VirtualBox

source: vbox/trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h@ 77091

Last change on this file since 77091 was 77091, checked in by vboxsync, 6 years ago

VMM/IEM: Nested VMX: bugref:9180 indentation space.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 323.7 KB
Line 
1/* $Id: IEMAllCImpl.cpp.h 77091 2019-02-01 06:06:38Z vboxsync $ */
2/** @file
3 * IEM - Instruction Implementation in C/C++ (code include).
4 */
5
6/*
7 * Copyright (C) 2011-2019 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 */
17
18#include "IEMAllCImplSvmInstr.cpp.h"
19#include "IEMAllCImplVmxInstr.cpp.h"
20
21
22/** @name Misc Helpers
23 * @{
24 */
25
26
27/**
28 * Worker function for iemHlpCheckPortIOPermission, don't call directly.
29 *
30 * @returns Strict VBox status code.
31 *
32 * @param pVCpu The cross context virtual CPU structure of the calling thread.
33 * @param u16Port The port number.
34 * @param cbOperand The operand size.
35 */
36static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, uint16_t u16Port, uint8_t cbOperand)
37{
38 /* The TSS bits we're interested in are the same on 386 and AMD64. */
39 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_BUSY == X86_SEL_TYPE_SYS_386_TSS_BUSY);
40 AssertCompile(AMD64_SEL_TYPE_SYS_TSS_AVAIL == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
41 AssertCompileMembersAtSameOffset(X86TSS32, offIoBitmap, X86TSS64, offIoBitmap);
42 AssertCompile(sizeof(X86TSS32) == sizeof(X86TSS64));
43
44 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
45
46 /*
47 * Check the TSS type, 16-bit TSSes doesn't have any I/O permission bitmap.
48 */
49 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
50 if (RT_UNLIKELY( pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_BUSY
51 && pVCpu->cpum.GstCtx.tr.Attr.n.u4Type != AMD64_SEL_TYPE_SYS_TSS_AVAIL))
52 {
53 Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
54 u16Port, cbOperand, pVCpu->cpum.GstCtx.tr.Attr.n.u4Type, pVCpu->cpum.GstCtx.tr.Attr.u));
55 return iemRaiseGeneralProtectionFault0(pVCpu);
56 }
57
58 /*
59 * Read the bitmap offset (may #PF).
60 */
61 uint16_t offBitmap;
62 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
63 pVCpu->cpum.GstCtx.tr.u64Base + RT_UOFFSETOF(X86TSS64, offIoBitmap));
64 if (rcStrict != VINF_SUCCESS)
65 {
66 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading offIoBitmap (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
67 return rcStrict;
68 }
69
70 /*
71 * The bit range from u16Port to (u16Port + cbOperand - 1), however intel
72 * describes the CPU actually reading two bytes regardless of whether the
73 * bit range crosses a byte boundrary. Thus the + 1 in the test below.
74 */
75 uint32_t offFirstBit = (uint32_t)u16Port / 8 + offBitmap;
76 /** @todo check if real CPUs ensures that offBitmap has a minimum value of
77 * for instance sizeof(X86TSS32). */
78 if (offFirstBit + 1 > pVCpu->cpum.GstCtx.tr.u32Limit) /* the limit is inclusive */
79 {
80 Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
81 offFirstBit, pVCpu->cpum.GstCtx.tr.u32Limit));
82 return iemRaiseGeneralProtectionFault0(pVCpu);
83 }
84
85 /*
86 * Read the necessary bits.
87 */
88 /** @todo Test the assertion in the intel manual that the CPU reads two
89 * bytes. The question is how this works wrt to #PF and #GP on the
90 * 2nd byte when it's not required. */
91 uint16_t bmBytes = UINT16_MAX;
92 rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base + offFirstBit);
93 if (rcStrict != VINF_SUCCESS)
94 {
95 Log(("iemHlpCheckPortIOPermissionBitmap: Error reading I/O bitmap @%#x (%Rrc)\n", offFirstBit, VBOXSTRICTRC_VAL(rcStrict)));
96 return rcStrict;
97 }
98
99 /*
100 * Perform the check.
101 */
102 uint16_t fPortMask = (1 << cbOperand) - 1;
103 bmBytes >>= (u16Port & 7);
104 if (bmBytes & fPortMask)
105 {
106 Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
107 u16Port, cbOperand, bmBytes, fPortMask));
108 return iemRaiseGeneralProtectionFault0(pVCpu);
109 }
110
111 return VINF_SUCCESS;
112}
113
114
115/**
116 * Checks if we are allowed to access the given I/O port, raising the
117 * appropriate exceptions if we aren't (or if the I/O bitmap is not
118 * accessible).
119 *
120 * @returns Strict VBox status code.
121 *
122 * @param pVCpu The cross context virtual CPU structure of the calling thread.
123 * @param u16Port The port number.
124 * @param cbOperand The operand size.
125 */
126DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, uint16_t u16Port, uint8_t cbOperand)
127{
128 X86EFLAGS Efl;
129 Efl.u = IEMMISC_GET_EFL(pVCpu);
130 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
131 && ( pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
132 || Efl.Bits.u1VM) )
133 return iemHlpCheckPortIOPermissionBitmap(pVCpu, u16Port, cbOperand);
134 return VINF_SUCCESS;
135}
136
137
138#if 0
139/**
140 * Calculates the parity bit.
141 *
142 * @returns true if the bit is set, false if not.
143 * @param u8Result The least significant byte of the result.
144 */
145static bool iemHlpCalcParityFlag(uint8_t u8Result)
146{
147 /*
148 * Parity is set if the number of bits in the least significant byte of
149 * the result is even.
150 */
151 uint8_t cBits;
152 cBits = u8Result & 1; /* 0 */
153 u8Result >>= 1;
154 cBits += u8Result & 1;
155 u8Result >>= 1;
156 cBits += u8Result & 1;
157 u8Result >>= 1;
158 cBits += u8Result & 1;
159 u8Result >>= 1;
160 cBits += u8Result & 1; /* 4 */
161 u8Result >>= 1;
162 cBits += u8Result & 1;
163 u8Result >>= 1;
164 cBits += u8Result & 1;
165 u8Result >>= 1;
166 cBits += u8Result & 1;
167 return !(cBits & 1);
168}
169#endif /* not used */
170
171
172/**
173 * Updates the specified flags according to a 8-bit result.
174 *
175 * @param pVCpu The cross context virtual CPU structure of the calling thread.
176 * @param u8Result The result to set the flags according to.
177 * @param fToUpdate The flags to update.
178 * @param fUndefined The flags that are specified as undefined.
179 */
180static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
181{
182 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
183 iemAImpl_test_u8(&u8Result, u8Result, &fEFlags);
184 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
185 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
186}
187
188
189/**
190 * Updates the specified flags according to a 16-bit result.
191 *
192 * @param pVCpu The cross context virtual CPU structure of the calling thread.
193 * @param u16Result The result to set the flags according to.
194 * @param fToUpdate The flags to update.
195 * @param fUndefined The flags that are specified as undefined.
196 */
197static void iemHlpUpdateArithEFlagsU16(PVMCPU pVCpu, uint16_t u16Result, uint32_t fToUpdate, uint32_t fUndefined)
198{
199 uint32_t fEFlags = pVCpu->cpum.GstCtx.eflags.u;
200 iemAImpl_test_u16(&u16Result, u16Result, &fEFlags);
201 pVCpu->cpum.GstCtx.eflags.u &= ~(fToUpdate | fUndefined);
202 pVCpu->cpum.GstCtx.eflags.u |= (fToUpdate | fUndefined) & fEFlags;
203}
204
205
206/**
207 * Helper used by iret.
208 *
209 * @param pVCpu The cross context virtual CPU structure of the calling thread.
210 * @param uCpl The new CPL.
211 * @param pSReg Pointer to the segment register.
212 */
213static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
214{
215#ifdef VBOX_WITH_RAW_MODE_NOT_R0
216 if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
217 CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
218#else
219 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
220#endif
221 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
222
223 if ( uCpl > pSReg->Attr.n.u2Dpl
224 && pSReg->Attr.n.u1DescType /* code or data, not system */
225 && (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
226 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
227 iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
228}
229
230
231/**
232 * Indicates that we have modified the FPU state.
233 *
234 * @param pVCpu The cross context virtual CPU structure of the calling thread.
235 */
236DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
237{
238 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
239}
240
241/** @} */
242
243/** @name C Implementations
244 * @{
245 */
246
247/**
248 * Implements a 16-bit popa.
249 */
250IEM_CIMPL_DEF_0(iemCImpl_popa_16)
251{
252 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
253 RTGCPTR GCPtrLast = GCPtrStart + 15;
254 VBOXSTRICTRC rcStrict;
255
256 /*
257 * The docs are a bit hard to comprehend here, but it looks like we wrap
258 * around in real mode as long as none of the individual "popa" crosses the
259 * end of the stack segment. In protected mode we check the whole access
260 * in one go. For efficiency, only do the word-by-word thing if we're in
261 * danger of wrapping around.
262 */
263 /** @todo do popa boundary / wrap-around checks. */
264 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
265 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
266 {
267 /* word-by-word */
268 RTUINT64U TmpRsp;
269 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
270 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.di, &TmpRsp);
271 if (rcStrict == VINF_SUCCESS)
272 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.si, &TmpRsp);
273 if (rcStrict == VINF_SUCCESS)
274 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bp, &TmpRsp);
275 if (rcStrict == VINF_SUCCESS)
276 {
277 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
278 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.bx, &TmpRsp);
279 }
280 if (rcStrict == VINF_SUCCESS)
281 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.dx, &TmpRsp);
282 if (rcStrict == VINF_SUCCESS)
283 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.cx, &TmpRsp);
284 if (rcStrict == VINF_SUCCESS)
285 rcStrict = iemMemStackPopU16Ex(pVCpu, &pVCpu->cpum.GstCtx.ax, &TmpRsp);
286 if (rcStrict == VINF_SUCCESS)
287 {
288 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
289 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
290 }
291 }
292 else
293 {
294 uint16_t const *pa16Mem = NULL;
295 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
296 if (rcStrict == VINF_SUCCESS)
297 {
298 pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
299 pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
300 pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
301 /* skip sp */
302 pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
303 pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
304 pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
305 pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
306 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
307 if (rcStrict == VINF_SUCCESS)
308 {
309 iemRegAddToRsp(pVCpu, 16);
310 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
311 }
312 }
313 }
314 return rcStrict;
315}
316
317
318/**
319 * Implements a 32-bit popa.
320 */
321IEM_CIMPL_DEF_0(iemCImpl_popa_32)
322{
323 RTGCPTR GCPtrStart = iemRegGetEffRsp(pVCpu);
324 RTGCPTR GCPtrLast = GCPtrStart + 31;
325 VBOXSTRICTRC rcStrict;
326
327 /*
328 * The docs are a bit hard to comprehend here, but it looks like we wrap
329 * around in real mode as long as none of the individual "popa" crosses the
330 * end of the stack segment. In protected mode we check the whole access
331 * in one go. For efficiency, only do the word-by-word thing if we're in
332 * danger of wrapping around.
333 */
334 /** @todo do popa boundary / wrap-around checks. */
335 if (RT_UNLIKELY( IEM_IS_REAL_OR_V86_MODE(pVCpu)
336 && (pVCpu->cpum.GstCtx.cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
337 {
338 /* word-by-word */
339 RTUINT64U TmpRsp;
340 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
341 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edi, &TmpRsp);
342 if (rcStrict == VINF_SUCCESS)
343 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.esi, &TmpRsp);
344 if (rcStrict == VINF_SUCCESS)
345 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebp, &TmpRsp);
346 if (rcStrict == VINF_SUCCESS)
347 {
348 iemRegAddToRspEx(pVCpu, &TmpRsp, 2); /* sp */
349 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ebx, &TmpRsp);
350 }
351 if (rcStrict == VINF_SUCCESS)
352 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.edx, &TmpRsp);
353 if (rcStrict == VINF_SUCCESS)
354 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.ecx, &TmpRsp);
355 if (rcStrict == VINF_SUCCESS)
356 rcStrict = iemMemStackPopU32Ex(pVCpu, &pVCpu->cpum.GstCtx.eax, &TmpRsp);
357 if (rcStrict == VINF_SUCCESS)
358 {
359#if 1 /** @todo what actually happens with the high bits when we're in 16-bit mode? */
360 pVCpu->cpum.GstCtx.rdi &= UINT32_MAX;
361 pVCpu->cpum.GstCtx.rsi &= UINT32_MAX;
362 pVCpu->cpum.GstCtx.rbp &= UINT32_MAX;
363 pVCpu->cpum.GstCtx.rbx &= UINT32_MAX;
364 pVCpu->cpum.GstCtx.rdx &= UINT32_MAX;
365 pVCpu->cpum.GstCtx.rcx &= UINT32_MAX;
366 pVCpu->cpum.GstCtx.rax &= UINT32_MAX;
367#endif
368 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
369 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
370 }
371 }
372 else
373 {
374 uint32_t const *pa32Mem;
375 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
376 if (rcStrict == VINF_SUCCESS)
377 {
378 pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
379 pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
380 pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
381 /* skip esp */
382 pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
383 pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
384 pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
385 pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
386 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
387 if (rcStrict == VINF_SUCCESS)
388 {
389 iemRegAddToRsp(pVCpu, 32);
390 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
391 }
392 }
393 }
394 return rcStrict;
395}
396
397
398/**
399 * Implements a 16-bit pusha.
400 */
401IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
402{
403 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
404 RTGCPTR GCPtrBottom = GCPtrTop - 15;
405 VBOXSTRICTRC rcStrict;
406
407 /*
408 * The docs are a bit hard to comprehend here, but it looks like we wrap
409 * around in real mode as long as none of the individual "pushd" crosses the
410 * end of the stack segment. In protected mode we check the whole access
411 * in one go. For efficiency, only do the word-by-word thing if we're in
412 * danger of wrapping around.
413 */
414 /** @todo do pusha boundary / wrap-around checks. */
415 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
416 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
417 {
418 /* word-by-word */
419 RTUINT64U TmpRsp;
420 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
421 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.ax, &TmpRsp);
422 if (rcStrict == VINF_SUCCESS)
423 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.cx, &TmpRsp);
424 if (rcStrict == VINF_SUCCESS)
425 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.dx, &TmpRsp);
426 if (rcStrict == VINF_SUCCESS)
427 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bx, &TmpRsp);
428 if (rcStrict == VINF_SUCCESS)
429 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.sp, &TmpRsp);
430 if (rcStrict == VINF_SUCCESS)
431 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.bp, &TmpRsp);
432 if (rcStrict == VINF_SUCCESS)
433 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.si, &TmpRsp);
434 if (rcStrict == VINF_SUCCESS)
435 rcStrict = iemMemStackPushU16Ex(pVCpu, pVCpu->cpum.GstCtx.di, &TmpRsp);
436 if (rcStrict == VINF_SUCCESS)
437 {
438 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
439 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
440 }
441 }
442 else
443 {
444 GCPtrBottom--;
445 uint16_t *pa16Mem = NULL;
446 rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
447 if (rcStrict == VINF_SUCCESS)
448 {
449 pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
450 pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
451 pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
452 pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
453 pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
454 pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
455 pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
456 pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
457 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
458 if (rcStrict == VINF_SUCCESS)
459 {
460 iemRegSubFromRsp(pVCpu, 16);
461 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
462 }
463 }
464 }
465 return rcStrict;
466}
467
468
469/**
470 * Implements a 32-bit pusha.
471 */
472IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
473{
474 RTGCPTR GCPtrTop = iemRegGetEffRsp(pVCpu);
475 RTGCPTR GCPtrBottom = GCPtrTop - 31;
476 VBOXSTRICTRC rcStrict;
477
478 /*
479 * The docs are a bit hard to comprehend here, but it looks like we wrap
480 * around in real mode as long as none of the individual "pusha" crosses the
481 * end of the stack segment. In protected mode we check the whole access
482 * in one go. For efficiency, only do the word-by-word thing if we're in
483 * danger of wrapping around.
484 */
485 /** @todo do pusha boundary / wrap-around checks. */
486 if (RT_UNLIKELY( GCPtrBottom > GCPtrTop
487 && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
488 {
489 /* word-by-word */
490 RTUINT64U TmpRsp;
491 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
492 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.eax, &TmpRsp);
493 if (rcStrict == VINF_SUCCESS)
494 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ecx, &TmpRsp);
495 if (rcStrict == VINF_SUCCESS)
496 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edx, &TmpRsp);
497 if (rcStrict == VINF_SUCCESS)
498 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebx, &TmpRsp);
499 if (rcStrict == VINF_SUCCESS)
500 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esp, &TmpRsp);
501 if (rcStrict == VINF_SUCCESS)
502 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.ebp, &TmpRsp);
503 if (rcStrict == VINF_SUCCESS)
504 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.esi, &TmpRsp);
505 if (rcStrict == VINF_SUCCESS)
506 rcStrict = iemMemStackPushU32Ex(pVCpu, pVCpu->cpum.GstCtx.edi, &TmpRsp);
507 if (rcStrict == VINF_SUCCESS)
508 {
509 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
510 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
511 }
512 }
513 else
514 {
515 GCPtrBottom--;
516 uint32_t *pa32Mem;
517 rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
518 if (rcStrict == VINF_SUCCESS)
519 {
520 pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
521 pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
522 pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
523 pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
524 pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
525 pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
526 pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
527 pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
528 rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
529 if (rcStrict == VINF_SUCCESS)
530 {
531 iemRegSubFromRsp(pVCpu, 32);
532 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
533 }
534 }
535 }
536 return rcStrict;
537}
538
539
540/**
541 * Implements pushf.
542 *
543 *
544 * @param enmEffOpSize The effective operand size.
545 */
546IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
547{
548 VBOXSTRICTRC rcStrict;
549
550 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_PUSHF))
551 {
552 Log2(("pushf: Guest intercept -> #VMEXIT\n"));
553 IEM_SVM_UPDATE_NRIP(pVCpu);
554 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_PUSHF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
555 }
556
557 /*
558 * If we're in V8086 mode some care is required (which is why we're in
559 * doing this in a C implementation).
560 */
561 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
562 if ( (fEfl & X86_EFL_VM)
563 && X86_EFL_GET_IOPL(fEfl) != 3 )
564 {
565 Assert(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE);
566 if ( enmEffOpSize != IEMMODE_16BIT
567 || !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
568 return iemRaiseGeneralProtectionFault0(pVCpu);
569 fEfl &= ~X86_EFL_IF; /* (RF and VM are out of range) */
570 fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
571 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
572 }
573 else
574 {
575
576 /*
577 * Ok, clear RF and VM, adjust for ancient CPUs, and push the flags.
578 */
579 fEfl &= ~(X86_EFL_RF | X86_EFL_VM);
580
581 switch (enmEffOpSize)
582 {
583 case IEMMODE_16BIT:
584 AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
585 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
586 fEfl |= UINT16_C(0xf000);
587 rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
588 break;
589 case IEMMODE_32BIT:
590 rcStrict = iemMemStackPushU32(pVCpu, fEfl);
591 break;
592 case IEMMODE_64BIT:
593 rcStrict = iemMemStackPushU64(pVCpu, fEfl);
594 break;
595 IEM_NOT_REACHED_DEFAULT_CASE_RET();
596 }
597 }
598 if (rcStrict != VINF_SUCCESS)
599 return rcStrict;
600
601 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
602 return VINF_SUCCESS;
603}
604
605
606/**
607 * Implements popf.
608 *
609 * @param enmEffOpSize The effective operand size.
610 */
611IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
612{
613 uint32_t const fEflOld = IEMMISC_GET_EFL(pVCpu);
614 VBOXSTRICTRC rcStrict;
615 uint32_t fEflNew;
616
617 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_POPF))
618 {
619 Log2(("popf: Guest intercept -> #VMEXIT\n"));
620 IEM_SVM_UPDATE_NRIP(pVCpu);
621 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_POPF, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
622 }
623
624 /*
625 * V8086 is special as usual.
626 */
627 if (fEflOld & X86_EFL_VM)
628 {
629 /*
630 * Almost anything goes if IOPL is 3.
631 */
632 if (X86_EFL_GET_IOPL(fEflOld) == 3)
633 {
634 switch (enmEffOpSize)
635 {
636 case IEMMODE_16BIT:
637 {
638 uint16_t u16Value;
639 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
640 if (rcStrict != VINF_SUCCESS)
641 return rcStrict;
642 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
643 break;
644 }
645 case IEMMODE_32BIT:
646 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
647 if (rcStrict != VINF_SUCCESS)
648 return rcStrict;
649 break;
650 IEM_NOT_REACHED_DEFAULT_CASE_RET();
651 }
652
653 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
654 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
655 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
656 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
657 }
658 /*
659 * Interrupt flag virtualization with CR4.VME=1.
660 */
661 else if ( enmEffOpSize == IEMMODE_16BIT
662 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
663 {
664 uint16_t u16Value;
665 RTUINT64U TmpRsp;
666 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
667 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
668 if (rcStrict != VINF_SUCCESS)
669 return rcStrict;
670
671 /** @todo Is the popf VME #GP(0) delivered after updating RSP+RIP
672 * or before? */
673 if ( ( (u16Value & X86_EFL_IF)
674 && (fEflOld & X86_EFL_VIP))
675 || (u16Value & X86_EFL_TF) )
676 return iemRaiseGeneralProtectionFault0(pVCpu);
677
678 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
679 fEflNew |= (fEflNew & X86_EFL_IF) << (19 - 9);
680 fEflNew &= X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF);
681 fEflNew |= ~(X86_EFL_POPF_BITS & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
682
683 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
684 }
685 else
686 return iemRaiseGeneralProtectionFault0(pVCpu);
687
688 }
689 /*
690 * Not in V8086 mode.
691 */
692 else
693 {
694 /* Pop the flags. */
695 switch (enmEffOpSize)
696 {
697 case IEMMODE_16BIT:
698 {
699 uint16_t u16Value;
700 rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
701 if (rcStrict != VINF_SUCCESS)
702 return rcStrict;
703 fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000));
704
705 /*
706 * Ancient CPU adjustments:
707 * - 8086, 80186, V20/30:
708 * Fixed bits 15:12 bits are not kept correctly internally, mostly for
709 * practical reasons (masking below). We add them when pushing flags.
710 * - 80286:
711 * The NT and IOPL flags cannot be popped from real mode and are
712 * therefore always zero (since a 286 can never exit from PM and
713 * their initial value is zero). This changed on a 386 and can
714 * therefore be used to detect 286 or 386 CPU in real mode.
715 */
716 if ( IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
717 && !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE) )
718 fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
719 break;
720 }
721 case IEMMODE_32BIT:
722 rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
723 if (rcStrict != VINF_SUCCESS)
724 return rcStrict;
725 break;
726 case IEMMODE_64BIT:
727 {
728 uint64_t u64Value;
729 rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
730 if (rcStrict != VINF_SUCCESS)
731 return rcStrict;
732 fEflNew = u64Value; /** @todo testcase: Check exactly what happens if high bits are set. */
733 break;
734 }
735 IEM_NOT_REACHED_DEFAULT_CASE_RET();
736 }
737
738 /* Merge them with the current flags. */
739 const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
740 ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
741 if ( (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
742 || pVCpu->iem.s.uCpl == 0)
743 {
744 fEflNew &= fPopfBits;
745 fEflNew |= ~fPopfBits & fEflOld;
746 }
747 else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
748 {
749 fEflNew &= fPopfBits & ~(X86_EFL_IOPL);
750 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL)) & fEflOld;
751 }
752 else
753 {
754 fEflNew &= fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF);
755 fEflNew |= ~(fPopfBits & ~(X86_EFL_IOPL | X86_EFL_IF)) & fEflOld;
756 }
757 }
758
759 /*
760 * Commit the flags.
761 */
762 Assert(fEflNew & RT_BIT_32(1));
763 IEMMISC_SET_EFL(pVCpu, fEflNew);
764 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
765
766 return VINF_SUCCESS;
767}
768
769
770/**
771 * Implements an indirect call.
772 *
773 * @param uNewPC The new program counter (RIP) value (loaded from the
774 * operand).
775 * @param enmEffOpSize The effective operand size.
776 */
777IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
778{
779 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
780 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
781 return iemRaiseGeneralProtectionFault0(pVCpu);
782
783 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
784 if (rcStrict != VINF_SUCCESS)
785 return rcStrict;
786
787 pVCpu->cpum.GstCtx.rip = uNewPC;
788 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
789
790#ifndef IEM_WITH_CODE_TLB
791 /* Flush the prefetch buffer. */
792 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
793#endif
794 return VINF_SUCCESS;
795}
796
797
798/**
799 * Implements a 16-bit relative call.
800 *
801 * @param offDisp The displacment offset.
802 */
803IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
804{
805 uint16_t uOldPC = pVCpu->cpum.GstCtx.ip + cbInstr;
806 uint16_t uNewPC = uOldPC + offDisp;
807 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
808 return iemRaiseGeneralProtectionFault0(pVCpu);
809
810 VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
811 if (rcStrict != VINF_SUCCESS)
812 return rcStrict;
813
814 pVCpu->cpum.GstCtx.rip = uNewPC;
815 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
816
817#ifndef IEM_WITH_CODE_TLB
818 /* Flush the prefetch buffer. */
819 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
820#endif
821 return VINF_SUCCESS;
822}
823
824
825/**
826 * Implements a 32-bit indirect call.
827 *
828 * @param uNewPC The new program counter (RIP) value (loaded from the
829 * operand).
830 * @param enmEffOpSize The effective operand size.
831 */
832IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
833{
834 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
835 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
836 return iemRaiseGeneralProtectionFault0(pVCpu);
837
838 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
839 if (rcStrict != VINF_SUCCESS)
840 return rcStrict;
841
842#if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE) && defined(VBOX_WITH_CALL_RECORD)
843 /*
844 * CASM hook for recording interesting indirect calls.
845 */
846 if ( !pVCpu->cpum.GstCtx.eflags.Bits.u1IF
847 && (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
848 && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
849 && pVCpu->iem.s.uCpl == 0)
850 {
851 EMSTATE enmState = EMGetState(pVCpu);
852 if ( enmState == EMSTATE_IEM_THEN_REM
853 || enmState == EMSTATE_IEM
854 || enmState == EMSTATE_REM)
855 CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.eip);
856 }
857#endif
858
859 pVCpu->cpum.GstCtx.rip = uNewPC;
860 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
861
862#ifndef IEM_WITH_CODE_TLB
863 /* Flush the prefetch buffer. */
864 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
865#endif
866 return VINF_SUCCESS;
867}
868
869
870/**
871 * Implements a 32-bit relative call.
872 *
873 * @param offDisp The displacment offset.
874 */
875IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
876{
877 uint32_t uOldPC = pVCpu->cpum.GstCtx.eip + cbInstr;
878 uint32_t uNewPC = uOldPC + offDisp;
879 if (uNewPC > pVCpu->cpum.GstCtx.cs.u32Limit)
880 return iemRaiseGeneralProtectionFault0(pVCpu);
881
882 VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
883 if (rcStrict != VINF_SUCCESS)
884 return rcStrict;
885
886 pVCpu->cpum.GstCtx.rip = uNewPC;
887 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
888
889#ifndef IEM_WITH_CODE_TLB
890 /* Flush the prefetch buffer. */
891 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
892#endif
893 return VINF_SUCCESS;
894}
895
896
897/**
898 * Implements a 64-bit indirect call.
899 *
900 * @param uNewPC The new program counter (RIP) value (loaded from the
901 * operand).
902 * @param enmEffOpSize The effective operand size.
903 */
904IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
905{
906 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
907 if (!IEM_IS_CANONICAL(uNewPC))
908 return iemRaiseGeneralProtectionFault0(pVCpu);
909
910 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
911 if (rcStrict != VINF_SUCCESS)
912 return rcStrict;
913
914 pVCpu->cpum.GstCtx.rip = uNewPC;
915 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
916
917#ifndef IEM_WITH_CODE_TLB
918 /* Flush the prefetch buffer. */
919 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
920#endif
921 return VINF_SUCCESS;
922}
923
924
925/**
926 * Implements a 64-bit relative call.
927 *
928 * @param offDisp The displacment offset.
929 */
930IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
931{
932 uint64_t uOldPC = pVCpu->cpum.GstCtx.rip + cbInstr;
933 uint64_t uNewPC = uOldPC + offDisp;
934 if (!IEM_IS_CANONICAL(uNewPC))
935 return iemRaiseNotCanonical(pVCpu);
936
937 VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
938 if (rcStrict != VINF_SUCCESS)
939 return rcStrict;
940
941 pVCpu->cpum.GstCtx.rip = uNewPC;
942 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
943
944#ifndef IEM_WITH_CODE_TLB
945 /* Flush the prefetch buffer. */
946 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
947#endif
948
949 return VINF_SUCCESS;
950}
951
952
953/**
954 * Implements far jumps and calls thru task segments (TSS).
955 *
956 * @param uSel The selector.
957 * @param enmBranch The kind of branching we're performing.
958 * @param enmEffOpSize The effective operand size.
959 * @param pDesc The descriptor corresponding to @a uSel. The type is
960 * task gate.
961 */
962IEM_CIMPL_DEF_4(iemCImpl_BranchTaskSegment, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
963{
964#ifndef IEM_IMPLEMENTS_TASKSWITCH
965 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
966#else
967 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
968 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
969 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
970 RT_NOREF_PV(enmEffOpSize);
971 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
972
973 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
974 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
975 {
976 Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
977 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
978 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
979 }
980
981 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
982 * far calls (see iemCImpl_callf). Most likely in both cases it should be
983 * checked here, need testcases. */
984 if (!pDesc->Legacy.Gen.u1Present)
985 {
986 Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
987 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
988 }
989
990 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
991 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
992 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
993#endif
994}
995
996
997/**
998 * Implements far jumps and calls thru task gates.
999 *
1000 * @param uSel The selector.
1001 * @param enmBranch The kind of branching we're performing.
1002 * @param enmEffOpSize The effective operand size.
1003 * @param pDesc The descriptor corresponding to @a uSel. The type is
1004 * task gate.
1005 */
1006IEM_CIMPL_DEF_4(iemCImpl_BranchTaskGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1007{
1008#ifndef IEM_IMPLEMENTS_TASKSWITCH
1009 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1010#else
1011 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1012 RT_NOREF_PV(enmEffOpSize);
1013 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1014
1015 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1016 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1017 {
1018 Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1019 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1020 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1021 }
1022
1023 /** @todo This is checked earlier for far jumps (see iemCImpl_FarJmp) but not
1024 * far calls (see iemCImpl_callf). Most likely in both cases it should be
1025 * checked here, need testcases. */
1026 if (!pDesc->Legacy.Gen.u1Present)
1027 {
1028 Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
1029 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1030 }
1031
1032 /*
1033 * Fetch the new TSS descriptor from the GDT.
1034 */
1035 RTSEL uSelTss = pDesc->Legacy.Gate.u16Sel;
1036 if (uSelTss & X86_SEL_LDT)
1037 {
1038 Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
1039 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1040 }
1041
1042 IEMSELDESC TssDesc;
1043 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
1044 if (rcStrict != VINF_SUCCESS)
1045 return rcStrict;
1046
1047 if (TssDesc.Legacy.Gate.u4Type & X86_SEL_TYPE_SYS_TSS_BUSY_MASK)
1048 {
1049 Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
1050 TssDesc.Legacy.Gate.u4Type));
1051 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
1052 }
1053
1054 if (!TssDesc.Legacy.Gate.u1Present)
1055 {
1056 Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
1057 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
1058 }
1059
1060 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
1061 return iemTaskSwitch(pVCpu, enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
1062 uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
1063#endif
1064}
1065
1066
1067/**
1068 * Implements far jumps and calls thru call gates.
1069 *
1070 * @param uSel The selector.
1071 * @param enmBranch The kind of branching we're performing.
1072 * @param enmEffOpSize The effective operand size.
1073 * @param pDesc The descriptor corresponding to @a uSel. The type is
1074 * call gate.
1075 */
1076IEM_CIMPL_DEF_4(iemCImpl_BranchCallGate, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1077{
1078#define IEM_IMPLEMENTS_CALLGATE
1079#ifndef IEM_IMPLEMENTS_CALLGATE
1080 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
1081#else
1082 RT_NOREF_PV(enmEffOpSize);
1083 IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1084
1085 /* NB: Far jumps can only do intra-privilege transfers. Far calls support
1086 * inter-privilege calls and are much more complex.
1087 *
1088 * NB: 64-bit call gate has the same type as a 32-bit call gate! If
1089 * EFER.LMA=1, the gate must be 64-bit. Conversely if EFER.LMA=0, the gate
1090 * must be 16-bit or 32-bit.
1091 */
1092 /** @todo: effective operand size is probably irrelevant here, only the
1093 * call gate bitness matters??
1094 */
1095 VBOXSTRICTRC rcStrict;
1096 RTPTRUNION uPtrRet;
1097 uint64_t uNewRsp;
1098 uint64_t uNewRip;
1099 uint64_t u64Base;
1100 uint32_t cbLimit;
1101 RTSEL uNewCS;
1102 IEMSELDESC DescCS;
1103
1104 AssertCompile(X86_SEL_TYPE_SYS_386_CALL_GATE == AMD64_SEL_TYPE_SYS_CALL_GATE);
1105 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1106 Assert( pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE
1107 || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE);
1108
1109 /* Determine the new instruction pointer from the gate descriptor. */
1110 uNewRip = pDesc->Legacy.Gate.u16OffsetLow
1111 | ((uint32_t)pDesc->Legacy.Gate.u16OffsetHigh << 16)
1112 | ((uint64_t)pDesc->Long.Gate.u32OffsetTop << 32);
1113
1114 /* Perform DPL checks on the gate descriptor. */
1115 if ( pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
1116 || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
1117 {
1118 Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
1119 pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
1120 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1121 }
1122
1123 /** @todo does this catch NULL selectors, too? */
1124 if (!pDesc->Legacy.Gen.u1Present)
1125 {
1126 Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
1127 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1128 }
1129
1130 /*
1131 * Fetch the target CS descriptor from the GDT or LDT.
1132 */
1133 uNewCS = pDesc->Legacy.Gate.u16Sel;
1134 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
1135 if (rcStrict != VINF_SUCCESS)
1136 return rcStrict;
1137
1138 /* Target CS must be a code selector. */
1139 if ( !DescCS.Legacy.Gen.u1DescType
1140 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
1141 {
1142 Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
1143 uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
1144 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1145 }
1146
1147 /* Privilege checks on target CS. */
1148 if (enmBranch == IEMBRANCH_JUMP)
1149 {
1150 if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1151 {
1152 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1153 {
1154 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1155 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1156 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1157 }
1158 }
1159 else
1160 {
1161 if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
1162 {
1163 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1164 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1165 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1166 }
1167 }
1168 }
1169 else
1170 {
1171 Assert(enmBranch == IEMBRANCH_CALL);
1172 if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
1173 {
1174 Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
1175 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1176 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
1177 }
1178 }
1179
1180 /* Additional long mode checks. */
1181 if (IEM_IS_LONG_MODE(pVCpu))
1182 {
1183 if (!DescCS.Legacy.Gen.u1Long)
1184 {
1185 Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
1186 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1187 }
1188
1189 /* L vs D. */
1190 if ( DescCS.Legacy.Gen.u1Long
1191 && DescCS.Legacy.Gen.u1DefBig)
1192 {
1193 Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
1194 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
1195 }
1196 }
1197
1198 if (!DescCS.Legacy.Gate.u1Present)
1199 {
1200 Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
1201 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
1202 }
1203
1204 if (enmBranch == IEMBRANCH_JUMP)
1205 {
1206 /** @todo: This is very similar to regular far jumps; merge! */
1207 /* Jumps are fairly simple... */
1208
1209 /* Chop the high bits off if 16-bit gate (Intel says so). */
1210 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1211 uNewRip = (uint16_t)uNewRip;
1212
1213 /* Limit check for non-long segments. */
1214 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1215 if (DescCS.Legacy.Gen.u1Long)
1216 u64Base = 0;
1217 else
1218 {
1219 if (uNewRip > cbLimit)
1220 {
1221 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
1222 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1223 }
1224 u64Base = X86DESC_BASE(&DescCS.Legacy);
1225 }
1226
1227 /* Canonical address check. */
1228 if (!IEM_IS_CANONICAL(uNewRip))
1229 {
1230 Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1231 return iemRaiseNotCanonical(pVCpu);
1232 }
1233
1234 /*
1235 * Ok, everything checked out fine. Now set the accessed bit before
1236 * committing the result into CS, CSHID and RIP.
1237 */
1238 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1239 {
1240 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1241 if (rcStrict != VINF_SUCCESS)
1242 return rcStrict;
1243 /** @todo check what VT-x and AMD-V does. */
1244 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1245 }
1246
1247 /* commit */
1248 pVCpu->cpum.GstCtx.rip = uNewRip;
1249 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1250 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1251 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1252 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1253 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1254 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1255 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1256 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1257 }
1258 else
1259 {
1260 Assert(enmBranch == IEMBRANCH_CALL);
1261 /* Calls are much more complicated. */
1262
1263 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
1264 {
1265 uint16_t offNewStack; /* Offset of new stack in TSS. */
1266 uint16_t cbNewStack; /* Number of bytes the stack information takes up in TSS. */
1267 uint8_t uNewCSDpl;
1268 uint8_t cbWords;
1269 RTSEL uNewSS;
1270 RTSEL uOldSS;
1271 uint64_t uOldRsp;
1272 IEMSELDESC DescSS;
1273 RTPTRUNION uPtrTSS;
1274 RTGCPTR GCPtrTSS;
1275 RTPTRUNION uPtrParmWds;
1276 RTGCPTR GCPtrParmWds;
1277
1278 /* More privilege. This is the fun part. */
1279 Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)); /* Filtered out above. */
1280
1281 /*
1282 * Determine new SS:rSP from the TSS.
1283 */
1284 Assert(!pVCpu->cpum.GstCtx.tr.Attr.n.u1DescType);
1285
1286 /* Figure out where the new stack pointer is stored in the TSS. */
1287 uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
1288 if (!IEM_IS_LONG_MODE(pVCpu))
1289 {
1290 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1291 {
1292 offNewStack = RT_UOFFSETOF(X86TSS32, esp0) + uNewCSDpl * 8;
1293 cbNewStack = RT_SIZEOFMEMB(X86TSS32, esp0) + RT_SIZEOFMEMB(X86TSS32, ss0);
1294 }
1295 else
1296 {
1297 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1298 offNewStack = RT_UOFFSETOF(X86TSS16, sp0) + uNewCSDpl * 4;
1299 cbNewStack = RT_SIZEOFMEMB(X86TSS16, sp0) + RT_SIZEOFMEMB(X86TSS16, ss0);
1300 }
1301 }
1302 else
1303 {
1304 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1305 offNewStack = RT_UOFFSETOF(X86TSS64, rsp0) + uNewCSDpl * RT_SIZEOFMEMB(X86TSS64, rsp0);
1306 cbNewStack = RT_SIZEOFMEMB(X86TSS64, rsp0);
1307 }
1308
1309 /* Check against TSS limit. */
1310 if ((uint16_t)(offNewStack + cbNewStack - 1) > pVCpu->cpum.GstCtx.tr.u32Limit)
1311 {
1312 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pVCpu->cpum.GstCtx.tr.u32Limit));
1313 return iemRaiseTaskSwitchFaultBySelector(pVCpu, pVCpu->cpum.GstCtx.tr.Sel);
1314 }
1315
1316 GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
1317 rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
1318 if (rcStrict != VINF_SUCCESS)
1319 {
1320 Log(("BranchCallGate: TSS mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1321 return rcStrict;
1322 }
1323
1324 if (!IEM_IS_LONG_MODE(pVCpu))
1325 {
1326 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
1327 {
1328 uNewRsp = uPtrTSS.pu32[0];
1329 uNewSS = uPtrTSS.pu16[2];
1330 }
1331 else
1332 {
1333 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
1334 uNewRsp = uPtrTSS.pu16[0];
1335 uNewSS = uPtrTSS.pu16[1];
1336 }
1337 }
1338 else
1339 {
1340 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
1341 /* SS will be a NULL selector, but that's valid. */
1342 uNewRsp = uPtrTSS.pu64[0];
1343 uNewSS = uNewCSDpl;
1344 }
1345
1346 /* Done with the TSS now. */
1347 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
1348 if (rcStrict != VINF_SUCCESS)
1349 {
1350 Log(("BranchCallGate: TSS unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1351 return rcStrict;
1352 }
1353
1354 /* Only used outside of long mode. */
1355 cbWords = pDesc->Legacy.Gate.u5ParmCount;
1356
1357 /* If EFER.LMA is 0, there's extra work to do. */
1358 if (!IEM_IS_LONG_MODE(pVCpu))
1359 {
1360 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
1361 {
1362 Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
1363 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1364 }
1365
1366 /* Grab the new SS descriptor. */
1367 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1368 if (rcStrict != VINF_SUCCESS)
1369 return rcStrict;
1370
1371 /* Ensure that CS.DPL == SS.RPL == SS.DPL. */
1372 if ( (DescCS.Legacy.Gen.u2Dpl != (uNewSS & X86_SEL_RPL))
1373 || (DescCS.Legacy.Gen.u2Dpl != DescSS.Legacy.Gen.u2Dpl))
1374 {
1375 Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
1376 uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
1377 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1378 }
1379
1380 /* Ensure new SS is a writable data segment. */
1381 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
1382 {
1383 Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
1384 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
1385 }
1386
1387 if (!DescSS.Legacy.Gen.u1Present)
1388 {
1389 Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
1390 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
1391 }
1392 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1393 cbNewStack = (uint16_t)sizeof(uint32_t) * (4 + cbWords);
1394 else
1395 cbNewStack = (uint16_t)sizeof(uint16_t) * (4 + cbWords);
1396 }
1397 else
1398 {
1399 /* Just grab the new (NULL) SS descriptor. */
1400 /** @todo testcase: Check whether the zero GDT entry is actually loaded here
1401 * like we do... */
1402 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
1403 if (rcStrict != VINF_SUCCESS)
1404 return rcStrict;
1405
1406 cbNewStack = sizeof(uint64_t) * 4;
1407 }
1408
1409 /** @todo: According to Intel, new stack is checked for enough space first,
1410 * then switched. According to AMD, the stack is switched first and
1411 * then pushes might fault!
1412 * NB: OS/2 Warp 3/4 actively relies on the fact that possible
1413 * incoming stack #PF happens before actual stack switch. AMD is
1414 * either lying or implicitly assumes that new state is committed
1415 * only if and when an instruction doesn't fault.
1416 */
1417
1418 /** @todo: According to AMD, CS is loaded first, then SS.
1419 * According to Intel, it's the other way around!?
1420 */
1421
1422 /** @todo: Intel and AMD disagree on when exactly the CPL changes! */
1423
1424 /* Set the accessed bit before committing new SS. */
1425 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1426 {
1427 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
1428 if (rcStrict != VINF_SUCCESS)
1429 return rcStrict;
1430 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1431 }
1432
1433 /* Remember the old SS:rSP and their linear address. */
1434 uOldSS = pVCpu->cpum.GstCtx.ss.Sel;
1435 uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
1436
1437 GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
1438
1439 /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
1440 or #PF, the former is not implemented in this workaround. */
1441 /** @todo Proper fix callgate target stack exceptions. */
1442 /** @todo testcase: Cover callgates with partially or fully inaccessible
1443 * target stacks. */
1444 void *pvNewFrame;
1445 RTGCPTR GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
1446 rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW);
1447 if (rcStrict != VINF_SUCCESS)
1448 {
1449 Log(("BranchCallGate: Incoming stack (%04x:%08RX64) not accessible, rc=%Rrc\n", uNewSS, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
1450 return rcStrict;
1451 }
1452 rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
1453 if (rcStrict != VINF_SUCCESS)
1454 {
1455 Log(("BranchCallGate: New stack probe unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1456 return rcStrict;
1457 }
1458
1459 /* Commit new SS:rSP. */
1460 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
1461 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
1462 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
1463 pVCpu->cpum.GstCtx.ss.u32Limit = X86DESC_LIMIT_G(&DescSS.Legacy);
1464 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
1465 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
1466 pVCpu->cpum.GstCtx.rsp = uNewRsp;
1467 pVCpu->iem.s.uCpl = uNewCSDpl;
1468 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->cpum.GstCtx.ss));
1469 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
1470
1471 /* At this point the stack access must not fail because new state was already committed. */
1472 /** @todo this can still fail due to SS.LIMIT not check. */
1473 rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
1474 &uPtrRet.pv, &uNewRsp);
1475 AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
1476 VERR_INTERNAL_ERROR_5);
1477
1478 if (!IEM_IS_LONG_MODE(pVCpu))
1479 {
1480 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1481 {
1482 /* Push the old CS:rIP. */
1483 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1484 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1485
1486 if (cbWords)
1487 {
1488 /* Map the relevant chunk of the old stack. */
1489 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1490 if (rcStrict != VINF_SUCCESS)
1491 {
1492 Log(("BranchCallGate: Old stack mapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1493 return rcStrict;
1494 }
1495
1496 /* Copy the parameter (d)words. */
1497 for (int i = 0; i < cbWords; ++i)
1498 uPtrRet.pu32[2 + i] = uPtrParmWds.pu32[i];
1499
1500 /* Unmap the old stack. */
1501 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1502 if (rcStrict != VINF_SUCCESS)
1503 {
1504 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1505 return rcStrict;
1506 }
1507 }
1508
1509 /* Push the old SS:rSP. */
1510 uPtrRet.pu32[2 + cbWords + 0] = uOldRsp;
1511 uPtrRet.pu32[2 + cbWords + 1] = uOldSS;
1512 }
1513 else
1514 {
1515 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1516
1517 /* Push the old CS:rIP. */
1518 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1519 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1520
1521 if (cbWords)
1522 {
1523 /* Map the relevant chunk of the old stack. */
1524 rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
1525 if (rcStrict != VINF_SUCCESS)
1526 {
1527 Log(("BranchCallGate: Old stack mapping (16-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1528 return rcStrict;
1529 }
1530
1531 /* Copy the parameter words. */
1532 for (int i = 0; i < cbWords; ++i)
1533 uPtrRet.pu16[2 + i] = uPtrParmWds.pu16[i];
1534
1535 /* Unmap the old stack. */
1536 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
1537 if (rcStrict != VINF_SUCCESS)
1538 {
1539 Log(("BranchCallGate: Old stack unmapping (32-bit) failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1540 return rcStrict;
1541 }
1542 }
1543
1544 /* Push the old SS:rSP. */
1545 uPtrRet.pu16[2 + cbWords + 0] = uOldRsp;
1546 uPtrRet.pu16[2 + cbWords + 1] = uOldSS;
1547 }
1548 }
1549 else
1550 {
1551 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1552
1553 /* For 64-bit gates, no parameters are copied. Just push old SS:rSP and CS:rIP. */
1554 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1555 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1556 uPtrRet.pu64[2] = uOldRsp;
1557 uPtrRet.pu64[3] = uOldSS; /** @todo Testcase: What is written to the high words when pushing SS? */
1558 }
1559
1560 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1561 if (rcStrict != VINF_SUCCESS)
1562 {
1563 Log(("BranchCallGate: New stack unmapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)));
1564 return rcStrict;
1565 }
1566
1567 /* Chop the high bits off if 16-bit gate (Intel says so). */
1568 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1569 uNewRip = (uint16_t)uNewRip;
1570
1571 /* Limit / canonical check. */
1572 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1573 if (!IEM_IS_LONG_MODE(pVCpu))
1574 {
1575 if (uNewRip > cbLimit)
1576 {
1577 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1578 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1579 }
1580 u64Base = X86DESC_BASE(&DescCS.Legacy);
1581 }
1582 else
1583 {
1584 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1585 if (!IEM_IS_CANONICAL(uNewRip))
1586 {
1587 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1588 return iemRaiseNotCanonical(pVCpu);
1589 }
1590 u64Base = 0;
1591 }
1592
1593 /*
1594 * Now set the accessed bit before
1595 * writing the return address to the stack and committing the result into
1596 * CS, CSHID and RIP.
1597 */
1598 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1599 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1600 {
1601 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1602 if (rcStrict != VINF_SUCCESS)
1603 return rcStrict;
1604 /** @todo check what VT-x and AMD-V does. */
1605 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1606 }
1607
1608 /* Commit new CS:rIP. */
1609 pVCpu->cpum.GstCtx.rip = uNewRip;
1610 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1611 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1612 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1613 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1614 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1615 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1616 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1617 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1618 }
1619 else
1620 {
1621 /* Same privilege. */
1622 /** @todo: This is very similar to regular far calls; merge! */
1623
1624 /* Check stack first - may #SS(0). */
1625 /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
1626 * 16-bit code cause a two or four byte CS to be pushed? */
1627 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
1628 IEM_IS_LONG_MODE(pVCpu) ? 8+8
1629 : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
1630 &uPtrRet.pv, &uNewRsp);
1631 if (rcStrict != VINF_SUCCESS)
1632 return rcStrict;
1633
1634 /* Chop the high bits off if 16-bit gate (Intel says so). */
1635 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE)
1636 uNewRip = (uint16_t)uNewRip;
1637
1638 /* Limit / canonical check. */
1639 cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
1640 if (!IEM_IS_LONG_MODE(pVCpu))
1641 {
1642 if (uNewRip > cbLimit)
1643 {
1644 Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
1645 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
1646 }
1647 u64Base = X86DESC_BASE(&DescCS.Legacy);
1648 }
1649 else
1650 {
1651 if (!IEM_IS_CANONICAL(uNewRip))
1652 {
1653 Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
1654 return iemRaiseNotCanonical(pVCpu);
1655 }
1656 u64Base = 0;
1657 }
1658
1659 /*
1660 * Now set the accessed bit before
1661 * writing the return address to the stack and committing the result into
1662 * CS, CSHID and RIP.
1663 */
1664 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
1665 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1666 {
1667 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
1668 if (rcStrict != VINF_SUCCESS)
1669 return rcStrict;
1670 /** @todo check what VT-x and AMD-V does. */
1671 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1672 }
1673
1674 /* stack */
1675 if (!IEM_IS_LONG_MODE(pVCpu))
1676 {
1677 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
1678 {
1679 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
1680 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when pushing CS? */
1681 }
1682 else
1683 {
1684 Assert(pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_CALL_GATE);
1685 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
1686 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
1687 }
1688 }
1689 else
1690 {
1691 Assert(pDesc->Legacy.Gate.u4Type == AMD64_SEL_TYPE_SYS_CALL_GATE);
1692 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
1693 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when pushing CS? */
1694 }
1695
1696 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
1697 if (rcStrict != VINF_SUCCESS)
1698 return rcStrict;
1699
1700 /* commit */
1701 pVCpu->cpum.GstCtx.rip = uNewRip;
1702 pVCpu->cpum.GstCtx.cs.Sel = uNewCS & X86_SEL_MASK_OFF_RPL;
1703 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
1704 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1705 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1706 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
1707 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1708 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1709 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1710 }
1711 }
1712 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1713
1714 /* Flush the prefetch buffer. */
1715# ifdef IEM_WITH_CODE_TLB
1716 pVCpu->iem.s.pbInstrBuf = NULL;
1717# else
1718 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1719# endif
1720 return VINF_SUCCESS;
1721#endif
1722}
1723
1724
1725/**
1726 * Implements far jumps and calls thru system selectors.
1727 *
1728 * @param uSel The selector.
1729 * @param enmBranch The kind of branching we're performing.
1730 * @param enmEffOpSize The effective operand size.
1731 * @param pDesc The descriptor corresponding to @a uSel.
1732 */
1733IEM_CIMPL_DEF_4(iemCImpl_BranchSysSel, uint16_t, uSel, IEMBRANCH, enmBranch, IEMMODE, enmEffOpSize, PIEMSELDESC, pDesc)
1734{
1735 Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
1736 Assert((uSel & X86_SEL_MASK_OFF_RPL));
1737 IEM_CTX_IMPORT_RET(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
1738
1739 if (IEM_IS_LONG_MODE(pVCpu))
1740 switch (pDesc->Legacy.Gen.u4Type)
1741 {
1742 case AMD64_SEL_TYPE_SYS_CALL_GATE:
1743 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1744
1745 default:
1746 case AMD64_SEL_TYPE_SYS_LDT:
1747 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
1748 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
1749 case AMD64_SEL_TYPE_SYS_TRAP_GATE:
1750 case AMD64_SEL_TYPE_SYS_INT_GATE:
1751 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1752 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1753 }
1754
1755 switch (pDesc->Legacy.Gen.u4Type)
1756 {
1757 case X86_SEL_TYPE_SYS_286_CALL_GATE:
1758 case X86_SEL_TYPE_SYS_386_CALL_GATE:
1759 return IEM_CIMPL_CALL_4(iemCImpl_BranchCallGate, uSel, enmBranch, enmEffOpSize, pDesc);
1760
1761 case X86_SEL_TYPE_SYS_TASK_GATE:
1762 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskGate, uSel, enmBranch, enmEffOpSize, pDesc);
1763
1764 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
1765 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
1766 return IEM_CIMPL_CALL_4(iemCImpl_BranchTaskSegment, uSel, enmBranch, enmEffOpSize, pDesc);
1767
1768 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
1769 Log(("branch %04x -> busy 286 TSS\n", uSel));
1770 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1771
1772 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
1773 Log(("branch %04x -> busy 386 TSS\n", uSel));
1774 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1775
1776 default:
1777 case X86_SEL_TYPE_SYS_LDT:
1778 case X86_SEL_TYPE_SYS_286_INT_GATE:
1779 case X86_SEL_TYPE_SYS_286_TRAP_GATE:
1780 case X86_SEL_TYPE_SYS_386_INT_GATE:
1781 case X86_SEL_TYPE_SYS_386_TRAP_GATE:
1782 Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
1783 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1784 }
1785}
1786
1787
1788/**
1789 * Implements far jumps.
1790 *
1791 * @param uSel The selector.
1792 * @param offSeg The segment offset.
1793 * @param enmEffOpSize The effective operand size.
1794 */
1795IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1796{
1797 NOREF(cbInstr);
1798 Assert(offSeg <= UINT32_MAX);
1799
1800 /*
1801 * Real mode and V8086 mode are easy. The only snag seems to be that
1802 * CS.limit doesn't change and the limit check is done against the current
1803 * limit.
1804 */
1805 /** @todo Robert Collins claims (The Segment Descriptor Cache, DDJ August
1806 * 1998) that up to and including the Intel 486, far control
1807 * transfers in real mode set default CS attributes (0x93) and also
1808 * set a 64K segment limit. Starting with the Pentium, the
1809 * attributes and limit are left alone but the access rights are
1810 * ignored. We only implement the Pentium+ behavior.
1811 * */
1812 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1813 {
1814 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1815 if (offSeg > pVCpu->cpum.GstCtx.cs.u32Limit)
1816 {
1817 Log(("iemCImpl_FarJmp: 16-bit limit\n"));
1818 return iemRaiseGeneralProtectionFault0(pVCpu);
1819 }
1820
1821 if (enmEffOpSize == IEMMODE_16BIT) /** @todo WRONG, must pass this. */
1822 pVCpu->cpum.GstCtx.rip = offSeg;
1823 else
1824 pVCpu->cpum.GstCtx.rip = offSeg & UINT16_MAX;
1825 pVCpu->cpum.GstCtx.cs.Sel = uSel;
1826 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
1827 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1828 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
1829 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1830 return VINF_SUCCESS;
1831 }
1832
1833 /*
1834 * Protected mode. Need to parse the specified descriptor...
1835 */
1836 if (!(uSel & X86_SEL_MASK_OFF_RPL))
1837 {
1838 Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
1839 return iemRaiseGeneralProtectionFault0(pVCpu);
1840 }
1841
1842 /* Fetch the descriptor. */
1843 IEMSELDESC Desc;
1844 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
1845 if (rcStrict != VINF_SUCCESS)
1846 return rcStrict;
1847
1848 /* Is it there? */
1849 if (!Desc.Legacy.Gen.u1Present) /** @todo this is probably checked too early. Testcase! */
1850 {
1851 Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
1852 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
1853 }
1854
1855 /*
1856 * Deal with it according to its type. We do the standard code selectors
1857 * here and dispatch the system selectors to worker functions.
1858 */
1859 if (!Desc.Legacy.Gen.u1DescType)
1860 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_JUMP, enmEffOpSize, &Desc);
1861
1862 /* Only code segments. */
1863 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
1864 {
1865 Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
1866 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1867 }
1868
1869 /* L vs D. */
1870 if ( Desc.Legacy.Gen.u1Long
1871 && Desc.Legacy.Gen.u1DefBig
1872 && IEM_IS_LONG_MODE(pVCpu))
1873 {
1874 Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
1875 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1876 }
1877
1878 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
1879 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
1880 {
1881 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
1882 {
1883 Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
1884 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1885 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1886 }
1887 }
1888 else
1889 {
1890 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
1891 {
1892 Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
1893 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1894 }
1895 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
1896 {
1897 Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
1898 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1899 }
1900 }
1901
1902 /* Chop the high bits if 16-bit (Intel says so). */
1903 if (enmEffOpSize == IEMMODE_16BIT)
1904 offSeg &= UINT16_MAX;
1905
1906 /* Limit check. (Should alternatively check for non-canonical addresses
1907 here, but that is ruled out by offSeg being 32-bit, right?) */
1908 uint64_t u64Base;
1909 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
1910 if (Desc.Legacy.Gen.u1Long)
1911 u64Base = 0;
1912 else
1913 {
1914 if (offSeg > cbLimit)
1915 {
1916 Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
1917 /** @todo: Intel says this is #GP(0)! */
1918 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
1919 }
1920 u64Base = X86DESC_BASE(&Desc.Legacy);
1921 }
1922
1923 /*
1924 * Ok, everything checked out fine. Now set the accessed bit before
1925 * committing the result into CS, CSHID and RIP.
1926 */
1927 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
1928 {
1929 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
1930 if (rcStrict != VINF_SUCCESS)
1931 return rcStrict;
1932 /** @todo check what VT-x and AMD-V does. */
1933 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
1934 }
1935
1936 /* commit */
1937 pVCpu->cpum.GstCtx.rip = offSeg;
1938 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
1939 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
1940 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
1941 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
1942 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
1943 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
1944 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
1945 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
1946 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
1947 /** @todo check if the hidden bits are loaded correctly for 64-bit
1948 * mode. */
1949
1950 /* Flush the prefetch buffer. */
1951#ifdef IEM_WITH_CODE_TLB
1952 pVCpu->iem.s.pbInstrBuf = NULL;
1953#else
1954 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
1955#endif
1956
1957 return VINF_SUCCESS;
1958}
1959
1960
1961/**
1962 * Implements far calls.
1963 *
1964 * This very similar to iemCImpl_FarJmp.
1965 *
1966 * @param uSel The selector.
1967 * @param offSeg The segment offset.
1968 * @param enmEffOpSize The operand size (in case we need it).
1969 */
1970IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
1971{
1972 VBOXSTRICTRC rcStrict;
1973 uint64_t uNewRsp;
1974 RTPTRUNION uPtrRet;
1975
1976 /*
1977 * Real mode and V8086 mode are easy. The only snag seems to be that
1978 * CS.limit doesn't change and the limit check is done against the current
1979 * limit.
1980 */
1981 /** @todo See comment for similar code in iemCImpl_FarJmp */
1982 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
1983 {
1984 Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
1985
1986 /* Check stack first - may #SS(0). */
1987 rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
1988 &uPtrRet.pv, &uNewRsp);
1989 if (rcStrict != VINF_SUCCESS)
1990 return rcStrict;
1991
1992 /* Check the target address range. */
1993 if (offSeg > UINT32_MAX)
1994 return iemRaiseGeneralProtectionFault0(pVCpu);
1995
1996 /* Everything is fine, push the return address. */
1997 if (enmEffOpSize == IEMMODE_16BIT)
1998 {
1999 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2000 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2001 }
2002 else
2003 {
2004 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2005 uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
2006 }
2007 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2008 if (rcStrict != VINF_SUCCESS)
2009 return rcStrict;
2010
2011 /* Branch. */
2012 pVCpu->cpum.GstCtx.rip = offSeg;
2013 pVCpu->cpum.GstCtx.cs.Sel = uSel;
2014 pVCpu->cpum.GstCtx.cs.ValidSel = uSel;
2015 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2016 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uSel << 4;
2017 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2018 return VINF_SUCCESS;
2019 }
2020
2021 /*
2022 * Protected mode. Need to parse the specified descriptor...
2023 */
2024 if (!(uSel & X86_SEL_MASK_OFF_RPL))
2025 {
2026 Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
2027 return iemRaiseGeneralProtectionFault0(pVCpu);
2028 }
2029
2030 /* Fetch the descriptor. */
2031 IEMSELDESC Desc;
2032 rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
2033 if (rcStrict != VINF_SUCCESS)
2034 return rcStrict;
2035
2036 /*
2037 * Deal with it according to its type. We do the standard code selectors
2038 * here and dispatch the system selectors to worker functions.
2039 */
2040 if (!Desc.Legacy.Gen.u1DescType)
2041 return IEM_CIMPL_CALL_4(iemCImpl_BranchSysSel, uSel, IEMBRANCH_CALL, enmEffOpSize, &Desc);
2042
2043 /* Only code segments. */
2044 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
2045 {
2046 Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
2047 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2048 }
2049
2050 /* L vs D. */
2051 if ( Desc.Legacy.Gen.u1Long
2052 && Desc.Legacy.Gen.u1DefBig
2053 && IEM_IS_LONG_MODE(pVCpu))
2054 {
2055 Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
2056 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2057 }
2058
2059 /* DPL/RPL/CPL check, where conforming segments makes a difference. */
2060 if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2061 {
2062 if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
2063 {
2064 Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
2065 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2066 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2067 }
2068 }
2069 else
2070 {
2071 if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
2072 {
2073 Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
2074 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2075 }
2076 if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
2077 {
2078 Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
2079 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2080 }
2081 }
2082
2083 /* Is it there? */
2084 if (!Desc.Legacy.Gen.u1Present)
2085 {
2086 Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
2087 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
2088 }
2089
2090 /* Check stack first - may #SS(0). */
2091 /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
2092 * 16-bit code cause a two or four byte CS to be pushed? */
2093 rcStrict = iemMemStackPushBeginSpecial(pVCpu,
2094 enmEffOpSize == IEMMODE_64BIT ? 8+8
2095 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
2096 &uPtrRet.pv, &uNewRsp);
2097 if (rcStrict != VINF_SUCCESS)
2098 return rcStrict;
2099
2100 /* Chop the high bits if 16-bit (Intel says so). */
2101 if (enmEffOpSize == IEMMODE_16BIT)
2102 offSeg &= UINT16_MAX;
2103
2104 /* Limit / canonical check. */
2105 uint64_t u64Base;
2106 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
2107 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2108 {
2109 if (!IEM_IS_CANONICAL(offSeg))
2110 {
2111 Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
2112 return iemRaiseNotCanonical(pVCpu);
2113 }
2114 u64Base = 0;
2115 }
2116 else
2117 {
2118 if (offSeg > cbLimit)
2119 {
2120 Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
2121 /** @todo: Intel says this is #GP(0)! */
2122 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
2123 }
2124 u64Base = X86DESC_BASE(&Desc.Legacy);
2125 }
2126
2127 /*
2128 * Now set the accessed bit before
2129 * writing the return address to the stack and committing the result into
2130 * CS, CSHID and RIP.
2131 */
2132 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2133 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2134 {
2135 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
2136 if (rcStrict != VINF_SUCCESS)
2137 return rcStrict;
2138 /** @todo check what VT-x and AMD-V does. */
2139 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2140 }
2141
2142 /* stack */
2143 if (enmEffOpSize == IEMMODE_16BIT)
2144 {
2145 uPtrRet.pu16[0] = pVCpu->cpum.GstCtx.ip + cbInstr;
2146 uPtrRet.pu16[1] = pVCpu->cpum.GstCtx.cs.Sel;
2147 }
2148 else if (enmEffOpSize == IEMMODE_32BIT)
2149 {
2150 uPtrRet.pu32[0] = pVCpu->cpum.GstCtx.eip + cbInstr;
2151 uPtrRet.pu32[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high word when callf is pushing CS? */
2152 }
2153 else
2154 {
2155 uPtrRet.pu64[0] = pVCpu->cpum.GstCtx.rip + cbInstr;
2156 uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
2157 }
2158 rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
2159 if (rcStrict != VINF_SUCCESS)
2160 return rcStrict;
2161
2162 /* commit */
2163 pVCpu->cpum.GstCtx.rip = offSeg;
2164 pVCpu->cpum.GstCtx.cs.Sel = uSel & X86_SEL_MASK_OFF_RPL;
2165 pVCpu->cpum.GstCtx.cs.Sel |= pVCpu->iem.s.uCpl;
2166 pVCpu->cpum.GstCtx.cs.ValidSel = pVCpu->cpum.GstCtx.cs.Sel;
2167 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2168 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
2169 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimit;
2170 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2171 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2172 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2173 /** @todo check if the hidden bits are loaded correctly for 64-bit
2174 * mode. */
2175
2176 /* Flush the prefetch buffer. */
2177#ifdef IEM_WITH_CODE_TLB
2178 pVCpu->iem.s.pbInstrBuf = NULL;
2179#else
2180 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2181#endif
2182 return VINF_SUCCESS;
2183}
2184
2185
2186/**
2187 * Implements retf.
2188 *
2189 * @param enmEffOpSize The effective operand size.
2190 * @param cbPop The amount of arguments to pop from the stack
2191 * (bytes).
2192 */
2193IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2194{
2195 VBOXSTRICTRC rcStrict;
2196 RTCPTRUNION uPtrFrame;
2197 uint64_t uNewRsp;
2198 uint64_t uNewRip;
2199 uint16_t uNewCs;
2200 NOREF(cbInstr);
2201
2202 /*
2203 * Read the stack values first.
2204 */
2205 uint32_t cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
2206 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
2207 rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2208 if (rcStrict != VINF_SUCCESS)
2209 return rcStrict;
2210 if (enmEffOpSize == IEMMODE_16BIT)
2211 {
2212 uNewRip = uPtrFrame.pu16[0];
2213 uNewCs = uPtrFrame.pu16[1];
2214 }
2215 else if (enmEffOpSize == IEMMODE_32BIT)
2216 {
2217 uNewRip = uPtrFrame.pu32[0];
2218 uNewCs = uPtrFrame.pu16[2];
2219 }
2220 else
2221 {
2222 uNewRip = uPtrFrame.pu64[0];
2223 uNewCs = uPtrFrame.pu16[4];
2224 }
2225 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2226 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2227 { /* extremely likely */ }
2228 else
2229 return rcStrict;
2230
2231 /*
2232 * Real mode and V8086 mode are easy.
2233 */
2234 /** @todo See comment for similar code in iemCImpl_FarJmp */
2235 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
2236 {
2237 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2238 /** @todo check how this is supposed to work if sp=0xfffe. */
2239
2240 /* Check the limit of the new EIP. */
2241 /** @todo Intel pseudo code only does the limit check for 16-bit
2242 * operands, AMD does not make any distinction. What is right? */
2243 if (uNewRip > pVCpu->cpum.GstCtx.cs.u32Limit)
2244 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2245
2246 /* commit the operation. */
2247 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2248 pVCpu->cpum.GstCtx.rip = uNewRip;
2249 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2250 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2251 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2252 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2253 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2254 if (cbPop)
2255 iemRegAddToRsp(pVCpu, cbPop);
2256 return VINF_SUCCESS;
2257 }
2258
2259 /*
2260 * Protected mode is complicated, of course.
2261 */
2262 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
2263 {
2264 Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
2265 return iemRaiseGeneralProtectionFault0(pVCpu);
2266 }
2267
2268 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
2269
2270 /* Fetch the descriptor. */
2271 IEMSELDESC DescCs;
2272 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
2273 if (rcStrict != VINF_SUCCESS)
2274 return rcStrict;
2275
2276 /* Can only return to a code selector. */
2277 if ( !DescCs.Legacy.Gen.u1DescType
2278 || !(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE) )
2279 {
2280 Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
2281 uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
2282 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2283 }
2284
2285 /* L vs D. */
2286 if ( DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
2287 && DescCs.Legacy.Gen.u1DefBig
2288 && IEM_IS_LONG_MODE(pVCpu))
2289 {
2290 Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
2291 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2292 }
2293
2294 /* DPL/RPL/CPL checks. */
2295 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
2296 {
2297 Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
2298 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2299 }
2300
2301 if (DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
2302 {
2303 if ((uNewCs & X86_SEL_RPL) < DescCs.Legacy.Gen.u2Dpl)
2304 {
2305 Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
2306 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2307 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2308 }
2309 }
2310 else
2311 {
2312 if ((uNewCs & X86_SEL_RPL) != DescCs.Legacy.Gen.u2Dpl)
2313 {
2314 Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
2315 uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
2316 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2317 }
2318 }
2319
2320 /* Is it there? */
2321 if (!DescCs.Legacy.Gen.u1Present)
2322 {
2323 Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
2324 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2325 }
2326
2327 /*
2328 * Return to outer privilege? (We'll typically have entered via a call gate.)
2329 */
2330 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
2331 {
2332 /* Read the outer stack pointer stored *after* the parameters. */
2333 rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrFrame.pv, &uNewRsp);
2334 if (rcStrict != VINF_SUCCESS)
2335 return rcStrict;
2336
2337 uPtrFrame.pu8 += cbPop; /* Skip the parameters. */
2338
2339 uint16_t uNewOuterSs;
2340 uint64_t uNewOuterRsp;
2341 if (enmEffOpSize == IEMMODE_16BIT)
2342 {
2343 uNewOuterRsp = uPtrFrame.pu16[0];
2344 uNewOuterSs = uPtrFrame.pu16[1];
2345 }
2346 else if (enmEffOpSize == IEMMODE_32BIT)
2347 {
2348 uNewOuterRsp = uPtrFrame.pu32[0];
2349 uNewOuterSs = uPtrFrame.pu16[2];
2350 }
2351 else
2352 {
2353 uNewOuterRsp = uPtrFrame.pu64[0];
2354 uNewOuterSs = uPtrFrame.pu16[4];
2355 }
2356 uPtrFrame.pu8 -= cbPop; /* Put uPtrFrame back the way it was. */
2357 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
2358 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2359 { /* extremely likely */ }
2360 else
2361 return rcStrict;
2362
2363 /* Check for NULL stack selector (invalid in ring-3 and non-long mode)
2364 and read the selector. */
2365 IEMSELDESC DescSs;
2366 if (!(uNewOuterSs & X86_SEL_MASK_OFF_RPL))
2367 {
2368 if ( !DescCs.Legacy.Gen.u1Long
2369 || (uNewOuterSs & X86_SEL_RPL) == 3)
2370 {
2371 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
2372 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2373 return iemRaiseGeneralProtectionFault0(pVCpu);
2374 }
2375 /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
2376 iemMemFakeStackSelDesc(&DescSs, (uNewOuterSs & X86_SEL_RPL));
2377 }
2378 else
2379 {
2380 /* Fetch the descriptor for the new stack segment. */
2381 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
2382 if (rcStrict != VINF_SUCCESS)
2383 return rcStrict;
2384 }
2385
2386 /* Check that RPL of stack and code selectors match. */
2387 if ((uNewCs & X86_SEL_RPL) != (uNewOuterSs & X86_SEL_RPL))
2388 {
2389 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2390 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2391 }
2392
2393 /* Must be a writable data segment. */
2394 if ( !DescSs.Legacy.Gen.u1DescType
2395 || (DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
2396 || !(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
2397 {
2398 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
2399 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
2400 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2401 }
2402
2403 /* L vs D. (Not mentioned by intel.) */
2404 if ( DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
2405 && DescSs.Legacy.Gen.u1DefBig
2406 && IEM_IS_LONG_MODE(pVCpu))
2407 {
2408 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
2409 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2410 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2411 }
2412
2413 /* DPL/RPL/CPL checks. */
2414 if (DescSs.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
2415 {
2416 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
2417 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
2418 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
2419 }
2420
2421 /* Is it there? */
2422 if (!DescSs.Legacy.Gen.u1Present)
2423 {
2424 Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2425 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
2426 }
2427
2428 /* Calc SS limit.*/
2429 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSs.Legacy);
2430
2431 /* Is RIP canonical or within CS.limit? */
2432 uint64_t u64Base;
2433 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2434
2435 /** @todo Testcase: Is this correct? */
2436 if ( DescCs.Legacy.Gen.u1Long
2437 && IEM_IS_LONG_MODE(pVCpu) )
2438 {
2439 if (!IEM_IS_CANONICAL(uNewRip))
2440 {
2441 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
2442 return iemRaiseNotCanonical(pVCpu);
2443 }
2444 u64Base = 0;
2445 }
2446 else
2447 {
2448 if (uNewRip > cbLimitCs)
2449 {
2450 Log(("retf %04x:%08RX64 %04x:%08RX64 - out of bounds (%#x)-> #GP(CS).\n",
2451 uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
2452 /** @todo: Intel says this is #GP(0)! */
2453 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2454 }
2455 u64Base = X86DESC_BASE(&DescCs.Legacy);
2456 }
2457
2458 /*
2459 * Now set the accessed bit before
2460 * writing the return address to the stack and committing the result into
2461 * CS, CSHID and RIP.
2462 */
2463 /** @todo Testcase: Need to check WHEN exactly the CS accessed bit is set. */
2464 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2465 {
2466 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2467 if (rcStrict != VINF_SUCCESS)
2468 return rcStrict;
2469 /** @todo check what VT-x and AMD-V does. */
2470 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2471 }
2472 /** @todo Testcase: Need to check WHEN exactly the SS accessed bit is set. */
2473 if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2474 {
2475 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
2476 if (rcStrict != VINF_SUCCESS)
2477 return rcStrict;
2478 /** @todo check what VT-x and AMD-V does. */
2479 DescSs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2480 }
2481
2482 /* commit */
2483 if (enmEffOpSize == IEMMODE_16BIT)
2484 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2485 else
2486 pVCpu->cpum.GstCtx.rip = uNewRip;
2487 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2488 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2489 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2490 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2491 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2492 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2493 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2494 pVCpu->cpum.GstCtx.ss.Sel = uNewOuterSs;
2495 pVCpu->cpum.GstCtx.ss.ValidSel = uNewOuterSs;
2496 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
2497 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
2498 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
2499 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2500 pVCpu->cpum.GstCtx.ss.u64Base = 0;
2501 else
2502 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSs.Legacy);
2503 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2504 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewOuterRsp;
2505 else
2506 pVCpu->cpum.GstCtx.rsp = uNewOuterRsp;
2507
2508 pVCpu->iem.s.uCpl = (uNewCs & X86_SEL_RPL);
2509 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
2510 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
2511 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
2512 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
2513
2514 /** @todo check if the hidden bits are loaded correctly for 64-bit
2515 * mode. */
2516
2517 if (cbPop)
2518 iemRegAddToRsp(pVCpu, cbPop);
2519 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2520
2521 /* Done! */
2522 }
2523 /*
2524 * Return to the same privilege level
2525 */
2526 else
2527 {
2528 /* Limit / canonical check. */
2529 uint64_t u64Base;
2530 uint32_t cbLimitCs = X86DESC_LIMIT_G(&DescCs.Legacy);
2531
2532 /** @todo Testcase: Is this correct? */
2533 if ( DescCs.Legacy.Gen.u1Long
2534 && IEM_IS_LONG_MODE(pVCpu) )
2535 {
2536 if (!IEM_IS_CANONICAL(uNewRip))
2537 {
2538 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
2539 return iemRaiseNotCanonical(pVCpu);
2540 }
2541 u64Base = 0;
2542 }
2543 else
2544 {
2545 if (uNewRip > cbLimitCs)
2546 {
2547 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
2548 /** @todo: Intel says this is #GP(0)! */
2549 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
2550 }
2551 u64Base = X86DESC_BASE(&DescCs.Legacy);
2552 }
2553
2554 /*
2555 * Now set the accessed bit before
2556 * writing the return address to the stack and committing the result into
2557 * CS, CSHID and RIP.
2558 */
2559 /** @todo Testcase: Need to check WHEN exactly the accessed bit is set. */
2560 if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
2561 {
2562 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
2563 if (rcStrict != VINF_SUCCESS)
2564 return rcStrict;
2565 /** @todo check what VT-x and AMD-V does. */
2566 DescCs.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
2567 }
2568
2569 /* commit */
2570 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2571 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
2572 else
2573 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2574 if (enmEffOpSize == IEMMODE_16BIT)
2575 pVCpu->cpum.GstCtx.rip = uNewRip & UINT16_MAX; /** @todo Testcase: When exactly does this occur? With call it happens prior to the limit check according to Intel... */
2576 else
2577 pVCpu->cpum.GstCtx.rip = uNewRip;
2578 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2579 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2580 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2581 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCs.Legacy);
2582 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCs;
2583 pVCpu->cpum.GstCtx.cs.u64Base = u64Base;
2584 /** @todo check if the hidden bits are loaded correctly for 64-bit
2585 * mode. */
2586 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
2587 if (cbPop)
2588 iemRegAddToRsp(pVCpu, cbPop);
2589 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2590 }
2591
2592 /* Flush the prefetch buffer. */
2593#ifdef IEM_WITH_CODE_TLB
2594 pVCpu->iem.s.pbInstrBuf = NULL;
2595#else
2596 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2597#endif
2598 return VINF_SUCCESS;
2599}
2600
2601
2602/**
2603 * Implements retn.
2604 *
2605 * We're doing this in C because of the \#GP that might be raised if the popped
2606 * program counter is out of bounds.
2607 *
2608 * @param enmEffOpSize The effective operand size.
2609 * @param cbPop The amount of arguments to pop from the stack
2610 * (bytes).
2611 */
2612IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
2613{
2614 NOREF(cbInstr);
2615
2616 /* Fetch the RSP from the stack. */
2617 VBOXSTRICTRC rcStrict;
2618 RTUINT64U NewRip;
2619 RTUINT64U NewRsp;
2620 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2621
2622 switch (enmEffOpSize)
2623 {
2624 case IEMMODE_16BIT:
2625 NewRip.u = 0;
2626 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
2627 break;
2628 case IEMMODE_32BIT:
2629 NewRip.u = 0;
2630 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
2631 break;
2632 case IEMMODE_64BIT:
2633 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
2634 break;
2635 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2636 }
2637 if (rcStrict != VINF_SUCCESS)
2638 return rcStrict;
2639
2640 /* Check the new RSP before loading it. */
2641 /** @todo Should test this as the intel+amd pseudo code doesn't mention half
2642 * of it. The canonical test is performed here and for call. */
2643 if (enmEffOpSize != IEMMODE_64BIT)
2644 {
2645 if (NewRip.DWords.dw0 > pVCpu->cpum.GstCtx.cs.u32Limit)
2646 {
2647 Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pVCpu->cpum.GstCtx.cs.u32Limit));
2648 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2649 }
2650 }
2651 else
2652 {
2653 if (!IEM_IS_CANONICAL(NewRip.u))
2654 {
2655 Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
2656 return iemRaiseNotCanonical(pVCpu);
2657 }
2658 }
2659
2660 /* Apply cbPop */
2661 if (cbPop)
2662 iemRegAddToRspEx(pVCpu, &NewRsp, cbPop);
2663
2664 /* Commit it. */
2665 pVCpu->cpum.GstCtx.rip = NewRip.u;
2666 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2667 pVCpu->cpum.GstCtx.eflags.Bits.u1RF = 0;
2668
2669 /* Flush the prefetch buffer. */
2670#ifndef IEM_WITH_CODE_TLB
2671 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2672#endif
2673
2674 return VINF_SUCCESS;
2675}
2676
2677
2678/**
2679 * Implements enter.
2680 *
2681 * We're doing this in C because the instruction is insane, even for the
2682 * u8NestingLevel=0 case dealing with the stack is tedious.
2683 *
2684 * @param enmEffOpSize The effective operand size.
2685 */
2686IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
2687{
2688 /* Push RBP, saving the old value in TmpRbp. */
2689 RTUINT64U NewRsp; NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2690 RTUINT64U TmpRbp; TmpRbp.u = pVCpu->cpum.GstCtx.rbp;
2691 RTUINT64U NewRbp;
2692 VBOXSTRICTRC rcStrict;
2693 if (enmEffOpSize == IEMMODE_64BIT)
2694 {
2695 rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
2696 NewRbp = NewRsp;
2697 }
2698 else if (enmEffOpSize == IEMMODE_32BIT)
2699 {
2700 rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
2701 NewRbp = NewRsp;
2702 }
2703 else
2704 {
2705 rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
2706 NewRbp = TmpRbp;
2707 NewRbp.Words.w0 = NewRsp.Words.w0;
2708 }
2709 if (rcStrict != VINF_SUCCESS)
2710 return rcStrict;
2711
2712 /* Copy the parameters (aka nesting levels by Intel). */
2713 cParameters &= 0x1f;
2714 if (cParameters > 0)
2715 {
2716 switch (enmEffOpSize)
2717 {
2718 case IEMMODE_16BIT:
2719 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2720 TmpRbp.DWords.dw0 -= 2;
2721 else
2722 TmpRbp.Words.w0 -= 2;
2723 do
2724 {
2725 uint16_t u16Tmp;
2726 rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
2727 if (rcStrict != VINF_SUCCESS)
2728 break;
2729 rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
2730 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2731 break;
2732
2733 case IEMMODE_32BIT:
2734 if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2735 TmpRbp.DWords.dw0 -= 4;
2736 else
2737 TmpRbp.Words.w0 -= 4;
2738 do
2739 {
2740 uint32_t u32Tmp;
2741 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
2742 if (rcStrict != VINF_SUCCESS)
2743 break;
2744 rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
2745 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2746 break;
2747
2748 case IEMMODE_64BIT:
2749 TmpRbp.u -= 8;
2750 do
2751 {
2752 uint64_t u64Tmp;
2753 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
2754 if (rcStrict != VINF_SUCCESS)
2755 break;
2756 rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
2757 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
2758 break;
2759
2760 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2761 }
2762 if (rcStrict != VINF_SUCCESS)
2763 return VINF_SUCCESS;
2764
2765 /* Push the new RBP */
2766 if (enmEffOpSize == IEMMODE_64BIT)
2767 rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
2768 else if (enmEffOpSize == IEMMODE_32BIT)
2769 rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
2770 else
2771 rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
2772 if (rcStrict != VINF_SUCCESS)
2773 return rcStrict;
2774
2775 }
2776
2777 /* Recalc RSP. */
2778 iemRegSubFromRspEx(pVCpu, &NewRsp, cbFrame);
2779
2780 /** @todo Should probe write access at the new RSP according to AMD. */
2781
2782 /* Commit it. */
2783 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2784 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2785 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2786
2787 return VINF_SUCCESS;
2788}
2789
2790
2791
2792/**
2793 * Implements leave.
2794 *
2795 * We're doing this in C because messing with the stack registers is annoying
2796 * since they depends on SS attributes.
2797 *
2798 * @param enmEffOpSize The effective operand size.
2799 */
2800IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
2801{
2802 /* Calculate the intermediate RSP from RBP and the stack attributes. */
2803 RTUINT64U NewRsp;
2804 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
2805 NewRsp.u = pVCpu->cpum.GstCtx.rbp;
2806 else if (pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
2807 NewRsp.u = pVCpu->cpum.GstCtx.ebp;
2808 else
2809 {
2810 /** @todo Check that LEAVE actually preserve the high EBP bits. */
2811 NewRsp.u = pVCpu->cpum.GstCtx.rsp;
2812 NewRsp.Words.w0 = pVCpu->cpum.GstCtx.bp;
2813 }
2814
2815 /* Pop RBP according to the operand size. */
2816 VBOXSTRICTRC rcStrict;
2817 RTUINT64U NewRbp;
2818 switch (enmEffOpSize)
2819 {
2820 case IEMMODE_16BIT:
2821 NewRbp.u = pVCpu->cpum.GstCtx.rbp;
2822 rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
2823 break;
2824 case IEMMODE_32BIT:
2825 NewRbp.u = 0;
2826 rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
2827 break;
2828 case IEMMODE_64BIT:
2829 rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
2830 break;
2831 IEM_NOT_REACHED_DEFAULT_CASE_RET();
2832 }
2833 if (rcStrict != VINF_SUCCESS)
2834 return rcStrict;
2835
2836
2837 /* Commit it. */
2838 pVCpu->cpum.GstCtx.rbp = NewRbp.u;
2839 pVCpu->cpum.GstCtx.rsp = NewRsp.u;
2840 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
2841
2842 return VINF_SUCCESS;
2843}
2844
2845
2846/**
2847 * Implements int3 and int XX.
2848 *
2849 * @param u8Int The interrupt vector number.
2850 * @param enmInt The int instruction type.
2851 */
2852IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, IEMINT, enmInt)
2853{
2854 Assert(pVCpu->iem.s.cXcptRecursions == 0);
2855 return iemRaiseXcptOrInt(pVCpu,
2856 cbInstr,
2857 u8Int,
2858 IEM_XCPT_FLAGS_T_SOFT_INT | enmInt,
2859 0,
2860 0);
2861}
2862
2863
2864/**
2865 * Implements iret for real mode and V8086 mode.
2866 *
2867 * @param enmEffOpSize The effective operand size.
2868 */
2869IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
2870{
2871 X86EFLAGS Efl;
2872 Efl.u = IEMMISC_GET_EFL(pVCpu);
2873 NOREF(cbInstr);
2874
2875 /*
2876 * iret throws an exception if VME isn't enabled.
2877 */
2878 if ( Efl.Bits.u1VM
2879 && Efl.Bits.u2IOPL != 3
2880 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME))
2881 return iemRaiseGeneralProtectionFault0(pVCpu);
2882
2883 /*
2884 * Do the stack bits, but don't commit RSP before everything checks
2885 * out right.
2886 */
2887 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
2888 VBOXSTRICTRC rcStrict;
2889 RTCPTRUNION uFrame;
2890 uint16_t uNewCs;
2891 uint32_t uNewEip;
2892 uint32_t uNewFlags;
2893 uint64_t uNewRsp;
2894 if (enmEffOpSize == IEMMODE_32BIT)
2895 {
2896 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
2897 if (rcStrict != VINF_SUCCESS)
2898 return rcStrict;
2899 uNewEip = uFrame.pu32[0];
2900 if (uNewEip > UINT16_MAX)
2901 return iemRaiseGeneralProtectionFault0(pVCpu);
2902
2903 uNewCs = (uint16_t)uFrame.pu32[1];
2904 uNewFlags = uFrame.pu32[2];
2905 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2906 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT
2907 | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
2908 | X86_EFL_ID;
2909 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
2910 uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
2911 uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
2912 }
2913 else
2914 {
2915 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
2916 if (rcStrict != VINF_SUCCESS)
2917 return rcStrict;
2918 uNewEip = uFrame.pu16[0];
2919 uNewCs = uFrame.pu16[1];
2920 uNewFlags = uFrame.pu16[2];
2921 uNewFlags &= X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
2922 | X86_EFL_TF | X86_EFL_IF | X86_EFL_DF | X86_EFL_OF | X86_EFL_IOPL | X86_EFL_NT;
2923 uNewFlags |= Efl.u & ((UINT32_C(0xffff0000) | X86_EFL_1) & ~X86_EFL_RF);
2924 /** @todo The intel pseudo code does not indicate what happens to
2925 * reserved flags. We just ignore them. */
2926 /* Ancient CPU adjustments: See iemCImpl_popf. */
2927 if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
2928 uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
2929 }
2930 rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
2931 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
2932 { /* extremely likely */ }
2933 else
2934 return rcStrict;
2935
2936 /** @todo Check how this is supposed to work if sp=0xfffe. */
2937 Log7(("iemCImpl_iret_real_v8086: uNewCs=%#06x uNewRip=%#010x uNewFlags=%#x uNewRsp=%#18llx\n",
2938 uNewCs, uNewEip, uNewFlags, uNewRsp));
2939
2940 /*
2941 * Check the limit of the new EIP.
2942 */
2943 /** @todo Only the AMD pseudo code check the limit here, what's
2944 * right? */
2945 if (uNewEip > pVCpu->cpum.GstCtx.cs.u32Limit)
2946 return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
2947
2948 /*
2949 * V8086 checks and flag adjustments
2950 */
2951 if (Efl.Bits.u1VM)
2952 {
2953 if (Efl.Bits.u2IOPL == 3)
2954 {
2955 /* Preserve IOPL and clear RF. */
2956 uNewFlags &= ~(X86_EFL_IOPL | X86_EFL_RF);
2957 uNewFlags |= Efl.u & (X86_EFL_IOPL);
2958 }
2959 else if ( enmEffOpSize == IEMMODE_16BIT
2960 && ( !(uNewFlags & X86_EFL_IF)
2961 || !Efl.Bits.u1VIP )
2962 && !(uNewFlags & X86_EFL_TF) )
2963 {
2964 /* Move IF to VIF, clear RF and preserve IF and IOPL.*/
2965 uNewFlags &= ~X86_EFL_VIF;
2966 uNewFlags |= (uNewFlags & X86_EFL_IF) << (19 - 9);
2967 uNewFlags &= ~(X86_EFL_IF | X86_EFL_IOPL | X86_EFL_RF);
2968 uNewFlags |= Efl.u & (X86_EFL_IF | X86_EFL_IOPL);
2969 }
2970 else
2971 return iemRaiseGeneralProtectionFault0(pVCpu);
2972 Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
2973 }
2974
2975 /*
2976 * Commit the operation.
2977 */
2978#ifdef DBGFTRACE_ENABLED
2979 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
2980 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
2981#endif
2982 pVCpu->cpum.GstCtx.rsp = uNewRsp;
2983 pVCpu->cpum.GstCtx.rip = uNewEip;
2984 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
2985 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
2986 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
2987 pVCpu->cpum.GstCtx.cs.u64Base = (uint32_t)uNewCs << 4;
2988 /** @todo do we load attribs and limit as well? */
2989 Assert(uNewFlags & X86_EFL_1);
2990 IEMMISC_SET_EFL(pVCpu, uNewFlags);
2991
2992 /* Flush the prefetch buffer. */
2993#ifdef IEM_WITH_CODE_TLB
2994 pVCpu->iem.s.pbInstrBuf = NULL;
2995#else
2996 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
2997#endif
2998
2999 return VINF_SUCCESS;
3000}
3001
3002
3003/**
3004 * Loads a segment register when entering V8086 mode.
3005 *
3006 * @param pSReg The segment register.
3007 * @param uSeg The segment to load.
3008 */
3009static void iemCImplCommonV8086LoadSeg(PCPUMSELREG pSReg, uint16_t uSeg)
3010{
3011 pSReg->Sel = uSeg;
3012 pSReg->ValidSel = uSeg;
3013 pSReg->fFlags = CPUMSELREG_FLAGS_VALID;
3014 pSReg->u64Base = (uint32_t)uSeg << 4;
3015 pSReg->u32Limit = 0xffff;
3016 pSReg->Attr.u = X86_SEL_TYPE_RW_ACC | RT_BIT(4) /*!sys*/ | RT_BIT(7) /*P*/ | (3 /*DPL*/ << 5); /* VT-x wants 0xf3 */
3017 /** @todo Testcase: Check if VT-x really needs this and what it does itself when
3018 * IRET'ing to V8086. */
3019}
3020
3021
3022/**
3023 * Implements iret for protected mode returning to V8086 mode.
3024 *
3025 * @param uNewEip The new EIP.
3026 * @param uNewCs The new CS.
3027 * @param uNewFlags The new EFLAGS.
3028 * @param uNewRsp The RSP after the initial IRET frame.
3029 *
3030 * @note This can only be a 32-bit iret du to the X86_EFL_VM position.
3031 */
3032IEM_CIMPL_DEF_4(iemCImpl_iret_prot_v8086, uint32_t, uNewEip, uint16_t, uNewCs, uint32_t, uNewFlags, uint64_t, uNewRsp)
3033{
3034 RT_NOREF_PV(cbInstr);
3035 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
3036
3037 /*
3038 * Pop the V8086 specific frame bits off the stack.
3039 */
3040 VBOXSTRICTRC rcStrict;
3041 RTCPTRUNION uFrame;
3042 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
3043 if (rcStrict != VINF_SUCCESS)
3044 return rcStrict;
3045 uint32_t uNewEsp = uFrame.pu32[0];
3046 uint16_t uNewSs = uFrame.pu32[1];
3047 uint16_t uNewEs = uFrame.pu32[2];
3048 uint16_t uNewDs = uFrame.pu32[3];
3049 uint16_t uNewFs = uFrame.pu32[4];
3050 uint16_t uNewGs = uFrame.pu32[5];
3051 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
3052 if (rcStrict != VINF_SUCCESS)
3053 return rcStrict;
3054
3055 /*
3056 * Commit the operation.
3057 */
3058 uNewFlags &= X86_EFL_LIVE_MASK;
3059 uNewFlags |= X86_EFL_RA1_MASK;
3060#ifdef DBGFTRACE_ENABLED
3061 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
3062 pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
3063#endif
3064 Log7(("iemCImpl_iret_prot_v8086: %04x:%08x -> %04x:%04x %x %04x:%04x\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp));
3065
3066 IEMMISC_SET_EFL(pVCpu, uNewFlags);
3067 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.cs, uNewCs);
3068 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ss, uNewSs);
3069 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.es, uNewEs);
3070 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.ds, uNewDs);
3071 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.fs, uNewFs);
3072 iemCImplCommonV8086LoadSeg(&pVCpu->cpum.GstCtx.gs, uNewGs);
3073 pVCpu->cpum.GstCtx.rip = (uint16_t)uNewEip;
3074 pVCpu->cpum.GstCtx.rsp = uNewEsp; /** @todo check this out! */
3075 pVCpu->iem.s.uCpl = 3;
3076
3077 /* Flush the prefetch buffer. */
3078#ifdef IEM_WITH_CODE_TLB
3079 pVCpu->iem.s.pbInstrBuf = NULL;
3080#else
3081 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3082#endif
3083
3084 return VINF_SUCCESS;
3085}
3086
3087
3088/**
3089 * Implements iret for protected mode returning via a nested task.
3090 *
3091 * @param enmEffOpSize The effective operand size.
3092 */
3093IEM_CIMPL_DEF_1(iemCImpl_iret_prot_NestedTask, IEMMODE, enmEffOpSize)
3094{
3095 Log7(("iemCImpl_iret_prot_NestedTask:\n"));
3096#ifndef IEM_IMPLEMENTS_TASKSWITCH
3097 IEM_RETURN_ASPECT_NOT_IMPLEMENTED();
3098#else
3099 RT_NOREF_PV(enmEffOpSize);
3100
3101 /*
3102 * Read the segment selector in the link-field of the current TSS.
3103 */
3104 RTSEL uSelRet;
3105 VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pVCpu->cpum.GstCtx.tr.u64Base);
3106 if (rcStrict != VINF_SUCCESS)
3107 return rcStrict;
3108
3109 /*
3110 * Fetch the returning task's TSS descriptor from the GDT.
3111 */
3112 if (uSelRet & X86_SEL_LDT)
3113 {
3114 Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
3115 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
3116 }
3117
3118 IEMSELDESC TssDesc;
3119 rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
3120 if (rcStrict != VINF_SUCCESS)
3121 return rcStrict;
3122
3123 if (TssDesc.Legacy.Gate.u1DescType)
3124 {
3125 Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
3126 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3127 }
3128
3129 if ( TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_286_TSS_BUSY
3130 && TssDesc.Legacy.Gate.u4Type != X86_SEL_TYPE_SYS_386_TSS_BUSY)
3131 {
3132 Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
3133 return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3134 }
3135
3136 if (!TssDesc.Legacy.Gate.u1Present)
3137 {
3138 Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
3139 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
3140 }
3141
3142 uint32_t uNextEip = pVCpu->cpum.GstCtx.eip + cbInstr;
3143 return iemTaskSwitch(pVCpu, IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
3144 0 /* uCr2 */, uSelRet, &TssDesc);
3145#endif
3146}
3147
3148
3149/**
3150 * Implements iret for protected mode
3151 *
3152 * @param enmEffOpSize The effective operand size.
3153 */
3154IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
3155{
3156 NOREF(cbInstr);
3157 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3158
3159 /*
3160 * Nested task return.
3161 */
3162 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3163 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot_NestedTask, enmEffOpSize);
3164
3165 /*
3166 * Normal return.
3167 *
3168 * Do the stack bits, but don't commit RSP before everything checks
3169 * out right.
3170 */
3171 Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
3172 VBOXSTRICTRC rcStrict;
3173 RTCPTRUNION uFrame;
3174 uint16_t uNewCs;
3175 uint32_t uNewEip;
3176 uint32_t uNewFlags;
3177 uint64_t uNewRsp;
3178 if (enmEffOpSize == IEMMODE_32BIT)
3179 {
3180 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
3181 if (rcStrict != VINF_SUCCESS)
3182 return rcStrict;
3183 uNewEip = uFrame.pu32[0];
3184 uNewCs = (uint16_t)uFrame.pu32[1];
3185 uNewFlags = uFrame.pu32[2];
3186 }
3187 else
3188 {
3189 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
3190 if (rcStrict != VINF_SUCCESS)
3191 return rcStrict;
3192 uNewEip = uFrame.pu16[0];
3193 uNewCs = uFrame.pu16[1];
3194 uNewFlags = uFrame.pu16[2];
3195 }
3196 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3197 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3198 { /* extremely likely */ }
3199 else
3200 return rcStrict;
3201 Log7(("iemCImpl_iret_prot: uNewCs=%#06x uNewEip=%#010x uNewFlags=%#x uNewRsp=%#18llx uCpl=%u\n", uNewCs, uNewEip, uNewFlags, uNewRsp, pVCpu->iem.s.uCpl));
3202
3203 /*
3204 * We're hopefully not returning to V8086 mode...
3205 */
3206 if ( (uNewFlags & X86_EFL_VM)
3207 && pVCpu->iem.s.uCpl == 0)
3208 {
3209 Assert(enmEffOpSize == IEMMODE_32BIT);
3210 return IEM_CIMPL_CALL_4(iemCImpl_iret_prot_v8086, uNewEip, uNewCs, uNewFlags, uNewRsp);
3211 }
3212
3213 /*
3214 * Protected mode.
3215 */
3216 /* Read the CS descriptor. */
3217 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3218 {
3219 Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
3220 return iemRaiseGeneralProtectionFault0(pVCpu);
3221 }
3222
3223 IEMSELDESC DescCS;
3224 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3225 if (rcStrict != VINF_SUCCESS)
3226 {
3227 Log(("iret %04x:%08x - rcStrict=%Rrc when fetching CS\n", uNewCs, uNewEip, VBOXSTRICTRC_VAL(rcStrict)));
3228 return rcStrict;
3229 }
3230
3231 /* Must be a code descriptor. */
3232 if (!DescCS.Legacy.Gen.u1DescType)
3233 {
3234 Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3235 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3236 }
3237 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3238 {
3239 Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
3240 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3241 }
3242
3243#ifdef VBOX_WITH_RAW_MODE_NOT_R0
3244 /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
3245 PVM pVM = pVCpu->CTX_SUFF(pVM);
3246 if (EMIsRawRing0Enabled(pVM) && VM_IS_RAW_MODE_ENABLED(pVM))
3247 {
3248 if ((uNewCs & X86_SEL_RPL) == 1)
3249 {
3250 if ( pVCpu->iem.s.uCpl == 0
3251 && ( !EMIsRawRing1Enabled(pVM)
3252 || pVCpu->cpum.GstCtx.cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
3253 {
3254 Log(("iret: Ring-0 compression fix: uNewCS=%#x -> %#x\n", uNewCs, uNewCs & X86_SEL_MASK_OFF_RPL));
3255 uNewCs &= X86_SEL_MASK_OFF_RPL;
3256 }
3257# ifdef LOG_ENABLED
3258 else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
3259 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
3260# endif
3261 }
3262 else if ( (uNewCs & X86_SEL_RPL) == 2
3263 && EMIsRawRing1Enabled(pVM)
3264 && pVCpu->iem.s.uCpl <= 1)
3265 {
3266 Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
3267 uNewCs = (uNewCs & X86_SEL_MASK_OFF_RPL) | 2;
3268 }
3269 }
3270#endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
3271
3272
3273 /* Privilege checks. */
3274 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3275 {
3276 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3277 {
3278 Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3279 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3280 }
3281 }
3282 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3283 {
3284 Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
3285 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3286 }
3287 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3288 {
3289 Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
3290 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3291 }
3292
3293 /* Present? */
3294 if (!DescCS.Legacy.Gen.u1Present)
3295 {
3296 Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
3297 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3298 }
3299
3300 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3301
3302 /*
3303 * Return to outer level?
3304 */
3305 if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
3306 {
3307 uint16_t uNewSS;
3308 uint32_t uNewESP;
3309 if (enmEffOpSize == IEMMODE_32BIT)
3310 {
3311 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
3312 if (rcStrict != VINF_SUCCESS)
3313 return rcStrict;
3314/** @todo We might be popping a 32-bit ESP from the IRET frame, but whether
3315 * 16-bit or 32-bit are being loaded into SP depends on the D/B
3316 * bit of the popped SS selector it turns out. */
3317 uNewESP = uFrame.pu32[0];
3318 uNewSS = (uint16_t)uFrame.pu32[1];
3319 }
3320 else
3321 {
3322 rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
3323 if (rcStrict != VINF_SUCCESS)
3324 return rcStrict;
3325 uNewESP = uFrame.pu16[0];
3326 uNewSS = uFrame.pu16[1];
3327 }
3328 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
3329 if (rcStrict != VINF_SUCCESS)
3330 return rcStrict;
3331 Log7(("iemCImpl_iret_prot: uNewSS=%#06x uNewESP=%#010x\n", uNewSS, uNewESP));
3332
3333 /* Read the SS descriptor. */
3334 if (!(uNewSS & X86_SEL_MASK_OFF_RPL))
3335 {
3336 Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
3337 return iemRaiseGeneralProtectionFault0(pVCpu);
3338 }
3339
3340 IEMSELDESC DescSS;
3341 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
3342 if (rcStrict != VINF_SUCCESS)
3343 {
3344 Log(("iret %04x:%08x/%04x:%08x - %Rrc when fetching SS\n",
3345 uNewCs, uNewEip, uNewSS, uNewESP, VBOXSTRICTRC_VAL(rcStrict)));
3346 return rcStrict;
3347 }
3348
3349 /* Privilege checks. */
3350 if ((uNewSS & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3351 {
3352 Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
3353 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3354 }
3355 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3356 {
3357 Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
3358 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
3359 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3360 }
3361
3362 /* Must be a writeable data segment descriptor. */
3363 if (!DescSS.Legacy.Gen.u1DescType)
3364 {
3365 Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
3366 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3367 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3368 }
3369 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3370 {
3371 Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
3372 uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
3373 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
3374 }
3375
3376 /* Present? */
3377 if (!DescSS.Legacy.Gen.u1Present)
3378 {
3379 Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
3380 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
3381 }
3382
3383 uint32_t cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3384
3385 /* Check EIP. */
3386 if (uNewEip > cbLimitCS)
3387 {
3388 Log(("iret %04x:%08x/%04x:%08x -> EIP is out of bounds (%#x) -> #GP(0)\n",
3389 uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
3390 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3391 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3392 }
3393
3394 /*
3395 * Commit the changes, marking CS and SS accessed first since
3396 * that may fail.
3397 */
3398 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3399 {
3400 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3401 if (rcStrict != VINF_SUCCESS)
3402 return rcStrict;
3403 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3404 }
3405 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3406 {
3407 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
3408 if (rcStrict != VINF_SUCCESS)
3409 return rcStrict;
3410 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3411 }
3412
3413 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3414 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3415 if (enmEffOpSize != IEMMODE_16BIT)
3416 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3417 if (pVCpu->iem.s.uCpl == 0)
3418 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3419 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3420 fEFlagsMask |= X86_EFL_IF;
3421 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3422 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3423 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3424 fEFlagsNew &= ~fEFlagsMask;
3425 fEFlagsNew |= uNewFlags & fEFlagsMask;
3426#ifdef DBGFTRACE_ENABLED
3427 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
3428 pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3429 uNewCs, uNewEip, uNewFlags, uNewSS, uNewESP);
3430#endif
3431
3432 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3433 pVCpu->cpum.GstCtx.rip = uNewEip;
3434 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3435 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3436 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3437 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3438 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3439 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3440 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3441
3442 pVCpu->cpum.GstCtx.ss.Sel = uNewSS;
3443 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSS;
3444 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3445 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3446 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3447 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3448 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3449 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewESP;
3450 else
3451 pVCpu->cpum.GstCtx.rsp = uNewESP;
3452
3453 pVCpu->iem.s.uCpl = uNewCs & X86_SEL_RPL;
3454 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.ds);
3455 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.es);
3456 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.fs);
3457 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pVCpu->cpum.GstCtx.gs);
3458
3459 /* Done! */
3460
3461 }
3462 /*
3463 * Return to the same level.
3464 */
3465 else
3466 {
3467 /* Check EIP. */
3468 if (uNewEip > cbLimitCS)
3469 {
3470 Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
3471 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3472 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3473 }
3474
3475 /*
3476 * Commit the changes, marking CS first since it may fail.
3477 */
3478 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3479 {
3480 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3481 if (rcStrict != VINF_SUCCESS)
3482 return rcStrict;
3483 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3484 }
3485
3486 X86EFLAGS NewEfl;
3487 NewEfl.u = IEMMISC_GET_EFL(pVCpu);
3488 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3489 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3490 if (enmEffOpSize != IEMMODE_16BIT)
3491 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3492 if (pVCpu->iem.s.uCpl == 0)
3493 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
3494 else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
3495 fEFlagsMask |= X86_EFL_IF;
3496 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
3497 fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
3498 NewEfl.u &= ~fEFlagsMask;
3499 NewEfl.u |= fEFlagsMask & uNewFlags;
3500#ifdef DBGFTRACE_ENABLED
3501 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
3502 pVCpu->iem.s.uCpl, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.eip,
3503 uNewCs, uNewEip, uNewFlags, pVCpu->cpum.GstCtx.ss.Sel, uNewRsp);
3504#endif
3505
3506 IEMMISC_SET_EFL(pVCpu, NewEfl.u);
3507 pVCpu->cpum.GstCtx.rip = uNewEip;
3508 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3509 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3510 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3511 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3512 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3513 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3514 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3515 if (!pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig)
3516 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3517 else
3518 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3519 /* Done! */
3520 }
3521
3522 /* Flush the prefetch buffer. */
3523#ifdef IEM_WITH_CODE_TLB
3524 pVCpu->iem.s.pbInstrBuf = NULL;
3525#else
3526 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3527#endif
3528
3529 return VINF_SUCCESS;
3530}
3531
3532
3533/**
3534 * Implements iret for long mode
3535 *
3536 * @param enmEffOpSize The effective operand size.
3537 */
3538IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
3539{
3540 NOREF(cbInstr);
3541
3542 /*
3543 * Nested task return is not supported in long mode.
3544 */
3545 if (pVCpu->cpum.GstCtx.eflags.Bits.u1NT)
3546 {
3547 Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.eflags.u));
3548 return iemRaiseGeneralProtectionFault0(pVCpu);
3549 }
3550
3551 /*
3552 * Normal return.
3553 *
3554 * Do the stack bits, but don't commit RSP before everything checks
3555 * out right.
3556 */
3557 VBOXSTRICTRC rcStrict;
3558 RTCPTRUNION uFrame;
3559 uint64_t uNewRip;
3560 uint16_t uNewCs;
3561 uint16_t uNewSs;
3562 uint32_t uNewFlags;
3563 uint64_t uNewRsp;
3564 if (enmEffOpSize == IEMMODE_64BIT)
3565 {
3566 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
3567 if (rcStrict != VINF_SUCCESS)
3568 return rcStrict;
3569 uNewRip = uFrame.pu64[0];
3570 uNewCs = (uint16_t)uFrame.pu64[1];
3571 uNewFlags = (uint32_t)uFrame.pu64[2];
3572 uNewRsp = uFrame.pu64[3];
3573 uNewSs = (uint16_t)uFrame.pu64[4];
3574 }
3575 else if (enmEffOpSize == IEMMODE_32BIT)
3576 {
3577 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
3578 if (rcStrict != VINF_SUCCESS)
3579 return rcStrict;
3580 uNewRip = uFrame.pu32[0];
3581 uNewCs = (uint16_t)uFrame.pu32[1];
3582 uNewFlags = uFrame.pu32[2];
3583 uNewRsp = uFrame.pu32[3];
3584 uNewSs = (uint16_t)uFrame.pu32[4];
3585 }
3586 else
3587 {
3588 Assert(enmEffOpSize == IEMMODE_16BIT);
3589 rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
3590 if (rcStrict != VINF_SUCCESS)
3591 return rcStrict;
3592 uNewRip = uFrame.pu16[0];
3593 uNewCs = uFrame.pu16[1];
3594 uNewFlags = uFrame.pu16[2];
3595 uNewRsp = uFrame.pu16[3];
3596 uNewSs = uFrame.pu16[4];
3597 }
3598 rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
3599 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
3600 { /* extremely like */ }
3601 else
3602 return rcStrict;
3603 Log7(("iretq stack: cs:rip=%04x:%016RX64 rflags=%016RX64 ss:rsp=%04x:%016RX64\n", uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp));
3604
3605 /*
3606 * Check stuff.
3607 */
3608 /* Read the CS descriptor. */
3609 if (!(uNewCs & X86_SEL_MASK_OFF_RPL))
3610 {
3611 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3612 return iemRaiseGeneralProtectionFault0(pVCpu);
3613 }
3614
3615 IEMSELDESC DescCS;
3616 rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
3617 if (rcStrict != VINF_SUCCESS)
3618 {
3619 Log(("iret %04x:%016RX64/%04x:%016RX64 - rcStrict=%Rrc when fetching CS\n",
3620 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3621 return rcStrict;
3622 }
3623
3624 /* Must be a code descriptor. */
3625 if ( !DescCS.Legacy.Gen.u1DescType
3626 || !(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
3627 {
3628 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
3629 uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
3630 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3631 }
3632
3633 /* Privilege checks. */
3634 uint8_t const uNewCpl = uNewCs & X86_SEL_RPL;
3635 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF))
3636 {
3637 if ((uNewCs & X86_SEL_RPL) != DescCS.Legacy.Gen.u2Dpl)
3638 {
3639 Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3640 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3641 }
3642 }
3643 else if ((uNewCs & X86_SEL_RPL) < DescCS.Legacy.Gen.u2Dpl)
3644 {
3645 Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
3646 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3647 }
3648 if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
3649 {
3650 Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
3651 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
3652 }
3653
3654 /* Present? */
3655 if (!DescCS.Legacy.Gen.u1Present)
3656 {
3657 Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3658 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
3659 }
3660
3661 uint32_t cbLimitCS = X86DESC_LIMIT_G(&DescCS.Legacy);
3662
3663 /* Read the SS descriptor. */
3664 IEMSELDESC DescSS;
3665 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3666 {
3667 if ( !DescCS.Legacy.Gen.u1Long
3668 || DescCS.Legacy.Gen.u1DefBig /** @todo exactly how does iret (and others) behave with u1Long=1 and u1DefBig=1? \#GP(sel)? */
3669 || uNewCpl > 2) /** @todo verify SS=0 impossible for ring-3. */
3670 {
3671 Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3672 return iemRaiseGeneralProtectionFault0(pVCpu);
3673 }
3674 DescSS.Legacy.u = 0;
3675 }
3676 else
3677 {
3678 rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
3679 if (rcStrict != VINF_SUCCESS)
3680 {
3681 Log(("iret %04x:%016RX64/%04x:%016RX64 - %Rrc when fetching SS\n",
3682 uNewCs, uNewRip, uNewSs, uNewRsp, VBOXSTRICTRC_VAL(rcStrict)));
3683 return rcStrict;
3684 }
3685 }
3686
3687 /* Privilege checks. */
3688 if ((uNewSs & X86_SEL_RPL) != (uNewCs & X86_SEL_RPL))
3689 {
3690 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3691 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3692 }
3693
3694 uint32_t cbLimitSs;
3695 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3696 cbLimitSs = UINT32_MAX;
3697 else
3698 {
3699 if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
3700 {
3701 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
3702 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
3703 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3704 }
3705
3706 /* Must be a writeable data segment descriptor. */
3707 if (!DescSS.Legacy.Gen.u1DescType)
3708 {
3709 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
3710 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3711 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3712 }
3713 if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
3714 {
3715 Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
3716 uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
3717 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
3718 }
3719
3720 /* Present? */
3721 if (!DescSS.Legacy.Gen.u1Present)
3722 {
3723 Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
3724 return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
3725 }
3726 cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
3727 }
3728
3729 /* Check EIP. */
3730 if (DescCS.Legacy.Gen.u1Long)
3731 {
3732 if (!IEM_IS_CANONICAL(uNewRip))
3733 {
3734 Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
3735 uNewCs, uNewRip, uNewSs, uNewRsp));
3736 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3737 }
3738 }
3739 else
3740 {
3741 if (uNewRip > cbLimitCS)
3742 {
3743 Log(("iret %04x:%016RX64/%04x:%016RX64 -> EIP is out of bounds (%#x) -> #GP(0)\n",
3744 uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
3745 /** @todo: Which is it, #GP(0) or #GP(sel)? */
3746 return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
3747 }
3748 }
3749
3750 /*
3751 * Commit the changes, marking CS and SS accessed first since
3752 * that may fail.
3753 */
3754 /** @todo where exactly are these actually marked accessed by a real CPU? */
3755 if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3756 {
3757 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
3758 if (rcStrict != VINF_SUCCESS)
3759 return rcStrict;
3760 DescCS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3761 }
3762 if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
3763 {
3764 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
3765 if (rcStrict != VINF_SUCCESS)
3766 return rcStrict;
3767 DescSS.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
3768 }
3769
3770 uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
3771 | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
3772 if (enmEffOpSize != IEMMODE_16BIT)
3773 fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
3774 if (pVCpu->iem.s.uCpl == 0)
3775 fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
3776 else if (pVCpu->iem.s.uCpl <= pVCpu->cpum.GstCtx.eflags.Bits.u2IOPL)
3777 fEFlagsMask |= X86_EFL_IF;
3778 uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu);
3779 fEFlagsNew &= ~fEFlagsMask;
3780 fEFlagsNew |= uNewFlags & fEFlagsMask;
3781#ifdef DBGFTRACE_ENABLED
3782 RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
3783 pVCpu->iem.s.uCpl, uNewCpl, pVCpu->cpum.GstCtx.rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
3784#endif
3785
3786 IEMMISC_SET_EFL(pVCpu, fEFlagsNew);
3787 pVCpu->cpum.GstCtx.rip = uNewRip;
3788 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
3789 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
3790 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
3791 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESC_GET_HID_ATTR(&DescCS.Legacy);
3792 pVCpu->cpum.GstCtx.cs.u32Limit = cbLimitCS;
3793 pVCpu->cpum.GstCtx.cs.u64Base = X86DESC_BASE(&DescCS.Legacy);
3794 pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pVCpu);
3795 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long || pVCpu->cpum.GstCtx.cs.Attr.n.u1DefBig)
3796 pVCpu->cpum.GstCtx.rsp = uNewRsp;
3797 else
3798 pVCpu->cpum.GstCtx.sp = (uint16_t)uNewRsp;
3799 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
3800 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
3801 if (!(uNewSs & X86_SEL_MASK_OFF_RPL))
3802 {
3803 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3804 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_UNUSABLE | (uNewCpl << X86DESCATTR_DPL_SHIFT);
3805 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
3806 pVCpu->cpum.GstCtx.ss.u64Base = 0;
3807 Log2(("iretq new SS: NULL\n"));
3808 }
3809 else
3810 {
3811 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
3812 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESC_GET_HID_ATTR(&DescSS.Legacy);
3813 pVCpu->cpum.GstCtx.ss.u32Limit = cbLimitSs;
3814 pVCpu->cpum.GstCtx.ss.u64Base = X86DESC_BASE(&DescSS.Legacy);
3815 Log2(("iretq new SS: base=%#RX64 lim=%#x attr=%#x\n", pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
3816 }
3817
3818 if (pVCpu->iem.s.uCpl != uNewCpl)
3819 {
3820 pVCpu->iem.s.uCpl = uNewCpl;
3821 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.ds);
3822 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.es);
3823 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.fs);
3824 iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pVCpu->cpum.GstCtx.gs);
3825 }
3826
3827 /* Flush the prefetch buffer. */
3828#ifdef IEM_WITH_CODE_TLB
3829 pVCpu->iem.s.pbInstrBuf = NULL;
3830#else
3831 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
3832#endif
3833
3834 return VINF_SUCCESS;
3835}
3836
3837
3838/**
3839 * Implements iret.
3840 *
3841 * @param enmEffOpSize The effective operand size.
3842 */
3843IEM_CIMPL_DEF_1(iemCImpl_iret, IEMMODE, enmEffOpSize)
3844{
3845 bool const fBlockingNmi = VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
3846
3847#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
3848 /*
3849 * Record whether NMIs (or virtual-NMIs) were unblocked by execution of this
3850 * IRET instruction. We need to provide this information as part of some VM-exits.
3851 *
3852 * See Intel spec. 27.2.2 "Information for VM Exits Due to Vectored Events".
3853 */
3854 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
3855 pVCpu->cpum.GstCtx.hwvirt.vmx.fNmiUnblockingIret = fBlockingNmi;
3856#endif
3857
3858 /*
3859 * The SVM nested-guest intercept for IRET takes priority over all exceptions,
3860 * The NMI is still held pending (which I assume means blocking of further NMIs
3861 * is in effect).
3862 *
3863 * See AMD spec. 15.9 "Instruction Intercepts".
3864 * See AMD spec. 15.21.9 "NMI Support".
3865 */
3866 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IRET))
3867 {
3868 Log(("iret: Guest intercept -> #VMEXIT\n"));
3869 IEM_SVM_UPDATE_NRIP(pVCpu);
3870 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IRET, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
3871 }
3872
3873 /*
3874 * Clear NMI blocking, if any, before causing any further exceptions.
3875 * See Intel spec. 6.7.1 "Handling Multiple NMIs".
3876 */
3877 if (fBlockingNmi)
3878 VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
3879
3880 /*
3881 * Call a mode specific worker.
3882 */
3883 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
3884 return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
3885 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_MASK | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_LDTR);
3886 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
3887 return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
3888 return IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
3889}
3890
3891
3892static void iemLoadallSetSelector(PVMCPU pVCpu, uint8_t iSegReg, uint16_t uSel)
3893{
3894 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3895
3896 pHid->Sel = uSel;
3897 pHid->ValidSel = uSel;
3898 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
3899}
3900
3901
3902static void iemLoadall286SetDescCache(PVMCPU pVCpu, uint8_t iSegReg, uint8_t const *pbMem)
3903{
3904 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
3905
3906 /* The base is in the first three bytes. */
3907 pHid->u64Base = pbMem[0] + (pbMem[1] << 8) + (pbMem[2] << 16);
3908 /* The attributes are in the fourth byte. */
3909 pHid->Attr.u = pbMem[3];
3910 /* The limit is in the last two bytes. */
3911 pHid->u32Limit = pbMem[4] + (pbMem[5] << 8);
3912}
3913
3914
3915/**
3916 * Implements 286 LOADALL (286 CPUs only).
3917 */
3918IEM_CIMPL_DEF_0(iemCImpl_loadall286)
3919{
3920 NOREF(cbInstr);
3921
3922 /* Data is loaded from a buffer at 800h. No checks are done on the
3923 * validity of loaded state.
3924 *
3925 * LOADALL only loads the internal CPU state, it does not access any
3926 * GDT, LDT, or similar tables.
3927 */
3928
3929 if (pVCpu->iem.s.uCpl != 0)
3930 {
3931 Log(("loadall286: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
3932 return iemRaiseGeneralProtectionFault0(pVCpu);
3933 }
3934
3935 uint8_t const *pbMem = NULL;
3936 uint16_t const *pa16Mem;
3937 uint8_t const *pa8Mem;
3938 RTGCPHYS GCPtrStart = 0x800; /* Fixed table location. */
3939 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R);
3940 if (rcStrict != VINF_SUCCESS)
3941 return rcStrict;
3942
3943 /* The MSW is at offset 0x06. */
3944 pa16Mem = (uint16_t const *)(pbMem + 0x06);
3945 /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
3946 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3947 uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
3948 uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
3949
3950 CPUMSetGuestCR0(pVCpu, uNewCr0);
3951 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCr0);
3952
3953 /* Inform PGM if mode changed. */
3954 if ((uNewCr0 & X86_CR0_PE) != (uOldCr0 & X86_CR0_PE))
3955 {
3956 int rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
3957 AssertRCReturn(rc, rc);
3958 /* ignore informational status codes */
3959 }
3960 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
3961
3962 /* TR selector is at offset 0x16. */
3963 pa16Mem = (uint16_t const *)(pbMem + 0x16);
3964 pVCpu->cpum.GstCtx.tr.Sel = pa16Mem[0];
3965 pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
3966 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
3967
3968 /* Followed by FLAGS... */
3969 pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
3970 pVCpu->cpum.GstCtx.ip = pa16Mem[2]; /* ...and IP. */
3971
3972 /* LDT is at offset 0x1C. */
3973 pa16Mem = (uint16_t const *)(pbMem + 0x1C);
3974 pVCpu->cpum.GstCtx.ldtr.Sel = pa16Mem[0];
3975 pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
3976 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
3977
3978 /* Segment registers are at offset 0x1E. */
3979 pa16Mem = (uint16_t const *)(pbMem + 0x1E);
3980 iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
3981 iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
3982 iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
3983 iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
3984
3985 /* GPRs are at offset 0x26. */
3986 pa16Mem = (uint16_t const *)(pbMem + 0x26);
3987 pVCpu->cpum.GstCtx.di = pa16Mem[0];
3988 pVCpu->cpum.GstCtx.si = pa16Mem[1];
3989 pVCpu->cpum.GstCtx.bp = pa16Mem[2];
3990 pVCpu->cpum.GstCtx.sp = pa16Mem[3];
3991 pVCpu->cpum.GstCtx.bx = pa16Mem[4];
3992 pVCpu->cpum.GstCtx.dx = pa16Mem[5];
3993 pVCpu->cpum.GstCtx.cx = pa16Mem[6];
3994 pVCpu->cpum.GstCtx.ax = pa16Mem[7];
3995
3996 /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
3997 iemLoadall286SetDescCache(pVCpu, X86_SREG_ES, pbMem + 0x36);
3998 iemLoadall286SetDescCache(pVCpu, X86_SREG_CS, pbMem + 0x3C);
3999 iemLoadall286SetDescCache(pVCpu, X86_SREG_SS, pbMem + 0x42);
4000 iemLoadall286SetDescCache(pVCpu, X86_SREG_DS, pbMem + 0x48);
4001
4002 /* GDTR contents are at offset 0x4E, 6 bytes. */
4003 RTGCPHYS GCPtrBase;
4004 uint16_t cbLimit;
4005 pa8Mem = pbMem + 0x4E;
4006 /* NB: Fourth byte "should be zero"; we are ignoring it. */
4007 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4008 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4009 CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4010
4011 /* IDTR contents are at offset 0x5A, 6 bytes. */
4012 pa8Mem = pbMem + 0x5A;
4013 GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
4014 cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
4015 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4016
4017 Log(("LOADALL: GDTR:%08RX64/%04X, IDTR:%08RX64/%04X\n", pVCpu->cpum.GstCtx.gdtr.pGdt, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.idtr.pIdt, pVCpu->cpum.GstCtx.idtr.cbIdt));
4018 Log(("LOADALL: CS:%04X, CS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.cs.u64Base, pVCpu->cpum.GstCtx.cs.u32Limit, pVCpu->cpum.GstCtx.cs.Attr.u));
4019 Log(("LOADALL: DS:%04X, DS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ds.Sel, pVCpu->cpum.GstCtx.ds.u64Base, pVCpu->cpum.GstCtx.ds.u32Limit, pVCpu->cpum.GstCtx.ds.Attr.u));
4020 Log(("LOADALL: ES:%04X, ES base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.es.Sel, pVCpu->cpum.GstCtx.es.u64Base, pVCpu->cpum.GstCtx.es.u32Limit, pVCpu->cpum.GstCtx.es.Attr.u));
4021 Log(("LOADALL: SS:%04X, SS base:%08X, limit:%04X, attrs:%02X\n", pVCpu->cpum.GstCtx.ss.Sel, pVCpu->cpum.GstCtx.ss.u64Base, pVCpu->cpum.GstCtx.ss.u32Limit, pVCpu->cpum.GstCtx.ss.Attr.u));
4022 Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
4023
4024 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
4025 if (rcStrict != VINF_SUCCESS)
4026 return rcStrict;
4027
4028 /* The CPL may change. It is taken from the "DPL fields of the SS and CS
4029 * descriptor caches" but there is no word as to what happens if those are
4030 * not identical (probably bad things).
4031 */
4032 pVCpu->iem.s.uCpl = pVCpu->cpum.GstCtx.cs.Attr.n.u2Dpl;
4033
4034 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS | CPUM_CHANGED_IDTR | CPUM_CHANGED_GDTR | CPUM_CHANGED_TR | CPUM_CHANGED_LDTR);
4035
4036 /* Flush the prefetch buffer. */
4037#ifdef IEM_WITH_CODE_TLB
4038 pVCpu->iem.s.pbInstrBuf = NULL;
4039#else
4040 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4041#endif
4042 return rcStrict;
4043}
4044
4045
4046/**
4047 * Implements SYSCALL (AMD and Intel64).
4048 *
4049 * @param enmEffOpSize The effective operand size.
4050 */
4051IEM_CIMPL_DEF_0(iemCImpl_syscall)
4052{
4053 /** @todo hack, LOADALL should be decoded as such on a 286. */
4054 if (RT_UNLIKELY(pVCpu->iem.s.uTargetCpu == IEMTARGETCPU_286))
4055 return iemCImpl_loadall286(pVCpu, cbInstr);
4056
4057 /*
4058 * Check preconditions.
4059 *
4060 * Note that CPUs described in the documentation may load a few odd values
4061 * into CS and SS than we allow here. This has yet to be checked on real
4062 * hardware.
4063 */
4064 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4065 {
4066 Log(("syscall: Not enabled in EFER -> #UD\n"));
4067 return iemRaiseUndefinedOpcode(pVCpu);
4068 }
4069 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4070 {
4071 Log(("syscall: Protected mode is required -> #GP(0)\n"));
4072 return iemRaiseGeneralProtectionFault0(pVCpu);
4073 }
4074 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4075 {
4076 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4077 return iemRaiseUndefinedOpcode(pVCpu);
4078 }
4079
4080 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4081
4082 /** @todo verify RPL ignoring and CS=0xfff8 (i.e. SS == 0). */
4083 /** @todo what about LDT selectors? Shouldn't matter, really. */
4084 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSCALL_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4085 uint16_t uNewSs = uNewCs + 8;
4086 if (uNewCs == 0 || uNewSs == 0)
4087 {
4088 Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4089 return iemRaiseGeneralProtectionFault0(pVCpu);
4090 }
4091
4092 /* Long mode and legacy mode differs. */
4093 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4094 {
4095 uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.msrLSTAR : pVCpu->cpum.GstCtx. msrCSTAR;
4096
4097 /* This test isn't in the docs, but I'm not trusting the guys writing
4098 the MSRs to have validated the values as canonical like they should. */
4099 if (!IEM_IS_CANONICAL(uNewRip))
4100 {
4101 Log(("syscall: Only available in long mode on intel -> #UD\n"));
4102 return iemRaiseUndefinedOpcode(pVCpu);
4103 }
4104
4105 /*
4106 * Commit it.
4107 */
4108 Log(("syscall: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, uNewRip));
4109 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.rip + cbInstr;
4110 pVCpu->cpum.GstCtx.rip = uNewRip;
4111
4112 pVCpu->cpum.GstCtx.rflags.u &= ~X86_EFL_RF;
4113 pVCpu->cpum.GstCtx.r11 = pVCpu->cpum.GstCtx.rflags.u;
4114 pVCpu->cpum.GstCtx.rflags.u &= ~pVCpu->cpum.GstCtx.msrSFMASK;
4115 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4116
4117 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4118 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4119 }
4120 else
4121 {
4122 /*
4123 * Commit it.
4124 */
4125 Log(("syscall: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n",
4126 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, (uint32_t)(pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK)));
4127 pVCpu->cpum.GstCtx.rcx = pVCpu->cpum.GstCtx.eip + cbInstr;
4128 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.msrSTAR & MSR_K6_STAR_SYSCALL_EIP_MASK;
4129 pVCpu->cpum.GstCtx.rflags.u &= ~(X86_EFL_VM | X86_EFL_IF | X86_EFL_RF);
4130
4131 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC;
4132 pVCpu->cpum.GstCtx.ss.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_RW_ACC;
4133 }
4134 pVCpu->cpum.GstCtx.cs.Sel = uNewCs;
4135 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs;
4136 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4137 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4138 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4139
4140 pVCpu->cpum.GstCtx.ss.Sel = uNewSs;
4141 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs;
4142 pVCpu->cpum.GstCtx.ss.u64Base = 0;
4143 pVCpu->cpum.GstCtx.ss.u32Limit = UINT32_MAX;
4144 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4145
4146 /* Flush the prefetch buffer. */
4147#ifdef IEM_WITH_CODE_TLB
4148 pVCpu->iem.s.pbInstrBuf = NULL;
4149#else
4150 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4151#endif
4152
4153 return VINF_SUCCESS;
4154}
4155
4156
4157/**
4158 * Implements SYSRET (AMD and Intel64).
4159 */
4160IEM_CIMPL_DEF_0(iemCImpl_sysret)
4161
4162{
4163 RT_NOREF_PV(cbInstr);
4164
4165 /*
4166 * Check preconditions.
4167 *
4168 * Note that CPUs described in the documentation may load a few odd values
4169 * into CS and SS than we allow here. This has yet to be checked on real
4170 * hardware.
4171 */
4172 if (!(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_SCE))
4173 {
4174 Log(("sysret: Not enabled in EFER -> #UD\n"));
4175 return iemRaiseUndefinedOpcode(pVCpu);
4176 }
4177 if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4178 {
4179 Log(("sysret: Only available in long mode on intel -> #UD\n"));
4180 return iemRaiseUndefinedOpcode(pVCpu);
4181 }
4182 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE))
4183 {
4184 Log(("sysret: Protected mode is required -> #GP(0)\n"));
4185 return iemRaiseGeneralProtectionFault0(pVCpu);
4186 }
4187 if (pVCpu->iem.s.uCpl != 0)
4188 {
4189 Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
4190 return iemRaiseGeneralProtectionFault0(pVCpu);
4191 }
4192
4193 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SYSCALL_MSRS);
4194
4195 /** @todo Does SYSRET verify CS != 0 and SS != 0? Neither is valid in ring-3. */
4196 uint16_t uNewCs = (pVCpu->cpum.GstCtx.msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
4197 uint16_t uNewSs = uNewCs + 8;
4198 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4199 uNewCs += 16;
4200 if (uNewCs == 0 || uNewSs == 0)
4201 {
4202 Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
4203 return iemRaiseGeneralProtectionFault0(pVCpu);
4204 }
4205
4206 /*
4207 * Commit it.
4208 */
4209 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4210 {
4211 if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
4212 {
4213 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
4214 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.r11));
4215 /* Note! We disregard intel manual regarding the RCX cananonical
4216 check, ask intel+xen why AMD doesn't do it. */
4217 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4218 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_L | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4219 | (3 << X86DESCATTR_DPL_SHIFT);
4220 }
4221 else
4222 {
4223 Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%08RX32 [r11=%#llx]\n",
4224 pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.rip, pVCpu->cpum.GstCtx.rflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx, pVCpu->cpum.GstCtx.r11));
4225 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.ecx;
4226 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4227 | (3 << X86DESCATTR_DPL_SHIFT);
4228 }
4229 /** @todo testcase: See what kind of flags we can make SYSRET restore and
4230 * what it really ignores. RF and VM are hinted at being zero, by AMD. */
4231 pVCpu->cpum.GstCtx.rflags.u = pVCpu->cpum.GstCtx.r11 & (X86_EFL_POPF_BITS | X86_EFL_VIF | X86_EFL_VIP);
4232 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_1;
4233 }
4234 else
4235 {
4236 Log(("sysret: %04x:%08RX32 [efl=%#x] -> %04x:%08RX32\n", pVCpu->cpum.GstCtx.cs, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, uNewCs, pVCpu->cpum.GstCtx.ecx));
4237 pVCpu->cpum.GstCtx.rip = pVCpu->cpum.GstCtx.rcx;
4238 pVCpu->cpum.GstCtx.rflags.u |= X86_EFL_IF;
4239 pVCpu->cpum.GstCtx.cs.Attr.u = X86DESCATTR_P | X86DESCATTR_G | X86DESCATTR_D | X86DESCATTR_DT | X86_SEL_TYPE_ER_ACC
4240 | (3 << X86DESCATTR_DPL_SHIFT);
4241 }
4242 pVCpu->cpum.GstCtx.cs.Sel = uNewCs | 3;
4243 pVCpu->cpum.GstCtx.cs.ValidSel = uNewCs | 3;
4244 pVCpu->cpum.GstCtx.cs.u64Base = 0;
4245 pVCpu->cpum.GstCtx.cs.u32Limit = UINT32_MAX;
4246 pVCpu->cpum.GstCtx.cs.fFlags = CPUMSELREG_FLAGS_VALID;
4247
4248 pVCpu->cpum.GstCtx.ss.Sel = uNewSs | 3;
4249 pVCpu->cpum.GstCtx.ss.ValidSel = uNewSs | 3;
4250 pVCpu->cpum.GstCtx.ss.fFlags = CPUMSELREG_FLAGS_VALID;
4251 /* The SS hidden bits remains unchanged says AMD. To that I say "Yeah, right!". */
4252 pVCpu->cpum.GstCtx.ss.Attr.u |= (3 << X86DESCATTR_DPL_SHIFT);
4253 /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
4254 * on sysret. */
4255
4256 /* Flush the prefetch buffer. */
4257#ifdef IEM_WITH_CODE_TLB
4258 pVCpu->iem.s.pbInstrBuf = NULL;
4259#else
4260 pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
4261#endif
4262
4263 return VINF_SUCCESS;
4264}
4265
4266
4267/**
4268 * Common worker for 'pop SReg', 'mov SReg, GReg' and 'lXs GReg, reg/mem'.
4269 *
4270 * @param iSegReg The segment register number (valid).
4271 * @param uSel The new selector value.
4272 */
4273IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
4274{
4275 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_SREG_FROM_IDX(iSegReg));
4276 uint16_t *pSel = iemSRegRef(pVCpu, iSegReg);
4277 PCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iSegReg);
4278
4279 Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
4280
4281 /*
4282 * Real mode and V8086 mode are easy.
4283 */
4284 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4285 {
4286 *pSel = uSel;
4287 pHid->u64Base = (uint32_t)uSel << 4;
4288 pHid->ValidSel = uSel;
4289 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4290#if 0 /* AMD Volume 2, chapter 4.1 - "real mode segmentation" - states that limit and attributes are untouched. */
4291 /** @todo Does the CPU actually load limits and attributes in the
4292 * real/V8086 mode segment load case? It doesn't for CS in far
4293 * jumps... Affects unreal mode. */
4294 pHid->u32Limit = 0xffff;
4295 pHid->Attr.u = 0;
4296 pHid->Attr.n.u1Present = 1;
4297 pHid->Attr.n.u1DescType = 1;
4298 pHid->Attr.n.u4Type = iSegReg != X86_SREG_CS
4299 ? X86_SEL_TYPE_RW
4300 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
4301#endif
4302 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4303 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4304 return VINF_SUCCESS;
4305 }
4306
4307 /*
4308 * Protected mode.
4309 *
4310 * Check if it's a null segment selector value first, that's OK for DS, ES,
4311 * FS and GS. If not null, then we have to load and parse the descriptor.
4312 */
4313 if (!(uSel & X86_SEL_MASK_OFF_RPL))
4314 {
4315 Assert(iSegReg != X86_SREG_CS); /** @todo testcase for \#UD on MOV CS, ax! */
4316 if (iSegReg == X86_SREG_SS)
4317 {
4318 /* In 64-bit kernel mode, the stack can be 0 because of the way
4319 interrupts are dispatched. AMD seems to have a slighly more
4320 relaxed relationship to SS.RPL than intel does. */
4321 /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
4322 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4323 || pVCpu->iem.s.uCpl > 2
4324 || ( uSel != pVCpu->iem.s.uCpl
4325 && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
4326 {
4327 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
4328 return iemRaiseGeneralProtectionFault0(pVCpu);
4329 }
4330 }
4331
4332 *pSel = uSel; /* Not RPL, remember :-) */
4333 iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
4334 if (iSegReg == X86_SREG_SS)
4335 pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
4336
4337 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4338 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4339
4340 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4341 return VINF_SUCCESS;
4342 }
4343
4344 /* Fetch the descriptor. */
4345 IEMSELDESC Desc;
4346 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
4347 if (rcStrict != VINF_SUCCESS)
4348 return rcStrict;
4349
4350 /* Check GPs first. */
4351 if (!Desc.Legacy.Gen.u1DescType)
4352 {
4353 Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
4354 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4355 }
4356 if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
4357 {
4358 if ( (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE)
4359 || !(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_WRITE) )
4360 {
4361 Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
4362 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4363 }
4364 if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
4365 {
4366 Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
4367 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4368 }
4369 if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
4370 {
4371 Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
4372 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4373 }
4374 }
4375 else
4376 {
4377 if ((Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4378 {
4379 Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
4380 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4381 }
4382 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4383 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4384 {
4385#if 0 /* this is what intel says. */
4386 if ( (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
4387 && pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4388 {
4389 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
4390 iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4391 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4392 }
4393#else /* this is what makes more sense. */
4394 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4395 {
4396 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
4397 iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
4398 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4399 }
4400 if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4401 {
4402 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
4403 iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
4404 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
4405 }
4406#endif
4407 }
4408 }
4409
4410 /* Is it there? */
4411 if (!Desc.Legacy.Gen.u1Present)
4412 {
4413 Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
4414 return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
4415 }
4416
4417 /* The base and limit. */
4418 uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
4419 uint64_t u64Base = X86DESC_BASE(&Desc.Legacy);
4420
4421 /*
4422 * Ok, everything checked out fine. Now set the accessed bit before
4423 * committing the result into the registers.
4424 */
4425 if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
4426 {
4427 rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
4428 if (rcStrict != VINF_SUCCESS)
4429 return rcStrict;
4430 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_ACCESSED;
4431 }
4432
4433 /* commit */
4434 *pSel = uSel;
4435 pHid->Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
4436 pHid->u32Limit = cbLimit;
4437 pHid->u64Base = u64Base;
4438 pHid->ValidSel = uSel;
4439 pHid->fFlags = CPUMSELREG_FLAGS_VALID;
4440
4441 /** @todo check if the hidden bits are loaded correctly for 64-bit
4442 * mode. */
4443 Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
4444
4445 CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
4446 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4447 return VINF_SUCCESS;
4448}
4449
4450
4451/**
4452 * Implements 'mov SReg, r/m'.
4453 *
4454 * @param iSegReg The segment register number (valid).
4455 * @param uSel The new selector value.
4456 */
4457IEM_CIMPL_DEF_2(iemCImpl_load_SReg, uint8_t, iSegReg, uint16_t, uSel)
4458{
4459 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4460 if (rcStrict == VINF_SUCCESS)
4461 {
4462 if (iSegReg == X86_SREG_SS)
4463 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4464 }
4465 return rcStrict;
4466}
4467
4468
4469/**
4470 * Implements 'pop SReg'.
4471 *
4472 * @param iSegReg The segment register number (valid).
4473 * @param enmEffOpSize The efficient operand size (valid).
4474 */
4475IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
4476{
4477 VBOXSTRICTRC rcStrict;
4478
4479 /*
4480 * Read the selector off the stack and join paths with mov ss, reg.
4481 */
4482 RTUINT64U TmpRsp;
4483 TmpRsp.u = pVCpu->cpum.GstCtx.rsp;
4484 switch (enmEffOpSize)
4485 {
4486 case IEMMODE_16BIT:
4487 {
4488 uint16_t uSel;
4489 rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
4490 if (rcStrict == VINF_SUCCESS)
4491 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4492 break;
4493 }
4494
4495 case IEMMODE_32BIT:
4496 {
4497 uint32_t u32Value;
4498 rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
4499 if (rcStrict == VINF_SUCCESS)
4500 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
4501 break;
4502 }
4503
4504 case IEMMODE_64BIT:
4505 {
4506 uint64_t u64Value;
4507 rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
4508 if (rcStrict == VINF_SUCCESS)
4509 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
4510 break;
4511 }
4512 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4513 }
4514
4515 /*
4516 * Commit the stack on success.
4517 */
4518 if (rcStrict == VINF_SUCCESS)
4519 {
4520 pVCpu->cpum.GstCtx.rsp = TmpRsp.u;
4521 if (iSegReg == X86_SREG_SS)
4522 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
4523 }
4524 return rcStrict;
4525}
4526
4527
4528/**
4529 * Implements lgs, lfs, les, lds & lss.
4530 */
4531IEM_CIMPL_DEF_5(iemCImpl_load_SReg_Greg,
4532 uint16_t, uSel,
4533 uint64_t, offSeg,
4534 uint8_t, iSegReg,
4535 uint8_t, iGReg,
4536 IEMMODE, enmEffOpSize)
4537{
4538 /*
4539 * Use iemCImpl_LoadSReg to do the tricky segment register loading.
4540 */
4541 /** @todo verify and test that mov, pop and lXs works the segment
4542 * register loading in the exact same way. */
4543 VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
4544 if (rcStrict == VINF_SUCCESS)
4545 {
4546 switch (enmEffOpSize)
4547 {
4548 case IEMMODE_16BIT:
4549 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4550 break;
4551 case IEMMODE_32BIT:
4552 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4553 break;
4554 case IEMMODE_64BIT:
4555 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
4556 break;
4557 IEM_NOT_REACHED_DEFAULT_CASE_RET();
4558 }
4559 }
4560
4561 return rcStrict;
4562}
4563
4564
4565/**
4566 * Helper for VERR, VERW, LAR, and LSL and loads the descriptor into memory.
4567 *
4568 * @retval VINF_SUCCESS on success.
4569 * @retval VINF_IEM_SELECTOR_NOT_OK if the selector isn't ok.
4570 * @retval iemMemFetchSysU64 return value.
4571 *
4572 * @param pVCpu The cross context virtual CPU structure of the calling thread.
4573 * @param uSel The selector value.
4574 * @param fAllowSysDesc Whether system descriptors are OK or not.
4575 * @param pDesc Where to return the descriptor on success.
4576 */
4577static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
4578{
4579 pDesc->Long.au64[0] = 0;
4580 pDesc->Long.au64[1] = 0;
4581
4582 if (!(uSel & X86_SEL_MASK_OFF_RPL)) /** @todo test this on 64-bit. */
4583 return VINF_IEM_SELECTOR_NOT_OK;
4584
4585 /* Within the table limits? */
4586 RTGCPTR GCPtrBase;
4587 if (uSel & X86_SEL_LDT)
4588 {
4589 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
4590 if ( !pVCpu->cpum.GstCtx.ldtr.Attr.n.u1Present
4591 || (uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.ldtr.u32Limit )
4592 return VINF_IEM_SELECTOR_NOT_OK;
4593 GCPtrBase = pVCpu->cpum.GstCtx.ldtr.u64Base;
4594 }
4595 else
4596 {
4597 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4598 if ((uSel | X86_SEL_RPL_LDT) > pVCpu->cpum.GstCtx.gdtr.cbGdt)
4599 return VINF_IEM_SELECTOR_NOT_OK;
4600 GCPtrBase = pVCpu->cpum.GstCtx.gdtr.pGdt;
4601 }
4602
4603 /* Fetch the descriptor. */
4604 VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
4605 if (rcStrict != VINF_SUCCESS)
4606 return rcStrict;
4607 if (!pDesc->Legacy.Gen.u1DescType)
4608 {
4609 if (!fAllowSysDesc)
4610 return VINF_IEM_SELECTOR_NOT_OK;
4611 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4612 {
4613 rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
4614 if (rcStrict != VINF_SUCCESS)
4615 return rcStrict;
4616 }
4617
4618 }
4619
4620 return VINF_SUCCESS;
4621}
4622
4623
4624/**
4625 * Implements verr (fWrite = false) and verw (fWrite = true).
4626 */
4627IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
4628{
4629 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4630
4631 /** @todo figure whether the accessed bit is set or not. */
4632
4633 bool fAccessible = true;
4634 IEMSELDESC Desc;
4635 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
4636 if (rcStrict == VINF_SUCCESS)
4637 {
4638 /* Check the descriptor, order doesn't matter much here. */
4639 if ( !Desc.Legacy.Gen.u1DescType
4640 || !Desc.Legacy.Gen.u1Present)
4641 fAccessible = false;
4642 else
4643 {
4644 if ( fWrite
4645 ? (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE
4646 : (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
4647 fAccessible = false;
4648
4649 /** @todo testcase for the conforming behavior. */
4650 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4651 != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
4652 {
4653 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4654 fAccessible = false;
4655 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4656 fAccessible = false;
4657 }
4658 }
4659
4660 }
4661 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4662 fAccessible = false;
4663 else
4664 return rcStrict;
4665
4666 /* commit */
4667 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fAccessible;
4668
4669 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4670 return VINF_SUCCESS;
4671}
4672
4673
4674/**
4675 * Implements LAR and LSL with 64-bit operand size.
4676 *
4677 * @returns VINF_SUCCESS.
4678 * @param pu16Dst Pointer to the destination register.
4679 * @param uSel The selector to load details for.
4680 * @param fIsLar true = LAR, false = LSL.
4681 */
4682IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, bool, fIsLar)
4683{
4684 Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
4685
4686 /** @todo figure whether the accessed bit is set or not. */
4687
4688 bool fDescOk = true;
4689 IEMSELDESC Desc;
4690 VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, true /*fAllowSysDesc*/, &Desc);
4691 if (rcStrict == VINF_SUCCESS)
4692 {
4693 /*
4694 * Check the descriptor type.
4695 */
4696 if (!Desc.Legacy.Gen.u1DescType)
4697 {
4698 if (CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu)))
4699 {
4700 if (Desc.Long.Gen.u5Zeros)
4701 fDescOk = false;
4702 else
4703 switch (Desc.Long.Gen.u4Type)
4704 {
4705 /** @todo Intel lists 0 as valid for LSL, verify whether that's correct */
4706 case AMD64_SEL_TYPE_SYS_TSS_AVAIL:
4707 case AMD64_SEL_TYPE_SYS_TSS_BUSY:
4708 case AMD64_SEL_TYPE_SYS_LDT: /** @todo Intel lists this as invalid for LAR, AMD and 32-bit does otherwise. */
4709 break;
4710 case AMD64_SEL_TYPE_SYS_CALL_GATE:
4711 fDescOk = fIsLar;
4712 break;
4713 default:
4714 fDescOk = false;
4715 break;
4716 }
4717 }
4718 else
4719 {
4720 switch (Desc.Long.Gen.u4Type)
4721 {
4722 case X86_SEL_TYPE_SYS_286_TSS_AVAIL:
4723 case X86_SEL_TYPE_SYS_286_TSS_BUSY:
4724 case X86_SEL_TYPE_SYS_386_TSS_AVAIL:
4725 case X86_SEL_TYPE_SYS_386_TSS_BUSY:
4726 case X86_SEL_TYPE_SYS_LDT:
4727 break;
4728 case X86_SEL_TYPE_SYS_286_CALL_GATE:
4729 case X86_SEL_TYPE_SYS_TASK_GATE:
4730 case X86_SEL_TYPE_SYS_386_CALL_GATE:
4731 fDescOk = fIsLar;
4732 break;
4733 default:
4734 fDescOk = false;
4735 break;
4736 }
4737 }
4738 }
4739 if (fDescOk)
4740 {
4741 /*
4742 * Check the RPL/DPL/CPL interaction..
4743 */
4744 /** @todo testcase for the conforming behavior. */
4745 if ( (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) != (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)
4746 || !Desc.Legacy.Gen.u1DescType)
4747 {
4748 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
4749 fDescOk = false;
4750 else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
4751 fDescOk = false;
4752 }
4753 }
4754
4755 if (fDescOk)
4756 {
4757 /*
4758 * All fine, start committing the result.
4759 */
4760 if (fIsLar)
4761 *pu64Dst = Desc.Legacy.au32[1] & UINT32_C(0x00ffff00);
4762 else
4763 *pu64Dst = X86DESC_LIMIT_G(&Desc.Legacy);
4764 }
4765
4766 }
4767 else if (rcStrict == VINF_IEM_SELECTOR_NOT_OK)
4768 fDescOk = false;
4769 else
4770 return rcStrict;
4771
4772 /* commit flags value and advance rip. */
4773 pVCpu->cpum.GstCtx.eflags.Bits.u1ZF = fDescOk;
4774 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4775
4776 return VINF_SUCCESS;
4777}
4778
4779
4780/**
4781 * Implements LAR and LSL with 16-bit operand size.
4782 *
4783 * @returns VINF_SUCCESS.
4784 * @param pu16Dst Pointer to the destination register.
4785 * @param u16Sel The selector to load details for.
4786 * @param fIsLar true = LAR, false = LSL.
4787 */
4788IEM_CIMPL_DEF_3(iemCImpl_LarLsl_u16, uint16_t *, pu16Dst, uint16_t, uSel, bool, fIsLar)
4789{
4790 uint64_t u64TmpDst = *pu16Dst;
4791 IEM_CIMPL_CALL_3(iemCImpl_LarLsl_u64, &u64TmpDst, uSel, fIsLar);
4792 *pu16Dst = u64TmpDst;
4793 return VINF_SUCCESS;
4794}
4795
4796
4797/**
4798 * Implements lgdt.
4799 *
4800 * @param iEffSeg The segment of the new gdtr contents
4801 * @param GCPtrEffSrc The address of the new gdtr contents.
4802 * @param enmEffOpSize The effective operand size.
4803 */
4804IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4805{
4806 if (pVCpu->iem.s.uCpl != 0)
4807 return iemRaiseGeneralProtectionFault0(pVCpu);
4808 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
4809
4810 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
4811 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
4812 {
4813 Log(("lgdt: Guest intercept -> VM-exit\n"));
4814 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_LGDT, cbInstr);
4815 }
4816
4817 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_WRITES))
4818 {
4819 Log(("lgdt: Guest intercept -> #VMEXIT\n"));
4820 IEM_SVM_UPDATE_NRIP(pVCpu);
4821 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4822 }
4823
4824 /*
4825 * Fetch the limit and base address.
4826 */
4827 uint16_t cbLimit;
4828 RTGCPTR GCPtrBase;
4829 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4830 if (rcStrict == VINF_SUCCESS)
4831 {
4832 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4833 || X86_IS_CANONICAL(GCPtrBase))
4834 {
4835 rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
4836 if (rcStrict == VINF_SUCCESS)
4837 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4838 }
4839 else
4840 {
4841 Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4842 return iemRaiseGeneralProtectionFault0(pVCpu);
4843 }
4844 }
4845 return rcStrict;
4846}
4847
4848
4849/**
4850 * Implements sgdt.
4851 *
4852 * @param iEffSeg The segment where to store the gdtr content.
4853 * @param GCPtrEffDst The address where to store the gdtr content.
4854 */
4855IEM_CIMPL_DEF_2(iemCImpl_sgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4856{
4857 /*
4858 * Join paths with sidt.
4859 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4860 * you really must know.
4861 */
4862 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
4863 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
4864 {
4865 Log(("sgdt: Guest intercept -> VM-exit\n"));
4866 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_GDTR_IDTR_ACCESS, VMXINSTRID_SGDT, cbInstr);
4867 }
4868
4869 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_GDTR_READS))
4870 {
4871 Log(("sgdt: Guest intercept -> #VMEXIT\n"));
4872 IEM_SVM_UPDATE_NRIP(pVCpu);
4873 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_GDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4874 }
4875
4876 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_GDTR);
4877 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.gdtr.cbGdt, pVCpu->cpum.GstCtx.gdtr.pGdt, iEffSeg, GCPtrEffDst);
4878 if (rcStrict == VINF_SUCCESS)
4879 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4880 return rcStrict;
4881}
4882
4883
4884/**
4885 * Implements lidt.
4886 *
4887 * @param iEffSeg The segment of the new idtr contents
4888 * @param GCPtrEffSrc The address of the new idtr contents.
4889 * @param enmEffOpSize The effective operand size.
4890 */
4891IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
4892{
4893 if (pVCpu->iem.s.uCpl != 0)
4894 return iemRaiseGeneralProtectionFault0(pVCpu);
4895 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
4896
4897 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_WRITES))
4898 {
4899 Log(("lidt: Guest intercept -> #VMEXIT\n"));
4900 IEM_SVM_UPDATE_NRIP(pVCpu);
4901 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4902 }
4903
4904 /*
4905 * Fetch the limit and base address.
4906 */
4907 uint16_t cbLimit;
4908 RTGCPTR GCPtrBase;
4909 VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
4910 if (rcStrict == VINF_SUCCESS)
4911 {
4912 if ( pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
4913 || X86_IS_CANONICAL(GCPtrBase))
4914 {
4915 CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
4916 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4917 }
4918 else
4919 {
4920 Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
4921 return iemRaiseGeneralProtectionFault0(pVCpu);
4922 }
4923 }
4924 return rcStrict;
4925}
4926
4927
4928/**
4929 * Implements sidt.
4930 *
4931 * @param iEffSeg The segment where to store the idtr content.
4932 * @param GCPtrEffDst The address where to store the idtr content.
4933 */
4934IEM_CIMPL_DEF_2(iemCImpl_sidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
4935{
4936 /*
4937 * Join paths with sgdt.
4938 * Note! No CPL or V8086 checks here, it's a really sad story, ask Intel if
4939 * you really must know.
4940 */
4941 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IDTR_READS))
4942 {
4943 Log(("sidt: Guest intercept -> #VMEXIT\n"));
4944 IEM_SVM_UPDATE_NRIP(pVCpu);
4945 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_IDTR_READ, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
4946 }
4947
4948 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_IDTR);
4949 VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pVCpu->cpum.GstCtx.idtr.cbIdt, pVCpu->cpum.GstCtx.idtr.pIdt, iEffSeg, GCPtrEffDst);
4950 if (rcStrict == VINF_SUCCESS)
4951 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
4952 return rcStrict;
4953}
4954
4955
4956/**
4957 * Implements lldt.
4958 *
4959 * @param uNewLdt The new LDT selector value.
4960 */
4961IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
4962{
4963 /*
4964 * Check preconditions.
4965 */
4966 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
4967 {
4968 Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
4969 return iemRaiseUndefinedOpcode(pVCpu);
4970 }
4971 if (pVCpu->iem.s.uCpl != 0)
4972 {
4973 Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
4974 return iemRaiseGeneralProtectionFault0(pVCpu);
4975 }
4976 /* Nested-guest VMX intercept. */
4977 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
4978 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
4979 {
4980 Log(("lldt: Guest intercept -> VM-exit\n"));
4981 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LLDT, cbInstr);
4982 }
4983 if (uNewLdt & X86_SEL_LDT)
4984 {
4985 Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
4986 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
4987 }
4988
4989 /*
4990 * Now, loading a NULL selector is easy.
4991 */
4992 if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
4993 {
4994 /* Nested-guest SVM intercept. */
4995 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
4996 {
4997 Log(("lldt: Guest intercept -> #VMEXIT\n"));
4998 IEM_SVM_UPDATE_NRIP(pVCpu);
4999 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5000 }
5001
5002 Log(("lldt %04x: Loading NULL selector.\n", uNewLdt));
5003 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_LDTR;
5004 CPUMSetGuestLDTR(pVCpu, uNewLdt);
5005 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt;
5006 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5007 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
5008 {
5009 /* AMD-V seems to leave the base and limit alone. */
5010 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE;
5011 }
5012 else
5013 {
5014 /* VT-x (Intel 3960x) seems to be doing the following. */
5015 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D;
5016 pVCpu->cpum.GstCtx.ldtr.u64Base = 0;
5017 pVCpu->cpum.GstCtx.ldtr.u32Limit = UINT32_MAX;
5018 }
5019
5020 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5021 return VINF_SUCCESS;
5022 }
5023
5024 /*
5025 * Read the descriptor.
5026 */
5027 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR);
5028 IEMSELDESC Desc;
5029 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
5030 if (rcStrict != VINF_SUCCESS)
5031 return rcStrict;
5032
5033 /* Check GPs first. */
5034 if (Desc.Legacy.Gen.u1DescType)
5035 {
5036 Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5037 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5038 }
5039 if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
5040 {
5041 Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
5042 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5043 }
5044 uint64_t u64Base;
5045 if (!IEM_IS_LONG_MODE(pVCpu))
5046 u64Base = X86DESC_BASE(&Desc.Legacy);
5047 else
5048 {
5049 if (Desc.Long.Gen.u5Zeros)
5050 {
5051 Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
5052 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5053 }
5054
5055 u64Base = X86DESC64_BASE(&Desc.Long);
5056 if (!IEM_IS_CANONICAL(u64Base))
5057 {
5058 Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
5059 return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5060 }
5061 }
5062
5063 /* NP */
5064 if (!Desc.Legacy.Gen.u1Present)
5065 {
5066 Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
5067 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
5068 }
5069
5070 /* Nested-guest SVM intercept. */
5071 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_LDTR_WRITES))
5072 {
5073 Log(("lldt: Guest intercept -> #VMEXIT\n"));
5074 IEM_SVM_UPDATE_NRIP(pVCpu);
5075 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_LDTR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5076 }
5077
5078 /*
5079 * It checks out alright, update the registers.
5080 */
5081/** @todo check if the actual value is loaded or if the RPL is dropped */
5082 CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
5083 pVCpu->cpum.GstCtx.ldtr.ValidSel = uNewLdt & X86_SEL_MASK_OFF_RPL;
5084 pVCpu->cpum.GstCtx.ldtr.fFlags = CPUMSELREG_FLAGS_VALID;
5085 pVCpu->cpum.GstCtx.ldtr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5086 pVCpu->cpum.GstCtx.ldtr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5087 pVCpu->cpum.GstCtx.ldtr.u64Base = u64Base;
5088
5089 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5090 return VINF_SUCCESS;
5091}
5092
5093
5094/**
5095 * Implements sldt GReg
5096 *
5097 * @param iGReg The general register to store the CRx value in.
5098 * @param enmEffOpSize The operand size.
5099 */
5100IEM_CIMPL_DEF_2(iemCImpl_sldt_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5101{
5102 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5103 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5104 {
5105 Log(("sldt: Guest intercept -> VM-exit\n"));
5106 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_SLDT, cbInstr);
5107 }
5108
5109 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5110
5111 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5112 switch (enmEffOpSize)
5113 {
5114 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5115 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5116 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.ldtr.Sel; break;
5117 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5118 }
5119 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5120 return VINF_SUCCESS;
5121}
5122
5123
5124/**
5125 * Implements sldt mem.
5126 *
5127 * @param iGReg The general register to store the CRx value in.
5128 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5129 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5130 */
5131IEM_CIMPL_DEF_2(iemCImpl_sldt_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5132{
5133 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_LDTR_READS, SVM_EXIT_LDTR_READ, 0, 0);
5134
5135 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR);
5136 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.ldtr.Sel);
5137 if (rcStrict == VINF_SUCCESS)
5138 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5139 return rcStrict;
5140}
5141
5142
5143/**
5144 * Implements ltr.
5145 *
5146 * @param uNewTr The new TSS selector value.
5147 */
5148IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
5149{
5150 /*
5151 * Check preconditions.
5152 */
5153 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
5154 {
5155 Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
5156 return iemRaiseUndefinedOpcode(pVCpu);
5157 }
5158 if (pVCpu->iem.s.uCpl != 0)
5159 {
5160 Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
5161 return iemRaiseGeneralProtectionFault0(pVCpu);
5162 }
5163 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5164 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5165 {
5166 Log(("ltr: Guest intercept -> VM-exit\n"));
5167 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_LTR, cbInstr);
5168 }
5169 if (uNewTr & X86_SEL_LDT)
5170 {
5171 Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
5172 return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
5173 }
5174 if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
5175 {
5176 Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
5177 return iemRaiseGeneralProtectionFault0(pVCpu);
5178 }
5179 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TR_WRITES))
5180 {
5181 Log(("ltr: Guest intercept -> #VMEXIT\n"));
5182 IEM_SVM_UPDATE_NRIP(pVCpu);
5183 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_TR_WRITE, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5184 }
5185
5186 /*
5187 * Read the descriptor.
5188 */
5189 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_LDTR | CPUMCTX_EXTRN_GDTR | CPUMCTX_EXTRN_TR);
5190 IEMSELDESC Desc;
5191 VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
5192 if (rcStrict != VINF_SUCCESS)
5193 return rcStrict;
5194
5195 /* Check GPs first. */
5196 if (Desc.Legacy.Gen.u1DescType)
5197 {
5198 Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5199 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5200 }
5201 if ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
5202 && ( Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
5203 || IEM_IS_LONG_MODE(pVCpu)) )
5204 {
5205 Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
5206 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5207 }
5208 uint64_t u64Base;
5209 if (!IEM_IS_LONG_MODE(pVCpu))
5210 u64Base = X86DESC_BASE(&Desc.Legacy);
5211 else
5212 {
5213 if (Desc.Long.Gen.u5Zeros)
5214 {
5215 Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
5216 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5217 }
5218
5219 u64Base = X86DESC64_BASE(&Desc.Long);
5220 if (!IEM_IS_CANONICAL(u64Base))
5221 {
5222 Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
5223 return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5224 }
5225 }
5226
5227 /* NP */
5228 if (!Desc.Legacy.Gen.u1Present)
5229 {
5230 Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
5231 return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
5232 }
5233
5234 /*
5235 * Set it busy.
5236 * Note! Intel says this should lock down the whole descriptor, but we'll
5237 * restrict our selves to 32-bit for now due to lack of inline
5238 * assembly and such.
5239 */
5240 void *pvDesc;
5241 rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
5242 if (rcStrict != VINF_SUCCESS)
5243 return rcStrict;
5244 switch ((uintptr_t)pvDesc & 3)
5245 {
5246 case 0: ASMAtomicBitSet(pvDesc, 40 + 1); break;
5247 case 1: ASMAtomicBitSet((uint8_t *)pvDesc + 3, 40 + 1 - 24); break;
5248 case 2: ASMAtomicBitSet((uint8_t *)pvDesc + 2, 40 + 1 - 16); break;
5249 case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 - 8); break;
5250 }
5251 rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
5252 if (rcStrict != VINF_SUCCESS)
5253 return rcStrict;
5254 Desc.Legacy.Gen.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
5255
5256 /*
5257 * It checks out alright, update the registers.
5258 */
5259/** @todo check if the actual value is loaded or if the RPL is dropped */
5260 CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
5261 pVCpu->cpum.GstCtx.tr.ValidSel = uNewTr & X86_SEL_MASK_OFF_RPL;
5262 pVCpu->cpum.GstCtx.tr.fFlags = CPUMSELREG_FLAGS_VALID;
5263 pVCpu->cpum.GstCtx.tr.Attr.u = X86DESC_GET_HID_ATTR(&Desc.Legacy);
5264 pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&Desc.Legacy);
5265 pVCpu->cpum.GstCtx.tr.u64Base = u64Base;
5266
5267 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5268 return VINF_SUCCESS;
5269}
5270
5271
5272/**
5273 * Implements str GReg
5274 *
5275 * @param iGReg The general register to store the CRx value in.
5276 * @param enmEffOpSize The operand size.
5277 */
5278IEM_CIMPL_DEF_2(iemCImpl_str_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5279{
5280 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5281 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5282 {
5283 Log(("str_reg: Guest intercept -> VM-exit\n"));
5284 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5285 }
5286
5287 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5288
5289 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5290 switch (enmEffOpSize)
5291 {
5292 case IEMMODE_16BIT: *(uint16_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5293 case IEMMODE_32BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5294 case IEMMODE_64BIT: *(uint64_t *)iemGRegRef(pVCpu, iGReg) = pVCpu->cpum.GstCtx.tr.Sel; break;
5295 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5296 }
5297 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5298 return VINF_SUCCESS;
5299}
5300
5301
5302/**
5303 * Implements str mem.
5304 *
5305 * @param iGReg The general register to store the CRx value in.
5306 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5307 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5308 */
5309IEM_CIMPL_DEF_2(iemCImpl_str_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5310{
5311 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5312 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_DESC_TABLE_EXIT))
5313 {
5314 Log(("str_mem: Guest intercept -> VM-exit\n"));
5315 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_LDTR_TR_ACCESS, VMXINSTRID_STR, cbInstr);
5316 }
5317
5318 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_TR_READS, SVM_EXIT_TR_READ, 0, 0);
5319
5320 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TR);
5321 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, pVCpu->cpum.GstCtx.tr.Sel);
5322 if (rcStrict == VINF_SUCCESS)
5323 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5324 return rcStrict;
5325}
5326
5327
5328/**
5329 * Implements mov GReg,CRx.
5330 *
5331 * @param iGReg The general register to store the CRx value in.
5332 * @param iCrReg The CRx register to read (valid).
5333 */
5334IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
5335{
5336 if (pVCpu->iem.s.uCpl != 0)
5337 return iemRaiseGeneralProtectionFault0(pVCpu);
5338 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5339
5340 if (IEM_SVM_IS_READ_CR_INTERCEPT_SET(pVCpu, iCrReg))
5341 {
5342 Log(("iemCImpl_mov_Rd_Cd: Guest intercept CR%u -> #VMEXIT\n", iCrReg));
5343 IEM_SVM_UPDATE_NRIP(pVCpu);
5344 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_READ_CR0 + iCrReg, IEMACCESSCRX_MOV_CRX, iGReg);
5345 }
5346
5347 /* Read it. */
5348 uint64_t crX;
5349 switch (iCrReg)
5350 {
5351 case 0:
5352 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5353 crX = pVCpu->cpum.GstCtx.cr0;
5354 if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
5355 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
5356 break;
5357 case 2:
5358 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_CR2);
5359 crX = pVCpu->cpum.GstCtx.cr2;
5360 break;
5361 case 3:
5362 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5363 crX = pVCpu->cpum.GstCtx.cr3;
5364 break;
5365 case 4:
5366 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5367 crX = pVCpu->cpum.GstCtx.cr4;
5368 break;
5369 case 8:
5370 {
5371 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5372#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5373 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5374 {
5375 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr8(pVCpu, iGReg, cbInstr);
5376 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5377 return rcStrict;
5378
5379 /*
5380 * If the Mov-from-CR8 doesn't cause a VM-exit, bits 7:4 of the VTPR is copied
5381 * to bits 0:3 of the destination operand. Bits 63:4 of the destination operand
5382 * are cleared.
5383 *
5384 * See Intel Spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5385 */
5386 if (IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5387 {
5388 uint32_t const uTpr = iemVmxVirtApicReadRaw32(pVCpu, XAPIC_OFF_TPR);
5389 crX = (uTpr >> 4) & 0xf;
5390 break;
5391 }
5392 }
5393#endif
5394#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5395 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5396 {
5397 PCSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5398 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5399 {
5400 crX = pVmcbCtrl->IntCtrl.n.u8VTPR & 0xf;
5401 break;
5402 }
5403 }
5404#endif
5405 uint8_t uTpr;
5406 int rc = APICGetTpr(pVCpu, &uTpr, NULL, NULL);
5407 if (RT_SUCCESS(rc))
5408 crX = uTpr >> 4;
5409 else
5410 crX = 0;
5411 break;
5412 }
5413 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5414 }
5415
5416#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5417 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5418 {
5419 switch (iCrReg)
5420 {
5421 case 0:
5422 case 4:
5423 {
5424 /* CR0/CR4 reads are subject to masking when in VMX non-root mode. */
5425 crX = iemVmxMaskCr0CR4(pVCpu, iCrReg, crX);
5426 break;
5427 }
5428
5429 case 3:
5430 {
5431 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovFromCr3(pVCpu, iGReg, cbInstr);
5432 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5433 return rcStrict;
5434 break;
5435 }
5436 }
5437 }
5438#endif
5439
5440 /* Store it. */
5441 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5442 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
5443 else
5444 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
5445
5446 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5447 return VINF_SUCCESS;
5448}
5449
5450
5451/**
5452 * Implements smsw GReg.
5453 *
5454 * @param iGReg The general register to store the CRx value in.
5455 * @param enmEffOpSize The operand size.
5456 */
5457IEM_CIMPL_DEF_2(iemCImpl_smsw_reg, uint8_t, iGReg, uint8_t, enmEffOpSize)
5458{
5459 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5460
5461 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5462#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5463 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5464 u64GuestCr0 = iemVmxMaskCr0CR4(pVCpu, 0 /* iCrReg */, u64GuestCr0);
5465#endif
5466
5467 switch (enmEffOpSize)
5468 {
5469 case IEMMODE_16BIT:
5470 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5471 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0;
5472 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5473 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xffe0;
5474 else
5475 *(uint16_t *)iemGRegRef(pVCpu, iGReg) = (uint16_t)u64GuestCr0 | 0xfff0;
5476 break;
5477
5478 case IEMMODE_32BIT:
5479 *(uint32_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)u64GuestCr0;
5480 break;
5481
5482 case IEMMODE_64BIT:
5483 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = u64GuestCr0;
5484 break;
5485
5486 IEM_NOT_REACHED_DEFAULT_CASE_RET();
5487 }
5488
5489 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5490 return VINF_SUCCESS;
5491}
5492
5493
5494/**
5495 * Implements smsw mem.
5496 *
5497 * @param iGReg The general register to store the CR0 value in.
5498 * @param iEffSeg The effective segment register to use with @a GCPtrMem.
5499 * @param GCPtrEffDst Where to store the 16-bit CR0 value.
5500 */
5501IEM_CIMPL_DEF_2(iemCImpl_smsw_mem, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
5502{
5503 IEM_SVM_CHECK_READ_CR0_INTERCEPT(pVCpu, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
5504
5505 uint64_t u64GuestCr0 = pVCpu->cpum.GstCtx.cr0;
5506#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5507 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5508 u64GuestCr0 = iemVmxMaskCr0CR4(pVCpu, 0 /* iCrReg */, u64GuestCr0);
5509#endif
5510
5511 uint16_t u16Value;
5512 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
5513 u16Value = (uint16_t)u64GuestCr0;
5514 else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
5515 u16Value = (uint16_t)u64GuestCr0 | 0xffe0;
5516 else
5517 u16Value = (uint16_t)u64GuestCr0 | 0xfff0;
5518
5519 VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iEffSeg, GCPtrEffDst, u16Value);
5520 if (rcStrict == VINF_SUCCESS)
5521 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5522 return rcStrict;
5523}
5524
5525
5526/**
5527 * Used to implemented 'mov CRx,GReg' and 'lmsw r/m16'.
5528 *
5529 * @param iCrReg The CRx register to write (valid).
5530 * @param uNewCrX The new value.
5531 * @param enmAccessCrx The instruction that caused the CrX load.
5532 * @param iGReg The general register in case of a 'mov CRx,GReg'
5533 * instruction.
5534 */
5535IEM_CIMPL_DEF_4(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX, IEMACCESSCRX, enmAccessCrX, uint8_t, iGReg)
5536{
5537 VBOXSTRICTRC rcStrict;
5538 int rc;
5539#ifndef VBOX_WITH_NESTED_HWVIRT_SVM
5540 RT_NOREF2(iGReg, enmAccessCrX);
5541#endif
5542
5543 /*
5544 * Try store it.
5545 * Unfortunately, CPUM only does a tiny bit of the work.
5546 */
5547 switch (iCrReg)
5548 {
5549 case 0:
5550 {
5551 /*
5552 * Perform checks.
5553 */
5554 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
5555
5556 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr0;
5557 uint32_t const fValid = CPUMGetGuestCR0ValidMask();
5558
5559 /* ET is hardcoded on 486 and later. */
5560 if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
5561 uNewCrX |= X86_CR0_ET;
5562 /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
5563 else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
5564 {
5565 uNewCrX &= fValid;
5566 uNewCrX |= X86_CR0_ET;
5567 }
5568 else
5569 uNewCrX &= X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS | X86_CR0_PG | X86_CR0_ET;
5570
5571 /* Check for reserved bits. */
5572 if (uNewCrX & ~(uint64_t)fValid)
5573 {
5574 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5575 return iemRaiseGeneralProtectionFault0(pVCpu);
5576 }
5577
5578 /* Check for invalid combinations. */
5579 if ( (uNewCrX & X86_CR0_PG)
5580 && !(uNewCrX & X86_CR0_PE) )
5581 {
5582 Log(("Trying to set CR0.PG without CR0.PE\n"));
5583 return iemRaiseGeneralProtectionFault0(pVCpu);
5584 }
5585
5586 if ( !(uNewCrX & X86_CR0_CD)
5587 && (uNewCrX & X86_CR0_NW) )
5588 {
5589 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
5590 return iemRaiseGeneralProtectionFault0(pVCpu);
5591 }
5592
5593 if ( !(uNewCrX & X86_CR0_PG)
5594 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE))
5595 {
5596 Log(("Trying to clear CR0.PG while leaving CR4.PCID set\n"));
5597 return iemRaiseGeneralProtectionFault0(pVCpu);
5598 }
5599
5600 /* Long mode consistency checks. */
5601 if ( (uNewCrX & X86_CR0_PG)
5602 && !(uOldCrX & X86_CR0_PG)
5603 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5604 {
5605 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE))
5606 {
5607 Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
5608 return iemRaiseGeneralProtectionFault0(pVCpu);
5609 }
5610 if (pVCpu->cpum.GstCtx.cs.Attr.n.u1Long)
5611 {
5612 Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
5613 return iemRaiseGeneralProtectionFault0(pVCpu);
5614 }
5615 }
5616
5617 /* Check for bits that must remain set or cleared in VMX operation,
5618 see Intel spec. 23.8 "Restrictions on VMX operation". */
5619 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5620 {
5621 uint32_t const uCr0Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed0;
5622 if ((uNewCrX & uCr0Fixed0) != uCr0Fixed0)
5623 {
5624 Log(("Trying to clear reserved CR0 bits in VMX operation: NewCr0=%#llx MB1=%#llx\n", uNewCrX, uCr0Fixed0));
5625 return iemRaiseGeneralProtectionFault0(pVCpu);
5626 }
5627
5628 uint32_t const uCr0Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr0Fixed1;
5629 if (uNewCrX & ~uCr0Fixed1)
5630 {
5631 Log(("Trying to set reserved CR0 bits in VMX operation: NewCr0=%#llx MB0=%#llx\n", uNewCrX, uCr0Fixed1));
5632 return iemRaiseGeneralProtectionFault0(pVCpu);
5633 }
5634 }
5635
5636 /** @todo check reserved PDPTR bits as AMD states. */
5637
5638 /*
5639 * SVM nested-guest CR0 write intercepts.
5640 */
5641 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, iCrReg))
5642 {
5643 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5644 IEM_SVM_UPDATE_NRIP(pVCpu);
5645 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR0, enmAccessCrX, iGReg);
5646 }
5647 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CR0_SEL_WRITE))
5648 {
5649 /* 'lmsw' intercepts regardless of whether the TS/MP bits are actually toggled. */
5650 if ( enmAccessCrX == IEMACCESSCRX_LMSW
5651 || (uNewCrX & ~(X86_CR0_TS | X86_CR0_MP)) != (uOldCrX & ~(X86_CR0_TS | X86_CR0_MP)))
5652 {
5653 Assert(enmAccessCrX != IEMACCESSCRX_CLTS);
5654 Log(("iemCImpl_load_Cr%#x: lmsw or bits other than TS/MP changed: Guest intercept -> #VMEXIT\n", iCrReg));
5655 IEM_SVM_UPDATE_NRIP(pVCpu);
5656 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_CR0_SEL_WRITE, enmAccessCrX, iGReg);
5657 }
5658 }
5659
5660 /*
5661 * Change CR0.
5662 */
5663 CPUMSetGuestCR0(pVCpu, uNewCrX);
5664 Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
5665
5666 /*
5667 * Change EFER.LMA if entering or leaving long mode.
5668 */
5669 if ( (uNewCrX & X86_CR0_PG) != (uOldCrX & X86_CR0_PG)
5670 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME) )
5671 {
5672 uint64_t NewEFER = pVCpu->cpum.GstCtx.msrEFER;
5673 if (uNewCrX & X86_CR0_PG)
5674 NewEFER |= MSR_K6_EFER_LMA;
5675 else
5676 NewEFER &= ~MSR_K6_EFER_LMA;
5677
5678 CPUMSetGuestEFER(pVCpu, NewEFER);
5679 Assert(pVCpu->cpum.GstCtx.msrEFER == NewEFER);
5680 }
5681
5682 /*
5683 * Inform PGM.
5684 */
5685 if ( (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
5686 != (uOldCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE)) )
5687 {
5688 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5689 AssertRCReturn(rc, rc);
5690 /* ignore informational status codes */
5691 }
5692 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
5693
5694#ifdef IN_RC
5695 /* Return to ring-3 for rescheduling if WP or AM changes. */
5696 if ( rcStrict == VINF_SUCCESS
5697 && ( (uNewCrX & (X86_CR0_WP | X86_CR0_AM))
5698 != (uOldCrX & (X86_CR0_WP | X86_CR0_AM))) )
5699 rcStrict = VINF_EM_RESCHEDULE;
5700#endif
5701 break;
5702 }
5703
5704 /*
5705 * CR2 can be changed without any restrictions.
5706 */
5707 case 2:
5708 {
5709 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 2))
5710 {
5711 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5712 IEM_SVM_UPDATE_NRIP(pVCpu);
5713 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR2, enmAccessCrX, iGReg);
5714 }
5715 pVCpu->cpum.GstCtx.cr2 = uNewCrX;
5716 pVCpu->cpum.GstCtx.fExtrn &= ~CPUMCTX_EXTRN_CR2;
5717 rcStrict = VINF_SUCCESS;
5718 break;
5719 }
5720
5721 /*
5722 * CR3 is relatively simple, although AMD and Intel have different
5723 * accounts of how setting reserved bits are handled. We take intel's
5724 * word for the lower bits and AMD's for the high bits (63:52). The
5725 * lower reserved bits are ignored and left alone; OpenBSD 5.8 relies
5726 * on this.
5727 */
5728 /** @todo Testcase: Setting reserved bits in CR3, especially before
5729 * enabling paging. */
5730 case 3:
5731 {
5732 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR3);
5733
5734 /* Bit 63 being clear in the source operand with PCIDE indicates no invalidations are required. */
5735 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCIDE)
5736 && (uNewCrX & RT_BIT_64(63)))
5737 {
5738 /** @todo r=ramshankar: avoiding a TLB flush altogether here causes Windows 10
5739 * SMP(w/o nested-paging) to hang during bootup on Skylake systems, see
5740 * Intel spec. 4.10.4.1 "Operations that Invalidate TLBs and
5741 * Paging-Structure Caches". */
5742 uNewCrX &= ~RT_BIT_64(63);
5743 }
5744
5745 /* Check / mask the value. */
5746 if (uNewCrX & UINT64_C(0xfff0000000000000))
5747 {
5748 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
5749 return iemRaiseGeneralProtectionFault0(pVCpu);
5750 }
5751
5752 uint64_t fValid;
5753 if ( (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PAE)
5754 && (pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_LME))
5755 fValid = UINT64_C(0x000fffffffffffff);
5756 else
5757 fValid = UINT64_C(0xffffffff);
5758 if (uNewCrX & ~fValid)
5759 {
5760 Log(("Automatically clearing reserved MBZ bits in CR3 load: NewCR3=%#llx ClearedBits=%#llx\n",
5761 uNewCrX, uNewCrX & ~fValid));
5762 uNewCrX &= fValid;
5763 }
5764
5765 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 3))
5766 {
5767 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5768 IEM_SVM_UPDATE_NRIP(pVCpu);
5769 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR3, enmAccessCrX, iGReg);
5770 }
5771
5772 /** @todo If we're in PAE mode we should check the PDPTRs for
5773 * invalid bits. */
5774
5775 /* Make the change. */
5776 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
5777 AssertRCSuccessReturn(rc, rc);
5778
5779 /* Inform PGM. */
5780 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG)
5781 {
5782 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PGE));
5783 AssertRCReturn(rc, rc);
5784 /* ignore informational status codes */
5785 }
5786 rcStrict = VINF_SUCCESS;
5787 break;
5788 }
5789
5790 /*
5791 * CR4 is a bit more tedious as there are bits which cannot be cleared
5792 * under some circumstances and such.
5793 */
5794 case 4:
5795 {
5796 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
5797 uint64_t const uOldCrX = pVCpu->cpum.GstCtx.cr4;
5798
5799 /* Reserved bits. */
5800 uint32_t const fValid = CPUMGetGuestCR4ValidMask(pVCpu->CTX_SUFF(pVM));
5801 if (uNewCrX & ~(uint64_t)fValid)
5802 {
5803 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
5804 return iemRaiseGeneralProtectionFault0(pVCpu);
5805 }
5806
5807 bool const fPcide = ((uNewCrX ^ uOldCrX) & X86_CR4_PCIDE) && (uNewCrX & X86_CR4_PCIDE);
5808 bool const fLongMode = CPUMIsGuestInLongModeEx(IEM_GET_CTX(pVCpu));
5809
5810 /* PCIDE check. */
5811 if ( fPcide
5812 && ( !fLongMode
5813 || (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))))
5814 {
5815 Log(("Trying to set PCIDE with invalid PCID or outside long mode. Pcid=%#x\n", (pVCpu->cpum.GstCtx.cr3 & UINT64_C(0xfff))));
5816 return iemRaiseGeneralProtectionFault0(pVCpu);
5817 }
5818
5819 /* PAE check. */
5820 if ( fLongMode
5821 && (uOldCrX & X86_CR4_PAE)
5822 && !(uNewCrX & X86_CR4_PAE))
5823 {
5824 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
5825 return iemRaiseGeneralProtectionFault0(pVCpu);
5826 }
5827
5828 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 4))
5829 {
5830 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5831 IEM_SVM_UPDATE_NRIP(pVCpu);
5832 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR4, enmAccessCrX, iGReg);
5833 }
5834
5835 /* Check for bits that must remain set or cleared in VMX operation,
5836 see Intel spec. 23.8 "Restrictions on VMX operation". */
5837 if (IEM_VMX_IS_ROOT_MODE(pVCpu))
5838 {
5839 uint32_t const uCr4Fixed0 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed0;
5840 if ((uNewCrX & uCr4Fixed0) != uCr4Fixed0)
5841 {
5842 Log(("Trying to clear reserved CR4 bits in VMX operation: NewCr4=%#llx MB1=%#llx\n", uNewCrX, uCr4Fixed0));
5843 return iemRaiseGeneralProtectionFault0(pVCpu);
5844 }
5845
5846 uint32_t const uCr4Fixed1 = pVCpu->cpum.GstCtx.hwvirt.vmx.Msrs.u64Cr4Fixed1;
5847 if (uNewCrX & ~uCr4Fixed1)
5848 {
5849 Log(("Trying to set reserved CR4 bits in VMX operation: NewCr4=%#llx MB0=%#llx\n", uNewCrX, uCr4Fixed1));
5850 return iemRaiseGeneralProtectionFault0(pVCpu);
5851 }
5852 }
5853
5854 /*
5855 * Change it.
5856 */
5857 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
5858 AssertRCSuccessReturn(rc, rc);
5859 Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
5860
5861 /*
5862 * Notify SELM and PGM.
5863 */
5864 /* SELM - VME may change things wrt to the TSS shadowing. */
5865 if ((uNewCrX ^ uOldCrX) & X86_CR4_VME)
5866 {
5867 Log(("iemCImpl_load_CrX: VME %d -> %d => Setting VMCPU_FF_SELM_SYNC_TSS\n",
5868 RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
5869#ifdef VBOX_WITH_RAW_MODE
5870 if (VM_IS_RAW_MODE_ENABLED(pVCpu->CTX_SUFF(pVM)))
5871 VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
5872#endif
5873 }
5874
5875 /* PGM - flushing and mode. */
5876 if ((uNewCrX ^ uOldCrX) & (X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE | X86_CR4_PCIDE /* | X86_CR4_SMEP */))
5877 {
5878 rc = PGMFlushTLB(pVCpu, pVCpu->cpum.GstCtx.cr3, true /* global */);
5879 AssertRCReturn(rc, rc);
5880 /* ignore informational status codes */
5881 }
5882 rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
5883 break;
5884 }
5885
5886 /*
5887 * CR8 maps to the APIC TPR.
5888 */
5889 case 8:
5890 {
5891 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_APIC_TPR);
5892 if (uNewCrX & ~(uint64_t)0xf)
5893 {
5894 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
5895 return iemRaiseGeneralProtectionFault0(pVCpu);
5896 }
5897
5898#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5899 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
5900 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_USE_TPR_SHADOW))
5901 {
5902 /*
5903 * If the Mov-to-CR8 doesn't cause a VM-exit, bits 0:3 of the source operand
5904 * is copied to bits 7:4 of the VTPR. Bits 0:3 and bits 31:8 of the VTPR are
5905 * cleared. Following this the processor performs TPR virtualization.
5906 *
5907 * However, we should not perform TPR virtualization immediately here but
5908 * after this instruction has completed.
5909 *
5910 * See Intel spec. 29.3 "Virtualizing CR8-based TPR Accesses"
5911 * See Intel spec. 27.1 "Architectural State Before A VM-exit"
5912 */
5913 uint32_t const uTpr = (uNewCrX & 0xf) << 4;
5914 Log(("iemCImpl_load_Cr%#x: Virtualizing TPR (%#x) write\n", iCrReg, uTpr));
5915 iemVmxVirtApicWriteRaw32(pVCpu, XAPIC_OFF_TPR, uTpr);
5916 iemVmxVirtApicSetPendingWrite(pVCpu, XAPIC_OFF_TPR);
5917 rcStrict = VINF_SUCCESS;
5918 break;
5919 }
5920#endif
5921
5922#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
5923 if (CPUMIsGuestInSvmNestedHwVirtMode(IEM_GET_CTX(pVCpu)))
5924 {
5925 if (IEM_SVM_IS_WRITE_CR_INTERCEPT_SET(pVCpu, /*cr*/ 8))
5926 {
5927 Log(("iemCImpl_load_Cr%#x: Guest intercept -> #VMEXIT\n", iCrReg));
5928 IEM_SVM_UPDATE_NRIP(pVCpu);
5929 IEM_SVM_CRX_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_CR8, enmAccessCrX, iGReg);
5930 }
5931
5932 PSVMVMCBCTRL pVmcbCtrl = &pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pVmcb)->ctrl;
5933 pVmcbCtrl->IntCtrl.n.u8VTPR = uNewCrX;
5934 if (CPUMIsGuestSvmVirtIntrMasking(pVCpu, IEM_GET_CTX(pVCpu)))
5935 {
5936 rcStrict = VINF_SUCCESS;
5937 break;
5938 }
5939 }
5940#endif
5941 uint8_t const u8Tpr = (uint8_t)uNewCrX << 4;
5942 APICSetTpr(pVCpu, u8Tpr);
5943 rcStrict = VINF_SUCCESS;
5944 break;
5945 }
5946
5947 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
5948 }
5949
5950 /*
5951 * Advance the RIP on success.
5952 */
5953 if (RT_SUCCESS(rcStrict))
5954 {
5955 if (rcStrict != VINF_SUCCESS)
5956 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
5957 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
5958 }
5959
5960 return rcStrict;
5961}
5962
5963
5964/**
5965 * Implements mov CRx,GReg.
5966 *
5967 * @param iCrReg The CRx register to write (valid).
5968 * @param iGReg The general register to load the CRx value from.
5969 */
5970IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
5971{
5972 if (pVCpu->iem.s.uCpl != 0)
5973 return iemRaiseGeneralProtectionFault0(pVCpu);
5974 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
5975
5976 /*
5977 * Read the new value from the source register and call common worker.
5978 */
5979 uint64_t uNewCrX;
5980 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
5981 uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
5982 else
5983 uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
5984
5985#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
5986 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
5987 {
5988 VBOXSTRICTRC rcStrict = VINF_VMX_INTERCEPT_NOT_ACTIVE;
5989 switch (iCrReg)
5990 {
5991 case 0:
5992 case 4: rcStrict = iemVmxVmexitInstrMovToCr0Cr4(pVCpu, iCrReg, &uNewCrX, iGReg, cbInstr); break;
5993 case 3: rcStrict = iemVmxVmexitInstrMovToCr3(pVCpu, uNewCrX, iGReg, cbInstr); break;
5994 case 8: rcStrict = iemVmxVmexitInstrMovToCr8(pVCpu, iGReg, cbInstr); break;
5995 }
5996 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
5997 return rcStrict;
5998 }
5999#endif
6000
6001 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, iCrReg, uNewCrX, IEMACCESSCRX_MOV_CRX, iGReg);
6002}
6003
6004
6005/**
6006 * Implements 'LMSW r/m16'
6007 *
6008 * @param u16NewMsw The new value.
6009 * @param GCPtrEffDst The guest-linear address of the source operand in case
6010 * of a memory operand. For register operand, pass
6011 * NIL_RTGCPTR.
6012 */
6013IEM_CIMPL_DEF_2(iemCImpl_lmsw, uint16_t, u16NewMsw, RTGCPTR, GCPtrEffDst)
6014{
6015 if (pVCpu->iem.s.uCpl != 0)
6016 return iemRaiseGeneralProtectionFault0(pVCpu);
6017 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6018 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6019
6020#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6021 /* Check nested-guest VMX intercept and get updated MSW if there's no VM-exit. */
6022 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6023 {
6024 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrLmsw(pVCpu, pVCpu->cpum.GstCtx.cr0, &u16NewMsw, GCPtrEffDst, cbInstr);
6025 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6026 return rcStrict;
6027 }
6028#else
6029 RT_NOREF_PV(GCPtrEffDst);
6030#endif
6031
6032 /*
6033 * Compose the new CR0 value and call common worker.
6034 */
6035 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6036 uNewCr0 |= u16NewMsw & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
6037 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_LMSW, UINT8_MAX /* iGReg */);
6038}
6039
6040
6041/**
6042 * Implements 'CLTS'.
6043 */
6044IEM_CIMPL_DEF_0(iemCImpl_clts)
6045{
6046 if (pVCpu->iem.s.uCpl != 0)
6047 return iemRaiseGeneralProtectionFault0(pVCpu);
6048
6049 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
6050 uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0;
6051 uNewCr0 &= ~X86_CR0_TS;
6052
6053#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6054 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6055 {
6056 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrClts(pVCpu, cbInstr);
6057 if (rcStrict == VINF_VMX_MODIFIES_BEHAVIOR)
6058 uNewCr0 |= (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS);
6059 else if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6060 return rcStrict;
6061 }
6062#endif
6063
6064 return IEM_CIMPL_CALL_4(iemCImpl_load_CrX, /*cr*/ 0, uNewCr0, IEMACCESSCRX_CLTS, UINT8_MAX /* iGReg */);
6065}
6066
6067
6068/**
6069 * Implements mov GReg,DRx.
6070 *
6071 * @param iGReg The general register to store the DRx value in.
6072 * @param iDrReg The DRx register to read (0-7).
6073 */
6074IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
6075{
6076#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6077 /*
6078 * Check nested-guest VMX intercept.
6079 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6080 * over CPL and CR4.DE and even DR4/DR5 checks.
6081 *
6082 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6083 */
6084 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6085 {
6086 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_FROM_DRX, iDrReg, iGReg, cbInstr);
6087 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6088 return rcStrict;
6089 }
6090#endif
6091
6092 /*
6093 * Check preconditions.
6094 */
6095 /* Raise GPs. */
6096 if (pVCpu->iem.s.uCpl != 0)
6097 return iemRaiseGeneralProtectionFault0(pVCpu);
6098 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6099 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR0);
6100
6101 if ( (iDrReg == 4 || iDrReg == 5)
6102 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE) )
6103 {
6104 Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
6105 return iemRaiseGeneralProtectionFault0(pVCpu);
6106 }
6107
6108 /* Raise #DB if general access detect is enabled. */
6109 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6110 {
6111 Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
6112 return iemRaiseDebugException(pVCpu);
6113 }
6114
6115 /*
6116 * Read the debug register and store it in the specified general register.
6117 */
6118 uint64_t drX;
6119 switch (iDrReg)
6120 {
6121 case 0:
6122 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6123 drX = pVCpu->cpum.GstCtx.dr[0];
6124 break;
6125 case 1:
6126 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6127 drX = pVCpu->cpum.GstCtx.dr[1];
6128 break;
6129 case 2:
6130 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6131 drX = pVCpu->cpum.GstCtx.dr[2];
6132 break;
6133 case 3:
6134 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6135 drX = pVCpu->cpum.GstCtx.dr[3];
6136 break;
6137 case 6:
6138 case 4:
6139 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6140 drX = pVCpu->cpum.GstCtx.dr[6];
6141 drX |= X86_DR6_RA1_MASK;
6142 drX &= ~X86_DR6_RAZ_MASK;
6143 break;
6144 case 7:
6145 case 5:
6146 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7);
6147 drX = pVCpu->cpum.GstCtx.dr[7];
6148 drX |=X86_DR7_RA1_MASK;
6149 drX &= ~X86_DR7_RAZ_MASK;
6150 break;
6151 IEM_NOT_REACHED_DEFAULT_CASE_RET(); /* call checks */
6152 }
6153
6154 /** @todo SVM nested-guest intercept for DR8-DR15? */
6155 /*
6156 * Check for any SVM nested-guest intercepts for the DRx read.
6157 */
6158 if (IEM_SVM_IS_READ_DR_INTERCEPT_SET(pVCpu, iDrReg))
6159 {
6160 Log(("mov r%u,dr%u: Guest intercept -> #VMEXIT\n", iGReg, iDrReg));
6161 IEM_SVM_UPDATE_NRIP(pVCpu);
6162 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_READ_DR0 + (iDrReg & 0xf),
6163 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6164 }
6165
6166 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6167 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
6168 else
6169 *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
6170
6171 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6172 return VINF_SUCCESS;
6173}
6174
6175
6176/**
6177 * Implements mov DRx,GReg.
6178 *
6179 * @param iDrReg The DRx register to write (valid).
6180 * @param iGReg The general register to load the DRx value from.
6181 */
6182IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
6183{
6184#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6185 /*
6186 * Check nested-guest VMX intercept.
6187 * Unlike most other intercepts, the Mov DRx intercept takes preceedence
6188 * over CPL and CR4.DE and even DR4/DR5 checks.
6189 *
6190 * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
6191 */
6192 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6193 {
6194 VBOXSTRICTRC rcStrict = iemVmxVmexitInstrMovDrX(pVCpu, VMXINSTRID_MOV_TO_DRX, iDrReg, iGReg, cbInstr);
6195 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6196 return rcStrict;
6197 }
6198#endif
6199
6200 /*
6201 * Check preconditions.
6202 */
6203 if (pVCpu->iem.s.uCpl != 0)
6204 return iemRaiseGeneralProtectionFault0(pVCpu);
6205 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6206 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_DR7 | CPUMCTX_EXTRN_CR4);
6207
6208 if (iDrReg == 4 || iDrReg == 5)
6209 {
6210 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE)
6211 {
6212 Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
6213 return iemRaiseGeneralProtectionFault0(pVCpu);
6214 }
6215 iDrReg += 2;
6216 }
6217
6218 /* Raise #DB if general access detect is enabled. */
6219 /** @todo is \#DB/DR7.GD raised before any reserved high bits in DR7/DR6
6220 * \#GP? */
6221 if (pVCpu->cpum.GstCtx.dr[7] & X86_DR7_GD)
6222 {
6223 Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
6224 return iemRaiseDebugException(pVCpu);
6225 }
6226
6227 /*
6228 * Read the new value from the source register.
6229 */
6230 uint64_t uNewDrX;
6231 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
6232 uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
6233 else
6234 uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
6235
6236 /*
6237 * Adjust it.
6238 */
6239 switch (iDrReg)
6240 {
6241 case 0:
6242 case 1:
6243 case 2:
6244 case 3:
6245 /* nothing to adjust */
6246 break;
6247
6248 case 6:
6249 if (uNewDrX & X86_DR6_MBZ_MASK)
6250 {
6251 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6252 return iemRaiseGeneralProtectionFault0(pVCpu);
6253 }
6254 uNewDrX |= X86_DR6_RA1_MASK;
6255 uNewDrX &= ~X86_DR6_RAZ_MASK;
6256 break;
6257
6258 case 7:
6259 if (uNewDrX & X86_DR7_MBZ_MASK)
6260 {
6261 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
6262 return iemRaiseGeneralProtectionFault0(pVCpu);
6263 }
6264 uNewDrX |= X86_DR7_RA1_MASK;
6265 uNewDrX &= ~X86_DR7_RAZ_MASK;
6266 break;
6267
6268 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6269 }
6270
6271 /** @todo SVM nested-guest intercept for DR8-DR15? */
6272 /*
6273 * Check for any SVM nested-guest intercepts for the DRx write.
6274 */
6275 if (IEM_SVM_IS_WRITE_DR_INTERCEPT_SET(pVCpu, iDrReg))
6276 {
6277 Log2(("mov dr%u,r%u: Guest intercept -> #VMEXIT\n", iDrReg, iGReg));
6278 IEM_SVM_UPDATE_NRIP(pVCpu);
6279 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_WRITE_DR0 + (iDrReg & 0xf),
6280 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? (iGReg & 7) : 0, 0 /* uExitInfo2 */);
6281 }
6282
6283 /*
6284 * Do the actual setting.
6285 */
6286 if (iDrReg < 4)
6287 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3);
6288 else if (iDrReg == 6)
6289 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR6);
6290
6291 int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
6292 AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
6293
6294 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6295 return VINF_SUCCESS;
6296}
6297
6298
6299/**
6300 * Implements 'INVLPG m'.
6301 *
6302 * @param GCPtrPage The effective address of the page to invalidate.
6303 * @remarks Updates the RIP.
6304 */
6305IEM_CIMPL_DEF_1(iemCImpl_invlpg, RTGCPTR, GCPtrPage)
6306{
6307 /* ring-0 only. */
6308 if (pVCpu->iem.s.uCpl != 0)
6309 return iemRaiseGeneralProtectionFault0(pVCpu);
6310 Assert(!pVCpu->cpum.GstCtx.eflags.Bits.u1VM);
6311 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6312
6313#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6314 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6315 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6316 {
6317 Log(("invlpg: Guest intercept (%RGp) -> VM-exit\n", GCPtrPage));
6318 return iemVmxVmexitInstrInvlpg(pVCpu, GCPtrPage, cbInstr);
6319 }
6320#endif
6321
6322 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_INVLPG))
6323 {
6324 Log(("invlpg: Guest intercept (%RGp) -> #VMEXIT\n", GCPtrPage));
6325 IEM_SVM_UPDATE_NRIP(pVCpu);
6326 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_INVLPG,
6327 IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSvmDecodeAssists ? GCPtrPage : 0, 0 /* uExitInfo2 */);
6328 }
6329
6330 int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
6331 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6332
6333 if (rc == VINF_SUCCESS)
6334 return VINF_SUCCESS;
6335 if (rc == VINF_PGM_SYNC_CR3)
6336 return iemSetPassUpStatus(pVCpu, rc);
6337
6338 AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
6339 Log(("PGMInvalidatePage(%RGv) -> %Rrc\n", GCPtrPage, rc));
6340 return rc;
6341}
6342
6343
6344/**
6345 * Implements INVPCID.
6346 *
6347 * @param iEffSeg The segment of the invpcid descriptor.
6348 * @param GCPtrInvpcidDesc The address of invpcid descriptor.
6349 * @param uInvpcidType The invalidation type.
6350 * @remarks Updates the RIP.
6351 */
6352IEM_CIMPL_DEF_3(iemCImpl_invpcid, uint8_t, iEffSeg, RTGCPTR, GCPtrInvpcidDesc, uint8_t, uInvpcidType)
6353{
6354 /*
6355 * Check preconditions.
6356 */
6357 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fInvpcid)
6358 return iemRaiseUndefinedOpcode(pVCpu);
6359
6360 /* When in VMX non-root mode and INVPCID is not enabled, it results in #UD. */
6361 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6362 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_INVPCID))
6363 {
6364 Log(("invpcid: Not enabled for nested-guest execution -> #UD\n"));
6365 return iemRaiseUndefinedOpcode(pVCpu);
6366 }
6367
6368 if (pVCpu->iem.s.uCpl != 0)
6369 {
6370 Log(("invpcid: CPL != 0 -> #GP(0)\n"));
6371 return iemRaiseGeneralProtectionFault0(pVCpu);
6372 }
6373
6374 if (IEM_IS_V86_MODE(pVCpu))
6375 {
6376 Log(("invpcid: v8086 mode -> #GP(0)\n"));
6377 return iemRaiseGeneralProtectionFault0(pVCpu);
6378 }
6379
6380 /*
6381 * Check nested-guest intercept.
6382 *
6383 * INVPCID causes a VM-exit if "enable INVPCID" and "INVLPG exiting" are
6384 * both set. We have already checked the former earlier in this function.
6385 *
6386 * CPL checks take priority over VM-exit.
6387 * See Intel spec. "25.1.1 Relative Priority of Faults and VM Exits".
6388 */
6389 /** @todo r=ramshankar: NSTVMX: I'm not entirely certain if V86 mode check has
6390 * higher or lower priority than a VM-exit, we assume higher for the time
6391 * being. */
6392 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6393 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INVLPG_EXIT))
6394 {
6395 Log(("invpcid: Guest intercept -> #VM-exit\n"));
6396 IEM_VMX_VMEXIT_INSTR_NEEDS_INFO_RET(pVCpu, VMX_EXIT_INVPCID, VMXINSTRID_NONE, cbInstr);
6397 }
6398
6399 if (uInvpcidType > X86_INVPCID_TYPE_MAX_VALID)
6400 {
6401 Log(("invpcid: invalid/unrecognized invpcid type %#x -> #GP(0)\n", uInvpcidType));
6402 return iemRaiseGeneralProtectionFault0(pVCpu);
6403 }
6404 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_EFER);
6405
6406 /*
6407 * Fetch the invpcid descriptor from guest memory.
6408 */
6409 RTUINT128U uDesc;
6410 VBOXSTRICTRC rcStrict = iemMemFetchDataU128(pVCpu, &uDesc, iEffSeg, GCPtrInvpcidDesc);
6411 if (rcStrict == VINF_SUCCESS)
6412 {
6413 /*
6414 * Validate the descriptor.
6415 */
6416 if (uDesc.s.Lo > 0xfff)
6417 {
6418 Log(("invpcid: reserved bits set in invpcid descriptor %#RX64 -> #GP(0)\n", uDesc.s.Lo));
6419 return iemRaiseGeneralProtectionFault0(pVCpu);
6420 }
6421
6422 RTGCUINTPTR64 const GCPtrInvAddr = uDesc.s.Hi;
6423 uint8_t const uPcid = uDesc.s.Lo & UINT64_C(0xfff);
6424 uint32_t const uCr4 = pVCpu->cpum.GstCtx.cr4;
6425 uint64_t const uCr3 = pVCpu->cpum.GstCtx.cr3;
6426 switch (uInvpcidType)
6427 {
6428 case X86_INVPCID_TYPE_INDV_ADDR:
6429 {
6430 if (!IEM_IS_CANONICAL(GCPtrInvAddr))
6431 {
6432 Log(("invpcid: invalidation address %#RGP is not canonical -> #GP(0)\n", GCPtrInvAddr));
6433 return iemRaiseGeneralProtectionFault0(pVCpu);
6434 }
6435 if ( !(uCr4 & X86_CR4_PCIDE)
6436 && uPcid != 0)
6437 {
6438 Log(("invpcid: invalid pcid %#x\n", uPcid));
6439 return iemRaiseGeneralProtectionFault0(pVCpu);
6440 }
6441
6442 /* Invalidate mappings for the linear address tagged with PCID except global translations. */
6443 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6444 break;
6445 }
6446
6447 case X86_INVPCID_TYPE_SINGLE_CONTEXT:
6448 {
6449 if ( !(uCr4 & X86_CR4_PCIDE)
6450 && uPcid != 0)
6451 {
6452 Log(("invpcid: invalid pcid %#x\n", uPcid));
6453 return iemRaiseGeneralProtectionFault0(pVCpu);
6454 }
6455 /* Invalidate all mappings associated with PCID except global translations. */
6456 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6457 break;
6458 }
6459
6460 case X86_INVPCID_TYPE_ALL_CONTEXT_INCL_GLOBAL:
6461 {
6462 PGMFlushTLB(pVCpu, uCr3, true /* fGlobal */);
6463 break;
6464 }
6465
6466 case X86_INVPCID_TYPE_ALL_CONTEXT_EXCL_GLOBAL:
6467 {
6468 PGMFlushTLB(pVCpu, uCr3, false /* fGlobal */);
6469 break;
6470 }
6471 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6472 }
6473 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6474 }
6475 return rcStrict;
6476}
6477
6478
6479/**
6480 * Implements INVD.
6481 */
6482IEM_CIMPL_DEF_0(iemCImpl_invd)
6483{
6484 if (pVCpu->iem.s.uCpl != 0)
6485 {
6486 Log(("invd: CPL != 0 -> #GP(0)\n"));
6487 return iemRaiseGeneralProtectionFault0(pVCpu);
6488 }
6489
6490 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6491 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_INVD, cbInstr);
6492
6493 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_INVD, SVM_EXIT_INVD, 0, 0);
6494
6495 /* We currently take no action here. */
6496 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6497 return VINF_SUCCESS;
6498}
6499
6500
6501/**
6502 * Implements WBINVD.
6503 */
6504IEM_CIMPL_DEF_0(iemCImpl_wbinvd)
6505{
6506 if (pVCpu->iem.s.uCpl != 0)
6507 {
6508 Log(("wbinvd: CPL != 0 -> #GP(0)\n"));
6509 return iemRaiseGeneralProtectionFault0(pVCpu);
6510 }
6511
6512 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6513 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WBINVD, cbInstr);
6514
6515 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_WBINVD, SVM_EXIT_WBINVD, 0, 0);
6516
6517 /* We currently take no action here. */
6518 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6519 return VINF_SUCCESS;
6520}
6521
6522
6523/** Opcode 0x0f 0xaa. */
6524IEM_CIMPL_DEF_0(iemCImpl_rsm)
6525{
6526 IEM_SVM_CHECK_INSTR_INTERCEPT(pVCpu, SVM_CTRL_INTERCEPT_RSM, SVM_EXIT_RSM, 0, 0);
6527 NOREF(cbInstr);
6528 return iemRaiseUndefinedOpcode(pVCpu);
6529}
6530
6531
6532/**
6533 * Implements RDTSC.
6534 */
6535IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
6536{
6537 /*
6538 * Check preconditions.
6539 */
6540 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
6541 return iemRaiseUndefinedOpcode(pVCpu);
6542
6543 if (pVCpu->iem.s.uCpl != 0)
6544 {
6545 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6546 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6547 {
6548 Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6549 return iemRaiseGeneralProtectionFault0(pVCpu);
6550 }
6551 }
6552
6553 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6554 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDTSC_EXIT))
6555 {
6556 Log(("rdtsc: Guest intercept -> VM-exit\n"));
6557 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSC, cbInstr);
6558 }
6559
6560 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSC))
6561 {
6562 Log(("rdtsc: Guest intercept -> #VMEXIT\n"));
6563 IEM_SVM_UPDATE_NRIP(pVCpu);
6564 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6565 }
6566
6567 /*
6568 * Do the job.
6569 */
6570 uint64_t uTicks = TMCpuTickGet(pVCpu);
6571#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6572 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6573#endif
6574 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6575 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6576 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX); /* For IEMExecDecodedRdtsc. */
6577 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6578 return VINF_SUCCESS;
6579}
6580
6581
6582/**
6583 * Implements RDTSC.
6584 */
6585IEM_CIMPL_DEF_0(iemCImpl_rdtscp)
6586{
6587 /*
6588 * Check preconditions.
6589 */
6590 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fRdTscP)
6591 return iemRaiseUndefinedOpcode(pVCpu);
6592
6593 if (pVCpu->iem.s.uCpl != 0)
6594 {
6595 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6596 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_TSD)
6597 {
6598 Log(("rdtscp: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
6599 return iemRaiseGeneralProtectionFault0(pVCpu);
6600 }
6601 }
6602
6603 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6604 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_RDTSCP))
6605 {
6606 Log(("rdtscp: Guest intercept -> VM-exit\n"));
6607 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDTSCP, cbInstr);
6608 }
6609 else if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDTSCP))
6610 {
6611 Log(("rdtscp: Guest intercept -> #VMEXIT\n"));
6612 IEM_SVM_UPDATE_NRIP(pVCpu);
6613 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDTSCP, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6614 }
6615
6616 /*
6617 * Do the job.
6618 * Query the MSR first in case of trips to ring-3.
6619 */
6620 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
6621 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &pVCpu->cpum.GstCtx.rcx);
6622 if (rcStrict == VINF_SUCCESS)
6623 {
6624 /* Low dword of the TSC_AUX msr only. */
6625 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
6626
6627 uint64_t uTicks = TMCpuTickGet(pVCpu);
6628#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6629 uTicks = CPUMApplyNestedGuestTscOffset(pVCpu, uTicks);
6630#endif
6631 pVCpu->cpum.GstCtx.rax = RT_LO_U32(uTicks);
6632 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(uTicks);
6633 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RCX); /* For IEMExecDecodedRdtscp. */
6634 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6635 }
6636 return rcStrict;
6637}
6638
6639
6640/**
6641 * Implements RDPMC.
6642 */
6643IEM_CIMPL_DEF_0(iemCImpl_rdpmc)
6644{
6645 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
6646
6647 if ( pVCpu->iem.s.uCpl != 0
6648 && !(pVCpu->cpum.GstCtx.cr4 & X86_CR4_PCE))
6649 return iemRaiseGeneralProtectionFault0(pVCpu);
6650
6651 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
6652 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_RDPMC_EXIT))
6653 {
6654 Log(("rdpmc: Guest intercept -> VM-exit\n"));
6655 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDPMC, cbInstr);
6656 }
6657
6658 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_RDPMC))
6659 {
6660 Log(("rdpmc: Guest intercept -> #VMEXIT\n"));
6661 IEM_SVM_UPDATE_NRIP(pVCpu);
6662 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_RDPMC, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
6663 }
6664
6665 /** @todo Emulate performance counters, for now just return 0. */
6666 pVCpu->cpum.GstCtx.rax = 0;
6667 pVCpu->cpum.GstCtx.rdx = 0;
6668 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
6669 /** @todo We should trigger a \#GP here if the CPU doesn't support the index in
6670 * ecx but see @bugref{3472}! */
6671
6672 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6673 return VINF_SUCCESS;
6674}
6675
6676
6677/**
6678 * Implements RDMSR.
6679 */
6680IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
6681{
6682 /*
6683 * Check preconditions.
6684 */
6685 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6686 return iemRaiseUndefinedOpcode(pVCpu);
6687 if (pVCpu->iem.s.uCpl != 0)
6688 return iemRaiseGeneralProtectionFault0(pVCpu);
6689
6690 /*
6691 * Check nested-guest intercepts.
6692 */
6693#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6694 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6695 {
6696 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_RDMSR, pVCpu->cpum.GstCtx.ecx))
6697 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_RDMSR, cbInstr);
6698 }
6699#endif
6700
6701#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6702 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6703 {
6704 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, pVCpu->cpum.GstCtx.ecx, false /* fWrite */);
6705 if (rcStrict == VINF_SVM_VMEXIT)
6706 return VINF_SUCCESS;
6707 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
6708 {
6709 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", pVCpu->cpum.GstCtx.ecx, VBOXSTRICTRC_VAL(rcStrict)));
6710 return rcStrict;
6711 }
6712 }
6713#endif
6714
6715 /*
6716 * Do the job.
6717 */
6718 RTUINT64U uValue;
6719 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
6720 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
6721
6722 VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pVCpu->cpum.GstCtx.ecx, &uValue.u);
6723 if (rcStrict == VINF_SUCCESS)
6724 {
6725 pVCpu->cpum.GstCtx.rax = uValue.s.Lo;
6726 pVCpu->cpum.GstCtx.rdx = uValue.s.Hi;
6727 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RDX);
6728
6729 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6730 return VINF_SUCCESS;
6731 }
6732
6733#ifndef IN_RING3
6734 /* Deferred to ring-3. */
6735 if (rcStrict == VINF_CPUM_R3_MSR_READ)
6736 {
6737 Log(("IEM: rdmsr(%#x) -> ring-3\n", pVCpu->cpum.GstCtx.ecx));
6738 return rcStrict;
6739 }
6740#endif
6741
6742 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6743 if (pVCpu->iem.s.cLogRelRdMsr < 32)
6744 {
6745 pVCpu->iem.s.cLogRelRdMsr++;
6746 LogRel(("IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
6747 }
6748 else
6749 Log(( "IEM: rdmsr(%#x) -> #GP(0)\n", pVCpu->cpum.GstCtx.ecx));
6750 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6751 return iemRaiseGeneralProtectionFault0(pVCpu);
6752}
6753
6754
6755/**
6756 * Implements WRMSR.
6757 */
6758IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
6759{
6760 /*
6761 * Check preconditions.
6762 */
6763 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
6764 return iemRaiseUndefinedOpcode(pVCpu);
6765 if (pVCpu->iem.s.uCpl != 0)
6766 return iemRaiseGeneralProtectionFault0(pVCpu);
6767
6768 RTUINT64U uValue;
6769 uValue.s.Lo = pVCpu->cpum.GstCtx.eax;
6770 uValue.s.Hi = pVCpu->cpum.GstCtx.edx;
6771
6772 uint32_t const idMsr = pVCpu->cpum.GstCtx.ecx;
6773
6774 /** @todo make CPUMAllMsrs.cpp import the necessary MSR state. */
6775 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
6776
6777 /*
6778 * Check nested-guest intercepts.
6779 */
6780#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6781 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6782 {
6783 if (iemVmxIsRdmsrWrmsrInterceptSet(pVCpu, VMX_EXIT_WRMSR, idMsr))
6784 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_WRMSR, cbInstr);
6785 }
6786#endif
6787
6788#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6789 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MSR_PROT))
6790 {
6791 VBOXSTRICTRC rcStrict = iemSvmHandleMsrIntercept(pVCpu, idMsr, true /* fWrite */);
6792 if (rcStrict == VINF_SVM_VMEXIT)
6793 return VINF_SUCCESS;
6794 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
6795 {
6796 Log(("IEM: SVM intercepted rdmsr(%#x) failed. rc=%Rrc\n", idMsr, VBOXSTRICTRC_VAL(rcStrict)));
6797 return rcStrict;
6798 }
6799 }
6800#endif
6801
6802 /*
6803 * Do the job.
6804 */
6805 VBOXSTRICTRC rcStrict = CPUMSetGuestMsr(pVCpu, idMsr, uValue.u);
6806 if (rcStrict == VINF_SUCCESS)
6807 {
6808 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6809 return VINF_SUCCESS;
6810 }
6811
6812#ifndef IN_RING3
6813 /* Deferred to ring-3. */
6814 if (rcStrict == VINF_CPUM_R3_MSR_WRITE)
6815 {
6816 Log(("IEM: wrmsr(%#x) -> ring-3\n", idMsr));
6817 return rcStrict;
6818 }
6819#endif
6820
6821 /* Often a unimplemented MSR or MSR bit, so worth logging. */
6822 if (pVCpu->iem.s.cLogRelWrMsr < 32)
6823 {
6824 pVCpu->iem.s.cLogRelWrMsr++;
6825 LogRel(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
6826 }
6827 else
6828 Log(( "IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", idMsr, uValue.s.Hi, uValue.s.Lo));
6829 AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
6830 return iemRaiseGeneralProtectionFault0(pVCpu);
6831}
6832
6833
6834/**
6835 * Implements 'IN eAX, port'.
6836 *
6837 * @param u16Port The source port.
6838 * @param fImm Whether the port was specified through an immediate operand
6839 * or the implicit DX register.
6840 * @param cbReg The register size.
6841 */
6842IEM_CIMPL_DEF_3(iemCImpl_in, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
6843{
6844 /*
6845 * CPL check
6846 */
6847 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
6848 if (rcStrict != VINF_SUCCESS)
6849 return rcStrict;
6850
6851 /*
6852 * Check VMX nested-guest IO intercept.
6853 */
6854#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6855 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6856 {
6857 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_IN, u16Port, fImm, cbReg, cbInstr);
6858 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6859 return rcStrict;
6860 }
6861#else
6862 RT_NOREF(fImm);
6863#endif
6864
6865 /*
6866 * Check SVM nested-guest IO intercept.
6867 */
6868#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6869 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6870 {
6871 uint8_t cAddrSizeBits;
6872 switch (pVCpu->iem.s.enmEffAddrMode)
6873 {
6874 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6875 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6876 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6877 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6878 }
6879 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_IN, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6880 false /* fRep */, false /* fStrIo */, cbInstr);
6881 if (rcStrict == VINF_SVM_VMEXIT)
6882 return VINF_SUCCESS;
6883 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
6884 {
6885 Log(("iemCImpl_in: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6886 VBOXSTRICTRC_VAL(rcStrict)));
6887 return rcStrict;
6888 }
6889 }
6890#endif
6891
6892 /*
6893 * Perform the I/O.
6894 */
6895 uint32_t u32Value = 0;
6896 rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
6897 if (IOM_SUCCESS(rcStrict))
6898 {
6899 switch (cbReg)
6900 {
6901 case 1: pVCpu->cpum.GstCtx.al = (uint8_t)u32Value; break;
6902 case 2: pVCpu->cpum.GstCtx.ax = (uint16_t)u32Value; break;
6903 case 4: pVCpu->cpum.GstCtx.rax = u32Value; break;
6904 default: AssertFailedReturn(VERR_IEM_IPE_3);
6905 }
6906 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
6907 pVCpu->iem.s.cPotentialExits++;
6908 if (rcStrict != VINF_SUCCESS)
6909 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
6910 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
6911
6912 /*
6913 * Check for I/O breakpoints.
6914 */
6915 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
6916 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
6917 && X86_DR7_ANY_RW_IO(uDr7)
6918 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
6919 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
6920 {
6921 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
6922 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
6923 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
6924 rcStrict = iemRaiseDebugException(pVCpu);
6925 }
6926 }
6927
6928 return rcStrict;
6929}
6930
6931
6932/**
6933 * Implements 'IN eAX, DX'.
6934 *
6935 * @param cbReg The register size.
6936 */
6937IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
6938{
6939 return IEM_CIMPL_CALL_3(iemCImpl_in, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
6940}
6941
6942
6943/**
6944 * Implements 'OUT port, eAX'.
6945 *
6946 * @param u16Port The destination port.
6947 * @param fImm Whether the port was specified through an immediate operand
6948 * or the implicit DX register.
6949 * @param cbReg The register size.
6950 */
6951IEM_CIMPL_DEF_3(iemCImpl_out, uint16_t, u16Port, bool, fImm, uint8_t, cbReg)
6952{
6953 /*
6954 * CPL check
6955 */
6956 VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, u16Port, cbReg);
6957 if (rcStrict != VINF_SUCCESS)
6958 return rcStrict;
6959
6960 /*
6961 * Check VMX nested-guest I/O intercept.
6962 */
6963#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
6964 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
6965 {
6966 rcStrict = iemVmxVmexitInstrIo(pVCpu, VMXINSTRID_IO_OUT, u16Port, fImm, cbReg, cbInstr);
6967 if (rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE)
6968 return rcStrict;
6969 }
6970#else
6971 RT_NOREF(fImm);
6972#endif
6973
6974 /*
6975 * Check SVM nested-guest I/O intercept.
6976 */
6977#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
6978 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_IOIO_PROT))
6979 {
6980 uint8_t cAddrSizeBits;
6981 switch (pVCpu->iem.s.enmEffAddrMode)
6982 {
6983 case IEMMODE_16BIT: cAddrSizeBits = 16; break;
6984 case IEMMODE_32BIT: cAddrSizeBits = 32; break;
6985 case IEMMODE_64BIT: cAddrSizeBits = 64; break;
6986 IEM_NOT_REACHED_DEFAULT_CASE_RET();
6987 }
6988 rcStrict = iemSvmHandleIOIntercept(pVCpu, u16Port, SVMIOIOTYPE_OUT, cbReg, cAddrSizeBits, 0 /* N/A - iEffSeg */,
6989 false /* fRep */, false /* fStrIo */, cbInstr);
6990 if (rcStrict == VINF_SVM_VMEXIT)
6991 return VINF_SUCCESS;
6992 if (rcStrict != VINF_SVM_INTERCEPT_NOT_ACTIVE)
6993 {
6994 Log(("iemCImpl_out: iemSvmHandleIOIntercept failed (u16Port=%#x, cbReg=%u) rc=%Rrc\n", u16Port, cbReg,
6995 VBOXSTRICTRC_VAL(rcStrict)));
6996 return rcStrict;
6997 }
6998 }
6999#endif
7000
7001 /*
7002 * Perform the I/O.
7003 */
7004 uint32_t u32Value;
7005 switch (cbReg)
7006 {
7007 case 1: u32Value = pVCpu->cpum.GstCtx.al; break;
7008 case 2: u32Value = pVCpu->cpum.GstCtx.ax; break;
7009 case 4: u32Value = pVCpu->cpum.GstCtx.eax; break;
7010 default: AssertFailedReturn(VERR_IEM_IPE_4);
7011 }
7012 rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
7013 if (IOM_SUCCESS(rcStrict))
7014 {
7015 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7016 pVCpu->iem.s.cPotentialExits++;
7017 if (rcStrict != VINF_SUCCESS)
7018 rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
7019 Assert(rcStrict == VINF_SUCCESS); /* assumed below */
7020
7021 /*
7022 * Check for I/O breakpoints.
7023 */
7024 uint32_t const uDr7 = pVCpu->cpum.GstCtx.dr[7];
7025 if (RT_UNLIKELY( ( (uDr7 & X86_DR7_ENABLED_MASK)
7026 && X86_DR7_ANY_RW_IO(uDr7)
7027 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_DE))
7028 || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
7029 {
7030 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_DR0_DR3 | CPUMCTX_EXTRN_DR6);
7031 rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, IEM_GET_CTX(pVCpu), u16Port, cbReg);
7032 if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
7033 rcStrict = iemRaiseDebugException(pVCpu);
7034 }
7035 }
7036 return rcStrict;
7037}
7038
7039
7040/**
7041 * Implements 'OUT DX, eAX'.
7042 *
7043 * @param cbReg The register size.
7044 */
7045IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
7046{
7047 return IEM_CIMPL_CALL_3(iemCImpl_out, pVCpu->cpum.GstCtx.dx, false /* fImm */, cbReg);
7048}
7049
7050
7051/**
7052 * Implements 'CLI'.
7053 */
7054IEM_CIMPL_DEF_0(iemCImpl_cli)
7055{
7056 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7057 uint32_t const fEflOld = fEfl;
7058
7059 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7060 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7061 {
7062 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7063 if (!(fEfl & X86_EFL_VM))
7064 {
7065 if (pVCpu->iem.s.uCpl <= uIopl)
7066 fEfl &= ~X86_EFL_IF;
7067 else if ( pVCpu->iem.s.uCpl == 3
7068 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI) )
7069 fEfl &= ~X86_EFL_VIF;
7070 else
7071 return iemRaiseGeneralProtectionFault0(pVCpu);
7072 }
7073 /* V8086 */
7074 else if (uIopl == 3)
7075 fEfl &= ~X86_EFL_IF;
7076 else if ( uIopl < 3
7077 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME) )
7078 fEfl &= ~X86_EFL_VIF;
7079 else
7080 return iemRaiseGeneralProtectionFault0(pVCpu);
7081 }
7082 /* real mode */
7083 else
7084 fEfl &= ~X86_EFL_IF;
7085
7086 /* Commit. */
7087 IEMMISC_SET_EFL(pVCpu, fEfl);
7088 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7089 Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
7090 return VINF_SUCCESS;
7091}
7092
7093
7094/**
7095 * Implements 'STI'.
7096 */
7097IEM_CIMPL_DEF_0(iemCImpl_sti)
7098{
7099 uint32_t fEfl = IEMMISC_GET_EFL(pVCpu);
7100 uint32_t const fEflOld = fEfl;
7101
7102 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR4);
7103 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PE)
7104 {
7105 uint8_t const uIopl = X86_EFL_GET_IOPL(fEfl);
7106 if (!(fEfl & X86_EFL_VM))
7107 {
7108 if (pVCpu->iem.s.uCpl <= uIopl)
7109 fEfl |= X86_EFL_IF;
7110 else if ( pVCpu->iem.s.uCpl == 3
7111 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_PVI)
7112 && !(fEfl & X86_EFL_VIP) )
7113 fEfl |= X86_EFL_VIF;
7114 else
7115 return iemRaiseGeneralProtectionFault0(pVCpu);
7116 }
7117 /* V8086 */
7118 else if (uIopl == 3)
7119 fEfl |= X86_EFL_IF;
7120 else if ( uIopl < 3
7121 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_VME)
7122 && !(fEfl & X86_EFL_VIP) )
7123 fEfl |= X86_EFL_VIF;
7124 else
7125 return iemRaiseGeneralProtectionFault0(pVCpu);
7126 }
7127 /* real mode */
7128 else
7129 fEfl |= X86_EFL_IF;
7130
7131 /* Commit. */
7132 IEMMISC_SET_EFL(pVCpu, fEfl);
7133 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7134 if (!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF))
7135 EMSetInhibitInterruptsPC(pVCpu, pVCpu->cpum.GstCtx.rip);
7136 Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
7137 return VINF_SUCCESS;
7138}
7139
7140
7141/**
7142 * Implements 'HLT'.
7143 */
7144IEM_CIMPL_DEF_0(iemCImpl_hlt)
7145{
7146 if (pVCpu->iem.s.uCpl != 0)
7147 return iemRaiseGeneralProtectionFault0(pVCpu);
7148
7149 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7150 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_HLT_EXIT))
7151 {
7152 Log2(("hlt: Guest intercept -> VM-exit\n"));
7153 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_HLT, cbInstr);
7154 }
7155
7156 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_HLT))
7157 {
7158 Log2(("hlt: Guest intercept -> #VMEXIT\n"));
7159 IEM_SVM_UPDATE_NRIP(pVCpu);
7160 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_HLT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7161 }
7162
7163 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7164 return VINF_EM_HALT;
7165}
7166
7167
7168/**
7169 * Implements 'MONITOR'.
7170 */
7171IEM_CIMPL_DEF_1(iemCImpl_monitor, uint8_t, iEffSeg)
7172{
7173 /*
7174 * Permission checks.
7175 */
7176 if (pVCpu->iem.s.uCpl != 0)
7177 {
7178 Log2(("monitor: CPL != 0\n"));
7179 return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
7180 }
7181 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7182 {
7183 Log2(("monitor: Not in CPUID\n"));
7184 return iemRaiseUndefinedOpcode(pVCpu);
7185 }
7186
7187 /*
7188 * Check VMX guest-intercept.
7189 * This should be considered a fault-like VM-exit.
7190 * See Intel spec. 25.1.1 "Relative Priority of Faults and VM Exits".
7191 */
7192 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7193 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MONITOR_EXIT))
7194 {
7195 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7196 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_MONITOR, cbInstr);
7197 }
7198
7199 /*
7200 * Gather the operands and validate them.
7201 */
7202 RTGCPTR GCPtrMem = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pVCpu->cpum.GstCtx.rax : pVCpu->cpum.GstCtx.eax;
7203 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7204 uint32_t uEdx = pVCpu->cpum.GstCtx.edx;
7205/** @todo Test whether EAX or ECX is processed first, i.e. do we get \#PF or
7206 * \#GP first. */
7207 if (uEcx != 0)
7208 {
7209 Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
7210 return iemRaiseGeneralProtectionFault0(pVCpu);
7211 }
7212
7213 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
7214 if (rcStrict != VINF_SUCCESS)
7215 return rcStrict;
7216
7217 RTGCPHYS GCPhysMem;
7218 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7219 if (rcStrict != VINF_SUCCESS)
7220 return rcStrict;
7221
7222#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7223 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7224 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7225 {
7226 /*
7227 * MONITOR does not access the memory, just monitors the address. However,
7228 * if the address falls in the APIC-access page, the address monitored must
7229 * instead be the corresponding address in the virtual-APIC page.
7230 *
7231 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7232 */
7233 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem);
7234 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7235 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7236 return rcStrict;
7237 }
7238#endif
7239
7240 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MONITOR))
7241 {
7242 Log2(("monitor: Guest intercept -> #VMEXIT\n"));
7243 IEM_SVM_UPDATE_NRIP(pVCpu);
7244 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MONITOR, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7245 }
7246
7247 /*
7248 * Call EM to prepare the monitor/wait.
7249 */
7250 rcStrict = EMMonitorWaitPrepare(pVCpu, pVCpu->cpum.GstCtx.rax, pVCpu->cpum.GstCtx.rcx, pVCpu->cpum.GstCtx.rdx, GCPhysMem);
7251 Assert(rcStrict == VINF_SUCCESS);
7252
7253 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7254 return rcStrict;
7255}
7256
7257
7258/**
7259 * Implements 'MWAIT'.
7260 */
7261IEM_CIMPL_DEF_0(iemCImpl_mwait)
7262{
7263 /*
7264 * Permission checks.
7265 */
7266 if (pVCpu->iem.s.uCpl != 0)
7267 {
7268 Log2(("mwait: CPL != 0\n"));
7269 /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
7270 * EFLAGS.VM then.) */
7271 return iemRaiseUndefinedOpcode(pVCpu);
7272 }
7273 if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
7274 {
7275 Log2(("mwait: Not in CPUID\n"));
7276 return iemRaiseUndefinedOpcode(pVCpu);
7277 }
7278
7279 /* Check VMX nested-guest intercept. */
7280 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7281 && IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_MWAIT_EXIT))
7282 IEM_VMX_VMEXIT_MWAIT_RET(pVCpu, EMMonitorIsArmed(pVCpu), cbInstr);
7283
7284 /*
7285 * Gather the operands and validate them.
7286 */
7287 uint32_t const uEax = pVCpu->cpum.GstCtx.eax;
7288 uint32_t const uEcx = pVCpu->cpum.GstCtx.ecx;
7289 if (uEcx != 0)
7290 {
7291 /* Only supported extension is break on IRQ when IF=0. */
7292 if (uEcx > 1)
7293 {
7294 Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
7295 return iemRaiseGeneralProtectionFault0(pVCpu);
7296 }
7297 uint32_t fMWaitFeatures = 0;
7298 uint32_t uIgnore = 0;
7299 CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
7300 if ( (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7301 != (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
7302 {
7303 Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
7304 return iemRaiseGeneralProtectionFault0(pVCpu);
7305 }
7306
7307#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7308 /*
7309 * If the interrupt-window exiting control is set or a virtual-interrupt is pending
7310 * for delivery; and interrupts are disabled the processor does not enter its
7311 * mwait state but rather passes control to the next instruction.
7312 *
7313 * See Intel spec. 25.3 "Changes to Instruction Behavior In VMX Non-root Operation".
7314 */
7315 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7316 && !pVCpu->cpum.GstCtx.eflags.Bits.u1IF)
7317 {
7318 if ( IEM_VMX_IS_PROCCTLS_SET(pVCpu, VMX_PROC_CTLS_INT_WINDOW_EXIT)
7319 || VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INTERRUPT_NESTED_GUEST))
7320 {
7321 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7322 return VINF_SUCCESS;
7323 }
7324 }
7325#endif
7326 }
7327
7328 /*
7329 * Check SVM nested-guest mwait intercepts.
7330 */
7331 if ( IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT_ARMED)
7332 && EMMonitorIsArmed(pVCpu))
7333 {
7334 Log2(("mwait: Guest intercept (monitor hardware armed) -> #VMEXIT\n"));
7335 IEM_SVM_UPDATE_NRIP(pVCpu);
7336 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT_ARMED, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7337 }
7338 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_MWAIT))
7339 {
7340 Log2(("mwait: Guest intercept -> #VMEXIT\n"));
7341 IEM_SVM_UPDATE_NRIP(pVCpu);
7342 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_MWAIT, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7343 }
7344
7345 /*
7346 * Call EM to prepare the monitor/wait.
7347 */
7348 VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
7349
7350 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7351 return rcStrict;
7352}
7353
7354
7355/**
7356 * Implements 'SWAPGS'.
7357 */
7358IEM_CIMPL_DEF_0(iemCImpl_swapgs)
7359{
7360 Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
7361
7362 /*
7363 * Permission checks.
7364 */
7365 if (pVCpu->iem.s.uCpl != 0)
7366 {
7367 Log2(("swapgs: CPL != 0\n"));
7368 return iemRaiseUndefinedOpcode(pVCpu);
7369 }
7370
7371 /*
7372 * Do the job.
7373 */
7374 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_GS);
7375 uint64_t uOtherGsBase = pVCpu->cpum.GstCtx.msrKERNELGSBASE;
7376 pVCpu->cpum.GstCtx.msrKERNELGSBASE = pVCpu->cpum.GstCtx.gs.u64Base;
7377 pVCpu->cpum.GstCtx.gs.u64Base = uOtherGsBase;
7378
7379 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7380 return VINF_SUCCESS;
7381}
7382
7383
7384/**
7385 * Implements 'CPUID'.
7386 */
7387IEM_CIMPL_DEF_0(iemCImpl_cpuid)
7388{
7389 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7390 {
7391 Log2(("cpuid: Guest intercept -> VM-exit\n"));
7392 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_CPUID, cbInstr);
7393 }
7394
7395 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_CPUID))
7396 {
7397 Log2(("cpuid: Guest intercept -> #VMEXIT\n"));
7398 IEM_SVM_UPDATE_NRIP(pVCpu);
7399 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_CPUID, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7400 }
7401
7402 CPUMGetGuestCpuId(pVCpu, pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.ecx,
7403 &pVCpu->cpum.GstCtx.eax, &pVCpu->cpum.GstCtx.ebx, &pVCpu->cpum.GstCtx.ecx, &pVCpu->cpum.GstCtx.edx);
7404 pVCpu->cpum.GstCtx.rax &= UINT32_C(0xffffffff);
7405 pVCpu->cpum.GstCtx.rbx &= UINT32_C(0xffffffff);
7406 pVCpu->cpum.GstCtx.rcx &= UINT32_C(0xffffffff);
7407 pVCpu->cpum.GstCtx.rdx &= UINT32_C(0xffffffff);
7408 pVCpu->cpum.GstCtx.fExtrn &= ~(CPUMCTX_EXTRN_RAX | CPUMCTX_EXTRN_RCX | CPUMCTX_EXTRN_RDX | CPUMCTX_EXTRN_RBX);
7409
7410 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7411 pVCpu->iem.s.cPotentialExits++;
7412 return VINF_SUCCESS;
7413}
7414
7415
7416/**
7417 * Implements 'AAD'.
7418 *
7419 * @param bImm The immediate operand.
7420 */
7421IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
7422{
7423 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7424 uint8_t const al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
7425 pVCpu->cpum.GstCtx.ax = al;
7426 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7427 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7428 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7429
7430 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7431 return VINF_SUCCESS;
7432}
7433
7434
7435/**
7436 * Implements 'AAM'.
7437 *
7438 * @param bImm The immediate operand. Cannot be 0.
7439 */
7440IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
7441{
7442 Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
7443
7444 uint16_t const ax = pVCpu->cpum.GstCtx.ax;
7445 uint8_t const al = (uint8_t)ax % bImm;
7446 uint8_t const ah = (uint8_t)ax / bImm;
7447 pVCpu->cpum.GstCtx.ax = (ah << 8) + al;
7448 iemHlpUpdateArithEFlagsU8(pVCpu, al,
7449 X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
7450 X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
7451
7452 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7453 return VINF_SUCCESS;
7454}
7455
7456
7457/**
7458 * Implements 'DAA'.
7459 */
7460IEM_CIMPL_DEF_0(iemCImpl_daa)
7461{
7462 uint8_t const al = pVCpu->cpum.GstCtx.al;
7463 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7464
7465 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7466 || (al & 0xf) >= 10)
7467 {
7468 pVCpu->cpum.GstCtx.al = al + 6;
7469 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7470 }
7471 else
7472 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7473
7474 if (al >= 0x9a || fCarry)
7475 {
7476 pVCpu->cpum.GstCtx.al += 0x60;
7477 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7478 }
7479 else
7480 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7481
7482 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7483 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7484 return VINF_SUCCESS;
7485}
7486
7487
7488/**
7489 * Implements 'DAS'.
7490 */
7491IEM_CIMPL_DEF_0(iemCImpl_das)
7492{
7493 uint8_t const uInputAL = pVCpu->cpum.GstCtx.al;
7494 bool const fCarry = pVCpu->cpum.GstCtx.eflags.Bits.u1CF;
7495
7496 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7497 || (uInputAL & 0xf) >= 10)
7498 {
7499 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7500 if (uInputAL < 6)
7501 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7502 pVCpu->cpum.GstCtx.al = uInputAL - 6;
7503 }
7504 else
7505 {
7506 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7507 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7508 }
7509
7510 if (uInputAL >= 0x9a || fCarry)
7511 {
7512 pVCpu->cpum.GstCtx.al -= 0x60;
7513 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7514 }
7515
7516 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7517 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7518 return VINF_SUCCESS;
7519}
7520
7521
7522/**
7523 * Implements 'AAA'.
7524 */
7525IEM_CIMPL_DEF_0(iemCImpl_aaa)
7526{
7527 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7528 {
7529 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7530 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7531 {
7532 iemAImpl_add_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7533 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7534 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7535 }
7536 else
7537 {
7538 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7539 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7540 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7541 }
7542 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7543 }
7544 else
7545 {
7546 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7547 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7548 {
7549 pVCpu->cpum.GstCtx.ax += UINT16_C(0x106);
7550 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7551 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7552 }
7553 else
7554 {
7555 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7556 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7557 }
7558 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7559 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7560 }
7561
7562 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7563 return VINF_SUCCESS;
7564}
7565
7566
7567/**
7568 * Implements 'AAS'.
7569 */
7570IEM_CIMPL_DEF_0(iemCImpl_aas)
7571{
7572 if (IEM_IS_GUEST_CPU_AMD(pVCpu))
7573 {
7574 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7575 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7576 {
7577 iemAImpl_sub_u16(&pVCpu->cpum.GstCtx.ax, 0x106, &pVCpu->cpum.GstCtx.eflags.u32);
7578 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7579 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7580 }
7581 else
7582 {
7583 iemHlpUpdateArithEFlagsU16(pVCpu, pVCpu->cpum.GstCtx.ax, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7584 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7585 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7586 }
7587 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7588 }
7589 else
7590 {
7591 if ( pVCpu->cpum.GstCtx.eflags.Bits.u1AF
7592 || (pVCpu->cpum.GstCtx.ax & 0xf) >= 10)
7593 {
7594 pVCpu->cpum.GstCtx.ax -= UINT16_C(0x106);
7595 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 1;
7596 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 1;
7597 }
7598 else
7599 {
7600 pVCpu->cpum.GstCtx.eflags.Bits.u1AF = 0;
7601 pVCpu->cpum.GstCtx.eflags.Bits.u1CF = 0;
7602 }
7603 pVCpu->cpum.GstCtx.ax &= UINT16_C(0xff0f);
7604 iemHlpUpdateArithEFlagsU8(pVCpu, pVCpu->cpum.GstCtx.al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
7605 }
7606
7607 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7608 return VINF_SUCCESS;
7609}
7610
7611
7612/**
7613 * Implements the 16-bit version of 'BOUND'.
7614 *
7615 * @note We have separate 16-bit and 32-bit variants of this function due to
7616 * the decoder using unsigned parameters, whereas we want signed one to
7617 * do the job. This is significant for a recompiler.
7618 */
7619IEM_CIMPL_DEF_3(iemCImpl_bound_16, int16_t, idxArray, int16_t, idxLowerBound, int16_t, idxUpperBound)
7620{
7621 /*
7622 * Check if the index is inside the bounds, otherwise raise #BR.
7623 */
7624 if ( idxArray >= idxLowerBound
7625 && idxArray <= idxUpperBound)
7626 {
7627 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7628 return VINF_SUCCESS;
7629 }
7630
7631 return iemRaiseBoundRangeExceeded(pVCpu);
7632}
7633
7634
7635/**
7636 * Implements the 32-bit version of 'BOUND'.
7637 */
7638IEM_CIMPL_DEF_3(iemCImpl_bound_32, int32_t, idxArray, int32_t, idxLowerBound, int32_t, idxUpperBound)
7639{
7640 /*
7641 * Check if the index is inside the bounds, otherwise raise #BR.
7642 */
7643 if ( idxArray >= idxLowerBound
7644 && idxArray <= idxUpperBound)
7645 {
7646 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7647 return VINF_SUCCESS;
7648 }
7649
7650 return iemRaiseBoundRangeExceeded(pVCpu);
7651}
7652
7653
7654
7655/*
7656 * Instantiate the various string operation combinations.
7657 */
7658#define OP_SIZE 8
7659#define ADDR_SIZE 16
7660#include "IEMAllCImplStrInstr.cpp.h"
7661#define OP_SIZE 8
7662#define ADDR_SIZE 32
7663#include "IEMAllCImplStrInstr.cpp.h"
7664#define OP_SIZE 8
7665#define ADDR_SIZE 64
7666#include "IEMAllCImplStrInstr.cpp.h"
7667
7668#define OP_SIZE 16
7669#define ADDR_SIZE 16
7670#include "IEMAllCImplStrInstr.cpp.h"
7671#define OP_SIZE 16
7672#define ADDR_SIZE 32
7673#include "IEMAllCImplStrInstr.cpp.h"
7674#define OP_SIZE 16
7675#define ADDR_SIZE 64
7676#include "IEMAllCImplStrInstr.cpp.h"
7677
7678#define OP_SIZE 32
7679#define ADDR_SIZE 16
7680#include "IEMAllCImplStrInstr.cpp.h"
7681#define OP_SIZE 32
7682#define ADDR_SIZE 32
7683#include "IEMAllCImplStrInstr.cpp.h"
7684#define OP_SIZE 32
7685#define ADDR_SIZE 64
7686#include "IEMAllCImplStrInstr.cpp.h"
7687
7688#define OP_SIZE 64
7689#define ADDR_SIZE 32
7690#include "IEMAllCImplStrInstr.cpp.h"
7691#define OP_SIZE 64
7692#define ADDR_SIZE 64
7693#include "IEMAllCImplStrInstr.cpp.h"
7694
7695
7696/**
7697 * Implements 'XGETBV'.
7698 */
7699IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
7700{
7701 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR4);
7702 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
7703 {
7704 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7705 switch (uEcx)
7706 {
7707 case 0:
7708 break;
7709
7710 case 1: /** @todo Implement XCR1 support. */
7711 default:
7712 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
7713 return iemRaiseGeneralProtectionFault0(pVCpu);
7714
7715 }
7716 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
7717 pVCpu->cpum.GstCtx.rax = RT_LO_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
7718 pVCpu->cpum.GstCtx.rdx = RT_HI_U32(pVCpu->cpum.GstCtx.aXcr[uEcx]);
7719
7720 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7721 return VINF_SUCCESS;
7722 }
7723 Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
7724 return iemRaiseUndefinedOpcode(pVCpu);
7725}
7726
7727
7728/**
7729 * Implements 'XSETBV'.
7730 */
7731IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
7732{
7733 if (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE)
7734 {
7735 if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_XSETBV))
7736 {
7737 Log2(("xsetbv: Guest intercept -> #VMEXIT\n"));
7738 IEM_SVM_UPDATE_NRIP(pVCpu);
7739 IEM_SVM_VMEXIT_RET(pVCpu, SVM_EXIT_XSETBV, 0 /* uExitInfo1 */, 0 /* uExitInfo2 */);
7740 }
7741
7742 if (pVCpu->iem.s.uCpl == 0)
7743 {
7744 IEM_CTX_IMPORT_RET(pVCpu, CPUMCTX_EXTRN_XCRx);
7745
7746 if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
7747 IEM_VMX_VMEXIT_INSTR_RET(pVCpu, VMX_EXIT_XSETBV, cbInstr);
7748
7749 uint32_t uEcx = pVCpu->cpum.GstCtx.ecx;
7750 uint64_t uNewValue = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx);
7751 switch (uEcx)
7752 {
7753 case 0:
7754 {
7755 int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
7756 if (rc == VINF_SUCCESS)
7757 break;
7758 Assert(rc == VERR_CPUM_RAISE_GP_0);
7759 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7760 return iemRaiseGeneralProtectionFault0(pVCpu);
7761 }
7762
7763 case 1: /** @todo Implement XCR1 support. */
7764 default:
7765 Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
7766 return iemRaiseGeneralProtectionFault0(pVCpu);
7767
7768 }
7769
7770 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7771 return VINF_SUCCESS;
7772 }
7773
7774 Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
7775 return iemRaiseGeneralProtectionFault0(pVCpu);
7776 }
7777 Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
7778 return iemRaiseUndefinedOpcode(pVCpu);
7779}
7780
7781#ifdef IN_RING3
7782
7783/** Argument package for iemCImpl_cmpxchg16b_fallback_rendezvous_callback. */
7784struct IEMCIMPLCX16ARGS
7785{
7786 PRTUINT128U pu128Dst;
7787 PRTUINT128U pu128RaxRdx;
7788 PRTUINT128U pu128RbxRcx;
7789 uint32_t *pEFlags;
7790# ifdef VBOX_STRICT
7791 uint32_t cCalls;
7792# endif
7793};
7794
7795/**
7796 * @callback_method_impl{FNVMMEMTRENDEZVOUS,
7797 * Worker for iemCImpl_cmpxchg16b_fallback_rendezvous}
7798 */
7799static DECLCALLBACK(VBOXSTRICTRC) iemCImpl_cmpxchg16b_fallback_rendezvous_callback(PVM pVM, PVMCPU pVCpu, void *pvUser)
7800{
7801 RT_NOREF(pVM, pVCpu);
7802 struct IEMCIMPLCX16ARGS *pArgs = (struct IEMCIMPLCX16ARGS *)pvUser;
7803# ifdef VBOX_STRICT
7804 Assert(pArgs->cCalls == 0);
7805 pArgs->cCalls++;
7806# endif
7807
7808 iemAImpl_cmpxchg16b_fallback(pArgs->pu128Dst, pArgs->pu128RaxRdx, pArgs->pu128RbxRcx, pArgs->pEFlags);
7809 return VINF_SUCCESS;
7810}
7811
7812#endif /* IN_RING3 */
7813
7814/**
7815 * Implements 'CMPXCHG16B' fallback using rendezvous.
7816 */
7817IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
7818 PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
7819{
7820#ifdef IN_RING3
7821 struct IEMCIMPLCX16ARGS Args;
7822 Args.pu128Dst = pu128Dst;
7823 Args.pu128RaxRdx = pu128RaxRdx;
7824 Args.pu128RbxRcx = pu128RbxRcx;
7825 Args.pEFlags = pEFlags;
7826# ifdef VBOX_STRICT
7827 Args.cCalls = 0;
7828# endif
7829 VBOXSTRICTRC rcStrict = VMMR3EmtRendezvous(pVCpu->CTX_SUFF(pVM), VMMEMTRENDEZVOUS_FLAGS_TYPE_ONCE,
7830 iemCImpl_cmpxchg16b_fallback_rendezvous_callback, &Args);
7831 Assert(Args.cCalls == 1);
7832 if (rcStrict == VINF_SUCCESS)
7833 {
7834 /* Duplicated tail code. */
7835 rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
7836 if (rcStrict == VINF_SUCCESS)
7837 {
7838 pVCpu->cpum.GstCtx.eflags.u = *pEFlags; /* IEM_MC_COMMIT_EFLAGS */
7839 if (!(*pEFlags & X86_EFL_ZF))
7840 {
7841 pVCpu->cpum.GstCtx.rax = pu128RaxRdx->s.Lo;
7842 pVCpu->cpum.GstCtx.rdx = pu128RaxRdx->s.Hi;
7843 }
7844 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7845 }
7846 }
7847 return rcStrict;
7848#else
7849 RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
7850 return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now. Should perhaps be replaced later. */
7851#endif
7852}
7853
7854
7855/**
7856 * Implements 'CLFLUSH' and 'CLFLUSHOPT'.
7857 *
7858 * This is implemented in C because it triggers a load like behaviour without
7859 * actually reading anything. Since that's not so common, it's implemented
7860 * here.
7861 *
7862 * @param iEffSeg The effective segment.
7863 * @param GCPtrEff The address of the image.
7864 */
7865IEM_CIMPL_DEF_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
7866{
7867 /*
7868 * Pretend to do a load w/o reading (see also iemCImpl_monitor and iemMemMap).
7869 */
7870 VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrEff);
7871 if (rcStrict == VINF_SUCCESS)
7872 {
7873 RTGCPHYS GCPhysMem;
7874 rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrEff, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
7875 if (rcStrict == VINF_SUCCESS)
7876 {
7877#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
7878 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
7879 && IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_VIRT_APIC_ACCESS))
7880 {
7881 /*
7882 * CLFLUSH/CLFLUSHOPT does not access the memory, but flushes the cache-line
7883 * that contains the address. However, if the address falls in the APIC-access
7884 * page, the address flushed must instead be the corresponding address in the
7885 * virtual-APIC page.
7886 *
7887 * See Intel spec. 29.4.4 "Instruction-Specific Considerations".
7888 */
7889 rcStrict = iemVmxVirtApicAccessUnused(pVCpu, &GCPhysMem);
7890 if ( rcStrict != VINF_VMX_INTERCEPT_NOT_ACTIVE
7891 && rcStrict != VINF_VMX_MODIFIES_BEHAVIOR)
7892 return rcStrict;
7893 }
7894#endif
7895 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7896 return VINF_SUCCESS;
7897 }
7898 }
7899
7900 return rcStrict;
7901}
7902
7903
7904/**
7905 * Implements 'FINIT' and 'FNINIT'.
7906 *
7907 * @param fCheckXcpts Whether to check for umasked pending exceptions or
7908 * not.
7909 */
7910IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
7911{
7912 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0);
7913 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
7914 return iemRaiseDeviceNotAvailable(pVCpu);
7915
7916 iemFpuActualizeStateForChange(pVCpu);
7917 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_X87);
7918
7919 NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
7920 if (fCheckXcpts && TODO )
7921 return iemRaiseMathFault(pVCpu);
7922 */
7923
7924 PX86XSAVEAREA pXState = pVCpu->cpum.GstCtx.CTX_SUFF(pXState);
7925 pXState->x87.FCW = 0x37f;
7926 pXState->x87.FSW = 0;
7927 pXState->x87.FTW = 0x00; /* 0 - empty. */
7928 pXState->x87.FPUDP = 0;
7929 pXState->x87.DS = 0; //??
7930 pXState->x87.Rsrvd2= 0;
7931 pXState->x87.FPUIP = 0;
7932 pXState->x87.CS = 0; //??
7933 pXState->x87.Rsrvd1= 0;
7934 pXState->x87.FOP = 0;
7935
7936 iemHlpUsedFpu(pVCpu);
7937 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
7938 return VINF_SUCCESS;
7939}
7940
7941
7942/**
7943 * Implements 'FXSAVE'.
7944 *
7945 * @param iEffSeg The effective segment.
7946 * @param GCPtrEff The address of the image.
7947 * @param enmEffOpSize The operand size (only REX.W really matters).
7948 */
7949IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
7950{
7951 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
7952
7953 /*
7954 * Raise exceptions.
7955 */
7956 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
7957 return iemRaiseUndefinedOpcode(pVCpu);
7958 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
7959 return iemRaiseDeviceNotAvailable(pVCpu);
7960 if (GCPtrEff & 15)
7961 {
7962 /** @todo CPU/VM detection possible! \#AC might not be signal for
7963 * all/any misalignment sizes, intel says its an implementation detail. */
7964 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
7965 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
7966 && pVCpu->iem.s.uCpl == 3)
7967 return iemRaiseAlignmentCheckException(pVCpu);
7968 return iemRaiseGeneralProtectionFault0(pVCpu);
7969 }
7970
7971 /*
7972 * Access the memory.
7973 */
7974 void *pvMem512;
7975 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
7976 if (rcStrict != VINF_SUCCESS)
7977 return rcStrict;
7978 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
7979 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
7980
7981 /*
7982 * Store the registers.
7983 */
7984 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
7985 * implementation specific whether MXCSR and XMM0-XMM7 are saved. */
7986
7987 /* common for all formats */
7988 pDst->FCW = pSrc->FCW;
7989 pDst->FSW = pSrc->FSW;
7990 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
7991 pDst->FOP = pSrc->FOP;
7992 pDst->MXCSR = pSrc->MXCSR;
7993 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
7994 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
7995 {
7996 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
7997 * them for now... */
7998 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
7999 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8000 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8001 pDst->aRegs[i].au32[3] = 0;
8002 }
8003
8004 /* FPU IP, CS, DP and DS. */
8005 pDst->FPUIP = pSrc->FPUIP;
8006 pDst->CS = pSrc->CS;
8007 pDst->FPUDP = pSrc->FPUDP;
8008 pDst->DS = pSrc->DS;
8009 if (enmEffOpSize == IEMMODE_64BIT)
8010 {
8011 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8012 pDst->Rsrvd1 = pSrc->Rsrvd1;
8013 pDst->Rsrvd2 = pSrc->Rsrvd2;
8014 pDst->au32RsrvdForSoftware[0] = 0;
8015 }
8016 else
8017 {
8018 pDst->Rsrvd1 = 0;
8019 pDst->Rsrvd2 = 0;
8020 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
8021 }
8022
8023 /* XMM registers. */
8024 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8025 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8026 || pVCpu->iem.s.uCpl != 0)
8027 {
8028 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8029 for (uint32_t i = 0; i < cXmmRegs; i++)
8030 pDst->aXMM[i] = pSrc->aXMM[i];
8031 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8032 * right? */
8033 }
8034
8035 /*
8036 * Commit the memory.
8037 */
8038 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8039 if (rcStrict != VINF_SUCCESS)
8040 return rcStrict;
8041
8042 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8043 return VINF_SUCCESS;
8044}
8045
8046
8047/**
8048 * Implements 'FXRSTOR'.
8049 *
8050 * @param GCPtrEff The address of the image.
8051 * @param enmEffOpSize The operand size (only REX.W really matters).
8052 */
8053IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8054{
8055 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8056
8057 /*
8058 * Raise exceptions.
8059 */
8060 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8061 return iemRaiseUndefinedOpcode(pVCpu);
8062 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_TS | X86_CR0_EM))
8063 return iemRaiseDeviceNotAvailable(pVCpu);
8064 if (GCPtrEff & 15)
8065 {
8066 /** @todo CPU/VM detection possible! \#AC might not be signal for
8067 * all/any misalignment sizes, intel says its an implementation detail. */
8068 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8069 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8070 && pVCpu->iem.s.uCpl == 3)
8071 return iemRaiseAlignmentCheckException(pVCpu);
8072 return iemRaiseGeneralProtectionFault0(pVCpu);
8073 }
8074
8075 /*
8076 * Access the memory.
8077 */
8078 void *pvMem512;
8079 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
8080 if (rcStrict != VINF_SUCCESS)
8081 return rcStrict;
8082 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8083 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8084
8085 /*
8086 * Check the state for stuff which will #GP(0).
8087 */
8088 uint32_t const fMXCSR = pSrc->MXCSR;
8089 uint32_t const fMXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8090 if (fMXCSR & ~fMXCSR_MASK)
8091 {
8092 Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
8093 return iemRaiseGeneralProtectionFault0(pVCpu);
8094 }
8095
8096 /*
8097 * Load the registers.
8098 */
8099 /** @todo CPU/VM detection possible! If CR4.OSFXSR=0 MXCSR it's
8100 * implementation specific whether MXCSR and XMM0-XMM7 are restored. */
8101
8102 /* common for all formats */
8103 pDst->FCW = pSrc->FCW;
8104 pDst->FSW = pSrc->FSW;
8105 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8106 pDst->FOP = pSrc->FOP;
8107 pDst->MXCSR = fMXCSR;
8108 /* (MXCSR_MASK is read-only) */
8109 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8110 {
8111 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8112 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8113 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8114 pDst->aRegs[i].au32[3] = 0;
8115 }
8116
8117 /* FPU IP, CS, DP and DS. */
8118 if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
8119 {
8120 pDst->FPUIP = pSrc->FPUIP;
8121 pDst->CS = pSrc->CS;
8122 pDst->Rsrvd1 = pSrc->Rsrvd1;
8123 pDst->FPUDP = pSrc->FPUDP;
8124 pDst->DS = pSrc->DS;
8125 pDst->Rsrvd2 = pSrc->Rsrvd2;
8126 }
8127 else
8128 {
8129 pDst->FPUIP = pSrc->FPUIP;
8130 pDst->CS = pSrc->CS;
8131 pDst->Rsrvd1 = 0;
8132 pDst->FPUDP = pSrc->FPUDP;
8133 pDst->DS = pSrc->DS;
8134 pDst->Rsrvd2 = 0;
8135 }
8136
8137 /* XMM registers. */
8138 if ( !(pVCpu->cpum.GstCtx.msrEFER & MSR_K6_EFER_FFXSR)
8139 || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
8140 || pVCpu->iem.s.uCpl != 0)
8141 {
8142 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8143 for (uint32_t i = 0; i < cXmmRegs; i++)
8144 pDst->aXMM[i] = pSrc->aXMM[i];
8145 }
8146
8147 /*
8148 * Commit the memory.
8149 */
8150 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8151 if (rcStrict != VINF_SUCCESS)
8152 return rcStrict;
8153
8154 iemHlpUsedFpu(pVCpu);
8155 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8156 return VINF_SUCCESS;
8157}
8158
8159
8160/**
8161 * Implements 'XSAVE'.
8162 *
8163 * @param iEffSeg The effective segment.
8164 * @param GCPtrEff The address of the image.
8165 * @param enmEffOpSize The operand size (only REX.W really matters).
8166 */
8167IEM_CIMPL_DEF_3(iemCImpl_xsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8168{
8169 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8170
8171 /*
8172 * Raise exceptions.
8173 */
8174 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8175 return iemRaiseUndefinedOpcode(pVCpu);
8176 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8177 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8178 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8179 {
8180 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8181 return iemRaiseUndefinedOpcode(pVCpu);
8182 }
8183 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8184 return iemRaiseDeviceNotAvailable(pVCpu);
8185 if (GCPtrEff & 63)
8186 {
8187 /** @todo CPU/VM detection possible! \#AC might not be signal for
8188 * all/any misalignment sizes, intel says its an implementation detail. */
8189 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8190 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8191 && pVCpu->iem.s.uCpl == 3)
8192 return iemRaiseAlignmentCheckException(pVCpu);
8193 return iemRaiseGeneralProtectionFault0(pVCpu);
8194 }
8195
8196 /*
8197 * Calc the requested mask.
8198 */
8199 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8200 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8201 uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8202
8203/** @todo figure out the exact protocol for the memory access. Currently we
8204 * just need this crap to work halfways to make it possible to test
8205 * AVX instructions. */
8206/** @todo figure out the XINUSE and XMODIFIED */
8207
8208 /*
8209 * Access the x87 memory state.
8210 */
8211 /* The x87+SSE state. */
8212 void *pvMem512;
8213 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8214 if (rcStrict != VINF_SUCCESS)
8215 return rcStrict;
8216 PX86FXSTATE pDst = (PX86FXSTATE)pvMem512;
8217 PCX86FXSTATE pSrc = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8218
8219 /* The header. */
8220 PX86XSAVEHDR pHdr;
8221 rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW);
8222 if (rcStrict != VINF_SUCCESS)
8223 return rcStrict;
8224
8225 /*
8226 * Store the X87 state.
8227 */
8228 if (fReqComponents & XSAVE_C_X87)
8229 {
8230 /* common for all formats */
8231 pDst->FCW = pSrc->FCW;
8232 pDst->FSW = pSrc->FSW;
8233 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8234 pDst->FOP = pSrc->FOP;
8235 pDst->FPUIP = pSrc->FPUIP;
8236 pDst->CS = pSrc->CS;
8237 pDst->FPUDP = pSrc->FPUDP;
8238 pDst->DS = pSrc->DS;
8239 if (enmEffOpSize == IEMMODE_64BIT)
8240 {
8241 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8242 pDst->Rsrvd1 = pSrc->Rsrvd1;
8243 pDst->Rsrvd2 = pSrc->Rsrvd2;
8244 pDst->au32RsrvdForSoftware[0] = 0;
8245 }
8246 else
8247 {
8248 pDst->Rsrvd1 = 0;
8249 pDst->Rsrvd2 = 0;
8250 pDst->au32RsrvdForSoftware[0] = X86_FXSTATE_RSVD_32BIT_MAGIC;
8251 }
8252 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8253 {
8254 /** @todo Testcase: What actually happens to the 6 reserved bytes? I'm clearing
8255 * them for now... */
8256 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8257 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8258 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8259 pDst->aRegs[i].au32[3] = 0;
8260 }
8261
8262 }
8263
8264 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8265 {
8266 pDst->MXCSR = pSrc->MXCSR;
8267 pDst->MXCSR_MASK = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8268 }
8269
8270 if (fReqComponents & XSAVE_C_SSE)
8271 {
8272 /* XMM registers. */
8273 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8274 for (uint32_t i = 0; i < cXmmRegs; i++)
8275 pDst->aXMM[i] = pSrc->aXMM[i];
8276 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8277 * right? */
8278 }
8279
8280 /* Commit the x87 state bits. (probably wrong) */
8281 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8282 if (rcStrict != VINF_SUCCESS)
8283 return rcStrict;
8284
8285 /*
8286 * Store AVX state.
8287 */
8288 if (fReqComponents & XSAVE_C_YMM)
8289 {
8290 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8291 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8292 PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
8293 PX86XSAVEYMMHI pCompDst;
8294 rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
8295 IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8296 if (rcStrict != VINF_SUCCESS)
8297 return rcStrict;
8298
8299 uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8300 for (uint32_t i = 0; i < cXmmRegs; i++)
8301 pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
8302
8303 rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8304 if (rcStrict != VINF_SUCCESS)
8305 return rcStrict;
8306 }
8307
8308 /*
8309 * Update the header.
8310 */
8311 pHdr->bmXState = (pHdr->bmXState & ~fReqComponents)
8312 | (fReqComponents & fXInUse);
8313
8314 rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
8315 if (rcStrict != VINF_SUCCESS)
8316 return rcStrict;
8317
8318 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8319 return VINF_SUCCESS;
8320}
8321
8322
8323/**
8324 * Implements 'XRSTOR'.
8325 *
8326 * @param iEffSeg The effective segment.
8327 * @param GCPtrEff The address of the image.
8328 * @param enmEffOpSize The operand size (only REX.W really matters).
8329 */
8330IEM_CIMPL_DEF_3(iemCImpl_xrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
8331{
8332 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_OTHER_XSAVE | CPUMCTX_EXTRN_XCRx);
8333
8334 /*
8335 * Raise exceptions.
8336 */
8337 if (!(pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8338 return iemRaiseUndefinedOpcode(pVCpu);
8339 /* When in VMX non-root mode and XSAVE/XRSTOR is not enabled, it results in #UD. */
8340 if ( IEM_VMX_IS_NON_ROOT_MODE(pVCpu)
8341 && !IEM_VMX_IS_PROCCTLS2_SET(pVCpu, VMX_PROC_CTLS2_XSAVES_XRSTORS))
8342 {
8343 Log(("xrstor: Not enabled for nested-guest execution -> #UD\n"));
8344 return iemRaiseUndefinedOpcode(pVCpu);
8345 }
8346 if (pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS)
8347 return iemRaiseDeviceNotAvailable(pVCpu);
8348 if (GCPtrEff & 63)
8349 {
8350 /** @todo CPU/VM detection possible! \#AC might not be signal for
8351 * all/any misalignment sizes, intel says its an implementation detail. */
8352 if ( (pVCpu->cpum.GstCtx.cr0 & X86_CR0_AM)
8353 && pVCpu->cpum.GstCtx.eflags.Bits.u1AC
8354 && pVCpu->iem.s.uCpl == 3)
8355 return iemRaiseAlignmentCheckException(pVCpu);
8356 return iemRaiseGeneralProtectionFault0(pVCpu);
8357 }
8358
8359/** @todo figure out the exact protocol for the memory access. Currently we
8360 * just need this crap to work halfways to make it possible to test
8361 * AVX instructions. */
8362/** @todo figure out the XINUSE and XMODIFIED */
8363
8364 /*
8365 * Access the x87 memory state.
8366 */
8367 /* The x87+SSE state. */
8368 void *pvMem512;
8369 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
8370 if (rcStrict != VINF_SUCCESS)
8371 return rcStrict;
8372 PCX86FXSTATE pSrc = (PCX86FXSTATE)pvMem512;
8373 PX86FXSTATE pDst = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8374
8375 /*
8376 * Calc the requested mask
8377 */
8378 PX86XSAVEHDR pHdrDst = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->Hdr;
8379 PCX86XSAVEHDR pHdrSrc;
8380 rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_R);
8381 if (rcStrict != VINF_SUCCESS)
8382 return rcStrict;
8383
8384 uint64_t const fReqComponents = RT_MAKE_U64(pVCpu->cpum.GstCtx.eax, pVCpu->cpum.GstCtx.edx) & pVCpu->cpum.GstCtx.aXcr[0];
8385 AssertLogRelReturn(!(fReqComponents & ~(XSAVE_C_X87 | XSAVE_C_SSE | XSAVE_C_YMM)), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8386 //uint64_t const fXInUse = pVCpu->cpum.GstCtx.aXcr[0];
8387 uint64_t const fRstorMask = pHdrSrc->bmXState;
8388 uint64_t const fCompMask = pHdrSrc->bmXComp;
8389
8390 AssertLogRelReturn(!(fCompMask & XSAVE_C_X), VERR_IEM_ASPECT_NOT_IMPLEMENTED);
8391
8392 uint32_t const cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
8393
8394 /* We won't need this any longer. */
8395 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
8396 if (rcStrict != VINF_SUCCESS)
8397 return rcStrict;
8398
8399 /*
8400 * Store the X87 state.
8401 */
8402 if (fReqComponents & XSAVE_C_X87)
8403 {
8404 if (fRstorMask & XSAVE_C_X87)
8405 {
8406 pDst->FCW = pSrc->FCW;
8407 pDst->FSW = pSrc->FSW;
8408 pDst->FTW = pSrc->FTW & UINT16_C(0xff);
8409 pDst->FOP = pSrc->FOP;
8410 pDst->FPUIP = pSrc->FPUIP;
8411 pDst->CS = pSrc->CS;
8412 pDst->FPUDP = pSrc->FPUDP;
8413 pDst->DS = pSrc->DS;
8414 if (enmEffOpSize == IEMMODE_64BIT)
8415 {
8416 /* Save upper 16-bits of FPUIP (IP:CS:Rsvd1) and FPUDP (DP:DS:Rsvd2). */
8417 pDst->Rsrvd1 = pSrc->Rsrvd1;
8418 pDst->Rsrvd2 = pSrc->Rsrvd2;
8419 }
8420 else
8421 {
8422 pDst->Rsrvd1 = 0;
8423 pDst->Rsrvd2 = 0;
8424 }
8425 for (uint32_t i = 0; i < RT_ELEMENTS(pDst->aRegs); i++)
8426 {
8427 pDst->aRegs[i].au32[0] = pSrc->aRegs[i].au32[0];
8428 pDst->aRegs[i].au32[1] = pSrc->aRegs[i].au32[1];
8429 pDst->aRegs[i].au32[2] = pSrc->aRegs[i].au32[2] & UINT32_C(0xffff);
8430 pDst->aRegs[i].au32[3] = 0;
8431 }
8432 }
8433 else
8434 {
8435 pDst->FCW = 0x37f;
8436 pDst->FSW = 0;
8437 pDst->FTW = 0x00; /* 0 - empty. */
8438 pDst->FPUDP = 0;
8439 pDst->DS = 0; //??
8440 pDst->Rsrvd2= 0;
8441 pDst->FPUIP = 0;
8442 pDst->CS = 0; //??
8443 pDst->Rsrvd1= 0;
8444 pDst->FOP = 0;
8445 for (uint32_t i = 0; i < RT_ELEMENTS(pSrc->aRegs); i++)
8446 {
8447 pDst->aRegs[i].au32[0] = 0;
8448 pDst->aRegs[i].au32[1] = 0;
8449 pDst->aRegs[i].au32[2] = 0;
8450 pDst->aRegs[i].au32[3] = 0;
8451 }
8452 }
8453 pHdrDst->bmXState |= XSAVE_C_X87; /* playing safe for now */
8454 }
8455
8456 /* MXCSR */
8457 if (fReqComponents & (XSAVE_C_SSE | XSAVE_C_YMM))
8458 {
8459 if (fRstorMask & (XSAVE_C_SSE | XSAVE_C_YMM))
8460 pDst->MXCSR = pSrc->MXCSR;
8461 else
8462 pDst->MXCSR = 0x1f80;
8463 }
8464
8465 /* XMM registers. */
8466 if (fReqComponents & XSAVE_C_SSE)
8467 {
8468 if (fRstorMask & XSAVE_C_SSE)
8469 {
8470 for (uint32_t i = 0; i < cXmmRegs; i++)
8471 pDst->aXMM[i] = pSrc->aXMM[i];
8472 /** @todo Testcase: What happens to the reserved XMM registers? Untouched,
8473 * right? */
8474 }
8475 else
8476 {
8477 for (uint32_t i = 0; i < cXmmRegs; i++)
8478 {
8479 pDst->aXMM[i].au64[0] = 0;
8480 pDst->aXMM[i].au64[1] = 0;
8481 }
8482 }
8483 pHdrDst->bmXState |= XSAVE_C_SSE; /* playing safe for now */
8484 }
8485
8486 /* Unmap the x87 state bits (so we've don't run out of mapping). */
8487 rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
8488 if (rcStrict != VINF_SUCCESS)
8489 return rcStrict;
8490
8491 /*
8492 * Restore AVX state.
8493 */
8494 if (fReqComponents & XSAVE_C_YMM)
8495 {
8496 AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
8497 PX86XSAVEYMMHI pCompDst = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PX86XSAVEYMMHI);
8498
8499 if (fRstorMask & XSAVE_C_YMM)
8500 {
8501 /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
8502 PCX86XSAVEYMMHI pCompSrc;
8503 rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
8504 iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT], IEM_ACCESS_DATA_R);
8505 if (rcStrict != VINF_SUCCESS)
8506 return rcStrict;
8507
8508 for (uint32_t i = 0; i < cXmmRegs; i++)
8509 {
8510 pCompDst->aYmmHi[i].au64[0] = pCompSrc->aYmmHi[i].au64[0];
8511 pCompDst->aYmmHi[i].au64[1] = pCompSrc->aYmmHi[i].au64[1];
8512 }
8513
8514 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
8515 if (rcStrict != VINF_SUCCESS)
8516 return rcStrict;
8517 }
8518 else
8519 {
8520 for (uint32_t i = 0; i < cXmmRegs; i++)
8521 {
8522 pCompDst->aYmmHi[i].au64[0] = 0;
8523 pCompDst->aYmmHi[i].au64[1] = 0;
8524 }
8525 }
8526 pHdrDst->bmXState |= XSAVE_C_YMM; /* playing safe for now */
8527 }
8528
8529 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8530 return VINF_SUCCESS;
8531}
8532
8533
8534
8535
8536/**
8537 * Implements 'STMXCSR'.
8538 *
8539 * @param GCPtrEff The address of the image.
8540 */
8541IEM_CIMPL_DEF_2(iemCImpl_stmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8542{
8543 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8544
8545 /*
8546 * Raise exceptions.
8547 */
8548 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8549 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8550 {
8551 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8552 {
8553 /*
8554 * Do the job.
8555 */
8556 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87.MXCSR);
8557 if (rcStrict == VINF_SUCCESS)
8558 {
8559 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8560 return VINF_SUCCESS;
8561 }
8562 return rcStrict;
8563 }
8564 return iemRaiseDeviceNotAvailable(pVCpu);
8565 }
8566 return iemRaiseUndefinedOpcode(pVCpu);
8567}
8568
8569
8570/**
8571 * Implements 'VSTMXCSR'.
8572 *
8573 * @param GCPtrEff The address of the image.
8574 */
8575IEM_CIMPL_DEF_2(iemCImpl_vstmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8576{
8577 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX | CPUMCTX_EXTRN_XCRx);
8578
8579 /*
8580 * Raise exceptions.
8581 */
8582 if ( ( !IEM_IS_GUEST_CPU_AMD(pVCpu)
8583 ? (pVCpu->cpum.GstCtx.aXcr[0] & (XSAVE_C_SSE | XSAVE_C_YMM)) == (XSAVE_C_SSE | XSAVE_C_YMM)
8584 : !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)) /* AMD Jaguar CPU (f0x16,m0,s1) behaviour */
8585 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSXSAVE))
8586 {
8587 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8588 {
8589 /*
8590 * Do the job.
8591 */
8592 VBOXSTRICTRC rcStrict = iemMemStoreDataU32(pVCpu, iEffSeg, GCPtrEff, pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87.MXCSR);
8593 if (rcStrict == VINF_SUCCESS)
8594 {
8595 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8596 return VINF_SUCCESS;
8597 }
8598 return rcStrict;
8599 }
8600 return iemRaiseDeviceNotAvailable(pVCpu);
8601 }
8602 return iemRaiseUndefinedOpcode(pVCpu);
8603}
8604
8605
8606/**
8607 * Implements 'LDMXCSR'.
8608 *
8609 * @param GCPtrEff The address of the image.
8610 */
8611IEM_CIMPL_DEF_2(iemCImpl_ldmxcsr, uint8_t, iEffSeg, RTGCPTR, GCPtrEff)
8612{
8613 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87 | CPUMCTX_EXTRN_SSE_AVX);
8614
8615 /*
8616 * Raise exceptions.
8617 */
8618 /** @todo testcase - order of LDMXCSR faults. Does \#PF, \#GP and \#SS
8619 * happen after or before \#UD and \#EM? */
8620 if ( !(pVCpu->cpum.GstCtx.cr0 & X86_CR0_EM)
8621 && (pVCpu->cpum.GstCtx.cr4 & X86_CR4_OSFXSR))
8622 {
8623 if (!(pVCpu->cpum.GstCtx.cr0 & X86_CR0_TS))
8624 {
8625 /*
8626 * Do the job.
8627 */
8628 uint32_t fNewMxCsr;
8629 VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, &fNewMxCsr, iEffSeg, GCPtrEff);
8630 if (rcStrict == VINF_SUCCESS)
8631 {
8632 uint32_t const fMxCsrMask = CPUMGetGuestMxCsrMask(pVCpu->CTX_SUFF(pVM));
8633 if (!(fNewMxCsr & ~fMxCsrMask))
8634 {
8635 pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87.MXCSR = fNewMxCsr;
8636 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8637 return VINF_SUCCESS;
8638 }
8639 Log(("lddmxcsr: New MXCSR=%#RX32 & ~MASK=%#RX32 = %#RX32 -> #GP(0)\n",
8640 fNewMxCsr, fMxCsrMask, fNewMxCsr & ~fMxCsrMask));
8641 return iemRaiseGeneralProtectionFault0(pVCpu);
8642 }
8643 return rcStrict;
8644 }
8645 return iemRaiseDeviceNotAvailable(pVCpu);
8646 }
8647 return iemRaiseUndefinedOpcode(pVCpu);
8648}
8649
8650
8651/**
8652 * Commmon routine for fnstenv and fnsave.
8653 *
8654 * @param pVCpu The cross context virtual CPU structure of the calling thread.
8655 * @param enmEffOpSize The effective operand size.
8656 * @param uPtr Where to store the state.
8657 */
8658static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr)
8659{
8660 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8661 PCX86FXSTATE pSrcX87 = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8662 if (enmEffOpSize == IEMMODE_16BIT)
8663 {
8664 uPtr.pu16[0] = pSrcX87->FCW;
8665 uPtr.pu16[1] = pSrcX87->FSW;
8666 uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
8667 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8668 {
8669 /** @todo Testcase: How does this work when the FPUIP/CS was saved in
8670 * protected mode or long mode and we save it in real mode? And vice
8671 * versa? And with 32-bit operand size? I think CPU is storing the
8672 * effective address ((CS << 4) + IP) in the offset register and not
8673 * doing any address calculations here. */
8674 uPtr.pu16[3] = (uint16_t)pSrcX87->FPUIP;
8675 uPtr.pu16[4] = ((pSrcX87->FPUIP >> 4) & UINT16_C(0xf000)) | pSrcX87->FOP;
8676 uPtr.pu16[5] = (uint16_t)pSrcX87->FPUDP;
8677 uPtr.pu16[6] = (pSrcX87->FPUDP >> 4) & UINT16_C(0xf000);
8678 }
8679 else
8680 {
8681 uPtr.pu16[3] = pSrcX87->FPUIP;
8682 uPtr.pu16[4] = pSrcX87->CS;
8683 uPtr.pu16[5] = pSrcX87->FPUDP;
8684 uPtr.pu16[6] = pSrcX87->DS;
8685 }
8686 }
8687 else
8688 {
8689 /** @todo Testcase: what is stored in the "gray" areas? (figure 8-9 and 8-10) */
8690 uPtr.pu16[0*2] = pSrcX87->FCW;
8691 uPtr.pu16[0*2+1] = 0xffff; /* (0xffff observed on intel skylake.) */
8692 uPtr.pu16[1*2] = pSrcX87->FSW;
8693 uPtr.pu16[1*2+1] = 0xffff;
8694 uPtr.pu16[2*2] = iemFpuCalcFullFtw(pSrcX87);
8695 uPtr.pu16[2*2+1] = 0xffff;
8696 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8697 {
8698 uPtr.pu16[3*2] = (uint16_t)pSrcX87->FPUIP;
8699 uPtr.pu32[4] = ((pSrcX87->FPUIP & UINT32_C(0xffff0000)) >> 4) | pSrcX87->FOP;
8700 uPtr.pu16[5*2] = (uint16_t)pSrcX87->FPUDP;
8701 uPtr.pu32[6] = (pSrcX87->FPUDP & UINT32_C(0xffff0000)) >> 4;
8702 }
8703 else
8704 {
8705 uPtr.pu32[3] = pSrcX87->FPUIP;
8706 uPtr.pu16[4*2] = pSrcX87->CS;
8707 uPtr.pu16[4*2+1] = pSrcX87->FOP;
8708 uPtr.pu32[5] = pSrcX87->FPUDP;
8709 uPtr.pu16[6*2] = pSrcX87->DS;
8710 uPtr.pu16[6*2+1] = 0xffff;
8711 }
8712 }
8713}
8714
8715
8716/**
8717 * Commmon routine for fldenv and frstor
8718 *
8719 * @param pVCpu The cross context virtual CPU structure of the calling thread.
8720 * @param enmEffOpSize The effective operand size.
8721 * @param uPtr Where to store the state.
8722 */
8723static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr)
8724{
8725 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8726 PX86FXSTATE pDstX87 = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8727 if (enmEffOpSize == IEMMODE_16BIT)
8728 {
8729 pDstX87->FCW = uPtr.pu16[0];
8730 pDstX87->FSW = uPtr.pu16[1];
8731 pDstX87->FTW = uPtr.pu16[2];
8732 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8733 {
8734 pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
8735 pDstX87->FPUDP = uPtr.pu16[5] | ((uint32_t)(uPtr.pu16[6] & UINT16_C(0xf000)) << 4);
8736 pDstX87->FOP = uPtr.pu16[4] & UINT16_C(0x07ff);
8737 pDstX87->CS = 0;
8738 pDstX87->Rsrvd1= 0;
8739 pDstX87->DS = 0;
8740 pDstX87->Rsrvd2= 0;
8741 }
8742 else
8743 {
8744 pDstX87->FPUIP = uPtr.pu16[3];
8745 pDstX87->CS = uPtr.pu16[4];
8746 pDstX87->Rsrvd1= 0;
8747 pDstX87->FPUDP = uPtr.pu16[5];
8748 pDstX87->DS = uPtr.pu16[6];
8749 pDstX87->Rsrvd2= 0;
8750 /** @todo Testcase: Is FOP cleared when doing 16-bit protected mode fldenv? */
8751 }
8752 }
8753 else
8754 {
8755 pDstX87->FCW = uPtr.pu16[0*2];
8756 pDstX87->FSW = uPtr.pu16[1*2];
8757 pDstX87->FTW = uPtr.pu16[2*2];
8758 if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
8759 {
8760 pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
8761 pDstX87->FOP = uPtr.pu32[4] & UINT16_C(0x07ff);
8762 pDstX87->FPUDP = uPtr.pu16[5*2] | ((uPtr.pu32[6] & UINT32_C(0x0ffff000)) << 4);
8763 pDstX87->CS = 0;
8764 pDstX87->Rsrvd1= 0;
8765 pDstX87->DS = 0;
8766 pDstX87->Rsrvd2= 0;
8767 }
8768 else
8769 {
8770 pDstX87->FPUIP = uPtr.pu32[3];
8771 pDstX87->CS = uPtr.pu16[4*2];
8772 pDstX87->Rsrvd1= 0;
8773 pDstX87->FOP = uPtr.pu16[4*2+1];
8774 pDstX87->FPUDP = uPtr.pu32[5];
8775 pDstX87->DS = uPtr.pu16[6*2];
8776 pDstX87->Rsrvd2= 0;
8777 }
8778 }
8779
8780 /* Make adjustments. */
8781 pDstX87->FTW = iemFpuCompressFtw(pDstX87->FTW);
8782 pDstX87->FCW &= ~X86_FCW_ZERO_MASK;
8783 iemFpuRecalcExceptionStatus(pDstX87);
8784 /** @todo Testcase: Check if ES and/or B are automatically cleared if no
8785 * exceptions are pending after loading the saved state? */
8786}
8787
8788
8789/**
8790 * Implements 'FNSTENV'.
8791 *
8792 * @param enmEffOpSize The operand size (only REX.W really matters).
8793 * @param iEffSeg The effective segment register for @a GCPtrEff.
8794 * @param GCPtrEffDst The address of the image.
8795 */
8796IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8797{
8798 RTPTRUNION uPtr;
8799 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8800 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8801 if (rcStrict != VINF_SUCCESS)
8802 return rcStrict;
8803
8804 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
8805
8806 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8807 if (rcStrict != VINF_SUCCESS)
8808 return rcStrict;
8809
8810 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8811 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8812 return VINF_SUCCESS;
8813}
8814
8815
8816/**
8817 * Implements 'FNSAVE'.
8818 *
8819 * @param GCPtrEffDst The address of the image.
8820 * @param enmEffOpSize The operand size.
8821 */
8822IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
8823{
8824 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8825
8826 RTPTRUNION uPtr;
8827 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8828 iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8829 if (rcStrict != VINF_SUCCESS)
8830 return rcStrict;
8831
8832 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8833 iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
8834 PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8835 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8836 {
8837 paRegs[i].au32[0] = pFpuCtx->aRegs[i].au32[0];
8838 paRegs[i].au32[1] = pFpuCtx->aRegs[i].au32[1];
8839 paRegs[i].au16[4] = pFpuCtx->aRegs[i].au16[4];
8840 }
8841
8842 rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
8843 if (rcStrict != VINF_SUCCESS)
8844 return rcStrict;
8845
8846 /*
8847 * Re-initialize the FPU context.
8848 */
8849 pFpuCtx->FCW = 0x37f;
8850 pFpuCtx->FSW = 0;
8851 pFpuCtx->FTW = 0x00; /* 0 - empty */
8852 pFpuCtx->FPUDP = 0;
8853 pFpuCtx->DS = 0;
8854 pFpuCtx->Rsrvd2= 0;
8855 pFpuCtx->FPUIP = 0;
8856 pFpuCtx->CS = 0;
8857 pFpuCtx->Rsrvd1= 0;
8858 pFpuCtx->FOP = 0;
8859
8860 iemHlpUsedFpu(pVCpu);
8861 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8862 return VINF_SUCCESS;
8863}
8864
8865
8866
8867/**
8868 * Implements 'FLDENV'.
8869 *
8870 * @param enmEffOpSize The operand size (only REX.W really matters).
8871 * @param iEffSeg The effective segment register for @a GCPtrEff.
8872 * @param GCPtrEffSrc The address of the image.
8873 */
8874IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8875{
8876 RTCPTRUNION uPtr;
8877 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
8878 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8879 if (rcStrict != VINF_SUCCESS)
8880 return rcStrict;
8881
8882 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
8883
8884 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8885 if (rcStrict != VINF_SUCCESS)
8886 return rcStrict;
8887
8888 iemHlpUsedFpu(pVCpu);
8889 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8890 return VINF_SUCCESS;
8891}
8892
8893
8894/**
8895 * Implements 'FRSTOR'.
8896 *
8897 * @param GCPtrEffSrc The address of the image.
8898 * @param enmEffOpSize The operand size.
8899 */
8900IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
8901{
8902 RTCPTRUNION uPtr;
8903 VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
8904 iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
8905 if (rcStrict != VINF_SUCCESS)
8906 return rcStrict;
8907
8908 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8909 iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
8910 PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
8911 for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
8912 {
8913 pFpuCtx->aRegs[i].au32[0] = paRegs[i].au32[0];
8914 pFpuCtx->aRegs[i].au32[1] = paRegs[i].au32[1];
8915 pFpuCtx->aRegs[i].au32[2] = paRegs[i].au16[4];
8916 pFpuCtx->aRegs[i].au32[3] = 0;
8917 }
8918
8919 rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
8920 if (rcStrict != VINF_SUCCESS)
8921 return rcStrict;
8922
8923 iemHlpUsedFpu(pVCpu);
8924 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8925 return VINF_SUCCESS;
8926}
8927
8928
8929/**
8930 * Implements 'FLDCW'.
8931 *
8932 * @param u16Fcw The new FCW.
8933 */
8934IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
8935{
8936 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8937
8938 /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
8939 /** @todo Testcase: Try see what happens when trying to set undefined bits
8940 * (other than 6 and 7). Currently ignoring them. */
8941 /** @todo Testcase: Test that it raises and loweres the FPU exception bits
8942 * according to FSW. (This is was is currently implemented.) */
8943 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8944 pFpuCtx->FCW = u16Fcw & ~X86_FCW_ZERO_MASK;
8945 iemFpuRecalcExceptionStatus(pFpuCtx);
8946
8947 /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
8948 iemHlpUsedFpu(pVCpu);
8949 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
8950 return VINF_SUCCESS;
8951}
8952
8953
8954
8955/**
8956 * Implements the underflow case of fxch.
8957 *
8958 * @param iStReg The other stack register.
8959 */
8960IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
8961{
8962 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
8963
8964 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
8965 unsigned const iReg1 = X86_FSW_TOP_GET(pFpuCtx->FSW);
8966 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
8967 Assert(!(RT_BIT(iReg1) & pFpuCtx->FTW) || !(RT_BIT(iReg2) & pFpuCtx->FTW));
8968
8969 /** @todo Testcase: fxch underflow. Making assumptions that underflowed
8970 * registers are read as QNaN and then exchanged. This could be
8971 * wrong... */
8972 if (pFpuCtx->FCW & X86_FCW_IM)
8973 {
8974 if (RT_BIT(iReg1) & pFpuCtx->FTW)
8975 {
8976 if (RT_BIT(iReg2) & pFpuCtx->FTW)
8977 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8978 else
8979 pFpuCtx->aRegs[0].r80 = pFpuCtx->aRegs[iStReg].r80;
8980 iemFpuStoreQNan(&pFpuCtx->aRegs[iStReg].r80);
8981 }
8982 else
8983 {
8984 pFpuCtx->aRegs[iStReg].r80 = pFpuCtx->aRegs[0].r80;
8985 iemFpuStoreQNan(&pFpuCtx->aRegs[0].r80);
8986 }
8987 pFpuCtx->FSW &= ~X86_FSW_C_MASK;
8988 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF;
8989 }
8990 else
8991 {
8992 /* raise underflow exception, don't change anything. */
8993 pFpuCtx->FSW &= ~(X86_FSW_TOP_MASK | X86_FSW_XCPT_MASK);
8994 pFpuCtx->FSW |= X86_FSW_C1 | X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
8995 }
8996
8997 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
8998 iemHlpUsedFpu(pVCpu);
8999 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9000 return VINF_SUCCESS;
9001}
9002
9003
9004/**
9005 * Implements 'FCOMI', 'FCOMIP', 'FUCOMI', and 'FUCOMIP'.
9006 *
9007 * @param cToAdd 1 or 7.
9008 */
9009IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
9010{
9011 Assert(iStReg < 8);
9012 IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
9013
9014 /*
9015 * Raise exceptions.
9016 */
9017 if (pVCpu->cpum.GstCtx.cr0 & (X86_CR0_EM | X86_CR0_TS))
9018 return iemRaiseDeviceNotAvailable(pVCpu);
9019
9020 PX86FXSTATE pFpuCtx = &pVCpu->cpum.GstCtx.CTX_SUFF(pXState)->x87;
9021 uint16_t u16Fsw = pFpuCtx->FSW;
9022 if (u16Fsw & X86_FSW_ES)
9023 return iemRaiseMathFault(pVCpu);
9024
9025 /*
9026 * Check if any of the register accesses causes #SF + #IA.
9027 */
9028 unsigned const iReg1 = X86_FSW_TOP_GET(u16Fsw);
9029 unsigned const iReg2 = (iReg1 + iStReg) & X86_FSW_TOP_SMASK;
9030 if ((pFpuCtx->FTW & (RT_BIT(iReg1) | RT_BIT(iReg2))) == (RT_BIT(iReg1) | RT_BIT(iReg2)))
9031 {
9032 uint32_t u32Eflags = pfnAImpl(pFpuCtx, &u16Fsw, &pFpuCtx->aRegs[0].r80, &pFpuCtx->aRegs[iStReg].r80);
9033 NOREF(u32Eflags);
9034
9035 pFpuCtx->FSW &= ~X86_FSW_C1;
9036 pFpuCtx->FSW |= u16Fsw & ~X86_FSW_TOP_MASK;
9037 if ( !(u16Fsw & X86_FSW_IE)
9038 || (pFpuCtx->FCW & X86_FCW_IM) )
9039 {
9040 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9041 pVCpu->cpum.GstCtx.eflags.u |= pVCpu->cpum.GstCtx.eflags.u & (X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9042 }
9043 }
9044 else if (pFpuCtx->FCW & X86_FCW_IM)
9045 {
9046 /* Masked underflow. */
9047 pFpuCtx->FSW &= ~X86_FSW_C1;
9048 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF;
9049 pVCpu->cpum.GstCtx.eflags.u &= ~(X86_EFL_OF | X86_EFL_SF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF);
9050 pVCpu->cpum.GstCtx.eflags.u |= X86_EFL_ZF | X86_EFL_PF | X86_EFL_CF;
9051 }
9052 else
9053 {
9054 /* Raise underflow - don't touch EFLAGS or TOP. */
9055 pFpuCtx->FSW &= ~X86_FSW_C1;
9056 pFpuCtx->FSW |= X86_FSW_IE | X86_FSW_SF | X86_FSW_ES | X86_FSW_B;
9057 fPop = false;
9058 }
9059
9060 /*
9061 * Pop if necessary.
9062 */
9063 if (fPop)
9064 {
9065 pFpuCtx->FTW &= ~RT_BIT(iReg1);
9066 pFpuCtx->FSW &= X86_FSW_TOP_MASK;
9067 pFpuCtx->FSW |= ((iReg1 + 7) & X86_FSW_TOP_SMASK) << X86_FSW_TOP_SHIFT;
9068 }
9069
9070 iemFpuUpdateOpcodeAndIpWorker(pVCpu, pFpuCtx);
9071 iemHlpUsedFpu(pVCpu);
9072 iemRegAddToRipAndClearRF(pVCpu, cbInstr);
9073 return VINF_SUCCESS;
9074}
9075
9076/** @} */
9077
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette