax / bImm;
6711 pCtx->ax = (ah << 8) + al;
6712 iemHlpUpdateArithEFlagsU8(pVCpu, al,
6713 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
6714 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
6715
6716 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6717 return VINF_SUCCESS;
6718}
6719
6720
6721/**
6722 * Implements 'DAA'.
6723 */
6724IEM_CIMPL_DEF_0(iemCImpl_daa)
6725{
6726 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6727
6728 uint8_t const al = pCtx->al;
6729 bool const fCarry = pCtx->eflags.Bits.u1CF;
6730
6731 if ( pCtx->eflags.Bits.u1AF
6732 || (al & 0xf) >= 10)
6733 {
6734 pCtx->al = al + 6;
6735 pCtx->eflags.Bits.u1AF = 1;
6736 }
6737 else
6738 pCtx->eflags.Bits.u1AF = 0;
6739
6740 if (al >= 0x9a || fCarry)
6741 {
6742 pCtx->al += 0x60;
6743 pCtx->eflags.Bits.u1CF = 1;
6744 }
6745 else
6746 pCtx->eflags.Bits.u1CF = 0;
6747
6748 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6749 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6750 return VINF_SUCCESS;
6751}
6752
6753
6754/**
6755 * Implements 'DAS'.
6756 */
6757IEM_CIMPL_DEF_0(iemCImpl_das)
6758{
6759 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6760
6761 uint8_t const uInputAL = pCtx->al;
6762 bool const fCarry = pCtx->eflags.Bits.u1CF;
6763
6764 if ( pCtx->eflags.Bits.u1AF
6765 || (uInputAL & 0xf) >= 10)
6766 {
6767 pCtx->eflags.Bits.u1AF = 1;
6768 if (uInputAL < 6)
6769 pCtx->eflags.Bits.u1CF = 1;
6770 pCtx->al = uInputAL - 6;
6771 }
6772 else
6773 {
6774 pCtx->eflags.Bits.u1AF = 0;
6775 pCtx->eflags.Bits.u1CF = 0;
6776 }
6777
6778 if (uInputAL >= 0x9a || fCarry)
6779 {
6780 pCtx->al -= 0x60;
6781 pCtx->eflags.Bits.u1CF = 1;
6782 }
6783
6784 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6785 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6786 return VINF_SUCCESS;
6787}
6788
6789
6790/**
6791 * Implements 'AAA'.
6792 */
6793IEM_CIMPL_DEF_0(iemCImpl_aaa)
6794{
6795 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6796
6797 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
6798 {
6799 if ( pCtx->eflags.Bits.u1AF
6800 || (pCtx->ax & 0xf) >= 10)
6801 {
6802 iemAImpl_add_u16(&pCtx->ax, 0x106, &pCtx->eflags.u32);
6803 pCtx->eflags.Bits.u1AF = 1;
6804 pCtx->eflags.Bits.u1CF = 1;
6805#ifdef IEM_VERIFICATION_MODE_FULL
6806 pVCpu->iem.s.fUndefinedEFlags |= X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF;
6807#endif
6808 }
6809 else
6810 {
6811 iemHlpUpdateArithEFlagsU16(pVCpu, pCtx->ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6812 pCtx->eflags.Bits.u1AF = 0;
6813 pCtx->eflags.Bits.u1CF = 0;
6814 }
6815 pCtx->ax &= UINT16_C(0xff0f);
6816 }
6817 else
6818 {
6819 if ( pCtx->eflags.Bits.u1AF
6820 || (pCtx->ax & 0xf) >= 10)
6821 {
6822 pCtx->ax += UINT16_C(0x106);
6823 pCtx->eflags.Bits.u1AF = 1;
6824 pCtx->eflags.Bits.u1CF = 1;
6825 }
6826 else
6827 {
6828 pCtx->eflags.Bits.u1AF = 0;
6829 pCtx->eflags.Bits.u1CF = 0;
6830 }
6831 pCtx->ax &= UINT16_C(0xff0f);
6832 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6833 }
6834
6835 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6836 return VINF_SUCCESS;
6837}
6838
6839
6840/**
6841 * Implements 'AAS'.
6842 */
6843IEM_CIMPL_DEF_0(iemCImpl_aas)
6844{
6845 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6846
6847 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
6848 {
6849 if ( pCtx->eflags.Bits.u1AF
6850 || (pCtx->ax & 0xf) >= 10)
6851 {
6852 iemAImpl_sub_u16(&pCtx->ax, 0x106, &pCtx->eflags.u32);
6853 pCtx->eflags.Bits.u1AF = 1;
6854 pCtx->eflags.Bits.u1CF = 1;
6855#ifdef IEM_VERIFICATION_MODE_FULL
6856 pVCpu->iem.s.fUndefinedEFlags |= X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF;
6857#endif
6858 }
6859 else
6860 {
6861 iemHlpUpdateArithEFlagsU16(pVCpu, pCtx->ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6862 pCtx->eflags.Bits.u1AF = 0;
6863 pCtx->eflags.Bits.u1CF = 0;
6864 }
6865 pCtx->ax &= UINT16_C(0xff0f);
6866 }
6867 else
6868 {
6869 if ( pCtx->eflags.Bits.u1AF
6870 || (pCtx->ax & 0xf) >= 10)
6871 {
6872 pCtx->ax -= UINT16_C(0x106);
6873 pCtx->eflags.Bits.u1AF = 1;
6874 pCtx->eflags.Bits.u1CF = 1;
6875 }
6876 else
6877 {
6878 pCtx->eflags.Bits.u1AF = 0;
6879 pCtx->eflags.Bits.u1CF = 0;
6880 }
6881 pCtx->ax &= UINT16_C(0xff0f);
6882 iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
6883 }
6884
6885 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6886 return VINF_SUCCESS;
6887}
6888
6889
6890/**
6891 * Implements the 16-bit version of 'BOUND'.
6892 *
6893 * @note We have separate 16-bit and 32-bit variants of this function due to
6894 * the decoder using unsigned parameters, whereas we want signed one to
6895 * do the job. This is significant for a recompiler.
6896 */
6897IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
6898{
6899 /*
6900 * Check if the index is inside the bounds, otherwise raise #BR.
6901 */
6902 if ( idxArray >= idxLowerBound
6903 && idxArray <= idxUpperBound)
6904 {
6905 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6906 return VINF_SUCCESS;
6907 }
6908
6909 return iemRaiseBoundRangeExceeded(pVCpu);
6910}
6911
6912
6913/**
6914 * Implements the 32-bit version of 'BOUND'.
6915 */
6916IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
6917{
6918 /*
6919 * Check if the index is inside the bounds, otherwise raise #BR.
6920 */
6921 if ( idxArray >= idxLowerBound
6922 && idxArray <= idxUpperBound)
6923 {
6924 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6925 return VINF_SUCCESS;
6926 }
6927
6928 return iemRaiseBoundRangeExceeded(pVCpu);
6929}
6930
6931
6932
6933/*
6934 * Instantiate the various string operation combinations.
6935 */
6936#define OP_SIZE 8
6937#define ADDR_SIZE 16
6938#include "IEMAllCImplStrInstr.cpp.h"
6939#define OP_SIZE 8
6940#define ADDR_SIZE 32
6941#include "IEMAllCImplStrInstr.cpp.h"
6942#define OP_SIZE 8
6943#define ADDR_SIZE 64
6944#include "IEMAllCImplStrInstr.cpp.h"
6945
6946#define OP_SIZE 16
6947#define ADDR_SIZE 16
6948#include "IEMAllCImplStrInstr.cpp.h"
6949#define OP_SIZE 16
6950#define ADDR_SIZE 32
6951#include "IEMAllCImplStrInstr.cpp.h"
6952#define OP_SIZE 16
6953#define ADDR_SIZE 64
6954#include "IEMAllCImplStrInstr.cpp.h"
6955
6956#define OP_SIZE 32
6957#define ADDR_SIZE 16
6958#include "IEMAllCImplStrInstr.cpp.h"
6959#define OP_SIZE 32
6960#define ADDR_SIZE 32
6961#include "IEMAllCImplStrInstr.cpp.h"
6962#define OP_SIZE 32
6963#define ADDR_SIZE 64
6964#include "IEMAllCImplStrInstr.cpp.h"
6965
6966#define OP_SIZE 64
6967#define ADDR_SIZE 32
6968#include "IEMAllCImplStrInstr.cpp.h"
6969#define OP_SIZE 64
6970#define ADDR_SIZE 64
6971#include "IEMAllCImplStrInstr.cpp.h"
6972
6973
6974/**
6975 * Implements 'XGETBV'.
6976 */
6977IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
6978{
6979 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
6980 if (pCtx->cr4 & X86_CR4_OSXSAVE)
6981 {
6982 uint32_t uEcx = pCtx->ecx;
6983 switch (uEcx)
6984 {
6985 case 0:
6986 break;
6987
6988 case 1: /** @todo Implement XCR1 support. */
6989 default:
6990 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
6991 return iemRaiseGeneralProtectionFault0(pVCpu);
6992
6993 }
6994 pCtx->rax = RT_LO_U32(pCtx->aXcr[uEcx]);
6995 pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
6996
6997 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6998 return VINF_SUCCESS;
6999 }
7000 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
7001 return iemRaiseUndefinedOpcode(pVCpu);
7002}
7003
7004
7005/**
7006 * Implements 'XSETBV'.
7007 */
7008IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
7009{
7010 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7011 if (pCtx->cr4 & X86_CR4_OSXSAVE)
7012 {
7013 if (IEM_IS_SVM_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
7014 {
7015 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
7016 IEM_RETURN_SVM_VMEXIT(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7017 }
7018
7019 if (pVCpu->iem.s.uCpl == 0)
7020 {
7021 uint32_t uEcx = pCtx->ecx;
7022 uint64_t uNewValue = RT_MAKE_U64(pCtx->eax, pCtx->edx);
7023 switch (uEcx)
7024 {
7025 case 0:
7026 {
7027 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
7028 if (rc == VINF_SUCCESS)
7029 break;
7030 Assert(rc == VERR_CPUM_RAISE_GP_0);
7031 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7032 return iemRaiseGeneralProtectionFault0(pVCpu);
7033 }
7034
7035 case 1: /** @todo Implement XCR1 support. */
7036 default:
7037 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7038 return iemRaiseGeneralProtectionFault0(pVCpu);
7039
7040 }
7041
7042 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7043 return VINF_SUCCESS;
7044 }
7045
7046 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
7047 return iemRaiseGeneralProtectionFault0(pVCpu);
7048 }
7049 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
7050 return iemRaiseUndefinedOpcode(pVCpu);
7051}
7052
7053#ifdef IN_RING3
7054
7055/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
7056struct IEMCIMPLCX16ARGS
7057{
7058 PRTUINT128U pu128Dst;
7059 PRTUINT128U pu128RaxRdx;
7060 PRTUINT128U pu128RbxRcx;
7061 uint32_t *pEFlags;
7062# ifdef VBOX_STRICT
7063 uint32_t cCalls;
7064# endif
7065};
7066
7067/**
7068 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
7069 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
7070 */
7071static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPU pVCpu, void *pvUser)
7072{
7073 RT_NOREF(pVM, pVCpu);
7074 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
7075# ifdef VBOX_STRICT
7076 Assert(pArgs->cCalls == 0);
7077 pArgs->cCalls++;
7078# endif
7079
7080 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
7081 return VINF_SUCCESS;
7082}
7083
7084#endif /* IN_RING3 */
7085
7086/**
7087 * Implements 'CMPXCHG16B' fallback using rendezvous.
7088 */
7089IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
7090 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
7091{
7092#ifdef IN_RING3
7093 struct IEMCIMPLCX16ARGS Args;
7094 Args.pu128Dst = pu128Dst;
7095 Args.pu128RaxRdx = pu128RaxRdx;
7096 Args.pu128RbxRcx = pu128RbxRcx;
7097 Args.pEFlags = pEFlags;
7098# ifdef VBOX_STRICT
7099 Args.cCalls = 0;
7100# endif
7101 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
7102 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
7103 Assert(Args.cCalls == 1);
7104 if (rcStrict == VINF_SUCCESS)
7105 {
7106 /* Duplicated tail code. */
7107 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
7108 if (rcStrict == VINF_SUCCESS)
7109 {
7110 PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
7111 pCtx->eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
7112 if (!(*pEFlags & X86_EFL_ZF))
7113 {
7114 pCtx->rax = pu128RaxRdx->s.Lo;
7115 pCtx->rdx = pu128RaxRdx->s.Hi;
7116 }
7117 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7118 }
7119 }
7120 return rcStrict;
7121#else
7122 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
7123 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
7124#endif
7125}
7126
7127
7128/**
7129 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
7130 *
7131 * This is implemented in C because it triggers a load like behviour without
7132 * actually reading anything. Since that's not so common, it's implemented
7133 * here.
7134 *
7135 * @param iEffSeg The effective segment.
7136 * @param GCPtrEff The address of the image.
7137 */
7138IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7139{
7140 /*
7141 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
7142 */
7143 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
7144 if (rcStrict == VINF_SUCCESS)
7145 {
7146 RTGCPHYS GCPhysMem;
7147 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7148 if (rcStrict == VINF_SUCCESS)
7149 {
7150 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7151 return VINF_SUCCESS;
7152 }
7153 }
7154
7155 return rcStrict;
7156}
7157
7158
7159/**
7160 * Implements 'FINIT' and 'FNINIT'.
7161 *
7162 * @param fCheckXcpts Whether to check for umasked pending exceptions or
7163 * not.
7164 */
7165IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
7166{
7167 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7168
7169 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
7170 return iemRaiseDeviceNotAvailable(pVCpu);
7171
7172 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
7173 if (fCheckXcpts && TODO )
7174 return iemRaiseMathFault(pVCpu);
7175 */
7176
7177 PX86XSAVEAREA pXState = pCtx->CTX_SUFF(pXState);
7178 pXState->x87.FCW = 0x37f;
7179 pXState->x87.FSW = 0;
7180 pXState->x87.FTW = 0x00; /* 0 - empty. */
7181 pXState->x87.FPUDP = 0;
7182 pXState->x87.DS = 0; //??
7183 pXState->x87.Rsrvd2= 0;
7184 pXState->x87.FPUIP = 0;
7185 pXState->x87.CS = 0; //??
7186 pXState->x87.Rsrvd1= 0;
7187 pXState->x87.FOP = 0;
7188
7189 iemHlpUsedFpu(pVCpu);
7190 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7191 return VINF_SUCCESS;
7192}
7193
7194
7195/**
7196 * Implements 'FXSAVE'.
7197 *
7198 * @param iEffSeg The effective segment.
7199 * @param GCPtrEff The address of the image.
7200 * @param enmEffOpSize The operand size (only REX.W really matters).
7201 */
7202IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7203{
7204 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7205
7206 /*
7207 * Raise exceptions.
7208 */
7209 if (pCtx->cr0 & X86_CR0_EM)
7210 return iemRaiseUndefinedOpcode(pVCpu);
7211 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
7212 return iemRaiseDeviceNotAvailable(pVCpu);
7213 if (GCPtrEff & 15)
7214 {
7215 /** @todo CPU/VM detection possible! \#AC might not be signal for
7216 * all/any misalignment sizes, intel says its an implementation detail. */
7217 if ( (pCtx->cr0 & X86_CR0_AM)
7218 && pCtx->eflags.Bits.u1AC
7219 && pVCpu->iem.s.uCpl == 3)
7220 return iemRaiseAlignmentCheckException(pVCpu);
7221 return iemRaiseGeneralProtectionFault0(pVCpu);
7222 }
7223
7224 /*
7225 * Access the memory.
7226 */
7227 void *pvMem512;
7228 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7229 if (rcStrict != VINF_SUCCESS)
7230 return rcStrict;
7231 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7232 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
7233
7234 /*
7235 * Store the registers.
7236 */
7237 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
7238 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
7239
7240 /* common for all formats */
7241 pDst->FCW = pSrc->FCW;
7242 pDst->FSW = pSrc->FSW;
7243 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7244 pDst->FOP = pSrc->FOP;
7245 pDst->MXCSR = pSrc->MXCSR;
7246 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7247 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7248 {
7249 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7250 * them for now... */
7251 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7252 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7253 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7254 pDst->aRegs[i].au32[3] = 0;
7255 }
7256
7257 /* FPU IP, CS, DP and DS. */
7258 pDst->FPUIP = pSrc->FPUIP;
7259 pDst->CS = pSrc->CS;
7260 pDst->FPUDP = pSrc->FPUDP;
7261 pDst->DS = pSrc->DS;
7262 if (enmEffOpSize == IEMMODE_64BIT)
7263 {
7264 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7265 pDst->Rsrvd1 = pSrc->Rsrvd1;
7266 pDst->Rsrvd2 = pSrc->Rsrvd2;
7267 pDst->au32RsrvdForSoftware[0] = 0;
7268 }
7269 else
7270 {
7271 pDst->Rsrvd1 = 0;
7272 pDst->Rsrvd2 = 0;
7273 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
7274 }
7275
7276 /* XMM registers. */
7277 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
7278 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
7279 || pVCpu->iem.s.uCpl != 0)
7280 {
7281 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7282 for (uint32_t i = 0; i < cXmmRegs; i++)
7283 pDst->aXMM[i] = pSrc->aXMM[i];
7284 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7285 * right? */
7286 }
7287
7288 /*
7289 * Commit the memory.
7290 */
7291 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7292 if (rcStrict != VINF_SUCCESS)
7293 return rcStrict;
7294
7295 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7296 return VINF_SUCCESS;
7297}
7298
7299
7300/**
7301 * Implements 'FXRSTOR'.
7302 *
7303 * @param GCPtrEff The address of the image.
7304 * @param enmEffOpSize The operand size (only REX.W really matters).
7305 */
7306IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7307{
7308 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7309
7310 /*
7311 * Raise exceptions.
7312 */
7313 if (pCtx->cr0 & X86_CR0_EM)
7314 return iemRaiseUndefinedOpcode(pVCpu);
7315 if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
7316 return iemRaiseDeviceNotAvailable(pVCpu);
7317 if (GCPtrEff & 15)
7318 {
7319 /** @todo CPU/VM detection possible! \#AC might not be signal for
7320 * all/any misalignment sizes, intel says its an implementation detail. */
7321 if ( (pCtx->cr0 & X86_CR0_AM)
7322 && pCtx->eflags.Bits.u1AC
7323 && pVCpu->iem.s.uCpl == 3)
7324 return iemRaiseAlignmentCheckException(pVCpu);
7325 return iemRaiseGeneralProtectionFault0(pVCpu);
7326 }
7327
7328 /*
7329 * Access the memory.
7330 */
7331 void *pvMem512;
7332 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
7333 if (rcStrict != VINF_SUCCESS)
7334 return rcStrict;
7335 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
7336 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
7337
7338 /*
7339 * Check the state for stuff which will #GP(0).
7340 */
7341 uint32_t const fMXCSR = pSrc->MXCSR;
7342 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7343 if (fMXCSR & ~fMXCSR_MASK)
7344 {
7345 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
7346 return iemRaiseGeneralProtectionFault0(pVCpu);
7347 }
7348
7349 /*
7350 * Load the registers.
7351 */
7352 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
7353 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
7354
7355 /* common for all formats */
7356 pDst->FCW = pSrc->FCW;
7357 pDst->FSW = pSrc->FSW;
7358 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7359 pDst->FOP = pSrc->FOP;
7360 pDst->MXCSR = fMXCSR;
7361 /* (MXCSR_MASK is read-only) */
7362 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7363 {
7364 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7365 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7366 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7367 pDst->aRegs[i].au32[3] = 0;
7368 }
7369
7370 /* FPU IP, CS, DP and DS. */
7371 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
7372 {
7373 pDst->FPUIP = pSrc->FPUIP;
7374 pDst->CS = pSrc->CS;
7375 pDst->Rsrvd1 = pSrc->Rsrvd1;
7376 pDst->FPUDP = pSrc->FPUDP;
7377 pDst->DS = pSrc->DS;
7378 pDst->Rsrvd2 = pSrc->Rsrvd2;
7379 }
7380 else
7381 {
7382 pDst->FPUIP = pSrc->FPUIP;
7383 pDst->CS = pSrc->CS;
7384 pDst->Rsrvd1 = 0;
7385 pDst->FPUDP = pSrc->FPUDP;
7386 pDst->DS = pSrc->DS;
7387 pDst->Rsrvd2 = 0;
7388 }
7389
7390 /* XMM registers. */
7391 if ( !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
7392 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
7393 || pVCpu->iem.s.uCpl != 0)
7394 {
7395 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7396 for (uint32_t i = 0; i < cXmmRegs; i++)
7397 pDst->aXMM[i] = pSrc->aXMM[i];
7398 }
7399
7400 /*
7401 * Commit the memory.
7402 */
7403 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7404 if (rcStrict != VINF_SUCCESS)
7405 return rcStrict;
7406
7407 iemHlpUsedFpu(pVCpu);
7408 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7409 return VINF_SUCCESS;
7410}
7411
7412
7413/**
7414 * Implements 'XSAVE'.
7415 *
7416 * @param iEffSeg The effective segment.
7417 * @param GCPtrEff The address of the image.
7418 * @param enmEffOpSize The operand size (only REX.W really matters).
7419 */
7420IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7421{
7422 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7423
7424 /*
7425 * Raise exceptions.
7426 */
7427 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7428 return iemRaiseUndefinedOpcode(pVCpu);
7429 if (pCtx->cr0 & X86_CR0_TS)
7430 return iemRaiseDeviceNotAvailable(pVCpu);
7431 if (GCPtrEff & 63)
7432 {
7433 /** @todo CPU/VM detection possible! \#AC might not be signal for
7434 * all/any misalignment sizes, intel says its an implementation detail. */
7435 if ( (pCtx->cr0 & X86_CR0_AM)
7436 && pCtx->eflags.Bits.u1AC
7437 && pVCpu->iem.s.uCpl == 3)
7438 return iemRaiseAlignmentCheckException(pVCpu);
7439 return iemRaiseGeneralProtectionFault0(pVCpu);
7440 }
7441
7442 /*
7443 * Calc the requested mask
7444 */
7445 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7446 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7447 uint64_t const fXInUse = pCtx->aXcr[0];
7448
7449/** @todo figure out the exact protocol for the memory access. Currently we
7450 * just need this crap to work halfways to make it possible to test
7451 * AVX instructions. */
7452/** @todo figure out the XINUSE and XMODIFIED */
7453
7454 /*
7455 * Access the x87 memory state.
7456 */
7457 /* The x87+SSE state. */
7458 void *pvMem512;
7459 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7460 if (rcStrict != VINF_SUCCESS)
7461 return rcStrict;
7462 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7463 PCX86FXSTATE pSrc = &pCtx->CTX_SUFF(pXState)->x87;
7464
7465 /* The header. */
7466 PX86XSAVEHDR pHdr;
7467 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW);
7468 if (rcStrict != VINF_SUCCESS)
7469 return rcStrict;
7470
7471 /*
7472 * Store the X87 state.
7473 */
7474 if (fReqComponents & XSAVE_C_X87)
7475 {
7476 /* common for all formats */
7477 pDst->FCW = pSrc->FCW;
7478 pDst->FSW = pSrc->FSW;
7479 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7480 pDst->FOP = pSrc->FOP;
7481 pDst->FPUIP = pSrc->FPUIP;
7482 pDst->CS = pSrc->CS;
7483 pDst->FPUDP = pSrc->FPUDP;
7484 pDst->DS = pSrc->DS;
7485 if (enmEffOpSize == IEMMODE_64BIT)
7486 {
7487 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7488 pDst->Rsrvd1 = pSrc->Rsrvd1;
7489 pDst->Rsrvd2 = pSrc->Rsrvd2;
7490 pDst->au32RsrvdForSoftware[0] = 0;
7491 }
7492 else
7493 {
7494 pDst->Rsrvd1 = 0;
7495 pDst->Rsrvd2 = 0;
7496 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
7497 }
7498 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7499 {
7500 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7501 * them for now... */
7502 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7503 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7504 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7505 pDst->aRegs[i].au32[3] = 0;
7506 }
7507
7508 }
7509
7510 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7511 {
7512 pDst->MXCSR = pSrc->MXCSR;
7513 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7514 }
7515
7516 if (fReqComponents & XSAVE_C_SSE)
7517 {
7518 /* XMM registers. */
7519 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7520 for (uint32_t i = 0; i < cXmmRegs; i++)
7521 pDst->aXMM[i] = pSrc->aXMM[i];
7522 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7523 * right? */
7524 }
7525
7526 /* Commit the x87 state bits. (probably wrong) */
7527 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7528 if (rcStrict != VINF_SUCCESS)
7529 return rcStrict;
7530
7531 /*
7532 * Store AVX state.
7533 */
7534 if (fReqComponents & XSAVE_C_YMM)
7535 {
7536 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7537 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7538 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
7539 PX86XSAVEYMMHI pCompDst;
7540 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT],
7541 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7542 if (rcStrict != VINF_SUCCESS)
7543 return rcStrict;
7544
7545 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7546 for (uint32_t i = 0; i < cXmmRegs; i++)
7547 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
7548
7549 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7550 if (rcStrict != VINF_SUCCESS)
7551 return rcStrict;
7552 }
7553
7554 /*
7555 * Update the header.
7556 */
7557 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
7558 | (fReqComponents & fXInUse);
7559
7560 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
7561 if (rcStrict != VINF_SUCCESS)
7562 return rcStrict;
7563
7564 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7565 return VINF_SUCCESS;
7566}
7567
7568
7569/**
7570 * Implements 'XRSTOR'.
7571 *
7572 * @param iEffSeg The effective segment.
7573 * @param GCPtrEff The address of the image.
7574 * @param enmEffOpSize The operand size (only REX.W really matters).
7575 */
7576IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7577{
7578 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7579
7580 /*
7581 * Raise exceptions.
7582 */
7583 if (!(pCtx->cr4 & X86_CR4_OSXSAVE))
7584 return iemRaiseUndefinedOpcode(pVCpu);
7585 if (pCtx->cr0 & X86_CR0_TS)
7586 return iemRaiseDeviceNotAvailable(pVCpu);
7587 if (GCPtrEff & 63)
7588 {
7589 /** @todo CPU/VM detection possible! \#AC might not be signal for
7590 * all/any misalignment sizes, intel says its an implementation detail. */
7591 if ( (pCtx->cr0 & X86_CR0_AM)
7592 && pCtx->eflags.Bits.u1AC
7593 && pVCpu->iem.s.uCpl == 3)
7594 return iemRaiseAlignmentCheckException(pVCpu);
7595 return iemRaiseGeneralProtectionFault0(pVCpu);
7596 }
7597
7598/** @todo figure out the exact protocol for the memory access. Currently we
7599 * just need this crap to work halfways to make it possible to test
7600 * AVX instructions. */
7601/** @todo figure out the XINUSE and XMODIFIED */
7602
7603 /*
7604 * Access the x87 memory state.
7605 */
7606 /* The x87+SSE state. */
7607 void *pvMem512;
7608 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
7609 if (rcStrict != VINF_SUCCESS)
7610 return rcStrict;
7611 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
7612 PX86FXSTATE pDst = &pCtx->CTX_SUFF(pXState)->x87;
7613
7614 /*
7615 * Calc the requested mask
7616 */
7617 PX86XSAVEHDR pHdrDst = &pCtx->CTX_SUFF(pXState)->Hdr;
7618 PCX86XSAVEHDR pHdrSrc;
7619 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_R);
7620 if (rcStrict != VINF_SUCCESS)
7621 return rcStrict;
7622
7623 uint64_t const fReqComponents = RT_MAKE_U64(pCtx->eax, pCtx->edx) & pCtx->aXcr[0];
7624 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7625 //uint64_t const fXInUse = pCtx->aXcr[0];
7626 uint64_t const fRstorMask = pHdrSrc->bmXState;
7627 uint64_t const fCompMask = pHdrSrc->bmXComp;
7628
7629 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
7630
7631 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
7632
7633 /* We won't need this any longer. */
7634 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
7635 if (rcStrict != VINF_SUCCESS)
7636 return rcStrict;
7637
7638 /*
7639 * Store the X87 state.
7640 */
7641 if (fReqComponents & XSAVE_C_X87)
7642 {
7643 if (fRstorMask & XSAVE_C_X87)
7644 {
7645 pDst->FCW = pSrc->FCW;
7646 pDst->FSW = pSrc->FSW;
7647 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7648 pDst->FOP = pSrc->FOP;
7649 pDst->FPUIP = pSrc->FPUIP;
7650 pDst->CS = pSrc->CS;
7651 pDst->FPUDP = pSrc->FPUDP;
7652 pDst->DS = pSrc->DS;
7653 if (enmEffOpSize == IEMMODE_64BIT)
7654 {
7655 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
7656 pDst->Rsrvd1 = pSrc->Rsrvd1;
7657 pDst->Rsrvd2 = pSrc->Rsrvd2;
7658 }
7659 else
7660 {
7661 pDst->Rsrvd1 = 0;
7662 pDst->Rsrvd2 = 0;
7663 }
7664 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7665 {
7666 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7667 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
7668 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
7669 pDst->aRegs[i].au32[3] = 0;
7670 }
7671 }
7672 else
7673 {
7674 pDst->FCW = 0x37f;
7675 pDst->FSW = 0;
7676 pDst->FTW = 0x00; /* 0 - empty. */
7677 pDst->FPUDP = 0;
7678 pDst->DS = 0; //??
7679 pDst->Rsrvd2= 0;
7680 pDst->FPUIP = 0;
7681 pDst->CS = 0; //??
7682 pDst->Rsrvd1= 0;
7683 pDst->FOP = 0;
7684 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
7685 {
7686 pDst->aRegs[i].au32[0] = 0;
7687 pDst->aRegs[i].au32[1] = 0;
7688 pDst->aRegs[i].au32[2] = 0;
7689 pDst->aRegs[i].au32[3] = 0;
7690 }
7691 }
7692 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
7693 }
7694
7695 /* MXCSR */
7696 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
7697 {
7698 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
7699 pDst->MXCSR = pSrc->MXCSR;
7700 else
7701 pDst->MXCSR = 0x1f80;
7702 }
7703
7704 /* XMM registers. */
7705 if (fReqComponents & XSAVE_C_SSE)
7706 {
7707 if (fRstorMask & XSAVE_C_SSE)
7708 {
7709 for (uint32_t i = 0; i < cXmmRegs; i++)
7710 pDst->aXMM[i] = pSrc->aXMM[i];
7711 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
7712 * right? */
7713 }
7714 else
7715 {
7716 for (uint32_t i = 0; i < cXmmRegs; i++)
7717 {
7718 pDst->aXMM[i].au64[0] = 0;
7719 pDst->aXMM[i].au64[1] = 0;
7720 }
7721 }
7722 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
7723 }
7724
7725 /* Unmap the x87 state bits (so we've don't run out of mapping). */
7726 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
7727 if (rcStrict != VINF_SUCCESS)
7728 return rcStrict;
7729
7730 /*
7731 * Restore AVX state.
7732 */
7733 if (fReqComponents & XSAVE_C_YMM)
7734 {
7735 AssertLogRelReturn(pCtx->aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
7736 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(pCtx, XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
7737
7738 if (fRstorMask & XSAVE_C_YMM)
7739 {
7740 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
7741 PCX86XSAVEYMMHI pCompSrc;
7742 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
7743 iEffSeg, GCPtrEff + pCtx->aoffXState[XSAVE_C_YMM_BIT], IEM_ACCESS_DATA_R);
7744 if (rcStrict != VINF_SUCCESS)
7745 return rcStrict;
7746
7747 for (uint32_t i = 0; i < cXmmRegs; i++)
7748 {
7749 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
7750 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
7751 }
7752
7753 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
7754 if (rcStrict != VINF_SUCCESS)
7755 return rcStrict;
7756 }
7757 else
7758 {
7759 for (uint32_t i = 0; i < cXmmRegs; i++)
7760 {
7761 pCompDst->aYmmHi[i].au64[0] = 0;
7762 pCompDst->aYmmHi[i].au64[1] = 0;
7763 }
7764 }
7765 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
7766 }
7767
7768 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7769 return VINF_SUCCESS;
7770}
7771
7772
7773
7774
7775/**
7776 * Implements 'STMXCSR'.
7777 *
7778 * @param GCPtrEff The address of the image.
7779 */
7780IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7781{
7782 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7783
7784 /*
7785 * Raise exceptions.
7786 */
7787 if ( !(pCtx->cr0 & X86_CR0_EM)
7788 && (pCtx->cr4 & X86_CR4_OSFXSR))
7789 {
7790 if (!(pCtx->cr0 & X86_CR0_TS))
7791 {
7792 /*
7793 * Do the job.
7794 */
7795 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7796 if (rcStrict == VINF_SUCCESS)
7797 {
7798 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7799 return VINF_SUCCESS;
7800 }
7801 return rcStrict;
7802 }
7803 return iemRaiseDeviceNotAvailable(pVCpu);
7804 }
7805 return iemRaiseUndefinedOpcode(pVCpu);
7806}
7807
7808
7809/**
7810 * Implements 'VSTMXCSR'.
7811 *
7812 * @param GCPtrEff The address of the image.
7813 */
7814IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7815{
7816 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7817
7818 /*
7819 * Raise exceptions.
7820 */
7821 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
7822 ? (pCtx->aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
7823 : !(pCtx->cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
7824 && (pCtx->cr4 & X86_CR4_OSXSAVE))
7825 {
7826 if (!(pCtx->cr0 & X86_CR0_TS))
7827 {
7828 /*
7829 * Do the job.
7830 */
7831 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pCtx->CTX_SUFF(pXState)->x87.MXCSR);
7832 if (rcStrict == VINF_SUCCESS)
7833 {
7834 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7835 return VINF_SUCCESS;
7836 }
7837 return rcStrict;
7838 }
7839 return iemRaiseDeviceNotAvailable(pVCpu);
7840 }
7841 return iemRaiseUndefinedOpcode(pVCpu);
7842}
7843
7844
7845/**
7846 * Implements 'LDMXCSR'.
7847 *
7848 * @param GCPtrEff The address of the image.
7849 */
7850IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7851{
7852 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
7853
7854 /*
7855 * Raise exceptions.
7856 */
7857 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
7858 * happen after or before \#UD and \#EM? */
7859 if ( !(pCtx->cr0 & X86_CR0_EM)
7860 && (pCtx->cr4 & X86_CR4_OSFXSR))
7861 {
7862 if (!(pCtx->cr0 & X86_CR0_TS))
7863 {
7864 /*
7865 * Do the job.
7866 */
7867 uint32_t fNewMxCsr;
7868 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
7869 if (rcStrict == VINF_SUCCESS)
7870 {
7871 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7872 if (!(fNewMxCsr & ~fMxCsrMask))
7873 {
7874 pCtx->CTX_SUFF(pXState)->x87.MXCSR = fNewMxCsr;
7875 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7876 return VINF_SUCCESS;
7877 }
7878 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
7879 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
7880 return iemRaiseGeneralProtectionFault0(pVCpu);
7881 }
7882 return rcStrict;
7883 }
7884 return iemRaiseDeviceNotAvailable(pVCpu);
7885 }
7886 return iemRaiseUndefinedOpcode(pVCpu);
7887}
7888
7889
7890/**
7891 * Commmon routine for fnstenv and fnsave.
7892 *
7893 * @param uPtr Where to store the state.
7894 * @param pCtx The CPU context.
7895 */
7896static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
7897{
7898 PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
7899 if (enmEffOpSize == IEMMODE_16BIT)
7900 {
7901 uPtr.pu16[0] = pSrcX87->FCW;
7902 uPtr.pu16[1] = pSrcX87->FSW;
7903 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
7904 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7905 {
7906 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
7907 * protected mode or long mode and we save it in real mode? And vice
7908 * versa? And with 32-bit operand size? I think CPU is storing the
7909 * effective address ((CS << 4) + IP) in the offset register and not
7910 * doing any address calculations here. */
7911 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
7912 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
7913 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
7914 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
7915 }
7916 else
7917 {
7918 uPtr.pu16[3] = pSrcX87->FPUIP;
7919 uPtr.pu16[4] = pSrcX87->CS;
7920 uPtr.pu16[5] = pSrcX87->FPUDP;
7921 uPtr.pu16[6] = pSrcX87->DS;
7922 }
7923 }
7924 else
7925 {
7926 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
7927 uPtr.pu16[0*2] = pSrcX87->FCW;
7928 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
7929 uPtr.pu16[1*2] = pSrcX87->FSW;
7930 uPtr.pu16[1*2+1] = 0xffff;
7931 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
7932 uPtr.pu16[2*2+1] = 0xffff;
7933 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7934 {
7935 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
7936 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
7937 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
7938 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
7939 }
7940 else
7941 {
7942 uPtr.pu32[3] = pSrcX87->FPUIP;
7943 uPtr.pu16[4*2] = pSrcX87->CS;
7944 uPtr.pu16[4*2+1] = pSrcX87->FOP;
7945 uPtr.pu32[5] = pSrcX87->FPUDP;
7946 uPtr.pu16[6*2] = pSrcX87->DS;
7947 uPtr.pu16[6*2+1] = 0xffff;
7948 }
7949 }
7950}
7951
7952
7953/**
7954 * Commmon routine for fldenv and frstor
7955 *
7956 * @param uPtr Where to store the state.
7957 * @param pCtx The CPU context.
7958 */
7959static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
7960{
7961 PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
7962 if (enmEffOpSize == IEMMODE_16BIT)
7963 {
7964 pDstX87->FCW = uPtr.pu16[0];
7965 pDstX87->FSW = uPtr.pu16[1];
7966 pDstX87->FTW = uPtr.pu16[2];
7967 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7968 {
7969 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
7970 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
7971 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
7972 pDstX87->CS = 0;
7973 pDstX87->Rsrvd1= 0;
7974 pDstX87->DS = 0;
7975 pDstX87->Rsrvd2= 0;
7976 }
7977 else
7978 {
7979 pDstX87->FPUIP = uPtr.pu16[3];
7980 pDstX87->CS = uPtr.pu16[4];
7981 pDstX87->Rsrvd1= 0;
7982 pDstX87->FPUDP = uPtr.pu16[5];
7983 pDstX87->DS = uPtr.pu16[6];
7984 pDstX87->Rsrvd2= 0;
7985 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
7986 }
7987 }
7988 else
7989 {
7990 pDstX87->FCW = uPtr.pu16[0*2];
7991 pDstX87->FSW = uPtr.pu16[1*2];
7992 pDstX87->FTW = uPtr.pu16[2*2];
7993 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
7994 {
7995 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
7996 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
7997 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
7998 pDstX87->CS = 0;
7999 pDstX87->Rsrvd1= 0;
8000 pDstX87->DS = 0;
8001 pDstX87->Rsrvd2= 0;
8002 }
8003 else
8004 {
8005 pDstX87->FPUIP = uPtr.pu32[3];
8006 pDstX87->CS = uPtr.pu16[4*2];
8007 pDstX87->Rsrvd1= 0;
8008 pDstX87->FOP = uPtr.pu16[4*2+1];
8009 pDstX87->FPUDP = uPtr.pu32[5];
8010 pDstX87->DS = uPtr.pu16[6*2];
8011 pDstX87->Rsrvd2= 0;
8012 }
8013 }
8014
8015 /* Make adjustments. */
8016 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
8017 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
8018 iemFpuRecalcExceptionStatus(pDstX87);
8019 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
8020 * exceptions are pending after loading the saved state? */
8021}
8022
8023
8024/**
8025 * Implements 'FNSTENV'.
8026 *
8027 * @param enmEffOpSize The operand size (only REX.W really matters).
8028 * @param iEffSeg The effective segment register for @a GCPtrEff.
8029 * @param GCPtrEffDst The address of the image.
8030 */
8031IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8032{
8033 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8034 RTPTRUNION uPtr;
8035 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8036 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8037 if (rcStrict != VINF_SUCCESS)
8038 return rcStrict;
8039
8040 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8041
8042 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8043 if (rcStrict != VINF_SUCCESS)
8044 return rcStrict;
8045
8046 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8047 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8048 return VINF_SUCCESS;
8049}
8050
8051
8052/**
8053 * Implements 'FNSAVE'.
8054 *
8055 * @param GCPtrEffDst The address of the image.
8056 * @param enmEffOpSize The operand size.
8057 */
8058IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8059{
8060 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8061 RTPTRUNION uPtr;
8062 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8063 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8064 if (rcStrict != VINF_SUCCESS)
8065 return rcStrict;
8066
8067 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8068 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8069 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8070 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8071 {
8072 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
8073 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
8074 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
8075 }
8076
8077 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8078 if (rcStrict != VINF_SUCCESS)
8079 return rcStrict;
8080
8081 /*
8082 * Re-initialize the FPU context.
8083 */
8084 pFpuCtx->FCW = 0x37f;
8085 pFpuCtx->FSW = 0;
8086 pFpuCtx->FTW = 0x00; /* 0 - empty */
8087 pFpuCtx->FPUDP = 0;
8088 pFpuCtx->DS = 0;
8089 pFpuCtx->Rsrvd2= 0;
8090 pFpuCtx->FPUIP = 0;
8091 pFpuCtx->CS = 0;
8092 pFpuCtx->Rsrvd1= 0;
8093 pFpuCtx->FOP = 0;
8094
8095 iemHlpUsedFpu(pVCpu);
8096 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8097 return VINF_SUCCESS;
8098}
8099
8100
8101
8102/**
8103 * Implements 'FLDENV'.
8104 *
8105 * @param enmEffOpSize The operand size (only REX.W really matters).
8106 * @param iEffSeg The effective segment register for @a GCPtrEff.
8107 * @param GCPtrEffSrc The address of the image.
8108 */
8109IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8110{
8111 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8112 RTCPTRUNION uPtr;
8113 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8114 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8115 if (rcStrict != VINF_SUCCESS)
8116 return rcStrict;
8117
8118 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8119
8120 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8121 if (rcStrict != VINF_SUCCESS)
8122 return rcStrict;
8123
8124 iemHlpUsedFpu(pVCpu);
8125 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8126 return VINF_SUCCESS;
8127}
8128
8129
8130/**
8131 * Implements 'FRSTOR'.
8132 *
8133 * @param GCPtrEffSrc The address of the image.
8134 * @param enmEffOpSize The operand size.
8135 */
8136IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8137{
8138 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8139 RTCPTRUNION uPtr;
8140 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8141 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8142 if (rcStrict != VINF_SUCCESS)
8143 return rcStrict;
8144
8145 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8146 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
8147 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8148 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8149 {
8150 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
8151 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
8152 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
8153 pFpuCtx->aRegs[i].au32[3] = 0;
8154 }
8155
8156 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8157 if (rcStrict != VINF_SUCCESS)
8158 return rcStrict;
8159
8160 iemHlpUsedFpu(pVCpu);
8161 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8162 return VINF_SUCCESS;
8163}
8164
8165
8166/**
8167 * Implements 'FLDCW'.
8168 *
8169 * @param u16Fcw The new FCW.
8170 */
8171IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
8172{
8173 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8174
8175 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
8176 /** @todo Testcase: Try see what happens when trying to set undefined bits
8177 * (other than 6 and 7). Currently ignoring them. */
8178 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
8179 * according to FSW. (This is was is currently implemented.) */
8180 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8181 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
8182 iemFpuRecalcExceptionStatus(pFpuCtx);
8183
8184 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8185 iemHlpUsedFpu(pVCpu);
8186 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8187 return VINF_SUCCESS;
8188}
8189
8190
8191
8192/**
8193 * Implements the underflow case of fxch.
8194 *
8195 * @param iStReg The other stack register.
8196 */
8197IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
8198{
8199 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8200
8201 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8202 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
8203 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
8204 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
8205
8206 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
8207 * registers are read as QNaN and then exchanged. This could be
8208 * wrong... */
8209 if (pFpuCtx->FCW & X86_FCW_IM)
8210 {
8211 if (RT_BIT(iReg1) & pFpuCtx->FTW)
8212 {
8213 if (RT_BIT(iReg2) & pFpuCtx->FTW)
8214 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8215 else
8216 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
8217 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
8218 }
8219 else
8220 {
8221 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
8222 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8223 }
8224 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
8225 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
8226 }
8227 else
8228 {
8229 /* raise underflow exception, don't change anything. */
8230 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
8231 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
8232 }
8233
8234 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
8235 iemHlpUsedFpu(pVCpu);
8236 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8237 return VINF_SUCCESS;
8238}
8239
8240
8241/**
8242 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
8243 *
8244 * @param cToAdd 1 or 7.
8245 */
8246IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
8247{
8248 PCPUMCTX pCtx = IEM_GET_CTX(pVCpu);
8249 Assert(iStReg < 8);
8250
8251 /*
8252 * Raise exceptions.
8253 */
8254 if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
8255 return iemRaiseDeviceNotAvailable(pVCpu);
8256
8257 PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
8258 uint16_t u16Fsw = pFpuCtx->FSW;
8259 if (u16Fsw & X86_FSW_ES)
8260 return iemRaiseMathFault(pVCpu);
8261
8262 /*
8263 * Check if any of the register accesses causes #SF + #IA.
8264 */
8265 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
8266 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
8267 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
8268 {
8269 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
8270 NOREF(u32Eflags);
8271
8272 pFpuCtx->FSW &= ~X86_FSW_C1;
8273 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
8274 if ( !(u16Fsw & X86_FSW_IE)
8275 || (pFpuCtx->FCW & X86_FCW_IM) )
8276 {
8277 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8278 pCtx->eflags.u |= pCtx->eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8279 }
8280 }
8281 else if (pFpuCtx->FCW & X86_FCW_IM)
8282 {
8283 /* Masked underflow. */
8284 pFpuCtx->FSW &= ~X86_FSW_C1;
8285 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
8286 pCtx->eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
8287 pCtx->eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
8288 }
8289 else
8290 {
8291 /* Raise underflow - don't touch EFLAGS or TOP. */
8292 pFpuCtx->FSW &= ~X86_FSW_C1;
8293 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
8294 fPop = false;
8295 }
8296
8297 /*
8298 * Pop if necessary.
8299 */
8300 if (fPop)
8301 {
8302 pFpuCtx->FTW &= ~RT_BIT(iReg1);
8303 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
8304 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
8305 }
8306
8307 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
8308 iemHlpUsedFpu(pVCpu);
8309 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8310 return VINF_SUCCESS;
8311}
8312
8313/** @} */
8314
Note: See TracBrowser for help on using the repository browser.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette